mindoodb 0.0.94 → 0.0.96

package/dist/core/BaseMindooTenantDirectory.js

@@ -3,6 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BaseMindooTenantDirectory = void 0;
 const types_1 = require("./types");
 const errors_1 = require("./errors");
+const storeEntryTime_1 = require("./storeEntryTime");
+const fingerprint_1 = require("./userkeys/fingerprint");
+const deviceCertificate_1 = require("./userkeys/deviceCertificate");
 const timeSource_1 = require("./utils/timeSource");
 const singleFlight_1 = require("./utils/singleFlight");
 const logging_1 = require("./logging");
@@ -16,6 +19,8 @@ const types_3 = require("./accesscontrol/types");
 const evaluate_1 = require("./accesscontrol/evaluate");
 const RSAEncryption_1 = require("./crypto/RSAEncryption");
 const encryptedFields_1 = require("./crypto/encryptedFields");
+const tenantSetup_1 = require("./tenantSetup");
+const adminKeys_1 = require("./accesscontrol/adminKeys");
 const DIRECTORY_SYNC_INTERVAL_MS = 5 * 60 * 1000;
 const MAX_UNKNOWN_KEYS_TRACKED = 1000;
 /** De-duplicated union of two string lists, preserving first-seen order. */
@@ -87,6 +92,10 @@ class BaseMindooTenantDirectory {
         // Best-effort reverse lookup cache for public signing key -> user details.
         // Entries remain available even after revocation so historical UIs can still show identity labels.
         this.userLookupCache = new Map();
+        // Device certificates read from `userdirectory` (docs/userkeys.md §9.6),
+        // keyed by the certified device's normalized signing key.
+        this.deviceCertIndex = null;
+        this.buildingDeviceCertIndex = null;
         // Remote-wipe directive index (docs/accesscontrol.md §6.5): signing public key
         // targeted for wipe -> id of the admin-signed grant document carrying the
         // directive. Self-contained key values survive key removal, so this stays
@@ -242,10 +251,7 @@ class BaseMindooTenantDirectory {
         // Cast to BaseMindooTenant to access protected methods
         const baseTenant = this.tenant;
         // Create SigningKeyPair for the administration key
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         // Compute username hash (salted v2 for new documents) and encrypted user
         // details before creating the document.
         const usernameHash = await this.hashUsernameForWrite(userId.username);
@@ -329,8 +335,7 @@ class BaseMindooTenantDirectory {
         ];
         if (filtered.length === 0)
             return;
-        const baseTenant = this.tenant;
-        const preparedBy = baseTenant.getAdministrationPublicKey();
+        const preparedBy = (await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword)).publicKey;
         for (const keyId of filtered) {
             const keyVersions = await this.getKeyVersionManifest(keyId);
             if (keyVersions.length === 0) {
@@ -530,6 +535,21 @@ class BaseMindooTenantDirectory {
                 return additionalResult;
             }
         }
+        // A delegated admin key (docs/accesscontrol.md §6.13) holds no grant; it is
+        // trusted while its admin window covers now. Checked before the poll below:
+        // the admin-key resolver reads the store directly, while the poll may wait
+        // for a directory cache pass that is itself verifying this key's entries.
+        if (this.trustedKeysCache.get(publicKey) !== true) {
+            if (await this.isAdminKeyNow(publicKey)) {
+                this.logger.debug(`Public key is an active delegated admin key, trusted`);
+                return true;
+            }
+            // An ended delegated admin key holds no grant either: nothing to poll for.
+            if (await this.tenant.isKnownDelegatedAdminKey(publicKey)) {
+                this.logger.debug(`Public key is a delegated admin key outside its window, not trusted now`);
+                return false;
+            }
+        }
         // Store poll: discovers entries this process has not seen yet, so it is
         // throttled to once per interval — unless the caller forces it (audit #4):
         // the server push path must observe a freshly pushed revocation
@@ -562,10 +582,252 @@ class BaseMindooTenantDirectory {
             this.logger.debug(`Public key validation result (from cache): ${cachedResult}`);
             return cachedResult;
         }
+        // Not on any grant: it may be a device the person certified (§9.6 of userkeys.md).
+        if (await this.resolveSignerToGrant(publicKey, Number.MAX_SAFE_INTEGER)) {
+            return true;
+        }
         // Key not found in cache means it was never granted access
         this.logger.debug(`Public key not found in cache, returning false`);
         return false;
     }
+    // ==================== Delegated administrators (§6.13) ====================
+    /** The signing key pair for an admin private key: the root's, or a delegated admin's. */
+    async adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword) {
+        const pair = await this.tenant.resolveAdminSigningKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
+        if (!(0, DirectoryStateNode_1.signingKeysEqual)(pair.publicKey, this.getRootAdminPublicKey()) &&
+            !(await this.isAdminKeyNow(pair.publicKey))) {
+            throw new Error("Signing key pair mismatch: the private key belongs to neither the root admin key nor an active delegated admin of this tenant");
+        }
+        return pair;
+    }
+    /** Like {@link adminKeyPair}, but refuses anything but the root admin key. */
+    async rootKeyPair(administrationPrivateKey, administrationPrivateKeyPassword, action) {
+        const pair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
+        if (!(0, DirectoryStateNode_1.signingKeysEqual)(pair.publicKey, this.tenant.getAdministrationPublicKey())) {
+            throw new Error(`Only the root admin key may ${action}`);
+        }
+        return pair;
+    }
+    /**
+     * What the trust cache already knows about `publicKey` (true: an active
+     * grant key), without polling. Lets entry verification try the store-level
+     * admin check first for keys that are not grant keys (§6.13).
+     */
+    peekTrustedKey(publicKey) {
+        return this.trustedKeysCache.get(publicKey);
+    }
+    /** The tenant's root admin key (the fixed trust anchor). */
+    getRootAdminPublicKey() {
+        return this.tenant.getAdministrationPublicKey();
+    }
+    /**
+     * Live admin check (auth, read gate, push check): root, or a delegated admin
+     * key whose window covers now. Reads the root-signed admin-key documents from
+     * the directory store, so it is safe on the directory's own load path.
+     */
+    async isAdminKeyNow(signingKey) {
+        return this.tenant.isAdminSigningKeyAt(signingKey, (0, timeSource_1.semanticNow)());
+    }
+    /**
+     * Whether `signingKey` is a tenant admin at trusted time `T` (§6.13): the
+     * root always; a delegated admin key while the directory state at `T` holds
+     * its admin-key document with `validFrom ≤ T < validUntil`. Pass
+     * `Number.MAX_SAFE_INTEGER` for the directory head judged at "now".
+     */
+    async isAdminAt(signingKey, T) {
+        const root = this.getRootAdminPublicKey();
+        if ((0, DirectoryStateNode_1.signingKeysEqual)(signingKey, root))
+            return true;
+        const node = await this.getDirectoryStateAt(T);
+        return (0, DirectoryStateNode_1.isAdminInNode)(node, root, signingKey, (0, adminKeys_1.adminDecisionTime)(T, (0, timeSource_1.semanticNow)()));
+    }
+    /**
+     * Like {@link isAdminAt}, but read from the root-signed admin-key documents in
+     * the directory store rather than the time-travel chain (§6.13). This is the
+     * form the sync server uses for push and auth decisions: it never waits for a
+     * chain rebuild and is safe to call while the directory itself loads.
+     */
+    async isAdminSigningKeyAt(signingKey, T) {
+        return this.tenant.isAdminSigningKeyAt(signingKey, (0, adminKeys_1.adminDecisionTime)(T, (0, timeSource_1.semanticNow)()));
+    }
+    /**
+     * The delegated admin key `signingKey` as valid at `T` (its encryption key and
+     * window), or null when it is not a delegated admin then. Store-level like
+     * {@link isAdminSigningKeyAt}; the sync server uses it to let an admin key
+     * authenticate without a grant.
+     */
+    async getDelegatedAdminKeyAt(signingKey, T) {
+        const tenant = this.tenant;
+        if (!(await tenant.isAdminSigningKeyAt(signingKey, (0, adminKeys_1.adminDecisionTime)(T, (0, timeSource_1.semanticNow)()))))
+            return null;
+        const directoryDB = await this.getDirectoryDB();
+        return tenant
+            .getDirectoryAdminResolver(directoryDB.getStore())
+            .delegatedAdminKeyAt(signingKey, (0, adminKeys_1.adminDecisionTime)(T, (0, timeSource_1.semanticNow)()));
+    }
+    /**
+     * The delegated admin keys at the directory head, with their windows, names
+     * (when this replica holds `default`) and status at "now". `pending` is true
+     * while the latest revision of a key's document carries no witness receipt
+     * yet: other replicas do not see it until a trusted witness stamped it.
+     */
+    async listAdminKeys() {
+        return this.adminKeysFromNode(await this.getDirectoryStateHead(), (0, timeSource_1.semanticNow)(), true);
+    }
+    /** The delegated admin keys as the directory knew them at trusted time `T`. */
+    async getAdminKeysAt(T) {
+        return this.adminKeysFromNode(await this.getDirectoryStateAt(T), (0, adminKeys_1.adminDecisionTime)(T, (0, timeSource_1.semanticNow)()), false);
+    }
+    async adminKeysFromNode(node, at, withPending) {
+        const directoryDB = await this.getDirectoryDB();
+        const subtle = this.tenant.getCryptoAdapter().getSubtle();
+        const out = [];
+        for (const snapshot of node.adminKeys?.values() ?? []) {
+            const docId = await (0, adminKeys_1.aclAdminKeyDocIdForKey)(snapshot.signingPublicKey, subtle);
+            let name;
+            try {
+                const doc = await directoryDB.getDocument(docId);
+                const decrypted = await (0, encryptedFields_1.decryptEncryptedField)(this.tenant, doc.getData(), "name_encrypted");
+                if (typeof decrypted === "string" && decrypted.trim())
+                    name = decrypted.trim();
+            }
+            catch {
+                // No `default` key here, or the document is not materialized.
+            }
+            let pending = false;
+            if (withPending) {
+                try {
+                    const entries = await directoryDB.getStore().findNewEntriesForDoc([], docId);
+                    const latest = entries
+                        .filter((e) => (0, DirectoryStateNode_1.signingKeysEqual)(e.createdByPublicKey, this.getRootAdminPublicKey()))
+                        .sort((a, b) => a.createdAt - b.createdAt)
+                        .pop();
+                    pending = !!latest && latest.receivedAt === undefined;
+                }
+                catch {
+                    pending = false;
+                }
+            }
+            out.push({
+                ...snapshot,
+                ...(name ? { name } : {}),
+                status: (0, adminKeys_1.adminKeyStatusAt)(snapshot, at),
+                active: (0, adminKeys_1.isAdminKeySnapshotValidAt)(snapshot, at),
+                pending,
+            });
+        }
+        return out.sort((a, b) => a.validFrom - b.validFrom);
+    }
+    /**
+     * Make `signingPublicKey` a delegated admin (§6.13). Root only. Writes the
+     * `acl_adminkey_<fingerprint>` document (under `$publicinfos`) and records the
+     * admin in `tenantsetup.administrators` for display. Adding a key whose
+     * document already exists starts a new window (reactivation): entries signed
+     * between the old end and the new start stay invalid.
+     *
+     * The key becomes effective at the witness time of this write (or at
+     * `validFrom`, if later). Other replicas honor it once a trusted witness has
+     * stamped the document.
+     */
+    async addAdminKey(admin, administrationPrivateKey, administrationPrivateKeyPassword) {
+        const rootPair = await this.rootKeyPair(administrationPrivateKey, administrationPrivateKeyPassword, "add administrators");
+        const name = admin.name.trim();
+        if (!name)
+            throw new Error("addAdminKey: name is required");
+        if (!admin.signingPublicKey.trim() || !admin.encryptionPublicKey.trim()) {
+            throw new Error("addAdminKey: signingPublicKey and encryptionPublicKey are required");
+        }
+        if ((0, DirectoryStateNode_1.signingKeysEqual)(admin.signingPublicKey, rootPair.publicKey)) {
+            throw new Error("addAdminKey: the root admin key is always an administrator");
+        }
+        const directoryDB = await this.getDirectoryDB();
+        const subtle = this.tenant.getCryptoAdapter().getSubtle();
+        const docId = await (0, adminKeys_1.aclAdminKeyDocIdForKey)(admin.signingPublicKey, subtle);
+        const nameEncrypted = await (0, encryptedFields_1.encryptEncryptedField)(this.tenant, name);
+        const label = admin.label?.trim();
+        const doc = await this.getOrCreateAclDoc(directoryDB, docId, rootPair, administrationPrivateKeyPassword);
+        await directoryDB.changeDoc(doc, async (d) => {
+            const data = d.getData();
+            data.form = types_3.ACCESS_CONTROL_FORM;
+            data.type = adminKeys_1.ADMIN_KEY_TYPE;
+            data.signingPublicKey = admin.signingPublicKey;
+            data.encryptionPublicKey = admin.encryptionPublicKey;
+            data.name_encrypted = nameEncrypted;
+            data.name_encrypted_key = types_1.DEFAULT_TENANT_KEY_ID;
+            if (label)
+                data.label = label;
+            else
+                delete data.label;
+            if (typeof admin.validFrom === "number" && Number.isFinite(admin.validFrom)) {
+                data.validFrom = admin.validFrom;
+            }
+            else {
+                delete data.validFrom;
+            }
+            delete data.validUntil;
+        }, { signingKeyPair: rootPair, signingKeyPassword: administrationPrivateKeyPassword });
+        try {
+            await (0, tenantSetup_1.ensureTenantSetupAdministrator)(directoryDB, {
+                username: name,
+                keyPairs: [
+                    {
+                        signingPublicKey: admin.signingPublicKey,
+                        encryptionPublicKey: admin.encryptionPublicKey,
+                        ...(label ? { label } : {}),
+                        addedAt: (0, timeSource_1.semanticNow)(),
+                    },
+                ],
+            }, rootPair, administrationPrivateKeyPassword, this.tenant);
+        }
+        catch (error) {
+            this.logger.warn(`addAdminKey: recording the administrator in tenantsetup failed: ${error}`);
+        }
+        await this.updateUnifiedCache();
+    }
+    /**
+     * Change the window of a delegated admin key (§6.13). Root only.
+     *
+     * - `validUntil: <ms>` deactivates the key as of that witness time; a future
+     *   date schedules the end. A date before the witness time of this write is
+     *   raised to it — deactivation never reaches back.
+     * - `validUntil: null` removes the end. On a key that has already ended this
+     *   reactivates it from the witness time of this write on.
+     * - `validFrom: <ms>` / `null` sets or clears a later start.
+     */
+    async setAdminKeyValidity(signingPublicKey, validity, administrationPrivateKey, administrationPrivateKeyPassword) {
+        const rootPair = await this.rootKeyPair(administrationPrivateKey, administrationPrivateKeyPassword, "change administrators");
+        const directoryDB = await this.getDirectoryDB();
+        const docId = await (0, adminKeys_1.aclAdminKeyDocIdForKey)(signingPublicKey, this.tenant.getCryptoAdapter().getSubtle());
+        let doc;
+        try {
+            doc = await directoryDB.getDocument(docId);
+        }
+        catch {
+            throw new Error("setAdminKeyValidity: this key is not a delegated administrator");
+        }
+        const ended = (() => {
+            const data = doc.getData();
+            return typeof data.validUntil === "number" && data.validUntil <= (0, timeSource_1.semanticNow)();
+        })();
+        await directoryDB.changeDoc(doc, async (d) => {
+            const data = d.getData();
+            if (validity.validUntil === null)
+                delete data.validUntil;
+            else if (typeof validity.validUntil === "number" && Number.isFinite(validity.validUntil)) {
+                data.validUntil = validity.validUntil;
+            }
+            if (validity.validFrom === null)
+                delete data.validFrom;
+            else if (typeof validity.validFrom === "number" && Number.isFinite(validity.validFrom)) {
+                data.validFrom = validity.validFrom;
+            }
+            else if (validity.validUntil === null && ended) {
+                // Reactivation: a new window starting at this revision's witness time.
+                delete data.validFrom;
+            }
+        }, { signingKeyPair: rootPair, signingKeyPassword: administrationPrivateKeyPassword });
+        await this.updateUnifiedCache();
+    }
     /**
      * Whether a cache miss for `publicKey` may poll the store. A key that missed
      * within the last DIRECTORY_SYNC_INTERVAL_MS does not poll again; it still
@@ -1093,6 +1355,7 @@ class BaseMindooTenantDirectory {
         const node = await this.getDirectoryStateAt(input.trustedTime);
         const identity = await this.identitySetForSigningKey(input.signingKey, node, {
             isAuthor: input.op === "doc_create" || !!input.isAuthor,
+            trustedTime: input.trustedTime,
         });
         return (0, evaluate_1.evaluateAccess)({
             op: input.op,
@@ -1112,6 +1375,7 @@ class BaseMindooTenantDirectory {
         const node = await this.getDirectoryStateAt(input.trustedTime);
         const identity = await this.identitySetForSigningKey(input.signingKey, node, {
             isAuthor: input.op === "doc_create" || input.isAuthor,
+            trustedTime: input.trustedTime,
         });
         return (0, evaluate_1.evaluateAccess)({
             op: input.op,
@@ -1132,15 +1396,283 @@ class BaseMindooTenantDirectory {
         const signerNode = input.signerTrustedTime === input.creatorTrustedTime
             ? creatorNode
             : await this.getDirectoryStateAt(input.signerTrustedTime);
-        return (0, DirectoryStateNode_1.isSamePerson)(creatorNode, signerNode, input.creatorSigningKey, input.signerSigningKey);
+        if ((0, DirectoryStateNode_1.isSamePerson)(creatorNode, signerNode, input.creatorSigningKey, input.signerSigningKey)) {
+            return true;
+        }
+        // Certified devices (userkeys.md §9.6): compare the persons they act for.
+        // The creator is looked up without revocation, like a retired grant device.
+        const creatorHash = (0, DirectoryStateNode_1.grantAtOrBefore)(creatorNode, input.creatorSigningKey)?.usernameHash ??
+            (await this.certifiedGrantInNode(creatorNode, input.creatorSigningKey, input.creatorTrustedTime, {
+                enforceRevocation: false,
+            }))?.grant.usernameHash;
+        const signerHash = (await this.resolveSignerInNode(signerNode, input.signerSigningKey, input.signerTrustedTime))?.grant.usernameHash;
+        return !!creatorHash && creatorHash === signerHash;
     }
     /**
      * The `username_hash` of the active grant that contained `signingKey` at
      * trusted time `T`, or `null` when the key was not a granted device then.
      */
     async resolveUsernameHashForSigningKey(signingKey, trustedTime) {
+        return (await this.resolveSignerToGrant(signingKey, trustedTime))?.grant.usernameHash ?? null;
+    }
+    /**
+     * The grant a signing key acts under at trusted time `T`
+     * (docs/userkeys.md §9.6): a device listed on the grant, or a device with a
+     * valid certificate. A certificate counts when
+     *
+     * - it verifies with the self-grant key that the person's grant names at `T`,
+     * - its `doc_create` was accepted (trusted time) at or before `T`, and
+     *   before the delegation's `revokedAt`,
+     * - the person did not delete it at or before `T`, and
+     * - the device is not in the grant's `revokedUserKeyPairs` at `T`.
+     *
+     * The one place that answers "which person is this key"; server auth, ACL
+     * evaluation, ownership and attribution go through it.
+     */
+    async resolveSignerToGrant(signingKey, trustedTime) {
         const node = await this.getDirectoryStateAt(trustedTime);
-        return (0, DirectoryStateNode_1.grantForSigningKey)(node, signingKey)?.usernameHash ?? null;
+        return this.resolveSignerInNode(node, signingKey, trustedTime);
+    }
+    async resolveSignerInNode(node, signingKey, trustedTime) {
+        const listed = (0, DirectoryStateNode_1.grantForSigningKey)(node, signingKey);
+        if (listed)
+            return { grant: listed, via: "grant" };
+        const certified = await this.certifiedGrantInNode(node, signingKey, trustedTime, {
+            enforceRevocation: true,
+        });
+        return certified ? { grant: certified.grant, via: "certificate", certificate: certified.cert } : null;
+    }
+    /** Device certificates valid for `signingKey` in `node` (see {@link resolveSignerToGrant}). */
+    async certifiedGrantInNode(node, signingKey, trustedTime, options) {
+        if (!signingKey)
+            return null;
+        const records = (await this.loadDeviceCertificateIndex()).get((0, fingerprint_1.normalizePublicKeyPem)(signingKey));
+        if (!records?.length)
+            return null;
+        const now = Date.now();
+        for (const record of records) {
+            const grant = node.usersByHash.get(record.cert.username_hash);
+            if (!grant)
+                continue;
+            const delegation = grant.deviceSelfGrant;
+            if (!delegation ||
+                (0, fingerprint_1.normalizePublicKeyPem)(delegation.signingPublicKey) !==
+                    (0, fingerprint_1.normalizePublicKeyPem)(record.cert.selfGrantPublicKey)) {
+                continue;
+            }
+            const issuedAt = (0, storeEntryTime_1.entryTrustedTime)(record.createMeta, now);
+            if (delegation.revokedAt !== undefined && issuedAt >= delegation.revokedAt)
+                continue;
+            if (options.enforceRevocation) {
+                if (!grant.active)
+                    continue;
+                if (issuedAt > trustedTime)
+                    continue;
+                const deletedAt = record.deleteMetas.length
+                    ? Math.min(...record.deleteMetas.map((m) => (0, storeEntryTime_1.entryTrustedTime)(m, now)))
+                    : undefined;
+                if (deletedAt !== undefined && deletedAt <= trustedTime)
+                    continue;
+                if ((grant.revokedSigningKeys ?? []).some((key) => (0, DirectoryStateNode_1.signingKeysEqual)(key, signingKey)))
+                    continue;
+            }
+            return { grant, cert: record.cert };
+        }
+        return null;
+    }
+    /**
+     * Every certificate of the person with `usernameHash` that their current
+     * self-grant key signed, including revoked devices (for revoke and wipe).
+     */
+    async certificatesOfPerson(usernameHash) {
+        const head = await this.getDirectoryStateHead();
+        const result = [];
+        for (const records of (await this.loadDeviceCertificateIndex()).values()) {
+            const record = records.find((r) => r.cert.username_hash === usernameHash);
+            if (!record)
+                continue;
+            const hit = await this.certifiedGrantInNode(head, record.cert.deviceSigningPublicKey, Number.MAX_SAFE_INTEGER, {
+                enforceRevocation: false,
+            });
+            if (hit?.grant.usernameHash === usernameHash)
+                result.push(hit.cert);
+        }
+        return result;
+    }
+    /**
+     * Certified devices of the person with `usernameHash` that count at the head
+     * state, with their certificates.
+     */
+    async listCertifiedDevices(usernameHash) {
+        const head = await this.getDirectoryStateHead();
+        const index = await this.loadDeviceCertificateIndex();
+        const result = [];
+        const seen = new Set();
+        for (const [key, records] of index) {
+            if (!records.some((r) => r.cert.username_hash === usernameHash))
+                continue;
+            const hit = await this.certifiedGrantInNode(head, records[0].cert.deviceSigningPublicKey, Number.MAX_SAFE_INTEGER, {
+                enforceRevocation: true,
+            });
+            if (hit && hit.grant.usernameHash === usernameHash && !seen.has(key)) {
+                seen.add(key);
+                result.push(hit.cert);
+            }
+        }
+        return result;
+    }
+    /**
+     * Every device certificate in `userdirectory`, with the trusted time its
+     * `doc_create` was accepted (`issuedAt`) and, when the person withdrew it,
+     * the trusted time of the first delete (`deletedAt`) (docs/userkeys.md §9.6).
+     *
+     * Unlike {@link listCertifiedDevices} nothing is filtered: revoked devices,
+     * withdrawn certificates and certificates of revoked delegations are listed
+     * too, so audit views can work out which certified devices a person had at
+     * any point in time. Whether a certificate is valid at `T` is still decided
+     * by {@link resolveSignerToGrant}.
+     */
+    async listDeviceCertificates() {
+        const index = await this.loadDeviceCertificateIndex();
+        const now = Date.now();
+        const result = [];
+        for (const records of index.values()) {
+            for (const record of records) {
+                const deletedAt = record.deleteMetas.length
+                    ? Math.min(...record.deleteMetas.map((meta) => (0, storeEntryTime_1.entryTrustedTime)(meta, now)))
+                    : undefined;
+                result.push({
+                    certificate: record.cert,
+                    issuedAt: (0, storeEntryTime_1.entryTrustedTime)(record.createMeta, now),
+                    ...(deletedAt !== undefined ? { deletedAt } : {}),
+                });
+            }
+        }
+        return result.sort((a, b) => a.issuedAt - b.issuedAt);
+    }
+    /**
+     * Read every `dcert_*` certificate from the `userdirectory` store without
+     * materializing that database (whose own trust checks call back into this
+     * index). Only `doc_create` entries carry a certificate; deletes withdraw
+     * it. Rebuilt when the store head moves, at most every two seconds for
+     * stores that cannot report a head.
+     */
+    async loadDeviceCertificateIndex() {
+        if (this.buildingDeviceCertIndex) {
+            // Re-entry while building: answer from what is known.
+            return this.deviceCertIndex?.byKey ?? new Map();
+        }
+        const baseTenant = this.tenant;
+        if (typeof baseTenant.getDocStoreForDb !== "function")
+            return new Map();
+        let store;
+        try {
+            store = baseTenant.getDocStoreForDb(types_1.USER_DIRECTORY_DB_ID);
+        }
+        catch {
+            return new Map();
+        }
+        const head = await store.getStoreHead?.().catch(() => undefined);
+        const stamp = head ? `${head.epoch}:${head.maxReceiptOrder}` : null;
+        const cached = this.deviceCertIndex;
+        if (cached && stamp !== null && cached.stamp === stamp)
+            return cached.byKey;
+        if (cached && stamp === null && Date.now() - cached.at < 2000)
+            return cached.byKey;
+        const build = (async () => {
+            const byKey = new Map();
+            const isCert = (m) => m.docId.startsWith(deviceCertificate_1.DEVICE_CERT_DOC_ID_PREFIX);
+            const creates = (await store.findEntries("doc_create", null, null)).filter(isCert);
+            if (creates.length === 0)
+                return byKey;
+            const deletes = (await store.findEntries("doc_delete", null, null)).filter(isCert);
+            const entries = await store.getEntries(creates.map((m) => m.id));
+            const crypto = this.tenant.getCryptoAdapter();
+            for (const entry of entries) {
+                try {
+                    const plaintext = await baseTenant.decryptPayload(entry.encryptedData, entry.decryptionKeyId);
+                    const cert = (0, deviceCertificate_1.asDeviceCertificate)((0, builtinDbInvariants_1.recordFromCreateChangeBytes)(plaintext));
+                    if (!cert || !(await (0, deviceCertificate_1.verifyDeviceCertificate)(crypto, cert)))
+                        continue;
+                    const createMeta = creates.find((m) => m.id === entry.id) ?? entry;
+                    const key = (0, fingerprint_1.normalizePublicKeyPem)(cert.deviceSigningPublicKey);
+                    const list = byKey.get(key) ?? [];
+                    list.push({
+                        cert,
+                        docId: entry.docId,
+                        createMeta,
+                        deleteMetas: deletes.filter((m) => m.docId === entry.docId),
+                    });
+                    byKey.set(key, list);
+                }
+                catch {
+                    // Not readable here (no $publicinfos) or not a certificate.
+                }
+            }
+            return byKey;
+        })();
+        this.buildingDeviceCertIndex = build;
+        try {
+            const byKey = await build;
+            this.deviceCertIndex = { stamp, at: Date.now(), byKey };
+            return byKey;
+        }
+        finally {
+            this.buildingDeviceCertIndex = null;
+        }
+    }
+    /**
+     * The person's device self-grant delegation at the head state
+     * (docs/userkeys.md §9), or `null` when the admin never granted it.
+     */
+    async getDeviceSelfGrantForUsernameHash(usernameHash) {
+        const head = await this.getDirectoryStateHead();
+        return head.usersByHash.get(usernameHash)?.deviceSelfGrant ?? null;
+    }
+    /** {@link getDeviceSelfGrantForUsernameHash} by username (newest grant wins). */
+    async getDeviceSelfGrant(username) {
+        const grants = await this.findGrantAccessDocuments(username);
+        return (0, grantKeys_1.newestDeviceSelfGrant)(grants.map((g) => (0, grantKeys_1.extractDeviceSelfGrant)(g.getData())));
+    }
+    /**
+     * Grant or revoke the person's right to certify their own devices
+     * (docs/userkeys.md §9). `signingPublicKey` is the public half of their
+     * device self-grant key (from the join request, or
+     * `tenant.getDeviceSelfGrantPublicKey()` on one of their devices). `null`
+     * revokes: the key stays on the grant with `revokedAt`, so certificates and
+     * generations signed before stay valid; certificates issued later do not.
+     */
+    async setDeviceSelfGrant(username, signingPublicKey, administrationPrivateKey, administrationPrivateKeyPassword) {
+        await this.updateUserGrant(username, { deviceSelfGrant: signingPublicKey }, administrationPrivateKey, administrationPrivateKeyPassword);
+    }
+    /**
+     * Trusted time from which new User-Key generations must be signed
+     * (`requireUserKeyGenerationSignatureSince`, docs/userkeys.md §9.3), or
+     * `undefined`. Read from the `acl_defaultpolicy` head regardless of the
+     * master switch, like {@link getRequireMetadataSignatureSince}.
+     */
+    async getRequireUserKeyGenerationSignatureSince() {
+        const head = await this.getDirectoryStateHead();
+        const since = head.defaultPolicy?.requireUserKeyGenerationSignatureSince;
+        return typeof since === "number" && Number.isFinite(since) ? since : undefined;
+    }
+    /**
+     * Require signed User-Key generations from now on (docs/userkeys.md §9.3).
+     * Idempotent: an existing cutoff is kept. Run it once every device of the
+     * tenant runs a client that signs generations; unsigned generations
+     * introduced before stay valid.
+     */
+    async requireUserKeyGenerationSignatures(administrationPrivateKey, administrationPrivateKeyPassword) {
+        const head = await this.getDirectoryStateHead();
+        const existing = head.defaultPolicy?.requireUserKeyGenerationSignatureSince;
+        if (typeof existing === "number" && Number.isFinite(existing)) {
+            return { since: existing, changed: false };
+        }
+        const since = (0, timeSource_1.semanticNow)();
+        await this.setDefaultAccessPolicy(head.defaultPolicy
+            ? { requireUserKeyGenerationSignatureSince: since }
+            : { disableAllAccessChecksAndPolicies: true, requireUserKeyGenerationSignatureSince: since }, administrationPrivateKey, administrationPrivateKeyPassword);
+        return { since, changed: true };
     }
     /**
      * Whether the active policy has any Tier 2 (`withfields`) content rule for
@@ -1242,8 +1774,7 @@ class BaseMindooTenantDirectory {
      */
     async canUseLlm() {
         const currentUser = await this.tenant.getCurrentUserId();
-        const adminKey = this.tenant.getAdministrationPublicKey();
-        if (currentUser.userSigningPublicKey === adminKey) {
+        if (await this.isAdminKeyNow(currentUser.userSigningPublicKey)) {
             return { allowed: true, reason: "tenant admin", tier: "tier1" };
         }
         // Head selector, NOT Date.now() — see canDo.
@@ -1310,8 +1841,7 @@ class BaseMindooTenantDirectory {
         if (allowedDbIds.includes(dbid))
             return true;
         if (opts?.signingKey !== undefined) {
-            const adminKey = this.tenant.getAdministrationPublicKey();
-            if (opts.signingKey === adminKey)
+            if (await this.isAdminKeyNow(opts.signingKey))
                 return true;
         }
         return false;
@@ -1335,9 +1865,8 @@ class BaseMindooTenantDirectory {
         // policy that defines the read gate can be read at all).
         if (input.dbid === types_1.DIRECTORY_DB_ID || input.dbid === types_1.USER_DIRECTORY_DB_ID)
             return true;
-        // The tenant admin is exempt from the read gate.
-        const adminKey = this.tenant.getAdministrationPublicKey();
-        if (input.signingKey === adminKey)
+        // Tenant admins (root and active delegated admins, §6.13) are exempt from the read gate.
+        if (await this.isAdminKeyNow(input.signingKey))
             return true;
         // Gate 2 — per-user/group database read gate (`doc_read`, §6.6). Evaluated
         // server-side (Tier 1) from the principal's signing key at acceptance time.
@@ -1363,8 +1892,7 @@ class BaseMindooTenantDirectory {
     async evaluateReadScopeForSigningKey(input) {
         if (input.dbid === types_1.DIRECTORY_DB_ID || input.dbid === types_1.USER_DIRECTORY_DB_ID)
             return "all";
-        const adminKey = this.tenant.getAdministrationPublicKey();
-        if (input.signingKey === adminKey)
+        if (await this.isAdminKeyNow(input.signingKey))
             return "all";
         const decision = await this.evaluateAccessForSigningKey({
             op: "doc_read_all",
@@ -1397,7 +1925,7 @@ class BaseMindooTenantDirectory {
         if (personal) {
             if (personal.mode === "none")
                 return personal;
-            if ((0, DirectoryStateNode_1.signingKeysEqual)(input.signingKey, this.tenant.getAdministrationPublicKey())) {
+            if (await this.isAdminKeyNow(input.signingKey)) {
                 return personal;
             }
             if (personal.mode === "read") {
@@ -1453,7 +1981,7 @@ class BaseMindooTenantDirectory {
         const owner = (0, builtinDbInvariants_1.personalDatabaseOwner)(input.dbid, head.defaultPolicy?.personalDatabasePrefixes ?? []);
         if (!owner)
             return null;
-        const isAdmin = (0, DirectoryStateNode_1.signingKeysEqual)(input.signingKey, this.tenant.getAdministrationPublicKey());
+        const isAdmin = await this.isAdminKeyNow(input.signingKey);
         if (isAdmin && owner.prefix !== "mbusy_") {
             return { mode: "read", reason: "tenant admin" };
         }
@@ -1461,6 +1989,12 @@ class BaseMindooTenantDirectory {
         if (grant && (0, grantKeys_1.extractActiveKeyPairs)(grant).some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, input.signingKey))) {
             return { mode: "read", reason: "a device of the owner" };
         }
+        if (grant && typeof grant.username_hash === "string") {
+            const certified = await this.resolveSignerInNode(head, input.signingKey, Number.MAX_SAFE_INTEGER);
+            if (certified?.via === "certificate" && certified.grant.usernameHash === grant.username_hash) {
+                return { mode: "read", reason: "a certified device of the owner" };
+            }
+        }
         // Free/busy (§6.11): the tenant admin reads every person's busy times but,
         // like every other member, does not write them (unless the admin key is a
         // device of the owner, checked above).
@@ -1559,10 +2093,17 @@ class BaseMindooTenantDirectory {
         if (!lookup)
             return [];
         const grants = await this.findGrantAccessDocuments(lookup.username);
-        return grants
+        const live = grants
             .filter((doc) => !doc.isDeleted())
-            .map((doc) => doc.getData())
-            .filter((data) => (0, grantKeys_1.extractActiveKeyPairs)(data).some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, signingKey)));
+            .map((doc) => doc.getData());
+        const listed = live.filter((data) => (0, grantKeys_1.extractActiveKeyPairs)(data).some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, signingKey)));
+        if (listed.length > 0)
+            return listed;
+        // A certified device acts under its person's grants (userkeys.md §9.6).
+        const certified = await this.resolveSignerToGrant(signingKey, Number.MAX_SAFE_INTEGER);
+        if (certified?.via !== "certificate")
+            return [];
+        return live.filter((data) => data.username_hash === certified.grant.usernameHash);
     }
     /**
      * Let an identity deposit into personal databases with these prefixes
@@ -1597,10 +2138,7 @@ class BaseMindooTenantDirectory {
         if (grants.length === 0)
             throw new Error(`No grant for ${username}`);
         const directoryDB = await this.getDirectoryDB();
-        const signingKeyPair = {
-            publicKey: this.tenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const signingKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         for (const grant of grants) {
             await directoryDB.changeDoc(grant, (d) => {
                 const data = d.getData();
@@ -1649,8 +2187,7 @@ class BaseMindooTenantDirectory {
         if (dbid === types_1.DIRECTORY_DB_ID || dbid === types_1.USER_DIRECTORY_DB_ID)
             return true;
         const currentUser = await this.tenant.getCurrentUserId();
-        const adminKey = this.tenant.getAdministrationPublicKey();
-        if (currentUser.userSigningPublicKey === adminKey)
+        if (await this.isAdminKeyNow(currentUser.userSigningPublicKey))
             return true;
         // The personal-database invariant (§6.11) decides first, policy on top.
         const personal = await this.evaluatePersonalDatabaseAccess({ dbid, signingKey: currentUser.userSigningPublicKey });
@@ -1707,10 +2244,7 @@ class BaseMindooTenantDirectory {
     async writePolicyDoc(docId, policy, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         const doc = await this.getOrCreateAclDoc(directoryDB, docId, adminSigningKeyPair, administrationPrivateKeyPassword);
         await directoryDB.changeDoc(doc, async (d) => {
             const data = d.getData();
@@ -1756,10 +2290,7 @@ class BaseMindooTenantDirectory {
         (0, types_3.validateAclRule)(ruleDoc);
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         const doc = await this.getOrCreateAclDoc(directoryDB, (0, types_3.aclRuleDocId)(rule.ruleId), adminSigningKeyPair, administrationPrivateKeyPassword);
         await directoryDB.changeDoc(doc, async (d) => {
             const data = d.getData();
@@ -1811,10 +2342,7 @@ class BaseMindooTenantDirectory {
     async deleteRule(ruleId, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         try {
             await directoryDB.deleteDocument((0, types_3.aclRuleDocId)(ruleId), {
                 signingKeyPair: adminSigningKeyPair,
@@ -1833,10 +2361,9 @@ class BaseMindooTenantDirectory {
     async addTrustedWitness(witness, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
+        // Trusted witnesses decide whose receipt times count (§6.13): root only.
+        await this.rootKeyPair(administrationPrivateKey, administrationPrivateKeyPassword, "add trusted witnesses");
         const fingerprint = await this.sha256Hex(witness.witnessPublicKey);
         const doc = await this.getOrCreateAclDoc(directoryDB, (0, types_2.aclTrustedWitnessDocId)(fingerprint), adminSigningKeyPair, administrationPrivateKeyPassword);
         await directoryDB.changeDoc(doc, async (d) => {
@@ -1853,10 +2380,8 @@ class BaseMindooTenantDirectory {
     async removeTrustedWitness(witnessPublicKey, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
+        await this.rootKeyPair(administrationPrivateKey, administrationPrivateKeyPassword, "remove trusted witnesses");
         const fingerprint = await this.sha256Hex(witnessPublicKey);
         try {
             await directoryDB.deleteDocument((0, types_2.aclTrustedWitnessDocId)(fingerprint), {
@@ -2076,6 +2601,15 @@ class BaseMindooTenantDirectory {
             ? await this.encryptUserDetailsForTenant(this.buildUserDetailsPayload(username, changes.details))
             : null;
         const identityHashes = await this.computeIdentityHashes(username);
+        // Devices this person certified (userkeys.md §9.6) can be revoked and
+        // wiped here like listed ones, although they are not on the grant.
+        const certifiedByHash = new Map();
+        for (const grant of await this.findGrantAccessDocuments(username)) {
+            const hash = grant.getData().username_hash;
+            if (typeof hash === "string" && !certifiedByHash.has(hash)) {
+                certifiedByHash.set(hash, await this.certificatesOfPerson(hash));
+            }
+        }
         await this.editGrantArrays(username, administrationPrivateKey, administrationPrivateKeyPassword, (data) => {
             if (userDetailsEncrypted !== null) {
                 data.user_details_encrypted = userDetailsEncrypted;
@@ -2107,12 +2641,52 @@ class BaseMindooTenantDirectory {
                 }
                 return p;
             });
-            (0, grantKeys_1.applyKeyPairFields)(data, next);
+            const certified = typeof data.username_hash === "string" ? certifiedByHash.get(data.username_hash) ?? [] : [];
+            const isCertifiedOnly = (key) => certified.some((c) => (0, DirectoryStateNode_1.signingKeysEqual)(c.deviceSigningPublicKey, key)) &&
+                !(0, grantKeys_1.extractActiveKeyPairs)(data).some((pair) => (0, DirectoryStateNode_1.signingKeysEqual)(pair.signingPublicKey, key));
+            for (const cert of certified) {
+                const key = cert.deviceSigningPublicKey;
+                if (!revokeSet.has(key) || next.some((p) => (0, DirectoryStateNode_1.signingKeysEqual)(p.signingPublicKey, key)))
+                    continue;
+                next.push({
+                    signingPublicKey: key,
+                    encryptionPublicKey: cert.deviceEncryptionPublicKey,
+                    ...(cert.label ? { label: cert.label } : {}),
+                    revoked: true,
+                    revokedAt: now,
+                });
+            }
+            // Restoring a certified device only lifts the revocation; it does not
+            // turn it into a device listed on the grant.
+            const kept = next.filter((p) => !(restoreSet.has(p.signingPublicKey) && isCertifiedOnly(p.signingPublicKey) && !p.revoked));
+            (0, grantKeys_1.applyKeyPairFields)(data, kept);
             // Remote-wipe set: authoritative when supplied (else preserve existing),
-            // restricted to keys present on this grant doc and never for restored keys.
-            const present = new Set(next.map((p) => p.signingPublicKey));
+            // restricted to keys present on this grant doc or certified by its
+            // person, and never for restored keys.
+            const present = new Set([
+                ...kept.map((p) => p.signingPublicKey),
+                ...certified.map((c) => c.deviceSigningPublicKey),
+            ]);
             const desiredWipe = changes.wipeSigningKeys ?? (0, grantKeys_1.extractWipeRequestedSigningKeys)(data);
             data.wipeRequestedForSigningKeys = Array.from(new Set(desiredWipe.filter((k) => present.has(k) && !restoreSet.has(k))));
+            if (changes.deviceSelfGrant !== undefined) {
+                const existing = (0, grantKeys_1.extractDeviceSelfGrant)(data);
+                if (changes.deviceSelfGrant === null) {
+                    if (existing && existing.revokedAt === undefined) {
+                        data.deviceSelfGrant = { ...existing, revokedAt: now };
+                    }
+                }
+                else {
+                    const key = changes.deviceSelfGrant.trim();
+                    if (!key)
+                        throw new Error("deviceSelfGrant must be a PEM public key or null");
+                    if (!existing ||
+                        existing.revokedAt !== undefined ||
+                        existing.signingPublicKey.replace(/\s+/g, "") !== key.replace(/\s+/g, "")) {
+                        data.deviceSelfGrant = { signingPublicKey: key, grantedAt: now };
+                    }
+                }
+            }
         });
     }
     /**
@@ -2398,10 +2972,7 @@ class BaseMindooTenantDirectory {
         const docId = (0, types_3.aclKeyDistributionDocId)(keyId);
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         const doc = await this.getOrCreateAclDoc(directoryDB, docId, adminSigningKeyPair, administrationPrivateKeyPassword);
         await directoryDB.changeDoc(doc, async (d) => {
             const data = d.getData();
@@ -2518,10 +3089,7 @@ class BaseMindooTenantDirectory {
     async deleteKeyDistribution(keyId, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         try {
             await directoryDB.deleteDocument((0, types_3.aclKeyDistributionDocId)(keyId), {
                 signingKeyPair: adminSigningKeyPair,
@@ -2778,10 +3346,7 @@ class BaseMindooTenantDirectory {
         const docId = (0, types_3.aclAppDistributionDocId)(appId);
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         const doc = await this.getOrCreateAclDoc(directoryDB, docId, adminSigningKeyPair, administrationPrivateKeyPassword);
         await directoryDB.changeDoc(doc, async (d) => {
             const data = d.getData();
@@ -2890,10 +3455,7 @@ class BaseMindooTenantDirectory {
     async deleteAppDistribution(appId, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         try {
             await directoryDB.deleteDocument((0, types_3.aclAppDistributionDocId)(appId), {
                 signingKeyPair: adminSigningKeyPair,
@@ -3017,10 +3579,7 @@ class BaseMindooTenantDirectory {
         const docId = (0, types_3.aclSyncSetupPolicyDocId)(policyId);
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         const doc = await this.getOrCreateAclDoc(directoryDB, docId, adminSigningKeyPair, administrationPrivateKeyPassword);
         await directoryDB.changeDoc(doc, async (d) => {
             const data = d.getData();
@@ -3130,10 +3689,7 @@ class BaseMindooTenantDirectory {
     async deleteSyncSetupPolicy(policyId, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         try {
             await directoryDB.deleteDocument((0, types_3.aclSyncSetupPolicyDocId)(policyId), {
                 signingKeyPair: adminSigningKeyPair,
@@ -3212,7 +3768,7 @@ class BaseMindooTenantDirectory {
      * server-readable and carries every variant.
      */
     async getRevokedDecryptionKeyIdsForSigningKey(signingKey) {
-        if (signingKey === this.tenant.getAdministrationPublicKey())
+        if (await this.isAdminKeyNow(signingKey))
             return [];
         const lookup = await this.getUserBySigningPublicKey(signingKey);
         if (!lookup)
@@ -3290,10 +3846,7 @@ class BaseMindooTenantDirectory {
         }
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         for (const grant of grants) {
             const doc = await directoryDB.getDocument(grant.getId());
             await directoryDB.changeDoc(doc, async (d) => {
@@ -3325,9 +3878,9 @@ class BaseMindooTenantDirectory {
      */
     async identitySetForSigningKey(signingKey, node, opts) {
         // The tenant admin key is the root of trust and is resolved even without a
-        // grant document (it authors the directory itself).
-        const adminKey = this.tenant.getAdministrationPublicKey();
-        const isAdmin = signingKey === adminKey;
+        // grant document (it authors the directory itself). Delegated admin keys
+        // (§6.13) count while their window covers the evaluation time.
+        const isAdmin = (0, DirectoryStateNode_1.isAdminInNode)(node, this.getRootAdminPublicKey(), signingKey, (0, adminKeys_1.adminDecisionTime)(opts.trustedTime ?? Number.MAX_SAFE_INTEGER, (0, timeSource_1.semanticNow)()));
         // Audit #4 (revocation lag): resolve the acting identity strictly from the
         // directory state at the entry's trusted time `T`. A signing key that was
         // not an ACTIVE grant at `T` carries only the pseudo-tokens
@@ -3337,7 +3890,8 @@ class BaseMindooTenantDirectory {
         // allow-rules until the trust cache refreshed (up to
         // DIRECTORY_SYNC_INTERVAL_MS later). The `node` is the time-`T` snapshot
         // whose `bySigningKey` only contains keys whose grant is active at `T`.
-        const grantedAtT = !!(0, DirectoryStateNode_1.grantForSigningKey)(node, signingKey);
+        // A certified device (userkeys.md §9.6) acts for its person like a listed one.
+        const grantedAtT = !!(await this.resolveSignerInNode(node, signingKey, opts.trustedTime ?? node.trustedTimeUpperBound));
         // Resolve the author's username from their signing key. Trusted non-user
         // keys (e.g. server-to-server sync identities) have no grant; treat them as
         // an empty identity that still carries `$everyone`/`$author`. Keys that were
@@ -3560,6 +4114,30 @@ class BaseMindooTenantDirectory {
             if (key.replace(/\s+/g, "") === needle)
                 return lookup;
         }
+        // A device the person certified (userkeys.md §9.6). Like the cache above,
+        // this keeps naming the person after the device was revoked; callers that
+        // need "active" check the signing-key universe or resolveSignerToGrant.
+        const certified = await this.certifiedGrantInNode(await this.getDirectoryStateHead(), publicKey, Number.MAX_SAFE_INTEGER, { enforceRevocation: false });
+        if (!certified)
+            return null;
+        const personKeys = [
+            ...certified.grant.signingKeys,
+            ...(certified.grant.revokedSigningKeys ?? []),
+        ];
+        for (const personKey of personKeys) {
+            const lookup = this.userLookupCache.get(personKey) ??
+                [...this.userLookupCache.entries()].find(([k]) => (0, DirectoryStateNode_1.signingKeysEqual)(k, personKey))?.[1];
+            if (lookup) {
+                // Device-specific fields come from the certificate; a join response
+                // wrapped for another device of the person must not be handed out.
+                const { joinResponseWrapped: _other, ...personLookup } = lookup;
+                return {
+                    ...personLookup,
+                    signingPublicKey: certified.cert.deviceSigningPublicKey,
+                    encryptionPublicKey: certified.cert.deviceEncryptionPublicKey,
+                };
+            }
+        }
         return null;
     }
     /**
@@ -3577,14 +4155,27 @@ class BaseMindooTenantDirectory {
         const grants = await this.findGrantAccessDocuments(username);
         const active = new Set();
         const wipeRequested = new Set();
+        const revokedPairs = new Set();
+        const hashes = new Set();
         for (const grant of grants) {
             const data = grant.getData();
             for (const key of (0, grantKeys_1.extractSigningPublicKeys)(data))
                 active.add(key);
             for (const key of (0, grantKeys_1.extractWipeRequestedSigningKeys)(data))
                 wipeRequested.add(key);
+            for (const pair of (0, grantKeys_1.extractRevokedKeyPairs)(data))
+                revokedPairs.add(pair.signingPublicKey);
+            if (typeof data.username_hash === "string")
+                hashes.add(data.username_hash);
         }
-        return { active: Array.from(active), wipeRequested: Array.from(wipeRequested) };
+        // Devices the person certified count as active (userkeys.md §9.6).
+        for (const hash of hashes) {
+            for (const cert of await this.listCertifiedDevices(hash))
+                active.add(cert.deviceSigningPublicKey);
+        }
+        // A key revoked on one grant but active on another (or restored) is active.
+        const revoked = [...revokedPairs].filter((key) => ![...active].some((other) => (0, DirectoryStateNode_1.signingKeysEqual)(other, key)));
+        return { active: Array.from(active), wipeRequested: Array.from(wipeRequested), revoked };
     }
     /**
      * List a user's currently-granted device key pairs (§6.5), each with its
@@ -3666,10 +4257,7 @@ class BaseMindooTenantDirectory {
         const requestedAt = (0, timeSource_1.semanticNow)();
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         const doc = await this.getOrCreateAclDoc(directoryDB, docId, adminSigningKeyPair, administrationPrivateKeyPassword);
         await directoryDB.changeDoc(doc, async (d) => {
             const data = d.getData();
@@ -3748,10 +4336,7 @@ class BaseMindooTenantDirectory {
     async deleteDocHistoryPurge(requestId, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         try {
             await directoryDB.deleteDocument((0, types_3.aclDocHistoryPurgeDocId)(requestId), {
                 signingKeyPair: adminSigningKeyPair,
@@ -3800,10 +4385,7 @@ class BaseMindooTenantDirectory {
     async changeTenantSettings(changeFunc, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         // Get cached settings doc or create new one
         let settingsDoc = await this.getTenantSettings();
         if (!settingsDoc) {
@@ -3827,10 +4409,7 @@ class BaseMindooTenantDirectory {
     async changeDBSettings(dbId, changeFunc, administrationPrivateKey, administrationPrivateKeyPassword) {
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         // Get cached settings doc for this dbId or create new one
         let settingsDoc = await this.getDBSettings(dbId);
         if (!settingsDoc) {
@@ -3885,10 +4464,7 @@ class BaseMindooTenantDirectory {
         const normalizedGroupName = this.normalizeGroupName(groupName);
         const baseTenant = this.tenant;
         const directoryDB = await this.getDirectoryDB();
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         // Compute hashes (salted v2 for new writes) and encrypted values for all
         // new usernames. Reads match both v1 and v2 forms (docs/accesscontrol.md §6.5).
         const newMembersHashes = await Promise.all(username.map(u => this.hashUsernameForWrite(u)));
@@ -3958,10 +4534,7 @@ class BaseMindooTenantDirectory {
             // Group doesn't exist, nothing to do
             return;
         }
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         // Compute hashes of usernames to remove. Include both legacy (v1) and
         // salted (v2) forms so members stored under either scheme are removed.
         const hashesToRemove = new Set((await Promise.all(username.map(u => this.usernameHashCandidates(u)))).flat());
@@ -4020,10 +4593,7 @@ class BaseMindooTenantDirectory {
             // Group doesn't exist, nothing to do
             return;
         }
-        const adminSigningKeyPair = {
-            publicKey: baseTenant.getAdministrationPublicKey(),
-            privateKey: administrationPrivateKey,
-        };
+        const adminSigningKeyPair = await this.adminKeyPair(administrationPrivateKey, administrationPrivateKeyPassword);
         // Delete the document using the proper API
         await directoryDB.deleteDocument(cachedGroup.docId, {
             signingKeyPair: adminSigningKeyPair,