mindoodb 0.0.85 → 0.0.88

package/dist/node/server/TenantManager.js

@@ -1,420 +1,30 @@
 "use strict";
 /**
- * TenantManager handles loading, caching, and registration of tenants.
- *
- * Uses a global server identity (one per server, not per tenant) for
- * authenticating with remote servers and opening tenant directories.
- *
- * When a tenant has a $publicinfos key (sent during publishToServer), the
- * manager creates a real BaseMindooTenant for directory reading. User
- * authentication is then validated against the admin-signed directory DB
- * rather than a static JSON config.
- *
- * When no $publicinfos key is available, a SimpleMindooDirectory backed
- * by config.json users[] is used as a fallback (useful for tests).
- *
- * A CompositeMindooDirectory wraps whichever directory source is used and
- * also checks the global trusted-servers list, enabling server-to-server
- * auth without servers being in each tenant's user directory.
+ * Node host of the {@link CoreTenantManager}: tenant state lives in files
+ * below the data directory and every tenant database is an on-disk store in
+ * `<dataDir>/<tenantId>/stores` (see {@link StoreFactory}).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TenantManager = exports.SimpleMindooDirectory = void 0;
+exports.TenantManager = exports.NodeServerStoreProvider = exports.SimpleMindooDirectory = void 0;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const NodeCryptoAdapter_1 = require("../crypto/NodeCryptoAdapter");
-const AuthenticationService_1 = require("../../core/appendonlystores/network/AuthenticationService");
-const ServerNetworkContentAddressedStore_1 = require("../../appendonlystores/network/ServerNetworkContentAddressedStore");
-const PurgedDocRegistry_1 = require("./PurgedDocRegistry");
-const purgeDocumentHistory_1 = require("../../core/appendonlystores/purgeDocumentHistory");
-const Ed25519WitnessProvider_1 = require("../../core/accesscontrol/timestamp/Ed25519WitnessProvider");
-const BaseMindooTenantFactory_1 = require("../../core/BaseMindooTenantFactory");
-const RSAEncryption_1 = require("../../core/crypto/RSAEncryption");
-const privateKeyEncryption_1 = require("../../core/crypto/privateKeyEncryption");
-const KeyBag_1 = require("../../core/keys/KeyBag");
-const types_1 = require("../../core/types");
-const builtinDbInvariants_1 = require("../../core/builtinDbInvariants");
-const DirectoryStateNode_1 = require("../../core/accesscontrol/DirectoryStateNode");
-const tier1Evaluator_1 = require("../../core/accesscontrol/tier1Evaluator");
+const TenantManager_1 = require("../../server/TenantManager");
+const FsServerDataStore_1 = require("./FsServerDataStore");
 const StoreFactory_1 = require("./StoreFactory");
-// ---------------------------------------------------------------------------
-// StoreFactoryAdapter
-// ---------------------------------------------------------------------------
-class StoreFactoryAdapter {
-    constructor(storeFactory) {
-        this.storeFactory = storeFactory;
-    }
-    createStore(dbId, _options) {
-        return {
-            docStore: this.storeFactory.getStore(dbId, "docs"),
-            attachmentStore: this.storeFactory.getStore(dbId, "attachments"),
-        };
-    }
-}
-// ---------------------------------------------------------------------------
-// SimpleMindooDirectory — config-based fallback
-// ---------------------------------------------------------------------------
-class SimpleMindooDirectory {
-    constructor(config) {
-        /** Canonical index: entries are identified by their signing public key. */
-        this.usersByKey = new Map();
-        /**
-         * Backward-compat index by documentation-only username, populated only for
-         * config entries that carry a `username`. Lets legacy username-based
-         * challenges keep resolving; `username` is never required.
-         */
-        this.usersByUsername = new Map();
-        this.revokedUsers = new Set();
-        this.adminSigningPublicKey = config.adminSigningPublicKey;
-        if (config.users) {
-            for (const user of config.users) {
-                // Identity is the signing key. `username` is documentation-only and
-                // ignored for matching; index it only as a legacy convenience.
-                this.usersByKey.set(user.signingPublicKey, user);
-                if (typeof user.username === "string" && user.username.trim()) {
-                    this.usersByUsername.set(user.username.toLowerCase(), user);
-                }
-            }
-        }
-    }
-    async getUserPublicKeys(username) {
-        const normalizedUsername = username.toLowerCase();
-        if (this.revokedUsers.has(normalizedUsername)) {
-            return null;
-        }
-        const user = this.usersByUsername.get(normalizedUsername);
-        if (!user) {
-            return null;
-        }
-        return {
-            signingPublicKey: user.signingPublicKey,
-            encryptionPublicKey: user.encryptionPublicKey,
-        };
-    }
-    async getUserBySigningPublicKey(publicKey) {
-        const exact = this.usersByKey.get(publicKey);
-        if (exact) {
-            return this.toLookup(exact);
-        }
-        const needle = publicKey.replace(/\s+/g, "");
-        if (!needle)
-            return null;
-        for (const [key, user] of this.usersByKey) {
-            if (key.replace(/\s+/g, "") === needle) {
-                return this.toLookup(user);
-            }
-        }
-        return null;
-    }
-    toLookup(user) {
-        if (typeof user.username === "string" &&
-            this.revokedUsers.has(user.username.toLowerCase())) {
-            return null;
-        }
-        return {
-            username: typeof user.username === "string" ? user.username : "",
-            signingPublicKey: user.signingPublicKey,
-            encryptionPublicKey: user.encryptionPublicKey,
-            details: null,
-        };
-    }
-    async isUserRevoked(username) {
-        return this.revokedUsers.has(username.toLowerCase());
-    }
-    async validatePublicSigningKey(publicKey, _opts) {
-        if (publicKey === this.adminSigningPublicKey) {
-            return true;
-        }
-        const user = this.usersByKey.get(publicKey);
-        if (!user) {
-            return false;
-        }
-        if (typeof user.username === "string" &&
-            this.revokedUsers.has(user.username.toLowerCase())) {
-            return false;
-        }
-        return true;
-    }
-}
-exports.SimpleMindooDirectory = SimpleMindooDirectory;
-// ---------------------------------------------------------------------------
-// CompositeMindooDirectory — wraps tenant directory + trusted servers
-// ---------------------------------------------------------------------------
-/**
- * Wraps a per-tenant directory (real or config-based) and also checks
- * the global trusted-servers list. Holds a reference to the array so
- * runtime changes via the admin API are immediately visible.
- */
-class CompositeMindooDirectory {
-    constructor(inner, trustedServers, adminBootstrapIdentity) {
-        this.inner = inner;
-        this.trustedServers = trustedServers;
-        this.adminBootstrapIdentity = adminBootstrapIdentity;
-        this.adminUsernameNormalized =
-            adminBootstrapIdentity?.username.toLowerCase() ?? null;
-    }
-    async getUserPublicKeys(username) {
-        const normalizedUsername = username.toLowerCase();
-        // Bootstrap special-case: allow configured admin identity to authenticate
-        // even before directory grantaccess docs are present on the server.
-        if (this.adminBootstrapIdentity &&
-            this.adminUsernameNormalized &&
-            normalizedUsername === this.adminUsernameNormalized) {
-            return {
-                signingPublicKey: this.adminBootstrapIdentity.signingPublicKey,
-                encryptionPublicKey: this.adminBootstrapIdentity.encryptionPublicKey,
-            };
-        }
-        const result = await this.inner.getUserPublicKeys(username);
-        if (result)
-            return result;
-        for (const server of this.trustedServers) {
-            if (server.name.toLowerCase() === normalizedUsername) {
-                return {
-                    signingPublicKey: server.signingPublicKey,
-                    encryptionPublicKey: server.encryptionPublicKey,
-                };
-            }
-        }
-        return null;
-    }
-    async isUserRevoked(username) {
-        const normalizedUsername = username.toLowerCase();
-        if (this.adminUsernameNormalized &&
-            normalizedUsername === this.adminUsernameNormalized) {
-            return false;
-        }
-        for (const server of this.trustedServers) {
-            if (server.name.toLowerCase() === normalizedUsername) {
-                return false;
-            }
-        }
-        return this.inner.isUserRevoked(username);
-    }
-    async validatePublicSigningKey(publicKey, opts) {
-        if (this.adminBootstrapIdentity &&
-            (0, DirectoryStateNode_1.signingKeysEqual)(this.adminBootstrapIdentity.signingPublicKey, publicKey)) {
-            return true;
-        }
-        const innerResult = await this.inner.validatePublicSigningKey(publicKey, opts);
-        if (innerResult)
-            return true;
-        for (const server of this.trustedServers) {
-            if (server.signingPublicKey === publicKey) {
-                return true;
-            }
-        }
-        return false;
-    }
-    // -----------------------------------------------------------------------
-    // Advanced directory features forwarded to the inner directory. Config-based
-    // inner directories (SimpleMindooDirectory) do not implement these, so the
-    // composite degrades gracefully (no key-based identity, no read policy, no
-    // wipe directives) — preserving legacy config-only behavior — while a real
-    // BaseMindooTenantDirectory inner enables the key-based auth, read gate, and
-    // remote-wipe paths (docs/accesscontrol.md §6.5).
-    // -----------------------------------------------------------------------
-    async getUserBySigningPublicKey(publicKey) {
-        if (typeof this.inner.getUserBySigningPublicKey === "function") {
-            const innerLookup = await this.inner.getUserBySigningPublicKey(publicKey);
-            if (innerLookup)
-                return innerLookup;
-        }
-        // Bootstrap/config fallback: the admin and trusted-server identities can be
-        // resolved by their signing key even without a grantaccess document on this
-        // server, mirroring getUserPublicKeys. Without this, key-based identity
-        // resolution (and the validateToken active-key check below) would treat the
-        // admin's own key as unknown the moment the directory has no admin grant.
-        if (this.adminBootstrapIdentity &&
-            (0, DirectoryStateNode_1.signingKeysEqual)(this.adminBootstrapIdentity.signingPublicKey, publicKey)) {
-            return {
-                username: this.adminBootstrapIdentity.username,
-                signingPublicKey: this.adminBootstrapIdentity.signingPublicKey,
-                encryptionPublicKey: this.adminBootstrapIdentity.encryptionPublicKey,
-                details: null,
-            };
-        }
-        for (const server of this.trustedServers) {
-            if (server.signingPublicKey === publicKey) {
-                return {
-                    username: server.name,
-                    signingPublicKey: server.signingPublicKey,
-                    encryptionPublicKey: server.encryptionPublicKey,
-                    details: null,
-                };
-            }
-        }
-        return null;
-    }
-    async getUserSigningKeyUniverse(username) {
-        const base = typeof this.inner.getUserSigningKeyUniverse === "function"
-            ? await this.inner.getUserSigningKeyUniverse(username)
-            : { active: [], wipeRequested: [] };
-        // The admin bootstrap identity, trusted servers, and config-based users are
-        // valid principals even without a grantaccess document on this server (the
-        // server config / bootstrap identity is the root of trust). Their signing
-        // key must therefore count as ACTIVE so the token-validation gate in
-        // AuthenticationService.validateToken (which requires the device key to be
-        // in this active set) does not reject a freshly-issued admin/config token.
-        // We reuse getUserPublicKeys, which already applies exactly those fallbacks.
-        const active = new Set(base.active);
-        const fallback = await this.getUserPublicKeys(username);
-        if (fallback)
-            active.add(fallback.signingPublicKey);
-        return { active: Array.from(active), wipeRequested: base.wipeRequested };
-    }
-    async getUserKeyPairs(username) {
-        if (typeof this.inner.getUserKeyPairs === "function") {
-            return this.inner.getUserKeyPairs(username);
-        }
-        return [];
-    }
-    async getWipeGrantDocId(signingKey) {
-        if (typeof this.inner.getWipeGrantDocId === "function") {
-            return this.inner.getWipeGrantDocId(signingKey);
-        }
-        return null;
-    }
-    async getRevokedDecryptionKeyIdsForSigningKey(signingKey) {
-        if (typeof this.inner.getRevokedDecryptionKeyIdsForSigningKey === "function") {
-            return this.inner.getRevokedDecryptionKeyIdsForSigningKey(signingKey);
-        }
-        return [];
-    }
-    async evaluateDbAccessForSigningKey(input) {
-        if (typeof this.inner.evaluateDbAccessForSigningKey === "function") {
-            return this.inner.evaluateDbAccessForSigningKey(input);
-        }
-        // Config-based directories carry no database-open policy -> unrestricted.
-        return true;
-    }
-    /**
-     * Forwarded so the witness enforces Tier 1 rules on push
-     * (docs/accesscontrol.md §7). `buildTier1Evaluator` only wires the check when
-     * the directory it is given has this method; without the forward every push
-     * was accepted, whatever the tenant's rules said. Config-based directories
-     * have no rules and therefore no method, which keeps their legacy behavior.
-     */
-    get evaluateAccessForSigningKey() {
-        const inner = this.inner;
-        return typeof inner.evaluateAccessForSigningKey === "function"
-            ? (input) => inner.evaluateAccessForSigningKey(input)
-            : undefined;
-    }
-    /** Forwarded with {@link evaluateAccessForSigningKey}: `$author` at grant level. */
-    get isSamePerson() {
-        const inner = this.inner;
-        return typeof inner.isSamePerson === "function" ? (input) => inner.isSamePerson(input) : undefined;
-    }
-    /**
-     * Forwarded so server-side `userdirectory` writes can resolve the signer's
-     * grant. Without this, `evaluateUserdirectoryInvariant` sees a missing
-     * method, leaves `signerUsernameHash` null, and denies every non-admin
-     * change as "signer is not a granted device" — including the founder
-     * wrapping a second device of their own User-Key.
-     */
-    async resolveUsernameHashForSigningKey(signingKey, trustedTime) {
-        if (typeof this.inner.resolveUsernameHashForSigningKey === "function") {
-            return this.inner.resolveUsernameHashForSigningKey(signingKey, trustedTime);
-        }
-        return null;
-    }
-}
-// ---------------------------------------------------------------------------
-// TenantManager
-// ---------------------------------------------------------------------------
-/**
- * TenantManager is responsible for:
- * - Loading the global server identity and trusted servers
- * - Loading tenant configurations from disk
- * - Caching loaded tenants
- * - Registering new tenants
- * - Managing tenant stores and authentication services
- * - Creating a real MindooDB tenant for directory reading (when keys available)
- * - Runtime management of trusted servers
- */
-class TenantManager {
-    constructor(dataDir, serverPassword) {
-        this.loadedTenants = new Map();
-        this.serverIdentity = null;
-        this.trustedServers = [];
-        /** Peer wiring handed down to every server store; see setPeerAccessControl. */
-        this.peerAccessControl = {};
-        /** Per-tenant persistent registry of executed purges (docs/accesscontrol.md §13). */
-        this.purgedDocRegistries = new Map();
-        /** In-flight purge executions, keyed by normalized tenant id (serializes runs). */
-        this.purgeInFlight = new Map();
+var TenantManager_2 = require("../../server/TenantManager");
+Object.defineProperty(exports, "SimpleMindooDirectory", { enumerable: true, get: function () { return TenantManager_2.SimpleMindooDirectory; } });
+/** The on-disk stores of every tenant below `<dataDir>/<tenantId>/stores`. */
+class NodeServerStoreProvider {
+    constructor(dataDir, dataStore) {
         this.dataDir = dataDir;
-        this.serverPassword = serverPassword;
-        this.cryptoAdapter = new NodeCryptoAdapter_1.NodeCryptoAdapter();
-        if (!(0, fs_1.existsSync)(dataDir)) {
-            (0, fs_1.mkdirSync)(dataDir, { recursive: true });
-            console.log(`[TenantManager] Created data directory: ${dataDir}`);
-        }
-        // Load global server identity
-        const identityPath = (0, path_1.join)(dataDir, "server.identity.json");
-        if ((0, fs_1.existsSync)(identityPath)) {
-            this.serverIdentity = JSON.parse((0, fs_1.readFileSync)(identityPath, "utf-8"));
-            console.log(`[TenantManager] Loaded server identity: ${this.serverIdentity.username}`);
-        }
-        else {
-            console.log(`[TenantManager] No server.identity.json found (run "npm run init" to create one)`);
-        }
-        // Load trusted servers
-        const trustedPath = (0, path_1.join)(dataDir, "trusted-servers.json");
-        if ((0, fs_1.existsSync)(trustedPath)) {
-            this.trustedServers = JSON.parse((0, fs_1.readFileSync)(trustedPath, "utf-8"));
-            console.log(`[TenantManager] Loaded ${this.trustedServers.length} trusted server(s)`);
-        }
+        this.dataStore = dataStore;
     }
-    // =======================================================================
-    // Server identity
-    // =======================================================================
-    getServerIdentity() {
-        return this.serverIdentity;
+    createTenantStores(tenantId, config) {
+        return new StoreFactory_1.StoreFactory(tenantId, config, this.dataDir);
     }
-    getServerPublicInfo() {
-        if (!this.serverIdentity)
-            return null;
-        return {
-            name: this.serverIdentity.username,
-            signingPublicKey: this.serverIdentity.userSigningKeyPair
-                .publicKey,
-            encryptionPublicKey: this.serverIdentity.userEncryptionKeyPair
-                .publicKey,
-        };
-    }
-    getDataDir() {
-        return this.dataDir;
-    }
-    /**
-     * Teach every server store how to recognise a trusted peer.
-     *
-     * `MindooDBServer` calls this once at startup. Two hooks, both required for
-     * peer replication to be correct:
-     *
-     * - `peerTokenResolver` lets a peer's cluster-level JWT through the tenant
-     *   sync routes. A peer holds no per-tenant grant, so without it the mirror
-     *   would need a second replication protocol; with it the peer reuses the
-     *   client one and the store skips the per-user gates that do not apply to a
-     *   full replica.
-     * - `trustedWitnessResolver` decides whose witness receipts may be preserved
-     *   instead of re-stamped (convergence invariant 3). Without it a replicated
-     *   entry would get a fresh `receivedAt` on every hop and "trusted time"
-     *   would mean "time it reached the last server".
-     *
-     * Must be called before the first {@link getServerStore}, since stores are
-     * cached per tenant and database.
-     */
-    setPeerAccessControl(options) {
-        this.peerAccessControl = options;
-    }
-    /**
-     * Database ids this server holds for a tenant, read from
-     * `{dataDir}/{tenantId}/stores`. Used by peer replication to mirror every
-     * database rather than a configured subset.
-     */
     listDatabases(tenantId) {
-        const storesDir = (0, path_1.join)(this.resolveTenantDir(tenantId.toLowerCase()), "stores");
+        const storesDir = this.dataStore.resolvePath((0, path_1.join)(tenantId, "stores"));
         if (!(0, fs_1.existsSync)(storesDir)) {
             return [];
         }
@@ -426,774 +36,31 @@ class TenantManager {
             return [];
         }
     }
-    /**
-     * The server's own RSA private key, imported for decryption.
-     *
-     * Peer replication needs it because the remote wraps transported entries to
-     * this server's `encryptionPublicKey` (the one in its `trusted-servers.json`),
-     * exactly as it would wrap them for a client.
-     */
-    async getServerEncryptionPrivateKey() {
-        if (this.serverEncryptionPrivateKey)
-            return this.serverEncryptionPrivateKey;
-        if (!this.serverIdentity || !this.serverPassword)
-            return undefined;
-        const subtle = this.cryptoAdapter.getSubtle();
-        const keyBuffer = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, this.serverIdentity.userEncryptionKeyPair
-            .privateKey, this.serverPassword, "encryption");
-        this.serverEncryptionPrivateKey = await subtle.importKey("pkcs8", keyBuffer, { name: "RSA-OAEP", hash: "SHA-256" }, false, ["decrypt"]);
-        return this.serverEncryptionPrivateKey;
-    }
-    /**
-     * Build (and cache) the server's witness identity used to stamp receipts on
-     * accepted entries (docs/accesscontrol.md §5.3). Returns undefined when the
-     * server identity or its unlock password is unavailable, in which case the
-     * server runs in pre-access-control mode (no stamping, no Tier 1 advertised).
-     */
-    async getWitnessSigner() {
-        if (this.witnessSigner)
-            return this.witnessSigner;
-        if (!this.serverIdentity || !this.serverPassword)
-            return undefined;
-        const subtle = this.cryptoAdapter.getSubtle();
-        const signingKeyBuffer = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, this.serverIdentity.userSigningKeyPair.privateKey, this.serverPassword, "signing");
-        const signingPrivateKey = await subtle.importKey("pkcs8", signingKeyBuffer, { name: "Ed25519" }, false, ["sign"]);
-        this.witnessSigner = {
-            publicKeyPem: this.serverIdentity.userSigningKeyPair.publicKey,
-            signingPrivateKey,
-            subtle,
-        };
-        return this.witnessSigner;
-    }
-    /**
-     * Build the trusted-time provider that stamps receipts on accepted entries
-     * (docs/accesscontrol.md §5.3, §13). v1 wraps the server's Ed25519 witness
-     * identity; returns undefined when no witness signer is available, leaving the
-     * server in pre-access-control mode.
-     */
-    async getTimestampProvider() {
-        const signer = await this.getWitnessSigner();
-        if (!signer)
-            return undefined;
-        return new Ed25519WitnessProvider_1.Ed25519WitnessProvider({ signer, subtle: signer.subtle });
-    }
-    // =======================================================================
-    // Trusted server management
-    // =======================================================================
-    listTrustedServers() {
-        return [...this.trustedServers];
-    }
-    addTrustedServer(server) {
-        const existing = this.trustedServers.find((s) => s.name.toLowerCase() === server.name.toLowerCase());
-        if (existing) {
-            throw new Error(`Trusted server "${server.name}" already exists`);
-        }
-        this.trustedServers.push(server);
-        this.persistTrustedServers();
-        console.log(`[TenantManager] Added trusted server: ${server.name}`);
-    }
-    /**
-     * Add or replace a trusted server by name.
-     *
-     * Peer CRUD needs an upsert: `addTrustedServer` throws on an existing name,
-     * which is right for `add-to-network` (a silent overwrite of a peer's keys
-     * would be a trust change disguised as a config edit) but wrong for the admin
-     * API, where changing a peer's url or role is the common case.
-     */
-    saveTrustedServer(server) {
-        const idx = this.trustedServers.findIndex((s) => s.name.toLowerCase() === server.name.toLowerCase());
-        if (idx === -1) {
-            this.trustedServers.push(server);
-        }
-        else {
-            this.trustedServers[idx] = server;
-        }
-        this.persistTrustedServers();
-        console.log(`[TenantManager] Saved trusted server: ${server.name}`);
-    }
-    removeTrustedServer(name) {
-        const idx = this.trustedServers.findIndex((s) => s.name.toLowerCase() === name.toLowerCase());
-        if (idx === -1)
-            return false;
-        this.trustedServers.splice(idx, 1);
-        this.persistTrustedServers();
-        console.log(`[TenantManager] Removed trusted server: ${name}`);
-        return true;
-    }
-    persistTrustedServers() {
-        const filePath = (0, path_1.join)(this.dataDir, "trusted-servers.json");
-        (0, fs_1.writeFileSync)(filePath, JSON.stringify(this.trustedServers, null, 2), "utf-8");
-    }
-    getServerKeyBagPath() {
-        return (0, path_1.join)(this.dataDir, "server.keybag");
-    }
-    async loadServerKeyBag() {
-        if (!this.serverIdentity || !this.serverPassword) {
-            throw new Error("Server identity and server password are required to manage tenant $publicinfos keys");
-        }
-        const keyBag = await this.createServerKeyBag(this.serverIdentity, this.serverPassword);
-        const keyBagPath = this.getServerKeyBagPath();
-        if ((0, fs_1.existsSync)(keyBagPath)) {
-            const data = (0, fs_1.readFileSync)(keyBagPath);
-            await keyBag.load(new Uint8Array(data));
-        }
-        return keyBag;
-    }
-    async createServerKeyBag(serverUser, serverPassword) {
-        const wrappingKey = await KeyBag_1.KeyBag.deriveWrappingKey(serverUser.userEncryptionKeyPair.privateKey, serverPassword, this.cryptoAdapter);
-        return new KeyBag_1.KeyBag({
-            wrappingKey,
-            cryptoAdapter: this.cryptoAdapter,
-        });
-    }
-    async saveServerKeyBag(keyBag) {
-        const data = await keyBag.save();
-        (0, fs_1.writeFileSync)(this.getServerKeyBagPath(), new DataView(data.buffer, data.byteOffset, data.byteLength));
-    }
-    bytesToBase64(bytes) {
-        return Buffer.from(bytes).toString("base64");
-    }
-    mergeUniqueKeys(keys) {
-        const seen = new Set();
-        const unique = [];
-        for (const key of keys) {
-            const signature = this.bytesToBase64(key);
-            if (seen.has(signature)) {
-                continue;
-            }
-            seen.add(signature);
-            unique.push(key);
-        }
-        return unique;
-    }
-    async computePublicInfosFingerprint(key) {
-        const digest = await this.cryptoAdapter
-            .getSubtle()
-            .digest("SHA-256", key);
-        return Array.from(new Uint8Array(digest).slice(0, 8))
-            .map((byte) => byte.toString(16).padStart(2, "0"))
-            .join(":");
-    }
-    resolveTenantDir(tenantId) {
-        const baseDir = (0, path_1.resolve)(this.dataDir);
-        const tenantDir = (0, path_1.resolve)(baseDir, tenantId);
-        if (tenantDir !== baseDir && !tenantDir.startsWith(`${baseDir}${path_1.sep}`)) {
-            throw new Error(`Resolved tenant path escapes data directory for tenantId "${tenantId}"`);
-        }
-        return tenantDir;
-    }
-    resolveTenantConfigPath(tenantId) {
-        return (0, path_1.join)(this.resolveTenantDir(tenantId), "config.json");
-    }
-    async decryptEncryptedPublicInfosKey(base64Payload) {
-        if (!this.serverIdentity) {
-            throw new Error("Server identity not initialized; cannot decrypt encrypted $publicinfos payload");
-        }
-        if (!this.serverPassword) {
-            throw new Error("Server password not configured; cannot decrypt encrypted $publicinfos payload");
-        }
-        const privateKeyBuffer = await (0, privateKeyEncryption_1.decryptPrivateKey)(this.cryptoAdapter, this.serverIdentity.userEncryptionKeyPair
-            .privateKey, this.serverPassword, "encryption");
-        const privateKey = await this.cryptoAdapter.getSubtle().importKey("pkcs8", privateKeyBuffer, {
-            name: "RSA-OAEP",
-            hash: "SHA-256",
-        }, false, ["decrypt"]);
-        const decrypted = await new RSAEncryption_1.RSAEncryption(this.cryptoAdapter).decrypt(new Uint8Array(Buffer.from(base64Payload, "base64")), privateKey);
-        return new Uint8Array(decrypted);
-    }
-    async resolveIncomingPublicInfosKey(request) {
-        if (request.encryptedPublicInfosKey) {
-            return this.decryptEncryptedPublicInfosKey(request.encryptedPublicInfosKey);
-        }
-        if (request.publicInfosKey) {
-            return new Uint8Array(Buffer.from(request.publicInfosKey, "base64"));
-        }
-        throw new Error("Tenant registration requires encryptedPublicInfosKey or publicInfosKey");
-    }
-    async getStoredPublicInfosKeys(tenantId) {
-        const keys = [];
-        if (this.serverIdentity &&
-            this.serverPassword &&
-            (0, fs_1.existsSync)(this.getServerKeyBagPath())) {
-            const keyBag = await this.loadServerKeyBag();
-            keys.push(...(await keyBag.getAllKeys("doc", tenantId, types_1.PUBLIC_INFOS_KEY_ID)));
-        }
-        return this.mergeUniqueKeys(keys);
-    }
-    async persistTenantPublicInfosKey(tenantId, key) {
-        const keyBag = await this.loadServerKeyBag();
-        const existingKeys = await keyBag.getAllKeys("doc", tenantId, types_1.PUBLIC_INFOS_KEY_ID);
-        const incomingSignature = this.bytesToBase64(key);
-        const alreadyStored = existingKeys.some((entry) => this.bytesToBase64(entry) === incomingSignature);
-        if (!alreadyStored) {
-            await keyBag.set("doc", tenantId, types_1.PUBLIC_INFOS_KEY_ID, key, Date.now());
-            await this.saveServerKeyBag(keyBag);
-        }
-    }
-    /**
-     * All stored `$publicinfos` AES key versions for a tenant from `server.keybag`.
-     * Empty when the tenant was never published or the server keybag is locked.
-     */
-    async getPublicInfosKeysForTenant(tenantId) {
-        return this.getStoredPublicInfosKeys(tenantId.toLowerCase());
-    }
-    async listTenantPublicInfosFingerprints(tenantId) {
-        const normalizedId = tenantId.toLowerCase();
-        const configPath = this.resolveTenantConfigPath(normalizedId);
-        if (!(0, fs_1.existsSync)(configPath)) {
-            throw new Error(`Tenant ${normalizedId} not found`);
-        }
-        const fingerprints = await Promise.all((await this.getStoredPublicInfosKeys(normalizedId)).map((key) => this.computePublicInfosFingerprint(key)));
-        return [...new Set(fingerprints)].sort();
-    }
-    // =======================================================================
-    // Tenant management
-    // =======================================================================
-    async registerTenant(request) {
-        const tenantId = request.tenantId.toLowerCase();
-        const tenantDir = this.resolveTenantDir(tenantId);
-        const configPath = this.resolveTenantConfigPath(tenantId);
-        if (!this.serverIdentity || !this.serverPassword) {
-            throw new Error("Tenant registration requires an unlocked server identity to store $publicinfos keys");
-        }
-        const publicInfosKey = await this.resolveIncomingPublicInfosKey(request);
-        if ((0, fs_1.existsSync)(configPath)) {
-            const existingConfig = JSON.parse((0, fs_1.readFileSync)(configPath, "utf-8"));
-            const incomingSignature = this.bytesToBase64(publicInfosKey);
-            const existingKeys = await this.getStoredPublicInfosKeys(tenantId);
-            const hasMatch = existingKeys.some((key) => this.bytesToBase64(key) === incomingSignature);
-            if (hasMatch) {
-                console.log(`[TenantManager] Tenant ${tenantId} already registered with matching $publicinfos key`);
-                return {
-                    context: { tenantId, config: existingConfig },
-                    created: false,
-                };
-            }
-            throw new Error(`Tenant ${tenantId} already exists with different $publicinfos key`);
-        }
-        (0, fs_1.mkdirSync)(tenantDir, { recursive: true });
-        const config = {
-            adminUsername: request.adminUsername,
-            adminSigningPublicKey: request.adminSigningPublicKey,
-            adminEncryptionPublicKey: request.adminEncryptionPublicKey,
-            defaultStoreType: request.defaultStoreType || "file",
-            users: [],
-        };
-        try {
-            (0, fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2), "utf-8");
-            await this.persistTenantPublicInfosKey(tenantId, publicInfosKey);
-        }
-        catch (error) {
-            (0, fs_1.rmSync)(tenantDir, { recursive: true, force: true });
-            throw error;
-        }
-        console.log(`[TenantManager] Registered tenant: ${tenantId} ($publicinfos stored in server keybag)`);
-        return {
-            context: { tenantId, config },
-            created: true,
-        };
-    }
-    async getTenant(tenantId) {
-        const normalizedId = tenantId.toLowerCase();
-        const cached = this.loadedTenants.get(normalizedId);
-        if (cached) {
-            return cached;
-        }
-        const loaded = await this.loadTenant(normalizedId);
-        this.loadedTenants.set(normalizedId, loaded);
-        return loaded;
-    }
-    tenantExists(tenantId) {
-        const normalizedId = tenantId.toLowerCase();
-        const configPath = this.resolveTenantConfigPath(normalizedId);
-        return (0, fs_1.existsSync)(configPath);
-    }
-    /**
-     * Read the tenant's registered admin signing key without fully loading the
-     * tenant. Returns `null` if the tenant is missing or the config is unreadable.
-     */
-    getTenantAdminSigningPublicKey(tenantId) {
-        try {
-            const normalizedId = tenantId.toLowerCase();
-            const cached = this.loadedTenants.get(normalizedId);
-            if (cached?.context.config.adminSigningPublicKey) {
-                return cached.context.config.adminSigningPublicKey;
-            }
-            const configPath = this.resolveTenantConfigPath(normalizedId);
-            if (!(0, fs_1.existsSync)(configPath)) {
-                return null;
-            }
-            const config = JSON.parse((0, fs_1.readFileSync)(configPath, "utf-8"));
-            return typeof config.adminSigningPublicKey === "string" &&
-                config.adminSigningPublicKey.length > 0
-                ? config.adminSigningPublicKey
-                : null;
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * True when `publicsignkey` is the registered tenant-admin signing key for
-     * `tenantId` (PEM whitespace-insensitive).
-     */
-    isTenantAdminSigningKeyFor(tenantId, publicsignkey) {
-        const adminKey = this.getTenantAdminSigningPublicKey(tenantId);
-        return adminKey !== null && (0, DirectoryStateNode_1.signingKeysEqual)(adminKey, publicsignkey);
-    }
-    /**
-     * True when `publicsignkey` is the registered admin signing key of any
-     * tenant on this server. Used to issue a system JWT so that admin can
-     * DELETE their own tenant; other `/system/*` routes stay capability-gated.
-     */
-    isRegisteredTenantAdminSigningKey(publicsignkey) {
-        for (const tenantId of this.listTenants()) {
-            if (this.isTenantAdminSigningKeyFor(tenantId, publicsignkey)) {
-                return true;
-            }
-        }
-        return false;
-    }
-    listTenants() {
-        if (!(0, fs_1.existsSync)(this.dataDir)) {
-            return [];
-        }
-        const entries = (0, fs_1.readdirSync)(this.dataDir);
-        const tenants = [];
-        for (const entry of entries) {
-            const entryPath = (0, path_1.join)(this.dataDir, entry);
-            const configPath = (0, path_1.join)(entryPath, "config.json");
-            if ((0, fs_1.statSync)(entryPath).isDirectory() && (0, fs_1.existsSync)(configPath)) {
-                tenants.push(entry);
-            }
-        }
-        return tenants.sort();
-    }
-    /**
-     * Update operator-owned fields of an existing tenant configuration.
-     * Only the fields present in `updates` are overwritten.
-     */
-    updateTenantConfig(tenantId, updates) {
-        const normalizedId = tenantId.toLowerCase();
-        const configPath = this.resolveTenantConfigPath(normalizedId);
-        if (!(0, fs_1.existsSync)(configPath)) {
-            throw new Error(`Tenant ${normalizedId} not found`);
-        }
-        const config = JSON.parse((0, fs_1.readFileSync)(configPath, "utf-8"));
-        if (updates.defaultStoreType !== undefined) {
-            config.defaultStoreType = updates.defaultStoreType;
-        }
-        (0, fs_1.writeFileSync)(configPath, JSON.stringify(config, null, 2), "utf-8");
-        this.loadedTenants.delete(normalizedId);
-        console.log(`[TenantManager] Updated tenant config: ${normalizedId}`);
-    }
-    async removeTenant(tenantId) {
-        const normalizedId = tenantId.toLowerCase();
-        const tenantDir = this.resolveTenantDir(normalizedId);
-        if (!(0, fs_1.existsSync)(tenantDir)) {
-            throw new Error(`Tenant ${normalizedId} does not exist`);
-        }
-        this.loadedTenants.delete(normalizedId);
-        if (this.serverIdentity &&
-            this.serverPassword &&
-            (0, fs_1.existsSync)(this.getServerKeyBagPath())) {
-            const keyBag = await this.loadServerKeyBag();
-            await keyBag.deleteKey("doc", normalizedId, types_1.PUBLIC_INFOS_KEY_ID);
-            await this.saveServerKeyBag(keyBag);
-        }
-        (0, fs_1.rmSync)(tenantDir, { recursive: true, force: true });
-        console.log(`[TenantManager] Removed tenant: ${normalizedId}`);
-    }
-    // =======================================================================
-    // Server stores
-    // =======================================================================
-    async getServerStore(tenantId, dbId, storeKind) {
-        const tenant = await this.getTenant(tenantId);
-        const cacheKey = `${dbId}:${storeKind}`;
-        const cached = tenant.serverStores.get(cacheKey);
-        if (cached) {
-            return cached;
-        }
-        const localStore = tenant.storeFactory.getStore(dbId, storeKind);
-        // Access-control v1 wiring (docs/accesscontrol.md §5–§7). The witness signer
-        // lets the server stamp receipts on accepted entries; the Tier 1 evaluator
-        // enforces identity-tier rules at push time. Both are only active when the
-        // server identity is unlocked and the directory supports evaluation, so
-        // pre-access-control deployments keep their existing behavior.
-        const timestampProvider = await this.getTimestampProvider();
-        const directory = tenant.directory;
-        const tier1Evaluator = this.buildTier1Evaluator(directory, localStore);
-        const wipeGrantDocIdResolver = this.buildWipeGrantDocIdResolver(directory);
-        // Database-open gate (directory-restricted policy). Never applied to the
-        // directory store itself, which must always sync so the policy can be read.
-        const dbAccessEvaluator = dbId === "directory" ? undefined : this.buildDbAccessEvaluator(directory);
-        // Per-user revoked-key blacklist (§13). Never applied to the directory store
-        // itself (its policy, which defines the blacklist, must always sync).
-        const revokedKeyResolver = dbId === "directory"
-            ? undefined
-            : this.buildRevokedKeyResolver(directory);
-        // Purged-document denylist (§13). Never applied to the directory store (purge
-        // requests themselves live there and must always sync).
-        const purgedDocResolver = dbId === "directory"
-            ? undefined
-            : () => this.getPurgedDocRegistry(tenantId).getPurgedDocIds(dbId);
-        const builtinWriteContext = dbId === types_1.USER_DIRECTORY_DB_ID
-            ? this.buildUserdirectoryWriteContext(tenant, localStore)
-            : undefined;
-        const serverStore = new ServerNetworkContentAddressedStore_1.ServerNetworkContentAddressedStore(localStore, directory, tenant.authService, this.cryptoAdapter, undefined, {
-            timestampProvider,
-            witnessDbid: dbId,
-            tier1Evaluator,
-            wipeGrantDocIdResolver,
-            dbAccessEvaluator,
-            revokedKeyResolver,
-            purgedDocResolver,
-            builtinWriteContext,
-            ...this.peerAccessControl,
-        });
-        tenant.serverStores.set(cacheKey, serverStore);
-        console.log(`[TenantManager] Created server store for ${tenantId}/${dbId}/${storeKind}`);
-        return serverStore;
-    }
-    /**
-     * Build a Tier 1 evaluator closure for a server store, or undefined when the
-     * directory cannot evaluate access (e.g. config-based directory without the
-     * access-control state chain). The closure resolves `$author` for non-create
-     * ops by reading the document's `doc_create` entry creator key from the local
-     * store (metadata only, no decryption) and comparing it to the change author.
-     */
-    /**
-     * The witness's Tier 1 gate. The evaluation itself is shared with the peer
-     * listener, which has to run it for entries that never reach a witness at
-     * all — see `core/accesscontrol/tier1Evaluator.ts`.
-     */
-    buildTier1Evaluator(directory, localStore) {
-        return (0, tier1Evaluator_1.buildTier1Evaluator)(directory, localStore);
-    }
-    /**
-     * Builtin `userdirectory` write invariant: admin may create/delete, only the
-     * owning person may change. `username_hash` is read from the decrypted
-     * `doc_create` payload (`$publicinfos`). Personal documents are sealed to
-     * their owner and therefore undecryptable here, so they are owned by whoever
-     * signed their `doc_create` — `resolveCreatorSigningKey` answers that from
-     * the entry chain alone.
-     */
-    buildUserdirectoryWriteContext(tenant, localStore) {
-        const adminPublicKey = tenant.context.config.adminSigningPublicKey;
-        const mindooTenant = tenant.mindooTenant;
-        return {
-            adminPublicKey,
-            resolveCreatorSigningKey: async (entry) => {
-                const createEntry = await this.findCreateEntry(localStore, entry);
-                return createEntry?.createdByPublicKey ?? null;
-            },
-            resolveDocumentUsernameHash: mindooTenant
-                ? async (entry) => {
-                    const createEntry = await this.findCreateEntry(localStore, entry);
-                    if (!createEntry)
-                        return null;
-                    try {
-                        const plaintext = await mindooTenant.decryptPayload(createEntry.encryptedData, createEntry.decryptionKeyId);
-                        return (0, builtinDbInvariants_1.usernameHashFromCreateChangeBytes)(plaintext);
-                    }
-                    catch {
-                        return null;
-                    }
-                }
-                : undefined,
-        };
-    }
-    async findCreateEntry(localStore, entry) {
-        if (entry.entryType === "doc_create") {
-            return entry;
-        }
-        try {
-            const metas = await localStore.findNewEntriesForDoc([], entry.docId);
-            const createMeta = metas.find((m) => m.entryType === "doc_create");
-            if (!createMeta)
-                return null;
-            const loaded = await localStore.getEntries([createMeta.id]);
-            return loaded[0] ?? null;
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Build a database-open evaluator closure for a server store, or undefined
-     * when the directory cannot evaluate the database-open policy (e.g. a
-     * config-based directory without the access-control state chain). When the
-     * tenant policy is `"directory-restricted"`, this rejects sync for any
-     * database id that is not in the allowlist; `"directory"` is always allowed
-     * and the tenant admin is exempt (resolved from the principal signing key).
-     */
-    buildDbAccessEvaluator(directory) {
-        const evaluable = directory;
-        if (typeof evaluable.evaluateDbAccessForSigningKey !== "function") {
-            return undefined;
-        }
-        return async (principal, dbid) => {
-            return evaluable.evaluateDbAccessForSigningKey({
-                dbid,
-                signingKey: principal.signingKey ?? "",
-            });
-        };
-    }
-    /**
-     * Build a remote-wipe resolver closure for a server store, or undefined when
-     * the directory does not support wipe directives (docs/accesscontrol.md §6.5).
-     * Maps a wipe-targeted signing key to the admin-signed grant document id so
-     * the server can serve only that document to the targeted device.
-     */
-    buildWipeGrantDocIdResolver(directory) {
-        if (typeof directory.getWipeGrantDocId !== "function") {
-            return undefined;
-        }
-        return (signingKey) => directory.getWipeGrantDocId(signingKey);
-    }
-    /**
-     * Build a per-user revoked-key blacklist resolver for a server store, or
-     * undefined when the directory cannot resolve revoked keys (e.g. a
-     * config-based directory). Maps the authenticated principal's signing key to
-     * the set of decryption key ids revoked for them at the directory head
-     * (docs/accesscontrol.md §13).
-     */
-    buildRevokedKeyResolver(directory) {
-        if (typeof directory.getRevokedDecryptionKeyIdsForSigningKey !== "function") {
-            return undefined;
-        }
-        return async (principal) => {
-            const ids = await directory.getRevokedDecryptionKeyIdsForSigningKey(principal.signingKey ?? "");
-            return new Set(ids);
-        };
-    }
-    async getStore(tenantId, dbId, storeKind) {
-        const tenant = await this.getTenant(tenantId);
-        return tenant.storeFactory.getStore(dbId, storeKind);
-    }
-    /**
-     * Documents purged from `dbId` on this server (the persistent purge
-     * registry). Peer pull replication refuses their entries.
-     */
-    getPurgedDocIds(tenantId, dbId) {
-        return this.getPurgedDocRegistry(tenantId).getPurgedDocIds(dbId);
-    }
-    /** The (lazily-loaded, cached) purge registry for a tenant. */
-    getPurgedDocRegistry(tenantId) {
-        const normalizedId = tenantId.toLowerCase();
-        let registry = this.purgedDocRegistries.get(normalizedId);
-        if (!registry) {
-            registry = new PurgedDocRegistry_1.PurgedDocRegistry((0, path_1.join)(this.resolveTenantDir(normalizedId), "purged-docs.json"));
-            this.purgedDocRegistries.set(normalizedId, registry);
-        }
-        return registry;
+}
+exports.NodeServerStoreProvider = NodeServerStoreProvider;
+function ensureDataDir(dataDir) {
+    if (!(0, fs_1.existsSync)(dataDir)) {
+        (0, fs_1.mkdirSync)(dataDir, { recursive: true });
+        console.log(`[TenantManager] Created data directory: ${dataDir}`);
     }
-    /**
-     * Execute any not-yet-processed document-history purge requests for a tenant
-     * (docs/accesscontrol.md §13). Reads the admin-signed purge requests from the
-     * tenant directory (server-readable `$publicinfos` envelope), physically
-     * purges each requested document's history from the tenant's `docs` and
-     * `attachments` stores, and records the purge in the persistent registry so
-     * (a) it is never executed twice and (b) re-pushes of the purged docs are
-     * rejected at sync time.
-     *
-     * No-op when the server cannot read the directory (config-based fallback, or
-     * the directory does not expose the purge reader). Runs are serialized per
-     * tenant; concurrent callers share the in-flight promise.
-     */
-    async executePendingPurges(tenantId) {
-        const normalizedId = tenantId.toLowerCase();
-        const existing = this.purgeInFlight.get(normalizedId);
-        if (existing)
-            return existing;
-        const run = this.executePendingPurgesInternal(normalizedId).finally(() => {
-            this.purgeInFlight.delete(normalizedId);
+    return dataDir;
+}
+class TenantManager extends TenantManager_1.TenantManager {
+    constructor(dataDir, serverPassword) {
+        const dataStore = new FsServerDataStore_1.FsServerDataStore(ensureDataDir(dataDir));
+        super({
+            dataStore,
+            storeProvider: new NodeServerStoreProvider(dataDir, dataStore),
+            cryptoAdapter: new NodeCryptoAdapter_1.NodeCryptoAdapter(),
+            serverPassword,
         });
-        this.purgeInFlight.set(normalizedId, run);
-        return run;
-    }
-    async executePendingPurgesInternal(normalizedId) {
-        const tenant = await this.getTenant(normalizedId);
-        if (!tenant.mindooTenant) {
-            // Config-based fallback: the server holds no $publicinfos directory and
-            // cannot read purge requests. Clients still purge locally on reconcile.
-            return;
-        }
-        let directory;
-        try {
-            directory = await tenant.mindooTenant.openDirectory();
-        }
-        catch (error) {
-            console.error(`[TenantManager] executePendingPurges: cannot open directory for ${normalizedId}:`, error);
-            return;
-        }
-        if (typeof directory.getRequestedDocHistoryPurges !== "function") {
-            return;
-        }
-        let requests;
-        try {
-            requests = await directory.getRequestedDocHistoryPurges();
-        }
-        catch (error) {
-            console.error(`[TenantManager] executePendingPurges: cannot read purge requests for ${normalizedId}:`, error);
-            return;
-        }
-        if (requests.length === 0)
-            return;
-        const registry = this.getPurgedDocRegistry(normalizedId);
-        const purgedNow = new Set();
-        const touchedDbIds = new Set();
-        for (const request of requests) {
-            if (registry.isRequestProcessed(request.purgeRequestDocId)) {
-                continue;
-            }
-            if (typeof request.dbId !== "string" || request.dbId.length === 0) {
-                continue;
-            }
-            for (const docId of request.docIds) {
-                if (typeof docId !== "string" || docId.length === 0)
-                    continue;
-                // Denylist BEFORE purging: the sync push path consults the registry
-                // live, so from this moment re-pushes of the doc are rejected. Doing it
-                // after the store purges would leave a window in which the entries are
-                // already gone but a stale client could still re-push (and the server
-                // would re-accept) the very history that is being purged. The record is
-                // kept regardless of per-store outcome so re-pushes are rejected even
-                // if one store had nothing to purge.
-                registry.recordPurgedDoc(request.dbId, docId);
-                await this.purgeDocumentFromDatabase(normalizedId, request.dbId, docId);
-                purgedNow.add(`${request.dbId}\u0000${docId}`);
-                touchedDbIds.add(request.dbId);
-            }
-            registry.markRequestProcessed(request.purgeRequestDocId);
-            console.log(`[TenantManager] Executed purge request ${request.purgeRequestDocId} (${request.docIds.length} doc(s)) for ${normalizedId}/${request.dbId}`);
-        }
-        // A purge keeps attachment chunks that another document's history still
-        // references (an in-place copy). Once that document is purged as well,
-        // the earlier purge's leftovers are unreferenced: sweep them now, since a
-        // processed request is never executed again.
-        for (const dbId of touchedDbIds) {
-            for (const docId of registry.getPurgedDocIds(dbId)) {
-                if (!purgedNow.has(`${dbId}\u0000${docId}`)) {
-                    await this.purgeDocumentFromDatabase(normalizedId, dbId, docId);
-                }
-            }
-        }
-    }
-    /**
-     * Purge one document from a database's docs and attachment stores. Attachment
-     * chunks still referenced by another document are kept (see
-     * `purgeDocumentHistory.ts`). Failures are logged, never thrown.
-     */
-    async purgeDocumentFromDatabase(tenantId, dbId, docId) {
-        try {
-            await (0, purgeDocumentHistory_1.purgeDocumentHistoryFromStores)({
-                docsStore: await this.getStore(tenantId, dbId, types_1.StoreKind.docs),
-                attachmentStore: await this.getStore(tenantId, dbId, types_1.StoreKind.attachments),
-            }, docId);
-        }
-        catch (error) {
-            console.error(`[TenantManager] executePendingPurges: failed to purge ${docId} in ${tenantId}/${dbId}:`, error);
-        }
+        this.dataDir = dataDir;
     }
-    async getAuthService(tenantId) {
-        const tenant = await this.getTenant(tenantId);
-        return tenant.authService;
+    getDataDir() {
+        return this.dataDir;
     }
     getCryptoAdapter() {
-        return this.cryptoAdapter;
-    }
-    async reloadTenant(tenantId) {
-        const normalizedId = tenantId.toLowerCase();
-        this.loadedTenants.delete(normalizedId);
-        return this.getTenant(normalizedId);
-    }
-    clearCache() {
-        this.loadedTenants.clear();
-        console.log(`[TenantManager] Cleared tenant cache`);
-    }
-    // -----------------------------------------------------------------------
-    // Private helpers
-    // -----------------------------------------------------------------------
-    async loadTenant(tenantId) {
-        const configPath = this.resolveTenantConfigPath(tenantId);
-        if (!(0, fs_1.existsSync)(configPath)) {
-            throw new Error(`Tenant ${tenantId} not found: ${configPath}`);
-        }
-        const configJson = (0, fs_1.readFileSync)(configPath, "utf-8");
-        const config = JSON.parse(configJson);
-        const context = { tenantId, config };
-        const storeFactory = new StoreFactory_1.StoreFactory(tenantId, config, this.dataDir);
-        // Build the inner directory (real or config-based fallback)
-        let innerDirectory;
-        let mindooTenant;
-        const publicInfosKeys = await this.getStoredPublicInfosKeys(tenantId);
-        if (publicInfosKeys.length > 0 &&
-            this.serverIdentity &&
-            this.serverPassword) {
-            try {
-                const result = await this.createDirectoryTenant(tenantId, config, storeFactory, publicInfosKeys);
-                mindooTenant = result.tenant;
-                innerDirectory = await mindooTenant.openDirectory();
-                console.log(`[TenantManager] Loaded tenant ${tenantId} with real directory`);
-            }
-            catch (error) {
-                console.error(`[TenantManager] Failed to create real directory for ${tenantId}, falling back to config:`, error);
-                innerDirectory = new SimpleMindooDirectory(config);
-            }
-        }
-        else {
-            if (publicInfosKeys.length > 0 && !this.serverIdentity) {
-                console.log(`[TenantManager] Tenant ${tenantId} has $publicinfos keys but no server identity; using config-based directory`);
-            }
-            else {
-                console.log(`[TenantManager] No $publicinfos keys for ${tenantId}, using config-based directory`);
-            }
-            innerDirectory = new SimpleMindooDirectory(config);
-        }
-        // Wrap with CompositeMindooDirectory so trusted servers are also recognized
-        const directory = new CompositeMindooDirectory(innerDirectory, this.trustedServers, config.adminUsername
-            ? {
-                username: config.adminUsername,
-                signingPublicKey: config.adminSigningPublicKey,
-                encryptionPublicKey: config.adminEncryptionPublicKey,
-            }
-            : undefined);
-        const authService = new AuthenticationService_1.AuthenticationService(this.cryptoAdapter, directory, tenantId);
-        console.log(`[TenantManager] Loaded tenant: ${tenantId}`);
-        return {
-            context,
-            storeFactory,
-            authService,
-            directory,
-            mindooTenant,
-            serverStores: new Map(),
-        };
-    }
-    /**
-     * Create a real BaseMindooTenant for directory reading using the global
-     * server identity.
-     */
-    async createDirectoryTenant(tenantId, config, storeFactory, publicInfosKeys) {
-        const storeFactoryAdapter = new StoreFactoryAdapter(storeFactory);
-        const factory = new BaseMindooTenantFactory_1.BaseMindooTenantFactory(storeFactoryAdapter, this.cryptoAdapter);
-        const serverUser = this.serverIdentity;
-        // Create a KeyBag using the server user's encryption key
-        const keyBag = await this.createServerKeyBag(serverUser, this.serverPassword);
-        for (const publicInfosKey of this.mergeUniqueKeys(publicInfosKeys)) {
-            await keyBag.set("doc", tenantId, types_1.PUBLIC_INFOS_KEY_ID, publicInfosKey);
-        }
-        // Collect trusted server signing keys for additionalTrustedKeys
-        const openOptions = {};
-        if (this.trustedServers.length > 0) {
-            const trustedKeys = new Map();
-            for (const server of this.trustedServers) {
-                trustedKeys.set(server.signingPublicKey, true);
-            }
-            openOptions.additionalTrustedKeys = trustedKeys;
-        }
-        const tenant = await factory.openTenant(tenantId, config.adminSigningPublicKey, config.adminEncryptionPublicKey, serverUser, this.serverPassword, keyBag, openOptions);
-        return { tenant };
+        return super.getCryptoAdapter();
     }
 }
 exports.TenantManager = TenantManager;