mindoodb 0.0.50 → 0.0.53

package/dist/core/BaseMindooDB.js

@@ -24,8 +24,12 @@ const copyDocuments_1 = require("./copy/copyDocuments");
 const materializationGuard_1 = require("./accesscontrol/materializationGuard");
 const Ed25519WitnessProvider_1 = require("./accesscontrol/timestamp/Ed25519WitnessProvider");
 const AccessDeniedError_1 = require("./accesscontrol/AccessDeniedError");
+const DirectoryStateNode_1 = require("./accesscontrol/DirectoryStateNode");
 const logging_1 = require("./logging");
 const databaseIdValidation_1 = require("./databaseIdValidation");
+const builtinDbInvariants_1 = require("./builtinDbInvariants");
+const recipients_1 = require("./userkeys/recipients");
+const sealedTypes_1 = require("./userkeys/sealedTypes");
 const DocumentSummaryStore_1 = require("./indexing/summary/DocumentSummaryStore");
 const types_4 = require("./indexing/summary/types");
 const DocumentFullTextIndex_1 = require("./indexing/fulltext/DocumentFullTextIndex");
@@ -219,12 +223,13 @@ class BaseMindooDB {
          */
         this.aclActiveCache = null;
         /**
-         * Per-document cache of the original creator's signing public key (the
-         * `doc_create` entry's `createdByPublicKey`). Used by the client write
-         * prechecks to resolve `$author` (`isAuthor`) without re-scanning metadata on
-         * every change/delete. Populated on create and lazily on first lookup.
+         * Per-document cache of the original creator's signing public key and the
+         * trusted time of the `doc_create` entry. Used by the client write prechecks
+         * to resolve `$author` (`isAuthor`) at grant level without re-scanning
+         * metadata on every change/delete. Populated on create and lazily on first
+         * lookup.
          */
-        this.creatorKeyCache = new Map();
+        this.creatorInfoCache = new Map();
         // Internal changefeed index: sorted by (changeSeq, docId) for deterministic iteration.
         // lastModified remains available for UX metadata but is not the primary cursor key.
         this.index = [];
@@ -453,6 +458,10 @@ class BaseMindooDB {
          * the warmer settled can still display its outcome.
          */
         this.warmerProgress = null;
+        /** `username_hash` per userdirectory document, filled from creates. */
+        this.userdirectoryHashByDocId = new Map();
+        /** Grant `username_hash` for a signing public key at "now". */
+        this.signerUsernameHashByKey = new Map();
         // ---------------------------------------------------------------------------
         // Author-trust reconciliation: heal documents whose entries were skipped
         // because their author was not yet known to the tenant directory.
@@ -528,6 +537,125 @@ class BaseMindooDB {
     getAdminPublicKey() {
         return this.tenant.getAdministrationPublicKey();
     }
+    /**
+     * Database id used by the builtin-write registry. Admin-only databases that
+     * are not `userdirectory` are treated like `directory` (admin-only writes).
+     */
+    effectiveBuiltinDbId() {
+        const dbId = this.store.getId();
+        if (this._isAdminOnlyDb && dbId !== types_1.USER_DIRECTORY_DB_ID) {
+            return types_1.DIRECTORY_DB_ID;
+        }
+        return dbId;
+    }
+    usernameHashFromRecord(payload) {
+        if (!payload || typeof payload !== "object")
+            return null;
+        const value = payload.username_hash;
+        return typeof value === "string" && value.length > 0 ? value : null;
+    }
+    usernameHashFromInternalDoc(internalDoc) {
+        return this.usernameHashFromRecord(this.convertAutomergeToJS(internalDoc.doc));
+    }
+    async resolveSignerUsernameHash(signerKey) {
+        try {
+            const directory = await this.tenant.openDirectory();
+            if (typeof directory.resolveUsernameHashForSigningKey !== "function") {
+                return null;
+            }
+            return directory.resolveUsernameHashForSigningKey(signerKey, Number.MAX_SAFE_INTEGER);
+        }
+        catch {
+            return null;
+        }
+    }
+    async resolveSignerPublicKey(signingKeyPair) {
+        if (signingKeyPair)
+            return signingKeyPair.publicKey;
+        return (await this.tenant.getCurrentUserId()).userSigningPublicKey;
+    }
+    /**
+     * Hard-wired write gate for `directory` / `userdirectory` (and other
+     * admin-only databases). Independent of the ACL master switch.
+     */
+    async assertBuiltinWriteAllowed(op, signerPublicKey, documentUsernameHash) {
+        const dbId = this.effectiveBuiltinDbId();
+        if (!(0, builtinDbInvariants_1.hasBuiltinWriteInvariant)(dbId) && !this._isAdminOnlyDb) {
+            return;
+        }
+        let signerUsernameHash = null;
+        if (dbId === types_1.USER_DIRECTORY_DB_ID) {
+            signerUsernameHash = await this.resolveSignerUsernameHash(signerPublicKey);
+            this.signerUsernameHashByKey.set(signerPublicKey, signerUsernameHash);
+        }
+        const decision = (0, builtinDbInvariants_1.evaluateBuiltinWrite)({
+            dbId,
+            op,
+            signerKey: signerPublicKey,
+            adminPublicKey: this.getAdminPublicKey(),
+            documentUsernameHash,
+            signerUsernameHash,
+        });
+        if (!decision.allowed) {
+            throw new Error(decision.reason);
+        }
+    }
+    /**
+     * Load-path counterpart: drop entries that the builtin invariant forbids.
+     * Username-hash matching for userdirectory creates is enforced on write and
+     * on the server. Admin-signed changes load only when the signer is also the
+     * person named by the document (the tenant founder wrapping their own key).
+     */
+    async shouldSkipLoadedEntryForBuiltin(entry) {
+        const dbId = this.effectiveBuiltinDbId();
+        const entryType = entry.entryType ?? "doc_change";
+        let documentUsernameHash = null;
+        let signerUsernameHash = null;
+        if (dbId === types_1.USER_DIRECTORY_DB_ID &&
+            (entryType === "doc_change" || entryType === "doc_snapshot") &&
+            entry.docId) {
+            documentUsernameHash = await this.ensureUserdirectoryDocHash(entry.docId);
+            signerUsernameHash = await this.ensureSignerUsernameHash(entry.createdByPublicKey);
+        }
+        return (0, builtinDbInvariants_1.shouldSkipLoadedEntry)({
+            dbId,
+            entryType,
+            signerKey: entry.createdByPublicKey,
+            adminPublicKey: this.getAdminPublicKey(),
+            documentUsernameHash,
+            signerUsernameHash,
+        });
+    }
+    async ensureSignerUsernameHash(signerKey) {
+        if (this.signerUsernameHashByKey.has(signerKey)) {
+            return this.signerUsernameHashByKey.get(signerKey) ?? null;
+        }
+        const hash = await this.resolveSignerUsernameHash(signerKey);
+        this.signerUsernameHashByKey.set(signerKey, hash);
+        return hash;
+    }
+    async ensureUserdirectoryDocHash(docId) {
+        const cached = this.userdirectoryHashByDocId.get(docId);
+        if (cached)
+            return cached;
+        try {
+            const metas = await this.scanAllMetadata(this.store, { docId });
+            const create = metas.find((meta) => meta.entryType === "doc_create");
+            if (!create)
+                return null;
+            const [entry] = await this.store.getEntries([create.id]);
+            if (!entry)
+                return null;
+            const decrypted = await this.tenant.decryptPayload(entry.encryptedData, entry.decryptionKeyId);
+            const hash = (0, builtinDbInvariants_1.usernameHashFromCreateChangeBytes)(decrypted);
+            if (hash)
+                this.userdirectoryHashByDocId.set(docId, hash);
+            return hash;
+        }
+        catch {
+            return null;
+        }
+    }
     isAdminOnlyDb() {
         return this._isAdminOnlyDb;
     }
@@ -715,7 +843,7 @@ class BaseMindooDB {
         // indexing (DirectoryTimeTravelIndex) and its change events interleave
         // with access-control evaluation; admin-only databases hold no user
         // data worth summarizing. Explicit getSummaryStore() calls still work.
-        if (this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         const hasSetupChange = changes.some((change) => change.docId === types_4.DB_SETUP_DOC_ID);
@@ -950,7 +1078,7 @@ class BaseMindooDB {
             return;
         }
         // Same system-database exclusion as the summary auto-activation.
-        if (this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         const hasSetupChange = changes.some((change) => change.docId === types_4.DB_SETUP_DOC_ID);
@@ -1557,27 +1685,34 @@ class BaseMindooDB {
     /**
      * Get or import a CryptoKey for signature verification, with caching.
      * This avoids re-importing the same public key multiple times.
+     *
+     * Trust is evaluated at `trustedTime` when provided (grant membership in the
+     * directory node covering that time, or the tenant admin key). Callers that
+     * omit it keep the historical HEAD check via `validatePublicSigningKey`.
      */
-    async getOrImportPublicKey(publicKey) {
-        // Check cache first
-        if (this.publicKeyCache.has(publicKey)) {
-            return this.publicKeyCache.get(publicKey);
-        }
-        // Validate the public key is trusted
+    async getOrImportPublicKey(publicKey, trustedTime) {
         const directory = await this.tenant.openDirectory();
-        const isTrusted = await directory.validatePublicSigningKey(publicKey);
+        let isTrusted = false;
+        if (trustedTime !== undefined && typeof directory.getDirectoryStateAt === "function") {
+            const node = await directory.getDirectoryStateAt(trustedTime);
+            isTrusted =
+                !!(0, DirectoryStateNode_1.grantForSigningKey)(node, publicKey) || publicKey === this.getAdminPublicKey();
+        }
+        else {
+            isTrusted = await directory.validatePublicSigningKey(publicKey);
+        }
         if (!isTrusted) {
             this.logger.warn(`Public key not trusted: ${publicKey}`);
             return null;
         }
-        // Import the key
+        const cached = this.publicKeyCache.get(publicKey);
+        if (cached)
+            return cached;
         const subtle = this.tenant.getCryptoAdapter().getSubtle();
         const publicKeyBuffer = this.tenant.pemToArrayBuffer(publicKey);
         const cryptoKey = await subtle.importKey("spki", publicKeyBuffer, {
             name: "Ed25519",
-        }, false, // not extractable
-        ["verify"]);
-        // Cache the imported key
+        }, false, ["verify"]);
         this.publicKeyCache.set(publicKey, cryptoKey);
         return cryptoKey;
     }
@@ -2055,7 +2190,7 @@ class BaseMindooDB {
         if (!this.summaryAutoUpdateEnabled || this.summarySetupProbed || this.summaryStore) {
             return;
         }
-        if (this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         this.summarySetupProbed = true;
@@ -2089,7 +2224,7 @@ class BaseMindooDB {
         if (!this.fulltextAutoUpdateEnabled || this.fulltextSetupProbed || this.fulltextIndex) {
             return;
         }
-        if (this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         if (this.isTimeTravelMode()) {
@@ -2254,10 +2389,7 @@ class BaseMindooDB {
             }
             const existingIndex = this.getDocIndexPosition(docId);
             const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
-            // Visibility is governed by key possession alone: documents whose
-            // decryption key is in the bag are visible; the rest are hidden. Which
-            // keys a user holds is governed by the key distribution model
-            // (docs/accesscontrol.md §13), not by a server/client read gate.
+            await this.tenant.ingestSealedFromEntries?.(visibility.decryptionKeyId, metadataByDoc.get(docId));
             const canRead = await this.tenant.hasDecryptionKey(visibility.decryptionKeyId);
             if (canRead) {
                 // Reveal-on-add only triggers when the previous state was
@@ -2407,7 +2539,7 @@ class BaseMindooDB {
      *     directory was synced in a session that never opened this DB).
      */
     async reconcileAuthorTrustAtOpen() {
-        if (this.isTimeTravelMode() || this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this.isTimeTravelMode() || this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         if (this.legacyCheckpointNeedsAuthorTrustScan) {
@@ -2601,6 +2733,10 @@ class BaseMindooDB {
                 const cachedDoc = this.getCachedDocument(docId);
                 let updatedDoc = null;
                 if (cachedDoc) {
+                    if (await this.dropSealedAccessIfUnwrapFailed(cachedDoc)) {
+                        this.logger.debug(`Dropping cached sealed document ${docId} — newest wrap is not for this user`);
+                        return;
+                    }
                     // Document is cached - try incremental update
                     this.logger.debug(`Document ${docId} found in cache, attempting incremental update`);
                     try {
@@ -2646,9 +2782,18 @@ class BaseMindooDB {
                         // Before indexing, verify the user has the decryption key so that
                         // documents the user cannot access do not appear in getAllDocumentIds.
                         const representativeEntry = docLifecycleEntries[0];
+                        await this.tenant.ingestSealedFromEntries?.(representativeEntry.decryptionKeyId, docLifecycleEntries);
                         const keyAvailable = await this.tenant.hasDecryptionKey(representativeEntry.decryptionKeyId);
                         if (!keyAvailable) {
                             this.logger.debug(`Skipping metadata-first index for doc ${docId} — decryption key "${representativeEntry.decryptionKeyId}" not available`);
+                            const existingIndex = this.getDocIndexPosition(docId);
+                            const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
+                            if (existing?.accessState === "visible") {
+                                await this.purgeMaterializedDocument(docId);
+                                this.updateIndex(docId, existing.lastModified, true, representativeEntry.decryptionKeyId, "inaccessible");
+                                this.cacheMetaDirty = true;
+                                this.cacheManager?.markDirty();
+                            }
                         }
                         else {
                             // Cold sync: entryMetadataList is already the full doc history from
@@ -3861,8 +4006,8 @@ class BaseMindooDB {
         return stripped.length > 0 ? stripped : undefined;
     }
     /**
-     * Generate a fresh document id (`<prefix>_<22-char-base62(uuidv7)>`, or the
-     * bare base62 part without a prefix) that does not collide with any document
+     * Generate a fresh document id (`<prefix>_<24-char-objectid>`, or the
+     * bare ObjectId without a prefix) that does not collide with any document
      * already present in the local index. A collision is practically impossible
      * (128-bit UUID7), so this is only a cheap O(1) safety net reusing the
      * existing `indexLookup` map — no extra bookkeeping.
@@ -3879,10 +4024,10 @@ class BaseMindooDB {
      * Internal method to create a new document.
      *
      * Handles the creation flavors expressible through `CreateOptions`:
-     * - generated ID (time-sortable base62-encoded UUID7), current user signs,
+     * - generated ID (time-sortable MongoDB-style ObjectId), current user signs,
      *   default tenant key
      * - generated ID with custom signing key (e.g. directory admin operations)
-     * - generated ID with a caller-provided `idPrefix` (`<prefix>_<base62>`)
+     * - generated ID with a caller-provided `idPrefix` (`<prefix>_<objectId>`)
      * - caller-provided ID, current user signs (idempotent on existing IDs)
      * - caller-provided ID with custom signing key
      *
@@ -3899,7 +4044,6 @@ class BaseMindooDB {
             throw new Error("createDocument: signingKeyPair and signingKeyPassword must be provided together");
         }
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
-        const keyId = await this.resolveCreateKeyId(options);
         const useCustomDocId = options.id !== undefined;
         this.validateIdPrefixOption("createDocument", options);
         this.validateAssumeUniqueIdOption("createDocument", options);
@@ -3931,17 +4075,14 @@ class BaseMindooDB {
                 throw new Error("createDocument: initialValues is not supported together with a custom id; " +
                     "create the document, then apply values with changeDoc().");
             }
-        }
-        // Admin-only validation: only admin key can modify data in admin-only databases
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const signerPublicKey = useCustomSigningKey
-                ? signingKeyPair.publicKey
-                : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            if (signerPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
+            if (useDeterministicSeed && options.recipients !== undefined) {
+                throw new Error("createDocument: recipients is not supported together with a convergent custom id; " +
+                    "pass assumeUniqueId for random ids.");
             }
         }
+        const signerPublicKey = await this.resolveSignerPublicKey(useCustomSigningKey ? signingKeyPair : undefined);
+        const createUsernameHash = this.usernameHashFromRecord(Object.fromEntries(initialValueEntries));
+        await this.assertBuiltinWriteAllowed("doc_create", signerPublicKey, createUsernameHash);
         const docId = useCustomDocId ? options.id : this.generateUnusedDocId(options.idPrefix);
         // Idempotent create: when a caller-provided id already exists locally,
         // return the existing document instead of producing a duplicate doc_create.
@@ -3961,6 +4102,7 @@ class BaseMindooDB {
                 return this.wrapDocument(existing);
             }
         }
+        const keyId = await this.resolveCreateKeyId(options, docId);
         this.logger.debug(`Creating document ${docId} with key ${keyId}${useCustomSigningKey ? ' using custom signing key' : ''}${useCustomDocId ? ' with caller-provided id' : ''}`);
         // Build the initial Automerge document and its first change bytes.
         //
@@ -3970,6 +4112,7 @@ class BaseMindooDB {
         // replicas using the same id produce the same Automerge hash and
         // `doc_create` entry id, allowing later changes to merge.
         const now = (0, timeSource_1.semanticNow)();
+        const sealedCreate = await this.prepareSealedCreate(options, docId, keyId, now, signerPublicKey);
         let newDoc;
         let changeBytes;
         if (useDeterministicSeed) {
@@ -3995,6 +4138,9 @@ class BaseMindooDB {
                     // Store metadata in the document payload
                     // We need to modify the document to ensure a change is created
                     doc._attachments = [];
+                    if (sealedCreate) {
+                        (0, recipients_1.applyEncryptForCreate)(doc, sealedCreate.encryptFor);
+                    }
                     // Seed caller-provided initial values within the same doc_create
                     // change so a doc_create Tier 2 rule can evaluate them in the
                     // "after" state (docs/accesscontrol.md §6.3, §9).
@@ -4074,9 +4220,12 @@ class BaseMindooDB {
             createdByPublicKey = currentUser.userSigningPublicKey;
         }
         this.logger.debug(`Signed payload, signature length: ${signature.length} bytes`);
-        // Remember the creator's signing key so $author prechecks on subsequent
-        // change/delete operations don't need a metadata scan.
-        this.creatorKeyCache.set(docId, createdByPublicKey);
+        // Remember the creator so $author prechecks on subsequent change/delete
+        // operations don't need a metadata scan. `now` is the local createdAt;
+        // a later witness may stamp receivedAt, which resolveCreatorInfo picks up
+        // on a cache miss. For the local writer, createdAt is sufficient: the
+        // creating device is still granted.
+        this.creatorInfoCache.set(docId, { signingKey: createdByPublicKey, trustedTime: now });
         // Snapshot of attachments referenced by the freshly created doc (normally
         // empty; the public create API does not add attachments inline).
         const createAttachmentRefs = this.collectAttachmentRefs(newDoc);
@@ -4094,6 +4243,7 @@ class BaseMindooDB {
             originalSize: changeBytes.length,
             encryptedSize: encryptedPayload.length,
             attachmentRefs: createAttachmentRefs.length > 0 ? createAttachmentRefs : undefined,
+            recipients: sealedCreate?.recipients,
             entryVersion: types_1.CURRENT_STORE_ENTRY_VERSION,
         };
         // Bind the metadata with the author signature (audit finding #5).
@@ -4123,6 +4273,7 @@ class BaseMindooDB {
             isDeleted: false,
             awaitingWitness,
             witnessed,
+            sealedRecipients: sealedCreate?.recipients,
         };
         // Update cache and index
         await this.storeCachedDocument(internalDoc);
@@ -4149,7 +4300,6 @@ class BaseMindooDB {
             throw new Error("createDocuments: signingKeyPair and signingKeyPassword must be provided together");
         }
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
-        const keyId = await this.resolveCreateKeyId(options);
         const useCustomDocId = options.id !== undefined;
         this.validateIdPrefixOption("createDocuments", options);
         this.validateAssumeUniqueIdOption("createDocuments", options);
@@ -4157,24 +4307,22 @@ class BaseMindooDB {
         // out of the deterministic seed, so initialValues fold into doc_create
         // and the document costs a single store entry.
         const useDeterministicSeed = useCustomDocId && !options.assumeUniqueId;
+        if (useDeterministicSeed && options.recipients !== undefined) {
+            throw new Error("createDocuments: recipients is not supported together with a convergent custom id; pass assumeUniqueId");
+        }
         // Sanitize caller-provided initial values: internal/reserved fields are
         // managed by MindooDB and must not be seeded by callers. `undefined`
         // values are treated as "not set" (Automerge cannot represent undefined).
         const initialValueEntries = options.initialValues
             ? Object.entries(options.initialValues).filter(([k, v]) => !k.startsWith("_") && v !== undefined)
             : [];
-        // Admin-only validation: only admin key can modify data in admin-only databases
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const signerPublicKey = useCustomSigningKey
-                ? signingKeyPair.publicKey
-                : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            if (signerPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
+        const signerPublicKey = await this.resolveSignerPublicKey(useCustomSigningKey ? signingKeyPair : undefined);
+        const createUsernameHash = this.usernameHashFromRecord(Object.fromEntries(initialValueEntries));
+        await this.assertBuiltinWriteAllowed("doc_create", signerPublicKey, createUsernameHash);
         const docId = useCustomDocId ? options.id : this.generateUnusedDocId(options.idPrefix);
         const now = (0, timeSource_1.semanticNow)();
+        const keyId = await this.resolveCreateKeyId(options, docId);
+        const sealedCreate = await this.prepareSealedCreate(options, docId, keyId, now, signerPublicKey);
         // Build the initial Automerge document and its first change bytes,
         // following the same seeding rules as the single-create path.
         let seedDoc;
@@ -4189,6 +4337,9 @@ class BaseMindooDB {
             const initialDoc = automerge_adapter_1.Automerge.init();
             seedDoc = automerge_adapter_1.Automerge.change(initialDoc, (doc) => {
                 doc._attachments = [];
+                if (sealedCreate) {
+                    (0, recipients_1.applyEncryptForCreate)(doc, sealedCreate.encryptFor);
+                }
                 // Seed caller-provided initial values within the same doc_create change
                 // so a doc_create Tier 2 rule can evaluate them in the "after" state.
                 for (const [key, value] of initialValueEntries) {
@@ -4254,9 +4405,12 @@ class BaseMindooDB {
             signature = await this.tenant.signPayload(encryptedPayload);
             createdByPublicKey = currentUser.userSigningPublicKey;
         }
-        // Remember the creator's signing key so $author prechecks on subsequent
-        // change/delete operations don't need a metadata scan.
-        this.creatorKeyCache.set(docId, createdByPublicKey);
+        // Remember the creator so $author prechecks on subsequent change/delete
+        // operations don't need a metadata scan. `now` is the local createdAt;
+        // a later witness may stamp receivedAt, which resolveCreatorInfo picks up
+        // on a cache miss. For the local writer, createdAt is sufficient: the
+        // creating device is still granted.
+        this.creatorInfoCache.set(docId, { signingKey: createdByPublicKey, trustedTime: now });
         const createAttachmentRefs = this.collectAttachmentRefs(finalDoc);
         const entryMetadata = {
             entryType: "doc_create",
@@ -4271,6 +4425,7 @@ class BaseMindooDB {
             originalSize: createChangeBytes.length,
             encryptedSize: encryptedPayload.length,
             attachmentRefs: createAttachmentRefs.length > 0 ? createAttachmentRefs : undefined,
+            recipients: sealedCreate?.recipients,
             entryVersion: types_1.CURRENT_STORE_ENTRY_VERSION,
         };
         // Bind the metadata with the author signature (audit finding #5).
@@ -4317,6 +4472,7 @@ class BaseMindooDB {
             isDeleted: false,
             awaitingWitness,
             witnessed,
+            sealedRecipients: sealedCreate?.recipients,
         };
         return { internalDoc, entries };
     }
@@ -4335,6 +4491,9 @@ class BaseMindooDB {
         this.logger.debug(`Getting document ${docId} at timestamp ${timestamp}`);
         // Get all entry metadata for this document
         const allEntryMetadata = await this.scanAllMetadata(this.store, { docId });
+        if (allEntryMetadata.length > 0) {
+            await this.ingestSealedKeyFromEntries(allEntryMetadata);
+        }
         // Filter to document replay metadata plus snapshots up to the timestamp.
         // Attachment chunks are not part of the Automerge replay DAG and must not
         // participate in historical materialization.
@@ -4380,7 +4539,7 @@ class BaseMindooDB {
             if (snapshotEntries.length > 0) {
                 const snapshotData = snapshotEntries[0];
                 let isValid = false;
-                if (this._isAdminOnlyDb && snapshotData.createdByPublicKey !== this.getAdminPublicKey()) {
+                if (await this.shouldSkipLoadedEntryForBuiltin(snapshotData)) {
                     this.logger.warn(`Admin-only DB: skipping snapshot ${snapshotData.id} not signed by admin key`);
                 }
                 else {
@@ -4427,7 +4586,7 @@ class BaseMindooDB {
                 this.logger.warn(`Entry ${entryMeta.id} not found in store, skipping`);
                 continue;
             }
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
                 continue;
             }
@@ -4470,10 +4629,62 @@ class BaseMindooDB {
         });
         return this.wrapDocument(internalDoc);
     }
+    /**
+     * Unwrap a `$sealed:` DEK from entry recipient wraps into the tenant session
+     * cache. `loadDocumentInternal` already does this; history / timestamp reads
+     * must as well — otherwise Haven's revision list throws SymmetricKeyNotFoundError
+     * on a cold tenant even when this device is in the wrap list.
+     */
+    async ingestSealedKeyFromEntries(entries) {
+        if (entries.length === 0)
+            return;
+        const keyId = entries.find((entry) => entry.entryType === "doc_create")?.decryptionKeyId
+            ?? entries[0].decryptionKeyId;
+        await this.tenant.ingestSealedFromEntries?.(keyId, entries);
+    }
+    /**
+     * Re-ingest the newest sealed wrap list. When this replica can no longer
+     * unwrap it (recipient removal), drop the leftover session DEK and any
+     * materialized plaintext so later honest-client writes cannot reuse it.
+     *
+     * @returns true when access was revoked
+     */
+    async dropSealedAccessIfUnwrapFailed(internalDoc) {
+        if (!(0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId)) {
+            return false;
+        }
+        const metas = await this.scanAllMetadata(this.store, { docId: internalDoc.id });
+        await this.ingestSealedKeyFromEntries(metas);
+        if (await this.tenant.hasDecryptionKey(internalDoc.decryptionKeyId)) {
+            return false;
+        }
+        await this.purgeMaterializedDocument(internalDoc.id);
+        const existingIndex = this.getDocIndexPosition(internalDoc.id);
+        const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
+        if (existing?.accessState === "visible") {
+            this.updateIndex(internalDoc.id, existing.lastModified, true, internalDoc.decryptionKeyId, "inaccessible");
+            this.cacheMetaDirty = true;
+            this.cacheManager?.markDirty();
+        }
+        return true;
+    }
+    /**
+     * Patch paths (`applyTextPatch`, rich-text, Automerge) used to persist with
+     * a leftover session DEK after the newest wrap excluded this user.
+     * `changeDoc` already refused those writes; this is the shared chokepoint.
+     */
+    async assertCurrentSealedAccess(internalDoc) {
+        if (await this.dropSealedAccessIfUnwrapFailed(internalDoc)) {
+            throw new errors_1.DocumentNotFoundError(internalDoc.id);
+        }
+    }
     async *iterateDocumentHistory(docId) {
         this.logger.debug(`Iterating document history for ${docId}`);
         // Get all entry metadata for this document
         const allEntryMetadata = await this.scanAllMetadata(this.store, { docId });
+        if (allEntryMetadata.length > 0) {
+            await this.ingestSealedKeyFromEntries(allEntryMetadata);
+        }
         // Filter to document replay entries (exclude snapshots) and order them
         // causally: a plain chronological sort can place an effect before its
         // cause when several entries share the same millisecond (or when replica
@@ -4486,6 +4697,7 @@ class BaseMindooDB {
         }
         // Load all entries
         const entries = await this.store.getEntries(relevantEntries.map(em => em.id));
+        await this.ingestSealedKeyFromEntries(entries.length > 0 ? entries : relevantEntries);
         // Build a map for quick lookup
         const entryMap = new Map(entries.map(e => [e.id, e]));
         // Apply changes in order
@@ -4500,7 +4712,7 @@ class BaseMindooDB {
                 continue;
             }
             // Admin-only mode: only accept entries signed by the admin key
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
                 continue;
             }
@@ -4660,14 +4872,14 @@ class BaseMindooDB {
         // leading witnessed prefix.
         let stableCursor = cursor;
         let sawProvisional = false;
-        const consider = (em) => {
+        const consider = async (em) => {
             if (!this.isDocumentReplayEntry(em)) {
                 return;
             }
             // Admin-only mode: only accept entries signed by the admin key (mirrors
             // materialization / iterateDocumentHistory). Non-admin entries are
             // permanently ignored and do not gate the stable cursor.
-            if (this._isAdminOnlyDb && em.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(em)) {
                 return;
             }
             newEntries.push(em);
@@ -4699,7 +4911,7 @@ class BaseMindooDB {
             while (true) {
                 const page = await this.store.scanEntriesSince(scanCursor, 1000, scanFilters);
                 for (const em of page.entries) {
-                    consider(em);
+                    await consider(em);
                 }
                 scanCursor = page.nextCursor;
                 if (!page.hasMore) {
@@ -4720,7 +4932,7 @@ class BaseMindooDB {
                 if (cursor && !this.isAfterReceiptCursor(em, cursor)) {
                     continue;
                 }
-                consider(em);
+                await consider(em);
             }
         }
         return { newEntries, resumeCursor: stableCursor };
@@ -4749,10 +4961,12 @@ class BaseMindooDB {
         // All metadata for this doc (metadata only, cheap). Includes snapshots, used
         // for cache-miss seed reconstruction.
         const docAllMeta = await this.scanAllMetadata(this.store, { docId });
-        let replayMeta = docAllMeta.filter((em) => this.isDocumentReplayEntry(em));
-        if (this._isAdminOnlyDb) {
-            const adminKey = this.getAdminPublicKey();
-            replayMeta = replayMeta.filter((em) => em.createdByPublicKey === adminKey);
+        const replayCandidates = docAllMeta.filter((em) => this.isDocumentReplayEntry(em));
+        const replayMeta = [];
+        for (const em of replayCandidates) {
+            if (!(await this.shouldSkipLoadedEntryForBuiltin(em))) {
+                replayMeta.push(em);
+            }
         }
         if (replayMeta.length === 0) {
             return;
@@ -4951,7 +5165,7 @@ class BaseMindooDB {
             return null;
         }
         const snapshotData = entries[0];
-        if (this._isAdminOnlyDb && snapshotData.createdByPublicKey !== this.getAdminPublicKey()) {
+        if (await this.shouldSkipLoadedEntryForBuiltin(snapshotData)) {
             this.logger.warn(`Admin-only DB: skipping snapshot ${snapshotData.id} not signed by admin key`);
             return null;
         }
@@ -5120,7 +5334,7 @@ class BaseMindooDB {
                 result.set(metadata.id, null);
                 continue;
             }
-            if (this._isAdminOnlyDb && entry.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entry)) {
                 result.set(metadata.id, null);
                 continue;
             }
@@ -5286,7 +5500,7 @@ class BaseMindooDB {
             const entry = entries[0];
             if (entry) {
                 let isValid = false;
-                if (this._isAdminOnlyDb && entry.createdByPublicKey !== this.getAdminPublicKey()) {
+                if (await this.shouldSkipLoadedEntryForBuiltin(entry)) {
                     this.logger.warn(`Admin-only DB: skipping DAG details for ${entry.id} not signed by admin key`);
                 }
                 else {
@@ -5983,7 +6197,7 @@ class BaseMindooDB {
                 this.logger.warn(`Conflict analysis: entry ${metadata.id} not found in store, skipping`);
                 continue;
             }
-            if (this._isAdminOnlyDb && entry.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entry)) {
                 this.logger.warn(`Admin-only DB: skipping conflict analysis entry ${entry.id} not signed by admin key`);
                 continue;
             }
@@ -6425,7 +6639,7 @@ class BaseMindooDB {
             createdAt: createdAtByDocId.get(entry.docId) ?? entry.lastModified,
             isDeleted: entry.isDeleted,
         }));
-        // Plain comparison, NOT localeCompare: ids are base62 in ASCII order and
+        // Plain comparison, NOT localeCompare: ids are ObjectIds in ASCII order and
         // locale collation would reorder digits against letters, so the tie-break
         // for same-millisecond documents would no longer follow their ids.
         results.sort((left, right) => left.createdAt !== right.createdAt
@@ -6533,7 +6747,7 @@ class BaseMindooDB {
         if (docIds.length === 0) {
             return;
         }
-        await this.assertLifecycleMutationAllowed(options.signingKeyPair, options.signingKeyPassword);
+        await this.assertLifecycleMutationAllowed("doc_delete", options.signingKeyPair, options.signingKeyPassword);
         this.logger.info(`Bulk-deleting ${docIds.length} documents`);
         // Unlike creation, a delete must first materialize the CURRENT document
         // (the doc_delete entry is an Automerge change on its heads), which costs
@@ -6580,21 +6794,14 @@ class BaseMindooDB {
     async undeleteDocument(docId, options = {}) {
         return this.undeleteDocInternal(docId, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck);
     }
-    async assertLifecycleMutationAllowed(signingKeyPair, signingKeyPassword) {
+    async assertLifecycleMutationAllowed(op, signingKeyPair, signingKeyPassword, documentUsernameHash) {
         this.assertWritable("document lifecycle mutation");
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         if ((signingKeyPair !== undefined) !== (signingKeyPassword !== undefined)) {
             throw new Error("Lifecycle mutation requires both signingKeyPair and signingKeyPassword");
         }
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const signerPublicKey = useCustomSigningKey
-                ? signingKeyPair.publicKey
-                : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            if (signerPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
+        const signerPublicKey = await this.resolveSignerPublicKey(useCustomSigningKey ? signingKeyPair : undefined);
+        await this.assertBuiltinWriteAllowed(op, signerPublicKey, documentUsernameHash);
     }
     /**
      * Write a delete or undelete lifecycle entry for an existing document.
@@ -6700,12 +6907,11 @@ class BaseMindooDB {
         // default to the "before" state; both states are supplied so either `when`
         // resolves. Throws AccessDeniedError if denied.
         {
-            const creatorKey = await this.resolveCreatorSigningKey(docId);
             const beforeState = internalDoc.doc;
             await this.assertWriteAllowed({
                 op: entryType,
                 signerKey: createdByPublicKey,
-                isAuthor: creatorKey !== null && createdByPublicKey === creatorKey,
+                isAuthor: await this.resolveIsAuthor(docId, createdByPublicKey, Number.MAX_SAFE_INTEGER),
                 bypass: bypassPrecheck,
                 getBeforeDoc: () => this.convertAutomergeToJS(beforeState),
                 getAfterDoc: () => this.convertAutomergeToJS(newDoc),
@@ -6769,7 +6975,7 @@ class BaseMindooDB {
     async deleteDocInternal(docId, signingKeyPair, signingKeyPassword, bypassPrecheck) {
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         this.logger.debug(`Deleting document ${docId}${useCustomSigningKey ? ' using custom signing key' : ''}`);
-        await this.assertLifecycleMutationAllowed(signingKeyPair, signingKeyPassword);
+        await this.assertLifecycleMutationAllowed("doc_delete", signingKeyPair, signingKeyPassword);
         // Get current document
         const internalDoc = await this.loadDocumentInternal(docId);
         if (!internalDoc || internalDoc.isDeleted) {
@@ -6781,11 +6987,11 @@ class BaseMindooDB {
     async undeleteDocInternal(docId, signingKeyPair, signingKeyPassword, bypassPrecheck) {
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         this.logger.debug(`Undeleting document ${docId}${useCustomSigningKey ? ' using custom signing key' : ''}`);
-        await this.assertLifecycleMutationAllowed(signingKeyPair, signingKeyPassword);
         const internalDoc = await this.loadDocumentInternal(docId);
         if (!internalDoc) {
             throw new errors_1.DocumentNotFoundError(docId);
         }
+        await this.assertLifecycleMutationAllowed("doc_undelete", signingKeyPair, signingKeyPassword, this.usernameHashFromInternalDoc(internalDoc));
         if (!internalDoc.isDeleted) {
             this.logger.debug(`Document ${docId} is already alive; undelete is a no-op`);
             return;
@@ -6803,13 +7009,6 @@ class BaseMindooDB {
         this.assertWritable("applyTextPatch");
         const docId = doc.getId();
         this.logger.debug(`===== applyTextPatch called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
             const loadedDoc = await this.loadDocumentInternal(docId);
@@ -6867,13 +7066,6 @@ class BaseMindooDB {
         this.assertWritable("applyRichTextPatch");
         const docId = doc.getId();
         this.logger.debug(`===== applyRichTextPatch called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
             const loadedDoc = await this.loadDocumentInternal(docId);
@@ -6942,13 +7134,6 @@ class BaseMindooDB {
         this.assertWritable("applyRichTextStepsPatch");
         const docId = doc.getId();
         this.logger.debug(`===== applyRichTextStepsPatch called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
             const loadedDoc = await this.loadDocumentInternal(docId);
@@ -7061,13 +7246,6 @@ class BaseMindooDB {
         this.assertWritable("applyAutomergeChanges");
         const docId = doc.getId();
         this.logger.debug(`===== applyAutomergeChanges called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         if (!Array.isArray(patch.changes) || patch.changes.length === 0) {
             throw new Error("Automerge changes patch must include at least one change byte sequence");
         }
@@ -7171,13 +7349,6 @@ class BaseMindooDB {
         this.assertWritable("applyJsonPatch");
         const docId = doc.getId();
         this.logger.debug(`===== applyJsonPatch called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
             const loadedDoc = await this.loadDocumentInternal(docId);
@@ -7235,16 +7406,6 @@ class BaseMindooDB {
         }
         const useCustomKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         this.logger.debug(`===== ${useCustomKey ? 'changeDocWithSigningKey' : 'changeDoc'} called for document ${docId} =====`);
-        // Admin-only validation: only admin key can modify data in admin-only databases
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const signerPublicKey = useCustomKey
-                ? signingKeyPair.publicKey
-                : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            if (signerPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         // Get internal document from cache or load it
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
@@ -7262,6 +7423,7 @@ class BaseMindooDB {
         if (internalDoc.isDeleted) {
             throw new errors_1.DocumentDeletedError(docId);
         }
+        await this.assertCurrentSealedAccess(internalDoc);
         // Apply the change function
         const now = (0, timeSource_1.semanticNow)();
         this.logger.debug(`Applying change function to document ${docId}`);
@@ -7304,6 +7466,11 @@ class BaseMindooDB {
             isAccessible: () => true,
             isAwaitingWitness: () => internalDoc.awaitingWitness ?? false,
             isWitnessed: () => internalDoc.witnessed ?? false,
+            isSealed: () => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId),
+            getRecipients: () => (0, recipients_1.resolveRecipientsFromPayload)(internalDoc.doc, internalDoc.sealedRecipients),
+            getRecipientEpoch: () => internalDoc.sealedRecipients?.epoch ?? 0,
+            isEncryptedFor: (users) => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId)
+                && (0, recipients_1.isPayloadEncryptedFor)(internalDoc.doc, internalDoc.sealedRecipients, Array.isArray(users) ? users : [users]),
             getHeads: () => automerge_adapter_1.Automerge.getHeads(internalDoc.doc),
             getData: () => {
                 // Return a proxy that collects property assignments and deletions
@@ -7584,6 +7751,7 @@ class BaseMindooDB {
                 successMessage: useCustomKey ? "changed with custom signing key" : "changed",
                 attachmentIds: pendingAttachmentAdditions.map((ref) => ref.attachmentId),
                 bypassPrecheck,
+                recipients: internalDoc.sealedRecipients,
             });
         }
         catch (error) {
@@ -8087,7 +8255,7 @@ class BaseMindooDB {
         }
     }
     async persistDocumentChange(options) {
-        const { internalDoc, newDoc, now, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck } = options;
+        const { internalDoc, newDoc, now, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck, recipients } = options;
         const docId = internalDoc.id;
         this.logger.debug(`Getting change bytes from document ${docId}`);
         const changesSincePreviousHeads = headsBeforeChange
@@ -8111,17 +8279,21 @@ class BaseMindooDB {
             successMessage,
             attachmentIds,
             bypassPrecheck,
+            recipients: options.recipients,
         });
     }
     async persistAutomergeDocumentChanges(options) {
-        const { internalDoc, newDoc, now, changeBytesList, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck, } = options;
+        const { internalDoc, newDoc, now, changeBytesList, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck, recipients, } = options;
         const docId = internalDoc.id;
+        await this.assertCurrentSealedAccess(internalDoc);
         const resolvedChangeBytesList = changeBytesList ?? (headsBeforeChange
             ? automerge_adapter_1.Automerge.getChangesSince(newDoc, headsBeforeChange)
             : []);
         if (resolvedChangeBytesList.length === 0) {
             throw new Error("No Automerge changes to persist");
         }
+        const signerPublicKey = await this.resolveSignerPublicKey(useCustomKey ? signingKeyPair : undefined);
+        await this.assertBuiltinWriteAllowed("doc_change", signerPublicKey, this.usernameHashFromInternalDoc(internalDoc));
         // Signed snapshot of the document's attachments after this change, computed
         // once from the resulting document state so EVERY change path (changeDoc,
         // text patches, merges, ...) carries it consistently on each produced entry.
@@ -8140,6 +8312,7 @@ class BaseMindooDB {
                 // The full attachment snapshot describes the document's resulting state,
                 // so it goes on every produced entry (unlike the add-only attachmentIds).
                 attachmentRefs,
+                recipients: index === 0 ? recipients : undefined,
             });
             entries.push(entry);
             const decodedChange = automerge_adapter_1.Automerge.decodeChange(changeBytes);
@@ -8153,12 +8326,11 @@ class BaseMindooDB {
             const signerKey = useCustomKey
                 ? signingKeyPair.publicKey
                 : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            const creatorKey = await this.resolveCreatorSigningKey(docId);
             const beforeState = internalDoc.doc;
             await this.assertWriteAllowed({
                 op: "doc_change",
                 signerKey,
-                isAuthor: creatorKey !== null && signerKey === creatorKey,
+                isAuthor: await this.resolveIsAuthor(docId, signerKey, Number.MAX_SAFE_INTEGER),
                 bypass: bypassPrecheck,
                 getBeforeDoc: () => this.convertAutomergeToJS(beforeState),
                 getAfterDoc: () => this.convertAutomergeToJS(newDoc),
@@ -8181,6 +8353,9 @@ class BaseMindooDB {
         // changefeed must re-emit the doc even when `lastModified` collides with
         // the previous change in the same millisecond.
         this.updateIndex(docId, internalDoc.lastModified, internalDoc.isDeleted, internalDoc.decryptionKeyId, "visible", internalDoc.awaitingWitness, internalDoc.witnessed, true);
+        if (recipients) {
+            internalDoc.sealedRecipients = recipients;
+        }
         this.markDocDirty(docId);
         this.logger.info(`Document ${docId} ${successMessage} successfully`);
         const createdByPublicKey = useCustomKey
@@ -8191,7 +8366,7 @@ class BaseMindooDB {
             : { createdByPublicKey: createdByPublicKey ?? "" });
     }
     async buildDocChangeStoreEntry(options) {
-        const { internalDoc, changeBytes, now, useCustomKey, signingKeyPair, signingKeyPassword, attachmentIds, attachmentRefs } = options;
+        const { internalDoc, changeBytes, now, useCustomKey, signingKeyPair, signingKeyPassword, attachmentIds, attachmentRefs, recipients } = options;
         const docId = internalDoc.id;
         this.logger.debug(`Got change bytes: ${changeBytes.length} bytes`);
         const decodedChange = automerge_adapter_1.Automerge.decodeChange(changeBytes);
@@ -8230,6 +8405,7 @@ class BaseMindooDB {
             encryptedSize: encryptedPayload.length,
             attachmentIds: attachmentIds && attachmentIds.length > 0 ? attachmentIds : undefined,
             attachmentRefs: attachmentRefs && attachmentRefs.length > 0 ? attachmentRefs : undefined,
+            recipients,
             entryVersion: types_1.CURRENT_STORE_ENTRY_VERSION,
         };
         // Bind the metadata with the author signature (audit finding #5).
@@ -8741,7 +8917,7 @@ class BaseMindooDB {
             if (snapshotEntries.length > 0) {
                 const snapshotData = snapshotEntries[0];
                 let isValid = false;
-                if (this._isAdminOnlyDb && snapshotData.createdByPublicKey !== this.getAdminPublicKey()) {
+                if (await this.shouldSkipLoadedEntryForBuiltin(snapshotData)) {
                     this.logger.warn(`Admin-only DB: skipping snapshot ${snapshotData.id} not signed by admin key`);
                 }
                 else {
@@ -8786,7 +8962,7 @@ class BaseMindooDB {
                 this.logger.warn(`Entry ${entryMeta.id} not found in store, skipping`);
                 continue;
             }
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
                 continue;
             }
@@ -9035,13 +9211,14 @@ class BaseMindooDB {
         // Load entries from store
         const entries = await this.store.getEntries(orderedEntryIds);
         // Filter entries for admin-only mode first
-        const validEntries = entries.filter(entryData => {
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+        const validEntries = [];
+        for (const entryData of entries) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
-                return false;
+                continue;
             }
-            return true;
-        });
+            validEntries.push(entryData);
+        }
         if (validEntries.length === 0) {
             this.logger.debug(`No valid entries to process for cached document ${docId}`);
             return null;
@@ -9592,7 +9769,13 @@ class BaseMindooDB {
      * server. Directory ACL writes always pass an explicit key, so this never
      * re-enters the directory for them.
      */
-    async resolveCreateKeyId(options) {
+    async resolveCreateKeyId(options, docId) {
+        if (options.recipients !== undefined && options.decryptionKeyId !== undefined) {
+            throw new Error("createDocument: recipients and decryptionKeyId are mutually exclusive");
+        }
+        if (options.recipients !== undefined) {
+            return (0, sealedTypes_1.sealedKeyId)(docId ?? options.id ?? "pending");
+        }
         if (options.decryptionKeyId !== undefined)
             return options.decryptionKeyId;
         try {
@@ -9609,6 +9792,34 @@ class BaseMindooDB {
         }
         return "default";
     }
+    async prepareSealedCreate(options, docId, keyId, now, signerPublicKey) {
+        if (options.recipients === undefined)
+            return undefined;
+        const tenant = this.tenant;
+        const resolved = await (0, recipients_1.resolveRecipientSpecs)({
+            tenant,
+            specs: options.recipients,
+            options: options.recipientOptions,
+            addedBy: signerPublicKey,
+            now,
+        });
+        const dek = tenant.getCryptoAdapter().getRandomValues(new Uint8Array(32));
+        console.log("[sealed] prepareSealedCreate", {
+            docId,
+            keyId,
+            includeSelf: options.recipientOptions?.includeSelf !== false,
+            userTargets: resolved.targets.map((target) => ({ kind: target.kind, id: target.id })),
+            skipped: resolved.skipped,
+        });
+        const recipients = await (0, recipients_1.sealToTargets)({
+            tenant,
+            generations: [dek],
+            targets: resolved.targets,
+            epoch: 1,
+        });
+        tenant.rememberSealedGenerations(keyId, [dek]);
+        return { encryptFor: resolved.encryptFor, recipients };
+    }
     /**
      * Evaluate the full client-side (Tier 1 + Tier 2) write ruleset for a
      * candidate write, returning the {@link AccessDecision}. Returns `null` only
@@ -9701,17 +9912,203 @@ class BaseMindooDB {
         const signerKey = signingKeyPair
             ? signingKeyPair.publicKey
             : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-        const creatorKey = await this.resolveCreatorSigningKey(docId);
         const before = doc.getData();
         const decision = await this.evaluateClientWriteAccess({
             op: "doc_change",
             signerKey,
-            isAuthor: creatorKey !== null && signerKey === creatorKey,
+            isAuthor: await this.resolveIsAuthor(docId, signerKey, Number.MAX_SAFE_INTEGER),
             getBeforeDoc: () => before,
             getAfterDoc: () => candidateAfter,
         });
         return decision ?? BaseMindooDB.ACL_NOT_ENFORCED_DECISION;
     }
+    async addRecipients(doc, recipients, options) {
+        return this.mutateRecipients(doc, "add", recipients, options);
+    }
+    async removeRecipients(doc, recipients, options) {
+        return this.mutateRecipients(doc, "remove", recipients, options);
+    }
+    async setRecipients(doc, recipients, options) {
+        return this.mutateRecipients(doc, "set", recipients, options);
+    }
+    async canChangeRecipients(doc, next) {
+        const after = { ...doc.getData() };
+        after[sealedTypes_1.ENCRYPT_FOR_FIELD] = { ...(0, recipients_1.readEncryptFor)(after) };
+        return this.canChange(doc, after);
+    }
+    async mutateRecipients(doc, mode, specs, options) {
+        this.assertWritable("changeDoc");
+        if (!(0, sealedTypes_1.isSealedKeyId)(doc.getDecryptionKeyId())) {
+            throw new Error("Recipient mutators require a document created with `recipients`");
+        }
+        const tenant = this.tenant;
+        const docId = doc.getId();
+        let internalDoc = this.getCachedDocument(docId) ?? (await this.loadDocumentInternal(docId));
+        if (!internalDoc || internalDoc.isDeleted) {
+            throw new errors_1.DocumentNotFoundError(docId);
+        }
+        const now = (0, timeSource_1.semanticNow)();
+        const signer = options?.signingKeyPair?.publicKey
+            ?? (await this.tenant.getCurrentUserId()).userSigningPublicKey;
+        const resolved = await (0, recipients_1.resolveRecipientSpecs)({
+            tenant,
+            specs,
+            options: {
+                includeSelf: mode === "set" ? options?.includeSelf !== false : false,
+                strict: options?.strict,
+            },
+            addedBy: signer,
+            now,
+        });
+        const currentMap = (0, recipients_1.readEncryptFor)(internalDoc.doc);
+        const activeIds = new Set(Object.entries(currentMap).filter(([, e]) => !e.removedAt).map(([id]) => id.split("#")[0]));
+        const addedTargets = [];
+        const removedStableIds = [];
+        const matchesTarget = (id, entry, target) => {
+            const base = id.split("#")[0];
+            return (target.stableId === base
+                || target.id === base
+                || (!!entry.label && target.id === entry.label)
+                || (!!entry.keyFingerprint && target.keyFingerprint === entry.keyFingerprint));
+        };
+        if (mode === "add" || mode === "set") {
+            for (const target of resolved.targets) {
+                if (!activeIds.has(target.stableId) && !activeIds.has(target.id))
+                    addedTargets.push(target);
+            }
+        }
+        if (mode === "remove") {
+            for (const [id, entry] of Object.entries(currentMap)) {
+                if (entry.removedAt)
+                    continue;
+                if (resolved.targets.some((target) => matchesTarget(id, entry, target))) {
+                    removedStableIds.push(id.split("#")[0]);
+                }
+            }
+        }
+        else if (mode === "set") {
+            const nextIds = new Set(resolved.targets.flatMap((t) => [t.stableId, t.id]));
+            for (const [id, entry] of Object.entries(currentMap)) {
+                if (entry.removedAt)
+                    continue;
+                const base = id.split("#")[0];
+                const keep = resolved.targets.some((target) => matchesTarget(id, entry, target));
+                if (!keep && !nextIds.has(base))
+                    removedStableIds.push(base);
+            }
+        }
+        const rotate = removedStableIds.length > 0;
+        const currentGens = tenant.getSealedGenerations(internalDoc.decryptionKeyId);
+        if (currentGens.length === 0) {
+            throw new Error("Cannot change recipients: the current document key is not in this session");
+        }
+        let generations = currentGens;
+        let epoch = internalDoc.sealedRecipients?.epoch ?? currentGens.length;
+        if (rotate) {
+            const nextDek = tenant.getCryptoAdapter().getRandomValues(new Uint8Array(32));
+            generations = [nextDek, ...currentGens];
+            epoch += 1;
+        }
+        const remainingByStable = new Map();
+        const existingSpecs = Object.entries(currentMap)
+            .filter(([, e]) => !e.removedAt)
+            .map(([id, e]) => e.kind === "device"
+            ? { device: e.keyFingerprint ?? id, label: e.label }
+            : (e.label ?? id));
+        if (existingSpecs.length > 0) {
+            const existingResolved = await (0, recipients_1.resolveRecipientSpecs)({
+                tenant,
+                specs: existingSpecs,
+                options: { includeSelf: false, strict: false },
+                addedBy: signer,
+                now,
+            });
+            for (const target of existingResolved.targets)
+                remainingByStable.set(target.stableId, target);
+        }
+        for (const target of addedTargets)
+            remainingByStable.set(target.stableId, target);
+        for (const id of removedStableIds) {
+            remainingByStable.delete(id);
+            for (const [stableId, target] of [...remainingByStable.entries()]) {
+                if (target.id === id || target.stableId === id || target.keyFingerprint === id) {
+                    remainingByStable.delete(stableId);
+                }
+            }
+        }
+        const remaining = [...remainingByStable.values()];
+        if (remaining.length === 0) {
+            throw new Error("Refusing to leave a sealed document with no recipients");
+        }
+        const recipientsBlock = await (0, recipients_1.sealToTargets)({
+            tenant,
+            generations,
+            targets: remaining,
+            epoch,
+        });
+        tenant.rememberSealedGenerations(internalDoc.decryptionKeyId, generations);
+        const headsBeforeChange = automerge_adapter_1.Automerge.getHeads(internalDoc.doc);
+        const newDoc = automerge_adapter_1.Automerge.change(internalDoc.doc, (draft) => {
+            if (addedTargets.length > 0) {
+                const addMap = {};
+                for (const target of addedTargets) {
+                    addMap[target.stableId] = {
+                        kind: target.kind,
+                        addedAt: now,
+                        addedBy: signer,
+                        keyFingerprint: target.keyFingerprint,
+                        ...(target.label ? { label: target.label } : {}),
+                    };
+                }
+                (0, recipients_1.applyEncryptForAdds)(draft, addMap, epoch);
+            }
+            if (removedStableIds.length > 0) {
+                (0, recipients_1.applyEncryptForRemoves)(draft, removedStableIds, now, signer);
+            }
+            if (options?.change) {
+                // Content edits from the caller happen in a follow-up changeDoc; the
+                // recipient field itself is the carrier entry.
+            }
+            draft._lastModified = now;
+        });
+        await this.persistDocumentChange({
+            internalDoc,
+            newDoc,
+            now,
+            headsBeforeChange,
+            useCustomKey: !!(options?.signingKeyPair && options.signingKeyPassword),
+            signingKeyPair: options?.signingKeyPair,
+            signingKeyPassword: options?.signingKeyPassword,
+            successMessage: "recipients updated",
+            bypassPrecheck: options?.bypassAccessControlPrecheck,
+            recipients: recipientsBlock,
+        });
+        if (options?.change) {
+            await this.changeDoc(this.wrapDocument(internalDoc), options.change, {
+                signingKeyPair: options.signingKeyPair,
+                signingKeyPassword: options.signingKeyPassword,
+                bypassAccessControlPrecheck: options.bypassAccessControlPrecheck,
+            });
+        }
+        const wrapped = this.wrapDocument(internalDoc);
+        return {
+            epoch,
+            rotated: rotate,
+            added: wrapped.getRecipients().filter((r) => addedTargets.some((t) => t.keyFingerprint === r.keyFingerprint)),
+            removed: Object.entries((0, recipients_1.readEncryptFor)(internalDoc.doc))
+                .filter(([id, e]) => e.removedAt && removedStableIds.includes(id.split("#")[0]))
+                .map(([id, e]) => ({
+                kind: e.kind === "device" ? "device" : "user",
+                id: e.kind === "device" ? (e.keyFingerprint ?? id) : id,
+                keyFingerprint: e.keyFingerprint ?? "",
+                label: e.label,
+                addedInEpoch: epoch,
+                sealed: false,
+            })),
+            skipped: resolved.skipped,
+            entryId: "",
+        };
+    }
     /**
      * Predict whether deleting `doc` via {@link deleteDocument} would be allowed
      * by the active write policy, without writing anything.
@@ -9721,12 +10118,11 @@ class BaseMindooDB {
         const signerKey = signingKeyPair
             ? signingKeyPair.publicKey
             : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-        const creatorKey = await this.resolveCreatorSigningKey(docId);
         const current = doc.getData();
         const decision = await this.evaluateClientWriteAccess({
             op: "doc_delete",
             signerKey,
-            isAuthor: creatorKey !== null && signerKey === creatorKey,
+            isAuthor: await this.resolveIsAuthor(docId, signerKey, Number.MAX_SAFE_INTEGER),
             getBeforeDoc: () => current,
             getAfterDoc: () => current,
         });
@@ -9741,40 +10137,71 @@ class BaseMindooDB {
         const signerKey = signingKeyPair
             ? signingKeyPair.publicKey
             : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-        const creatorKey = await this.resolveCreatorSigningKey(docId);
         const current = doc.getData();
         const decision = await this.evaluateClientWriteAccess({
             op: "doc_undelete",
             signerKey,
-            isAuthor: creatorKey !== null && signerKey === creatorKey,
+            isAuthor: await this.resolveIsAuthor(docId, signerKey, Number.MAX_SAFE_INTEGER),
             getBeforeDoc: () => current,
             getAfterDoc: () => current,
         });
         return decision ?? BaseMindooDB.ACL_NOT_ENFORCED_DECISION;
     }
     /**
-     * Resolve the signing public key of the document's original creator (the
-     * `doc_create` entry's `createdByPublicKey`), used to set `$author`
-     * (`isAuthor`) for the client write prechecks on change/delete/undelete.
-     * Cached per document; returns `null` if the create entry isn't present yet
-     * (in which case `isAuthor` is treated as false, matching materialization).
+     * Resolve the signing public key of the document's original creator and the
+     * trusted time of the `doc_create` entry, used to set `$author` (`isAuthor`)
+     * at grant level. Cached per document; returns `null` if the create entry
+     * isn't present yet (in which case `isAuthor` is treated as false).
      */
-    async resolveCreatorSigningKey(docId) {
-        const cached = this.creatorKeyCache.get(docId);
+    async resolveCreatorInfo(docId) {
+        const cached = this.creatorInfoCache.get(docId);
         if (cached)
             return cached;
         try {
             const metas = await this.scanAllMetadata(this.store, { docId });
-            const createKey = metas.find((m) => m.entryType === "doc_create")?.createdByPublicKey ?? null;
-            if (createKey)
-                this.creatorKeyCache.set(docId, createKey);
-            return createKey;
+            const createMeta = metas.find((m) => m.entryType === "doc_create");
+            const createKey = createMeta?.createdByPublicKey ?? null;
+            if (!createMeta || !createKey)
+                return null;
+            const trustedTime = createMeta.receivedAt ?? createMeta.createdAt;
+            const info = { signingKey: createKey, trustedTime };
+            this.creatorInfoCache.set(docId, info);
+            return info;
         }
         catch (error) {
             this.logger.debug(`[ACL] creator-key resolution failed for ${docId}: ${error}`);
             return null;
         }
     }
+    /**
+     * Whether `signerKey` is the document author at grant level: the creator is
+     * resolved at the `doc_create` trusted time, the signer at `signerTrustedTime`.
+     */
+    async resolveIsAuthor(docId, signerKey, signerTrustedTime) {
+        const creator = await this.resolveCreatorInfo(docId);
+        if (!creator)
+            return false;
+        try {
+            const directory = await this.tenant.openDirectory();
+            if (typeof directory.isSamePerson === "function") {
+                return directory.isSamePerson({
+                    creatorSigningKey: creator.signingKey,
+                    signerSigningKey: signerKey,
+                    creatorTrustedTime: creator.trustedTime,
+                    signerTrustedTime,
+                });
+            }
+        }
+        catch (error) {
+            this.logger.debug(`[ACL] grant-level $author resolution failed for ${docId}: ${error}`);
+        }
+        return creator.signingKey === signerKey;
+    }
+    /** @deprecated kept as a thin wrapper for any remaining device-key callers. */
+    async resolveCreatorSigningKey(docId) {
+        const info = await this.resolveCreatorInfo(docId);
+        return info?.signingKey ?? null;
+    }
     /** Append a record to the quarantine/audit log (and log it). */
     recordQuarantine(rec) {
         this.quarantineLog.push(rec);
@@ -9835,7 +10262,12 @@ class BaseMindooDB {
             : (a.receivedAt ?? a.createdAt) - (b.receivedAt ?? b.createdAt));
         if (dataEntries.length === 0)
             return { doc: null, cacheable };
-        const creatorKey = dataEntries.find((m) => m.entryType === "doc_create")?.createdByPublicKey ?? null;
+        const createMeta = dataEntries.find((m) => m.entryType === "doc_create");
+        const creatorKey = createMeta?.createdByPublicKey ?? null;
+        const creatorTrustedTime = createMeta
+            ? (createMeta.receivedAt ?? createMeta.createdAt)
+            : 0;
+        const isSamePersonFn = directory.isSamePerson?.bind(directory);
         const fetched = await this.store.getEntries(dataEntries.map((m) => m.id));
         const entryById = new Map(fetched.map((e) => [e.id, e]));
         let currentDoc = null;
@@ -9869,8 +10301,13 @@ class BaseMindooDB {
                 quarantine(meta, "cascade_dependent", "causally depends on a quarantined entry");
                 continue;
             }
-            // Verify the author signature over the encrypted payload.
-            const cryptoKey = await this.getOrImportPublicKey(entry.createdByPublicKey);
+            // Verify the author signature over the encrypted payload. Trust the
+            // signing key at the entry's trusted time (not HEAD) so a later revoke
+            // does not rewrite history.
+            const trustedTimeForTrust = (0, storeEntryTime_1.isProvisional)(meta)
+                ? Number.MAX_SAFE_INTEGER
+                : (meta.receivedAt ?? meta.createdAt);
+            const cryptoKey = await this.getOrImportPublicKey(entry.createdByPublicKey, trustedTimeForTrust);
             if (!cryptoKey) {
                 // Author key not (yet) trusted by the directory. Remember it so a
                 // later grantaccess sync can re-materialize the doc (reconcileAuthorTrust).
@@ -9931,20 +10368,29 @@ class BaseMindooDB {
                 ? this.convertAutomergeToJS(currentDoc)
                 : null;
             const afterJS = this.convertAutomergeToJS(afterDoc);
-            const isAuthor = creatorKey !== null && entry.createdByPublicKey === creatorKey;
-            // Trusted-time rule (docs/accesscontrol.md §8, version-aware): a witnessed
-            // entry is judged against the directory as it provably was at its
-            // `receivedAt`. A versioned un-witnessed entry (provisional) has no
-            // provable position, so it is judged against the current directory HEAD —
-            // `MAX_SAFE_INTEGER` selects the head node deterministically regardless of
-            // where the directory's own provisional (un-witnessed) entries currently
-            // float, which a wall-clock `now` would not (those entries can sit at a
-            // later `now`). A legacy un-witnessed entry predates witnessing and is
-            // stable at its `createdAt`, so it is judged against the historical
-            // directory state in effect then. See {@link isProvisional}.
             const trustedTime = (0, storeEntryTime_1.isProvisional)(meta)
                 ? Number.MAX_SAFE_INTEGER
                 : (meta.receivedAt ?? meta.createdAt);
+            let isAuthor = false;
+            if (creatorKey !== null) {
+                if (isSamePersonFn) {
+                    try {
+                        isAuthor = await isSamePersonFn({
+                            creatorSigningKey: creatorKey,
+                            signerSigningKey: entry.createdByPublicKey,
+                            creatorTrustedTime,
+                            signerTrustedTime: trustedTime,
+                        });
+                    }
+                    catch (error) {
+                        this.logger.debug(`[ACL] grant-level $author resolution failed during materialization: ${error}`);
+                        isAuthor = entry.createdByPublicKey === creatorKey;
+                    }
+                }
+                else {
+                    isAuthor = entry.createdByPublicKey === creatorKey;
+                }
+            }
             let decision;
             try {
                 decision = await evaluateClientAccess({
@@ -10107,6 +10553,22 @@ class BaseMindooDB {
         // Log all entry types
         const entryTypes = allEntryMetadata.map(em => `${em.entryType}@${em.createdAt}`).join(', ');
         this.logger.debug(`Entry types for ${docId}: ${entryTypes}`);
+        await this.tenant.ingestSealedFromEntries?.(allEntryMetadata.find((em) => em.entryType === "doc_create")?.decryptionKeyId
+            ?? allEntryMetadata[0].decryptionKeyId, allEntryMetadata);
+        const loadKeyId = allEntryMetadata.find((em) => em.entryType === "doc_create")?.decryptionKeyId
+            ?? allEntryMetadata[0].decryptionKeyId;
+        if ((0, sealedTypes_1.isSealedKeyId)(loadKeyId) && !(await this.tenant.hasDecryptionKey(loadKeyId))) {
+            this.logger.debug(`Document ${docId} is sealed and not unwrapable; treating as missing`);
+            const existingIndex = this.getDocIndexPosition(docId);
+            const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
+            if (existing?.accessState === "visible") {
+                await this.purgeMaterializedDocument(docId);
+                this.updateIndex(docId, existing.lastModified, true, loadKeyId, "inaccessible");
+                this.cacheMetaDirty = true;
+                this.cacheManager?.markDirty();
+            }
+            return null;
+        }
         // Access-control materialization (docs/accesscontrol.md §10): when the
         // tenant has access control active, materialize through the Tier 2
         // quarantine path (deterministic per-entry evaluation + cascade) instead of
@@ -10184,7 +10646,7 @@ class BaseMindooDB {
                 const snapshotData = snapshotEntries[0];
                 // Admin-only mode: only accept snapshots signed by admin
                 let isValid = false;
-                if (this._isAdminOnlyDb && snapshotData.createdByPublicKey !== this.getAdminPublicKey()) {
+                if (await this.shouldSkipLoadedEntryForBuiltin(snapshotData)) {
                     this.logger.warn(`Admin-only DB: skipping snapshot ${snapshotData.id} not signed by admin key`);
                 }
                 else {
@@ -10253,13 +10715,14 @@ class BaseMindooDB {
         if (this.isDebugEnabled())
             this.logger.debug(`Document state before applying entries: heads=${JSON.stringify(automerge_adapter_1.Automerge.getHeads(doc))}`);
         // Filter entries for admin-only mode first
-        const validEntries = entries.filter(entryData => {
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+        const validEntries = [];
+        for (const entryData of entries) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
-                return false;
+                continue;
             }
-            return true;
-        });
+            validEntries.push(entryData);
+        }
         if (validEntries.length === 0) {
             this.logger.debug(`No valid entries to process for document ${docId}`);
         }
@@ -10385,6 +10848,7 @@ class BaseMindooDB {
             isDeleted,
             awaitingWitness: witnessState.awaitingWitness,
             witnessed: witnessState.witnessed,
+            sealedRecipients: (0, recipients_1.newestRecipientBlock)(allEntryMetadata),
         };
         // Update cache
         await this.storeCachedDocument(internalDoc);
@@ -10486,6 +10950,11 @@ class BaseMindooDB {
             isAccessible: () => internalDoc.accessible ?? true,
             isAwaitingWitness: () => internalDoc.awaitingWitness ?? false,
             isWitnessed: () => internalDoc.witnessed ?? false,
+            isSealed: () => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId),
+            getRecipients: () => (0, recipients_1.resolveRecipientsFromPayload)(internalDoc.doc, internalDoc.sealedRecipients),
+            getRecipientEpoch: () => internalDoc.sealedRecipients?.epoch ?? 0,
+            isEncryptedFor: (users) => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId)
+                && (0, recipients_1.isPayloadEncryptedFor)(internalDoc.doc, internalDoc.sealedRecipients, Array.isArray(users) ? users : [users]),
             getHeads: () => automerge_adapter_1.Automerge.getHeads(internalDoc.doc),
             getData: () => {
                 // Convert Automerge document to plain JS object, converting Text
@@ -10618,7 +11087,7 @@ class BaseMindooDB {
         });
     }
     async decryptAttachmentChunk(chunk) {
-        if (this._isAdminOnlyDb && chunk.createdByPublicKey !== this.getAdminPublicKey()) {
+        if (await this.shouldSkipLoadedEntryForBuiltin(chunk)) {
             throw new Error(`Admin-only DB: chunk ${chunk.id} not signed by admin key`);
         }
         const isValid = await this.tenant.verifyEntrySignature(chunk, chunk.encryptedData);
@@ -11090,10 +11559,13 @@ class BaseMindooDB {
         // entries can be decrypted with the same override identity.
         const encryptionKeyBuffer = await this.tenant.decryptPrivateKey(override.user.userEncryptionKeyPair.privateKey, override.password, "encryption");
         const encryptionKey = await subtle.importKey("pkcs8", encryptionKeyBuffer, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["decrypt"]);
-        // Activate temporary override on the remote store.
+        // Activate temporary override on the remote store. Include the public PEM
+        // so the auth challenge names the same device key that will sign — otherwise
+        // the server rejects bootstrap pushes as an unknown device key.
         overrideCapableStore.setSyncAuthOverride({
             username: override.user.username,
             signingKey,
+            signingPublicKey: override.user.userSigningKeyPair.publicKey,
             privateEncryptionKey: encryptionKey,
         });
         // Return cleanup callback so caller can always restore normal auth in finally.
@@ -11132,6 +11604,18 @@ class BaseMindooDB {
             encryptAttachmentPayload: (payload, keyId) => this.tenant.encryptAttachmentPayload(payload, keyId),
             syncStoreChanges: () => this.syncStoreChanges(),
             evaluateWriteAccess: (op, signerKey, isAuthor) => this.evaluateClientWriteAccess({ op, signerKey, isAuthor }),
+            isSamePerson: async (creatorSigningKey, signerSigningKey, creatorTrustedTime, signerTrustedTime) => {
+                const directory = await this.tenant.openDirectory();
+                if (typeof directory.isSamePerson === "function") {
+                    return directory.isSamePerson({
+                        creatorSigningKey,
+                        signerSigningKey,
+                        creatorTrustedTime,
+                        signerTrustedTime,
+                    });
+                }
+                return creatorSigningKey === signerSigningKey;
+            },
             hasWriteContentRules: async (op) => {
                 const directory = await this.tenant.openDirectory();
                 return (await directory.hasWriteContentRules?.(op, this.store.getId())) ?? false;
@@ -11306,6 +11790,9 @@ class BaseMindooDB {
             }
             if (syncResult.transferred === 0) {
                 this.logger.debug(`No new entries to pull`);
+                if (storeKind === types_2.StoreKind.docs) {
+                    await this.reconcileAfterDocsPull();
+                }
                 return { transferredEntries: 0, transferredBytes, scannedEntries: syncResult.scanned, cancelled: false };
             }
             options?.onProgress?.({
@@ -11328,23 +11815,7 @@ class BaseMindooDB {
             }
             if (storeKind === types_2.StoreKind.docs) {
                 await this.syncStoreChanges();
-                // SDK-driven key-distribution reconcile (docs/accesscontrol.md §13).
-                // After the directory pulls and processes new entries, reconcile the
-                // local KeyBag against the directory head: bulk-remove revoked keys
-                // (forgetting now-inaccessible docs) and import keys newly pushed to
-                // this user (revealing their docs on the next content-DB pull). Runs in
-                // the SDK so standalone apps get it too, not just Haven. Best-effort and
-                // single-flight; never blocks or fails the sync.
-                if (this.store.getId() === "directory") {
-                    await this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
-                    // Author-trust reconcile: refresh the directory trust caches NOW
-                    // (instead of waiting up to DIRECTORY_SYNC_INTERVAL_MS for the next
-                    // cache-miss validation) so grantaccess documents that just arrived
-                    // immediately unblock entries other open databases skipped while
-                    // the author was still unknown. Awaited so a subsequent content-DB
-                    // sync in the same flow observes the healed state.
-                    await this.tenant.reconcileAuthorTrustAfterDirectorySyncSafe();
-                }
+                await this.reconcileAfterDocsPull();
             }
             if (options?.signal?.aborted) {
                 this.logger.info(`Pull cancelled after local processing for ${storeKind} entries`);
@@ -11374,6 +11845,26 @@ class BaseMindooDB {
             restoreAuthOverride();
         }
     }
+    /**
+     * After a directory / userdirectory docs pull — including a no-op pull
+     * (`transferred === 0`). Device 2 typically already has
+     * `acl_keydistribution_default` from bootstrap, then later imports the
+     * User-Key from `userdirectory`. A subsequent directory pull transfers
+     * nothing and used to skip reconcile, so `default` never landed in the bag.
+     * Re-run both passes whenever either database is fetched.
+     */
+    async reconcileAfterDocsPull() {
+        if (this.store.getId() === "directory") {
+            await this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
+            await this.tenant.reconcileAuthorTrustAfterDirectorySyncSafe();
+            await this.tenant.reconcileUserKeysSafe?.();
+        }
+        if (this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
+            this.tenant.noteUserDirectoryFetched?.();
+            await this.tenant.reconcileUserKeysSafe?.();
+            await this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
+        }
+    }
     /**
      * Push changes to a remote content-addressed store or another MindooDB instance.
      *