mindoodb 0.0.85 → 0.0.88

package/dist/server/peer/ClusterJobRunner.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * Job registry for the mutating cluster actions.
+ *
+ * Every `POST /system/cluster/actions/*` returns a `jobId` immediately instead
+ * of holding the connection open. A full mirror of a large tenant can run for
+ * minutes; a console that waits for the response would either time out at some
+ * proxy or force the operator to stare at a spinner with no idea what is
+ * happening. With a job the UI gets an id in milliseconds and then polls
+ * `GET /system/cluster/jobs/:id` for typed progress.
+ *
+ * Jobs live in memory. They describe an action in flight, not a durable
+ * promise: after a restart nothing is running, so there is nothing to report,
+ * and the audit log (not this registry) is what preserves the record that the
+ * action happened.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterJobRunner = void 0;
+const idGeneration_1 = require("../../core/utils/idGeneration");
+const types_1 = require("./types");
+/** How many finished jobs to keep for polling before evicting the oldest. */
+const DEFAULT_HISTORY_LIMIT = 200;
+class ClusterJobRunner {
+    constructor(historyLimit = DEFAULT_HISTORY_LIMIT) {
+        this.historyLimit = historyLimit;
+        this.jobs = new Map();
+        this.order = [];
+    }
+    /**
+     * Register a job and start it. Returns as soon as the job is queued, so the
+     * caller can answer `202 Accepted` with the id.
+     */
+    start(kind, scope, requestedBy, work) {
+        const job = {
+            id: (0, idGeneration_1.generateRandomUuid)(),
+            kind,
+            scope,
+            state: "queued",
+            createdAt: new Date().toISOString(),
+            startedAt: null,
+            finishedAt: null,
+            progress: { total: 0, completed: 0 },
+            result: null,
+            error: null,
+            errorClass: null,
+            requestedBy,
+        };
+        this.jobs.set(job.id, job);
+        this.order.push(job.id);
+        this.evictOverLimit();
+        void this.run(job, work);
+        return job;
+    }
+    async run(job, work) {
+        job.state = "running";
+        job.startedAt = new Date().toISOString();
+        try {
+            job.result = await work({
+                progress: (completed, total) => {
+                    job.progress = { completed, total };
+                },
+            });
+            job.state = "succeeded";
+        }
+        catch (error) {
+            job.state = "failed";
+            job.error = error instanceof Error ? error.message : String(error);
+            job.errorClass = (0, types_1.classifyPeerError)(error);
+        }
+        finally {
+            job.finishedAt = new Date().toISOString();
+        }
+    }
+    get(id) {
+        return this.jobs.get(id) ?? null;
+    }
+    /** Newest first, which is the order a console wants to render. */
+    list(limit = 50) {
+        const ids = this.order.slice(-limit).reverse();
+        return ids
+            .map((id) => this.jobs.get(id))
+            .filter((job) => job !== undefined);
+    }
+    /**
+     * Wait for a job to settle. Only for tests — the HTTP surface always polls,
+     * because that is the contract the console is built against.
+     */
+    async waitFor(id, timeoutMs = 30000) {
+        const deadline = Date.now() + timeoutMs;
+        for (;;) {
+            const job = this.jobs.get(id);
+            if (!job)
+                return null;
+            if (job.state === "succeeded" || job.state === "failed")
+                return job;
+            if (Date.now() > deadline)
+                return job;
+            await new Promise((resolve) => setTimeout(resolve, 25));
+        }
+    }
+    evictOverLimit() {
+        let index = 0;
+        while (this.order.length > this.historyLimit && index < this.order.length) {
+            const id = this.order[index];
+            const job = this.jobs.get(id);
+            // Never drop a job that is still going: its id is in a caller's hands and
+            // they are polling for it. Skip past it and evict the next finished one,
+            // which keeps `order` oldest-to-newest.
+            if (job && (job.state === "queued" || job.state === "running")) {
+                index += 1;
+                continue;
+            }
+            this.order.splice(index, 1);
+            this.jobs.delete(id);
+        }
+    }
+}
+exports.ClusterJobRunner = ClusterJobRunner;
+//# sourceMappingURL=ClusterJobRunner.js.map

package/dist/server/peer/ClusterJobRunner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterJobRunner.js","sourceRoot":"","sources":["../../../src/server/peer/ClusterJobRunner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAEH,gEAAmE;AACnE,mCAMiB;AAEjB,6EAA6E;AAC7E,MAAM,qBAAqB,GAAG,GAAG,CAAC;AASlC,MAAa,gBAAgB;IAI3B,YAA6B,eAAuB,qBAAqB;QAA5C,iBAAY,GAAZ,YAAY,CAAgC;QAHxD,SAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;QACrC,UAAK,GAAa,EAAE,CAAC;IAEsC,CAAC;IAE7E;;;OAGG;IACH,KAAK,CACH,IAAoB,EACpB,KAAsB,EACtB,WAAmB,EACnB,IAAoB;QAEpB,MAAM,GAAG,GAAe;YACtB,EAAE,EAAE,IAAA,iCAAkB,GAAE;YACxB,IAAI;YACJ,KAAK;YACL,KAAK,EAAE,QAAQ;YACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,IAAI;YACf,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE;YACpC,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,IAAI;YAChB,WAAW;SACZ,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxB,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,KAAK,CAAC,GAAG,CAAC,GAAe,EAAE,IAAoB;QACrD,GAAG,CAAC,KAAK,GAAG,SAAS,CAAC;QACtB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC;gBACtB,QAAQ,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE;oBAC7B,GAAG,CAAC,QAAQ,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBACtC,CAAC;aACF,CAAC,CAAC;YACH,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC;YACrB,GAAG,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnE,GAAG,CAAC,UAAU,GAAG,IAAA,yBAAiB,EAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;gBAAS,CAAC;YACT,GAAG,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC;IACnC,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC,KAAK,GAAG,EAAE;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO,GAAG;aACP,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;aAC9B,MAAM,CAAC,CAAC,GAAG,EAAqB,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IAC3D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,SAAS,GAAG,KAAM;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,IAAI,GAAG,CAAC,KAAK,KAAK,WAAW,IAAI,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YACpE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBAAE,OAAO,GAAG,CAAC;YACtC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,cAAc;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,0EAA0E;YAC1E,yEAAyE;YACzE,wCAAwC;YACxC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC/D,KAAK,IAAI,CAAC,CAAC;gBACX,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;CACF;AArGD,4CAqGC"}

package/dist/server/peer/ClusterManager.d.ts

@@ -0,0 +1,149 @@
+/**
+ * Owns everything cluster-shaped on one node: the peer session authenticator,
+ * one {@link PeerReplicator} per trusted server that has a `url`, the job
+ * registry behind the mutating admin actions, and the audit log.
+ *
+ * `MindooDBServer` holds exactly one of these and routes both `/system/peer/*`
+ * (server-to-server protocol) and `/system/cluster/*` (admin surface) into it.
+ * Keeping the two prefixes on one object is fine — they never share an auth
+ * class, and the read model both need is the same in-memory replication state.
+ */
+import { StoreKind, type ContentAddressedStore } from "../../core/types";
+import { Logger } from "../../core/logging";
+import type { CryptoAdapter } from "../../core/crypto/CryptoAdapter";
+import type { IrohStreamIO } from "../../core/appendonlystores/network/IrohStreamIO";
+import type { TrustedServer } from "../types";
+import type { SyncEventBus } from "../SyncEventBus";
+import { PeerAuthService } from "./PeerAuthService";
+import { PeerReplicator, type PeerIrohLink, type PeerTransferLimits } from "./PeerReplicator";
+import { ClusterJobRunner } from "./ClusterJobRunner";
+import { ClusterAuditLog, type ClusterAuditStorage } from "./ClusterAuditLog";
+import { type ClusterJob, type ClusterJobKind, type ClusterJobScope, type ClusterStatusResponse, type ClusterTenantStatusResponse, type ClusterTopologyResponse, type PeerRole } from "./types";
+/** Result of dispatching an admin action; `accepted` discriminates the union. */
+export type ClusterActionOutcome = {
+    accepted: true;
+    job: ClusterJob;
+} | {
+    accepted: false;
+    error: string;
+};
+export interface ClusterManagerDeps {
+    cryptoAdapter: CryptoAdapter;
+    /** Where the audit log is kept (on Node `<dataDir>/cluster/audit.jsonl`). */
+    auditStorage: ClusterAuditStorage;
+    eventBus: SyncEventBus;
+    /** Trusted servers, re-read on every call so peer CRUD takes effect at once. */
+    listTrustedServers(): TrustedServer[];
+    /** This node's own name from `server.identity.json`, or null without identity. */
+    localServerName(): string | null;
+    /** This node's Ed25519 public key (PEM), how peers look it up. */
+    localSigningPublicKey(): string | null;
+    getSigningKey(): Promise<CryptoKey | undefined>;
+    getEncryptionKey(): Promise<CryptoKey | undefined>;
+    listTenants(): string[];
+    listDatabases(tenantId: string): string[] | Promise<string[]>;
+    getLocalStore(tenantId: string, dbId: string, storeKind: StoreKind): Promise<ContentAddressedStore>;
+    /** This node's mesh role; `peer` unless config says hub or spoke. */
+    localRole?: PeerRole;
+    /**
+     * Bound Iroh endpoint for outbound peer dials. `null` until Iroh is online
+     * (or when `iroh.enabled` is off). Replicators treat that as a reconnect.
+     */
+    getIrohStreamIO?: () => IrohStreamIO | null;
+    /** Dial a peer over Iroh; without it `iroh:` peer urls cannot be replicated. */
+    openIrohLink?: (io: IrohStreamIO, ticket: string) => PeerIrohLink;
+    /** See {@link PeerReplicatorHost.liveEventStream}. */
+    liveEventStream?: boolean;
+    /** See {@link PeerReplicatorHost.transferLimits}. */
+    transferLimits?: PeerTransferLimits;
+    /**
+     * HMAC secret of peer tokens. Defaults to a random one per process; a host
+     * that validates peer tokens in several places passes a shared secret.
+     */
+    peerJwtSecret?: Uint8Array;
+    /** See {@link PeerReplicatorHost.getPurgedDocIds}. */
+    getPurgedDocIds?(tenantId: string, dbId: string): ReadonlySet<string>;
+    /** See {@link PeerReplicatorHost.onDirectoryPulled}. */
+    onDirectoryPulled?(tenantId: string): Promise<void>;
+    logger?: Logger;
+}
+export declare class ClusterManager {
+    private readonly deps;
+    readonly auth: PeerAuthService;
+    readonly jobs: ClusterJobRunner;
+    readonly audit: ClusterAuditLog;
+    private readonly replicators;
+    private readonly logger;
+    private started;
+    /**
+     * Tenants each peer is allowed to hear about, from the last Bloom handshake
+     * that peer performed against us.
+     *
+     * Inbound state, distinct from a replicator's own outbound intersection: this
+     * is what *they* asked about, and it exists so the peer event stream can be
+     * filtered. Without it the feed would announce every tenant we host, which
+     * would hand a peer the tenant list the Bloom exchange is designed to keep
+     * from it.
+     */
+    private readonly peerIntersections;
+    constructor(deps: ClusterManagerDeps);
+    private get localRole();
+    /**
+     * Bring the replicator set in line with `trusted-servers.json`.
+     *
+     * Called at startup and after any peer CRUD. Existing replicators are updated
+     * in place rather than recreated so their scan cursors and echo-suppression
+     * state survive an edit to, say, the attachment mode.
+     */
+    syncReplicators(): void;
+    start(): void;
+    stop(): Promise<void>;
+    get autoSyncEnabled(): boolean;
+    getReplicator(name: string): PeerReplicator | null;
+    /**
+     * One replication pass with every peer, resolved when all are done. For
+     * hosts that drive replication from a schedule rather than from timers.
+     */
+    syncAll(options?: {
+        deadline?: number;
+    }): Promise<{
+        deferred: boolean;
+    }>;
+    /** Push a local change to every peer that takes it; see {@link PeerReplicator.replicateLocalChange}. */
+    replicateLocalChange(event: Parameters<PeerReplicator["replicateLocalChange"]>[0]): Promise<void>;
+    /** Record what a peer's Bloom handshake matched; see {@link peerIntersections}. */
+    recordPeerIntersection(peerName: string, tenantIds: string[]): void;
+    /**
+     * May this peer be told that something changed in this tenant?
+     *
+     * Closed by default: a peer that has not run the Bloom handshake in this
+     * process gets nothing, rather than everything.
+     */
+    peerMaySeeTenant(peerName: string, tenantId: string): boolean;
+    topology(): ClusterTopologyResponse;
+    status(): ClusterStatusResponse;
+    tenantStatus(tenantId: string): ClusterTenantStatusResponse;
+    /**
+     * Dispatch an action as a job across the peers the scope selects.
+     *
+     * Records the request in the audit log first, with the job id, so an action
+     * that is issued is on record even if the node dies mid-run.
+     */
+    runAction(kind: ClusterJobKind, scope: ClusterJobScope, requestedBy: string): ClusterActionOutcome;
+    private targetsFor;
+    /** Record a peer CRUD change; the caller has already persisted it. */
+    auditPeerChange(action: "peer-create" | "peer-update" | "peer-delete", peerName: string, actor: string): void;
+    /**
+     * Mirrors of one tenant, for `GET /.well-known/mindoodb-cluster`.
+     *
+     * Only peers that actually hold the requested tenant are listed — a client
+     * asking about tenant A must not learn that this server also replicates
+     * tenants B and C to some other node.
+     */
+    mirrorsForTenant(tenantId: string): Array<{
+        name: string;
+        url: string;
+        role: PeerRole;
+    }>;
+}
+//# sourceMappingURL=ClusterManager.d.ts.map

package/dist/server/peer/ClusterManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterManager.d.ts","sourceRoot":"","sources":["../../../src/server/peer/ClusterManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,MAAM,EAAoC,MAAM,oBAAoB,CAAC;AAC9E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kDAAkD,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,cAAc,EAEd,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EACL,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,EAChC,KAAK,uBAAuB,EAC5B,KAAK,QAAQ,EACd,MAAM,SAAS,CAAC;AAEjB,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE,GACnC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,kBAAkB;IACjC,aAAa,EAAE,aAAa,CAAC;IAC7B,6EAA6E;IAC7E,YAAY,EAAE,mBAAmB,CAAC;IAClC,QAAQ,EAAE,YAAY,CAAC;IACvB,gFAAgF;IAChF,kBAAkB,IAAI,aAAa,EAAE,CAAC;IACtC,kFAAkF;IAClF,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,kEAAkE;IAClE,qBAAqB,IAAI,MAAM,GAAG,IAAI,CAAC;IACvC,aAAa,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAChD,gBAAgB,IAAI,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IACnD,WAAW,IAAI,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,aAAa,CACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClC,qEAAqE;IACrE,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,YAAY,GAAG,IAAI,CAAC;IAC5C,gFAAgF;IAChF,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,YAAY,CAAC;IAClE,sDAAsD;IACtD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,qDAAqD;IACrD,cAAc,CAAC,EAAE,kBAAkB,CAAC;IACpC;;;OAGG;IACH,aAAa,CAAC,EAAE,UAAU,CAAC;IAC3B,sDAAsD;IACtD,eAAe,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACtE,wDAAwD;IACxD,iBAAiB,CAAC,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,cAAc;IAoBb,OAAO,CAAC,QAAQ,CAAC,IAAI;IAnBjC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,IAAI,mBAA0B;IACvC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAEhC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqC;IACjE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,OAAO,CAAS;IACxB;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAkC;gBAEvC,IAAI,EAAE,kBAAkB;IAYrD,OAAO,KAAK,SAAS,GAEpB;IAID;;;;;;OAMG;IACH,eAAe,IAAI,IAAI;IA8CvB,KAAK,IAAI,IAAI;IAcP,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAM3B,IAAI,eAAe,IAAI,OAAO,CAE7B;IAED,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAIlD;;;OAGG;IACG,OAAO,CAAC,OAAO,GAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;IASlF,wGAAwG;IAClG,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvG,mFAAmF;IACnF,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI;IAInE;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO;IAM7D,QAAQ,IAAI,uBAAuB;IAOnC,MAAM,IAAI,qBAAqB;IAkB/B,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,2BAA2B;IAa3D;;;;;OAKG;IACH,SAAS,CACP,IAAI,EAAE,cAAc,EACpB,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,MAAM,GAClB,oBAAoB;IA2EvB,OAAO,CAAC,UAAU;IAMlB,sEAAsE;IACtE,eAAe,CACb,MAAM,EAAE,aAAa,GAAG,aAAa,GAAG,aAAa,EACrD,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GACZ,IAAI;IAWP;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,QAAQ,CAAA;KAAE,CAAC;CAYzF"}

package/dist/server/peer/ClusterManager.js

@@ -0,0 +1,292 @@
+"use strict";
+/**
+ * Owns everything cluster-shaped on one node: the peer session authenticator,
+ * one {@link PeerReplicator} per trusted server that has a `url`, the job
+ * registry behind the mutating admin actions, and the audit log.
+ *
+ * `MindooDBServer` holds exactly one of these and routes both `/system/peer/*`
+ * (server-to-server protocol) and `/system/cluster/*` (admin surface) into it.
+ * Keeping the two prefixes on one object is fine — they never share an auth
+ * class, and the read model both need is the same in-memory replication state.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ClusterManager = void 0;
+const logging_1 = require("../../core/logging");
+const PeerAuthService_1 = require("./PeerAuthService");
+const PeerReplicator_1 = require("./PeerReplicator");
+const ClusterJobRunner_1 = require("./ClusterJobRunner");
+const ClusterAuditLog_1 = require("./ClusterAuditLog");
+class ClusterManager {
+    constructor(deps) {
+        this.deps = deps;
+        this.jobs = new ClusterJobRunner_1.ClusterJobRunner();
+        this.replicators = new Map();
+        this.started = false;
+        /**
+         * Tenants each peer is allowed to hear about, from the last Bloom handshake
+         * that peer performed against us.
+         *
+         * Inbound state, distinct from a replicator's own outbound intersection: this
+         * is what *they* asked about, and it exists so the peer event stream can be
+         * filtered. Without it the feed would announce every tenant we host, which
+         * would hand a peer the tenant list the Bloom exchange is designed to keep
+         * from it.
+         */
+        this.peerIntersections = new Map();
+        this.logger =
+            deps.logger?.createChild("Cluster") ??
+                new logging_1.MindooLogger((0, logging_1.getDefaultLogLevel)(), "Cluster", true);
+        this.auth = new PeerAuthService_1.PeerAuthService(deps.cryptoAdapter, () => deps.listTrustedServers(), deps.peerJwtSecret ? { jwtSecret: deps.peerJwtSecret } : undefined);
+        this.audit = new ClusterAuditLog_1.ClusterAuditLog(deps.auditStorage);
+    }
+    get localRole() {
+        return this.deps.localRole ?? "peer";
+    }
+    // ------------------------------------------------------------- lifecycle
+    /**
+     * Bring the replicator set in line with `trusted-servers.json`.
+     *
+     * Called at startup and after any peer CRUD. Existing replicators are updated
+     * in place rather than recreated so their scan cursors and echo-suppression
+     * state survive an edit to, say, the attachment mode.
+     */
+    syncReplicators() {
+        const configured = new Map(this.deps
+            .listTrustedServers()
+            .filter((peer) => typeof peer.url === "string" && peer.url.length > 0)
+            .map((peer) => [peer.name, peer]));
+        for (const [name, replicator] of this.replicators) {
+            if (!configured.has(name)) {
+                void replicator.stop();
+                this.replicators.delete(name);
+            }
+        }
+        for (const [name, peer] of configured) {
+            const existing = this.replicators.get(name);
+            if (existing) {
+                existing.updatePeer(peer);
+                continue;
+            }
+            const replicator = new PeerReplicator_1.PeerReplicator(peer, {
+                cryptoAdapter: this.deps.cryptoAdapter,
+                localServerName: this.deps.localServerName() ?? "",
+                localSigningPublicKey: this.deps.localSigningPublicKey() ?? "",
+                localRole: this.localRole,
+                getSigningKey: () => this.deps.getSigningKey(),
+                getEncryptionKey: () => this.deps.getEncryptionKey(),
+                listTenants: () => this.deps.listTenants(),
+                listDatabases: (tenantId) => this.deps.listDatabases(tenantId),
+                getLocalStore: (tenantId, dbId, storeKind) => this.deps.getLocalStore(tenantId, dbId, storeKind),
+                eventBus: this.deps.eventBus,
+                getIrohStreamIO: this.deps.getIrohStreamIO,
+                openIrohLink: this.deps.openIrohLink,
+                liveEventStream: this.deps.liveEventStream,
+                transferLimits: this.deps.transferLimits,
+                getPurgedDocIds: this.deps.getPurgedDocIds?.bind(this.deps),
+                onDirectoryPulled: this.deps.onDirectoryPulled?.bind(this.deps),
+                logger: this.logger,
+            });
+            this.replicators.set(name, replicator);
+            if (this.started)
+                replicator.start();
+        }
+    }
+    start() {
+        if (this.started)
+            return;
+        if (!this.deps.localServerName()) {
+            this.logger.info("No server identity; peer replication stays off");
+            return;
+        }
+        this.started = true;
+        this.syncReplicators();
+        for (const replicator of this.replicators.values()) {
+            replicator.start();
+        }
+        this.logger.info(`Peer replication started for ${this.replicators.size} peer(s)`);
+    }
+    async stop() {
+        this.started = false;
+        await Promise.all([...this.replicators.values()].map((peer) => peer.stop()));
+        this.replicators.clear();
+    }
+    get autoSyncEnabled() {
+        return this.started;
+    }
+    getReplicator(name) {
+        return this.replicators.get(name) ?? null;
+    }
+    /**
+     * One replication pass with every peer, resolved when all are done. For
+     * hosts that drive replication from a schedule rather than from timers.
+     */
+    async syncAll(options = {}) {
+        const runs = await Promise.all([...this.replicators.values()].map((replicator) => replicator.syncNow({ deadline: options.deadline }).catch(() => null)));
+        return { deferred: runs.some((run) => run?.deferred === true) };
+    }
+    /** Push a local change to every peer that takes it; see {@link PeerReplicator.replicateLocalChange}. */
+    async replicateLocalChange(event) {
+        await Promise.all([...this.replicators.values()].map((replicator) => replicator.replicateLocalChange(event)));
+    }
+    /** Record what a peer's Bloom handshake matched; see {@link peerIntersections}. */
+    recordPeerIntersection(peerName, tenantIds) {
+        this.peerIntersections.set(peerName, new Set(tenantIds));
+    }
+    /**
+     * May this peer be told that something changed in this tenant?
+     *
+     * Closed by default: a peer that has not run the Bloom handshake in this
+     * process gets nothing, rather than everything.
+     */
+    peerMaySeeTenant(peerName, tenantId) {
+        return this.peerIntersections.get(peerName)?.has(tenantId) ?? false;
+    }
+    // ------------------------------------------------------------ read model
+    topology() {
+        return {
+            server: { name: this.deps.localServerName(), role: this.localRole },
+            peers: [...this.replicators.values()].map((peer) => peer.topologyEntry()),
+        };
+    }
+    status() {
+        const peers = [...this.replicators.values()].map((peer) => peer.snapshot());
+        // Node health is the worst peer's health: one stalled link is enough to
+        // mean this node is not fully converged with the mesh.
+        const { health, reasons } = (0, PeerReplicator_1.rollUpHealth)([], peers.flatMap((peer) => peer.reasons));
+        return {
+            server: this.deps.localServerName(),
+            health: peers.length === 0 ? "ok" : health,
+            reasons: peers.length === 0 ? [] : reasons,
+            autoSyncEnabled: this.started,
+            generatedAt: new Date().toISOString(),
+            peers,
+        };
+    }
+    tenantStatus(tenantId) {
+        return {
+            tenantId,
+            generatedAt: new Date().toISOString(),
+            peers: [...this.replicators.values()].map((peer) => ({
+                name: peer.name,
+                tenant: peer.tenantSnapshot(tenantId),
+            })),
+        };
+    }
+    // --------------------------------------------------------------- actions
+    /**
+     * Dispatch an action as a job across the peers the scope selects.
+     *
+     * Records the request in the audit log first, with the job id, so an action
+     * that is issued is on record even if the node dies mid-run.
+     */
+    runAction(kind, scope, requestedBy) {
+        const targets = this.targetsFor(scope);
+        if (targets.length === 0) {
+            this.audit.append({
+                at: new Date().toISOString(),
+                actor: requestedBy,
+                action: kind,
+                scope,
+                jobId: null,
+                outcome: "rejected",
+                detail: scope.peer ? "unknown peer" : "no peers configured",
+            });
+            return {
+                accepted: false,
+                error: scope.peer ? `Unknown peer: ${scope.peer}` : "No peers configured",
+            };
+        }
+        const job = this.jobs.start(kind, scope, requestedBy, async (ctx) => {
+            const result = {
+                transferredEntries: 0,
+                transferredBytes: 0,
+                rejectedEntries: 0,
+                tenantsProcessed: 0,
+                databasesProcessed: 0,
+            };
+            let completed = 0;
+            const peerScope = { tenantId: scope.tenantId, dbId: scope.dbId };
+            for (const replicator of targets) {
+                switch (kind) {
+                    case "sync":
+                    case "retry-rejected": {
+                        const run = kind === "sync"
+                            ? await replicator.syncNow(peerScope)
+                            : await replicator.retryRejected(peerScope);
+                        result.transferredEntries += run.pushed + run.pulled;
+                        result.rejectedEntries += run.rejected;
+                        result.tenantsProcessed += run.tenants;
+                        result.databasesProcessed += run.databases;
+                        if (run.errors.length > 0) {
+                            throw new Error(run.errors.join("; "));
+                        }
+                        break;
+                    }
+                    case "refresh-intersection": {
+                        const shared = await replicator.refreshIntersection();
+                        result.tenantsProcessed += shared.length;
+                        break;
+                    }
+                    case "pause":
+                        replicator.pause();
+                        break;
+                    case "resume":
+                        replicator.resume();
+                        break;
+                }
+                completed += 1;
+                ctx.progress(completed, targets.length);
+            }
+            return result;
+        });
+        this.audit.append({
+            at: new Date().toISOString(),
+            actor: requestedBy,
+            action: kind,
+            scope,
+            jobId: job.id,
+            outcome: "accepted",
+        });
+        return { accepted: true, job };
+    }
+    targetsFor(scope) {
+        if (!scope.peer)
+            return [...this.replicators.values()];
+        const replicator = this.replicators.get(scope.peer);
+        return replicator ? [replicator] : [];
+    }
+    /** Record a peer CRUD change; the caller has already persisted it. */
+    auditPeerChange(action, peerName, actor) {
+        this.audit.append({
+            at: new Date().toISOString(),
+            actor,
+            action,
+            scope: { peer: peerName },
+            jobId: null,
+            outcome: "accepted",
+        });
+    }
+    /**
+     * Mirrors of one tenant, for `GET /.well-known/mindoodb-cluster`.
+     *
+     * Only peers that actually hold the requested tenant are listed — a client
+     * asking about tenant A must not learn that this server also replicates
+     * tenants B and C to some other node.
+     */
+    mirrorsForTenant(tenantId) {
+        const mirrors = [];
+        for (const replicator of this.replicators.values()) {
+            // No snapshot for this tenant means the Bloom intersection did not put it
+            // on both sides, so the peer is not a mirror a client could fail over to.
+            if (!replicator.tenantSnapshot(tenantId))
+                continue;
+            const entry = replicator.topologyEntry();
+            if (!entry.url)
+                continue;
+            mirrors.push({ name: entry.name, url: entry.url, role: entry.role });
+        }
+        return mirrors;
+    }
+}
+exports.ClusterManager = ClusterManager;
+//# sourceMappingURL=ClusterManager.js.map

package/dist/server/peer/ClusterManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClusterManager.js","sourceRoot":"","sources":["../../../src/server/peer/ClusterManager.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAGH,gDAA8E;AAK9E,uDAAoD;AACpD,qDAM0B;AAC1B,yDAAsD;AACtD,uDAA8E;AA8D9E,MAAa,cAAc;IAoBzB,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QAlB5C,SAAI,GAAG,IAAI,mCAAgB,EAAE,CAAC;QAGtB,gBAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;QAEzD,YAAO,GAAG,KAAK,CAAC;QACxB;;;;;;;;;WASG;QACc,sBAAiB,GAAG,IAAI,GAAG,EAAuB,CAAC;QAGlE,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,SAAS,CAAC;gBACnC,IAAI,sBAAY,CAAC,IAAA,4BAAkB,GAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,GAAG,IAAI,iCAAe,CAC7B,IAAI,CAAC,aAAa,EAClB,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAC/B,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,iCAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,IAAY,SAAS;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IACvC,CAAC;IAED,0EAA0E;IAE1E;;;;;;OAMG;IACH,eAAe;QACb,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,IAAI,CAAC,IAAI;aACN,kBAAkB,EAAE;aACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAU,CAAC,CAC7C,CAAC;QAEF,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,+BAAc,CAAC,IAAI,EAAE;gBAC1C,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa;gBACtC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE;gBAClD,qBAAqB,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,EAAE;gBAC9D,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,aAAa,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE;gBAC9C,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE;gBACpD,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAC1C,aAAa,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC;gBAC9D,aAAa,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAC3C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC;gBACpD,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;gBAC1C,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;gBACpC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;gBAC1C,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc;gBACxC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC3D,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC/D,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACvC,IAAI,IAAI,CAAC,OAAO;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YACnE,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,IAAI,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,UAAiC,EAAE;QAC/C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAChD,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACrE,CACF,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;IAClE,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,oBAAoB,CAAC,KAA4D;QACrF,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAC3F,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,sBAAsB,CAAC,QAAgB,EAAE,SAAmB;QAC1D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,QAAgB,EAAE,QAAgB;QACjD,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;IACtE,CAAC;IAED,0EAA0E;IAE1E,QAAQ;QACN,OAAO;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE;YACnE,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;SAC1E,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,6BAAY,EACtC,EAAE,EACF,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CACtC,CAAC;QACF,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YACnC,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAC1C,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO;YAC1C,eAAe,EAAE,IAAI,CAAC,OAAO;YAC7B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,KAAK;SACN,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,QAAgB;QAC3B,OAAO;YACL,QAAQ;YACR,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACnD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;aACtC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAED,0EAA0E;IAE1E;;;;;OAKG;IACH,SAAS,CACP,IAAoB,EACpB,KAAsB,EACtB,WAAmB;QAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,KAAK,EAAE,WAAW;gBAClB,MAAM,EAAE,IAAI;gBACZ,KAAK;gBACL,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,UAAU;gBACnB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB;aAC5D,CAAC,CAAC;YACH,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,qBAAqB;aAC1E,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAClE,MAAM,MAAM,GAAqB;gBAC/B,kBAAkB,EAAE,CAAC;gBACrB,gBAAgB,EAAE,CAAC;gBACnB,eAAe,EAAE,CAAC;gBAClB,gBAAgB,EAAE,CAAC;gBACnB,kBAAkB,EAAE,CAAC;aACtB,CAAC;YACF,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,MAAM,SAAS,GAAkB,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;YAEhF,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;gBACjC,QAAQ,IAAI,EAAE,CAAC;oBACb,KAAK,MAAM,CAAC;oBACZ,KAAK,gBAAgB,CAAC,CAAC,CAAC;wBACtB,MAAM,GAAG,GACP,IAAI,KAAK,MAAM;4BACb,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;4BACrC,CAAC,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;wBAChD,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;wBACrD,MAAM,CAAC,eAAe,IAAI,GAAG,CAAC,QAAQ,CAAC;wBACvC,MAAM,CAAC,gBAAgB,IAAI,GAAG,CAAC,OAAO,CAAC;wBACvC,MAAM,CAAC,kBAAkB,IAAI,GAAG,CAAC,SAAS,CAAC;wBAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;4BAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;wBACzC,CAAC;wBACD,MAAM;oBACR,CAAC;oBACD,KAAK,sBAAsB,CAAC,CAAC,CAAC;wBAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,mBAAmB,EAAE,CAAC;wBACtD,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,MAAM,CAAC;wBACzC,MAAM;oBACR,CAAC;oBACD,KAAK,OAAO;wBACV,UAAU,CAAC,KAAK,EAAE,CAAC;wBACnB,MAAM;oBACR,KAAK,QAAQ;wBACX,UAAU,CAAC,MAAM,EAAE,CAAC;wBACpB,MAAM;gBACV,CAAC;gBACD,SAAS,IAAI,CAAC,CAAC;gBACf,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,IAAI;YACZ,KAAK;YACL,KAAK,EAAE,GAAG,CAAC,EAAE;YACb,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACjC,CAAC;IAEO,UAAU,CAAC,KAAsB;QACvC,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,eAAe,CACb,MAAqD,EACrD,QAAgB,EAChB,KAAa;QAEb,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YAChB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC5B,KAAK;YACL,MAAM;YACN,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,QAAgB;QAC/B,MAAM,OAAO,GAAyD,EAAE,CAAC;QACzE,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,0EAA0E;YAC1E,0EAA0E;YAC1E,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,CAAC,KAAK,CAAC,GAAG;gBAAE,SAAS;YACzB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAhUD,wCAgUC"}

package/dist/server/peer/PeerAuthService.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Peer (server-to-server) authentication for `/system/peer/*`.
+ *
+ * Same Ed25519 challenge-response as the tenant sync handshake, but the key
+ * lookup goes to `trusted-servers.json` instead of a tenant directory. The
+ * issued JWT is deliberately a **different token class** from the system-admin
+ * JWT: `/system/peer/*` accepts only peer tokens and `/system/cluster/*` only
+ * admin tokens, so a peer can never administer this node and an admin can never
+ * write as a peer.
+ */
+import type { CryptoAdapter } from "../../core/crypto/CryptoAdapter";
+import type { TrustedServer } from "../types";
+export interface PeerTokenPayload {
+    /** Trusted-server name that authenticated. */
+    sub: string;
+    /** The Ed25519 key that signed the challenge, i.e. the peer's identity. */
+    publicsignkey: string;
+    /** Marks this as a peer token; absent/false tokens are rejected by peer routes. */
+    peer: true;
+    iat: number;
+    exp: number;
+}
+export declare class PeerAuthService {
+    private readonly cryptoAdapter;
+    /** Live view of `trusted-servers.json` — re-read on every handshake. */
+    private readonly listTrustedServers;
+    private challenges;
+    /** Challenge creation is unauthenticated, so the map is bounded (DoS guard). */
+    private static readonly MAX_CHALLENGES;
+    private readonly jwtSecret;
+    private readonly challengeExpirationMs;
+    private readonly tokenExpirationMs;
+    constructor(cryptoAdapter: CryptoAdapter, 
+    /** Live view of `trusted-servers.json` — re-read on every handshake. */
+    listTrustedServers: () => TrustedServer[], options?: {
+        jwtSecret?: Uint8Array;
+        challengeExpirationMs?: number;
+        tokenExpirationMs?: number;
+    });
+    /** Resolve a trusted server by its signing key (the canonical identity). */
+    findTrustedServerByKey(publicsignkey: string): TrustedServer | null;
+    /**
+     * Issue a challenge for a peer identified by its signing key.
+     *
+     * @throws Error("Unknown peer") when the key is not in trusted-servers.json.
+     */
+    generateChallenge(publicsignkey: string): Promise<string>;
+    authenticate(challenge: string, signature: Uint8Array): Promise<{
+        success: boolean;
+        token?: string;
+        error?: string;
+    }>;
+    /**
+     * Validate a peer JWT. Returns null unless the token carries `peer: true`
+     * *and* the signing key is still trusted — revoking trust must cut off
+     * outstanding tokens, not just future handshakes.
+     */
+    validateToken(token: string): Promise<PeerTokenPayload | null>;
+    private verifySignature;
+    private generateToken;
+    private cleanupExpiredChallenges;
+    private evictChallengesOverCap;
+    private base64UrlEncode;
+    private base64UrlDecode;
+    private uint8ArrayToBase64Url;
+    private base64UrlToUint8Array;
+    private base64ToUint8Array;
+}
+//# sourceMappingURL=PeerAuthService.d.ts.map