mindoodb 0.0.50 → 0.0.53

package/dist/core/BaseMindooTenantDirectory.js

@@ -6,6 +6,7 @@ const timeSource_1 = require("./utils/timeSource");
 const logging_1 = require("./logging");
 const grantKeys_1 = require("./accesscontrol/grantKeys");
 const types_2 = require("./accesscontrol/types");
+const DirectoryStateNode_1 = require("./accesscontrol/DirectoryStateNode");
 const DirectoryTimeTravelIndex_1 = require("./accesscontrol/DirectoryTimeTravelIndex");
 const directoryProjection_1 = require("./accesscontrol/directoryProjection");
 const types_3 = require("./accesscontrol/types");
@@ -113,7 +114,7 @@ class BaseMindooTenantDirectory {
         }
         return this.directoryDB;
     }
-    async registerUser(userId, administrationPrivateKey, administrationPrivateKeyPassword, userDetails, label) {
+    async registerUser(userId, administrationPrivateKey, administrationPrivateKeyPassword, userDetails, label, options) {
         this.logger.info(`Registering user: ${userId.username}`);
         // Check if user with same username (case-insensitive) already has ACTIVE
         // access. A grant whose keys were removed (revocation, §6.5) is ignored
@@ -131,7 +132,7 @@ class BaseMindooTenantDirectory {
             const keysMatch = (0, grantKeys_1.extractSigningPublicKeys)(existingData).includes(userId.userSigningPublicKey) &&
                 (0, grantKeys_1.extractEncryptionPublicKeys)(existingData).includes(userId.userEncryptionPublicKey);
             if (keysMatch) {
-                // Same user with same keys - skip re-registration
+                // Same user with same keys - skip re-registration and re-wrap
                 this.logger.debug(`User ${userId.username} already registered with same keys, skipping`);
                 return;
             }
@@ -141,10 +142,11 @@ class BaseMindooTenantDirectory {
             const newPair = {
                 signingPublicKey: userId.userSigningPublicKey,
                 encryptionPublicKey: userId.userEncryptionPublicKey,
+                addedAt: (0, timeSource_1.semanticNow)(),
             };
             if (trimmedLabel.length > 0)
                 newPair.label = trimmedLabel;
-            await this.addUserKeys(userId.username, [newPair], administrationPrivateKey, administrationPrivateKeyPassword);
+            await this.addUserKeys(userId.username, [newPair], administrationPrivateKey, administrationPrivateKeyPassword, options?.distributeKeyIds);
             return;
         }
         // Cast to BaseMindooTenant to access protected methods
@@ -202,6 +204,7 @@ class BaseMindooTenantDirectory {
                 const initialPair = {
                     signingPublicKey: userId.userSigningPublicKey,
                     encryptionPublicKey: userId.userEncryptionPublicKey,
+                    addedAt: (0, timeSource_1.semanticNow)(),
                 };
                 if (trimmedLabel.length > 0)
                     initialPair.label = trimmedLabel;
@@ -216,6 +219,91 @@ class BaseMindooTenantDirectory {
             throw error;
         }
         this.logger.info(`Registered user: ${userId.username}`);
+        // Push selected keys (default: tenant default) via key distribution so the
+        // joining device can bootstrap without a join-response URI once the
+        // server delivers `$publicinfos` (docs/accesscontrol.md §13).
+        const distributeKeyIds = options?.distributeKeyIds ?? [types_1.DEFAULT_TENANT_KEY_ID];
+        await this.autoDistributeKeysToUser(userId.username, distributeKeyIds, administrationPrivateKey, administrationPrivateKeyPassword);
+    }
+    /**
+     * Merge `username` into `acl_keydistribution_<keyId>` for each distributable
+     * key id (wraps to the person's published User-Key). Skips protected ids and
+     * keys the caller's KeyBag does not hold. Used after grant so
+     * discover-bootstrap can import `default` without a join-response URI.
+     */
+    async autoDistributeKeysToUser(username, keyIds, administrationPrivateKey, administrationPrivateKeyPassword, publicKeyOverride) {
+        const filtered = [
+            ...new Set(keyIds
+                .map((id) => (typeof id === "string" ? id.trim() : ""))
+                .filter((id) => id.length > 0 && !types_3.PROTECTED_DISTRIBUTION_KEY_IDS.includes(id))),
+        ];
+        if (filtered.length === 0)
+            return;
+        const baseTenant = this.tenant;
+        const preparedBy = baseTenant.getAdministrationPublicKey();
+        for (const keyId of filtered) {
+            const keyVersions = await this.getKeyVersionManifest(keyId);
+            if (keyVersions.length === 0) {
+                this.logger.debug(`autoDistributeKeysToUser: skipping "${keyId}" — caller KeyBag does not hold it`);
+                continue;
+            }
+            const existing = (await this.listKeyDistributions()).find((v) => v.keyId === keyId);
+            const pushtoNames = new Set((existing?.pushtoUsernames ?? [])
+                .map((u) => u.trim())
+                .filter((u) => u.length > 0));
+            pushtoNames.add(username.trim());
+            const usernameLower = username.trim().toLowerCase();
+            const pullfromNames = (existing?.pullfromUsernames ?? [])
+                .map((u) => u.trim())
+                .filter((u) => u.length > 0 && u.toLowerCase() !== usernameLower);
+            const pushto = [];
+            for (const pushtoUsername of pushtoNames) {
+                const override = pushtoUsername.trim() === username.trim() ? publicKeyOverride : undefined;
+                const wrapped = await this.wrapKeyForUser(keyId, pushtoUsername, override);
+                if (wrapped)
+                    pushto.push(wrapped);
+            }
+            if (pushto.length === 0) {
+                this.logger.warn(`autoDistributeKeysToUser: skipping "${keyId}" — no published User-Key wrap yet for "${username}"`);
+                continue;
+            }
+            const pullfrom = [];
+            for (const pullUsername of pullfromNames) {
+                pullfrom.push({
+                    username: pullUsername,
+                    username_hash: await this.hashUsernameForWrite(pullUsername),
+                });
+            }
+            const title = (typeof existing?.title === "string" && existing.title.trim()) || keyId;
+            const comment = typeof existing?.comment === "string" && existing.comment.trim()
+                ? existing.comment.trim()
+                : undefined;
+            await this.publishKeyDistribution({
+                v: 1,
+                keyId,
+                keyVersions,
+                title,
+                ...(comment ? { comment } : {}),
+                preparedByPublicKey: preparedBy,
+                pushto,
+                pullfrom,
+            }, administrationPrivateKey, administrationPrivateKeyPassword);
+            this.logger.info(`autoDistributeKeysToUser: merged "${username}" into distribution for "${keyId}"`);
+        }
+    }
+    /**
+     * Key ids that already list `username` in pushto (plus `default`), so a newly
+     * added device gets re-wrapped material. Protected ids are excluded.
+     */
+    async keyIdsNeedingDeviceWrap(username) {
+        const lower = username.trim().toLowerCase();
+        const ids = new Set([types_1.DEFAULT_TENANT_KEY_ID]);
+        for (const view of await this.listKeyDistributions()) {
+            if (view.pushtoUsernames?.some((u) => u.trim().toLowerCase() === lower)) {
+                ids.add(view.keyId);
+            }
+        }
+        return [...ids].filter((id) => !types_3.PROTECTED_DISTRIBUTION_KEY_IDS.includes(id));
     }
     async findGrantAccessDocuments(username) {
         this.logger.debug(`Finding grant access documents for username: ${username}`);
@@ -421,6 +509,7 @@ class BaseMindooTenantDirectory {
         }
         // Track group documents by name for merging (handles offline sync scenarios)
         const groupDocsByName = new Map();
+        let sawGrantAccessChange = false;
         // Process changes (documents are returned in order by lastModified, oldest to newest)
         for await (const { doc, cursor } of directoryDB.iterateChangesSince(startCursor)) {
             const data = doc.getData();
@@ -440,6 +529,7 @@ class BaseMindooTenantDirectory {
                     }
                 }
                 if (data.type === "grantaccess") {
+                    sawGrantAccessChange = true;
                     // Record this grant document's CURRENT signing keys. Because grant
                     // documents are Automerge-merged in place, removing keys (the only
                     // revocation mechanism, §6.5) is reflected by a smaller array here.
@@ -580,6 +670,9 @@ class BaseMindooTenantDirectory {
         if (newlyTrustedKeys.size > 0) {
             void this.tenant.reconcileAuthorTrustChangesSafe(newlyTrustedKeys);
         }
+        if (sawGrantAccessChange) {
+            this.tenant.scheduleUserKeyReconcile?.();
+        }
         // Merge group documents with the same name
         for (const [normalizedGroupName, docs] of groupDocsByName.entries()) {
             // Collect all member hashes and encrypted values from all documents with this group name
@@ -823,6 +916,25 @@ class BaseMindooTenantDirectory {
             isServer: false,
         });
     }
+    /**
+     * Grant-level `$author` resolver: creator at `creatorTrustedTime`, signer at
+     * `signerTrustedTime`. See {@link isSamePerson}.
+     */
+    async isSamePerson(input) {
+        const creatorNode = await this.getDirectoryStateAt(input.creatorTrustedTime);
+        const signerNode = input.signerTrustedTime === input.creatorTrustedTime
+            ? creatorNode
+            : await this.getDirectoryStateAt(input.signerTrustedTime);
+        return (0, DirectoryStateNode_1.isSamePerson)(creatorNode, signerNode, input.creatorSigningKey, input.signerSigningKey);
+    }
+    /**
+     * The `username_hash` of the active grant that contained `signingKey` at
+     * trusted time `T`, or `null` when the key was not a granted device then.
+     */
+    async resolveUsernameHashForSigningKey(signingKey, trustedTime) {
+        const node = await this.getDirectoryStateAt(trustedTime);
+        return (0, DirectoryStateNode_1.grantForSigningKey)(node, signingKey)?.usernameHash ?? null;
+    }
     /**
      * Whether the active policy has any Tier 2 (`withfields`) content rule for
      * operation `op` in database `dbid` at the current head state. Lets the
@@ -927,7 +1039,7 @@ class BaseMindooTenantDirectory {
      * bypass).
      */
     async isDatabaseAllowed(dbid, opts) {
-        if (dbid === "directory")
+        if (dbid === types_1.DIRECTORY_DB_ID || dbid === types_1.USER_DIRECTORY_DB_ID)
             return true;
         const { mode, allowedDbIds } = await this.getDatabaseCreationPolicy();
         if (mode === "open")
@@ -954,7 +1066,7 @@ class BaseMindooTenantDirectory {
         }
         // The directory database is never read-gated (it must always sync so the
         // policy that defines the read gate can be read at all).
-        if (input.dbid === "directory")
+        if (input.dbid === types_1.DIRECTORY_DB_ID || input.dbid === types_1.USER_DIRECTORY_DB_ID)
             return true;
         // The tenant admin is exempt from the read gate.
         const adminKey = this.tenant.getAdministrationPublicKey();
@@ -984,7 +1096,7 @@ class BaseMindooTenantDirectory {
      * ({@link isDatabaseAllowed}); callers enforce both gates.
      */
     async canReadDatabase(dbid) {
-        if (dbid === "directory")
+        if (dbid === types_1.DIRECTORY_DB_ID || dbid === types_1.USER_DIRECTORY_DB_ID)
             return true;
         const currentUser = await this.tenant.getCurrentUserId();
         const adminKey = this.tenant.getAdministrationPublicKey();
@@ -1177,16 +1289,61 @@ class BaseMindooTenantDirectory {
      * Pairs are merged by signing key (a pair with an already-present signing key
      * updates its encryption key/label). See {@link mergeKeyPairs}.
      */
-    async addUserKeys(username, keyPairs, administrationPrivateKey, administrationPrivateKeyPassword) {
+    async addUserKeys(username, keyPairs, administrationPrivateKey, administrationPrivateKeyPassword, distributeKeyIds) {
+        const now = (0, timeSource_1.semanticNow)();
         const additions = keyPairs.map((pair) => {
             const trimmedLabel = typeof pair.label === "string" ? pair.label.trim() : "";
-            return trimmedLabel.length > 0
-                ? { ...pair, label: trimmedLabel }
-                : { signingPublicKey: pair.signingPublicKey, encryptionPublicKey: pair.encryptionPublicKey };
+            const next = {
+                signingPublicKey: pair.signingPublicKey,
+                encryptionPublicKey: pair.encryptionPublicKey,
+                addedAt: pair.addedAt ?? now,
+            };
+            if (trimmedLabel.length > 0)
+                next.label = trimmedLabel;
+            if (pair.revoked) {
+                next.revoked = true;
+                if (typeof pair.revokedAt === "number")
+                    next.revokedAt = pair.revokedAt;
+            }
+            const wrapped = typeof pair.joinResponseWrapped === "string" ? pair.joinResponseWrapped.trim() : "";
+            if (wrapped)
+                next.joinResponseWrapped = wrapped;
+            return next;
         });
         await this.editGrantArrays(username, administrationPrivateKey, administrationPrivateKeyPassword, (data) => {
             (0, grantKeys_1.applyKeyPairFields)(data, (0, grantKeys_1.mergeKeyPairs)((0, grantKeys_1.extractKeyPairs)(data), additions));
         });
+        // Device enrollment no longer re-wraps named keys: wraps target User-Keys,
+        // which do not change when a device is added. An existing approved device
+        // wraps the User-Key for the new device instead.
+        if (distributeKeyIds !== undefined && distributeKeyIds.length > 0) {
+            await this.autoDistributeKeysToUser(username, distributeKeyIds, administrationPrivateKey, administrationPrivateKeyPassword);
+        }
+    }
+    /**
+     * Store a per-device RSA-hybrid join bootstrap (`username` + optional
+     * `tenantLabel`) on the matching `userKeyPairs` entry. The blob is
+     * `$publicinfos`-readable so device discovery can forward it; only the
+     * device's encryption private key can unwrap it.
+     */
+    async attachDeviceJoinBootstrap(username, signingPublicKey, wrappedJoinResponse, administrationPrivateKey, administrationPrivateKeyPassword) {
+        const wrapped = wrappedJoinResponse.trim();
+        if (!wrapped) {
+            throw new Error("Cannot attach device join bootstrap: wrappedJoinResponse is empty");
+        }
+        let found = false;
+        await this.editGrantArrays(username, administrationPrivateKey, administrationPrivateKeyPassword, (data) => {
+            const next = (0, grantKeys_1.extractKeyPairs)(data).map((pair) => {
+                if (!(0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, signingPublicKey))
+                    return pair;
+                found = true;
+                return { ...pair, joinResponseWrapped: wrapped };
+            });
+            (0, grantKeys_1.applyKeyPairFields)(data, next);
+        });
+        if (!found) {
+            throw new Error(`Cannot attach device join bootstrap: no granted device matches the signing key for "${username}"`);
+        }
     }
     /**
      * Revoke keys from a user's grant (§6.5 revoke a device/key). A device is
@@ -1498,6 +1655,61 @@ class BaseMindooTenantDirectory {
             devices,
         };
     }
+    /**
+     * Wrap every stored version of `keyId` to the recipient's published User-Key
+     * (one wrap per person, not per device). Throws if the caller does not hold
+     * the key. Returns `null` when the recipient has no published (non-pending)
+     * User-Key — callers treat that as a pending state, not an error.
+     *
+     * `publicKeyOverride` is the join-bootstrap exception: the admin wraps
+     * `default` to the User-Key from the join request before the person has
+     * written a device wrap.
+     */
+    async wrapKeyForUser(keyId, username, publicKeyOverride) {
+        const baseTenant = this.tenant;
+        const versions = await baseTenant.fingerprintKeyVersions(keyId);
+        if (versions.length === 0) {
+            throw new Error(`Cannot wrap key: key "${keyId}" is not in your KeyBag`);
+        }
+        let publicKey = publicKeyOverride;
+        let fingerprint;
+        if (!publicKey) {
+            const published = await baseTenant.getUserKeyManager().publishedUserKeyFor(username);
+            // Wrap even while the User-Key document is still pending (no device
+            // wraps yet). The public key is already the person's; later devices
+            // unwrap `default` from this document after they import the User-Key.
+            if (!published) {
+                this.logger.warn(`wrapKeyForUser: no published User-Key for "${username}" — cannot wrap "${keyId}"`);
+                return null;
+            }
+            publicKey = published.publicKey;
+            // Derive the map key from the PEM we actually encrypt to, never from the
+            // document's fingerprint field. If the two ever disagree, the recipient
+            // finds a wrap under its own fingerprint that its private key cannot
+            // open — an undebuggable "wrong User-Key or corrupt wrap".
+            const derived = await this.encryptionKeyFingerprint(publicKey);
+            if (published.fingerprint && published.fingerprint !== derived) {
+                this.logger.warn(`wrapKeyForUser: User-Key document for "${username}" is inconsistent — ` +
+                    `fingerprint field says ${published.fingerprint} but its publicKey hashes to ${derived}; ` +
+                    `wrapping "${keyId}" under ${derived}`);
+            }
+            fingerprint = derived;
+        }
+        if (!fingerprint) {
+            fingerprint = await this.encryptionKeyFingerprint(publicKey);
+        }
+        const rsa = new RSAEncryption_1.RSAEncryption(this.tenant.getCryptoAdapter(), this.logger.createChild("RSAEncryption"));
+        const wrappedByVersion = {};
+        for (const version of versions) {
+            const wrapped = await rsa.encrypt(version.bytes, publicKey);
+            wrappedByVersion[version.fingerprint] = this.bytesToBase64(wrapped);
+        }
+        return {
+            username,
+            username_hash: await this.hashUsernameForWrite(username),
+            devices: { [fingerprint]: wrappedByVersion },
+        };
+    }
     /**
      * The canonical write-time hash for `username` (the value stored in
      * `pushto_users_hashes` / `pullfrom_users_hashes`). Exposed so callers (the
@@ -1507,6 +1719,13 @@ class BaseMindooTenantDirectory {
     async getUsernameHash(username) {
         return this.hashUsernameForWrite(username);
     }
+    /**
+     * All hash forms a given username could be stored as (v1/v2/v3). Public so
+     * User-Key lookup can scan `userdirectory` the same way grants are found.
+     */
+    async getUsernameHashCandidates(username) {
+        return this.usernameHashCandidates(username);
+    }
     /**
      * The version manifest (`{createdAt, fingerprint}`) of `keyId` from the
      * caller's KeyBag. The single source of truth for the distribution's
@@ -1547,15 +1766,31 @@ class BaseMindooTenantDirectory {
             pullfrom_users_hashes: pullfromHashes,
             pushto_users_keys: pushtoUsersKeys,
         });
-        // Directory-level validation: every pushto user must have an active grant,
-        // and every active encryption device must have wrapped material (otherwise a
-        // newly-added device could not decrypt — re-wrap is required).
+        // Directory-level validation: every pushto user must have an active grant.
+        // Coverage is per published User-Key epoch (or per device for service
+        // accounts that have no User-Key).
         const manifestFps = new Set(request.keyVersions.map((v) => v.fingerprint));
         for (const p of request.pushto) {
             const userKeys = await this.getUserPublicKeys(p.username);
             if (!userKeys) {
                 throw new Error(`Cannot publish: pushto user "${p.username}" has no active grant`);
             }
+            const baseTenant = this.tenant;
+            const published = await baseTenant.getUserKeyManager().publishedUserKeyFor(p.username);
+            if (published) {
+                // Pending documents are the join-bootstrap case: the admin wraps
+                // `default` to the join-request User-Key before the person has written
+                // a device wrap. Coverage is still per User-Key fingerprint.
+                const wrapped = p.devices[published.fingerprint];
+                if (!wrapped) {
+                    throw new Error(`Cannot publish: pushto user "${p.username}" has no wrap for their User-Key`);
+                }
+                const covered = Object.keys(wrapped);
+                if (covered.length !== manifestFps.size || covered.some((fp) => !manifestFps.has(fp))) {
+                    throw new Error(`Cannot publish: User-Key coverage for "${p.username}" does not match the version manifest`);
+                }
+                continue;
+            }
             const activePems = await this.getUserEncryptionPublicKeys(p.username);
             for (const pem of activePems) {
                 const deviceFp = await this.encryptionKeyFingerprint(pem);
@@ -1722,13 +1957,41 @@ class BaseMindooTenantDirectory {
      */
     async reconcileImportedKeysForCurrentUser(username) {
         const baseTenant = this.tenant;
-        const key = await baseTenant.getEncryptionPrivateKeyForReconcile();
-        if (!key) {
+        const keys = [];
+        const userKeys = await baseTenant.getUserKeyManager().getUserKeyCryptoKeysForReconcile();
+        keys.push(...userKeys);
+        const deviceKey = await baseTenant.getEncryptionPrivateKeyForReconcile();
+        if (deviceKey)
+            keys.push(deviceKey);
+        if (keys.length === 0) {
             this.logger.debug("reconcileImportedKeysForCurrentUser: no encryption key available; " +
                 "skipping import pass (revoke pass still ran)");
             return { imported: [], removed: [] };
         }
-        return this.reconcileKeyDistributionsWithKey(username, key);
+        let imported = [];
+        let removed = [];
+        // A wrap is addressed to exactly one of these keys, so every other candidate
+        // fails on it by construction. Collect the misses and judge them only once
+        // the whole pass is done, otherwise the losing candidates cry wolf on a key
+        // that was delivered fine.
+        const unopened = new Map();
+        for (const key of keys) {
+            const result = await this.reconcileKeyDistributionsWithKey(username, key);
+            imported = Array.from(new Set([...imported, ...result.imported]));
+            removed = Array.from(new Set([...removed, ...result.removed]));
+            for (const [keyId, reason] of result.unopened ?? []) {
+                unopened.set(keyId, [...(unopened.get(keyId) ?? []), reason]);
+            }
+        }
+        for (const [keyId, reasons] of unopened) {
+            if (imported.includes(keyId))
+                continue;
+            if (await baseTenant.hasDecryptionKey(keyId))
+                continue;
+            this.logger.warn(`reconcileKeyDistributions: ${keyId} not unwrapped by any of the ${keys.length} ` +
+                `available encryption key(s) (wrong User-Key or corrupt wrap): ${reasons.join(" || ")}`);
+        }
+        return { imported, removed };
     }
     /**
      * Reconcile the local KeyBag against the directory head for `username`
@@ -1755,14 +2018,35 @@ class BaseMindooTenantDirectory {
         const directoryDB = await this.getDirectoryDB();
         await directoryDB.syncStoreChanges();
         await this.updateUnifiedCache();
-        if (this.keyDistributionCache.size === 0)
+        if (this.keyDistributionCache.size === 0) {
+            this.logger.warn("reconcileKeyDistributionsWithKey: directory has no key-distribution documents in cache");
             return { imported: [], removed: [] };
+        }
+        if (!this.keyDistributionCache.has(types_1.DEFAULT_TENANT_KEY_ID)) {
+            this.logger.warn("reconcileKeyDistributionsWithKey: no acl_keydistribution_default in directory cache");
+        }
         const myHashes = new Set(await this.usernameHashCandidates(username));
+        // Nameless / pre-adoption devices: also match via the grant's
+        // identity_hashes / username_hash looked up by signing public key.
+        try {
+            const signingKey = (await this.tenant.getCurrentUserId()).userSigningPublicKey;
+            const lookup = await this.getUserBySigningPublicKey(signingKey);
+            if (lookup) {
+                for (const h of await this.identityHashesForLookup(lookup)) {
+                    myHashes.add(h);
+                }
+            }
+        }
+        catch (error) {
+            this.logger.debug(`reconcileKeyDistributionsWithKey: signing-key hash supplement failed: ${error}`);
+        }
         const baseTenant = this.tenant;
         const privateKey = encryptionPrivateCryptoKey;
         const rsa = new RSAEncryption_1.RSAEncryption(this.tenant.getCryptoAdapter(), this.logger.createChild("RSAEncryption"));
         const imported = [];
         const removed = [];
+        // keyId -> why this candidate key could not open any of its wraps.
+        const unopened = new Map();
         for (const [keyId, entry] of this.keyDistributionCache.entries()) {
             if (types_3.PROTECTED_DISTRIBUTION_KEY_IDS.includes(keyId))
                 continue;
@@ -1778,8 +2062,13 @@ class BaseMindooTenantDirectory {
                     removed.push(keyId);
                 continue;
             }
-            if (!meInPush)
+            if (!meInPush) {
+                if (keyId === types_1.DEFAULT_TENANT_KEY_ID) {
+                    this.logger.warn(`reconcileKeyDistributions: "${keyId}" exists but current user is not in pushto ` +
+                        `(hashes=${entry.pushto_users_hashes.length})`);
+                }
                 continue;
+            }
             const wrappedMap = entry.pushto_users_keys;
             // Collect device entries addressed to me (by hash prefix). We do not know
             // which device is ours without trying, so attempt to unwrap each; only our
@@ -1788,39 +2077,63 @@ class BaseMindooTenantDirectory {
                 const hash = entryKey.split("|")[0];
                 return myHashes.has(hash);
             });
-            if (myEntries.length === 0)
+            if (myEntries.length === 0) {
+                this.logger.warn(`reconcileKeyDistributions: "${keyId}" lists this user in pushto but has no wrap entries for their hashes`);
                 continue;
+            }
             const collected = new Map();
-            for (const [, wrappedByVersion] of myEntries) {
+            // Why each candidate failed, so a "none unwrapped" warning can name the
+            // cause instead of lumping a missing version in with a decrypt failure.
+            const attempts = [];
+            for (const [entryKey, wrappedByVersion] of myEntries) {
                 for (const ref of manifest) {
                     if (collected.has(ref.fingerprint))
                         continue;
                     const wrappedB64 = wrappedByVersion[ref.fingerprint];
-                    if (typeof wrappedB64 !== "string")
+                    if (typeof wrappedB64 !== "string") {
+                        attempts.push(`${entryKey}: no wrap for version ${ref.fingerprint}; entry carries [${Object.keys(wrappedByVersion).join(", ")}]`);
                         continue;
+                    }
                     try {
                         const bytes = await rsa.decrypt(this.base64ToBytes(wrappedB64), privateKey);
                         const actualFp = await baseTenant.fingerprintKeyBytes(bytes);
                         if (actualFp !== ref.fingerprint) {
                             this.logger.warn(`reconcileKeyDistributions: fingerprint mismatch for ${keyId}@${ref.fingerprint} (got ${actualFp}); rejecting`);
+                            attempts.push(`${entryKey}: unwrapped ${ref.fingerprint} but got key ${actualFp}`);
                             continue;
                         }
                         collected.set(ref.fingerprint, { bytes, keyVersionCreatedAt: ref.createdAt });
                     }
-                    catch {
-                        // Not our device entry (or corrupt); try the next one.
+                    catch (error) {
+                        // Byte length separates a truncated/corrupt wrap from a genuine
+                        // key mismatch: hybrid format is 2 + 384 (RSA-3072) + 12 + AES.
+                        const wrappedBytes = this.base64ToBytes(wrappedB64);
+                        const rsaBlockLength = (wrappedBytes[0] << 8) | wrappedBytes[1];
+                        attempts.push(`${entryKey}: RSA decrypt of version ${ref.fingerprint} failed ` +
+                            `(${error instanceof Error ? error.message || error.name : error}); ` +
+                            `wrap b64=${wrappedB64.length} bytes=${wrappedBytes.length} rsaBlock=${rsaBlockLength}`);
                     }
                 }
                 if (collected.size === manifest.length)
                     break;
             }
-            if (collected.size === 0)
+            if (collected.size === 0) {
+                // Not an error yet: the caller runs this pass once per candidate key
+                // (every User-Key epoch, then the device key), so a wrap addressed to
+                // the User-Key can never open with the device key. Only the caller knows
+                // whether some other candidate succeeded, so report instead of warning.
+                const addressedTo = myEntries.map(([entryKey]) => entryKey.split("|")[1] ?? "?");
+                unopened.set(keyId, `${myEntries.length} wrap(s) for this user, none unwrapped; ` +
+                    `wraps addressed to [${addressedTo.join(", ")}], ` +
+                    `manifest versions [${manifest.map((ref) => ref.fingerprint).join(", ")}]; ` +
+                    `attempts: ${attempts.join(" | ")}`);
                 continue;
+            }
             const count = await baseTenant.importDeliveredDecryptionKeyVersions(keyId, Array.from(collected.values()));
             if (count > 0)
                 imported.push(keyId);
         }
-        return { imported, removed };
+        return { imported, removed, unopened };
     }
     /**
      * Whether `keyId` is managed by a distribution at the directory head AND the
@@ -2345,13 +2658,13 @@ class BaseMindooTenantDirectory {
         return hashes;
     }
     /**
-     * Hash-space core of the revoked-key blacklist (docs/accesscontrol.md §13):
-     * every `acl_keydistribution_<keyId>` whose `pullfrom_users_hashes` intersects
-     * `myHashes`. Protected ids (the tenant default / public-infos keys) are never
-     * reported. Reads straight from {@link keyDistributionCache} (O(cache size),
-     * no doc scan); the caller must have refreshed it first (both entry points do,
-     * via `updateUnifiedCache` / `getUserBySigningPublicKey`).
-     */
+   * Hash-space core of the revoked-key blacklist (docs/accesscontrol.md §13):
+   * every `acl_keydistribution_<keyId>` whose `pullfrom_users_hashes` intersects
+   * `myHashes`. Protected id `$publicinfos` is never reported. Reads straight from
+   * {@link keyDistributionCache} (O(cache size), no doc scan); the caller must have
+   * refreshed it first (both entry points do, via `updateUnifiedCache` /
+   * `getUserBySigningPublicKey`).
+   */
     collectRevokedKeyIdsForHashes(myHashes) {
         const revoked = [];
         for (const [keyId, entry] of this.keyDistributionCache.entries()) {
@@ -2439,7 +2752,7 @@ class BaseMindooTenantDirectory {
         // allow-rules until the trust cache refreshed (up to
         // DIRECTORY_SYNC_INTERVAL_MS later). The `node` is the time-`T` snapshot
         // whose `bySigningKey` only contains keys whose grant is active at `T`.
-        const grantedAtT = node.bySigningKey.has(signingKey);
+        const grantedAtT = !!(0, DirectoryStateNode_1.grantForSigningKey)(node, signingKey);
         // Resolve the author's username from their signing key. Trusted non-user
         // keys (e.g. server-to-server sync identities) have no grant; treat them as
         // an empty identity that still carries `$everyone`/`$author`. Keys that were
@@ -2650,7 +2963,19 @@ class BaseMindooTenantDirectory {
         const directoryDB = await this.getDirectoryDB();
         await directoryDB.syncStoreChanges();
         await this.updateUnifiedCache();
-        return this.userLookupCache.get(publicKey) ?? null;
+        const exact = this.userLookupCache.get(publicKey);
+        if (exact)
+            return exact;
+        // Auth/JWT/client transport may re-wrap PEM line endings; match the grant
+        // entry whose signing key is the same key material.
+        const needle = publicKey.replace(/\s+/g, "");
+        if (!needle)
+            return null;
+        for (const [key, lookup] of this.userLookupCache) {
+            if (key.replace(/\s+/g, "") === needle)
+                return lookup;
+        }
+        return null;
     }
     /**
      * Resolve the full set of signing keys relevant to authenticating a device for
@@ -2881,7 +3206,7 @@ class BaseMindooTenantDirectory {
         const directoryDB = await this.getDirectoryDB();
         await directoryDB.syncStoreChanges();
         await this.updateUnifiedCache();
-        const known = new Set(["directory", "main"]);
+        const known = new Set([types_1.DIRECTORY_DB_ID, types_1.USER_DIRECTORY_DB_ID]);
         for (const dbId of this.dbSettingsCache.keys()) {
             known.add(dbId);
         }
@@ -3282,6 +3607,9 @@ class BaseMindooTenantDirectory {
             details,
             identityHashes,
             identityHashesV,
+            ...(pair.joinResponseWrapped
+                ? { joinResponseWrapped: pair.joinResponseWrapped }
+                : {}),
         }));
     }
     async encryptGroupMemberForTenant(plaintext) {