mindoodb 0.0.51 → 0.0.53

package/dist/core/BaseMindooTenant.js

@@ -2,11 +2,19 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMindooTenant = void 0;
 const types_1 = require("./types");
+const userid_1 = require("./userid");
 const BaseMindooDB_1 = require("./BaseMindooDB");
 const BaseMindooTenantDirectory_1 = require("./BaseMindooTenantDirectory");
 const grantKeys_1 = require("./accesscontrol/grantKeys");
+const UserKeyManager_1 = require("./userkeys/UserKeyManager");
+const types_2 = require("./userkeys/types");
+const validateUserKeyDocument_1 = require("./userkeys/validateUserKeyDocument");
+const sealedTypes_1 = require("./userkeys/sealedTypes");
+const recipients_1 = require("./userkeys/recipients");
+const sealedCrypto_1 = require("./userkeys/sealedCrypto");
 const MindooDocSigner_1 = require("./crypto/MindooDocSigner");
 const RSAEncryption_1 = require("./crypto/RSAEncryption");
+const deviceJoinBootstrap_1 = require("./join/deviceJoinBootstrap");
 const privateKeyEncryption_1 = require("./crypto/privateKeyEncryption");
 const EntrySignature_1 = require("./crypto/EntrySignature");
 const DomainStatement_1 = require("./crypto/DomainStatement");
@@ -48,6 +56,7 @@ class BaseMindooTenant {
      */
     preDecryptedMaterial) {
         this.databaseCache = new Map();
+        this.databaseOpenInFlight = new Map();
         this.directoryCache = null;
         this.remoteStoreCache = new Map();
         /**
@@ -89,6 +98,9 @@ class BaseMindooTenant {
         // recursing or overlapping. Reconcile is idempotent, so a skipped overlap is
         // harmless — the next trigger re-runs it.
         this.reconcileInFlight = false;
+        this.userKeyReconcileScheduled = false;
+        this.userKeys = new UserKeyManager_1.UserKeyManager(this);
+        this.sealedGenerations = new Map();
         // Local cache support
         this.cacheManager = null;
         this.factory = factory;
@@ -134,6 +146,9 @@ class BaseMindooTenant {
         if (preDecryptedMaterial?.encryptionKey) {
             this.decryptedUserEncryptionKeyCache = preDecryptedMaterial.encryptionKey;
         }
+        if (preDecryptedMaterial?.userKeyPrivateBytes) {
+            this.userKeys.seedDecryptedUserKeyBytes(preDecryptedMaterial.userKeyPrivateBytes);
+        }
         // Set up cache if a local cache store is provided. When a pre-derived
         // cache encryption key is available, prefer that to skip the password
         // path and avoid retaining the plaintext password inside the encrypted
@@ -193,6 +208,148 @@ class BaseMindooTenant {
         }
         return timestamp;
     }
+    getCurrentPrivateUser() {
+        return this.currentUser;
+    }
+    getCurrentUserPassword() {
+        return this.currentUserPassword;
+    }
+    getUserKeyManager() {
+        return this.userKeys;
+    }
+    isDatabaseOpen(dbId) {
+        return this.databaseCache.has(dbId) || this.databaseOpenInFlight.has(dbId);
+    }
+    /** Fully initialized (not merely in-flight). See UserKeyManager.canReconcileAgainstUserDirectory. */
+    isDatabaseReady(dbId) {
+        return this.databaseCache.has(dbId);
+    }
+    /**
+     * Coalesce grant-driven user-key compares onto one run after the current
+     * `updateUnifiedCache` stack unwinds. Calling reconcile synchronously from
+     * the cache pass re-enters the cache via `findGrantAccessDocuments` and
+     * unbounded-allocates.
+     */
+    scheduleUserKeyReconcile() {
+        if (this.userKeys.isReconciling() || this.userKeyReconcileScheduled)
+            return;
+        this.userKeyReconcileScheduled = true;
+        queueMicrotask(() => {
+            this.userKeyReconcileScheduled = false;
+            if (this.userKeys.isReconciling())
+                return;
+            void this.reconcileUserKeysSafe();
+        });
+    }
+    noteUserDirectoryFetched() {
+        this.userKeys.noteUserDirectoryFetched();
+    }
+    noteUserDirectoryFetchFailed(error) {
+        this.userKeys.noteUserDirectoryFetchFailed(error);
+    }
+    async listPendingUserKeyDevices() {
+        return this.userKeys.listPendingUserKeyDevices();
+    }
+    async listUserKeyDevices() {
+        return this.userKeys.listUserKeyDevices();
+    }
+    async approveUserKeyDevice(fingerprint) {
+        return this.userKeys.approveUserKeyDevice(fingerprint);
+    }
+    async declineUserKeyDevice(fingerprint) {
+        return this.userKeys.declineUserKeyDevice(fingerprint);
+    }
+    async undoDeclineUserKeyDevice(fingerprint) {
+        return this.userKeys.undoDeclineUserKeyDevice(fingerprint);
+    }
+    async rotateUserKey() {
+        return this.userKeys.rotateUserKey();
+    }
+    async reconcileUserKeys(options) {
+        return this.userKeys.reconcile(options);
+    }
+    async reconcileUserKeysSafe() {
+        try {
+            await this.userKeys.reconcile();
+        }
+        catch (error) {
+            this.logger.warn(`reconcileUserKeysSafe: ${error}`);
+        }
+    }
+    async getUserKeyEnrollmentStatus() {
+        return this.userKeys.getEnrollmentStatus();
+    }
+    async ensureLocalUserKeyPair() {
+        await this.userKeys.ensureLocalUserKeyPair(this.currentUser, this.currentUserPassword);
+    }
+    rememberSealedGenerations(keyId, generations) {
+        this.sealedGenerations.set(keyId, generations);
+    }
+    getSealedGenerations(keyId) {
+        return this.sealedGenerations.get(keyId) ?? [];
+    }
+    async ingestSealedRecipients(keyId, recipients) {
+        const cached = this.sealedGenerations.get(keyId);
+        const epoch = typeof recipients.epoch === "number" ? recipients.epoch : 0;
+        if (cached && cached.length >= epoch && epoch > 0) {
+            console.log("[sealed] ingest: cache already has generations", {
+                keyId,
+                cached: cached.length,
+                epoch,
+            });
+            return;
+        }
+        const keys = [
+            ...(await this.userKeys.getUserKeyCryptoKeysForReconcile()),
+            await this.getEncryptionPrivateKeyForReconcile(),
+        ].filter((k) => !!k);
+        console.log("[sealed] ingest: trying unwrap", {
+            keyId,
+            wrapCount: recipients.wraps?.length ?? 0,
+            wrapKinds: (recipients.wraps ?? []).map((wrap) => wrap.kind),
+            epoch,
+            keyCount: keys.length,
+            cached: cached?.length ?? 0,
+        });
+        if (keys.length === 0) {
+            // Keep a create-time session DEK. Without unwrap keys we cannot prove
+            // the wrap list excludes us, and deleting would make the author unable
+            // to read a document they just sealed.
+            return;
+        }
+        for (const key of keys) {
+            try {
+                const gens = await (0, sealedCrypto_1.openBundle)({
+                    crypto: this.cryptoAdapter,
+                    recipients,
+                    privateKey: key,
+                });
+                this.sealedGenerations.set(keyId, gens);
+                console.log("[sealed] ingest: unwrapped", { keyId, generations: gens.length });
+                return;
+            }
+            catch {
+                // try next key
+            }
+        }
+        // Newest wrap list is not for us (removed, or never added). Drop any
+        // session DEK so hasDecryptionKey / visibility reconcile hide the
+        // document instead of leaving the last readable plaintext editable.
+        console.log("[sealed] ingest: unwrap failed, dropping session DEK", {
+            keyId,
+            cached: cached?.length ?? 0,
+            epoch,
+        });
+        this.sealedGenerations.delete(keyId);
+    }
+    async ingestSealedFromEntries(keyId, entries) {
+        if (!(0, sealedTypes_1.isSealedKeyId)(keyId))
+            return;
+        const newest = (0, recipients_1.newestRecipientBlock)(entries);
+        if (!newest)
+            return;
+        await this.ingestSealedRecipients(keyId, newest);
+    }
     getFactory() {
         return this.factory;
     }
@@ -225,6 +382,9 @@ class BaseMindooTenant {
      */
     async importAesKeyCached(symmetricKey, usage) {
         let cacheKey = usage + ":";
+        if (symmetricKey.length !== 32) {
+            throw new Error(`AES-256 key must be 32 bytes, got ${symmetricKey.length}`);
+        }
         for (let i = 0; i < symmetricKey.length; i++) {
             cacheKey += symmetricKey[i].toString(16).padStart(2, "0");
         }
@@ -233,9 +393,8 @@ class BaseMindooTenant {
             return cached;
         }
         const subtle = this.cryptoAdapter.getSubtle();
-        // Create a new Uint8Array to ensure we have a proper ArrayBuffer
-        const keyArray = new Uint8Array(symmetricKey);
-        const cryptoKey = await subtle.importKey("raw", keyArray.buffer, { name: "AES-GCM" }, false, // not extractable
+        const keyArray = symmetricKey.slice();
+        const cryptoKey = await subtle.importKey("raw", keyArray, { name: "AES-GCM" }, false, // not extractable
         [usage]);
         if (this.importedAesKeyCache.size >= BaseMindooTenant.MAX_IMPORTED_KEY_CACHE_ENTRIES) {
             this.importedAesKeyCache.clear();
@@ -254,7 +413,14 @@ class BaseMindooTenant {
         // Get the symmetric key for this key ID
         let symmetricKey;
         try {
-            if (decryptionKeyId === "default") {
+            if ((0, sealedTypes_1.isSealedKeyId)(decryptionKeyId)) {
+                const generations = this.sealedGenerations.get(decryptionKeyId);
+                if (!generations?.length) {
+                    throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
+                }
+                symmetricKey = generations[0];
+            }
+            else if (decryptionKeyId === "default") {
                 // Use cached tenant encryption key if available
                 if (this.decryptedTenantKeyCache) {
                     symmetricKey = this.decryptedTenantKeyCache;
@@ -388,7 +554,9 @@ class BaseMindooTenant {
             }
         }
         this.logger.debug(`Decrypt failed against all ${candidates.length} version(s) of key "${decryptionKeyId}"`);
-        throw lastError ?? new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
+        throw lastError instanceof Error
+            ? new errors_1.SymmetricKeyNotFoundError(decryptionKeyId)
+            : new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
     }
     /**
      * Return every stored version of the symmetric key for `decryptionKeyId`,
@@ -400,6 +568,9 @@ class BaseMindooTenant {
      * tenant-default version so encryption keeps using the latest key.
      */
     async getDecryptionKeyCandidates(decryptionKeyId) {
+        if ((0, sealedTypes_1.isSealedKeyId)(decryptionKeyId)) {
+            return this.sealedGenerations.get(decryptionKeyId) ?? [];
+        }
         const id = decryptionKeyId === "default" ? types_1.DEFAULT_TENANT_KEY_ID : decryptionKeyId;
         const versions = await this.keyBag.getAllKeys("doc", this.tenantId, id);
         if (decryptionKeyId === "default" && versions.length > 0) {
@@ -415,7 +586,7 @@ class BaseMindooTenant {
         // Sign the payload
         const signature = await subtle.sign({
             name: "Ed25519",
-        }, signingKey, payload.buffer);
+        }, signingKey, payload.slice());
         this.logger.debug(`Signed payload (signature: ${signature.byteLength} bytes)`);
         return new Uint8Array(signature);
     }
@@ -467,11 +638,23 @@ class BaseMindooTenant {
         }, false, // not extractable
         ["sign"]);
         // Sign the payload
-        const signature = await subtle.sign({
+        const signatureBuffer = await subtle.sign({
             name: "Ed25519",
         }, signingKey, payload.buffer);
+        const signature = new Uint8Array(signatureBuffer);
+        // Prove the decrypted private key belongs to the claimed public key.
+        // Directory helpers historically paired `getAdministrationPublicKey()` with
+        // whatever private key the UI passed; admin-only then compared only the
+        // claimed PEM and accepted the write into local memory. Verifying here
+        // closes that gap before any store entry is attributed to that public key.
+        const verifyKey = await this.importVerifyKeyCached(signingKeyPair.publicKey);
+        const matches = await subtle.verify({ name: "Ed25519" }, verifyKey, signature.buffer, payload.buffer);
+        if (!matches) {
+            throw new Error("Signing key pair mismatch: the decrypted private key does not correspond to the claimed public key. "
+                + "For admin-only databases this usually means a non-admin identity was used as the tenant admin.");
+        }
         this.logger.debug(`Signed payload with provided key (signature: ${signature.byteLength} bytes)`);
-        return new Uint8Array(signature);
+        return signature;
     }
     async verifySignature(payload, signature, publicKey) {
         this.logger.debug(`Verifying signature`);
@@ -645,7 +828,8 @@ class BaseMindooTenant {
         // Every local database belonging to this tenant: the directory plus any
         // opened/known data databases. Wipe is a whole-tenant operation.
         const dbIds = new Set([
-            "directory",
+            types_1.DIRECTORY_DB_ID,
+            types_1.USER_DIRECTORY_DB_ID,
             ...this.databaseCache.keys(),
             ...(additionalDbIds ?? []),
         ]);
@@ -701,7 +885,7 @@ class BaseMindooTenant {
         }
     }
     async assertCurrentUserCanOpenDB(id) {
-        if (id === "directory") {
+        if (id === types_1.DIRECTORY_DB_ID || id === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         const currentUser = await this.getCurrentUserId();
@@ -757,7 +941,7 @@ class BaseMindooTenant {
         const validDbId = (0, databaseIdValidation_1.validateDatabaseId)(id, "dbId");
         // Enforce admin-only mode for directory database - this is a security invariant
         // The directory database must only accept entries signed by the admin key
-        const effectiveOptions = validDbId === "directory"
+        const effectiveOptions = validDbId === types_1.DIRECTORY_DB_ID
             ? { ...options, adminOnlyDb: true }
             : options ?? {};
         const normalizedTimeTravelDate = this.normalizeTimeTravelDate(effectiveOptions.timeTravelDate);
@@ -765,22 +949,41 @@ class BaseMindooTenant {
             ? validDbId
             : `${validDbId}::tt:${normalizedTimeTravelDate}`;
         await this.assertCurrentUserCanOpenDB(validDbId);
-        // Return cached database if it exists
         const cached = this.databaseCache.get(databaseCacheKey);
         if (cached) {
-            // For directory DB, verify admin-only flag matches (defensive check)
-            if (validDbId === "directory" && !cached.isAdminOnlyDb()) {
+            if (validDbId === types_1.DIRECTORY_DB_ID && !cached.isAdminOnlyDb()) {
                 throw new Error("Directory database was cached without adminOnlyDb - this should never happen");
             }
-            // Live databases must reflect the current KeyBag state before they
-            // are handed back to callers. Time-travel snapshots are immutable
-            // historical views and intentionally do not participate in
-            // visibility reconciliation, so we skip the call for them.
             if (normalizedTimeTravelDate == null) {
                 await this.reconcileKeyBagChanges();
             }
             return cached;
         }
+        const inFlight = this.databaseOpenInFlight.get(databaseCacheKey);
+        if (inFlight) {
+            return inFlight;
+        }
+        let resolveOpen;
+        let rejectOpen;
+        const opening = new Promise((resolve, reject) => {
+            resolveOpen = resolve;
+            rejectOpen = reject;
+        });
+        this.databaseOpenInFlight.set(databaseCacheKey, opening);
+        try {
+            const db = await this.openDBUncached(validDbId, databaseCacheKey, effectiveOptions, normalizedTimeTravelDate);
+            resolveOpen(db);
+            return db;
+        }
+        catch (error) {
+            rejectOpen(error);
+            throw error;
+        }
+        finally {
+            this.databaseOpenInFlight.delete(databaseCacheKey);
+        }
+    }
+    async openDBUncached(validDbId, databaseCacheKey, effectiveOptions, normalizedTimeTravelDate) {
         // Extract store options and DB-specific options
         const { adminOnlyDb, timeTravelDate: _timeTravelDate, persistTimeTravelCache, autoIndexing, attachmentConfig, documentCacheConfig, snapshotConfig, performanceCallback, ...storeOptions } = effectiveOptions;
         // Snapshot opens can share an already-open live store instance. This keeps
@@ -1056,50 +1259,23 @@ class BaseMindooTenant {
         const signerLogger = this.logger.createChild("MindooDocSigner");
         return new MindooDocSigner_1.MindooDocSigner(this, signKey, signerLogger);
     }
-    async exportJoinResponseDocKeyVersions(keyId, sharePassword) {
-        const scopedKeyId = `doc:${this.tenantId}:${keyId}`;
-        const details = (await this.keyBag.listKeyDetails())
-            .filter((detail) => detail.scopedKeyId === scopedKeyId)
-            .sort((a, b) => a.versionIndex - b.versionIndex);
-        if (details.length === 0) {
+    async exportJoinResponseDocKeyVersions(keyId, recipientEncryptionPublicKey) {
+        const keyVersions = await this.keyBag.getAllKeyVersions("doc", this.tenantId, keyId);
+        if (keyVersions.length === 0) {
             throw new Error(`Failed to export document key "${keyId}" for tenant "${this.tenantId}"`);
         }
+        const rsa = new RSAEncryption_1.RSAEncryption(this.cryptoAdapter, this.logger.createChild("RSAEncryption"));
         const versions = [];
-        for (const detail of details) {
-            const encryptedKey = await this.keyBag.encryptAndExportKeyVersion("doc", this.tenantId, keyId, detail.versionIndex, sharePassword);
-            if (!encryptedKey) {
-                throw new Error(`Failed to export document key "${keyId}" version ${detail.versionIndex} for tenant "${this.tenantId}"`);
-            }
-            const { createdAt: encryptedKeyCreatedAt, ...encryptedKeyPayload } = encryptedKey;
+        for (const version of keyVersions) {
             versions.push({
-                createdAt: detail.createdAt ?? encryptedKeyCreatedAt,
-                encryptedKey: encryptedKeyPayload,
+                createdAt: version.createdAt,
+                wrappedKey: await rsa.wrapKeyToBase64(version.key, recipientEncryptionPublicKey),
             });
         }
         return { keyId, versions };
     }
-    resolveJoinResponseDocKeyIds(options) {
-        const requestedKeyIds = options.sharedDocKeyIds ?? [types_1.PUBLIC_INFOS_KEY_ID, types_1.DEFAULT_TENANT_KEY_ID];
-        const keyIds = new Set();
-        keyIds.add(types_1.PUBLIC_INFOS_KEY_ID);
-        for (const keyId of requestedKeyIds) {
-            const normalizedKeyId = keyId.trim();
-            if (normalizedKeyId) {
-                keyIds.add(normalizedKeyId);
-            }
-        }
-        return [
-            types_1.PUBLIC_INFOS_KEY_ID,
-            ...Array.from(keyIds)
-                .filter((keyId) => keyId !== types_1.PUBLIC_INFOS_KEY_ID)
-                .sort((a, b) => {
-                if (a === types_1.DEFAULT_TENANT_KEY_ID)
-                    return -1;
-                if (b === types_1.DEFAULT_TENANT_KEY_ID)
-                    return 1;
-                return a.localeCompare(b);
-            }),
-        ];
+    resolveJoinResponseDocKeyIds(_options) {
+        return [types_1.PUBLIC_INFOS_KEY_ID];
     }
     async approveJoinRequest(joinRequest, options) {
         // Parse the join request if it's a URI string
@@ -1138,17 +1314,81 @@ class BaseMindooTenant {
         // overrides the one suggested by the joining user in the request.
         const deviceLabel = typeof options.label === "string" && options.label.trim().length > 0
             ? options.label.trim()
-            : request.label;
-        await directory.registerUser(publicUserId, options.adminSigningKey, options.adminPassword, undefined, deviceLabel);
-        // 2. Export selected document keys encrypted with the share password.
-        // `$publicinfos` is mandatory because the joining user needs it for
-        // directory access; all selected key ids include every rotated version.
-        const encryptedDocKeys = await Promise.all(this.resolveJoinResponseDocKeyIds(options).map((keyId) => this.exportJoinResponseDocKeyVersions(keyId, options.sharePassword)));
+            : typeof request.label === "string"
+                ? request.label.trim()
+                : "";
+        if (!deviceLabel) {
+            throw new Error("Device label is required when granting access");
+        }
+        await directory.registerUser(publicUserId, options.adminSigningKey, options.adminPassword, undefined, deviceLabel, {
+            distributeKeyIds: [],
+        });
+        const userPublicKey = typeof request.userPublicKey === "string" ? request.userPublicKey.trim() : "";
+        if (userPublicKey) {
+            const userKeyDoc = await this.userKeys.createPendingFromJoin({
+                username,
+                userPublicKey,
+                signingKeyPair: {
+                    publicKey: this.administrationPublicKey,
+                    privateKey: options.adminSigningKey,
+                },
+                signingKeyPassword: options.adminPassword,
+            });
+            const payload = (0, validateUserKeyDocument_1.asUserKeyPayload)(userKeyDoc.getData());
+            const epoch = payload ? (0, types_2.currentUserKeyEpoch)(payload) : null;
+            const publishedPublicKey = epoch ? payload?.userKeys[epoch]?.publicKey : undefined;
+            // First device: wrap `default` to the join-request User-Key (pending is
+            // OK). Additional device: wrap to the already-published User-Key — never
+            // to this device's freshly generated pair.
+            if (publishedPublicKey === userPublicKey) {
+                await directory.autoDistributeKeysToUser(username, [types_1.DEFAULT_TENANT_KEY_ID], options.adminSigningKey, options.adminPassword, userPublicKey);
+            }
+            else if (publishedPublicKey) {
+                await directory.autoDistributeKeysToUser(username, [types_1.DEFAULT_TENANT_KEY_ID], options.adminSigningKey, options.adminPassword);
+            }
+        }
+        else {
+            const existingUserKey = await this.userKeys.publishedUserKeyFor(username);
+            if (!existingUserKey) {
+                throw new Error("Cannot approve join request: it carries no userPublicKey and the person has no published User-Key. Generate a User-Key on the joining device first.");
+            }
+            await directory.autoDistributeKeysToUser(username, [types_1.DEFAULT_TENANT_KEY_ID], options.adminSigningKey, options.adminPassword);
+        }
+        // Same person: wrap the published User-Key to this device's encryption
+        // key (from the grant). A different existing person stays pending until
+        // one of *their* devices writes the wrap — this replica cannot.
+        const current = await this.getCurrentUserId();
+        const samePerson = (0, userid_1.usernamesEqual)(current.username, username);
+        console.log("[approveJoinRequest] User-Key wrap decision", {
+            joiningUsername: username,
+            currentUsername: current.username,
+            samePerson,
+            hasEncryptionPublicKey: !!request.encryptionPublicKey,
+        });
+        if (samePerson) {
+            try {
+                await this.userKeys.wrapUserKeyForGrantDevice(request.encryptionPublicKey, deviceLabel);
+                console.log(`[approveJoinRequest] ✓ wrapped User-Key for joining device of "${username}"`);
+                this.logger.info(`approveJoinRequest: wrapped User-Key for joining device of "${username}"`);
+            }
+            catch (error) {
+                console.error("[approveJoinRequest] User-Key wrap for joining device failed", error);
+                this.logger.error(`approveJoinRequest: User-Key wrap for joining device failed (${error instanceof Error ? error.message : error})`);
+            }
+        }
+        else {
+            this.logger.info(`approveJoinRequest: User-Key wrap deferred; joining "${username}" is not the current user "${current.username}"`);
+        }
+        // 2. Export selected document keys RSA-OAEP-wrapped to the requester's
+        // encryption public key. `$publicinfos` is mandatory because the joining
+        // user needs it for directory access; all selected key ids include every
+        // rotated version.
+        const encryptedDocKeys = await Promise.all(this.resolveJoinResponseDocKeyIds(options).map((keyId) => this.exportJoinResponseDocKeyVersions(keyId, request.encryptionPublicKey)));
         // 3. Build the join response. It echoes the registered username so the
         //    joining device can adopt it instead of keeping a name the directory
         //    does not hold.
         const joinResponse = {
-            v: 2,
+            v: 3,
             tenantId: this.tenantId,
             adminSigningPublicKey: this.administrationPublicKey,
             adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
@@ -1168,7 +1408,7 @@ class BaseMindooTenant {
         else {
             try {
                 const directoryDb = await this.openDB("directory", { adminOnlyDb: true });
-                const setupLabel = await (0, tenantSetup_1.readTenantSetupLabel)(directoryDb);
+                const setupLabel = await (0, tenantSetup_1.readTenantSetupLabel)(directoryDb, this);
                 if (setupLabel) {
                     joinResponse.tenantLabel = setupLabel;
                 }
@@ -1177,6 +1417,36 @@ class BaseMindooTenant {
                 // Best-effort: older tenants or missing setup doc.
             }
         }
+        const rsa = new RSAEncryption_1.RSAEncryption(this.cryptoAdapter, this.logger.createChild("RSAEncryption"));
+        const wrappedJoinResponse = await (0, deviceJoinBootstrap_1.wrapDeviceJoinBootstrap)(rsa, {
+            username,
+            tenantLabel: joinResponse.tenantLabel,
+            adminUsername: joinResponse.adminUsername,
+        }, request.encryptionPublicKey);
+        await directory.attachDeviceJoinBootstrap(username, request.signingPublicKey, wrappedJoinResponse, options.adminSigningKey, options.adminPassword);
+        // Tenants created before `tenantsetup` recorded administrators have no
+        // entry, leaving members with a fingerprint instead of a name. A grant is
+        // where the admin supplies both its name and its keys, so heal it here.
+        if (options.adminUsername) {
+            try {
+                const directoryDb = await this.openDB("directory", { adminOnlyDb: true });
+                const written = await (0, tenantSetup_1.ensureTenantSetupAdministrator)(directoryDb, {
+                    username: options.adminUsername,
+                    keyPairs: [
+                        {
+                            signingPublicKey: this.administrationPublicKey,
+                            encryptionPublicKey: this.administrationEncryptionPublicKey,
+                        },
+                    ],
+                }, { publicKey: this.administrationPublicKey, privateKey: options.adminSigningKey }, options.adminPassword, this);
+                if (written) {
+                    this.logger.info(`approveJoinRequest: recorded administrator "${options.adminUsername}" in tenantsetup`);
+                }
+            }
+            catch (error) {
+                this.logger.warn(`approveJoinRequest: recording the administrator in tenantsetup failed: ${error instanceof Error ? error.message : error}`);
+            }
+        }
         console.log(`[approveJoinRequest] ✓ Join request approved for user "${username}"`);
         this.logger.info(`Join request approved for user: ${username}`);
         // Return as URI string or object depending on format option
@@ -1342,8 +1612,9 @@ class BaseMindooTenant {
             const signingKey = await this.getDecryptedSigningKey();
             // Get the current user's decrypted RSA encryption private key (for decrypting entries)
             const decryptedEncryptionKey = await this.getDecryptedEncryptionKey();
-            // Create the client network store
-            const store = new ClientNetworkContentAddressedStore(validDbId, storeKind, transport, this.cryptoAdapter, this.currentUser.username, signingKey, decryptedEncryptionKey, this.logger.createChild(`ClientNetworkStore:${validDbId}:${storeKind}`));
+            // Create the client network store. Pass the device signing public key so
+            // auth challenges can identify this specific device on multi-device grants.
+            const store = new ClientNetworkContentAddressedStore(validDbId, storeKind, transport, this.cryptoAdapter, this.currentUser.username, signingKey, decryptedEncryptionKey, this.logger.createChild(`ClientNetworkStore:${validDbId}:${storeKind}`), this.currentUser.userSigningKeyPair.publicKey);
             console.log(`[connectToServer] ✓ Connected to server for db "${validDbId}"`);
             this.logger.info(`Connected to server for db "${validDbId}"`);
             return store;
@@ -1507,6 +1778,9 @@ class BaseMindooTenant {
      * @returns true if the key can be resolved, false otherwise
      */
     async hasDecryptionKey(decryptionKeyId) {
+        if ((0, sealedTypes_1.isSealedKeyId)(decryptionKeyId)) {
+            return (this.sealedGenerations.get(decryptionKeyId)?.length ?? 0) > 0;
+        }
         try {
             await this.getSymmetricKey(decryptionKeyId);
             return true;
@@ -1529,14 +1803,14 @@ class BaseMindooTenant {
         return this.keyBag.getDocKeyFingerprint(this.tenantId);
     }
     /**
-     * Remove a **named** document key from the local KeyBag. Refuses to delete the
-     * shared tenant default key (`"default"` / {@link DEFAULT_TENANT_KEY_ID}),
-     * which is required for the tenant to function. Returns true if a key was
-     * removed.
+     * Remove a **named** document key from the local KeyBag. Refuses to delete
+     * `$publicinfos` (required for directory access). The tenant `default` key
+     * may be removed when a key-distribution `pullfrom` revokes content access.
+     * Returns true if a key was removed.
      */
     async removeNamedDecryptionKey(decryptionKeyId) {
-        if (decryptionKeyId === "default" || decryptionKeyId === types_1.DEFAULT_TENANT_KEY_ID) {
-            this.logger.debug(`removeNamedDecryptionKey: refusing to delete the tenant default key`);
+        if (decryptionKeyId === types_1.PUBLIC_INFOS_KEY_ID) {
+            this.logger.debug(`removeNamedDecryptionKey: refusing to delete the public-infos key`);
             return false;
         }
         try {
@@ -1573,19 +1847,24 @@ class BaseMindooTenant {
         const directory = await this.openDirectory();
         const removed = [];
         const imported = [];
-        // Revoke pass — no key, no comparison, idempotent.
-        if (typeof directory.getRevokedDecryptionKeyIdsForUser === "function") {
-            let revokedIds = [];
-            try {
-                revokedIds = await directory.getRevokedDecryptionKeyIdsForUser(username);
+        // Revoke pass — no key, no comparison, idempotent. Prefer signing-key
+        // lookup when the local username is empty (nameless device bootstrap).
+        let revokedIds = [];
+        try {
+            if (!username.trim() &&
+                typeof directory.getRevokedDecryptionKeyIdsForSigningKey === "function") {
+                revokedIds = await directory.getRevokedDecryptionKeyIdsForSigningKey(this.currentUser.userSigningKeyPair.publicKey);
             }
-            catch (error) {
-                this.logger.warn(`reconcileKeyDistributionsForCurrentUser: revoked-id lookup failed: ${error}`);
+            else if (typeof directory.getRevokedDecryptionKeyIdsForUser === "function") {
+                revokedIds = await directory.getRevokedDecryptionKeyIdsForUser(username);
             }
-            for (const keyId of revokedIds) {
-                if (await this.removeNamedDecryptionKey(keyId)) {
-                    removed.push(keyId);
-                }
+        }
+        catch (error) {
+            this.logger.warn(`reconcileKeyDistributionsForCurrentUser: revoked-id lookup failed: ${error}`);
+        }
+        for (const keyId of revokedIds) {
+            if (await this.removeNamedDecryptionKey(keyId)) {
+                removed.push(keyId);
             }
         }
         // Import pass — sources the encryption private key from this tenant. The
@@ -1605,7 +1884,41 @@ class BaseMindooTenant {
                 this.logger.warn(`reconcileKeyDistributionsForCurrentUser: import pass failed: ${error}`);
             }
         }
-        return { imported, removed };
+        let adoptedUsername;
+        if (imported.includes(types_1.DEFAULT_TENANT_KEY_ID) ||
+            imported.includes("default")) {
+            adoptedUsername = await this.adoptRegisteredUsernameFromGrant(directory);
+        }
+        return { imported, removed, ...(adoptedUsername ? { adoptedUsername } : {}) };
+    }
+    /**
+     * After importing the tenant `default` key, decrypt grant `user_details` and
+     * adopt the registered username so local identity matches the directory
+     * (same outcome as join-response `username`).
+     */
+    async adoptRegisteredUsernameFromGrant(directory) {
+        try {
+            if (typeof directory.getUserBySigningPublicKey !== "function")
+                return undefined;
+            const lookup = await directory.getUserBySigningPublicKey(this.currentUser.userSigningKeyPair.publicKey);
+            const registered = (typeof lookup?.details?.username === "string" && lookup.details.username.trim()) ||
+                (typeof lookup?.username === "string" &&
+                    lookup.username.trim() &&
+                    // Server-side lookups return username_hash when details are opaque;
+                    // only adopt cleartext names (contain '/' for DN form, or non-hex).
+                    (lookup.username.includes("/") || !/^[a-f0-9]{64}$/i.test(lookup.username))
+                    ? lookup.username.trim()
+                    : "");
+            if (!registered || registered === this.currentUser.username)
+                return undefined;
+            this.logger.info(`Adopting registered username "${registered}" (was "${this.currentUser.username}")`);
+            this.currentUser = { ...this.currentUser, username: registered };
+            return registered;
+        }
+        catch (error) {
+            this.logger.debug(`adoptRegisteredUsernameFromGrant failed: ${error}`);
+            return undefined;
+        }
     }
     /**
      * Single-flight, best-effort wrapper around
@@ -1717,13 +2030,14 @@ class BaseMindooTenant {
     /**
      * Remove exactly the key versions of `keyId` whose raw-bytes fingerprint is in
      * `fingerprints` (version-scoped `pullfrom` revocation). Versions obtained
-     * elsewhere — i.e. not in the distribution manifest — survive. Refuses the
-     * protected tenant default / `$publicinfos` keys. The KeyBag change feed
-     * triggers visibility reconciliation (scope purge when nothing remains).
+     * elsewhere — i.e. not in the distribution manifest — survive. Refuses
+     * `$publicinfos` (directory access). The tenant `default` key may be version-
+     * revoked via key distribution. The KeyBag change feed triggers visibility
+     * reconciliation (scope purge when nothing remains).
      * Returns the number of versions removed.
      */
     async removeDecryptionKeyVersionsByFingerprint(keyId, fingerprints) {
-        if (keyId === "default" || keyId === types_1.DEFAULT_TENANT_KEY_ID || keyId === types_1.PUBLIC_INFOS_KEY_ID) {
+        if (keyId === types_1.PUBLIC_INFOS_KEY_ID) {
             this.logger.debug(`removeDecryptionKeyVersionsByFingerprint: refusing protected key ${keyId}`);
             return 0;
         }
@@ -1768,6 +2082,13 @@ class BaseMindooTenant {
      * @returns The decrypted symmetric key bytes
      */
     async getSymmetricKey(decryptionKeyId) {
+        if ((0, sealedTypes_1.isSealedKeyId)(decryptionKeyId)) {
+            const generations = this.sealedGenerations.get(decryptionKeyId);
+            if (!generations?.length) {
+                throw new errors_1.SymmetricKeyNotFoundError(decryptionKeyId);
+            }
+            return generations[0];
+        }
         if (decryptionKeyId === "default") {
             // Use cached tenant encryption key if available
             if (this.decryptedTenantKeyCache) {