mindoodb 0.0.2 → 0.0.4

package/dist/core/MindooDBServerAdmin.d.ts

@@ -0,0 +1,238 @@
+/**
+ * MindooDBServerAdmin — client for MindooDB server `/system/*` endpoints.
+ *
+ * Platform-agnostic: pass a {@link CryptoAdapter} (`NodeCryptoAdapter`,
+ * `createCryptoAdapter()` in browser, or React Native adapter). Uses `fetch`,
+ * Web Crypto via the adapter, and `atob`/`btoa` for base64 (no Node `Buffer`).
+ */
+import type { CryptoAdapter } from "./crypto/CryptoAdapter";
+import type { PrivateUserId } from "./userid";
+/**
+ * Connection and authentication options for {@link MindooDBServerAdmin}.
+ */
+export interface MindooDBServerAdminOptions {
+    serverUrl: string;
+    systemAdminUser: PrivateUserId;
+    systemAdminPassword: string;
+    /** Platform crypto (e.g. `NodeCryptoAdapter`, browser `createCryptoAdapter()`, RN adapter). */
+    cryptoAdapter: CryptoAdapter;
+}
+interface TrustedServer {
+    name: string;
+    signingPublicKey: string;
+    encryptionPublicKey: string;
+}
+interface SyncServerConfig {
+    name: string;
+    url: string;
+    syncIntervalMs?: number;
+    databases: string[];
+}
+/**
+ * One system-admin identity as stored in server `config.json`.
+ *
+ * A principal is uniquely identified by the combination of `username` and
+ * `publicsignkey`.
+ */
+export interface SystemAdminPrincipal {
+    username: string;
+    publicsignkey: string;
+}
+/**
+ * Runtime server config returned by `GET /system/config`.
+ */
+export interface ServerConfig {
+    capabilities: Record<string, SystemAdminPrincipal[]>;
+}
+/**
+ * Metadata for one historical `config.json` backup.
+ */
+export interface ConfigBackupInfo {
+    file: string;
+    createdAt: string;
+}
+/**
+ * Response body for reading one historical config backup.
+ */
+export interface ConfigBackupResponse {
+    file: string;
+    config: ServerConfig;
+}
+interface RegisterTenantBody {
+    adminSigningPublicKey: string;
+    adminEncryptionPublicKey: string;
+    adminUsername?: string;
+    publicInfosKey?: string;
+    defaultStoreType?: "inmemory" | "file";
+    users?: Array<{
+        username: string;
+        signingPublicKey: string;
+        encryptionPublicKey: string;
+    }>;
+}
+/**
+ * High-level client for authenticated access to MindooDB server `/system/*`
+ * endpoints.
+ *
+ * This wrapper performs the Ed25519 challenge/response flow automatically,
+ * caches the short-lived JWT, and exposes ergonomic methods for common server
+ * administration tasks such as tenant registration, runtime config updates,
+ * and delegated system-admin management.
+ */
+export declare class MindooDBServerAdmin {
+    private baseUrl;
+    private adminUser;
+    private adminPassword;
+    private cryptoAdapter;
+    private cachedToken;
+    private tokenExpiresAt;
+    /**
+     * Create a new system-admin API client for one MindooDB server.
+     */
+    constructor(options: MindooDBServerAdminOptions);
+    /**
+     * List all tenant IDs currently registered on the server.
+     */
+    listTenants(): Promise<string[]>;
+    /**
+     * Create a new tenant on the server.
+     *
+     * The caller must already be authorized for `POST /system/tenants/:tenantId`
+     * by the server's runtime config.
+     */
+    registerTenant(tenantId: string, body: RegisterTenantBody): Promise<{
+        success: boolean;
+        tenantId: string;
+        message?: string;
+    }>;
+    /**
+     * Update server-side metadata for an existing tenant.
+     */
+    updateTenant(tenantId: string, updates: Record<string, unknown>): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    /**
+     * Remove a tenant from the server.
+     */
+    removeTenant(tenantId: string): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    /**
+     * List globally trusted peer servers used for server-to-server sync.
+     */
+    listTrustedServers(): Promise<TrustedServer[]>;
+    /**
+     * Add one globally trusted peer server.
+     */
+    addTrustedServer(server: TrustedServer): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    /**
+     * Remove one globally trusted peer server by name.
+     */
+    removeTrustedServer(serverName: string): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    /**
+     * List sync server targets configured for one tenant.
+     */
+    listTenantSyncServers(tenantId: string): Promise<SyncServerConfig[]>;
+    /**
+     * Add one sync target for a tenant.
+     */
+    addTenantSyncServer(tenantId: string, config: SyncServerConfig): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    /**
+     * Remove one tenant-specific sync target.
+     */
+    removeTenantSyncServer(tenantId: string, serverName: string): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    /**
+     * Trigger an on-demand sync for one tenant.
+     */
+    triggerTenantSync(tenantId: string): Promise<{
+        success: boolean;
+        message?: string;
+    }>;
+    /**
+     * Fetch the currently active runtime server config.
+     */
+    getConfig(): Promise<ServerConfig>;
+    /**
+     * Replace the full runtime server config.
+     *
+     * The server remains the source of truth for validation, backup creation, and
+     * self-lockout protection.
+     */
+    updateConfig(config: ServerConfig): Promise<{
+        success: boolean;
+        message?: string;
+        backupFile?: string;
+    }>;
+    /**
+     * List historical config backups created by prior runtime config updates.
+     */
+    listConfigBackups(): Promise<ConfigBackupInfo[]>;
+    /**
+     * Read one historical config backup from the server.
+     */
+    readConfigBackup(backupFile: string): Promise<ConfigBackupResponse>;
+    /**
+     * Read one historical config backup from the server.
+     *
+     * Alias for {@link readConfigBackup} kept for compatibility with earlier
+     * wrapper code.
+     */
+    getConfigBackup(backupFile: string): Promise<ConfigBackupResponse>;
+    /**
+     * Return all capability rules that currently include the given principal.
+     *
+     * This is a client-side convenience method derived from `getConfig()`. It
+     * does not require a dedicated server endpoint.
+     */
+    findSystemAdminAccess(principal: SystemAdminPrincipal): Promise<{
+        principal: SystemAdminPrincipal;
+        rules: string[];
+    }>;
+    /**
+     * Grant a principal access to one or more capability rules.
+     *
+     * Missing rules are created automatically. Existing principal entries are
+     * deduplicated by `username.toLowerCase()` + `publicsignkey`.
+     */
+    grantSystemAdminAccess(principal: SystemAdminPrincipal, rules: string[]): Promise<{
+        success: boolean;
+        config: ServerConfig;
+        addedToRules: string[];
+        alreadyPresentRules: string[];
+        backupFile?: string;
+    }>;
+    /**
+     * Revoke a principal from selected capability rules, or from all rules when
+     * no `rules` filter is provided.
+     */
+    revokeSystemAdminAccess(principal: SystemAdminPrincipal, options?: {
+        rules?: string[];
+    }): Promise<{
+        success: boolean;
+        config: ServerConfig;
+        removedFromRules: string[];
+        backupFile?: string;
+    }>;
+    private authenticatedRequest;
+    private ensureAuthenticated;
+    /**
+     * Decrypt a PBKDF2 + AES-GCM encrypted private key (same layout as BaseMindooTenant).
+     */
+    private decryptPrivateKey;
+}
+export {};
+//# sourceMappingURL=MindooDBServerAdmin.d.ts.map

package/dist/core/MindooDBServerAdmin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MindooDBServerAdmin.d.ts","sourceRoot":"","sources":["../../src/core/MindooDBServerAdmin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAE5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAG9C;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,aAAa,CAAC;IAC/B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+FAA+F;IAC/F,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED,UAAU,aAAa;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;CACtD;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,YAAY,CAAC;CACtB;AAED,UAAU,kBAAkB;IAC1B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IACvC,KAAK,CAAC,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,EAAE,MAAM,CAAC;QACzB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;CACJ;AAsCD;;;;;;;;GAQG;AACH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAgB;IACjC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,aAAa,CAAgB;IAErC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,cAAc,CAAa;IAEnC;;OAEG;gBACS,OAAO,EAAE,0BAA0B;IAW/C;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKtC;;;;;OAKG;IACG,cAAc,CAClB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQpE;;OAEG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQlD;;OAEG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlD;;OAEG;IACG,kBAAkB,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;IAKpD;;OAEG;IACG,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI9F;;OAEG;IACG,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAW9F;;OAEG;IACG,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAQ1E;;OAEG;IACG,mBAAmB,CACvB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAQlD;;OAEG;IACG,sBAAsB,CAC1B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlD;;OAEG;IACG,iBAAiB,CACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAWlD;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC;;;;;OAKG;IACG,YAAY,CAChB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvE;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAKtD;;OAEG;IACG,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAOzE;;;;;OAKG;IACG,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAIxE;;;;;OAKG;IACG,qBAAqB,CACzB,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAAC;QAAE,SAAS,EAAE,oBAAoB,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAgBhE;;;;;OAKG;IACG,sBAAsB,CAC1B,SAAS,EAAE,oBAAoB,EAC/B,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,YAAY,CAAC;QACrB,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,mBAAmB,EAAE,MAAM,EAAE,CAAC;QAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IAuCF;;;OAGG;IACG,uBAAuB,CAC3B,SAAS,EAAE,oBAAoB,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC7B,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,YAAY,CAAC;QACrB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;YA0CY,oBAAoB;YA4BpB,mBAAmB;IA6EjC;;OAEG;YACW,iBAAiB;CAYhC"}

package/dist/core/MindooDBServerAdmin.js

@@ -0,0 +1,345 @@
+"use strict";
+/**
+ * MindooDBServerAdmin — client for MindooDB server `/system/*` endpoints.
+ *
+ * Platform-agnostic: pass a {@link CryptoAdapter} (`NodeCryptoAdapter`,
+ * `createCryptoAdapter()` in browser, or React Native adapter). Uses `fetch`,
+ * Web Crypto via the adapter, and `atob`/`btoa` for base64 (no Node `Buffer`).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MindooDBServerAdmin = void 0;
+const privateKeyEncryption_1 = require("./crypto/privateKeyEncryption");
+function uint8ArrayToBase64(bytes) {
+    let binary = "";
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+}
+function normalizePrincipalKey(principal) {
+    return `${principal.username.toLowerCase()}\0${principal.publicsignkey}`;
+}
+function dedupePrincipals(principals) {
+    const seen = new Set();
+    const result = [];
+    for (const principal of principals) {
+        const key = normalizePrincipalKey(principal);
+        if (!seen.has(key)) {
+            seen.add(key);
+            result.push(principal);
+        }
+    }
+    return result;
+}
+function cloneServerConfig(config) {
+    return {
+        capabilities: Object.fromEntries(Object.entries(config.capabilities).map(([rule, principals]) => [
+            rule,
+            principals.map((principal) => ({ ...principal })),
+        ])),
+    };
+}
+/**
+ * High-level client for authenticated access to MindooDB server `/system/*`
+ * endpoints.
+ *
+ * This wrapper performs the Ed25519 challenge/response flow automatically,
+ * caches the short-lived JWT, and exposes ergonomic methods for common server
+ * administration tasks such as tenant registration, runtime config updates,
+ * and delegated system-admin management.
+ */
+class MindooDBServerAdmin {
+    /**
+     * Create a new system-admin API client for one MindooDB server.
+     */
+    constructor(options) {
+        this.cachedToken = null;
+        this.tokenExpiresAt = 0;
+        this.baseUrl = options.serverUrl.replace(/\/$/, "");
+        this.adminUser = options.systemAdminUser;
+        this.adminPassword = options.systemAdminPassword;
+        this.cryptoAdapter = options.cryptoAdapter;
+    }
+    // =========================================================================
+    // Tenant management
+    // =========================================================================
+    /**
+     * List all tenant IDs currently registered on the server.
+     */
+    async listTenants() {
+        const res = await this.authenticatedRequest("GET", "/system/tenants");
+        return res.tenants;
+    }
+    /**
+     * Create a new tenant on the server.
+     *
+     * The caller must already be authorized for `POST /system/tenants/:tenantId`
+     * by the server's runtime config.
+     */
+    async registerTenant(tenantId, body) {
+        return await this.authenticatedRequest("POST", `/system/tenants/${encodeURIComponent(tenantId)}`, body);
+    }
+    /**
+     * Update server-side metadata for an existing tenant.
+     */
+    async updateTenant(tenantId, updates) {
+        return await this.authenticatedRequest("PUT", `/system/tenants/${encodeURIComponent(tenantId)}`, updates);
+    }
+    /**
+     * Remove a tenant from the server.
+     */
+    async removeTenant(tenantId) {
+        return await this.authenticatedRequest("DELETE", `/system/tenants/${encodeURIComponent(tenantId)}`);
+    }
+    // =========================================================================
+    // Trusted server management
+    // =========================================================================
+    /**
+     * List globally trusted peer servers used for server-to-server sync.
+     */
+    async listTrustedServers() {
+        const res = await this.authenticatedRequest("GET", "/system/trusted-servers");
+        return res.servers;
+    }
+    /**
+     * Add one globally trusted peer server.
+     */
+    async addTrustedServer(server) {
+        return await this.authenticatedRequest("POST", "/system/trusted-servers", server);
+    }
+    /**
+     * Remove one globally trusted peer server by name.
+     */
+    async removeTrustedServer(serverName) {
+        return await this.authenticatedRequest("DELETE", `/system/trusted-servers/${encodeURIComponent(serverName)}`);
+    }
+    // =========================================================================
+    // Per-tenant sync server management
+    // =========================================================================
+    /**
+     * List sync server targets configured for one tenant.
+     */
+    async listTenantSyncServers(tenantId) {
+        const res = await this.authenticatedRequest("GET", `/system/tenants/${encodeURIComponent(tenantId)}/sync-servers`);
+        return res.servers;
+    }
+    /**
+     * Add one sync target for a tenant.
+     */
+    async addTenantSyncServer(tenantId, config) {
+        return await this.authenticatedRequest("POST", `/system/tenants/${encodeURIComponent(tenantId)}/sync-servers`, config);
+    }
+    /**
+     * Remove one tenant-specific sync target.
+     */
+    async removeTenantSyncServer(tenantId, serverName) {
+        return await this.authenticatedRequest("DELETE", `/system/tenants/${encodeURIComponent(tenantId)}/sync-servers/${encodeURIComponent(serverName)}`);
+    }
+    // =========================================================================
+    // Trigger sync
+    // =========================================================================
+    /**
+     * Trigger an on-demand sync for one tenant.
+     */
+    async triggerTenantSync(tenantId) {
+        return await this.authenticatedRequest("POST", `/system/tenants/${encodeURIComponent(tenantId)}/trigger-sync`);
+    }
+    // =========================================================================
+    // Runtime config management
+    // =========================================================================
+    /**
+     * Fetch the currently active runtime server config.
+     */
+    async getConfig() {
+        return await this.authenticatedRequest("GET", "/system/config");
+    }
+    /**
+     * Replace the full runtime server config.
+     *
+     * The server remains the source of truth for validation, backup creation, and
+     * self-lockout protection.
+     */
+    async updateConfig(config) {
+        return await this.authenticatedRequest("PUT", "/system/config", config);
+    }
+    /**
+     * List historical config backups created by prior runtime config updates.
+     */
+    async listConfigBackups() {
+        const res = await this.authenticatedRequest("GET", "/system/config/backups");
+        return res.backups;
+    }
+    /**
+     * Read one historical config backup from the server.
+     */
+    async readConfigBackup(backupFile) {
+        return await this.authenticatedRequest("GET", `/system/config/backups/${encodeURIComponent(backupFile)}`);
+    }
+    /**
+     * Read one historical config backup from the server.
+     *
+     * Alias for {@link readConfigBackup} kept for compatibility with earlier
+     * wrapper code.
+     */
+    async getConfigBackup(backupFile) {
+        return await this.readConfigBackup(backupFile);
+    }
+    /**
+     * Return all capability rules that currently include the given principal.
+     *
+     * This is a client-side convenience method derived from `getConfig()`. It
+     * does not require a dedicated server endpoint.
+     */
+    async findSystemAdminAccess(principal) {
+        const config = await this.getConfig();
+        const principalKey = normalizePrincipalKey(principal);
+        const rules = Object.entries(config.capabilities)
+            .filter(([, principals]) => principals.some((existing) => normalizePrincipalKey(existing) === principalKey))
+            .map(([rule]) => rule)
+            .sort();
+        return {
+            principal: { ...principal },
+            rules,
+        };
+    }
+    /**
+     * Grant a principal access to one or more capability rules.
+     *
+     * Missing rules are created automatically. Existing principal entries are
+     * deduplicated by `username.toLowerCase()` + `publicsignkey`.
+     */
+    async grantSystemAdminAccess(principal, rules) {
+        if (rules.length === 0) {
+            throw new Error("grantSystemAdminAccess requires at least one rule");
+        }
+        const config = await this.getConfig();
+        const nextConfig = cloneServerConfig(config);
+        const principalKey = normalizePrincipalKey(principal);
+        const addedToRules = [];
+        const alreadyPresentRules = [];
+        for (const rule of rules) {
+            const existing = nextConfig.capabilities[rule] ?? [];
+            const alreadyPresent = existing.some((candidate) => normalizePrincipalKey(candidate) === principalKey);
+            if (alreadyPresent) {
+                alreadyPresentRules.push(rule);
+                continue;
+            }
+            nextConfig.capabilities[rule] = dedupePrincipals([
+                ...existing,
+                { ...principal },
+            ]);
+            addedToRules.push(rule);
+        }
+        const result = await this.updateConfig(nextConfig);
+        return {
+            success: result.success,
+            config: nextConfig,
+            addedToRules,
+            alreadyPresentRules,
+            backupFile: result.backupFile,
+        };
+    }
+    /**
+     * Revoke a principal from selected capability rules, or from all rules when
+     * no `rules` filter is provided.
+     */
+    async revokeSystemAdminAccess(principal, options) {
+        const config = await this.getConfig();
+        const nextConfig = cloneServerConfig(config);
+        const principalKey = normalizePrincipalKey(principal);
+        const targetRules = options?.rules ?? Object.keys(nextConfig.capabilities);
+        const removedFromRules = [];
+        for (const rule of targetRules) {
+            const existing = nextConfig.capabilities[rule];
+            if (!existing) {
+                continue;
+            }
+            const filtered = existing.filter((candidate) => normalizePrincipalKey(candidate) !== principalKey);
+            if (filtered.length === existing.length) {
+                continue;
+            }
+            removedFromRules.push(rule);
+            if (filtered.length === 0) {
+                delete nextConfig.capabilities[rule];
+            }
+            else {
+                nextConfig.capabilities[rule] = filtered;
+            }
+        }
+        const result = await this.updateConfig(nextConfig);
+        return {
+            success: result.success,
+            config: nextConfig,
+            removedFromRules,
+            backupFile: result.backupFile,
+        };
+    }
+    // =========================================================================
+    // Internal: auth + request
+    // =========================================================================
+    async authenticatedRequest(method, path, body) {
+        const token = await this.ensureAuthenticated();
+        const headers = {
+            "Content-Type": "application/json",
+            Authorization: `Bearer ${token}`,
+        };
+        const response = await fetch(`${this.baseUrl}${path}`, {
+            method,
+            headers,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+        if (!response.ok) {
+            const errorBody = await response.text();
+            throw new Error(`MindooDBServerAdmin: ${method} ${path} failed (HTTP ${response.status}): ${errorBody}`);
+        }
+        return response.json();
+    }
+    async ensureAuthenticated() {
+        if (this.cachedToken && Date.now() < this.tokenExpiresAt - 60000) {
+            return this.cachedToken;
+        }
+        const subtle = this.cryptoAdapter.getSubtle();
+        const signingKeyBuffer = await this.decryptPrivateKey(this.adminUser.userSigningKeyPair.privateKey, this.adminPassword, "signing");
+        const signingKey = await subtle.importKey("pkcs8", signingKeyBuffer, { name: "Ed25519" }, false, ["sign"]);
+        const challengeRes = await fetch(`${this.baseUrl}/system/auth/challenge`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                username: this.adminUser.username,
+                publicsignkey: this.adminUser.userSigningKeyPair.publicKey,
+            }),
+        });
+        if (!challengeRes.ok) {
+            const errorBody = await challengeRes.text();
+            throw new Error(`MindooDBServerAdmin: challenge request failed (HTTP ${challengeRes.status}): ${errorBody}`);
+        }
+        const { challenge } = (await challengeRes.json());
+        const messageBytes = new TextEncoder().encode(challenge);
+        const signatureBuffer = await subtle.sign({ name: "Ed25519" }, signingKey, messageBytes);
+        const signatureBase64 = uint8ArrayToBase64(new Uint8Array(signatureBuffer));
+        const authRes = await fetch(`${this.baseUrl}/system/auth/authenticate`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ challenge, signature: signatureBase64 }),
+        });
+        if (!authRes.ok) {
+            const errorBody = await authRes.text();
+            throw new Error(`MindooDBServerAdmin: authenticate request failed (HTTP ${authRes.status}): ${errorBody}`);
+        }
+        const result = (await authRes.json());
+        if (!result.success || !result.token) {
+            throw new Error(`MindooDBServerAdmin: authentication failed: ${result.error || "unknown error"}`);
+        }
+        this.cachedToken = result.token;
+        this.tokenExpiresAt = Date.now() + 55 * 60 * 1000;
+        return result.token;
+    }
+    /**
+     * Decrypt a PBKDF2 + AES-GCM encrypted private key (same layout as BaseMindooTenant).
+     */
+    async decryptPrivateKey(encrypted, password, saltString) {
+        return (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, encrypted, password, saltString);
+    }
+}
+exports.MindooDBServerAdmin = MindooDBServerAdmin;
+//# sourceMappingURL=MindooDBServerAdmin.js.map

package/dist/core/MindooDBServerAdmin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MindooDBServerAdmin.js","sourceRoot":"","sources":["../../src/core/MindooDBServerAdmin.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAGH,wEAAmG;AA2EnG,SAAS,kBAAkB,CAAC,KAAiB;IAC3C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,SAA+B;IAC5D,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC,aAAa,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,gBAAgB,CAAC,UAAkC;IAC1D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,GAAG,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAoB;IAC7C,OAAO;QACL,YAAY,EAAE,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;YAC9D,IAAI;YACJ,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;SAClD,CAAC,CACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAa,mBAAmB;IAS9B;;OAEG;IACH,YAAY,OAAmC;QANvC,gBAAW,GAAkB,IAAI,CAAC;QAClC,mBAAc,GAAW,CAAC,CAAC;QAMjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC;QACzC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC;QACjD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;IAED,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAE5E;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACtE,OAAQ,GAA6B,CAAC,OAAO,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAClB,QAAgB,EAChB,IAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,MAAM,EACN,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACjD,IAAI,CACL,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,OAAgC;QAEhC,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,KAAK,EACL,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACjD,OAAO,CACR,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB;QAEhB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,QAAQ,EACR,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,4BAA4B;IAC5B,4EAA4E;IAE5E;;OAEG;IACH,KAAK,CAAC,kBAAkB;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QAC9E,OAAQ,GAAoC,CAAC,OAAO,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAqB;QAC1C,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,yBAAyB,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CAAC,UAAkB;QAC1C,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,QAAQ,EACR,2BAA2B,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC5D,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,oCAAoC;IACpC,4EAA4E;IAE5E;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,QAAgB;QAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,CACzC,KAAK,EACL,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,eAAe,CAC/D,CAAC;QACF,OAAQ,GAAuC,CAAC,OAAO,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,mBAAmB,CACvB,QAAgB,EAChB,MAAwB;QAExB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,MAAM,EACN,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,eAAe,EAC9D,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,sBAAsB,CAC1B,QAAgB,EAChB,UAAkB;QAElB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,QAAQ,EACR,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,kBAAkB,CAAC,UAAU,CAAC,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,eAAe;IACf,4EAA4E;IAE5E;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,QAAgB;QAEhB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,MAAM,EACN,mBAAmB,kBAAkB,CAAC,QAAQ,CAAC,eAAe,CAC/D,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,4BAA4B;IAC5B,4EAA4E;IAE5E;;OAEG;IACH,KAAK,CAAC,SAAS;QACb,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IAClE,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAChB,MAAoB;QAEpB,OAAO,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;QAC7E,OAAQ,GAAuC,CAAC,OAAO,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QACvC,OAAO,MAAM,IAAI,CAAC,oBAAoB,CACpC,KAAK,EACL,0BAA0B,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAC3D,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,UAAkB;QACtC,OAAO,MAAM,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,qBAAqB,CACzB,SAA+B;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;aAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CACzB,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,YAAY,CAAC,CAChF;aACA,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;aACrB,IAAI,EAAE,CAAC;QAEV,OAAO;YACL,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE;YAC3B,KAAK;SACN,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,sBAAsB,CAC1B,SAA+B,EAC/B,KAAe;QAQf,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,mBAAmB,GAAa,EAAE,CAAC;QAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,CAClC,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,KAAK,YAAY,CACjE,CAAC;YAEF,IAAI,cAAc,EAAE,CAAC;gBACnB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YAED,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC;gBAC/C,GAAG,QAAQ;gBACX,EAAE,GAAG,SAAS,EAAE;aACjB,CAAC,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,UAAU;YAClB,YAAY;YACZ,mBAAmB;YACnB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,uBAAuB,CAC3B,SAA+B,EAC/B,OAA8B;QAO9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,YAAY,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3E,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAC9B,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,KAAK,YAAY,CACjE,CAAC;YAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACxC,SAAS;YACX,CAAC;YAED,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACvC,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,UAAU;YAClB,gBAAgB;YAChB,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,2BAA2B;IAC3B,4EAA4E;IAEpE,KAAK,CAAC,oBAAoB,CAChC,MAAc,EACd,IAAY,EACZ,IAAc;QAEd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAE/C,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,UAAU,KAAK,EAAE;SACjC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,GAAG,IAAI,EAAE,EAAE;YACrD,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,IAAI,IAAI,iBAAiB,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CACxF,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,mBAAmB;QAC/B,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,KAAM,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;QAE9C,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,iBAAiB,CACnD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,UAAiC,EACnE,IAAI,CAAC,aAAa,EAClB,SAAS,CACV,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,OAAO,EACP,gBAAgB,EAChB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,wBAAwB,EAAE;YACxE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;gBACjC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,SAAS;aAC3D,CAAC;SACH,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,uDAAuD,YAAY,CAAC,MAAM,MAAM,SAAS,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA0B,CAAC;QAE3E,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,IAAI,CACvC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,UAAU,EACV,YAAY,CACb,CAAC;QACF,MAAM,eAAe,GAAG,kBAAkB,CAAC,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;QAE5E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,2BAA2B,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;SAChE,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,0DAA0D,OAAO,CAAC,MAAM,MAAM,SAAS,EAAE,CAC1F,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAInC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,+CAA+C,MAAM,CAAC,KAAK,IAAI,eAAe,EAAE,CACjF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAElD,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,iBAAiB,CAC7B,SAA8B,EAC9B,QAAgB,EAChB,UAAkB;QAElB,OAAO,IAAA,wCAA6B,EAClC,IAAI,CAAC,aAAa,EAClB,SAAS,EACT,QAAQ,EACR,UAAU,CACX,CAAC;IACJ,CAAC;CACF;AAhdD,kDAgdC"}

package/dist/core/appendonlystores/BasicOnDiskContentAddressedStore.d.ts

@@ -0,0 +1,68 @@
+import { ContentAddressedStore, ContentAddressedStoreFactory, CreateStoreResult, OpenStoreOptions, StoreIndexBuildStatus, AwaitIndexReadyOptions, StoreScanCursor, StoreScanFilters, StoreScanResult, StoreIdBloomSummary } from "./types";
+import type { StoreEntry, StoreEntryMetadata, StoreEntryType } from "../types";
+import { Logger } from "../logging";
+/**
+ * Simple persistent on-disk ContentAddressedStore implementation.
+ * Uses metadata files by id and binary content files by contentHash.
+ * Supports reset-on-start and optional in-memory indexing.
+ */
+export declare class BasicOnDiskContentAddressedStore implements ContentAddressedStore {
+    private readonly dbId;
+    private readonly logger;
+    private readonly storeRoot;
+    private readonly entriesDir;
+    private readonly contentDir;
+    private readonly metadataIndexPath;
+    private readonly indexingEnabled;
+    private initPromise;
+    private entries;
+    private docIndex;
+    private contentRefCount;
+    private orderedMetadata;
+    private indexStatus;
+    constructor(dbId: string, logger?: Logger, options?: OpenStoreOptions);
+    private initialize;
+    private ensureInitialized;
+    private clearAllLocalDataInternal;
+    private rebuildInMemoryIndexes;
+    private tryLoadPersistedIndex;
+    private validatePersistedIndexCoverage;
+    private persistMetadataIndex;
+    private compareMetadata;
+    private lowerBoundForCursor;
+    private metadataMatchesFilters;
+    private insertOrderedMetadata;
+    private removeOrderedMetadataById;
+    private listEntryFiles;
+    private metadataPathForId;
+    private contentPathForHash;
+    private fileExists;
+    private writeFileAtomic;
+    private syncParentDirectory;
+    private readMetadataById;
+    private readMetadataByFileName;
+    private listAllMetadata;
+    getId(): string;
+    putEntries(entries: StoreEntry[]): Promise<void>;
+    getEntries(ids: string[]): Promise<StoreEntry[]>;
+    hasEntries(ids: string[]): Promise<string[]>;
+    findNewEntries(knownIds: string[]): Promise<StoreEntryMetadata[]>;
+    findNewEntriesForDoc(knownIds: string[], docId: string): Promise<StoreEntryMetadata[]>;
+    findEntries(type: StoreEntryType, creationDateFrom: number | null, creationDateUntil: number | null): Promise<StoreEntryMetadata[]>;
+    getAllIds(): Promise<string[]>;
+    /**
+     * Cursor-based metadata scan for high-volume synchronization.
+     * Ordering: createdAt ASC, id ASC.
+     */
+    scanEntriesSince(cursor: StoreScanCursor | null, limit?: number, filters?: StoreScanFilters): Promise<StoreScanResult>;
+    getIdBloomSummary(): Promise<StoreIdBloomSummary>;
+    resolveDependencies(startId: string, options?: Record<string, unknown>): Promise<string[]>;
+    purgeDocHistory(docId: string): Promise<void>;
+    clearAllLocalData(): Promise<void>;
+    awaitIndexReady(_options?: AwaitIndexReadyOptions): Promise<StoreIndexBuildStatus>;
+    getIndexBuildStatus(): StoreIndexBuildStatus;
+}
+export declare class BasicOnDiskContentAddressedStoreFactory implements ContentAddressedStoreFactory {
+    createStore(dbId: string, options?: OpenStoreOptions): CreateStoreResult;
+}
+//# sourceMappingURL=BasicOnDiskContentAddressedStore.d.ts.map