mindoodb 0.0.94 → 0.0.96

package/dist/core/accesscontrol/DirectoryStateNode.js.map

@@ -1 +1 @@
-{"version":3,"file":"DirectoryStateNode.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/DirectoryStateNode.ts"],"names":[],"mappings":";;;AA4EA,8CAYC;AAOD,oCAMC;AAoBD,oCAiBC;AAOD,0CAWC;AAiBD,4CAKC;AAGD,gDAUC;AApHD,iEAAiE;AACjE,SAAgB,iBAAiB;IAC/B,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,iBAAiB;QAC/C,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,kBAAkB,EAAE,IAAI,GAAG,EAAE;QAC7B,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAwB,EAAE,CAAS;IAC9D,IAAI,IAAI,GAA8B,IAAI,CAAC;IAC3C,OAAO,IAAI,IAAI,IAAI,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,iBAAiB,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,YAAY,CAC1B,WAA+B,EAC/B,UAA8B,EAC9B,iBAAyB,EACzB,gBAAwB;IAExB,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACrE,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,YAAY,KAAK,WAAW,CAAC,YAAY,CAAC;IAChE,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,WAAW;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,iBAAiB,KAAK,gBAAgB,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,IAAwB,EACxB,UAAkB;IAElB,IAAI,OAAO,GAA8B,IAAI,CAAC;IAC9C,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CACxB,WAA2C;IAE3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,uFAAuF;AACvF,SAAgB,gBAAgB,CAAC,CAAS,EAAE,CAAS;IACnD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,SAAgB,kBAAkB,CAChC,IAAwB,EACxB,UAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA2BD;;;;;;;;GAQG;AACH,MAAa,0BAA0B;IAAvC;QACU,SAAI,GAAuB,iBAAiB,EAAE,CAAC;QAEvD;;;WAGG;QACK,aAAQ,GAA6B,EAAE,CAAC;QAEhD;;;;;WAKG;QACK,uBAAkB,GAAG,IAAI,GAAG,EAAoD,CAAC;QAEzF;;;;;WAKG;QACK,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;IAuUpE,CAAC;IArUC,qCAAqC;IACrC,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,CAAS;QAClB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,gEAAgE;IAChE,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAgC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;gBACb,KAAK,eAAe;oBAClB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvC,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,MAAM;oBACT,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM;gBACR,KAAK,YAAY;oBACf,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,MAAM;gBACR,KAAK,sBAAsB;oBACzB,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnD,MAAM;gBACR,KAAK,OAAO;oBACV,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM;gBACR,KAAK,oBAAoB;oBACvB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM;gBACR,KAAK,WAAW;oBACd,IAAI,CAAC,SAAS,CACZ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EACzC,CAAC,CAAC,CAAC,CACJ,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,IAAI,CAAC,WAAmB,EAAE,MAA0C;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAuB;YAC/B,qBAAqB,EAAE,KAAK;YAC5B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;YACtC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAAC,MAA8B,EAAE,WAAmB;QACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,aAAa,CAAC,IAAY,EAAE,MAA8B,EAAE,WAAmB;QAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,SAAS,CAAC,IAAgB,EAAE,WAAmB;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,UAAU,CAAC,MAAc,EAAE,QAAkB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,mBAAmB,CAAC,OAA0B,EAAE,WAAmB;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,oBAAoB,CAAC,gBAAwB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,KAAwB,EAAE,WAAmB;QACtD,IAAI,CAAC,aAAa,CAAC,SAAS,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,KAAa,EAAE,KAAwB,EAAE,WAAmB;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,YAAoB,EAAE,WAAmB;QAC7D,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,YAAY,KAAK,YAAY;gBAAE,SAAS;YACzD,eAAe,GAAG,IAAI,CAAC;YACvB,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;gBACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAClC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;gBAC5D,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE;oBACjC,YAAY;oBACZ,WAAW;oBACX,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACrE,wBAAwB,EAAE,CAAC,GAAG,aAAa,CAAC;oBAC5C,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;iBAC/B,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;QACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,WAAW,GAAsB,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACX,KAAa,EACb,IAAY,EACZ,YAAsB,EACtB,WAAmB;QAEnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,IAAY,EAAE,WAAmB;QACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YACzC,eAAe,GAAG,IAAI,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;gBAC7C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAkC,EAAE,WAAmB;QAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,EAAE,EAAE,WAAW;YACf,CAAC,EAAE,WAAW;YACd,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SAC/F,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA9VD,gEA8VC"}
+{"version":3,"file":"DirectoryStateNode.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/DirectoryStateNode.ts"],"names":[],"mappings":";;;AAiGA,8CAaC;AAMD,sDAKC;AAQD,sCASC;AAOD,oCAMC;AAoBD,oCAiBC;AAOD,0CAWC;AAiBD,4CAKC;AAGD,gDAUC;AA3OD,2CAIqB;AAsFrB,iEAAiE;AACjE,SAAgB,iBAAiB;IAC/B,OAAO;QACL,qBAAqB,EAAE,MAAM,CAAC,iBAAiB;QAC/C,aAAa,EAAE,IAAI;QACnB,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,YAAY,EAAE,IAAI,GAAG,EAAE;QACvB,kBAAkB,EAAE,IAAI,GAAG,EAAE;QAC7B,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,IAAwB,EACxB,UAAkB;IAElB,OAAO,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAA,+BAAmB,EAAC,UAAU,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAC3B,IAAwB,EACxB,YAAoB,EACpB,UAAkB,EAClB,CAAS;IAET,IAAI,gBAAgB,CAAC,UAAU,EAAE,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzD,OAAO,CAAC,CAAC,QAAQ,IAAI,IAAA,qCAAyB,EAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,IAAwB,EAAE,CAAS;IAC9D,IAAI,IAAI,GAA8B,IAAI,CAAC;IAC3C,OAAO,IAAI,IAAI,IAAI,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,IAAI,iBAAiB,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,YAAY,CAC1B,WAA+B,EAC/B,UAA8B,EAC9B,iBAAyB,EACzB,gBAAwB;IAExB,MAAM,YAAY,GAAG,eAAe,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,kBAAkB,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IACrE,IAAI,YAAY,IAAI,WAAW,EAAE,CAAC;QAChC,OAAO,YAAY,CAAC,YAAY,KAAK,WAAW,CAAC,YAAY,CAAC;IAChE,CAAC;IACD,yEAAyE;IACzE,0EAA0E;IAC1E,+CAA+C;IAC/C,IAAI,WAAW;QAAE,OAAO,KAAK,CAAC;IAC9B,IAAI,YAAY;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,iBAAiB,KAAK,gBAAgB,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAC7B,IAAwB,EACxB,UAAkB;IAElB,IAAI,OAAO,GAA8B,IAAI,CAAC;IAC9C,OAAO,OAAO,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CACxB,WAA2C;IAE3C,MAAM,YAAY,GAAG,IAAI,GAAG,EAA6B,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,SAAS;QAC5B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACpC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,uFAAuF;AACvF,SAAgB,gBAAgB,CAAC,CAAS,EAAE,CAAS;IACnD,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,KAAK,CAAC;AAC3C,CAAC;AAED,+FAA+F;AAC/F,SAAgB,kBAAkB,CAChC,IAAwB,EACxB,UAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7C,IAAI,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AA6BD;;;;;;;;GAQG;AACH,MAAa,0BAA0B;IAAvC;QACU,SAAI,GAAuB,iBAAiB,EAAE,CAAC;QAEvD;;;WAGG;QACK,aAAQ,GAA6B,EAAE,CAAC;QAEhD;;;;;WAKG;QACK,uBAAkB,GAAG,IAAI,GAAG,EAAoD,CAAC;QAEzF;;;;;WAKG;QACK,uBAAkB,GAAG,IAAI,GAAG,EAA6B,CAAC;IA6WpE,CAAC;IA3WC,qCAAqC;IACrC,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,0CAA0C;IAC1C,UAAU,CAAC,CAAS;QAClB,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,gEAAgE;IAChE,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,iBAAiB,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,cAAc,CAAC,MAAgC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC;gBACb,KAAK,eAAe;oBAClB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvC,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,MAAM;oBACT,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5B,MAAM;gBACR,KAAK,YAAY;oBACf,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzC,MAAM;gBACR,KAAK,sBAAsB;oBACzB,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACnD,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACpC,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC7C,MAAM;gBACR,KAAK,OAAO;oBACV,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9B,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC1C,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM;gBACR,KAAK,oBAAoB;oBACvB,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC3C,MAAM;gBACR,KAAK,UAAU;oBACb,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBACzD,MAAM;gBACR,KAAK,gBAAgB;oBACnB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,MAAM;gBACR,KAAK,WAAW;oBACd,IAAI,CAAC,SAAS,CACZ,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EACzC,CAAC,CAAC,CAAC,CACJ,CAAC;oBACF,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,IAAI,CAAC,WAAmB,EAAE,MAA0C;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAuB;YAC/B,qBAAqB,EAAE,KAAK;YAC5B,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;YACtC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;YAChC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAChD,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE;YAC3C,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,gDAAgD;IAChD,kBAAkB,CAAC,MAA8B,EAAE,WAAmB;QACpE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC9B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,aAAa,CAAC,IAAY,EAAE,MAA8B,EAAE,WAAmB;QAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,SAAS,CAAC,IAAgB,EAAE,WAAmB;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;YAClE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,UAAU,CAAC,MAAc,EAAE,QAAkB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,WAAW,CAAC,GAAG,CAClB,QAAQ,EACR,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,mBAAmB,CAAC,OAA0B,EAAE,WAAmB;QACjE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6DAA6D;IAC7D,oBAAoB,CAAC,gBAAwB,EAAE,WAAmB;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,sBAAsB,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,kBAAkB,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,aAAa,CAAC,QAA0B,EAAE,WAAmB;QAC3D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAA,+BAAmB,EAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,cAAc,CAAC,gBAAwB,EAAE,WAAmB;QAC1D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAA,+BAAmB,EAAC,gBAAgB,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,UAAU,CAAC,KAAwB,EAAE,WAAmB;QACtD,IAAI,CAAC,aAAa,CAAC,SAAS,KAAK,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,KAAa,EAAE,KAAwB,EAAE,WAAmB;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC1C,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,YAAoB,EAAE,WAAmB;QAC7D,0EAA0E;QAC1E,4EAA4E;QAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,IAAI,eAAqD,CAAC;QAC1D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;QACtC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,YAAY,KAAK,YAAY;gBAAE,SAAS;YACzD,eAAe,GAAG,IAAI,CAAC;YACvB,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE;gBACrD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;oBAClC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,wBAAwB,EAAE,CAAC;gBAC5D,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,kBAAkB,IAAI,EAAE;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9E,IACE,YAAY,CAAC,eAAe;gBAC5B,CAAC,CAAC,eAAe,IAAI,YAAY,CAAC,eAAe,CAAC,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,EACxF,CAAC;gBACD,eAAe,GAAG,YAAY,CAAC,eAAe,CAAC;YACjD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,WAAW,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC7C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE;oBACjC,YAAY;oBACZ,WAAW;oBACX,cAAc,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBACrE,wBAAwB,EAAE,CAAC,GAAG,aAAa,CAAC;oBAC5C,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC;oBAC9B,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/C,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC;wBACtB,CAAC,CAAC,EAAE,kBAAkB,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE;wBAClF,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,UAAkB,EAAE,WAAmB;QACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,WAAW,GAAsB,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;YACnE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC5D,IAAI,CAAC,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACX,KAAa,EACb,IAAY,EACZ,YAAsB,EACtB,WAAmB;QAEnB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACzC,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,KAAa,EAAE,WAAmB;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,IAAY,EAAE,WAAmB;QACtD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;QACvC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,KAAK,MAAM,YAAY,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5D,IAAI,YAAY,CAAC,IAAI,KAAK,IAAI;gBAAE,SAAS;YACzC,eAAe,GAAG,IAAI,CAAC;YACvB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;gBAC7C,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACpD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CAAC,MAAkC,EAAE,WAAmB;QAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACjB,EAAE,EAAE,WAAW;YACf,CAAC,EAAE,WAAW;YACd,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;SAC/F,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AApYD,gEAoYC"}

package/dist/core/accesscontrol/adminKeys.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Delegated administrators (docs/accesscontrol.md §6.13).
+ *
+ * The tenant's `administrationPublicKey` is the **root** admin key and stays the
+ * only fixed trust anchor. The root may delegate administration to further
+ * signing keys by writing one `acl_adminkey_<fingerprint>` document per key into
+ * the `directory` database. Each document carries a validity window in witness
+ * time (`validFrom`, `validUntil`), so a key can be deactivated as of a date
+ * without rewriting what it signed before.
+ *
+ * `isAdminAt(key, T)` is true when `key` is the root, or when the directory
+ * state at `T` holds an admin-key document for `key` with
+ * `validFrom ≤ T < validUntil`. `T` is the witness time (`receivedAt`) of a
+ * stored entry, or the server's clock for live decisions (auth, read gate,
+ * push check).
+ *
+ * Rules that keep witness time honest:
+ * - Only the root may write `acl_adminkey_*` (and `acl_trustedwitness_*`, which
+ *   decides whose receipts count). Enforced on the client and on the server.
+ * - A delegated admin's directory entries count on other replicas only with a
+ *   valid receipt of a trusted witness. Without one they are visible on the
+ *   device that wrote them only.
+ * - No retroactive effect: a window never starts or ends before the witness
+ *   time of the revision that set it (see {@link adminKeyWindowFromDoc}).
+ */
+import { ACCESS_CONTROL_FORM } from "./types";
+/** `type` of an admin-key document (form {@link ACCESS_CONTROL_FORM}). */
+export declare const ADMIN_KEY_TYPE = "adminkey";
+/** Document-id prefix of admin-key documents in `directory`. */
+export declare const ACL_ADMIN_KEY_PREFIX = "acl_adminkey_";
+/** Document-id prefix of trusted-witness documents in `directory` (§6.4). */
+export declare const ACL_TRUSTED_WITNESS_DOC_PREFIX = "acl_trustedwitness_";
+/**
+ * Directory documents only the root admin key may write. Admin keys decide who
+ * is an admin, trusted witnesses decide whose clock counts — a delegated admin
+ * writing either could make itself permanent or backdate its own entries.
+ */
+export declare const ROOT_ONLY_DIRECTORY_DOC_PREFIXES: readonly string[];
+/** Whether only the root admin key may write `docId` in `directory`. */
+export declare function isRootOnlyDirectoryDocId(docId: string | undefined | null): boolean;
+/** An admin-key document as stored in `directory` (encrypted under `$publicinfos`). */
+export interface AdminKeyDoc {
+    form: typeof ACCESS_CONTROL_FORM;
+    type: typeof ADMIN_KEY_TYPE;
+    /** Ed25519 public key of the admin device, PEM. */
+    signingPublicKey: string;
+    /** RSA-OAEP public key of the admin device, PEM. */
+    encryptionPublicKey: string;
+    /** The admin's name, field-encrypted under `default` (as in `tenantsetup`). */
+    name_encrypted?: string;
+    /** Key id of `name_encrypted`; always `"default"`. */
+    name_encrypted_key?: string;
+    /** Device label, e.g. "Laptop". */
+    label?: string;
+    /** Witness time (ms) the key becomes an admin; absent: this revision's witness time. */
+    validFrom?: number;
+    /** Witness time (ms) the key stops being an admin; absent: no end. */
+    validUntil?: number;
+}
+/** One admin key as projected into a directory-state node. */
+export interface AdminKeySnapshot {
+    signingPublicKey: string;
+    encryptionPublicKey: string;
+    label?: string;
+    /** Effective start (ms, inclusive). */
+    validFrom: number;
+    /** Effective end (ms, exclusive); undefined: no end. */
+    validUntil?: number;
+    /** Trusted (witness) time of the document revision this snapshot came from. */
+    revisionTime: number;
+}
+/** PEM with all whitespace removed, the form keys are compared and hashed in. */
+export declare function normalizeSigningKey(pem: string): string;
+/** Hex SHA-256 of the whitespace-free PEM: the fingerprint in the document id. */
+export declare function adminKeyFingerprint(pem: string, subtle: SubtleCrypto): Promise<string>;
+/** Document id of the admin-key document for a fingerprint. */
+export declare function aclAdminKeyDocId(fingerprint: string): string;
+/** Document id of the admin-key document for a signing key. */
+export declare function aclAdminKeyDocIdForKey(pem: string, subtle: SubtleCrypto): Promise<string>;
+/**
+ * The effective window of one admin-key document revision whose witness time is
+ * `revisionTime`. Neither end may lie before `revisionTime`: a deactivation
+ * dated in the past ends the key at the deactivation's own witness time, and
+ * an activation dated in the past starts it there. Already accepted entries
+ * therefore never flip from allowed to denied (§4), and entries refused in a
+ * gap never become allowed later.
+ *
+ * `previous` is the key's snapshot before this revision. A revision that finds
+ * the key active continues its window (a deactivation keeps the original
+ * start); one that finds it ended or absent opens a new window at
+ * `revisionTime` (a reactivation), unless it names a later `validFrom`.
+ *
+ * Returns null when the document is not a usable admin-key document.
+ */
+export declare function adminKeyWindowFromDoc(data: Record<string, unknown>, revisionTime: number, previous?: AdminKeySnapshot | null): AdminKeySnapshot | null;
+/** Whether `snapshot` makes its key an admin at time `T`. */
+export declare function isAdminKeySnapshotValidAt(snapshot: AdminKeySnapshot, T: number): boolean;
+/** Display status of an admin key at time `now`. */
+export type AdminKeyStatus = "active" | "ending" | "ended" | "scheduled";
+export declare function adminKeyStatusAt(snapshot: AdminKeySnapshot, now: number): AdminKeyStatus;
+/** One document revision, in the shape the store-level registry replays. */
+export interface AdminKeyRevision {
+    /** Trusted (witness) time of the revision. */
+    trustedTime: number;
+    /** The document's data after this revision, or null once deleted. */
+    data: Record<string, unknown> | null;
+}
+/**
+ * The admin-key snapshot in effect at `T` from a list of revisions of ONE
+ * admin-key document: the latest revision whose trusted time is ≤ `T`
+ * decides. Ties are broken by list order (later wins).
+ */
+export declare function adminKeySnapshotAt(revisions: readonly AdminKeyRevision[], T: number): AdminKeySnapshot | null;
+/** A decision time for "now" given a head selector (`Number.MAX_SAFE_INTEGER`). */
+export declare function adminDecisionTime(T: number, now?: number): number;
+/** A delegated admin key as listed for admin UIs. */
+export interface AdminKeyInfo extends AdminKeySnapshot {
+    /** The admin's name, when this replica holds the tenant `default` key. */
+    name?: string;
+    /** Status at the time the list was taken. */
+    status: AdminKeyStatus;
+    /** Whether the key is an admin at the time the list was taken. */
+    active: boolean;
+    /**
+     * The latest root revision of the key's document carries no witness receipt
+     * yet, so other replicas do not see the change until a trusted witness stamps it.
+     */
+    pending: boolean;
+}
+//# sourceMappingURL=adminKeys.d.ts.map

package/dist/core/accesscontrol/adminKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminKeys.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/adminKeys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,mBAAmB,EAAwB,MAAM,SAAS,CAAC;AAGpE,0EAA0E;AAC1E,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC,gEAAgE;AAChE,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,8BAA8B,wBAAwB,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,SAAS,MAAM,EAG7D,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAGlF;AAED,uFAAuF;AACvF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,mBAAmB,CAAC;IACjC,IAAI,EAAE,OAAO,cAAc,CAAC;IAC5B,mDAAmD;IACnD,gBAAgB,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8DAA8D;AAC9D,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,kFAAkF;AAClF,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAK5F;AAED,+DAA+D;AAC/D,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,+DAA+D;AAC/D,wBAAsB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAE/F;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,YAAY,EAAE,MAAM,EACpB,QAAQ,GAAE,gBAAgB,GAAG,IAAW,GACvC,gBAAgB,GAAG,IAAI,CAyBzB;AAED,6DAA6D;AAC7D,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAIxF;AAED,oDAAoD;AACpD,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAC;AAEzE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAMxF;AAED,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACtC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,gBAAgB,EAAE,EACtC,CAAC,EAAE,MAAM,GACR,gBAAgB,GAAG,IAAI,CAUzB;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,MAAM,CAE7E;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAa,SAAQ,gBAAgB;IACpD,0EAA0E;IAC1E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,MAAM,EAAE,cAAc,CAAC;IACvB,kEAAkE;IAClE,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB"}

package/dist/core/accesscontrol/adminKeys.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROOT_ONLY_DIRECTORY_DOC_PREFIXES = exports.ACL_TRUSTED_WITNESS_DOC_PREFIX = exports.ACL_ADMIN_KEY_PREFIX = exports.ADMIN_KEY_TYPE = void 0;
+exports.isRootOnlyDirectoryDocId = isRootOnlyDirectoryDocId;
+exports.normalizeSigningKey = normalizeSigningKey;
+exports.adminKeyFingerprint = adminKeyFingerprint;
+exports.aclAdminKeyDocId = aclAdminKeyDocId;
+exports.aclAdminKeyDocIdForKey = aclAdminKeyDocIdForKey;
+exports.adminKeyWindowFromDoc = adminKeyWindowFromDoc;
+exports.isAdminKeySnapshotValidAt = isAdminKeySnapshotValidAt;
+exports.adminKeyStatusAt = adminKeyStatusAt;
+exports.adminKeySnapshotAt = adminKeySnapshotAt;
+exports.adminDecisionTime = adminDecisionTime;
+/**
+ * Delegated administrators (docs/accesscontrol.md §6.13).
+ *
+ * The tenant's `administrationPublicKey` is the **root** admin key and stays the
+ * only fixed trust anchor. The root may delegate administration to further
+ * signing keys by writing one `acl_adminkey_<fingerprint>` document per key into
+ * the `directory` database. Each document carries a validity window in witness
+ * time (`validFrom`, `validUntil`), so a key can be deactivated as of a date
+ * without rewriting what it signed before.
+ *
+ * `isAdminAt(key, T)` is true when `key` is the root, or when the directory
+ * state at `T` holds an admin-key document for `key` with
+ * `validFrom ≤ T < validUntil`. `T` is the witness time (`receivedAt`) of a
+ * stored entry, or the server's clock for live decisions (auth, read gate,
+ * push check).
+ *
+ * Rules that keep witness time honest:
+ * - Only the root may write `acl_adminkey_*` (and `acl_trustedwitness_*`, which
+ *   decides whose receipts count). Enforced on the client and on the server.
+ * - A delegated admin's directory entries count on other replicas only with a
+ *   valid receipt of a trusted witness. Without one they are visible on the
+ *   device that wrote them only.
+ * - No retroactive effect: a window never starts or ends before the witness
+ *   time of the revision that set it (see {@link adminKeyWindowFromDoc}).
+ */
+const types_1 = require("./types");
+const types_2 = require("../types");
+/** `type` of an admin-key document (form {@link ACCESS_CONTROL_FORM}). */
+exports.ADMIN_KEY_TYPE = "adminkey";
+/** Document-id prefix of admin-key documents in `directory`. */
+exports.ACL_ADMIN_KEY_PREFIX = "acl_adminkey_";
+/** Document-id prefix of trusted-witness documents in `directory` (§6.4). */
+exports.ACL_TRUSTED_WITNESS_DOC_PREFIX = "acl_trustedwitness_";
+/**
+ * Directory documents only the root admin key may write. Admin keys decide who
+ * is an admin, trusted witnesses decide whose clock counts — a delegated admin
+ * writing either could make itself permanent or backdate its own entries.
+ */
+exports.ROOT_ONLY_DIRECTORY_DOC_PREFIXES = [
+    exports.ACL_ADMIN_KEY_PREFIX,
+    exports.ACL_TRUSTED_WITNESS_DOC_PREFIX,
+];
+/** Whether only the root admin key may write `docId` in `directory`. */
+function isRootOnlyDirectoryDocId(docId) {
+    if (!docId)
+        return false;
+    return exports.ROOT_ONLY_DIRECTORY_DOC_PREFIXES.some((prefix) => docId.startsWith(prefix));
+}
+/** PEM with all whitespace removed, the form keys are compared and hashed in. */
+function normalizeSigningKey(pem) {
+    return pem.replace(/\s+/g, "");
+}
+/** Hex SHA-256 of the whitespace-free PEM: the fingerprint in the document id. */
+async function adminKeyFingerprint(pem, subtle) {
+    const digest = await subtle.digest("SHA-256", new TextEncoder().encode(normalizeSigningKey(pem)));
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+/** Document id of the admin-key document for a fingerprint. */
+function aclAdminKeyDocId(fingerprint) {
+    const id = exports.ACL_ADMIN_KEY_PREFIX + (0, types_1.encodeAclIdComponent)(fingerprint);
+    if (!types_2.CUSTOM_DOC_ID_REGEX.test(id)) {
+        throw new Error(`Internal error: computed admin-key document id "${id}" is not a valid document id`);
+    }
+    return id;
+}
+/** Document id of the admin-key document for a signing key. */
+async function aclAdminKeyDocIdForKey(pem, subtle) {
+    return aclAdminKeyDocId(await adminKeyFingerprint(pem, subtle));
+}
+function finiteNumber(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+/**
+ * The effective window of one admin-key document revision whose witness time is
+ * `revisionTime`. Neither end may lie before `revisionTime`: a deactivation
+ * dated in the past ends the key at the deactivation's own witness time, and
+ * an activation dated in the past starts it there. Already accepted entries
+ * therefore never flip from allowed to denied (§4), and entries refused in a
+ * gap never become allowed later.
+ *
+ * `previous` is the key's snapshot before this revision. A revision that finds
+ * the key active continues its window (a deactivation keeps the original
+ * start); one that finds it ended or absent opens a new window at
+ * `revisionTime` (a reactivation), unless it names a later `validFrom`.
+ *
+ * Returns null when the document is not a usable admin-key document.
+ */
+function adminKeyWindowFromDoc(data, revisionTime, previous = null) {
+    if (data.form !== types_1.ACCESS_CONTROL_FORM || data.type !== exports.ADMIN_KEY_TYPE)
+        return null;
+    if (typeof data.signingPublicKey !== "string" || data.signingPublicKey.trim().length === 0) {
+        return null;
+    }
+    const requestedFrom = finiteNumber(data.validFrom);
+    const requestedUntil = finiteNumber(data.validUntil);
+    const continuing = previous !== null &&
+        normalizeSigningKey(previous.signingPublicKey) === normalizeSigningKey(data.signingPublicKey) &&
+        isAdminKeySnapshotValidAt(previous, revisionTime);
+    let validFrom = Math.max(requestedFrom ?? revisionTime, revisionTime);
+    if (continuing && (requestedFrom === undefined || requestedFrom <= revisionTime)) {
+        validFrom = previous.validFrom;
+    }
+    const validUntil = requestedUntil === undefined ? undefined : Math.max(requestedUntil, revisionTime);
+    return {
+        signingPublicKey: data.signingPublicKey,
+        encryptionPublicKey: typeof data.encryptionPublicKey === "string" ? data.encryptionPublicKey : "",
+        ...(typeof data.label === "string" && data.label.trim() ? { label: data.label.trim() } : {}),
+        validFrom,
+        ...(validUntil !== undefined ? { validUntil } : {}),
+        revisionTime,
+    };
+}
+/** Whether `snapshot` makes its key an admin at time `T`. */
+function isAdminKeySnapshotValidAt(snapshot, T) {
+    if (T < snapshot.validFrom)
+        return false;
+    if (snapshot.validUntil !== undefined && T >= snapshot.validUntil)
+        return false;
+    return true;
+}
+function adminKeyStatusAt(snapshot, now) {
+    if (now < snapshot.validFrom)
+        return "scheduled";
+    if (snapshot.validUntil !== undefined) {
+        return now >= snapshot.validUntil ? "ended" : "ending";
+    }
+    return "active";
+}
+/**
+ * The admin-key snapshot in effect at `T` from a list of revisions of ONE
+ * admin-key document: the latest revision whose trusted time is ≤ `T`
+ * decides. Ties are broken by list order (later wins).
+ */
+function adminKeySnapshotAt(revisions, T) {
+    const ordered = revisions
+        .map((revision, index) => ({ revision, index }))
+        .filter(({ revision }) => revision.trustedTime <= T)
+        .sort((a, b) => a.revision.trustedTime - b.revision.trustedTime || a.index - b.index);
+    let snapshot = null;
+    for (const { revision } of ordered) {
+        snapshot = revision.data ? adminKeyWindowFromDoc(revision.data, revision.trustedTime, snapshot) : null;
+    }
+    return snapshot;
+}
+/** A decision time for "now" given a head selector (`Number.MAX_SAFE_INTEGER`). */
+function adminDecisionTime(T, now = Date.now()) {
+    return T >= Number.MAX_SAFE_INTEGER ? now : T;
+}
+//# sourceMappingURL=adminKeys.js.map

package/dist/core/accesscontrol/adminKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminKeys.js","sourceRoot":"","sources":["../../../src/core/accesscontrol/adminKeys.ts"],"names":[],"mappings":";;;AAgDA,4DAGC;AAoCD,kDAEC;AAGD,kDAKC;AAGD,4CAMC;AAGD,wDAEC;AAqBD,sDA6BC;AAGD,8DAIC;AAKD,4CAMC;AAeD,gDAaC;AAGD,8CAEC;AApND;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,mCAAoE;AACpE,oCAA+C;AAE/C,0EAA0E;AAC7D,QAAA,cAAc,GAAG,UAAU,CAAC;AAEzC,gEAAgE;AACnD,QAAA,oBAAoB,GAAG,eAAe,CAAC;AAEpD,6EAA6E;AAChE,QAAA,8BAA8B,GAAG,qBAAqB,CAAC;AAEpE;;;;GAIG;AACU,QAAA,gCAAgC,GAAsB;IACjE,4BAAoB;IACpB,sCAA8B;CAC/B,CAAC;AAEF,wEAAwE;AACxE,SAAgB,wBAAwB,CAAC,KAAgC;IACvE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,wCAAgC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACrF,CAAC;AAmCD,iFAAiF;AACjF,SAAgB,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,kFAAkF;AAC3E,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAAoB;IACzE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAgB,gBAAgB,CAAC,WAAmB;IAClD,MAAM,EAAE,GAAG,4BAAoB,GAAG,IAAA,4BAAoB,EAAC,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC,2BAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,EAAE,8BAA8B,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,+DAA+D;AACxD,KAAK,UAAU,sBAAsB,CAAC,GAAW,EAAE,MAAoB;IAC5E,OAAO,gBAAgB,CAAC,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,qBAAqB,CACnC,IAA6B,EAC7B,YAAoB,EACpB,WAAoC,IAAI;IAExC,IAAI,IAAI,CAAC,IAAI,KAAK,2BAAmB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAc;QAAE,OAAO,IAAI,CAAC;IACnF,IAAI,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrD,MAAM,UAAU,GACd,QAAQ,KAAK,IAAI;QACjB,mBAAmB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,mBAAmB,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC7F,yBAAyB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,YAAY,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,UAAU,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,IAAI,YAAY,CAAC,EAAE,CAAC;QACjF,SAAS,GAAG,QAAS,CAAC,SAAS,CAAC;IAClC,CAAC;IACD,MAAM,UAAU,GACd,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACpF,OAAO;QACL,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,mBAAmB,EAAE,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE;QACjG,GAAG,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,SAAS;QACT,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,YAAY;KACb,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,SAAgB,yBAAyB,CAAC,QAA0B,EAAE,CAAS;IAC7E,IAAI,CAAC,GAAG,QAAQ,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,IAAI,CAAC;AACd,CAAC;AAKD,SAAgB,gBAAgB,CAAC,QAA0B,EAAE,GAAW;IACtE,IAAI,GAAG,GAAG,QAAQ,CAAC,SAAS;QAAE,OAAO,WAAW,CAAC;IACjD,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACzD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD;;;;GAIG;AACH,SAAgB,kBAAkB,CAChC,SAAsC,EACtC,CAAS;IAET,MAAM,OAAO,GAAG,SAAS;SACtB,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;SAC/C,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC;SACnD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACxF,IAAI,QAAQ,GAA4B,IAAI,CAAC;IAC7C,KAAK,MAAM,EAAE,QAAQ,EAAE,IAAI,OAAO,EAAE,CAAC;QACnC,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,SAAgB,iBAAiB,CAAC,CAAS,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACnE,OAAO,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/core/accesscontrol/directoryAdminResolver.d.ts

@@ -0,0 +1,54 @@
+import type { StoreEntryMetadata } from "../types";
+import type { ContentAddressedStore } from "../appendonlystores/types";
+import { type AdminKeySnapshot } from "./adminKeys";
+export interface DirectoryAdminResolverDeps {
+    store: ContentAddressedStore;
+    /** The tenant's root admin key (`administrationPublicKey`). */
+    rootAdminKey: () => string;
+    decryptPayload: (encrypted: Uint8Array, keyId: string) => Promise<Uint8Array>;
+    subtle: SubtleCrypto;
+    /** Whether this process signs with `signingKey` (its writes may be un-witnessed). */
+    isLocalSigningKey: (signingKey: string) => boolean;
+    /** Wall clock (ms). */
+    now?: () => number;
+}
+/** Outcome of judging one directory entry. */
+export interface DirectoryAdminDecision {
+    allowed: boolean;
+    reason: string;
+    /** The time the decision was taken at (witness time, or now for own entries). */
+    at?: number;
+}
+export declare class DirectoryAdminKeyResolver {
+    private readonly deps;
+    private readonly cache;
+    private readonly inFlight;
+    constructor(deps: DirectoryAdminResolverDeps);
+    private now;
+    /** Drop cached revisions (e.g. after a purge rewrote history). */
+    clear(): void;
+    /** Whether `signingKey` is a delegated admin at `T` (the root is not checked here). */
+    isDelegatedAdminAt(signingKey: string, T: number): Promise<boolean>;
+    /** The delegated admin-key snapshot of `signingKey` valid at `T`, or null. */
+    delegatedAdminKeyAt(signingKey: string, T: number): Promise<AdminKeySnapshot | null>;
+    /** Whether the root ever wrote an admin-key document for `signingKey` (active or not). */
+    hasAdminKeyDocument(signingKey: string): Promise<boolean>;
+    /** Whether `signingKey` is the root or a delegated admin at `T`. */
+    isAdminAt(signingKey: string, T: number): Promise<boolean>;
+    /** Whether `witnessPublicKey` is a trusted witness at `T` (root-written document present). */
+    isTrustedWitnessAt(witnessPublicKey: string, T: number): Promise<boolean>;
+    /**
+     * Judge one entry of the `directory` database signed by `entry.createdByPublicKey`.
+     * Root entries are always allowed (unchanged behavior).
+     */
+    judgeEntry(entry: Pick<StoreEntryMetadata, "id" | "docId" | "entryType" | "contentHash" | "decryptionKeyId" | "createdAt" | "createdByPublicKey" | "receivedAt" | "receivedByPublicKey" | "receivedDateSignature" | "receiptScheme">, options: {
+        dbid: string;
+        allowLocalUnwitnessed?: boolean;
+    }): Promise<DirectoryAdminDecision>;
+    /** Root-signed revisions of one root-only document, oldest first. */
+    private revisionsFor;
+    private loadRevisions;
+    /** The root's signature must verify; a forged "root" entry from a peer is ignored. */
+    private verifyRootEntry;
+}
+//# sourceMappingURL=directoryAdminResolver.d.ts.map

package/dist/core/accesscontrol/directoryAdminResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directoryAdminResolver.d.ts","sourceRoot":"","sources":["../../../src/core/accesscontrol/directoryAdminResolver.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAc,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,EAGL,KAAK,gBAAgB,EAKtB,MAAM,aAAa,CAAC;AAOrB,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,+DAA+D;IAC/D,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,cAAc,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9E,MAAM,EAAE,YAAY,CAAC;IACrB,qFAAqF;IACrF,iBAAiB,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,uBAAuB;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAOD,qBAAa,yBAAyB;IAIxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAsC;IAC5D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkD;gBAE9C,IAAI,EAAE,0BAA0B;IAE7D,OAAO,CAAC,GAAG;IAIX,kEAAkE;IAClE,KAAK,IAAI,IAAI;IAIb,uFAAuF;IACjF,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWzE,8EAA8E;IACxE,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;IAO1F,0FAA0F;IACpF,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAK/D,oEAAoE;IAC9D,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKhE,8FAA8F;IACxF,kBAAkB,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB/E;;;OAGG;IACG,UAAU,CACd,KAAK,EAAE,IAAI,CACT,kBAAkB,EAChB,IAAI,GACJ,OAAO,GACP,WAAW,GACX,aAAa,GACb,iBAAiB,GACjB,WAAW,GACX,oBAAoB,GACpB,YAAY,GACZ,qBAAqB,GACrB,uBAAuB,GACvB,eAAe,CAClB,EACD,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzD,OAAO,CAAC,sBAAsB,CAAC;IAwClC,qEAAqE;IACrE,OAAO,CAAC,YAAY;YAQN,aAAa;IAqD3B,sFAAsF;YACxE,eAAe;CAO9B"}