mindoodb 0.0.50 → 0.0.53

package/dist/core/userkeys/UserKeyManager.js

@@ -0,0 +1,1277 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserKeyManager = void 0;
+const grantKeys_1 = require("../accesscontrol/grantKeys");
+const privateKeyEncryption_1 = require("../crypto/privateKeyEncryption");
+const RSAEncryption_1 = require("../crypto/RSAEncryption");
+const rsaOaep3072_1 = require("../crypto/rsaOaep3072");
+const types_1 = require("../types");
+const fingerprint_1 = require("./fingerprint");
+const resolveUserKeyDocument_1 = require("./resolveUserKeyDocument");
+const validateUserKeyDocument_1 = require("./validateUserKeyDocument");
+const UserKeyDocument_1 = require("./UserKeyDocument");
+const types_2 = require("./types");
+class UserKeyManager {
+    constructor(tenant) {
+        this.tenant = tenant;
+        this.userDirectoryFetched = false;
+        this.lastUserDirectoryFetchError = null;
+        this.decryptedUserKeyCache = null;
+        this.decryptedUserKeyBytes = null;
+        this.seededBytesMatchLocalPublic = null;
+        this.seededBytesVerifiedForPublicKey = null;
+        this.resolvingOwnDeviceWrap = false;
+        this.reconcileInFlight = null;
+    }
+    noteUserDirectoryFetched() {
+        this.userDirectoryFetched = true;
+        this.lastUserDirectoryFetchError = null;
+    }
+    noteUserDirectoryFetchFailed(error) {
+        this.lastUserDirectoryFetchError = error;
+    }
+    /**
+     * Inject User-Key PKCS8 bytes already decrypted by the host (Haven unlock).
+     * Used when `currentUserPassword` is empty so mint/wrap does not generate a
+     * second pair.
+     */
+    seedDecryptedUserKeyBytes(bytes) {
+        this.decryptedUserKeyBytes = bytes.slice();
+        this.decryptedUserKeyCache = null;
+        this.seededBytesMatchLocalPublic = null;
+        this.seededBytesVerifiedForPublicKey = null;
+    }
+    /**
+     * RSA round-trip against `publicKeyPem`: seal a probe with the public key and
+     * open it with the seeded private bytes. Cheaper than deriving the public key
+     * from PKCS8 and works on every crypto adapter.
+     */
+    async seededBytesBelongToLocalPublicKey(publicKeyPem) {
+        if (this.seededBytesMatchLocalPublic !== null &&
+            this.seededBytesVerifiedForPublicKey === publicKeyPem) {
+            return this.seededBytesMatchLocalPublic;
+        }
+        const bytes = this.decryptedUserKeyBytes;
+        if (!bytes)
+            return false;
+        let matches = false;
+        try {
+            const crypto = this.tenant.getCryptoAdapter();
+            const rsa = new RSAEncryption_1.RSAEncryption(crypto);
+            const probe = crypto.getRandomValues(new Uint8Array(16));
+            const sealed = await rsa.encrypt(probe, publicKeyPem);
+            const privateKey = await (0, rsaOaep3072_1.importRsaOaepPrivateKey)(crypto, bytes.slice(), false);
+            const opened = await rsa.decrypt(sealed, privateKey);
+            matches = opened.length === probe.length && opened.every((b, i) => b === probe[i]);
+        }
+        catch (error) {
+            console.warn("[userkeys] User-Key round-trip check failed", error);
+            matches = false;
+        }
+        const fingerprint = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(publicKeyPem, this.tenant.getCryptoAdapter().getSubtle()).catch(() => "?");
+        console.log(matches
+            ? "[userkeys] seeded User-Key private bytes match the local public key"
+            : "[userkeys] seeded User-Key private bytes do NOT match the local public key", { publicKeyFingerprint: fingerprint });
+        this.seededBytesMatchLocalPublic = matches;
+        this.seededBytesVerifiedForPublicKey = publicKeyPem;
+        return matches;
+    }
+    hasFetchedUserDirectory() {
+        return this.userDirectoryFetched;
+    }
+    async ensureLocalUserKeyPair(user, password) {
+        if (user.userKeyPair) {
+            // Host-seeded bytes come first: Haven opens with an empty password, so
+            // trying PBKDF2 would only log a decrypt failure per call. They must
+            // belong to `userKeyPair.publicKey` — a foreign pair would publish a
+            // document whose wraps nobody, not even this device, can open.
+            if (this.decryptedUserKeyBytes &&
+                (await this.seededBytesBelongToLocalPublicKey(user.userKeyPair.publicKey))) {
+                return user.userKeyPair;
+            }
+            const usable = password
+                ? await this.decryptUserKeyPairBytes(user.userKeyPair, password)
+                : null;
+            if (usable) {
+                this.decryptedUserKeyBytes = usable;
+                this.seededBytesMatchLocalPublic = true;
+                this.seededBytesVerifiedForPublicKey = user.userKeyPair.publicKey;
+                return user.userKeyPair;
+            }
+            // Joined device: the key lives as a wrap to this device's key, and the
+            // host may have seeded different bytes for the same identity.
+            const fromWrap = await this.ownDeviceWrapPrivateKeyBytes(user.userKeyPair.publicKey);
+            if (fromWrap) {
+                this.decryptedUserKeyBytes = fromWrap;
+                this.decryptedUserKeyCache = null;
+                this.seededBytesMatchLocalPublic = true;
+                this.seededBytesVerifiedForPublicKey = user.userKeyPair.publicKey;
+                return user.userKeyPair;
+            }
+            if (this.decryptedUserKeyBytes) {
+                console.error("[userkeys] seeded User-Key private bytes do not match the identity's User-Key public key");
+            }
+            throw new types_2.UserKeyDecryptError();
+        }
+        const crypto = this.tenant.getCryptoAdapter();
+        const generated = await (0, rsaOaep3072_1.generateRsaOaep3072)(crypto);
+        const encrypted = await (0, privateKeyEncryption_1.encryptPrivateKey)(crypto, generated.privateKeyBytes, password, types_2.USERKEY_PRIVATE_SALT);
+        const pair = {
+            publicKey: generated.publicKeyPem,
+            privateKey: encrypted,
+        };
+        user.userKeyPair = pair;
+        this.decryptedUserKeyBytes = generated.privateKeyBytes;
+        this.decryptedUserKeyCache = null;
+        this.seededBytesMatchLocalPublic = true;
+        this.seededBytesVerifiedForPublicKey = pair.publicKey;
+        return pair;
+    }
+    async getLocalUserPublicKey() {
+        const user = this.tenant.getCurrentPrivateUser();
+        if (user.userKeyPair?.publicKey)
+            return user.userKeyPair.publicKey;
+        return null;
+    }
+    async decryptUserKeyPairBytes(pair, password) {
+        try {
+            return new Uint8Array(await this.tenant.decryptPrivateKey(pair.privateKey, password, types_2.USERKEY_PRIVATE_SALT));
+        }
+        catch {
+            return null;
+        }
+    }
+    async getDecryptedUserKeyBytes() {
+        const user = this.tenant.getCurrentPrivateUser();
+        const pair = user.userKeyPair;
+        if (this.decryptedUserKeyBytes) {
+            if (!pair)
+                return this.decryptedUserKeyBytes;
+            // Host-seeded bytes are only usable if they open the published pair;
+            // wrapping with a foreign key produces wraps nobody can unwrap. On a
+            // mismatch fall through to the password path rather than giving up.
+            if (await this.seededBytesBelongToLocalPublicKey(pair.publicKey)) {
+                return this.decryptedUserKeyBytes;
+            }
+        }
+        if (!pair)
+            return null;
+        const password = this.tenant.getCurrentUserPassword();
+        // Haven live-bag opens with "". PBKDF2 then fails loudly, so skip it and
+        // let the device wrap supply the key.
+        const bytes = password ? await this.decryptUserKeyPairBytes(pair, password) : null;
+        if (bytes) {
+            this.decryptedUserKeyBytes = bytes;
+            this.seededBytesMatchLocalPublic = true;
+            this.seededBytesVerifiedForPublicKey = pair.publicKey;
+            return bytes;
+        }
+        // A joined device holds the User-Key only as a wrap to its device key, and
+        // the host may have seeded this identity's own (different) bytes over it.
+        // Recover from the wrap so wrapping/reconcile is not lost for the session.
+        const fromWrap = await this.ownDeviceWrapPrivateKeyBytes(pair.publicKey);
+        if (!fromWrap)
+            return null;
+        this.decryptedUserKeyBytes = fromWrap;
+        this.decryptedUserKeyCache = null;
+        this.seededBytesMatchLocalPublic = true;
+        this.seededBytesVerifiedForPublicKey = pair.publicKey;
+        return fromWrap;
+    }
+    /**
+     * The User-Key private bytes taken from THIS device's wrap in the own
+     * User-Key document, verified against `publicKeyPem`. Returns null when no
+     * wrap for this device exists or it does not open the pair. Kept free of
+     * {@link getDecryptedUserKeyBytes} so the two cannot recurse.
+     */
+    async ownDeviceWrapPrivateKeyBytes(publicKeyPem) {
+        if (this.resolvingOwnDeviceWrap)
+            return null;
+        this.resolvingOwnDeviceWrap = true;
+        try {
+            const deviceKey = await this.tenant.getEncryptionPrivateKeyForReconcile();
+            if (!deviceKey)
+                return null;
+            const resolved = await this.resolveOwnUserKeyDocument();
+            if (!resolved)
+                return null;
+            const user = this.tenant.getCurrentPrivateUser();
+            const deviceFp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(user.userEncryptionKeyPair.publicKey, this.tenant.getCryptoAdapter().getSubtle());
+            for (const epoch of this.epochsNewestFirst(resolved.payload)) {
+                const gen = resolved.payload.userKeys[epoch];
+                if (gen?.publicKey !== publicKeyPem)
+                    continue;
+                const wrappedKeyB64 = gen.deviceWraps?.[deviceFp]?.wrappedKey;
+                if (!wrappedKeyB64)
+                    continue;
+                try {
+                    const bytes = await (0, UserKeyDocument_1.unwrapPrivateKeyFromDevice)({
+                        cryptoAdapter: this.tenant.getCryptoAdapter(),
+                        wrappedKeyB64,
+                        deviceEncryptionPrivateKey: deviceKey,
+                    });
+                    console.log("[userkeys] recovered User-Key private bytes from own device wrap", {
+                        epoch,
+                        ownDeviceFingerprint: deviceFp,
+                    });
+                    return bytes;
+                }
+                catch (error) {
+                    console.warn("[userkeys] own device wrap unwrap failed", { epoch }, error);
+                }
+            }
+            return null;
+        }
+        finally {
+            this.resolvingOwnDeviceWrap = false;
+        }
+    }
+    async getDecryptedUserKey() {
+        if (this.decryptedUserKeyCache)
+            return this.decryptedUserKeyCache;
+        const bytes = await this.getDecryptedUserKeyBytes();
+        if (!bytes)
+            return null;
+        const key = await (0, rsaOaep3072_1.importRsaOaepPrivateKey)(this.tenant.getCryptoAdapter(), bytes, false);
+        this.decryptedUserKeyCache = key;
+        return key;
+    }
+    /**
+     * All epochs this device can open, newest first. Used by key-distribution
+     * reconcile so wraps addressed to a retired fingerprint still import.
+     */
+    async getUserKeyCryptoKeysForReconcile() {
+        const keys = [];
+        const seen = new Set();
+        let usedPublishedDocument = false;
+        // Prefer the published User-Key (possibly a different pair than this
+        // device generated). Opening userdirectory during directory bring-up
+        // races a second Automerge WASM heap — only do it when that DB is
+        // already fetched or already open on this tenant instance.
+        const canUseUserDirectory = this.canReconcileAgainstUserDirectory();
+        let resolvedDocId;
+        if (canUseUserDirectory) {
+            try {
+                const resolved = await this.resolveOwnUserKeyDocument();
+                if (resolved) {
+                    usedPublishedDocument = true;
+                    resolvedDocId = resolved.doc.getId();
+                    for (const epoch of this.epochsNewestFirst(resolved.payload)) {
+                        const bytes = await this.privateKeyBytesForEpoch(resolved.payload, epoch);
+                        if (!bytes)
+                            continue;
+                        const fingerprint = resolved.payload.userKeys[epoch]?.fingerprint;
+                        if (!fingerprint || seen.has(fingerprint))
+                            continue;
+                        seen.add(fingerprint);
+                        keys.push(await (0, rsaOaep3072_1.importRsaOaepPrivateKey)(this.tenant.getCryptoAdapter(), bytes.slice(), false));
+                    }
+                }
+            }
+            catch (error) {
+                console.warn("[userkeys] getUserKeyCryptoKeysForReconcile: published lookup failed", error);
+            }
+        }
+        if (keys.length === 0) {
+            const current = await this.getDecryptedUserKey();
+            if (current)
+                keys.push(current);
+        }
+        console.log("[userkeys] getUserKeyCryptoKeysForReconcile", {
+            canUseUserDirectory,
+            usedPublishedDocument,
+            resolvedDocId,
+            userKeyFingerprints: [...seen],
+            keyCount: keys.length,
+        });
+        return keys;
+    }
+    async openUserDirectory() {
+        return this.tenant.openDB(types_1.USER_DIRECTORY_DB_ID);
+    }
+    async resolveOwnUserKeyDocument() {
+        const db = await this.openUserDirectory();
+        const directory = await this.directory();
+        const username = (await this.tenant.getCurrentUserId()).username;
+        const hashes = await directory.getUsernameHashCandidates(username);
+        const grants = await directory.findGrantAccessDocuments(username);
+        return (0, resolveUserKeyDocument_1.resolveUserKeyDocument)({
+            db,
+            directory,
+            username,
+            usernameHashCandidates: hashes,
+            grantDocIds: grants.map((g) => g.getId()),
+            adminPublicKey: this.tenant.getAdministrationPublicKey(),
+        });
+    }
+    /**
+     * Admin path: create a pending userkey document from a join-request public key.
+     */
+    async createPendingFromJoin(input) {
+        const binding = await this.mintBindingForUsername(input.username);
+        if (!binding) {
+            throw new Error(`Cannot create user key: no grant for "${input.username}"`);
+        }
+        const { grantDocId, usernameHash, usernameHashVersion } = binding;
+        const fingerprint = await (0, UserKeyDocument_1.fingerprintUserPublicKey)(input.userPublicKey, this.tenant.getCryptoAdapter());
+        const db = await this.openUserDirectory();
+        try {
+            const existing = await db.getDocument((0, types_2.userKeyDocumentId)(grantDocId));
+            if (existing && !existing.isDeleted())
+                return existing;
+        }
+        catch {
+            // missing
+        }
+        return (0, UserKeyDocument_1.createPendingUserKeyDocument)({
+            db,
+            grantDocId,
+            usernameHash,
+            usernameHashVersion,
+            publicKey: input.userPublicKey,
+            fingerprint,
+            signingKeyPair: {
+                publicKey: input.signingKeyPair.publicKey,
+                privateKey: input.signingKeyPair.privateKey,
+            },
+            signingKeyPassword: input.signingKeyPassword,
+        });
+    }
+    /**
+     * Self-create for legacy users who never sent a User-Key in a join request.
+     * Refuses unless userdirectory has been fetched this session (Trap 1).
+     * On mint, wraps the new private key to every active grant device so already
+     * enrolled devices can import without an approval dialog. Devices added to
+     * the grant afterwards still require explicit approval.
+     */
+    async ensureOwnUserKeyDocument(options) {
+        const existing = await this.resolveOwnUserKeyDocument();
+        if (existing)
+            return existing;
+        const allow = options?.allowSelfCreate === true || this.userDirectoryFetched;
+        if (!allow)
+            return null;
+        // Additional device: `acl_keydistribution_default` is already wrapped to
+        // the published User-Key. Minting a second pair (this device's locally
+        // generated key) desyncs dist — Device 2 would publish a key that cannot
+        // unwrap `default`. Wait for the userkey document and import from wrap.
+        if (await this.defaultAlreadyWrappedForCurrentUser()) {
+            return null;
+        }
+        const user = this.tenant.getCurrentPrivateUser();
+        let pair;
+        try {
+            pair = await this.ensureLocalUserKeyPair(user, this.tenant.getCurrentUserPassword());
+        }
+        catch (error) {
+            if (error instanceof types_2.UserKeyDecryptError)
+                return null;
+            throw error;
+        }
+        const userId = await this.tenant.getCurrentUserId();
+        const binding = await this.mintBindingForUsername(userId.username, userId.userSigningPublicKey);
+        if (!binding)
+            return null;
+        const { grantDocId, usernameHash, usernameHashVersion } = binding;
+        const fingerprint = await (0, UserKeyDocument_1.fingerprintUserPublicKey)(pair.publicKey, this.tenant.getCryptoAdapter());
+        const db = await this.openUserDirectory();
+        let doc;
+        let mintedHere = false;
+        try {
+            const occupied = await db.getDocument((0, types_2.userKeyDocumentId)(grantDocId));
+            if (occupied && !occupied.isDeleted() && (0, validateUserKeyDocument_1.asUserKeyPayload)(occupied.getData())) {
+                doc = occupied;
+            }
+        }
+        catch {
+            // missing
+        }
+        if (!doc) {
+            const occupiedInvalid = await db.getDocument((0, types_2.userKeyDocumentId)(grantDocId)).catch(() => null);
+            if (occupiedInvalid && !occupiedInvalid.isDeleted() && !(0, validateUserKeyDocument_1.asUserKeyPayload)(occupiedInvalid.getData())) {
+                const built = (0, UserKeyDocument_1.buildPendingUserKeyPayload)({
+                    usernameHash,
+                    usernameHashVersion,
+                    publicKey: pair.publicKey,
+                    fingerprint,
+                    createdAt: Date.now(),
+                });
+                doc = await db.createDocument({
+                    idPrefix: "userkey",
+                    decryptionKeyId: "$publicinfos",
+                    initialValues: built,
+                });
+            }
+            else {
+                doc = await (0, UserKeyDocument_1.createPendingUserKeyDocument)({
+                    db,
+                    grantDocId,
+                    usernameHash,
+                    usernameHashVersion,
+                    publicKey: pair.publicKey,
+                    fingerprint,
+                });
+            }
+            mintedHere = true;
+        }
+        const payload = (0, validateUserKeyDocument_1.asUserKeyPayload)(doc.getData());
+        if (!payload)
+            return null;
+        // Occupied valid document: another replica won the mint. Do not wrap-all
+        // onto it — that would auto-approve later grant devices.
+        if (!mintedHere) {
+            return { doc, payload };
+        }
+        try {
+            await this.wrapPrivateKeyForActiveGrantDevices(doc, payload);
+        }
+        catch (error) {
+            if (!(error instanceof types_2.UserKeyMismatchError))
+                throw error;
+        }
+        // Grant overview can be empty (directory not pulled yet). Still wrap this
+        // device so the document does not stay pending with `deviceWraps: {}`.
+        await this.writeOwnDeviceWrap(doc, payload);
+        const refreshed = await db.getDocument(doc.getId());
+        const next = (0, validateUserKeyDocument_1.asUserKeyPayload)(refreshed.getData());
+        return next ? { doc: refreshed, payload: next } : { doc, payload };
+    }
+    /**
+     * Bootstrap / recreate: wrap the new private key to every active grant
+     * device. Later devices added to the grant still require explicit approval.
+     *
+     * `legacyUnstampedOnly` wraps only grant devices with no `addedAt` (pre-User-Keys
+     * fleet). Devices stamped with `addedAt` after the userkey document exists still
+     * need an explicit approve.
+     */
+    async wrapPrivateKeyForActiveGrantDevices(doc, payload, options) {
+        const bytes = await this.getDecryptedUserKeyBytes();
+        if (!bytes) {
+            throw new types_2.UserKeyMismatchError("Local User-Key private material is unavailable");
+        }
+        const live = (0, validateUserKeyDocument_1.asUserKeyPayload)(doc.getData()) ?? payload;
+        const localPublic = await this.getLocalUserPublicKey();
+        const epoch = (0, types_2.currentUserKeyEpoch)(live);
+        if (!epoch || !localPublic)
+            return;
+        const gen = live.userKeys[epoch];
+        if (!gen || gen.publicKey !== localPublic)
+            return;
+        const directory = await this.directory();
+        const signer = await this.tenant.getCurrentUserId();
+        const user = this.tenant.getCurrentPrivateUser();
+        const overview = await directory.getUserGrantOverview(signer.username);
+        const now = Date.now();
+        const deviceWraps = {
+            ...(gen.deviceWraps ?? {}),
+        };
+        let changed = false;
+        const devices = [...overview.activeDevices];
+        if (!devices.some((device) => device.encryptionPublicKey === user.userEncryptionKeyPair.publicKey)) {
+            devices.push({
+                signingPublicKey: user.userSigningKeyPair.publicKey,
+                encryptionPublicKey: user.userEncryptionKeyPair.publicKey,
+                wipeRequested: false,
+            });
+        }
+        for (const device of devices) {
+            if (device.wipeRequested)
+                continue;
+            if (options?.legacyUnstampedOnly && typeof device.addedAt === "number")
+                continue;
+            const deviceFp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(device.encryptionPublicKey, this.tenant.getCryptoAdapter().getSubtle());
+            const existing = deviceWraps[deviceFp];
+            if (existing) {
+                if (!existing.label && device.label) {
+                    deviceWraps[deviceFp] = { ...existing, label: device.label };
+                    changed = true;
+                }
+                continue;
+            }
+            deviceWraps[deviceFp] = {
+                wrappedKey: await (0, UserKeyDocument_1.wrapPrivateKeyForDevice)({
+                    cryptoAdapter: this.tenant.getCryptoAdapter(),
+                    privateKeyBytes: bytes,
+                    deviceEncryptionPublicKey: device.encryptionPublicKey,
+                }),
+                ...(device.label ? { label: device.label } : {}),
+                approvedAt: now,
+                approvedBySigningPublicKey: signer.userSigningPublicKey,
+            };
+            changed = true;
+        }
+        if (!changed)
+            return;
+        await (0, UserKeyDocument_1.replaceUserKeys)(doc.getDatabase(), doc, {
+            ...live.userKeys,
+            [epoch]: { ...gen, deviceWraps },
+        });
+    }
+    async tryImportUserKeyFromWrap(payload) {
+        const user = this.tenant.getCurrentPrivateUser();
+        const deviceKey = await this.tenant.getEncryptionPrivateKeyForReconcile();
+        if (!deviceKey)
+            return false;
+        const deviceFp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(user.userEncryptionKeyPair.publicKey, this.tenant.getCryptoAdapter().getSubtle());
+        for (const epoch of this.epochsNewestFirst(payload)) {
+            const gen = payload.userKeys[epoch];
+            const wrap = gen?.deviceWraps?.[deviceFp];
+            if (!wrap?.wrappedKey)
+                continue;
+            try {
+                const bytes = await (0, UserKeyDocument_1.unwrapPrivateKeyFromDevice)({
+                    cryptoAdapter: this.tenant.getCryptoAdapter(),
+                    wrappedKeyB64: wrap.wrappedKey,
+                    deviceEncryptionPrivateKey: deviceKey,
+                });
+                const encrypted = await (0, privateKeyEncryption_1.encryptPrivateKey)(this.tenant.getCryptoAdapter(), bytes, this.tenant.getCurrentUserPassword(), types_2.USERKEY_PRIVATE_SALT);
+                user.userKeyPair = {
+                    publicKey: gen.publicKey,
+                    privateKey: encrypted,
+                };
+                this.decryptedUserKeyBytes = bytes;
+                this.decryptedUserKeyCache = null;
+                this.seededBytesMatchLocalPublic = true;
+                this.seededBytesVerifiedForPublicKey = gen.publicKey;
+                return true;
+            }
+            catch {
+                // wrap is not for this device or is corrupt; try next generation
+            }
+        }
+        return false;
+    }
+    async writeOwnDeviceWrap(doc, payload) {
+        const localPublic = await this.getLocalUserPublicKey();
+        if (!localPublic) {
+            throw new types_2.UserKeyMismatchError("This device has no local User-Key to compare against the published document");
+        }
+        const live = (0, validateUserKeyDocument_1.asUserKeyPayload)(doc.getData()) ?? payload;
+        const currentEpoch = (0, types_2.currentUserKeyEpoch)(live);
+        if (!currentEpoch) {
+            throw new types_2.UserKeyMismatchError("Published user-key document has no generations");
+        }
+        const published = live.userKeys[currentEpoch]?.publicKey;
+        if (published !== localPublic) {
+            throw new types_2.UserKeyMismatchError();
+        }
+        const user = this.tenant.getCurrentPrivateUser();
+        const deviceFp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(user.userEncryptionKeyPair.publicKey, this.tenant.getCryptoAdapter().getSubtle());
+        const signer = await this.tenant.getCurrentUserId();
+        const ownLabel = await this.labelForOwnEncryptionKey();
+        const db = doc.getDatabase();
+        for (const epoch of Object.keys(live.userKeys)) {
+            const gen = live.userKeys[epoch];
+            if (gen.publicKey !== localPublic)
+                continue;
+            if (gen.deviceWraps?.[deviceFp]) {
+                if (!gen.deviceWraps[deviceFp].label && ownLabel) {
+                    await (0, UserKeyDocument_1.writeDeviceWrap)({
+                        db,
+                        doc,
+                        epoch,
+                        deviceFingerprint: deviceFp,
+                        wrap: { ...gen.deviceWraps[deviceFp], label: ownLabel },
+                    });
+                }
+                continue;
+            }
+            const bytes = await this.privateKeyBytesForEpoch(live, epoch);
+            if (!bytes) {
+                throw new types_2.UserKeyMismatchError("Local User-Key private material is unavailable");
+            }
+            const wrapped = await (0, UserKeyDocument_1.wrapPrivateKeyForDevice)({
+                cryptoAdapter: this.tenant.getCryptoAdapter(),
+                privateKeyBytes: bytes,
+                deviceEncryptionPublicKey: user.userEncryptionKeyPair.publicKey,
+            });
+            await (0, UserKeyDocument_1.writeDeviceWrap)({
+                db,
+                doc,
+                epoch,
+                deviceFingerprint: deviceFp,
+                wrap: {
+                    wrappedKey: wrapped,
+                    ...(ownLabel ? { label: ownLabel } : {}),
+                    approvedAt: Date.now(),
+                    approvedBySigningPublicKey: signer.userSigningPublicKey,
+                },
+            });
+        }
+    }
+    /**
+     * A wrap-less userkey document cannot be imported by anyone. Replace its
+     * planted public key with this device's local pair and wrap the current
+     * grant (same outcome as a first mint).
+     */
+    async adoptPendingUserKeyDocument(doc, payload) {
+        const user = this.tenant.getCurrentPrivateUser();
+        const pair = await this.ensureLocalUserKeyPair(user, this.tenant.getCurrentUserPassword());
+        const epoch = (0, types_2.currentUserKeyEpoch)(payload) ?? "1";
+        const gen = payload.userKeys[epoch];
+        const fingerprint = await (0, UserKeyDocument_1.fingerprintUserPublicKey)(pair.publicKey, this.tenant.getCryptoAdapter());
+        await (0, UserKeyDocument_1.replaceUserKeys)(doc.getDatabase(), doc, {
+            ...payload.userKeys,
+            [epoch]: {
+                publicKey: pair.publicKey,
+                fingerprint,
+                createdAt: gen?.createdAt ?? Date.now(),
+                deviceWraps: {},
+            },
+        });
+        const db = await this.openUserDirectory();
+        const refreshed = await db.getDocument(doc.getId());
+        const nextPayload = (0, validateUserKeyDocument_1.asUserKeyPayload)(refreshed.getData()) ?? payload;
+        const nextDoc = refreshed;
+        await this.wrapPrivateKeyForActiveGrantDevices(nextDoc, nextPayload);
+        const wrappedDoc = await db.getDocument(nextDoc.getId());
+        const wrappedPayload = (0, validateUserKeyDocument_1.asUserKeyPayload)(wrappedDoc.getData()) ?? nextPayload;
+        await this.writeOwnDeviceWrap(wrappedDoc, wrappedPayload);
+        const afterDoc = await db.getDocument(wrappedDoc.getId());
+        const afterPayload = (0, validateUserKeyDocument_1.asUserKeyPayload)(afterDoc.getData());
+        return afterPayload
+            ? { doc: afterDoc, payload: afterPayload }
+            : { doc: wrappedDoc, payload: wrappedPayload };
+    }
+    /**
+     * A wrap-less document cannot be used by any device. Either wrap it with the
+     * local pair that matches the planted public key, or replace that key and wrap.
+     * This is the recovery path for an already-minted pending document (the user's
+     * leftover `deviceWraps: {}` row).
+     */
+    async sealPendingUserKeyDocument(doc, payload) {
+        const user = this.tenant.getCurrentPrivateUser();
+        await this.ensureLocalUserKeyPair(user, this.tenant.getCurrentUserPassword());
+        const localPublic = await this.getLocalUserPublicKey();
+        const epoch = (0, types_2.currentUserKeyEpoch)(payload);
+        const published = epoch ? payload.userKeys[epoch]?.publicKey : undefined;
+        const bytes = await this.getDecryptedUserKeyBytes();
+        const canUsePlantedKey = Boolean(localPublic && published && localPublic === published && bytes);
+        try {
+            if (canUsePlantedKey) {
+                await this.writeOwnDeviceWrap(doc, payload);
+                await this.wrapPrivateKeyForActiveGrantDevices(doc, payload, {
+                    legacyUnstampedOnly: true,
+                });
+            }
+            else {
+                console.warn("[userkeys] sealing pending document by adopting a new pair", {
+                    hasLocalPublic: Boolean(localPublic),
+                    publicKeysMatch: localPublic === published,
+                    hasPrivateBytes: Boolean(bytes),
+                });
+                return await this.adoptPendingUserKeyDocument(doc, payload);
+            }
+        }
+        catch (error) {
+            console.warn("[userkeys] wrap of pending document failed, adopting", error);
+            return await this.adoptPendingUserKeyDocument(doc, payload);
+        }
+        const db = await this.openUserDirectory();
+        const afterDoc = await db.getDocument(doc.getId());
+        const afterPayload = (0, validateUserKeyDocument_1.asUserKeyPayload)(afterDoc.getData());
+        return afterPayload ? { doc: afterDoc, payload: afterPayload } : { doc, payload };
+    }
+    isReconciling() {
+        return this.reconcileInFlight !== null;
+    }
+    /**
+     * True when userdirectory has been fetched this session, or is already fully
+     * initialized. In-flight `openDB` does **not** count: treating that as ready
+     * starts reconcile during initialize, which re-enters `updateUnifiedCache`
+     * and unbounded-allocates Automerge/AES heaps.
+     */
+    canReconcileAgainstUserDirectory() {
+        if (this.userDirectoryFetched)
+            return true;
+        if (typeof this.tenant.isDatabaseReady === "function") {
+            return this.tenant.isDatabaseReady(types_1.USER_DIRECTORY_DB_ID);
+        }
+        return this.tenant.isDatabaseOpen?.(types_1.USER_DIRECTORY_DB_ID) === true;
+    }
+    async reconcile(options) {
+        if (this.reconcileInFlight) {
+            const inFlight = await this.reconcileInFlight;
+            if (options?.allowSelfCreate !== true)
+                return inFlight;
+        }
+        const run = this.reconcileInner(options).finally(() => {
+            if (this.reconcileInFlight === run)
+                this.reconcileInFlight = null;
+        });
+        this.reconcileInFlight = run;
+        return run;
+    }
+    async reconcileInner(options) {
+        try {
+            if (!this.canReconcileAgainstUserDirectory()) {
+                return this.enrollmentStatus(null, "unknown");
+            }
+            const db = await this.openUserDirectory();
+            await db.syncStoreChanges();
+            if (this.userDirectoryFetched) {
+                this.lastUserDirectoryFetchError = null;
+            }
+            let resolved = await this.resolveOwnUserKeyDocument();
+            if (!resolved) {
+                resolved = await this.ensureOwnUserKeyDocument(options);
+            }
+            if (!resolved) {
+                return this.enrollmentStatus(null, "unknown");
+            }
+            if ((0, types_2.isPendingUserKeyDocument)(resolved.payload)) {
+                resolved = await this.sealPendingUserKeyDocument(resolved.doc, resolved.payload);
+            }
+            const localPublic = await this.getLocalUserPublicKey();
+            if (!localPublic) {
+                await this.tryImportUserKeyFromWrap(resolved.payload);
+            }
+            let afterImport = await this.getLocalUserPublicKey();
+            if (afterImport) {
+                const epoch = (0, types_2.currentUserKeyEpoch)(resolved.payload);
+                const published = epoch ? resolved.payload.userKeys[epoch]?.publicKey : undefined;
+                if (published && published !== afterImport) {
+                    await this.tryImportUserKeyFromWrap(resolved.payload);
+                    afterImport = await this.getLocalUserPublicKey();
+                }
+                const user = this.tenant.getCurrentPrivateUser();
+                const deviceFp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(user.userEncryptionKeyPair.publicKey, this.tenant.getCryptoAdapter().getSubtle());
+                const hasOwnWrap = Object.values(resolved.payload.userKeys).some((gen) => !!gen.deviceWraps?.[deviceFp]);
+                if (published && afterImport && published !== afterImport) {
+                    const matchesSomeEpoch = Object.values(resolved.payload.userKeys).some((gen) => gen.publicKey === afterImport);
+                    if (!matchesSomeEpoch) {
+                        if (hasOwnWrap) {
+                            throw new types_2.UserKeyMismatchError();
+                        }
+                        await this.dropRevokedDeviceWraps(resolved.doc, resolved.payload);
+                        return this.enrollmentStatus(resolved.payload, "waiting");
+                    }
+                }
+                if (!hasOwnWrap && afterImport === published) {
+                    await this.writeOwnDeviceWrap(resolved.doc, resolved.payload);
+                    resolved = (await this.resolveOwnUserKeyDocument()) ?? resolved;
+                }
+                if (afterImport === published) {
+                    await this.wrapPrivateKeyForActiveGrantDevices(resolved.doc, resolved.payload, {
+                        legacyUnstampedOnly: true,
+                    });
+                    resolved = (await this.resolveOwnUserKeyDocument()) ?? resolved;
+                }
+            }
+            await this.dropRevokedDeviceWraps(resolved.doc, resolved.payload);
+            return this.enrollmentStatus(resolved.payload, this.waitState());
+        }
+        catch (error) {
+            if (error instanceof types_2.UserKeyMismatchError || error instanceof types_2.UserKeyDecryptError)
+                throw error;
+            this.lastUserDirectoryFetchError = error;
+            console.warn("[userkeys] reconcile failed", error);
+            return this.enrollmentStatus(null, "unknown");
+        }
+    }
+    async listPendingUserKeyDevices() {
+        const resolved = await this.resolveOwnUserKeyDocument();
+        if (!resolved)
+            return [];
+        const directory = await this.directory();
+        const username = (await this.tenant.getCurrentUserId()).username;
+        const overview = await directory.getUserGrantOverview(username);
+        const fallbackAddedAt = await this.grantCreatedAtFallback(username);
+        const wrapped = this.wrappedDeviceFingerprints(resolved.payload);
+        const rejected = new Set(Object.keys(resolved.payload.rejectedDevices ?? {}));
+        const pending = [];
+        for (const device of overview.activeDevices) {
+            const fp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(device.encryptionPublicKey, this.tenant.getCryptoAdapter().getSubtle());
+            if (wrapped.has(fp) || rejected.has(fp))
+                continue;
+            pending.push({
+                fingerprint: fp,
+                signingPublicKey: device.signingPublicKey,
+                encryptionPublicKey: device.encryptionPublicKey,
+                label: device.label,
+                addedAt: device.addedAt ?? fallbackAddedAt,
+            });
+        }
+        return pending;
+    }
+    async listUserKeyDevices() {
+        const resolved = await this.resolveOwnUserKeyDocument();
+        if (!resolved)
+            return [];
+        const directory = await this.directory();
+        const username = (await this.tenant.getCurrentUserId()).username;
+        const overview = await directory.getUserGrantOverview(username);
+        const fallbackAddedAt = await this.grantCreatedAtFallback(username);
+        const wrapped = this.wrappedDeviceFingerprints(resolved.payload);
+        const rejected = resolved.payload.rejectedDevices ?? {};
+        const rows = [];
+        const seen = new Set();
+        for (const device of overview.activeDevices) {
+            const fp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(device.encryptionPublicKey, this.tenant.getCryptoAdapter().getSubtle());
+            seen.add(fp);
+            const status = wrapped.has(fp) ? "approved" : rejected[fp] ? "declined" : "pending";
+            rows.push({
+                fingerprint: fp,
+                signingPublicKey: device.signingPublicKey,
+                encryptionPublicKey: device.encryptionPublicKey,
+                label: device.label,
+                addedAt: device.addedAt ?? fallbackAddedAt,
+                status,
+            });
+        }
+        for (const [fp, wrap] of Object.entries(Object.values(resolved.payload.userKeys ?? {}).reduce((acc, gen) => Object.assign(acc, gen.deviceWraps ?? {}), {}))) {
+            if (seen.has(fp))
+                continue;
+            rows.push({
+                fingerprint: fp,
+                label: wrap.label,
+                addedAt: wrap.approvedAt,
+                status: "approved",
+            });
+        }
+        for (const fp of Object.keys(rejected)) {
+            if (seen.has(fp))
+                continue;
+            rows.push({ fingerprint: fp, status: "declined" });
+        }
+        return rows;
+    }
+    /**
+     * Wrap every User-Key epoch to `encryptionPublicKey` (the joining device).
+     * Does not look up the grant overview — join approval just registered the
+     * device, and the directory cache can still miss it.
+     */
+    async wrapUserKeyForGrantDevice(encryptionPublicKey, label) {
+        const fingerprint = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(encryptionPublicKey, this.tenant.getCryptoAdapter().getSubtle());
+        const resolved = await this.resolveOwnUserKeyDocument();
+        console.log("[userkeys] wrapUserKeyForGrantDevice: start", {
+            joiningDeviceFingerprint: fingerprint,
+            hasUserKeyDocument: !!resolved,
+            docId: resolved?.doc.getId(),
+            epochs: resolved ? this.epochsNewestFirst(resolved.payload) : [],
+        });
+        if (!resolved) {
+            throw new Error("Cannot wrap User-Key for joining device: no user-key document");
+        }
+        const signer = await this.tenant.getCurrentUserId();
+        const db = resolved.doc.getDatabase();
+        let wroteWrap = false;
+        for (const epoch of this.epochsNewestFirst(resolved.payload).reverse()) {
+            const bytes = await this.privateKeyBytesForEpoch(resolved.payload, epoch);
+            console.log("[userkeys] wrapUserKeyForGrantDevice: epoch", {
+                epoch,
+                hasPrivateKeyBytes: !!bytes,
+            });
+            if (!bytes)
+                continue;
+            const wrapped = await (0, UserKeyDocument_1.wrapPrivateKeyForDevice)({
+                cryptoAdapter: this.tenant.getCryptoAdapter(),
+                privateKeyBytes: bytes,
+                deviceEncryptionPublicKey: encryptionPublicKey,
+            });
+            await (0, UserKeyDocument_1.writeDeviceWrap)({
+                db,
+                doc: resolved.doc,
+                epoch,
+                deviceFingerprint: fingerprint,
+                wrap: {
+                    wrappedKey: wrapped,
+                    ...(label ? { label } : {}),
+                    approvedAt: Date.now(),
+                    approvedBySigningPublicKey: signer.userSigningPublicKey,
+                },
+            });
+            wroteWrap = true;
+        }
+        if (!wroteWrap) {
+            throw new Error("Cannot wrap User-Key for joining device: local User-Key is locked");
+        }
+        console.log("[userkeys] wrapUserKeyForGrantDevice: wrote wrap", {
+            joiningDeviceFingerprint: fingerprint,
+        });
+    }
+    async approveUserKeyDevice(fingerprint) {
+        const resolved = await this.resolveOwnUserKeyDocument();
+        if (!resolved) {
+            throw new Error("Cannot approve a device: no user-key document");
+        }
+        const directory = await this.directory();
+        const username = (await this.tenant.getCurrentUserId()).username;
+        const overview = await directory.getUserGrantOverview(username);
+        const match = await this.findActiveDeviceByFingerprint(overview.activeDevices, fingerprint);
+        if (!match) {
+            throw new Error(`Cannot approve device "${fingerprint}": not an active grant device`);
+        }
+        const signer = await this.tenant.getCurrentUserId();
+        const db = resolved.doc.getDatabase();
+        let wroteWrap = false;
+        for (const epoch of this.epochsNewestFirst(resolved.payload).reverse()) {
+            const bytes = await this.privateKeyBytesForEpoch(resolved.payload, epoch);
+            if (!bytes)
+                continue;
+            const wrapped = await (0, UserKeyDocument_1.wrapPrivateKeyForDevice)({
+                cryptoAdapter: this.tenant.getCryptoAdapter(),
+                privateKeyBytes: bytes,
+                deviceEncryptionPublicKey: match.encryptionPublicKey,
+            });
+            await (0, UserKeyDocument_1.writeDeviceWrap)({
+                db,
+                doc: resolved.doc,
+                epoch,
+                deviceFingerprint: fingerprint,
+                wrap: {
+                    wrappedKey: wrapped,
+                    ...(match.label ? { label: match.label } : {}),
+                    approvedAt: Date.now(),
+                    approvedBySigningPublicKey: signer.userSigningPublicKey,
+                },
+            });
+            wroteWrap = true;
+        }
+        if (!wroteWrap) {
+            throw new Error("Cannot approve a device: local User-Key is locked");
+        }
+        if (resolved.payload.rejectedDevices?.[fingerprint]) {
+            const next = { ...resolved.payload.rejectedDevices };
+            delete next[fingerprint];
+            await (0, UserKeyDocument_1.replaceRejectedDevices)(db, resolved.doc, next);
+        }
+    }
+    async declineUserKeyDevice(fingerprint) {
+        const resolved = await this.resolveOwnUserKeyDocument();
+        if (!resolved) {
+            throw new Error("Cannot decline a device: no user-key document");
+        }
+        const signer = await this.tenant.getCurrentUserId();
+        await (0, UserKeyDocument_1.replaceRejectedDevices)(resolved.doc.getDatabase(), resolved.doc, {
+            ...(resolved.payload.rejectedDevices ?? {}),
+            [fingerprint]: {
+                rejectedAt: Date.now(),
+                rejectedBySigningPublicKey: signer.userSigningPublicKey,
+            },
+        });
+    }
+    async undoDeclineUserKeyDevice(fingerprint) {
+        const resolved = await this.resolveOwnUserKeyDocument();
+        if (!resolved)
+            return;
+        if (!resolved.payload.rejectedDevices?.[fingerprint])
+            return;
+        const next = { ...resolved.payload.rejectedDevices };
+        delete next[fingerprint];
+        await (0, UserKeyDocument_1.replaceRejectedDevices)(resolved.doc.getDatabase(), resolved.doc, next);
+    }
+    async rotateUserKey() {
+        const resolved = await this.resolveOwnUserKeyDocument();
+        if (!resolved) {
+            throw new Error("Cannot rotate: no user-key document");
+        }
+        const current = (0, types_2.currentUserKeyEpoch)(resolved.payload);
+        if (!current) {
+            throw new Error("Cannot rotate: user-key document has no generations");
+        }
+        const nextEpoch = (BigInt(current) + 1n).toString();
+        if (resolved.payload.userKeys[nextEpoch]) {
+            throw new Error(`Cannot rotate: epoch ${nextEpoch} already exists`);
+        }
+        const user = this.tenant.getCurrentPrivateUser();
+        const generated = await (0, rsaOaep3072_1.generateRsaOaep3072)(this.tenant.getCryptoAdapter());
+        const encrypted = await (0, privateKeyEncryption_1.encryptPrivateKey)(this.tenant.getCryptoAdapter(), generated.privateKeyBytes, this.tenant.getCurrentUserPassword(), types_2.USERKEY_PRIVATE_SALT);
+        user.userKeyPair = {
+            publicKey: generated.publicKeyPem,
+            privateKey: encrypted,
+        };
+        this.decryptedUserKeyBytes = generated.privateKeyBytes;
+        this.decryptedUserKeyCache = null;
+        const fingerprint = await (0, UserKeyDocument_1.fingerprintUserPublicKey)(generated.publicKeyPem, this.tenant.getCryptoAdapter());
+        const signer = await this.tenant.getCurrentUserId();
+        const now = Date.now();
+        const directory = await this.directory();
+        const overview = await directory.getUserGrantOverview(signer.username);
+        const previousWraps = resolved.payload.userKeys[current]?.deviceWraps ?? {};
+        const deviceWraps = {};
+        for (const device of overview.activeDevices) {
+            const deviceFp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(device.encryptionPublicKey, this.tenant.getCryptoAdapter().getSubtle());
+            if (!previousWraps[deviceFp])
+                continue;
+            deviceWraps[deviceFp] = {
+                wrappedKey: await (0, UserKeyDocument_1.wrapPrivateKeyForDevice)({
+                    cryptoAdapter: this.tenant.getCryptoAdapter(),
+                    privateKeyBytes: generated.privateKeyBytes,
+                    deviceEncryptionPublicKey: device.encryptionPublicKey,
+                }),
+                ...(device.label ? { label: device.label } : {}),
+                approvedAt: now,
+                approvedBySigningPublicKey: signer.userSigningPublicKey,
+            };
+        }
+        await (0, UserKeyDocument_1.replaceUserKeys)(resolved.doc.getDatabase(), resolved.doc, {
+            ...resolved.payload.userKeys,
+            [current]: { ...resolved.payload.userKeys[current], retiredAt: now },
+            [nextEpoch]: {
+                publicKey: generated.publicKeyPem,
+                fingerprint,
+                createdAt: now,
+                deviceWraps,
+            },
+        });
+    }
+    /**
+     * Admin-only delete of the published user-key document for `username`.
+     * Lookup uses the same grant-binding path as {@link publishedUserKeyFor}.
+     * Recovery path when every device that held the private key is gone.
+     * A remaining enrolled device keeps local access; it does not republish
+     * the tombstone on unlock while `default` is already wrapped to that user.
+     */
+    async deletePublishedUserKeyFor(input) {
+        const resolved = await this.resolvePublishedUserKeyDocument(input.username);
+        if (!resolved) {
+            throw new Error(`No published personal key document for "${input.username}".`);
+        }
+        const db = await this.openUserDirectory();
+        await db.deleteDocument(resolved.doc.getId(), {
+            signingKeyPair: input.signingKeyPair,
+            signingKeyPassword: input.signingKeyPassword,
+        });
+    }
+    async publishedUserKeyFor(username) {
+        const resolved = await this.resolvePublishedUserKeyDocument(username);
+        if (!resolved)
+            return null;
+        const epoch = (0, types_2.currentUserKeyEpoch)(resolved.payload);
+        if (!epoch)
+            return null;
+        const gen = resolved.payload.userKeys[epoch];
+        return {
+            publicKey: gen.publicKey,
+            fingerprint: gen.fingerprint,
+            pending: (0, types_2.isPendingUserKeyDocument)(resolved.payload),
+        };
+    }
+    /**
+     * Lookup only — Trap 1 (no mint from local emptiness) does not apply.
+     * Haven reopens a fresh tenant per action; blocking on
+     * `userDirectoryFetched` made wrapKeyForUser return null so
+     * `acl_keydistribution_default` never gained a User-Key wrap.
+     */
+    async resolvePublishedUserKeyDocument(username) {
+        const directory = await this.directory();
+        const db = await this.openUserDirectory();
+        const hashes = await directory.getUsernameHashCandidates(username);
+        const grants = await directory.findGrantAccessDocuments(username);
+        return (0, resolveUserKeyDocument_1.resolveUserKeyDocument)({
+            db,
+            directory,
+            username,
+            usernameHashCandidates: hashes,
+            grantDocIds: grants.map((g) => g.getId()),
+            adminPublicKey: this.tenant.getAdministrationPublicKey(),
+        });
+    }
+    async getEnrollmentStatus() {
+        if (this.lastUserDirectoryFetchError && !this.userDirectoryFetched) {
+            return this.enrollmentStatus(null, "unknown");
+        }
+        const resolved = await this.resolveOwnUserKeyDocument();
+        if (!resolved) {
+            return this.enrollmentStatus(null, this.userDirectoryFetched ? "waiting" : "unknown");
+        }
+        return this.enrollmentStatus(resolved.payload, this.waitState());
+    }
+    waitState() {
+        if (!this.userDirectoryFetched && this.lastUserDirectoryFetchError)
+            return "unknown";
+        return this.userDirectoryFetched ? "waiting" : "unknown";
+    }
+    async waitStateForDevice(payload) {
+        const user = this.tenant.getCurrentPrivateUser();
+        const fp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(user.userEncryptionKeyPair.publicKey, this.tenant.getCryptoAdapter().getSubtle());
+        // A wrap on this device is enough to be approved. Do not wait for a
+        // userdirectory fetch flag: reload / local-only mint already has the wrap
+        // in the local replica, and treating that as "unknown" keeps the waiting
+        // banner up after the approve dialog is gone.
+        if (this.wrappedDeviceFingerprints(payload).has(fp))
+            return "approved";
+        if (!this.userDirectoryFetched && this.lastUserDirectoryFetchError)
+            return "unknown";
+        if (!this.userDirectoryFetched)
+            return "unknown";
+        return "waiting";
+    }
+    async enrollmentStatus(payload, fallback) {
+        if (!payload) {
+            return { state: fallback, pending: true, missingKeys: ["default"] };
+        }
+        const state = await this.waitStateForDevice(payload);
+        const pending = (0, types_2.isPendingUserKeyDocument)(payload);
+        const missingKeys = state === "approved" ? [] : ["default"];
+        return { state, pending, missingKeys };
+    }
+    epochsNewestFirst(payload) {
+        return Object.keys(payload.userKeys ?? {})
+            .filter((epoch) => /^\d+$/.test(epoch))
+            .sort((a, b) => (BigInt(a) > BigInt(b) ? -1 : BigInt(a) < BigInt(b) ? 1 : 0));
+    }
+    async privateKeyBytesForEpoch(payload, epoch) {
+        const gen = payload.userKeys[epoch];
+        if (!gen)
+            return null;
+        const localPublic = await this.getLocalUserPublicKey();
+        const publicKeyMatchesLocal = !!localPublic && gen.publicKey === localPublic;
+        if (publicKeyMatchesLocal) {
+            const localBytes = await this.getDecryptedUserKeyBytes();
+            if (localBytes)
+                return localBytes;
+            // Haven restoreTenantWithLiveBag opens with an empty password, so the
+            // identity's password-encrypted User-Key may not unwrap even when the
+            // public key matches. Fall through to the device wrap.
+        }
+        const deviceKey = await this.tenant.getEncryptionPrivateKeyForReconcile();
+        const user = this.tenant.getCurrentPrivateUser();
+        const deviceFp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(user.userEncryptionKeyPair.publicKey, this.tenant.getCryptoAdapter().getSubtle());
+        const wrap = gen.deviceWraps?.[deviceFp];
+        console.log("[userkeys] privateKeyBytesForEpoch", {
+            epoch,
+            publicKeyMatchesLocal,
+            seededUserKeyBytes: !!this.decryptedUserKeyBytes,
+            ownDeviceFingerprint: deviceFp,
+            wrappedDeviceFingerprints: Object.keys(gen.deviceWraps ?? {}),
+            hasOwnDeviceWrap: !!wrap?.wrappedKey,
+            hasDeviceEncryptionKey: !!deviceKey,
+        });
+        if (!deviceKey)
+            return null;
+        if (!wrap?.wrappedKey)
+            return null;
+        try {
+            return (0, UserKeyDocument_1.unwrapPrivateKeyFromDevice)({
+                cryptoAdapter: this.tenant.getCryptoAdapter(),
+                wrappedKeyB64: wrap.wrappedKey,
+                deviceEncryptionPrivateKey: deviceKey,
+            });
+        }
+        catch (error) {
+            console.warn("[userkeys] privateKeyBytesForEpoch: device wrap unwrap failed", epoch, error);
+            return null;
+        }
+    }
+    async grantCreatedAtFallback(username) {
+        const directory = await this.directory();
+        const grants = await directory.findGrantAccessDocuments(username);
+        let earliest;
+        for (const grant of grants) {
+            const created = grant.getCreatedAt();
+            if (typeof created !== "number")
+                continue;
+            earliest = earliest == null ? created : Math.min(earliest, created);
+        }
+        return earliest;
+    }
+    wrappedDeviceFingerprints(payload) {
+        const fps = new Set();
+        for (const gen of Object.values(payload.userKeys ?? {})) {
+            for (const fp of Object.keys(gen.deviceWraps ?? {}))
+                fps.add(fp);
+        }
+        return fps;
+    }
+    async dropRevokedDeviceWraps(doc, payload) {
+        const directory = await this.directory();
+        const username = (await this.tenant.getCurrentUserId()).username;
+        const grants = await directory.findGrantAccessDocuments(username);
+        const revokedFps = new Set();
+        const crypto = this.tenant.getCryptoAdapter();
+        for (const grant of grants) {
+            for (const pair of (0, grantKeys_1.extractRevokedKeyPairs)(grant.getData())) {
+                if (!pair.encryptionPublicKey)
+                    continue;
+                revokedFps.add(await (0, fingerprint_1.fingerprintEncryptionPublicKey)(pair.encryptionPublicKey, crypto.getSubtle()));
+            }
+        }
+        if (revokedFps.size === 0)
+            return;
+        let changed = false;
+        const userKeys = {};
+        for (const [epoch, gen] of Object.entries(payload.userKeys ?? {})) {
+            const deviceWraps = { ...(gen.deviceWraps ?? {}) };
+            for (const fp of Object.keys(deviceWraps)) {
+                if (revokedFps.has(fp)) {
+                    delete deviceWraps[fp];
+                    changed = true;
+                }
+            }
+            userKeys[epoch] = { ...gen, deviceWraps };
+        }
+        if (!changed)
+            return;
+        await (0, UserKeyDocument_1.replaceUserKeys)(doc.getDatabase(), doc, userKeys);
+    }
+    async findActiveDeviceByFingerprint(devices, fingerprint) {
+        const crypto = this.tenant.getCryptoAdapter();
+        for (const device of devices) {
+            const fp = await (0, fingerprint_1.fingerprintEncryptionPublicKey)(device.encryptionPublicKey, crypto.getSubtle());
+            if (fp === fingerprint)
+                return device;
+        }
+        return null;
+    }
+    /**
+     * Bind a userkey document to the grant that names this person.
+     * Writes the grant's `username_hash` (not the current write-version hash) so
+     * the userdirectory invariant matches `resolveUsernameHashForSigningKey`.
+     * When `signingPublicKey` is set (self-mint), that key must be on the grant.
+     */
+    async mintBindingForUsername(username, signingPublicKey) {
+        const directory = await this.directory();
+        const grants = await directory.findGrantAccessDocuments(username);
+        if (grants.length === 0)
+            return null;
+        let signerHash = null;
+        if (signingPublicKey && typeof directory.resolveUsernameHashForSigningKey === "function") {
+            signerHash = await directory.resolveUsernameHashForSigningKey(signingPublicKey, Number.MAX_SAFE_INTEGER);
+            if (!signerHash)
+                return null;
+        }
+        const grant = (signerHash
+            ? grants.find((g) => g.getData().username_hash === signerHash)
+            : undefined) ?? grants[0];
+        const binding = (0, UserKeyDocument_1.usernameHashBindingFromGrant)(grant.getData());
+        const usernameHash = signerHash ?? binding?.usernameHash;
+        if (!usernameHash)
+            return null;
+        return {
+            grantDocId: grant.getId(),
+            usernameHash,
+            usernameHashVersion: binding?.usernameHashVersion ?? types_2.USERKEY_USERNAME_HASH_VERSION,
+        };
+    }
+    async labelForOwnEncryptionKey() {
+        try {
+            const directory = await this.directory();
+            const signer = await this.tenant.getCurrentUserId();
+            const user = this.tenant.getCurrentPrivateUser();
+            const overview = await directory.getUserGrantOverview(signer.username);
+            return overview.activeDevices.find((device) => device.encryptionPublicKey === user.userEncryptionKeyPair.publicKey)?.label;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async defaultAlreadyWrappedForCurrentUser() {
+        try {
+            const directory = await this.directory();
+            const username = (await this.tenant.getCurrentUserId()).username;
+            const managed = await directory.getManagedKeyIds(username);
+            return managed.includes(types_1.DEFAULT_TENANT_KEY_ID);
+        }
+        catch {
+            return false;
+        }
+    }
+    async directory() {
+        const directory = await this.tenant.openDirectory();
+        return directory;
+    }
+}
+exports.UserKeyManager = UserKeyManager;
+//# sourceMappingURL=UserKeyManager.js.map