mindoodb 0.0.84 → 0.0.86

package/dist/server/CapabilityMatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityMatcher.d.ts","sourceRoot":"","sources":["../../src/server/CapabilityMatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAwB,MAAM,SAAS,CAAC;AASlE,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAe;gBAEhB,MAAM,EAAE,YAAY;IAKhC;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAKlC,OAAO,CAAC,WAAW;IAUnB;;;;OAIG;IACH,YAAY,CACV,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,GACpB,OAAO;IA2BV;;;OAGG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAuBjE,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,gBAAgB;IA0BxB,OAAO,CAAC,oBAAoB;IAI5B,OAAO,CAAC,uBAAuB;IAI/B;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IAInC;;;OAGG;IACH,OAAO,CAAC,WAAW;CAoBpB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGrE"}

package/dist/server/CapabilityMatcher.js

@@ -0,0 +1,138 @@
+"use strict";
+/**
+ * Capability matching engine for system admin authorization.
+ *
+ * Parses `METHOD:PATHPATTERN` rules from config.json and checks whether
+ * a given (method, path, username, publicsignkey) tuple is authorized.
+ *
+ * Matching semantics:
+ * - Rule method `ALL` matches any HTTP method.
+ * - Path patterns use `*` as a wildcard that matches any remaining characters.
+ * - All matching rules are unioned; access is granted if *any* matching rule
+ *   lists a principal with both the correct username AND publicsignkey.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CapabilityMatcher = void 0;
+exports.parseSystemTenantItemPath = parseSystemTenantItemPath;
+const serverConfig_1 = require("./serverConfig");
+class CapabilityMatcher {
+    constructor(config) {
+        this.rules = [];
+        this.parseConfig(config);
+    }
+    /**
+     * Hot-swap the internal rules from a new config.
+     * Existing authorization decisions in-flight are unaffected;
+     * subsequent calls to `isAuthorized` / `principalExists` use the new rules.
+     */
+    reload(config) {
+        this.rules = [];
+        this.parseConfig(config);
+    }
+    parseConfig(config) {
+        for (const [ruleKey, principals] of Object.entries(config.capabilities)) {
+            const colonIdx = ruleKey.indexOf(":");
+            const method = ruleKey.substring(0, colonIdx).toUpperCase();
+            const pathPattern = ruleKey.substring(colonIdx + 1);
+            this.rules.push({ method, pathPattern, principals });
+        }
+    }
+    /**
+     * Check whether a request is authorized.
+     *
+     * @returns `true` if any matching capability rule lists the given principal.
+     */
+    isAuthorized(httpMethod, httpPath, username, publicsignkey) {
+        const method = httpMethod.toUpperCase();
+        const normalizedUsername = username.toLowerCase();
+        for (const rule of this.rules) {
+            if (!this.methodMatches(rule.method, method))
+                continue;
+            if (!this.pathMatches(rule.pathPattern, httpPath))
+                continue;
+            for (const principal of rule.principals) {
+                if (this.principalMatches(rule, method, httpPath, principal, normalizedUsername, publicsignkey)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    /**
+     * Check whether a principal exists in *any* capability rule.
+     * Used during challenge generation to reject unknown principals early.
+     */
+    principalExists(username, publicsignkey) {
+        const normalizedUsername = username.toLowerCase();
+        for (const rule of this.rules) {
+            for (const principal of rule.principals) {
+                if (this.principalMatches(rule, rule.method, rule.pathPattern, principal, normalizedUsername, publicsignkey)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    methodMatches(ruleMethod, requestMethod) {
+        return ruleMethod === "ALL" || ruleMethod === requestMethod;
+    }
+    principalMatches(rule, requestMethod, requestPath, principal, normalizedUsername, publicsignkey) {
+        if (principal.username.toLowerCase() === normalizedUsername &&
+            principal.publicsignkey === publicsignkey) {
+            return true;
+        }
+        if ((0, serverConfig_1.isWildcardSystemAdminPrincipal)(principal) &&
+            this.isTenantCreationRule(rule.method, rule.pathPattern) &&
+            this.isTenantCreationRequest(requestMethod, requestPath)) {
+            return true;
+        }
+        return false;
+    }
+    isTenantCreationRule(method, pathPattern) {
+        return method === "POST" && CapabilityMatcher.isTenantCreationPath(pathPattern);
+    }
+    isTenantCreationRequest(method, path) {
+        return method === "POST" && CapabilityMatcher.isTenantCreationPath(path);
+    }
+    /**
+     * Tenant creation targets exactly one path segment under `/system/tenants/`
+     * (the new tenant id) — e.g. `/system/tenants/acme`. A prefix (`startsWith`)
+     * test over-grants the wildcard tenant-creation principal to sub-resources of
+     * an *existing* tenant, e.g. any future `/system/tenants/acme/<sub>` route
+     * (audit #6). Require a segment-exact
+     * match so the wildcard authorizes creation only. A trailing slash is allowed
+     * but no further path segment.
+     */
+    static isTenantCreationPath(path) {
+        return parseSystemTenantItemPath(path) !== null;
+    }
+    /**
+     * Match a path pattern against a request path.
+     * `*` matches any remaining characters (greedy).
+     */
+    pathMatches(pattern, requestPath) {
+        const starIdx = pattern.indexOf("*");
+        if (starIdx === -1) {
+            return pattern === requestPath;
+        }
+        const prefix = pattern.substring(0, starIdx);
+        const suffix = pattern.substring(starIdx + 1);
+        if (!requestPath.startsWith(prefix)) {
+            return false;
+        }
+        if (suffix.length === 0) {
+            return true;
+        }
+        return requestPath.endsWith(suffix);
+    }
+}
+exports.CapabilityMatcher = CapabilityMatcher;
+/**
+ * Parse `/system/tenants/:tenantId` (optional trailing slash, no sub-resource).
+ * Returns the tenant id segment or `null`.
+ */
+function parseSystemTenantItemPath(path) {
+    const match = /^\/system\/tenants\/([^/]+)\/?$/.exec(path);
+    return match ? match[1] : null;
+}
+//# sourceMappingURL=CapabilityMatcher.js.map

package/dist/server/CapabilityMatcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CapabilityMatcher.js","sourceRoot":"","sources":["../../src/server/CapabilityMatcher.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAwLH,8DAGC;AAxLD,iDAAgE;AAQhE,MAAa,iBAAiB;IAG5B,YAAY,MAAoB;QAC9B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAoB;QACzB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAEO,WAAW,CAAC,MAAoB;QACtC,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;YAEpD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,YAAY,CACV,UAAkB,EAClB,QAAgB,EAChB,QAAgB,EAChB,aAAqB;QAErB,MAAM,MAAM,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACxC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;gBAAE,SAAS;YACvD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC;gBAAE,SAAS;YAE5D,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,QAAgB,EAAE,aAAqB;QACrD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACxC,IACE,IAAI,CAAC,gBAAgB,CACnB,IAAI,EACJ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,WAAW,EAChB,SAAS,EACT,kBAAkB,EAClB,aAAa,CACd,EACD,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,UAAkB,EAAE,aAAqB;QAC7D,OAAO,UAAU,KAAK,KAAK,IAAI,UAAU,KAAK,aAAa,CAAC;IAC9D,CAAC;IAEO,gBAAgB,CACtB,IAAgB,EAChB,aAAqB,EACrB,WAAmB,EACnB,SAA+B,EAC/B,kBAA0B,EAC1B,aAAqB;QAErB,IACE,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,kBAAkB;YACvD,SAAS,CAAC,aAAa,KAAK,aAAa,EACzC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,IAAA,6CAA8B,EAAC,SAAS,CAAC;YACzC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC;YACxD,IAAI,CAAC,uBAAuB,CAAC,aAAa,EAAE,WAAW,CAAC,EACxD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,MAAc,EAAE,WAAmB;QAC9D,OAAO,MAAM,KAAK,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAClF,CAAC;IAEO,uBAAuB,CAAC,MAAc,EAAE,IAAY;QAC1D,OAAO,MAAM,KAAK,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,oBAAoB,CAAC,IAAY;QAC9C,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAClD,CAAC;IAED;;;OAGG;IACK,WAAW,CAAC,OAAe,EAAE,WAAmB;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAErC,IAAI,OAAO,KAAK,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,OAAO,KAAK,WAAW,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAE9C,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;CACF;AAvKD,8CAuKC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CAAC,IAAY;IACpD,MAAM,KAAK,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/server/DeviceDiscoveryService.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Server-wide device discovery: prove possession of a device signing key,
+ * then scan all tenants for an active grant and deliver RSA-wrapped
+ * `$publicinfos` plus admin public keys and the per-device join bootstrap —
+ * no join-response URI required.
+ */
+import type { CryptoAdapter } from "../core/crypto/CryptoAdapter";
+import type { DeviceTenantDelivery } from "../core/types";
+import type { TenantManager } from "./TenantManager";
+export type { DeviceTenantDelivery };
+export interface DeviceDiscoverResult {
+    tenants: DeviceTenantDelivery[];
+}
+export declare class DeviceDiscoveryAuthError extends Error {
+    constructor(message: string);
+}
+export declare class DeviceDiscoveryService {
+    private readonly tenantManager;
+    private readonly cryptoAdapter;
+    private challenges;
+    constructor(tenantManager: TenantManager, cryptoAdapter: CryptoAdapter);
+    /**
+     * Issue a short-lived, single-use challenge bound to `signingPublicKey`.
+     * Does not require the key to be on any tenant yet (discovery finds that).
+     */
+    createChallenge(signingPublicKey: string): string;
+    /**
+     * Verify the Ed25519 signature over the challenge, then scan every local
+     * tenant for an active grant containing this signing key. Matching tenants
+     * receive a delivery with RSA-wrapped `$publicinfos` (parallelized).
+     */
+    discover(challenge: string, signature: Uint8Array): Promise<DeviceDiscoverResult>;
+    private verifySignature;
+    private cleanup;
+}
+//# sourceMappingURL=DeviceDiscoveryService.d.ts.map

package/dist/server/DeviceDiscoveryService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceDiscoveryService.d.ts","sourceRoot":"","sources":["../../src/server/DeviceDiscoveryService.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAarD,YAAY,EAAE,oBAAoB,EAAE,CAAC;AAErC,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,sBAAsB;IAI/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,OAAO,CAAC,UAAU,CAAsC;gBAGrC,aAAa,EAAE,aAAa,EAC5B,aAAa,EAAE,aAAa;IAG/C;;;OAGG;IACH,eAAe,CAAC,gBAAgB,EAAE,MAAM,GAAG,MAAM;IAkBjD;;;;OAIG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC;YA0GzE,eAAe;IAkC7B,OAAO,CAAC,OAAO;CAahB"}

package/dist/server/DeviceDiscoveryService.js

@@ -0,0 +1,165 @@
+"use strict";
+/**
+ * Server-wide device discovery: prove possession of a device signing key,
+ * then scan all tenants for an active grant and deliver RSA-wrapped
+ * `$publicinfos` plus admin public keys and the per-device join bootstrap —
+ * no join-response URI required.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceDiscoveryService = exports.DeviceDiscoveryAuthError = void 0;
+const idGeneration_1 = require("../core/utils/idGeneration");
+const RSAEncryption_1 = require("../core/crypto/RSAEncryption");
+const CHALLENGE_TTL_MS = 5 * 60 * 1000;
+const MAX_CHALLENGES = 10000;
+class DeviceDiscoveryAuthError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DeviceDiscoveryAuthError";
+    }
+}
+exports.DeviceDiscoveryAuthError = DeviceDiscoveryAuthError;
+class DeviceDiscoveryService {
+    constructor(tenantManager, cryptoAdapter) {
+        this.tenantManager = tenantManager;
+        this.cryptoAdapter = cryptoAdapter;
+        this.challenges = new Map();
+    }
+    /**
+     * Issue a short-lived, single-use challenge bound to `signingPublicKey`.
+     * Does not require the key to be on any tenant yet (discovery finds that).
+     */
+    createChallenge(signingPublicKey) {
+        const trimmed = signingPublicKey.trim();
+        if (!trimmed) {
+            throw new Error("signingPublicKey is required");
+        }
+        const challenge = (0, idGeneration_1.generateRandomUuid)();
+        const now = Date.now();
+        this.challenges.set(challenge, {
+            challenge,
+            signingPublicKey: trimmed,
+            createdAt: now,
+            expiresAt: now + CHALLENGE_TTL_MS,
+            used: false,
+        });
+        this.cleanup();
+        return challenge;
+    }
+    /**
+     * Verify the Ed25519 signature over the challenge, then scan every local
+     * tenant for an active grant containing this signing key. Matching tenants
+     * receive a delivery with RSA-wrapped `$publicinfos` (parallelized).
+     */
+    async discover(challenge, signature) {
+        const authChallenge = this.challenges.get(challenge);
+        if (!authChallenge) {
+            throw new DeviceDiscoveryAuthError("Challenge not found or expired");
+        }
+        if (Date.now() > authChallenge.expiresAt) {
+            this.challenges.delete(challenge);
+            throw new DeviceDiscoveryAuthError("Challenge expired");
+        }
+        if (authChallenge.used) {
+            throw new DeviceDiscoveryAuthError("Challenge already used");
+        }
+        authChallenge.used = true;
+        const ok = await this.verifySignature(challenge, signature, authChallenge.signingPublicKey);
+        if (!ok) {
+            throw new DeviceDiscoveryAuthError("Invalid signature");
+        }
+        const signingPublicKey = authChallenge.signingPublicKey;
+        const tenantIds = this.tenantManager.listTenants();
+        const matches = [];
+        for (const tenantId of tenantIds) {
+            try {
+                const loaded = await this.tenantManager.getTenant(tenantId);
+                const lookup = await loaded.directory.getUserBySigningPublicKey(signingPublicKey);
+                if (!lookup?.encryptionPublicKey)
+                    continue;
+                matches.push({
+                    tenantId,
+                    adminSigningPublicKey: loaded.context.config.adminSigningPublicKey,
+                    adminEncryptionPublicKey: loaded.context.config.adminEncryptionPublicKey,
+                    encryptionPublicKey: lookup.encryptionPublicKey,
+                    username_hash: typeof lookup.username === "string" && /^[a-f0-9]{64}$/i.test(lookup.username)
+                        ? lookup.username
+                        : undefined,
+                    identity_hashes: lookup.identityHashes,
+                    joinResponseWrapped: typeof lookup.joinResponseWrapped === "string" && lookup.joinResponseWrapped.trim()
+                        ? lookup.joinResponseWrapped.trim()
+                        : undefined,
+                });
+            }
+            catch {
+                // Tenant missing directory / not loadable — skip.
+            }
+        }
+        if (matches.length === 0) {
+            return { tenants: [] };
+        }
+        const rsa = new RSAEncryption_1.RSAEncryption(this.cryptoAdapter);
+        const deliveries = await Promise.all(matches.map(async (match) => {
+            try {
+                const keys = await this.tenantManager.getPublicInfosKeysForTenant(match.tenantId);
+                if (!keys.length)
+                    return null;
+                const wrappedPublicInfosKeys = await Promise.all(keys.map((rawKey) => rsa.wrapKeyToBase64(rawKey, match.encryptionPublicKey)));
+                // getAllKeys is newest-first; keep wrappedPublicInfosKey as the current generation.
+                const wrappedPublicInfosKey = wrappedPublicInfosKeys[0];
+                console.log(`[DeviceDiscovery] Wrapped ${wrappedPublicInfosKeys.length} $publicinfos version(s) for tenant ${match.tenantId}`);
+                return {
+                    tenantId: match.tenantId,
+                    adminSigningPublicKey: match.adminSigningPublicKey,
+                    adminEncryptionPublicKey: match.adminEncryptionPublicKey,
+                    wrappedPublicInfosKey,
+                    ...(wrappedPublicInfosKeys.length > 1
+                        ? { wrappedPublicInfosKeys }
+                        : {}),
+                    ...(match.joinResponseWrapped
+                        ? { wrappedJoinResponse: match.joinResponseWrapped }
+                        : {}),
+                    ...(match.username_hash ? { username_hash: match.username_hash } : {}),
+                    ...(match.identity_hashes?.length
+                        ? { identity_hashes: match.identity_hashes }
+                        : {}),
+                };
+            }
+            catch {
+                return null;
+            }
+        }));
+        return { tenants: deliveries.filter((d) => d !== null) };
+    }
+    async verifySignature(challenge, signature, publicKeyPem) {
+        try {
+            const subtle = this.cryptoAdapter.getSubtle();
+            const pemContents = publicKeyPem
+                .replace(/-----BEGIN PUBLIC KEY-----/g, "")
+                .replace(/-----END PUBLIC KEY-----/g, "")
+                .replace(/\s/g, "");
+            const binaryDer = Uint8Array.from(atob(pemContents), (c) => c.charCodeAt(0));
+            const key = await subtle.importKey("spki", binaryDer.buffer, { name: "Ed25519" }, false, ["verify"]);
+            const data = new TextEncoder().encode(challenge);
+            return await subtle.verify("Ed25519", key, signature.buffer.slice(signature.byteOffset, signature.byteOffset + signature.byteLength), data.buffer);
+        }
+        catch {
+            return false;
+        }
+    }
+    cleanup() {
+        const now = Date.now();
+        for (const [id, entry] of this.challenges) {
+            if (entry.used || entry.expiresAt <= now) {
+                this.challenges.delete(id);
+            }
+        }
+        while (this.challenges.size > MAX_CHALLENGES) {
+            const oldest = this.challenges.keys().next().value;
+            if (oldest === undefined)
+                break;
+            this.challenges.delete(oldest);
+        }
+    }
+}
+exports.DeviceDiscoveryService = DeviceDiscoveryService;
+//# sourceMappingURL=DeviceDiscoveryService.js.map

package/dist/server/DeviceDiscoveryService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeviceDiscoveryService.js","sourceRoot":"","sources":["../../src/server/DeviceDiscoveryService.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,6DAAgE;AAEhE,gEAA6D;AAI7D,MAAM,gBAAgB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,cAAc,GAAG,KAAM,CAAC;AAgB9B,MAAa,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AALD,4DAKC;AAED,MAAa,sBAAsB;IAGjC,YACmB,aAA4B,EAC5B,aAA4B;QAD5B,kBAAa,GAAb,aAAa,CAAe;QAC5B,kBAAa,GAAb,aAAa,CAAe;QAJvC,eAAU,GAAG,IAAI,GAAG,EAA2B,CAAC;IAKrD,CAAC;IAEJ;;;OAGG;IACH,eAAe,CAAC,gBAAwB;QACtC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,SAAS,GAAG,IAAA,iCAAkB,GAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE;YAC7B,SAAS;YACT,gBAAgB,EAAE,OAAO;YACzB,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG,GAAG,gBAAgB;YACjC,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,SAAqB;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,wBAAwB,CAAC,gCAAgC,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,wBAAwB,CAAC,wBAAwB,CAAC,CAAC;QAC/D,CAAC;QACD,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC;QAE1B,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CACnC,SAAS,EACT,SAAS,EACT,aAAa,CAAC,gBAAgB,CAC/B,CAAC;QACF,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,wBAAwB,CAAC,mBAAmB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,gBAAgB,GAAG,aAAa,CAAC,gBAAgB,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAWnD,MAAM,OAAO,GAAY,EAAE,CAAC;QAE5B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC5D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAC,gBAAgB,CAAC,CAAC;gBAClF,IAAI,CAAC,MAAM,EAAE,mBAAmB;oBAAE,SAAS;gBAE3C,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB;oBAClE,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB;oBACxE,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;oBAC/C,aAAa,EACX,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;wBAC5E,CAAC,CAAC,MAAM,CAAC,QAAQ;wBACjB,CAAC,CAAC,SAAS;oBACf,eAAe,EAAE,MAAM,CAAC,cAAc;oBACtC,mBAAmB,EACjB,OAAO,MAAM,CAAC,mBAAmB,KAAK,QAAQ,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;wBACjF,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;wBACnC,CAAC,CAAC,SAAS;iBAChB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACzB,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,6BAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAwC,EAAE;YAChE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,2BAA2B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAClF,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,OAAO,IAAI,CAAC;gBAC9B,MAAM,sBAAsB,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9C,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAC7E,CAAC;gBACF,oFAAoF;gBACpF,MAAM,qBAAqB,GAAG,sBAAsB,CAAC,CAAC,CAAE,CAAC;gBACzD,OAAO,CAAC,GAAG,CACT,6BAA6B,sBAAsB,CAAC,MAAM,uCAAuC,KAAK,CAAC,QAAQ,EAAE,CAClH,CAAC;gBACF,OAAO;oBACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;oBAClD,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;oBACxD,qBAAqB;oBACrB,GAAG,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC;wBACnC,CAAC,CAAC,EAAE,sBAAsB,EAAE;wBAC5B,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,mBAAmB;wBAC3B,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,EAAE;wBACpD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM;wBAC/B,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CACH,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAA6B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;IACtF,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,SAAiB,EACjB,SAAqB,EACrB,YAAoB;QAEpB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,YAAY;iBAC7B,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;iBAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;iBACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtB,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,MAAM,EACN,SAAS,CAAC,MAAqB,EAC/B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,OAAO,MAAM,MAAM,CAAC,MAAM,CACxB,SAAS,EACT,GAAG,EACH,SAAS,CAAC,MAAM,CAAC,KAAK,CACpB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAC7B,EAChB,IAAI,CAAC,MAAqB,CAC3B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBACzC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACnD,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;CACF;AA5LD,wDA4LC"}

package/dist/server/PurgedDocRegistry.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Per-tenant persistent record of executed document-history purges.
+ *
+ * Server-side purge execution (docs/accesscontrol.md §13) physically deletes a
+ * document's history from the tenant's on-disk stores. Because
+ * {@link ContentAddressedStore.purgeDocHistory} leaves no tombstone, a stale
+ * client that has not yet reconciled could re-push the very entries that were
+ * just purged and the server would re-accept them. This registry is the churn
+ * guard: it remembers which `purgeRequestDocId`s have already been executed (so
+ * we never purge twice) and which `docId`s were purged per database (so the sync
+ * push path can reject any re-upload of a purged document).
+ *
+ * Stored under `<tenantId>/purged-docs.json` in the server data store (a file
+ * below the data directory on Node).
+ */
+import type { ServerDataStore } from "./ServerDataStore";
+export declare class PurgedDocRegistry {
+    private readonly dataStore;
+    private readonly key;
+    private processedRequestDocIds;
+    private purgedDocIds;
+    private loaded;
+    constructor(dataStore: ServerDataStore, key: string);
+    private ensureLoaded;
+    private save;
+    /** True when this purge request was already executed. */
+    isRequestProcessed(purgeRequestDocId: string): boolean;
+    /** Record that a document was purged from a database (re-push denylist). */
+    recordPurgedDoc(dbId: string, docId: string): void;
+    /** Mark a purge request as executed and persist the registry. */
+    markRequestProcessed(purgeRequestDocId: string): void;
+    /** The set of purged docIds for a database (live; used by the push reject path). */
+    getPurgedDocIds(dbId: string): Set<string>;
+}
+//# sourceMappingURL=PurgedDocRegistry.d.ts.map

package/dist/server/PurgedDocRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PurgedDocRegistry.d.ts","sourceRoot":"","sources":["../../src/server/PurgedDocRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAUzD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,sBAAsB,CAAc;IAC5C,OAAO,CAAC,YAAY,CAA2B;IAC/C,OAAO,CAAC,MAAM,CAAS;gBAEX,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM;IAOnD,OAAO,CAAC,YAAY;IA8BpB,OAAO,CAAC,IAAI;IAWZ,yDAAyD;IACzD,kBAAkB,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO;IAKtD,4EAA4E;IAC5E,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAUlD,iEAAiE;IACjE,oBAAoB,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI;IAMrD,oFAAoF;IACpF,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;CAI3C"}

package/dist/server/PurgedDocRegistry.js

@@ -0,0 +1,90 @@
+"use strict";
+/**
+ * Per-tenant persistent record of executed document-history purges.
+ *
+ * Server-side purge execution (docs/accesscontrol.md §13) physically deletes a
+ * document's history from the tenant's on-disk stores. Because
+ * {@link ContentAddressedStore.purgeDocHistory} leaves no tombstone, a stale
+ * client that has not yet reconciled could re-push the very entries that were
+ * just purged and the server would re-accept them. This registry is the churn
+ * guard: it remembers which `purgeRequestDocId`s have already been executed (so
+ * we never purge twice) and which `docId`s were purged per database (so the sync
+ * push path can reject any re-upload of a purged document).
+ *
+ * Stored under `<tenantId>/purged-docs.json` in the server data store (a file
+ * below the data directory on Node).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PurgedDocRegistry = void 0;
+class PurgedDocRegistry {
+    constructor(dataStore, key) {
+        this.loaded = false;
+        this.dataStore = dataStore;
+        this.key = key;
+        this.processedRequestDocIds = new Set();
+        this.purgedDocIds = new Map();
+    }
+    ensureLoaded() {
+        if (this.loaded)
+            return;
+        this.loaded = true;
+        try {
+            const raw = this.dataStore.readText(this.key);
+            if (raw === null)
+                return;
+            const data = JSON.parse(raw);
+            if (Array.isArray(data.processedRequestDocIds)) {
+                this.processedRequestDocIds = new Set(data.processedRequestDocIds.filter((id) => typeof id === "string"));
+            }
+            if (data.purgedDocIds && typeof data.purgedDocIds === "object") {
+                for (const [dbId, ids] of Object.entries(data.purgedDocIds)) {
+                    if (Array.isArray(ids)) {
+                        this.purgedDocIds.set(dbId, new Set(ids.filter((id) => typeof id === "string")));
+                    }
+                }
+            }
+        }
+        catch {
+            // Corrupt or unreadable registry: start from empty rather than crashing
+            // the server. A subsequent save will overwrite it.
+            this.processedRequestDocIds = new Set();
+            this.purgedDocIds = new Map();
+        }
+    }
+    save() {
+        const data = {
+            version: 1,
+            processedRequestDocIds: [...this.processedRequestDocIds],
+            purgedDocIds: Object.fromEntries([...this.purgedDocIds.entries()].map(([dbId, ids]) => [dbId, [...ids]])),
+        };
+        this.dataStore.writeText(this.key, JSON.stringify(data, null, 2));
+    }
+    /** True when this purge request was already executed. */
+    isRequestProcessed(purgeRequestDocId) {
+        this.ensureLoaded();
+        return this.processedRequestDocIds.has(purgeRequestDocId);
+    }
+    /** Record that a document was purged from a database (re-push denylist). */
+    recordPurgedDoc(dbId, docId) {
+        this.ensureLoaded();
+        let set = this.purgedDocIds.get(dbId);
+        if (!set) {
+            set = new Set();
+            this.purgedDocIds.set(dbId, set);
+        }
+        set.add(docId);
+    }
+    /** Mark a purge request as executed and persist the registry. */
+    markRequestProcessed(purgeRequestDocId) {
+        this.ensureLoaded();
+        this.processedRequestDocIds.add(purgeRequestDocId);
+        this.save();
+    }
+    /** The set of purged docIds for a database (live; used by the push reject path). */
+    getPurgedDocIds(dbId) {
+        this.ensureLoaded();
+        return this.purgedDocIds.get(dbId) ?? new Set();
+    }
+}
+exports.PurgedDocRegistry = PurgedDocRegistry;
+//# sourceMappingURL=PurgedDocRegistry.js.map

package/dist/server/PurgedDocRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PurgedDocRegistry.js","sourceRoot":"","sources":["../../src/server/PurgedDocRegistry.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAYH,MAAa,iBAAiB;IAO5B,YAAY,SAA0B,EAAE,GAAW;QAF3C,WAAM,GAAG,KAAK,CAAC;QAGrB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,IAAI,CAAC,sBAAsB,GAAG,IAAI,GAAG,EAAE,CAAC;QACxC,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;IAChC,CAAC;IAEO,YAAY;QAClB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmC,CAAC;YAC/D,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,sBAAsB,GAAG,IAAI,GAAG,CACnC,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CACjF,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;gBAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;oBAC5D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;wBACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CACnB,IAAI,EACJ,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAClE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,mDAAmD;YACnD,IAAI,CAAC,sBAAsB,GAAG,IAAI,GAAG,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,IAAI;QACV,MAAM,IAAI,GAA0B;YAClC,OAAO,EAAE,CAAC;YACV,sBAAsB,EAAE,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC;YACxD,YAAY,EAAE,MAAM,CAAC,WAAW,CAC9B,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CACxE;SACF,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,yDAAyD;IACzD,kBAAkB,CAAC,iBAAyB;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5D,CAAC;IAED,4EAA4E;IAC5E,eAAe,CAAC,IAAY,EAAE,KAAa;QACzC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnC,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;IAED,iEAAiE;IACjE,oBAAoB,CAAC,iBAAyB;QAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,oFAAoF;IACpF,eAAe,CAAC,IAAY;QAC1B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;IAClD,CAAC;CACF;AApFD,8CAoFC"}

package/dist/server/ServerDataStore.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Where the server keeps its own small state: the server identity, trusted
+ * servers, the server key bag, tenant configs and per-tenant registries.
+ *
+ * Keys are `/`-separated relative paths, and on Node they are exactly the
+ * file paths below the data directory (`server.identity.json`,
+ * `trusted-servers.json`, `server.keybag`, `<tenantId>/config.json`,
+ * `<tenantId>/purged-docs.json`), so existing servers keep reading their data.
+ * Other hosts map the same keys onto their own storage, e.g. a Durable
+ * Object's SQLite.
+ *
+ * The interface is synchronous on purpose: the server code that reads this
+ * state (tenant lookup, purge denylist) is synchronous today, and both hosts
+ * have synchronous storage (Node `fs`, Durable Object SQLite).
+ *
+ * Entry payloads never go through here; they live in the content-addressed
+ * stores (see {@link ServerStoreProvider}).
+ */
+import type { ContentAddressedStore } from "../core/types";
+import type { StoreKind } from "../core/appendonlystores/types";
+import type { TenantConfig } from "./types";
+export interface ServerDataStore {
+    /** True when `key` holds a value or has children (a "directory"). */
+    exists(key: string): boolean;
+    readText(key: string): string | null;
+    writeText(key: string, value: string): void;
+    readBytes(key: string): Uint8Array | null;
+    writeBytes(key: string, value: Uint8Array): void;
+    /** Names of the direct children of `prefix` ("" for the root) that have children themselves. */
+    listDirectories(prefix: string): string[];
+    /** Remove `prefix` and everything below it. */
+    deleteTree(prefix: string): void;
+}
+/** Stores of one tenant, as the tenant manager uses them. */
+export interface TenantStoreFactory {
+    getStore(dbId: string, storeKind: StoreKind): ContentAddressedStore;
+}
+/**
+ * How a host provides the content-addressed stores of a tenant. On Node these
+ * are the on-disk stores below `<dataDir>/<tenantId>/stores`.
+ */
+export interface ServerStoreProvider {
+    /** Called whenever a tenant is (re)loaded; the result is cached with the tenant. */
+    createTenantStores(tenantId: string, config: TenantConfig): TenantStoreFactory;
+    /** Database ids this server holds for a tenant. */
+    listDatabases(tenantId: string): string[];
+    /**
+     * Drop all stores of a removed tenant. Optional: on Node the stores live
+     * inside the tenant directory and go away with {@link ServerDataStore.deleteTree}.
+     */
+    removeTenantStores?(tenantId: string): void | Promise<void>;
+}
+/**
+ * Volatile {@link ServerDataStore}: tests, and hosts that seed their state at
+ * startup.
+ */
+export declare class MemoryServerDataStore implements ServerDataStore {
+    private readonly values;
+    exists(key: string): boolean;
+    readText(key: string): string | null;
+    writeText(key: string, value: string): void;
+    readBytes(key: string): Uint8Array | null;
+    writeBytes(key: string, value: Uint8Array): void;
+    listDirectories(prefix: string): string[];
+    deleteTree(prefix: string): void;
+}
+//# sourceMappingURL=ServerDataStore.d.ts.map

package/dist/server/ServerDataStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServerDataStore.d.ts","sourceRoot":"","sources":["../../src/server/ServerDataStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CAAC;IACjD,gGAAgG;IAChG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1C,+CAA+C;IAC/C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,qBAAqB,CAAC;CACrE;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,oFAAoF;IACpF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,kBAAkB,CAAC;IAC/E,mDAAmD;IACnD,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1C;;;OAGG;IACH,kBAAkB,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAMD;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IAEjE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAW5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAMpC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAI3C,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI;IAMzC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAIhD,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE;IAazC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAQjC"}