mindoodb 0.0.50 → 0.0.53

package/dist/core/userkeys/recipients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipients.js","sourceRoot":"","sources":["../../../src/core/userkeys/recipients.ts"],"names":[],"mappings":";;AA+BA,oDAeC;AAED,wCAIC;AAED,0DAIC;AAED,oEAcC;AAwBD,sDA8EC;AA6ED,sCAiBC;AAMD,sDAKC;AAED,kDAgBC;AAED,wDAkBC;AAED,8DAYC;AAOD,sDAgBC;AAnWD,0DAAmE;AACnE,oCAA2C;AAE3C,mEAIqC;AACrC,+CAA+D;AAC/D,iDAA4C;AAC5C,+CAOuB;AAavB,SAAgB,oBAAoB,CAClC,OAAmE;IAEnE,IAAI,IAAoE,CAAC;IACzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM;YAAE,SAAS;QAC/C,IACE,CAAC,IAAI;YACL,KAAK,CAAC,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,EACtF,CAAC;YACD,IAAI,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,EAAE,UAAU,CAAC;AAC1B,CAAC;AAED,SAAgB,cAAc,CAAC,OAAmD;IAChF,MAAM,GAAG,GAAI,OAAmC,CAAC,+BAAiB,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACrE,OAAO,GAAsC,CAAC;AAChD,CAAC;AAED,SAAgB,uBAAuB,CACrC,GAAoC;IAEpC,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACrE,CAAC;AAED,SAAgB,4BAA4B,CAC1C,OAAmD,EACnD,eAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,eAAe,EAAE,KAAK,IAAI,CAAC,CAAC;IAC1C,OAAO,uBAAuB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;QACjD,EAAE,EAAE,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,EAAE;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;KACpE,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,OAAO,CAAC,IAAmB;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,IAAI,EAAE,CAAC;IACpD,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/C,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC;IACrD,IAAI,WAAW,IAAI,IAAI;QAAE,OAAO,aAAa,IAAI,CAAC,SAAS,EAAE,CAAC;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAmB;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,MAAM,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACrC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAsB;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,IAAI;YAAE,SAAS;QAC3B,IAAA,wCAAoB,EAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,qBAAqB,CAAC,KAM3C;IAKC,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,WAAW,KAAK,KAAK,CAAC;IACzD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YACjF,IAAI,IAAI,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,IAAA,kCAAc,EAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,OAAO,GAAmD,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,MAAM,SAAS,GAAG,CAAC,MAA0B,EAAE,EAAE;QAC/C,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO;QACtC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACrB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;gBACjD,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,CAAC,IAAI,CAAC,2BAA2B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;gBAAE,SAAS,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,MAAM;gBAAE,MAAM,KAAK,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI;gBACJ,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,WAAW;YACT,CAAC,CAAC,6DAA6D;YAC/D,CAAC,CAAC,iFAAiF,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAoC,EAAE,CAAC;IACvD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;YAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,MAAwB,EACxB,IAAmB;IAEnB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,CAAC;IACD,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC;QACrD,MAAM,WAAW,GAAG,MAAM,IAAA,4CAA8B,EAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACjF,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,WAAW;oBACf,QAAQ,EAAE,WAAW;oBACrB,cAAc,EAAE,WAAW;oBAC3B,YAAY,EAAE,IAAI,CAAC,SAAS;oBAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;iBAClB;aACF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACjE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAAwB,EACxB,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAA,wCAAoB,EAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,iBAAiB,EAAE,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAClF,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,EAAE,EAAE,SAAS;QACb,QAAQ,EAAE,SAAS;QACnB,cAAc,EAAE,SAAS,CAAC,WAAW;QACrC,YAAY,EAAE,SAAS,CAAC,SAAS;QACjC,KAAK,EAAE,IAAA,gDAA4B,EAAC,QAAQ,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,MAAwB,EACxB,WAAmB,EACnB,KAAc;IAEd,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,uBAAe,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC;IACrD,IAAI,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,WAAW,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAA6B,CAAC;QACtD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa;YAAE,SAAS;QAC3E,KAAK,MAAM,IAAI,IAAI,IAAA,iCAAqB,EAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,EAAE,GAAG,MAAM,IAAA,4CAA8B,EAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;YAClF,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;gBACvB,OAAO;oBACL,IAAI,EAAE,QAAQ;oBACd,EAAE,EAAE,WAAW;oBACf,QAAQ,EAAE,WAAW;oBACrB,cAAc,EAAE,WAAW;oBAC3B,YAAY,EAAE,IAAI,CAAC,mBAAmB;oBACtC,KAAK,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK;iBAC3B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,aAAa,CAAC,KAKnC;IACC,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAU,EAAC;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE;QACvC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,cAAc;YAClC,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;KACJ,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAI,KAAQ;IAChC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAM,CAAC;AAChD,CAAC;AAED,SAAgB,qBAAqB,CACnC,GAAqB,EACrB,UAA2C;IAE1C,GAA+B,CAAC,+BAAiB,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;AAClF,CAAC;AAED,SAAgB,mBAAmB,CACjC,GAAqB,EACrB,UAA2C,EAC3C,KAAa;IAEb,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAoC,CAAC;IACvE,IAAI,CAAC,CAAC,+BAAiB,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,+BAAiB,CAAC,EAAE,CAAC;QAC1D,GAA+B,CAAC,+BAAiB,CAAC,GAAG,EAAE,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,+BAAiB,CAAoC,CAAC;IACtE,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,SAAS;QAC9C,MAAM,GAAG,GAAG,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,SAAgB,sBAAsB,CACpC,GAAqB,EACrB,SAAmB,EACnB,GAAW,EACX,SAAiB;IAEjB,MAAM,GAAG,GAAG,GAAG,CAAC,+BAAiB,CAAgD,CAAC;IAClF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,SAAS;QACnE,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS;YAAE,SAAS;QAChC,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC;QACxB,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,yBAAyB,CACvC,GAAoC,EACpC,QAA8B;IAE9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,MAAM,GAAG,GAAyB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrH,IAAI,MAAM;YAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,qBAAqB,CACnC,OAAmD,EACnD,eAA4C,EAC5C,KAAe;IAEf,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAC1E,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,IAAA,wCAAoB,EAAC,IAAI,CAAC,CAAC;QACvC,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,IAAI,KAAK,MAAM;eACtB,SAAS,CAAC,MAAM;eAChB,IAAA,wCAAoB,EAAC,SAAS,CAAC,EAAE,CAAC,KAAK,GAAG,CAChD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/userkeys/resolveUserKeyDocument.d.ts

@@ -0,0 +1,21 @@
+import type { MindooDB, MindooDoc, MindooTenantDirectory } from "../types";
+import { type UserKeyDocumentPayload } from "./types";
+export interface ResolveUserKeyDocumentInput {
+    db: MindooDB;
+    directory: MindooTenantDirectory;
+    username: string;
+    usernameHashCandidates: string[];
+    grantDocIds: string[];
+    adminPublicKey?: string;
+}
+export interface ResolvedUserKeyDocument {
+    doc: MindooDoc;
+    payload: UserKeyDocumentPayload;
+}
+/**
+ * §5.1 lookup: canonical `userkey_<grantDocId>` first, then a scan over
+ * `username_hash`. Invalid squatters are ignored. Ties break by highest
+ * epoch, then lowest fingerprint (byte-deterministic).
+ */
+export declare function resolveUserKeyDocument(input: ResolveUserKeyDocumentInput): Promise<ResolvedUserKeyDocument | null>;
+//# sourceMappingURL=resolveUserKeyDocument.d.ts.map

package/dist/core/userkeys/resolveUserKeyDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveUserKeyDocument.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/resolveUserKeyDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAGzE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,qBAAqB,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAiCzC"}

package/dist/core/userkeys/resolveUserKeyDocument.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveUserKeyDocument = resolveUserKeyDocument;
+const types_1 = require("./types");
+const validateUserKeyDocument_1 = require("./validateUserKeyDocument");
+/**
+ * §5.1 lookup: canonical `userkey_<grantDocId>` first, then a scan over
+ * `username_hash`. Invalid squatters are ignored. Ties break by highest
+ * epoch, then lowest fingerprint (byte-deterministic).
+ */
+async function resolveUserKeyDocument(input) {
+    const valid = [];
+    for (const grantDocId of input.grantDocIds) {
+        const canonicalId = (0, types_1.userKeyDocumentId)(grantDocId);
+        try {
+            const doc = await input.db.getDocument(canonicalId);
+            if (doc.isDeleted())
+                continue;
+            const resolved = await validateLoaded(doc, input);
+            if (resolved)
+                valid.push(resolved);
+        }
+        catch {
+            // missing or unreadable
+        }
+    }
+    if (valid.length === 0) {
+        const ids = await input.db.getAllDocumentIds();
+        for (const id of ids) {
+            if (valid.some((v) => v.doc.getId() === id))
+                continue;
+            try {
+                const doc = await input.db.getDocument(id);
+                if (doc.isDeleted())
+                    continue;
+                const resolved = await validateLoaded(doc, input);
+                if (resolved)
+                    valid.push(resolved);
+            }
+            catch {
+                // skip
+            }
+        }
+    }
+    if (valid.length === 0)
+        return null;
+    valid.sort(compareResolved);
+    return valid[0];
+}
+async function validateLoaded(doc, input) {
+    const signerKey = await creatorSigningKey(input.db, doc.getId());
+    if (!signerKey)
+        return null;
+    const payload = await (0, validateUserKeyDocument_1.validateUserKeyDocument)({
+        payload: doc.getData(),
+        signerKey,
+        usernameHashCandidates: input.usernameHashCandidates,
+        directory: input.directory,
+        adminPublicKey: input.adminPublicKey,
+    });
+    if (!payload)
+        return null;
+    return { doc, payload };
+}
+async function creatorSigningKey(db, docId) {
+    const store = db.getStore();
+    const metas = await store.findNewEntriesForDoc([], docId);
+    const create = metas.find((m) => m.entryType === "doc_create");
+    return create?.createdByPublicKey ?? null;
+}
+function compareResolved(a, b) {
+    const epochA = maxEpoch(a.payload);
+    const epochB = maxEpoch(b.payload);
+    if (epochA !== epochB)
+        return epochB > epochA ? 1 : -1;
+    const fpA = currentFingerprint(a.payload);
+    const fpB = currentFingerprint(b.payload);
+    if (fpA !== fpB)
+        return fpA < fpB ? -1 : 1;
+    return a.doc.getId() < b.doc.getId() ? -1 : 1;
+}
+function maxEpoch(payload) {
+    const epochs = Object.keys(payload.userKeys ?? {}).filter((k) => /^\d+$/.test(k));
+    if (epochs.length === 0)
+        return 0n;
+    return epochs.reduce((acc, k) => {
+        const n = BigInt(k);
+        return n > acc ? n : acc;
+    }, 0n);
+}
+function currentFingerprint(payload) {
+    const epochs = Object.keys(payload.userKeys ?? {}).filter((k) => /^\d+$/.test(k));
+    if (epochs.length === 0)
+        return "";
+    const current = epochs.reduce((a, b) => (BigInt(a) > BigInt(b) ? a : b));
+    return payload.userKeys[current]?.fingerprint ?? "";
+}
+//# sourceMappingURL=resolveUserKeyDocument.js.map

package/dist/core/userkeys/resolveUserKeyDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveUserKeyDocument.js","sourceRoot":"","sources":["../../../src/core/userkeys/resolveUserKeyDocument.ts"],"names":[],"mappings":";;AAuBA,wDAmCC;AAzDD,mCAAyE;AACzE,uEAAoE;AAgBpE;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAC1C,KAAkC;IAElC,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,GAAG,CAAC,SAAS,EAAE;gBAAE,SAAS;YAC9B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;gBAAE,SAAS;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,CAAC,SAAS,EAAE;oBAAE,SAAS;gBAC9B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAc,EACd,KAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAA,iDAAuB,EAAC;QAC5C,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QACtB,SAAS;QACT,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,KAAa;IAC1D,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;IAC/D,OAAO,MAAM,EAAE,kBAAkB,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B,EAAE,CAA0B;IAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,OAA+B;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3B,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA+B;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC"}

package/dist/core/userkeys/sealedCrypto.d.ts

@@ -0,0 +1,21 @@
+import type { CryptoAdapter } from "../crypto/CryptoAdapter";
+import type { EntryRecipients } from "./sealedTypes";
+export declare function encryptAesGcm(crypto: CryptoAdapter, keyBytes: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
+export declare function decryptAesGcm(crypto: CryptoAdapter, keyBytes: Uint8Array, packed: Uint8Array): Promise<Uint8Array>;
+export declare function concatGenerations(generations: Uint8Array[]): Uint8Array;
+export declare function splitGenerations(bytes: Uint8Array): Uint8Array[];
+export declare function sealBundle(input: {
+    crypto: CryptoAdapter;
+    generations: Uint8Array[];
+    wrapsTo: Array<{
+        kind: "user" | "device";
+        fingerprint: string;
+        publicKeyPem: string;
+    }>;
+}): Promise<EntryRecipients>;
+export declare function openBundle(input: {
+    crypto: CryptoAdapter;
+    recipients: EntryRecipients;
+    privateKey: CryptoKey;
+}): Promise<Uint8Array[]>;
+//# sourceMappingURL=sealedCrypto.d.ts.map

package/dist/core/userkeys/sealedCrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedCrypto.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/sealedCrypto.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,UAAU,EACpB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAerB;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,UAAU,EACpB,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,UAAU,CAAC,CAarB;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAIvE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,EAAE,CAMhE;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,aAAa,CAAC;IACtB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxF,GAAG,OAAO,CAAC,eAAe,CAAC,CAkB3B;AAED,wBAAsB,UAAU,CAAC,KAAK,EAAE;IACtC,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,eAAe,CAAC;IAC5B,UAAU,EAAE,SAAS,CAAC;CACvB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAaxB"}

package/dist/core/userkeys/sealedCrypto.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptAesGcm = encryptAesGcm;
+exports.decryptAesGcm = decryptAesGcm;
+exports.concatGenerations = concatGenerations;
+exports.splitGenerations = splitGenerations;
+exports.sealBundle = sealBundle;
+exports.openBundle = openBundle;
+const RSAEncryption_1 = require("../crypto/RSAEncryption");
+const fingerprint_1 = require("./fingerprint");
+async function encryptAesGcm(crypto, keyBytes, plaintext) {
+    const subtle = crypto.getSubtle();
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const key = await subtle.importKey("raw", keyBytes.slice(), { name: "AES-GCM" }, false, [
+        "encrypt",
+    ]);
+    const ct = await subtle.encrypt({ name: "AES-GCM", iv: iv.slice(), tagLength: 128 }, key, plaintext.slice());
+    const out = new Uint8Array(12 + ct.byteLength);
+    out.set(iv, 0);
+    out.set(new Uint8Array(ct), 12);
+    return out;
+}
+async function decryptAesGcm(crypto, keyBytes, packed) {
+    const subtle = crypto.getSubtle();
+    const iv = packed.slice(0, 12);
+    const ct = packed.slice(12);
+    const key = await subtle.importKey("raw", keyBytes.slice(), { name: "AES-GCM" }, false, [
+        "decrypt",
+    ]);
+    const pt = await subtle.decrypt({ name: "AES-GCM", iv: iv, tagLength: 128 }, key, ct);
+    return new Uint8Array(pt);
+}
+function concatGenerations(generations) {
+    const out = new Uint8Array(generations.length * 32);
+    generations.forEach((g, i) => out.set(g, i * 32));
+    return out;
+}
+function splitGenerations(bytes) {
+    const gens = [];
+    for (let i = 0; i + 32 <= bytes.length; i += 32) {
+        gens.push(bytes.slice(i, i + 32));
+    }
+    return gens;
+}
+async function sealBundle(input) {
+    const bundleKey = input.crypto.getRandomValues(new Uint8Array(32));
+    const bundle = await encryptAesGcm(input.crypto, bundleKey, concatGenerations(input.generations));
+    const rsa = new RSAEncryption_1.RSAEncryption(input.crypto);
+    const wraps = [];
+    for (const target of input.wrapsTo) {
+        const wrapped = await rsa.encrypt(bundleKey, target.publicKeyPem);
+        wraps.push({
+            kind: target.kind,
+            keyFingerprint: target.fingerprint,
+            wrapped: (0, fingerprint_1.bytesToBase64)(wrapped),
+        });
+    }
+    return {
+        epoch: input.generations.length,
+        bundle: (0, fingerprint_1.bytesToBase64)(bundle),
+        wraps,
+    };
+}
+async function openBundle(input) {
+    const rsa = new RSAEncryption_1.RSAEncryption(input.crypto);
+    let lastError;
+    for (const wrap of input.recipients.wraps) {
+        try {
+            const bundleKey = await rsa.decrypt((0, fingerprint_1.base64ToBytes)(wrap.wrapped), input.privateKey);
+            const packed = await decryptAesGcm(input.crypto, bundleKey, (0, fingerprint_1.base64ToBytes)(input.recipients.bundle));
+            return splitGenerations(packed).reverse();
+        }
+        catch (error) {
+            lastError = error;
+        }
+    }
+    throw lastError ?? new Error("no recipient wrap opened");
+}
+//# sourceMappingURL=sealedCrypto.js.map

package/dist/core/userkeys/sealedCrypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedCrypto.js","sourceRoot":"","sources":["../../../src/core/userkeys/sealedCrypto.ts"],"names":[],"mappings":";;AAKA,sCAmBC;AAED,sCAiBC;AAED,8CAIC;AAED,4CAMC;AAED,gCAsBC;AAED,gCAiBC;AApGD,2DAAwD;AAExD,+CAA6D;AAGtD,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,QAAoB,EACpB,SAAqB;IAErB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QACtF,SAAS;KACV,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EACnD,GAAG,EACH,SAAS,CAAC,KAAK,EAAE,CAClB,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAC/C,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACf,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,QAAoB,EACpB,MAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE;QACtF,SAAS;KACV,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAC7B,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAC3C,GAAG,EACH,EAAE,CACH,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,SAAgB,iBAAiB,CAAC,WAAyB;IACzD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACpD,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAiB;IAChD,MAAM,IAAI,GAAiB,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,KAIhC;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,IAAI,6BAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,cAAc,EAAE,MAAM,CAAC,WAAW;YAClC,OAAO,EAAE,IAAA,2BAAa,EAAC,OAAO,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM;QAC/B,MAAM,EAAE,IAAA,2BAAa,EAAC,MAAM,CAAC;QAC7B,KAAK;KACN,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,KAIhC;IACC,MAAM,GAAG,GAAG,IAAI,6BAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,SAAkB,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAA,2BAAa,EAAC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,IAAA,2BAAa,EAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACpG,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,IAAI,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAC3D,CAAC"}

package/dist/core/userkeys/sealedTypes.d.ts

@@ -0,0 +1,72 @@
+export declare const SEALED_KEY_PREFIX = "$sealed:";
+export declare const ENCRYPT_FOR_FIELD = "_encryptFor";
+export declare function sealedKeyId(docId: string): string;
+export declare function isSealedKeyId(keyId: string): boolean;
+export type RecipientSpec = string | {
+    user: string;
+} | {
+    device: string;
+    label?: string;
+} | {
+    devicePem: string;
+    label: string;
+};
+export interface RecipientOptions {
+    includeSelf?: boolean;
+    strict?: boolean;
+}
+export interface EncryptForEntry {
+    kind: "user" | "device";
+    label?: string;
+    addedAt: number;
+    addedBy: string;
+    /** Fingerprint of the public key wrapped to; used for `sealed` on the handle. */
+    keyFingerprint?: string;
+    /**
+     * Legacy field from when recipients could be expanded from a directory group.
+     * No longer written. Still read so older documents keep their payload shape.
+     */
+    viaGroup?: string;
+    removedAt?: number;
+    removedBy?: string;
+}
+export interface RecipientChangeOptions {
+    signingKeyPair?: import("../types").SigningKeyPair;
+    signingKeyPassword?: string;
+    bypassAccessControlPrecheck?: boolean;
+    change?: (doc: import("../types").MindooDoc) => void | Promise<void>;
+    strict?: boolean;
+    /** When setting the list, also keep the caller (default true). */
+    includeSelf?: boolean;
+}
+export interface ResolvedRecipient {
+    kind: "user" | "device";
+    id: string;
+    keyFingerprint: string;
+    label?: string;
+    addedInEpoch: number;
+    sealed: boolean;
+}
+export interface EntryRecipientWrap {
+    kind: "user" | "device";
+    keyFingerprint: string;
+    wrapped: string;
+}
+export interface EntryRecipients {
+    epoch: number;
+    bundle: string;
+    wraps: EntryRecipientWrap[];
+    namesEncrypted?: string;
+}
+export interface RecipientChangeResult {
+    epoch: number;
+    rotated: boolean;
+    added: ResolvedRecipient[];
+    removed: ResolvedRecipient[];
+    skipped: Array<{
+        spec: RecipientSpec;
+        reason: string;
+    }>;
+    entryId: string;
+}
+//# sourceMappingURL=sealedTypes.d.ts.map

package/dist/core/userkeys/sealedTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedTypes.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/sealedTypes.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAC5C,eAAO,MAAM,iBAAiB,gBAAgB,CAAC;AAE/C,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,MAAM,MAAM,aAAa,GACrB,MAAM,GACN;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,OAAO,UAAU,EAAE,cAAc,CAAC;IACnD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,UAAU,EAAE,SAAS,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,OAAO,EAAE,MAAM,CAAC;CACjB"}

package/dist/core/userkeys/sealedTypes.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENCRYPT_FOR_FIELD = exports.SEALED_KEY_PREFIX = void 0;
+exports.sealedKeyId = sealedKeyId;
+exports.isSealedKeyId = isSealedKeyId;
+exports.SEALED_KEY_PREFIX = "$sealed:";
+exports.ENCRYPT_FOR_FIELD = "_encryptFor";
+function sealedKeyId(docId) {
+    return `${exports.SEALED_KEY_PREFIX}${docId}`;
+}
+function isSealedKeyId(keyId) {
+    return keyId.startsWith(exports.SEALED_KEY_PREFIX);
+}
+//# sourceMappingURL=sealedTypes.js.map

package/dist/core/userkeys/sealedTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealedTypes.js","sourceRoot":"","sources":["../../../src/core/userkeys/sealedTypes.ts"],"names":[],"mappings":";;;AAGA,kCAEC;AAED,sCAEC;AATY,QAAA,iBAAiB,GAAG,UAAU,CAAC;AAC/B,QAAA,iBAAiB,GAAG,aAAa,CAAC;AAE/C,SAAgB,WAAW,CAAC,KAAa;IACvC,OAAO,GAAG,yBAAiB,GAAG,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,UAAU,CAAC,yBAAiB,CAAC,CAAC;AAC7C,CAAC"}

package/dist/core/userkeys/types.d.ts

@@ -0,0 +1,70 @@
+export declare const USERKEY_FORM = "userdirectory";
+export declare const USERKEY_TYPE = "userkey";
+export declare const USERKEY_SCHEMA_VERSION = 1;
+export declare const USERKEY_DOC_ID_PREFIX = "userkey_";
+export declare const USERKEY_PRIVATE_SALT = "userkey";
+/** Matches `BaseMindooTenantDirectory.USERNAME_HASH_VERSION` (write version 3). */
+export declare const USERKEY_USERNAME_HASH_VERSION = 3;
+export type UserKeyWaitState = "approved" | "waiting" | "unknown";
+export interface PendingUserKeyDevice {
+    fingerprint: string;
+    signingPublicKey: string;
+    encryptionPublicKey: string;
+    label?: string;
+    addedAt?: number;
+}
+export type UserKeyDeviceStatus = "approved" | "pending" | "declined";
+export interface UserKeyDeviceRow {
+    fingerprint: string;
+    signingPublicKey?: string;
+    encryptionPublicKey?: string;
+    label?: string;
+    addedAt?: number;
+    status: UserKeyDeviceStatus;
+}
+export interface UserKeyEnrollmentStatus {
+    state: UserKeyWaitState;
+    /** True while the published document has no person-written wrap. */
+    pending: boolean;
+    missingKeys: string[];
+}
+export declare function userKeyDocumentId(grantDocId: string): string;
+export interface UserKeyDeviceWrap {
+    wrappedKey: string;
+    label?: string;
+    approvedAt: number;
+    approvedBySigningPublicKey: string;
+}
+export interface UserKeyGeneration {
+    publicKey: string;
+    fingerprint: string;
+    createdAt: number;
+    retiredAt?: number;
+    deviceWraps: Record<string, UserKeyDeviceWrap>;
+}
+export interface RejectedUserKeyDevice {
+    signingPublicKey?: string;
+    rejectedAt: number;
+    rejectedBySigningPublicKey: string;
+}
+export interface UserKeyDocumentPayload {
+    form: typeof USERKEY_FORM;
+    type: typeof USERKEY_TYPE;
+    schemaVersion: number;
+    username_hash: string;
+    username_hash_v: number;
+    userKeys: Record<string, UserKeyGeneration>;
+    rejectedDevices?: Record<string, RejectedUserKeyDevice>;
+}
+export declare function currentUserKeyEpoch(payload: UserKeyDocumentPayload): string | null;
+export declare function isPendingUserKeyDocument(payload: UserKeyDocumentPayload): boolean;
+export declare class UserKeyMismatchError extends Error {
+    readonly name = "UserKeyMismatchError";
+    constructor(message?: string);
+}
+/** Identity already has a User-Key that this session cannot open. */
+export declare class UserKeyDecryptError extends Error {
+    readonly name = "UserKeyDecryptError";
+    constructor(message?: string);
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/userkeys/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/types.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,YAAY,CAAC;AACtC,eAAO,MAAM,sBAAsB,IAAI,CAAC;AACxC,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAChD,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAC9C,mFAAmF;AACnF,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAElE,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,gBAAgB,CAAC;IACxB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,YAAY,CAAC;IAC1B,IAAI,EAAE,OAAO,YAAY,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CACzD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAIlF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAIjF;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,0BAA0B;gBAErC,OAAO,SAA2E;CAIrF;AAED,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,yBAAyB;gBAEpC,OAAO,SAAiK;CAI3K"}

package/dist/core/userkeys/types.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserKeyDecryptError = exports.UserKeyMismatchError = exports.USERKEY_USERNAME_HASH_VERSION = exports.USERKEY_PRIVATE_SALT = exports.USERKEY_DOC_ID_PREFIX = exports.USERKEY_SCHEMA_VERSION = exports.USERKEY_TYPE = exports.USERKEY_FORM = void 0;
+exports.userKeyDocumentId = userKeyDocumentId;
+exports.currentUserKeyEpoch = currentUserKeyEpoch;
+exports.isPendingUserKeyDocument = isPendingUserKeyDocument;
+const types_1 = require("../accesscontrol/types");
+exports.USERKEY_FORM = "userdirectory";
+exports.USERKEY_TYPE = "userkey";
+exports.USERKEY_SCHEMA_VERSION = 1;
+exports.USERKEY_DOC_ID_PREFIX = "userkey_";
+exports.USERKEY_PRIVATE_SALT = "userkey";
+/** Matches `BaseMindooTenantDirectory.USERNAME_HASH_VERSION` (write version 3). */
+exports.USERKEY_USERNAME_HASH_VERSION = 3;
+function userKeyDocumentId(grantDocId) {
+    // Grant ids used to be mixed-case (e.g. `033p0Fh2PNGwn0yTqWp7UE`). Custom
+    // document ids may only be `^[a-z][a-z0-9_]*$`. Encode like ACL ids so
+    // MongoDB hex object ids pass through unchanged and legacy ids stay valid.
+    return `${exports.USERKEY_DOC_ID_PREFIX}${(0, types_1.encodeAclIdComponent)(grantDocId)}`;
+}
+function currentUserKeyEpoch(payload) {
+    const epochs = Object.keys(payload.userKeys ?? {}).filter((k) => /^\d+$/.test(k));
+    if (epochs.length === 0)
+        return null;
+    return epochs.reduce((a, b) => (BigInt(a) > BigInt(b) ? a : b));
+}
+function isPendingUserKeyDocument(payload) {
+    const epochs = Object.values(payload.userKeys ?? {});
+    if (epochs.length === 0)
+        return true;
+    return epochs.every((gen) => Object.keys(gen.deviceWraps ?? {}).length === 0);
+}
+class UserKeyMismatchError extends Error {
+    constructor(message = "Published user public key does not match the key this device generated") {
+        super(message);
+        this.name = "UserKeyMismatchError";
+    }
+}
+exports.UserKeyMismatchError = UserKeyMismatchError;
+/** Identity already has a User-Key that this session cannot open. */
+class UserKeyDecryptError extends Error {
+    constructor(message = "Local User-Key exists but cannot be decrypted with the current password. Refusing to generate a second pair (that would desync acl_keydistribution_default).") {
+        super(message);
+        this.name = "UserKeyDecryptError";
+    }
+}
+exports.UserKeyDecryptError = UserKeyDecryptError;
+//# sourceMappingURL=types.js.map

package/dist/core/userkeys/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/userkeys/types.ts"],"names":[],"mappings":";;;AAsCA,8CAKC;AAiCD,kDAIC;AAED,4DAIC;AAtFD,kDAA8D;AAEjD,QAAA,YAAY,GAAG,eAAe,CAAC;AAC/B,QAAA,YAAY,GAAG,SAAS,CAAC;AACzB,QAAA,sBAAsB,GAAG,CAAC,CAAC;AAC3B,QAAA,qBAAqB,GAAG,UAAU,CAAC;AACnC,QAAA,oBAAoB,GAAG,SAAS,CAAC;AAC9C,mFAAmF;AACtE,QAAA,6BAA6B,GAAG,CAAC,CAAC;AA8B/C,SAAgB,iBAAiB,CAAC,UAAkB;IAClD,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,OAAO,GAAG,6BAAqB,GAAG,IAAA,4BAAoB,EAAC,UAAU,CAAC,EAAE,CAAC;AACvE,CAAC;AAiCD,SAAgB,mBAAmB,CAAC,OAA+B;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,wBAAwB,CAAC,OAA+B;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IAE7C,YACE,OAAO,GAAG,wEAAwE;QAElF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAG,sBAAsB,CAAC;IAKvC,CAAC;CACF;AAPD,oDAOC;AAED,qEAAqE;AACrE,MAAa,mBAAoB,SAAQ,KAAK;IAE5C,YACE,OAAO,GAAG,8JAA8J;QAExK,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAG,qBAAqB,CAAC;IAKtC,CAAC;CACF;AAPD,kDAOC"}

package/dist/core/userkeys/validateUserKeyDocument.d.ts

@@ -0,0 +1,19 @@
+import type { MindooTenantDirectory } from "../types";
+import { type UserKeyDocumentPayload } from "./types";
+export interface ValidateUserKeyInput {
+    payload: unknown;
+    /** Signing public key of the `doc_create` entry (or of the change being judged). */
+    signerKey: string;
+    usernameHashCandidates: string[];
+    directory: MindooTenantDirectory;
+    /** Admin create of a pending document is valid even though the signer is not the person. */
+    adminPublicKey?: string;
+    trustedTime?: number;
+}
+/**
+ * §6.4 binding: the payload has the userkey shape, `username_hash` matches
+ * the person, and the create signer is either that person or the tenant admin.
+ */
+export declare function validateUserKeyDocument(input: ValidateUserKeyInput): Promise<UserKeyDocumentPayload | null>;
+export declare function asUserKeyPayload(payload: unknown): UserKeyDocumentPayload | null;
+//# sourceMappingURL=validateUserKeyDocument.d.ts.map

package/dist/core/userkeys/validateUserKeyDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateUserKeyDocument.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/validateUserKeyDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,qBAAqB,CAAC;IACjC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAoBxC;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAShF"}

package/dist/core/userkeys/validateUserKeyDocument.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateUserKeyDocument = validateUserKeyDocument;
+exports.asUserKeyPayload = asUserKeyPayload;
+const types_1 = require("./types");
+/**
+ * §6.4 binding: the payload has the userkey shape, `username_hash` matches
+ * the person, and the create signer is either that person or the tenant admin.
+ */
+async function validateUserKeyDocument(input) {
+    const payload = asUserKeyPayload(input.payload);
+    if (!payload)
+        return null;
+    if (!input.usernameHashCandidates.includes(payload.username_hash)) {
+        return null;
+    }
+    if (input.adminPublicKey && input.signerKey === input.adminPublicKey) {
+        return payload;
+    }
+    if (typeof input.directory.resolveUsernameHashForSigningKey !== "function") {
+        return null;
+    }
+    const signerHash = await input.directory.resolveUsernameHashForSigningKey(input.signerKey, input.trustedTime ?? Number.MAX_SAFE_INTEGER);
+    if (!signerHash || signerHash !== payload.username_hash) {
+        return null;
+    }
+    return payload;
+}
+function asUserKeyPayload(payload) {
+    if (!payload || typeof payload !== "object")
+        return null;
+    const data = payload;
+    if (data.form !== types_1.USERKEY_FORM || data.type !== types_1.USERKEY_TYPE)
+        return null;
+    if (typeof data.username_hash !== "string" || data.username_hash.length === 0) {
+        return null;
+    }
+    if (!data.userKeys || typeof data.userKeys !== "object")
+        return null;
+    return data;
+}
+//# sourceMappingURL=validateUserKeyDocument.js.map

package/dist/core/userkeys/validateUserKeyDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateUserKeyDocument.js","sourceRoot":"","sources":["../../../src/core/userkeys/validateUserKeyDocument.ts"],"names":[],"mappings":";;AAsBA,0DAsBC;AAED,4CASC;AAtDD,mCAIiB;AAajB;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAA2B;IAE3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,gCAAgC,KAAK,UAAU,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,gCAAgC,CACvE,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,CAC7C,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,OAAkC,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAY,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAY;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,IAAyC,CAAC;AACnD,CAAC"}