mindoodb 0.0.1

package/README.md

@@ -0,0 +1,263 @@
+# MindooDB - Your Data. Your Control.
+
+**Sleep well, even if your hosting service gets hacked.** 🔒
+
+MindooDB is an **end-to-end encrypted, offline-first sync database**.
+It lets apps collaborate and sync data without giving servers access to the contents.
+
+Even if someone has full access to your infrastructure — database dumps, backups, logs — all they get is ciphertext.
+
+Your data is encrypted on the client before it ever touches a server. No plaintext. No server-side keys. No trust required.
+
+> ⚠️ **Alpha software**: This project is in early development and not yet recommended for production use. APIs may change without notice.
+
+
+## The Problem
+
+Traditional databases trust the server. If your hosting provider is compromised, your data is exposed. Even "encrypted at rest" solutions decrypt data server-side for queries. **MindooDB takes a different approach**: encryption keys never leave your clients.
+
+## How It Works
+
+```
+┌──────────────────────────────────────────────────────────────────┐
+│                         Your Clients                             │
+│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐               │
+│  │   Alice's   │  │    Bob's    │  │  Charlie's  │               │
+│  │   Device    │  │   Device    │  │   Device    │               │
+│  │ ┌─────────┐ │  │ ┌─────────┐ │  │ ┌─────────┐ │               │
+│  │ │  Keys   │ │  │ │  Keys   │ │  │ │  Keys   │ │ ← Keys stay   │
+│  │ │(private)│ │  │ │(private)│ │  │ │(private)│ │   on devices  │
+│  │ └─────────┘ │  │ └─────────┘ │  │ └─────────┘ │               │
+│  └──────┬──────┘  └──────┬──────┘  └──────┬──────┘               │
+└─────────┼────────────────┼────────────────┼──────────────────────┘
+          │ encrypted      │ encrypted      │ encrypted
+          ▼                ▼                ▼
+┌──────────────────────────────────────────────────────────────────┐
+│                     Server (or P2P Peers)                        │
+│                                                                  │
+│   ┌─────────────────────────────────────────────────────────┐    │
+│   │           Encrypted Blobs (unreadable)                  │    │
+│   │     🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒 🔒             │    │
+│   └─────────────────────────────────────────────────────────┘    │
+│                                                                  │
+│   Server can sync & store data, but CANNOT read it               │
+└──────────────────────────────────────────────────────────────────┘
+```
+
+**Sync happens through content-addressed stores**: clients exchange only the encrypted entries they're missing. Works peer-to-peer, client-server, or any combination.
+
+## Key Features
+
+| Feature | What It Means |
+|---------|---------------|
+| 🛡️ **End-to-End Encrypted** | Data encrypted on client before sync. Servers can't decrypt. |
+| 📴 **Offline-First** | Create and edit documents without network. Sync when online. |
+| ✍️ **Signed Changes** | Every change is digitally signed. Proves authorship, prevents tampering. |
+| 🔗 **Tamperproof History** | Append-only, cryptographically chained. Like a blockchain for your docs. |
+| 🤝 **Real-time Collaboration** | Built on [Automerge](https://automerge.org/) CRDTs. Conflicts resolve automatically. |
+| 🔑 **Fine-grained Access** | Named encryption keys for sensitive documents. Share with specific users. |
+
+## Quick Start
+
+### Installation
+
+```bash
+npm install mindoodb
+```
+
+### Create a Tenant and Start Working
+
+```typescript
+import { 
+  BaseMindooTenantFactory, 
+  InMemoryAppendOnlyStoreFactory,
+  KeyBag 
+} from "mindoodb";
+
+// 1. Set up storage (in-memory for demo; use file/server-backed for production)
+const storeFactory = new InMemoryAppendOnlyStoreFactory();
+const factory = new BaseMindooTenantFactory(storeFactory);
+
+// 2. Create a user (generates signing + encryption key pairs)
+const user = await factory.createUserId("CN=alice/O=acme", "user-password");
+const keyBag = new KeyBag(user.userEncryptionKeyPair.privateKey, "user-password");
+
+// 3. Create admin keys (for managing users)
+const adminKeyPair = await factory.createSigningKeyPair("admin-password");
+
+// 4. Create a tenant (an organization that shares documents)
+const tenant = await factory.createTenant(
+  "acme-corp",
+  adminKeyPair.publicKey,
+  "tenant-key-password",
+  user,
+  "user-password",
+  keyBag
+);
+
+// 5. Open a database and create documents
+const db = await tenant.openDB("contacts");
+const doc = await db.createDocument();
+
+await db.changeDoc(doc, async (d) => {
+  const data = d.getData();
+  data.name = "John Doe";
+  data.email = "john@example.com";
+});
+
+// 6. Read it back
+const contacts = await db.getAllDocumentIds();
+const loaded = await db.getDocument(contacts[0]);
+console.log(loaded.getData()); // { name: "John Doe", email: "john@example.com" }
+```
+
+### Sync Between Users
+
+```typescript
+// Alice creates a document
+const aliceDB = await aliceTenant.openDB("projects");
+const project = await aliceDB.createDocument();
+await aliceDB.changeDoc(project, (d) => { d.getData().title = "Secret Project"; });
+
+// Bob pulls Alice's changes
+const bobDB = await bobTenant.openDB("projects");
+await bobDB.pullChangesFrom(aliceDB.getStore());
+
+// Bob edits the document
+const projectDoc = await bobDB.getDocument(project.id);
+await bobDB.changeDoc(projectDoc, (d) => { d.getData().status = "In Progress"; });
+
+// Alice pulls Bob's changes
+await aliceDB.pullChangesFrom(bobDB.getStore());
+// Alice now sees: { title: "Secret Project", status: "In Progress" }
+```
+
+## Core Concepts
+
+### Tenants
+An organization or team that shares access. Created client-side—no server registration needed.
+- Has a **default encryption key** (a regular KeyBag key shared with all members)
+- Has an **admin key** (for registering/revoking users)
+- Contains multiple databases
+
+### Users
+Identified by cryptographic key pairs, registered by an admin:
+- **Signing key** (Ed25519): Proves authorship of changes
+- **Encryption key** (RSA-OAEP): Protects local key storage
+- Keys generated locally; only public keys shared with admin
+
+### Databases
+Each tenant can have multiple databases, created on-demand:
+```typescript
+const contacts = await tenant.openDB("contacts");
+const invoices = await tenant.openDB("invoices");
+```
+A special **directory** database stores user registrations (admin-only).
+
+### Documents
+[Automerge](https://automerge.org/) CRDTs with full history:
+- Every change is signed and encrypted
+- Automatic conflict resolution for concurrent edits
+- Time travel: reconstruct any historical state of documents (e.g. run queries on historic data)
+
+### Attachments
+Files attached to documents:
+- Chunked (256KB) and encrypted
+- Streaming upload/download for large files
+- Deduplication across the tenant
+
+See: [Attachments Documentation](./docs/attachments.md)
+
+### Document Indexing
+MindooDB provides a flexible, **incremental indexing** facility:
+- **Cursor-based processing**: Only index documents that changed since the last run—no full rescans
+- **Pluggable indexers**: Add any indexer you need (fulltext search, aggregations, custom queries)
+- **Built-in [Virtual Views](./docs/virtualview.md)**: Spreadsheet-like views that categorize, sort, and aggregate documents
+- **Cross-boundary queries**: Virtual Views can span multiple databases, mix local and remote data, or even query across tenants
+
+```typescript
+// Incremental indexing: process only what's new
+let cursor = null;
+while (true) {
+  const { documents, cursor: newCursor } = await db.processChangesSince(cursor);
+  for (const doc of documents) {
+    if (doc.isDeleted()) {
+      mySearchIndex.remove(doc.id);
+    } else {
+      mySearchIndex.update(doc);  // Flexsearch, Lunr, or custom
+    }
+  }
+  cursor = newCursor;
+  await sleep(1000);
+}
+```
+
+### Encryption Model
+
+All encryption keys are stored in the **KeyBag**—a local, password-protected key store.
+
+| Key Type | Purpose | Who Has It |
+|----------|---------|------------|
+| **`default` key** | Used when no other key is specified | All tenant members |
+| **Named keys** | Fine-grained access for sensitive docs | Only users you share it with |
+
+Keys are distributed offline (email, phone, in-person). The `default` key is typically shared during onboarding; named keys are shared as needed for specific documents.
+
+## Security
+
+### Cryptographic Guarantees
+- **Signatures**: Ed25519 on every change—proves who wrote it
+- **Encryption**: AES-256-GCM—servers see only ciphertext
+- **Integrity**: Changes are hash-chained—tampering breaks the chain
+
+### User Revocation
+Revoked users:
+- ❌ Cannot sync with peers or servers
+- ❌ Cannot make new changes (signatures rejected)
+- ⚠️ Can still read previously-synced data (fundamental trade-off of E2E encryption)
+
+MindooDB includes **revocation timestamp protection** to prevent backdated changes from revoked users. See: [Revocation Protection](./docs/revocation-timestamp-protection.md)
+
+### Audit Trail
+Append-only storage means nothing is ever deleted:
+- Complete history of who changed what and when
+- Cryptographic proof of all operations
+- GDPR compliance via `purgeDocHistory()` when legally required
+
+## Use Cases
+
+- **Multi-Tenant SaaS**: Each customer isolated with encrypted data
+- **Collaborative Editing**: Real-time co-editing with signed changes
+- **Secure File Sharing**: Named keys for need-to-know access
+- **Audit-Critical Systems**: Tamperproof history meets compliance requirements
+- **Offline-First Apps**: Full functionality without network; sync when connected
+
+See: [Use Cases Documentation](./docs/usecases/README.md)
+
+## Documentation
+
+- [Architecture Specification](./docs/specification.md) — Full technical details
+- [Virtual Views](./docs/virtualview.md) — Aggregations and cross-database views
+- [Data Indexing](./docs/dataindexing.md) — Incremental indexing and search integration
+- [P2P Sync](./docs/p2psync.md) — Peer-to-peer synchronization
+- [Attachments](./docs/attachments.md) — File storage and streaming
+
+## Support
+
+Need help, have questions, or want to request a feature? We're here to help! :-)
+
+- 🐛 **Bug Reports**: [Open an issue on GitHub](https://github.com/klehmann/mindoodb/issues)
+- 💬 **Questions & Discussions**: [GitHub Discussions](https://github.com/klehmann/mindoodb/discussions)
+- ✨ **Feature Requests**: [Create a feature request](https://github.com/klehmann/mindoodb/issues/new?template=feature_request.md)
+
+## License
+
+Apache 2.0
+
+## Author
+
+Mindoo GmbH
+
+---
+
+**Your data. Your keys. Your control.** With MindooDB, even a complete server breach doesn't expose your documents. Sleep well! 😴🔒

package/dist/appendonlystores/InMemoryContentAddressedStoreFactory.d.ts

@@ -0,0 +1,5 @@
+import { ContentAddressedStoreFactory, CreateStoreResult, OpenStoreOptions } from "../core/types";
+export declare class InMemoryContentAddressedStoreFactory implements ContentAddressedStoreFactory {
+    createStore(dbId: string, _options?: OpenStoreOptions): CreateStoreResult;
+}
+//# sourceMappingURL=InMemoryContentAddressedStoreFactory.d.ts.map

package/dist/appendonlystores/InMemoryContentAddressedStoreFactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryContentAddressedStoreFactory.d.ts","sourceRoot":"","sources":["../../src/appendonlystores/InMemoryContentAddressedStoreFactory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAElG,qBAAa,oCAAqC,YAAW,4BAA4B;IACvF,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,iBAAiB;CAS1E"}

package/dist/appendonlystores/InMemoryContentAddressedStoreFactory.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryContentAddressedStoreFactory = void 0;
+const InMemoryContentAddressedStore_1 = require("../core/appendonlystores/InMemoryContentAddressedStore");
+class InMemoryContentAddressedStoreFactory {
+    createStore(dbId, _options) {
+        // For in-memory stores, we use a single store for both documents and attachments
+        // (no separate attachment store needed for simple/test scenarios)
+        // Note: options are ignored for in-memory stores but accepted for interface compatibility
+        return {
+            docStore: new InMemoryContentAddressedStore_1.InMemoryContentAddressedStore(dbId),
+            // attachmentStore not provided - will use docStore for attachments
+        };
+    }
+}
+exports.InMemoryContentAddressedStoreFactory = InMemoryContentAddressedStoreFactory;
+//# sourceMappingURL=InMemoryContentAddressedStoreFactory.js.map

package/dist/appendonlystores/InMemoryContentAddressedStoreFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InMemoryContentAddressedStoreFactory.js","sourceRoot":"","sources":["../../src/appendonlystores/InMemoryContentAddressedStoreFactory.ts"],"names":[],"mappings":";;;AAAA,0GAAuG;AAGvG,MAAa,oCAAoC;IAC/C,WAAW,CAAC,IAAY,EAAE,QAA2B;QACnD,iFAAiF;QACjF,kEAAkE;QAClE,0FAA0F;QAC1F,OAAO;YACL,QAAQ,EAAE,IAAI,6DAA6B,CAAC,IAAI,CAAC;YACjD,mEAAmE;SACpE,CAAC;IACJ,CAAC;CACF;AAVD,oFAUC"}

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.d.ts

@@ -0,0 +1,111 @@
+import type { ContentAddressedStore } from "../../core/types";
+import type { StoreEntry, StoreEntryMetadata } from "../../core/types";
+import type { CryptoAdapter } from "../../core/crypto/CryptoAdapter";
+import type { NetworkTransport } from "../../core/appendonlystores/network/NetworkTransport";
+/**
+ * Client-side network ContentAddressedStore that forwards all operations to a remote server.
+ *
+ * This store acts as a pure remote proxy:
+ * 1. All read/write operations are forwarded to the remote server
+ * 2. Authenticates with the remote peer using challenge-response
+ * 3. Decrypts RSA-encrypted entries received from the network
+ *
+ * Usage patterns:
+ * 1. **Direct remote**: Instantiate MindooDB with ClientNetworkContentAddressedStore for
+ *    transparent remote read/write operations.
+ * 2. **Sync-based**: Use a local store (e.g., InMemoryContentAddressedStore) with MindooDB,
+ *    then sync with a ClientNetworkContentAddressedStore via pullChangesFrom/pushChangesTo.
+ */
+export declare class ClientNetworkContentAddressedStore implements ContentAddressedStore {
+    private dbId;
+    private transport;
+    private rsaEncryption;
+    private privateEncryptionKey;
+    private username;
+    private signingKey;
+    private cryptoAdapter;
+    private accessToken;
+    private tokenExpiry;
+    /**
+     * Create a new ClientNetworkContentAddressedStore.
+     *
+     * @param dbId The database ID
+     * @param transport The network transport for remote communication
+     * @param cryptoAdapter The crypto adapter for encryption
+     * @param username The username for authentication
+     * @param signingKey The user's private signing key (for signing challenges)
+     * @param privateEncryptionKey The user's private RSA key (for decrypting received entries)
+     */
+    constructor(dbId: string, transport: NetworkTransport, cryptoAdapter: CryptoAdapter, username: string, signingKey: CryptoKey, privateEncryptionKey: CryptoKey | string);
+    getId(): string;
+    /**
+     * Store entries to the remote store.
+     * The entries are pushed to the server immediately.
+     */
+    putEntries(entries: StoreEntry[]): Promise<void>;
+    /**
+     * Get entries from the remote store by their IDs.
+     *
+     * @param ids The IDs of entries to retrieve
+     * @returns The entries with decrypted payloads
+     */
+    getEntries(ids: string[]): Promise<StoreEntry[]>;
+    /**
+     * Check which IDs exist in the remote store.
+     *
+     * @param ids The IDs to check
+     * @returns List of IDs that exist in the remote store
+     */
+    hasEntries(ids: string[]): Promise<string[]>;
+    /**
+     * Find new entries from the remote store.
+     *
+     * @param knownIds The list of entry IDs we already have
+     * @returns List of new entry metadata from the remote store
+     */
+    findNewEntries(knownIds: string[]): Promise<StoreEntryMetadata[]>;
+    /**
+     * Find new entries for a specific document from the remote store.
+     */
+    findNewEntriesForDoc(knownIds: string[], docId: string): Promise<StoreEntryMetadata[]>;
+    /**
+     * Get all entry IDs from the remote store.
+     * Used for synchronization to identify which entries the remote has.
+     */
+    getAllIds(): Promise<string[]>;
+    /**
+     * Resolve dependencies for an entry.
+     *
+     * Delegates to the remote server for efficient server-side traversal.
+     */
+    resolveDependencies(startId: string, options?: Record<string, unknown>): Promise<string[]>;
+    /**
+     * Purge document history from the store.
+     *
+     * Note: Network stores are proxies that forward operations to remote servers.
+     * Purging should be done on local stores after syncing data from remote stores.
+     * This method is a no-op for network stores.
+     *
+     * @param docId The document ID whose entry history should be purged
+     */
+    purgeDocHistory(docId: string): Promise<void>;
+    /**
+     * Ensure we have a valid access token, authenticating if necessary.
+     */
+    private ensureAuthenticated;
+    /**
+     * Sign a challenge with the user's private signing key.
+     */
+    private signChallenge;
+    /**
+     * Decrypt network-encrypted entries.
+     * Transforms NetworkEncryptedEntry[] to StoreEntry[].
+     */
+    private decryptNetworkEntries;
+    /**
+     * Clear the cached access token.
+     * Call this if you need to force re-authentication.
+     */
+    clearAuthCache(): void;
+}
+//# sourceMappingURL=ClientNetworkContentAddressedStore.d.ts.map

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientNetworkContentAddressedStore.d.ts","sourceRoot":"","sources":["../../../src/appendonlystores/network/ClientNetworkContentAddressedStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAK7F;;;;;;;;;;;;;GAaG;AACH,qBAAa,kCAAmC,YAAW,qBAAqB;IAC9E,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,aAAa,CAAgB;IAGrC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAa;IAEhC;;;;;;;;;OASG;gBAED,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,gBAAgB,EAC3B,aAAa,EAAE,aAAa,EAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,SAAS,EACrB,oBAAoB,EAAE,SAAS,GAAG,MAAM;IAW1C,KAAK,IAAI,MAAM;IAIf;;;OAGG;IACG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAatD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAmBtD;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAclD;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAUvE;;OAEG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAU5F;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpC;;;;OAIG;IACG,mBAAmB,CACvB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC;IAUpB;;;;;;;;OAQG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD;;OAEG;YACW,mBAAmB;IA8CjC;;OAEG;YACW,aAAa;IAa3B;;;OAGG;YACW,qBAAqB;IAkCnC;;;OAGG;IACH,cAAc,IAAI,IAAI;CAIvB"}

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.js

@@ -0,0 +1,237 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClientNetworkContentAddressedStore = void 0;
+const types_1 = require("../../core/appendonlystores/network/types");
+const RSAEncryption_1 = require("../../core/crypto/RSAEncryption");
+/**
+ * Client-side network ContentAddressedStore that forwards all operations to a remote server.
+ *
+ * This store acts as a pure remote proxy:
+ * 1. All read/write operations are forwarded to the remote server
+ * 2. Authenticates with the remote peer using challenge-response
+ * 3. Decrypts RSA-encrypted entries received from the network
+ *
+ * Usage patterns:
+ * 1. **Direct remote**: Instantiate MindooDB with ClientNetworkContentAddressedStore for
+ *    transparent remote read/write operations.
+ * 2. **Sync-based**: Use a local store (e.g., InMemoryContentAddressedStore) with MindooDB,
+ *    then sync with a ClientNetworkContentAddressedStore via pullChangesFrom/pushChangesTo.
+ */
+class ClientNetworkContentAddressedStore {
+    /**
+     * Create a new ClientNetworkContentAddressedStore.
+     *
+     * @param dbId The database ID
+     * @param transport The network transport for remote communication
+     * @param cryptoAdapter The crypto adapter for encryption
+     * @param username The username for authentication
+     * @param signingKey The user's private signing key (for signing challenges)
+     * @param privateEncryptionKey The user's private RSA key (for decrypting received entries)
+     */
+    constructor(dbId, transport, cryptoAdapter, username, signingKey, privateEncryptionKey) {
+        // Cached access token
+        this.accessToken = null;
+        this.tokenExpiry = 0;
+        this.dbId = dbId;
+        this.transport = transport;
+        this.cryptoAdapter = cryptoAdapter;
+        this.rsaEncryption = new RSAEncryption_1.RSAEncryption(cryptoAdapter);
+        this.username = username;
+        this.signingKey = signingKey;
+        this.privateEncryptionKey = privateEncryptionKey;
+    }
+    getId() {
+        return this.dbId;
+    }
+    /**
+     * Store entries to the remote store.
+     * The entries are pushed to the server immediately.
+     */
+    async putEntries(entries) {
+        if (entries.length === 0) {
+            return;
+        }
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Pushing ${entries.length} entries to remote`);
+        const token = await this.ensureAuthenticated();
+        await this.transport.putEntries(token, entries);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Successfully pushed ${entries.length} entries`);
+    }
+    /**
+     * Get entries from the remote store by their IDs.
+     *
+     * @param ids The IDs of entries to retrieve
+     * @returns The entries with decrypted payloads
+     */
+    async getEntries(ids) {
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Getting ${ids.length} entries from remote`);
+        if (ids.length === 0) {
+            return [];
+        }
+        const token = await this.ensureAuthenticated();
+        const encryptedEntries = await this.transport.getEntries(token, ids);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Received ${encryptedEntries.length} encrypted entries from remote`);
+        // Decrypt the RSA layer for each entry
+        const entries = await this.decryptNetworkEntries(encryptedEntries);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Decrypted ${entries.length} entries`);
+        return entries;
+    }
+    /**
+     * Check which IDs exist in the remote store.
+     *
+     * @param ids The IDs to check
+     * @returns List of IDs that exist in the remote store
+     */
+    async hasEntries(ids) {
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Checking ${ids.length} IDs in remote`);
+        if (ids.length === 0) {
+            return [];
+        }
+        const token = await this.ensureAuthenticated();
+        const existingIds = await this.transport.hasEntries(token, ids);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Found ${existingIds.length} existing entries`);
+        return existingIds;
+    }
+    /**
+     * Find new entries from the remote store.
+     *
+     * @param knownIds The list of entry IDs we already have
+     * @returns List of new entry metadata from the remote store
+     */
+    async findNewEntries(knownIds) {
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Finding new entries from remote`);
+        const token = await this.ensureAuthenticated();
+        const newEntries = await this.transport.findNewEntries(token, knownIds);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Found ${newEntries.length} new entries from remote`);
+        return newEntries;
+    }
+    /**
+     * Find new entries for a specific document from the remote store.
+     */
+    async findNewEntriesForDoc(knownIds, docId) {
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Finding new entries for doc ${docId} from remote`);
+        const token = await this.ensureAuthenticated();
+        const newEntries = await this.transport.findNewEntriesForDoc(token, knownIds, docId);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Found ${newEntries.length} new entries for doc ${docId}`);
+        return newEntries;
+    }
+    /**
+     * Get all entry IDs from the remote store.
+     * Used for synchronization to identify which entries the remote has.
+     */
+    async getAllIds() {
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Getting all entry IDs from remote`);
+        const token = await this.ensureAuthenticated();
+        const allIds = await this.transport.getAllIds(token);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Remote has ${allIds.length} entry IDs`);
+        return allIds;
+    }
+    /**
+     * Resolve dependencies for an entry.
+     *
+     * Delegates to the remote server for efficient server-side traversal.
+     */
+    async resolveDependencies(startId, options) {
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Resolving dependencies for ${startId}`);
+        const token = await this.ensureAuthenticated();
+        const resolvedIds = await this.transport.resolveDependencies(token, startId, options);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Resolved ${resolvedIds.length} dependencies`);
+        return resolvedIds;
+    }
+    /**
+     * Purge document history from the store.
+     *
+     * Note: Network stores are proxies that forward operations to remote servers.
+     * Purging should be done on local stores after syncing data from remote stores.
+     * This method is a no-op for network stores.
+     *
+     * @param docId The document ID whose entry history should be purged
+     */
+    async purgeDocHistory(docId) {
+        console.warn(`[ClientNetworkContentAddressedStore:${this.dbId}] purgeDocHistory() called on network store for doc ${docId}. Network stores do not support purging directly. Purge should be done on local stores after syncing from remote.`);
+        // No-op: Network stores forward to server, purging should be done on local stores
+    }
+    /**
+     * Ensure we have a valid access token, authenticating if necessary.
+     */
+    async ensureAuthenticated() {
+        const now = Date.now();
+        // Check if we have a valid token
+        if (this.accessToken && this.tokenExpiry > now + 60000) { // 1 minute buffer
+            return this.accessToken;
+        }
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Authenticating user: ${this.username}`);
+        // Request a challenge
+        const challenge = await this.transport.requestChallenge(this.username);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Received challenge: ${challenge}`);
+        // Sign the challenge
+        const signature = await this.signChallenge(challenge);
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Signed challenge`);
+        // Authenticate
+        const result = await this.transport.authenticate(challenge, signature);
+        if (!result.success || !result.token) {
+            throw new types_1.NetworkError(types_1.NetworkErrorType.INVALID_SIGNATURE, result.error || "Authentication failed");
+        }
+        this.accessToken = result.token;
+        // Parse token expiry from JWT (simple extraction)
+        try {
+            const parts = result.token.split(".");
+            if (parts.length === 3) {
+                const payload = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
+                this.tokenExpiry = payload.exp * 1000; // Convert to milliseconds
+            }
+        }
+        catch {
+            // Default to 1 hour if we can't parse
+            this.tokenExpiry = now + 3600000;
+        }
+        console.log(`[ClientNetworkContentAddressedStore:${this.dbId}] Authentication successful`);
+        return this.accessToken;
+    }
+    /**
+     * Sign a challenge with the user's private signing key.
+     */
+    async signChallenge(challenge) {
+        const subtle = this.cryptoAdapter.getSubtle();
+        const messageBytes = new TextEncoder().encode(challenge);
+        const signature = await subtle.sign({ name: "Ed25519" }, this.signingKey, messageBytes);
+        return new Uint8Array(signature);
+    }
+    /**
+     * Decrypt network-encrypted entries.
+     * Transforms NetworkEncryptedEntry[] to StoreEntry[].
+     */
+    async decryptNetworkEntries(encryptedEntries) {
+        const results = [];
+        for (const enc of encryptedEntries) {
+            // Decrypt the RSA layer to get the original symmetric-encrypted payload
+            const encryptedData = await this.rsaEncryption.decrypt(enc.rsaEncryptedPayload, this.privateEncryptionKey);
+            // Create the full StoreEntry using metadata from the network entry
+            const entry = {
+                entryType: enc.entryType,
+                id: enc.id,
+                contentHash: enc.contentHash,
+                docId: enc.docId,
+                dependencyIds: enc.dependencyIds,
+                createdAt: enc.createdAt,
+                createdByPublicKey: enc.createdByPublicKey,
+                decryptionKeyId: enc.decryptionKeyId,
+                signature: enc.signature,
+                originalSize: enc.originalSize,
+                encryptedSize: enc.encryptedSize,
+                encryptedData,
+            };
+            results.push(entry);
+        }
+        return results;
+    }
+    /**
+     * Clear the cached access token.
+     * Call this if you need to force re-authentication.
+     */
+    clearAuthCache() {
+        this.accessToken = null;
+        this.tokenExpiry = 0;
+    }
+}
+exports.ClientNetworkContentAddressedStore = ClientNetworkContentAddressedStore;
+//# sourceMappingURL=ClientNetworkContentAddressedStore.js.map

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientNetworkContentAddressedStore.js","sourceRoot":"","sources":["../../../src/appendonlystores/network/ClientNetworkContentAddressedStore.ts"],"names":[],"mappings":";;;AAKA,qEAA2F;AAC3F,mEAAgE;AAEhE;;;;;;;;;;;;;GAaG;AACH,MAAa,kCAAkC;IAa7C;;;;;;;;;OASG;IACH,YACE,IAAY,EACZ,SAA2B,EAC3B,aAA4B,EAC5B,QAAgB,EAChB,UAAqB,EACrB,oBAAwC;QApB1C,sBAAsB;QACd,gBAAW,GAAkB,IAAI,CAAC;QAClC,gBAAW,GAAW,CAAC,CAAC;QAoB9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,aAAa,GAAG,aAAa,CAAC;QACnC,IAAI,CAAC,aAAa,GAAG,IAAI,6BAAa,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;IACnD,CAAC;IAED,KAAK;QACH,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,OAAqB;QACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,aAAa,OAAO,CAAC,MAAM,oBAAoB,CAAC,CAAC;QAE7G,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC/C,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAEhD,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,yBAAyB,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;IACjH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAa;QAC5B,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,aAAa,GAAG,CAAC,MAAM,sBAAsB,CAAC,CAAC;QAE3G,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE/C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,cAAc,gBAAgB,CAAC,MAAM,gCAAgC,CAAC,CAAC;QAEnI,uCAAuC;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,eAAe,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC;QAErG,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,GAAa;QAC5B,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,cAAc,GAAG,CAAC,MAAM,gBAAgB,CAAC,CAAC;QAEtG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,WAAW,WAAW,CAAC,MAAM,mBAAmB,CAAC,CAAC;QAE9G,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,QAAkB;QACrC,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,mCAAmC,CAAC,CAAC;QAEjG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAExE,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,WAAW,UAAU,CAAC,MAAM,0BAA0B,CAAC,CAAC;QACpH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,oBAAoB,CAAC,QAAkB,EAAE,KAAa;QAC1D,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,iCAAiC,KAAK,cAAc,CAAC,CAAC;QAElH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAErF,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,WAAW,UAAU,CAAC,MAAM,wBAAwB,KAAK,EAAE,CAAC,CAAC;QACzH,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACb,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,qCAAqC,CAAC,CAAC;QAEnG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,gBAAgB,MAAM,CAAC,MAAM,YAAY,CAAC,CAAC;QACvG,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAAe,EACf,OAAiC;QAEjC,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,gCAAgC,OAAO,EAAE,CAAC,CAAC;QAEvG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC/C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAEtF,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,cAAc,WAAW,CAAC,MAAM,eAAe,CAAC,CAAC;QAC7G,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,OAAO,CAAC,IAAI,CAAC,uCAAuC,IAAI,CAAC,IAAI,uDAAuD,KAAK,mHAAmH,CAAC,CAAC;QAC9O,kFAAkF;IACpF,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,mBAAmB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,iCAAiC;QACjC,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,kBAAkB;YAC1E,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,0BAA0B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEvG,sBAAsB;QACtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,yBAAyB,SAAS,EAAE,CAAC,CAAC;QAElG,qBAAqB;QACrB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,oBAAoB,CAAC,CAAC;QAElF,eAAe;QACf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAEvE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,oBAAY,CACpB,wBAAgB,CAAC,iBAAiB,EAClC,MAAM,CAAC,KAAK,IAAI,uBAAuB,CACxC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAEhC,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,0BAA0B;YACnE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;YACtC,IAAI,CAAC,WAAW,GAAG,GAAG,GAAG,OAAO,CAAC;QACnC,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,uCAAuC,IAAI,CAAC,IAAI,6BAA6B,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CAAC,SAAiB;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,IAAI,CAAC,UAAU,EACf,YAAY,CACb,CAAC;QAEF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,qBAAqB,CACjC,gBAAyC;QAEzC,MAAM,OAAO,GAAiB,EAAE,CAAC;QAEjC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;YACnC,wEAAwE;YACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CACpD,GAAG,CAAC,mBAAmB,EACvB,IAAI,CAAC,oBAAoB,CAC1B,CAAC;YAEF,mEAAmE;YACnE,MAAM,KAAK,GAAe;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;gBAC1C,eAAe,EAAE,GAAG,CAAC,eAAe;gBACpC,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,aAAa,EAAE,GAAG,CAAC,aAAa;gBAChC,aAAa;aACd,CAAC;YAEF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,cAAc;QACZ,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;IACvB,CAAC;CACF;AApSD,gFAoSC"}