mindoodb 0.0.45 → 0.0.46

package/dist/core/copy/flatten.js

@@ -0,0 +1,155 @@
+"use strict";
+/**
+ * The flatten copy strategy.
+ *
+ * Reads the source document's state — at its head, or as of
+ * {@link CopyDocumentOptions.atTimestamp} — and writes it into the target as a
+ * brand-new document with a single revision. History, original authors and the
+ * CRDT structure are all deliberately left behind; what arrives is a clean
+ * document that happens to have the same content.
+ *
+ * Unlike the two history strategies this one goes entirely through the public
+ * document API, which is what makes it work regardless of tenant, key or
+ * document id: `createDocument` + one `changeDoc`, with attachments re-uploaded
+ * through `addAttachmentStream` so they get fresh chunk ids in the target.
+ *
+ * **Caveat worth knowing:** materializing an Automerge document to plain JS
+ * collapses its text fields into ordinary strings. A flattened copy therefore
+ * loses the character-level text CRDT structure, and concurrent edits to those
+ * fields merge as whole-value conflicts rather than per-character. That is
+ * usually the right trade for a fresh document, but it is the reason
+ * `mode: "history"` exists.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.flattenDocument = flattenDocument;
+const types_1 = require("../types");
+/** Payload key holding {@link FlattenedDocumentProvenance}. */
+const PROVENANCE_FIELD = "_provenance";
+/**
+ * Materialize the source payload as plain data the target can accept.
+ *
+ * `_`-prefixed keys are MindooDB's own namespace (`_attachments`,
+ * `_lastModified`) and are managed by the target database, so they are dropped
+ * rather than copied over stale.
+ */
+function copyablePayload(payload) {
+    const copy = {};
+    for (const [key, value] of Object.entries(payload)) {
+        if (key.startsWith("_"))
+            continue;
+        copy[key] = structuredClone(value);
+    }
+    return copy;
+}
+/** Flatten one document into the target database. */
+async function flattenDocument(source, target, context, options, reporter) {
+    const { sourceDocId, targetDocId } = context;
+    reporter.emit("planning", `Reading ${sourceDocId} for a flattened copy`);
+    const sourceDoc = options.atTimestamp != null
+        ? await source.db.getDocumentAtTimestamp(sourceDocId, options.atTimestamp)
+        : await source.db.getDocument(sourceDocId);
+    if (!sourceDoc) {
+        throw new Error(options.atTimestamp != null
+            ? `Document ${sourceDocId} did not exist at timestamp ${options.atTimestamp}.`
+            : `Document ${sourceDocId} was not found in database ${context.sourceDbId}.`);
+    }
+    const usesGeneratedId = (options.targetDocId ?? "new") === "new";
+    if (!usesGeneratedId && !types_1.CUSTOM_DOC_ID_REGEX.test(targetDocId)) {
+        // Ids minted by MindooDB may start with a digit, which the caller-provided
+        // id rules reject. Say so here rather than letting createDocument fail with
+        // a message that gives no hint about the copy.
+        throw new Error(`Cannot flatten into document id '${targetDocId}': caller-provided ids must ` +
+            "match /^[A-Za-z][A-Za-z0-9_]*$/. Copy with mode 'history' to keep a " +
+            "MindooDB-generated id, or pass an explicit targetDocId that satisfies the rule.");
+    }
+    const copiedByPublicKey = options.signingKeyPair?.publicKey ??
+        (await target.tenant.getCurrentUserId()).userSigningPublicKey;
+    const payload = copyablePayload(sourceDoc.getData());
+    let provenance;
+    if (options.provenance !== false) {
+        provenance = {
+            copiedAt: Date.now(),
+            sourceTenantId: context.sourceTenantId,
+            sourceDbId: context.sourceDbId,
+            sourceDocId,
+            copiedByPublicKey,
+        };
+        if (options.atTimestamp != null) {
+            // Automerge rejects an explicit `undefined`, so optional fields have to be
+            // left out entirely rather than assigned an absent value.
+            provenance.sourceAtTimestamp = options.atTimestamp;
+        }
+    }
+    const includeAttachments = options.includeAttachments !== false;
+    const sourceAttachments = includeAttachments ? sourceDoc.getAttachments() : [];
+    // Fold the payload into the `doc_create` change instead of writing a second
+    // entry for it. A caller-provided id normally cannot do this: it is seeded
+    // from a hard-coded Automerge change so independent replicas converge on the
+    // same hash, and baking content into that change would diverge it per
+    // document — `createDocument` rejects the combination. `assumeUniqueId` is
+    // the caller's assertion that concurrent same-id creation cannot happen, so
+    // convergence is moot and the create can take the generated-id path.
+    //
+    // `copyablePayload` has already dropped every `_`-prefixed key, so nothing is
+    // silently lost to `initialValues`' own reserved-field sanitizer.
+    const assumeUniqueId = !usesGeneratedId && options.assumeUniqueTargetDocId === true;
+    const seedPayloadIntoCreate = usesGeneratedId || assumeUniqueId;
+    const idsBefore = new Set((await target.store.findNewEntriesForDoc([], targetDocId)).map((entry) => entry.id));
+    reporter.emit("transferring", `Writing flattened copy as ${targetDocId}`);
+    const targetDoc = await target.db.createDocument({
+        ...(usesGeneratedId
+            ? { idPrefix: options.idPrefix }
+            : { id: targetDocId, assumeUniqueId }),
+        ...(seedPayloadIntoCreate ? { initialValues: payload } : {}),
+        decryptionKeyId: context.targetDecryptionKeyId,
+        signingKeyPair: options.signingKeyPair,
+        signingKeyPassword: options.signingKeyPassword,
+        bypassAccessControlPrecheck: options.bypassAccessControlPrecheck,
+    });
+    // Whatever the create could not carry. `_provenance` is in MindooDB's
+    // reserved namespace, which `initialValues` refuses to seed, so asking for
+    // provenance costs the second entry — the price of keeping the marker out of
+    // the caller's field namespace, where a later re-copy would treat it as
+    // ordinary content.
+    const needsFollowUpChange = !seedPayloadIntoCreate || provenance !== undefined || sourceAttachments.length > 0;
+    if (needsFollowUpChange) {
+        await target.db.changeDoc(targetDoc, async (draft) => {
+            if (!seedPayloadIntoCreate) {
+                Object.assign(draft.getData(), payload);
+            }
+            if (provenance) {
+                draft.getData()[PROVENANCE_FIELD] = provenance;
+            }
+            for (const attachment of sourceAttachments) {
+                if (options.signal?.aborted)
+                    break;
+                await draft.addAttachmentStream(sourceDoc.streamAttachment(attachment.attachmentId), attachment.fileName, attachment.mimeType);
+            }
+        }, {
+            signingKeyPair: options.signingKeyPair,
+            signingKeyPassword: options.signingKeyPassword,
+            bypassAccessControlPrecheck: options.bypassAccessControlPrecheck,
+        });
+    }
+    const written = (await target.store.findNewEntriesForDoc([], targetDoc.getId())).filter((entry) => !idsBefore.has(entry.id));
+    reporter.copiedEntries += written.length;
+    for (const entry of written) {
+        reporter.copiedBytes += entry.encryptedSize;
+    }
+    reporter.copiedAttachments += sourceAttachments.length;
+    reporter.emit("complete", `Flattened ${sourceDocId} into ${targetDoc.getId()}`);
+    return {
+        sourceDocId,
+        targetDocId: targetDoc.getId(),
+        strategy: "flatten",
+        authorshipPreserved: false,
+        mergedIntoExisting: context.targetHasDocId,
+        copiedEntries: written.length,
+        copiedBytes: written.reduce((total, entry) => total + entry.encryptedSize, 0),
+        copiedAttachments: sourceAttachments.length,
+        cancelled: options.signal?.aborted ?? false,
+    };
+}
+//# sourceMappingURL=flatten.js.map

package/dist/core/copy/flatten.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flatten.js","sourceRoot":"","sources":["../../../src/core/copy/flatten.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AAuDH,0CA+IC;AApMD,oCAA+C;AAiC/C,+DAA+D;AAC/D,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,OAAyB;IAChD,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qDAAqD;AAC9C,KAAK,UAAU,eAAe,CACnC,MAAsB,EACtB,MAAsB,EACtB,OAAoB,EACpB,OAA4B,EAC5B,QAA8B;IAE9B,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE7C,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,WAAW,uBAAuB,CAAC,CAAC;IACzE,MAAM,SAAS,GACb,OAAO,CAAC,WAAW,IAAI,IAAI;QACzB,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC,sBAAsB,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC;QAC1E,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,WAAW,IAAI,IAAI;YACzB,CAAC,CAAC,YAAY,WAAW,+BAA+B,OAAO,CAAC,WAAW,GAAG;YAC9E,CAAC,CAAC,YAAY,WAAW,8BAA8B,OAAO,CAAC,UAAU,GAAG,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC;IACjE,IAAI,CAAC,eAAe,IAAI,CAAC,2BAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,2EAA2E;QAC3E,4EAA4E;QAC5E,+CAA+C;QAC/C,MAAM,IAAI,KAAK,CACb,oCAAoC,WAAW,8BAA8B;YAC3E,sEAAsE;YACtE,iFAAiF,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GACrB,OAAO,CAAC,cAAc,EAAE,SAAS;QACjC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,oBAAoB,CAAC;IAChE,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC;IAErD,IAAI,UAAmD,CAAC;IACxD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QACjC,UAAU,GAAG;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;YACpB,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,WAAW;YACX,iBAAiB;SAClB,CAAC;QACF,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAChC,2EAA2E;YAC3E,0DAA0D;YAC1D,UAAU,CAAC,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,KAAK,KAAK,CAAC;IAChE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,cAAc,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC;IACpF,MAAM,qBAAqB,GAAG,eAAe,IAAI,cAAc,CAAC;IAEhE,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CACpF,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,cAAc,EAAE,6BAA6B,WAAW,EAAE,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC;QAC/C,GAAG,CAAC,eAAe;YACjB,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;YAChC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;QACxC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,eAAe,EAAE,OAAO,CAAC,qBAAqB;QAC9C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;KACjE,CAAC,CAAC;IAEH,sEAAsE;IACtE,2EAA2E;IAC3E,6EAA6E;IAC7E,wEAAwE;IACxE,oBAAoB;IACpB,MAAM,mBAAmB,GACvB,CAAC,qBAAqB,IAAI,UAAU,KAAK,SAAS,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;IAErF,IAAI,mBAAmB,EAAE,CAAC;QACxB,MAAM,MAAM,CAAC,EAAE,CAAC,SAAS,CACvB,SAAS,EACT,KAAK,EAAE,KAAgB,EAAE,EAAE;YACzB,IAAI,CAAC,qBAAqB,EAAE,CAAC;gBAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACf,KAAK,CAAC,OAAO,EAAE,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAAC;YACjD,CAAC;YACD,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,CAAC;gBAC3C,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;oBAAE,MAAM;gBACnC,MAAM,KAAK,CAAC,mBAAmB,CAC7B,SAAS,CAAC,gBAAgB,CAAC,UAAU,CAAC,YAAY,CAAC,EACnD,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,QAAQ,CACpB,CAAC;YACJ,CAAC;QACH,CAAC,EACD;YACE,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,2BAA2B,EAAE,OAAO,CAAC,2BAA2B;SACjE,CACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,CACd,MAAM,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,SAAS,CAAC,KAAK,EAAE,CAAC,CAC/D,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,QAAQ,CAAC,WAAW,IAAI,KAAK,CAAC,aAAa,CAAC;IAC9C,CAAC;IACD,QAAQ,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,WAAW,SAAS,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEhF,OAAO;QACL,WAAW;QACX,WAAW,EAAE,SAAS,CAAC,KAAK,EAAE;QAC9B,QAAQ,EAAE,SAAS;QACnB,mBAAmB,EAAE,KAAK;QAC1B,kBAAkB,EAAE,OAAO,CAAC,cAAc;QAC1C,aAAa,EAAE,OAAO,CAAC,MAAM;QAC7B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,iBAAiB,EAAE,iBAAiB,CAAC,MAAM;QAC3C,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI,KAAK;KAC5C,CAAC;AACJ,CAAC"}

package/dist/core/copy/host.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The narrow seam the copy engine uses to reach into a database.
+ *
+ * `BaseMindooDB` is already very large, so the copy engine lives in its own
+ * module and receives only what it needs through {@link CopyEngineHost} rather
+ * than being written as more methods on the class. A handful of the things it
+ * needs (entry signing, the attachment-ref snapshot) are private on
+ * `BaseMindooDB`; the class exposes them here through one `@internal` accessor
+ * instead of widening their visibility.
+ *
+ * @internal
+ * @module
+ */
+import type { ContentAddressedStore } from "../appendonlystores/types";
+import type { AccessDecision, RuleType } from "../accesscontrol/types";
+import type { EntryProvenance } from "../crypto/EntrySignature";
+import type { MindooDB, MindooDocPayload, MindooTenant, SigningKeyPair, StoreEntryAttachmentRef, StoreEntryMetadata } from "../types";
+/**
+ * Everything the copy engine needs from one side of a copy.
+ *
+ * @internal
+ */
+export interface CopyEngineHost {
+    /** The database itself, for the strategies that go through the public API. */
+    readonly db: MindooDB;
+    /** The tenant owning {@link db}. */
+    readonly tenant: MindooTenant;
+    /** The document entry store. */
+    readonly store: ContentAddressedStore;
+    /** The attachment chunk store. */
+    readonly attachmentStore: ContentAddressedStore;
+    /**
+     * Compute the author's metadata-binding signature for an entry, using the
+     * supplied signing key when given and the current user's key otherwise.
+     * Mirrors what every ordinary write path does, so copied entries are
+     * indistinguishable in structure from natively written ones.
+     */
+    computeEntryMetadataSignature(meta: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs"> & {
+        provenance?: EntryProvenance;
+    }, signing?: {
+        signingKeyPair?: SigningKeyPair;
+        signingKeyPassword?: string;
+    }): Promise<Uint8Array>;
+    /**
+     * Build the canonical, sorted attachment-ref snapshot for a payload, matching
+     * exactly what the writer would have signed.
+     */
+    collectAttachmentRefs(doc: MindooDocPayload): StoreEntryAttachmentRef[];
+    /**
+     * Decrypt an attachment chunk payload.
+     *
+     * Attachment chunks use a different envelope from document changes (a
+     * deterministic IV, so identical plaintext yields identical ciphertext), and
+     * the tenant's attachment crypto is not part of the public `MindooTenant`
+     * surface — hence the passthrough here rather than widening that interface.
+     */
+    decryptAttachmentPayload(encryptedPayload: Uint8Array, decryptionKeyId: string): Promise<Uint8Array>;
+    /** Encrypt an attachment chunk payload. Counterpart of {@link decryptAttachmentPayload}. */
+    encryptAttachmentPayload(payload: Uint8Array, decryptionKeyId: string): Promise<Uint8Array>;
+    /** Materialize newly written store entries into the in-memory document state. */
+    syncStoreChanges(): Promise<void>;
+    /**
+     * Evaluate this database's write policy for an entry signed by `signerKey`,
+     * exactly as the ordinary write paths do. Resolves to `null` when access
+     * control is not enforced here.
+     *
+     * The copy engine writes entries straight to the store rather than through
+     * `changeDoc`, so it does not inherit that precheck and has to run its own —
+     * see `preflight.ts` for why that matters most when grafting.
+     */
+    evaluateWriteAccess(op: RuleType, signerKey: string, isAuthor: boolean): Promise<AccessDecision | null>;
+    /**
+     * Whether a Tier 2 (content) rule governs `op` on this database. A copy
+     * cannot evaluate one — grafting never decrypts anything — so the preflight
+     * reports such cases as undecidable instead of guessing.
+     */
+    hasWriteContentRules(op: RuleType): Promise<boolean>;
+    /**
+     * Write one `doc_change` that re-points `_attachments[].lastChunkId` at the
+     * given chunk ids, keyed by attachment id.
+     *
+     * Needed only when a document is duplicated inside its own database, where
+     * the copied chunks had to be renamed (see `attachments.ts`). There is no
+     * public API for this — `changeDoc` deliberately does not let a caller write
+     * `_attachments` directly — so the database exposes it here.
+     */
+    remapAttachmentPointers(docId: string, lastChunkIdByAttachmentId: Map<string, string>, signing?: {
+        signingKeyPair: SigningKeyPair;
+        signingKeyPassword: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=host.d.ts.map

package/dist/core/copy/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../../src/core/copy/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EACV,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,kCAAkC;IAClC,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAEhD;;;;;OAKG;IACH,6BAA6B,CAC3B,IAAI,EAAE,IAAI,CACR,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,CACnB,GAAG;QAAE,UAAU,CAAC,EAAE,eAAe,CAAA;KAAE,EACpC,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,cAAc,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB;;;OAGG;IACH,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,uBAAuB,EAAE,CAAC;IAExE;;;;;;;OAOG;IACH,wBAAwB,CACtB,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB,4FAA4F;IAC5F,wBAAwB,CACtB,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB,iFAAiF;IACjF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC;;;;;;;;OAQG;IACH,mBAAmB,CACjB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAElC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;;;;OAQG;IACH,uBAAuB,CACrB,KAAK,EAAE,MAAM,EACb,yBAAyB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9C,OAAO,CAAC,EAAE;QAAE,cAAc,EAAE,cAAc,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,GACvE,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/core/copy/host.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * The narrow seam the copy engine uses to reach into a database.
+ *
+ * `BaseMindooDB` is already very large, so the copy engine lives in its own
+ * module and receives only what it needs through {@link CopyEngineHost} rather
+ * than being written as more methods on the class. A handful of the things it
+ * needs (entry signing, the attachment-ref snapshot) are private on
+ * `BaseMindooDB`; the class exposes them here through one `@internal` accessor
+ * instead of widening their visibility.
+ *
+ * @internal
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=host.js.map

package/dist/core/copy/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../../src/core/copy/host.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG"}

package/dist/core/copy/preflight.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The write-policy preflight for a history copy.
+ *
+ * Access-control rules are keyed by database id, so a set of entries that was
+ * perfectly legal in the source database is not automatically legal in the
+ * target. This bites hardest when sharding: a graft carries the *original*
+ * authors' signatures, and the server witness evaluates Tier 1 against the
+ * **target** `dbid` when the shard is pushed. If the new database's policy does
+ * not admit those authors, the entries are accepted locally and then rejected
+ * at the witness — after the copy has already run.
+ *
+ * So the copy checks up front, once per distinct (signer, operation) pair
+ * rather than once per entry, since the Tier 1 verdict depends only on that
+ * pair. What it deliberately does NOT do is decide Tier 2 (content) rules: a
+ * graft never decrypts anything, so it cannot evaluate them, and it reports
+ * them as undecidable rather than guessing.
+ *
+ * @module
+ */
+import type { AccessDecision, RuleType } from "../accesscontrol/types";
+import type { StoreEntryMetadata } from "../types";
+import type { CopyEngineHost } from "./host";
+/** One (signer, operation) pair the target database was asked about. */
+export interface CopyAdmissionCheck {
+    /** The key that will sign the copied entries of this kind in the target. */
+    signerPublicKey: string;
+    /** The operation those entries represent. */
+    op: RuleType;
+    /** How many entries in the copy fall under this pair. */
+    entryCount: number;
+    /** The target's verdict, or `null` when access control is not enforced. */
+    decision: AccessDecision | null;
+}
+/** What the preflight established about a copy. */
+export interface CopyAdmissionPreflight {
+    /** True when nothing the copy will write is denied by the target policy. */
+    admitted: boolean;
+    /** The pairs the target denied. Empty when {@link admitted} is true. */
+    denied: CopyAdmissionCheck[];
+    /**
+     * Operations governed by a Tier 2 content rule on the target. The copy cannot
+     * evaluate those without decrypting, so the witness may still reject entries
+     * this preflight passed. Advisory only.
+     */
+    undecidableOps: RuleType[];
+    /** Every pair that was checked, for diagnostics. */
+    checked: CopyAdmissionCheck[];
+}
+/**
+ * Ask the target database whether it admits everything the copy will write.
+ *
+ * @param target The database being written to.
+ * @param entries The source entries about to be copied.
+ * @param signerFor Resolves the key that will sign a copied entry: the original
+ *   author under a graft, the copying user under a replay.
+ * @param documentCreatorKey The source document's creator key, used to answer
+ *   `$author` ownership rules.
+ */
+export declare function preflightCopyAdmission(target: CopyEngineHost, entries: StoreEntryMetadata[], signerFor: (entry: StoreEntryMetadata) => string, documentCreatorKey: string | null): Promise<CopyAdmissionPreflight>;
+/** Render a preflight refusal as an actionable message. */
+export declare function describeAdmissionFailure(preflight: CopyAdmissionPreflight, targetDbId: string): string;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/core/copy/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../src/core/copy/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAE7C,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,EAAE,EAAE,QAAQ,CAAC;IACb,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;CACjC;AAED,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B;;;;OAIG;IACH,cAAc,EAAE,QAAQ,EAAE,CAAC;IAC3B,oDAAoD;IACpD,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAWD;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,SAAS,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,MAAM,EAChD,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,OAAO,CAAC,sBAAsB,CAAC,CA0CjC;AAED,2DAA2D;AAC3D,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,sBAAsB,EACjC,UAAU,EAAE,MAAM,GACjB,MAAM,CAgBR"}

package/dist/core/copy/preflight.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * The write-policy preflight for a history copy.
+ *
+ * Access-control rules are keyed by database id, so a set of entries that was
+ * perfectly legal in the source database is not automatically legal in the
+ * target. This bites hardest when sharding: a graft carries the *original*
+ * authors' signatures, and the server witness evaluates Tier 1 against the
+ * **target** `dbid` when the shard is pushed. If the new database's policy does
+ * not admit those authors, the entries are accepted locally and then rejected
+ * at the witness — after the copy has already run.
+ *
+ * So the copy checks up front, once per distinct (signer, operation) pair
+ * rather than once per entry, since the Tier 1 verdict depends only on that
+ * pair. What it deliberately does NOT do is decide Tier 2 (content) rules: a
+ * graft never decrypts anything, so it cannot evaluate them, and it reports
+ * them as undecidable rather than guessing.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preflightCopyAdmission = preflightCopyAdmission;
+exports.describeAdmissionFailure = describeAdmissionFailure;
+/** Entry types that are subject to a write rule. */
+const RULE_OPS = new Set([
+    "doc_create",
+    "doc_change",
+    "doc_delete",
+    "doc_undelete",
+    "doc_snapshot",
+]);
+/**
+ * Ask the target database whether it admits everything the copy will write.
+ *
+ * @param target The database being written to.
+ * @param entries The source entries about to be copied.
+ * @param signerFor Resolves the key that will sign a copied entry: the original
+ *   author under a graft, the copying user under a replay.
+ * @param documentCreatorKey The source document's creator key, used to answer
+ *   `$author` ownership rules.
+ */
+async function preflightCopyAdmission(target, entries, signerFor, documentCreatorKey) {
+    const pairs = new Map();
+    for (const entry of entries) {
+        if (!RULE_OPS.has(entry.entryType))
+            continue;
+        const op = entry.entryType;
+        const signerPublicKey = signerFor(entry);
+        const key = `${op}\u0000${signerPublicKey}`;
+        const existing = pairs.get(key);
+        if (existing) {
+            existing.entryCount++;
+        }
+        else {
+            pairs.set(key, { signerPublicKey, op, entryCount: 1 });
+        }
+    }
+    const checked = [];
+    const denied = [];
+    const undecidableOps = new Set();
+    for (const pair of pairs.values()) {
+        const decision = await target.evaluateWriteAccess(pair.op, pair.signerPublicKey, documentCreatorKey !== null && pair.signerPublicKey === documentCreatorKey);
+        const check = { ...pair, decision };
+        checked.push(check);
+        if (decision && !decision.allowed) {
+            denied.push(check);
+            continue;
+        }
+        if (decision && (await target.hasWriteContentRules(pair.op))) {
+            undecidableOps.add(pair.op);
+        }
+    }
+    return {
+        admitted: denied.length === 0,
+        denied,
+        undecidableOps: [...undecidableOps],
+        checked,
+    };
+}
+/** Render a preflight refusal as an actionable message. */
+function describeAdmissionFailure(preflight, targetDbId) {
+    const details = preflight.denied
+        .map((check) => `${check.op} signed by ${shortKey(check.signerPublicKey)} ` +
+        `(${check.entryCount} ${check.entryCount === 1 ? "entry" : "entries"}): ` +
+        `${check.decision?.reason ?? "denied"}`)
+        .join("; ");
+    return (`The target database '${targetDbId}' does not admit every entry this copy would ` +
+        `write, so the server witness would reject them after the copy ran. ${details}. ` +
+        "Grant the original authors the corresponding rights on the target database, copy " +
+        "with authorship 'reauthor' so the entries are signed by the copying user, or pass " +
+        "bypassAccessControlPrecheck to write anyway.");
+}
+/** The identifying tail of a PEM key, enough to recognize it in a message. */
+function shortKey(publicKeyPem) {
+    const body = publicKeyPem.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "");
+    return body.length > 12 ? `…${body.slice(-12)}` : body;
+}
+//# sourceMappingURL=preflight.js.map

package/dist/core/copy/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../src/core/copy/preflight.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AAqDH,wDA+CC;AAGD,4DAmBC;AAxFD,oDAAoD;AACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS;IAC/B,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACI,KAAK,UAAU,sBAAsB,CAC1C,MAAsB,EACtB,OAA6B,EAC7B,SAAgD,EAChD,kBAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyE,CAAC;IAC/F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,SAAS;QAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,SAAqB,CAAC;QACvC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,EAAE,SAAS,eAAe,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAY,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAC/C,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,eAAe,EACpB,kBAAkB,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,kBAAkB,CAC3E,CAAC;QACF,MAAM,KAAK,GAAuB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7D,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC7B,MAAM;QACN,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC;QACnC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,SAAgB,wBAAwB,CACtC,SAAiC,EACjC,UAAkB;IAElB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM;SAC7B,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,GAAG,KAAK,CAAC,EAAE,cAAc,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG;QAC3D,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK;QACzE,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,EAAE,CAC1C;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,CACL,wBAAwB,UAAU,+CAA+C;QACjF,sEAAsE,OAAO,IAAI;QACjF,mFAAmF;QACnF,oFAAoF;QACpF,8CAA8C,CAC/C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,YAAoB;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC"}

package/dist/core/copy/provenance.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Building and verifying the provenance record attached to copied entries.
+ *
+ * When a document is copied with `mode: "history"` but the original signatures
+ * cannot be carried over (see `feasibility.ts` for exactly when that is), every
+ * produced entry is re-signed by the copying user. That would normally erase
+ * all trace of who actually wrote each revision. The provenance record puts it
+ * back — and does so verifiably rather than as an unbacked assertion, by
+ * embedding the source entry's own signed projection together with the original
+ * author's signature over it.
+ *
+ * @module
+ */
+import { type EntryProvenance } from "../crypto/EntrySignature";
+import type { StoreEntryMetadata } from "../types";
+/** Outcome of {@link verifyEntryProvenance}. */
+export type ProvenanceVerificationStatus = 
+/** The entry carries no provenance record: it was not produced by a copy. */
+"absent"
+/** The original author's signature over the embedded projection verifies. */
+ | "verified"
+/**
+ * The record is present and well-formed but carries no source signature,
+ * because the source entry predates `metadataSignature`. Informative, not
+ * provable.
+ */
+ | "unverifiable"
+/** A source signature is present and does NOT verify. Treat as tampering. */
+ | "invalid";
+/** Result of verifying an entry's provenance record. */
+export interface ProvenanceVerification {
+    /** What could be established about the record. */
+    status: ProvenanceVerificationStatus;
+    /** The record itself, when the entry has one. */
+    provenance?: EntryProvenance;
+    /**
+     * True when this entry's `contentHash` equals the source entry's, i.e. the
+     * copy holds byte-identical ciphertext and the verified original signature
+     * therefore covers *this* entry's payload too.
+     *
+     * False when the copy was re-encrypted (a different tenant or key). The
+     * provenance then still proves the named author signed the original payload,
+     * but nothing ties that payload to this entry's ciphertext beyond the copying
+     * user's own signature.
+     */
+    payloadUnchanged: boolean;
+    /** Human-readable explanation for a non-`verified` status. */
+    reason?: string;
+}
+/**
+ * Capture a source entry as a provenance record for its copy.
+ *
+ * The projection is taken with the same canonicalization the signer used, so
+ * rebuilding it reproduces the original signing input exactly.
+ */
+export declare function buildProvenanceFromEntry(sourceEntry: StoreEntryMetadata, sourceTenantId: string, sourceDbId: string): EntryProvenance;
+/**
+ * Verify that the original author named in an entry's provenance record really
+ * signed the payload the record describes.
+ *
+ * This is a purely cryptographic check against the public key embedded in the
+ * record, which is what makes it work across tenants where the source author is
+ * absent from the local directory. It deliberately does NOT establish that the
+ * key belongs to the person it claims to — confirm that against the tenant
+ * directory in-tenant, or out of band across tenants.
+ *
+ * A caller that also wants to know the copy itself is intact should verify the
+ * entry's own `metadataSignature` as usual; that signature binds this record,
+ * so a relay cannot attach, alter or remove it.
+ */
+export declare function verifyEntryProvenance(entry: Pick<StoreEntryMetadata, "contentHash"> & {
+    provenance?: EntryProvenance;
+}, subtle: SubtleCrypto): Promise<ProvenanceVerification>;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/core/copy/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/core/copy/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,gDAAgD;AAChD,MAAM,MAAM,4BAA4B;AACtC,6EAA6E;AAC3E,QAAQ;AACV,6EAA6E;GAC3E,UAAU;AACZ;;;;GAIG;GACD,cAAc;AAChB,6EAA6E;GAC3E,SAAS,CAAC;AAEd,wDAAwD;AACxD,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,MAAM,EAAE,4BAA4B,CAAC;IACrC,iDAAiD;IACjD,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;;;OASG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,kBAAkB,EAC/B,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GACjB,eAAe,CASjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,eAAe,CAAA;CAAE,EACjF,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,sBAAsB,CAAC,CAyDjC"}

package/dist/core/copy/provenance.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Building and verifying the provenance record attached to copied entries.
+ *
+ * When a document is copied with `mode: "history"` but the original signatures
+ * cannot be carried over (see `feasibility.ts` for exactly when that is), every
+ * produced entry is re-signed by the copying user. That would normally erase
+ * all trace of who actually wrote each revision. The provenance record puts it
+ * back — and does so verifiably rather than as an unbacked assertion, by
+ * embedding the source entry's own signed projection together with the original
+ * author's signature over it.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildProvenanceFromEntry = buildProvenanceFromEntry;
+exports.verifyEntryProvenance = verifyEntryProvenance;
+const EntrySignature_1 = require("../crypto/EntrySignature");
+/**
+ * Capture a source entry as a provenance record for its copy.
+ *
+ * The projection is taken with the same canonicalization the signer used, so
+ * rebuilding it reproduces the original signing input exactly.
+ */
+function buildProvenanceFromEntry(sourceEntry, sourceTenantId, sourceDbId) {
+    return {
+        sourceTenantId,
+        sourceDbId,
+        source: (0, EntrySignature_1.entrySignatureFieldsFromEntry)(sourceEntry),
+        sourceMetadataSignature: sourceEntry.metadataSignature
+            ? (0, EntrySignature_1.bytesToBase64)(sourceEntry.metadataSignature)
+            : undefined,
+    };
+}
+/**
+ * Verify that the original author named in an entry's provenance record really
+ * signed the payload the record describes.
+ *
+ * This is a purely cryptographic check against the public key embedded in the
+ * record, which is what makes it work across tenants where the source author is
+ * absent from the local directory. It deliberately does NOT establish that the
+ * key belongs to the person it claims to — confirm that against the tenant
+ * directory in-tenant, or out of band across tenants.
+ *
+ * A caller that also wants to know the copy itself is intact should verify the
+ * entry's own `metadataSignature` as usual; that signature binds this record,
+ * so a relay cannot attach, alter or remove it.
+ */
+async function verifyEntryProvenance(entry, subtle) {
+    const provenance = entry.provenance;
+    if (!provenance) {
+        return { status: "absent", payloadUnchanged: false };
+    }
+    const payloadUnchanged = entry.contentHash === provenance.source.contentHash;
+    if (!provenance.sourceMetadataSignature) {
+        return {
+            status: "unverifiable",
+            provenance,
+            payloadUnchanged,
+            reason: "The source entry predates metadataSignature, so the origin claim cannot " +
+                "be checked cryptographically. It is still bound to the copying user's " +
+                "own signature.",
+        };
+    }
+    const signingBytes = (0, EntrySignature_1.buildEntrySigningBytes)(provenance.source);
+    let verified;
+    try {
+        const cryptoKey = await (0, EntrySignature_1.importEd25519PublicKeyFromPem)(provenance.source.createdByPublicKey, subtle);
+        verified = await subtle.verify({ name: "Ed25519" }, cryptoKey, (0, EntrySignature_1.base64ToBytes)(provenance.sourceMetadataSignature).buffer, signingBytes.buffer);
+    }
+    catch (error) {
+        return {
+            status: "invalid",
+            provenance,
+            payloadUnchanged,
+            reason: `Provenance verification failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    if (!verified) {
+        return {
+            status: "invalid",
+            provenance,
+            payloadUnchanged,
+            reason: "The embedded source signature does not match the embedded source " +
+                "projection. The provenance record has been tampered with or was " +
+                "fabricated.",
+        };
+    }
+    return { status: "verified", provenance, payloadUnchanged };
+}
+//# sourceMappingURL=provenance.js.map

package/dist/core/copy/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../src/core/copy/provenance.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAsDH,4DAaC;AAgBD,sDA4DC;AA7ID,6DAOkC;AAuClC;;;;;GAKG;AACH,SAAgB,wBAAwB,CACtC,WAA+B,EAC/B,cAAsB,EACtB,UAAkB;IAElB,OAAO;QACL,cAAc;QACd,UAAU;QACV,MAAM,EAAE,IAAA,8CAA6B,EAAC,WAAW,CAAC;QAClD,uBAAuB,EAAE,WAAW,CAAC,iBAAiB;YACpD,CAAC,CAAC,IAAA,8BAAa,EAAC,WAAW,CAAC,iBAAiB,CAAC;YAC9C,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,qBAAqB,CACzC,KAAiF,EACjF,MAAoB;IAEpB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,UAAU;YACV,gBAAgB;YAChB,MAAM,EACJ,0EAA0E;gBAC1E,wEAAwE;gBACxE,gBAAgB;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,uCAAsB,EAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,IAAA,8CAA6B,EACnD,UAAU,CAAC,MAAM,CAAC,kBAAkB,EACpC,MAAM,CACP,CAAC;QACF,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,IAAA,8BAAa,EAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,MAAqB,EACvE,YAAY,CAAC,MAAqB,CACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,UAAU;YACV,gBAAgB;YAChB,MAAM,EAAE,mCACN,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;SACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,UAAU;YACV,gBAAgB;YAChB,MAAM,EACJ,mEAAmE;gBACnE,kEAAkE;gBAClE,aAAa;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;AAC9D,CAAC"}