mindoodb 0.0.85 → 0.0.88

package/dist/server/TenantManager.js

@@ -0,0 +1,1416 @@
+"use strict";
+/**
+ * TenantManager handles loading, caching, and registration of tenants.
+ *
+ * Uses a global server identity (one per server, not per tenant) for
+ * authenticating with remote servers and opening tenant directories.
+ *
+ * When a tenant has a $publicinfos key (sent during publishToServer), the
+ * manager creates a real BaseMindooTenant for directory reading. User
+ * authentication is then validated against the admin-signed directory DB
+ * rather than a static JSON config.
+ *
+ * When no $publicinfos key is available, a SimpleMindooDirectory backed
+ * by config.json users[] is used as a fallback (useful for tests).
+ *
+ * A CompositeMindooDirectory wraps whichever directory source is used and
+ * also checks the global trusted-servers list, enabling server-to-server
+ * auth without servers being in each tenant's user directory.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantManager = exports.SimpleMindooDirectory = void 0;
+exports.lazyContentAddressedStore = lazyContentAddressedStore;
+const AuthenticationService_1 = require("../core/appendonlystores/network/AuthenticationService");
+const ServerNetworkContentAddressedStore_1 = require("../appendonlystores/network/ServerNetworkContentAddressedStore");
+const PurgedDocRegistry_1 = require("./PurgedDocRegistry");
+const purgeDocumentHistory_1 = require("../core/appendonlystores/purgeDocumentHistory");
+const Ed25519WitnessProvider_1 = require("../core/accesscontrol/timestamp/Ed25519WitnessProvider");
+const BaseMindooTenantFactory_1 = require("../core/BaseMindooTenantFactory");
+const RSAEncryption_1 = require("../core/crypto/RSAEncryption");
+const privateKeyEncryption_1 = require("../core/crypto/privateKeyEncryption");
+const KeyBag_1 = require("../core/keys/KeyBag");
+const types_1 = require("../core/types");
+const builtinDbInvariants_1 = require("../core/builtinDbInvariants");
+const DirectoryStateNode_1 = require("../core/accesscontrol/DirectoryStateNode");
+const tier1Evaluator_1 = require("../core/accesscontrol/tier1Evaluator");
+const base64_1 = require("../core/utils/base64");
+// ---------------------------------------------------------------------------
+// StoreFactoryAdapter
+// ---------------------------------------------------------------------------
+class StoreFactoryAdapter {
+    constructor(storeFactory) {
+        this.storeFactory = storeFactory;
+    }
+    createStore(dbId, _options) {
+        return {
+            docStore: this.storeFactory.getStore(dbId, types_1.StoreKind.docs),
+            attachmentStore: this.storeFactory.getStore(dbId, types_1.StoreKind.attachments),
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// SimpleMindooDirectory — config-based fallback
+// ---------------------------------------------------------------------------
+/** Document-id prefix of a document-history purge request in `directory` (§13). */
+const DIRECTORY_PURGE_REQUEST_ID_PREFIX = "acl_dochistorypurge_";
+class SimpleMindooDirectory {
+    constructor(config) {
+        /** Canonical index: entries are identified by their signing public key. */
+        this.usersByKey = new Map();
+        /**
+         * Backward-compat index by documentation-only username, populated only for
+         * config entries that carry a `username`. Lets legacy username-based
+         * challenges keep resolving; `username` is never required.
+         */
+        this.usersByUsername = new Map();
+        this.revokedUsers = new Set();
+        this.adminSigningPublicKey = config.adminSigningPublicKey;
+        if (config.users) {
+            for (const user of config.users) {
+                // Identity is the signing key. `username` is documentation-only and
+                // ignored for matching; index it only as a legacy convenience.
+                this.usersByKey.set(user.signingPublicKey, user);
+                if (typeof user.username === "string" && user.username.trim()) {
+                    this.usersByUsername.set(user.username.toLowerCase(), user);
+                }
+            }
+        }
+    }
+    async getUserPublicKeys(username) {
+        const normalizedUsername = username.toLowerCase();
+        if (this.revokedUsers.has(normalizedUsername)) {
+            return null;
+        }
+        const user = this.usersByUsername.get(normalizedUsername);
+        if (!user) {
+            return null;
+        }
+        return {
+            signingPublicKey: user.signingPublicKey,
+            encryptionPublicKey: user.encryptionPublicKey,
+        };
+    }
+    async getUserBySigningPublicKey(publicKey) {
+        const exact = this.usersByKey.get(publicKey);
+        if (exact) {
+            return this.toLookup(exact);
+        }
+        const needle = publicKey.replace(/\s+/g, "");
+        if (!needle)
+            return null;
+        for (const [key, user] of this.usersByKey) {
+            if (key.replace(/\s+/g, "") === needle) {
+                return this.toLookup(user);
+            }
+        }
+        return null;
+    }
+    toLookup(user) {
+        if (typeof user.username === "string" &&
+            this.revokedUsers.has(user.username.toLowerCase())) {
+            return null;
+        }
+        return {
+            username: typeof user.username === "string" ? user.username : "",
+            signingPublicKey: user.signingPublicKey,
+            encryptionPublicKey: user.encryptionPublicKey,
+            details: null,
+        };
+    }
+    async isUserRevoked(username) {
+        return this.revokedUsers.has(username.toLowerCase());
+    }
+    async validatePublicSigningKey(publicKey, _opts) {
+        if (publicKey === this.adminSigningPublicKey) {
+            return true;
+        }
+        const user = this.usersByKey.get(publicKey);
+        if (!user) {
+            return false;
+        }
+        if (typeof user.username === "string" &&
+            this.revokedUsers.has(user.username.toLowerCase())) {
+            return false;
+        }
+        return true;
+    }
+}
+exports.SimpleMindooDirectory = SimpleMindooDirectory;
+// ---------------------------------------------------------------------------
+// CompositeMindooDirectory — wraps tenant directory + trusted servers
+// ---------------------------------------------------------------------------
+/**
+ * Wraps a per-tenant directory (real or config-based) and also checks
+ * the global trusted-servers list. Holds a reference to the array so
+ * runtime changes via the admin API are immediately visible.
+ */
+class CompositeMindooDirectory {
+    constructor(inner, trustedServers, adminBootstrapIdentity) {
+        this.inner = inner;
+        this.trustedServers = trustedServers;
+        this.adminBootstrapIdentity = adminBootstrapIdentity;
+        this.adminUsernameNormalized =
+            adminBootstrapIdentity?.username.toLowerCase() ?? null;
+    }
+    async getUserPublicKeys(username) {
+        const normalizedUsername = username.toLowerCase();
+        // Bootstrap special-case: allow configured admin identity to authenticate
+        // even before directory grantaccess docs are present on the server.
+        if (this.adminBootstrapIdentity &&
+            this.adminUsernameNormalized &&
+            normalizedUsername === this.adminUsernameNormalized) {
+            return {
+                signingPublicKey: this.adminBootstrapIdentity.signingPublicKey,
+                encryptionPublicKey: this.adminBootstrapIdentity.encryptionPublicKey,
+            };
+        }
+        const result = await this.inner.getUserPublicKeys(username);
+        if (result)
+            return result;
+        for (const server of this.trustedServers) {
+            if (server.name.toLowerCase() === normalizedUsername) {
+                return {
+                    signingPublicKey: server.signingPublicKey,
+                    encryptionPublicKey: server.encryptionPublicKey,
+                };
+            }
+        }
+        return null;
+    }
+    async isUserRevoked(username) {
+        const normalizedUsername = username.toLowerCase();
+        if (this.adminUsernameNormalized &&
+            normalizedUsername === this.adminUsernameNormalized) {
+            return false;
+        }
+        for (const server of this.trustedServers) {
+            if (server.name.toLowerCase() === normalizedUsername) {
+                return false;
+            }
+        }
+        return this.inner.isUserRevoked(username);
+    }
+    async validatePublicSigningKey(publicKey, opts) {
+        if (this.adminBootstrapIdentity &&
+            (0, DirectoryStateNode_1.signingKeysEqual)(this.adminBootstrapIdentity.signingPublicKey, publicKey)) {
+            return true;
+        }
+        const innerResult = await this.inner.validatePublicSigningKey(publicKey, opts);
+        if (innerResult)
+            return true;
+        for (const server of this.trustedServers) {
+            if (server.signingPublicKey === publicKey) {
+                return true;
+            }
+        }
+        return false;
+    }
+    // -----------------------------------------------------------------------
+    // Advanced directory features forwarded to the inner directory. Config-based
+    // inner directories (SimpleMindooDirectory) do not implement these, so the
+    // composite degrades gracefully (no key-based identity, no read policy, no
+    // wipe directives) — preserving legacy config-only behavior — while a real
+    // BaseMindooTenantDirectory inner enables the key-based auth, read gate, and
+    // remote-wipe paths (docs/accesscontrol.md §6.5).
+    // -----------------------------------------------------------------------
+    async getUserBySigningPublicKey(publicKey) {
+        if (typeof this.inner.getUserBySigningPublicKey === "function") {
+            const innerLookup = await this.inner.getUserBySigningPublicKey(publicKey);
+            if (innerLookup)
+                return innerLookup;
+        }
+        // Bootstrap/config fallback: the admin and trusted-server identities can be
+        // resolved by their signing key even without a grantaccess document on this
+        // server, mirroring getUserPublicKeys. Without this, key-based identity
+        // resolution (and the validateToken active-key check below) would treat the
+        // admin's own key as unknown the moment the directory has no admin grant.
+        if (this.adminBootstrapIdentity &&
+            (0, DirectoryStateNode_1.signingKeysEqual)(this.adminBootstrapIdentity.signingPublicKey, publicKey)) {
+            return {
+                username: this.adminBootstrapIdentity.username,
+                signingPublicKey: this.adminBootstrapIdentity.signingPublicKey,
+                encryptionPublicKey: this.adminBootstrapIdentity.encryptionPublicKey,
+                details: null,
+            };
+        }
+        for (const server of this.trustedServers) {
+            if (server.signingPublicKey === publicKey) {
+                return {
+                    username: server.name,
+                    signingPublicKey: server.signingPublicKey,
+                    encryptionPublicKey: server.encryptionPublicKey,
+                    details: null,
+                };
+            }
+        }
+        return null;
+    }
+    async getUserSigningKeyUniverse(username) {
+        const base = typeof this.inner.getUserSigningKeyUniverse === "function"
+            ? await this.inner.getUserSigningKeyUniverse(username)
+            : { active: [], wipeRequested: [] };
+        // The admin bootstrap identity, trusted servers, and config-based users are
+        // valid principals even without a grantaccess document on this server (the
+        // server config / bootstrap identity is the root of trust). Their signing
+        // key must therefore count as ACTIVE so the token-validation gate in
+        // AuthenticationService.validateToken (which requires the device key to be
+        // in this active set) does not reject a freshly-issued admin/config token.
+        // We reuse getUserPublicKeys, which already applies exactly those fallbacks.
+        const active = new Set(base.active);
+        const fallback = await this.getUserPublicKeys(username);
+        if (fallback)
+            active.add(fallback.signingPublicKey);
+        return { active: Array.from(active), wipeRequested: base.wipeRequested };
+    }
+    async getUserKeyPairs(username) {
+        if (typeof this.inner.getUserKeyPairs === "function") {
+            return this.inner.getUserKeyPairs(username);
+        }
+        return [];
+    }
+    async getWipeGrantDocId(signingKey) {
+        if (typeof this.inner.getWipeGrantDocId === "function") {
+            return this.inner.getWipeGrantDocId(signingKey);
+        }
+        return null;
+    }
+    async getRevokedDecryptionKeyIdsForSigningKey(signingKey) {
+        if (typeof this.inner.getRevokedDecryptionKeyIdsForSigningKey === "function") {
+            return this.inner.getRevokedDecryptionKeyIdsForSigningKey(signingKey);
+        }
+        return [];
+    }
+    async evaluateDbAccessForSigningKey(input) {
+        if (typeof this.inner.evaluateDbAccessForSigningKey === "function") {
+            return this.inner.evaluateDbAccessForSigningKey(input);
+        }
+        // Config-based directories carry no database-open policy -> unrestricted.
+        return true;
+    }
+    /**
+     * Forwarded so the server can tell read from deposit (docs/accesscontrol.md
+     * §6.10). Without it the boolean gate above stays in charge and a depositor
+     * is refused like anyone else without read access.
+     */
+    async evaluateDbAccessModeForSigningKey(input) {
+        if (typeof this.inner.evaluateDbAccessModeForSigningKey === "function") {
+            return this.inner.evaluateDbAccessModeForSigningKey(input);
+        }
+        return { mode: (await this.evaluateDbAccessForSigningKey(input)) ? "read" : "none" };
+    }
+    /**
+     * Forwarded so the witness enforces Tier 1 rules on push
+     * (docs/accesscontrol.md §7). `buildTier1Evaluator` only wires the check when
+     * the directory it is given has this method; without the forward every push
+     * was accepted, whatever the tenant's rules said. Config-based directories
+     * have no rules and therefore no method, which keeps their legacy behavior.
+     */
+    get evaluateAccessForSigningKey() {
+        const inner = this.inner;
+        return typeof inner.evaluateAccessForSigningKey === "function"
+            ? (input) => inner.evaluateAccessForSigningKey(input)
+            : undefined;
+    }
+    /** Forwarded with {@link evaluateAccessForSigningKey}: `$author` at grant level. */
+    get isSamePerson() {
+        const inner = this.inner;
+        return typeof inner.isSamePerson === "function" ? (input) => inner.isSamePerson(input) : undefined;
+    }
+    /** Forwarded for the author-scoped read (§6.12). */
+    get evaluateReadScopeForSigningKey() {
+        const inner = this.inner;
+        return typeof inner.evaluateReadScopeForSigningKey === "function"
+            ? (input) => inner.evaluateReadScopeForSigningKey(input)
+            : undefined;
+    }
+    /**
+     * Forwarded so server-side `userdirectory` writes can resolve the signer's
+     * grant. Without this, `evaluateUserdirectoryInvariant` sees a missing
+     * method, leaves `signerUsernameHash` null, and denies every non-admin
+     * change as "signer is not a granted device" — including the founder
+     * wrapping a second device of their own User-Key.
+     */
+    async resolveUsernameHashForSigningKey(signingKey, trustedTime) {
+        if (typeof this.inner.resolveUsernameHashForSigningKey === "function") {
+            return this.inner.resolveUsernameHashForSigningKey(signingKey, trustedTime);
+        }
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// TenantManager
+// ---------------------------------------------------------------------------
+/** Keys of the server-wide state in the {@link ServerDataStore}. */
+const SERVER_IDENTITY_KEY = "server.identity.json";
+const TRUSTED_SERVERS_KEY = "trusted-servers.json";
+const SERVER_KEYBAG_KEY = "server.keybag";
+/**
+ * TenantManager is responsible for:
+ * - Loading the global server identity and trusted servers
+ * - Loading tenant configurations from disk
+ * - Caching loaded tenants
+ * - Registering new tenants
+ * - Managing tenant stores and authentication services
+ * - Creating a real MindooDB tenant for directory reading (when keys available)
+ * - Runtime management of trusted servers
+ */
+class TenantManager {
+    constructor(options) {
+        this.loadedTenants = new Map();
+        this.serverIdentity = null;
+        this.trustedServers = [];
+        /** Peer wiring handed down to every server store; see setPeerAccessControl. */
+        this.peerAccessControl = {};
+        /** Per-tenant persistent registry of executed purges (docs/accesscontrol.md §13). */
+        this.purgedDocRegistries = new Map();
+        /** In-flight purge executions, keyed by normalized tenant id (serializes runs). */
+        this.purgeInFlight = new Map();
+        this.dataStore = options.dataStore;
+        this.storeProvider = options.storeProvider;
+        this.serverPassword = options.serverPassword;
+        this.cryptoAdapter = options.cryptoAdapter;
+        this.jwtSecretForTenant = options.jwtSecretForTenant;
+        this.publicInfosKeysResolver = options.publicInfosKeysResolver;
+        // Load global server identity
+        const identityJson = this.dataStore.readText(SERVER_IDENTITY_KEY);
+        if (identityJson !== null) {
+            this.serverIdentity = JSON.parse(identityJson);
+            console.log(`[TenantManager] Loaded server identity: ${this.serverIdentity.username}`);
+        }
+        else {
+            console.log(`[TenantManager] No server.identity.json found (run "npm run init" to create one)`);
+        }
+        // Load trusted servers
+        const trustedJson = this.dataStore.readText(TRUSTED_SERVERS_KEY);
+        if (trustedJson !== null) {
+            this.trustedServers = JSON.parse(trustedJson);
+            console.log(`[TenantManager] Loaded ${this.trustedServers.length} trusted server(s)`);
+        }
+    }
+    // =======================================================================
+    // Server identity
+    // =======================================================================
+    getServerIdentity() {
+        return this.serverIdentity;
+    }
+    getServerPublicInfo() {
+        if (!this.serverIdentity)
+            return null;
+        return {
+            name: this.serverIdentity.username,
+            signingPublicKey: this.serverIdentity.userSigningKeyPair
+                .publicKey,
+            encryptionPublicKey: this.serverIdentity.userEncryptionKeyPair
+                .publicKey,
+        };
+    }
+    /**
+     * Teach every server store how to recognise a trusted peer.
+     *
+     * `MindooDBServer` calls this once at startup. Two hooks, both required for
+     * peer replication to be correct:
+     *
+     * - `peerTokenResolver` lets a peer's cluster-level JWT through the tenant
+     *   sync routes. A peer holds no per-tenant grant, so without it the mirror
+     *   would need a second replication protocol; with it the peer reuses the
+     *   client one and the store skips the per-user gates that do not apply to a
+     *   full replica.
+     * - `trustedWitnessResolver` decides whose witness receipts may be preserved
+     *   instead of re-stamped (convergence invariant 3). Without it a replicated
+     *   entry would get a fresh `receivedAt` on every hop and "trusted time"
+     *   would mean "time it reached the last server".
+     *
+     * Must be called before the first {@link getServerStore}, since stores are
+     * cached per tenant and database.
+     */
+    setPeerAccessControl(options) {
+        this.peerAccessControl = options;
+    }
+    /**
+     * Database ids this server holds for a tenant (on Node, the directories in
+     * `{dataDir}/{tenantId}/stores`). Used by peer replication to mirror every
+     * database rather than a configured subset.
+     */
+    listDatabases(tenantId) {
+        return this.storeProvider.listDatabases(this.tenantKey(tenantId.toLowerCase()));
+    }
+    /**
+     * The server's own RSA private key, imported for decryption.
+     *
+     * Peer replication needs it because the remote wraps transported entries to
+     * this server's `encryptionPublicKey` (the one in its `trusted-servers.json`),
+     * exactly as it would wrap them for a client.
+     */
+    async getServerEncryptionPrivateKey() {
+        if (this.serverEncryptionPrivateKey)
+            return this.serverEncryptionPrivateKey;
+        if (!this.serverIdentity || !this.serverPassword)
+            return undefined;
+        const subtle = this.cryptoAdapter.getSubtle();
+        const keyBuffer = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, this.serverIdentity.userEncryptionKeyPair
+            .privateKey, this.serverPassword, "encryption");
+        this.serverEncryptionPrivateKey = await subtle.importKey("pkcs8", keyBuffer, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["decrypt"]);
+        return this.serverEncryptionPrivateKey;
+    }
+    /**
+     * Build (and cache) the server's witness identity used to stamp receipts on
+     * accepted entries (docs/accesscontrol.md §5.3). Returns undefined when the
+     * server identity or its unlock password is unavailable, in which case the
+     * server runs in pre-access-control mode (no stamping, no Tier 1 advertised).
+     */
+    async getWitnessSigner() {
+        if (this.witnessSigner)
+            return this.witnessSigner;
+        if (!this.serverIdentity || !this.serverPassword)
+            return undefined;
+        const subtle = this.cryptoAdapter.getSubtle();
+        const signingKeyBuffer = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, this.serverIdentity.userSigningKeyPair.privateKey, this.serverPassword, "signing");
+        const signingPrivateKey = await subtle.importKey("pkcs8", signingKeyBuffer, { name: "Ed25519" }, false, ["sign"]);
+        this.witnessSigner = {
+            publicKeyPem: this.serverIdentity.userSigningKeyPair.publicKey,
+            signingPrivateKey,
+            subtle,
+        };
+        return this.witnessSigner;
+    }
+    /**
+     * Build the trusted-time provider that stamps receipts on accepted entries
+     * (docs/accesscontrol.md §5.3, §13). v1 wraps the server's Ed25519 witness
+     * identity; returns undefined when no witness signer is available, leaving the
+     * server in pre-access-control mode.
+     */
+    async getTimestampProvider() {
+        const signer = await this.getWitnessSigner();
+        if (!signer)
+            return undefined;
+        return new Ed25519WitnessProvider_1.Ed25519WitnessProvider({ signer, subtle: signer.subtle });
+    }
+    // =======================================================================
+    // Trusted server management
+    // =======================================================================
+    listTrustedServers() {
+        return [...this.trustedServers];
+    }
+    addTrustedServer(server) {
+        const existing = this.trustedServers.find((s) => s.name.toLowerCase() === server.name.toLowerCase());
+        if (existing) {
+            throw new Error(`Trusted server "${server.name}" already exists`);
+        }
+        this.trustedServers.push(server);
+        this.persistTrustedServers();
+        console.log(`[TenantManager] Added trusted server: ${server.name}`);
+    }
+    /**
+     * Add or replace a trusted server by name.
+     *
+     * Peer CRUD needs an upsert: `addTrustedServer` throws on an existing name,
+     * which is right for `add-to-network` (a silent overwrite of a peer's keys
+     * would be a trust change disguised as a config edit) but wrong for the admin
+     * API, where changing a peer's url or role is the common case.
+     */
+    saveTrustedServer(server) {
+        const idx = this.trustedServers.findIndex((s) => s.name.toLowerCase() === server.name.toLowerCase());
+        if (idx === -1) {
+            this.trustedServers.push(server);
+        }
+        else {
+            this.trustedServers[idx] = server;
+        }
+        this.persistTrustedServers();
+        console.log(`[TenantManager] Saved trusted server: ${server.name}`);
+    }
+    removeTrustedServer(name) {
+        const idx = this.trustedServers.findIndex((s) => s.name.toLowerCase() === name.toLowerCase());
+        if (idx === -1)
+            return false;
+        this.trustedServers.splice(idx, 1);
+        this.persistTrustedServers();
+        console.log(`[TenantManager] Removed trusted server: ${name}`);
+        return true;
+    }
+    persistTrustedServers() {
+        this.dataStore.writeText(TRUSTED_SERVERS_KEY, JSON.stringify(this.trustedServers, null, 2));
+    }
+    async loadServerKeyBag() {
+        if (!this.serverIdentity || !this.serverPassword) {
+            throw new Error("Server identity and server password are required to manage tenant $publicinfos keys");
+        }
+        const keyBag = await this.createServerKeyBag(this.serverIdentity, this.serverPassword);
+        const data = this.dataStore.readBytes(SERVER_KEYBAG_KEY);
+        if (data !== null) {
+            await keyBag.load(data);
+        }
+        return keyBag;
+    }
+    async createServerKeyBag(serverUser, serverPassword) {
+        const wrappingKey = await KeyBag_1.KeyBag.deriveWrappingKey(serverUser.userEncryptionKeyPair.privateKey, serverPassword, this.cryptoAdapter);
+        return new KeyBag_1.KeyBag({
+            wrappingKey,
+            cryptoAdapter: this.cryptoAdapter,
+        });
+    }
+    async saveServerKeyBag(keyBag) {
+        this.dataStore.writeBytes(SERVER_KEYBAG_KEY, await keyBag.save());
+    }
+    bytesToBase64(bytes) {
+        return (0, base64_1.bytesToBase64)(bytes);
+    }
+    mergeUniqueKeys(keys) {
+        const seen = new Set();
+        const unique = [];
+        for (const key of keys) {
+            const signature = this.bytesToBase64(key);
+            if (seen.has(signature)) {
+                continue;
+            }
+            seen.add(signature);
+            unique.push(key);
+        }
+        return unique;
+    }
+    async computePublicInfosFingerprint(key) {
+        const digest = await this.cryptoAdapter
+            .getSubtle()
+            .digest("SHA-256", key);
+        return Array.from(new Uint8Array(digest).slice(0, 8))
+            .map((byte) => byte.toString(16).padStart(2, "0"))
+            .join(":");
+    }
+    /**
+     * The data-store key of a tenant's directory. Tenant ids reach this from
+     * request paths, so anything that could address another key is refused.
+     */
+    tenantKey(tenantId) {
+        if (tenantId.length === 0 ||
+            tenantId.includes("/") ||
+            tenantId.includes("\\") ||
+            tenantId === "." ||
+            tenantId === "..") {
+            throw new Error(`Resolved tenant path escapes data directory for tenantId "${tenantId}"`);
+        }
+        return tenantId;
+    }
+    tenantConfigKey(tenantId) {
+        return `${this.tenantKey(tenantId)}/config.json`;
+    }
+    readTenantConfig(tenantId) {
+        const json = this.dataStore.readText(this.tenantConfigKey(tenantId));
+        return json === null ? null : JSON.parse(json);
+    }
+    writeTenantConfig(tenantId, config) {
+        this.dataStore.writeText(this.tenantConfigKey(tenantId), JSON.stringify(config, null, 2));
+    }
+    async decryptEncryptedPublicInfosKey(base64Payload) {
+        if (!this.serverIdentity) {
+            throw new Error("Server identity not initialized; cannot decrypt encrypted $publicinfos payload");
+        }
+        if (!this.serverPassword) {
+            throw new Error("Server password not configured; cannot decrypt encrypted $publicinfos payload");
+        }
+        const privateKeyBuffer = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, this.serverIdentity.userEncryptionKeyPair
+            .privateKey, this.serverPassword, "encryption");
+        const privateKey = await this.cryptoAdapter.getSubtle().importKey("pkcs8", privateKeyBuffer, {
+            name: "RSA-OAEP",
+            hash: "SHA-256",
+        }, false, ["decrypt"]);
+        const decrypted = await new RSAEncryption_1.RSAEncryption(this.cryptoAdapter).decrypt((0, base64_1.base64ToBytes)(base64Payload), privateKey);
+        return new Uint8Array(decrypted);
+    }
+    async resolveIncomingPublicInfosKey(request) {
+        if (request.encryptedPublicInfosKey) {
+            return this.decryptEncryptedPublicInfosKey(request.encryptedPublicInfosKey);
+        }
+        if (request.publicInfosKey) {
+            return (0, base64_1.base64ToBytes)(request.publicInfosKey);
+        }
+        throw new Error("Tenant registration requires encryptedPublicInfosKey or publicInfosKey");
+    }
+    async getStoredPublicInfosKeys(tenantId) {
+        if (this.publicInfosKeysResolver) {
+            return this.mergeUniqueKeys(await this.publicInfosKeysResolver(tenantId));
+        }
+        const keys = [];
+        if (this.serverIdentity &&
+            this.serverPassword &&
+            this.dataStore.exists(SERVER_KEYBAG_KEY)) {
+            const keyBag = await this.loadServerKeyBag();
+            keys.push(...(await keyBag.getAllKeys("doc", tenantId, types_1.PUBLIC_INFOS_KEY_ID)));
+        }
+        return this.mergeUniqueKeys(keys);
+    }
+    async persistTenantPublicInfosKey(tenantId, key) {
+        const keyBag = await this.loadServerKeyBag();
+        const existingKeys = await keyBag.getAllKeys("doc", tenantId, types_1.PUBLIC_INFOS_KEY_ID);
+        const incomingSignature = this.bytesToBase64(key);
+        const alreadyStored = existingKeys.some((entry) => this.bytesToBase64(entry) === incomingSignature);
+        if (!alreadyStored) {
+            await keyBag.set("doc", tenantId, types_1.PUBLIC_INFOS_KEY_ID, key, Date.now());
+            await this.saveServerKeyBag(keyBag);
+        }
+    }
+    /**
+     * All stored `$publicinfos` AES key versions for a tenant from `server.keybag`.
+     * Empty when the tenant was never published or the server keybag is locked.
+     */
+    async getPublicInfosKeysForTenant(tenantId) {
+        return this.getStoredPublicInfosKeys(tenantId.toLowerCase());
+    }
+    async listTenantPublicInfosFingerprints(tenantId) {
+        const normalizedId = tenantId.toLowerCase();
+        if (!this.dataStore.exists(this.tenantConfigKey(normalizedId))) {
+            throw new Error(`Tenant ${normalizedId} not found`);
+        }
+        const fingerprints = await Promise.all((await this.getStoredPublicInfosKeys(normalizedId)).map((key) => this.computePublicInfosFingerprint(key)));
+        return [...new Set(fingerprints)].sort();
+    }
+    // =======================================================================
+    // Tenant management
+    // =======================================================================
+    async registerTenant(request) {
+        const tenantId = request.tenantId.toLowerCase();
+        const tenantKey = this.tenantKey(tenantId);
+        if (!this.serverIdentity || !this.serverPassword) {
+            throw new Error("Tenant registration requires an unlocked server identity to store $publicinfos keys");
+        }
+        const publicInfosKey = await this.resolveIncomingPublicInfosKey(request);
+        const existingConfig = this.readTenantConfig(tenantId);
+        if (existingConfig !== null) {
+            const incomingSignature = this.bytesToBase64(publicInfosKey);
+            const existingKeys = await this.getStoredPublicInfosKeys(tenantId);
+            const hasMatch = existingKeys.some((key) => this.bytesToBase64(key) === incomingSignature);
+            if (hasMatch) {
+                console.log(`[TenantManager] Tenant ${tenantId} already registered with matching $publicinfos key`);
+                return {
+                    context: { tenantId, config: existingConfig },
+                    created: false,
+                };
+            }
+            throw new Error(`Tenant ${tenantId} already exists with different $publicinfos key`);
+        }
+        const config = {
+            adminUsername: request.adminUsername,
+            adminSigningPublicKey: request.adminSigningPublicKey,
+            adminEncryptionPublicKey: request.adminEncryptionPublicKey,
+            defaultStoreType: request.defaultStoreType || "file",
+            users: [],
+        };
+        try {
+            this.writeTenantConfig(tenantId, config);
+            await this.persistTenantPublicInfosKey(tenantId, publicInfosKey);
+        }
+        catch (error) {
+            this.dataStore.deleteTree(tenantKey);
+            throw error;
+        }
+        console.log(`[TenantManager] Registered tenant: ${tenantId} ($publicinfos stored in server keybag)`);
+        return {
+            context: { tenantId, config },
+            created: true,
+        };
+    }
+    async getTenant(tenantId) {
+        const normalizedId = tenantId.toLowerCase();
+        const cached = this.loadedTenants.get(normalizedId);
+        if (cached) {
+            return cached;
+        }
+        const loaded = await this.loadTenant(normalizedId);
+        this.loadedTenants.set(normalizedId, loaded);
+        return loaded;
+    }
+    tenantExists(tenantId) {
+        const normalizedId = tenantId.toLowerCase();
+        return this.dataStore.exists(this.tenantConfigKey(normalizedId));
+    }
+    /**
+     * Read the tenant's registered admin signing key without fully loading the
+     * tenant. Returns `null` if the tenant is missing or the config is unreadable.
+     */
+    getTenantAdminSigningPublicKey(tenantId) {
+        try {
+            const normalizedId = tenantId.toLowerCase();
+            const cached = this.loadedTenants.get(normalizedId);
+            if (cached?.context.config.adminSigningPublicKey) {
+                return cached.context.config.adminSigningPublicKey;
+            }
+            const config = this.readTenantConfig(normalizedId);
+            if (config === null) {
+                return null;
+            }
+            return typeof config.adminSigningPublicKey === "string" &&
+                config.adminSigningPublicKey.length > 0
+                ? config.adminSigningPublicKey
+                : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * True when `publicsignkey` is the registered tenant-admin signing key for
+     * `tenantId` (PEM whitespace-insensitive).
+     */
+    isTenantAdminSigningKeyFor(tenantId, publicsignkey) {
+        const adminKey = this.getTenantAdminSigningPublicKey(tenantId);
+        return adminKey !== null && (0, DirectoryStateNode_1.signingKeysEqual)(adminKey, publicsignkey);
+    }
+    /**
+     * True when `publicsignkey` is the registered admin signing key of any
+     * tenant on this server. Used to issue a system JWT so that admin can
+     * DELETE their own tenant; other `/system/*` routes stay capability-gated.
+     */
+    isRegisteredTenantAdminSigningKey(publicsignkey) {
+        for (const tenantId of this.listTenants()) {
+            if (this.isTenantAdminSigningKeyFor(tenantId, publicsignkey)) {
+                return true;
+            }
+        }
+        return false;
+    }
+    listTenants() {
+        return this.dataStore
+            .listDirectories("")
+            .filter((entry) => this.dataStore.exists(`${entry}/config.json`))
+            .sort();
+    }
+    /**
+     * Update operator-owned fields of an existing tenant configuration.
+     * Only the fields present in `updates` are overwritten.
+     */
+    updateTenantConfig(tenantId, updates) {
+        const normalizedId = tenantId.toLowerCase();
+        const config = this.readTenantConfig(normalizedId);
+        if (config === null) {
+            throw new Error(`Tenant ${normalizedId} not found`);
+        }
+        if (updates.defaultStoreType !== undefined) {
+            config.defaultStoreType = updates.defaultStoreType;
+        }
+        this.writeTenantConfig(normalizedId, config);
+        this.loadedTenants.delete(normalizedId);
+        console.log(`[TenantManager] Updated tenant config: ${normalizedId}`);
+    }
+    async removeTenant(tenantId) {
+        const normalizedId = tenantId.toLowerCase();
+        const tenantKey = this.tenantKey(normalizedId);
+        if (!this.dataStore.exists(tenantKey)) {
+            throw new Error(`Tenant ${normalizedId} does not exist`);
+        }
+        this.loadedTenants.delete(normalizedId);
+        if (this.serverIdentity &&
+            this.serverPassword &&
+            this.dataStore.exists(SERVER_KEYBAG_KEY)) {
+            const keyBag = await this.loadServerKeyBag();
+            await keyBag.deleteKey("doc", normalizedId, types_1.PUBLIC_INFOS_KEY_ID);
+            await this.saveServerKeyBag(keyBag);
+        }
+        this.dataStore.deleteTree(tenantKey);
+        await this.storeProvider.removeTenantStores?.(normalizedId);
+        console.log(`[TenantManager] Removed tenant: ${normalizedId}`);
+    }
+    // =======================================================================
+    // Server stores
+    // =======================================================================
+    async getServerStore(tenantId, dbId, storeKind) {
+        const tenant = await this.getTenant(tenantId);
+        const cacheKey = `${dbId}:${storeKind}`;
+        const cached = tenant.serverStores.get(cacheKey);
+        if (cached) {
+            return cached;
+        }
+        // Created on first real use, i.e. after the request's token and rights
+        // were checked: a refused or unauthenticated request must not leave a
+        // store directory behind for an arbitrary database id (disk, inodes, and
+        // listDatabases() would report it).
+        const localStore = lazyContentAddressedStore(dbId, storeKind, () => tenant.storeFactory.getStore(dbId, storeKind));
+        // Access-control v1 wiring (docs/accesscontrol.md §5–§7). The witness signer
+        // lets the server stamp receipts on accepted entries; the Tier 1 evaluator
+        // enforces identity-tier rules at push time. Both are only active when the
+        // server identity is unlocked and the directory supports evaluation, so
+        // pre-access-control deployments keep their existing behavior.
+        const timestampProvider = await this.getTimestampProvider();
+        const directory = tenant.directory;
+        const tier1Evaluator = this.buildTier1Evaluator(directory, localStore);
+        const wipeGrantDocIdResolver = this.buildWipeGrantDocIdResolver(directory);
+        // Database-open gate (directory-restricted policy). Never applied to the
+        // directory store itself, which must always sync so the policy can be read.
+        const dbAccessEvaluator = dbId === "directory" ? undefined : this.buildDbAccessEvaluator(directory);
+        // Same gate, also reporting the deposit right (docs/accesscontrol.md §6.10).
+        const dbAccessModeEvaluator = dbId === "directory" ? undefined : this.buildDbAccessModeEvaluator(directory);
+        // Per-user revoked-key blacklist (§13). Never applied to the directory store
+        // itself (its policy, which defines the blacklist, must always sync).
+        const revokedKeyResolver = dbId === "directory"
+            ? undefined
+            : this.buildRevokedKeyResolver(directory);
+        // Purged-document denylist (§13). In the directory store the purge requests
+        // themselves (`acl_dochistorypurge_…`) must always sync, so they are never
+        // on it; any other purged directory document is, or a member whose replica
+        // still holds it (it has not processed the request yet) would upload it
+        // again on its next push, and the server would keep it for good.
+        const purgedDocResolver = dbId === "directory"
+            ? () => {
+                const ids = this.getPurgedDocRegistry(tenantId).getPurgedDocIds(dbId);
+                return new Set([...ids].filter((id) => !id.startsWith(DIRECTORY_PURGE_REQUEST_ID_PREFIX)));
+            }
+            : () => this.getPurgedDocRegistry(tenantId).getPurgedDocIds(dbId);
+        // Author-scoped read (§6.12). Never for the directory databases. The
+        // attachments store finds a document's creator in the docs store.
+        const readScopeResolver = dbId === "directory" || dbId === types_1.USER_DIRECTORY_DB_ID
+            ? undefined
+            : this.buildReadScopeResolver(directory, dbId);
+        const docCreatorResolver = storeKind === types_1.StoreKind.attachments
+            ? this.buildDocCreatorResolver(
+            // Lazy as well: a refused request must not create the docs store.
+            lazyContentAddressedStore(dbId, types_1.StoreKind.docs, () => tenant.storeFactory.getStore(dbId, types_1.StoreKind.docs)))
+            : undefined;
+        // Purge requests in personal databases (§6.11): checked on push (only in
+        // the docs store, where the request documents live).
+        const purgeRequestValidator = storeKind === types_1.StoreKind.docs && (0, builtinDbInvariants_1.personalDatabaseOwner)(dbId)
+            ? this.buildPurgeRequestValidator(tenant, directory, localStore, dbId)
+            : undefined;
+        const builtinWriteContext = dbId === types_1.USER_DIRECTORY_DB_ID
+            ? this.buildUserdirectoryWriteContext(tenant, localStore)
+            : undefined;
+        const serverStore = new ServerNetworkContentAddressedStore_1.ServerNetworkContentAddressedStore(localStore, directory, tenant.authService, this.cryptoAdapter, undefined, {
+            timestampProvider,
+            witnessDbid: dbId,
+            tier1Evaluator,
+            wipeGrantDocIdResolver,
+            dbAccessEvaluator,
+            dbAccessModeEvaluator,
+            revokedKeyResolver,
+            purgedDocResolver,
+            readScopeResolver,
+            docCreatorResolver,
+            purgeRequestValidator,
+            builtinWriteContext,
+            ...this.peerAccessControl,
+        });
+        tenant.serverStores.set(cacheKey, serverStore);
+        console.log(`[TenantManager] Created server store for ${tenantId}/${dbId}/${storeKind}`);
+        return serverStore;
+    }
+    /**
+     * Build a Tier 1 evaluator closure for a server store, or undefined when the
+     * directory cannot evaluate access (e.g. config-based directory without the
+     * access-control state chain). The closure resolves `$author` for non-create
+     * ops by reading the document's `doc_create` entry creator key from the local
+     * store (metadata only, no decryption) and comparing it to the change author.
+     */
+    /**
+     * The witness's Tier 1 gate. The evaluation itself is shared with the peer
+     * listener, which has to run it for entries that never reach a witness at
+     * all — see `core/accesscontrol/tier1Evaluator.ts`.
+     */
+    buildTier1Evaluator(directory, localStore) {
+        return (0, tier1Evaluator_1.buildTier1Evaluator)(directory, localStore);
+    }
+    /**
+     * Builtin `userdirectory` write invariant: admin may create/delete, only the
+     * owning person may change. `username_hash` is read from the decrypted
+     * `doc_create` payload (`$publicinfos`). Personal documents are sealed to
+     * their owner and therefore undecryptable here, so they are owned by whoever
+     * signed their `doc_create` — `resolveCreatorSigningKey` answers that from
+     * the entry chain alone.
+     */
+    buildUserdirectoryWriteContext(tenant, localStore) {
+        const adminPublicKey = tenant.context.config.adminSigningPublicKey;
+        const mindooTenant = tenant.mindooTenant;
+        return {
+            adminPublicKey,
+            resolveCreatorSigningKey: async (entry) => {
+                const createEntry = await this.findCreateEntry(localStore, entry);
+                return createEntry?.createdByPublicKey ?? null;
+            },
+            resolveDocumentUsernameHash: mindooTenant
+                ? async (entry) => {
+                    const createEntry = await this.findCreateEntry(localStore, entry);
+                    if (!createEntry)
+                        return null;
+                    try {
+                        const plaintext = await mindooTenant.decryptPayload(createEntry.encryptedData, createEntry.decryptionKeyId);
+                        return (0, builtinDbInvariants_1.usernameHashFromCreateChangeBytes)(plaintext);
+                    }
+                    catch {
+                        return null;
+                    }
+                }
+                : undefined,
+        };
+    }
+    /**
+     * Read-scope resolver (§6.12): `null` (reads everything) unless the
+     * database's `docReadScope` is `"own"` for this principal; then the principal
+     * sees documents whose creator is the same person (grant level).
+     */
+    buildReadScopeResolver(directory, dbId) {
+        const dir = directory;
+        const evaluate = dir.evaluateReadScopeForSigningKey;
+        const isSamePerson = dir.isSamePerson;
+        if (typeof evaluate !== "function" || typeof isSamePerson !== "function")
+            return undefined;
+        return async (principal) => {
+            const signingKey = principal.signingKey;
+            // No principal key: nothing to attribute documents to, so nothing is shown.
+            if (!signingKey) {
+                return { scopeId: "none", ownsDocument: async () => false };
+            }
+            if ((await evaluate({ dbid: dbId, signingKey })) === "all")
+                return null;
+            return {
+                scopeId: "own",
+                ownsDocument: (creatorSigningKey, creatorTrustedTime) => isSamePerson({
+                    creatorSigningKey,
+                    signerSigningKey: signingKey,
+                    creatorTrustedTime,
+                    signerTrustedTime: Number.MAX_SAFE_INTEGER,
+                }),
+            };
+        };
+    }
+    /** Finds a document's `doc_create` creator in the given (docs) store. */
+    buildDocCreatorResolver(docsStore) {
+        return async (docId) => {
+            const metas = await docsStore.findNewEntriesForDoc([], docId);
+            const create = metas.find((m) => m.entryType === "doc_create");
+            return create
+                ? { signingKey: create.createdByPublicKey, trustedTime: create.receivedAt ?? create.createdAt }
+                : null;
+        };
+    }
+    async findCreateEntry(localStore, entry) {
+        if (entry.entryType === "doc_create") {
+            return entry;
+        }
+        try {
+            const metas = await localStore.findNewEntriesForDoc([], entry.docId);
+            const createMeta = metas.find((m) => m.entryType === "doc_create");
+            if (!createMeta)
+                return null;
+            const loaded = await localStore.getEntries([createMeta.id]);
+            return loaded[0] ?? null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Build a database-open evaluator closure for a server store, or undefined
+     * when the directory cannot evaluate the database-open policy (e.g. a
+     * config-based directory without the access-control state chain). When the
+     * tenant policy is `"directory-restricted"`, this rejects sync for any
+     * database id that is not in the allowlist; `"directory"` is always allowed
+     * and the tenant admin is exempt (resolved from the principal signing key).
+     */
+    buildDbAccessEvaluator(directory) {
+        const evaluable = directory;
+        if (typeof evaluable.evaluateDbAccessForSigningKey !== "function") {
+            return undefined;
+        }
+        return async (principal, dbid) => {
+            return evaluable.evaluateDbAccessForSigningKey({
+                dbid,
+                signingKey: principal.signingKey ?? "",
+            });
+        };
+    }
+    /**
+     * Like {@link buildDbAccessEvaluator}, but reports read / deposit / none
+     * (docs/accesscontrol.md §6.10). Undefined when the directory predates it,
+     * in which case the boolean evaluator stays in charge.
+     */
+    buildDbAccessModeEvaluator(directory) {
+        const evaluable = directory;
+        if (typeof evaluable.evaluateDbAccessModeForSigningKey !== "function") {
+            return undefined;
+        }
+        return async (principal, dbid) => evaluable.evaluateDbAccessModeForSigningKey({ dbid, signingKey: principal.signingKey ?? "" });
+    }
+    /**
+     * Build a remote-wipe resolver closure for a server store, or undefined when
+     * the directory does not support wipe directives (docs/accesscontrol.md §6.5).
+     * Maps a wipe-targeted signing key to the admin-signed grant document id so
+     * the server can serve only that document to the targeted device.
+     */
+    buildWipeGrantDocIdResolver(directory) {
+        if (typeof directory.getWipeGrantDocId !== "function") {
+            return undefined;
+        }
+        return (signingKey) => directory.getWipeGrantDocId(signingKey);
+    }
+    /**
+     * Build a per-user revoked-key blacklist resolver for a server store, or
+     * undefined when the directory cannot resolve revoked keys (e.g. a
+     * config-based directory). Maps the authenticated principal's signing key to
+     * the set of decryption key ids revoked for them at the directory head
+     * (docs/accesscontrol.md §13).
+     */
+    buildRevokedKeyResolver(directory) {
+        if (typeof directory.getRevokedDecryptionKeyIdsForSigningKey !== "function") {
+            return undefined;
+        }
+        return async (principal) => {
+            const ids = await directory.getRevokedDecryptionKeyIdsForSigningKey(principal.signingKey ?? "");
+            return new Set(ids);
+        };
+    }
+    async getStore(tenantId, dbId, storeKind) {
+        const tenant = await this.getTenant(tenantId);
+        return tenant.storeFactory.getStore(dbId, storeKind);
+    }
+    /**
+     * Documents purged from `dbId` on this server (the persistent purge
+     * registry). Peer pull replication refuses their entries.
+     */
+    getPurgedDocIds(tenantId, dbId) {
+        return this.getPurgedDocRegistry(tenantId).getPurgedDocIds(dbId);
+    }
+    /** The (lazily-loaded, cached) purge registry for a tenant. */
+    getPurgedDocRegistry(tenantId) {
+        const normalizedId = tenantId.toLowerCase();
+        let registry = this.purgedDocRegistries.get(normalizedId);
+        if (!registry) {
+            registry = new PurgedDocRegistry_1.PurgedDocRegistry(this.dataStore, `${this.tenantKey(normalizedId)}/purged-docs.json`);
+            this.purgedDocRegistries.set(normalizedId, registry);
+        }
+        return registry;
+    }
+    /**
+     * Execute any not-yet-processed document-history purge requests for a tenant
+     * (docs/accesscontrol.md §13). Reads the admin-signed purge requests from the
+     * tenant directory (server-readable `$publicinfos` envelope), physically
+     * purges each requested document's history from the tenant's `docs` and
+     * `attachments` stores, and records the purge in the persistent registry so
+     * (a) it is never executed twice and (b) re-pushes of the purged docs are
+     * rejected at sync time.
+     *
+     * No-op when the server cannot read the directory (config-based fallback, or
+     * the directory does not expose the purge reader). Runs are serialized per
+     * tenant; concurrent callers share the in-flight promise.
+     */
+    async executePendingPurges(tenantId, options) {
+        const normalizedId = tenantId.toLowerCase();
+        const existing = this.purgeInFlight.get(normalizedId);
+        if (existing)
+            return existing;
+        const run = this.executePendingPurgesInternal(normalizedId, options?.dbIds).finally(() => {
+            this.purgeInFlight.delete(normalizedId);
+        });
+        this.purgeInFlight.set(normalizedId, run);
+        return run;
+    }
+    async executePendingPurgesInternal(normalizedId, dbIds) {
+        const tenant = await this.getTenant(normalizedId);
+        if (!tenant.mindooTenant) {
+            // Config-based fallback: the server holds no $publicinfos directory and
+            // cannot read purge requests. Clients still purge locally on reconcile.
+            return;
+        }
+        let directory;
+        try {
+            directory = await tenant.mindooTenant.openDirectory();
+        }
+        catch (error) {
+            console.error(`[TenantManager] executePendingPurges: cannot open directory for ${normalizedId}:`, error);
+            return;
+        }
+        if (typeof directory.getRequestedDocHistoryPurges !== "function") {
+            return;
+        }
+        let requests;
+        try {
+            requests = await directory.getRequestedDocHistoryPurges();
+        }
+        catch (error) {
+            console.error(`[TenantManager] executePendingPurges: cannot read purge requests for ${normalizedId}:`, error);
+            return;
+        }
+        if (requests.length === 0)
+            return;
+        const registry = this.getPurgedDocRegistry(normalizedId);
+        const purgedNow = new Set();
+        const touchedDbIds = new Set();
+        for (const request of requests) {
+            if (registry.isRequestProcessed(request.purgeRequestDocId)) {
+                continue;
+            }
+            if (typeof request.dbId !== "string" || request.dbId.length === 0) {
+                continue;
+            }
+            if (dbIds && !dbIds.has(request.dbId)) {
+                continue;
+            }
+            for (const docId of request.docIds) {
+                if (typeof docId !== "string" || docId.length === 0)
+                    continue;
+                // Denylist BEFORE purging: the sync push path consults the registry
+                // live, so from this moment re-pushes of the doc are rejected. Doing it
+                // after the store purges would leave a window in which the entries are
+                // already gone but a stale client could still re-push (and the server
+                // would re-accept) the very history that is being purged. The record is
+                // kept regardless of per-store outcome so re-pushes are rejected even
+                // if one store had nothing to purge.
+                registry.recordPurgedDoc(request.dbId, docId);
+                await this.purgeDocumentFromDatabase(normalizedId, request.dbId, docId);
+                purgedNow.add(`${request.dbId}\u0000${docId}`);
+                touchedDbIds.add(request.dbId);
+            }
+            registry.markRequestProcessed(request.purgeRequestDocId);
+            console.log(`[TenantManager] Executed purge request ${request.purgeRequestDocId} (${request.docIds.length} doc(s)) for ${normalizedId}/${request.dbId}`);
+        }
+        // A purge keeps attachment chunks that another document's history still
+        // references (an in-place copy). Once that document is purged as well,
+        // the earlier purge's leftovers are unreferenced: sweep them now, since a
+        // processed request is never executed again.
+        for (const dbId of touchedDbIds) {
+            for (const docId of registry.getPurgedDocIds(dbId)) {
+                if (!purgedNow.has(`${dbId}\u0000${docId}`)) {
+                    await this.purgeDocumentFromDatabase(normalizedId, dbId, docId);
+                }
+            }
+        }
+    }
+    /**
+     * The push check for purge requests in a personal database (§6.11): a
+     * `$publicinfos` create, signed by someone with read access to the database
+     * (a device of the owner, a service with a matching `accessPrefixes` grant,
+     * the tenant admin), naming only documents that are deleted (last
+     * delete/undelete is a delete, on the server or in the same push). Purge
+     * requests themselves cannot be purged, changed or deleted.
+     */
+    buildPurgeRequestValidator(tenant, directory, localStore, dbId) {
+        const mindooTenant = tenant.mindooTenant;
+        const dir = directory;
+        return async (entry, batch) => {
+            if (entry.entryType !== "doc_create") {
+                return "a purge request can only be created, not changed or deleted";
+            }
+            if (entry.decryptionKeyId !== types_1.PUBLIC_INFOS_KEY_ID) {
+                return "a purge request must be encrypted with $publicinfos";
+            }
+            if (!mindooTenant || typeof dir.evaluateDbAccessModeForSigningKey !== "function") {
+                return "this server cannot check purge requests";
+            }
+            const access = await dir.evaluateDbAccessModeForSigningKey({ dbid: dbId, signingKey: entry.createdByPublicKey });
+            if (access.mode !== "read") {
+                return "only the owner, a service with access or the tenant admin may purge";
+            }
+            let docIds = null;
+            try {
+                docIds = (0, builtinDbInvariants_1.purgeRequestDocIdsFromCreateBytes)(await mindooTenant.decryptPayload(entry.encryptedData, types_1.PUBLIC_INFOS_KEY_ID));
+            }
+            catch {
+                docIds = null;
+            }
+            if (!docIds)
+                return "not a readable purge request";
+            for (const docId of docIds) {
+                if ((0, builtinDbInvariants_1.isPurgeRequestDocId)(docId))
+                    return "purge requests cannot be purged";
+                const history = [
+                    ...(await localStore.findNewEntriesForDoc([], docId)),
+                    ...batch.filter((e) => e.docId === docId),
+                ].filter((e) => e.entryType === "doc_delete" || e.entryType === "doc_undelete");
+                history.sort((a, b) => (a.receivedAt ?? a.createdAt) - (b.receivedAt ?? b.createdAt));
+                if (history.at(-1)?.entryType !== "doc_delete") {
+                    return `document ${docId} is not deleted`;
+                }
+            }
+            return null;
+        };
+    }
+    /**
+     * Executes the purge requests of one personal database (§6.11): every
+     * document a request names is put on the denylist and removed from the docs
+     * and attachment stores. Called after accepted writes to the database;
+     * requests already executed are skipped. Serialized per database.
+     */
+    async executePersonalPurges(tenantId, dbId) {
+        const key = `${tenantId.toLowerCase()}\u0000${dbId}`;
+        const existing = this.purgeInFlight.get(key);
+        if (existing)
+            return existing;
+        const run = this.executePersonalPurgesInternal(tenantId.toLowerCase(), dbId).finally(() => {
+            this.purgeInFlight.delete(key);
+        });
+        this.purgeInFlight.set(key, run);
+        return run;
+    }
+    async executePersonalPurgesInternal(normalizedId, dbId) {
+        if (!(0, builtinDbInvariants_1.personalDatabaseOwner)(dbId))
+            return;
+        const tenant = await this.getTenant(normalizedId);
+        const mindooTenant = tenant.mindooTenant;
+        if (!mindooTenant)
+            return;
+        const docsStore = await this.getStore(normalizedId, dbId, types_1.StoreKind.docs);
+        const creates = (await docsStore.findEntries("doc_create", null, null)).filter((m) => (0, builtinDbInvariants_1.isPurgeRequestDocId)(m.docId));
+        if (creates.length === 0)
+            return;
+        const registry = this.getPurgedDocRegistry(normalizedId);
+        for (const meta of creates) {
+            const requestKey = `${dbId}/${meta.docId}`;
+            if (registry.isRequestProcessed(requestKey))
+                continue;
+            const [entry] = await docsStore.getEntries([meta.id]);
+            if (!entry)
+                continue;
+            let docIds = null;
+            try {
+                docIds = (0, builtinDbInvariants_1.purgeRequestDocIdsFromCreateBytes)(await mindooTenant.decryptPayload(entry.encryptedData, entry.decryptionKeyId));
+            }
+            catch (error) {
+                console.error(`[TenantManager] purge request ${requestKey} is not readable:`, error);
+                continue;
+            }
+            for (const docId of docIds ?? []) {
+                if ((0, builtinDbInvariants_1.isPurgeRequestDocId)(docId))
+                    continue;
+                // Denylist first, as for directory purge requests (see above).
+                registry.recordPurgedDoc(dbId, docId);
+                await this.purgeDocumentFromDatabase(normalizedId, dbId, docId);
+            }
+            registry.markRequestProcessed(requestKey);
+            console.log(`[TenantManager] Executed personal purge ${requestKey} (${docIds?.length ?? 0} doc(s)) for ${normalizedId}`);
+        }
+    }
+    /**
+     * Purge one document from a database's docs and attachment stores. Attachment
+     * chunks still referenced by another document are kept (see
+     * `purgeDocumentHistory.ts`). Failures are logged, never thrown.
+     */
+    async purgeDocumentFromDatabase(tenantId, dbId, docId) {
+        try {
+            await (0, purgeDocumentHistory_1.purgeDocumentHistoryFromStores)({
+                docsStore: await this.getStore(tenantId, dbId, types_1.StoreKind.docs),
+                attachmentStore: await this.getStore(tenantId, dbId, types_1.StoreKind.attachments),
+            }, docId);
+        }
+        catch (error) {
+            console.error(`[TenantManager] executePendingPurges: failed to purge ${docId} in ${tenantId}/${dbId}:`, error);
+        }
+    }
+    async getAuthService(tenantId) {
+        const tenant = await this.getTenant(tenantId);
+        return tenant.authService;
+    }
+    getCryptoAdapter() {
+        return this.cryptoAdapter;
+    }
+    async reloadTenant(tenantId) {
+        const normalizedId = tenantId.toLowerCase();
+        this.loadedTenants.delete(normalizedId);
+        return this.getTenant(normalizedId);
+    }
+    clearCache() {
+        this.loadedTenants.clear();
+        console.log(`[TenantManager] Cleared tenant cache`);
+    }
+    // -----------------------------------------------------------------------
+    // Private helpers
+    // -----------------------------------------------------------------------
+    async loadTenant(tenantId) {
+        const config = this.readTenantConfig(tenantId);
+        if (config === null) {
+            throw new Error(`Tenant ${tenantId} not found: ${this.tenantConfigKey(tenantId)}`);
+        }
+        const context = { tenantId, config };
+        const storeFactory = this.storeProvider.createTenantStores(tenantId, config);
+        // Build the inner directory (real or config-based fallback)
+        let innerDirectory;
+        let mindooTenant;
+        const publicInfosKeys = await this.getStoredPublicInfosKeys(tenantId);
+        if (publicInfosKeys.length > 0 &&
+            this.serverIdentity &&
+            this.serverPassword) {
+            try {
+                const result = await this.createDirectoryTenant(tenantId, config, storeFactory, publicInfosKeys);
+                mindooTenant = result.tenant;
+                innerDirectory = await mindooTenant.openDirectory();
+                console.log(`[TenantManager] Loaded tenant ${tenantId} with real directory`);
+            }
+            catch (error) {
+                console.error(`[TenantManager] Failed to create real directory for ${tenantId}, falling back to config:`, error);
+                innerDirectory = new SimpleMindooDirectory(config);
+            }
+        }
+        else {
+            if (publicInfosKeys.length > 0 && !this.serverIdentity) {
+                console.log(`[TenantManager] Tenant ${tenantId} has $publicinfos keys but no server identity; using config-based directory`);
+            }
+            else {
+                console.log(`[TenantManager] No $publicinfos keys for ${tenantId}, using config-based directory`);
+            }
+            innerDirectory = new SimpleMindooDirectory(config);
+        }
+        // Wrap with CompositeMindooDirectory so trusted servers are also recognized
+        const directory = new CompositeMindooDirectory(innerDirectory, this.trustedServers, config.adminUsername
+            ? {
+                username: config.adminUsername,
+                signingPublicKey: config.adminSigningPublicKey,
+                encryptionPublicKey: config.adminEncryptionPublicKey,
+            }
+            : undefined);
+        const authService = new AuthenticationService_1.AuthenticationService(this.cryptoAdapter, directory, tenantId, this.jwtSecretForTenant
+            ? { jwtSecret: await this.jwtSecretForTenant(tenantId) }
+            : undefined);
+        console.log(`[TenantManager] Loaded tenant: ${tenantId}`);
+        return {
+            context,
+            storeFactory,
+            authService,
+            directory,
+            mindooTenant,
+            serverStores: new Map(),
+        };
+    }
+    /**
+     * Create a real BaseMindooTenant for directory reading using the global
+     * server identity.
+     */
+    async createDirectoryTenant(tenantId, config, storeFactory, publicInfosKeys) {
+        const storeFactoryAdapter = new StoreFactoryAdapter(storeFactory);
+        const factory = new BaseMindooTenantFactory_1.BaseMindooTenantFactory(storeFactoryAdapter, this.cryptoAdapter);
+        const serverUser = this.serverIdentity;
+        // Create a KeyBag using the server user's encryption key
+        const keyBag = await this.createServerKeyBag(serverUser, this.serverPassword);
+        for (const publicInfosKey of this.mergeUniqueKeys(publicInfosKeys)) {
+            await keyBag.set("doc", tenantId, types_1.PUBLIC_INFOS_KEY_ID, publicInfosKey);
+        }
+        // Collect trusted server signing keys for additionalTrustedKeys
+        const openOptions = {};
+        if (this.trustedServers.length > 0) {
+            const trustedKeys = new Map();
+            for (const server of this.trustedServers) {
+                trustedKeys.set(server.signingPublicKey, true);
+            }
+            openOptions.additionalTrustedKeys = trustedKeys;
+        }
+        const tenant = await factory.openTenant(tenantId, config.adminSigningPublicKey, config.adminEncryptionPublicKey, serverUser, this.serverPassword, keyBag, openOptions);
+        return { tenant };
+    }
+}
+exports.TenantManager = TenantManager;
+/**
+ * A store that is only created when something other than its identity
+ * (`getId`, `getStoreKind`) is used. See {@link TenantManager.getServerStore}.
+ */
+function lazyContentAddressedStore(dbId, storeKind, create) {
+    let real = null;
+    const target = () => (real ?? (real = create()));
+    return new Proxy({}, {
+        get(_shell, prop) {
+            if (prop === "getId")
+                return () => dbId;
+            if (prop === "getStoreKind")
+                return () => storeKind;
+            const store = target();
+            const value = store[prop];
+            return typeof value === "function" ? value.bind(store) : value;
+        },
+        has(_shell, prop) {
+            return prop in target();
+        },
+    });
+}
+//# sourceMappingURL=TenantManager.js.map