npm - mindoodb - Versions diffs - 0.0.86 → 0.0.89 - Mend

mindoodb 0.0.86 → 0.0.89

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (127) hide show

package/dist/core/BaseMindooTenant.d.ts CHANGED Viewed

@@ -5,6 +5,8 @@ import { KeyBag } from "./keys/KeyBag";
 import { UserKeyManager } from "./userkeys/UserKeyManager";
 import type { PendingUserKeyDevice, UserKeyEnrollmentStatus } from "./userkeys/types";
 import type { EntryRecipients } from "./userkeys/sealedTypes";
+import type { RecipientOptions, RecipientSpec } from "./userkeys/sealedTypes";
+import { type SealedValue } from "./userkeys/sealedValues";
 import { MindooDocSigner } from "./crypto/MindooDocSigner";
 import { Logger } from "./logging";
 import { type LocalCacheStore } from "./cache/LocalCacheStore";
@@ -170,6 +172,19 @@ export declare class BaseMindooTenant implements MindooTenant {
     rememberSealedGenerations(keyId: string, generations: Uint8Array[]): void;
     getSealedGenerations(keyId: string): Uint8Array[];
     ingestSealedRecipients(keyId: string, recipients: EntryRecipients): Promise<void>;
+    /**
+     * Seals `value` to people (their published User-Keys) or devices, for a
+     * field of a document encrypted with another key (see {@link SealedValue}).
+     * `options` as for sealed documents: the current user is included unless
+     * `includeSelf` is false; `strict` fails on a recipient without a published
+     * User-Key instead of leaving them out.
+     */
+    sealValue(value: Uint8Array, recipients: RecipientSpec[], options?: RecipientOptions): Promise<SealedValue>;
+    /**
+     * Opens a {@link SealedValue} with this identity's User-Key (any generation)
+     * or device key. Returns null when it is not sealed to them.
+     */
+    openSealedValue(sealed: SealedValue): Promise<Uint8Array | null>;
     ingestSealedFromEntries(keyId: string, entries: Array<{
         recipients?: EntryRecipients;
         createdAt: number;
@@ -411,6 +426,20 @@ export declare class BaseMindooTenant implements MindooTenant {
      * and the full ticket so the same handshake runs over Iroh RPC.
      */
     publishToServer(serverUrl: string, options?: PublishToServerOptions): Promise<void>;
+    /**
+     * Adds the server the tenant was just published to as a trusted witness
+     * (docs/accesscontrol.md §6.4). The server stamps every entry it accepts;
+     * without this directory document those receipts come from an untrusted key,
+     * and once access control is switched on every stamped entry is quarantined.
+     * Trust is evaluated at the receipt's `receivedAt`, so it has to be in place
+     * before the first entry is pushed: that is why the publish flow writes it.
+     *
+     * Needs the administration private key: {@link PublishToServerOptions.adminSigningKey}
+     * and `adminPassword`, or a `systemAdminUser` that is the tenant admin (demo
+     * servers with open tenant creation). Without it a warning is logged and the
+     * admin has to call `MindooTenantDirectory.addTrustedWitness()` before pushing.
+     */
+    private trustServerAsWitness;
     private resolveIrohDial;
     private publishToIrohServer;
     private authenticateAsSystemAdminOverIroh;

package/dist/core/BaseMindooTenant.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EACzB,sBAAsB,EAEtB,sBAAsB,EAIvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAkB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;~~AACvD~~,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;~~AAI9D~~,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAe3D,OAAO,EAAE,MAAM,EAA8C,MAAM,WAAW,CAAC;AAG/E,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAExF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;~~AAKpD~~;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,sEAAsE;IACtE,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,iBAAiB,CAAgF;IACzG,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,oBAAoB,CAA6C;IACzE,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqD;IAGrF,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAO;IAC7D,OAAO,CAAC,MAAM,CAAS;IAQvB,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAMtC;IACH,OAAO,CAAC,yBAAyB,CAAS;IAC1C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IAGrE,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;QAC/B,mBAAmB,CAAC,EAAE,UAAU,CAAC;KAClC;IA0FH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB1C,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,qBAAqB,IAAI,aAAa;IAItC,sBAAsB,IAAI,MAAM;IAIhC,iBAAiB,IAAI,cAAc;IAInC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIrC,qGAAqG;IACrG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;OAKG;IACH,wBAAwB,IAAI,IAAI;IAYhC;;;OAGG;IACH,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAIjD;;;;;;OAMG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAezC,wBAAwB,IAAI,IAAI;IAIhC,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI5C,yBAAyB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI5D,kBAAkB,IAAI,OAAO,CAAC,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IAI5E,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAI5F,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtC,0BAA0B,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAI9D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI;IAIzE,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE;IAI3C,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;~~IAsDjF~~,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,CAAC,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,IAAI,CAAC;IAOhB,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAI9C;;;;OAIG;YACW,kBAAkB;IA+B1B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8GjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsDhG;;;;;;;;OAQG;YACW,0BAA0B;IAYlC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqB3D;;;;;;;;;;;OAWG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAMrF;;;;;;;OAOG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAiBb,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAwDhB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCtG;;;OAGG;YACW,qBAAqB;IAsB7B,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAgDlG;;;;;;;OAOG;YACW,yBAAyB;IAsBjC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAQrD;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC;IA0BjD;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChE,uEAAuE;YACzD,qBAAqB;YA8BrB,0BAA0B;~~IAyElC~~,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;YAuDtD,cAAc;IAqE5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAMlC;IAEX;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/D;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAmBtE;;;;;;;;OAQG;IACG,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;OAQG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD/F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI/B,kBAAkB;IAsChC;;;;;;;;;;;;OAYG;IACG,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxF;;;;OAIG;IACG,+BAA+B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5F;;;;;;OAMG;IACG,0CAA0C,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjE,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAqB9C,OAAO,CAAC,4BAA4B;IAMpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;~~IAiQtH~~;;;;;;;;;;OAUG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;~~IA0GzF~~,OAAO,CAAC,eAAe;YAmBT,mBAAmB;~~YAqEnB~~,iCAAiC;IAsC/C;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,EACrC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;~~IA4EjC~~;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;OAMG;IACH,uBAAuB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAInD;;;;;;OAMG;IACG,mCAAmC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IActE;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAsBvB;;;;;;;;OAQG;IACG,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAalD,yBAAyB;IA8BvC;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAejE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;OAKG;IACG,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE;;;;;;;;;;;;;;;;;;OAkBG;IACG,uCAAuC,IAAI,OAAO,CAAC;QACvD,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,gFAAgF;QAChF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IA4DF;;;;OAIG;YACW,gCAAgC;IA6B9C;;;;;;OAMG;IACG,2CAA2C,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlE;;;;;;;;;OASG;IACG,8BAA8B,CAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;;OAOG;IACG,oCAAoC,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,MAAM,CAAC;IAwBlB,8FAA8F;IACxF,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7D;;;;;OAKG;IACG,sBAAsB,CAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAchF;;;;;;;;OAQG;IACG,wCAAwC,CAC5C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC;IAiClB,oEAAoE;IACpE,OAAO,CAAC,4BAA4B;IAIpC;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8B7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CA2DvB"}
1	+ {"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EACzB,sBAAsB,EAEtB,sBAAsB,EAIvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAkB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAe3D,OAAO,EAAE,MAAM,EAA8C,MAAM,WAAW,CAAC;AAG/E,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAExF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAMpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,sEAAsE;IACtE,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,iBAAiB,CAAgF;IACzG,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,oBAAoB,CAA6C;IACzE,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqD;IAGrF,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAO;IAC7D,OAAO,CAAC,MAAM,CAAS;IAQvB,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAMtC;IACH,OAAO,CAAC,yBAAyB,CAAS;IAC1C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IAGrE,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;QAC/B,mBAAmB,CAAC,EAAE,UAAU,CAAC;KAClC;IA0FH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB1C,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,qBAAqB,IAAI,aAAa;IAItC,sBAAsB,IAAI,MAAM;IAIhC,iBAAiB,IAAI,cAAc;IAInC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIrC,qGAAqG;IACrG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;OAKG;IACH,wBAAwB,IAAI,IAAI;IAYhC;;;OAGG;IACH,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAIjD;;;;;;OAMG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAezC,wBAAwB,IAAI,IAAI;IAIhC,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI5C,yBAAyB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI5D,kBAAkB,IAAI,OAAO,CAAC,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IAI5E,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAI5F,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtC,0BAA0B,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAI9D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,IAAI;IAIzE,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE;IAI3C,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAsDvF;;;;;;OAMG;IACG,SAAS,CACb,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,aAAa,EAAE,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,CAAC;IAkBvB;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAQhE,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,CAAC,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,IAAI,CAAC;IAOhB,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAI9C;;;;OAIG;YACW,kBAAkB;IA+B1B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8GjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsDhG;;;;;;;;OAQG;YACW,0BAA0B;IAYlC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqB3D;;;;;;;;;;;OAWG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAMrF;;;;;;;OAOG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAiBb,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAwDhB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCtG;;;OAGG;YACW,qBAAqB;IAsB7B,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAgDlG;;;;;;;OAOG;YACW,yBAAyB;IAsBjC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAQrD;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC;IA0BjD;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChE,uEAAuE;YACzD,qBAAqB;YA8BrB,0BAA0B;IA+ElC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;YAuDtD,cAAc;IAqE5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAMlC;IAEX;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/D;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAmBtE;;;;;;;;OAQG;IACG,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;OAQG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD/F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI/B,kBAAkB;IAsChC;;;;;;;;;;;;OAYG;IACG,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxF;;;;OAIG;IACG,+BAA+B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5F;;;;;;OAMG;IACG,0CAA0C,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjE,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAqB9C,OAAO,CAAC,4BAA4B;IAMpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IA+QtH;;;;;;;;;;OAUG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6GzF;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAyClC,OAAO,CAAC,eAAe;YAmBT,mBAAmB;YA2EnB,iCAAiC;IAsC/C;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,EACrC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IAkFjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;OAMG;IACH,uBAAuB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAInD;;;;;;OAMG;IACG,mCAAmC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IActE;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAsBvB;;;;;;;;OAQG;IACG,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAalD,yBAAyB;IA8BvC;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAejE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;OAKG;IACG,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE;;;;;;;;;;;;;;;;;;OAkBG;IACG,uCAAuC,IAAI,OAAO,CAAC;QACvD,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,gFAAgF;QAChF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IA4DF;;;;OAIG;YACW,gCAAgC;IA6B9C;;;;;;OAMG;IACG,2CAA2C,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlE;;;;;;;;;OASG;IACG,8BAA8B,CAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;;OAOG;IACG,oCAAoC,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,MAAM,CAAC;IAwBlB,8FAA8F;IACxF,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7D;;;;;OAKG;IACG,sBAAsB,CAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAchF;;;;;;;;OAQG;IACG,wCAAwC,CAC5C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC;IAiClB,oEAAoE;IACpE,OAAO,CAAC,4BAA4B;IAIpC;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8B7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CA2DvB"}

package/dist/core/BaseMindooTenant.js CHANGED Viewed

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMindooTenant = void 0;
 const types_1 = require("./types");
 const userid_1 = require("./userid");
+const AuthChallenge_1 = require("./crypto/AuthChallenge");
 const BaseMindooDB_1 = require("./BaseMindooDB");
 const BaseMindooTenantDirectory_1 = require("./BaseMindooTenantDirectory");
 const grantKeys_1 = require("./accesscontrol/grantKeys");
@@ -11,6 +12,7 @@ const types_2 = require("./userkeys/types");
 const validateUserKeyDocument_1 = require("./userkeys/validateUserKeyDocument");
 const sealedTypes_1 = require("./userkeys/sealedTypes");
 const recipients_1 = require("./userkeys/recipients");
+const sealedValues_1 = require("./userkeys/sealedValues");
 const sealedCrypto_1 = require("./userkeys/sealedCrypto");
 const MindooDocSigner_1 = require("./crypto/MindooDocSigner");
 const RSAEncryption_1 = require("./crypto/RSAEncryption");
@@ -33,6 +35,7 @@ const CacheManager_1 = require("./cache/CacheManager");
 const databaseIdValidation_1 = require("./databaseIdValidation");
 const BackgroundTaskTracker_1 = require("./BackgroundTaskTracker");
 const singleFlight_1 = require("./utils/singleFlight");
+const dynamicImportInterop_1 = require("./utils/dynamicImportInterop");
 /**
  * BaseMindooTenant is a platform-agnostic implementation of MindooTenant
  * that works in both browser and server environments.
@@ -402,6 +405,41 @@ class BaseMindooTenant {
         });
         this.sealedGenerations.delete(keyId);
     }
+    /**
+     * Seals `value` to people (their published User-Keys) or devices, for a
+     * field of a document encrypted with another key (see {@link SealedValue}).
+     * `options` as for sealed documents: the current user is included unless
+     * `includeSelf` is false; `strict` fails on a recipient without a published
+     * User-Key instead of leaving them out.
+     */
+    async sealValue(value, recipients, options) {
+        const resolved = await (0, recipients_1.resolveRecipientSpecs)({
+            tenant: this,
+            specs: recipients,
+            options,
+            addedBy: this.currentUser.userSigningKeyPair.publicKey,
+            now: (0, timeSource_1.semanticNow)(),
+        });
+        const { contentKey, ciphertext } = await (0, sealedValues_1.encryptSealedValueContent)(this.cryptoAdapter, value);
+        const sealed = await (0, recipients_1.sealToTargets)({ tenant: this, generations: [contentKey], targets: resolved.targets, epoch: 1 });
+        return {
+            v: sealedValues_1.SEALED_VALUE_VERSION,
+            ciphertext,
+            recipients: sealed,
+            to: resolved.targets.map((target) => ({ kind: target.kind, keyFingerprint: target.keyFingerprint })),
+        };
+    }
+    /**
+     * Opens a {@link SealedValue} with this identity's User-Key (any generation)
+     * or device key. Returns null when it is not sealed to them.
+     */
+    async openSealedValue(sealed) {
+        const privateKeys = [
+            ...(await this.userKeys.getUserKeyCryptoKeysForReconcile()),
+            await this.getEncryptionPrivateKeyForReconcile(),
+        ].filter((key) => !!key);
+        return (0, sealedValues_1.openSealedValueWithKeys)({ crypto: this.cryptoAdapter, sealed, privateKeys });
+    }
     async ingestSealedFromEntries(keyId, entries) {
         if (!(0, sealedTypes_1.isSealedKeyId)(keyId))
             return;
@@ -991,6 +1029,12 @@ class BaseMindooTenant {
         // canReadDatabase).
         if (typeof directory.canReadDatabase === "function") {
             const canRead = await directory.canReadDatabase(id);
+            // Deposit right (doc_deposit, §6.10): the database opens so the user can
+            // create sealed documents and push them; the server refuses every read.
+            if (!canRead && typeof directory.canDepositDatabase === "function" && (await directory.canDepositDatabase(id))) {
+                this.logger.info(`Opening database "${id}" for deposit only (no read access)`);
+                return;
+            }
             if (!canRead) {
                 this.logger.warn(`Denied database open for ${currentUser.username}: no read access to database "${id}"`);
                 throw new Error(`User "${currentUser.username}" does not have read access to database "${id}".`);
@@ -1419,6 +1463,15 @@ class BaseMindooTenant {
         await directory.registerUser(publicUserId, options.adminSigningKey, options.adminPassword, undefined, deviceLabel, {
             distributeKeyIds: [],
         });
+        if ((options.depositPrefixes?.length ?? 0) > 0 || (options.accessPrefixes?.length ?? 0) > 0) {
+            if (typeof directory.setGrantPersonalDatabaseRights !== "function") {
+                throw new Error("This directory cannot record personal-database rights (depositPrefixes, accessPrefixes)");
+            }
+            await directory.setGrantPersonalDatabaseRights(publicUserId.username, {
+                ...(options.depositPrefixes?.length ? { depositPrefixes: options.depositPrefixes } : {}),
+                ...(options.accessPrefixes?.length ? { accessPrefixes: options.accessPrefixes } : {}),
+            }, options.adminSigningKey, options.adminPassword);
+        }
         const userPublicKey = typeof request.userPublicKey === "string" ? request.userPublicKey.trim() : "";
         if (userPublicKey) {
             const userKeyDoc = await this.userKeys.createPendingFromJoin({
@@ -1590,6 +1643,7 @@ class BaseMindooTenant {
             adminSigningPublicKey: this.administrationPublicKey,
             adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
         };
+        let serverSigningPublicKey;
         try {
             const serverInfoResponse = await fetch(`${baseUrl}/.well-known/mindoodb-server-info`, {
                 headers: {
@@ -1614,6 +1668,7 @@ class BaseMindooTenant {
                 || typeof serverInfoBody.encryptionPublicKey !== "string") {
                 throw new Error("The server returned an invalid .well-known payload.");
             }
+            serverSigningPublicKey = readServerSigningPublicKey(serverInfoBody);
             const rsaEncryption = new RSAEncryption_1.RSAEncryption(this.cryptoAdapter);
             requestBody.encryptedPublicInfosKey = this.uint8ArrayToBase64(await rsaEncryption.encrypt(publicInfosKeyBytes, serverInfoBody.encryptionPublicKey));
         }
@@ -1653,6 +1708,48 @@ class BaseMindooTenant {
         }
         console.log(`[publishToServer] ✓ Tenant "${this.tenantId}" published to server successfully`);
         this.logger.info(`Tenant "${this.tenantId}" published to server successfully`);
+        await this.trustServerAsWitness(serverSigningPublicKey, baseUrl, options);
+    }
+    /**
+     * Adds the server the tenant was just published to as a trusted witness
+     * (docs/accesscontrol.md §6.4). The server stamps every entry it accepts;
+     * without this directory document those receipts come from an untrusted key,
+     * and once access control is switched on every stamped entry is quarantined.
+     * Trust is evaluated at the receipt's `receivedAt`, so it has to be in place
+     * before the first entry is pushed: that is why the publish flow writes it.
+     *
+     * Needs the administration private key: {@link PublishToServerOptions.adminSigningKey}
+     * and `adminPassword`, or a `systemAdminUser` that is the tenant admin (demo
+     * servers with open tenant creation). Without it a warning is logged and the
+     * admin has to call `MindooTenantDirectory.addTrustedWitness()` before pushing.
+     */
+    async trustServerAsWitness(serverSigningPublicKey, serverUrl, options) {
+        if (options?.skipTrustedWitness)
+            return;
+        if (!serverSigningPublicKey) {
+            this.logger.warn(`[publishToServer] ${serverUrl} did not report a signing key; it was not added as a trusted witness`);
+            return;
+        }
+        let adminKey = options?.adminSigningKey;
+        let adminPassword = options?.adminPassword;
+        if ((!adminKey || adminPassword === undefined) &&
+            options?.systemAdminUser &&
+            options.systemAdminPassword !== undefined &&
+            options.systemAdminUser.userSigningKeyPair.publicKey === this.administrationPublicKey) {
+            adminKey = options.systemAdminUser.userSigningKeyPair.privateKey;
+            adminPassword = options.systemAdminPassword;
+        }
+        const directory = await this.openDirectory();
+        const trustedNow = await directory.getTrustedWitnessKeysAt?.(Date.now());
+        if (trustedNow?.has(serverSigningPublicKey))
+            return;
+        if (!adminKey || adminPassword === undefined || !directory.addTrustedWitness) {
+            console.warn(`[publishToServer] ${serverUrl} was not added as a trusted witness (no administration key given). ` +
+                `Call directory.addTrustedWitness() before pushing data, or entries it stamps are quarantined once access control is enabled.`);
+            return;
+        }
+        await directory.addTrustedWitness({ witnessPublicKey: serverSigningPublicKey, serverUrl }, adminKey, adminPassword);
+        this.logger.info(`Added ${serverUrl} as a trusted witness of tenant "${this.tenantId}"`);
     }
     resolveIrohDial(serverUrl, options) {
         if (!(0, irohLocator_1.isIrohLocator)(serverUrl) && !options?.irohTicket) {
@@ -1668,7 +1765,7 @@ class BaseMindooTenant {
         return { ticket, io: options.irohStreamIO };
     }
     async publishToIrohServer(target, options) {
-        const { IrohNetworkTransport } = await import("./appendonlystores/network/IrohNetworkTransport.js");
+        const IrohNetworkTransport = (0, dynamicImportInterop_1.namedExport)(await import("./appendonlystores/network/IrohNetworkTransport.js"), "IrohNetworkTransport");
         const transport = new IrohNetworkTransport(target.io, target.ticket, {
             tenantId: this.tenantId,
         });
@@ -1681,6 +1778,7 @@ class BaseMindooTenant {
             adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
         };
         let supportsSystemAdmin = false;
+        let serverSigningPublicKey;
         try {
             const serverInfo = await transport.getServerInfo();
             if (!serverInfo
@@ -1690,6 +1788,7 @@ class BaseMindooTenant {
                 throw new Error("The server returned an invalid Iroh server-info payload.");
             }
             supportsSystemAdmin = serverInfo.supportsSystemAdmin === true;
+            serverSigningPublicKey = readServerSigningPublicKey(serverInfo);
             const rsaEncryption = new RSAEncryption_1.RSAEncryption(this.cryptoAdapter);
             requestBody.encryptedPublicInfosKey = this.uint8ArrayToBase64(await rsaEncryption.encrypt(publicInfosKeyBytes, serverInfo.encryptionPublicKey));
         }
@@ -1717,13 +1816,14 @@ class BaseMindooTenant {
         await transport.registerTenant(token, this.tenantId, requestBody);
         console.log(`[publishToServer] ✓ Tenant "${this.tenantId}" published to server successfully`);
         this.logger.info(`Tenant "${this.tenantId}" published to server successfully`);
+        await this.trustServerAsWitness(serverSigningPublicKey, `iroh:${target.ticket}`, options);
     }
     async authenticateAsSystemAdminOverIroh(transport, adminUser, adminPassword) {
         const subtle = this.cryptoAdapter.getSubtle();
         const signingKeyBuffer = await this.decryptPrivateKey(adminUser.userSigningKeyPair.privateKey, adminPassword, "signing");
         const signingKey = await subtle.importKey("pkcs8", signingKeyBuffer, { name: "Ed25519" }, false, ["sign"]);
         const { challenge } = await transport.requestSystemChallenge(adminUser.username, adminUser.userSigningKeyPair.publicKey);
-        const messageBytes = new TextEncoder().encode(challenge);
+        const messageBytes = (0, AuthChallenge_1.authChallengeSigningBytes)(challenge);
         const signatureBuffer = await subtle.sign({ name: "Ed25519" }, signingKey, messageBytes);
         const result = await transport.authenticateSystem(challenge, new Uint8Array(signatureBuffer));
         if (!result.success || !result.token) {
@@ -1754,7 +1854,7 @@ class BaseMindooTenant {
         }
         const { challenge } = (await challengeRes.json());
         // Step 2: Sign the challenge
-        const messageBytes = new TextEncoder().encode(challenge);
+        const messageBytes = (0, AuthChallenge_1.authChallengeSigningBytes)(challenge);
         const signatureBuffer = await subtle.sign({ name: "Ed25519" }, signingKey, messageBytes);
         const signatureBase64 = this.uint8ArrayToBase64(new Uint8Array(signatureBuffer));
         // Step 3: Authenticate
@@ -1790,14 +1890,14 @@ class BaseMindooTenant {
         }
         const remoteStorePromise = (async () => {
             // Lazy-import network modules to avoid circular dependencies and keep core lightweight
-            const { ClientNetworkContentAddressedStore } = await import("../appendonlystores/network/ClientNetworkContentAddressedStore.js");
+            const ClientNetworkContentAddressedStore = (0, dynamicImportInterop_1.namedExport)(await import("../appendonlystores/network/ClientNetworkContentAddressedStore.js"), "ClientNetworkContentAddressedStore");
             const transport = irohTarget
-                ? new (await import("./appendonlystores/network/IrohNetworkTransport.js")).IrohNetworkTransport(irohTarget.io, irohTarget.ticket, {
+                ? new ((0, dynamicImportInterop_1.namedExport)(await import("./appendonlystores/network/IrohNetworkTransport.js"), "IrohNetworkTransport"))(irohTarget.io, irohTarget.ticket, {
                     tenantId: this.tenantId,
                     dbId: validDbId,
                     storeKind,
                 })
-                : new (await import("../appendonlystores/network/HttpTransport.js")).HttpTransport({
+                : new ((0, dynamicImportInterop_1.namedExport)(await import("../appendonlystores/network/HttpTransport.js"), "HttpTransport"))({
                     baseUrl: `${normalizedServerUrl}/${this.tenantId}`,
                     tenantId: this.tenantId,
                     dbId: validDbId,
@@ -2485,4 +2585,9 @@ BaseMindooTenant.DB_CACHE_RECORD_TYPES = [
  */
 BaseMindooTenant.ENCRYPTION_MODE_RANDOM = 0x00;
 BaseMindooTenant.ENCRYPTION_MODE_DETERMINISTIC = 0x01;
+/** The server's Ed25519 signing key (its witness key) from its server-info payload. */
+function readServerSigningPublicKey(serverInfo) {
+    const key = serverInfo?.signingPublicKey;
+    return typeof key === "string" && key.length > 0 ? key : undefined;
+}
 //# sourceMappingURL=BaseMindooTenant.js.map