mindoodb 0.0.94 → 0.0.96

package/dist/core/BaseMindooTenant.d.ts

@@ -1,4 +1,4 @@
-import { MindooTenant, EncryptedPrivateKey, MindooDB, ContentAddressedStore, ContentAddressedStoreFactory, StoreKind, OpenDBOptions, MindooTenantFactory, MindooTenantDirectory, StoreEntryMetadata, SigningKeyPair, JoinRequest, JoinResponse, ApproveJoinRequestOptions, ConnectToServerOptions, PublishToServerOptions } from "./types";
+import { MindooTenant, EncryptedPrivateKey, MindooDB, ContentAddressedStore, ContentAddressedStoreFactory, StoreKind, OpenDBOptions, MindooTenantFactory, MindooTenantDirectory, StoreEntryMetadata, SigningKeyPair, JoinRequest, JoinResponse, ApproveJoinRequestOptions, ApproveAdminRequestOptions, ConnectToServerOptions, PublishToServerOptions } from "./types";
 import { PrivateUserId, PublicUserId } from "./userid";
 import { CryptoAdapter } from "./crypto/CryptoAdapter";
 import { KeyBag } from "./keys/KeyBag";
@@ -9,8 +9,10 @@ import type { RecipientOptions, RecipientSpec } from "./userkeys/sealedTypes";
 import { type SealedValue } from "./userkeys/sealedValues";
 import { MindooDocSigner } from "./crypto/MindooDocSigner";
 import { Logger } from "./logging";
+import { type AdminRequest, type AdminResponse } from "./uri/adminUri";
 import { type LocalCacheStore } from "./cache/LocalCacheStore";
 import { CacheManager } from "./cache/CacheManager";
+import { DirectoryAdminKeyResolver } from "./accesscontrol/directoryAdminResolver";
 /**
  * BaseMindooTenant is a platform-agnostic implementation of MindooTenant
  * that works in both browser and server environments.
@@ -143,6 +145,12 @@ export declare class BaseMindooTenant implements MindooTenant {
     getCurrentPrivateUser(): PrivateUserId;
     getCurrentUserPassword(): string;
     getUserKeyManager(): UserKeyManager;
+    /**
+     * The document store of `dbId` without opening (materializing) the
+     * database: the open database's store, or a store handle from the factory.
+     * For readers that only scan entries, such as the device-certificate index.
+     */
+    getDocStoreForDb(dbId: string): ContentAddressedStore;
     isDatabaseOpen(dbId: string): boolean;
     /** Fully initialized (not merely in-flight). See UserKeyManager.canReconcileAgainstUserDirectory. */
     isDatabaseReady(dbId: string): boolean;
@@ -174,6 +182,20 @@ export declare class BaseMindooTenant implements MindooTenant {
     declineUserKeyDevice(fingerprint: string): Promise<void>;
     undoDeclineUserKeyDevice(fingerprint: string): Promise<void>;
     rotateUserKey(): Promise<void>;
+    getDeviceSelfGrantPublicKey(): Promise<string | null>;
+    issueDeviceCertificate(device: {
+        signingPublicKey: string;
+        encryptionPublicKey: string;
+    }, label?: string): Promise<{
+        docId: string;
+        certificate: import("./userkeys/deviceCertificate").DeviceCertificatePayload;
+    }>;
+    revokeOwnDeviceCertificate(fingerprint: string): Promise<number>;
+    listOwnDeviceCertificates(): Promise<Array<{
+        docId: string;
+        fingerprint: string;
+        certificate: import("./userkeys/deviceCertificate").DeviceCertificatePayload;
+    }>>;
     reconcileUserKeys(options?: {
         allowSelfCreate?: boolean;
     }): Promise<UserKeyEnrollmentStatus>;
@@ -250,6 +272,50 @@ export declare class BaseMindooTenant implements MindooTenant {
      * @return The administration public key (Ed25519, PEM format)
      */
     getAdministrationPublicKey(): string;
+    /**
+     * Signing keys this process writes with besides the current user's (e.g. a
+     * delegated admin key, docs/accesscontrol.md §6.13). Directory entries such a
+     * key wrote here count locally before a witness stamped them.
+     */
+    private readonly localSigningKeys;
+    /** Store-level admin-key resolver of the open `directory` database (§6.13). */
+    private directoryAdminResolver;
+    /** Public keys derived from admin private keys handed to directory methods. */
+    private readonly adminPublicKeyByPrivateKey;
+    /** Remember that this process signs with `publicKey` (see {@link isLocalSigningKey}). */
+    noteLocalSigningKey(publicKey: string): void;
+    /** Whether this process signs with `publicKey`: the current user or a noted key. */
+    isLocalSigningKey(publicKey: string): boolean;
+    /**
+     * The store-level admin-key resolver for this tenant's `directory` database,
+     * created on first use for `store`. Used by the directory load path and by
+     * {@link isAdminSigningKeyAt}; it reads root-signed admin-key documents
+     * straight from the store, so it never recurses into directory materialization.
+     */
+    getDirectoryAdminResolver(store: ContentAddressedStore): DirectoryAdminKeyResolver;
+    /**
+     * Whether `signingKey` is a tenant admin at time `T` (docs/accesscontrol.md
+     * §6.13): the root admin key always is; a delegated admin key is while its
+     * admin-key document's window covers `T`. `T` is a witness time, or "now"
+     * for live decisions.
+     */
+    isAdminSigningKeyAt(signingKey: string, T: number): Promise<boolean>;
+    /**
+     * Whether `signingKey` has ever been a delegated admin key of this tenant (an
+     * admin-key document exists, whatever its window). Such a key holds no grant,
+     * so its trust is decided by {@link isAdminSigningKeyAt} alone.
+     */
+    isKnownDelegatedAdminKey(signingKey: string): Promise<boolean>;
+    /**
+     * The signing key pair for an admin private key passed to a directory method.
+     * The root admin key pair is the default; for a delegated admin key
+     * (§6.13) the public key is derived from the private key once and cached.
+     * The derived key is remembered as a local signing key, so the directory
+     * entries it writes count here before a witness stamps them.
+     */
+    resolveAdminSigningKeyPair(privateKey: EncryptedPrivateKey, password: string): Promise<SigningKeyPair>;
+    /** Ed25519 public key (SPKI PEM) of an encrypted private signing key. */
+    private derivePublicSigningKey;
     /**
      * Get the administration encryption public key for this tenant.
      * Used for encrypting sensitive data in the directory that only admins can decrypt
@@ -338,6 +404,13 @@ export declare class BaseMindooTenant implements MindooTenant {
      * @returns true if a wipe was applied (the tenant is now gone locally), false
      *   if this device is not targeted.
      */
+    /**
+     * Whether the admin revoked this device (docs/accesscontrol.md §6.5): its
+     * signing key is kept on one of the person's grants as a revoked pair, or is
+     * the target of a remote wipe. Returns null for a device that was never
+     * granted, so callers can tell the two apart.
+     */
+    private findRevocationOfCurrentDevice;
     checkAndApplyRemoteWipe(): Promise<boolean>;
     /**
      * Delete all local data for this tenant from the device (docs/accesscontrol.md
@@ -466,6 +539,14 @@ export declare class BaseMindooTenant implements MindooTenant {
         format: "uri";
     }): Promise<string>;
     approveJoinRequest(joinRequest: JoinRequest | string, options: ApproveJoinRequestOptions): Promise<JoinResponse>;
+    /**
+     * Approve a delegated-admin request (docs/accesscontrol.md §6.13). Root admin
+     * key only: writes the admin-key document and the `tenantsetup` entry, then
+     * returns an admin response with `default` and `$publicinfos` wrapped to the
+     * new admin's encryption key. The response names the ROOT key as
+     * `adminSigningPublicKey`; the trust anchor never changes.
+     */
+    approveAdminRequest(adminRequest: AdminRequest | string, options: ApproveAdminRequestOptions): Promise<AdminResponse | string>;
     /**
      * Publish (register) this tenant on a MindooDB server.
      *

package/dist/core/BaseMindooTenant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EACzB,sBAAsB,EAEtB,sBAAsB,EAIvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAkB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAe3D,OAAO,EAAE,MAAM,EAA8C,MAAM,WAAW,CAAC;AAG/E,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAExF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAMpD;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,sEAAsE;IACtE,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,iBAAiB,CAAgF;IACzG,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,oBAAoB,CAA6C;IACzE,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqD;IAGrF,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAO;IAC7D,OAAO,CAAC,MAAM,CAAS;IAQvB,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAMtC;IACH,OAAO,CAAC,yBAAyB,CAAS;IAC1C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IACrE,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IAGjE,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;QAC/B,mBAAmB,CAAC,EAAE,UAAU,CAAC;KAClC;IA0FH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB1C,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAA8C;IAEjE,gBAAgB,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkC/F,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,qBAAqB,IAAI,aAAa;IAItC,sBAAsB,IAAI,MAAM;IAIhC,iBAAiB,IAAI,cAAc;IAInC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIrC,qGAAqG;IACrG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;OAKG;IACH,wBAAwB,IAAI,IAAI;IAYhC;;;OAGG;IACH,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAIjD;;;;;;OAMG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAezC,wBAAwB,IAAI,IAAI;IAIhC,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI5C,yBAAyB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI5D,kBAAkB,IAAI,OAAO,CAAC,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IAI5E,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAI5F,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtC,0BAA0B,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAI9D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C;;;;;OAKG;IACH,yBAAyB,CACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,CAAC,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,IAAI;IAQP,uDAAuD;IACvD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAA;KAAE,CAAC;IAMzE;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAM7C;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAO7C,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE;YAInC,gBAAgB;YAOhB,eAAe;IAc7B,mFAAmF;IACnF,OAAO,CAAC,iBAAiB;IAczB;;;;OAIG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCvF;;;;;;OAMG;IACG,SAAS,CACb,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,aAAa,EAAE,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,CAAC;IAkBvB;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAQtE;;;;;;OAMG;IACG,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,CAAC,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EACnE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IAkChB,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAI9C;;;;OAIG;YACW,kBAAkB;IA+B1B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8GjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsDhG;;;;;;;;OAQG;YACW,0BAA0B;IAYlC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqB3D;;;;;;;;;;;OAWG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAMrF;;;;;;;OAOG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAiBb,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAwDhB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCtG;;;OAGG;YACW,qBAAqB;IAsB7B,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAgDlG;;;;;;;OAOG;YACW,yBAAyB;IAsBjC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAQrD;;;;;;;;;;;;;;OAcG;IACG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC;IA0BjD;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChE,uEAAuE;YACzD,qBAAqB;YA8BrB,0BAA0B;IA+ElC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;YAuDtD,cAAc;IAqE5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAMlC;IAEX;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/D;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAmBtE;;;;;;;;OAQG;IACG,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;OAQG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD/F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI/B,kBAAkB;IAsChC;;;;;;;;;;;;OAYG;IACG,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxF;;;;OAIG;IACG,+BAA+B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5F;;;;;;OAMG;IACG,0CAA0C,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjE,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAqB9C,OAAO,CAAC,4BAA4B;IAMpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IA+QtH;;;;;;;;;;OAUG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6GzF;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAyClC,OAAO,CAAC,eAAe;YAmBT,mBAAmB;YA2EnB,iCAAiC;IAsC/C;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,EACrC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IAkFjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;OAMG;IACH,uBAAuB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAInD;;;;;;OAMG;IACG,mCAAmC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IActE;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAsBvB;;;;;;;;OAQG;IACG,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAalD,yBAAyB;IA8BvC;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAejE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;OAKG;IACG,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE;;;;;;;;;;;;;;;;;;OAkBG;IACG,uCAAuC,IAAI,OAAO,CAAC;QACvD,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,gFAAgF;QAChF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IA4DF;;;;OAIG;YACW,gCAAgC;IA6B9C;;;;;;OAMG;IACG,2CAA2C,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlE;;;;;;;;;OASG;IACG,8BAA8B,CAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;;OAOG;IACG,oCAAoC,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,MAAM,CAAC;IAwBlB,8FAA8F;IACxF,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7D;;;;;OAKG;IACG,sBAAsB,CAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAchF;;;;;;;;OAQG;IACG,wCAAwC,CAC5C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC;IAiClB,oEAAoE;IACpE,OAAO,CAAC,4BAA4B;IAKpC;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8B7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CA2DvB"}
+{"version":3,"file":"BaseMindooTenant.d.ts","sourceRoot":"","sources":["../../src/core/BaseMindooTenant.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,QAAQ,EACR,qBAAqB,EACrB,4BAA4B,EAE5B,SAAS,EACT,aAAa,EACb,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,YAAY,EAGZ,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EAEtB,sBAAsB,EAIvB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,YAAY,EAAkB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,EAAE,MAAM,EAA2B,MAAM,eAAe,CAAC;AAIhE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,KAAK,EACV,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAI1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC9E,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAe3D,OAAO,EAAE,MAAM,EAA8C,MAAM,WAAW,CAAC;AAG/E,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAExF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAInF;;;;;;;;;;;;;GAaG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,uBAAuB,CAAS;IACxC,OAAO,CAAC,iCAAiC,CAAS;IAClD,OAAO,CAAC,WAAW,CAAgB;IACnC,sEAAsE;IACtE,OAAO,CAAC,uBAAuB,CAAK;IACpC,OAAO,CAAC,iBAAiB,CAAgF;IACzG,OAAO,CAAC,mBAAmB,CAAS;IACpC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,YAAY,CAA+B;IACnD,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,oBAAoB,CAA6C;IACzE,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,gBAAgB,CAA0D;IAClF;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAmC;IAC7D;;;OAGG;IACH,OAAO,CAAC,wBAAwB,CAA6B;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqD;IAGrF,OAAO,CAAC,uBAAuB,CAAC,CAAa;IAC7C,OAAO,CAAC,4BAA4B,CAAC,CAAY;IACjD,OAAO,CAAC,+BAA+B,CAAC,CAAY;IACpD;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAgC;IACpE;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAgC;IACvE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAAO;IAC7D,OAAO,CAAC,MAAM,CAAS;IAQvB,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAMtC;IACH,OAAO,CAAC,yBAAyB,CAAS;IAC1C,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4B;IACrD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAmC;IACrE,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA+B;IAC5D,6FAA6F;IAC7F,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IACxD,+DAA+D;IAC/D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAkC;IAGjE,OAAO,CAAC,YAAY,CAA6B;IAEjD;;;;;;;;;OASG;IACH,OAAO,CAAC,qBAAqB,CAAC,CAA+B;gBAG3D,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,MAAM,EAChB,uBAAuB,EAAE,MAAM,EAC/B,iCAAiC,EAAE,MAAM,EACzC,WAAW,EAAE,aAAa,EAC1B,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,4BAA4B,EAC1C,aAAa,EAAE,aAAa,EAC5B,MAAM,CAAC,EAAE,MAAM,EACf,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EACpD,eAAe,CAAC,EAAE,eAAe;IACjC;;;;;;;;OAQG;IACH,oBAAoB,CAAC,EAAE;QACrB,UAAU,CAAC,EAAE,SAAS,CAAC;QACvB,aAAa,CAAC,EAAE,SAAS,CAAC;QAC1B,kBAAkB,CAAC,EAAE,SAAS,CAAC;QAC/B,mBAAmB,CAAC,EAAE,UAAU,CAAC;KAClC;IA0FH;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC;;OAEG;IACH,eAAe,IAAI,YAAY,GAAG,IAAI;IAItC;;;OAGG;IACG,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB1C,oFAAoF;IACpF,OAAO,CAAC,iBAAiB,CAA8C;IAEjE,gBAAgB,CAAC,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkC/F,gBAAgB,IAAI,aAAa;IAIjC,OAAO,CAAC,uBAAuB;IAW/B,qBAAqB,IAAI,aAAa;IAItC,sBAAsB,IAAI,MAAM;IAIhC,iBAAiB,IAAI,cAAc;IAInC;;;;OAIG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,qBAAqB;IAMrD,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIrC,qGAAqG;IACrG,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAItC;;;;;OAKG;IACH,wBAAwB,IAAI,IAAI;IAYhC;;;OAGG;IACH,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI;IAIjD;;;;;;OAMG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAezC,wBAAwB,IAAI,IAAI;IAIhC,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI;IAI5C,yBAAyB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAI5D,kBAAkB,IAAI,OAAO,CAAC,OAAO,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;IAI5E,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxD,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI5D,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC;IAI9B,2BAA2B,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIrD,sBAAsB,CAC1B,MAAM,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,EACjE,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,OAAO,8BAA8B,EAAE,wBAAwB,CAAA;KAAE,CAAC;IAIrG,0BAA0B,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhE,yBAAyB,IAAI,OAAO,CACxC,KAAK,CAAC;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,OAAO,8BAA8B,EAAE,wBAAwB,CAAC;KAC9E,CAAC,CACH;IAIK,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAI5F,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtC,0BAA0B,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAI9D,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C;;;;;OAKG;IACH,yBAAyB,CACvB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,UAAU,EAAE,EACzB,KAAK,CAAC,EAAE,eAAe,EACvB,MAAM,CAAC,EAAE,MAAM,EAAE,GAChB,IAAI;IAQP,uDAAuD;IACvD,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,UAAU,CAAA;KAAE,CAAC;IAMzE;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAM7C;;;;OAIG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAO7C,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE;YAInC,gBAAgB;YAOhB,eAAe;IAc7B,mFAAmF;IACnF,OAAO,CAAC,iBAAiB;IAczB;;;;OAIG;IACG,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCvF;;;;;;OAMG;IACG,SAAS,CACb,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,aAAa,EAAE,EAC3B,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,CAAC;IAkBvB;;;OAGG;IACG,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAQtE;;;;;;OAMG;IACG,uBAAuB,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,KAAK,CAAC;QAAE,UAAU,CAAC,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,EACnE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,GAC/B,OAAO,CAAC,IAAI,CAAC;IAkChB,UAAU,IAAI,mBAAmB;IAIjC,KAAK,IAAI,MAAM;IAIf;;;;;OAKG;IACH,0BAA0B,IAAI,MAAM;IAIpC;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,+EAA+E;IAC/E,OAAO,CAAC,sBAAsB,CAA0C;IACxE,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAA8C;IAEzF,yFAAyF;IACzF,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAI5C,oFAAoF;IACpF,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAM7C;;;;;OAKG;IACH,yBAAyB,CAAC,KAAK,EAAE,qBAAqB,GAAG,yBAAyB;IAclF;;;;;OAKG;IACG,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAW1E;;;;OAIG;IACG,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKpE;;;;;;OAMG;IACG,0BAA0B,CAC9B,UAAU,EAAE,mBAAmB,EAC/B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,CAAC;IAiB1B,yEAAyE;YAC3D,sBAAsB;IAmBpC;;;;;;OAMG;IACH,oCAAoC,IAAI,MAAM;IAI9C;;;;OAIG;YACW,kBAAkB;IA+B1B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8GjF,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAsDhG;;;;;;;;OAQG;YACW,0BAA0B;IAYlC,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAqB3D;;;;;;;;;;;OAWG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAMrF;;;;;;;OAOG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,OAAO,CAAC;IAiBb,kBAAkB,CACtB,OAAO,EAAE,UAAU,EACnB,cAAc,EAAE,cAAc,EAC9B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC;IAwDhB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAgCtG;;;OAGG;YACW,qBAAqB;IAsB7B,oBAAoB,CAAC,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IA8DlG;;;;;;;OAOG;YACW,yBAAyB;IAsBjC,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC;IAS/C;;;OAGG;IACH,wBAAwB,IAAI,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;IAI9D,aAAa,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAQrD;;;;;;;;;;;;;;OAcG;IACH;;;;;OAKG;YACW,6BAA6B;IA0BrC,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC;IA0BjD;;;;;;;;;;;OAWG;IACG,eAAe,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChE,uEAAuE;YACzD,qBAAqB;YA8BrB,0BAA0B;IA+FlC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC;YAuDtD,cAAc;IAqE5B;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAMlC;IAEX;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAYhC;;;;;;OAMG;IACG,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAmC/D;;;;OAIG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAmBtE;;;;;;;;OAQG;IACG,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjF;;;;;;;;OAQG;IACG,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoD/F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC;YAI/B,kBAAkB;IAsChC;;;;;;;;;;;;OAYG;IACG,2BAA2B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBxF;;;;OAIG;IACG,+BAA+B,CAAC,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5F;;;;;;OAMG;IACG,0CAA0C,IAAI,OAAO,CAAC,IAAI,CAAC;IAYjE,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,eAAe;YAM9C,gCAAgC;IAqB9C,OAAO,CAAC,4BAA4B;IAMpC;;OAEG;IACG,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG;QAAE,MAAM,EAAE,KAAK,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9H,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,YAAY,CAAC;IA+RtH;;;;;;OAMG;IACG,mBAAmB,CACvB,YAAY,EAAE,YAAY,GAAG,MAAM,EACnC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,aAAa,GAAG,MAAM,CAAC;IAyDlC;;;;;;;;;;OAUG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6GzF;;;;;;;;;;;;OAYG;YACW,oBAAoB;IAyClC,OAAO,CAAC,eAAe;YAmBT,mBAAmB;YA2EnB,iCAAiC;IAsC/C;;OAEG;YACW,yBAAyB;IA6EvC;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,SAA0B,EACrC,OAAO,CAAC,EAAE,sBAAsB,GAC/B,OAAO,CAAC,qBAAqB,CAAC;IAkFjC;;;OAGG;cACa,sBAAsB,IAAI,OAAO,CAAC,SAAS,CAAC;IA8B5D;;;OAGG;YACW,yBAAyB;IA4BvC;;;;;;OAMG;IACH,uBAAuB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI;IAInD;;;;;;OAMG;IACG,mCAAmC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IActE;;;;;;;;;OASG;IACU,iBAAiB,CAC5B,YAAY,EAAE,mBAAmB,EACjC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAsBvB;;;;;;;;OAQG;IACG,qBAAqB,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YAalD,yBAAyB;IA8BvC;;;OAGG;IACH,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU;IASxD;;;OAGG;IACI,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM;IAQpD;;;;OAIG;IACI,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW;IA0BjD;;;;OAIG;IACH,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,KAAQ;IACxD,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,6BAA6B,KAAQ;IAE/D;;;;;;OAMG;IACG,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAejE;;;;;;OAMG;IACG,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7C;;;;;OAKG;IACG,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAezE;;;;;;;;;;;;;;;;;;OAkBG;IACG,uCAAuC,IAAI,OAAO,CAAC;QACvD,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,gFAAgF;QAChF,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;IA4DF;;;;OAIG;YACW,gCAAgC;IA6B9C;;;;;;OAMG;IACG,2CAA2C,IAAI,OAAO,CAAC,IAAI,CAAC;IAIlE;;;;;;;;;OASG;IACG,8BAA8B,CAClC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;IAS5E;;;;;;OAMG;IACG,4BAA4B,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,UAAU,EACjB,mBAAmB,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;;OAOG;IACG,oCAAoC,CACxC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,CAAC,GAClE,OAAO,CAAC,MAAM,CAAC;IAwBlB,8FAA8F;IACxF,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ7D;;;;;OAKG;IACG,sBAAsB,CAC1B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,UAAU,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAchF;;;;;;;;OAQG;IACG,wCAAwC,CAC5C,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EAAE,GACrB,OAAO,CAAC,MAAM,CAAC;IAiClB,oEAAoE;IACpE,OAAO,CAAC,4BAA4B;IAKpC;;;;;;OAMG;cACa,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8B7E;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qCAAqC,IAAI,OAAO;IAI1D;;;;;;;;;;OAUG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;IAgEtB;;;;;;;OAOG;IACG,wBAAwB,CAC5B,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC;CA2DvB"}

package/dist/core/BaseMindooTenant.js

@@ -29,12 +29,15 @@ const errors_1 = require("./errors");
 const logging_1 = require("./logging");
 const MindooURI_1 = require("./uri/MindooURI");
 const joinRequestUri_1 = require("./uri/joinRequestUri");
+const adminUri_1 = require("./uri/adminUri");
 const LocalCacheStore_1 = require("./cache/LocalCacheStore");
 const EncryptedLocalCacheStore_1 = require("./cache/EncryptedLocalCacheStore");
 const CacheManager_1 = require("./cache/CacheManager");
 const databaseIdValidation_1 = require("./databaseIdValidation");
 const BackgroundTaskTracker_1 = require("./BackgroundTaskTracker");
 const singleFlight_1 = require("./utils/singleFlight");
+const directoryAdminResolver_1 = require("./accesscontrol/directoryAdminResolver");
+const DirectoryStateNode_1 = require("./accesscontrol/DirectoryStateNode");
 const dynamicImportInterop_1 = require("./utils/dynamicImportInterop");
 /**
  * BaseMindooTenant is a platform-agnostic implementation of MindooTenant
@@ -133,6 +136,16 @@ class BaseMindooTenant {
         this.cacheManager = null;
         /** Imported HMAC subkeys of {@link computeKeyedHash}, keyed by key id + purpose. */
         this.keyedHashKeyCache = new Map();
+        /**
+         * Signing keys this process writes with besides the current user's (e.g. a
+         * delegated admin key, docs/accesscontrol.md §6.13). Directory entries such a
+         * key wrote here count locally before a witness stamped them.
+         */
+        this.localSigningKeys = new Set();
+        /** Store-level admin-key resolver of the open `directory` database (§6.13). */
+        this.directoryAdminResolver = null;
+        /** Public keys derived from admin private keys handed to directory methods. */
+        this.adminPublicKeyByPrivateKey = new WeakMap();
         this.factory = factory;
         this.tenantId = tenantId;
         this.administrationPublicKey = administrationPublicKey;
@@ -287,6 +300,17 @@ class BaseMindooTenant {
     getUserKeyManager() {
         return this.userKeys;
     }
+    /**
+     * The document store of `dbId` without opening (materializing) the
+     * database: the open database's store, or a store handle from the factory.
+     * For readers that only scan entries, such as the device-certificate index.
+     */
+    getDocStoreForDb(dbId) {
+        const live = this.databaseCache.get(dbId);
+        if (live)
+            return live.getStore();
+        return this.storeFactory.createStore(dbId).docStore;
+    }
     isDatabaseOpen(dbId) {
         return this.databaseCache.has(dbId) || this.databaseOpenInFlight.has(dbId);
     }
@@ -363,6 +387,18 @@ class BaseMindooTenant {
     async rotateUserKey() {
         return this.userKeys.rotateUserKey();
     }
+    async getDeviceSelfGrantPublicKey() {
+        return this.userKeys.getDeviceSelfGrantPublicKey();
+    }
+    async issueDeviceCertificate(device, label) {
+        return this.userKeys.issueDeviceCertificate(device, label);
+    }
+    async revokeOwnDeviceCertificate(fingerprint) {
+        return this.userKeys.revokeOwnDeviceCertificate(fingerprint);
+    }
+    async listOwnDeviceCertificates() {
+        return this.userKeys.listOwnDeviceCertificates();
+    }
     async reconcileUserKeys(options) {
         return this.userKeys.reconcile(options);
     }
@@ -582,6 +618,109 @@ class BaseMindooTenant {
     getAdministrationPublicKey() {
         return this.administrationPublicKey;
     }
+    /** Remember that this process signs with `publicKey` (see {@link isLocalSigningKey}). */
+    noteLocalSigningKey(publicKey) {
+        this.localSigningKeys.add(publicKey.replace(/\s+/g, ""));
+    }
+    /** Whether this process signs with `publicKey`: the current user or a noted key. */
+    isLocalSigningKey(publicKey) {
+        const normalized = publicKey.replace(/\s+/g, "");
+        if (this.currentUser.userSigningKeyPair.publicKey.replace(/\s+/g, "") === normalized)
+            return true;
+        return this.localSigningKeys.has(normalized);
+    }
+    /**
+     * The store-level admin-key resolver for this tenant's `directory` database,
+     * created on first use for `store`. Used by the directory load path and by
+     * {@link isAdminSigningKeyAt}; it reads root-signed admin-key documents
+     * straight from the store, so it never recurses into directory materialization.
+     */
+    getDirectoryAdminResolver(store) {
+        if (!this.directoryAdminResolver) {
+            this.directoryAdminResolver = new directoryAdminResolver_1.DirectoryAdminKeyResolver({
+                store,
+                rootAdminKey: () => this.administrationPublicKey,
+                decryptPayload: (encrypted, keyId) => this.decryptPayload(encrypted, keyId),
+                subtle: this.cryptoAdapter.getSubtle(),
+                isLocalSigningKey: (key) => this.isLocalSigningKey(key),
+                now: () => (0, timeSource_1.semanticNow)(),
+            });
+        }
+        return this.directoryAdminResolver;
+    }
+    /**
+     * Whether `signingKey` is a tenant admin at time `T` (docs/accesscontrol.md
+     * §6.13): the root admin key always is; a delegated admin key is while its
+     * admin-key document's window covers `T`. `T` is a witness time, or "now"
+     * for live decisions.
+     */
+    async isAdminSigningKeyAt(signingKey, T) {
+        if ((0, DirectoryStateNode_1.signingKeysEqual)(signingKey, this.administrationPublicKey))
+            return true;
+        if (!this.directoryAdminResolver) {
+            // Opening the directory registers the resolver. Never awaited from the
+            // directory's own load path: that path uses its resolver directly.
+            await this.openDB(types_1.DIRECTORY_DB_ID, { adminOnlyDb: true });
+        }
+        if (!this.directoryAdminResolver)
+            return false;
+        return this.directoryAdminResolver.isDelegatedAdminAt(signingKey, T);
+    }
+    /**
+     * Whether `signingKey` has ever been a delegated admin key of this tenant (an
+     * admin-key document exists, whatever its window). Such a key holds no grant,
+     * so its trust is decided by {@link isAdminSigningKeyAt} alone.
+     */
+    async isKnownDelegatedAdminKey(signingKey) {
+        if (!this.directoryAdminResolver)
+            return false;
+        return this.directoryAdminResolver.hasAdminKeyDocument(signingKey);
+    }
+    /**
+     * The signing key pair for an admin private key passed to a directory method.
+     * The root admin key pair is the default; for a delegated admin key
+     * (§6.13) the public key is derived from the private key once and cached.
+     * The derived key is remembered as a local signing key, so the directory
+     * entries it writes count here before a witness stamps them.
+     */
+    async resolveAdminSigningKeyPair(privateKey, password) {
+        let publicKey = this.adminPublicKeyByPrivateKey.get(privateKey);
+        if (!publicKey) {
+            try {
+                publicKey = await this.derivePublicSigningKey(privateKey, password);
+            }
+            catch (error) {
+                this.logger.debug(`resolveAdminSigningKeyPair: could not derive public key, assuming root: ${error}`);
+                publicKey = this.administrationPublicKey;
+            }
+            this.adminPublicKeyByPrivateKey.set(privateKey, publicKey);
+        }
+        if (!(0, DirectoryStateNode_1.signingKeysEqual)(publicKey, this.administrationPublicKey)) {
+            this.noteLocalSigningKey(publicKey);
+        }
+        return { publicKey: (0, DirectoryStateNode_1.signingKeysEqual)(publicKey, this.administrationPublicKey) ? this.administrationPublicKey : publicKey, privateKey };
+    }
+    /** Ed25519 public key (SPKI PEM) of an encrypted private signing key. */
+    async derivePublicSigningKey(privateKey, password) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        const pkcs8 = await this.decryptPrivateKey(privateKey, password, "signing");
+        const key = await subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, true, ["sign"]);
+        const jwk = (await subtle.exportKey("jwk", key));
+        if (!jwk.x)
+            throw new Error("Ed25519 JWK export carries no public key");
+        const base64 = jwk.x.replace(/-/g, "+").replace(/_/g, "/");
+        const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
+        const raw = Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+        const spkiPrefix = [0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00];
+        const spki = new Uint8Array(spkiPrefix.length + raw.length);
+        spki.set(spkiPrefix, 0);
+        spki.set(raw, spkiPrefix.length);
+        let binary = "";
+        for (const byte of spki)
+            binary += String.fromCharCode(byte);
+        const body = btoa(binary).match(/.{1,64}/g).join("\n");
+        return `-----BEGIN PUBLIC KEY-----\n${body}\n-----END PUBLIC KEY-----`;
+    }
     /**
      * Get the administration encryption public key for this tenant.
      * Used for encrypting sensitive data in the directory that only admins can decrypt
@@ -917,7 +1056,20 @@ class BaseMindooTenant {
     async verifyEntrySignature(entry, encryptedData) {
         // The author key must be trusted by the tenant directory.
         const directory = await this.openDirectory();
-        const isTrusted = await directory.validatePublicSigningKey(entry.createdByPublicKey);
+        // A delegated admin key (docs/accesscontrol.md §6.13) holds no grant. It is
+        // trusted for what it signed while it was an admin (judged at the witness
+        // time, or now for an un-witnessed entry), also after its window ended.
+        // Checked first for keys the trust cache does not know as grant keys: the
+        // store-level check never waits for the directory cache pass that may be
+        // verifying this very entry.
+        const peek = directory.peekTrustedKey;
+        let isTrusted = (0, DirectoryStateNode_1.signingKeysEqual)(entry.createdByPublicKey, this.administrationPublicKey) ||
+            (typeof peek === "function" &&
+                peek.call(directory, entry.createdByPublicKey) !== true &&
+                (await this.isAdminSigningKeyAt(entry.createdByPublicKey, entry.receivedAt ?? (0, timeSource_1.semanticNow)())));
+        if (!isTrusted) {
+            isTrusted = await directory.validatePublicSigningKey(entry.createdByPublicKey);
+        }
         if (!isTrusted) {
             this.logger.warn(`Public key not trusted: ${entry.createdByPublicKey}`);
             return false;
@@ -1013,6 +1165,33 @@ class BaseMindooTenant {
      * @returns true if a wipe was applied (the tenant is now gone locally), false
      *   if this device is not targeted.
      */
+    /**
+     * Whether the admin revoked this device (docs/accesscontrol.md §6.5): its
+     * signing key is kept on one of the person's grants as a revoked pair, or is
+     * the target of a remote wipe. Returns null for a device that was never
+     * granted, so callers can tell the two apart.
+     */
+    async findRevocationOfCurrentDevice(username) {
+        const directory = await this.openDirectory();
+        const finder = directory;
+        if (typeof finder.findGrantAccessDocuments !== "function") {
+            return null;
+        }
+        const normalize = (key) => key.replace(/\s+/g, "");
+        const myKey = normalize(this.currentUser.userSigningKeyPair.publicKey);
+        let revoked = false;
+        let wipeRequested = false;
+        for (const grant of await finder.findGrantAccessDocuments(username)) {
+            const data = grant.getData();
+            if ((0, grantKeys_1.extractRevokedKeyPairs)(data).some((pair) => normalize(pair.signingPublicKey) === myKey)) {
+                revoked = true;
+            }
+            if ((0, grantKeys_1.extractWipeRequestedSigningKeys)(data).some((key) => normalize(key) === myKey)) {
+                wipeRequested = true;
+            }
+        }
+        return revoked || wipeRequested ? { wipeRequested } : null;
+    }
     async checkAndApplyRemoteWipe() {
         const directory = await this.openDirectory();
         const myKey = this.currentUser.userSigningKeyPair.publicKey;
@@ -1106,7 +1285,7 @@ class BaseMindooTenant {
             return;
         }
         const currentUser = await this.getCurrentUserId();
-        if (currentUser.userSigningPublicKey === this.getAdministrationPublicKey()) {
+        if (await this.isAdminSigningKeyAt(currentUser.userSigningPublicKey, (0, timeSource_1.semanticNow)())) {
             return;
         }
         const directory = await this.openDirectory();
@@ -1124,7 +1303,18 @@ class BaseMindooTenant {
                 registeredUser?.signingPublicKey === currentUser.userSigningPublicKey &&
                     registeredUser?.encryptionPublicKey === currentUser.userEncryptionPublicKey;
         }
+        // A device its person certified (docs/userkeys.md §9.6).
+        if (!hasMatchingGrant && typeof directory.resolveSignerToGrant === "function") {
+            hasMatchingGrant = !!(await directory.resolveSignerToGrant(currentUser.userSigningPublicKey, Number.MAX_SAFE_INTEGER));
+        }
         if (!hasMatchingGrant) {
+            // A revoked device (its key kept on the grant as a revoked pair, or
+            // targeted for remote wipe) is told so, not asked to request access.
+            const revoked = await this.findRevocationOfCurrentDevice(currentUser.username);
+            if (revoked) {
+                this.logger.warn(`Denied database open for revoked device of ${currentUser.username} on database ${id}`);
+                throw new errors_1.DeviceAccessRevokedError(currentUser.username, revoked.wipeRequested);
+            }
             this.logger.warn(`Denied database open for ungranted user ${currentUser.username} on database ${id}`);
             throw new Error(`User "${currentUser.username}" does not have tenant access yet; the tenant admin must grant access first.`);
         }
@@ -1562,6 +1752,9 @@ class BaseMindooTenant {
         }
         console.log(`[approveJoinRequest] Approving join request for user "${username}"`);
         this.logger.info(`Approving join request for user: ${username}`);
+        // The approving admin: the root, or a delegated admin (§6.13).
+        const approverKeyPair = await this.resolveAdminSigningKeyPair(options.adminSigningKey, options.adminPassword);
+        const approverIsRoot = (0, DirectoryStateNode_1.signingKeysEqual)(approverKeyPair.publicKey, this.administrationPublicKey);
         // 1. Register the user in the directory
         const directory = await this.openDirectory();
         const publicUserId = {
@@ -1596,10 +1789,7 @@ class BaseMindooTenant {
             const userKeyDoc = await this.userKeys.createPendingFromJoin({
                 username,
                 userPublicKey,
-                signingKeyPair: {
-                    publicKey: this.administrationPublicKey,
-                    privateKey: options.adminSigningKey,
-                },
+                signingKeyPair: approverKeyPair,
                 signingKeyPassword: options.adminPassword,
             });
             const payload = (0, validateUserKeyDocument_1.asUserKeyPayload)(userKeyDoc.getData());
@@ -1613,6 +1803,15 @@ class BaseMindooTenant {
             // (`[$publicinfos]`) must not quietly hand out the tenant key.
             const wrapDefault = options.sharedDocKeyIds === undefined ||
                 options.sharedDocKeyIds.includes(types_1.DEFAULT_TENANT_KEY_ID);
+            // The person's first device brings their device self-grant key. Only
+            // then is it the person's own key; an additional device's request
+            // carries a key nobody else holds (docs/userkeys.md §9).
+            const selfGrantKey = typeof request.deviceSelfGrantPublicKey === "string"
+                ? request.deviceSelfGrantPublicKey.trim()
+                : "";
+            if (options.allowDeviceSelfGrant && selfGrantKey && publishedPublicKey === userPublicKey) {
+                await directory.setDeviceSelfGrant(username, selfGrantKey, options.adminSigningKey, options.adminPassword);
+            }
             if (wrapDefault && publishedPublicKey === userPublicKey) {
                 await directory.autoDistributeKeysToUser(username, [types_1.DEFAULT_TENANT_KEY_ID], options.adminSigningKey, options.adminPassword, userPublicKey);
             }
@@ -1704,7 +1903,7 @@ class BaseMindooTenant {
         // Tenants created before `tenantsetup` recorded administrators have no
         // entry, leaving members with a fingerprint instead of a name. A grant is
         // where the admin supplies both its name and its keys, so heal it here.
-        if (options.adminUsername) {
+        if (options.adminUsername && approverIsRoot) {
             try {
                 const directoryDb = await this.openDB("directory", { adminOnlyDb: true });
                 const written = await (0, tenantSetup_1.ensureTenantSetupAdministrator)(directoryDb, {
@@ -1732,6 +1931,63 @@ class BaseMindooTenant {
         }
         return joinResponse;
     }
+    /**
+     * Approve a delegated-admin request (docs/accesscontrol.md §6.13). Root admin
+     * key only: writes the admin-key document and the `tenantsetup` entry, then
+     * returns an admin response with `default` and `$publicinfos` wrapped to the
+     * new admin's encryption key. The response names the ROOT key as
+     * `adminSigningPublicKey`; the trust anchor never changes.
+     */
+    async approveAdminRequest(adminRequest, options) {
+        const request = (0, adminUri_1.decodeAdminRequestUri)(adminRequest);
+        if (request.tenantId && request.tenantId !== this.tenantId) {
+            throw new Error(`This admin request is for tenant "${request.tenantId}", not "${this.tenantId}"`);
+        }
+        const name = (options.name ?? request.name ?? "").trim();
+        if (!name) {
+            throw new Error("Cannot approve admin request: no name in the request and none supplied via options.name");
+        }
+        const label = (options.label ?? request.label ?? "").trim();
+        const directory = (await this.openDirectory());
+        await directory.addAdminKey({
+            signingPublicKey: request.signingPublicKey,
+            encryptionPublicKey: request.encryptionPublicKey,
+            name,
+            ...(label ? { label } : {}),
+            ...(typeof options.validFrom === "number" ? { validFrom: options.validFrom } : {}),
+        }, options.adminSigningKey, options.adminPassword);
+        const encryptedDocKeys = await Promise.all([types_1.DEFAULT_TENANT_KEY_ID, types_1.PUBLIC_INFOS_KEY_ID].map((keyId) => this.exportJoinResponseDocKeyVersions(keyId, request.encryptionPublicKey)));
+        const response = {
+            v: 1,
+            tenantId: this.tenantId,
+            adminSigningPublicKey: this.administrationPublicKey,
+            adminEncryptionPublicKey: this.administrationEncryptionPublicKey,
+            signingPublicKey: request.signingPublicKey,
+            name,
+            encryptedDocKeys,
+        };
+        if (label)
+            response.label = label;
+        if (options.serverUrl)
+            response.serverUrl = options.serverUrl;
+        const tenantLabel = options.tenantLabel?.trim();
+        if (tenantLabel) {
+            response.tenantLabel = tenantLabel;
+        }
+        else {
+            try {
+                const directoryDb = await this.openDB(types_1.DIRECTORY_DB_ID, { adminOnlyDb: true });
+                const setupLabel = await (0, tenantSetup_1.readTenantSetupLabel)(directoryDb, this);
+                if (setupLabel)
+                    response.tenantLabel = setupLabel;
+            }
+            catch {
+                // Best-effort, as for join responses.
+            }
+        }
+        this.logger.info(`Admin request approved for "${name}"`);
+        return options.format === "uri" ? (0, adminUri_1.encodeAdminResponseUri)(response) : response;
+    }
     /**
      * Publish (register) this tenant on a MindooDB server.
      *