mindoodb 0.0.51 → 0.0.53

package/dist/node/server/CapabilityMatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"CapabilityMatcher.js","sourceRoot":"","sources":["../../../src/node/server/CapabilityMatcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAGH,qCAA0D;AAQ1D,MAAa,iBAAiB;IAG5B,YAAY,MAAoB;QAC9B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAoB;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW,CAAC,MAAoB;QACtC,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAEpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY,CACV,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBAAE,SAAS;YACvD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAE5D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,QAAgB,EAAE,aAAqB;QACrD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,EAChB,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,UAAkB,EAAE,aAAqB;QAC7D,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,aAAa,CAAC;IAC9D,CAAC;IAEO,gBAAgB,CACtB,IAAgB,EAChB,aAAqB,EACrB,WAAmB,EACnB,SAA+B,EAC/B,kBAA0B,EAC1B,aAAqB;QAErB,IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YACvD,SAAS,CAAC,aAAa,KAAK,aAAa,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,IAAA,uCAA8B,EAAC,SAAS,CAAC;YACzC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;YACxD,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,EACxD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,MAAc,EAAE,WAAmB;QAC9D,OAAO,MAAM,KAAK,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAClF,CAAC;IAEO,uBAAuB,CAAC,MAAc,EAAE,IAAY;QAC1D,OAAO,MAAM,KAAK,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,oBAAoB,CAAC,IAAY;QAC9C,OAAO,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,OAAe,EAAE,WAAmB;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,KAAK,WAAW,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE9C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAvKD,8CAuKC"}
+{"version":3,"file":"CapabilityMatcher.js","sourceRoot":"","sources":["../../../src/node/server/CapabilityMatcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAwLH,8DAGC;AAxLD,qCAA0D;AAQ1D,MAAa,iBAAiB;IAG5B,YAAY,MAAoB;QAC9B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAoB;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW,CAAC,MAAoB;QACtC,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAEpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY,CACV,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBAAE,SAAS;YACvD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAE5D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,QAAgB,EAAE,aAAqB;QACrD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,EAChB,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,UAAkB,EAAE,aAAqB;QAC7D,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,aAAa,CAAC;IAC9D,CAAC;IAEO,gBAAgB,CACtB,IAAgB,EAChB,aAAqB,EACrB,WAAmB,EACnB,SAA+B,EAC/B,kBAA0B,EAC1B,aAAqB;QAErB,IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YACvD,SAAS,CAAC,aAAa,KAAK,aAAa,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,IAAA,uCAA8B,EAAC,SAAS,CAAC;YACzC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;YACxD,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,EACxD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,MAAc,EAAE,WAAmB;QAC9D,OAAO,MAAM,KAAK,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAClF,CAAC;IAEO,uBAAuB,CAAC,MAAc,EAAE,IAAY;QAC1D,OAAO,MAAM,KAAK,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,oBAAoB,CAAC,IAAY;QAC9C,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,OAAe,EAAE,WAAmB;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,KAAK,WAAW,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE9C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAvKD,8CAuKC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,IAAY;IACpD,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/node/server/DeviceDiscoveryService.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Server-wide device discovery: prove possession of a device signing key,
+ * then scan all tenants for an active grant and deliver RSA-wrapped
+ * `$publicinfos` plus admin public keys and the per-device join bootstrap —
+ * no join-response URI required.
+ */
+import type { CryptoAdapter } from "../../core/crypto/CryptoAdapter";
+import type { DeviceTenantDelivery } from "../../core/types";
+import type { TenantManager } from "./TenantManager";
+export type { DeviceTenantDelivery };
+export interface DeviceDiscoverResult {
+    tenants: DeviceTenantDelivery[];
+}
+export declare class DeviceDiscoveryAuthError extends Error {
+    constructor(message: string);
+}
+export declare class DeviceDiscoveryService {
+    private readonly tenantManager;
+    private readonly cryptoAdapter;
+    private challenges;
+    constructor(tenantManager: TenantManager, cryptoAdapter: CryptoAdapter);
+    /**
+     * Issue a short-lived, single-use challenge bound to `signingPublicKey`.
+     * Does not require the key to be on any tenant yet (discovery finds that).
+     */
+    createChallenge(signingPublicKey: string): string;
+    /**
+     * Verify the Ed25519 signature over the challenge, then scan every local
+     * tenant for an active grant containing this signing key. Matching tenants
+     * receive a delivery with RSA-wrapped `$publicinfos` (parallelized).
+     */
+    discover(challenge: string, signature: Uint8Array): Promise<DeviceDiscoverResult>;
+    private verifySignature;
+    private cleanup;
+}
+//# sourceMappingURL=DeviceDiscoveryService.d.ts.map

package/dist/node/server/DeviceDiscoveryService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceDiscoveryService.d.ts","sourceRoot":"","sources":["../../../src/node/server/DeviceDiscoveryService.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAErE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAarD,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAErC,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,OAAO,CAAC,UAAU,CAAsC;gBAGrC,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,aAAa;IAG/C;;;OAGG;IACH,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM;IAkBjD;;;;OAIG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC;YA0GzE,eAAe;IAkC7B,OAAO,CAAC,OAAO;CAahB"}

package/dist/node/server/DeviceDiscoveryService.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Server-wide device discovery: prove possession of a device signing key,
+ * then scan all tenants for an active grant and deliver RSA-wrapped
+ * `$publicinfos` plus admin public keys and the per-device join bootstrap —
+ * no join-response URI required.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceDiscoveryService = exports.DeviceDiscoveryAuthError = void 0;
+const uuid_1 = require("uuid");
+const RSAEncryption_1 = require("../../core/crypto/RSAEncryption");
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+const MAX_CHALLENGES = 10000;
+class DeviceDiscoveryAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DeviceDiscoveryAuthError";
+    }
+}
+exports.DeviceDiscoveryAuthError = DeviceDiscoveryAuthError;
+class DeviceDiscoveryService {
+    constructor(tenantManager, cryptoAdapter) {
+        this.tenantManager = tenantManager;
+        this.cryptoAdapter = cryptoAdapter;
+        this.challenges = new Map();
+    }
+    /**
+     * Issue a short-lived, single-use challenge bound to `signingPublicKey`.
+     * Does not require the key to be on any tenant yet (discovery finds that).
+     */
+    createChallenge(signingPublicKey) {
+        const trimmed = signingPublicKey.trim();
+        if (!trimmed) {
+            throw new Error("signingPublicKey is required");
+        }
+        const challenge = (0, uuid_1.v7)();
+        const now = Date.now();
+        this.challenges.set(challenge, {
+            challenge,
+            signingPublicKey: trimmed,
+            createdAt: now,
+            expiresAt: now + CHALLENGE_TTL_MS,
+            used: false,
+        });
+        this.cleanup();
+        return challenge;
+    }
+    /**
+     * Verify the Ed25519 signature over the challenge, then scan every local
+     * tenant for an active grant containing this signing key. Matching tenants
+     * receive a delivery with RSA-wrapped `$publicinfos` (parallelized).
+     */
+    async discover(challenge, signature) {
+        const authChallenge = this.challenges.get(challenge);
+        if (!authChallenge) {
+            throw new DeviceDiscoveryAuthError("Challenge not found or expired");
+        }
+        if (Date.now() > authChallenge.expiresAt) {
+            this.challenges.delete(challenge);
+            throw new DeviceDiscoveryAuthError("Challenge expired");
+        }
+        if (authChallenge.used) {
+            throw new DeviceDiscoveryAuthError("Challenge already used");
+        }
+        authChallenge.used = true;
+        const ok = await this.verifySignature(challenge, signature, authChallenge.signingPublicKey);
+        if (!ok) {
+            throw new DeviceDiscoveryAuthError("Invalid signature");
+        }
+        const signingPublicKey = authChallenge.signingPublicKey;
+        const tenantIds = this.tenantManager.listTenants();
+        const matches = [];
+        for (const tenantId of tenantIds) {
+            try {
+                const loaded = await this.tenantManager.getTenant(tenantId);
+                const lookup = await loaded.directory.getUserBySigningPublicKey(signingPublicKey);
+                if (!lookup?.encryptionPublicKey)
+                    continue;
+                matches.push({
+                    tenantId,
+                    adminSigningPublicKey: loaded.context.config.adminSigningPublicKey,
+                    adminEncryptionPublicKey: loaded.context.config.adminEncryptionPublicKey,
+                    encryptionPublicKey: lookup.encryptionPublicKey,
+                    username_hash: typeof lookup.username === "string" && /^[a-f0-9]{64}$/i.test(lookup.username)
+                        ? lookup.username
+                        : undefined,
+                    identity_hashes: lookup.identityHashes,
+                    joinResponseWrapped: typeof lookup.joinResponseWrapped === "string" && lookup.joinResponseWrapped.trim()
+                        ? lookup.joinResponseWrapped.trim()
+                        : undefined,
+                });
+            }
+            catch {
+                // Tenant missing directory / not loadable — skip.
+            }
+        }
+        if (matches.length === 0) {
+            return { tenants: [] };
+        }
+        const rsa = new RSAEncryption_1.RSAEncryption(this.cryptoAdapter);
+        const deliveries = await Promise.all(matches.map(async (match) => {
+            try {
+                const keys = await this.tenantManager.getPublicInfosKeysForTenant(match.tenantId);
+                if (!keys.length)
+                    return null;
+                const wrappedPublicInfosKeys = await Promise.all(keys.map((rawKey) => rsa.wrapKeyToBase64(rawKey, match.encryptionPublicKey)));
+                // getAllKeys is newest-first; keep wrappedPublicInfosKey as the current generation.
+                const wrappedPublicInfosKey = wrappedPublicInfosKeys[0];
+                console.log(`[DeviceDiscovery] Wrapped ${wrappedPublicInfosKeys.length} $publicinfos version(s) for tenant ${match.tenantId}`);
+                return {
+                    tenantId: match.tenantId,
+                    adminSigningPublicKey: match.adminSigningPublicKey,
+                    adminEncryptionPublicKey: match.adminEncryptionPublicKey,
+                    wrappedPublicInfosKey,
+                    ...(wrappedPublicInfosKeys.length > 1
+                        ? { wrappedPublicInfosKeys }
+                        : {}),
+                    ...(match.joinResponseWrapped
+                        ? { wrappedJoinResponse: match.joinResponseWrapped }
+                        : {}),
+                    ...(match.username_hash ? { username_hash: match.username_hash } : {}),
+                    ...(match.identity_hashes?.length
+                        ? { identity_hashes: match.identity_hashes }
+                        : {}),
+                };
+            }
+            catch {
+                return null;
+            }
+        }));
+        return { tenants: deliveries.filter((d) => d !== null) };
+    }
+    async verifySignature(challenge, signature, publicKeyPem) {
+        try {
+            const subtle = this.cryptoAdapter.getSubtle();
+            const pemContents = publicKeyPem
+                .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+                .replace(/-----END PUBLIC KEY-----/g, "")
+                .replace(/\s/g, "");
+            const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
+            const key = await subtle.importKey("spki", binaryDer.buffer, { name: "Ed25519" }, false, ["verify"]);
+            const data = new TextEncoder().encode(challenge);
+            return await subtle.verify("Ed25519", key, signature.buffer.slice(signature.byteOffset, signature.byteOffset + signature.byteLength), data.buffer);
+        }
+        catch {
+            return false;
+        }
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [id, entry] of this.challenges) {
+            if (entry.used || entry.expiresAt <= now) {
+                this.challenges.delete(id);
+            }
+        }
+        while (this.challenges.size > MAX_CHALLENGES) {
+            const oldest = this.challenges.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.challenges.delete(oldest);
+        }
+    }
+}
+exports.DeviceDiscoveryService = DeviceDiscoveryService;
+//# sourceMappingURL=DeviceDiscoveryService.js.map

package/dist/node/server/DeviceDiscoveryService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceDiscoveryService.js","sourceRoot":"","sources":["../../../src/node/server/DeviceDiscoveryService.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,+BAAoC;AAEpC,mEAAgE;AAIhE,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,cAAc,GAAG,KAAM,CAAC;AAgB9B,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,MAAa,sBAAsB;IAGjC,YACmB,aAA4B,EAC5B,aAA4B;QAD5B,kBAAa,GAAb,aAAa,CAAe;QAC5B,kBAAa,GAAb,aAAa,CAAe;QAJvC,eAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAKrD,CAAC;IAEJ;;;OAGG;IACH,eAAe,CAAC,gBAAwB;QACtC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,SAAS,GAAG,IAAA,SAAM,GAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,gBAAgB,EAAE,OAAO;YACzB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,gBAAgB;YACjC,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,SAAqB;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC;QAE1B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACnC,SAAS,EACT,SAAS,EACT,aAAa,CAAC,gBAAgB,CAC/B,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,gBAAgB,GAAG,aAAa,CAAC,gBAAgB,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAWnD,MAAM,OAAO,GAAY,EAAE,CAAC;QAE5B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;gBAClF,IAAI,CAAC,MAAM,EAAE,mBAAmB;oBAAE,SAAS;gBAE3C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB;oBAClE,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB;oBACxE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;oBAC/C,aAAa,EACX,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;wBAC5E,CAAC,CAAC,MAAM,CAAC,QAAQ;wBACjB,CAAC,CAAC,SAAS;oBACf,eAAe,EAAE,MAAM,CAAC,cAAc;oBACtC,mBAAmB,EACjB,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;wBACjF,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;wBACnC,CAAC,CAAC,SAAS;iBAChB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,6BAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAwC,EAAE;YAChE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClF,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;gBAC9B,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9C,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAC7E,CAAC;gBACF,oFAAoF;gBACpF,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,CAAC,CAAE,CAAC;gBACzD,OAAO,CAAC,GAAG,CACT,6BAA6B,sBAAsB,CAAC,MAAM,uCAAuC,KAAK,CAAC,QAAQ,EAAE,CAClH,CAAC;gBACF,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;oBAClD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;oBACxD,qBAAqB;oBACrB,GAAG,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC;wBACnC,CAAC,CAAC,EAAE,sBAAsB,EAAE;wBAC5B,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,mBAAmB;wBAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;wBACpD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM;wBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAA6B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;IACtF,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,SAAiB,EACjB,SAAqB,EACrB,YAAoB;QAEpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,YAAY;iBAC7B,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;iBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;iBACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,MAAM,EACN,SAAS,CAAC,MAAqB,EAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,OAAO,MAAM,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,GAAG,EACH,SAAS,CAAC,MAAM,CAAC,KAAK,CACpB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAC7B,EAChB,IAAI,CAAC,MAAqB,CAC3B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBACzC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACnD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AA5LD,wDA4LC"}

package/dist/node/server/MindooDBServer.d.ts

@@ -44,6 +44,7 @@ export declare class MindooDBServer {
     private tenantManager;
     private capabilityMatcher;
     private systemAdminAuth;
+    private deviceDiscovery;
     private readonly staticDir;
     private serverConfig;
     private configPath;
@@ -124,8 +125,18 @@ export declare class MindooDBServer {
      * JWT-based middleware for /system/* routes (excluding /system/auth/*).
      * Extracts and validates the bearer token, then checks capabilities
      * for the current (method, path, username, publicsignkey).
+     *
+     * `DELETE /system/tenants/:tenantId` is also allowed when the JWT signing
+     * key is that tenant's registered `adminSigningPublicKey` (own-tenant
+     * delete). Sub-resources and other tenants stay capability-gated.
      */
     private systemAdminMiddleware;
+    /**
+     * Owner bypass for deleting the caller's own tenant. Matches only
+     * `DELETE /system/tenants/:tenantId` (no sub-resource) and requires the
+     * JWT public key to equal that tenant's stored admin signing key.
+     */
+    private isOwnTenantDeleteAuthorized;
     private tenantMiddleware;
     /**
      * Wire up all /system/* routes. Auth endpoints sit outside the JWT
@@ -237,6 +248,8 @@ export declare class MindooDBServer {
     private getClientIpForRateLimit;
     private validateDbId;
     private formatTenantNotFoundOnServerError;
+    private handleDeviceChallenge;
+    private handleDeviceDiscover;
     private handleChallenge;
     private handleAuthenticate;
     private handleFindNewEntries;

package/dist/node/server/MindooDBServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MindooDBServer.d.ts","sourceRoot":"","sources":["../../../src/node/server/MindooDBServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,OAAoD,MAAM,SAAS,CAAC;AAwC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAc3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAuC5C;;;;;GAKG;AACH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,WAAW,CAAC,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,aAAa,EAAE,MAAM,CAAA;aAAE,CAAC;YAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,yFAAyF;YACzF,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC5B,yFAAyF;YACzF,aAAa,CAAC,EAAE,MAAM,CAAC;SACxB;KACF;CACF;AAwID,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAsB;IACjC,0EAA0E;IAC1E,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAgB;IACnD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IAEnD;;;;;;;;OAQG;gBAED,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,YAAY,EACrB,UAAU,CAAC,EAAE,MAAM;IA8CrB,MAAM,IAAI,OAAO,CAAC,WAAW;IAI7B,gBAAgB,IAAI,aAAa;IAIjC,kBAAkB,IAAI,sBAAsB;IAI5C,eAAe,IAAI,YAAY;IAI/B,aAAa,IAAI,MAAM;IAIvB;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI;IAM3C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ1B;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAgBhE;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA4CvB,qFAAqF;IACrF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAyB9B,OAAO,CAAC,sBAAsB;IAe9B;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAgHnB;;;;OAIG;YACW,qBAAqB;IA4CnC,OAAO,CAAC,gBAAgB;IA0BxB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;YAqXX,qBAAqB;YAmCrB,wBAAwB;YAgCxB,kBAAkB;IA4DhC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAqE1B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAiBhC,2FAA2F;IAC3F,OAAO,CAAC,sBAAsB;IAO9B,2FAA2F;IAC3F,OAAO,CAAC,sBAAsB;IAO9B,gGAAgG;IAChG,OAAO,CAAC,2BAA2B;IAanC;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;;;;;;;;OASG;YACW,uBAAuB;IAkBrC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA2B3B;;;;;;OAMG;YACW,uBAAuB;IAoBrC;;;;;;;;OAQG;YACW,sBAAsB;IAoDpC;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;;;;;;;OASG;IACH,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,iCAAiC;YAW3B,eAAe;YA0Bf,kBAAkB;YA8BlB,oBAAoB;YAuBpB,0BAA0B;YAuB1B,iBAAiB;YAuBjB,sBAAsB;YA8BtB,kBAAkB;YAelB,uBAAuB;YAevB,qBAAqB;IAqBnC;;;;;;;;;;;;;;OAcG;YACW,gBAAgB;IAyD9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;YAwBhB,yBAAyB;YAezB,gBAAgB;IAuC9B;;;;OAIG;YACW,sBAAsB;YAgCtB,sBAAsB;IAsBpC;;;;OAIG;YACW,gBAAgB;IAiG9B;;;;OAIG;YACW,sBAAsB;YAoFtB,gBAAgB;YAiBhB,eAAe;YAcf,yBAAyB;YAoBzB,iCAAiC;YAqBjC,sCAAsC;YAkBtC,yCAAyC;YAqCzC,iBAAiB;IAM/B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAW/B,OAAO,CAAC,YAAY;IAQpB,yEAAyE;IACzE,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,qBAAqB;IAmB7B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IA+CpB,OAAO,CAAC,sBAAsB;IA6B9B,OAAO,CAAC,wBAAwB;IA8BhC,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,kBAAkB;CAG3B"}
+{"version":3,"file":"MindooDBServer.d.ts","sourceRoot":"","sources":["../../../src/node/server/MindooDBServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,OAAoD,MAAM,SAAS,CAAC;AA4C3E,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAKhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAkB3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAuC5C;;;;;GAKG;AACH,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,WAAW,CAAC,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,aAAa,EAAE,MAAM,CAAA;aAAE,CAAC;YAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,yFAAyF;YACzF,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC5B,yFAAyF;YACzF,aAAa,CAAC,EAAE,MAAM,CAAC;SACxB;KACF;CACF;AAqGD,qBAAa,cAAc;IACzB,OAAO,CAAC,GAAG,CAAsB;IACjC,0EAA0E;IAC1E,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,iBAAiB,CAAoB;IAC7C,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,eAAe,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAgB;IACnD;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;IAEnD;;;;;;;;OAQG;gBAED,OAAO,EAAE,MAAM,EACf,cAAc,CAAC,EAAE,MAAM,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,YAAY,EACrB,UAAU,CAAC,EAAE,MAAM;IAsDrB,MAAM,IAAI,OAAO,CAAC,WAAW;IAI7B,gBAAgB,IAAI,aAAa;IAIjC,kBAAkB,IAAI,sBAAsB;IAI5C,eAAe,IAAI,YAAY;IAI/B,aAAa,IAAI,MAAM;IAIvB;;;;OAIG;IACH,YAAY,CAAC,SAAS,EAAE,YAAY,GAAG,IAAI;IAM3C,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAQ1B;;;;;OAKG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IAgBhE;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA4CvB,qFAAqF;IACrF;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,sBAAsB;IAyB9B,OAAO,CAAC,sBAAsB;IAe9B;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAoInB;;;;;;;;OAQG;YACW,qBAAqB;IA6CnC;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAsBnC,OAAO,CAAC,gBAAgB;IA0BxB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;YAqXX,qBAAqB;YAmCrB,wBAAwB;YAgCxB,kBAAkB;IA4DhC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;IAqE1B;;;;OAIG;IACH,OAAO,CAAC,wBAAwB;IAiBhC,2FAA2F;IAC3F,OAAO,CAAC,sBAAsB;IAO9B,2FAA2F;IAC3F,OAAO,CAAC,sBAAsB;IAO9B,gGAAgG;IAChG,OAAO,CAAC,2BAA2B;IAanC;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;;;;;;;;OASG;YACW,uBAAuB;IAkBrC;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IA2B3B;;;;;;OAMG;YACW,uBAAuB;IAoBrC;;;;;;;;OAQG;YACW,sBAAsB;IAoDpC;;;;;;OAMG;IACH,OAAO,CAAC,mBAAmB;IAmB3B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAyB3B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAgB3B;;;;;;;;;OASG;IACH,OAAO,CAAC,uBAAuB;IAU/B,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,iCAAiC;YAO3B,qBAAqB;YAerB,oBAAoB;YA+BpB,eAAe;YA0Bf,kBAAkB;YA8BlB,oBAAoB;YAuBpB,0BAA0B;YAuB1B,iBAAiB;YAuBjB,sBAAsB;YA8BtB,kBAAkB;YAelB,uBAAuB;YAevB,qBAAqB;IAqBnC;;;;;;;;;;;;;;OAcG;YACW,gBAAgB;IAyD9B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;YAwBhB,yBAAyB;YAezB,gBAAgB;IAuC9B;;;;OAIG;YACW,sBAAsB;YAgCtB,sBAAsB;IAsBpC;;;;OAIG;YACW,gBAAgB;IAiG9B;;;;OAIG;YACW,sBAAsB;YAoFtB,gBAAgB;YAiBhB,eAAe;YAcf,yBAAyB;YAoBzB,iCAAiC;YAqBjC,sCAAsC;YAkBtC,yCAAyC;YAqCzC,iBAAiB;IAM/B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAW/B,OAAO,CAAC,YAAY;IAQpB,yEAAyE;IACzE,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,qBAAqB;IAmB7B;;;;OAIG;IACH,OAAO,CAAC,YAAY;IA+CpB,OAAO,CAAC,sBAAsB;IAI9B,OAAO,CAAC,wBAAwB;IAIhC,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,kBAAkB;IAI1B,OAAO,CAAC,kBAAkB;CAG3B"}

package/dist/node/server/MindooDBServer.js

@@ -59,12 +59,14 @@ const cors_1 = __importDefault(require("cors"));
 const express_rate_limit_1 = __importStar(require("express-rate-limit"));
 const compressionMiddleware_1 = require("./compressionMiddleware");
 const binaryEntryFraming_1 = require("../../core/appendonlystores/network/binaryEntryFraming");
+const entryWireCodec_1 = require("../../core/appendonlystores/network/entryWireCodec");
 const SyncEventBus_1 = require("./SyncEventBus");
 const types_1 = require("../../core/appendonlystores/types");
 const types_2 = require("../../core/appendonlystores/network/types");
 const TenantManager_1 = require("./TenantManager");
 const CapabilityMatcher_1 = require("./CapabilityMatcher");
 const SystemAdminAuth_1 = require("./SystemAdminAuth");
+const DeviceDiscoveryService_1 = require("./DeviceDiscoveryService");
 const config_1 = require("./config");
 const SystemIpAllowlist_1 = require("./SystemIpAllowlist");
 const validation_1 = require("./validation");
@@ -72,6 +74,13 @@ const urlSafety_1 = require("../../core/utils/urlSafety");
 const types_3 = require("./types");
 const timestampProxy_1 = require("./timestampProxy");
 const rateLimits_1 = require("./rateLimits");
+/**
+ * Wire-format types for the sync HTTP API live in
+ * {@link ../../core/appendonlystores/network/entryWireCodec}: binary fields
+ * (signature, encryptedData, rsaEncryptedPayload) are base64 strings in
+ * transit. Client and server share that codec so signed trailing blocks
+ * cannot drift off the wire.
+ */
 /**
  * Rate-limit defaults. Auth and sync have separate tiers because a single
  * challenge/authenticate handshake is two requests; with multiple tenants,
@@ -187,7 +196,10 @@ class MindooDBServer {
         // SystemAdminAuthService generates a random HMAC-SHA256 secret for JWTs
         // on each server start — existing tokens become invalid after restart.
         const cryptoAdapter = this.tenantManager.getCryptoAdapter();
-        this.systemAdminAuth = new SystemAdminAuth_1.SystemAdminAuthService(cryptoAdapter, this.serverConfig);
+        this.systemAdminAuth = new SystemAdminAuth_1.SystemAdminAuthService(cryptoAdapter, this.serverConfig, {
+            isTenantAdminSigningKey: (publicsignkey) => this.tenantManager.isRegisteredTenantAdminSigningKey(publicsignkey),
+        });
+        this.deviceDiscovery = new DeviceDiscoveryService_1.DeviceDiscoveryService(this.tenantManager, cryptoAdapter);
         const principalCount = Object.values(this.serverConfig.capabilities).reduce((sum, arr) => sum + arr.length, 0);
         if (principalCount === 0) {
             console.log(`[MindooDBServer] WARNING: No system admin principals configured. All /system/* endpoints are locked down.`);
@@ -362,6 +374,17 @@ class MindooDBServer {
         this.app.get("/health", (req, res) => {
             res.json({ status: "ok", timestamp: Date.now() });
         });
+        // Server-wide device discovery (before /:tenantId so "device" is not a tenant id).
+        // Aggressive rate limit: challenge+discover scans every local tenant.
+        const deviceDiscoveryRateLimit = (0, express_rate_limit_1.default)({
+            windowMs: 60000,
+            max: 10,
+            standardHeaders: true,
+            legacyHeaders: false,
+            message: { error: "Too many device discovery requests, please try again later" },
+        });
+        this.app.post("/device/challenge", deviceDiscoveryRateLimit, this.handleDeviceChallenge.bind(this));
+        this.app.post("/device/discover", deviceDiscoveryRateLimit, this.handleDeviceDiscover.bind(this));
         // .well-known endpoints are unauthenticated so clients can discover
         // server identity and tenant availability before attempting to authenticate.
         this.app.get("/.well-known/mindoodb-server-info", (req, res) => {
@@ -451,6 +474,10 @@ class MindooDBServer {
      * JWT-based middleware for /system/* routes (excluding /system/auth/*).
      * Extracts and validates the bearer token, then checks capabilities
      * for the current (method, path, username, publicsignkey).
+     *
+     * `DELETE /system/tenants/:tenantId` is also allowed when the JWT signing
+     * key is that tenant's registered `adminSigningPublicKey` (own-tenant
+     * delete). Sub-resources and other tenants stay capability-gated.
      */
     async systemAdminMiddleware(req, res, next) {
         const auth = req.headers.authorization;
@@ -468,7 +495,10 @@ class MindooDBServer {
         // but we need the full path for capability matching.
         const fullPath = `/system${req.path}`;
         const method = req.method.toUpperCase();
-        if (!this.capabilityMatcher.isAuthorized(method, fullPath, payload.sub, payload.publicsignkey)) {
+        const capabilityAuthorized = this.capabilityMatcher.isAuthorized(method, fullPath, payload.sub, payload.publicsignkey);
+        const ownerDeleteAuthorized = !capabilityAuthorized &&
+            this.isOwnTenantDeleteAuthorized(method, fullPath, payload.publicsignkey);
+        if (!capabilityAuthorized && !ownerDeleteAuthorized) {
             res.status(403).json({ error: "Forbidden: insufficient capabilities" });
             return;
         }
@@ -478,6 +508,27 @@ class MindooDBServer {
         };
         next();
     }
+    /**
+     * Owner bypass for deleting the caller's own tenant. Matches only
+     * `DELETE /system/tenants/:tenantId` (no sub-resource) and requires the
+     * JWT public key to equal that tenant's stored admin signing key.
+     */
+    isOwnTenantDeleteAuthorized(method, fullPath, publicsignkey) {
+        if (method !== "DELETE") {
+            return false;
+        }
+        const tenantId = (0, CapabilityMatcher_1.parseSystemTenantItemPath)(fullPath);
+        if (!tenantId) {
+            return false;
+        }
+        try {
+            (0, validation_1.validateTenantIdFormat)(tenantId);
+        }
+        catch {
+            return false;
+        }
+        return this.tenantManager.isTenantAdminSigningKeyFor(tenantId, publicsignkey);
+    }
     // ==================== Tenant Middleware ====================
     tenantMiddleware(req, res, next) {
         const rawTenantId = req.params.tenantId?.toLowerCase();
@@ -1298,6 +1349,47 @@ class MindooDBServer {
         const serverName = this.tenantManager.getServerPublicInfo()?.name ?? "unknown";
         return `Tenant ${tenantId} not found on server ${serverName}`;
     }
+    // ==================== Device Discovery (server-wide) ====================
+    async handleDeviceChallenge(req, res) {
+        try {
+            const { signingPublicKey } = req.body ?? {};
+            if (typeof signingPublicKey !== "string" || !signingPublicKey.trim()) {
+                res.status(400).json({ error: "signingPublicKey is required" });
+                return;
+            }
+            (0, validation_1.validateStringLength)(signingPublicKey, validation_1.MAX_PEM_KEY_LENGTH, "signingPublicKey");
+            const challenge = this.deviceDiscovery.createChallenge(signingPublicKey);
+            res.json({ challenge });
+        }
+        catch (error) {
+            this.handleRequestError(error, res);
+        }
+    }
+    async handleDeviceDiscover(req, res) {
+        try {
+            const { challenge, signature } = req.body ?? {};
+            if (typeof challenge !== "string" || !challenge.trim()) {
+                res.status(400).json({ error: "challenge is required" });
+                return;
+            }
+            if (typeof signature !== "string" || !signature.trim()) {
+                res.status(400).json({ error: "signature is required" });
+                return;
+            }
+            (0, validation_1.validateStringLength)(challenge, validation_1.MAX_CHALLENGE_LENGTH, "challenge");
+            (0, validation_1.validateStringLength)(signature, validation_1.MAX_SIGNATURE_LENGTH, "signature");
+            const signatureBytes = this.base64ToUint8Array(signature);
+            const result = await this.deviceDiscovery.discover(challenge, signatureBytes);
+            res.json(result);
+        }
+        catch (error) {
+            if (error instanceof DeviceDiscoveryService_1.DeviceDiscoveryAuthError) {
+                res.status(401).json({ error: error.message });
+                return;
+            }
+            this.handleRequestError(error, res);
+        }
+    }
     // ==================== Tenant Auth Handlers ====================
     // Two-step challenge-response flow:
     //  1. POST /auth/challenge  → client sends username, server returns a random nonce
@@ -2007,70 +2099,16 @@ class MindooDBServer {
     }
     // ==================== Serialization ====================
     // Entries are stored with binary fields (Uint8Array) internally but
-    // transmitted as base64 strings over JSON. These methods handle the
-    // conversion in both directions.
+    // transmitted as base64 strings over JSON. Shared with the client
+    // (entryWireCodec) so signed trailing blocks cannot drift off the wire.
     serializeEntryMetadata(metadata) {
-        return {
-            entryType: metadata.entryType,
-            id: metadata.id,
-            contentHash: metadata.contentHash,
-            docId: metadata.docId,
-            dependencyIds: metadata.dependencyIds,
-            createdAt: metadata.createdAt,
-            receiptOrder: metadata.receiptOrder,
-            createdByPublicKey: metadata.createdByPublicKey,
-            decryptionKeyId: metadata.decryptionKeyId,
-            signature: this.uint8ArrayToBase64(metadata.signature),
-            metadataSignature: metadata.metadataSignature
-                ? this.uint8ArrayToBase64(metadata.metadataSignature)
-                : undefined,
-            originalSize: metadata.originalSize,
-            encryptedSize: metadata.encryptedSize,
-            receivedAt: metadata.receivedAt,
-            receivedByPublicKey: metadata.receivedByPublicKey,
-            receivedDateSignature: metadata.receivedDateSignature
-                ? this.uint8ArrayToBase64(metadata.receivedDateSignature)
-                : undefined,
-            attachmentRefs: metadata.attachmentRefs,
-            // Bound into metadataSignature, so it must survive the round-trip.
-            provenance: metadata.provenance,
-            entryVersion: metadata.entryVersion,
-        };
+        return (0, entryWireCodec_1.serializeEntryMetadata)(metadata);
     }
     deserializeEntryMetadata(serialized) {
-        return {
-            entryType: serialized.entryType,
-            id: serialized.id,
-            contentHash: serialized.contentHash,
-            docId: serialized.docId,
-            dependencyIds: serialized.dependencyIds,
-            createdAt: serialized.createdAt,
-            receiptOrder: serialized.receiptOrder,
-            createdByPublicKey: serialized.createdByPublicKey,
-            decryptionKeyId: serialized.decryptionKeyId,
-            signature: this.base64ToUint8Array(serialized.signature),
-            metadataSignature: serialized.metadataSignature
-                ? this.base64ToUint8Array(serialized.metadataSignature)
-                : undefined,
-            originalSize: serialized.originalSize,
-            encryptedSize: serialized.encryptedSize,
-            // Preserve any pre-existing witness receipt (e.g. on re-sync or
-            // server-to-server forwarding); a fresh local push has none.
-            receivedAt: serialized.receivedAt,
-            receivedByPublicKey: serialized.receivedByPublicKey,
-            receivedDateSignature: serialized.receivedDateSignature
-                ? this.base64ToUint8Array(serialized.receivedDateSignature)
-                : undefined,
-            attachmentRefs: serialized.attachmentRefs,
-            provenance: serialized.provenance,
-            entryVersion: serialized.entryVersion,
-        };
+        return (0, entryWireCodec_1.deserializeEntryMetadata)(serialized);
     }
     deserializeEntry(serialized) {
-        return {
-            ...this.deserializeEntryMetadata(serialized),
-            encryptedData: this.base64ToUint8Array(serialized.encryptedData),
-        };
+        return (0, entryWireCodec_1.deserializeStoreEntry)(serialized);
     }
     uint8ArrayToBase64(bytes) {
         return Buffer.from(bytes).toString("base64");