mindoodb 0.0.2 → 0.0.4

package/dist/node/cli/identity-info.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export declare const HELP_TEXT = "mindoodb identity:info - display public information from an identity file\n\nUsage:\n  npm run identity:info -- --identity <path>\n  ./mindoodb-cli.sh identity:info <file>\n\nOptions:\n  --identity <path>   Path to an *.identity.json file (required)\n  --help              Show this help\n";
+export declare function run(argv?: string[]): Promise<number>;
+//# sourceMappingURL=identity-info.d.ts.map

package/dist/node/cli/identity-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-info.d.ts","sourceRoot":"","sources":["../../../src/node/cli/identity-info.ts"],"names":[],"mappings":";AAKA,eAAO,MAAM,SAAS,sSASrB,CAAC;AAYF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAejF"}

package/dist/node/cli/identity-info.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HELP_TEXT = void 0;
+exports.run = run;
+const NodeCryptoAdapter_1 = require("../crypto/NodeCryptoAdapter");
+const cli_utils_1 = require("./cli-utils");
+exports.HELP_TEXT = `mindoodb identity:info - display public information from an identity file
+
+Usage:
+  npm run identity:info -- --identity <path>
+  ./mindoodb-cli.sh identity:info <file>
+
+Options:
+  --identity <path>   Path to an *.identity.json file (required)
+  --help              Show this help
+`;
+async function hashUsernameHex(username) {
+    const cryptoAdapter = new NodeCryptoAdapter_1.NodeCryptoAdapter();
+    const subtle = cryptoAdapter.getSubtle();
+    const bytes = new TextEncoder().encode(username.toLowerCase());
+    const digest = await subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+async function run(argv = process.argv.slice(2)) {
+    const args = (0, cli_utils_1.parseArgs)(argv);
+    const identityPath = (0, cli_utils_1.requireIdentityArg)(args, exports.HELP_TEXT);
+    const identity = (0, cli_utils_1.loadPrivateIdentity)(identityPath);
+    const usernameHash = await hashUsernameHex(identity.username);
+    console.log(`Identity file: ${identityPath}`);
+    console.log(`Username: ${identity.username}`);
+    console.log(`Public user ID (hex): ${usernameHash}`);
+    console.log(`Signing public key:\n${identity.userSigningKeyPair.publicKey}`);
+    console.log(`Encryption public key:\n${identity.userEncryptionKeyPair.publicKey}`);
+    console.log(`Salt strings: signing, encryption`);
+    console.log(`Encrypted private keys present: yes`);
+    return 0;
+}
+function isDirectExecution() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    return /[/\\]identity-info\.(ts|js|mjs|cjs)$/.test(entry);
+}
+if (isDirectExecution()) {
+    run().then((exitCode) => process.exit(exitCode), (error) => {
+        if (error instanceof cli_utils_1.CliUsageError) {
+            console.log(error.message);
+            process.exit(error.exitCode);
+        }
+        console.error("Fatal error:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=identity-info.js.map

package/dist/node/cli/identity-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-info.js","sourceRoot":"","sources":["../../../src/node/cli/identity-info.ts"],"names":[],"mappings":";;;;AA0BA,kBAeC;AAvCD,mEAAgE;AAChE,2CAAgG;AAEnF,QAAA,SAAS,GAAG;;;;;;;;;CASxB,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,aAAa,GAAG,IAAI,qCAAiB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,GAAG,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAA,qBAAS,EAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAA,8BAAkB,EAAC,IAAI,EAAE,iBAAS,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAA,+BAAmB,EAAC,YAAY,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE9D,OAAO,CAAC,GAAG,CAAC,kBAAkB,YAAY,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,CAAC,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,CAAC,qBAAqB,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IAEnD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,GAAG,EAAE,CAAC,IAAI,CACR,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EACpC,CAAC,KAAK,EAAE,EAAE;QACR,IAAI,KAAK,YAAY,yBAAa,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/node/index.d.ts

@@ -1,3 +1,5 @@
 export * from "../core";
 export { NodeCryptoAdapter, createCryptoAdapter } from "./crypto/NodeCryptoAdapter";
+export { BasicOnDiskContentAddressedStore, BasicOnDiskContentAddressedStoreFactory, } from "./appendonlystores/BasicOnDiskContentAddressedStore";
+export { FileSystemLocalCacheStore } from "./cache/FileSystemLocalCacheStore";
 //# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAIA,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAIA,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGpF,OAAO,EACL,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,qDAAqD,CAAC;AAG7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/node/index.js

@@ -16,11 +16,18 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCryptoAdapter = exports.NodeCryptoAdapter = void 0;
+exports.FileSystemLocalCacheStore = exports.BasicOnDiskContentAddressedStoreFactory = exports.BasicOnDiskContentAddressedStore = exports.createCryptoAdapter = exports.NodeCryptoAdapter = void 0;
 // Re-export all core exports
 __exportStar(require("../core"), exports);
 // Node.js-specific crypto adapter
 var NodeCryptoAdapter_1 = require("./crypto/NodeCryptoAdapter");
 Object.defineProperty(exports, "NodeCryptoAdapter", { enumerable: true, get: function () { return NodeCryptoAdapter_1.NodeCryptoAdapter; } });
 Object.defineProperty(exports, "createCryptoAdapter", { enumerable: true, get: function () { return NodeCryptoAdapter_1.createCryptoAdapter; } });
+// Node.js-specific persistent store implementation
+var BasicOnDiskContentAddressedStore_1 = require("./appendonlystores/BasicOnDiskContentAddressedStore");
+Object.defineProperty(exports, "BasicOnDiskContentAddressedStore", { enumerable: true, get: function () { return BasicOnDiskContentAddressedStore_1.BasicOnDiskContentAddressedStore; } });
+Object.defineProperty(exports, "BasicOnDiskContentAddressedStoreFactory", { enumerable: true, get: function () { return BasicOnDiskContentAddressedStore_1.BasicOnDiskContentAddressedStoreFactory; } });
+// Node.js-specific cache store
+var FileSystemLocalCacheStore_1 = require("./cache/FileSystemLocalCacheStore");
+Object.defineProperty(exports, "FileSystemLocalCacheStore", { enumerable: true, get: function () { return FileSystemLocalCacheStore_1.FileSystemLocalCacheStore; } });
 //# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,2BAA2B;AAC3B,wEAAwE;;;;;;;;;;;;;;;;;AAExE,6BAA6B;AAC7B,0CAAwB;AAExB,kCAAkC;AAClC,gEAAoF;AAA3E,sHAAA,iBAAiB,OAAA;AAAE,wHAAA,mBAAmB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,2BAA2B;AAC3B,wEAAwE;;;;;;;;;;;;;;;;;AAExE,6BAA6B;AAC7B,0CAAwB;AAExB,kCAAkC;AAClC,gEAAoF;AAA3E,sHAAA,iBAAiB,OAAA;AAAE,wHAAA,mBAAmB,OAAA;AAE/C,mDAAmD;AACnD,wGAG6D;AAF3D,oJAAA,gCAAgC,OAAA;AAChC,2JAAA,uCAAuC,OAAA;AAGzC,+BAA+B;AAC/B,+EAA8E;AAArE,sIAAA,yBAAyB,OAAA"}

package/dist/node/server/CapabilityMatcher.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Capability matching engine for system admin authorization.
+ *
+ * Parses `METHOD:PATHPATTERN` rules from config.json and checks whether
+ * a given (method, path, username, publicsignkey) tuple is authorized.
+ *
+ * Matching semantics:
+ * - Rule method `ALL` matches any HTTP method.
+ * - Path patterns use `*` as a wildcard that matches any remaining characters.
+ * - All matching rules are unioned; access is granted if *any* matching rule
+ *   lists a principal with both the correct username AND publicsignkey.
+ */
+import type { ServerConfig } from "./types";
+export declare class CapabilityMatcher {
+    private rules;
+    constructor(config: ServerConfig);
+    /**
+     * Hot-swap the internal rules from a new config.
+     * Existing authorization decisions in-flight are unaffected;
+     * subsequent calls to `isAuthorized` / `principalExists` use the new rules.
+     */
+    reload(config: ServerConfig): void;
+    private parseConfig;
+    /**
+     * Check whether a request is authorized.
+     *
+     * @returns `true` if any matching capability rule lists the given principal.
+     */
+    isAuthorized(httpMethod: string, httpPath: string, username: string, publicsignkey: string): boolean;
+    /**
+     * Check whether a principal exists in *any* capability rule.
+     * Used during challenge generation to reject unknown principals early.
+     */
+    principalExists(username: string, publicsignkey: string): boolean;
+    private methodMatches;
+    private principalMatches;
+    private isTenantCreationRule;
+    private isTenantCreationRequest;
+    /**
+     * Match a path pattern against a request path.
+     * `*` matches any remaining characters (greedy).
+     */
+    private pathMatches;
+}
+//# sourceMappingURL=CapabilityMatcher.d.ts.map

package/dist/node/server/CapabilityMatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityMatcher.d.ts","sourceRoot":"","sources":["../../../src/node/server/CapabilityMatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAwB,MAAM,SAAS,CAAC;AASlE,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAe;gBAEhB,MAAM,EAAE,YAAY;IAKhC;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAKlC,OAAO,CAAC,WAAW;IAUnB;;;;OAIG;IACH,YAAY,CACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO;IA2BV;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAuBjE,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,uBAAuB;IAI/B;;;OAGG;IACH,OAAO,CAAC,WAAW;CAoBpB"}

package/dist/node/server/CapabilityMatcher.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Capability matching engine for system admin authorization.
+ *
+ * Parses `METHOD:PATHPATTERN` rules from config.json and checks whether
+ * a given (method, path, username, publicsignkey) tuple is authorized.
+ *
+ * Matching semantics:
+ * - Rule method `ALL` matches any HTTP method.
+ * - Path patterns use `*` as a wildcard that matches any remaining characters.
+ * - All matching rules are unioned; access is granted if *any* matching rule
+ *   lists a principal with both the correct username AND publicsignkey.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityMatcher = void 0;
+const config_1 = require("./config");
+class CapabilityMatcher {
+    constructor(config) {
+        this.rules = [];
+        this.parseConfig(config);
+    }
+    /**
+     * Hot-swap the internal rules from a new config.
+     * Existing authorization decisions in-flight are unaffected;
+     * subsequent calls to `isAuthorized` / `principalExists` use the new rules.
+     */
+    reload(config) {
+        this.rules = [];
+        this.parseConfig(config);
+    }
+    parseConfig(config) {
+        for (const [ruleKey, principals] of Object.entries(config.capabilities)) {
+            const colonIdx = ruleKey.indexOf(":");
+            const method = ruleKey.substring(0, colonIdx).toUpperCase();
+            const pathPattern = ruleKey.substring(colonIdx + 1);
+            this.rules.push({ method, pathPattern, principals });
+        }
+    }
+    /**
+     * Check whether a request is authorized.
+     *
+     * @returns `true` if any matching capability rule lists the given principal.
+     */
+    isAuthorized(httpMethod, httpPath, username, publicsignkey) {
+        const method = httpMethod.toUpperCase();
+        const normalizedUsername = username.toLowerCase();
+        for (const rule of this.rules) {
+            if (!this.methodMatches(rule.method, method))
+                continue;
+            if (!this.pathMatches(rule.pathPattern, httpPath))
+                continue;
+            for (const principal of rule.principals) {
+                if (this.principalMatches(rule, method, httpPath, principal, normalizedUsername, publicsignkey)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Check whether a principal exists in *any* capability rule.
+     * Used during challenge generation to reject unknown principals early.
+     */
+    principalExists(username, publicsignkey) {
+        const normalizedUsername = username.toLowerCase();
+        for (const rule of this.rules) {
+            for (const principal of rule.principals) {
+                if (this.principalMatches(rule, rule.method, rule.pathPattern, principal, normalizedUsername, publicsignkey)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    methodMatches(ruleMethod, requestMethod) {
+        return ruleMethod === "ALL" || ruleMethod === requestMethod;
+    }
+    principalMatches(rule, requestMethod, requestPath, principal, normalizedUsername, publicsignkey) {
+        if (principal.username.toLowerCase() === normalizedUsername &&
+            principal.publicsignkey === publicsignkey) {
+            return true;
+        }
+        if ((0, config_1.isWildcardSystemAdminPrincipal)(principal) &&
+            this.isTenantCreationRule(rule.method, rule.pathPattern) &&
+            this.isTenantCreationRequest(requestMethod, requestPath)) {
+            return true;
+        }
+        return false;
+    }
+    isTenantCreationRule(method, pathPattern) {
+        return method === "POST" && pathPattern.startsWith("/system/tenants/");
+    }
+    isTenantCreationRequest(method, path) {
+        return method === "POST" && path.startsWith("/system/tenants/");
+    }
+    /**
+     * Match a path pattern against a request path.
+     * `*` matches any remaining characters (greedy).
+     */
+    pathMatches(pattern, requestPath) {
+        const starIdx = pattern.indexOf("*");
+        if (starIdx === -1) {
+            return pattern === requestPath;
+        }
+        const prefix = pattern.substring(0, starIdx);
+        const suffix = pattern.substring(starIdx + 1);
+        if (!requestPath.startsWith(prefix)) {
+            return false;
+        }
+        if (suffix.length === 0) {
+            return true;
+        }
+        return requestPath.endsWith(suffix);
+    }
+}
+exports.CapabilityMatcher = CapabilityMatcher;
+//# sourceMappingURL=CapabilityMatcher.js.map

package/dist/node/server/CapabilityMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityMatcher.js","sourceRoot":"","sources":["../../../src/node/server/CapabilityMatcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAGH,qCAA0D;AAQ1D,MAAa,iBAAiB;IAG5B,YAAY,MAAoB;QAC9B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAoB;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW,CAAC,MAAoB;QACtC,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAEpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY,CACV,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBAAE,SAAS;YACvD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAE5D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,QAAgB,EAAE,aAAqB;QACrD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,EAChB,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,UAAkB,EAAE,aAAqB;QAC7D,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,aAAa,CAAC;IAC9D,CAAC;IAEO,gBAAgB,CACtB,IAAgB,EAChB,aAAqB,EACrB,WAAmB,EACnB,SAA+B,EAC/B,kBAA0B,EAC1B,aAAqB;QAErB,IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YACvD,SAAS,CAAC,aAAa,KAAK,aAAa,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,IAAA,uCAA8B,EAAC,SAAS,CAAC;YACzC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;YACxD,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,EACxD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,MAAc,EAAE,WAAmB;QAC9D,OAAO,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACzE,CAAC;IAEO,uBAAuB,CAAC,MAAc,EAAE,IAAY;QAC1D,OAAO,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,OAAe,EAAE,WAAmB;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,KAAK,WAAW,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE9C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AA1JD,8CA0JC"}

package/dist/node/server/MindooDBServer.d.ts

@@ -0,0 +1,87 @@
+/**
+ * MindooDB Server - Express HTTP server implementing the sync API.
+ *
+ * Security features:
+ * - Capabilities-based system admin authorization via config.json
+ * - Challenge/response (Ed25519) authentication for /system/* endpoints
+ * - JWT-based session management for system admins
+ * - Input validation on all identifiers (path traversal prevention)
+ * - Rate limiting per endpoint tier
+ * - Security headers (helmet) and CORS
+ * - Error sanitization (no internal details leaked)
+ * - Request size limits and timeouts
+ */
+import express from "express";
+import { TenantManager } from "./TenantManager";
+import { SystemAdminAuthService } from "./SystemAdminAuth";
+import type { ServerConfig } from "./types";
+declare global {
+    namespace Express {
+        interface Request {
+            tenantId?: string;
+            systemAdmin?: {
+                username: string;
+                publicsignkey: string;
+            };
+        }
+    }
+}
+export declare class MindooDBServer {
+    private app;
+    private tenantManager;
+    private capabilityMatcher;
+    private systemAdminAuth;
+    private readonly staticDir;
+    private serverConfig;
+    private configPath;
+    constructor(dataDir: string, serverPassword?: string, staticDir?: string, config?: ServerConfig, configPath?: string);
+    getApp(): express.Application;
+    getTenantManager(): TenantManager;
+    getSystemAdminAuth(): SystemAdminAuthService;
+    getServerConfig(): ServerConfig;
+    getConfigPath(): string;
+    reloadConfig(newConfig: ServerConfig): void;
+    listen(port: number): void;
+    listenTls(port: number, certPath: string, keyPath: string): void;
+    private setupMiddleware;
+    private setupRoutes;
+    /**
+     * JWT-based middleware for /system/* routes (excluding /system/auth/*).
+     * Extracts and validates the bearer token, then checks capabilities
+     * for the current (method, path, username, publicsignkey).
+     */
+    private systemAdminMiddleware;
+    private tenantMiddleware;
+    private setupSystemRoutes;
+    private handleSystemChallenge;
+    private handleSystemAuthenticate;
+    private handleUpdateConfig;
+    private createTenantRouter;
+    private validateDbId;
+    private handleChallenge;
+    private handleAuthenticate;
+    private handleFindNewEntries;
+    private handleFindNewEntriesForDoc;
+    private handleFindEntries;
+    private handleScanEntriesSince;
+    private handleGetIdBloomSummary;
+    private handleGetCapabilities;
+    private handleGetCompactionStatus;
+    private handleGetEntries;
+    private handlePutEntries;
+    private handleHasEntries;
+    private handleGetAllIds;
+    private handleResolveDependencies;
+    private handlePlanDocumentMaterialization;
+    private handlePlanDocumentMaterializationBatch;
+    private handleTriggerSync;
+    private extractToken;
+    private handleRequestError;
+    private getStatusForErrorType;
+    private errorHandler;
+    private serializeEntryMetadata;
+    private deserializeEntry;
+    private uint8ArrayToBase64;
+    private base64ToUint8Array;
+}
+//# sourceMappingURL=MindooDBServer.d.ts.map

package/dist/node/server/MindooDBServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MindooDBServer.d.ts","sourceRoot":"","sources":["../../../src/node/server/MindooDBServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,OAAoD,MAAM,SAAS,CAAC;AAqB3E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAc3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAwB5C,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,WAAW,CAAC,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,aAAa,EAAE,MAAM,CAAA;aAAE,CAAC;SAC3D;KACF;CACF;AAsCD,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,UAAU,CAAS;gBAGzB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,YAAY,EACrB,UAAU,CAAC,EAAE,MAAM;IA8BrB,MAAM,IAAI,OAAO,CAAC,WAAW;IAI7B,gBAAgB,IAAI,aAAa;IAIjC,kBAAkB,IAAI,sBAAsB;IAI5C,eAAe,IAAI,YAAY;IAI/B,aAAa,IAAI,MAAM;IAIvB,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI;IAM3C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ1B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAahE,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,WAAW;IAqEnB;;;;OAIG;YACW,qBAAqB;IA4CnC,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,iBAAiB;YAoVX,qBAAqB;YAmCrB,wBAAwB;YA2BxB,kBAAkB;IA2DhC,OAAO,CAAC,kBAAkB;IA4C1B,OAAO,CAAC,YAAY;YAMN,eAAe;YAef,kBAAkB;YAwBlB,oBAAoB;YAmBpB,0BAA0B;YAuB1B,iBAAiB;YAuBjB,sBAAsB;YA8BtB,uBAAuB;YAevB,qBAAqB;YAarB,yBAAyB;YAezB,gBAAgB;YAsBhB,gBAAgB;YAqBhB,gBAAgB;YAiBhB,eAAe;YAef,yBAAyB;YAoBzB,iCAAiC;YAqBjC,sCAAsC;YAoBtC,iBAAiB;IAM/B,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,qBAAqB;IAiB7B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,sBAAsB;IAgB9B,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,kBAAkB;CAG3B"}