mindoodb 0.0.85 → 0.0.88

package/dist/core/accesscontrol/directoryProjection.js

@@ -23,6 +23,7 @@ function parsePolicyDoc(data) {
         denyDocUndelete: bool(data.denyDocUndelete),
         denyDocSnapshot: bool(data.denyDocSnapshot),
         denyDocRead: bool(data.denyDocRead),
+        docReadScope: data.docReadScope === "own" ? "own" : data.docReadScope === "all" ? "all" : undefined,
         defaultCreateKeyId: typeof data.defaultCreateKeyId === "string" ? data.defaultCreateKeyId : undefined,
         databaseCreationPolicy: data.databaseCreationPolicy === "directory-restricted"
             ? "directory-restricted"
@@ -35,8 +36,20 @@ function parsePolicyDoc(data) {
             ? data.requireMetadataSignatureSince
             : undefined,
         llm: parseLlmEndpointPolicy(data.llm),
+        personalDatabasePrefixes: stringArray(data.personalDatabasePrefixes)?.filter((prefix) => /^[a-z][a-z0-9]*_$/.test(prefix)),
+        internalMail: data.internalMail === "off" || data.internalMail === "members" || data.internalMail === "rules"
+            ? data.internalMail
+            : undefined,
+        internalMailLimits: parseInternalMailLimits(data.internalMailLimits),
     };
 }
+function parseInternalMailLimits(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return undefined;
+    const v = value;
+    const positive = (x) => (typeof x === "number" && Number.isInteger(x) && x > 0 ? x : undefined);
+    return { maxBytesPerMail: positive(v.maxBytesPerMail), maxMailsPerHour: positive(v.maxMailsPerHour) };
+}
 /**
  * Parse the `llm` block of a default policy. Malformed members are dropped
  * rather than failing the whole policy; a block without usable members still
@@ -80,6 +93,12 @@ function parseRuleDoc(data, ruleType) {
         users_hashes: usersHashes,
         users_encrypted: typeof data.users_encrypted === "string" ? data.users_encrypted : "",
         action: data.action === "deny" ? "deny" : "allow",
+        ...(ruleType === "doc_deposit" && typeof data.maxRecipients === "number"
+            ? { maxRecipients: data.maxRecipients }
+            : {}),
+        ...(ruleType === "doc_deposit" && Array.isArray(data.docIdPrefixes)
+            ? { docIdPrefixes: data.docIdPrefixes.filter((p) => typeof p === "string" && p.length > 0) }
+            : {}),
     };
 }
 /**

package/dist/core/accesscontrol/directoryProjection.js.map

@@ -1 +1 @@
-{"version":3,"file":"directoryProjection.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryProjection.ts"],"names":[],"mappings":";;AAwBA,wCAgCC;AAOD,wDAmBC;AAGD,oCAmBC;AAqBD,4DAqDC;AAlLD,2CAGqB;AACrB,mCAWiB;AAMjB,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,IAA6B;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,CAAC,CAAU,EAAwB,EAAE,CACvD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,eAAe;QACrB,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC;QAC/E,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACnF,sBAAsB,EACpB,IAAI,CAAC,sBAAsB,KAAK,sBAAsB;YACpD,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,IAAI,CAAC,sBAAsB,KAAK,MAAM;gBACtC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS;QACjB,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,6BAA6B,EAC3B,OAAO,IAAI,CAAC,6BAA6B,KAAK,QAAQ;YACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,6BAA6B;YACpC,CAAC,CAAC,SAAS;QACf,GAAG,EAAE,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB;aAC3C,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;aAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1E,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iEAAiE;AACjE,SAAgB,YAAY,CAAC,IAA6B,EAAE,QAAkB;IAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,CAAC,CAAE,IAAI,CAAC,UAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAChE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAqB,CAAC,GAAG,KAAK,QAAQ,CAAC;QACnF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,IAAI,CAAC,MAAgB;QAC7B,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAChF,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACrD,UAAU;QACV,YAAY,EAAE,WAAW;QACzB,eAAe,EAAE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QACrF,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;KAClD,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,OAAmC,EACnC,KAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpD,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wDAAwD;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC3C,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,KAAK,GAAG,IAAA,iCAAqB,EAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAsB;gBAC/B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,WAAW;gBACX,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBAC7D,wBAAwB,EAAE,IAAA,2CAA+B,EAAC,IAAI,CAAC;gBAC/D,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;aAC/B,CAAC;YACF,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,IAAI,KAAK,2BAAmB,EAAE,CAAC;QACtC,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;gBACrD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,uBAAuB,CAC9B,OAAmC,EACnC,KAAa,EACb,IAA6B,EAC7B,OAAgB,EAChB,WAAmB;IAEnB,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,iCAAyB,EAAE,CAAC;YACxC,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAA,4BAAoB,EAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAsB;gBACjC,IAAI,EAAE,2BAAmB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC3E,CAAC;YACF,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IAED,8BAA8B;IAC9B,IAAK,kBAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAgB,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"directoryProjection.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryProjection.ts"],"names":[],"mappings":";;AAwBA,wCAwCC;AAcD,wDAmBC;AAGD,oCAyBC;AAqBD,4DAqDC;AAvMD,2CAGqB;AACrB,mCAWiB;AAMjB,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,8EAA8E;AAC9E,SAAgB,cAAc,CAAC,IAA6B;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAU,EAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC3F,sEAAsE;IACtE,8DAA8D;IAC9D,MAAM,WAAW,GAAG,CAAC,CAAU,EAAwB,EAAE,CACvD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,eAAe;QACrB,iCAAiC,EAAE,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC;QAC/E,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACvC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC;QAC3C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QACnC,YAAY,EACV,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACvF,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QACnF,sBAAsB,EACpB,IAAI,CAAC,sBAAsB,KAAK,sBAAsB;YACpD,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,IAAI,CAAC,sBAAsB,KAAK,MAAM;gBACtC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS;QACjB,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC;QAC5C,6BAA6B,EAC3B,OAAO,IAAI,CAAC,6BAA6B,KAAK,QAAQ;YACtD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,6BAA6B,CAAC;YACjD,CAAC,CAAC,IAAI,CAAC,6BAA6B;YACpC,CAAC,CAAC,SAAS;QACf,GAAG,EAAE,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QACrC,wBAAwB,EAAE,WAAW,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1H,YAAY,EACV,IAAI,CAAC,YAAY,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO;YAC7F,CAAC,CAAC,IAAI,CAAC,YAAY;YACnB,CAAC,CAAC,SAAS;QACf,kBAAkB,EAAE,uBAAuB,CAAC,IAAI,CAAC,kBAAkB,CAAC;KACrE,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzG,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC;AACxG,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAc;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,gBAAgB;aAC3C,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;aAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;aAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1E,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iEAAiE;AACjE,SAAgB,YAAY,CAAC,IAA6B,EAAE,QAAkB;IAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;QAClD,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAC/C,CAAC,CAAE,IAAI,CAAC,UAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CAChE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAQ,CAAqB,CAAC,GAAG,KAAK,QAAQ,CAAC;QACnF,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,IAAI,EAAE,2BAAmB;QACzB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,IAAI,CAAC,MAAgB;QAC7B,WAAW,EAAE,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QAChF,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;QACrD,UAAU;QACV,YAAY,EAAE,WAAW;QACzB,eAAe,EAAE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QACrF,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACjD,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YACtE,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE;YACvC,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC;YACjE,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE;YACzG,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAYD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,OAAmC,EACnC,KAA6B;IAE7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IAEpD,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,wDAAwD;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,EAAE,CAAC;YAC3C,yEAAyE;YACzE,0DAA0D;YAC1D,MAAM,KAAK,GAAG,IAAA,iCAAqB,EAAC,IAAI,CAAC,CAAC;YAC1C,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAsB;gBAC/B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,WAAW;gBACX,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC;gBAC7D,wBAAwB,EAAE,IAAA,2CAA+B,EAAC,IAAI,CAAC;gBAC/D,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;aAC/B,CAAC;YACF,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,IAAI,KAAK,2BAAmB,EAAE,CAAC;QACtC,uBAAuB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;QACpE,OAAO;IACT,CAAC;IAED,oEAAoE;IACpE,0EAA0E;IAC1E,sCAAsC;IACtC,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACzF,MAAM,IAAI,GAAG,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;gBACrD,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;gBACvE,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,uBAAuB,CAC9B,OAAmC,EACnC,KAAa,EACb,IAA6B,EAC7B,OAAgB,EAChB,WAAmB;IAEnB,2EAA2E;IAC3E,yDAAyD;IACzD,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QAClC,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,KAAK,iCAAyB,EAAE,CAAC;YACxC,OAAO,CAAC,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,IAAA,4BAAoB,EAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;QACD,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0EAA0E;IAC1E,+EAA+E;IAC/E,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,8BAA8B;IAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,kBAAkB;IAClB,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO;IACT,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAsB;gBACjC,IAAI,EAAE,2BAAmB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;gBACvC,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;aAC3E,CAAC;YACF,OAAO,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IAED,8BAA8B;IAC9B,IAAK,kBAAgC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAc,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACvG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAgB,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/core/accesscontrol/evaluate.d.ts

@@ -82,6 +82,20 @@ export declare function evaluateLlmUse(input: {
     identity: IdentitySet;
     node: DirectoryStateNode;
 }): AccessDecision;
+/**
+ * Whether the acting user reads every document of a database whose
+ * `docReadScope` is `"own"` (`doc_read_all`, docs/accesscontrol.md §6.12).
+ *
+ * Baseline is deny (only the own documents); a matching allow rule for this
+ * database (or `"*"`) opens all documents, deny overrides allow. The master
+ * switch turns the whole scope off (everyone reads everything), as it does
+ * every other check. The tenant admin is handled by the caller.
+ */
+export declare function evaluateDocReadAll(input: {
+    dbid: string;
+    identity: IdentitySet;
+    node: DirectoryStateNode;
+}): AccessDecision;
 /**
  * Convenience: the set of reserved pseudo-tokens an identity always/optionally
  * carries. `$everyone` is always present for registered users; `$admin` and

package/dist/core/accesscontrol/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAGd,kBAAkB,EAClB,mBAAmB,EAGnB,QAAQ,EAER,aAAa,EAGd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,qCAAqC;IACrC,EAAE,EAAE,QAAQ,CAAC;IACb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,QAAQ,EAAE,WAAW,CAAC;IACtB,mEAAmE;IACnE,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,aAAa,CAE5D;AAUD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CA4FzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAAG,cAAc,CAgBzG;AA8GD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAA4B,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EAGd,kBAAkB,EAClB,mBAAmB,EAGnB,QAAQ,EAER,aAAa,EAId,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;GASG;AAEH;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;OAKG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACrB;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,qCAAqC;IACrC,EAAE,EAAE,QAAQ,CAAC;IACb,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,QAAQ,EAAE,WAAW,CAAC;IACtB,mEAAmE;IACnE,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,mEAAmE;AACnE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,GAAG,aAAa,CAE5D;AAUD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,cAAc,CAkGzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAA;CAAE,GAAG,cAAc,CAgBzG;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,GAAG,cAAc,CA2BjB;AA8GD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAA4B,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/core/accesscontrol/evaluate.js

@@ -4,6 +4,7 @@ exports.PSEUDO_TOKEN_AUTHOR = exports.PSEUDO_TOKEN_ADMIN = exports.ALWAYS_PRESEN
 exports.defaultWhenForOp = defaultWhenForOp;
 exports.evaluateAccess = evaluateAccess;
 exports.evaluateLlmUse = evaluateLlmUse;
+exports.evaluateDocReadAll = evaluateDocReadAll;
 const types_1 = require("./types");
 Object.defineProperty(exports, "PSEUDO_TOKEN_ADMIN", { enumerable: true, get: function () { return types_1.PSEUDO_TOKEN_ADMIN; } });
 Object.defineProperty(exports, "PSEUDO_TOKEN_AUTHOR", { enumerable: true, get: function () { return types_1.PSEUDO_TOKEN_AUTHOR; } });
@@ -27,6 +28,10 @@ function evaluateAccess(input) {
     if (op === "llm_use") {
         return evaluateLlmUse({ identity, node });
     }
+    // `doc_read_all` only matters in a `docReadScope: "own"` database (§6.12).
+    if (op === "doc_read_all") {
+        return evaluateDocReadAll({ dbid, identity, node });
+    }
     // No policy document has ever existed -> access control was never enabled ->
     // everything is allowed (§6.1, the "no acl_defaultpolicy" state).
     if (node.defaultPolicy === null) {
@@ -47,11 +52,13 @@ function evaluateAccess(input) {
         doc_undelete: eff.denyDocUndelete,
         doc_snapshot: eff.denyDocSnapshot,
         doc_read: eff.denyDocRead,
+        // No baseline flag: only an explicit allow rule grants deposit (§6.10).
+        doc_deposit: true,
     }[op];
     const baselineDenied = denyField === true;
     // Step 4: collect rules of this type whose dbid matches and whose users_hashes
     // intersect the identity set.
-    const candidateRules = (node.rulesByType.get(op) ?? []).filter((r) => (r.dbid === dbid || r.dbid === "*") && intersects(r.users_hashes, identity.hashes));
+    const candidateRules = (node.rulesByType.get(op) ?? []).filter((r) => (0, types_1.ruleMatchesDbid)(r.dbid, dbid) && intersects(r.users_hashes, identity.hashes));
     // Partition into Tier 1 (no withfields) and Tier 2 (withfields) rules.
     let denyMatched = null;
     let allowMatched = null;
@@ -124,6 +131,40 @@ function evaluateLlmUse(input) {
         ? deny("denied by baseline policy for llm_use", "tier1")
         : allow("allowed by baseline policy for llm_use", "tier1");
 }
+/**
+ * Whether the acting user reads every document of a database whose
+ * `docReadScope` is `"own"` (`doc_read_all`, docs/accesscontrol.md §6.12).
+ *
+ * Baseline is deny (only the own documents); a matching allow rule for this
+ * database (or `"*"`) opens all documents, deny overrides allow. The master
+ * switch turns the whole scope off (everyone reads everything), as it does
+ * every other check. The tenant admin is handled by the caller.
+ */
+function evaluateDocReadAll(input) {
+    const { dbid, identity, node } = input;
+    if (node.defaultPolicy === null) {
+        return allow("access control not enabled (no default policy)", "tier1");
+    }
+    const eff = (0, types_1.effectivePolicy)(node.defaultPolicy, node.dbPolicies.get(dbid) ?? null);
+    if (eff.disableAllAccessChecksAndPolicies) {
+        return allow("access control disabled by master switch", "tier1");
+    }
+    if (eff.docReadScope !== "own") {
+        return allow(`docReadScope of ${dbid} is "all"`, "tier1");
+    }
+    const rules = (node.rulesByType.get("doc_read_all") ?? []).filter((r) => (r.dbid === dbid || r.dbid === "*") &&
+        (r.withfields?.length ?? 0) === 0 &&
+        intersects(r.users_hashes, identity.hashes));
+    const denyRule = rules.find((r) => r.action === "deny");
+    if (denyRule) {
+        return deny(`denied by rule ${denyRule.ruleId}`, "tier1", denyRule.ruleId);
+    }
+    const allowRule = rules.find((r) => r.action === "allow");
+    if (allowRule) {
+        return allow(`allowed by rule ${allowRule.ruleId}`, "tier1", allowRule.ruleId);
+    }
+    return deny(`docReadScope of ${dbid} is "own"`, "tier1");
+}
 /** Returns true if any element of `hashes` is in `set`. */
 function intersects(hashes, set) {
     for (const h of hashes) {

package/dist/core/accesscontrol/evaluate.js.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/evaluate.ts"],"names":[],"mappings":";;;AAgFA,4CAEC;AAcD,wCA4FC;AAaD,wCAgBC;AAzND,mCAaiB;AAgUR,mGAzUP,0BAAkB,OAyUO;AAAE,oGAxU3B,2BAAmB,OAwU2B;AA9PhD,mEAAmE;AACnE,SAAgB,gBAAgB,CAAC,EAAY;IAC3C,OAAO,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED,SAAS,KAAK,CAAC,MAAc,EAAE,IAAuB,EAAE,aAAsB;IAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAuB,EAAE,aAAsB;IAC3E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAErD,gEAAgE;IAChE,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAE1D,6EAA6E;IAC7E,qBAAqB;IACrB,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,qDAAqD;IACrD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,YAAY,EAAE,GAAG,CAAC,eAAe;QACjC,YAAY,EAAE,GAAG,CAAC,eAAe;QACjC,QAAQ,EAAE,GAAG,CAAC,WAAW;KAC1B,CAAC,EAAE,CAAC,CAAC;IACN,MAAM,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;IAE1C,+EAA+E;IAC/E,8BAA8B;IAC9B,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAC1F,CAAC;IAEF,uEAAuE;IACvE,IAAI,WAAW,GAAyD,IAAI,CAAC;IAC7E,IAAI,YAAY,GAAyD,IAAI,CAAC;IAC9E,4EAA4E;IAC5E,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;gBAAE,kBAAkB,GAAG,IAAI,CAAC;;gBAClD,iBAAiB,GAAG,IAAI,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,IAAI,GAAsB,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,WAAW;YAAE,WAAW,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IAED,+DAA+D;IAC/D,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI,CACT,kBAAkB,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAC3C,WAAW,CAAC,IAAI,EAChB,WAAW,CAAC,IAAI,CAAC,MAAM,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,KAAK,CACV,mBAAmB,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAC7C,YAAY,CAAC,IAAI,EACjB,YAAY,CAAC,IAAI,CAAC,MAAM,CACzB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,QAAQ,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,wEAAwE,EAAE,OAAO,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACrD,+DAA+D;QAC/D,OAAO,KAAK,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,cAAc;QACnB,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,EAAE,OAAO,CAAC;QACtD,CAAC,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,KAA0D;IACvF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC1D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAC1G,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kBAAkB,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,mBAAmB,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI;QAC9C,CAAC,CAAC,IAAI,CAAC,uCAAuC,EAAE,OAAO,CAAC;QACxD,CAAC,CAAC,KAAK,CAAC,wCAAwC,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAC,MAAgB,EAAE,GAAgB;IACpD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAgB,EAAE,KAA0B;IAClE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CACnB,KAA+B,EAC/B,QAAqB;IAErB,IAAI,IAAA,qBAAa,EAAC,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,KAAoB,EAAE,CAAC;YAC7B,KAAK,kBAAkB;gBACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,KAAK,mBAAmB;gBACtB,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,KAAK,gBAAgB;gBACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,8CAA8C;AAC9C,SAAS,QAAQ,CAAC,GAAmC,EAAE,GAAW;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnF,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,SAAS,cAAc,CACrB,MAAuB,EACvB,GAAmC,EACnC,QAAqB;IAErB,MAAM,EAAE,GAAa,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAE3C,4CAA4C;IAC5C,IAAI,EAAE,KAAK,QAAQ;QAAE,OAAO,QAAQ,KAAK,SAAS,CAAC;IACnD,IAAI,EAAE,KAAK,WAAW;QAAE,OAAO,QAAQ,KAAK,SAAS,CAAC;IAEtD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEtD,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC;QACvE,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,sEAAsE;YACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,QAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,QAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACtF,MAAM,CAAC,GAAG,QAAQ,CAAC;YACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC1B,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACU,QAAA,4BAA4B,GAAsB,CAAC,6BAAqB,CAAC,CAAC"}
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/evaluate.ts"],"names":[],"mappings":";;;AAiFA,4CAEC;AAcD,wCAkGC;AAaD,wCAgBC;AAWD,gDA+BC;AA1QD,mCAciB;AAgXR,mGA1XP,0BAAkB,OA0XO;AAAE,oGAzX3B,2BAAmB,OAyX2B;AA9ShD,mEAAmE;AACnE,SAAgB,gBAAgB,CAAC,EAAY;IAC3C,OAAO,EAAE,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClD,CAAC;AAED,SAAS,KAAK,CAAC,MAAc,EAAE,IAAuB,EAAE,aAAsB;IAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,IAAuB,EAAE,aAAsB;IAC3E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAErD,gEAAgE;IAChE,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,2EAA2E;IAC3E,IAAI,EAAE,KAAK,cAAc,EAAE,CAAC;QAC1B,OAAO,kBAAkB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACnD,MAAM,GAAG,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAE1D,6EAA6E;IAC7E,qBAAqB;IACrB,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IAED,qDAAqD;IACrD,MAAM,SAAS,GAAG;QAChB,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,UAAU,EAAE,GAAG,CAAC,aAAa;QAC7B,YAAY,EAAE,GAAG,CAAC,eAAe;QACjC,YAAY,EAAE,GAAG,CAAC,eAAe;QACjC,QAAQ,EAAE,GAAG,CAAC,WAAW;QACzB,wEAAwE;QACxE,WAAW,EAAE,IAAI;KAClB,CAAC,EAAE,CAAC,CAAC;IACN,MAAM,cAAc,GAAG,SAAS,KAAK,IAAI,CAAC;IAE1C,+EAA+E;IAC/E,8BAA8B;IAC9B,MAAM,cAAc,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,uBAAe,EAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CACpF,CAAC;IAEF,uEAAuE;IACvE,IAAI,WAAW,GAAyD,IAAI,CAAC;IAC7E,IAAI,YAAY,GAAyD,IAAI,CAAC;IAC9E,4EAA4E;IAC5E,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO;gBAAE,kBAAkB,GAAG,IAAI,CAAC;;gBAClD,iBAAiB,GAAG,IAAI,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,IAAI,GAAsB,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,WAAW;YAAE,WAAW,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACzE,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,YAAY;YAAE,YAAY,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9E,CAAC;IAED,+DAA+D;IAC/D,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,IAAI,CACT,kBAAkB,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAC3C,WAAW,CAAC,IAAI,EAChB,WAAW,CAAC,IAAI,CAAC,MAAM,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,KAAK,CACV,mBAAmB,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,EAC7C,YAAY,CAAC,IAAI,EACjB,YAAY,CAAC,IAAI,CAAC,MAAM,CACzB,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,QAAQ,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;QACrD,OAAO,KAAK,CAAC,wEAAwE,EAAE,OAAO,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,cAAc,IAAI,iBAAiB,EAAE,CAAC;QACrD,+DAA+D;QAC/D,OAAO,KAAK,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,cAAc;QACnB,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,EAAE,OAAO,CAAC;QACtD,CAAC,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,KAA0D;IACvF,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC1D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAC1G,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kBAAkB,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,mBAAmB,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI;QAC9C,CAAC,CAAC,IAAI,CAAC,uCAAuC,EAAE,OAAO,CAAC;QACxD,CAAC,CAAC,KAAK,CAAC,wCAAwC,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,kBAAkB,CAAC,KAIlC;IACC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,gDAAgD,EAAE,OAAO,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,uBAAe,EAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IACnF,IAAI,GAAG,CAAC,iCAAiC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,mBAAmB,IAAI,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/D,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;QACnC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QACjC,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,kBAAkB,QAAQ,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,mBAAmB,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC,mBAAmB,IAAI,WAAW,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAC,MAAgB,EAAE,GAAgB;IACpD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAgB,EAAE,KAA0B;IAClE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;QAChE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CACnB,KAA+B,EAC/B,QAAqB;IAErB,IAAI,IAAA,qBAAa,EAAC,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,KAAoB,EAAE,CAAC;YAC7B,KAAK,kBAAkB;gBACrB,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClE,KAAK,mBAAmB;gBACtB,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;YACtC,KAAK,gBAAgB;gBACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED,8CAA8C;AAC9C,SAAS,QAAQ,CAAC,GAAmC,EAAE,GAAW;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnF,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,SAAS,cAAc,CACrB,MAAuB,EACvB,GAAmC,EACnC,QAAqB;IAErB,MAAM,EAAE,GAAa,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAE3C,4CAA4C;IAC5C,IAAI,EAAE,KAAK,QAAQ;QAAE,OAAO,QAAQ,KAAK,SAAS,CAAC;IACnD,IAAI,EAAE,KAAK,WAAW;QAAE,OAAO,QAAQ,KAAK,SAAS,CAAC;IAEtD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAEtD,QAAQ,EAAE,EAAE,CAAC;QACX,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC;QACvE,KAAK,WAAW;YACd,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC;QACvE,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,sEAAsE;YACtE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC/B,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;gBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,QAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,QAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACtF,MAAM,CAAC,GAAG,QAAQ,CAAC;YACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC1B,OAAO,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpF,CAAC;QACD;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACU,QAAA,4BAA4B,GAAsB,CAAC,6BAAqB,CAAC,CAAC"}

package/dist/core/accesscontrol/types.d.ts

@@ -27,9 +27,28 @@ export declare const ACCESS_CONTROL_FORM: "accesscontrol";
  * evaluated by {@link evaluateLlmUse}, independent of the master switch. Like
  * the rest of the `llm` block it is client-enforced.
  */
-export type RuleType = "doc_create" | "doc_change" | "doc_delete" | "doc_undelete" | "doc_snapshot" | "doc_read" | "llm_use";
+export type RuleType = "doc_create" | "doc_change" | "doc_delete" | "doc_undelete" | "doc_snapshot" | "doc_read" | "doc_read_all" | "doc_deposit" | "llm_use";
 /** All valid {@link RuleType} values, for validation and iteration. */
 export declare const RULE_TYPES: readonly RuleType[];
+/**
+ * `doc_deposit` (§6.10): a database-level right to put sealed documents into a
+ * database the principal may not read. Only an explicit allow rule grants it
+ * (there is no baseline flag), it never carries `withfields`, and its `dbid`
+ * may be exact, `"*"`, or a prefix pattern ending in `*` (e.g. `"mmail_*"`), so
+ * one rule can cover a family of per-person databases.
+ *
+ * {@link AclRuleDoc.maxRecipients} bounds how many recipient wraps a deposited
+ * `doc_create` may carry; it defaults to {@link DEFAULT_DEPOSIT_MAX_RECIPIENTS}.
+ */
+export declare const DEFAULT_DEPOSIT_MAX_RECIPIENTS = 1;
+/** Upper bound accepted for {@link AclRuleDoc.maxRecipients}. */
+export declare const MAX_DEPOSIT_RECIPIENTS = 100;
+/**
+ * Whether a rule's `dbid` applies to `dbid`. `"*"` matches every database; a
+ * pattern ending in `*` (only valid on `doc_deposit` rules, see
+ * {@link validateAclRule}) matches by prefix.
+ */
+export declare function ruleMatchesDbid(ruleDbid: string, dbid: string): boolean;
 /** Comparison operators usable in a {@link WithFieldClause}. Closed set. */
 export type Operator = "equals" | "notEquals" | "contains" | "containsAny" | "containsAll" | "exists" | "notExists" | "gt" | "gte" | "lt" | "lte";
 /** All valid {@link Operator} values. */
@@ -116,6 +135,17 @@ export interface DefaultAccessPolicyDoc {
      * itself can be read). Defaults to false.
      */
     denyDocRead?: boolean;
+    /**
+     * Which documents of the database a member may read (§6.12). `"all"`
+     * (default): every document. `"own"`: only documents whose `doc_create` was
+     * signed by one of the member's own signing keys (same grant, any device);
+     * the sync server leaves out everything else on every read path and refuses
+     * writes into other people's documents. The tenant admin and members matched
+     * by a `doc_read_all` allow rule still read everything. Layers per-db over
+     * the tenant default in {@link effectivePolicy}; usually set per-db only.
+     * Server-enforced (Tier 1, metadata only).
+     */
+    docReadScope?: "all" | "own";
     /**
      * Optional default `decryptionKeyId` for a `doc_create` that does not specify
      * one in the governed scope (tenant default, or a single database when set on
@@ -184,7 +214,38 @@ export interface DefaultAccessPolicyDoc {
      * the whole object is replaced on write. See {@link LlmEndpointPolicy}.
      */
     llm?: LlmEndpointPolicy;
+    /**
+     * More personal-database prefixes (§6.11), in addition to the built-in ones
+     * (`mmail_`). Tenant default policy only. Adding a prefix only ever makes
+     * databases more private: the built-in rule applies to every database id
+     * `<prefix><grantDocId>`. Like `llm` it holds while the master switch is on.
+     */
+    personalDatabasePrefixes?: string[];
+    /**
+     * Internal mail between tenant members (§6.11, "Internal mail"): who may
+     * deposit MindooMail messages (`memo_…`, sealed to the owner) into another
+     * person's `mmail_<grantDocId>`. `"members"` (default): every member with a
+     * grant. `"rules"`: only members matched by a `doc_deposit` allow rule for
+     * the mailbox (e.g. `dbid: "mmail_*"`, a group). `"off"`: nobody (only
+     * grants with `depositPrefixes`, such as the mail gateway). A `doc_deposit`
+     * deny rule always wins, so one member's right can be taken away. Tenant
+     * default policy only; holds while the master switch is on.
+     */
+    internalMail?: "off" | "members" | "rules";
+    /**
+     * Limits for internal mail deposits, enforced by the sync server per sender
+     * and mailbox: `maxBytesPerMail` (document plus attachments, default
+     * 25 MiB) and `maxMailsPerHour` (default 200). Tenant default policy only.
+     */
+    internalMailLimits?: InternalMailLimits;
 }
+/** {@link DefaultAccessPolicyDoc.internalMailLimits}. */
+export interface InternalMailLimits {
+    maxBytesPerMail?: number;
+    maxMailsPerHour?: number;
+}
+/** Defaults for {@link DefaultAccessPolicyDoc.internalMailLimits}. */
+export declare const DEFAULT_INTERNAL_MAIL_LIMITS: Required<InternalMailLimits>;
 /**
  * The `llm` block of the tenant default policy.
  *
@@ -212,12 +273,14 @@ export interface LlmEndpointPolicy {
  * The effective baseline defaults when a policy document exists but omits a
  * field (§6.1). Snapshot and purge default to denied (admin-only).
  */
-export declare const DEFAULT_POLICY_DEFAULTS: Required<Omit<DefaultAccessPolicyDoc, "form" | "type" | "disableAllAccessChecksAndPolicies" | "defaultCreateKeyId" | "databaseCreationPolicy" | "allowedDbIds" | "requireMetadataSignatureSince" | "llm">>;
+export declare const DEFAULT_POLICY_DEFAULTS: Required<Omit<DefaultAccessPolicyDoc, "form" | "type" | "disableAllAccessChecksAndPolicies" | "defaultCreateKeyId" | "docReadScope" | "databaseCreationPolicy" | "allowedDbIds" | "requireMetadataSignatureSince" | "llm" | "personalDatabasePrefixes" | "internalMail" | "internalMailLimits">>;
 /**
  * Map a database-scoped {@link RuleType} to the policy `deny<Op>` field that
  * gates it. `llm_use` is not listed: its baseline is `llm.denyUse` (§6.9).
+ * Neither is `doc_deposit`: it has no baseline flag and is always denied
+ * unless an allow rule grants it (§6.10).
  */
-export declare const RULE_TYPE_TO_DENY_FIELD: Record<Exclude<RuleType, "llm_use">, keyof typeof DEFAULT_POLICY_DEFAULTS>;
+export declare const RULE_TYPE_TO_DENY_FIELD: Record<Exclude<RuleType, "llm_use" | "doc_read_all" | "doc_deposit">, keyof typeof DEFAULT_POLICY_DEFAULTS>;
 /** A single access-control rule (§6.3). */
 export interface AclRuleDoc {
     form: typeof ACCESS_CONTROL_FORM;
@@ -241,6 +304,17 @@ export interface AclRuleDoc {
      */
     users_encrypted: string;
     action: "allow" | "deny";
+    /**
+     * `doc_deposit` only: the largest number of recipient wraps a deposited
+     * `doc_create` may carry (1..{@link MAX_DEPOSIT_RECIPIENTS}). Absent means
+     * {@link DEFAULT_DEPOSIT_MAX_RECIPIENTS}. Ignored on every other rule type.
+     */
+    maxRecipients?: number;
+    /**
+     * `doc_deposit` only: the document ids a depositor may create must start with
+     * one of these prefixes (e.g. `["proposal_"]`). Absent or empty: any id.
+     */
+    docIdPrefixes?: string[];
 }
 /**
  * Decrypted targets of a rule, for admin-UI display only (never serialized to
@@ -311,12 +385,21 @@ export declare function validateWithFieldClause(clause: WithFieldClause, ruleTyp
  * directory sets). Enforces the closed type/operator/placeholder sets and the
  * `withfields` constraints (§6.3). Throws on the first violation.
  */
+/**
+ * Document-id prefixes for deposits (§6.10): an array of non-empty strings
+ * made of the characters document ids use. Throws on violation.
+ */
+export declare function validateDocIdPrefixes(prefixes: unknown, what: string): void;
+/** Whether `docId` passes a deposit's `docIdPrefixes` (absent or empty: any id). */
+export declare function docIdMatchesPrefixes(docId: string, prefixes: readonly string[] | undefined): boolean;
 export declare function validateAclRule(rule: {
     type: RuleType;
     dbid: string;
     action: "allow" | "deny";
     users_hashes: string[];
     withfields?: WithFieldClause[];
+    maxRecipients?: number;
+    docIdPrefixes?: string[];
 }): void;
 /**
  * Validate a {@link DefaultAccessPolicyDoc} (tenant default or per-db) before
@@ -335,8 +418,9 @@ export declare function validateLlmEndpointPolicy(llm: unknown): void;
  * A `null`/absent default policy means access control was never enabled, which
  * callers should treat as "all allowed" before calling this.
  */
-export declare function effectivePolicy(tenantDefault: DefaultAccessPolicyDoc | null | undefined, dbPolicy: DefaultAccessPolicyDoc | null | undefined): Required<Omit<DefaultAccessPolicyDoc, "form" | "type" | "defaultCreateKeyId" | "databaseCreationPolicy" | "allowedDbIds" | "requireMetadataSignatureSince" | "llm">> & {
+export declare function effectivePolicy(tenantDefault: DefaultAccessPolicyDoc | null | undefined, dbPolicy: DefaultAccessPolicyDoc | null | undefined): Required<Omit<DefaultAccessPolicyDoc, "form" | "type" | "defaultCreateKeyId" | "docReadScope" | "databaseCreationPolicy" | "allowedDbIds" | "requireMetadataSignatureSince" | "llm" | "personalDatabasePrefixes" | "internalMail" | "internalMailLimits">> & {
     defaultCreateKeyId?: string;
+    docReadScope: "all" | "own";
 };
 /**
  * Key distribution type tag (the `type` field of a {@link KeyDistributionDoc}).

package/dist/core/accesscontrol/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/types.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAO5D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,cAAc,GACd,UAAU,GACV,SAAS,CAAC;AAEd,uEAAuE;AACvE,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAQzC,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAChB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,aAAa,GACb,aAAa,GACb,QAAQ,GACR,WAAW,GACX,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,CAAC;AAEV,yCAAyC;AACzC,eAAO,MAAM,SAAS,EAAE,SAAS,QAAQ,EAYxC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAEtF,4CAA4C;AAC5C,eAAO,MAAM,YAAY,EAAE,SAAS,WAAW,EAI9C,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,WAAoB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,EAAG,QAAiB,CAAC;AACpD,eAAO,MAAM,mBAAmB,EAAG,SAAkB,CAAC;AACtD,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAInD,CAAC;AAMF,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,QAAQ,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,WAAW,CAAC;IAC1D;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAAC;IACzD;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;OASG;IACH,GAAG,CAAC,EAAE,iBAAiB,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAC5C,IAAI,CACF,sBAAsB,EACpB,MAAM,GACN,MAAM,GACN,mCAAmC,GACnC,oBAAoB,GACpB,wBAAwB,GACxB,cAAc,GACd,+BAA+B,GAC/B,KAAK,CACR,CAQF,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAC1C,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,EAC5B,MAAM,OAAO,uBAAuB,CAQrC,CAAC;AAEF,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;IACnB,oDAAoD;IACpD,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,+BAA+B;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC;AAE3C,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;CAClB;AAMD,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAM7D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAaxD;AAED,+CAA+C;AAC/C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa5D;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAeD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAgBzF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAChC,GAAG,IAAI,CAgCP;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAC7D,IAAI,CAuCN;AAKD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAe5D;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwC5D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,EACxD,QAAQ,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,GAClD,QAAQ,CACT,IAAI,CACF,sBAAsB,EACpB,MAAM,GACN,MAAM,GACN,oBAAoB,GACpB,wBAAwB,GACxB,cAAc,GACd,+BAA+B,GAC/B,KAAK,CACR,CACF,GAAG;IACF,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAyBA;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE,qEAAqE;AACrE,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAqB,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mFAAmF;IACnF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzD,yFAAyF;IACzF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACpC;AAED,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAC1D,GAAG,IAAI,CAoCP;AAWD;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,gFAAgF;IAChF,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,kDAAkD;IAClD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,6BAA6B,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACjC;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,sBAAsB,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,sBAAsB,EAAE,MAAM,EAAE,CAAC;CAClC,GAAG,IAAI,CAgBP;AAcD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAG,iBAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,WAAW,CAAC;AAE1D,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,EAAE,SAAS,mBAAmB,EAA6B,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IACpC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,IAAI,EAAE,mBAAmB,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,8EAA8E;IAC9E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,yBAAyB,EAAE,MAAM,CAAC;IAClC,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,8EAA8E;IAC9E,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,wDAAwD;IACxD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,6BAA6B,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACjC;AAED,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,sBAAsB,EAAE,MAAM,EAAE,CAAC;CAClC,GAAG,IAAI,CAwBP;AAcD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAG,iBAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IACpC,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wDAAwD;AACxD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GAAG,IAAI,CAaP"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/types.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,+EAA+E;AAC/E,eAAO,MAAM,mBAAmB,EAAG,eAAwB,CAAC;AAO5D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,YAAY,GACZ,YAAY,GACZ,cAAc,GACd,cAAc,GACd,UAAU,GACV,cAAc,GACd,aAAa,GACb,SAAS,CAAC;AAEd,uEAAuE;AACvE,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAUzC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGvE;AAED,4EAA4E;AAC5E,MAAM,MAAM,QAAQ,GAChB,QAAQ,GACR,WAAW,GACX,UAAU,GACV,aAAa,GACb,aAAa,GACb,QAAQ,GACR,WAAW,GACX,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,CAAC;AAEV,yCAAyC;AACzC,eAAO,MAAM,SAAS,EAAE,SAAS,QAAQ,EAYxC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,gBAAgB,CAAC;AAEtF,4CAA4C;AAC5C,eAAO,MAAM,YAAY,EAAE,SAAS,WAAW,EAI9C,CAAC;AAEF,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,EAAG,WAAoB,CAAC;AAC1D,eAAO,MAAM,kBAAkB,EAAG,QAAiB,CAAC;AACpD,eAAO,MAAM,mBAAmB,EAAG,SAAkB,CAAC;AACtD,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAInD,CAAC;AAMF,kFAAkF;AAClF,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE/C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,QAAQ,CAAC;IACb,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,WAAW,CAAC;IAC1D;;;;;OAKG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;CACtB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,eAAe,CAAC;IACtB;;;;OAIG;IACH,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;;;;;;;OAaG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,sBAAsB,CAAC;IACzD;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC;;;;;;;;;OASG;IACL,GAAG,CAAC,EAAE,iBAAiB,CAAC;IACtB;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC;;;;;;;;;OASG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC;IAC3C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;CACzC;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sEAAsE;AACtE,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,kBAAkB,CAGrE,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAC5C,IAAI,CACF,sBAAsB,EACpB,MAAM,GACN,MAAM,GACN,mCAAmC,GACnC,oBAAoB,GACpB,cAAc,GACd,wBAAwB,GACxB,cAAc,GACd,+BAA+B,GAC/B,KAAK,GACL,0BAA0B,GAC1B,cAAc,GACd,oBAAoB,CACvB,CAQF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAC1C,OAAO,CAAC,QAAQ,EAAE,SAAS,GAAG,cAAc,GAAG,aAAa,CAAC,EAC7D,MAAM,OAAO,uBAAuB,CAQrC,CAAC;AAEF,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC;IACnB,oDAAoD;IACpD,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;;;;;OAOG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,gBAAgB,CAAC;IACvB,+BAA+B;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC;AAE3C,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,UAAU,CAAC;CAClB;AAMD,0DAA0D;AAC1D,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAM7D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAaxD;AAED,+CAA+C;AAC/C,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAa5D;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAElE;AAED,0EAA0E;AAC1E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEnD;AAeD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAgBzF;AAED;;;;GAIG;AACH;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAQ3E;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,OAAO,CAEpG;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE;IACpC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IACzB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,GAAG,IAAI,CAgEP;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAC7D,IAAI,CAyEN;AAKD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAe5D;AAED,sFAAsF;AACtF,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAwC5D;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,EACxD,QAAQ,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,GAClD,QAAQ,CACT,IAAI,CACF,sBAAsB,EACpB,MAAM,GACN,MAAM,GACN,oBAAoB,GACpB,cAAc,GACd,wBAAwB,GACxB,cAAc,GACd,+BAA+B,GAC/B,KAAK,GACL,0BAA0B,GAC1B,cAAc,GACd,oBAAoB,CACvB,CACF,GAAG;IACF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,YAAY,EAAE,KAAK,GAAG,KAAK,CAAC;CAC7B,CA0BA;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE,qEAAqE;AACrE,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAAqB,CAAC;AAElF;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,oFAAoF;IACpF,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mFAAmF;IACnF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;OAGG;IACH,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzD,yFAAyF;IACzF,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;CACvC;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAChD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACvC,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACzD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACpC;AAED,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,2DAA2D;AAC3D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CAC1D,GAAG,IAAI,CAoCP;AAWD;;GAEG;AACH,eAAO,MAAM,qBAAqB,EAAG,iBAA0B,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,qBAAqB,CAAC;IACnC,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,iFAAiF;IACjF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uDAAuD;IACvD,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,gFAAgF;IAChF,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,kDAAkD;IAClD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,6BAA6B,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,OAAO,EAAE,OAAO,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACjC;AAED,qFAAqF;AACrF,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,sBAAsB,EAAE,CAAC;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,sBAAsB,EAAE,MAAM,EAAE,CAAC;CAClC,GAAG,IAAI,CAgBP;AAcD;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAG,iBAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,WAAW,CAAC;AAE1D,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,EAAE,SAAS,mBAAmB,EAA6B,CAAC;AAEhG;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IACpC,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,2EAA2E;IAC3E,IAAI,EAAE,mBAAmB,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,8EAA8E;IAC9E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,yBAAyB,EAAE,MAAM,CAAC;IAClC,wEAAwE;IACxE,mBAAmB,EAAE,MAAM,CAAC;IAC5B,0DAA0D;IAC1D,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,8EAA8E;IAC9E,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,+EAA+E;IAC/E,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,4BAA4B,CAAC,EAAE,MAAM,CAAC;IACtC,wDAAwD;IACxD,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,6BAA6B,CAAC,EAAE,MAAM,CAAC;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjC,YAAY,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC9B,iBAAiB,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CACjC;AAED,sFAAsF;AACtF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,+FAA+F;IAC/F,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,SAAS,EAAE,uBAAuB,EAAE,CAAC;CACtC;AAED,yEAAyE;AACzE,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,sBAAsB,EAAE,MAAM,EAAE,CAAC;CAClC,GAAG,IAAI,CAwBP;AAcD;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAG,iBAA0B,CAAC;AAEjE;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,sBAAsB,CAAC;IACpC,sEAAsE;IACtE,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kFAAkF;IAClF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,8DAA8D;AAC9D,eAAO,MAAM,4BAA4B,yBAAyB,CAAC;AAEnE;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wDAAwD;AACxD,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GAAG,IAAI,CAaP"}

package/dist/core/accesscontrol/types.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACL_DOC_HISTORY_PURGE_PREFIX = exports.DOC_HISTORY_PURGE_TYPE = exports.ACL_SYNC_SETUP_POLICY_PREFIX = exports.SYNC_SETUP_POLICY_MODES = exports.SYNC_SETUP_POLICY_TYPE = exports.ACL_APP_DISTRIBUTION_PREFIX = exports.APP_DISTRIBUTION_TYPE = exports.ACL_KEY_DISTRIBUTION_PREFIX = exports.PROTECTED_DISTRIBUTION_KEY_IDS = exports.KEY_DISTRIBUTION_TYPE = exports.ACL_DEFAULT_POLICY_DOC_ID = exports.RULE_TYPE_TO_DENY_FIELD = exports.DEFAULT_POLICY_DEFAULTS = exports.RESERVED_PSEUDO_TOKENS = exports.PSEUDO_TOKEN_AUTHOR = exports.PSEUDO_TOKEN_ADMIN = exports.PSEUDO_TOKEN_EVERYONE = exports.PLACEHOLDERS = exports.OPERATORS = exports.RULE_TYPES = exports.ACCESS_CONTROL_FORM = void 0;
+exports.ACL_DOC_HISTORY_PURGE_PREFIX = exports.DOC_HISTORY_PURGE_TYPE = exports.ACL_SYNC_SETUP_POLICY_PREFIX = exports.SYNC_SETUP_POLICY_MODES = exports.SYNC_SETUP_POLICY_TYPE = exports.ACL_APP_DISTRIBUTION_PREFIX = exports.APP_DISTRIBUTION_TYPE = exports.ACL_KEY_DISTRIBUTION_PREFIX = exports.PROTECTED_DISTRIBUTION_KEY_IDS = exports.KEY_DISTRIBUTION_TYPE = exports.ACL_DEFAULT_POLICY_DOC_ID = exports.RULE_TYPE_TO_DENY_FIELD = exports.DEFAULT_POLICY_DEFAULTS = exports.DEFAULT_INTERNAL_MAIL_LIMITS = exports.RESERVED_PSEUDO_TOKENS = exports.PSEUDO_TOKEN_AUTHOR = exports.PSEUDO_TOKEN_ADMIN = exports.PSEUDO_TOKEN_EVERYONE = exports.PLACEHOLDERS = exports.OPERATORS = exports.MAX_DEPOSIT_RECIPIENTS = exports.DEFAULT_DEPOSIT_MAX_RECIPIENTS = exports.RULE_TYPES = exports.ACCESS_CONTROL_FORM = void 0;
+exports.ruleMatchesDbid = ruleMatchesDbid;
 exports.isPlaceholder = isPlaceholder;
 exports.encodeAclIdComponent = encodeAclIdComponent;
 exports.decodeAclIdComponent = decodeAclIdComponent;
@@ -8,6 +9,8 @@ exports.aclDbPolicyDocId = aclDbPolicyDocId;
 exports.aclTrustedWitnessDocId = aclTrustedWitnessDocId;
 exports.aclRuleDocId = aclRuleDocId;
 exports.validateWithFieldClause = validateWithFieldClause;
+exports.validateDocIdPrefixes = validateDocIdPrefixes;
+exports.docIdMatchesPrefixes = docIdMatchesPrefixes;
 exports.validateAclRule = validateAclRule;
 exports.validateAccessPolicy = validateAccessPolicy;
 exports.isValidLlmEndpointUrl = isValidLlmEndpointUrl;
@@ -48,8 +51,33 @@ exports.RULE_TYPES = [
     "doc_undelete",
     "doc_snapshot",
     "doc_read",
+    "doc_read_all",
+    "doc_deposit",
     "llm_use",
 ];
+/**
+ * `doc_deposit` (§6.10): a database-level right to put sealed documents into a
+ * database the principal may not read. Only an explicit allow rule grants it
+ * (there is no baseline flag), it never carries `withfields`, and its `dbid`
+ * may be exact, `"*"`, or a prefix pattern ending in `*` (e.g. `"mmail_*"`), so
+ * one rule can cover a family of per-person databases.
+ *
+ * {@link AclRuleDoc.maxRecipients} bounds how many recipient wraps a deposited
+ * `doc_create` may carry; it defaults to {@link DEFAULT_DEPOSIT_MAX_RECIPIENTS}.
+ */
+exports.DEFAULT_DEPOSIT_MAX_RECIPIENTS = 1;
+/** Upper bound accepted for {@link AclRuleDoc.maxRecipients}. */
+exports.MAX_DEPOSIT_RECIPIENTS = 100;
+/**
+ * Whether a rule's `dbid` applies to `dbid`. `"*"` matches every database; a
+ * pattern ending in `*` (only valid on `doc_deposit` rules, see
+ * {@link validateAclRule}) matches by prefix.
+ */
+function ruleMatchesDbid(ruleDbid, dbid) {
+    if (ruleDbid === "*" || ruleDbid === dbid)
+        return true;
+    return ruleDbid.length > 1 && ruleDbid.endsWith("*") && dbid.startsWith(ruleDbid.slice(0, -1));
+}
 /** All valid {@link Operator} values. */
 exports.OPERATORS = [
     "equals",
@@ -90,6 +118,11 @@ exports.RESERVED_PSEUDO_TOKENS = [
     exports.PSEUDO_TOKEN_ADMIN,
     exports.PSEUDO_TOKEN_AUTHOR,
 ];
+/** Defaults for {@link DefaultAccessPolicyDoc.internalMailLimits}. */
+exports.DEFAULT_INTERNAL_MAIL_LIMITS = {
+    maxBytesPerMail: 25 * 1024 * 1024,
+    maxMailsPerHour: 200,
+};
 /**
  * The effective baseline defaults when a policy document exists but omits a
  * field (§6.1). Snapshot and purge default to denied (admin-only).
@@ -105,6 +138,8 @@ exports.DEFAULT_POLICY_DEFAULTS = {
 /**
  * Map a database-scoped {@link RuleType} to the policy `deny<Op>` field that
  * gates it. `llm_use` is not listed: its baseline is `llm.denyUse` (§6.9).
+ * Neither is `doc_deposit`: it has no baseline flag and is always denied
+ * unless an allow rule grants it (§6.10).
  */
 exports.RULE_TYPE_TO_DENY_FIELD = {
     doc_create: "denyDocCreate",
@@ -220,6 +255,25 @@ function validateWithFieldClause(clause, ruleType) {
  * directory sets). Enforces the closed type/operator/placeholder sets and the
  * `withfields` constraints (§6.3). Throws on the first violation.
  */
+/**
+ * Document-id prefixes for deposits (§6.10): an array of non-empty strings
+ * made of the characters document ids use. Throws on violation.
+ */
+function validateDocIdPrefixes(prefixes, what) {
+    if (prefixes === undefined)
+        return;
+    if (!Array.isArray(prefixes))
+        throw new Error(`${what} must be an array of strings`);
+    for (const prefix of prefixes) {
+        if (typeof prefix !== "string" || !/^[A-Za-z0-9_-]{1,64}$/.test(prefix)) {
+            throw new Error(`${what}: "${String(prefix)}" is not a valid document-id prefix`);
+        }
+    }
+}
+/** Whether `docId` passes a deposit's `docIdPrefixes` (absent or empty: any id). */
+function docIdMatchesPrefixes(docId, prefixes) {
+    return !prefixes || prefixes.length === 0 || prefixes.some((prefix) => docId.startsWith(prefix));
+}
 function validateAclRule(rule) {
     if (!exports.RULE_TYPES.includes(rule.type)) {
         throw new Error(`rule has unknown type "${rule.type}"`);
@@ -239,6 +293,37 @@ function validateAclRule(rule) {
     if (rule.type === "doc_read" && (rule.withfields?.length ?? 0) > 0) {
         throw new Error("doc_read rules are database-level and cannot use `withfields`");
     }
+    // `doc_read_all` names who reads every document of a `docReadScope: "own"`
+    // database (§6.12): database-level as well, so the server can enforce it.
+    if (rule.type === "doc_read_all" && (rule.withfields?.length ?? 0) > 0) {
+        throw new Error("doc_read_all rules are database-level and cannot use `withfields`");
+    }
+    // `doc_deposit` is a database-level right like `doc_read` (§6.10). It is the
+    // only type whose dbid may be a prefix pattern ("mmail_*").
+    if (rule.type === "doc_deposit") {
+        if ((rule.withfields?.length ?? 0) > 0) {
+            throw new Error("doc_deposit rules are database-level and cannot use `withfields`");
+        }
+        if (rule.maxRecipients !== undefined) {
+            if (!Number.isInteger(rule.maxRecipients) ||
+                rule.maxRecipients < 1 ||
+                rule.maxRecipients > exports.MAX_DEPOSIT_RECIPIENTS) {
+                throw new Error(`doc_deposit maxRecipients must be an integer from 1 to ${exports.MAX_DEPOSIT_RECIPIENTS}`);
+            }
+        }
+        validateDocIdPrefixes(rule.docIdPrefixes, "doc_deposit docIdPrefixes");
+    }
+    else {
+        if (rule.dbid !== "*" && rule.dbid.endsWith("*")) {
+            throw new Error('only doc_deposit rules may use a dbid prefix pattern ending in "*"');
+        }
+        if (rule.maxRecipients !== undefined) {
+            throw new Error("maxRecipients is only valid on doc_deposit rules");
+        }
+        if (rule.docIdPrefixes !== undefined) {
+            throw new Error("docIdPrefixes is only valid on doc_deposit rules");
+        }
+    }
     // `llm_use` is a tenant-wide decision about the assistant (§6.9), not about
     // a database or its documents.
     if (rule.type === "llm_use") {
@@ -258,6 +343,33 @@ function validateAclRule(rule) {
  * it is written. Throws on violation.
  */
 function validateAccessPolicy(policy) {
+    if (policy.internalMail !== undefined &&
+        policy.internalMail !== "off" &&
+        policy.internalMail !== "members" &&
+        policy.internalMail !== "rules") {
+        throw new Error(`internalMail "${String(policy.internalMail)}" must be "off", "members" or "rules"`);
+    }
+    if (policy.internalMailLimits !== undefined) {
+        for (const [key, value] of Object.entries(policy.internalMailLimits)) {
+            if (!["maxBytesPerMail", "maxMailsPerHour"].includes(key)) {
+                throw new Error(`internalMailLimits.${key} is unknown`);
+            }
+            if (value !== undefined && (!Number.isInteger(value) || value < 1)) {
+                throw new Error(`internalMailLimits.${key} must be a positive integer`);
+            }
+        }
+    }
+    if (policy.personalDatabasePrefixes !== undefined) {
+        if (!Array.isArray(policy.personalDatabasePrefixes) ||
+            !policy.personalDatabasePrefixes.every((prefix) => typeof prefix === "string" && /^[a-z][a-z0-9]*_$/.test(prefix))) {
+            throw new Error('personalDatabasePrefixes must be prefixes like "notes_" (lowercase letters and digits, ending in "_")');
+        }
+    }
+    if (policy.docReadScope !== undefined &&
+        policy.docReadScope !== "all" &&
+        policy.docReadScope !== "own") {
+        throw new Error(`docReadScope "${String(policy.docReadScope)}" must be "all" or "own"`);
+    }
     if (policy.databaseCreationPolicy !== undefined &&
         policy.databaseCreationPolicy !== "open" &&
         policy.databaseCreationPolicy !== "directory-restricted") {
@@ -372,6 +484,7 @@ function effectivePolicy(tenantDefault, dbPolicy) {
         denyDocSnapshot: pick("denyDocSnapshot"),
         denyDocRead: pick("denyDocRead"),
         defaultCreateKeyId,
+        docReadScope: dbPolicy?.docReadScope ?? tenantDefault?.docReadScope ?? "all",
     };
 }
 /**