mindoodb 0.0.3 → 0.0.4

package/dist/node/cli/cli-utils.d.ts

@@ -0,0 +1,16 @@
+import type { PrivateUserId } from "../../core/userid";
+export interface ParsedCliArgs {
+    values: Record<string, string>;
+    positionals: string[];
+    help: boolean;
+}
+export declare class CliUsageError extends Error {
+    exitCode: number;
+    constructor(message: string, exitCode?: number);
+}
+export declare function parseArgs(argv: string[]): ParsedCliArgs;
+export declare function requireIdentityArg(args: ParsedCliArgs, helpText: string): string;
+export declare function getOptionalArg(args: ParsedCliArgs, name: string): string | undefined;
+export declare function loadPrivateIdentity(path: string): PrivateUserId;
+export declare function promptHiddenLine(question: string): Promise<string>;
+//# sourceMappingURL=cli-utils.d.ts.map

package/dist/node/cli/cli-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-utils.d.ts","sourceRoot":"","sources":["../../../src/node/cli/cli-utils.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,EAAE,MAAM,CAAC;gBAEL,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAI;CAK1C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,CA2BvD;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAWhF;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpF;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAe/D;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgDxE"}

package/dist/node/cli/cli-utils.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CliUsageError = void 0;
+exports.parseArgs = parseArgs;
+exports.requireIdentityArg = requireIdentityArg;
+exports.getOptionalArg = getOptionalArg;
+exports.loadPrivateIdentity = loadPrivateIdentity;
+exports.promptHiddenLine = promptHiddenLine;
+const fs_1 = require("fs");
+const readline_1 = require("readline");
+const stream_1 = require("stream");
+class CliUsageError extends Error {
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.name = "CliUsageError";
+        this.exitCode = exitCode;
+    }
+}
+exports.CliUsageError = CliUsageError;
+function parseArgs(argv) {
+    const values = {};
+    const positionals = [];
+    let help = false;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h") {
+            help = true;
+            continue;
+        }
+        if (arg.startsWith("--")) {
+            const key = arg.slice(2);
+            const nextArg = argv[i + 1];
+            if (!nextArg || nextArg.startsWith("-")) {
+                throw new CliUsageError(`Missing value for ${arg}`, 1);
+            }
+            values[key] = nextArg;
+            i++;
+            continue;
+        }
+        positionals.push(arg);
+    }
+    return { values, positionals, help };
+}
+function requireIdentityArg(args, helpText) {
+    if (args.help) {
+        throw new CliUsageError(helpText, 0);
+    }
+    const identityPath = args.values.identity;
+    if (!identityPath) {
+        throw new CliUsageError(helpText, 1);
+    }
+    return identityPath;
+}
+function getOptionalArg(args, name) {
+    return args.values[name];
+}
+function loadPrivateIdentity(path) {
+    const raw = (0, fs_1.readFileSync)(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.username ||
+        !parsed?.userSigningKeyPair?.publicKey ||
+        !parsed?.userSigningKeyPair?.privateKey ||
+        !parsed?.userEncryptionKeyPair?.publicKey ||
+        !parsed?.userEncryptionKeyPair?.privateKey) {
+        throw new Error(`Invalid identity file: ${path}`);
+    }
+    return parsed;
+}
+async function promptHiddenLine(question) {
+    if (!process.stdin.isTTY) {
+        const rl = (0, readline_1.createInterface)({
+            input: process.stdin,
+            output: process.stderr,
+        });
+        const answer = await new Promise((resolve) => {
+            rl.question(question, (value) => resolve(value));
+        });
+        rl.close();
+        return answer;
+    }
+    let muted = false;
+    const output = new stream_1.Writable({
+        write(chunk, encoding, callback) {
+            if (!muted) {
+                process.stderr.write(chunk, encoding);
+            }
+            callback();
+        },
+    });
+    const rl = (0, readline_1.createInterface)({
+        input: process.stdin,
+        output,
+        terminal: true,
+    });
+    return new Promise((resolve) => {
+        const cleanup = () => {
+            muted = false;
+            rl.close();
+        };
+        rl.on("SIGINT", () => {
+            cleanup();
+            process.kill(process.pid, "SIGINT");
+        });
+        process.stderr.write(question);
+        muted = true;
+        rl.question("", (answer) => {
+            process.stderr.write("\n");
+            cleanup();
+            resolve(answer);
+        });
+    });
+}
+//# sourceMappingURL=cli-utils.js.map

package/dist/node/cli/cli-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-utils.js","sourceRoot":"","sources":["../../../src/node/cli/cli-utils.ts"],"names":[],"mappings":";;;AAsBA,8BA2BC;AAED,gDAWC;AAED,wCAEC;AAED,kDAeC;AAED,4CAgDC;AArID,2BAAkC;AAClC,uCAA2C;AAC3C,mCAAkC;AAUlC,MAAa,aAAc,SAAQ,KAAK;IAGtC,YAAY,OAAe,EAAE,QAAQ,GAAG,CAAC;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AARD,sCAQC;AAED,SAAgB,SAAS,CAAC,IAAc;IACtC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,IAAI,GAAG,KAAK,CAAC;IAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACrC,IAAI,GAAG,IAAI,CAAC;YACZ,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,aAAa,CAAC,qBAAqB,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;YACtB,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QAED,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAmB,EAAE,QAAgB;IACtE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAgB,cAAc,CAAC,IAAmB,EAAE,IAAY;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAgB,mBAAmB,CAAC,IAAY;IAC9C,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAEhD,IACE,CAAC,MAAM,EAAE,QAAQ;QACjB,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS;QACtC,CAAC,MAAM,EAAE,kBAAkB,EAAE,UAAU;QACvC,CAAC,MAAM,EAAE,qBAAqB,EAAE,SAAS;QACzC,CAAC,MAAM,EAAE,qBAAqB,EAAE,UAAU,EAC1C,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IACrD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,IAAA,0BAAe,EAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACnD,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,MAAM,GAAG,IAAI,iBAAQ,CAAC;QAC1B,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ;YAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAA0B,CAAC,CAAC;YAC1D,CAAC;YACD,QAAQ,EAAE,CAAC;QACb,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,EAAE,GAAG,IAAA,0BAAe,EAAC;QACzB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM;QACN,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,KAAK,GAAG,KAAK,CAAC;YACd,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC,CAAC;QAEF,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACnB,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,KAAK,GAAG,IAAI,CAAC;QACb,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE;YACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/node/cli/identity-export-public.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export declare const HELP_TEXT = "mindoodb identity:export-public - export public keys from an identity file\n\nUsage:\n  npm run identity:export-public -- --identity <path> [--output <path>]\n  ./mindoodb-cli.sh identity:export-public <file> [--output <path>]\n\nOptions:\n  --identity <path>   Path to an *.identity.json file (required)\n  --output <path>     Write JSON to file instead of stdout\n  --help              Show this help\n";
+export declare function run(argv?: string[]): Promise<number>;
+//# sourceMappingURL=identity-export-public.d.ts.map

package/dist/node/cli/identity-export-public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-export-public.d.ts","sourceRoot":"","sources":["../../../src/node/cli/identity-export-public.ts"],"names":[],"mappings":";AAeA,eAAO,MAAM,SAAS,yZAUrB,CAAC;AAEF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAqBjF"}

package/dist/node/cli/identity-export-public.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HELP_TEXT = void 0;
+exports.run = run;
+const fs_1 = require("fs");
+const InMemoryContentAddressedStoreFactory_1 = require("../../appendonlystores/InMemoryContentAddressedStoreFactory");
+const BaseMindooTenantFactory_1 = require("../../core/BaseMindooTenantFactory");
+const NodeCryptoAdapter_1 = require("../crypto/NodeCryptoAdapter");
+const cli_utils_1 = require("./cli-utils");
+exports.HELP_TEXT = `mindoodb identity:export-public - export public keys from an identity file
+
+Usage:
+  npm run identity:export-public -- --identity <path> [--output <path>]
+  ./mindoodb-cli.sh identity:export-public <file> [--output <path>]
+
+Options:
+  --identity <path>   Path to an *.identity.json file (required)
+  --output <path>     Write JSON to file instead of stdout
+  --help              Show this help
+`;
+async function run(argv = process.argv.slice(2)) {
+    const args = (0, cli_utils_1.parseArgs)(argv);
+    const identityPath = (0, cli_utils_1.requireIdentityArg)(args, exports.HELP_TEXT);
+    const outputPath = (0, cli_utils_1.getOptionalArg)(args, "output");
+    const identity = (0, cli_utils_1.loadPrivateIdentity)(identityPath);
+    const factory = new BaseMindooTenantFactory_1.BaseMindooTenantFactory(new InMemoryContentAddressedStoreFactory_1.InMemoryContentAddressedStoreFactory(), new NodeCryptoAdapter_1.NodeCryptoAdapter());
+    const publicIdentity = factory.toPublicUserId(identity);
+    const json = JSON.stringify(publicIdentity, null, 2);
+    if (outputPath) {
+        (0, fs_1.writeFileSync)(outputPath, `${json}\n`, "utf8");
+        console.log(`Public identity written to: ${outputPath}`);
+    }
+    else {
+        console.log(json);
+    }
+    return 0;
+}
+function isDirectExecution() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    return /[/\\]identity-export-public\.(ts|js|mjs|cjs)$/.test(entry);
+}
+if (isDirectExecution()) {
+    run().then((exitCode) => process.exit(exitCode), (error) => {
+        if (error instanceof cli_utils_1.CliUsageError) {
+            console.log(error.message);
+            process.exit(error.exitCode);
+        }
+        console.error("Fatal error:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=identity-export-public.js.map

package/dist/node/cli/identity-export-public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-export-public.js","sourceRoot":"","sources":["../../../src/node/cli/identity-export-public.ts"],"names":[],"mappings":";;;;AA2BA,kBAqBC;AA9CD,2BAAmC;AAEnC,sHAAmH;AACnH,gFAA6E;AAC7E,mEAAgE;AAChE,2CAMqB;AAER,QAAA,SAAS,GAAG;;;;;;;;;;CAUxB,CAAC;AAEK,KAAK,UAAU,GAAG,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAA,qBAAS,EAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAA,8BAAkB,EAAC,IAAI,EAAE,iBAAS,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAA,0BAAc,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,IAAA,+BAAmB,EAAC,YAAY,CAAC,CAAC;IAEnD,MAAM,OAAO,GAAG,IAAI,iDAAuB,CACzC,IAAI,2EAAoC,EAAE,EAC1C,IAAI,qCAAiB,EAAE,CACxB,CAAC;IACF,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,IAAI,UAAU,EAAE,CAAC;QACf,IAAA,kBAAa,EAAC,UAAU,EAAE,GAAG,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,UAAU,EAAE,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,+CAA+C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,GAAG,EAAE,CAAC,IAAI,CACR,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EACpC,CAAC,KAAK,EAAE,EAAE;QACR,IAAI,KAAK,YAAY,yBAAa,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/node/cli/identity-info.d.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+export declare const HELP_TEXT = "mindoodb identity:info - display public information from an identity file\n\nUsage:\n  npm run identity:info -- --identity <path>\n  ./mindoodb-cli.sh identity:info <file>\n\nOptions:\n  --identity <path>   Path to an *.identity.json file (required)\n  --help              Show this help\n";
+export declare function run(argv?: string[]): Promise<number>;
+//# sourceMappingURL=identity-info.d.ts.map

package/dist/node/cli/identity-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-info.d.ts","sourceRoot":"","sources":["../../../src/node/cli/identity-info.ts"],"names":[],"mappings":";AAKA,eAAO,MAAM,SAAS,sSASrB,CAAC;AAYF,wBAAsB,GAAG,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,MAAM,CAAC,CAejF"}

package/dist/node/cli/identity-info.js

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HELP_TEXT = void 0;
+exports.run = run;
+const NodeCryptoAdapter_1 = require("../crypto/NodeCryptoAdapter");
+const cli_utils_1 = require("./cli-utils");
+exports.HELP_TEXT = `mindoodb identity:info - display public information from an identity file
+
+Usage:
+  npm run identity:info -- --identity <path>
+  ./mindoodb-cli.sh identity:info <file>
+
+Options:
+  --identity <path>   Path to an *.identity.json file (required)
+  --help              Show this help
+`;
+async function hashUsernameHex(username) {
+    const cryptoAdapter = new NodeCryptoAdapter_1.NodeCryptoAdapter();
+    const subtle = cryptoAdapter.getSubtle();
+    const bytes = new TextEncoder().encode(username.toLowerCase());
+    const digest = await subtle.digest("SHA-256", bytes);
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+async function run(argv = process.argv.slice(2)) {
+    const args = (0, cli_utils_1.parseArgs)(argv);
+    const identityPath = (0, cli_utils_1.requireIdentityArg)(args, exports.HELP_TEXT);
+    const identity = (0, cli_utils_1.loadPrivateIdentity)(identityPath);
+    const usernameHash = await hashUsernameHex(identity.username);
+    console.log(`Identity file: ${identityPath}`);
+    console.log(`Username: ${identity.username}`);
+    console.log(`Public user ID (hex): ${usernameHash}`);
+    console.log(`Signing public key:\n${identity.userSigningKeyPair.publicKey}`);
+    console.log(`Encryption public key:\n${identity.userEncryptionKeyPair.publicKey}`);
+    console.log(`Salt strings: signing, encryption`);
+    console.log(`Encrypted private keys present: yes`);
+    return 0;
+}
+function isDirectExecution() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    return /[/\\]identity-info\.(ts|js|mjs|cjs)$/.test(entry);
+}
+if (isDirectExecution()) {
+    run().then((exitCode) => process.exit(exitCode), (error) => {
+        if (error instanceof cli_utils_1.CliUsageError) {
+            console.log(error.message);
+            process.exit(error.exitCode);
+        }
+        console.error("Fatal error:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=identity-info.js.map

package/dist/node/cli/identity-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-info.js","sourceRoot":"","sources":["../../../src/node/cli/identity-info.ts"],"names":[],"mappings":";;;;AA0BA,kBAeC;AAvCD,mEAAgE;AAChE,2CAAgG;AAEnF,QAAA,SAAS,GAAG;;;;;;;;;CASxB,CAAC;AAEF,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,aAAa,GAAG,IAAI,qCAAiB,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAEM,KAAK,UAAU,GAAG,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAA,qBAAS,EAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,YAAY,GAAG,IAAA,8BAAkB,EAAC,IAAI,EAAE,iBAAS,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAA,+BAAmB,EAAC,YAAY,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAE9D,OAAO,CAAC,GAAG,CAAC,kBAAkB,YAAY,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,yBAAyB,YAAY,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,wBAAwB,QAAQ,CAAC,kBAAkB,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,2BAA2B,QAAQ,CAAC,qBAAqB,CAAC,SAAS,EAAE,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IAEnD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,sCAAsC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,GAAG,EAAE,CAAC,IAAI,CACR,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EACpC,CAAC,KAAK,EAAE,EAAE;QACR,IAAI,KAAK,YAAY,yBAAa,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/node/index.d.ts

@@ -1,4 +1,5 @@
 export * from "../core";
 export { NodeCryptoAdapter, createCryptoAdapter } from "./crypto/NodeCryptoAdapter";
 export { BasicOnDiskContentAddressedStore, BasicOnDiskContentAddressedStoreFactory, } from "./appendonlystores/BasicOnDiskContentAddressedStore";
+export { FileSystemLocalCacheStore } from "./cache/FileSystemLocalCacheStore";
 //# sourceMappingURL=index.d.ts.map

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAIA,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGpF,OAAO,EACL,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,qDAAqD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAIA,cAAc,SAAS,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGpF,OAAO,EACL,gCAAgC,EAChC,uCAAuC,GACxC,MAAM,qDAAqD,CAAC;AAG7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC"}

package/dist/node/index.js

@@ -16,7 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BasicOnDiskContentAddressedStoreFactory = exports.BasicOnDiskContentAddressedStore = exports.createCryptoAdapter = exports.NodeCryptoAdapter = void 0;
+exports.FileSystemLocalCacheStore = exports.BasicOnDiskContentAddressedStoreFactory = exports.BasicOnDiskContentAddressedStore = exports.createCryptoAdapter = exports.NodeCryptoAdapter = void 0;
 // Re-export all core exports
 __exportStar(require("../core"), exports);
 // Node.js-specific crypto adapter
@@ -27,4 +27,7 @@ Object.defineProperty(exports, "createCryptoAdapter", { enumerable: true, get: f
 var BasicOnDiskContentAddressedStore_1 = require("./appendonlystores/BasicOnDiskContentAddressedStore");
 Object.defineProperty(exports, "BasicOnDiskContentAddressedStore", { enumerable: true, get: function () { return BasicOnDiskContentAddressedStore_1.BasicOnDiskContentAddressedStore; } });
 Object.defineProperty(exports, "BasicOnDiskContentAddressedStoreFactory", { enumerable: true, get: function () { return BasicOnDiskContentAddressedStore_1.BasicOnDiskContentAddressedStoreFactory; } });
+// Node.js-specific cache store
+var FileSystemLocalCacheStore_1 = require("./cache/FileSystemLocalCacheStore");
+Object.defineProperty(exports, "FileSystemLocalCacheStore", { enumerable: true, get: function () { return FileSystemLocalCacheStore_1.FileSystemLocalCacheStore; } });
 //# sourceMappingURL=index.js.map

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,2BAA2B;AAC3B,wEAAwE;;;;;;;;;;;;;;;;;AAExE,6BAA6B;AAC7B,0CAAwB;AAExB,kCAAkC;AAClC,gEAAoF;AAA3E,sHAAA,iBAAiB,OAAA;AAAE,wHAAA,mBAAmB,OAAA;AAE/C,mDAAmD;AACnD,wGAG6D;AAF3D,oJAAA,gCAAgC,OAAA;AAChC,2JAAA,uCAAuC,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":";AAAA,2BAA2B;AAC3B,wEAAwE;;;;;;;;;;;;;;;;;AAExE,6BAA6B;AAC7B,0CAAwB;AAExB,kCAAkC;AAClC,gEAAoF;AAA3E,sHAAA,iBAAiB,OAAA;AAAE,wHAAA,mBAAmB,OAAA;AAE/C,mDAAmD;AACnD,wGAG6D;AAF3D,oJAAA,gCAAgC,OAAA;AAChC,2JAAA,uCAAuC,OAAA;AAGzC,+BAA+B;AAC/B,+EAA8E;AAArE,sIAAA,yBAAyB,OAAA"}

package/dist/node/server/CapabilityMatcher.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Capability matching engine for system admin authorization.
+ *
+ * Parses `METHOD:PATHPATTERN` rules from config.json and checks whether
+ * a given (method, path, username, publicsignkey) tuple is authorized.
+ *
+ * Matching semantics:
+ * - Rule method `ALL` matches any HTTP method.
+ * - Path patterns use `*` as a wildcard that matches any remaining characters.
+ * - All matching rules are unioned; access is granted if *any* matching rule
+ *   lists a principal with both the correct username AND publicsignkey.
+ */
+import type { ServerConfig } from "./types";
+export declare class CapabilityMatcher {
+    private rules;
+    constructor(config: ServerConfig);
+    /**
+     * Hot-swap the internal rules from a new config.
+     * Existing authorization decisions in-flight are unaffected;
+     * subsequent calls to `isAuthorized` / `principalExists` use the new rules.
+     */
+    reload(config: ServerConfig): void;
+    private parseConfig;
+    /**
+     * Check whether a request is authorized.
+     *
+     * @returns `true` if any matching capability rule lists the given principal.
+     */
+    isAuthorized(httpMethod: string, httpPath: string, username: string, publicsignkey: string): boolean;
+    /**
+     * Check whether a principal exists in *any* capability rule.
+     * Used during challenge generation to reject unknown principals early.
+     */
+    principalExists(username: string, publicsignkey: string): boolean;
+    private methodMatches;
+    private principalMatches;
+    private isTenantCreationRule;
+    private isTenantCreationRequest;
+    /**
+     * Match a path pattern against a request path.
+     * `*` matches any remaining characters (greedy).
+     */
+    private pathMatches;
+}
+//# sourceMappingURL=CapabilityMatcher.d.ts.map

package/dist/node/server/CapabilityMatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityMatcher.d.ts","sourceRoot":"","sources":["../../../src/node/server/CapabilityMatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAwB,MAAM,SAAS,CAAC;AASlE,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAe;gBAEhB,MAAM,EAAE,YAAY;IAKhC;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAKlC,OAAO,CAAC,WAAW;IAUnB;;;;OAIG;IACH,YAAY,CACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO;IA2BV;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAuBjE,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,uBAAuB;IAI/B;;;OAGG;IACH,OAAO,CAAC,WAAW;CAoBpB"}

package/dist/node/server/CapabilityMatcher.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Capability matching engine for system admin authorization.
+ *
+ * Parses `METHOD:PATHPATTERN` rules from config.json and checks whether
+ * a given (method, path, username, publicsignkey) tuple is authorized.
+ *
+ * Matching semantics:
+ * - Rule method `ALL` matches any HTTP method.
+ * - Path patterns use `*` as a wildcard that matches any remaining characters.
+ * - All matching rules are unioned; access is granted if *any* matching rule
+ *   lists a principal with both the correct username AND publicsignkey.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityMatcher = void 0;
+const config_1 = require("./config");
+class CapabilityMatcher {
+    constructor(config) {
+        this.rules = [];
+        this.parseConfig(config);
+    }
+    /**
+     * Hot-swap the internal rules from a new config.
+     * Existing authorization decisions in-flight are unaffected;
+     * subsequent calls to `isAuthorized` / `principalExists` use the new rules.
+     */
+    reload(config) {
+        this.rules = [];
+        this.parseConfig(config);
+    }
+    parseConfig(config) {
+        for (const [ruleKey, principals] of Object.entries(config.capabilities)) {
+            const colonIdx = ruleKey.indexOf(":");
+            const method = ruleKey.substring(0, colonIdx).toUpperCase();
+            const pathPattern = ruleKey.substring(colonIdx + 1);
+            this.rules.push({ method, pathPattern, principals });
+        }
+    }
+    /**
+     * Check whether a request is authorized.
+     *
+     * @returns `true` if any matching capability rule lists the given principal.
+     */
+    isAuthorized(httpMethod, httpPath, username, publicsignkey) {
+        const method = httpMethod.toUpperCase();
+        const normalizedUsername = username.toLowerCase();
+        for (const rule of this.rules) {
+            if (!this.methodMatches(rule.method, method))
+                continue;
+            if (!this.pathMatches(rule.pathPattern, httpPath))
+                continue;
+            for (const principal of rule.principals) {
+                if (this.principalMatches(rule, method, httpPath, principal, normalizedUsername, publicsignkey)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Check whether a principal exists in *any* capability rule.
+     * Used during challenge generation to reject unknown principals early.
+     */
+    principalExists(username, publicsignkey) {
+        const normalizedUsername = username.toLowerCase();
+        for (const rule of this.rules) {
+            for (const principal of rule.principals) {
+                if (this.principalMatches(rule, rule.method, rule.pathPattern, principal, normalizedUsername, publicsignkey)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    methodMatches(ruleMethod, requestMethod) {
+        return ruleMethod === "ALL" || ruleMethod === requestMethod;
+    }
+    principalMatches(rule, requestMethod, requestPath, principal, normalizedUsername, publicsignkey) {
+        if (principal.username.toLowerCase() === normalizedUsername &&
+            principal.publicsignkey === publicsignkey) {
+            return true;
+        }
+        if ((0, config_1.isWildcardSystemAdminPrincipal)(principal) &&
+            this.isTenantCreationRule(rule.method, rule.pathPattern) &&
+            this.isTenantCreationRequest(requestMethod, requestPath)) {
+            return true;
+        }
+        return false;
+    }
+    isTenantCreationRule(method, pathPattern) {
+        return method === "POST" && pathPattern.startsWith("/system/tenants/");
+    }
+    isTenantCreationRequest(method, path) {
+        return method === "POST" && path.startsWith("/system/tenants/");
+    }
+    /**
+     * Match a path pattern against a request path.
+     * `*` matches any remaining characters (greedy).
+     */
+    pathMatches(pattern, requestPath) {
+        const starIdx = pattern.indexOf("*");
+        if (starIdx === -1) {
+            return pattern === requestPath;
+        }
+        const prefix = pattern.substring(0, starIdx);
+        const suffix = pattern.substring(starIdx + 1);
+        if (!requestPath.startsWith(prefix)) {
+            return false;
+        }
+        if (suffix.length === 0) {
+            return true;
+        }
+        return requestPath.endsWith(suffix);
+    }
+}
+exports.CapabilityMatcher = CapabilityMatcher;
+//# sourceMappingURL=CapabilityMatcher.js.map

package/dist/node/server/CapabilityMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityMatcher.js","sourceRoot":"","sources":["../../../src/node/server/CapabilityMatcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAGH,qCAA0D;AAQ1D,MAAa,iBAAiB;IAG5B,YAAY,MAAoB;QAC9B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAoB;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW,CAAC,MAAoB;QACtC,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAEpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY,CACV,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBAAE,SAAS;YACvD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAE5D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,QAAgB,EAAE,aAAqB;QACrD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,EAChB,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,UAAkB,EAAE,aAAqB;QAC7D,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,aAAa,CAAC;IAC9D,CAAC;IAEO,gBAAgB,CACtB,IAAgB,EAChB,aAAqB,EACrB,WAAmB,EACnB,SAA+B,EAC/B,kBAA0B,EAC1B,aAAqB;QAErB,IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YACvD,SAAS,CAAC,aAAa,KAAK,aAAa,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,IAAA,uCAA8B,EAAC,SAAS,CAAC;YACzC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;YACxD,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,EACxD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,MAAc,EAAE,WAAmB;QAC9D,OAAO,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IACzE,CAAC;IAEO,uBAAuB,CAAC,MAAc,EAAE,IAAY;QAC1D,OAAO,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAClE,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,OAAe,EAAE,WAAmB;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,KAAK,WAAW,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE9C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AA1JD,8CA0JC"}

package/dist/node/server/MindooDBServer.d.ts

@@ -0,0 +1,87 @@
+/**
+ * MindooDB Server - Express HTTP server implementing the sync API.
+ *
+ * Security features:
+ * - Capabilities-based system admin authorization via config.json
+ * - Challenge/response (Ed25519) authentication for /system/* endpoints
+ * - JWT-based session management for system admins
+ * - Input validation on all identifiers (path traversal prevention)
+ * - Rate limiting per endpoint tier
+ * - Security headers (helmet) and CORS
+ * - Error sanitization (no internal details leaked)
+ * - Request size limits and timeouts
+ */
+import express from "express";
+import { TenantManager } from "./TenantManager";
+import { SystemAdminAuthService } from "./SystemAdminAuth";
+import type { ServerConfig } from "./types";
+declare global {
+    namespace Express {
+        interface Request {
+            tenantId?: string;
+            systemAdmin?: {
+                username: string;
+                publicsignkey: string;
+            };
+        }
+    }
+}
+export declare class MindooDBServer {
+    private app;
+    private tenantManager;
+    private capabilityMatcher;
+    private systemAdminAuth;
+    private readonly staticDir;
+    private serverConfig;
+    private configPath;
+    constructor(dataDir: string, serverPassword?: string, staticDir?: string, config?: ServerConfig, configPath?: string);
+    getApp(): express.Application;
+    getTenantManager(): TenantManager;
+    getSystemAdminAuth(): SystemAdminAuthService;
+    getServerConfig(): ServerConfig;
+    getConfigPath(): string;
+    reloadConfig(newConfig: ServerConfig): void;
+    listen(port: number): void;
+    listenTls(port: number, certPath: string, keyPath: string): void;
+    private setupMiddleware;
+    private setupRoutes;
+    /**
+     * JWT-based middleware for /system/* routes (excluding /system/auth/*).
+     * Extracts and validates the bearer token, then checks capabilities
+     * for the current (method, path, username, publicsignkey).
+     */
+    private systemAdminMiddleware;
+    private tenantMiddleware;
+    private setupSystemRoutes;
+    private handleSystemChallenge;
+    private handleSystemAuthenticate;
+    private handleUpdateConfig;
+    private createTenantRouter;
+    private validateDbId;
+    private handleChallenge;
+    private handleAuthenticate;
+    private handleFindNewEntries;
+    private handleFindNewEntriesForDoc;
+    private handleFindEntries;
+    private handleScanEntriesSince;
+    private handleGetIdBloomSummary;
+    private handleGetCapabilities;
+    private handleGetCompactionStatus;
+    private handleGetEntries;
+    private handlePutEntries;
+    private handleHasEntries;
+    private handleGetAllIds;
+    private handleResolveDependencies;
+    private handlePlanDocumentMaterialization;
+    private handlePlanDocumentMaterializationBatch;
+    private handleTriggerSync;
+    private extractToken;
+    private handleRequestError;
+    private getStatusForErrorType;
+    private errorHandler;
+    private serializeEntryMetadata;
+    private deserializeEntry;
+    private uint8ArrayToBase64;
+    private base64ToUint8Array;
+}
+//# sourceMappingURL=MindooDBServer.d.ts.map

package/dist/node/server/MindooDBServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MindooDBServer.d.ts","sourceRoot":"","sources":["../../../src/node/server/MindooDBServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,OAAoD,MAAM,SAAS,CAAC;AAqB3E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAc3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAwB5C,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,WAAW,CAAC,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,aAAa,EAAE,MAAM,CAAA;aAAE,CAAC;SAC3D;KACF;CACF;AAsCD,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,UAAU,CAAS;gBAGzB,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,YAAY,EACrB,UAAU,CAAC,EAAE,MAAM;IA8BrB,MAAM,IAAI,OAAO,CAAC,WAAW;IAI7B,gBAAgB,IAAI,aAAa;IAIjC,kBAAkB,IAAI,sBAAsB;IAI5C,eAAe,IAAI,YAAY;IAI/B,aAAa,IAAI,MAAM;IAIvB,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI;IAM3C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ1B,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAahE,OAAO,CAAC,eAAe;IA0BvB,OAAO,CAAC,WAAW;IAqEnB;;;;OAIG;YACW,qBAAqB;IA4CnC,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,iBAAiB;YAoVX,qBAAqB;YAmCrB,wBAAwB;YA2BxB,kBAAkB;IA2DhC,OAAO,CAAC,kBAAkB;IA4C1B,OAAO,CAAC,YAAY;YAMN,eAAe;YAef,kBAAkB;YAwBlB,oBAAoB;YAmBpB,0BAA0B;YAuB1B,iBAAiB;YAuBjB,sBAAsB;YA8BtB,uBAAuB;YAevB,qBAAqB;YAarB,yBAAyB;YAezB,gBAAgB;YAsBhB,gBAAgB;YAqBhB,gBAAgB;YAiBhB,eAAe;YAef,yBAAyB;YAoBzB,iCAAiC;YAqBjC,sCAAsC;YAoBtC,iBAAiB;IAM/B,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,qBAAqB;IAiB7B,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,sBAAsB;IAgB9B,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,kBAAkB;CAG3B"}