mindoodb 0.0.94 → 0.0.95

package/dist/core/userkeys/generationValidity.d.ts

@@ -0,0 +1,75 @@
+import type { CryptoAdapter } from "../crypto/CryptoAdapter";
+import type { MindooDB } from "../types";
+import type { UserKeyDocumentPayload, UserKeyGeneration } from "./types";
+/**
+ * Which User-Key generations count (docs/userkeys.md §9.3).
+ *
+ * Anyone on a person's grant may change their User-Key document, including a
+ * device the person never approved. A generation therefore only counts when
+ * one of these holds for the change that gave it its current value
+ * (`publicKey` + `signingPublicKey`):
+ *
+ * 1. **Root:** the value was already in the document's `doc_create`. Only the
+ *    admin (from the join request) or the person may create it.
+ * 2. **Signed:** a signature over the generation verifies with the person's
+ *    device self-grant key from their admin-signed grant (not revoked at that
+ *    trusted time), or with the `signingPublicKey` of the previous accepted
+ *    generation.
+ * 3. **Adoption:** the lowest epoch was replaced while the document had no
+ *    device wraps at all (a pending document nobody could use yet), signed by
+ *    its own new `signingPublicKey`.
+ * 4. **Legacy:** the change's trusted (witness) time is before the cutoff.
+ *    The cutoff is the earlier of the tenant's
+ *    `requireUserKeyGenerationSignatureSince` and the person's
+ *    `deviceSelfGrant.grantedAt`. Without either, every generation counts, as
+ *    before.
+ *
+ * When the current value of an epoch does not count, an earlier value of the
+ * same epoch that did count is used instead, so overwriting a generation in
+ * place cannot take it away from its owner either.
+ */
+export interface GenerationValidityPolicy {
+    usernameHash: string;
+    /** Trusted time from which unsigned generations stop counting. */
+    cutoff?: number;
+    /** The person's admin-granted self-grant key. */
+    selfGrant?: {
+        signingPublicKey: string;
+        revokedAt?: number;
+    } | null;
+}
+/** One value an epoch had, as first set by one change. */
+export interface GenerationVersion {
+    valueKey: string;
+    /** The generation object as of that change. */
+    generation: UserKeyGeneration;
+    trustedTime: number;
+    /** Set by the document's `doc_create`. */
+    isCreate: boolean;
+    /** The document had no device wrap in any generation right before. */
+    pendingBefore: boolean;
+}
+export type GenerationHistory = Map<string, GenerationVersion[]>;
+/**
+ * Record, per epoch, each distinct value with the trusted time of the change
+ * that introduced it. Works on the signed change DAG: for every entry the
+ * state at its parents is compared with the state at the entry, so a change
+ * with a backdated `createdAt` cannot pose as part of the create. Cached per
+ * database and document until the document gains entries.
+ */
+export declare function loadGenerationHistory(db: MindooDB, docId: string): Promise<GenerationHistory>;
+/**
+ * The payload with only the generations that count, each at its newest value
+ * that counts. Wraps on the live value are kept; a fallback to an earlier
+ * value uses that value's own snapshot.
+ */
+export declare function filterValidGenerations(input: {
+    payload: UserKeyDocumentPayload;
+    history: GenerationHistory;
+    policy: GenerationValidityPolicy;
+    crypto: CryptoAdapter;
+}): Promise<{
+    payload: UserKeyDocumentPayload;
+    rejectedEpochs: string[];
+}>;
+//# sourceMappingURL=generationValidity.d.ts.map

package/dist/core/userkeys/generationValidity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generationValidity.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/generationValidity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,KAAK,EAAE,QAAQ,EAAsB,MAAM,UAAU,CAAC;AAO7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,SAAS,CAAC,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACrE;AAED,0DAA0D;AAC1D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,UAAU,EAAE,iBAAiB,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,iBAAiB,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAgBjE;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,CAAC,CA4D5B;AAoBD;;;;GAIG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,MAAM,EAAE,wBAAwB,CAAC;IACjC,MAAM,EAAE,aAAa,CAAC;CACvB,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,CAAC;IAAC,cAAc,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAqCzE"}

package/dist/core/userkeys/generationValidity.js

@@ -0,0 +1,175 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadGenerationHistory = loadGenerationHistory;
+exports.filterValidGenerations = filterValidGenerations;
+const storeEntryTime_1 = require("../storeEntryTime");
+const fingerprint_1 = require("./fingerprint");
+const generationSignature_1 = require("./generationSignature");
+const historyCache = new WeakMap();
+function hasAnyWrap(payload) {
+    for (const gen of Object.values(payload?.userKeys ?? {})) {
+        if (Object.keys(gen?.deviceWraps ?? {}).length > 0)
+            return true;
+    }
+    return false;
+}
+/**
+ * Record, per epoch, each distinct value with the trusted time of the change
+ * that introduced it. Works on the signed change DAG: for every entry the
+ * state at its parents is compared with the state at the entry, so a change
+ * with a backdated `createdAt` cannot pose as part of the create. Cached per
+ * database and document until the document gains entries.
+ */
+async function loadGenerationHistory(db, docId) {
+    const metas = await db.getStore().findNewEntriesForDoc([], docId);
+    const ids = metas.map((m) => m.id).sort();
+    const stamp = `${ids.length}:${ids.join(",").length}:${ids[ids.length - 1] ?? ""}`;
+    let perDb = historyCache.get(db);
+    if (!perDb) {
+        perDb = new Map();
+        historyCache.set(db, perDb);
+    }
+    const cached = perDb.get(docId);
+    if (cached && cached.stamp === stamp)
+        return cached.history;
+    const now = Date.now();
+    const history = new Map();
+    const stateCache = new Map();
+    const stateAt = async (heads) => {
+        if (heads.length === 0)
+            return null;
+        const key = [...heads].sort().join(",");
+        if (stateCache.has(key))
+            return stateCache.get(key);
+        const result = await db.materializeDocumentAtHeads(docId, heads);
+        const data = result ? result.doc.getData() : null;
+        stateCache.set(key, data);
+        return data;
+    };
+    for (const meta of metas) {
+        if (meta.entryType !== "doc_create" && meta.entryType !== "doc_change")
+            continue;
+        const before = meta.entryType === "doc_create" ? null : await stateAt(meta.dependencyIds ?? []);
+        const after = await stateAt([meta.id]);
+        if (!after)
+            continue;
+        const trustedTime = (0, storeEntryTime_1.entryTrustedTime)(meta, now);
+        const isCreate = meta.entryType === "doc_create";
+        const pendingBefore = !hasAnyWrap(before);
+        for (const [epoch, gen] of Object.entries(after.userKeys ?? {})) {
+            if (!/^\d+$/.test(epoch) || !gen)
+                continue;
+            const valueKey = (0, generationSignature_1.generationValueKey)(gen);
+            const prior = before?.userKeys?.[epoch];
+            if (prior && (0, generationSignature_1.generationValueKey)(prior) === valueKey)
+                continue;
+            const versions = history.get(epoch) ?? [];
+            const existing = versions.find((v) => v.valueKey === valueKey);
+            const version = {
+                valueKey,
+                generation: JSON.parse(JSON.stringify(gen)),
+                trustedTime,
+                isCreate,
+                pendingBefore,
+            };
+            if (!existing) {
+                versions.push(version);
+            }
+            else if (isCreate || (!existing.isCreate && trustedTime < existing.trustedTime)) {
+                versions[versions.indexOf(existing)] = version;
+            }
+            history.set(epoch, versions);
+        }
+    }
+    for (const versions of history.values()) {
+        versions.sort((a, b) => a.trustedTime - b.trustedTime);
+    }
+    perDb.set(docId, { stamp, history });
+    return history;
+}
+async function signedBy(crypto, usernameHash, epoch, gen, acceptedSigners) {
+    if (!gen.signatures?.length || acceptedSigners.length === 0)
+        return false;
+    const accepted = new Set(acceptedSigners.map(fingerprint_1.normalizePublicKeyPem));
+    const message = (0, generationSignature_1.userKeyGenerationSigningMessage)(usernameHash, epoch, gen);
+    for (const sig of gen.signatures) {
+        if (!sig?.signerPublicKey || !sig.signature)
+            continue;
+        if (!accepted.has((0, fingerprint_1.normalizePublicKeyPem)(sig.signerPublicKey)))
+            continue;
+        if (await (0, generationSignature_1.verifyEd25519)(crypto, sig.signerPublicKey, sig.signature, message))
+            return true;
+    }
+    return false;
+}
+/**
+ * The payload with only the generations that count, each at its newest value
+ * that counts. Wraps on the live value are kept; a fallback to an earlier
+ * value uses that value's own snapshot.
+ */
+async function filterValidGenerations(input) {
+    const { payload, history, policy, crypto } = input;
+    const epochs = Object.keys(payload.userKeys ?? {})
+        .filter((e) => /^\d+$/.test(e))
+        .sort((a, b) => (BigInt(a) < BigInt(b) ? -1 : BigInt(a) > BigInt(b) ? 1 : 0));
+    const accepted = {};
+    const rejectedEpochs = [];
+    let previous = null;
+    for (const epoch of epochs) {
+        const live = payload.userKeys[epoch];
+        const versions = history.get(epoch) ?? [];
+        const liveKey = (0, generationSignature_1.generationValueKey)(live);
+        // Live value first, then older values newest first.
+        const candidates = [];
+        const liveVersion = versions.find((v) => v.valueKey === liveKey);
+        candidates.push({ gen: live, version: liveVersion });
+        for (const version of [...versions].reverse()) {
+            if (version.valueKey === liveKey)
+                continue;
+            candidates.push({ gen: version.generation, version });
+        }
+        let chosen = null;
+        for (const candidate of candidates) {
+            if (await counts(candidate.gen, candidate.version, epoch, previous, policy, crypto)) {
+                chosen = candidate.gen;
+                break;
+            }
+        }
+        if (chosen) {
+            accepted[epoch] = chosen;
+            previous = chosen;
+        }
+        else {
+            rejectedEpochs.push(epoch);
+        }
+    }
+    return { payload: { ...payload, userKeys: accepted }, rejectedEpochs };
+}
+async function counts(gen, version, epoch, previous, policy, crypto) {
+    if (!gen?.publicKey)
+        return false;
+    // Not seen in history (not yet materialized): treat as brand new.
+    const trustedTime = version?.trustedTime ?? Number.POSITIVE_INFINITY;
+    if (version?.isCreate)
+        return true;
+    const signers = [];
+    const selfGrant = policy.selfGrant;
+    if (selfGrant?.signingPublicKey &&
+        (selfGrant.revokedAt === undefined || trustedTime < selfGrant.revokedAt)) {
+        signers.push(selfGrant.signingPublicKey);
+    }
+    if (previous?.signingPublicKey)
+        signers.push(previous.signingPublicKey);
+    if (await signedBy(crypto, policy.usernameHash, epoch, gen, signers))
+        return true;
+    if (!previous &&
+        version?.pendingBefore &&
+        gen.signingPublicKey &&
+        (await signedBy(crypto, policy.usernameHash, epoch, gen, [gen.signingPublicKey]))) {
+        return true;
+    }
+    if (policy.cutoff === undefined)
+        return true;
+    return trustedTime < policy.cutoff;
+}
+//# sourceMappingURL=generationValidity.js.map

package/dist/core/userkeys/generationValidity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generationValidity.js","sourceRoot":"","sources":["../../../src/core/userkeys/generationValidity.ts"],"names":[],"mappings":";;AAkFA,sDA+DC;AAyBD,wDA0CC;AAnND,sDAAqD;AAErD,+CAAsD;AACtD,+DAI+B;AA0D/B,MAAM,YAAY,GAAG,IAAI,OAAO,EAAmC,CAAC;AAEpE,SAAS,UAAU,CAAC,OAA2D;IAC7E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CACzC,EAAY,EACZ,KAAa;IAEb,MAAM,KAAK,GAAyB,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IACnF,IAAI,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;QAClB,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,KAAK;QAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IAE5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,OAAO,GAAsB,IAAI,GAAG,EAAE,CAAC;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkD,CAAC;IAC7E,MAAM,OAAO,GAAG,KAAK,EAAE,KAAe,EAAmD,EAAE;QACzF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,0BAA0B,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAsC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvF,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY,IAAI,IAAI,CAAC,SAAS,KAAK,YAAY;YAAE,SAAS;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;QAChG,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,WAAW,GAAG,IAAA,iCAAgB,EAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;QACjD,MAAM,aAAa,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;gBAAE,SAAS;YAC3C,MAAM,QAAQ,GAAG,IAAA,wCAAkB,EAAC,GAAG,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,KAAK,IAAI,IAAA,wCAAkB,EAAC,KAAK,CAAC,KAAK,QAAQ;gBAAE,SAAS;YAC9D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAsB;gBACjC,QAAQ;gBACR,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAsB;gBAChE,WAAW;gBACX,QAAQ;gBACR,aAAa;aACd,CAAC;YACF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;iBAAM,IAAI,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,IAAI,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClF,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,OAAO,CAAC;YACjD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IACzD,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,MAAqB,EACrB,YAAoB,EACpB,KAAa,EACb,GAAsB,EACtB,eAAyB;IAEzB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,mCAAqB,CAAC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,IAAA,qDAA+B,EAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1E,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,GAAG,EAAE,eAAe,IAAI,CAAC,GAAG,CAAC,SAAS;YAAE,SAAS;QACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAA,mCAAqB,EAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAAE,SAAS;QACxE,IAAI,MAAM,IAAA,mCAAa,EAAC,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IACC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC/C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAC9B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAsC,EAAE,CAAC;IACvD,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,QAAQ,GAA6B,IAAI,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAA,wCAAkB,EAAC,IAAI,CAAC,CAAC;QACzC,oDAAoD;QACpD,MAAM,UAAU,GAAmE,EAAE,CAAC;QACtF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACjE,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QACrD,KAAK,MAAM,OAAO,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAAE,SAAS;YAC3C,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,MAAM,GAA6B,IAAI,CAAC;QAC5C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;gBACpF,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC;gBACvB,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC;YACzB,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,GAAsB,EACtB,OAAsC,EACtC,KAAa,EACb,QAAkC,EAClC,MAAgC,EAChC,MAAqB;IAErB,IAAI,CAAC,GAAG,EAAE,SAAS;QAAE,OAAO,KAAK,CAAC;IAClC,kEAAkE;IAClE,MAAM,WAAW,GAAG,OAAO,EAAE,WAAW,IAAI,MAAM,CAAC,iBAAiB,CAAC;IACrE,IAAI,OAAO,EAAE,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IACE,SAAS,EAAE,gBAAgB;QAC3B,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,WAAW,GAAG,SAAS,CAAC,SAAS,CAAC,EACxE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,QAAQ,EAAE,gBAAgB;QAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACxE,IAAI,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAElF,IACE,CAAC,QAAQ;QACT,OAAO,EAAE,aAAa;QACtB,GAAG,CAAC,gBAAgB;QACpB,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EACjF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;AACrC,CAAC"}

package/dist/core/userkeys/index.d.ts

@@ -1,12 +1,15 @@
 export { SEALED_KEY_PREFIX, ENCRYPT_FOR_FIELD, sealedKeyId, isSealedKeyId, type RecipientSpec, type RecipientOptions, type RecipientChangeOptions, type EncryptForEntry, type ResolvedRecipient, type EntryRecipients, type RecipientChangeResult, } from "./sealedTypes";
 export { resolveRecipientSpecs, newestRecipientBlock, resolveRecipientsFromPayload, isPayloadEncryptedFor, } from "./recipients";
-export { USERKEY_FORM, USERKEY_TYPE, USERKEY_SCHEMA_VERSION, USERKEY_DOC_ID_PREFIX, USERKEY_PRIVATE_SALT, userKeyDocumentId, currentUserKeyEpoch, isPendingUserKeyDocument, UserKeyMismatchError, UserKeyDecryptError, USERKEY_USERNAME_HASH_VERSION, type UserKeyDeviceWrap, type UserKeyGeneration, type RejectedUserKeyDevice, type UserKeyDocumentPayload, type PendingUserKeyDevice, type UserKeyDeviceRow, type UserKeyDeviceStatus, type UserKeyEnrollmentStatus, type UserKeyWaitState, } from "./types";
+export { USERKEY_FORM, USERKEY_TYPE, USERKEY_SCHEMA_VERSION, USERKEY_DOC_ID_PREFIX, USERKEY_PRIVATE_SALT, DEVICE_SELF_GRANT_PRIVATE_SALT, userKeyDocumentId, currentUserKeyEpoch, isPendingUserKeyDocument, UserKeyMismatchError, UserKeyDecryptError, USERKEY_USERNAME_HASH_VERSION, type UserKeyDeviceWrap, type UserKeyGeneration, type UserKeyGenerationSignature, type RejectedUserKeyDevice, type UserKeyDocumentPayload, type PendingUserKeyDevice, type UserKeyDeviceRow, type UserKeyDeviceStatus, type UserKeyEnrollmentStatus, type UserKeyWaitState, } from "./types";
 export { canonicalizeUsername, usernamesEqual } from "../userid/canonicalUsername";
 export { fingerprintEncryptionPublicKey, normalizePublicKeyPem, spkiToPem, bytesToBase64, base64ToBytes, } from "./fingerprint";
 export { validateUserKeyDocument, asUserKeyPayload } from "./validateUserKeyDocument";
-export { resolveUserKeyDocument } from "./resolveUserKeyDocument";
+export { resolveUserKeyDocument, applyGenerationValidity } from "./resolveUserKeyDocument";
+export { deriveGenerationSigningKey, generateSelfGrantKeyPair, userKeyGenerationSigningMessage, signEd25519, verifyEd25519, } from "./generationSignature";
+export { filterValidGenerations, loadGenerationHistory, type GenerationValidityPolicy, } from "./generationValidity";
 export type { ResolveUserKeyDocumentInput, ResolvedUserKeyDocument } from "./resolveUserKeyDocument";
 export { buildPendingUserKeyPayload, createPendingUserKeyDocument, wrapPrivateKeyForDevice, writeDeviceWrap, fingerprintUserPublicKey, unwrapPrivateKeyFromDevice, } from "./UserKeyDocument";
 export { UserKeyManager } from "./UserKeyManager";
 export { SEALED_VALUE_VERSION, isSealedValue, readSealedValue, type SealedValue, } from "./sealedValues";
+export { DEVICE_CERT_DOC_ID_PREFIX, DEVICE_CERT_TYPE, asDeviceCertificate, deviceCertificateDocId, deviceCertificateMessage, signDeviceCertificate, verifyDeviceCertificate, type DeviceCertificatePayload, } from "./deviceCertificate";
 //# sourceMappingURL=index.d.ts.map

package/dist/core/userkeys/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACrG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,eAAe,EACf,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,qBAAqB,GAC3B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,8BAA8B,EAC9B,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,6BAA6B,EAC7B,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,SAAS,EACT,aAAa,EACb,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,+BAA+B,EAC/B,WAAW,EACX,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACrG,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,uBAAuB,EACvB,eAAe,EACf,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,KAAK,WAAW,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,yBAAyB,EACzB,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,wBAAwB,GAC9B,MAAM,qBAAqB,CAAC"}

package/dist/core/userkeys/index.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readSealedValue = exports.isSealedValue = exports.SEALED_VALUE_VERSION = exports.UserKeyManager = exports.unwrapPrivateKeyFromDevice = exports.fingerprintUserPublicKey = exports.writeDeviceWrap = exports.wrapPrivateKeyForDevice = exports.createPendingUserKeyDocument = exports.buildPendingUserKeyPayload = exports.resolveUserKeyDocument = exports.asUserKeyPayload = exports.validateUserKeyDocument = exports.base64ToBytes = exports.bytesToBase64 = exports.spkiToPem = exports.normalizePublicKeyPem = exports.fingerprintEncryptionPublicKey = exports.usernamesEqual = exports.canonicalizeUsername = exports.USERKEY_USERNAME_HASH_VERSION = exports.UserKeyDecryptError = exports.UserKeyMismatchError = exports.isPendingUserKeyDocument = exports.currentUserKeyEpoch = exports.userKeyDocumentId = exports.USERKEY_PRIVATE_SALT = exports.USERKEY_DOC_ID_PREFIX = exports.USERKEY_SCHEMA_VERSION = exports.USERKEY_TYPE = exports.USERKEY_FORM = exports.isPayloadEncryptedFor = exports.resolveRecipientsFromPayload = exports.newestRecipientBlock = exports.resolveRecipientSpecs = exports.isSealedKeyId = exports.sealedKeyId = exports.ENCRYPT_FOR_FIELD = exports.SEALED_KEY_PREFIX = void 0;
+exports.DEVICE_CERT_TYPE = exports.DEVICE_CERT_DOC_ID_PREFIX = exports.readSealedValue = exports.isSealedValue = exports.SEALED_VALUE_VERSION = exports.UserKeyManager = exports.unwrapPrivateKeyFromDevice = exports.fingerprintUserPublicKey = exports.writeDeviceWrap = exports.wrapPrivateKeyForDevice = exports.createPendingUserKeyDocument = exports.buildPendingUserKeyPayload = exports.loadGenerationHistory = exports.filterValidGenerations = exports.verifyEd25519 = exports.signEd25519 = exports.userKeyGenerationSigningMessage = exports.generateSelfGrantKeyPair = exports.deriveGenerationSigningKey = exports.applyGenerationValidity = exports.resolveUserKeyDocument = exports.asUserKeyPayload = exports.validateUserKeyDocument = exports.base64ToBytes = exports.bytesToBase64 = exports.spkiToPem = exports.normalizePublicKeyPem = exports.fingerprintEncryptionPublicKey = exports.usernamesEqual = exports.canonicalizeUsername = exports.USERKEY_USERNAME_HASH_VERSION = exports.UserKeyDecryptError = exports.UserKeyMismatchError = exports.isPendingUserKeyDocument = exports.currentUserKeyEpoch = exports.userKeyDocumentId = exports.DEVICE_SELF_GRANT_PRIVATE_SALT = exports.USERKEY_PRIVATE_SALT = exports.USERKEY_DOC_ID_PREFIX = exports.USERKEY_SCHEMA_VERSION = exports.USERKEY_TYPE = exports.USERKEY_FORM = exports.isPayloadEncryptedFor = exports.resolveRecipientsFromPayload = exports.newestRecipientBlock = exports.resolveRecipientSpecs = exports.isSealedKeyId = exports.sealedKeyId = exports.ENCRYPT_FOR_FIELD = exports.SEALED_KEY_PREFIX = void 0;
+exports.verifyDeviceCertificate = exports.signDeviceCertificate = exports.deviceCertificateMessage = exports.deviceCertificateDocId = exports.asDeviceCertificate = void 0;
 var sealedTypes_1 = require("./sealedTypes");
 Object.defineProperty(exports, "SEALED_KEY_PREFIX", { enumerable: true, get: function () { return sealedTypes_1.SEALED_KEY_PREFIX; } });
 Object.defineProperty(exports, "ENCRYPT_FOR_FIELD", { enumerable: true, get: function () { return sealedTypes_1.ENCRYPT_FOR_FIELD; } });
@@ -17,6 +18,7 @@ Object.defineProperty(exports, "USERKEY_TYPE", { enumerable: true, get: function
 Object.defineProperty(exports, "USERKEY_SCHEMA_VERSION", { enumerable: true, get: function () { return types_1.USERKEY_SCHEMA_VERSION; } });
 Object.defineProperty(exports, "USERKEY_DOC_ID_PREFIX", { enumerable: true, get: function () { return types_1.USERKEY_DOC_ID_PREFIX; } });
 Object.defineProperty(exports, "USERKEY_PRIVATE_SALT", { enumerable: true, get: function () { return types_1.USERKEY_PRIVATE_SALT; } });
+Object.defineProperty(exports, "DEVICE_SELF_GRANT_PRIVATE_SALT", { enumerable: true, get: function () { return types_1.DEVICE_SELF_GRANT_PRIVATE_SALT; } });
 Object.defineProperty(exports, "userKeyDocumentId", { enumerable: true, get: function () { return types_1.userKeyDocumentId; } });
 Object.defineProperty(exports, "currentUserKeyEpoch", { enumerable: true, get: function () { return types_1.currentUserKeyEpoch; } });
 Object.defineProperty(exports, "isPendingUserKeyDocument", { enumerable: true, get: function () { return types_1.isPendingUserKeyDocument; } });
@@ -37,6 +39,16 @@ Object.defineProperty(exports, "validateUserKeyDocument", { enumerable: true, ge
 Object.defineProperty(exports, "asUserKeyPayload", { enumerable: true, get: function () { return validateUserKeyDocument_1.asUserKeyPayload; } });
 var resolveUserKeyDocument_1 = require("./resolveUserKeyDocument");
 Object.defineProperty(exports, "resolveUserKeyDocument", { enumerable: true, get: function () { return resolveUserKeyDocument_1.resolveUserKeyDocument; } });
+Object.defineProperty(exports, "applyGenerationValidity", { enumerable: true, get: function () { return resolveUserKeyDocument_1.applyGenerationValidity; } });
+var generationSignature_1 = require("./generationSignature");
+Object.defineProperty(exports, "deriveGenerationSigningKey", { enumerable: true, get: function () { return generationSignature_1.deriveGenerationSigningKey; } });
+Object.defineProperty(exports, "generateSelfGrantKeyPair", { enumerable: true, get: function () { return generationSignature_1.generateSelfGrantKeyPair; } });
+Object.defineProperty(exports, "userKeyGenerationSigningMessage", { enumerable: true, get: function () { return generationSignature_1.userKeyGenerationSigningMessage; } });
+Object.defineProperty(exports, "signEd25519", { enumerable: true, get: function () { return generationSignature_1.signEd25519; } });
+Object.defineProperty(exports, "verifyEd25519", { enumerable: true, get: function () { return generationSignature_1.verifyEd25519; } });
+var generationValidity_1 = require("./generationValidity");
+Object.defineProperty(exports, "filterValidGenerations", { enumerable: true, get: function () { return generationValidity_1.filterValidGenerations; } });
+Object.defineProperty(exports, "loadGenerationHistory", { enumerable: true, get: function () { return generationValidity_1.loadGenerationHistory; } });
 var UserKeyDocument_1 = require("./UserKeyDocument");
 Object.defineProperty(exports, "buildPendingUserKeyPayload", { enumerable: true, get: function () { return UserKeyDocument_1.buildPendingUserKeyPayload; } });
 Object.defineProperty(exports, "createPendingUserKeyDocument", { enumerable: true, get: function () { return UserKeyDocument_1.createPendingUserKeyDocument; } });
@@ -50,4 +62,12 @@ var sealedValues_1 = require("./sealedValues");
 Object.defineProperty(exports, "SEALED_VALUE_VERSION", { enumerable: true, get: function () { return sealedValues_1.SEALED_VALUE_VERSION; } });
 Object.defineProperty(exports, "isSealedValue", { enumerable: true, get: function () { return sealedValues_1.isSealedValue; } });
 Object.defineProperty(exports, "readSealedValue", { enumerable: true, get: function () { return sealedValues_1.readSealedValue; } });
+var deviceCertificate_1 = require("./deviceCertificate");
+Object.defineProperty(exports, "DEVICE_CERT_DOC_ID_PREFIX", { enumerable: true, get: function () { return deviceCertificate_1.DEVICE_CERT_DOC_ID_PREFIX; } });
+Object.defineProperty(exports, "DEVICE_CERT_TYPE", { enumerable: true, get: function () { return deviceCertificate_1.DEVICE_CERT_TYPE; } });
+Object.defineProperty(exports, "asDeviceCertificate", { enumerable: true, get: function () { return deviceCertificate_1.asDeviceCertificate; } });
+Object.defineProperty(exports, "deviceCertificateDocId", { enumerable: true, get: function () { return deviceCertificate_1.deviceCertificateDocId; } });
+Object.defineProperty(exports, "deviceCertificateMessage", { enumerable: true, get: function () { return deviceCertificate_1.deviceCertificateMessage; } });
+Object.defineProperty(exports, "signDeviceCertificate", { enumerable: true, get: function () { return deviceCertificate_1.signDeviceCertificate; } });
+Object.defineProperty(exports, "verifyDeviceCertificate", { enumerable: true, get: function () { return deviceCertificate_1.verifyDeviceCertificate; } });
 //# sourceMappingURL=index.js.map

package/dist/core/userkeys/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/userkeys/index.ts"],"names":[],"mappings":";;;AAAA,6CAYuB;AAXrB,gHAAA,iBAAiB,OAAA;AACjB,gHAAA,iBAAiB,OAAA;AACjB,0GAAA,WAAW,OAAA;AACX,4GAAA,aAAa,OAAA;AASf,2CAKsB;AAJpB,mHAAA,qBAAqB,OAAA;AACrB,kHAAA,oBAAoB,OAAA;AACpB,0HAAA,4BAA4B,OAAA;AAC5B,mHAAA,qBAAqB,OAAA;AAEvB,iCAqBiB;AApBf,qGAAA,YAAY,OAAA;AACZ,qGAAA,YAAY,OAAA;AACZ,+GAAA,sBAAsB,OAAA;AACtB,8GAAA,qBAAqB,OAAA;AACrB,6GAAA,oBAAoB,OAAA;AACpB,0GAAA,iBAAiB,OAAA;AACjB,4GAAA,mBAAmB,OAAA;AACnB,iHAAA,wBAAwB,OAAA;AACxB,6GAAA,oBAAoB,OAAA;AACpB,4GAAA,mBAAmB,OAAA;AACnB,sHAAA,6BAA6B,OAAA;AAW/B,iEAAmF;AAA1E,yHAAA,oBAAoB,OAAA;AAAE,mHAAA,cAAc,OAAA;AAC7C,6CAMuB;AALrB,6HAAA,8BAA8B,OAAA;AAC9B,oHAAA,qBAAqB,OAAA;AACrB,wGAAA,SAAS,OAAA;AACT,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AAEf,qEAAsF;AAA7E,kIAAA,uBAAuB,OAAA;AAAE,2HAAA,gBAAgB,OAAA;AAClD,mEAAkE;AAAzD,gIAAA,sBAAsB,OAAA;AAE/B,qDAO2B;AANzB,6HAAA,0BAA0B,OAAA;AAC1B,+HAAA,4BAA4B,OAAA;AAC5B,0HAAA,uBAAuB,OAAA;AACvB,kHAAA,eAAe,OAAA;AACf,2HAAA,wBAAwB,OAAA;AACxB,6HAAA,0BAA0B,OAAA;AAE5B,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,+CAKwB;AAJtB,oHAAA,oBAAoB,OAAA;AACpB,6GAAA,aAAa,OAAA;AACb,+GAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/userkeys/index.ts"],"names":[],"mappings":";;;;AAAA,6CAYuB;AAXrB,gHAAA,iBAAiB,OAAA;AACjB,gHAAA,iBAAiB,OAAA;AACjB,0GAAA,WAAW,OAAA;AACX,4GAAA,aAAa,OAAA;AASf,2CAKsB;AAJpB,mHAAA,qBAAqB,OAAA;AACrB,kHAAA,oBAAoB,OAAA;AACpB,0HAAA,4BAA4B,OAAA;AAC5B,mHAAA,qBAAqB,OAAA;AAEvB,iCAuBiB;AAtBf,qGAAA,YAAY,OAAA;AACZ,qGAAA,YAAY,OAAA;AACZ,+GAAA,sBAAsB,OAAA;AACtB,8GAAA,qBAAqB,OAAA;AACrB,6GAAA,oBAAoB,OAAA;AACpB,uHAAA,8BAA8B,OAAA;AAC9B,0GAAA,iBAAiB,OAAA;AACjB,4GAAA,mBAAmB,OAAA;AACnB,iHAAA,wBAAwB,OAAA;AACxB,6GAAA,oBAAoB,OAAA;AACpB,4GAAA,mBAAmB,OAAA;AACnB,sHAAA,6BAA6B,OAAA;AAY/B,iEAAmF;AAA1E,yHAAA,oBAAoB,OAAA;AAAE,mHAAA,cAAc,OAAA;AAC7C,6CAMuB;AALrB,6HAAA,8BAA8B,OAAA;AAC9B,oHAAA,qBAAqB,OAAA;AACrB,wGAAA,SAAS,OAAA;AACT,4GAAA,aAAa,OAAA;AACb,4GAAA,aAAa,OAAA;AAEf,qEAAsF;AAA7E,kIAAA,uBAAuB,OAAA;AAAE,2HAAA,gBAAgB,OAAA;AAClD,mEAA2F;AAAlF,gIAAA,sBAAsB,OAAA;AAAE,iIAAA,uBAAuB,OAAA;AACxD,6DAM+B;AAL7B,iIAAA,0BAA0B,OAAA;AAC1B,+HAAA,wBAAwB,OAAA;AACxB,sIAAA,+BAA+B,OAAA;AAC/B,kHAAA,WAAW,OAAA;AACX,oHAAA,aAAa,OAAA;AAEf,2DAI8B;AAH5B,4HAAA,sBAAsB,OAAA;AACtB,2HAAA,qBAAqB,OAAA;AAIvB,qDAO2B;AANzB,6HAAA,0BAA0B,OAAA;AAC1B,+HAAA,4BAA4B,OAAA;AAC5B,0HAAA,uBAAuB,OAAA;AACvB,kHAAA,eAAe,OAAA;AACf,2HAAA,wBAAwB,OAAA;AACxB,6HAAA,0BAA0B,OAAA;AAE5B,mDAAkD;AAAzC,gHAAA,cAAc,OAAA;AACvB,+CAKwB;AAJtB,oHAAA,oBAAoB,OAAA;AACpB,6GAAA,aAAa,OAAA;AACb,+GAAA,eAAe,OAAA;AAGjB,yDAS6B;AAR3B,8HAAA,yBAAyB,OAAA;AACzB,qHAAA,gBAAgB,OAAA;AAChB,wHAAA,mBAAmB,OAAA;AACnB,2HAAA,sBAAsB,OAAA;AACtB,6HAAA,wBAAwB,OAAA;AACxB,0HAAA,qBAAqB,OAAA;AACrB,4HAAA,uBAAuB,OAAA"}

package/dist/core/userkeys/resolveUserKeyDocument.d.ts

@@ -10,7 +10,15 @@ export interface ResolveUserKeyDocumentInput {
 }
 export interface ResolvedUserKeyDocument {
     doc: MindooDoc;
+    /**
+     * The document with only the generations that count (docs/userkeys.md
+     * §9.3). Use this to decide what is current.
+     */
     payload: UserKeyDocumentPayload;
+    /** The document as stored, including generations that do not count. */
+    rawPayload: UserKeyDocumentPayload;
+    /** Epochs present in the document that do not count. */
+    rejectedEpochs: string[];
 }
 /**
  * §5.1 lookup: canonical `userkey_<grantDocId>` first, then a scan over
@@ -18,4 +26,12 @@ export interface ResolvedUserKeyDocument {
  * epoch, then lowest fingerprint (byte-deterministic).
  */
 export declare function resolveUserKeyDocument(input: ResolveUserKeyDocumentInput): Promise<ResolvedUserKeyDocument | null>;
+/**
+ * Drop generations nobody may rely on (docs/userkeys.md §9.3). Exported so
+ * callers that already hold a validated payload use the same rule.
+ */
+export declare function applyGenerationValidity(doc: MindooDoc, payload: UserKeyDocumentPayload, input: {
+    db: MindooDB;
+    directory: MindooTenantDirectory;
+}): Promise<ResolvedUserKeyDocument>;
 //# sourceMappingURL=resolveUserKeyDocument.d.ts.map

package/dist/core/userkeys/resolveUserKeyDocument.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveUserKeyDocument.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/resolveUserKeyDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAGzE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,qBAAqB,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,SAAS,CAAC;IACf,OAAO,EAAE,sBAAsB,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAiCzC"}
+{"version":3,"file":"resolveUserKeyDocument.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/resolveUserKeyDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAC3E,OAAO,EAAqB,KAAK,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAIzE,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,qBAAqB,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,SAAS,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,sBAAsB,CAAC;IAChC,uEAAuE;IACvE,UAAU,EAAE,sBAAsB,CAAC;IACnC,wDAAwD;IACxD,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,2BAA2B,GACjC,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAiCzC;AAmBD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,sBAAsB,EAC/B,KAAK,EAAE;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,SAAS,EAAE,qBAAqB,CAAA;CAAE,GACxD,OAAO,CAAC,uBAAuB,CAAC,CAsClC"}

package/dist/core/userkeys/resolveUserKeyDocument.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveUserKeyDocument = resolveUserKeyDocument;
+exports.applyGenerationValidity = applyGenerationValidity;
 const types_1 = require("./types");
 const validateUserKeyDocument_1 = require("./validateUserKeyDocument");
+const generationValidity_1 = require("./generationValidity");
 /**
  * §5.1 lookup: canonical `userkey_<grantDocId>` first, then a scan over
  * `username_hash`. Invalid squatters are ignored. Ties break by highest
@@ -60,7 +62,46 @@ async function validateLoaded(doc, input) {
     });
     if (!payload)
         return null;
-    return { doc, payload };
+    return applyGenerationValidity(doc, payload, input);
+}
+/**
+ * Drop generations nobody may rely on (docs/userkeys.md §9.3). Exported so
+ * callers that already hold a validated payload use the same rule.
+ */
+async function applyGenerationValidity(doc, payload, input) {
+    const directory = input.directory;
+    const selfGrant = typeof directory.getDeviceSelfGrantForUsernameHash === "function"
+        ? await directory.getDeviceSelfGrantForUsernameHash(payload.username_hash)
+        : null;
+    const tenantCutoff = typeof directory.getRequireUserKeyGenerationSignatureSince === "function"
+        ? await directory.getRequireUserKeyGenerationSignatureSince()
+        : undefined;
+    const cutoffs = [tenantCutoff, selfGrant?.grantedAt].filter((t) => typeof t === "number" && Number.isFinite(t));
+    const history = await (0, generationValidity_1.loadGenerationHistory)(input.db, doc.getId());
+    const filtered = await (0, generationValidity_1.filterValidGenerations)({
+        payload,
+        history,
+        crypto: input.db.getTenant().getCryptoAdapter(),
+        policy: {
+            usernameHash: payload.username_hash,
+            cutoff: cutoffs.length > 0 ? Math.min(...cutoffs) : undefined,
+            selfGrant: selfGrant
+                ? { signingPublicKey: selfGrant.signingPublicKey, revokedAt: selfGrant.revokedAt }
+                : null,
+        },
+    });
+    if (filtered.rejectedEpochs.length > 0) {
+        console.warn("[userkeys] ignoring User-Key generations that do not count", {
+            docId: doc.getId(),
+            rejectedEpochs: filtered.rejectedEpochs,
+        });
+    }
+    return {
+        doc,
+        payload: filtered.payload,
+        rawPayload: payload,
+        rejectedEpochs: filtered.rejectedEpochs,
+    };
 }
 async function creatorSigningKey(db, docId) {
     const store = db.getStore();

package/dist/core/userkeys/resolveUserKeyDocument.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveUserKeyDocument.js","sourceRoot":"","sources":["../../../src/core/userkeys/resolveUserKeyDocument.ts"],"names":[],"mappings":";;AAuBA,wDAmCC;AAzDD,mCAAyE;AACzE,uEAAoE;AAgBpE;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAC1C,KAAkC;IAElC,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,GAAG,CAAC,SAAS,EAAE;gBAAE,SAAS;YAC9B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;gBAAE,SAAS;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,CAAC,SAAS,EAAE;oBAAE,SAAS;gBAC9B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAc,EACd,KAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAA,iDAAuB,EAAC;QAC5C,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QACtB,SAAS;QACT,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,KAAa;IAC1D,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;IAC/D,OAAO,MAAM,EAAE,kBAAkB,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B,EAAE,CAA0B;IAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,OAA+B;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3B,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA+B;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC"}
+{"version":3,"file":"resolveUserKeyDocument.js","sourceRoot":"","sources":["../../../src/core/userkeys/resolveUserKeyDocument.ts"],"names":[],"mappings":";;AAgCA,wDAmCC;AAuBD,0DA0CC;AAnID,mCAAyE;AACzE,uEAAoE;AACpE,6DAAqF;AAwBrF;;;;GAIG;AACI,KAAK,UAAU,sBAAsB,CAC1C,KAAkC;IAElC,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,WAAW,GAAG,IAAA,yBAAiB,EAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YACpD,IAAI,GAAG,CAAC,SAAS,EAAE;gBAAE,SAAS;YAC9B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,QAAQ;gBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC/C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;gBAAE,SAAS;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,GAAG,CAAC,SAAS,EAAE;oBAAE,SAAS;gBAC9B,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,GAAc,EACd,KAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,OAAO,GAAG,MAAM,IAAA,iDAAuB,EAAC;QAC5C,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;QACtB,SAAS;QACT,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;KACrC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAC3C,GAAc,EACd,OAA+B,EAC/B,KAAyD;IAEzD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;IAClC,MAAM,SAAS,GACb,OAAO,SAAS,CAAC,iCAAiC,KAAK,UAAU;QAC/D,CAAC,CAAC,MAAM,SAAS,CAAC,iCAAiC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC1E,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,YAAY,GAChB,OAAO,SAAS,CAAC,yCAAyC,KAAK,UAAU;QACvE,CAAC,CAAC,MAAM,SAAS,CAAC,yCAAyC,EAAE;QAC7D,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,OAAO,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,MAAM,CACzD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,IAAA,0CAAqB,EAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,IAAA,2CAAsB,EAAC;QAC5C,OAAO;QACP,OAAO;QACP,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,gBAAgB,EAAE;QAC/C,MAAM,EAAE;YACN,YAAY,EAAE,OAAO,CAAC,aAAa;YACnC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YAC7D,SAAS,EAAE,SAAS;gBAClB,CAAC,CAAC,EAAE,gBAAgB,EAAE,SAAS,CAAC,gBAAgB,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE;gBAClF,CAAC,CAAC,IAAI;SACT;KACF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,4DAA4D,EAAE;YACzE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;YAClB,cAAc,EAAE,QAAQ,CAAC,cAAc;SACxC,CAAC,CAAC;IACL,CAAC;IACD,OAAO;QACL,GAAG;QACH,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,UAAU,EAAE,OAAO;QACnB,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,EAAY,EAAE,KAAa;IAC1D,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;IAC/D,OAAO,MAAM,EAAE,kBAAkB,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe,CAAC,CAA0B,EAAE,CAA0B;IAC7E,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,QAAQ,CAAC,OAA+B;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACpB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3B,CAAC,EAAE,EAAE,CAAC,CAAC;AACT,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA+B;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC;AACtD,CAAC"}

package/dist/core/userkeys/types.d.ts

@@ -3,6 +3,8 @@ export declare const USERKEY_TYPE = "userkey";
 export declare const USERKEY_SCHEMA_VERSION = 1;
 export declare const USERKEY_DOC_ID_PREFIX = "userkey_";
 export declare const USERKEY_PRIVATE_SALT = "userkey";
+/** PBKDF2 salt for the person's device self-grant key on {@link PrivateUserId}. */
+export declare const DEVICE_SELF_GRANT_PRIVATE_SALT = "deviceselfgrant";
 /** Matches `BaseMindooTenantDirectory.USERNAME_HASH_VERSION` (write version 3). */
 export declare const USERKEY_USERNAME_HASH_VERSION = 3;
 export type UserKeyWaitState = "approved" | "waiting" | "unknown";
@@ -31,16 +33,40 @@ export interface UserKeyEnrollmentStatus {
 export declare function userKeyDocumentId(grantDocId: string): string;
 export interface UserKeyDeviceWrap {
     wrappedKey: string;
+    /**
+     * The person's device self-grant private key (Ed25519 PKCS8), RSA-OAEP
+     * wrapped to the same device key as {@link wrappedKey}. Present when the
+     * writing device held the self-grant key (docs/userkeys.md §9).
+     */
+    wrappedSelfGrantKey?: string;
     label?: string;
     approvedAt: number;
     approvedBySigningPublicKey: string;
 }
+/**
+ * Signature over a generation's identity (docs/userkeys.md §9.3). `signerPublicKey`
+ * is either the person's device self-grant key named in their admin-signed
+ * grant, or the {@link UserKeyGeneration.signingPublicKey} of the previous
+ * accepted generation.
+ */
+export interface UserKeyGenerationSignature {
+    signerPublicKey: string;
+    /** Base64 Ed25519 signature over {@link userKeyGenerationSigningMessage}. */
+    signature: string;
+}
 export interface UserKeyGeneration {
     publicKey: string;
     fingerprint: string;
     createdAt: number;
     retiredAt?: number;
     deviceWraps: Record<string, UserKeyDeviceWrap>;
+    /**
+     * Ed25519 public key derived from this generation's private User-Key
+     * (HKDF, docs/userkeys.md §9.3). Only holders of the generation can sign
+     * with it, which is what lets them sign the next generation.
+     */
+    signingPublicKey?: string;
+    signatures?: UserKeyGenerationSignature[];
 }
 export interface RejectedUserKeyDevice {
     signingPublicKey?: string;

package/dist/core/userkeys/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/types.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,YAAY,CAAC;AACtC,eAAO,MAAM,sBAAsB,IAAI,CAAC;AACxC,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAChD,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAC9C,mFAAmF;AACnF,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAElE,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,gBAAgB,CAAC;IACxB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,YAAY,CAAC;IAC1B,IAAI,EAAE,OAAO,YAAY,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CACzD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAIlF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAIjF;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,0BAA0B;gBAErC,OAAO,SAA2E;CAIrF;AAED,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,yBAAyB;gBAEpC,OAAO,SAAiK;CAI3K"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/types.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C,eAAO,MAAM,YAAY,YAAY,CAAC;AACtC,eAAO,MAAM,sBAAsB,IAAI,CAAC;AACxC,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAChD,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAC9C,mFAAmF;AACnF,eAAO,MAAM,8BAA8B,oBAAoB,CAAC;AAChE,mFAAmF;AACnF,eAAO,MAAM,6BAA6B,IAAI,CAAC;AAE/C,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAElE,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,gBAAgB,CAAC;IACxB,oEAAoE;IACpE,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,eAAe,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC/C;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,0BAA0B,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACpC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,0BAA0B,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,OAAO,YAAY,CAAC;IAC1B,IAAI,EAAE,OAAO,YAAY,CAAC;IAC1B,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC5C,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;CACzD;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,GAAG,IAAI,CAIlF;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAIjF;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,0BAA0B;gBAErC,OAAO,SAA2E;CAIrF;AAED,qEAAqE;AACrE,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,yBAAyB;gBAEpC,OAAO,SAAiK;CAI3K"}

package/dist/core/userkeys/types.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserKeyDecryptError = exports.UserKeyMismatchError = exports.USERKEY_USERNAME_HASH_VERSION = exports.USERKEY_PRIVATE_SALT = exports.USERKEY_DOC_ID_PREFIX = exports.USERKEY_SCHEMA_VERSION = exports.USERKEY_TYPE = exports.USERKEY_FORM = void 0;
+exports.UserKeyDecryptError = exports.UserKeyMismatchError = exports.USERKEY_USERNAME_HASH_VERSION = exports.DEVICE_SELF_GRANT_PRIVATE_SALT = exports.USERKEY_PRIVATE_SALT = exports.USERKEY_DOC_ID_PREFIX = exports.USERKEY_SCHEMA_VERSION = exports.USERKEY_TYPE = exports.USERKEY_FORM = void 0;
 exports.userKeyDocumentId = userKeyDocumentId;
 exports.currentUserKeyEpoch = currentUserKeyEpoch;
 exports.isPendingUserKeyDocument = isPendingUserKeyDocument;
@@ -10,6 +10,8 @@ exports.USERKEY_TYPE = "userkey";
 exports.USERKEY_SCHEMA_VERSION = 1;
 exports.USERKEY_DOC_ID_PREFIX = "userkey_";
 exports.USERKEY_PRIVATE_SALT = "userkey";
+/** PBKDF2 salt for the person's device self-grant key on {@link PrivateUserId}. */
+exports.DEVICE_SELF_GRANT_PRIVATE_SALT = "deviceselfgrant";
 /** Matches `BaseMindooTenantDirectory.USERNAME_HASH_VERSION` (write version 3). */
 exports.USERKEY_USERNAME_HASH_VERSION = 3;
 function userKeyDocumentId(grantDocId) {

package/dist/core/userkeys/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/userkeys/types.ts"],"names":[],"mappings":";;;AAsCA,8CAKC;AAiCD,kDAIC;AAED,4DAIC;AAtFD,kDAA8D;AAEjD,QAAA,YAAY,GAAG,eAAe,CAAC;AAC/B,QAAA,YAAY,GAAG,SAAS,CAAC;AACzB,QAAA,sBAAsB,GAAG,CAAC,CAAC;AAC3B,QAAA,qBAAqB,GAAG,UAAU,CAAC;AACnC,QAAA,oBAAoB,GAAG,SAAS,CAAC;AAC9C,mFAAmF;AACtE,QAAA,6BAA6B,GAAG,CAAC,CAAC;AA8B/C,SAAgB,iBAAiB,CAAC,UAAkB;IAClD,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,OAAO,GAAG,6BAAqB,GAAG,IAAA,4BAAoB,EAAC,UAAU,CAAC,EAAE,CAAC;AACvE,CAAC;AAiCD,SAAgB,mBAAmB,CAAC,OAA+B;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,wBAAwB,CAAC,OAA+B;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IAE7C,YACE,OAAO,GAAG,wEAAwE;QAElF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAG,sBAAsB,CAAC;IAKvC,CAAC;CACF;AAPD,oDAOC;AAED,qEAAqE;AACrE,MAAa,mBAAoB,SAAQ,KAAK;IAE5C,YACE,OAAO,GAAG,8JAA8J;QAExK,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAG,qBAAqB,CAAC;IAKtC,CAAC;CACF;AAPD,kDAOC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/userkeys/types.ts"],"names":[],"mappings":";;;AAwCA,8CAKC;AA0DD,kDAIC;AAED,4DAIC;AAjHD,kDAA8D;AAEjD,QAAA,YAAY,GAAG,eAAe,CAAC;AAC/B,QAAA,YAAY,GAAG,SAAS,CAAC;AACzB,QAAA,sBAAsB,GAAG,CAAC,CAAC;AAC3B,QAAA,qBAAqB,GAAG,UAAU,CAAC;AACnC,QAAA,oBAAoB,GAAG,SAAS,CAAC;AAC9C,mFAAmF;AACtE,QAAA,8BAA8B,GAAG,iBAAiB,CAAC;AAChE,mFAAmF;AACtE,QAAA,6BAA6B,GAAG,CAAC,CAAC;AA8B/C,SAAgB,iBAAiB,CAAC,UAAkB;IAClD,0EAA0E;IAC1E,uEAAuE;IACvE,2EAA2E;IAC3E,OAAO,GAAG,6BAAqB,GAAG,IAAA,4BAAoB,EAAC,UAAU,CAAC,EAAE,CAAC;AACvE,CAAC;AA0DD,SAAgB,mBAAmB,CAAC,OAA+B;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAgB,wBAAwB,CAAC,OAA+B;IACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IAE7C,YACE,OAAO,GAAG,wEAAwE;QAElF,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAG,sBAAsB,CAAC;IAKvC,CAAC;CACF;AAPD,oDAOC;AAED,qEAAqE;AACrE,MAAa,mBAAoB,SAAQ,KAAK;IAE5C,YACE,OAAO,GAAG,8JAA8J;QAExK,KAAK,CAAC,OAAO,CAAC,CAAC;QAJR,SAAI,GAAG,qBAAqB,CAAC;IAKtC,CAAC;CACF;AAPD,kDAOC"}

package/dist/core/userkeys/validateUserKeyDocument.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateUserKeyDocument.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/validateUserKeyDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,qBAAqB,CAAC;IACjC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAoBxC;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAShF"}
+{"version":3,"file":"validateUserKeyDocument.d.ts","sourceRoot":"","sources":["../../../src/core/userkeys/validateUserKeyDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,SAAS,CAAC;AAEjB,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC;IAClB,sBAAsB,EAAE,MAAM,EAAE,CAAC;IACjC,SAAS,EAAE,qBAAqB,CAAC;IACjC,4FAA4F;IAC5F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA6BxC;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAShF"}

package/dist/core/userkeys/validateUserKeyDocument.js

@@ -17,6 +17,13 @@ async function validateUserKeyDocument(input) {
     if (input.adminPublicKey && input.signerKey === input.adminPublicKey) {
         return payload;
     }
+    // A delegated admin (docs/accesscontrol.md §6.13) may create pending
+    // documents as well, while its window covers the create's time.
+    if (input.adminPublicKey &&
+        typeof input.directory.isAdminAt === "function" &&
+        (await input.directory.isAdminAt(input.signerKey, input.trustedTime ?? Number.MAX_SAFE_INTEGER))) {
+        return payload;
+    }
     if (typeof input.directory.resolveUsernameHashForSigningKey !== "function") {
         return null;
     }

package/dist/core/userkeys/validateUserKeyDocument.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateUserKeyDocument.js","sourceRoot":"","sources":["../../../src/core/userkeys/validateUserKeyDocument.ts"],"names":[],"mappings":";;AAsBA,0DAsBC;AAED,4CASC;AAtDD,mCAIiB;AAajB;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAA2B;IAE3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,gCAAgC,KAAK,UAAU,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,gCAAgC,CACvE,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,CAC7C,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,OAAkC,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAY,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAY;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,IAAyC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"validateUserKeyDocument.js","sourceRoot":"","sources":["../../../src/core/userkeys/validateUserKeyDocument.ts"],"names":[],"mappings":";;AAsBA,0DA+BC;AAED,4CASC;AA/DD,mCAIiB;AAajB;;;GAGG;AACI,KAAK,UAAU,uBAAuB,CAC3C,KAA2B;IAE3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QACrE,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,qEAAqE;IACrE,gEAAgE;IAChE,IACE,KAAK,CAAC,cAAc;QACpB,OAAO,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,UAAU;QAC/C,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,EAChG,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,gCAAgC,KAAK,UAAU,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,gCAAgC,CACvE,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,gBAAgB,CAC7C,CAAC;IACF,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,IAAI,GAAG,OAAkC,CAAC;IAChD,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAY,IAAI,IAAI,CAAC,IAAI,KAAK,oBAAY;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,IAAyC,CAAC;AACnD,CAAC"}

package/dist/node/server/MindooDBServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MindooDBServer.d.ts","sourceRoot":"","sources":["../../../src/node/server/MindooDBServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,OAAoD,MAAM,SAAS,CAAC;AAS3E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAMlE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAQtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA+BvD;;;;;GAKG;AACH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,WAAW,CAAC,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,aAAa,EAAE,MAAM,CAAA;aAAE,CAAC;YAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,0FAA0F;YAC1F,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC5B,yFAAyF;YACzF,aAAa,CAAC,EAAE,MAAM,CAAC;SACxB;KACF;CACF;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAsB;IACjC,0EAA0E;IAC1E,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,eAAe,CAAyB;IAChD,kEAAkE;IAClE,OAAO,CAAC,OAAO,CAAiB;IAChC,2CAA2C;IAC3C,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IAEzD;;;;;;;;OAQG;gBAED,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,YAAY,EACrB,UAAU,CAAC,EAAE,MAAM;IAuHrB,MAAM,IAAI,OAAO,CAAC,WAAW;IAI7B,gBAAgB,IAAI,aAAa;IAIjC,kBAAkB,IAAI,sBAAsB;IAI5C,iBAAiB,IAAI,cAAc;IAInC;;;;;;;OAOG;IACH,YAAY,IAAI,IAAI;IAId,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC,eAAe,IAAI,YAAY;IAI/B,aAAa,IAAI,MAAM;IAIvB;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI;IAM3C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,IAAI;IAS5C;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAiBhE,aAAa;IAIb,eAAe;IAIT,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B,yBAAyB,IAAI,MAAM;IAI7B,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAyDzC,oEAAoE;IACpE,OAAO,CAAC,eAAe;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA4CvB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAyB9B,qFAAqF;IACrF,OAAO,CAAC,sBAAsB;IAe9B;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IA0HnB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA8DzB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA6D1B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAYhC,2FAA2F;IAC3F,OAAO,CAAC,sBAAsB;IAI9B;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IA+BhC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA2B3B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IA0B3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;;;;;;;OASG;IACH,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;YACW,gBAAgB;IAS9B,OAAO,CAAC,mBAAmB;IAkC3B;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAyCrB"}
+{"version":3,"file":"MindooDBServer.d.ts","sourceRoot":"","sources":["../../../src/node/server/MindooDBServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,OAAoD,MAAM,SAAS,CAAC;AAS3E,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAMlE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAQtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAgCvD;;;;;GAKG;AACH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,WAAW,CAAC,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,aAAa,EAAE,MAAM,CAAA;aAAE,CAAC;YAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,0FAA0F;YAC1F,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC5B,yFAAyF;YACzF,aAAa,CAAC,EAAE,MAAM,CAAC;SACxB;KACF;CACF;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAsB;IACjC,0EAA0E;IAC1E,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,eAAe,CAAyB;IAChD,kEAAkE;IAClE,OAAO,CAAC,OAAO,CAAiB;IAChC,2CAA2C;IAC3C,OAAO,CAAC,IAAI,CAAqB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA4B;IAEzD;;;;;;;;OAQG;gBAED,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,YAAY,EACrB,UAAU,CAAC,EAAE,MAAM;IAwHrB,MAAM,IAAI,OAAO,CAAC,WAAW;IAI7B,gBAAgB,IAAI,aAAa;IAIjC,kBAAkB,IAAI,sBAAsB;IAI5C,iBAAiB,IAAI,cAAc;IAInC;;;;;;;OAOG;IACH,YAAY,IAAI,IAAI;IAId,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlC,eAAe,IAAI,YAAY;IAI/B,aAAa,IAAI,MAAM;IAIvB;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI;IAM3C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAY,GAAG,IAAI;IAS5C;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAiBhE,aAAa;IAIb,eAAe;IAIT,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAI/B,yBAAyB,IAAI,MAAM;IAI7B,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAyDzC,oEAAoE;IACpE,OAAO,CAAC,eAAe;IAIvB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA4CvB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAyB9B,qFAAqF;IACrF,OAAO,CAAC,sBAAsB;IAe9B;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IA0HnB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IA8DzB;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IA6D1B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAYhC,2FAA2F;IAC3F,OAAO,CAAC,sBAAsB;IAI9B;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IA+BhC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA2B3B;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IA0B3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;;;;;;;OASG;IACH,OAAO,CAAC,uBAAuB;IAU/B;;;;OAIG;YACW,gBAAgB;IAS9B,OAAO,CAAC,mBAAmB;IA6C3B;;;;OAIG;IACH,OAAO,CAAC,YAAY;CAyCrB"}