mindoodb 0.0.51 → 0.0.54

package/dist/core/BaseMindooDB.js

@@ -9,7 +9,7 @@ const storeEntryTime_1 = require("./storeEntryTime");
 const uuid_1 = require("uuid");
 const types_1 = require("./types");
 const types_2 = require("./appendonlystores/types");
-const bloom_1 = require("./appendonlystores/bloom");
+const syncStores_1 = require("./appendonlystores/syncStores");
 const types_3 = require("./appendonlystores/network/types");
 const MaterializationPlanner_1 = require("./appendonlystores/MaterializationPlanner");
 const DocumentDagAnalysis_1 = require("./DocumentDagAnalysis");
@@ -24,8 +24,12 @@ const copyDocuments_1 = require("./copy/copyDocuments");
 const materializationGuard_1 = require("./accesscontrol/materializationGuard");
 const Ed25519WitnessProvider_1 = require("./accesscontrol/timestamp/Ed25519WitnessProvider");
 const AccessDeniedError_1 = require("./accesscontrol/AccessDeniedError");
+const DirectoryStateNode_1 = require("./accesscontrol/DirectoryStateNode");
 const logging_1 = require("./logging");
 const databaseIdValidation_1 = require("./databaseIdValidation");
+const builtinDbInvariants_1 = require("./builtinDbInvariants");
+const recipients_1 = require("./userkeys/recipients");
+const sealedTypes_1 = require("./userkeys/sealedTypes");
 const DocumentSummaryStore_1 = require("./indexing/summary/DocumentSummaryStore");
 const types_4 = require("./indexing/summary/types");
 const DocumentFullTextIndex_1 = require("./indexing/fulltext/DocumentFullTextIndex");
@@ -219,12 +223,13 @@ class BaseMindooDB {
          */
         this.aclActiveCache = null;
         /**
-         * Per-document cache of the original creator's signing public key (the
-         * `doc_create` entry's `createdByPublicKey`). Used by the client write
-         * prechecks to resolve `$author` (`isAuthor`) without re-scanning metadata on
-         * every change/delete. Populated on create and lazily on first lookup.
+         * Per-document cache of the original creator's signing public key and the
+         * trusted time of the `doc_create` entry. Used by the client write prechecks
+         * to resolve `$author` (`isAuthor`) at grant level without re-scanning
+         * metadata on every change/delete. Populated on create and lazily on first
+         * lookup.
          */
-        this.creatorKeyCache = new Map();
+        this.creatorInfoCache = new Map();
         // Internal changefeed index: sorted by (changeSeq, docId) for deterministic iteration.
         // lastModified remains available for UX metadata but is not the primary cursor key.
         this.index = [];
@@ -347,6 +352,35 @@ class BaseMindooDB {
          * from the cached materialization and seeds the pending map from them.
          */
         this.legacyCheckpointNeedsAuthorTrustScan = false;
+        /**
+         * Ids of documents that exist in the local store but cannot be read with
+         * the current KeyBag, so they are absent from the index and from every
+         * document listing.
+         *
+         * The index alone cannot answer "how much is hidden from me": a document
+         * that was never readable on this device gets no index entry at all (see
+         * {@link reconcileKeyVisibility}), and one that lost its key becomes an
+         * `"inaccessible"` tombstone that listings filter out. This set is the
+         * only place that remembers both cases, which is what
+         * {@link getInaccessibleDocumentCount} reports so a UI can tell an empty
+         * database apart from one whose keys have not arrived yet.
+         *
+         * Counts documents regardless of their deletion state - the question it
+         * answers is "is it here and unreadable", which is knowable without the
+         * key, unlike a reliable lifecycle state for a doc we cannot decrypt.
+         *
+         * Persisted in the metadata checkpoint: a warm start with an unchanged
+         * KeyBag skips the visibility scan, so an in-memory-only tally would
+         * silently reset to zero on every restart.
+         */
+        this.inaccessibleDocIds = new Set();
+        /**
+         * Set while restoring a metadata checkpoint that predates
+         * {@link inaccessibleDocIds}. Forces one visibility scan at open so the
+         * tally starts out complete instead of counting only what happens to
+         * arrive in this session.
+         */
+        this.legacyCheckpointNeedsVisibilityTally = false;
         // Local cache support
         this.cacheManager = null;
         this.cachePrefix = null;
@@ -453,6 +487,12 @@ class BaseMindooDB {
          * the warmer settled can still display its outcome.
          */
         this.warmerProgress = null;
+        /** `username_hash` per userdirectory document, filled from creates. */
+        this.userdirectoryHashByDocId = new Map();
+        /** Grant `username_hash` for a signing public key at "now". */
+        this.signerUsernameHashByKey = new Map();
+        /** Owning person per personal userdirectory document (its create signer). */
+        this.personalDocCreatorHashByDocId = new Map();
         // ---------------------------------------------------------------------------
         // Author-trust reconciliation: heal documents whose entries were skipped
         // because their author was not yet known to the tenant directory.
@@ -528,6 +568,171 @@ class BaseMindooDB {
     getAdminPublicKey() {
         return this.tenant.getAdministrationPublicKey();
     }
+    /**
+     * Database id used by the builtin-write registry. Admin-only databases that
+     * are not `userdirectory` are treated like `directory` (admin-only writes).
+     */
+    effectiveBuiltinDbId() {
+        const dbId = this.store.getId();
+        if (this._isAdminOnlyDb && dbId !== types_1.USER_DIRECTORY_DB_ID) {
+            return types_1.DIRECTORY_DB_ID;
+        }
+        return dbId;
+    }
+    usernameHashFromRecord(payload) {
+        if (!payload || typeof payload !== "object")
+            return null;
+        const value = payload.username_hash;
+        return typeof value === "string" && value.length > 0 ? value : null;
+    }
+    usernameHashFromInternalDoc(internalDoc) {
+        return this.usernameHashFromRecord(this.convertAutomergeToJS(internalDoc.doc));
+    }
+    async resolveSignerUsernameHash(signerKey) {
+        try {
+            const directory = await this.tenant.openDirectory();
+            if (typeof directory.resolveUsernameHashForSigningKey !== "function") {
+                return null;
+            }
+            return directory.resolveUsernameHashForSigningKey(signerKey, Number.MAX_SAFE_INTEGER);
+        }
+        catch {
+            return null;
+        }
+    }
+    async resolveSignerPublicKey(signingKeyPair) {
+        if (signingKeyPair)
+            return signingKeyPair.publicKey;
+        return (await this.tenant.getCurrentUserId()).userSigningPublicKey;
+    }
+    /**
+     * Hard-wired write gate for `directory` / `userdirectory` (and other
+     * admin-only databases). Independent of the ACL master switch.
+     */
+    async assertBuiltinWriteAllowed(op, signerPublicKey, documentUsernameHash, docId) {
+        const dbId = this.effectiveBuiltinDbId();
+        if (!(0, builtinDbInvariants_1.hasBuiltinWriteInvariant)(dbId) && !this._isAdminOnlyDb) {
+            return;
+        }
+        let signerUsernameHash = null;
+        let creatorUsernameHash = null;
+        if (dbId === types_1.USER_DIRECTORY_DB_ID) {
+            signerUsernameHash = await this.resolveSignerUsernameHash(signerPublicKey);
+            this.signerUsernameHashByKey.set(signerPublicKey, signerUsernameHash);
+            if ((0, builtinDbInvariants_1.isPersonalUserdirectoryDocId)(docId)) {
+                creatorUsernameHash =
+                    op === "doc_create"
+                        ? signerUsernameHash
+                        : await this.ensurePersonalDocCreatorHash(docId);
+            }
+        }
+        const decision = (0, builtinDbInvariants_1.evaluateBuiltinWrite)({
+            dbId,
+            op,
+            signerKey: signerPublicKey,
+            adminPublicKey: this.getAdminPublicKey(),
+            documentUsernameHash,
+            signerUsernameHash,
+            docId,
+            creatorUsernameHash,
+        });
+        if (!decision.allowed) {
+            throw new Error(decision.reason);
+        }
+    }
+    /**
+     * Load-path counterpart: drop entries that the builtin invariant forbids.
+     * Username-hash matching for userdirectory creates is enforced on write and
+     * on the server. Admin-signed changes load only when the signer is also the
+     * person named by the document (the tenant founder wrapping their own key).
+     */
+    async shouldSkipLoadedEntryForBuiltin(entry) {
+        const dbId = this.effectiveBuiltinDbId();
+        const entryType = entry.entryType ?? "doc_change";
+        let documentUsernameHash = null;
+        let signerUsernameHash = null;
+        let creatorUsernameHash = null;
+        if (dbId === types_1.USER_DIRECTORY_DB_ID && (0, builtinDbInvariants_1.isPersonalUserdirectoryDocId)(entry.docId)) {
+            if (entryType !== "doc_create") {
+                creatorUsernameHash = await this.ensurePersonalDocCreatorHash(entry.docId);
+                signerUsernameHash = await this.ensureSignerUsernameHash(entry.createdByPublicKey);
+            }
+        }
+        else if (dbId === types_1.USER_DIRECTORY_DB_ID &&
+            (entryType === "doc_change" || entryType === "doc_snapshot") &&
+            entry.docId) {
+            documentUsernameHash = await this.ensureUserdirectoryDocHash(entry.docId);
+            signerUsernameHash = await this.ensureSignerUsernameHash(entry.createdByPublicKey);
+        }
+        return (0, builtinDbInvariants_1.shouldSkipLoadedEntry)({
+            dbId,
+            entryType,
+            signerKey: entry.createdByPublicKey,
+            adminPublicKey: this.getAdminPublicKey(),
+            documentUsernameHash,
+            signerUsernameHash,
+            docId: entry.docId,
+            creatorUsernameHash,
+        });
+    }
+    async ensureSignerUsernameHash(signerKey) {
+        if (this.signerUsernameHashByKey.has(signerKey)) {
+            return this.signerUsernameHashByKey.get(signerKey) ?? null;
+        }
+        const hash = await this.resolveSignerUsernameHash(signerKey);
+        this.signerUsernameHashByKey.set(signerKey, hash);
+        return hash;
+    }
+    /**
+     * Owner of a personal `userdirectory` document: the person who signed its
+     * `doc_create`, resolved through grants rather than the payload. A sealed
+     * document is opaque to everyone but its owner, so the payload is not an
+     * option — and grants map every device of a person to one hash, which is
+     * exactly the granularity ownership needs.
+     */
+    async ensurePersonalDocCreatorHash(docId) {
+        const cached = this.personalDocCreatorHashByDocId.get(docId);
+        if (cached !== undefined)
+            return cached;
+        let hash = null;
+        try {
+            const metas = await this.scanAllMetadata(this.store, { docId });
+            const create = metas.find((meta) => meta.entryType === "doc_create");
+            if (create) {
+                hash = await this.ensureSignerUsernameHash(create.createdByPublicKey);
+            }
+        }
+        catch {
+            hash = null;
+        }
+        // Only a resolved owner is worth caching: a miss usually means the create
+        // entry has not arrived yet, and the next write must ask again.
+        if (hash)
+            this.personalDocCreatorHashByDocId.set(docId, hash);
+        return hash;
+    }
+    async ensureUserdirectoryDocHash(docId) {
+        const cached = this.userdirectoryHashByDocId.get(docId);
+        if (cached)
+            return cached;
+        try {
+            const metas = await this.scanAllMetadata(this.store, { docId });
+            const create = metas.find((meta) => meta.entryType === "doc_create");
+            if (!create)
+                return null;
+            const [entry] = await this.store.getEntries([create.id]);
+            if (!entry)
+                return null;
+            const decrypted = await this.tenant.decryptPayload(entry.encryptedData, entry.decryptionKeyId);
+            const hash = (0, builtinDbInvariants_1.usernameHashFromCreateChangeBytes)(decrypted);
+            if (hash)
+                this.userdirectoryHashByDocId.set(docId, hash);
+            return hash;
+        }
+        catch {
+            return null;
+        }
+    }
     isAdminOnlyDb() {
         return this._isAdminOnlyDb;
     }
@@ -715,7 +920,7 @@ class BaseMindooDB {
         // indexing (DirectoryTimeTravelIndex) and its change events interleave
         // with access-control evaluation; admin-only databases hold no user
         // data worth summarizing. Explicit getSummaryStore() calls still work.
-        if (this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         const hasSetupChange = changes.some((change) => change.docId === types_4.DB_SETUP_DOC_ID);
@@ -950,7 +1155,7 @@ class BaseMindooDB {
             return;
         }
         // Same system-database exclusion as the summary auto-activation.
-        if (this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         const hasSetupChange = changes.some((change) => change.docId === types_4.DB_SETUP_DOC_ID);
@@ -1344,6 +1549,11 @@ class BaseMindooDB {
             }
         }
         checkpoint.pendingUntrustedAuthors = pendingUntrusted;
+        // Persist the unreadable-document tally (additive field). Written even
+        // when empty, for the same reason as above: the field's PRESENCE marks
+        // the checkpoint as tally-aware, so restore can tell "nothing hidden"
+        // apart from "written before this existed, count unknown".
+        checkpoint.inaccessibleDocIds = Array.from(this.inaccessibleDocIds);
         return new TextEncoder().encode(JSON.stringify(checkpoint));
     }
     /**
@@ -1390,6 +1600,22 @@ class BaseMindooDB {
             else {
                 this.legacyCheckpointNeedsAuthorTrustScan = true;
             }
+            // Unreadable-document tally. Missing field means the checkpoint predates
+            // it: the count would otherwise stay at zero for as long as the KeyBag
+            // is unchanged, because that is exactly when the visibility scan is
+            // skipped. Force one scan instead.
+            this.inaccessibleDocIds.clear();
+            if (Array.isArray(checkpoint.inaccessibleDocIds)) {
+                this.legacyCheckpointNeedsVisibilityTally = false;
+                for (const docId of checkpoint.inaccessibleDocIds) {
+                    if (typeof docId === "string") {
+                        this.inaccessibleDocIds.add(docId);
+                    }
+                }
+            }
+            else {
+                this.legacyCheckpointNeedsVisibilityTally = true;
+            }
             this.syncScanCursors.clear();
             if (checkpoint.syncScanCursors && typeof checkpoint.syncScanCursors === "object") {
                 for (const [key, value] of Object.entries(checkpoint.syncScanCursors)) {
@@ -1557,27 +1783,34 @@ class BaseMindooDB {
     /**
      * Get or import a CryptoKey for signature verification, with caching.
      * This avoids re-importing the same public key multiple times.
+     *
+     * Trust is evaluated at `trustedTime` when provided (grant membership in the
+     * directory node covering that time, or the tenant admin key). Callers that
+     * omit it keep the historical HEAD check via `validatePublicSigningKey`.
      */
-    async getOrImportPublicKey(publicKey) {
-        // Check cache first
-        if (this.publicKeyCache.has(publicKey)) {
-            return this.publicKeyCache.get(publicKey);
-        }
-        // Validate the public key is trusted
+    async getOrImportPublicKey(publicKey, trustedTime) {
         const directory = await this.tenant.openDirectory();
-        const isTrusted = await directory.validatePublicSigningKey(publicKey);
+        let isTrusted = false;
+        if (trustedTime !== undefined && typeof directory.getDirectoryStateAt === "function") {
+            const node = await directory.getDirectoryStateAt(trustedTime);
+            isTrusted =
+                !!(0, DirectoryStateNode_1.grantForSigningKey)(node, publicKey) || publicKey === this.getAdminPublicKey();
+        }
+        else {
+            isTrusted = await directory.validatePublicSigningKey(publicKey);
+        }
         if (!isTrusted) {
             this.logger.warn(`Public key not trusted: ${publicKey}`);
             return null;
         }
-        // Import the key
+        const cached = this.publicKeyCache.get(publicKey);
+        if (cached)
+            return cached;
         const subtle = this.tenant.getCryptoAdapter().getSubtle();
         const publicKeyBuffer = this.tenant.pemToArrayBuffer(publicKey);
         const cryptoKey = await subtle.importKey("spki", publicKeyBuffer, {
             name: "Ed25519",
-        }, false, // not extractable
-        ["verify"]);
-        // Cache the imported key
+        }, false, ["verify"]);
         this.publicKeyCache.set(publicKey, cryptoKey);
         return cryptoKey;
     }
@@ -1736,6 +1969,17 @@ class BaseMindooDB {
         // Every path that writes entries for a document lands here, so this is
         // where retained metadata for it goes stale (see scannedEntryMetadata).
         this.forgetScannedEntryMetadata(docId);
+        // Same reasoning for the unreadable-document tally: every reveal and every
+        // inaccessibility tombstone passes through here, so keeping it in step
+        // needs no bookkeeping at the individual call sites. The one case this
+        // misses is a document that was never readable, which produces no index
+        // entry at all - those call `noteInaccessibleDocument` directly.
+        if (accessState === "visible") {
+            this.forgetInaccessibleDocument(docId);
+        }
+        else {
+            this.noteInaccessibleDocument(docId);
+        }
         const assignedSeq = this.nextChangeSeq;
         const newEntry = {
             docId,
@@ -2003,7 +2247,8 @@ class BaseMindooDB {
                 // transition.
                 const currentFingerprint = await this.computeCurrentKeyBagFingerprint();
                 const fingerprintMatches = currentFingerprint !== null && currentFingerprint === this.lastReconciledKeyBagFingerprint;
-                if (!fingerprintMatches) {
+                if (!fingerprintMatches || this.legacyCheckpointNeedsVisibilityTally) {
+                    this.legacyCheckpointNeedsVisibilityTally = false;
                     await this.reconcileKeyVisibility();
                 }
                 this.markKeyBagFingerprintReconciled(currentFingerprint);
@@ -2055,7 +2300,7 @@ class BaseMindooDB {
         if (!this.summaryAutoUpdateEnabled || this.summarySetupProbed || this.summaryStore) {
             return;
         }
-        if (this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         this.summarySetupProbed = true;
@@ -2089,7 +2334,7 @@ class BaseMindooDB {
         if (!this.fulltextAutoUpdateEnabled || this.fulltextSetupProbed || this.fulltextIndex) {
             return;
         }
-        if (this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         if (this.isTimeTravelMode()) {
@@ -2122,6 +2367,39 @@ class BaseMindooDB {
         this.cacheMetaDirty = true;
         this.cacheManager?.markDirty();
     }
+    /**
+     * Remember that `docId` is present in the store but unreadable. Idempotent:
+     * the same document is re-observed on every sync batch that carries another
+     * entry for it.
+     */
+    noteInaccessibleDocument(docId) {
+        if (this.inaccessibleDocIds.has(docId)) {
+            return;
+        }
+        this.inaccessibleDocIds.add(docId);
+        this.cacheMetaDirty = true;
+        this.cacheManager?.markDirty();
+    }
+    /** Counterpart of {@link noteInaccessibleDocument} for a doc that became readable. */
+    forgetInaccessibleDocument(docId) {
+        if (!this.inaccessibleDocIds.delete(docId)) {
+            return;
+        }
+        this.cacheMetaDirty = true;
+        this.cacheManager?.markDirty();
+    }
+    /**
+     * How many documents this database holds locally that the current KeyBag
+     * cannot open. They appear in no listing and in no view, so this count is
+     * the only signal that a database looks emptier than it is - typically on a
+     * device whose user key is still waiting for approval.
+     *
+     * Includes deleted documents, and counts what has arrived on this device -
+     * not what the tenant holds.
+     */
+    getInaccessibleDocumentCount() {
+        return this.inaccessibleDocIds.size;
+    }
     /**
      * Derive the per-doc visibility summary needed to reconcile the index
      * against the current KeyBag state.
@@ -2254,12 +2532,12 @@ class BaseMindooDB {
             }
             const existingIndex = this.getDocIndexPosition(docId);
             const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
-            // Visibility is governed by key possession alone: documents whose
-            // decryption key is in the bag are visible; the rest are hidden. Which
-            // keys a user holds is governed by the key distribution model
-            // (docs/accesscontrol.md §13), not by a server/client read gate.
+            await this.tenant.ingestSealedFromEntries?.(visibility.decryptionKeyId, metadataByDoc.get(docId));
             const canRead = await this.tenant.hasDecryptionKey(visibility.decryptionKeyId);
             if (canRead) {
+                // This scan is the authority on visibility, so it also heals a tally
+                // that a visible->visible short-circuit below would leave untouched.
+                this.forgetInaccessibleDocument(docId);
                 // Reveal-on-add only triggers when the previous state was
                 // missing or inaccessible; visible->visible transitions stay
                 // idempotent via the existing `updateIndex` short-circuit.
@@ -2279,8 +2557,11 @@ class BaseMindooDB {
                 changed = true;
             }
             else {
-                // Already inaccessible (or never seen). Scrub defensively in
-                // case a previous session left an L2 record behind.
+                // Already inaccessible (or never seen, which is the common case on a
+                // device whose keys have not arrived). No index entry is written for
+                // it, so the tally is the only record that it is here at all.
+                this.noteInaccessibleDocument(docId);
+                // Scrub defensively in case a previous session left an L2 record behind.
                 await this.purgeMaterializedDocument(docId);
             }
         }
@@ -2407,7 +2688,7 @@ class BaseMindooDB {
      *     directory was synced in a session that never opened this DB).
      */
     async reconcileAuthorTrustAtOpen() {
-        if (this.isTimeTravelMode() || this._isAdminOnlyDb || this.store.getId() === "directory") {
+        if (this.isTimeTravelMode() || this._isAdminOnlyDb || this.store.getId() === types_1.DIRECTORY_DB_ID || this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
             return;
         }
         if (this.legacyCheckpointNeedsAuthorTrustScan) {
@@ -2601,6 +2882,10 @@ class BaseMindooDB {
                 const cachedDoc = this.getCachedDocument(docId);
                 let updatedDoc = null;
                 if (cachedDoc) {
+                    if (await this.dropSealedAccessIfUnwrapFailed(cachedDoc)) {
+                        this.logger.debug(`Dropping cached sealed document ${docId} — newest wrap is not for this user`);
+                        return;
+                    }
                     // Document is cached - try incremental update
                     this.logger.debug(`Document ${docId} found in cache, attempting incremental update`);
                     try {
@@ -2646,9 +2931,22 @@ class BaseMindooDB {
                         // Before indexing, verify the user has the decryption key so that
                         // documents the user cannot access do not appear in getAllDocumentIds.
                         const representativeEntry = docLifecycleEntries[0];
+                        await this.tenant.ingestSealedFromEntries?.(representativeEntry.decryptionKeyId, docLifecycleEntries);
                         const keyAvailable = await this.tenant.hasDecryptionKey(representativeEntry.decryptionKeyId);
                         if (!keyAvailable) {
                             this.logger.debug(`Skipping metadata-first index for doc ${docId} — decryption key "${representativeEntry.decryptionKeyId}" not available`);
+                            // This is where a device that is still waiting for its keys meets
+                            // most of the tenant: the doc is skipped before it ever reaches
+                            // the index, so record it for `getInaccessibleDocumentCount`.
+                            this.noteInaccessibleDocument(docId);
+                            const existingIndex = this.getDocIndexPosition(docId);
+                            const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
+                            if (existing?.accessState === "visible") {
+                                await this.purgeMaterializedDocument(docId);
+                                this.updateIndex(docId, existing.lastModified, true, representativeEntry.decryptionKeyId, "inaccessible");
+                                this.cacheMetaDirty = true;
+                                this.cacheManager?.markDirty();
+                            }
                         }
                         else {
                             // Cold sync: entryMetadataList is already the full doc history from
@@ -2695,6 +2993,7 @@ class BaseMindooDB {
                 // doc.
                 if (error instanceof errors_1.SymmetricKeyNotFoundError) {
                     this.logger.debug(`Skipping document ${docId} - missing key: ${error.keyId}`);
+                    this.noteInaccessibleDocument(docId);
                     // Avoid a per-doc scanAllMetadata round-trip here: everything
                     // we need is already in this batch's entryMetadataList plus the
                     // existing index entry (if any). We do NOT need a second pass
@@ -3005,54 +3304,8 @@ class BaseMindooDB {
             nextCursor: cursor,
         };
     }
-    /**
-     * Fetch a store's bloom filter summary, returning null if unsupported or on
-     * error. Used on the target for missing-id pre-screening (callers fall back
-     * to exact checks) and on the source for the total-entry-count progress
-     * denominator.
-     */
-    async getStoreBloomSummary(store) {
-        if (typeof store.getIdBloomSummary !== "function") {
-            return null;
-        }
-        try {
-            return await store.getIdBloomSummary();
-        }
-        catch (error) {
-            this.logger.warn("Failed to get bloom summary from store, falling back to exact checks", error);
-            return null;
-        }
-    }
-    static setSyncAbortSignalOnStore(store, signal) {
-        if ('setSyncAbortSignal' in store && typeof store.setSyncAbortSignal === 'function') {
-            store.setSyncAbortSignal(signal);
-        }
-    }
-    /**
-     * Fetch a store's head descriptor (`{ epoch, maxReceiptOrder }`), returning
-     * null when the store (or the remote server behind it) does not support it
-     * or the request fails. A null head simply disables the persisted-cursor
-     * fast path for this sync.
-     */
-    async getStoreHeadSafe(store) {
-        if (typeof store.getStoreHead !== "function") {
-            return null;
-        }
-        try {
-            return await store.getStoreHead();
-        }
-        catch (error) {
-            this.logger.debug("Store head unavailable, falling back to full scan", error);
-            return null;
-        }
-    }
-    /** Stable identity for a store in the persisted sync-cursor map. */
-    static syncStoreIdentity(store) {
-        return store.getCacheIdentity?.() ?? `${store.getId()}/${store.getStoreKind()}`;
-    }
-    /** Key for {@link syncScanCursors}: one record per (source, target) pair. */
-    syncScanCursorKey(sourceStore, targetStore) {
-        return `${BaseMindooDB.syncStoreIdentity(sourceStore)}->${BaseMindooDB.syncStoreIdentity(targetStore)}`;
+    getStoreBloomSummary(store) {
+        return (0, syncStores_1.getStoreBloomSummary)(store, this.logger);
     }
     /** Persist a sync scan cursor and schedule a checkpoint flush. */
     saveSyncScanCursor(key, record) {
@@ -3068,171 +3321,8 @@ class BaseMindooDB {
         this.cacheMetaDirty = true;
         this.cacheManager?.markDirty();
     }
-    /**
-     * From a list of candidate IDs, return only those the target store is
-     * missing.  Uses bloom-filter pre-screening when available, then falls
-     * back to exact `hasEntries` for the uncertain set.
-     */
-    async filterMissingIds(targetStore, candidateIds, bloom) {
-        let definitelyMissing = [];
-        let maybeExisting = candidateIds;
-        if (bloom) {
-            definitelyMissing = [];
-            maybeExisting = [];
-            for (const id of candidateIds) {
-                if ((0, bloom_1.bloomMightContainId)(bloom, id)) {
-                    maybeExisting.push(id);
-                }
-                else {
-                    definitelyMissing.push(id);
-                }
-            }
-        }
-        let missingIds = definitelyMissing;
-        if (maybeExisting.length > 0) {
-            const existing = await targetStore.hasEntries(maybeExisting);
-            const existingSet = new Set(existing);
-            missingIds = missingIds.concat(maybeExisting.filter((id) => !existingSet.has(id)));
-        }
-        return missingIds;
-    }
-    resolveTransferBatchSize(options) {
-        if (options?.transferBatchSize && options.transferBatchSize > 0) {
-            return options.transferBatchSize;
-        }
-        if (options?.storeKind === types_2.StoreKind.attachments) {
-            return 100;
-        }
-        return Math.min(options?.pageSize ?? 1000, BaseMindooDB.DEFAULT_DOCS_TRANSFER_BATCH_SIZE);
-    }
-    /**
-     * Transfer a set of entry IDs from source to target in fixed-size batches,
-     * emitting progress and checking for cancellation between each batch.
-     *
-     * Callers (cursor-scan path and legacy path) collect the IDs that need
-     * transferring, then delegate to this method instead of issuing one
-     * monolithic `getEntries`.  This gives three benefits:
-     *
-     * 1. The UI receives frequent progress updates with batch metadata so long
-     *    transfers no longer look frozen.
-     * 2. Cancellation can interrupt work between batches rather than waiting
-     *    for one large HTTP response to complete.
-     * 3. Each server-side `getEntries` + RSA encryption unit is smaller,
-     *    reducing the risk of socket timeouts on large payloads.
-     *
-     * Returns partial progress on cancellation so callers can report how much
-     * was actually transferred before the abort.
-     */
-    async transferEntriesInBatches(sourceStore, targetStore, entryIds, options, state) {
-        if (entryIds.length === 0) {
-            return { transferred: state.transferred, transferredBytes: state.transferredBytes, cancelled: false, rejected: [] };
-        }
-        const onProgress = options?.onProgress;
-        const signal = options?.signal;
-        const transferBatchSize = this.resolveTransferBatchSize(options);
-        const totalTransferBatches = Math.max(1, Math.ceil(entryIds.length / transferBatchSize));
-        // Parallel transfer window (sync-v5, phase 4): each batch is one
-        // getEntries + putEntries round trip; a small window of concurrent
-        // batches overlaps network latency and server-side crypto. Witness
-        // receipts are applied per batch and are order-independent.
-        const maxConcurrent = Math.min(Math.max(1, Math.floor(options?.maxConcurrentBatches ?? BaseMindooDB.DEFAULT_MAX_CONCURRENT_TRANSFER_BATCHES)), totalTransferBatches);
-        let transferred = state.transferred;
-        let transferredBytes = state.transferredBytes;
-        let cancelled = false;
-        let firstError = null;
-        let nextBatchIndex = 0;
-        // Per-entry rejections reported by a witnessing target (sync-v5): the
-        // push continues, the rejected entries are surfaced to the caller.
-        const rejected = [];
-        const runWorker = async () => {
-            while (true) {
-                if (firstError || cancelled || signal?.aborted) {
-                    if (signal?.aborted)
-                        cancelled = true;
-                    return;
-                }
-                const batchIndex = nextBatchIndex++;
-                const offset = batchIndex * transferBatchSize;
-                if (offset >= entryIds.length) {
-                    return;
-                }
-                const currentTransferBatch = batchIndex + 1;
-                const batchIds = entryIds.slice(offset, offset + transferBatchSize);
-                const pageSummary = state.currentPage ? `page ${state.currentPage}, ` : "";
-                onProgress?.({
-                    phase: "transferring",
-                    message: `Transferring batch ${currentTransferBatch}/${totalTransferBatches} (${batchIds.length} entries, ${pageSummary}scanned ${state.scanned})...`,
-                    transferredEntries: transferred,
-                    transferredBytes,
-                    scannedEntries: state.scanned,
-                    totalSourceEntries: state.totalSourceEntries,
-                    currentPage: state.currentPage,
-                    currentTransferBatch,
-                    totalTransferBatches,
-                    transferBatchSize,
-                });
-                try {
-                    const batchEntries = await sourceStore.getEntries(batchIds);
-                    if (signal?.aborted) {
-                        cancelled = true;
-                        return;
-                    }
-                    const putResult = await targetStore.putEntries(batchEntries);
-                    // On push, the remote (witnessing) target returns receipts for accepted
-                    // entries; persist them back onto the local source so the revision feed
-                    // re-anchors them from the provisional head to their committed
-                    // `receivedAt` (docs/accesscontrol.md §5.3). Pull targets return void.
-                    // sync-v5 targets return a structured ack that additionally carries
-                    // per-entry rejections (signature-class failures the remote skipped).
-                    const { receipts, batchRejected } = BaseMindooDB.normalizePutResult(putResult);
-                    if (receipts.length > 0 && sourceStore.applyWitnessReceipts) {
-                        await sourceStore.applyWitnessReceipts(receipts);
-                    }
-                    const rejectedIds = batchRejected.length > 0 ? new Set(batchRejected.map((entry) => entry.id)) : null;
-                    if (rejectedIds) {
-                        rejected.push(...batchRejected);
-                        this.logger.warn(`Target rejected ${batchRejected.length} of ${batchEntries.length} entries in transfer batch ${currentTransferBatch}/${totalTransferBatches}`);
-                    }
-                    for (const entry of batchEntries) {
-                        if (rejectedIds?.has(entry.id)) {
-                            continue;
-                        }
-                        transferredBytes += entry.encryptedSize ?? entry.encryptedData.length;
-                    }
-                    transferred += batchEntries.length - batchRejected.length;
-                }
-                catch (error) {
-                    if (signal?.aborted) {
-                        cancelled = true;
-                        return;
-                    }
-                    if (!firstError) {
-                        firstError = error;
-                    }
-                    return;
-                }
-                onProgress?.({
-                    phase: "transferring",
-                    message: `Transferred ${transferred} entries after batch ${currentTransferBatch}/${totalTransferBatches}`,
-                    transferredEntries: transferred,
-                    transferredBytes,
-                    scannedEntries: state.scanned,
-                    totalSourceEntries: state.totalSourceEntries,
-                    currentPage: state.currentPage,
-                    currentTransferBatch,
-                    totalTransferBatches,
-                    transferBatchSize,
-                });
-            }
-        };
-        await Promise.all(Array.from({ length: maxConcurrent }, () => runWorker()));
-        if (signal?.aborted || cancelled) {
-            return { transferred, transferredBytes, cancelled: true, rejected };
-        }
-        if (firstError) {
-            throw firstError;
-        }
-        return { transferred, transferredBytes, cancelled: false, rejected };
+    filterMissingIds(targetStore, candidateIds, bloom) {
+        return (0, syncStores_1.filterMissingIds)(targetStore, candidateIds, bloom);
     }
     /**
      * Normalize the polymorphic putEntries result (`void`, receipts array, or
@@ -3250,15 +3340,39 @@ class BaseMindooDB {
         }
         return { receipts: [], batchRejected: [] };
     }
+    /**
+     * Expose this database's persisted {@link syncScanCursors} map to the shared
+     * store-transfer helper. The map lives in the metadata checkpoint, so saving
+     * a cursor also marks the cache dirty.
+     */
+    syncCursorStore() {
+        return {
+            get: (key) => this.syncScanCursors.get(key) ?? null,
+            save: (key, record) => this.saveSyncScanCursor(key, record),
+            delete: (key) => {
+                this.syncScanCursors.delete(key);
+            },
+        };
+    }
     async syncEntriesFromStore(sourceStore, targetStore, options) {
         const signal = options?.signal;
-        BaseMindooDB.setSyncAbortSignalOnStore(sourceStore, signal);
-        BaseMindooDB.setSyncAbortSignalOnStore(targetStore, signal);
+        (0, syncStores_1.setSyncAbortSignalOnStore)(sourceStore, signal);
+        (0, syncStores_1.setSyncAbortSignalOnStore)(targetStore, signal);
         try {
             if (options?.mode === "dense") {
                 return await this.syncEntriesFromStoreDense(sourceStore, targetStore, options);
             }
-            return await this.syncEntriesFromStoreImpl(sourceStore, targetStore, options);
+            // Client rejection semantics: the scan cursor advances past a rejected
+            // entry so a single corrupt or forged entry cannot block this database's
+            // push sync forever (docs/network-sync-protocol.md §5.7.6). The
+            // server-to-server replicator passes `"hold"` instead, because there a
+            // rejection usually means "the peer has not replicated the directory
+            // yet" and skipping would drop the entry permanently.
+            return await (0, syncStores_1.syncEntriesBetweenStores)(sourceStore, targetStore, options, {
+                logger: this.logger,
+                cursors: this.syncCursorStore(),
+                rejectionPolicy: "advance",
+            });
         }
         catch (error) {
             if (signal?.aborted) {
@@ -3268,258 +3382,10 @@ class BaseMindooDB {
             throw error;
         }
         finally {
-            BaseMindooDB.setSyncAbortSignalOnStore(sourceStore, undefined);
-            BaseMindooDB.setSyncAbortSignalOnStore(targetStore, undefined);
+            (0, syncStores_1.setSyncAbortSignalOnStore)(sourceStore, undefined);
+            (0, syncStores_1.setSyncAbortSignalOnStore)(targetStore, undefined);
         }
     }
-    async syncEntriesFromStoreImpl(sourceStore, targetStore, options) {
-        let transferred = 0;
-        let transferredBytes = 0;
-        let scanned = 0;
-        // Per-entry rejections reported by a witnessing target (sync-v5): the
-        // sync completes; rejected entries are surfaced to the caller as warnings.
-        const rejected = [];
-        const onProgress = options?.onProgress;
-        const pageSize = options?.pageSize ?? 1000;
-        const signal = options?.signal;
-        if (this.supportsCursorScan(sourceStore)) {
-            // Persisted-cursor fast path (sync-v5, phase 1): resume the metadata
-            // scan where the previous sync between this (source, target) pair left
-            // off — or skip the sync entirely when the source head shows nothing
-            // new. The heads are fetched up front (cheap; one request per side for
-            // network stores) and also anchor the epochs persisted with the cursor.
-            const cursorKey = this.syncScanCursorKey(sourceStore, targetStore);
-            const persisted = options?.forceFullScan
-                ? null
-                : this.syncScanCursors.get(cursorKey) ?? null;
-            const [sourceHead, targetHead] = await Promise.all([
-                this.getStoreHeadSafe(sourceStore),
-                this.getStoreHeadSafe(targetStore),
-            ]);
-            let cursor = null;
-            if (persisted && sourceHead && targetHead) {
-                if (persisted.sourceEpoch === sourceHead.epoch &&
-                    persisted.targetEpoch === targetHead.epoch) {
-                    if (sourceHead.maxReceiptOrder <= persisted.cursor.receiptOrder) {
-                        this.logger.debug(`Sync skip: source head ${sourceHead.maxReceiptOrder} already covered by persisted cursor (${cursorKey})`);
-                        onProgress?.({
-                            phase: 'preparing',
-                            message: 'Source unchanged since last sync, nothing to scan',
-                            transferredEntries: 0,
-                            scannedEntries: 0,
-                        });
-                        return { transferred: 0, scanned: 0, cancelled: false };
-                    }
-                    cursor = persisted.cursor;
-                    this.logger.debug(`Resuming sync scan from persisted cursor receiptOrder=${cursor.receiptOrder} (${cursorKey})`);
-                }
-                else {
-                    // Epoch change on either side: the cursor lineage is broken
-                    // (store reset / receipt-order migration) — full rescan.
-                    this.logger.info(`Sync cursor epoch changed for ${cursorKey}, discarding persisted cursor and re-scanning`);
-                    this.syncScanCursors.delete(cursorKey);
-                }
-            }
-            const persistScanCursor = (finalCursor) => {
-                if (finalCursor && sourceHead && targetHead) {
-                    this.saveSyncScanCursor(cursorKey, {
-                        sourceEpoch: sourceHead.epoch,
-                        targetEpoch: targetHead.epoch,
-                        cursor: finalCursor,
-                    });
-                }
-            };
-            const targetBloom = await this.getStoreBloomSummary(targetStore);
-            // Fixed progress denominator: the SOURCE's total entry count. The cursor
-            // scan below examines every source entry, so `scannedEntries/totalSourceEntries`
-            // is a real completion ratio. (Local stores serve this from a cached bloom
-            // summary; network stores answer with one extra request.) The target bloom
-            // stays dedicated to missing-id pre-screening.
-            const sourceBloom = await this.getStoreBloomSummary(sourceStore);
-            const totalSourceEstimate = sourceBloom?.totalIds;
-            onProgress?.({
-                phase: 'preparing',
-                message: 'Preparing to sync entries...',
-                transferredEntries: 0,
-                scannedEntries: 0,
-                totalSourceEntries: totalSourceEstimate,
-            });
-            // Upper scan bound: the source head captured BEFORE the scan started.
-            // Pushing to a witnessing target re-anchors the just-transferred
-            // entries to a fresh receiptOrder on the source (applyWitnessReceipts),
-            // i.e. past the running cursor — without this bound the scan would
-            // re-discover its own transfers and never terminate (first-sync loop).
-            // Entries beyond the bound (re-anchored or written concurrently) are
-            // picked up by the next sync.
-            const scanUpperBound = sourceHead?.maxReceiptOrder;
-            // IDs already transferred in this sync session. Guards against
-            // re-pushing entries the scan re-discovers when the target bloom
-            // snapshot is stale (fetched once up front; empty on a first sync, so
-            // it would classify every re-discovered id as "definitely missing"
-            // and skip the exact hasEntries check).
-            const transferredThisSync = new Set();
-            let currentPage = 0;
-            // Scan-page pipelining (sync-v5, phase 4): while page N is being
-            // filtered and transferred, page N+1 is already being fetched.
-            let nextPagePromise = null;
-            const discardPrefetch = () => {
-                // Swallow errors of an in-flight prefetch we will never consume
-                // (abort/cancel paths) to avoid unhandled rejections.
-                nextPagePromise?.catch(() => { });
-                nextPagePromise = null;
-            };
-            while (true) {
-                if (signal?.aborted) {
-                    discardPrefetch();
-                    persistScanCursor(cursor);
-                    return { transferred, transferredBytes, scanned, cancelled: true, rejected };
-                }
-                const page = nextPagePromise
-                    ? await nextPagePromise
-                    : await sourceStore.scanEntriesSince(cursor, pageSize);
-                nextPagePromise = page.hasMore
-                    ? sourceStore.scanEntriesSince(page.nextCursor, pageSize)
-                    : null;
-                currentPage++;
-                // Clamp the page to the scan bound. Pages are ordered by
-                // (receiptOrder, id), so everything past the first out-of-bound
-                // entry is out of bound as well.
-                let pageEntries = page.entries;
-                let reachedScanBound = false;
-                if (scanUpperBound !== undefined && pageEntries.length > 0) {
-                    const inBound = pageEntries.filter((m) => (m.receiptOrder ?? 0) <= scanUpperBound);
-                    if (inBound.length < pageEntries.length) {
-                        reachedScanBound = true;
-                        pageEntries = inBound;
-                    }
-                }
-                scanned += pageEntries.length;
-                if (signal?.aborted) {
-                    discardPrefetch();
-                    persistScanCursor(cursor);
-                    return { transferred, transferredBytes, scanned, cancelled: true, rejected };
-                }
-                if (pageEntries.length > 0) {
-                    onProgress?.({
-                        phase: 'transferring',
-                        message: `Scanned ${scanned} entries, checking for changes (page ${currentPage})...`,
-                        transferredEntries: transferred,
-                        scannedEntries: scanned,
-                        totalSourceEntries: totalSourceEstimate,
-                        currentPage,
-                    });
-                    const ids = pageEntries
-                        .map((m) => m.id)
-                        .filter((id) => !transferredThisSync.has(id));
-                    const missingIds = ids.length > 0
-                        ? await this.filterMissingIds(targetStore, ids, targetBloom)
-                        : [];
-                    if (signal?.aborted) {
-                        discardPrefetch();
-                        persistScanCursor(cursor);
-                        return { transferred, transferredBytes, scanned, cancelled: true, rejected };
-                    }
-                    if (missingIds.length > 0) {
-                        const transferResult = await this.transferEntriesInBatches(sourceStore, targetStore, missingIds, options, {
-                            transferred,
-                            transferredBytes,
-                            scanned,
-                            totalSourceEntries: totalSourceEstimate,
-                            currentPage,
-                        });
-                        transferred = transferResult.transferred;
-                        transferredBytes = transferResult.transferredBytes;
-                        rejected.push(...transferResult.rejected);
-                        if (transferResult.cancelled) {
-                            // The current page's transfer did not complete: persist the
-                            // boundary of the last fully transferred page instead.
-                            discardPrefetch();
-                            persistScanCursor(cursor);
-                            return { transferred, transferredBytes, scanned, cancelled: true, rejected };
-                        }
-                        for (const id of missingIds) {
-                            transferredThisSync.add(id);
-                        }
-                    }
-                }
-                onProgress?.({
-                    phase: 'transferring',
-                    message: `Transferred ${transferred} entries (page ${currentPage}, scanned ${scanned})`,
-                    transferredEntries: transferred,
-                    transferredBytes,
-                    scannedEntries: scanned,
-                    totalSourceEntries: totalSourceEstimate,
-                    currentPage,
-                });
-                if (reachedScanBound) {
-                    // Persist the last in-bound position (NOT page.nextCursor, which
-                    // already points into the out-of-bound tail): a concurrent write
-                    // that landed between the bound and the re-anchored tail must be
-                    // scanned by the next sync.
-                    const lastInBound = pageEntries.length > 0 ? pageEntries[pageEntries.length - 1] : null;
-                    if (lastInBound) {
-                        cursor = { receiptOrder: lastInBound.receiptOrder ?? 0, id: lastInBound.id };
-                    }
-                    discardPrefetch();
-                    break;
-                }
-                cursor = page.nextCursor;
-                if (!page.hasMore) {
-                    break;
-                }
-            }
-            persistScanCursor(cursor);
-            return { transferred, transferredBytes, scanned, cancelled: false, rejected };
-        }
-        onProgress?.({
-            phase: 'preparing',
-            message: 'Finding new entries...',
-            transferredEntries: 0,
-            scannedEntries: 0,
-        });
-        const targetIds = await targetStore.getAllIds();
-        const sourceNewMetadata = await sourceStore.findNewEntries(targetIds);
-        if (sourceNewMetadata.length === 0) {
-            return { transferred: 0, scanned: 0, cancelled: false };
-        }
-        if (options?.signal?.aborted) {
-            return { transferred: 0, scanned: 0, cancelled: true };
-        }
-        onProgress?.({
-            phase: 'transferring',
-            message: `Transferring ${sourceNewMetadata.length} entries...`,
-            transferredEntries: transferred,
-            scannedEntries: sourceNewMetadata.length,
-            totalSourceEntries: sourceNewMetadata.length,
-        });
-        const transferResult = await this.transferEntriesInBatches(sourceStore, targetStore, sourceNewMetadata.map((m) => m.id), options, {
-            transferred,
-            transferredBytes,
-            scanned: sourceNewMetadata.length,
-            totalSourceEntries: sourceNewMetadata.length,
-        });
-        transferred = transferResult.transferred;
-        transferredBytes = transferResult.transferredBytes;
-        rejected.push(...transferResult.rejected);
-        if (transferResult.cancelled) {
-            return { transferred, transferredBytes, scanned: sourceNewMetadata.length, cancelled: true, rejected };
-        }
-        onProgress?.({
-            phase: 'transferring',
-            message: `Transferred ${transferred} entries`,
-            transferredEntries: transferred,
-            transferredBytes,
-            scannedEntries: sourceNewMetadata.length,
-            totalSourceEntries: sourceNewMetadata.length,
-        });
-        return {
-            transferred,
-            transferredBytes,
-            scanned: sourceNewMetadata.length,
-            cancelled: false,
-            rejected,
-        };
-    }
     /**
      * Dense sync: transfer only the entries required to reconstruct the latest
      * state of each document, using the batch materialization planner to skip
@@ -3899,7 +3765,6 @@ class BaseMindooDB {
             throw new Error("createDocument: signingKeyPair and signingKeyPassword must be provided together");
         }
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
-        const keyId = await this.resolveCreateKeyId(options);
         const useCustomDocId = options.id !== undefined;
         this.validateIdPrefixOption("createDocument", options);
         this.validateAssumeUniqueIdOption("createDocument", options);
@@ -3931,18 +3796,17 @@ class BaseMindooDB {
                 throw new Error("createDocument: initialValues is not supported together with a custom id; " +
                     "create the document, then apply values with changeDoc().");
             }
-        }
-        // Admin-only validation: only admin key can modify data in admin-only databases
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const signerPublicKey = useCustomSigningKey
-                ? signingKeyPair.publicKey
-                : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            if (signerPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
+            if (useDeterministicSeed && options.recipients !== undefined) {
+                throw new Error("createDocument: recipients is not supported together with a convergent custom id; " +
+                    "pass assumeUniqueId for random ids.");
             }
         }
+        const signerPublicKey = await this.resolveSignerPublicKey(useCustomSigningKey ? signingKeyPair : undefined);
+        const createUsernameHash = this.usernameHashFromRecord(Object.fromEntries(initialValueEntries));
+        // The id is settled before the write gate because it decides which rule
+        // applies in `userdirectory`: a personal document is recognized by its id.
         const docId = useCustomDocId ? options.id : this.generateUnusedDocId(options.idPrefix);
+        await this.assertBuiltinWriteAllowed("doc_create", signerPublicKey, createUsernameHash, docId);
         // Idempotent create: when a caller-provided id already exists locally,
         // return the existing document instead of producing a duplicate doc_create.
         if (useCustomDocId) {
@@ -3961,6 +3825,7 @@ class BaseMindooDB {
                 return this.wrapDocument(existing);
             }
         }
+        const keyId = await this.resolveCreateKeyId(options, docId);
         this.logger.debug(`Creating document ${docId} with key ${keyId}${useCustomSigningKey ? ' using custom signing key' : ''}${useCustomDocId ? ' with caller-provided id' : ''}`);
         // Build the initial Automerge document and its first change bytes.
         //
@@ -3970,6 +3835,7 @@ class BaseMindooDB {
         // replicas using the same id produce the same Automerge hash and
         // `doc_create` entry id, allowing later changes to merge.
         const now = (0, timeSource_1.semanticNow)();
+        const sealedCreate = await this.prepareSealedCreate(options, docId, keyId, now, signerPublicKey);
         let newDoc;
         let changeBytes;
         if (useDeterministicSeed) {
@@ -3995,6 +3861,9 @@ class BaseMindooDB {
                     // Store metadata in the document payload
                     // We need to modify the document to ensure a change is created
                     doc._attachments = [];
+                    if (sealedCreate) {
+                        (0, recipients_1.applyEncryptForCreate)(doc, sealedCreate.encryptFor);
+                    }
                     // Seed caller-provided initial values within the same doc_create
                     // change so a doc_create Tier 2 rule can evaluate them in the
                     // "after" state (docs/accesscontrol.md §6.3, §9).
@@ -4074,9 +3943,12 @@ class BaseMindooDB {
             createdByPublicKey = currentUser.userSigningPublicKey;
         }
         this.logger.debug(`Signed payload, signature length: ${signature.length} bytes`);
-        // Remember the creator's signing key so $author prechecks on subsequent
-        // change/delete operations don't need a metadata scan.
-        this.creatorKeyCache.set(docId, createdByPublicKey);
+        // Remember the creator so $author prechecks on subsequent change/delete
+        // operations don't need a metadata scan. `now` is the local createdAt;
+        // a later witness may stamp receivedAt, which resolveCreatorInfo picks up
+        // on a cache miss. For the local writer, createdAt is sufficient: the
+        // creating device is still granted.
+        this.creatorInfoCache.set(docId, { signingKey: createdByPublicKey, trustedTime: now });
         // Snapshot of attachments referenced by the freshly created doc (normally
         // empty; the public create API does not add attachments inline).
         const createAttachmentRefs = this.collectAttachmentRefs(newDoc);
@@ -4094,6 +3966,7 @@ class BaseMindooDB {
             originalSize: changeBytes.length,
             encryptedSize: encryptedPayload.length,
             attachmentRefs: createAttachmentRefs.length > 0 ? createAttachmentRefs : undefined,
+            recipients: sealedCreate?.recipients,
             entryVersion: types_1.CURRENT_STORE_ENTRY_VERSION,
         };
         // Bind the metadata with the author signature (audit finding #5).
@@ -4123,6 +3996,7 @@ class BaseMindooDB {
             isDeleted: false,
             awaitingWitness,
             witnessed,
+            sealedRecipients: sealedCreate?.recipients,
         };
         // Update cache and index
         await this.storeCachedDocument(internalDoc);
@@ -4149,7 +4023,6 @@ class BaseMindooDB {
             throw new Error("createDocuments: signingKeyPair and signingKeyPassword must be provided together");
         }
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
-        const keyId = await this.resolveCreateKeyId(options);
         const useCustomDocId = options.id !== undefined;
         this.validateIdPrefixOption("createDocuments", options);
         this.validateAssumeUniqueIdOption("createDocuments", options);
@@ -4157,24 +4030,22 @@ class BaseMindooDB {
         // out of the deterministic seed, so initialValues fold into doc_create
         // and the document costs a single store entry.
         const useDeterministicSeed = useCustomDocId && !options.assumeUniqueId;
+        if (useDeterministicSeed && options.recipients !== undefined) {
+            throw new Error("createDocuments: recipients is not supported together with a convergent custom id; pass assumeUniqueId");
+        }
         // Sanitize caller-provided initial values: internal/reserved fields are
         // managed by MindooDB and must not be seeded by callers. `undefined`
         // values are treated as "not set" (Automerge cannot represent undefined).
         const initialValueEntries = options.initialValues
             ? Object.entries(options.initialValues).filter(([k, v]) => !k.startsWith("_") && v !== undefined)
             : [];
-        // Admin-only validation: only admin key can modify data in admin-only databases
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const signerPublicKey = useCustomSigningKey
-                ? signingKeyPair.publicKey
-                : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            if (signerPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
+        const signerPublicKey = await this.resolveSignerPublicKey(useCustomSigningKey ? signingKeyPair : undefined);
+        const createUsernameHash = this.usernameHashFromRecord(Object.fromEntries(initialValueEntries));
         const docId = useCustomDocId ? options.id : this.generateUnusedDocId(options.idPrefix);
+        await this.assertBuiltinWriteAllowed("doc_create", signerPublicKey, createUsernameHash, docId);
         const now = (0, timeSource_1.semanticNow)();
+        const keyId = await this.resolveCreateKeyId(options, docId);
+        const sealedCreate = await this.prepareSealedCreate(options, docId, keyId, now, signerPublicKey);
         // Build the initial Automerge document and its first change bytes,
         // following the same seeding rules as the single-create path.
         let seedDoc;
@@ -4189,6 +4060,9 @@ class BaseMindooDB {
             const initialDoc = automerge_adapter_1.Automerge.init();
             seedDoc = automerge_adapter_1.Automerge.change(initialDoc, (doc) => {
                 doc._attachments = [];
+                if (sealedCreate) {
+                    (0, recipients_1.applyEncryptForCreate)(doc, sealedCreate.encryptFor);
+                }
                 // Seed caller-provided initial values within the same doc_create change
                 // so a doc_create Tier 2 rule can evaluate them in the "after" state.
                 for (const [key, value] of initialValueEntries) {
@@ -4254,9 +4128,12 @@ class BaseMindooDB {
             signature = await this.tenant.signPayload(encryptedPayload);
             createdByPublicKey = currentUser.userSigningPublicKey;
         }
-        // Remember the creator's signing key so $author prechecks on subsequent
-        // change/delete operations don't need a metadata scan.
-        this.creatorKeyCache.set(docId, createdByPublicKey);
+        // Remember the creator so $author prechecks on subsequent change/delete
+        // operations don't need a metadata scan. `now` is the local createdAt;
+        // a later witness may stamp receivedAt, which resolveCreatorInfo picks up
+        // on a cache miss. For the local writer, createdAt is sufficient: the
+        // creating device is still granted.
+        this.creatorInfoCache.set(docId, { signingKey: createdByPublicKey, trustedTime: now });
         const createAttachmentRefs = this.collectAttachmentRefs(finalDoc);
         const entryMetadata = {
             entryType: "doc_create",
@@ -4271,6 +4148,7 @@ class BaseMindooDB {
             originalSize: createChangeBytes.length,
             encryptedSize: encryptedPayload.length,
             attachmentRefs: createAttachmentRefs.length > 0 ? createAttachmentRefs : undefined,
+            recipients: sealedCreate?.recipients,
             entryVersion: types_1.CURRENT_STORE_ENTRY_VERSION,
         };
         // Bind the metadata with the author signature (audit finding #5).
@@ -4317,6 +4195,7 @@ class BaseMindooDB {
             isDeleted: false,
             awaitingWitness,
             witnessed,
+            sealedRecipients: sealedCreate?.recipients,
         };
         return { internalDoc, entries };
     }
@@ -4335,6 +4214,9 @@ class BaseMindooDB {
         this.logger.debug(`Getting document ${docId} at timestamp ${timestamp}`);
         // Get all entry metadata for this document
         const allEntryMetadata = await this.scanAllMetadata(this.store, { docId });
+        if (allEntryMetadata.length > 0) {
+            await this.ingestSealedKeyFromEntries(allEntryMetadata);
+        }
         // Filter to document replay metadata plus snapshots up to the timestamp.
         // Attachment chunks are not part of the Automerge replay DAG and must not
         // participate in historical materialization.
@@ -4380,7 +4262,7 @@ class BaseMindooDB {
             if (snapshotEntries.length > 0) {
                 const snapshotData = snapshotEntries[0];
                 let isValid = false;
-                if (this._isAdminOnlyDb && snapshotData.createdByPublicKey !== this.getAdminPublicKey()) {
+                if (await this.shouldSkipLoadedEntryForBuiltin(snapshotData)) {
                     this.logger.warn(`Admin-only DB: skipping snapshot ${snapshotData.id} not signed by admin key`);
                 }
                 else {
@@ -4427,7 +4309,7 @@ class BaseMindooDB {
                 this.logger.warn(`Entry ${entryMeta.id} not found in store, skipping`);
                 continue;
             }
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
                 continue;
             }
@@ -4470,10 +4352,62 @@ class BaseMindooDB {
         });
         return this.wrapDocument(internalDoc);
     }
+    /**
+     * Unwrap a `$sealed:` DEK from entry recipient wraps into the tenant session
+     * cache. `loadDocumentInternal` already does this; history / timestamp reads
+     * must as well — otherwise Haven's revision list throws SymmetricKeyNotFoundError
+     * on a cold tenant even when this device is in the wrap list.
+     */
+    async ingestSealedKeyFromEntries(entries) {
+        if (entries.length === 0)
+            return;
+        const keyId = entries.find((entry) => entry.entryType === "doc_create")?.decryptionKeyId
+            ?? entries[0].decryptionKeyId;
+        await this.tenant.ingestSealedFromEntries?.(keyId, entries);
+    }
+    /**
+     * Re-ingest the newest sealed wrap list. When this replica can no longer
+     * unwrap it (recipient removal), drop the leftover session DEK and any
+     * materialized plaintext so later honest-client writes cannot reuse it.
+     *
+     * @returns true when access was revoked
+     */
+    async dropSealedAccessIfUnwrapFailed(internalDoc) {
+        if (!(0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId)) {
+            return false;
+        }
+        const metas = await this.scanAllMetadata(this.store, { docId: internalDoc.id });
+        await this.ingestSealedKeyFromEntries(metas);
+        if (await this.tenant.hasDecryptionKey(internalDoc.decryptionKeyId)) {
+            return false;
+        }
+        await this.purgeMaterializedDocument(internalDoc.id);
+        const existingIndex = this.getDocIndexPosition(internalDoc.id);
+        const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
+        if (existing?.accessState === "visible") {
+            this.updateIndex(internalDoc.id, existing.lastModified, true, internalDoc.decryptionKeyId, "inaccessible");
+            this.cacheMetaDirty = true;
+            this.cacheManager?.markDirty();
+        }
+        return true;
+    }
+    /**
+     * Patch paths (`applyTextPatch`, rich-text, Automerge) used to persist with
+     * a leftover session DEK after the newest wrap excluded this user.
+     * `changeDoc` already refused those writes; this is the shared chokepoint.
+     */
+    async assertCurrentSealedAccess(internalDoc) {
+        if (await this.dropSealedAccessIfUnwrapFailed(internalDoc)) {
+            throw new errors_1.DocumentNotFoundError(internalDoc.id);
+        }
+    }
     async *iterateDocumentHistory(docId) {
         this.logger.debug(`Iterating document history for ${docId}`);
         // Get all entry metadata for this document
         const allEntryMetadata = await this.scanAllMetadata(this.store, { docId });
+        if (allEntryMetadata.length > 0) {
+            await this.ingestSealedKeyFromEntries(allEntryMetadata);
+        }
         // Filter to document replay entries (exclude snapshots) and order them
         // causally: a plain chronological sort can place an effect before its
         // cause when several entries share the same millisecond (or when replica
@@ -4486,6 +4420,7 @@ class BaseMindooDB {
         }
         // Load all entries
         const entries = await this.store.getEntries(relevantEntries.map(em => em.id));
+        await this.ingestSealedKeyFromEntries(entries.length > 0 ? entries : relevantEntries);
         // Build a map for quick lookup
         const entryMap = new Map(entries.map(e => [e.id, e]));
         // Apply changes in order
@@ -4500,7 +4435,7 @@ class BaseMindooDB {
                 continue;
             }
             // Admin-only mode: only accept entries signed by the admin key
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
                 continue;
             }
@@ -4660,14 +4595,14 @@ class BaseMindooDB {
         // leading witnessed prefix.
         let stableCursor = cursor;
         let sawProvisional = false;
-        const consider = (em) => {
+        const consider = async (em) => {
             if (!this.isDocumentReplayEntry(em)) {
                 return;
             }
             // Admin-only mode: only accept entries signed by the admin key (mirrors
             // materialization / iterateDocumentHistory). Non-admin entries are
             // permanently ignored and do not gate the stable cursor.
-            if (this._isAdminOnlyDb && em.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(em)) {
                 return;
             }
             newEntries.push(em);
@@ -4699,7 +4634,7 @@ class BaseMindooDB {
             while (true) {
                 const page = await this.store.scanEntriesSince(scanCursor, 1000, scanFilters);
                 for (const em of page.entries) {
-                    consider(em);
+                    await consider(em);
                 }
                 scanCursor = page.nextCursor;
                 if (!page.hasMore) {
@@ -4720,7 +4655,7 @@ class BaseMindooDB {
                 if (cursor && !this.isAfterReceiptCursor(em, cursor)) {
                     continue;
                 }
-                consider(em);
+                await consider(em);
             }
         }
         return { newEntries, resumeCursor: stableCursor };
@@ -4749,10 +4684,12 @@ class BaseMindooDB {
         // All metadata for this doc (metadata only, cheap). Includes snapshots, used
         // for cache-miss seed reconstruction.
         const docAllMeta = await this.scanAllMetadata(this.store, { docId });
-        let replayMeta = docAllMeta.filter((em) => this.isDocumentReplayEntry(em));
-        if (this._isAdminOnlyDb) {
-            const adminKey = this.getAdminPublicKey();
-            replayMeta = replayMeta.filter((em) => em.createdByPublicKey === adminKey);
+        const replayCandidates = docAllMeta.filter((em) => this.isDocumentReplayEntry(em));
+        const replayMeta = [];
+        for (const em of replayCandidates) {
+            if (!(await this.shouldSkipLoadedEntryForBuiltin(em))) {
+                replayMeta.push(em);
+            }
         }
         if (replayMeta.length === 0) {
             return;
@@ -4951,7 +4888,7 @@ class BaseMindooDB {
             return null;
         }
         const snapshotData = entries[0];
-        if (this._isAdminOnlyDb && snapshotData.createdByPublicKey !== this.getAdminPublicKey()) {
+        if (await this.shouldSkipLoadedEntryForBuiltin(snapshotData)) {
             this.logger.warn(`Admin-only DB: skipping snapshot ${snapshotData.id} not signed by admin key`);
             return null;
         }
@@ -5120,7 +5057,7 @@ class BaseMindooDB {
                 result.set(metadata.id, null);
                 continue;
             }
-            if (this._isAdminOnlyDb && entry.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entry)) {
                 result.set(metadata.id, null);
                 continue;
             }
@@ -5286,7 +5223,7 @@ class BaseMindooDB {
             const entry = entries[0];
             if (entry) {
                 let isValid = false;
-                if (this._isAdminOnlyDb && entry.createdByPublicKey !== this.getAdminPublicKey()) {
+                if (await this.shouldSkipLoadedEntryForBuiltin(entry)) {
                     this.logger.warn(`Admin-only DB: skipping DAG details for ${entry.id} not signed by admin key`);
                 }
                 else {
@@ -5983,7 +5920,7 @@ class BaseMindooDB {
                 this.logger.warn(`Conflict analysis: entry ${metadata.id} not found in store, skipping`);
                 continue;
             }
-            if (this._isAdminOnlyDb && entry.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entry)) {
                 this.logger.warn(`Admin-only DB: skipping conflict analysis entry ${entry.id} not signed by admin key`);
                 continue;
             }
@@ -6533,7 +6470,17 @@ class BaseMindooDB {
         if (docIds.length === 0) {
             return;
         }
-        await this.assertLifecycleMutationAllowed(options.signingKeyPair, options.signingKeyPassword);
+        // One gate call per document id: inside `userdirectory` the applicable rule
+        // depends on the id (personal documents are owned by their creator), so a
+        // single batch-wide check would deny an owner deleting their own data.
+        if ((0, builtinDbInvariants_1.hasBuiltinWriteInvariant)(this.effectiveBuiltinDbId()) || this._isAdminOnlyDb) {
+            for (const docId of docIds) {
+                await this.assertLifecycleMutationAllowed("doc_delete", options.signingKeyPair, options.signingKeyPassword, undefined, docId);
+            }
+        }
+        else {
+            await this.assertLifecycleMutationAllowed("doc_delete", options.signingKeyPair, options.signingKeyPassword);
+        }
         this.logger.info(`Bulk-deleting ${docIds.length} documents`);
         // Unlike creation, a delete must first materialize the CURRENT document
         // (the doc_delete entry is an Automerge change on its heads), which costs
@@ -6580,21 +6527,14 @@ class BaseMindooDB {
     async undeleteDocument(docId, options = {}) {
         return this.undeleteDocInternal(docId, options.signingKeyPair, options.signingKeyPassword, options.bypassAccessControlPrecheck);
     }
-    async assertLifecycleMutationAllowed(signingKeyPair, signingKeyPassword) {
+    async assertLifecycleMutationAllowed(op, signingKeyPair, signingKeyPassword, documentUsernameHash, docId) {
         this.assertWritable("document lifecycle mutation");
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         if ((signingKeyPair !== undefined) !== (signingKeyPassword !== undefined)) {
             throw new Error("Lifecycle mutation requires both signingKeyPair and signingKeyPassword");
         }
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const signerPublicKey = useCustomSigningKey
-                ? signingKeyPair.publicKey
-                : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            if (signerPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
+        const signerPublicKey = await this.resolveSignerPublicKey(useCustomSigningKey ? signingKeyPair : undefined);
+        await this.assertBuiltinWriteAllowed(op, signerPublicKey, documentUsernameHash, docId);
     }
     /**
      * Write a delete or undelete lifecycle entry for an existing document.
@@ -6700,12 +6640,11 @@ class BaseMindooDB {
         // default to the "before" state; both states are supplied so either `when`
         // resolves. Throws AccessDeniedError if denied.
         {
-            const creatorKey = await this.resolveCreatorSigningKey(docId);
             const beforeState = internalDoc.doc;
             await this.assertWriteAllowed({
                 op: entryType,
                 signerKey: createdByPublicKey,
-                isAuthor: creatorKey !== null && createdByPublicKey === creatorKey,
+                isAuthor: await this.resolveIsAuthor(docId, createdByPublicKey, Number.MAX_SAFE_INTEGER),
                 bypass: bypassPrecheck,
                 getBeforeDoc: () => this.convertAutomergeToJS(beforeState),
                 getAfterDoc: () => this.convertAutomergeToJS(newDoc),
@@ -6769,7 +6708,7 @@ class BaseMindooDB {
     async deleteDocInternal(docId, signingKeyPair, signingKeyPassword, bypassPrecheck) {
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         this.logger.debug(`Deleting document ${docId}${useCustomSigningKey ? ' using custom signing key' : ''}`);
-        await this.assertLifecycleMutationAllowed(signingKeyPair, signingKeyPassword);
+        await this.assertLifecycleMutationAllowed("doc_delete", signingKeyPair, signingKeyPassword, undefined, docId);
         // Get current document
         const internalDoc = await this.loadDocumentInternal(docId);
         if (!internalDoc || internalDoc.isDeleted) {
@@ -6781,11 +6720,11 @@ class BaseMindooDB {
     async undeleteDocInternal(docId, signingKeyPair, signingKeyPassword, bypassPrecheck) {
         const useCustomSigningKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         this.logger.debug(`Undeleting document ${docId}${useCustomSigningKey ? ' using custom signing key' : ''}`);
-        await this.assertLifecycleMutationAllowed(signingKeyPair, signingKeyPassword);
         const internalDoc = await this.loadDocumentInternal(docId);
         if (!internalDoc) {
             throw new errors_1.DocumentNotFoundError(docId);
         }
+        await this.assertLifecycleMutationAllowed("doc_undelete", signingKeyPair, signingKeyPassword, this.usernameHashFromInternalDoc(internalDoc), docId);
         if (!internalDoc.isDeleted) {
             this.logger.debug(`Document ${docId} is already alive; undelete is a no-op`);
             return;
@@ -6803,13 +6742,6 @@ class BaseMindooDB {
         this.assertWritable("applyTextPatch");
         const docId = doc.getId();
         this.logger.debug(`===== applyTextPatch called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
             const loadedDoc = await this.loadDocumentInternal(docId);
@@ -6867,13 +6799,6 @@ class BaseMindooDB {
         this.assertWritable("applyRichTextPatch");
         const docId = doc.getId();
         this.logger.debug(`===== applyRichTextPatch called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
             const loadedDoc = await this.loadDocumentInternal(docId);
@@ -6942,13 +6867,6 @@ class BaseMindooDB {
         this.assertWritable("applyRichTextStepsPatch");
         const docId = doc.getId();
         this.logger.debug(`===== applyRichTextStepsPatch called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
             const loadedDoc = await this.loadDocumentInternal(docId);
@@ -7061,13 +6979,6 @@ class BaseMindooDB {
         this.assertWritable("applyAutomergeChanges");
         const docId = doc.getId();
         this.logger.debug(`===== applyAutomergeChanges called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         if (!Array.isArray(patch.changes) || patch.changes.length === 0) {
             throw new Error("Automerge changes patch must include at least one change byte sequence");
         }
@@ -7171,13 +7082,6 @@ class BaseMindooDB {
         this.assertWritable("applyJsonPatch");
         const docId = doc.getId();
         this.logger.debug(`===== applyJsonPatch called for document ${docId} =====`);
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const currentUser = await this.tenant.getCurrentUserId();
-            if (currentUser.userSigningPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
             const loadedDoc = await this.loadDocumentInternal(docId);
@@ -7235,16 +7139,6 @@ class BaseMindooDB {
         }
         const useCustomKey = signingKeyPair !== undefined && signingKeyPassword !== undefined;
         this.logger.debug(`===== ${useCustomKey ? 'changeDocWithSigningKey' : 'changeDoc'} called for document ${docId} =====`);
-        // Admin-only validation: only admin key can modify data in admin-only databases
-        if (this._isAdminOnlyDb) {
-            const adminPublicKey = this.getAdminPublicKey();
-            const signerPublicKey = useCustomKey
-                ? signingKeyPair.publicKey
-                : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            if (signerPublicKey !== adminPublicKey) {
-                throw new Error("Admin-only database: only the admin key can modify data");
-            }
-        }
         // Get internal document from cache or load it
         let internalDoc = this.getCachedDocument(docId);
         if (!internalDoc) {
@@ -7262,6 +7156,7 @@ class BaseMindooDB {
         if (internalDoc.isDeleted) {
             throw new errors_1.DocumentDeletedError(docId);
         }
+        await this.assertCurrentSealedAccess(internalDoc);
         // Apply the change function
         const now = (0, timeSource_1.semanticNow)();
         this.logger.debug(`Applying change function to document ${docId}`);
@@ -7304,6 +7199,11 @@ class BaseMindooDB {
             isAccessible: () => true,
             isAwaitingWitness: () => internalDoc.awaitingWitness ?? false,
             isWitnessed: () => internalDoc.witnessed ?? false,
+            isSealed: () => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId),
+            getRecipients: () => (0, recipients_1.resolveRecipientsFromPayload)(internalDoc.doc, internalDoc.sealedRecipients),
+            getRecipientEpoch: () => internalDoc.sealedRecipients?.epoch ?? 0,
+            isEncryptedFor: (users) => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId)
+                && (0, recipients_1.isPayloadEncryptedFor)(internalDoc.doc, internalDoc.sealedRecipients, Array.isArray(users) ? users : [users]),
             getHeads: () => automerge_adapter_1.Automerge.getHeads(internalDoc.doc),
             getData: () => {
                 // Return a proxy that collects property assignments and deletions
@@ -7584,6 +7484,7 @@ class BaseMindooDB {
                 successMessage: useCustomKey ? "changed with custom signing key" : "changed",
                 attachmentIds: pendingAttachmentAdditions.map((ref) => ref.attachmentId),
                 bypassPrecheck,
+                recipients: internalDoc.sealedRecipients,
             });
         }
         catch (error) {
@@ -8087,7 +7988,7 @@ class BaseMindooDB {
         }
     }
     async persistDocumentChange(options) {
-        const { internalDoc, newDoc, now, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck } = options;
+        const { internalDoc, newDoc, now, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck, recipients } = options;
         const docId = internalDoc.id;
         this.logger.debug(`Getting change bytes from document ${docId}`);
         const changesSincePreviousHeads = headsBeforeChange
@@ -8111,17 +8012,21 @@ class BaseMindooDB {
             successMessage,
             attachmentIds,
             bypassPrecheck,
+            recipients: options.recipients,
         });
     }
     async persistAutomergeDocumentChanges(options) {
-        const { internalDoc, newDoc, now, changeBytesList, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck, } = options;
+        const { internalDoc, newDoc, now, changeBytesList, headsBeforeChange, useCustomKey, signingKeyPair, signingKeyPassword, successMessage, attachmentIds, bypassPrecheck, recipients, } = options;
         const docId = internalDoc.id;
+        await this.assertCurrentSealedAccess(internalDoc);
         const resolvedChangeBytesList = changeBytesList ?? (headsBeforeChange
             ? automerge_adapter_1.Automerge.getChangesSince(newDoc, headsBeforeChange)
             : []);
         if (resolvedChangeBytesList.length === 0) {
             throw new Error("No Automerge changes to persist");
         }
+        const signerPublicKey = await this.resolveSignerPublicKey(useCustomKey ? signingKeyPair : undefined);
+        await this.assertBuiltinWriteAllowed("doc_change", signerPublicKey, this.usernameHashFromInternalDoc(internalDoc), docId);
         // Signed snapshot of the document's attachments after this change, computed
         // once from the resulting document state so EVERY change path (changeDoc,
         // text patches, merges, ...) carries it consistently on each produced entry.
@@ -8140,6 +8045,7 @@ class BaseMindooDB {
                 // The full attachment snapshot describes the document's resulting state,
                 // so it goes on every produced entry (unlike the add-only attachmentIds).
                 attachmentRefs,
+                recipients: index === 0 ? recipients : undefined,
             });
             entries.push(entry);
             const decodedChange = automerge_adapter_1.Automerge.decodeChange(changeBytes);
@@ -8153,12 +8059,11 @@ class BaseMindooDB {
             const signerKey = useCustomKey
                 ? signingKeyPair.publicKey
                 : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-            const creatorKey = await this.resolveCreatorSigningKey(docId);
             const beforeState = internalDoc.doc;
             await this.assertWriteAllowed({
                 op: "doc_change",
                 signerKey,
-                isAuthor: creatorKey !== null && signerKey === creatorKey,
+                isAuthor: await this.resolveIsAuthor(docId, signerKey, Number.MAX_SAFE_INTEGER),
                 bypass: bypassPrecheck,
                 getBeforeDoc: () => this.convertAutomergeToJS(beforeState),
                 getAfterDoc: () => this.convertAutomergeToJS(newDoc),
@@ -8181,6 +8086,9 @@ class BaseMindooDB {
         // changefeed must re-emit the doc even when `lastModified` collides with
         // the previous change in the same millisecond.
         this.updateIndex(docId, internalDoc.lastModified, internalDoc.isDeleted, internalDoc.decryptionKeyId, "visible", internalDoc.awaitingWitness, internalDoc.witnessed, true);
+        if (recipients) {
+            internalDoc.sealedRecipients = recipients;
+        }
         this.markDocDirty(docId);
         this.logger.info(`Document ${docId} ${successMessage} successfully`);
         const createdByPublicKey = useCustomKey
@@ -8191,7 +8099,7 @@ class BaseMindooDB {
             : { createdByPublicKey: createdByPublicKey ?? "" });
     }
     async buildDocChangeStoreEntry(options) {
-        const { internalDoc, changeBytes, now, useCustomKey, signingKeyPair, signingKeyPassword, attachmentIds, attachmentRefs } = options;
+        const { internalDoc, changeBytes, now, useCustomKey, signingKeyPair, signingKeyPassword, attachmentIds, attachmentRefs, recipients } = options;
         const docId = internalDoc.id;
         this.logger.debug(`Got change bytes: ${changeBytes.length} bytes`);
         const decodedChange = automerge_adapter_1.Automerge.decodeChange(changeBytes);
@@ -8230,6 +8138,7 @@ class BaseMindooDB {
             encryptedSize: encryptedPayload.length,
             attachmentIds: attachmentIds && attachmentIds.length > 0 ? attachmentIds : undefined,
             attachmentRefs: attachmentRefs && attachmentRefs.length > 0 ? attachmentRefs : undefined,
+            recipients,
             entryVersion: types_1.CURRENT_STORE_ENTRY_VERSION,
         };
         // Bind the metadata with the author signature (audit finding #5).
@@ -8741,7 +8650,7 @@ class BaseMindooDB {
             if (snapshotEntries.length > 0) {
                 const snapshotData = snapshotEntries[0];
                 let isValid = false;
-                if (this._isAdminOnlyDb && snapshotData.createdByPublicKey !== this.getAdminPublicKey()) {
+                if (await this.shouldSkipLoadedEntryForBuiltin(snapshotData)) {
                     this.logger.warn(`Admin-only DB: skipping snapshot ${snapshotData.id} not signed by admin key`);
                 }
                 else {
@@ -8786,7 +8695,7 @@ class BaseMindooDB {
                 this.logger.warn(`Entry ${entryMeta.id} not found in store, skipping`);
                 continue;
             }
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
                 continue;
             }
@@ -9035,13 +8944,14 @@ class BaseMindooDB {
         // Load entries from store
         const entries = await this.store.getEntries(orderedEntryIds);
         // Filter entries for admin-only mode first
-        const validEntries = entries.filter(entryData => {
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+        const validEntries = [];
+        for (const entryData of entries) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
-                return false;
+                continue;
             }
-            return true;
-        });
+            validEntries.push(entryData);
+        }
         if (validEntries.length === 0) {
             this.logger.debug(`No valid entries to process for cached document ${docId}`);
             return null;
@@ -9592,7 +9502,13 @@ class BaseMindooDB {
      * server. Directory ACL writes always pass an explicit key, so this never
      * re-enters the directory for them.
      */
-    async resolveCreateKeyId(options) {
+    async resolveCreateKeyId(options, docId) {
+        if (options.recipients !== undefined && options.decryptionKeyId !== undefined) {
+            throw new Error("createDocument: recipients and decryptionKeyId are mutually exclusive");
+        }
+        if (options.recipients !== undefined) {
+            return (0, sealedTypes_1.sealedKeyId)(docId ?? options.id ?? "pending");
+        }
         if (options.decryptionKeyId !== undefined)
             return options.decryptionKeyId;
         try {
@@ -9609,6 +9525,34 @@ class BaseMindooDB {
         }
         return "default";
     }
+    async prepareSealedCreate(options, docId, keyId, now, signerPublicKey) {
+        if (options.recipients === undefined)
+            return undefined;
+        const tenant = this.tenant;
+        const resolved = await (0, recipients_1.resolveRecipientSpecs)({
+            tenant,
+            specs: options.recipients,
+            options: options.recipientOptions,
+            addedBy: signerPublicKey,
+            now,
+        });
+        const dek = tenant.getCryptoAdapter().getRandomValues(new Uint8Array(32));
+        console.log("[sealed] prepareSealedCreate", {
+            docId,
+            keyId,
+            includeSelf: options.recipientOptions?.includeSelf !== false,
+            userTargets: resolved.targets.map((target) => ({ kind: target.kind, id: target.id })),
+            skipped: resolved.skipped,
+        });
+        const recipients = await (0, recipients_1.sealToTargets)({
+            tenant,
+            generations: [dek],
+            targets: resolved.targets,
+            epoch: 1,
+        });
+        tenant.rememberSealedGenerations(keyId, [dek]);
+        return { encryptFor: resolved.encryptFor, recipients };
+    }
     /**
      * Evaluate the full client-side (Tier 1 + Tier 2) write ruleset for a
      * candidate write, returning the {@link AccessDecision}. Returns `null` only
@@ -9701,17 +9645,203 @@ class BaseMindooDB {
         const signerKey = signingKeyPair
             ? signingKeyPair.publicKey
             : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-        const creatorKey = await this.resolveCreatorSigningKey(docId);
         const before = doc.getData();
         const decision = await this.evaluateClientWriteAccess({
             op: "doc_change",
             signerKey,
-            isAuthor: creatorKey !== null && signerKey === creatorKey,
+            isAuthor: await this.resolveIsAuthor(docId, signerKey, Number.MAX_SAFE_INTEGER),
             getBeforeDoc: () => before,
             getAfterDoc: () => candidateAfter,
         });
         return decision ?? BaseMindooDB.ACL_NOT_ENFORCED_DECISION;
     }
+    async addRecipients(doc, recipients, options) {
+        return this.mutateRecipients(doc, "add", recipients, options);
+    }
+    async removeRecipients(doc, recipients, options) {
+        return this.mutateRecipients(doc, "remove", recipients, options);
+    }
+    async setRecipients(doc, recipients, options) {
+        return this.mutateRecipients(doc, "set", recipients, options);
+    }
+    async canChangeRecipients(doc, next) {
+        const after = { ...doc.getData() };
+        after[sealedTypes_1.ENCRYPT_FOR_FIELD] = { ...(0, recipients_1.readEncryptFor)(after) };
+        return this.canChange(doc, after);
+    }
+    async mutateRecipients(doc, mode, specs, options) {
+        this.assertWritable("changeDoc");
+        if (!(0, sealedTypes_1.isSealedKeyId)(doc.getDecryptionKeyId())) {
+            throw new Error("Recipient mutators require a document created with `recipients`");
+        }
+        const tenant = this.tenant;
+        const docId = doc.getId();
+        let internalDoc = this.getCachedDocument(docId) ?? (await this.loadDocumentInternal(docId));
+        if (!internalDoc || internalDoc.isDeleted) {
+            throw new errors_1.DocumentNotFoundError(docId);
+        }
+        const now = (0, timeSource_1.semanticNow)();
+        const signer = options?.signingKeyPair?.publicKey
+            ?? (await this.tenant.getCurrentUserId()).userSigningPublicKey;
+        const resolved = await (0, recipients_1.resolveRecipientSpecs)({
+            tenant,
+            specs,
+            options: {
+                includeSelf: mode === "set" ? options?.includeSelf !== false : false,
+                strict: options?.strict,
+            },
+            addedBy: signer,
+            now,
+        });
+        const currentMap = (0, recipients_1.readEncryptFor)(internalDoc.doc);
+        const activeIds = new Set(Object.entries(currentMap).filter(([, e]) => !e.removedAt).map(([id]) => id.split("#")[0]));
+        const addedTargets = [];
+        const removedStableIds = [];
+        const matchesTarget = (id, entry, target) => {
+            const base = id.split("#")[0];
+            return (target.stableId === base
+                || target.id === base
+                || (!!entry.label && target.id === entry.label)
+                || (!!entry.keyFingerprint && target.keyFingerprint === entry.keyFingerprint));
+        };
+        if (mode === "add" || mode === "set") {
+            for (const target of resolved.targets) {
+                if (!activeIds.has(target.stableId) && !activeIds.has(target.id))
+                    addedTargets.push(target);
+            }
+        }
+        if (mode === "remove") {
+            for (const [id, entry] of Object.entries(currentMap)) {
+                if (entry.removedAt)
+                    continue;
+                if (resolved.targets.some((target) => matchesTarget(id, entry, target))) {
+                    removedStableIds.push(id.split("#")[0]);
+                }
+            }
+        }
+        else if (mode === "set") {
+            const nextIds = new Set(resolved.targets.flatMap((t) => [t.stableId, t.id]));
+            for (const [id, entry] of Object.entries(currentMap)) {
+                if (entry.removedAt)
+                    continue;
+                const base = id.split("#")[0];
+                const keep = resolved.targets.some((target) => matchesTarget(id, entry, target));
+                if (!keep && !nextIds.has(base))
+                    removedStableIds.push(base);
+            }
+        }
+        const rotate = removedStableIds.length > 0;
+        const currentGens = tenant.getSealedGenerations(internalDoc.decryptionKeyId);
+        if (currentGens.length === 0) {
+            throw new Error("Cannot change recipients: the current document key is not in this session");
+        }
+        let generations = currentGens;
+        let epoch = internalDoc.sealedRecipients?.epoch ?? currentGens.length;
+        if (rotate) {
+            const nextDek = tenant.getCryptoAdapter().getRandomValues(new Uint8Array(32));
+            generations = [nextDek, ...currentGens];
+            epoch += 1;
+        }
+        const remainingByStable = new Map();
+        const existingSpecs = Object.entries(currentMap)
+            .filter(([, e]) => !e.removedAt)
+            .map(([id, e]) => e.kind === "device"
+            ? { device: e.keyFingerprint ?? id, label: e.label }
+            : (e.label ?? id));
+        if (existingSpecs.length > 0) {
+            const existingResolved = await (0, recipients_1.resolveRecipientSpecs)({
+                tenant,
+                specs: existingSpecs,
+                options: { includeSelf: false, strict: false },
+                addedBy: signer,
+                now,
+            });
+            for (const target of existingResolved.targets)
+                remainingByStable.set(target.stableId, target);
+        }
+        for (const target of addedTargets)
+            remainingByStable.set(target.stableId, target);
+        for (const id of removedStableIds) {
+            remainingByStable.delete(id);
+            for (const [stableId, target] of [...remainingByStable.entries()]) {
+                if (target.id === id || target.stableId === id || target.keyFingerprint === id) {
+                    remainingByStable.delete(stableId);
+                }
+            }
+        }
+        const remaining = [...remainingByStable.values()];
+        if (remaining.length === 0) {
+            throw new Error("Refusing to leave a sealed document with no recipients");
+        }
+        const recipientsBlock = await (0, recipients_1.sealToTargets)({
+            tenant,
+            generations,
+            targets: remaining,
+            epoch,
+        });
+        tenant.rememberSealedGenerations(internalDoc.decryptionKeyId, generations);
+        const headsBeforeChange = automerge_adapter_1.Automerge.getHeads(internalDoc.doc);
+        const newDoc = automerge_adapter_1.Automerge.change(internalDoc.doc, (draft) => {
+            if (addedTargets.length > 0) {
+                const addMap = {};
+                for (const target of addedTargets) {
+                    addMap[target.stableId] = {
+                        kind: target.kind,
+                        addedAt: now,
+                        addedBy: signer,
+                        keyFingerprint: target.keyFingerprint,
+                        ...(target.label ? { label: target.label } : {}),
+                    };
+                }
+                (0, recipients_1.applyEncryptForAdds)(draft, addMap, epoch);
+            }
+            if (removedStableIds.length > 0) {
+                (0, recipients_1.applyEncryptForRemoves)(draft, removedStableIds, now, signer);
+            }
+            if (options?.change) {
+                // Content edits from the caller happen in a follow-up changeDoc; the
+                // recipient field itself is the carrier entry.
+            }
+            draft._lastModified = now;
+        });
+        await this.persistDocumentChange({
+            internalDoc,
+            newDoc,
+            now,
+            headsBeforeChange,
+            useCustomKey: !!(options?.signingKeyPair && options.signingKeyPassword),
+            signingKeyPair: options?.signingKeyPair,
+            signingKeyPassword: options?.signingKeyPassword,
+            successMessage: "recipients updated",
+            bypassPrecheck: options?.bypassAccessControlPrecheck,
+            recipients: recipientsBlock,
+        });
+        if (options?.change) {
+            await this.changeDoc(this.wrapDocument(internalDoc), options.change, {
+                signingKeyPair: options.signingKeyPair,
+                signingKeyPassword: options.signingKeyPassword,
+                bypassAccessControlPrecheck: options.bypassAccessControlPrecheck,
+            });
+        }
+        const wrapped = this.wrapDocument(internalDoc);
+        return {
+            epoch,
+            rotated: rotate,
+            added: wrapped.getRecipients().filter((r) => addedTargets.some((t) => t.keyFingerprint === r.keyFingerprint)),
+            removed: Object.entries((0, recipients_1.readEncryptFor)(internalDoc.doc))
+                .filter(([id, e]) => e.removedAt && removedStableIds.includes(id.split("#")[0]))
+                .map(([id, e]) => ({
+                kind: e.kind === "device" ? "device" : "user",
+                id: e.kind === "device" ? (e.keyFingerprint ?? id) : id,
+                keyFingerprint: e.keyFingerprint ?? "",
+                label: e.label,
+                addedInEpoch: epoch,
+                sealed: false,
+            })),
+            skipped: resolved.skipped,
+            entryId: "",
+        };
+    }
     /**
      * Predict whether deleting `doc` via {@link deleteDocument} would be allowed
      * by the active write policy, without writing anything.
@@ -9721,12 +9851,11 @@ class BaseMindooDB {
         const signerKey = signingKeyPair
             ? signingKeyPair.publicKey
             : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-        const creatorKey = await this.resolveCreatorSigningKey(docId);
         const current = doc.getData();
         const decision = await this.evaluateClientWriteAccess({
             op: "doc_delete",
             signerKey,
-            isAuthor: creatorKey !== null && signerKey === creatorKey,
+            isAuthor: await this.resolveIsAuthor(docId, signerKey, Number.MAX_SAFE_INTEGER),
             getBeforeDoc: () => current,
             getAfterDoc: () => current,
         });
@@ -9741,40 +9870,71 @@ class BaseMindooDB {
         const signerKey = signingKeyPair
             ? signingKeyPair.publicKey
             : (await this.tenant.getCurrentUserId()).userSigningPublicKey;
-        const creatorKey = await this.resolveCreatorSigningKey(docId);
         const current = doc.getData();
         const decision = await this.evaluateClientWriteAccess({
             op: "doc_undelete",
             signerKey,
-            isAuthor: creatorKey !== null && signerKey === creatorKey,
+            isAuthor: await this.resolveIsAuthor(docId, signerKey, Number.MAX_SAFE_INTEGER),
             getBeforeDoc: () => current,
             getAfterDoc: () => current,
         });
         return decision ?? BaseMindooDB.ACL_NOT_ENFORCED_DECISION;
     }
     /**
-     * Resolve the signing public key of the document's original creator (the
-     * `doc_create` entry's `createdByPublicKey`), used to set `$author`
-     * (`isAuthor`) for the client write prechecks on change/delete/undelete.
-     * Cached per document; returns `null` if the create entry isn't present yet
-     * (in which case `isAuthor` is treated as false, matching materialization).
+     * Resolve the signing public key of the document's original creator and the
+     * trusted time of the `doc_create` entry, used to set `$author` (`isAuthor`)
+     * at grant level. Cached per document; returns `null` if the create entry
+     * isn't present yet (in which case `isAuthor` is treated as false).
      */
-    async resolveCreatorSigningKey(docId) {
-        const cached = this.creatorKeyCache.get(docId);
+    async resolveCreatorInfo(docId) {
+        const cached = this.creatorInfoCache.get(docId);
         if (cached)
             return cached;
         try {
             const metas = await this.scanAllMetadata(this.store, { docId });
-            const createKey = metas.find((m) => m.entryType === "doc_create")?.createdByPublicKey ?? null;
-            if (createKey)
-                this.creatorKeyCache.set(docId, createKey);
-            return createKey;
+            const createMeta = metas.find((m) => m.entryType === "doc_create");
+            const createKey = createMeta?.createdByPublicKey ?? null;
+            if (!createMeta || !createKey)
+                return null;
+            const trustedTime = createMeta.receivedAt ?? createMeta.createdAt;
+            const info = { signingKey: createKey, trustedTime };
+            this.creatorInfoCache.set(docId, info);
+            return info;
         }
         catch (error) {
             this.logger.debug(`[ACL] creator-key resolution failed for ${docId}: ${error}`);
             return null;
         }
     }
+    /**
+     * Whether `signerKey` is the document author at grant level: the creator is
+     * resolved at the `doc_create` trusted time, the signer at `signerTrustedTime`.
+     */
+    async resolveIsAuthor(docId, signerKey, signerTrustedTime) {
+        const creator = await this.resolveCreatorInfo(docId);
+        if (!creator)
+            return false;
+        try {
+            const directory = await this.tenant.openDirectory();
+            if (typeof directory.isSamePerson === "function") {
+                return directory.isSamePerson({
+                    creatorSigningKey: creator.signingKey,
+                    signerSigningKey: signerKey,
+                    creatorTrustedTime: creator.trustedTime,
+                    signerTrustedTime,
+                });
+            }
+        }
+        catch (error) {
+            this.logger.debug(`[ACL] grant-level $author resolution failed for ${docId}: ${error}`);
+        }
+        return creator.signingKey === signerKey;
+    }
+    /** @deprecated kept as a thin wrapper for any remaining device-key callers. */
+    async resolveCreatorSigningKey(docId) {
+        const info = await this.resolveCreatorInfo(docId);
+        return info?.signingKey ?? null;
+    }
     /** Append a record to the quarantine/audit log (and log it). */
     recordQuarantine(rec) {
         this.quarantineLog.push(rec);
@@ -9835,7 +9995,12 @@ class BaseMindooDB {
             : (a.receivedAt ?? a.createdAt) - (b.receivedAt ?? b.createdAt));
         if (dataEntries.length === 0)
             return { doc: null, cacheable };
-        const creatorKey = dataEntries.find((m) => m.entryType === "doc_create")?.createdByPublicKey ?? null;
+        const createMeta = dataEntries.find((m) => m.entryType === "doc_create");
+        const creatorKey = createMeta?.createdByPublicKey ?? null;
+        const creatorTrustedTime = createMeta
+            ? (createMeta.receivedAt ?? createMeta.createdAt)
+            : 0;
+        const isSamePersonFn = directory.isSamePerson?.bind(directory);
         const fetched = await this.store.getEntries(dataEntries.map((m) => m.id));
         const entryById = new Map(fetched.map((e) => [e.id, e]));
         let currentDoc = null;
@@ -9869,8 +10034,13 @@ class BaseMindooDB {
                 quarantine(meta, "cascade_dependent", "causally depends on a quarantined entry");
                 continue;
             }
-            // Verify the author signature over the encrypted payload.
-            const cryptoKey = await this.getOrImportPublicKey(entry.createdByPublicKey);
+            // Verify the author signature over the encrypted payload. Trust the
+            // signing key at the entry's trusted time (not HEAD) so a later revoke
+            // does not rewrite history.
+            const trustedTimeForTrust = (0, storeEntryTime_1.isProvisional)(meta)
+                ? Number.MAX_SAFE_INTEGER
+                : (meta.receivedAt ?? meta.createdAt);
+            const cryptoKey = await this.getOrImportPublicKey(entry.createdByPublicKey, trustedTimeForTrust);
             if (!cryptoKey) {
                 // Author key not (yet) trusted by the directory. Remember it so a
                 // later grantaccess sync can re-materialize the doc (reconcileAuthorTrust).
@@ -9931,20 +10101,29 @@ class BaseMindooDB {
                 ? this.convertAutomergeToJS(currentDoc)
                 : null;
             const afterJS = this.convertAutomergeToJS(afterDoc);
-            const isAuthor = creatorKey !== null && entry.createdByPublicKey === creatorKey;
-            // Trusted-time rule (docs/accesscontrol.md §8, version-aware): a witnessed
-            // entry is judged against the directory as it provably was at its
-            // `receivedAt`. A versioned un-witnessed entry (provisional) has no
-            // provable position, so it is judged against the current directory HEAD —
-            // `MAX_SAFE_INTEGER` selects the head node deterministically regardless of
-            // where the directory's own provisional (un-witnessed) entries currently
-            // float, which a wall-clock `now` would not (those entries can sit at a
-            // later `now`). A legacy un-witnessed entry predates witnessing and is
-            // stable at its `createdAt`, so it is judged against the historical
-            // directory state in effect then. See {@link isProvisional}.
             const trustedTime = (0, storeEntryTime_1.isProvisional)(meta)
                 ? Number.MAX_SAFE_INTEGER
                 : (meta.receivedAt ?? meta.createdAt);
+            let isAuthor = false;
+            if (creatorKey !== null) {
+                if (isSamePersonFn) {
+                    try {
+                        isAuthor = await isSamePersonFn({
+                            creatorSigningKey: creatorKey,
+                            signerSigningKey: entry.createdByPublicKey,
+                            creatorTrustedTime,
+                            signerTrustedTime: trustedTime,
+                        });
+                    }
+                    catch (error) {
+                        this.logger.debug(`[ACL] grant-level $author resolution failed during materialization: ${error}`);
+                        isAuthor = entry.createdByPublicKey === creatorKey;
+                    }
+                }
+                else {
+                    isAuthor = entry.createdByPublicKey === creatorKey;
+                }
+            }
             let decision;
             try {
                 decision = await evaluateClientAccess({
@@ -10107,6 +10286,22 @@ class BaseMindooDB {
         // Log all entry types
         const entryTypes = allEntryMetadata.map(em => `${em.entryType}@${em.createdAt}`).join(', ');
         this.logger.debug(`Entry types for ${docId}: ${entryTypes}`);
+        await this.tenant.ingestSealedFromEntries?.(allEntryMetadata.find((em) => em.entryType === "doc_create")?.decryptionKeyId
+            ?? allEntryMetadata[0].decryptionKeyId, allEntryMetadata);
+        const loadKeyId = allEntryMetadata.find((em) => em.entryType === "doc_create")?.decryptionKeyId
+            ?? allEntryMetadata[0].decryptionKeyId;
+        if ((0, sealedTypes_1.isSealedKeyId)(loadKeyId) && !(await this.tenant.hasDecryptionKey(loadKeyId))) {
+            this.logger.debug(`Document ${docId} is sealed and not unwrapable; treating as missing`);
+            const existingIndex = this.getDocIndexPosition(docId);
+            const existing = existingIndex === undefined ? undefined : this.index[existingIndex];
+            if (existing?.accessState === "visible") {
+                await this.purgeMaterializedDocument(docId);
+                this.updateIndex(docId, existing.lastModified, true, loadKeyId, "inaccessible");
+                this.cacheMetaDirty = true;
+                this.cacheManager?.markDirty();
+            }
+            return null;
+        }
         // Access-control materialization (docs/accesscontrol.md §10): when the
         // tenant has access control active, materialize through the Tier 2
         // quarantine path (deterministic per-entry evaluation + cascade) instead of
@@ -10184,7 +10379,7 @@ class BaseMindooDB {
                 const snapshotData = snapshotEntries[0];
                 // Admin-only mode: only accept snapshots signed by admin
                 let isValid = false;
-                if (this._isAdminOnlyDb && snapshotData.createdByPublicKey !== this.getAdminPublicKey()) {
+                if (await this.shouldSkipLoadedEntryForBuiltin(snapshotData)) {
                     this.logger.warn(`Admin-only DB: skipping snapshot ${snapshotData.id} not signed by admin key`);
                 }
                 else {
@@ -10253,13 +10448,14 @@ class BaseMindooDB {
         if (this.isDebugEnabled())
             this.logger.debug(`Document state before applying entries: heads=${JSON.stringify(automerge_adapter_1.Automerge.getHeads(doc))}`);
         // Filter entries for admin-only mode first
-        const validEntries = entries.filter(entryData => {
-            if (this._isAdminOnlyDb && entryData.createdByPublicKey !== this.getAdminPublicKey()) {
+        const validEntries = [];
+        for (const entryData of entries) {
+            if (await this.shouldSkipLoadedEntryForBuiltin(entryData)) {
                 this.logger.warn(`Admin-only DB: skipping entry ${entryData.id} not signed by admin key`);
-                return false;
+                continue;
             }
-            return true;
-        });
+            validEntries.push(entryData);
+        }
         if (validEntries.length === 0) {
             this.logger.debug(`No valid entries to process for document ${docId}`);
         }
@@ -10385,6 +10581,7 @@ class BaseMindooDB {
             isDeleted,
             awaitingWitness: witnessState.awaitingWitness,
             witnessed: witnessState.witnessed,
+            sealedRecipients: (0, recipients_1.newestRecipientBlock)(allEntryMetadata),
         };
         // Update cache
         await this.storeCachedDocument(internalDoc);
@@ -10486,6 +10683,11 @@ class BaseMindooDB {
             isAccessible: () => internalDoc.accessible ?? true,
             isAwaitingWitness: () => internalDoc.awaitingWitness ?? false,
             isWitnessed: () => internalDoc.witnessed ?? false,
+            isSealed: () => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId),
+            getRecipients: () => (0, recipients_1.resolveRecipientsFromPayload)(internalDoc.doc, internalDoc.sealedRecipients),
+            getRecipientEpoch: () => internalDoc.sealedRecipients?.epoch ?? 0,
+            isEncryptedFor: (users) => (0, sealedTypes_1.isSealedKeyId)(internalDoc.decryptionKeyId)
+                && (0, recipients_1.isPayloadEncryptedFor)(internalDoc.doc, internalDoc.sealedRecipients, Array.isArray(users) ? users : [users]),
             getHeads: () => automerge_adapter_1.Automerge.getHeads(internalDoc.doc),
             getData: () => {
                 // Convert Automerge document to plain JS object, converting Text
@@ -10618,7 +10820,7 @@ class BaseMindooDB {
         });
     }
     async decryptAttachmentChunk(chunk) {
-        if (this._isAdminOnlyDb && chunk.createdByPublicKey !== this.getAdminPublicKey()) {
+        if (await this.shouldSkipLoadedEntryForBuiltin(chunk)) {
             throw new Error(`Admin-only DB: chunk ${chunk.id} not signed by admin key`);
         }
         const isValid = await this.tenant.verifyEntrySignature(chunk, chunk.encryptedData);
@@ -11090,10 +11292,13 @@ class BaseMindooDB {
         // entries can be decrypted with the same override identity.
         const encryptionKeyBuffer = await this.tenant.decryptPrivateKey(override.user.userEncryptionKeyPair.privateKey, override.password, "encryption");
         const encryptionKey = await subtle.importKey("pkcs8", encryptionKeyBuffer, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["decrypt"]);
-        // Activate temporary override on the remote store.
+        // Activate temporary override on the remote store. Include the public PEM
+        // so the auth challenge names the same device key that will sign — otherwise
+        // the server rejects bootstrap pushes as an unknown device key.
         overrideCapableStore.setSyncAuthOverride({
             username: override.user.username,
             signingKey,
+            signingPublicKey: override.user.userSigningKeyPair.publicKey,
             privateEncryptionKey: encryptionKey,
         });
         // Return cleanup callback so caller can always restore normal auth in finally.
@@ -11132,6 +11337,18 @@ class BaseMindooDB {
             encryptAttachmentPayload: (payload, keyId) => this.tenant.encryptAttachmentPayload(payload, keyId),
             syncStoreChanges: () => this.syncStoreChanges(),
             evaluateWriteAccess: (op, signerKey, isAuthor) => this.evaluateClientWriteAccess({ op, signerKey, isAuthor }),
+            isSamePerson: async (creatorSigningKey, signerSigningKey, creatorTrustedTime, signerTrustedTime) => {
+                const directory = await this.tenant.openDirectory();
+                if (typeof directory.isSamePerson === "function") {
+                    return directory.isSamePerson({
+                        creatorSigningKey,
+                        signerSigningKey,
+                        creatorTrustedTime,
+                        signerTrustedTime,
+                    });
+                }
+                return creatorSigningKey === signerSigningKey;
+            },
             hasWriteContentRules: async (op) => {
                 const directory = await this.tenant.openDirectory();
                 return (await directory.hasWriteContentRules?.(op, this.store.getId())) ?? false;
@@ -11306,6 +11523,9 @@ class BaseMindooDB {
             }
             if (syncResult.transferred === 0) {
                 this.logger.debug(`No new entries to pull`);
+                if (storeKind === types_2.StoreKind.docs) {
+                    await this.reconcileAfterDocsPull();
+                }
                 return { transferredEntries: 0, transferredBytes, scannedEntries: syncResult.scanned, cancelled: false };
             }
             options?.onProgress?.({
@@ -11328,23 +11548,7 @@ class BaseMindooDB {
             }
             if (storeKind === types_2.StoreKind.docs) {
                 await this.syncStoreChanges();
-                // SDK-driven key-distribution reconcile (docs/accesscontrol.md §13).
-                // After the directory pulls and processes new entries, reconcile the
-                // local KeyBag against the directory head: bulk-remove revoked keys
-                // (forgetting now-inaccessible docs) and import keys newly pushed to
-                // this user (revealing their docs on the next content-DB pull). Runs in
-                // the SDK so standalone apps get it too, not just Haven. Best-effort and
-                // single-flight; never blocks or fails the sync.
-                if (this.store.getId() === "directory") {
-                    await this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
-                    // Author-trust reconcile: refresh the directory trust caches NOW
-                    // (instead of waiting up to DIRECTORY_SYNC_INTERVAL_MS for the next
-                    // cache-miss validation) so grantaccess documents that just arrived
-                    // immediately unblock entries other open databases skipped while
-                    // the author was still unknown. Awaited so a subsequent content-DB
-                    // sync in the same flow observes the healed state.
-                    await this.tenant.reconcileAuthorTrustAfterDirectorySyncSafe();
-                }
+                await this.reconcileAfterDocsPull();
             }
             if (options?.signal?.aborted) {
                 this.logger.info(`Pull cancelled after local processing for ${storeKind} entries`);
@@ -11374,6 +11578,26 @@ class BaseMindooDB {
             restoreAuthOverride();
         }
     }
+    /**
+     * After a directory / userdirectory docs pull — including a no-op pull
+     * (`transferred === 0`). Device 2 typically already has
+     * `acl_keydistribution_default` from bootstrap, then later imports the
+     * User-Key from `userdirectory`. A subsequent directory pull transfers
+     * nothing and used to skip reconcile, so `default` never landed in the bag.
+     * Re-run both passes whenever either database is fetched.
+     */
+    async reconcileAfterDocsPull() {
+        if (this.store.getId() === "directory") {
+            await this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
+            await this.tenant.reconcileAuthorTrustAfterDirectorySyncSafe();
+            await this.tenant.reconcileUserKeysSafe?.();
+        }
+        if (this.store.getId() === types_1.USER_DIRECTORY_DB_ID) {
+            this.tenant.noteUserDirectoryFetched?.();
+            await this.tenant.reconcileUserKeysSafe?.();
+            await this.tenant.reconcileKeyDistributionsForCurrentUserSafe();
+        }
+    }
     /**
      * Push changes to a remote content-addressed store or another MindooDB instance.
      *
@@ -11445,32 +11669,6 @@ class BaseMindooDB {
     }
 }
 exports.BaseMindooDB = BaseMindooDB;
-/**
- * Determine how many entry IDs to fetch per `getEntries` call during sync.
- *
- * This is intentionally separate from the metadata scan `pageSize` so that
- * scanning can page through large ID lists quickly while the heavier
- * payload downloads use a smaller batch to keep progress responsive and
- * cancellation timely.
- *
- * Priority: explicit option > attachment default (100) > docs default (250,
- * capped by pageSize).
- *
- * The docs default is intentionally smaller than the metadata scan pageSize
- * (1000): a full scan page transferred as one `putEntries` call serializes
- * to a multi-megabyte JSON body whose upload cannot report progress, risks
- * the HTTP timeout on slow uplinks (each retry restarts the whole body),
- * and can exceed the remote JSON body limit. Smaller batches keep progress
- * events frequent and make each POST cheap to retry.
- */
-BaseMindooDB.DEFAULT_DOCS_TRANSFER_BATCH_SIZE = 250;
-/**
- * Default window of transfer batches running in parallel (sync-v5,
- * phase 4). Kept small: each in-flight batch holds one decrypted page of
- * entries in memory, and HTTP/2 multiplexes the requests over a single
- * connection anyway. Overridable via `SyncOptions.maxConcurrentBatches`.
- */
-BaseMindooDB.DEFAULT_MAX_CONCURRENT_TRANSFER_BATCHES = 3;
 /** The "access control not enforced" allow decision returned by the
  * non-throwing `canCreate`/`canChange`/`canDelete` prediction helpers. */
 BaseMindooDB.ACL_NOT_ENFORCED_DECISION = {