mindoodb 0.0.45 → 0.0.47

package/dist/core/copy/host.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The narrow seam the copy engine uses to reach into a database.
+ *
+ * `BaseMindooDB` is already very large, so the copy engine lives in its own
+ * module and receives only what it needs through {@link CopyEngineHost} rather
+ * than being written as more methods on the class. A handful of the things it
+ * needs (entry signing, the attachment-ref snapshot) are private on
+ * `BaseMindooDB`; the class exposes them here through one `@internal` accessor
+ * instead of widening their visibility.
+ *
+ * @internal
+ * @module
+ */
+import type { ContentAddressedStore } from "../appendonlystores/types";
+import type { AccessDecision, RuleType } from "../accesscontrol/types";
+import type { EntryProvenance } from "../crypto/EntrySignature";
+import type { MindooDB, MindooDocPayload, MindooTenant, SigningKeyPair, StoreEntryAttachmentRef, StoreEntryMetadata } from "../types";
+/**
+ * Everything the copy engine needs from one side of a copy.
+ *
+ * @internal
+ */
+export interface CopyEngineHost {
+    /** The database itself, for the strategies that go through the public API. */
+    readonly db: MindooDB;
+    /** The tenant owning {@link db}. */
+    readonly tenant: MindooTenant;
+    /** The document entry store. */
+    readonly store: ContentAddressedStore;
+    /** The attachment chunk store. */
+    readonly attachmentStore: ContentAddressedStore;
+    /**
+     * Compute the author's metadata-binding signature for an entry, using the
+     * supplied signing key when given and the current user's key otherwise.
+     * Mirrors what every ordinary write path does, so copied entries are
+     * indistinguishable in structure from natively written ones.
+     */
+    computeEntryMetadataSignature(meta: Pick<StoreEntryMetadata, "entryType" | "id" | "docId" | "decryptionKeyId" | "createdAt" | "dependencyIds" | "contentHash" | "createdByPublicKey" | "attachmentRefs"> & {
+        provenance?: EntryProvenance;
+    }, signing?: {
+        signingKeyPair?: SigningKeyPair;
+        signingKeyPassword?: string;
+    }): Promise<Uint8Array>;
+    /**
+     * Build the canonical, sorted attachment-ref snapshot for a payload, matching
+     * exactly what the writer would have signed.
+     */
+    collectAttachmentRefs(doc: MindooDocPayload): StoreEntryAttachmentRef[];
+    /**
+     * Decrypt an attachment chunk payload.
+     *
+     * Attachment chunks use a different envelope from document changes (a
+     * deterministic IV, so identical plaintext yields identical ciphertext), and
+     * the tenant's attachment crypto is not part of the public `MindooTenant`
+     * surface — hence the passthrough here rather than widening that interface.
+     */
+    decryptAttachmentPayload(encryptedPayload: Uint8Array, decryptionKeyId: string): Promise<Uint8Array>;
+    /** Encrypt an attachment chunk payload. Counterpart of {@link decryptAttachmentPayload}. */
+    encryptAttachmentPayload(payload: Uint8Array, decryptionKeyId: string): Promise<Uint8Array>;
+    /** Materialize newly written store entries into the in-memory document state. */
+    syncStoreChanges(): Promise<void>;
+    /**
+     * Evaluate this database's write policy for an entry signed by `signerKey`,
+     * exactly as the ordinary write paths do. Resolves to `null` when access
+     * control is not enforced here.
+     *
+     * The copy engine writes entries straight to the store rather than through
+     * `changeDoc`, so it does not inherit that precheck and has to run its own —
+     * see `preflight.ts` for why that matters most when grafting.
+     */
+    evaluateWriteAccess(op: RuleType, signerKey: string, isAuthor: boolean): Promise<AccessDecision | null>;
+    /**
+     * Whether a Tier 2 (content) rule governs `op` on this database. A copy
+     * cannot evaluate one — grafting never decrypts anything — so the preflight
+     * reports such cases as undecidable instead of guessing.
+     */
+    hasWriteContentRules(op: RuleType): Promise<boolean>;
+    /**
+     * Write one `doc_change` that re-points `_attachments[].lastChunkId` at the
+     * given chunk ids, keyed by attachment id.
+     *
+     * Needed only when a document is duplicated inside its own database, where
+     * the copied chunks had to be renamed (see `attachments.ts`). There is no
+     * public API for this — `changeDoc` deliberately does not let a caller write
+     * `_attachments` directly — so the database exposes it here.
+     */
+    remapAttachmentPointers(docId: string, lastChunkIdByAttachmentId: Map<string, string>, signing?: {
+        signingKeyPair: SigningKeyPair;
+        signingKeyPassword: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=host.d.ts.map

package/dist/core/copy/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../../../src/core/copy/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,KAAK,EACV,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,UAAU,CAAC;AAElB;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,kCAAkC;IAClC,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAEhD;;;;;OAKG;IACH,6BAA6B,CAC3B,IAAI,EAAE,IAAI,CACR,kBAAkB,EAChB,WAAW,GACX,IAAI,GACJ,OAAO,GACP,iBAAiB,GACjB,WAAW,GACX,eAAe,GACf,aAAa,GACb,oBAAoB,GACpB,gBAAgB,CACnB,GAAG;QAAE,UAAU,CAAC,EAAE,eAAe,CAAA;KAAE,EACpC,OAAO,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,cAAc,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB;;;OAGG;IACH,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,GAAG,uBAAuB,EAAE,CAAC;IAExE;;;;;;;OAOG;IACH,wBAAwB,CACtB,gBAAgB,EAAE,UAAU,EAC5B,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB,4FAA4F;IAC5F,wBAAwB,CACtB,OAAO,EAAE,UAAU,EACnB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAAC;IAEvB,iFAAiF;IACjF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAElC;;;;;;;;OAQG;IACH,mBAAmB,CACjB,EAAE,EAAE,QAAQ,EACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IAElC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;;;;OAQG;IACH,uBAAuB,CACrB,KAAK,EAAE,MAAM,EACb,yBAAyB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9C,OAAO,CAAC,EAAE;QAAE,cAAc,EAAE,cAAc,CAAC;QAAC,kBAAkB,EAAE,MAAM,CAAA;KAAE,GACvE,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/core/copy/host.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * The narrow seam the copy engine uses to reach into a database.
+ *
+ * `BaseMindooDB` is already very large, so the copy engine lives in its own
+ * module and receives only what it needs through {@link CopyEngineHost} rather
+ * than being written as more methods on the class. A handful of the things it
+ * needs (entry signing, the attachment-ref snapshot) are private on
+ * `BaseMindooDB`; the class exposes them here through one `@internal` accessor
+ * instead of widening their visibility.
+ *
+ * @internal
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=host.js.map

package/dist/core/copy/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../../../src/core/copy/host.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG"}

package/dist/core/copy/preflight.d.ts

@@ -0,0 +1,62 @@
+/**
+ * The write-policy preflight for a history copy.
+ *
+ * Access-control rules are keyed by database id, so a set of entries that was
+ * perfectly legal in the source database is not automatically legal in the
+ * target. This bites hardest when sharding: a graft carries the *original*
+ * authors' signatures, and the server witness evaluates Tier 1 against the
+ * **target** `dbid` when the shard is pushed. If the new database's policy does
+ * not admit those authors, the entries are accepted locally and then rejected
+ * at the witness — after the copy has already run.
+ *
+ * So the copy checks up front, once per distinct (signer, operation) pair
+ * rather than once per entry, since the Tier 1 verdict depends only on that
+ * pair. What it deliberately does NOT do is decide Tier 2 (content) rules: a
+ * graft never decrypts anything, so it cannot evaluate them, and it reports
+ * them as undecidable rather than guessing.
+ *
+ * @module
+ */
+import type { AccessDecision, RuleType } from "../accesscontrol/types";
+import type { StoreEntryMetadata } from "../types";
+import type { CopyEngineHost } from "./host";
+/** One (signer, operation) pair the target database was asked about. */
+export interface CopyAdmissionCheck {
+    /** The key that will sign the copied entries of this kind in the target. */
+    signerPublicKey: string;
+    /** The operation those entries represent. */
+    op: RuleType;
+    /** How many entries in the copy fall under this pair. */
+    entryCount: number;
+    /** The target's verdict, or `null` when access control is not enforced. */
+    decision: AccessDecision | null;
+}
+/** What the preflight established about a copy. */
+export interface CopyAdmissionPreflight {
+    /** True when nothing the copy will write is denied by the target policy. */
+    admitted: boolean;
+    /** The pairs the target denied. Empty when {@link admitted} is true. */
+    denied: CopyAdmissionCheck[];
+    /**
+     * Operations governed by a Tier 2 content rule on the target. The copy cannot
+     * evaluate those without decrypting, so the witness may still reject entries
+     * this preflight passed. Advisory only.
+     */
+    undecidableOps: RuleType[];
+    /** Every pair that was checked, for diagnostics. */
+    checked: CopyAdmissionCheck[];
+}
+/**
+ * Ask the target database whether it admits everything the copy will write.
+ *
+ * @param target The database being written to.
+ * @param entries The source entries about to be copied.
+ * @param signerFor Resolves the key that will sign a copied entry: the original
+ *   author under a graft, the copying user under a replay.
+ * @param documentCreatorKey The source document's creator key, used to answer
+ *   `$author` ownership rules.
+ */
+export declare function preflightCopyAdmission(target: CopyEngineHost, entries: StoreEntryMetadata[], signerFor: (entry: StoreEntryMetadata) => string, documentCreatorKey: string | null): Promise<CopyAdmissionPreflight>;
+/** Render a preflight refusal as an actionable message. */
+export declare function describeAdmissionFailure(preflight: CopyAdmissionPreflight, targetDbId: string): string;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/core/copy/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../../src/core/copy/preflight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAE7C,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,EAAE,EAAE,QAAQ,CAAC;IACb,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,QAAQ,EAAE,cAAc,GAAG,IAAI,CAAC;CACjC;AAED,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B;;;;OAIG;IACH,cAAc,EAAE,QAAQ,EAAE,CAAC;IAC3B,oDAAoD;IACpD,OAAO,EAAE,kBAAkB,EAAE,CAAC;CAC/B;AAWD;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,kBAAkB,EAAE,EAC7B,SAAS,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,MAAM,EAChD,kBAAkB,EAAE,MAAM,GAAG,IAAI,GAChC,OAAO,CAAC,sBAAsB,CAAC,CA0CjC;AAED,2DAA2D;AAC3D,wBAAgB,wBAAwB,CACtC,SAAS,EAAE,sBAAsB,EACjC,UAAU,EAAE,MAAM,GACjB,MAAM,CAgBR"}

package/dist/core/copy/preflight.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * The write-policy preflight for a history copy.
+ *
+ * Access-control rules are keyed by database id, so a set of entries that was
+ * perfectly legal in the source database is not automatically legal in the
+ * target. This bites hardest when sharding: a graft carries the *original*
+ * authors' signatures, and the server witness evaluates Tier 1 against the
+ * **target** `dbid` when the shard is pushed. If the new database's policy does
+ * not admit those authors, the entries are accepted locally and then rejected
+ * at the witness — after the copy has already run.
+ *
+ * So the copy checks up front, once per distinct (signer, operation) pair
+ * rather than once per entry, since the Tier 1 verdict depends only on that
+ * pair. What it deliberately does NOT do is decide Tier 2 (content) rules: a
+ * graft never decrypts anything, so it cannot evaluate them, and it reports
+ * them as undecidable rather than guessing.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.preflightCopyAdmission = preflightCopyAdmission;
+exports.describeAdmissionFailure = describeAdmissionFailure;
+/** Entry types that are subject to a write rule. */
+const RULE_OPS = new Set([
+    "doc_create",
+    "doc_change",
+    "doc_delete",
+    "doc_undelete",
+    "doc_snapshot",
+]);
+/**
+ * Ask the target database whether it admits everything the copy will write.
+ *
+ * @param target The database being written to.
+ * @param entries The source entries about to be copied.
+ * @param signerFor Resolves the key that will sign a copied entry: the original
+ *   author under a graft, the copying user under a replay.
+ * @param documentCreatorKey The source document's creator key, used to answer
+ *   `$author` ownership rules.
+ */
+async function preflightCopyAdmission(target, entries, signerFor, documentCreatorKey) {
+    const pairs = new Map();
+    for (const entry of entries) {
+        if (!RULE_OPS.has(entry.entryType))
+            continue;
+        const op = entry.entryType;
+        const signerPublicKey = signerFor(entry);
+        const key = `${op}\u0000${signerPublicKey}`;
+        const existing = pairs.get(key);
+        if (existing) {
+            existing.entryCount++;
+        }
+        else {
+            pairs.set(key, { signerPublicKey, op, entryCount: 1 });
+        }
+    }
+    const checked = [];
+    const denied = [];
+    const undecidableOps = new Set();
+    for (const pair of pairs.values()) {
+        const decision = await target.evaluateWriteAccess(pair.op, pair.signerPublicKey, documentCreatorKey !== null && pair.signerPublicKey === documentCreatorKey);
+        const check = { ...pair, decision };
+        checked.push(check);
+        if (decision && !decision.allowed) {
+            denied.push(check);
+            continue;
+        }
+        if (decision && (await target.hasWriteContentRules(pair.op))) {
+            undecidableOps.add(pair.op);
+        }
+    }
+    return {
+        admitted: denied.length === 0,
+        denied,
+        undecidableOps: [...undecidableOps],
+        checked,
+    };
+}
+/** Render a preflight refusal as an actionable message. */
+function describeAdmissionFailure(preflight, targetDbId) {
+    const details = preflight.denied
+        .map((check) => `${check.op} signed by ${shortKey(check.signerPublicKey)} ` +
+        `(${check.entryCount} ${check.entryCount === 1 ? "entry" : "entries"}): ` +
+        `${check.decision?.reason ?? "denied"}`)
+        .join("; ");
+    return (`The target database '${targetDbId}' does not admit every entry this copy would ` +
+        `write, so the server witness would reject them after the copy ran. ${details}. ` +
+        "Grant the original authors the corresponding rights on the target database, copy " +
+        "with authorship 'reauthor' so the entries are signed by the copying user, or pass " +
+        "bypassAccessControlPrecheck to write anyway.");
+}
+/** The identifying tail of a PEM key, enough to recognize it in a message. */
+function shortKey(publicKeyPem) {
+    const body = publicKeyPem.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "");
+    return body.length > 12 ? `…${body.slice(-12)}` : body;
+}
+//# sourceMappingURL=preflight.js.map

package/dist/core/copy/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../../src/core/copy/preflight.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;AAqDH,wDA+CC;AAGD,4DAmBC;AAxFD,oDAAoD;AACpD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS;IAC/B,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;CACf,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACI,KAAK,UAAU,sBAAsB,CAC1C,MAAsB,EACtB,OAA6B,EAC7B,SAAgD,EAChD,kBAAiC;IAEjC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyE,CAAC;IAC/F,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YAAE,SAAS;QAC7C,MAAM,EAAE,GAAG,KAAK,CAAC,SAAqB,CAAC;QACvC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,EAAE,SAAS,eAAe,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAY,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAC/C,IAAI,CAAC,EAAE,EACP,IAAI,CAAC,eAAe,EACpB,kBAAkB,KAAK,IAAI,IAAI,IAAI,CAAC,eAAe,KAAK,kBAAkB,CAC3E,CAAC;QACF,MAAM,KAAK,GAAuB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7D,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QAC7B,MAAM;QACN,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC;QACnC,OAAO;KACR,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,SAAgB,wBAAwB,CACtC,SAAiC,EACjC,UAAkB;IAElB,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM;SAC7B,GAAG,CACF,CAAC,KAAK,EAAE,EAAE,CACR,GAAG,KAAK,CAAC,EAAE,cAAc,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG;QAC3D,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,KAAK;QACzE,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,EAAE,CAC1C;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,CACL,wBAAwB,UAAU,+CAA+C;QACjF,sEAAsE,OAAO,IAAI;QACjF,mFAAmF;QACnF,oFAAoF;QACpF,8CAA8C,CAC/C,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ,CAAC,YAAoB;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC"}

package/dist/core/copy/provenance.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Building and verifying the provenance record attached to copied entries.
+ *
+ * When a document is copied with `mode: "history"` but the original signatures
+ * cannot be carried over (see `feasibility.ts` for exactly when that is), every
+ * produced entry is re-signed by the copying user. That would normally erase
+ * all trace of who actually wrote each revision. The provenance record puts it
+ * back — and does so verifiably rather than as an unbacked assertion, by
+ * embedding the source entry's own signed projection together with the original
+ * author's signature over it.
+ *
+ * @module
+ */
+import { type EntryProvenance } from "../crypto/EntrySignature";
+import type { StoreEntryMetadata } from "../types";
+/** Outcome of {@link verifyEntryProvenance}. */
+export type ProvenanceVerificationStatus = 
+/** The entry carries no provenance record: it was not produced by a copy. */
+"absent"
+/** The original author's signature over the embedded projection verifies. */
+ | "verified"
+/**
+ * The record is present and well-formed but carries no source signature,
+ * because the source entry predates `metadataSignature`. Informative, not
+ * provable.
+ */
+ | "unverifiable"
+/** A source signature is present and does NOT verify. Treat as tampering. */
+ | "invalid";
+/** Result of verifying an entry's provenance record. */
+export interface ProvenanceVerification {
+    /** What could be established about the record. */
+    status: ProvenanceVerificationStatus;
+    /** The record itself, when the entry has one. */
+    provenance?: EntryProvenance;
+    /**
+     * True when this entry's `contentHash` equals the source entry's, i.e. the
+     * copy holds byte-identical ciphertext and the verified original signature
+     * therefore covers *this* entry's payload too.
+     *
+     * False when the copy was re-encrypted (a different tenant or key). The
+     * provenance then still proves the named author signed the original payload,
+     * but nothing ties that payload to this entry's ciphertext beyond the copying
+     * user's own signature.
+     */
+    payloadUnchanged: boolean;
+    /** Human-readable explanation for a non-`verified` status. */
+    reason?: string;
+}
+/**
+ * Capture a source entry as a provenance record for its copy.
+ *
+ * The projection is taken with the same canonicalization the signer used, so
+ * rebuilding it reproduces the original signing input exactly.
+ */
+export declare function buildProvenanceFromEntry(sourceEntry: StoreEntryMetadata, sourceTenantId: string, sourceDbId: string): EntryProvenance;
+/**
+ * Verify that the original author named in an entry's provenance record really
+ * signed the payload the record describes.
+ *
+ * This is a purely cryptographic check against the public key embedded in the
+ * record, which is what makes it work across tenants where the source author is
+ * absent from the local directory. It deliberately does NOT establish that the
+ * key belongs to the person it claims to — confirm that against the tenant
+ * directory in-tenant, or out of band across tenants.
+ *
+ * A caller that also wants to know the copy itself is intact should verify the
+ * entry's own `metadataSignature` as usual; that signature binds this record,
+ * so a relay cannot attach, alter or remove it.
+ */
+export declare function verifyEntryProvenance(entry: Pick<StoreEntryMetadata, "contentHash"> & {
+    provenance?: EntryProvenance;
+}, subtle: SubtleCrypto): Promise<ProvenanceVerification>;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/core/copy/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/core/copy/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAEnD,gDAAgD;AAChD,MAAM,MAAM,4BAA4B;AACtC,6EAA6E;AAC3E,QAAQ;AACV,6EAA6E;GAC3E,UAAU;AACZ;;;;GAIG;GACD,cAAc;AAChB,6EAA6E;GAC3E,SAAS,CAAC;AAEd,wDAAwD;AACxD,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,MAAM,EAAE,4BAA4B,CAAC;IACrC,iDAAiD;IACjD,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;;;;;;;OASG;IACH,gBAAgB,EAAE,OAAO,CAAC;IAC1B,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,kBAAkB,EAC/B,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,GACjB,eAAe,CASjB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,GAAG;IAAE,UAAU,CAAC,EAAE,eAAe,CAAA;CAAE,EACjF,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,sBAAsB,CAAC,CAyDjC"}

package/dist/core/copy/provenance.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Building and verifying the provenance record attached to copied entries.
+ *
+ * When a document is copied with `mode: "history"` but the original signatures
+ * cannot be carried over (see `feasibility.ts` for exactly when that is), every
+ * produced entry is re-signed by the copying user. That would normally erase
+ * all trace of who actually wrote each revision. The provenance record puts it
+ * back — and does so verifiably rather than as an unbacked assertion, by
+ * embedding the source entry's own signed projection together with the original
+ * author's signature over it.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildProvenanceFromEntry = buildProvenanceFromEntry;
+exports.verifyEntryProvenance = verifyEntryProvenance;
+const EntrySignature_1 = require("../crypto/EntrySignature");
+/**
+ * Capture a source entry as a provenance record for its copy.
+ *
+ * The projection is taken with the same canonicalization the signer used, so
+ * rebuilding it reproduces the original signing input exactly.
+ */
+function buildProvenanceFromEntry(sourceEntry, sourceTenantId, sourceDbId) {
+    return {
+        sourceTenantId,
+        sourceDbId,
+        source: (0, EntrySignature_1.entrySignatureFieldsFromEntry)(sourceEntry),
+        sourceMetadataSignature: sourceEntry.metadataSignature
+            ? (0, EntrySignature_1.bytesToBase64)(sourceEntry.metadataSignature)
+            : undefined,
+    };
+}
+/**
+ * Verify that the original author named in an entry's provenance record really
+ * signed the payload the record describes.
+ *
+ * This is a purely cryptographic check against the public key embedded in the
+ * record, which is what makes it work across tenants where the source author is
+ * absent from the local directory. It deliberately does NOT establish that the
+ * key belongs to the person it claims to — confirm that against the tenant
+ * directory in-tenant, or out of band across tenants.
+ *
+ * A caller that also wants to know the copy itself is intact should verify the
+ * entry's own `metadataSignature` as usual; that signature binds this record,
+ * so a relay cannot attach, alter or remove it.
+ */
+async function verifyEntryProvenance(entry, subtle) {
+    const provenance = entry.provenance;
+    if (!provenance) {
+        return { status: "absent", payloadUnchanged: false };
+    }
+    const payloadUnchanged = entry.contentHash === provenance.source.contentHash;
+    if (!provenance.sourceMetadataSignature) {
+        return {
+            status: "unverifiable",
+            provenance,
+            payloadUnchanged,
+            reason: "The source entry predates metadataSignature, so the origin claim cannot " +
+                "be checked cryptographically. It is still bound to the copying user's " +
+                "own signature.",
+        };
+    }
+    const signingBytes = (0, EntrySignature_1.buildEntrySigningBytes)(provenance.source);
+    let verified;
+    try {
+        const cryptoKey = await (0, EntrySignature_1.importEd25519PublicKeyFromPem)(provenance.source.createdByPublicKey, subtle);
+        verified = await subtle.verify({ name: "Ed25519" }, cryptoKey, (0, EntrySignature_1.base64ToBytes)(provenance.sourceMetadataSignature).buffer, signingBytes.buffer);
+    }
+    catch (error) {
+        return {
+            status: "invalid",
+            provenance,
+            payloadUnchanged,
+            reason: `Provenance verification failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    if (!verified) {
+        return {
+            status: "invalid",
+            provenance,
+            payloadUnchanged,
+            reason: "The embedded source signature does not match the embedded source " +
+                "projection. The provenance record has been tampered with or was " +
+                "fabricated.",
+        };
+    }
+    return { status: "verified", provenance, payloadUnchanged };
+}
+//# sourceMappingURL=provenance.js.map

package/dist/core/copy/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../../src/core/copy/provenance.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAsDH,4DAaC;AAgBD,sDA4DC;AA7ID,6DAOkC;AAuClC;;;;;GAKG;AACH,SAAgB,wBAAwB,CACtC,WAA+B,EAC/B,cAAsB,EACtB,UAAkB;IAElB,OAAO;QACL,cAAc;QACd,UAAU;QACV,MAAM,EAAE,IAAA,8CAA6B,EAAC,WAAW,CAAC;QAClD,uBAAuB,EAAE,WAAW,CAAC,iBAAiB;YACpD,CAAC,CAAC,IAAA,8BAAa,EAAC,WAAW,CAAC,iBAAiB,CAAC;YAC9C,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACI,KAAK,UAAU,qBAAqB,CACzC,KAAiF,EACjF,MAAoB;IAEpB,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACpC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,KAAK,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC;IAE7E,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,UAAU;YACV,gBAAgB;YAChB,MAAM,EACJ,0EAA0E;gBAC1E,wEAAwE;gBACxE,gBAAgB;SACnB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,IAAA,uCAAsB,EAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/D,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,IAAA,8CAA6B,EACnD,UAAU,CAAC,MAAM,CAAC,kBAAkB,EACpC,MAAM,CACP,CAAC;QACF,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,SAAS,EACT,IAAA,8BAAa,EAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,MAAqB,EACvE,YAAY,CAAC,MAAqB,CACnC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,UAAU;YACV,gBAAgB;YAChB,MAAM,EAAE,mCACN,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE;SACH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,UAAU;YACV,gBAAgB;YAChB,MAAM,EACJ,mEAAmE;gBACnE,kEAAkE;gBAClE,aAAa;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;AAC9D,CAAC"}