mindoodb 0.0.24 → 0.0.32

package/dist/core/accesscontrol/timestamp/Ed25519WitnessProvider.d.ts

@@ -0,0 +1,31 @@
+import type { WitnessSigner } from "../../crypto/WitnessReceipt";
+import { StampedReceipt, TimestampProvider, TimestampStampContext, TimestampVerifier, TimestampableEntry } from "./TimestampProvider";
+/**
+ * The v1 {@link TimestampProvider}: an Ed25519 receipt stamped by a trusted sync
+ * server ("witness", docs/accesscontrol.md §5). This is a thin facade over the
+ * existing primitives — {@link stampEntryReceipt} on the issue side and
+ * {@link WitnessReceiptValidator} on the verify side — so behavior is identical
+ * to the pre-abstraction code; the seam exists only so other schemes (e.g. an
+ * RFC 3161 TSA) can be added later without touching call sites.
+ */
+export declare class Ed25519WitnessProvider implements TimestampProvider {
+    readonly kind = "ed25519-witness";
+    /** The witness signing identity; undefined for a verify-only provider (clients). */
+    private readonly signer?;
+    private readonly subtle;
+    /**
+     * @param opts.signer The witness identity used to stamp receipts. Omit on
+     *   clients that only verify.
+     * @param opts.subtle WebCrypto used for signing/verifying. When a signer is
+     *   provided this is typically `signer.subtle`.
+     */
+    constructor(opts: {
+        signer?: WitnessSigner;
+        subtle: SubtleCrypto;
+    });
+    get issuerPublicKey(): string | undefined;
+    get canStamp(): boolean;
+    stamp(entry: TimestampableEntry, ctx: TimestampStampContext): Promise<StampedReceipt>;
+    createVerifier(initialLastSeen?: Map<string, number>): TimestampVerifier;
+}
+//# sourceMappingURL=Ed25519WitnessProvider.d.ts.map

package/dist/core/accesscontrol/timestamp/Ed25519WitnessProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ed25519WitnessProvider.d.ts","sourceRoot":"","sources":["../../../../src/core/accesscontrol/timestamp/Ed25519WitnessProvider.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAIjE,OAAO,EAEL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AACH,qBAAa,sBAAuB,YAAW,iBAAiB;IAC9D,QAAQ,CAAC,IAAI,qBAA0B;IAEvC,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IAEtC;;;;;OAKG;gBACS,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,aAAa,CAAC;QAAC,MAAM,EAAE,YAAY,CAAA;KAAE;IAKlE,IAAI,eAAe,IAAI,MAAM,GAAG,SAAS,CAExC;IAED,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAEK,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IAQ3F,cAAc,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,iBAAiB;CAGzE"}

package/dist/core/accesscontrol/timestamp/Ed25519WitnessProvider.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Ed25519WitnessProvider = void 0;
+const WitnessReceipt_1 = require("../../crypto/WitnessReceipt");
+const receiptValidation_1 = require("../receiptValidation");
+const TimestampProvider_1 = require("./TimestampProvider");
+/**
+ * The v1 {@link TimestampProvider}: an Ed25519 receipt stamped by a trusted sync
+ * server ("witness", docs/accesscontrol.md §5). This is a thin facade over the
+ * existing primitives — {@link stampEntryReceipt} on the issue side and
+ * {@link WitnessReceiptValidator} on the verify side — so behavior is identical
+ * to the pre-abstraction code; the seam exists only so other schemes (e.g. an
+ * RFC 3161 TSA) can be added later without touching call sites.
+ */
+class Ed25519WitnessProvider {
+    /**
+     * @param opts.signer The witness identity used to stamp receipts. Omit on
+     *   clients that only verify.
+     * @param opts.subtle WebCrypto used for signing/verifying. When a signer is
+     *   provided this is typically `signer.subtle`.
+     */
+    constructor(opts) {
+        this.kind = TimestampProvider_1.ED25519_WITNESS_SCHEME;
+        this.signer = opts.signer;
+        this.subtle = opts.subtle;
+    }
+    get issuerPublicKey() {
+        return this.signer?.publicKeyPem;
+    }
+    get canStamp() {
+        return this.signer !== undefined;
+    }
+    async stamp(entry, ctx) {
+        if (!this.signer) {
+            throw new Error("Ed25519WitnessProvider.stamp called on a verify-only provider (no signer configured)");
+        }
+        const stamp = await (0, WitnessReceipt_1.stampEntryReceipt)(entry, ctx, this.signer);
+        return { ...stamp, receiptScheme: this.kind };
+    }
+    createVerifier(initialLastSeen) {
+        return new Ed25519WitnessVerifier(this.subtle, initialLastSeen);
+    }
+}
+exports.Ed25519WitnessProvider = Ed25519WitnessProvider;
+/**
+ * Verifier adapter for {@link Ed25519WitnessProvider}. Wraps a
+ * {@link WitnessReceiptValidator} (which carries the per-witness `receivedAt`
+ * monotonicity state, §5.4) and first guards on the receipt scheme tag: with no
+ * router yet, a receipt declaring any other scheme is cleanly rejected rather
+ * than misinterpreted as Ed25519.
+ */
+class Ed25519WitnessVerifier {
+    constructor(subtle, initialLastSeen) {
+        this.subtle = subtle;
+        this.inner = new receiptValidation_1.WitnessReceiptValidator(initialLastSeen);
+    }
+    async validate(entry, ctx) {
+        // Absence means the default Ed25519 witness scheme (legacy entries predate
+        // the tag). Any explicit, non-Ed25519 scheme cannot be verified here.
+        if (entry.receiptScheme !== undefined && entry.receiptScheme !== TimestampProvider_1.ED25519_WITNESS_SCHEME) {
+            return { ok: false, reason: `unsupported receipt scheme: ${entry.receiptScheme}` };
+        }
+        return this.inner.validate(entry, ctx, this.subtle);
+    }
+}
+//# sourceMappingURL=Ed25519WitnessProvider.js.map

package/dist/core/accesscontrol/timestamp/Ed25519WitnessProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Ed25519WitnessProvider.js","sourceRoot":"","sources":["../../../../src/core/accesscontrol/timestamp/Ed25519WitnessProvider.ts"],"names":[],"mappings":";;;AAEA,gEAAgE;AAChE,4DAA+D;AAE/D,2DAO6B;AAE7B;;;;;;;GAOG;AACH,MAAa,sBAAsB;IAOjC;;;;;OAKG;IACH,YAAY,IAAsD;QAZzD,SAAI,GAAG,0CAAsB,CAAC;QAarC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;IACnC,CAAC;IAED,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,KAAyB,EAAE,GAA0B;QAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAA,kCAAiB,EAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,OAAO,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,cAAc,CAAC,eAAqC;QAClD,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAClE,CAAC;CACF;AArCD,wDAqCC;AAED;;;;;;GAMG;AACH,MAAM,sBAAsB;IAG1B,YAA6B,MAAoB,EAAE,eAAqC;QAA3D,WAAM,GAAN,MAAM,CAAc;QAC/C,IAAI,CAAC,KAAK,GAAG,IAAI,2CAAuB,CAAC,eAAe,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAyB,EAAE,GAA6B;QACrE,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,0CAAsB,EAAE,CAAC;YACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+BAA+B,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;CACF"}

package/dist/core/accesscontrol/timestamp/TimestampProvider.d.ts

@@ -0,0 +1,79 @@
+import { StoreEntryMetadata } from "../../types";
+import type { StampedWitnessFields } from "../../crypto/WitnessReceipt";
+import type { ReceiptValidationContext, ReceiptValidationResult } from "../receiptValidation";
+/**
+ * Pluggable trusted-time / receipt provider seam (docs/accesscontrol.md §5, §13).
+ *
+ * The trusted time of an entry (`receivedAt`, used for all access-control
+ * time-travel evaluation) is attested by a {@link TimestampProvider}. v1 ships a
+ * single implementation, the Ed25519 sync-server witness
+ * (`Ed25519WitnessProvider`), but the abstraction exists so an alternative such
+ * as an RFC 3161 Time-Stamping Authority (TSA) can later plug into BOTH sides:
+ *  - the **issue** side: a server stamps an accepted entry ({@link TimestampProvider.stamp}), and
+ *  - the **verify** side: a receiver validates the receipt ({@link TimestampVerifier}).
+ *
+ * Each scheme tags its receipts with a stable {@link TimestampProvider.kind}
+ * value, persisted on the entry as `receiptScheme`, so receipts can later be
+ * routed to the right verifier. Absence of `receiptScheme` means the default
+ * Ed25519 witness scheme (the only scheme that existed before this field).
+ */
+/** Stable identifier of the Ed25519 sync-server witness scheme (§5). */
+export declare const ED25519_WITNESS_SCHEME = "ed25519-witness";
+/**
+ * The subset of an entry's metadata a provider needs in order to stamp a
+ * receipt. Mirrors the fields bound by the witness signing layout (§5.2).
+ */
+export type TimestampableEntry = Pick<StoreEntryMetadata, "entryType" | "contentHash" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "createdByPublicKey">;
+/** Context the provider needs to stamp a receipt onto an accepted entry. */
+export interface TimestampStampContext {
+    /** Database id the entry is accepted/witnessed under (bound into the receipt). */
+    dbid: string;
+    /** Provider-assigned acceptance time (ms epoch). */
+    receivedAt: number;
+}
+/**
+ * The fields a provider writes onto an accepted entry: the existing witness
+ * receipt fields plus the {@link TimestampProvider.kind} discriminator
+ * (`receiptScheme`). Merging this into an entry's metadata produces a stamped
+ * entry.
+ */
+export interface StampedReceipt extends StampedWitnessFields {
+    /** The scheme that produced this receipt (equals the provider's `kind`). */
+    receiptScheme: string;
+}
+/**
+ * A stateful verifier for a single materialization pass. Implementations may
+ * carry per-issuer high-water marks (e.g. the Ed25519 per-witness `receivedAt`
+ * monotonicity, §5.4), so one verifier should be used per materialization.
+ */
+export interface TimestampVerifier {
+    /**
+     * Validate the receipt on an entry. Returns `{ ok: true, noReceipt: true }`
+     * for entries that carry no receipt (local, not-yet-synced). Never throws for
+     * an invalid receipt — returns `{ ok: false, reason }` so the caller can
+     * quarantine.
+     */
+    validate(entry: StoreEntryMetadata, ctx: ReceiptValidationContext): Promise<ReceiptValidationResult>;
+}
+/**
+ * Issues and verifies trusted-time receipts for one timestamping scheme. A
+ * single instance can be verify-only (no issuing identity configured) or able
+ * to both issue and verify.
+ */
+export interface TimestampProvider {
+    /** Stable scheme identifier written onto receipts as `receiptScheme`. */
+    readonly kind: string;
+    /**
+     * The public identity of the issuer (e.g. the witness public key, PEM), or
+     * undefined for a verify-only provider. Used to advertise capability and to
+     * skip self-witnessing (a server need not witness its own entries).
+     */
+    readonly issuerPublicKey?: string;
+    /** Whether this provider can issue (stamp) receipts. */
+    readonly canStamp: boolean;
+    /** Stamp a receipt onto an accepted entry (issue side). Throws if it cannot stamp. */
+    stamp(entry: TimestampableEntry, ctx: TimestampStampContext): Promise<StampedReceipt>;
+    /** Create a stateful verifier for a single materialization pass (verify side). */
+    createVerifier(initialLastSeen?: Map<string, number>): TimestampVerifier;
+}
+//# sourceMappingURL=TimestampProvider.d.ts.map

package/dist/core/accesscontrol/timestamp/TimestampProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TimestampProvider.d.ts","sourceRoot":"","sources":["../../../../src/core/accesscontrol/timestamp/TimestampProvider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAE9F;;;;;;;;;;;;;;;GAeG;AAEH,wEAAwE;AACxE,eAAO,MAAM,sBAAsB,oBAAoB,CAAC;AAExD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,kBAAkB,EAClB,WAAW,GAAG,aAAa,GAAG,IAAI,GAAG,OAAO,GAAG,iBAAiB,GAAG,WAAW,GAAG,oBAAoB,CACtG,CAAC;AAEF,4EAA4E;AAC5E,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAe,SAAQ,oBAAoB;IAC1D,4EAA4E;IAC5E,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACtG;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,sFAAsF;IACtF,KAAK,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACtF,kFAAkF;IAClF,cAAc,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,iBAAiB,CAAC;CAC1E"}

package/dist/core/accesscontrol/timestamp/TimestampProvider.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ED25519_WITNESS_SCHEME = void 0;
+/**
+ * Pluggable trusted-time / receipt provider seam (docs/accesscontrol.md §5, §13).
+ *
+ * The trusted time of an entry (`receivedAt`, used for all access-control
+ * time-travel evaluation) is attested by a {@link TimestampProvider}. v1 ships a
+ * single implementation, the Ed25519 sync-server witness
+ * (`Ed25519WitnessProvider`), but the abstraction exists so an alternative such
+ * as an RFC 3161 Time-Stamping Authority (TSA) can later plug into BOTH sides:
+ *  - the **issue** side: a server stamps an accepted entry ({@link TimestampProvider.stamp}), and
+ *  - the **verify** side: a receiver validates the receipt ({@link TimestampVerifier}).
+ *
+ * Each scheme tags its receipts with a stable {@link TimestampProvider.kind}
+ * value, persisted on the entry as `receiptScheme`, so receipts can later be
+ * routed to the right verifier. Absence of `receiptScheme` means the default
+ * Ed25519 witness scheme (the only scheme that existed before this field).
+ */
+/** Stable identifier of the Ed25519 sync-server witness scheme (§5). */
+exports.ED25519_WITNESS_SCHEME = "ed25519-witness";
+//# sourceMappingURL=TimestampProvider.js.map

package/dist/core/accesscontrol/timestamp/TimestampProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TimestampProvider.js","sourceRoot":"","sources":["../../../../src/core/accesscontrol/timestamp/TimestampProvider.ts"],"names":[],"mappings":";;;AAIA;;;;;;;;;;;;;;;GAeG;AAEH,wEAAwE;AAC3D,QAAA,sBAAsB,GAAG,iBAAiB,CAAC"}