mindoodb 0.0.1

package/dist/core/appendonlystores/network/types.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NetworkError = exports.NetworkErrorType = void 0;
+/**
+ * Network transport error types for error handling.
+ */
+var NetworkErrorType;
+(function (NetworkErrorType) {
+    /** Token is invalid or expired */
+    NetworkErrorType["INVALID_TOKEN"] = "INVALID_TOKEN";
+    /** User has been revoked */
+    NetworkErrorType["USER_REVOKED"] = "USER_REVOKED";
+    /** Signature verification failed */
+    NetworkErrorType["INVALID_SIGNATURE"] = "INVALID_SIGNATURE";
+    /** Challenge expired or already used */
+    NetworkErrorType["CHALLENGE_EXPIRED"] = "CHALLENGE_EXPIRED";
+    /** Network communication error */
+    NetworkErrorType["NETWORK_ERROR"] = "NETWORK_ERROR";
+    /** Server-side error */
+    NetworkErrorType["SERVER_ERROR"] = "SERVER_ERROR";
+    /** User not found in directory */
+    NetworkErrorType["USER_NOT_FOUND"] = "USER_NOT_FOUND";
+})(NetworkErrorType || (exports.NetworkErrorType = NetworkErrorType = {}));
+/**
+ * Network transport error with type for structured error handling.
+ */
+class NetworkError extends Error {
+    constructor(type, message) {
+        super(message);
+        this.type = type;
+        this.name = "NetworkError";
+    }
+}
+exports.NetworkError = NetworkError;
+//# sourceMappingURL=types.js.map

package/dist/core/appendonlystores/network/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/core/appendonlystores/network/types.ts"],"names":[],"mappings":";;;AA6HA;;GAEG;AACH,IAAY,gBAeX;AAfD,WAAY,gBAAgB;IAC1B,kCAAkC;IAClC,mDAA+B,CAAA;IAC/B,4BAA4B;IAC5B,iDAA6B,CAAA;IAC7B,oCAAoC;IACpC,2DAAuC,CAAA;IACvC,wCAAwC;IACxC,2DAAuC,CAAA;IACvC,kCAAkC;IAClC,mDAA+B,CAAA;IAC/B,wBAAwB;IACxB,iDAA6B,CAAA;IAC7B,kCAAkC;IAClC,qDAAiC,CAAA;AACnC,CAAC,EAfW,gBAAgB,gCAAhB,gBAAgB,QAe3B;AAED;;GAEG;AACH,MAAa,YAAa,SAAQ,KAAK;IACrC,YACkB,IAAsB,EACtC,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAAkB;QAItC,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AARD,oCAQC"}

package/dist/core/appendonlystores/types.d.ts

@@ -0,0 +1,157 @@
+import type { StoreEntry, StoreEntryMetadata } from "../types";
+/**
+ * Options for opening/creating a database store.
+ * Factory implementations can use these to customize store behavior.
+ *
+ * This is an open interface that allows any implementation-specific options.
+ * Examples of options that implementations might support:
+ * - preferLocal: boolean - Prefer local storage over remote
+ * - cacheSize: number - Maximum cache size
+ * - syncMode: "eager" | "lazy" - Synchronization strategy
+ */
+export interface OpenStoreOptions {
+    [key: string]: unknown;
+}
+/**
+ * Result of creating stores for a database.
+ * Contains the document store and an optional separate attachment store.
+ */
+export interface CreateStoreResult {
+    /**
+     * The store for document changes (doc_create, doc_change, doc_snapshot, doc_delete).
+     * This is required.
+     */
+    docStore: ContentAddressedStore;
+    /**
+     * Optional separate store for attachment chunks (attachment_chunk).
+     * If not provided, attachments are stored in the docStore.
+     * Having a separate store enables:
+     * - Different storage backends (e.g., local docs, cloud attachments)
+     * - Different caching/eviction policies
+     * - Cost optimization (cheaper storage for large attachments)
+     */
+    attachmentStore?: ContentAddressedStore;
+}
+/**
+ * ContentAddressedStoreFactory creates ContentAddressedStore instances for a given database ID.
+ * This allows different implementations to provide different storage backends
+ * (e.g., in-memory, file-based, database-backed, cloud storage) while maintaining a consistent interface.
+ */
+export interface ContentAddressedStoreFactory {
+    /**
+     * Create stores for the given database ID.
+     * Returns a document store and optionally a separate attachment store.
+     *
+     * @param dbId The ID of the database (e.g., "directory" for the tenant directory database)
+     * @param options Optional configuration for store creation (e.g., preferLocal, custom settings)
+     * @return An object containing the document store and optional attachment store
+     */
+    createStore(dbId: string, options?: OpenStoreOptions): CreateStoreResult;
+}
+/**
+ * A ContentAddressedStore is a store that stores signed and optionally encrypted
+ * binary entries. Each entry has:
+ * - A unique `id` (primary key for lookups)
+ * - A `contentHash` (SHA-256 of encrypted data, for deduplication)
+ *
+ * The store supports both Automerge document changes and attachment chunks through
+ * a unified interface, with storage-level deduplication based on contentHash.
+ *
+ * The store is responsible for:
+ * - Storing entries with metadata indexed by id
+ * - Deduplicating encrypted bytes by contentHash (same content stored once)
+ * - Providing methods to retrieve entries by id
+ * - Finding new entries for synchronization
+ * - Resolving dependency chains (for traversing DAG structures)
+ *
+ * The append-only structure makes synchronization easy between peers (client-client,
+ * client-server, server-server). Store implementations can optimize storage based on
+ * entry type (e.g., inline small doc changes, external storage for large attachment chunks).
+ */
+export interface ContentAddressedStore {
+    /**
+     * Get the ID of the store
+     *
+     * @return The ID of the store
+     */
+    getId(): string;
+    /**
+     * Store one or more entries.
+     * - Metadata is stored by entry id (always unique)
+     * - Encrypted bytes are deduplicated by contentHash (same bytes stored once)
+     *
+     * @param entries The entries to store
+     * @return A promise that resolves when all entries are stored
+     */
+    putEntries(entries: StoreEntry[]): Promise<void>;
+    /**
+     * Get entries by their IDs.
+     * Returns only entries that exist in this store.
+     *
+     * @param ids The IDs of the entries to fetch
+     * @return A list of entries (may be shorter than input if some don't exist)
+     */
+    getEntries(ids: string[]): Promise<StoreEntry[]>;
+    /**
+     * Check which IDs from the provided list exist in this store.
+     *
+     * @param ids The IDs to check
+     * @return A list of IDs that exist in this store
+     */
+    hasEntries(ids: string[]): Promise<string[]>;
+    /**
+     * Find entries in the store that are not listed in the given list of IDs.
+     * Used for synchronization to identify which entries we have that the peer doesn't.
+     *
+     * @param knownIds The list of entry IDs we already have
+     * @return A list of entry metadata for entries we have that aren't in knownIds
+     */
+    findNewEntries(knownIds: string[]): Promise<StoreEntryMetadata[]>;
+    /**
+     * Find entries in the store for a specific document that are not listed in the given list of IDs.
+     *
+     * @param knownIds The list of entry IDs we already have
+     * @param docId The ID of the document
+     * @return A list of entry metadata for entries we have that aren't in knownIds
+     */
+    findNewEntriesForDoc(knownIds: string[], docId: string): Promise<StoreEntryMetadata[]>;
+    /**
+     * Get all entry IDs in the store.
+     * Used for synchronization to identify which entries we have.
+     *
+     * @return A list of all entry IDs in the store
+     */
+    getAllIds(): Promise<string[]>;
+    /**
+     * Resolve the dependency chain starting from an entry ID.
+     * Returns IDs in dependency order, traversing backward through dependencyIds.
+     *
+     * This is useful for:
+     * - Loading all chunks of an attachment (traverse from last to first chunk)
+     * - Finding all changes needed to reconstruct a document state
+     * - Stopping at snapshots when loading documents (use options.stopAtEntryType)
+     *
+     * @param startId The entry ID to start traversal from
+     * @param options Optional traversal options:
+     *   - stopAtEntryType: Stop when encountering an entry of this type (e.g., "doc_snapshot")
+     *   - maxDepth: Maximum number of hops to traverse
+     *   - includeStart: Whether to include startId in the result (default: true)
+     * @return A list of entry IDs in dependency order (oldest first by default)
+     */
+    resolveDependencies(startId: string, options?: Record<string, unknown>): Promise<string[]>;
+    /**
+     * Purge all entries for a specific document from the store.
+     * This breaks append-only semantics but is required for GDPR compliance
+     * (right to be forgotten).
+     *
+     * After purging, all entries for the specified document will be removed
+     * from the store. Content bytes that are no longer referenced by any
+     * entry should also be cleaned up.
+     *
+     * @param docId The document ID whose entries should be purged
+     * @return A promise that resolves when the purge is complete
+     * @throws Error if the store implementation does not support purging
+     */
+    purgeDocHistory(docId: string): Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/appendonlystores/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/appendonlystores/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,WAAW,gBAAgB;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;OAGG;IACH,QAAQ,EAAE,qBAAqB,CAAC;IAEhC;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;CACzC;AAED;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;;;;OAOG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;CAC1E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;OAIG;IACH,KAAK,IAAI,MAAM,CAAC;IAEhB;;;;;;;OAOG;IACH,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;;;;;OAMG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;OAMG;IACH,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAElE;;;;;;OAMG;IACH,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;IAEvF;;;;;OAKG;IACH,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/B;;;;;;;;;;;;;;;OAeG;IACH,mBAAmB,CACjB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErB;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C"}

package/dist/core/appendonlystores/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/core/appendonlystores/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/appendonlystores/types.ts"],"names":[],"mappings":""}

package/dist/core/crypto/CryptoAdapter.d.ts

@@ -0,0 +1,19 @@
+/**
+ * CryptoAdapter provides a platform-agnostic interface to the Web Crypto API.
+ * This allows BaseMindooTenant to work in both browser and Node.js environments.
+ */
+export interface CryptoAdapter {
+    /**
+     * Get the SubtleCrypto interface for cryptographic operations.
+     * In browsers: window.crypto.subtle
+     * In Node.js: crypto.webcrypto.subtle
+     */
+    getSubtle(): SubtleCrypto;
+    /**
+     * Get random values for key generation and IVs.
+     * In browsers: window.crypto.getRandomValues
+     * In Node.js: crypto.webcrypto.getRandomValues
+     */
+    getRandomValues(array: Uint8Array): Uint8Array;
+}
+//# sourceMappingURL=CryptoAdapter.d.ts.map

package/dist/core/crypto/CryptoAdapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoAdapter.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/CryptoAdapter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,SAAS,IAAI,YAAY,CAAC;IAE1B;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;CAChD"}

package/dist/core/crypto/CryptoAdapter.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=CryptoAdapter.js.map

package/dist/core/crypto/CryptoAdapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CryptoAdapter.js","sourceRoot":"","sources":["../../../src/core/crypto/CryptoAdapter.ts"],"names":[],"mappings":""}

package/dist/core/crypto/MindooDocSigner.d.ts

@@ -0,0 +1,106 @@
+import { MindooDoc, SigningKeyPair } from "../types";
+import { BaseMindooTenant } from "../BaseMindooTenant";
+/**
+ * MindooDocSigner provides functionality to create and verify combined signatures
+ * for multiple document items in a MindooDoc.
+ *
+ * This class addresses the security requirement of preventing selective tampering
+ * with document fields. By signing multiple document items together in a single
+ * signature operation, any modification to any signed field will invalidate the
+ * entire signature.
+ *
+ * ## Key Features
+ *
+ * - **Combined Signatures**: All specified document items are signed together in
+ *   one operation, preventing attackers from selectively modifying individual fields
+ *   (e.g., changing a "type" field while keeping other fields intact).
+ *
+ * - **Canonical JSON Serialization**: Uses deterministic JSON serialization that
+ *   handles JavaScript's non-deterministic object key ordering. Object keys are
+ *   sorted alphabetically, and nested objects are processed recursively to ensure
+ *   the same data always produces the same signature.
+ *
+ * - **Ed25519 Signatures**: Uses Ed25519 digital signatures for cryptographic
+ *   security and verification.
+ *
+ * ## Usage Example
+ *
+ * ```typescript
+ * const signer = new MindooDocSigner(tenant, signingKeyPair);
+ *
+ * // Sign multiple document items together
+ * const signature = await signer.signItems(
+ *   doc,
+ *   ["type", "status", "metadata"],
+ *   password
+ * );
+ *
+ * // Verify the signature
+ * const isValid = await signer.verifyItems(
+ *   doc,
+ *   ["type", "status", "metadata"],
+ *   signature,
+ *   publicKey
+ * );
+ * ```
+ *
+ * ## Security Considerations
+ *
+ * - The signature covers all specified items as a single unit. Changing any
+ *   signed field will invalidate the signature.
+ * - Missing fields are included as `null` in the canonical representation to
+ *   ensure deterministic signatures regardless of field presence.
+ * - The signing key is decrypted using the tenant's key decryption infrastructure,
+ *   ensuring consistent security practices across the codebase.
+ *
+ * ## Dependencies
+ *
+ * - Requires a `BaseMindooTenant` instance for cryptographic operations
+ *   (key decryption, crypto adapter access)
+ * - Uses Ed25519 signing algorithm (Ed25519 signatures)
+ * - Uses canonical JSON serialization for deterministic signatures
+ *
+ * @see BaseMindooTenant For the tenant infrastructure used for key management
+ */
+export declare class MindooDocSigner {
+    private tenant;
+    private signKey;
+    constructor(tenant: BaseMindooTenant, signKey: SigningKeyPair);
+    /**
+     * Creates a canonical JSON representation of the selected document items.
+     * This ensures deterministic serialization regardless of object key order.
+     *
+     * The canonical format:
+     * - Object keys are sorted alphabetically
+     * - Nested objects are processed recursively
+     * - Arrays preserve order
+     * - Primitives (string, number, boolean, null) are serialized as-is
+     * - undefined values are omitted (not included in the signature)
+     *
+     * @param payload The document payload
+     * @param items The item keys to include in the signature
+     * @returns A canonical JSON string representation
+     */
+    private createCanonicalJSON;
+    /**
+     * Signs the specified document items with a combined signature.
+     * This prevents selective tampering by signing all items together in one operation.
+     *
+     * @param doc The document to sign items from
+     * @param items The item keys to include in the signature
+     * @param signPassword The password to decrypt the signing private key
+     * @returns The signature as a Uint8Array
+     */
+    signItems(doc: MindooDoc, items: string[], signPassword: string): Promise<Uint8Array>;
+    /**
+     * Verifies the signature for the specified document items.
+     *
+     * @param doc The document to verify items from
+     * @param items The item keys that were included in the signature
+     * @param signature The signature to verify
+     * @param publicKey The public key to verify the signature with (Ed25519, PEM format)
+     * @returns True if the signature is valid, false otherwise
+     */
+    verifyItems(doc: MindooDoc, items: string[], signature: Uint8Array, publicKey: string): Promise<boolean>;
+}
+//# sourceMappingURL=MindooDocSigner.d.ts.map

package/dist/core/crypto/MindooDocSigner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MindooDocSigner.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/MindooDocSigner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAoB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,OAAO,CAAiB;gBAEpB,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc;IAK7D;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,mBAAmB;IA6C3B;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA4C3F;;;;;;;;OAQG;IACG,WAAW,CACf,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;CAyCpB"}

package/dist/core/crypto/MindooDocSigner.js

@@ -0,0 +1,192 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MindooDocSigner = void 0;
+/**
+ * MindooDocSigner provides functionality to create and verify combined signatures
+ * for multiple document items in a MindooDoc.
+ *
+ * This class addresses the security requirement of preventing selective tampering
+ * with document fields. By signing multiple document items together in a single
+ * signature operation, any modification to any signed field will invalidate the
+ * entire signature.
+ *
+ * ## Key Features
+ *
+ * - **Combined Signatures**: All specified document items are signed together in
+ *   one operation, preventing attackers from selectively modifying individual fields
+ *   (e.g., changing a "type" field while keeping other fields intact).
+ *
+ * - **Canonical JSON Serialization**: Uses deterministic JSON serialization that
+ *   handles JavaScript's non-deterministic object key ordering. Object keys are
+ *   sorted alphabetically, and nested objects are processed recursively to ensure
+ *   the same data always produces the same signature.
+ *
+ * - **Ed25519 Signatures**: Uses Ed25519 digital signatures for cryptographic
+ *   security and verification.
+ *
+ * ## Usage Example
+ *
+ * ```typescript
+ * const signer = new MindooDocSigner(tenant, signingKeyPair);
+ *
+ * // Sign multiple document items together
+ * const signature = await signer.signItems(
+ *   doc,
+ *   ["type", "status", "metadata"],
+ *   password
+ * );
+ *
+ * // Verify the signature
+ * const isValid = await signer.verifyItems(
+ *   doc,
+ *   ["type", "status", "metadata"],
+ *   signature,
+ *   publicKey
+ * );
+ * ```
+ *
+ * ## Security Considerations
+ *
+ * - The signature covers all specified items as a single unit. Changing any
+ *   signed field will invalidate the signature.
+ * - Missing fields are included as `null` in the canonical representation to
+ *   ensure deterministic signatures regardless of field presence.
+ * - The signing key is decrypted using the tenant's key decryption infrastructure,
+ *   ensuring consistent security practices across the codebase.
+ *
+ * ## Dependencies
+ *
+ * - Requires a `BaseMindooTenant` instance for cryptographic operations
+ *   (key decryption, crypto adapter access)
+ * - Uses Ed25519 signing algorithm (Ed25519 signatures)
+ * - Uses canonical JSON serialization for deterministic signatures
+ *
+ * @see BaseMindooTenant For the tenant infrastructure used for key management
+ */
+class MindooDocSigner {
+    constructor(tenant, signKey) {
+        this.tenant = tenant;
+        this.signKey = signKey;
+    }
+    /**
+     * Creates a canonical JSON representation of the selected document items.
+     * This ensures deterministic serialization regardless of object key order.
+     *
+     * The canonical format:
+     * - Object keys are sorted alphabetically
+     * - Nested objects are processed recursively
+     * - Arrays preserve order
+     * - Primitives (string, number, boolean, null) are serialized as-is
+     * - undefined values are omitted (not included in the signature)
+     *
+     * @param payload The document payload
+     * @param items The item keys to include in the signature
+     * @returns A canonical JSON string representation
+     */
+    createCanonicalJSON(payload, items) {
+        // Extract only the specified items
+        // Include all specified items, even if they don't exist (will be null)
+        // This ensures deterministic signatures regardless of field presence
+        const selectedItems = {};
+        for (const itemKey of items) {
+            if (itemKey in payload) {
+                selectedItems[itemKey] = payload[itemKey];
+            }
+            else {
+                // Field doesn't exist - include as null for deterministic signature
+                selectedItems[itemKey] = null;
+            }
+        }
+        // Recursively canonicalize the object
+        const canonicalize = (value) => {
+            if (value === null || value === undefined) {
+                return null; // Treat undefined as null for consistency
+            }
+            if (Array.isArray(value)) {
+                return value.map(item => canonicalize(item));
+            }
+            if (typeof value === "object") {
+                // Sort keys alphabetically and recursively process values
+                const sortedKeys = Object.keys(value).sort();
+                const canonicalized = {};
+                for (const key of sortedKeys) {
+                    const itemValue = value[key];
+                    if (itemValue !== undefined) {
+                        canonicalized[key] = canonicalize(itemValue);
+                    }
+                }
+                return canonicalized;
+            }
+            // Primitives: string, number, boolean
+            return value;
+        };
+        const canonicalized = canonicalize(selectedItems);
+        return JSON.stringify(canonicalized);
+    }
+    /**
+     * Signs the specified document items with a combined signature.
+     * This prevents selective tampering by signing all items together in one operation.
+     *
+     * @param doc The document to sign items from
+     * @param items The item keys to include in the signature
+     * @param signPassword The password to decrypt the signing private key
+     * @returns The signature as a Uint8Array
+     */
+    async signItems(doc, items, signPassword) {
+        const docPayload = doc.getData();
+        // Create canonical JSON representation
+        const canonicalJSON = this.createCanonicalJSON(docPayload, items);
+        console.log(`[MindooDocSigner] Canonical JSON for signing: ${canonicalJSON}`);
+        // Convert to bytes (UTF-8 encoding)
+        const encoder = new TextEncoder();
+        const payloadBytes = encoder.encode(canonicalJSON);
+        // Decrypt the signing private key using the tenant's decryptPrivateKey method
+        const decryptedKeyBuffer = await this.tenant.decryptPrivateKey(this.signKey.privateKey, signPassword, "signing");
+        const subtle = this.tenant.getCryptoAdapter().getSubtle();
+        // Import the decrypted key as an Ed25519 private key
+        const signingKey = await subtle.importKey("pkcs8", decryptedKeyBuffer, {
+            name: "Ed25519",
+        }, false, // not extractable
+        ["sign"]);
+        // Sign the payload
+        const signature = await subtle.sign({
+            name: "Ed25519",
+        }, signingKey, payloadBytes.buffer);
+        console.log(`[MindooDocSigner] Signed ${items.length} items (signature: ${signature.byteLength} bytes)`);
+        return new Uint8Array(signature);
+    }
+    /**
+     * Verifies the signature for the specified document items.
+     *
+     * @param doc The document to verify items from
+     * @param items The item keys that were included in the signature
+     * @param signature The signature to verify
+     * @param publicKey The public key to verify the signature with (Ed25519, PEM format)
+     * @returns True if the signature is valid, false otherwise
+     */
+    async verifyItems(doc, items, signature, publicKey) {
+        const docPayload = doc.getData();
+        // Create the same canonical JSON representation
+        const canonicalJSON = this.createCanonicalJSON(docPayload, items);
+        console.log(`[MindooDocSigner] Canonical JSON for verification: ${canonicalJSON}`);
+        // Convert to bytes (UTF-8 encoding)
+        const encoder = new TextEncoder();
+        const payloadBytes = encoder.encode(canonicalJSON);
+        const subtle = this.tenant.getCryptoAdapter().getSubtle();
+        // Convert PEM format to ArrayBuffer using tenant's public method
+        const publicKeyBuffer = this.tenant.pemToArrayBuffer(publicKey);
+        // Import the public key from SPKI format
+        const cryptoKey = await subtle.importKey("spki", publicKeyBuffer, {
+            name: "Ed25519",
+        }, false, // not extractable
+        ["verify"]);
+        // Verify the signature
+        const isValid = await subtle.verify({
+            name: "Ed25519",
+        }, cryptoKey, signature.buffer, payloadBytes.buffer);
+        console.log(`[MindooDocSigner] Signature verification: ${isValid ? "valid" : "invalid"}`);
+        return isValid;
+    }
+}
+exports.MindooDocSigner = MindooDocSigner;
+//# sourceMappingURL=MindooDocSigner.js.map

package/dist/core/crypto/MindooDocSigner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MindooDocSigner.js","sourceRoot":"","sources":["../../../src/core/crypto/MindooDocSigner.ts"],"names":[],"mappings":";;;AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAa,eAAe;IAI1B,YAAY,MAAwB,EAAE,OAAuB;QAC3D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,mBAAmB,CAAC,OAAyB,EAAE,KAAe;QACpE,mCAAmC;QACnC,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,aAAa,GAAqB,EAAE,CAAC;QAC3C,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAW,EAAE;YAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,CAAC,0CAA0C;YACzD,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,0DAA0D;gBAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,aAAa,GAAqB,EAAE,CAAC;gBAC3C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,MAAM,SAAS,GAAI,KAA0B,CAAC,GAAG,CAAC,CAAC;oBACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,aAAa,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;gBACD,OAAO,aAAa,CAAC;YACvB,CAAC;YAED,sCAAsC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAc,EAAE,KAAe,EAAE,YAAoB;QACnE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAEjC,uCAAuC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iDAAiD,aAAa,EAAE,CAAC,CAAC;QAE9E,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnD,8EAA8E;QAC9E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC5D,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,YAAY,EACZ,SAAS,CACV,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC;QAE1D,qDAAqD;QACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,OAAO,EACP,kBAAkB,EAClB;YACE,IAAI,EAAE,SAAS;SAChB,EACD,KAAK,EAAE,kBAAkB;QACzB,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC;YACE,IAAI,EAAE,SAAS;SAChB,EACD,UAAU,EACV,YAAY,CAAC,MAAqB,CACnC,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,MAAM,sBAAsB,SAAS,CAAC,UAAU,SAAS,CAAC,CAAC;QACzG,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,GAAc,EACd,KAAe,EACf,SAAqB,EACrB,SAAiB;QAEjB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAEjC,gDAAgD;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,sDAAsD,aAAa,EAAE,CAAC,CAAC;QAEnF,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC;QAE1D,iEAAiE;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEhE,yCAAyC;QACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,eAAe,EACf;YACE,IAAI,EAAE,SAAS;SAChB,EACD,KAAK,EAAE,kBAAkB;QACzB,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC;YACE,IAAI,EAAE,SAAS;SAChB,EACD,SAAS,EACT,SAAS,CAAC,MAAqB,EAC/B,YAAY,CAAC,MAAqB,CACnC,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,6CAA6C,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1F,OAAO,OAAO,CAAC;IACjB,CAAC;CAEF;AAjLD,0CAiLC"}

package/dist/core/crypto/RSAEncryption.d.ts

@@ -0,0 +1,62 @@
+import type { CryptoAdapter } from "./CryptoAdapter";
+/**
+ * RSA Encryption utilities for network transport security.
+ *
+ * Uses RSA-OAEP for encrypting change payloads during network transport.
+ * The encrypted data can only be decrypted by the recipient who has
+ * the corresponding private key.
+ *
+ * This provides an additional layer of security on top of the existing
+ * symmetric encryption (AES-256-GCM) used for storage.
+ */
+export declare class RSAEncryption {
+    private cryptoAdapter;
+    constructor(cryptoAdapter: CryptoAdapter);
+    /**
+     * Import an RSA public key from PEM format.
+     *
+     * @param pemKey The public key in PEM format (SPKI)
+     * @returns The imported CryptoKey for encryption
+     */
+    importPublicKey(pemKey: string): Promise<CryptoKey>;
+    /**
+     * Import an RSA private key from PEM format.
+     *
+     * @param pemKey The private key in PEM format (PKCS#8)
+     * @returns The imported CryptoKey for decryption
+     */
+    importPrivateKey(pemKey: string): Promise<CryptoKey>;
+    /**
+     * Encrypt data with an RSA public key.
+     *
+     * Note: RSA-OAEP with 3072-bit keys and SHA-256 can only encrypt
+     * up to 318 bytes directly. For larger payloads, this method uses
+     * hybrid encryption: generates a random AES key, encrypts the data
+     * with AES-GCM, then encrypts the AES key with RSA.
+     *
+     * @param data The data to encrypt
+     * @param publicKey The RSA public key (CryptoKey or PEM string)
+     * @returns The encrypted data
+     */
+    encrypt(data: Uint8Array, publicKey: CryptoKey | string): Promise<Uint8Array>;
+    /**
+     * Decrypt data with an RSA private key.
+     *
+     * Handles hybrid encryption: extracts the RSA-encrypted AES key,
+     * decrypts it with RSA, then uses AES-GCM to decrypt the payload.
+     *
+     * @param encryptedData The encrypted data
+     * @param privateKey The RSA private key (CryptoKey or PEM string)
+     * @returns The decrypted data
+     */
+    decrypt(encryptedData: Uint8Array, privateKey: CryptoKey | string): Promise<Uint8Array>;
+    /**
+     * Convert a base64 string to Uint8Array.
+     */
+    private base64ToUint8Array;
+    /**
+     * Convert a Uint8Array to base64 string.
+     */
+    private uint8ArrayToBase64;
+}
+//# sourceMappingURL=RSAEncryption.d.ts.map

package/dist/core/crypto/RSAEncryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RSAEncryption.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/RSAEncryption.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;GASG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,aAAa,CAAgB;gBAEzB,aAAa,EAAE,aAAa;IAIxC;;;;;OAKG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA4BzD;;;;;OAKG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IA4B1D;;;;;;;;;;;OAWG;IACG,OAAO,CACX,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,SAAS,GAAG,MAAM,GAC5B,OAAO,CAAC,UAAU,CAAC;IAoEtB;;;;;;;;;OASG;IACG,OAAO,CACX,aAAa,EAAE,UAAU,EACzB,UAAU,EAAE,SAAS,GAAG,MAAM,GAC7B,OAAO,CAAC,UAAU,CAAC;IAgDtB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,OAAO,CAAC,kBAAkB;CAO3B"}