mindoodb 0.0.23 → 0.0.32

package/dist/core/crypto/EntrySignature.js

@@ -0,0 +1,210 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENTRY_SIGNATURE_LAYOUT_VERSION = void 0;
+exports.buildEntrySigningBytes = buildEntrySigningBytes;
+exports.entrySignatureFieldsFromEntry = entrySignatureFieldsFromEntry;
+exports.signEntryMetadata = signEntryMetadata;
+exports.verifyEntrySignatureWithImportedKey = verifyEntrySignatureWithImportedKey;
+exports.verifyEntrySignatureCrypto = verifyEntrySignatureCrypto;
+/**
+ * Author entry signatures (security hardening, audit finding #5).
+ *
+ * Historically (early betas) a store entry's author signature (`StoreEntryMetadata.signature`)
+ * covered ONLY the encrypted payload bytes. That leaves every cleartext metadata
+ * field (`entryType`, `docId`, `decryptionKeyId`, `createdAt`, `dependencyIds`,
+ * `contentHash`, ...) unauthenticated: a relay holding any trusted key could
+ * tweak metadata on an un-witnessed/legacy entry and the legacy signature would
+ * still verify.
+ *
+ * This module adds a second, stronger author signature
+ * (`StoreEntryMetadata.metadataSignature`) computed over a **fixed, versioned,
+ * length-prefixed byte layout** that binds the security-relevant metadata
+ * alongside the `contentHash` (which itself is `SHA-256(encryptedData)`, so the
+ * ciphertext is transitively bound). It mirrors {@link WitnessReceipt} in style
+ * and is intentionally free of tenant/IO dependencies so it can be reused on
+ * both client and server and unit-tested in isolation.
+ *
+ * Backward compatibility: writers populate BOTH `signature` (legacy, over
+ * ciphertext) and `metadataSignature`. Verifiers prefer `metadataSignature`
+ * when present and fall back to the legacy `signature` for v1/legacy entries
+ * that predate this field, so old entries remain readable.
+ */
+/**
+ * Version byte of the canonical entry-signature layout. Any change to the field
+ * set or ordering MUST bump this value (and verifiers MUST reject unknown
+ * versions).
+ *
+ * Exception — backward-compatible trailing extensions: a strictly trailing,
+ * optional block whose absence produces ZERO bytes (so the layout is
+ * byte-identical to the prior version for entries that do not carry the new
+ * data) does NOT bump this value. The `attachmentRefs` block (see
+ * {@link buildEntrySigningBytes}) is such an extension: attachment-free entries —
+ * including every entry signed before the field existed — are unaffected and
+ * keep verifying.
+ */
+exports.ENTRY_SIGNATURE_LAYOUT_VERSION = 0x01;
+const textEncoder = new TextEncoder();
+function pushLengthPrefixed(parts, bytes) {
+    const lengthPrefix = new Uint8Array(4);
+    new DataView(lengthPrefix.buffer).setUint32(0, bytes.length, false /* big-endian */);
+    parts.push(lengthPrefix, bytes);
+}
+function pushString(parts, value) {
+    pushLengthPrefixed(parts, textEncoder.encode(value));
+}
+function pushUint32BE(parts, value) {
+    const buf = new Uint8Array(4);
+    new DataView(buf.buffer).setUint32(0, value >>> 0, false /* big-endian */);
+    parts.push(buf);
+}
+function pushInt64BE(parts, value) {
+    if (!Number.isInteger(value)) {
+        throw new Error(`Entry signature int64 field must be an integer, got: ${value}`);
+    }
+    const buf = new Uint8Array(8);
+    new DataView(buf.buffer).setBigInt64(0, BigInt(value), false /* big-endian */);
+    parts.push(buf);
+}
+/**
+ * Build the canonical, versioned, length-prefixed byte layout the author signs
+ * over.
+ *
+ * Layout:
+ * ```
+ * version(1 byte)
+ *  || len(entryType)          || entryType
+ *  || len(id)                 || id
+ *  || len(docId)              || docId
+ *  || len(decryptionKeyId)    || decryptionKeyId
+ *  || int64BE(createdAt)
+ *  || uint32BE(dependencyIds.length)
+ *  || ( len(dep) || dep ) *   (in array order)
+ *  || len(contentHash)        || contentHash
+ *  || len(createdByPublicKey) || createdByPublicKey
+ *  -- trailing attachmentRefs block, PRESENT ONLY IF attachmentRefs.length > 0 --
+ *  || uint32BE(attachmentRefs.length)
+ *  || ( len(attachmentId) || attachmentId
+ *       || len(lastChunkId) || lastChunkId
+ *       || int64BE(size) ) * (one triple per ref, in array order)
+ * ```
+ *
+ * The attachmentRefs block is a deliberately backward-compatible TRAILING
+ * extension: it is appended ONLY when there is at least one ref, so an
+ * attachment-free entry (every entry written before this field existed, and
+ * every future text-only revision) produces byte-for-byte the same input as the
+ * original layout and its existing signature still verifies. This is why the
+ * version byte intentionally stays `0x01` and is NOT bumped despite the new
+ * field: absence is byte-identical to the prior layout. Callers MUST treat an
+ * empty array as absent (the canonicalization in {@link entrySignatureFieldsFromEntry}
+ * guarantees this) and emit refs in a stable order (the writer sorts by
+ * `attachmentId`) so signing and verification produce identical bytes.
+ */
+function buildEntrySigningBytes(fields, version = exports.ENTRY_SIGNATURE_LAYOUT_VERSION) {
+    const parts = [];
+    parts.push(new Uint8Array([version & 0xff]));
+    pushString(parts, fields.entryType);
+    pushString(parts, fields.id);
+    pushString(parts, fields.docId);
+    pushString(parts, fields.decryptionKeyId);
+    pushInt64BE(parts, fields.createdAt);
+    pushUint32BE(parts, fields.dependencyIds.length);
+    for (const dep of fields.dependencyIds) {
+        pushString(parts, dep);
+    }
+    pushString(parts, fields.contentHash);
+    pushString(parts, fields.createdByPublicKey);
+    // Backward-compatible trailing block: appended only when non-empty so that
+    // attachment-free entries remain byte-identical to the original v1 layout.
+    const attachmentRefs = fields.attachmentRefs;
+    if (attachmentRefs && attachmentRefs.length > 0) {
+        pushUint32BE(parts, attachmentRefs.length);
+        for (const ref of attachmentRefs) {
+            pushString(parts, ref.attachmentId);
+            pushString(parts, ref.lastChunkId);
+            pushInt64BE(parts, ref.size);
+        }
+    }
+    const total = parts.reduce((sum, p) => sum + p.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const p of parts) {
+        out.set(p, offset);
+        offset += p.length;
+    }
+    return out;
+}
+/** Project the signed fields out of an entry's metadata. */
+function entrySignatureFieldsFromEntry(entry) {
+    return {
+        entryType: entry.entryType,
+        id: entry.id,
+        docId: entry.docId,
+        decryptionKeyId: entry.decryptionKeyId,
+        createdAt: entry.createdAt,
+        dependencyIds: entry.dependencyIds,
+        contentHash: entry.contentHash,
+        createdByPublicKey: entry.createdByPublicKey,
+        // Canonicalize empty -> undefined so "no attachments" has a single byte
+        // representation (zero trailing bytes); see buildEntrySigningBytes.
+        attachmentRefs: entry.attachmentRefs && entry.attachmentRefs.length > 0
+            ? entry.attachmentRefs
+            : undefined,
+    };
+}
+/** Convert a PEM-encoded SPKI public key to an ArrayBuffer (dependency-free). */
+function pemToArrayBuffer(pem) {
+    const base64 = pem
+        .replace("-----BEGIN PUBLIC KEY-----", "")
+        .replace("-----END PUBLIC KEY-----", "")
+        .replace(/\s/g, "");
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
+/**
+ * Sign the canonical entry layout with an already-imported Ed25519 private key.
+ * Returns the raw signature bytes to store as `metadataSignature`.
+ */
+async function signEntryMetadata(fields, signingPrivateKey, subtle, version = exports.ENTRY_SIGNATURE_LAYOUT_VERSION) {
+    const bytes = buildEntrySigningBytes(fields, version);
+    const signature = await subtle.sign({ name: "Ed25519" }, signingPrivateKey, bytes.buffer);
+    return new Uint8Array(signature);
+}
+/**
+ * Pure cryptographic verification of an entry's author signature, version-aware.
+ *
+ * - If `metadataSignature` is present, verifies it over {@link buildEntrySigningBytes}
+ *   (strong, metadata-binding scheme; v2+).
+ * - Otherwise falls back to the legacy `signature` over `encryptedData`
+ *   (v1/legacy entries that predate the metadata-binding scheme).
+ *
+ * This does NOT decide whether the author key is *trusted* — callers must
+ * separately confirm the key via the tenant directory.
+ */
+async function verifyEntrySignatureWithImportedKey(entry, encryptedData, cryptoKey, subtle, opts) {
+    if (entry.metadataSignature) {
+        const bytes = buildEntrySigningBytes(entrySignatureFieldsFromEntry(entry));
+        return subtle.verify({ name: "Ed25519" }, cryptoKey, entry.metadataSignature.buffer, bytes.buffer);
+    }
+    // Storage-format floor (audit #5 follow-up): when the tenant requires the
+    // metadata-binding signature for this entry's trusted time, refuse to accept
+    // the weaker legacy ciphertext-only signature. Returning false routes the
+    // entry to the caller's fail-closed / quarantine path.
+    if (opts?.requireMetadataSignature) {
+        return false;
+    }
+    return subtle.verify({ name: "Ed25519" }, cryptoKey, entry.signature.buffer, encryptedData.buffer);
+}
+/**
+ * Same as {@link verifyEntrySignatureWithImportedKey} but imports the author's
+ * PEM-encoded public key first. Convenient for one-off verifications (e.g. on
+ * the server's push path) where no key cache is available.
+ */
+async function verifyEntrySignatureCrypto(entry, encryptedData, authorPublicKeyPem, subtle, opts) {
+    const cryptoKey = await subtle.importKey("spki", pemToArrayBuffer(authorPublicKeyPem), { name: "Ed25519" }, false, ["verify"]);
+    return verifyEntrySignatureWithImportedKey(entry, encryptedData, cryptoKey, subtle, opts);
+}
+//# sourceMappingURL=EntrySignature.js.map

package/dist/core/crypto/EntrySignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntrySignature.js","sourceRoot":"","sources":["../../../src/core/crypto/EntrySignature.ts"],"names":[],"mappings":";;;AA0IA,wDAsCC;AAGD,sEA8BC;AAoBD,8CASC;AAaD,kFAyCC;AAOD,gEA2BC;AApUD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;;;;GAYG;AACU,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAsCnD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAiB;IAChE,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,UAAU,CAAC,KAAmB,EAAE,KAAa;IACpD,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB,EAAE,KAAa;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAmB,EAAE,KAAa;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,sBAAsB,CACpC,MAA4B,EAC5B,UAAkB,sCAA8B;IAEhD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1C,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;QACvC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE7C,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAC7C,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,YAAY,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;YACnC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,SAAgB,6BAA6B,CAC3C,KAWC;IAED,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,wEAAwE;QACxE,oEAAoE;QACpE,cAAc,EACZ,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrD,CAAC,CAAC,KAAK,CAAC,cAAc;YACtB,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,iBAAiB,CACrC,MAA4B,EAC5B,iBAA4B,EAC5B,MAAoB,EACpB,UAAkB,sCAA8B;IAEhD,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,MAAqB,CAAC,CAAC;IACzG,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,mCAAmC,CACvD,KAYsC,EACtC,aAAyB,EACzB,SAAoB,EACpB,MAAoB,EACpB,IAAkC;IAElC,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,6BAA6B,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC,MAAM,CAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,KAAK,CAAC,iBAAiB,CAAC,MAAqB,EAC7C,KAAK,CAAC,MAAqB,CAC5B,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,IAAI,EAAE,wBAAwB,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,KAAK,CAAC,SAAS,CAAC,MAAqB,EACrC,aAAa,CAAC,MAAqB,CACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,0BAA0B,CAC9C,KAYsC,EACtC,aAAyB,EACzB,kBAA0B,EAC1B,MAAoB,EACpB,IAAkC;IAElC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,gBAAgB,CAAC,kBAAkB,CAAC,EACpC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,mCAAmC,CAAC,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC5F,CAAC"}

package/dist/core/crypto/MindooDocSigner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MindooDocSigner.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/MindooDocSigner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAoB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAoC,MAAM,YAAY,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM;IAQ9E;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,mBAAmB;IA6C3B;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA4C3F;;;;;;;;OAQG;IACG,WAAW,CACf,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;CAyCpB"}
+{"version":3,"file":"MindooDocSigner.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/MindooDocSigner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAoB,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAoC,MAAM,YAAY,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,OAAO,CAAiB;IAChC,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM;IAQ9E;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,mBAAmB;IA6C3B;;;;;;;;OAQG;IACG,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IA8C3F;;;;;;;;OAQG;IACG,WAAW,CACf,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EAAE,EACf,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC;CA2CpB"}

package/dist/core/crypto/MindooDocSigner.js

@@ -140,7 +140,9 @@ class MindooDocSigner {
         const docPayload = doc.getData();
         // Create canonical JSON representation
         const canonicalJSON = this.createCanonicalJSON(docPayload, items);
-        this.logger.debug(`Canonical JSON for signing: ${canonicalJSON}`);
+        // Do NOT log the canonical JSON itself: it is the plaintext document content
+        // being signed (audit, Medium: sensitive debug logging). Log only metadata.
+        this.logger.debug(`Building canonical payload for signing: ${items.length} item(s), ${canonicalJSON.length} chars`);
         // Convert to bytes (UTF-8 encoding)
         const encoder = new TextEncoder();
         const payloadBytes = encoder.encode(canonicalJSON);
@@ -172,7 +174,9 @@ class MindooDocSigner {
         const docPayload = doc.getData();
         // Create the same canonical JSON representation
         const canonicalJSON = this.createCanonicalJSON(docPayload, items);
-        this.logger.debug(`Canonical JSON for verification: ${canonicalJSON}`);
+        // Do NOT log the canonical JSON itself: it is the plaintext document content
+        // being verified (audit, Medium: sensitive debug logging). Log only metadata.
+        this.logger.debug(`Building canonical payload for verification: ${items.length} item(s), ${canonicalJSON.length} chars`);
         // Convert to bytes (UTF-8 encoding)
         const encoder = new TextEncoder();
         const payloadBytes = encoder.encode(canonicalJSON);

package/dist/core/crypto/MindooDocSigner.js.map

@@ -1 +1 @@
-{"version":3,"file":"MindooDocSigner.js","sourceRoot":"","sources":["../../../src/core/crypto/MindooDocSigner.ts"],"names":[],"mappings":";;;AAEA,wCAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAa,eAAe;IAK1B,YAAY,MAAwB,EAAE,OAAuB,EAAE,MAAe;QAC5E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM;YACT,MAAM;gBACN,IAAI,sBAAY,CAAC,IAAA,4BAAkB,GAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,mBAAmB,CAAC,OAAyB,EAAE,KAAe;QACpE,mCAAmC;QACnC,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,aAAa,GAAqB,EAAE,CAAC;QAC3C,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAW,EAAE;YAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,CAAC,0CAA0C;YACzD,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,0DAA0D;gBAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,aAAa,GAAqB,EAAE,CAAC;gBAC3C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,MAAM,SAAS,GAAI,KAA0B,CAAC,GAAG,CAAC,CAAC;oBACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,aAAa,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;gBACD,OAAO,aAAa,CAAC;YACvB,CAAC;YAED,sCAAsC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAc,EAAE,KAAe,EAAE,YAAoB;QACnE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAEjC,uCAAuC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,aAAa,EAAE,CAAC,CAAC;QAElE,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnD,8EAA8E;QAC9E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC5D,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,YAAY,EACZ,SAAS,CACV,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC;QAE1D,qDAAqD;QACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,OAAO,EACP,kBAAkB,EAClB;YACE,IAAI,EAAE,SAAS;SAChB,EACD,KAAK,EAAE,kBAAkB;QACzB,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC;YACE,IAAI,EAAE,SAAS;SAChB,EACD,UAAU,EACV,YAAY,CAAC,MAAqB,CACnC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,MAAM,sBAAsB,SAAS,CAAC,UAAU,SAAS,CAAC,CAAC;QAC7F,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,GAAc,EACd,KAAe,EACf,SAAqB,EACrB,SAAiB;QAEjB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAEjC,gDAAgD;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,aAAa,EAAE,CAAC,CAAC;QAEvE,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC;QAE1D,iEAAiE;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEhE,yCAAyC;QACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,eAAe,EACf;YACE,IAAI,EAAE,SAAS;SAChB,EACD,KAAK,EAAE,kBAAkB;QACzB,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC;YACE,IAAI,EAAE,SAAS;SAChB,EACD,SAAS,EACT,SAAS,CAAC,MAAqB,EAC/B,YAAY,CAAC,MAAqB,CACnC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACjB,CAAC;CAEF;AArLD,0CAqLC"}
+{"version":3,"file":"MindooDocSigner.js","sourceRoot":"","sources":["../../../src/core/crypto/MindooDocSigner.ts"],"names":[],"mappings":";;;AAEA,wCAAsE;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6DG;AACH,MAAa,eAAe;IAK1B,YAAY,MAAwB,EAAE,OAAuB,EAAE,MAAe;QAC5E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM;YACT,MAAM;gBACN,IAAI,sBAAY,CAAC,IAAA,4BAAkB,GAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACK,mBAAmB,CAAC,OAAyB,EAAE,KAAe;QACpE,mCAAmC;QACnC,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,aAAa,GAAqB,EAAE,CAAC;QAC3C,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACN,oEAAoE;gBACpE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,YAAY,GAAG,CAAC,KAAc,EAAW,EAAE;YAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,CAAC,0CAA0C;YACzD,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,0DAA0D;gBAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7C,MAAM,aAAa,GAAqB,EAAE,CAAC;gBAC3C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;oBAC7B,MAAM,SAAS,GAAI,KAA0B,CAAC,GAAG,CAAC,CAAC;oBACnD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;wBAC5B,aAAa,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;gBACD,OAAO,aAAa,CAAC;YACvB,CAAC;YAED,sCAAsC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;QAEF,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,SAAS,CAAC,GAAc,EAAE,KAAe,EAAE,YAAoB;QACnE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAEjC,uCAAuC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClE,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,KAAK,CAAC,MAAM,aAAa,aAAa,CAAC,MAAM,QAAQ,CAAC,CAAC;QAEpH,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnD,8EAA8E;QAC9E,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAC5D,IAAI,CAAC,OAAO,CAAC,UAAU,EACvB,YAAY,EACZ,SAAS,CACV,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC;QAE1D,qDAAqD;QACrD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CACvC,OAAO,EACP,kBAAkB,EAClB;YACE,IAAI,EAAE,SAAS;SAChB,EACD,KAAK,EAAE,kBAAkB;QACzB,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,mBAAmB;QACnB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CACjC;YACE,IAAI,EAAE,SAAS;SAChB,EACD,UAAU,EACV,YAAY,CAAC,MAAqB,CACnC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,MAAM,sBAAsB,SAAS,CAAC,UAAU,SAAS,CAAC,CAAC;QAC7F,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CACf,GAAc,EACd,KAAe,EACf,SAAqB,EACrB,SAAiB;QAEjB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAEjC,gDAAgD;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAClE,6EAA6E;QAC7E,8EAA8E;QAC9E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,KAAK,CAAC,MAAM,aAAa,aAAa,CAAC,MAAM,QAAQ,CAAC,CAAC;QAEzH,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAEnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,CAAC;QAE1D,iEAAiE;QACjE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAEhE,yCAAyC;QACzC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,eAAe,EACf;YACE,IAAI,EAAE,SAAS;SAChB,EACD,KAAK,EAAE,kBAAkB;QACzB,CAAC,QAAQ,CAAC,CACX,CAAC;QAEF,uBAAuB;QACvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CACjC;YACE,IAAI,EAAE,SAAS;SAChB,EACD,SAAS,EACT,SAAS,CAAC,MAAqB,EAC/B,YAAY,CAAC,MAAqB,CACnC,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACjB,CAAC;CAEF;AAzLD,0CAyLC"}

package/dist/core/crypto/WitnessReceipt.d.ts

@@ -0,0 +1,137 @@
+import { StoreEntryMetadata } from "../types";
+/**
+ * Witness receipts (docs/accesscontrol.md §5).
+ *
+ * A witness receipt is an Ed25519 signature, produced by a trusted sync server
+ * ("witness"), attesting that a store entry was accepted into the tenant at a
+ * specific `receivedAt` time and satisfied the Tier 1 (identity) access policy
+ * at that moment. Other replicas trust this attestation instead of
+ * re-evaluating Tier 1 forever, which keeps the system stable under eventual
+ * consistency (§4, Scenario C).
+ *
+ * The signature is computed over a **fixed, versioned, length-prefixed byte
+ * layout** rather than JSON, to avoid canonicalization ambiguity. The layout
+ * deliberately binds every attribute Tier 1 depends on — `entryType`, `dbid`
+ * and `decryptionKeyId` in particular — so a relay cannot transplant a receipt
+ * onto a different operation type, database, or key (§5.2).
+ *
+ * This module is intentionally free of any tenant/IO dependencies so it can be
+ * unit-tested in isolation and reused on both client and server.
+ */
+/**
+ * Version byte of the canonical signing layout. Any change to the field set or
+ * ordering MUST bump this value (and verifiers MUST reject unknown versions).
+ */
+export declare const WITNESS_RECEIPT_LAYOUT_VERSION = 1;
+/**
+ * The exact set of fields bound by a witness receipt signature, in the order
+ * they appear in the byte layout (§5.2).
+ */
+export interface WitnessReceiptFields {
+    /** Store entry operation type, e.g. `doc_create` / `doc_change`. */
+    entryType: string;
+    /**
+     * The database the witness accepted the entry under. This is the sync/store
+     * context, not necessarily a standalone metadata field; binding it prevents
+     * an entry witnessed for one database being presented as belonging to another.
+     */
+    dbid: string;
+    /** SHA-256 hash of the encrypted payload. */
+    contentHash: string;
+    /** Store entry id. */
+    id: string;
+    /** Document id the entry belongs to. */
+    docId: string;
+    /** Id of the symmetric key the entry was encrypted with. */
+    decryptionKeyId: string;
+    /** Author-reported creation time (ms epoch). */
+    createdAt: number;
+    /** Ed25519 public key (PEM) of the author. */
+    createdByPublicKey: string;
+    /** Witness-assigned acceptance time (ms epoch). */
+    receivedAt: number;
+    /** Ed25519 public key (PEM) of the witness. */
+    receivedByPublicKey: string;
+}
+/**
+ * Build the canonical, versioned, length-prefixed byte layout that a witness
+ * signs over (docs/accesscontrol.md §5.2).
+ *
+ * Layout:
+ * ```
+ * version(1 byte)
+ *  || len(entryType)          || entryType
+ *  || len(dbid)               || dbid
+ *  || len(contentHash)        || contentHash
+ *  || len(id)                 || id
+ *  || len(docId)              || docId
+ *  || len(decryptionKeyId)    || decryptionKeyId
+ *  || int64BE(createdAt)
+ *  || len(createdByPublicKey) || createdByPublicKey
+ *  || int64BE(receivedAt)
+ *  || len(receivedByPublicKey)|| receivedByPublicKey
+ * ```
+ */
+export declare function buildWitnessSigningBytes(fields: WitnessReceiptFields, version?: number): Uint8Array;
+/**
+ * Derive the {@link WitnessReceiptFields} for an entry the witness is about to
+ * stamp. `dbid`, `receivedAt` and `receivedByPublicKey` come from the witness's
+ * own context (which database it accepted the entry under, its clock, its key);
+ * everything else is read from the entry's existing metadata.
+ */
+export declare function witnessFieldsFromEntry(entry: Pick<StoreEntryMetadata, "entryType" | "contentHash" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "createdByPublicKey">, context: {
+    dbid: string;
+    receivedAt: number;
+    receivedByPublicKey: string;
+}): WitnessReceiptFields;
+/**
+ * Sign a witness receipt over {@link buildWitnessSigningBytes} using an already
+ * imported Ed25519 private `CryptoKey`. The caller (the witness/server) is
+ * responsible for decrypting and importing its own signing key.
+ *
+ * @returns the raw Ed25519 signature bytes (store as `receivedDateSignature`).
+ */
+export declare function signWitnessReceipt(fields: WitnessReceiptFields, signingPrivateKey: CryptoKey, subtle: SubtleCrypto, version?: number): Promise<Uint8Array>;
+/**
+ * The witness fields a server stamps onto an accepted entry (§5.3): the
+ * acceptance time, the witness identity, and the signature binding them to the
+ * entry. Merging this into an entry's metadata produces a witnessed entry.
+ */
+export interface StampedWitnessFields {
+    receivedAt: number;
+    receivedByPublicKey: string;
+    receivedDateSignature: Uint8Array;
+}
+/**
+ * A server's witness identity: its public key (PEM, stored as
+ * `receivedByPublicKey`) and the imported Ed25519 private key used to sign.
+ * Kept as a small struct so the server store can stamp receipts without
+ * depending on the full tenant crypto stack.
+ */
+export interface WitnessSigner {
+    publicKeyPem: string;
+    signingPrivateKey: CryptoKey;
+    subtle: SubtleCrypto;
+}
+/**
+ * Produce the witness fields for an entry the server has decided to accept
+ * (§5.3). The caller merges the returned fields into the stored metadata and
+ * echoes them back to the pushing client so every replica gets the receipt.
+ */
+export declare function stampEntryReceipt(entry: Pick<StoreEntryMetadata, "entryType" | "contentHash" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "createdByPublicKey">, context: {
+    dbid: string;
+    receivedAt: number;
+}, signer: WitnessSigner): Promise<StampedWitnessFields>;
+/**
+ * Verify a witness receipt signature against the witness public key (PEM).
+ *
+ * This is a pure cryptographic check of the signature over the §5.2 layout. It
+ * does NOT decide whether the witness is *trusted* — callers must separately
+ * confirm `receivedByPublicKey` is in the tenant's trusted-witness list and run
+ * the receipt-time validation rules (§5.4: per-witness monotonicity, wall-clock
+ * sanity) before relying on the attestation.
+ *
+ * Unknown layout versions are rejected.
+ */
+export declare function verifyWitnessReceipt(fields: WitnessReceiptFields, signature: Uint8Array, witnessPublicKeyPem: string, subtle: SubtleCrypto, version?: number): Promise<boolean>;
+//# sourceMappingURL=WitnessReceipt.d.ts.map

package/dist/core/crypto/WitnessReceipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"WitnessReceipt.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/WitnessReceipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAE9C;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;GAGG;AACH,eAAO,MAAM,8BAA8B,IAAO,CAAC;AAEnD;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AA6BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,oBAAoB,EAC5B,OAAO,GAAE,MAAuC,GAC/C,UAAU,CAsBZ;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,IAAI,CACT,kBAAkB,EAClB,WAAW,GAAG,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,iBAAiB,GAAG,WAAW,GAAG,oBAAoB,CACtG,EACD,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,GACzE,oBAAoB,CAatB;AAmBD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,oBAAoB,EAC5B,iBAAiB,EAAE,SAAS,EAC5B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,MAAuC,GAC/C,OAAO,CAAC,UAAU,CAAC,CAIrB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,qBAAqB,EAAE,UAAU,CAAC;CACnC;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,SAAS,CAAC;IAC7B,MAAM,EAAE,YAAY,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,IAAI,CACT,kBAAkB,EAClB,WAAW,GAAG,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,iBAAiB,GAAG,WAAW,GAAG,oBAAoB,CACtG,EACD,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC7C,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAY/B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,UAAU,EACrB,mBAAmB,EAAE,MAAM,EAC3B,MAAM,EAAE,YAAY,EACpB,OAAO,GAAE,MAAuC,GAC/C,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/dist/core/crypto/WitnessReceipt.js

@@ -0,0 +1,182 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WITNESS_RECEIPT_LAYOUT_VERSION = void 0;
+exports.buildWitnessSigningBytes = buildWitnessSigningBytes;
+exports.witnessFieldsFromEntry = witnessFieldsFromEntry;
+exports.signWitnessReceipt = signWitnessReceipt;
+exports.stampEntryReceipt = stampEntryReceipt;
+exports.verifyWitnessReceipt = verifyWitnessReceipt;
+/**
+ * Witness receipts (docs/accesscontrol.md §5).
+ *
+ * A witness receipt is an Ed25519 signature, produced by a trusted sync server
+ * ("witness"), attesting that a store entry was accepted into the tenant at a
+ * specific `receivedAt` time and satisfied the Tier 1 (identity) access policy
+ * at that moment. Other replicas trust this attestation instead of
+ * re-evaluating Tier 1 forever, which keeps the system stable under eventual
+ * consistency (§4, Scenario C).
+ *
+ * The signature is computed over a **fixed, versioned, length-prefixed byte
+ * layout** rather than JSON, to avoid canonicalization ambiguity. The layout
+ * deliberately binds every attribute Tier 1 depends on — `entryType`, `dbid`
+ * and `decryptionKeyId` in particular — so a relay cannot transplant a receipt
+ * onto a different operation type, database, or key (§5.2).
+ *
+ * This module is intentionally free of any tenant/IO dependencies so it can be
+ * unit-tested in isolation and reused on both client and server.
+ */
+/**
+ * Version byte of the canonical signing layout. Any change to the field set or
+ * ordering MUST bump this value (and verifiers MUST reject unknown versions).
+ */
+exports.WITNESS_RECEIPT_LAYOUT_VERSION = 0x01;
+const textEncoder = new TextEncoder();
+/**
+ * Append a 32-bit big-endian length prefix followed by the raw bytes.
+ * `len(x)` in the §5.2 layout.
+ */
+function pushLengthPrefixed(parts, bytes) {
+    const lengthPrefix = new Uint8Array(4);
+    new DataView(lengthPrefix.buffer).setUint32(0, bytes.length, false /* big-endian */);
+    parts.push(lengthPrefix, bytes);
+}
+/** Append a UTF-8, length-prefixed string. */
+function pushString(parts, value) {
+    pushLengthPrefixed(parts, textEncoder.encode(value));
+}
+/** Append a 64-bit big-endian integer (`int64BE` in the §5.2 layout). */
+function pushInt64BE(parts, value) {
+    if (!Number.isInteger(value)) {
+        throw new Error(`Witness receipt int64 field must be an integer, got: ${value}`);
+    }
+    const buf = new Uint8Array(8);
+    new DataView(buf.buffer).setBigInt64(0, BigInt(value), false /* big-endian */);
+    parts.push(buf);
+}
+/**
+ * Build the canonical, versioned, length-prefixed byte layout that a witness
+ * signs over (docs/accesscontrol.md §5.2).
+ *
+ * Layout:
+ * ```
+ * version(1 byte)
+ *  || len(entryType)          || entryType
+ *  || len(dbid)               || dbid
+ *  || len(contentHash)        || contentHash
+ *  || len(id)                 || id
+ *  || len(docId)              || docId
+ *  || len(decryptionKeyId)    || decryptionKeyId
+ *  || int64BE(createdAt)
+ *  || len(createdByPublicKey) || createdByPublicKey
+ *  || int64BE(receivedAt)
+ *  || len(receivedByPublicKey)|| receivedByPublicKey
+ * ```
+ */
+function buildWitnessSigningBytes(fields, version = exports.WITNESS_RECEIPT_LAYOUT_VERSION) {
+    const parts = [];
+    parts.push(new Uint8Array([version & 0xff]));
+    pushString(parts, fields.entryType);
+    pushString(parts, fields.dbid);
+    pushString(parts, fields.contentHash);
+    pushString(parts, fields.id);
+    pushString(parts, fields.docId);
+    pushString(parts, fields.decryptionKeyId);
+    pushInt64BE(parts, fields.createdAt);
+    pushString(parts, fields.createdByPublicKey);
+    pushInt64BE(parts, fields.receivedAt);
+    pushString(parts, fields.receivedByPublicKey);
+    const total = parts.reduce((sum, p) => sum + p.length, 0);
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const p of parts) {
+        out.set(p, offset);
+        offset += p.length;
+    }
+    return out;
+}
+/**
+ * Derive the {@link WitnessReceiptFields} for an entry the witness is about to
+ * stamp. `dbid`, `receivedAt` and `receivedByPublicKey` come from the witness's
+ * own context (which database it accepted the entry under, its clock, its key);
+ * everything else is read from the entry's existing metadata.
+ */
+function witnessFieldsFromEntry(entry, context) {
+    return {
+        entryType: entry.entryType,
+        dbid: context.dbid,
+        contentHash: entry.contentHash,
+        id: entry.id,
+        docId: entry.docId,
+        decryptionKeyId: entry.decryptionKeyId,
+        createdAt: entry.createdAt,
+        createdByPublicKey: entry.createdByPublicKey,
+        receivedAt: context.receivedAt,
+        receivedByPublicKey: context.receivedByPublicKey,
+    };
+}
+/**
+ * Convert a PEM-encoded SPKI public key to an ArrayBuffer. Mirrors
+ * `BaseMindooTenant.pemToArrayBuffer` but kept dependency-free here.
+ */
+function pemToArrayBuffer(pem) {
+    const base64 = pem
+        .replace("-----BEGIN PUBLIC KEY-----", "")
+        .replace("-----END PUBLIC KEY-----", "")
+        .replace(/\s/g, "");
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
+/**
+ * Sign a witness receipt over {@link buildWitnessSigningBytes} using an already
+ * imported Ed25519 private `CryptoKey`. The caller (the witness/server) is
+ * responsible for decrypting and importing its own signing key.
+ *
+ * @returns the raw Ed25519 signature bytes (store as `receivedDateSignature`).
+ */
+async function signWitnessReceipt(fields, signingPrivateKey, subtle, version = exports.WITNESS_RECEIPT_LAYOUT_VERSION) {
+    const bytes = buildWitnessSigningBytes(fields, version);
+    const signature = await subtle.sign({ name: "Ed25519" }, signingPrivateKey, bytes.buffer);
+    return new Uint8Array(signature);
+}
+/**
+ * Produce the witness fields for an entry the server has decided to accept
+ * (§5.3). The caller merges the returned fields into the stored metadata and
+ * echoes them back to the pushing client so every replica gets the receipt.
+ */
+async function stampEntryReceipt(entry, context, signer) {
+    const fields = witnessFieldsFromEntry(entry, {
+        dbid: context.dbid,
+        receivedAt: context.receivedAt,
+        receivedByPublicKey: signer.publicKeyPem,
+    });
+    const signature = await signWitnessReceipt(fields, signer.signingPrivateKey, signer.subtle);
+    return {
+        receivedAt: context.receivedAt,
+        receivedByPublicKey: signer.publicKeyPem,
+        receivedDateSignature: signature,
+    };
+}
+/**
+ * Verify a witness receipt signature against the witness public key (PEM).
+ *
+ * This is a pure cryptographic check of the signature over the §5.2 layout. It
+ * does NOT decide whether the witness is *trusted* — callers must separately
+ * confirm `receivedByPublicKey` is in the tenant's trusted-witness list and run
+ * the receipt-time validation rules (§5.4: per-witness monotonicity, wall-clock
+ * sanity) before relying on the attestation.
+ *
+ * Unknown layout versions are rejected.
+ */
+async function verifyWitnessReceipt(fields, signature, witnessPublicKeyPem, subtle, version = exports.WITNESS_RECEIPT_LAYOUT_VERSION) {
+    if (version !== exports.WITNESS_RECEIPT_LAYOUT_VERSION) {
+        return false;
+    }
+    const bytes = buildWitnessSigningBytes(fields, version);
+    const cryptoKey = await subtle.importKey("spki", pemToArrayBuffer(witnessPublicKeyPem), { name: "Ed25519" }, false, ["verify"]);
+    return subtle.verify({ name: "Ed25519" }, cryptoKey, signature.buffer, bytes.buffer);
+}
+//# sourceMappingURL=WitnessReceipt.js.map

package/dist/core/crypto/WitnessReceipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WitnessReceipt.js","sourceRoot":"","sources":["../../../src/core/crypto/WitnessReceipt.ts"],"names":[],"mappings":";;;AAyGA,4DAyBC;AAQD,wDAmBC;AA0BD,gDASC;AA8BD,8CAmBC;AAaD,oDAwBC;AApRD;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;GAGG;AACU,QAAA,8BAA8B,GAAG,IAAI,CAAC;AAiCnD,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;AAEtC;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAmB,EAAE,KAAiB;IAChE,MAAM,YAAY,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,8CAA8C;AAC9C,SAAS,UAAU,CAAC,KAAmB,EAAE,KAAa;IACpD,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW,CAAC,KAAmB,EAAE,KAAa;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,wBAAwB,CACtC,MAA4B,EAC5B,UAAkB,sCAA8B;IAEhD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7C,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACpC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACtC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1C,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC7C,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACtC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CACpC,KAGC,EACD,OAA0E;IAE1E,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;SACzC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC;SACvC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,kBAAkB,CACtC,MAA4B,EAC5B,iBAA4B,EAC5B,MAAoB,EACpB,UAAkB,sCAA8B;IAEhD,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,MAAqB,CAAC,CAAC;IACzG,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAyBD;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CACrC,KAGC,EACD,OAA6C,EAC7C,MAAqB;IAErB,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,EAAE;QAC3C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,MAAM,CAAC,YAAY;KACzC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5F,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,mBAAmB,EAAE,MAAM,CAAC,YAAY;QACxC,qBAAqB,EAAE,SAAS;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACI,KAAK,UAAU,oBAAoB,CACxC,MAA4B,EAC5B,SAAqB,EACrB,mBAA2B,EAC3B,MAAoB,EACpB,UAAkB,sCAA8B;IAEhD,IAAI,OAAO,KAAK,sCAA8B,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CACtC,MAAM,EACN,gBAAgB,CAAC,mBAAmB,CAAC,EACrC,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAClB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,SAAS,CAAC,MAAqB,EAC/B,KAAK,CAAC,MAAqB,CAC5B,CAAC;AACJ,CAAC"}

package/dist/core/crypto/encryptedFields.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Minimal decryptor surface needed to decrypt an `_encrypted` field. This is a
+ * subset of `MindooTenant` so callers can pass a tenant directly without this
+ * module depending on the full tenant type.
+ */
+export interface EncryptedFieldDecryptor {
+    decryptPayload(encryptedPayload: Uint8Array, decryptionKeyId: string): Promise<Uint8Array>;
+}
+/**
+ * Resolves the symmetric key id for an `_encrypted` field following the
+ * `<field>_encrypted` / `<field>_encrypted_key` naming convention.
+ *
+ * Resolution order: explicit `override` -> the field's `<field>_key` companion
+ * field on the document -> the tenant default key (`"default"`).
+ */
+export declare function getEncryptedFieldKeyId(data: Record<string, unknown>, encryptedFieldName: string, override?: string | null): string;
+/**
+ * Decrypts a base64 `_encrypted` field to its UTF-8 plaintext.
+ *
+ * The key id is resolved with {@link getEncryptedFieldKeyId} unless
+ * `keyIdOverride` is provided. Returns `null` when the field is missing/blank
+ * or decryption fails (for example the named key is not present in the
+ * decryptor's key bag), so callers can treat unreadable fields as absent rather
+ * than throwing.
+ */
+export declare function decryptEncryptedField(decryptor: EncryptedFieldDecryptor, data: Record<string, unknown>, encryptedFieldName: string, keyIdOverride?: string | null): Promise<string | null>;
+//# sourceMappingURL=encryptedFields.d.ts.map

package/dist/core/crypto/encryptedFields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryptedFields.d.ts","sourceRoot":"","sources":["../../../src/core/crypto/encryptedFields.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,cAAc,CAAC,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC5F;AAKD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,kBAAkB,EAAE,MAAM,EAC1B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GACvB,MAAM,CASR;AAYD;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,uBAAuB,EAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,kBAAkB,EAAE,MAAM,EAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,GAC5B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB"}