mindoodb 0.0.3 → 0.0.4

package/dist/node/server/add-to-network.js

@@ -0,0 +1,275 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * MindooDB Add-to-Network CLI
+ *
+ * Exchanges trusted-server public keys between a new server and existing servers
+ * using `/system/trusted-servers` with JWT auth (same system admin identity on each server).
+ *
+ * Password: MINDOODB_SYSTEM_ADMIN_PASSWORD, --password-file, or TTY prompt (hidden).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseArgs = parseArgs;
+const fs_1 = require("fs");
+const MindooDBServerAdmin_1 = require("../../core/MindooDBServerAdmin");
+const NodeCryptoAdapter_1 = require("../crypto/NodeCryptoAdapter");
+const ENV_PASSWORD = "MINDOODB_SYSTEM_ADMIN_PASSWORD";
+/** Exported for tests. */
+function parseArgs(args) {
+    const options = {
+        newServer: "",
+        servers: [],
+        identityPath: "",
+        passwordFile: "",
+        help: false,
+    };
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        const nextArg = args[i + 1];
+        switch (arg) {
+            case "--new-server":
+                if (nextArg) {
+                    options.newServer = nextArg.replace(/\/+$/, "");
+                    i++;
+                }
+                break;
+            case "--servers":
+                if (nextArg) {
+                    options.servers = nextArg.split(",").map((s) => s.trim().replace(/\/+$/, ""));
+                    i++;
+                }
+                break;
+            case "--identity":
+                if (nextArg) {
+                    options.identityPath = nextArg;
+                    i++;
+                }
+                break;
+            case "--password-file":
+                if (nextArg) {
+                    options.passwordFile = nextArg;
+                    i++;
+                }
+                break;
+            case "-h":
+            case "--help":
+                options.help = true;
+                break;
+            default:
+                if (arg.startsWith("-")) {
+                    console.error(`Unknown option: ${arg}`);
+                    process.exit(1);
+                }
+        }
+    }
+    return options;
+}
+function showHelp() {
+    console.log(`
+MindooDB Add-to-Network
+
+Adds a new server to an existing network by exchanging trust between all servers.
+Uses /system/trusted-servers with JWT (same system admin identity must be authorized on every server).
+
+Usage:
+  npm run server:add-to-network -- [options]
+
+Options:
+  --new-server <url>         URL of the server being added (required)
+  --servers <url,url,...>    Comma-separated URLs of existing servers (required)
+  --identity <path>          System admin *.identity.json (PrivateUserId) (required)
+  --password-file <path>     Read password from file (optional if env or TTY)
+  -h, --help                 Show this help message
+
+Password (first match wins):
+  ${ENV_PASSWORD}   environment variable
+  --password-file     file containing one line (trimmed)
+  TTY               hidden prompt on interactive terminal
+
+Example:
+  npm run server:add-to-network -- \\
+    --new-server https://server4.example.com \\
+    --servers https://s1.example.com,https://s2.example.com \\
+    --identity ./system-admin.identity.json
+`);
+}
+function loadIdentity(path) {
+    const raw = (0, fs_1.readFileSync)(path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.username || !parsed?.userSigningKeyPair?.publicKey) {
+        throw new Error(`Invalid identity file: ${path}`);
+    }
+    return parsed;
+}
+async function resolvePassword(passwordFile) {
+    const fromEnv = process.env[ENV_PASSWORD];
+    if (fromEnv !== undefined && fromEnv.length > 0) {
+        return fromEnv;
+    }
+    if (passwordFile) {
+        return (0, fs_1.readFileSync)(passwordFile, "utf8").replace(/\r?\n$/, "");
+    }
+    if (process.stdin.isTTY) {
+        return readPasswordHidden("System admin password: ");
+    }
+    console.error(`Error: Set ${ENV_PASSWORD}, use --password-file, or run from an interactive terminal.`);
+    process.exit(1);
+}
+/** Hidden password on TTY (no echo). */
+function readPasswordHidden(prompt) {
+    return new Promise((resolve, reject) => {
+        const stdin = process.stdin;
+        const stdout = process.stdout;
+        if (!stdin.isTTY) {
+            reject(new Error("Internal: readPasswordHidden without TTY"));
+            return;
+        }
+        stdout.write(prompt);
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        let pass = "";
+        const onData = (key) => {
+            if (key === "\n" || key === "\r" || key === "\u0004") {
+                stdin.setRawMode(false);
+                stdin.removeListener("data", onData);
+                stdin.pause();
+                stdout.write("\n");
+                resolve(pass);
+                return;
+            }
+            if (key === "\u0003") {
+                stdin.setRawMode(false);
+                process.exit(130);
+            }
+            if (key === "\u007f" || key === "\b") {
+                pass = pass.slice(0, -1);
+                return;
+            }
+            if (key.length === 1)
+                pass += key;
+        };
+        stdin.on("data", onData);
+    });
+}
+async function fetchServerInfo(serverUrl) {
+    const url = `${serverUrl}/.well-known/mindoodb-server-info`;
+    console.log(`  Fetching server info from ${url}`);
+    const response = await fetch(url);
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+        throw new Error(`Failed to fetch server info from ${serverUrl}: HTTP ${response.status} — ${JSON.stringify(body)}`);
+    }
+    const info = body;
+    if (!info.name || !info.signingPublicKey || !info.encryptionPublicKey) {
+        throw new Error(`Invalid server info response from ${serverUrl}`);
+    }
+    return info;
+}
+function createAdmin(baseUrl, identity, password) {
+    return new MindooDBServerAdmin_1.MindooDBServerAdmin({
+        serverUrl: baseUrl,
+        systemAdminUser: identity,
+        systemAdminPassword: password,
+        cryptoAdapter: new NodeCryptoAdapter_1.NodeCryptoAdapter(),
+    });
+}
+async function addTrustedServer(targetUrl, serverInfo, identity, password) {
+    const admin = createAdmin(targetUrl, identity, password);
+    try {
+        await admin.addTrustedServer({
+            name: serverInfo.name,
+            signingPublicKey: serverInfo.signingPublicKey,
+            encryptionPublicKey: serverInfo.encryptionPublicKey,
+        });
+        console.log(`  Added "${serverInfo.name}" to ${targetUrl}`);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        if (msg.includes("409") || /already exists/i.test(msg)) {
+            console.log(`  "${serverInfo.name}" already trusted on ${targetUrl} (skipped)`);
+            return;
+        }
+        throw e;
+    }
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const options = parseArgs(args);
+    if (options.help) {
+        showHelp();
+        process.exit(0);
+    }
+    if (!options.newServer) {
+        console.error("Error: --new-server is required. Use --help for usage.");
+        process.exit(1);
+    }
+    if (options.servers.length === 0) {
+        console.error("Error: --servers is required. Use --help for usage.");
+        process.exit(1);
+    }
+    if (!options.identityPath) {
+        console.error("Error: --identity is required. Use --help for usage.");
+        process.exit(1);
+    }
+    const identity = loadIdentity(options.identityPath);
+    const password = await resolvePassword(options.passwordFile);
+    if (!password) {
+        console.error("Error: system admin password is empty.");
+        process.exit(1);
+    }
+    console.log("=".repeat(60));
+    console.log("MindooDB Add-to-Network");
+    console.log("=".repeat(60));
+    console.log(`New server:       ${options.newServer}`);
+    console.log(`Existing servers: ${options.servers.join(", ")}`);
+    console.log(`Identity:         ${options.identityPath}`);
+    console.log("=".repeat(60));
+    console.log("\n[1/3] Fetching new server identity...");
+    const newServerInfo = await fetchServerInfo(options.newServer);
+    console.log(`  Server name: ${newServerInfo.name}\n`);
+    console.log("[2/3] Exchanging trust with existing servers...");
+    let successCount = 0;
+    const errors = [];
+    for (const existingUrl of options.servers) {
+        try {
+            console.log(`\n  --- ${existingUrl} ---`);
+            const existingInfo = await fetchServerInfo(existingUrl);
+            console.log(`  Server name: ${existingInfo.name}`);
+            await addTrustedServer(existingUrl, newServerInfo, identity, password);
+            await addTrustedServer(options.newServer, existingInfo, identity, password);
+            successCount++;
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            console.error(`  ERROR: ${msg}`);
+            errors.push(`${existingUrl}: ${msg}`);
+        }
+    }
+    console.log("\n" + "=".repeat(60));
+    console.log("[3/3] Summary");
+    console.log("=".repeat(60));
+    console.log(`Trust established with ${successCount}/${options.servers.length} servers.`);
+    if (errors.length > 0) {
+        console.log(`\nErrors (${errors.length}):`);
+        for (const err of errors) {
+            console.log(`  - ${err}`);
+        }
+        process.exit(1);
+    }
+    console.log(`\n${newServerInfo.name} is now part of the network.`);
+    console.log("Next step: configure per-tenant sync via POST /system/tenants/:tenantId/sync-servers (see README-server.md).");
+}
+function isDirectExecution() {
+    const entry = process.argv[1];
+    if (!entry)
+        return false;
+    return /[/\\]add-to-network\.(ts|js|mjs|cjs)$/.test(entry);
+}
+if (isDirectExecution()) {
+    main().catch((error) => {
+        console.error("Fatal error:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=add-to-network.js.map

package/dist/node/server/add-to-network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-to-network.js","sourceRoot":"","sources":["../../../src/node/server/add-to-network.ts"],"names":[],"mappings":";;AACA;;;;;;;GAOG;;AAmBH,8BAmDC;AApED,2BAAkC;AAClC,wEAAqE;AAGrE,mEAAgE;AAEhE,MAAM,YAAY,GAAG,gCAAgC,CAAC;AAUtD,0BAA0B;AAC1B,SAAgB,SAAS,CAAC,IAAc;IACtC,MAAM,OAAO,GAAe;QAC1B,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,EAAE;QACX,YAAY,EAAE,EAAE;QAChB,YAAY,EAAE,EAAE;QAChB,IAAI,EAAE,KAAK;KACZ,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAE5B,QAAQ,GAAG,EAAE,CAAC;YACZ,KAAK,cAAc;gBACjB,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBAChD,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;oBAC9E,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,YAAY;gBACf,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC;oBAC/B,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,iBAAiB;gBACpB,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,YAAY,GAAG,OAAO,CAAC;oBAC/B,CAAC,EAAE,CAAC;gBACN,CAAC;gBACD,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR;gBACE,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,OAAO,CAAC,KAAK,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;oBACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;IAiBV,YAAY;;;;;;;;;CASf,CAAC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,YAAoB;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,IAAA,iBAAY,EAAC,YAAY,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACxB,OAAO,kBAAkB,CAAC,yBAAyB,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,KAAK,CACX,cAAc,YAAY,6DAA6D,CACxF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,wCAAwC;AACxC,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACxB,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACrC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACrC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;gBACzB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,IAAI,GAAG,CAAC;QACpC,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,GAAG,GAAG,GAAG,SAAS,mCAAmC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,oCAAoC,SAAS,UAAU,QAAQ,CAAC,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACnG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,IAA0B,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAClB,OAAe,EACf,QAAuB,EACvB,QAAgB;IAEhB,OAAO,IAAI,yCAAmB,CAAC;QAC7B,SAAS,EAAE,OAAO;QAClB,eAAe,EAAE,QAAQ;QACzB,mBAAmB,EAAE,QAAQ;QAC7B,aAAa,EAAE,IAAI,qCAAiB,EAAE;KACvC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,SAAiB,EACjB,UAA8B,EAC9B,QAAuB,EACvB,QAAgB;IAEhB,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,gBAAgB,CAAC;YAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,mBAAmB,EAAE,UAAU,CAAC,mBAAmB;SACpD,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,YAAY,UAAU,CAAC,IAAI,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,wBAAwB,SAAS,YAAY,CAAC,CAAC;YAChF,OAAO;QACT,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAEhC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5B,OAAO,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,kBAAkB,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,WAAW,WAAW,MAAM,CAAC,CAAC;YAE1C,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;YACxD,OAAO,CAAC,GAAG,CAAC,kBAAkB,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;YAEnD,MAAM,gBAAgB,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACvE,MAAM,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAE5E,YAAY,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,GAAG,WAAW,KAAK,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,0BAA0B,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,WAAW,CAAC,CAAC;IAEzF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,IAAI,8BAA8B,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CACT,8GAA8G,CAC/G,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,uCAAuC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,IAAI,iBAAiB,EAAE,EAAE,CAAC;IACxB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/node/server/config.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Server config loader and validator.
+ *
+ * Loads `config.json` at server startup. The file defines capabilities-based
+ * authorization for system admin endpoints.
+ */
+import type { ServerConfig, SystemAdminPrincipal } from "./types";
+export interface ConfigBackupInfo {
+    file: string;
+    createdAt: string;
+}
+export declare function isTenantCreationCapabilityRule(ruleKey: string): boolean;
+export declare function isWildcardSystemAdminPrincipal(principal: SystemAdminPrincipal): boolean;
+export declare function hasTenantCreationWildcardPrincipal(config: ServerConfig): boolean;
+/**
+ * Resolve the config file path from CLI argument or data directory fallback.
+ */
+export declare function resolveConfigPath(dataDir: string, explicitConfigPath?: string): string;
+/**
+ * Load and validate the server config.
+ *
+ * Resolution order:
+ * 1. Explicit `--config <path>` CLI argument.
+ * 2. `<dataDir>/config.json` (default fallback).
+ *
+ * If neither file exists, an empty config with no capabilities is returned
+ * (all `/system/*` requests will be denied).
+ */
+export declare function loadServerConfig(dataDir: string, explicitConfigPath?: string): ServerConfig;
+export declare function validateServerConfig(raw: unknown, filePath: string): ServerConfig;
+/**
+ * Create a timestamped backup of the current config.json.
+ * Returns the backup filename (not full path).
+ *
+ * Backup naming: `config.<ISO-timestamp>.json` with colons replaced by
+ * hyphens for filesystem compatibility.
+ */
+export declare function backupConfig(configPath: string): string;
+/**
+ * Persist a ServerConfig to disk as formatted JSON.
+ */
+export declare function writeConfig(configPath: string, config: ServerConfig): void;
+export declare function isConfigBackupFilename(fileName: string): boolean;
+export declare function listConfigBackups(configPath: string): ConfigBackupInfo[];
+export declare function loadConfigBackup(configPath: string, backupFile: string): ServerConfig;
+/**
+ * Extract all unique system admin principals from the capabilities config.
+ * Each principal is identified by (username, publicsignkey).
+ */
+export declare function extractAllPrincipals(config: ServerConfig): SystemAdminPrincipal[];
+//# sourceMappingURL=config.d.ts.map

package/dist/node/server/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/node/server/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,KAAK,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAElE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAUvE;AAED,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,oBAAoB,GAC9B,OAAO,CAET;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAKhF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE,MAAM,GAC1B,MAAM,CAER;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,kBAAkB,CAAC,EAAE,MAAM,GAC1B,YAAY,CAmBd;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY,CA0CjF;AA6ED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CASvD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI,CAG1E;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEhE;AAcD,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAaxE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,YAAY,CAmBrF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,YAAY,GACnB,oBAAoB,EAAE,CAexB"}

package/dist/node/server/config.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * Server config loader and validator.
+ *
+ * Loads `config.json` at server startup. The file defines capabilities-based
+ * authorization for system admin endpoints.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isTenantCreationCapabilityRule = isTenantCreationCapabilityRule;
+exports.isWildcardSystemAdminPrincipal = isWildcardSystemAdminPrincipal;
+exports.hasTenantCreationWildcardPrincipal = hasTenantCreationWildcardPrincipal;
+exports.resolveConfigPath = resolveConfigPath;
+exports.loadServerConfig = loadServerConfig;
+exports.validateServerConfig = validateServerConfig;
+exports.backupConfig = backupConfig;
+exports.writeConfig = writeConfig;
+exports.isConfigBackupFilename = isConfigBackupFilename;
+exports.listConfigBackups = listConfigBackups;
+exports.loadConfigBackup = loadConfigBackup;
+exports.extractAllPrincipals = extractAllPrincipals;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const CONFIG_BACKUP_FILENAME_RE = /^config\.(\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}(?:\.\d{3})?Z)\.json$/;
+function isTenantCreationCapabilityRule(ruleKey) {
+    const colonIdx = ruleKey.indexOf(":");
+    if (colonIdx === -1) {
+        return false;
+    }
+    const method = ruleKey.substring(0, colonIdx).toUpperCase();
+    const pathPattern = ruleKey.substring(colonIdx + 1);
+    return method === "POST" && pathPattern.startsWith("/system/tenants/");
+}
+function isWildcardSystemAdminPrincipal(principal) {
+    return principal.username === "*" && principal.publicsignkey === "*";
+}
+function hasTenantCreationWildcardPrincipal(config) {
+    return Object.entries(config.capabilities).some(([ruleKey, principals]) => isTenantCreationCapabilityRule(ruleKey) &&
+        principals.some((principal) => isWildcardSystemAdminPrincipal(principal)));
+}
+/**
+ * Resolve the config file path from CLI argument or data directory fallback.
+ */
+function resolveConfigPath(dataDir, explicitConfigPath) {
+    return explicitConfigPath ?? (0, path_1.join)(dataDir, "config.json");
+}
+/**
+ * Load and validate the server config.
+ *
+ * Resolution order:
+ * 1. Explicit `--config <path>` CLI argument.
+ * 2. `<dataDir>/config.json` (default fallback).
+ *
+ * If neither file exists, an empty config with no capabilities is returned
+ * (all `/system/*` requests will be denied).
+ */
+function loadServerConfig(dataDir, explicitConfigPath) {
+    const configPath = resolveConfigPath(dataDir, explicitConfigPath);
+    if (!(0, fs_1.existsSync)(configPath)) {
+        console.log(`[Config] No config.json found at ${configPath} — all /system/* endpoints are locked down`);
+        return { capabilities: {} };
+    }
+    const raw = (0, fs_1.readFileSync)(configPath, "utf-8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse config.json at ${configPath}: ${err}`);
+    }
+    return validateServerConfig(parsed, configPath);
+}
+function validateServerConfig(raw, filePath) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath} must be a JSON object`);
+    }
+    const obj = raw;
+    if (!obj.capabilities || typeof obj.capabilities !== "object" || Array.isArray(obj.capabilities)) {
+        throw new Error(`config.json at ${filePath} must have a "capabilities" object`);
+    }
+    const capabilities = {};
+    for (const [ruleKey, principals] of Object.entries(obj.capabilities)) {
+        validateCapabilityRule(ruleKey, filePath);
+        if (!Array.isArray(principals)) {
+            throw new Error(`config.json: capability rule "${ruleKey}" must map to an array of principals`);
+        }
+        capabilities[ruleKey] = principals.map((p, i) => validatePrincipal(p, ruleKey, i, filePath));
+    }
+    const config = { capabilities };
+    const principalCount = Object.values(capabilities).reduce((sum, arr) => sum + arr.length, 0);
+    console.log(`[Config] Loaded config.json from ${filePath}: ${Object.keys(capabilities).length} capability rule(s), ${principalCount} principal entry/entries`);
+    return config;
+}
+/**
+ * Validate a capability rule key has the format `METHOD:PATH`.
+ */
+function validateCapabilityRule(rule, filePath) {
+    const colonIdx = rule.indexOf(":");
+    if (colonIdx === -1) {
+        throw new Error(`config.json at ${filePath}: invalid capability rule "${rule}" — expected "METHOD:PATH" format`);
+    }
+    const method = rule.substring(0, colonIdx).toUpperCase();
+    const pathPattern = rule.substring(colonIdx + 1);
+    const validMethods = ["ALL", "GET", "POST", "PUT", "DELETE", "PATCH"];
+    if (!validMethods.includes(method)) {
+        throw new Error(`config.json at ${filePath}: invalid method "${method}" in rule "${rule}" — expected one of ${validMethods.join(", ")}`);
+    }
+    if (!pathPattern.startsWith("/")) {
+        throw new Error(`config.json at ${filePath}: path pattern in rule "${rule}" must start with "/"`);
+    }
+}
+function validatePrincipal(raw, ruleKey, index, filePath) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        throw new Error(`config.json at ${filePath}: principal #${index} in rule "${ruleKey}" must be an object`);
+    }
+    const obj = raw;
+    if (typeof obj.username !== "string" || obj.username.length === 0) {
+        throw new Error(`config.json at ${filePath}: principal #${index} in rule "${ruleKey}" must have a non-empty "username" string`);
+    }
+    if (typeof obj.publicsignkey !== "string" || obj.publicsignkey.length === 0) {
+        throw new Error(`config.json at ${filePath}: principal #${index} in rule "${ruleKey}" must have a non-empty "publicsignkey" string`);
+    }
+    const hasWildcardField = obj.username === "*" || obj.publicsignkey === "*";
+    if (hasWildcardField) {
+        if (obj.username !== "*" || obj.publicsignkey !== "*") {
+            throw new Error(`config.json at ${filePath}: principal #${index} in rule "${ruleKey}" must use "*" for both "username" and "publicsignkey"`);
+        }
+        if (!isTenantCreationCapabilityRule(ruleKey)) {
+            throw new Error(`config.json at ${filePath}: wildcard principal "*" is only allowed for POST:/system/tenants/... rules`);
+        }
+    }
+    return {
+        username: obj.username,
+        publicsignkey: obj.publicsignkey,
+    };
+}
+/**
+ * Create a timestamped backup of the current config.json.
+ * Returns the backup filename (not full path).
+ *
+ * Backup naming: `config.<ISO-timestamp>.json` with colons replaced by
+ * hyphens for filesystem compatibility.
+ */
+function backupConfig(configPath) {
+    const timestamp = new Date().toISOString().replace(/:/g, "-");
+    const dir = (0, path_1.dirname)(configPath);
+    const backupName = `config.${timestamp}.json`;
+    const backupPath = (0, path_1.join)(dir, backupName);
+    (0, fs_1.copyFileSync)(configPath, backupPath);
+    console.log(`[Config] Backup created: ${backupName}`);
+    return backupName;
+}
+/**
+ * Persist a ServerConfig to disk as formatted JSON.
+ */
+function writeConfig(configPath, config) {
+    (0, fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2), "utf-8");
+    console.log(`[Config] Config written to ${configPath}`);
+}
+function isConfigBackupFilename(fileName) {
+    return CONFIG_BACKUP_FILENAME_RE.test(fileName);
+}
+function parseBackupTimestamp(fileName) {
+    const match = CONFIG_BACKUP_FILENAME_RE.exec(fileName);
+    if (!match) {
+        return null;
+    }
+    return match[1].replace(/^(\d{4}-\d{2}-\d{2}T\d{2})-(\d{2})-(\d{2}(?:\.\d{3})?Z)$/, "$1:$2:$3");
+}
+function listConfigBackups(configPath) {
+    const dir = (0, path_1.dirname)(configPath);
+    return (0, fs_1.readdirSync)(dir)
+        .filter((file) => isConfigBackupFilename(file))
+        .map((file) => {
+        const createdAt = parseBackupTimestamp(file);
+        if (!createdAt) {
+            throw new Error(`Invalid config backup filename: ${file}`);
+        }
+        return { file, createdAt };
+    })
+        .sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+}
+function loadConfigBackup(configPath, backupFile) {
+    if (!isConfigBackupFilename(backupFile)) {
+        throw new Error(`Invalid config backup filename: ${backupFile}`);
+    }
+    const backupPath = (0, path_1.join)((0, path_1.dirname)(configPath), backupFile);
+    if (!(0, fs_1.existsSync)(backupPath)) {
+        throw new Error(`Config backup not found: ${backupFile}`);
+    }
+    const raw = (0, fs_1.readFileSync)(backupPath, "utf-8");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`Failed to parse config backup ${backupFile}: ${err}`);
+    }
+    return validateServerConfig(parsed, backupPath);
+}
+/**
+ * Extract all unique system admin principals from the capabilities config.
+ * Each principal is identified by (username, publicsignkey).
+ */
+function extractAllPrincipals(config) {
+    const seen = new Set();
+    const result = [];
+    for (const principals of Object.values(config.capabilities)) {
+        for (const p of principals) {
+            const key = `${p.username.toLowerCase()}\0${p.publicsignkey}`;
+            if (!seen.has(key)) {
+                seen.add(key);
+                result.push(p);
+            }
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=config.js.map

package/dist/node/server/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/node/server/config.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAqBH,wEAUC;AAED,wEAIC;AAED,gFAKC;AAKD,8CAKC;AAYD,4CAsBC;AAED,oDA0CC;AAoFD,oCASC;AAKD,kCAGC;AAED,wDAEC;AAcD,8CAaC;AAED,4CAmBC;AAMD,oDAiBC;AAlTD,2BAMY;AACZ,+BAA+C;AAS/C,MAAM,yBAAyB,GAC7B,oEAAoE,CAAC;AAEvE,SAAgB,8BAA8B,CAAC,OAAe;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEpD,OAAO,MAAM,KAAK,MAAM,IAAI,WAAW,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AACzE,CAAC;AAED,SAAgB,8BAA8B,CAC5C,SAA+B;IAE/B,OAAO,SAAS,CAAC,QAAQ,KAAK,GAAG,IAAI,SAAS,CAAC,aAAa,KAAK,GAAG,CAAC;AACvE,CAAC;AAED,SAAgB,kCAAkC,CAAC,MAAoB;IACrE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,CACxE,8BAA8B,CAAC,OAAO,CAAC;QACvC,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC,CAC1E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,iBAAiB,CAC/B,OAAe,EACf,kBAA2B;IAE3B,OAAO,kBAAkB,IAAI,IAAA,WAAI,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gBAAgB,CAC9B,OAAe,EACf,kBAA2B;IAE3B,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAElE,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CACT,oCAAoC,UAAU,4CAA4C,CAC3F,CAAC;QACF,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC9B,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,SAAgB,oBAAoB,CAAC,GAAY,EAAE,QAAgB;IACjE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,wBAAwB,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACjG,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,oCAAoC,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAA2C,EAAE,CAAC;IAEhE,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAChD,GAAG,CAAC,YAAuC,CAC5C,EAAE,CAAC;QACF,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,sCAAsC,CAC/E,CAAC;QACJ,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,iBAAiB,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAiB,EAAE,YAAY,EAAE,CAAC;IAE9C,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CACvD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,EAC9B,CAAC,CACF,CAAC;IACF,OAAO,CAAC,GAAG,CACT,oCAAoC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,wBAAwB,cAAc,0BAA0B,CAClJ,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,QAAgB;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,8BAA8B,IAAI,mCAAmC,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IACzD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,qBAAqB,MAAM,cAAc,IAAI,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,2BAA2B,IAAI,uBAAuB,CACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CACxB,GAAY,EACZ,OAAe,EACf,KAAa,EACb,QAAgB;IAEhB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,qBAAqB,CACzF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAA8B,CAAC;IAE3C,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,2CAA2C,CAC/G,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,gDAAgD,CACpH,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,CAAC;IAC3E,IAAI,gBAAgB,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,aAAa,KAAK,GAAG,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,gBAAgB,KAAK,aAAa,OAAO,wDAAwD,CAC5H,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,6EAA6E,CACxG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa;KACjC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,YAAY,CAAC,UAAkB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,UAAU,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,UAAU,SAAS,OAAO,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAEzC,IAAA,iBAAY,EAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,UAAkB,EAAE,MAAoB;IAClE,IAAA,kBAAa,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,8BAA8B,UAAU,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAgB;IACrD,OAAO,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CACrB,0DAA0D,EAC1D,UAAU,CACX,CAAC;AACJ,CAAC;AAED,SAAgB,iBAAiB,CAAC,UAAkB;IAClD,MAAM,GAAG,GAAG,IAAA,cAAO,EAAC,UAAU,CAAC,CAAC;IAEhC,OAAO,IAAA,gBAAW,EAAC,GAAG,CAAC;SACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAgB,gBAAgB,CAAC,UAAkB,EAAE,UAAkB;IACrE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,IAAA,cAAO,EAAC,UAAU,CAAC,EAAE,UAAU,CAAC,CAAC;IACzD,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iCAAiC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,oBAAoB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,MAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACd,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/node/server/resolveServerPassword.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Server identity password: optional file (preferred for Docker: avoids putting
+ * the secret in the container environment block), else MINDOODB_SERVER_PASSWORD.
+ * File content is trimmed (single line).
+ */
+export declare function resolveServerPassword(): string | undefined;
+//# sourceMappingURL=resolveServerPassword.d.ts.map

package/dist/node/server/resolveServerPassword.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveServerPassword.d.ts","sourceRoot":"","sources":["../../../src/node/server/resolveServerPassword.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAgB1D"}

package/dist/node/server/resolveServerPassword.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveServerPassword = resolveServerPassword;
+const fs_1 = require("fs");
+const types_1 = require("./types");
+/**
+ * Server identity password: optional file (preferred for Docker: avoids putting
+ * the secret in the container environment block), else MINDOODB_SERVER_PASSWORD.
+ * File content is trimmed (single line).
+ */
+function resolveServerPassword() {
+    const filePath = process.env[types_1.ENV_VARS.SERVER_PASSWORD_FILE]?.trim();
+    if (filePath) {
+        try {
+            const s = (0, fs_1.readFileSync)(filePath, "utf8").trim();
+            return s.length > 0 ? s : undefined;
+        }
+        catch (e) {
+            throw new Error(`Cannot read ${types_1.ENV_VARS.SERVER_PASSWORD_FILE} (${filePath}): ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    const direct = process.env[types_1.ENV_VARS.SERVER_PASSWORD];
+    return direct !== undefined && direct.length > 0 ? direct : undefined;
+}
+//# sourceMappingURL=resolveServerPassword.js.map

package/dist/node/server/resolveServerPassword.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveServerPassword.js","sourceRoot":"","sources":["../../../src/node/server/resolveServerPassword.ts"],"names":[],"mappings":";;AAQA,sDAgBC;AAxBD,2BAAkC;AAClC,mCAAmC;AAEnC;;;;GAIG;AACH,SAAgB,qBAAqB;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAQ,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAA,iBAAY,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YAChD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,eAAe,gBAAQ,CAAC,oBAAoB,KAAK,QAAQ,MACvD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3C,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAQ,CAAC,eAAe,CAAC,CAAC;IACrD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACxE,CAAC"}

package/dist/node/server/server.d.ts

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+/**
+ * MindooDB Example Server - Entry Point
+ *
+ * Usage:
+ *   npm run server:dev -- [options]   (from repo root)
+ *   node dist/node/server/server.js [options]
+ *
+ * Options:
+ *   -d, --data-dir <path>   Data directory path (default: ./data)
+ *   -p, --port <port>       Server port (default: 1661)
+ *   -s, --auto-sync         Enable automatic sync with remote servers
+ *   -w, --static-dir <path> Serve static files from this directory at /statics/
+ *   --tls-cert <path>       Path to TLS certificate file (PEM)
+ *   --tls-key <path>        Path to TLS private key file (PEM)
+ *   -h, --help              Show this help message
+ *
+ * Environment variables:
+ *   MINDOODB_SERVER_PASSWORD / MINDOODB_SERVER_PASSWORD_FILE — server identity password
+ */
+export {};
+//# sourceMappingURL=server.d.ts.map

package/dist/node/server/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/node/server/server.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG"}