mindoodb 0.0.64 → 0.0.65

package/dist/core/peerdevices/PeerDeviceDocument.d.ts

@@ -0,0 +1,144 @@
+/**
+ * Peer-device records: how one device advertises its Iroh endpoint id to the
+ * other members of a tenant.
+ *
+ * A device publishes one `dev_<fingerprint>` document into `userdirectory`,
+ * encrypted with the tenant `default` key. That placement is deliberate:
+ *
+ * - **`userdirectory`, not `grantaccess`.** Every member already replicates
+ *   `userdirectory`, and a device can write its own record there without an
+ *   administrator approving anything.
+ * - **`default`, not `$publicinfos`.** The hoster holds the `$publicinfos`
+ *   key, and who talks to whom over Iroh is none of the hoster's business.
+ *   `default` keeps the record readable for every tenant member and opaque to
+ *   the server.
+ * - **`dev_` prefix.** That makes it a *personal document* (see
+ *   {@link PERSONAL_DOC_ID_PREFIXES}), so the write invariant lets its creator
+ *   — and only its creator — change and delete it.
+ *
+ * ## Why records must be verified on read
+ *
+ * Any tenant member can write a `dev_` document holding any endpoint id they
+ * like. The doc id and payload are therefore claims, not facts.
+ * {@link verifyPeerDeviceRecord} only accepts a record when all three hold:
+ *
+ * 1. the doc id is the fingerprint of the `signingPublicKey` in the payload,
+ * 2. the `doc_create` entry was signed by exactly that key, and
+ * 3. that key is an active (non-revoked) grant in the tenant.
+ *
+ * Together these mean a record can only be published by the device that owns
+ * the signing key it names, so nobody can put their own endpoint id under
+ * someone else's device.
+ *
+ * **Known v1 gap — id squatting.** A member can create `dev_<someone else's
+ * fingerprint>` before that device does. The squatted record fails step 2 and
+ * is discarded, so it cannot impersonate anyone; but the real device then
+ * cannot create its own record under that id and stays invisible to the
+ * picker. Detect it by the record being present yet unverifiable.
+ */
+import type { MindooDB, MindooDoc, SigningKeyPair } from "../types";
+export declare const PEER_DEVICE_DOC_ID_PREFIX = "dev_";
+export declare const PEER_DEVICE_FORM = "userdirectory";
+export declare const PEER_DEVICE_TYPE = "peerdevice";
+export declare const PEER_DEVICE_SCHEMA_VERSION = 1;
+/** Payload of a `dev_` document. Encrypted with {@link DEFAULT_TENANT_KEY_ID}. */
+export interface PeerDeviceDocumentPayload {
+    form: typeof PEER_DEVICE_FORM;
+    type: typeof PEER_DEVICE_TYPE;
+    schemaVersion: number;
+    /**
+     * 64-char lowercase hex Iroh endpoint id of this device. Peers dial this
+     * directly; the pkarr address lookup resolves the current relay, so the
+     * value stays valid when the device changes networks.
+     */
+    irohEndpointId: string;
+    /**
+     * Signing public key (PEM) of the device that owns this record. The whole
+     * verification chain hangs off this field.
+     */
+    signingPublicKey: string;
+    /** Human label shown in the peer picker, e.g. "Laptop (office)". */
+    label?: string;
+    updatedAt: number;
+}
+/** A record that passed {@link verifyPeerDeviceRecord}. */
+export interface PeerDeviceRecord {
+    docId: string;
+    irohEndpointId: string;
+    signingPublicKey: string;
+    /** Fingerprint of {@link signingPublicKey}, colon-separated hex. */
+    signingKeyFingerprint: string;
+    label?: string;
+    updatedAt: number;
+}
+/** The directory calls a peer-device record needs to verify a claim. */
+export interface PeerDeviceDirectory {
+    /** True when the key belongs to an active, non-revoked grant. */
+    validatePublicSigningKey(publicKey: string, opts?: {
+        forceRefresh?: boolean;
+    }): Promise<boolean>;
+}
+/**
+ * Deterministic document id for a device, derived from its signing key
+ * fingerprint.
+ *
+ * Deterministic so a device republishing after a reload updates its record
+ * instead of accumulating a new one per session. Colons are stripped because
+ * custom ids must match `^[a-z][a-z0-9_]*$` (`CUSTOM_DOC_ID_REGEX`).
+ */
+export declare function peerDeviceDocumentId(signingKeyFingerprint: string): string;
+export declare function isPeerDeviceDocId(docId: string): boolean;
+/**
+ * Publish (or refresh) this device's record.
+ *
+ * Idempotent: the id is derived from the device's own signing key, so calling
+ * this on every unlock keeps one record per device and updates the endpoint id
+ * and label in place.
+ *
+ * Note this does *not* pass `assumeUniqueId`. The id is deterministic rather
+ * than random, so two replicas creating it concurrently must share Automerge
+ * ancestry in order to converge instead of forking. That code path also
+ * forbids `initialValues`, which is why the payload is written with a
+ * follow-up `changeDoc` — the same call that refreshes an existing record.
+ */
+export declare function publishPeerDeviceRecord(input: {
+    db: MindooDB;
+    /** Signing public key (PEM) of this device — must match the signing identity writing the document. */
+    signingPublicKey: string;
+    irohEndpointId: string;
+    label?: string;
+    subtle: SubtleCrypto;
+    signingKeyPair?: SigningKeyPair;
+    signingKeyPassword?: string;
+}): Promise<MindooDoc>;
+/** Withdraw this device's record, e.g. when signing out of the tenant. */
+export declare function removePeerDeviceRecord(input: {
+    db: MindooDB;
+    signingPublicKey: string;
+    subtle: SubtleCrypto;
+}): Promise<void>;
+/**
+ * Check one record's claim. Returns the verified record, or `null` when any
+ * step of the chain described in the module docs fails.
+ */
+export declare function verifyPeerDeviceRecord(input: {
+    db: MindooDB;
+    directory: PeerDeviceDirectory;
+    doc: MindooDoc;
+    subtle: SubtleCrypto;
+}): Promise<PeerDeviceRecord | null>;
+/**
+ * Every verified peer-device record in this `userdirectory` replica.
+ *
+ * Requires the tenant `default` key to be unlocked; records that cannot be
+ * decrypted are simply absent. Unverifiable records are skipped silently —
+ * they are the expected shape of an attack, not an error to surface.
+ */
+export declare function listPeerDeviceRecords(input: {
+    db: MindooDB;
+    directory: PeerDeviceDirectory;
+    subtle: SubtleCrypto;
+    /** Endpoint id of the local device, excluded from the result. */
+    excludeEndpointId?: string;
+}): Promise<PeerDeviceRecord[]>;
+//# sourceMappingURL=PeerDeviceDocument.d.ts.map

package/dist/core/peerdevices/PeerDeviceDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PeerDeviceDocument.d.ts","sourceRoot":"","sources":["../../../src/core/peerdevices/PeerDeviceDocument.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAGpE,eAAO,MAAM,yBAAyB,SAAS,CAAC;AAChD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAChD,eAAO,MAAM,gBAAgB,eAAe,CAAC;AAC7C,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C,kFAAkF;AAClF,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,gBAAgB,CAAC;IAC9B,IAAI,EAAE,OAAO,gBAAgB,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2DAA2D;AAC3D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oEAAoE;IACpE,qBAAqB,EAAE,MAAM,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAClG;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,qBAAqB,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,EAAE,EAAE,QAAQ,CAAC;IACb,sGAAsG;IACtG,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;IACrB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAAC,SAAS,CAAC,CAwCrB;AAED,0EAA0E;AAC1E,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,EAAE,EAAE,QAAQ,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,YAAY,CAAC;CACtB,GAAG,OAAO,CAAC,IAAI,CAAC,CAMhB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,YAAY,CAAC;CACtB,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqCnC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,EAAE,EAAE,QAAQ,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,iEAAiE;IACjE,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAuB9B"}

package/dist/core/peerdevices/PeerDeviceDocument.js

@@ -0,0 +1,209 @@
+"use strict";
+/**
+ * Peer-device records: how one device advertises its Iroh endpoint id to the
+ * other members of a tenant.
+ *
+ * A device publishes one `dev_<fingerprint>` document into `userdirectory`,
+ * encrypted with the tenant `default` key. That placement is deliberate:
+ *
+ * - **`userdirectory`, not `grantaccess`.** Every member already replicates
+ *   `userdirectory`, and a device can write its own record there without an
+ *   administrator approving anything.
+ * - **`default`, not `$publicinfos`.** The hoster holds the `$publicinfos`
+ *   key, and who talks to whom over Iroh is none of the hoster's business.
+ *   `default` keeps the record readable for every tenant member and opaque to
+ *   the server.
+ * - **`dev_` prefix.** That makes it a *personal document* (see
+ *   {@link PERSONAL_DOC_ID_PREFIXES}), so the write invariant lets its creator
+ *   — and only its creator — change and delete it.
+ *
+ * ## Why records must be verified on read
+ *
+ * Any tenant member can write a `dev_` document holding any endpoint id they
+ * like. The doc id and payload are therefore claims, not facts.
+ * {@link verifyPeerDeviceRecord} only accepts a record when all three hold:
+ *
+ * 1. the doc id is the fingerprint of the `signingPublicKey` in the payload,
+ * 2. the `doc_create` entry was signed by exactly that key, and
+ * 3. that key is an active (non-revoked) grant in the tenant.
+ *
+ * Together these mean a record can only be published by the device that owns
+ * the signing key it names, so nobody can put their own endpoint id under
+ * someone else's device.
+ *
+ * **Known v1 gap — id squatting.** A member can create `dev_<someone else's
+ * fingerprint>` before that device does. The squatted record fails step 2 and
+ * is discarded, so it cannot impersonate anyone; but the real device then
+ * cannot create its own record under that id and stays invisible to the
+ * picker. Detect it by the record being present yet unverifiable.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PEER_DEVICE_SCHEMA_VERSION = exports.PEER_DEVICE_TYPE = exports.PEER_DEVICE_FORM = exports.PEER_DEVICE_DOC_ID_PREFIX = void 0;
+exports.peerDeviceDocumentId = peerDeviceDocumentId;
+exports.isPeerDeviceDocId = isPeerDeviceDocId;
+exports.publishPeerDeviceRecord = publishPeerDeviceRecord;
+exports.removePeerDeviceRecord = removePeerDeviceRecord;
+exports.verifyPeerDeviceRecord = verifyPeerDeviceRecord;
+exports.listPeerDeviceRecords = listPeerDeviceRecords;
+const types_1 = require("../types");
+const fingerprint_1 = require("../userkeys/fingerprint");
+exports.PEER_DEVICE_DOC_ID_PREFIX = "dev_";
+exports.PEER_DEVICE_FORM = "userdirectory";
+exports.PEER_DEVICE_TYPE = "peerdevice";
+exports.PEER_DEVICE_SCHEMA_VERSION = 1;
+/**
+ * Deterministic document id for a device, derived from its signing key
+ * fingerprint.
+ *
+ * Deterministic so a device republishing after a reload updates its record
+ * instead of accumulating a new one per session. Colons are stripped because
+ * custom ids must match `^[a-z][a-z0-9_]*$` (`CUSTOM_DOC_ID_REGEX`).
+ */
+function peerDeviceDocumentId(signingKeyFingerprint) {
+    return `${exports.PEER_DEVICE_DOC_ID_PREFIX}${signingKeyFingerprint.replace(/:/g, "").toLowerCase()}`;
+}
+function isPeerDeviceDocId(docId) {
+    return docId.startsWith(exports.PEER_DEVICE_DOC_ID_PREFIX);
+}
+/**
+ * Publish (or refresh) this device's record.
+ *
+ * Idempotent: the id is derived from the device's own signing key, so calling
+ * this on every unlock keeps one record per device and updates the endpoint id
+ * and label in place.
+ *
+ * Note this does *not* pass `assumeUniqueId`. The id is deterministic rather
+ * than random, so two replicas creating it concurrently must share Automerge
+ * ancestry in order to converge instead of forking. That code path also
+ * forbids `initialValues`, which is why the payload is written with a
+ * follow-up `changeDoc` — the same call that refreshes an existing record.
+ */
+async function publishPeerDeviceRecord(input) {
+    const fingerprint = await (0, fingerprint_1.fingerprintPublicKeyPem)(input.signingPublicKey, input.subtle);
+    const docId = peerDeviceDocumentId(fingerprint);
+    const doc = (await input.db.getDocument(docId).catch(() => null)) ??
+        (await input.db.createDocument({
+            id: docId,
+            decryptionKeyId: types_1.DEFAULT_TENANT_KEY_ID,
+            signingKeyPair: input.signingKeyPair,
+            signingKeyPassword: input.signingKeyPassword,
+        }));
+    const label = input.label ?? "";
+    const current = doc.getData();
+    const unchanged = current.type === exports.PEER_DEVICE_TYPE &&
+        current.schemaVersion === exports.PEER_DEVICE_SCHEMA_VERSION &&
+        current.irohEndpointId === input.irohEndpointId &&
+        current.signingPublicKey === input.signingPublicKey &&
+        (current.label ?? "") === label;
+    // Callers republish on every unlock and after every `userdirectory` sync.
+    // Rewriting `updatedAt` unconditionally would append an entry each time,
+    // and since that entry syncs and triggers the next refresh, the two halves
+    // would keep feeding each other. Only a real change is worth a write.
+    if (unchanged) {
+        return doc;
+    }
+    await input.db.changeDoc(doc, (editable) => {
+        const data = editable.getData();
+        data.form = exports.PEER_DEVICE_FORM;
+        data.type = exports.PEER_DEVICE_TYPE;
+        data.schemaVersion = exports.PEER_DEVICE_SCHEMA_VERSION;
+        data.irohEndpointId = input.irohEndpointId;
+        data.signingPublicKey = input.signingPublicKey;
+        data.label = label;
+        data.updatedAt = Date.now();
+    });
+    return doc;
+}
+/** Withdraw this device's record, e.g. when signing out of the tenant. */
+async function removePeerDeviceRecord(input) {
+    const fingerprint = await (0, fingerprint_1.fingerprintPublicKeyPem)(input.signingPublicKey, input.subtle);
+    const docId = peerDeviceDocumentId(fingerprint);
+    await input.db.deleteDocument(docId).catch(() => {
+        // Already gone, or never published from this device.
+    });
+}
+/**
+ * Check one record's claim. Returns the verified record, or `null` when any
+ * step of the chain described in the module docs fails.
+ */
+async function verifyPeerDeviceRecord(input) {
+    const docId = input.doc.getId();
+    const data = input.doc.getData();
+    const signingPublicKey = typeof data.signingPublicKey === "string" ? data.signingPublicKey : "";
+    const irohEndpointId = typeof data.irohEndpointId === "string" ? data.irohEndpointId.trim().toLowerCase() : "";
+    if (data.type !== exports.PEER_DEVICE_TYPE || !signingPublicKey || !/^[0-9a-f]{64}$/.test(irohEndpointId)) {
+        return null;
+    }
+    // 1. The id must be the fingerprint of the key the payload names, so a
+    //    record cannot sit under a device id it does not belong to.
+    const fingerprint = await (0, fingerprint_1.fingerprintPublicKeyPem)(signingPublicKey, input.subtle);
+    if (peerDeviceDocumentId(fingerprint) !== docId) {
+        return null;
+    }
+    // 2. That key must be the one that actually created the document. Without
+    //    this, any member could publish a record naming someone else's key.
+    const creatorKey = await resolveCreateSigner(input.db, docId);
+    if (!creatorKey || normalizePem(creatorKey) !== normalizePem(signingPublicKey)) {
+        return null;
+    }
+    // 3. And it must still be a live grant, so revoked devices drop out.
+    if (!(await input.directory.validatePublicSigningKey(signingPublicKey).catch(() => false))) {
+        return null;
+    }
+    return {
+        docId,
+        irohEndpointId,
+        signingPublicKey,
+        signingKeyFingerprint: fingerprint,
+        label: typeof data.label === "string" && data.label ? data.label : undefined,
+        updatedAt: typeof data.updatedAt === "number" ? data.updatedAt : 0,
+    };
+}
+/**
+ * Every verified peer-device record in this `userdirectory` replica.
+ *
+ * Requires the tenant `default` key to be unlocked; records that cannot be
+ * decrypted are simply absent. Unverifiable records are skipped silently —
+ * they are the expected shape of an attack, not an error to surface.
+ */
+async function listPeerDeviceRecords(input) {
+    // `idPrefix` matching is boundary-aware: "dev" matches `dev_…`, not `device…`.
+    const docIds = await input.db.getAllDocumentIds({ idPrefix: "dev" });
+    const records = [];
+    for (const docId of docIds) {
+        if (!isPeerDeviceDocId(docId)) {
+            continue;
+        }
+        const doc = await input.db.getDocument(docId).catch(() => null);
+        if (!doc) {
+            continue;
+        }
+        const record = await verifyPeerDeviceRecord({
+            db: input.db,
+            directory: input.directory,
+            doc,
+            subtle: input.subtle,
+        });
+        if (record && record.irohEndpointId !== input.excludeEndpointId) {
+            records.push(record);
+        }
+    }
+    return records;
+}
+/** Signing key that wrote the `doc_create` entry, or null when it is not here yet. */
+async function resolveCreateSigner(db, docId) {
+    try {
+        // History is ordered causally, so `doc_create` is on the first page.
+        const page = await db.getDocumentHistoryPage(docId, { limit: 10 });
+        const create = page.entries.find((entry) => entry.entryType === "doc_create");
+        return create?.changeCreatedByPublicKey ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/** PEM formatting varies by transport; compare the key material, not the wrapping. */
+function normalizePem(pem) {
+    return pem.replace(/\s+/g, "");
+}
+//# sourceMappingURL=PeerDeviceDocument.js.map

package/dist/core/peerdevices/PeerDeviceDocument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PeerDeviceDocument.js","sourceRoot":"","sources":["../../../src/core/peerdevices/PeerDeviceDocument.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;;;AAyDH,oDAEC;AAED,8CAEC;AAeD,0DAiDC;AAGD,wDAUC;AAMD,wDA0CC;AASD,sDA6BC;AAhOD,oCAAiD;AAEjD,yDAAkE;AAErD,QAAA,yBAAyB,GAAG,MAAM,CAAC;AACnC,QAAA,gBAAgB,GAAG,eAAe,CAAC;AACnC,QAAA,gBAAgB,GAAG,YAAY,CAAC;AAChC,QAAA,0BAA0B,GAAG,CAAC,CAAC;AAwC5C;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAAC,qBAA6B;IAChE,OAAO,GAAG,iCAAyB,GAAG,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAChG,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAa;IAC7C,OAAO,KAAK,CAAC,UAAU,CAAC,iCAAyB,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,uBAAuB,CAAC,KAS7C;IACC,MAAM,WAAW,GAAG,MAAM,IAAA,qCAAuB,EAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,GACP,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC;YAC7B,EAAE,EAAE,KAAK;YACT,eAAe,EAAE,6BAAqB;YACtC,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;SAC7C,CAAC,CAAC,CAAC;IAEN,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAmD,CAAC;IAC/E,MAAM,SAAS,GACb,OAAO,CAAC,IAAI,KAAK,wBAAgB;QACjC,OAAO,CAAC,aAAa,KAAK,kCAA0B;QACpD,OAAO,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc;QAC/C,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB;QACnD,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC;IAElC,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,sEAAsE;IACtE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAwC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,wBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,wBAAgB,CAAC;QAC7B,IAAI,CAAC,aAAa,GAAG,kCAA0B,CAAC;QAChD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,gBAAgB,CAAC;QAC/C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AACnE,KAAK,UAAU,sBAAsB,CAAC,KAI5C;IACC,MAAM,WAAW,GAAG,MAAM,IAAA,qCAAuB,EAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;QAC9C,qDAAqD;IACvD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,sBAAsB,CAAC,KAK5C;IACC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAmD,CAAC;IAClF,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IAChG,MAAM,cAAc,GAClB,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAgB,IAAI,CAAC,gBAAgB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,WAAW,GAAG,MAAM,IAAA,qCAAuB,EAAC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAClF,IAAI,oBAAoB,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC,KAAK,YAAY,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qEAAqE;IACrE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,KAAK;QACL,cAAc;QACd,gBAAgB;QAChB,qBAAqB,EAAE,WAAW;QAClC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC5E,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;KACnE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,qBAAqB,CAAC,KAM3C;IACC,+EAA+E;IAC/E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC;YAC1C,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QACH,IAAI,MAAM,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,mBAAmB,CAAC,EAAY,EAAE,KAAa;IAC5D,IAAI,CAAC;QACH,qEAAqE;QACrE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,sBAAsB,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,YAAY,CAAC,CAAC;QAC9E,OAAO,MAAM,EAAE,wBAAwB,IAAI,IAAI,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC"}

package/dist/core/types.d.ts

@@ -4821,6 +4821,21 @@ export interface MindooDB {
      * @return A promise that resolves when the sync is complete.
      */
     syncStoreChanges(): Promise<void>;
+    /**
+     * Would the builtin `directory` / `userdirectory` invariant forbid this
+     * entry? For callers that accept entries from somewhere other than a server
+     * — a peer sync — and therefore have to apply the admin/owner rules
+     * themselves before storing anything.
+     *
+     * Deliberately the same check the load path uses, so an entry admitted on
+     * this answer is one that will also materialize. Returns false for databases
+     * without a builtin invariant, so it can be asked unconditionally.
+     */
+    violatesBuiltinWriteInvariant(entry: {
+        entryType?: string;
+        createdByPublicKey: string;
+        docId?: string;
+    }): Promise<boolean>;
     /**
      * Reconcile local document visibility with the current tenant KeyBag.
      *