mindoodb 0.0.51 → 0.0.54

package/README-server.md

@@ -261,7 +261,7 @@ Each rule in `config.json` is a key-value pair where:
 | `POST:/system/tenants/acme` | Can only create the specific tenant `acme` |
 | `PUT:/system/tenants/company-*` | Can update any tenant whose ID starts with `company-` |
 | `GET:/system/tenants` | Read-only: can list tenants but not modify anything |
-| `DELETE:/system/tenants/*` | Can delete any tenant |
+| `DELETE:/system/tenants/*` | Can delete any tenant. Tenant admins can also delete **their own** tenant without this rule (see [Own-tenant delete](#own-tenant-delete)). |
 
 ### Multiple admins with different roles
 
@@ -304,6 +304,7 @@ On each `/system/*` request the server:
 3. Finds all capability rules whose method and path pattern match
 4. Unions all principal entries from matching rules
 5. **Allows** the request if any entry has **both** a matching `username` AND `publicsignkey`
+6. If that fails, **also allows** `DELETE /system/tenants/:tenantId` when the JWT signing key is that tenant's registered admin signing key (see [Own-tenant delete](#own-tenant-delete))
 
 A principal is identified by the combination of username + public key. Two admins may share a username but have different keys -- they are treated as distinct identities.
 
@@ -385,11 +386,21 @@ Prefix-restricted demo server (allow only tenant names starting with `demo_`):
 
 These examples are useful for public demos or temporary onboarding servers, but they are intentionally less strict than normal production setups. For regular servers, prefer explicit principals with real public keys.
 
+### Own-tenant delete
+
+Independently of `config.json`, `DELETE /system/tenants/:tenantId` is also allowed when the caller's JWT signing key equals that tenant's registered `adminSigningPublicKey`. The tenant admin can remove **their own** tenant from the server. They cannot list tenants, change server config, touch sync-server sub-resources, or delete anyone else's tenant.
+
+This is not a wildcard capability. `{ "username": "*", "publicsignkey": "*" }` remains valid only on `POST:/system/tenants/...`. A demo server that already allows open tenant creation therefore needs no extra `DELETE` rule — the creator's tenant-admin key is enough to unpublish that same tenant.
+
+A system admin with `DELETE:/system/tenants/*` or `ALL:/system/*` can still delete any tenant.
+
 For key rotation, adding/removing admins, and the full authentication flow (challenge/response, JWT lifecycle), see [Server Security](docs/server-security.md).
 
 ## Walkthrough: Multi-Server Setup
 
-MindooDB servers can mirror encrypted data between each other. This section covers the full workflow: initializing servers, establishing trust, and configuring per-tenant sync.
+MindooDB servers can mirror encrypted data between each other. This section covers the full workflow: initializing servers, establishing trust, seeding a tenant onto a second server, and running the mesh.
+
+**The model in one paragraph.** Replication is configured per *peer*, not per tenant. Each trusted server with a `url` becomes one replication session, and over that session the two servers mirror **every tenant they both host** — all databases, documents and attachments. Which tenants those are is negotiated, not configured: the peers exchange a Bloom summary of their tenant ids and intersect it, so a tenant only one side hosts is never replicated and the other side never learns it exists. Servers relay encrypted entries and never see plaintext; a mirror is a full replica that cannot read what it stores.
 
 ### 1. Initialize servers
 
@@ -423,15 +434,16 @@ curl https://server1.example.com/.well-known/mindoodb-server-info
 {
   "name": "CN=server1",
   "signingPublicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----",
-  "encryptionPublicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
+  "encryptionPublicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----",
+  "clusterRole": "peer"
 }
 ```
 
-This eliminates the need to manually copy public keys between servers.
+This eliminates the need to manually copy public keys between servers. `clusterRole` is the role this server announces for itself (`peer`, `hub` or `spoke`), which `add-to-network` records on the other side.
 
 ### 3. Establish trust
 
-The `add-to-network` CLI automates mutual trust exchange. It fetches each server's public keys from `/.well-known/mindoodb-server-info` and calls `POST /system/trusted-servers` on each side using your system admin identity.
+The `add-to-network` CLI automates mutual trust exchange. It fetches each server's public keys, url and cluster role from `/.well-known/mindoodb-server-info` and calls `POST /system/trusted-servers` on each side using your system admin identity. Because it records the peer's url, trust and replication are established in the same step — there is no separate "now configure sync" pass.
 
 ```bash
 printf '%s' 'admin-pass' > ./.admin-password && chmod 600 ./.admin-password
@@ -455,83 +467,112 @@ curl -X POST http://server1:1661/system/trusted-servers \
   -d '{
     "name": "CN=server2",
     "signingPublicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----",
-    "encryptionPublicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----"
+    "encryptionPublicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----",
+    "url": "http://server2:3001",
+    "direction": "bidirectional",
+    "role": "peer",
+    "attachments": "eager"
   }'
 ```
 
-Trust changes take effect immediately -- no restart required.
+Only `name` and the two public keys are required. The rest describe the replication session and all have defaults:
 
-### 4. Publish tenant to servers
+| Field | Values | Default | Meaning |
+| --- | --- | --- | --- |
+| `url` | base url | *(none)* | Where to reach the peer. **Without it the server is trusted but never dialled** — it can push to us, we never pull from it. |
+| `direction` | `bidirectional`, `push`, `pull`, `disabled` | `bidirectional` | Which legs are allowed. `pull` makes a read-only mirror; `disabled` keeps the trust but stops replicating. |
+| `role` | `peer`, `hub`, `spoke` | `peer` | Mesh shape. Two `spoke`s do not open a session with each other — they exchange data through their hub. |
+| `attachments` | `eager`, `lazy`, `never` | `eager` | `eager` completes each database before the next. `lazy` replicates every document store first and attachments afterwards, so an interrupted or slow run has spent its bandwidth on the text. `never` mirrors metadata only. |
 
-Reuse the same system admin identity that is authorized in each server's `config.json`:
+Trust and configuration changes take effect immediately -- no restart required.
 
-```typescript
-await result.tenant.publishToServer("http://server1:1661", {
-  systemAdminUser: systemAdminIdentity,
-  systemAdminPassword: "sysadmin-pass",
-  adminUsername: result.adminUser.username,
-});
+### 4. Seed the tenant onto both servers
 
-await result.tenant.publishToServer("http://server2:3001", {
-  systemAdminUser: systemAdminIdentity,
-  systemAdminPassword: "sysadmin-pass",
-  adminUsername: result.adminUser.username,
-});
+**A tenant is defined by its administration keypair, so "create the same tenant id on both servers" produces two different tenants that happen to share a name.** The second server would refuse every replicated entry as *not signed by a trusted user* — correctly, because for it the signer really is a stranger. Create the tenant once and publish it to each server that should host it:
+
+```typescript
+for (const url of ["http://server1:1661", "http://server2:3001"]) {
+  await result.tenant.publishToServer(url, {
+    systemAdminUser: systemAdminIdentity,
+    systemAdminPassword: "sysadmin-pass",
+    adminUsername: result.adminUser.username,
+  });
+}
 ```
 
-### 5. Configure per-tenant sync
+Publishing registers the tenant and its admin keys. The data itself arrives through replication; you do not have to push it to both servers by hand.
+
+To add a mirror for a tenant that already exists, publish that same tenant object to the new server and let the mesh fill it.
 
-After trust is established, configure which tenants each server syncs. This gives full control over sync topology -- not every server needs to sync every tenant.
+### 5. Enable replication
 
-**Add a sync server for a tenant:**
+Add `--auto-sync` via the `command` key in each server's `docker-compose.override.yml`, or set `"cluster": { "autoSync": true }` in `config.json`:
+
+```yaml
+services:
+  mindoodb:
+    command: ["--auto-sync"]
+```
+
+Then restart:
 
 ```bash
-curl -X POST http://server1:1661/system/tenants/acme/sync-servers \
-  -H "Content-Type: application/json" \
-  -H "Authorization: Bearer $SYSTEM_ADMIN_JWT" \
-  -d '{
-    "name": "CN=server2",
-    "url": "http://server2:3001",
-    "syncIntervalMs": 60000,
-    "databases": ["directory", "main"]
-  }'
+docker compose up -d
 ```
 
-The `databases` field is required and controls which databases are synced with the remote server. The `name` field identifies the remote server (must match the trusted server name). If a server with the same name already exists for the tenant, it is updated.
+Each peer with a `url` gets one session. A session catches up on start, then follows the peer's change feed over SSE and pushes local writes as they happen, with a periodic full pass as a safety net. Nothing is per-tenant: adding a tenant to both servers is enough for it to start replicating.
 
-**List sync servers for a tenant:**
+### 6. Watch the mesh
+
+`/system/cluster/*` is the administrative view, behind the same system-admin JWT and capability rules as the rest of `/system`:
 
 ```bash
-curl http://server1:1661/system/tenants/acme/sync-servers \
+curl http://server1:1661/system/cluster/status \
   -H "Authorization: Bearer $SYSTEM_ADMIN_JWT"
 ```
 
-**Remove a sync server from a tenant:**
+The status reports, per peer: session state, health with classified reasons, shared tenant count, lag, retry depth, rejected entries and the last error. Counts and classifications only — never a document id, so the console does not become a way around admin-blindness.
+
+Two health reasons are worth recognizing:
+
+- **`access-denied-backoff`** — the peer refused a batch (a purged document, a revoked key). The replicator holds its cursor and retries; it does not skip past the entries. This usually clears itself once the directory change that caused it has replicated.
+- **`entries-awaiting-directory-trust`** — entries are waiting for a grant that has not arrived yet. Also self-clearing.
+
+Mutating actions are jobs, so a long resync does not block the request:
 
 ```bash
-curl -X DELETE http://server1:1661/system/tenants/acme/sync-servers/CN%3Dserver2 \
+curl -X POST http://server1:1661/system/cluster/actions/sync-now \
+  -H "Content-Type: application/json" \
+  -H "Authorization: Bearer $SYSTEM_ADMIN_JWT" \
+  -d '{"peer": "CN=server2", "tenantId": "acme"}'
+# → { "jobId": "...", "job": { "state": "running", ... } }
+
+curl http://server1:1661/system/cluster/jobs/$JOB_ID \
   -H "Authorization: Bearer $SYSTEM_ADMIN_JWT"
 ```
 
-Note: the server name in the URL must be percent-encoded (e.g., `CN%3Dserver2` for `CN=server2`).
+Every action is recorded in an append-only audit log (`GET /system/cluster/audit`, paged) with who, what, where and when.
 
-### 6. Enable auto-sync
+Because each server is administered independently, there is no cluster-wide aggregate endpoint: a console shows the whole mesh by asking each server for its own view. That keeps one server's admin credentials from becoming credentials for the others.
 
-Add `--auto-sync` via the `command` key in each server's `docker-compose.override.yml`:
+### Client failover
 
-```yaml
-services:
-  mindoodb:
-    command: ["--auto-sync"]
-```
-
-Then restart:
+A client can discover where else a tenant lives, without authenticating:
 
 ```bash
-docker compose up -d
+curl "http://server1:1661/.well-known/mindoodb-cluster?tenantId=acme"
+# → { "mirrors": [ { "name": "CN=server2", "url": "http://server2:3001", "role": "peer" } ] }
 ```
 
-The servers will periodically sync all configured tenant databases, relaying encrypted entries without decrypting them. Sync config changes take effect on the next server restart or when auto-sync timers are restarted.
+Only mirrors of the tenant that was asked for are listed, so the answer says nothing about peers that exist for other tenants.
+
+### What the mesh guarantees
+
+Three invariants make repeated replication converge rather than drift:
+
+1. **Directory first.** Within each tenant, `directory` and `userdirectory` replicate before application databases. Application entries are signed by keys the peer only learns from the directory, so any other order rejects entries that are in fact valid.
+2. **The cursor holds on rejection.** A client may skip an entry the server refuses and move on. Two servers that are meant to be identical may not: the cursor stays clamped until the entry is accepted, or the divergence would be permanent and silent.
+3. **Receipts are preserved.** A replicated entry keeps the witness receipt of the server that first accepted it, verified against `trusted-servers.json` on arrival. Re-stamping would make "trusted time" mean "the time it reached the last server in the chain", and would show every mirrored document as having appeared today.
 
 ## Data Directory Layout
 
@@ -611,11 +652,17 @@ Generated by `pnpm server:init`. Contains a `PrivateUserId` with encrypted priva
   {
     "name": "CN=server2",
     "signingPublicKey": "-----BEGIN PUBLIC KEY-----\n...",
-    "encryptionPublicKey": "-----BEGIN PUBLIC KEY-----\n..."
+    "encryptionPublicKey": "-----BEGIN PUBLIC KEY-----\n...",
+    "url": "https://server2.example.com",
+    "direction": "bidirectional",
+    "role": "peer",
+    "attachments": "eager"
   }
 ]
 ```
 
+This file is the whole replication topology. An entry with a `url` becomes one replication session covering every tenant both servers host; an entry without one is trusted (it may push to us) but never dialled. See [Server-to-Server Sync](#server-to-server-sync) for the field meanings.
+
 ### `<tenantId>/config.json`
 
 ```json
@@ -631,18 +678,12 @@ Generated by `pnpm server:init`. Contains a `PrivateUserId` with encrypted priva
       "signingPublicKey": "-----BEGIN PUBLIC KEY-----\n...",
       "encryptionPublicKey": "-----BEGIN PUBLIC KEY-----\n..."
     }
-  ],
-  "remoteServers": [
-    {
-      "name": "CN=server2",
-      "url": "https://server2.example.com",
-      "syncIntervalMs": 60000,
-      "databases": ["directory", "main"]
-    }
   ]
 }
 ```
 
+Replication is not configured here. It is a property of the peer (`trusted-servers.json`), and a tenant is mirrored simply by existing on both servers.
+
 The `users` array is a **public-key allowlist**: each entry's identity is its
 `signingPublicKey` (with the paired `encryptionPublicKey`). The cleartext
 `username` from previous versions is **no longer required or used for matching** — clients may
@@ -664,8 +705,6 @@ extra field) for human-readable notes. Entries are matched solely by
 
 > **Set `MINDOODB_TRUST_PROXY` if anything fronts the server.** Rate limits and the `/system/*` allowlist both key on `req.ip`. Without it, every user behind the proxy shares one address, so one busy client can exhaust the address-keyed budgets for everyone and the allowlist matches the proxy instead of the operator network.
 
-> **Note:** The old `MINDOODB_ADMIN_API_KEY` variable has been removed. System admin **authorization** is enforced by `config.json` capabilities and JWTs. **`MINDOODB_ADMIN_ALLOWED_IPS`** is an optional **network** layer for `/system/*` only. See [Server Security](docs/server-security.md).
-
 ## CLI Reference
 
 ### `pnpm server:dev` / `pnpm server:start` — Start the server
@@ -676,7 +715,7 @@ Launches the MindooDB server process. `server:dev` runs via `ts-node` for develo
 |--------|-------|-------------|---------|
 | `--data-dir` | `-d` | Data directory path | `./data` |
 | `--port` | `-p` | Server port | `1661` |
-| `--auto-sync` | `-s` | Enable automatic sync with remote servers | disabled |
+| `--auto-sync` | `-s` | Start peer replication: one session per trusted server with a `url`, mirroring every tenant both sides host. Equivalent to `"cluster": { "autoSync": true }` in `config.json` | disabled |
 | `--static-dir` | `-w` | Serve static files at `/statics/` (e.g. bootstrap UI) | — |
 | `--tls-cert` | — | Path to TLS certificate file (PEM) | — |
 | `--tls-key` | — | Path to TLS private key file (PEM) | — |
@@ -686,16 +725,18 @@ Launches the MindooDB server process. `server:dev` runs via `ts-node` for develo
 
 One-time setup that generates the server's Ed25519/RSA keypair (`server.identity.json`) and an empty `trusted-servers.json`. It also interactively offers to create a first system admin keypair and writes the initial `config.json` with that admin's public key in the `capabilities` section.
 
+Both names — the server's and the system admin's — are stored in canonical form (`cn=…/o=…`). An abbreviated name is expanded, a canonical one is taken as it is, and a name without an organization is rejected: the system admin is matched against `config.json` as a string, so a client sending `cn=sysadmin/o=acme` would never match a stored `sysadmin/acme`, and an identity without an organization fails later in every path that resolves recipients.
+
 | Option | Alias | Description | Default |
 |--------|-------|-------------|---------|
-| `--name` | `-n` | Server name (e.g., "server1") | **required** |
+| `--name` | `-n` | Server name. Canonical (`cn=server1/o=acme`) or abbreviated (`server1/acme`); a common name and an organization are both required, and the value is stored in canonical form | **required** |
 | `--data-dir` | `-d` | Data directory path | `./data` |
 | `--force` | `-f` | Overwrite existing identity | — |
 | `--help` | `-h` | Show help message | — |
 
 ### `pnpm server:add-to-network` — Add a server to the network
 
-Automates mutual trust exchange when adding a new server to an existing network. For each existing server it fetches public keys from `/.well-known/mindoodb-server-info` and calls `POST /system/trusted-servers` in both directions so that the new server and every existing server trust each other.
+Automates mutual trust exchange when adding a new server to an existing network. For each existing server it fetches public keys, url and cluster role from `/.well-known/mindoodb-server-info` and calls `POST /system/trusted-servers` in both directions, so the new server and every existing server both trust *and* can dial each other.
 
 | Option | Description | Default |
 |--------|-------------|---------|
@@ -766,24 +807,48 @@ The **`curl`** examples in this document use **`$SYSTEM_ADMIN_JWT`** as a placeh
 | `POST` | `/system/tenants/:tenantId` | JWT | Create a tenant |
 | `GET` | `/system/tenants` | JWT | List all registered tenants |
 | `PUT` | `/system/tenants/:tenantId` | JWT | Update tenant config |
-| `DELETE` | `/system/tenants/:tenantId` | JWT | Remove a tenant |
+| `DELETE` | `/system/tenants/:tenantId` | JWT | Remove a tenant (capability **or** that tenant's admin signing key) |
 
 #### Trusted Server Management
 
 | Method | Endpoint | Auth | Description |
 |--------|----------|------|-------------|
 | `GET` | `/system/trusted-servers` | JWT | List trusted servers |
-| `POST` | `/system/trusted-servers` | JWT | Add a trusted server |
+| `POST` | `/system/trusted-servers` | JWT | Add or update a trusted server (keys, `url`, `direction`, `role`, `attachments`) |
 | `DELETE` | `/system/trusted-servers/:serverName` | JWT | Remove a trusted server |
 
-#### Per-Tenant Sync Server Management
+#### Cluster Administration
+
+The console surface for peer replication. Reads and writes are separate capabilities, so an auditor role can be granted `GET:/system/cluster/*` without the ability to change anything.
 
 | Method | Endpoint | Auth | Description |
 |--------|----------|------|-------------|
-| `GET` | `/system/tenants/:tenantId/sync-servers` | JWT | List sync servers for a tenant |
-| `POST` | `/system/tenants/:tenantId/sync-servers` | JWT | Add or update a sync server |
-| `DELETE` | `/system/tenants/:tenantId/sync-servers/:serverName` | JWT | Remove a sync server |
-| `POST` | `/system/tenants/:tenantId/trigger-sync` | JWT | Trigger sync for a tenant |
+| `GET` | `/system/cluster/topology` | JWT | Configured peers and their roles |
+| `GET` | `/system/cluster/status` | JWT | Live per-peer state: health, lag, retry depth, last error |
+| `GET` | `/system/cluster/tenants/:tenantId` | JWT | The same, narrowed to one tenant |
+| `POST` | `/system/cluster/actions/:action` | JWT | Start a job: `sync-now`, `retry-rejected`, `refresh-intersection`, `pause`, `resume` |
+| `GET` | `/system/cluster/jobs` | JWT | Recent jobs |
+| `GET` | `/system/cluster/jobs/:jobId` | JWT | One job's state and result |
+| `GET` | `/system/cluster/audit` | JWT | Append-only record of administrative actions (paged) |
+| `PUT`/`POST` | `/system/cluster/peers/:name` | JWT | Create or reconfigure a peer |
+| `DELETE` | `/system/cluster/peers/:name` | JWT | Remove a peer |
+
+Status, job and audit responses carry counts and classified reasons only — never document ids or author keys.
+
+#### Peer Protocol
+
+Server-to-server only, authenticated with a peer token from `trusted-servers.json` (a system-admin JWT is refused, and vice versa). Listed for completeness; operators do not call these.
+
+| Method | Endpoint | Description |
+|--------|----------|-------------|
+| `POST` | `/system/peer/challenge` | Request a challenge (only for a trusted signing key) |
+| `POST` | `/system/peer/authenticate` | Exchange a signed challenge for a peer token |
+| `POST` | `/system/peer/tenant-bloom` | Exchange Bloom summaries of tenant ids to find the intersection |
+| `GET` | `/system/peer/databases` | Database ids held for a shared tenant |
+| `GET` | `/system/peer/events` | SSE change feed for shared tenants |
+| `POST` | `/system/peer/sync` | Ask the peer to run a sync pass towards us |
+
+The data itself moves over the ordinary `/:tenantId/sync/*` routes: a peer speaks the client protocol with a peer token, rather than a second replication format existing alongside it.
 
 #### Server Config Management
 
@@ -1004,7 +1069,7 @@ docker run --rm -it \
   -v "$(pwd)/../mindoodb-data/.server_unlock:/run/secrets/server_unlock:ro" \
   -e MINDOODB_SERVER_PASSWORD_FILE=/run/secrets/server_unlock \
   --entrypoint node \
-  mindoodb-server dist/node/server/serverinit.js --data-dir /data --name server1
+  mindoodb-server dist/node/server/serverinit.js --data-dir /data --name server1/acme
 
 # Start the server
 docker compose up -d

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.d.ts

@@ -27,6 +27,8 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
     private privateEncryptionKey;
     private username;
     private signingKey;
+    /** PEM of the device signing public key; sent with challenge for multi-device auth. */
+    private signingPublicKeyPem;
     private cryptoAdapter;
     private accessToken;
     private tokenExpiry;
@@ -36,6 +38,18 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
     private capabilitiesPromise;
     private syncAuthOverride;
     private _syncAbortSignal?;
+    /**
+     * Supplies a ready-made bearer token instead of running the tenant
+     * challenge-response handshake.
+     *
+     * Used by server-to-server replication: a peer authenticates once at the
+     * cluster level (`/system/peer/authenticate`) against `trusted-servers.json`
+     * and holds no tenant grant, so the per-tenant handshake would always fail.
+     * Everything else — the entire sync protocol — is identical, which is the
+     * point: the mesh reuses the client protocol rather than inventing a second
+     * replication format.
+     */
+    private externalTokenProvider;
     /**
      * Create a new ClientNetworkContentAddressedStore.
      *
@@ -46,8 +60,11 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
      * @param signingKey The user's private signing key (for signing challenges)
      * @param privateEncryptionKey The user's private RSA key (for decrypting received entries)
      * @param logger Optional logger instance
+     * @param signingPublicKeyPem Optional device signing public key (PEM). Sent with
+     *        the auth challenge so the server can detect a second-device key that is
+     *        not yet in its directory copy (instead of a vague "Invalid signature").
      */
-    constructor(dbId: string, storeKind: StoreKind, transport: NetworkTransport, cryptoAdapter: CryptoAdapter, username: string, signingKey: CryptoKey, privateEncryptionKey: CryptoKey | string, logger?: Logger);
+    constructor(dbId: string, storeKind: StoreKind, transport: NetworkTransport, cryptoAdapter: CryptoAdapter, username: string, signingKey: CryptoKey, privateEncryptionKey: CryptoKey | string, logger?: Logger, signingPublicKeyPem?: string);
     getId(): string;
     getStoreKind(): StoreKind;
     getCacheIdentity(): string;
@@ -153,6 +170,11 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
     /**
      * Ensure we have a valid access token, authenticating if necessary.
      */
+    /**
+     * Route every authenticated call through `provider` instead of the tenant
+     * handshake. See {@link externalTokenProvider}.
+     */
+    setExternalTokenProvider(provider: (() => Promise<string>) | null): void;
     private ensureAuthenticated;
     private performAuthentication;
     /**
@@ -186,15 +208,22 @@ export declare class ClientNetworkContentAddressedStore implements ContentAddres
     /**
      * Set or clear a temporary per-sync authentication override.
      * Intended for bootstrap scenarios (for example authenticating as admin).
+     *
+     * When overriding, pass `signingPublicKey` (PEM) for the same key material as
+     * `signingKey`. Auth challenges bind username + device key; leaving the
+     * store's default PEM in place while signing with a different key causes the
+     * server to reject the challenge as an unknown device.
      */
     setSyncAuthOverride(override: {
         username: string;
         signingKey: CryptoKey;
+        signingPublicKey?: string;
         privateEncryptionKey?: CryptoKey | string;
     } | null): void;
     clearSyncAuthOverride(): void;
     private getActiveAuthUsername;
     private getActiveSigningKey;
+    private getActiveSigningPublicKeyPem;
     private getActivePrivateEncryptionKey;
 }
 //# sourceMappingURL=ClientNetworkContentAddressedStore.d.ts.map

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ClientNetworkContentAddressedStore.d.ts","sourceRoot":"","sources":["../../../src/appendonlystores/network/ClientNetworkContentAddressedStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC1B,aAAa,EACb,SAAS,EACT,SAAS,EACV,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC7F,OAAO,KAAK,EAGV,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,MAAM,EAAoC,MAAM,oBAAoB,CAAC;AAc9E;;;;;;;;;;;;;GAaG;AACH,qBAAa,kCAAmC,YAAW,qBAAqB;IAC9E,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAY;IAC9B,OAAO,CAAC,aAAa,CAAgB;IAGrC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,qBAAqB,CAAgC;IAC7D,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,iBAAiB,CAAwC;IACjE,OAAO,CAAC,mBAAmB,CAAiD;IAC5E,OAAO,CAAC,gBAAgB,CAIR;IAChB,OAAO,CAAC,gBAAgB,CAAC,CAAc;IAEvC;;;;;;;;;;OAUG;gBAED,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,gBAAgB,EAC3B,aAAa,EAAE,aAAa,EAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,SAAS,EACrB,oBAAoB,EAAE,SAAS,GAAG,MAAM,EACxC,MAAM,CAAC,EAAE,MAAM;IAgBjB,KAAK,IAAI,MAAM;IAIf,YAAY,IAAI,SAAS;IAIzB,gBAAgB,IAAI,MAAM;IAK1B,kBAAkB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI;IAO9C,OAAO,CAAC,kBAAkB;IAQ1B;;;;;;;;;OASG;IACG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAgC/D;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAqDhD,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQhE,mCAAmC,CACvC,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAW9B;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAclD;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAYvE;;OAEG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAW5F;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,cAAc,EACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAgBhC,OAAO,CAAC,kCAAkC;IAQ1C;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAWpC;;;OAGG;IACG,gBAAgB,CACpB,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,GAAE,MAAgC,EACvC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC;IA4D3B;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAWlC,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAcjD,eAAe,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAiDzD;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,MAAM,IAAI;YAM7D,yBAAyB;IAkDvC,OAAO,CAAC,MAAM,CAAC,cAAc;IAgBvB,mBAAmB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAwBrD,2BAA2B,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC;IAWjC,gCAAgC,CACpC,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,gCAAgC,CAAC;IAW5C;;;;OAIG;IACG,mBAAmB,CACvB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC;IAYpB;;;;;;;;OAQG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD;;OAEG;YACW,mBAAmB;YAqDnB,qBAAqB;IA2CnC;;OAEG;YACW,aAAa;YAIb,oBAAoB;IAalC;;;OAGG;YACW,8BAA8B;IA8C5C;;;OAGG;YACW,qBAAqB;IAsCnC,OAAO,CAAC,4BAA4B;IAKpC,OAAO,CAAC,0BAA0B;IAIlC,OAAO,CAAC,MAAM,CAAC,+BAA+B;IAQ9C,OAAO,CAAC,4BAA4B;IAgBpC,OAAO,CAAC,8BAA8B;IAYtC;;;OAGG;IACH,cAAc,IAAI,IAAI;YAYR,qBAAqB;IAKnC,OAAO,CAAC,mBAAmB;YAIb,qBAAqB;IAiBnC;;;OAGG;IACH,mBAAmB,CACjB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,SAAS,CAAC;QACtB,oBAAoB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3C,GAAG,IAAI,GACP,IAAI;IAQP,qBAAqB,IAAI,IAAI;IAS7B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,6BAA6B;CAGtC"}
+{"version":3,"file":"ClientNetworkContentAddressedStore.d.ts","sourceRoot":"","sources":["../../../src/appendonlystores/network/ClientNetworkContentAddressedStore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EACV,kBAAkB,EAClB,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,0BAA0B,EAC1B,aAAa,EACb,SAAS,EACT,SAAS,EACV,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sDAAsD,CAAC;AAC7F,OAAO,KAAK,EAGV,gBAAgB,EAChB,uBAAuB,EACxB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAE,MAAM,EAAoC,MAAM,oBAAoB,CAAC;AAc9E;;;;;;;;;;;;;GAaG;AACH,qBAAa,kCAAmC,YAAW,qBAAqB;IAC9E,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,SAAS,CAAmB;IACpC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,UAAU,CAAY;IAC9B,uFAAuF;IACvF,OAAO,CAAC,mBAAmB,CAAqB;IAChD,OAAO,CAAC,aAAa,CAAgB;IAGrC,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,qBAAqB,CAAgC;IAC7D,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,iBAAiB,CAAwC;IACjE,OAAO,CAAC,mBAAmB,CAAiD;IAC5E,OAAO,CAAC,gBAAgB,CAMR;IAChB,OAAO,CAAC,gBAAgB,CAAC,CAAc;IACvC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,qBAAqB,CAAwC;IAErE;;;;;;;;;;;;;OAaG;gBAED,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,gBAAgB,EAC3B,aAAa,EAAE,aAAa,EAC5B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,SAAS,EACrB,oBAAoB,EAAE,SAAS,GAAG,MAAM,EACxC,MAAM,CAAC,EAAE,MAAM,EACf,mBAAmB,CAAC,EAAE,MAAM;IAoB9B,KAAK,IAAI,MAAM;IAIf,YAAY,IAAI,SAAS;IAIzB,gBAAgB,IAAI,MAAM;IAK1B,kBAAkB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI;IAO9C,OAAO,CAAC,kBAAkB;IAQ1B;;;;;;;;;OASG;IACG,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAgC/D;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAqDhD,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAQhE,mCAAmC,CACvC,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAW9B;;;;;OAKG;IACG,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAclD;;;;;OAKG;IACG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAYvE;;OAEG;IACG,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAW5F;;OAEG;IACG,WAAW,CACf,IAAI,EAAE,cAAc,EACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,EAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAgBhC,OAAO,CAAC,kCAAkC;IAQ1C;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAWpC;;;OAGG;IACG,gBAAgB,CACpB,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,KAAK,GAAE,MAAgC,EACvC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,eAAe,CAAC;IA4D3B;;;;;OAKG;IACG,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAWlC,iBAAiB,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAcjD,eAAe,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAiDzD;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG,MAAM,IAAI;YAM7D,yBAAyB;IAkDvC,OAAO,CAAC,MAAM,CAAC,cAAc;IAgBvB,mBAAmB,IAAI,OAAO,CAAC,qBAAqB,CAAC;IAwBrD,2BAA2B,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,2BAA2B,CAAC;IAWjC,gCAAgC,CACpC,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAAC,gCAAgC,CAAC;IAW5C;;;;OAIG;IACG,mBAAmB,CACvB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,MAAM,EAAE,CAAC;IAYpB;;;;;;;;OAQG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD;;OAEG;IACH;;;OAGG;IACH,wBAAwB,CAAC,QAAQ,EAAE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI;YAI1D,mBAAmB;YAwDnB,qBAAqB;IAkDnC;;OAEG;YACW,aAAa;YAIb,oBAAoB;IAalC;;;OAGG;YACW,8BAA8B;IAuD5C;;;OAGG;YACW,qBAAqB;IAyBnC,OAAO,CAAC,4BAA4B;IAKpC,OAAO,CAAC,0BAA0B;IAIlC,OAAO,CAAC,MAAM,CAAC,+BAA+B;IAQ9C,OAAO,CAAC,4BAA4B;IAgBpC,OAAO,CAAC,8BAA8B;IAYtC;;;OAGG;IACH,cAAc,IAAI,IAAI;YAYR,qBAAqB;IAKnC,OAAO,CAAC,mBAAmB;YAIb,qBAAqB;IAiBnC;;;;;;;;OAQG;IACH,mBAAmB,CACjB,QAAQ,EAAE;QACR,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,SAAS,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,oBAAoB,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;KAC3C,GAAG,IAAI,GACP,IAAI;IAeP,qBAAqB,IAAI,IAAI;IAS7B,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,4BAA4B;IAQpC,OAAO,CAAC,6BAA6B;CAGtC"}

package/dist/appendonlystores/network/ClientNetworkContentAddressedStore.js

@@ -31,8 +31,11 @@ class ClientNetworkContentAddressedStore {
      * @param signingKey The user's private signing key (for signing challenges)
      * @param privateEncryptionKey The user's private RSA key (for decrypting received entries)
      * @param logger Optional logger instance
+     * @param signingPublicKeyPem Optional device signing public key (PEM). Sent with
+     *        the auth challenge so the server can detect a second-device key that is
+     *        not yet in its directory copy (instead of a vague "Invalid signature").
      */
-    constructor(dbId, storeKind, transport, cryptoAdapter, username, signingKey, privateEncryptionKey, logger) {
+    constructor(dbId, storeKind, transport, cryptoAdapter, username, signingKey, privateEncryptionKey, logger, signingPublicKeyPem) {
         // Cached access token
         this.accessToken = null;
         this.tokenExpiry = 0;
@@ -40,6 +43,18 @@ class ClientNetworkContentAddressedStore {
         this.capabilitiesCache = null;
         this.capabilitiesPromise = null;
         this.syncAuthOverride = null;
+        /**
+         * Supplies a ready-made bearer token instead of running the tenant
+         * challenge-response handshake.
+         *
+         * Used by server-to-server replication: a peer authenticates once at the
+         * cluster level (`/system/peer/authenticate`) against `trusted-servers.json`
+         * and holds no tenant grant, so the per-tenant handshake would always fail.
+         * Everything else — the entire sync protocol — is identical, which is the
+         * point: the mesh reuses the client protocol rather than inventing a second
+         * replication format.
+         */
+        this.externalTokenProvider = null;
         this.dbId = dbId;
         this.storeKind = storeKind;
         this.transport = transport;
@@ -47,6 +62,10 @@ class ClientNetworkContentAddressedStore {
         this.username = username;
         this.signingKey = signingKey;
         this.privateEncryptionKey = privateEncryptionKey;
+        this.signingPublicKeyPem =
+            typeof signingPublicKeyPem === "string" && signingPublicKeyPem.trim().length > 0
+                ? signingPublicKeyPem.trim()
+                : undefined;
         this.logger =
             logger ||
                 new logging_1.MindooLogger((0, logging_1.getDefaultLogLevel)(), `ClientNetworkStore:${dbId}:${storeKind}`, true);
@@ -524,7 +543,17 @@ class ClientNetworkContentAddressedStore {
     /**
      * Ensure we have a valid access token, authenticating if necessary.
      */
+    /**
+     * Route every authenticated call through `provider` instead of the tenant
+     * handshake. See {@link externalTokenProvider}.
+     */
+    setExternalTokenProvider(provider) {
+        this.externalTokenProvider = provider;
+    }
     async ensureAuthenticated() {
+        if (this.externalTokenProvider) {
+            return this.externalTokenProvider();
+        }
         const now = Date.now();
         const sharedState = this.getSharedAuthenticationState();
         const sharedKey = this.getSharedAuthenticationKey();
@@ -577,8 +606,12 @@ class ClientNetworkContentAddressedStore {
         const now = Date.now();
         const authUsername = this.getActiveAuthUsername();
         this.logger.debug(`Authenticating user: ${authUsername}`);
-        // Request a challenge
-        const challenge = await this.transport.requestChallenge(authUsername);
+        // Request a challenge. Prefer a non-empty username; always attach the
+        // signing public key that will actually sign (override PEM when set, else
+        // the store's default device PEM) so multi-device grants can be checked
+        // before the client signs.
+        const challengeSigningPublicKey = this.getActiveSigningPublicKeyPem();
+        const challenge = await this.transport.requestChallenge(authUsername.trim() ? authUsername : undefined, challengeSigningPublicKey ? { signingPublicKey: challengeSigningPublicKey } : undefined);
         this.logger.debug(`Received challenge: ${challenge}`);
         // Sign the challenge
         const signature = await this.signChallengeWithKey(challenge, this.getActiveSigningKey());
@@ -627,7 +660,15 @@ class ClientNetworkContentAddressedStore {
             return [];
         }
         const subtle = this.cryptoAdapter.getSubtle();
-        const sessionKeyBytes = await this.rsaEncryption.unwrapKey(batch.wrappedSessionKey, this.getActivePrivateEncryptionKey());
+        let sessionKeyBytes;
+        try {
+            sessionKeyBytes = await this.rsaEncryption.unwrapKey(batch.wrappedSessionKey, this.getActivePrivateEncryptionKey());
+        }
+        catch (error) {
+            const name = error instanceof Error ? error.name : "Error";
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`Cannot unwrap the directory sync session key: it is wrapped to a different device's encryption key (${name}: ${message})`);
+        }
         const sessionKey = await subtle.importKey("raw", sessionKeyBytes.buffer.slice(sessionKeyBytes.byteOffset, sessionKeyBytes.byteOffset + sessionKeyBytes.byteLength), { name: "AES-GCM", length: 256 }, false, ["decrypt"]);
         const results = [];
         for (const enc of batch.entries) {
@@ -654,22 +695,9 @@ class ClientNetworkContentAddressedStore {
             this.throwIfSyncAborted();
             // Decrypt the RSA layer to get the original symmetric-encrypted payload
             const encryptedData = await this.rsaEncryption.decrypt(enc.rsaEncryptedPayload, this.getActivePrivateEncryptionKey());
-            // Create the full StoreEntry using metadata from the network entry
+            const { rsaEncryptedPayload: _payload, ...metadata } = enc;
             const entry = {
-                entryType: enc.entryType,
-                id: enc.id,
-                contentHash: enc.contentHash,
-                docId: enc.docId,
-                dependencyIds: enc.dependencyIds,
-                createdAt: enc.createdAt,
-                createdByPublicKey: enc.createdByPublicKey,
-                decryptionKeyId: enc.decryptionKeyId,
-                snapshotHeadHashes: enc.snapshotHeadHashes,
-                snapshotHeadEntryIds: enc.snapshotHeadEntryIds,
-                signature: enc.signature,
-                originalSize: enc.originalSize,
-                encryptedSize: enc.encryptedSize,
-                attachmentRefs: enc.attachmentRefs,
+                ...metadata,
                 encryptedData,
             };
             results.push(entry);
@@ -752,10 +780,22 @@ class ClientNetworkContentAddressedStore {
     /**
      * Set or clear a temporary per-sync authentication override.
      * Intended for bootstrap scenarios (for example authenticating as admin).
+     *
+     * When overriding, pass `signingPublicKey` (PEM) for the same key material as
+     * `signingKey`. Auth challenges bind username + device key; leaving the
+     * store's default PEM in place while signing with a different key causes the
+     * server to reject the challenge as an unknown device.
      */
     setSyncAuthOverride(override) {
         const previousUsername = this.getActiveAuthUsername();
-        this.syncAuthOverride = override;
+        this.syncAuthOverride = override
+            ? {
+                ...override,
+                ...(typeof override.signingPublicKey === "string" && override.signingPublicKey.trim()
+                    ? { signingPublicKey: override.signingPublicKey.trim() }
+                    : {}),
+            }
+            : null;
         // Changing auth identity requires token refresh.
         this.clearAuthCache();
         this.clearSharedAuthenticationState(previousUsername);
@@ -774,6 +814,13 @@ class ClientNetworkContentAddressedStore {
     getActiveSigningKey() {
         return this.syncAuthOverride?.signingKey ?? this.signingKey;
     }
+    getActiveSigningPublicKeyPem() {
+        const fromOverride = this.syncAuthOverride?.signingPublicKey;
+        if (typeof fromOverride === "string" && fromOverride.trim().length > 0) {
+            return fromOverride.trim();
+        }
+        return this.signingPublicKeyPem;
+    }
     getActivePrivateEncryptionKey() {
         return this.syncAuthOverride?.privateEncryptionKey ?? this.privateEncryptionKey;
     }