@atlastodo/client-core 0.1.11-rc.5 → 0.1.11-rc.8

package/dist/crypto/rootKey.d.ts

@@ -16,6 +16,8 @@
  */
 /** The app whose key is the account's original DEK. */
 export declare const TODO_APP = "todo";
+/** Atlas Journal: its key and identity are a row under the root (`enableApp`). */
+export declare const JOURNAL_APP = "journal";
 /** A key wrapped under another (root slot, app key, app identity). */
 export interface RootKeyWrap {
     v: 1;

package/dist/fieldPolicy.d.ts

@@ -7,7 +7,19 @@
  * reads against.
  */
 import type { EntityKind } from "./types.js";
-/** A bundled app manifest: its id, version and the entity kinds it syncs. */
+/**
+ * What an app asks of the API tokens that include it (`api_tokens` in its manifest), which the
+ * server enforces. Absent keys are the defaults: no expiry needed, writes allowed.
+ */
+export interface TokenPolicy {
+    /** A token must name an expiry. */
+    expiry_required: boolean;
+    /** The latest expiry a token may name, in days after it is made; null is no limit. */
+    max_lifetime_days: number | null;
+    /** Whether a token may write when its creator does not say. */
+    write_by_default: boolean;
+}
+/** A bundled app manifest: its id, version, the entity kinds it syncs and its token policy. */
 export interface AppManifest {
     app: string;
     name: string;
@@ -15,14 +27,27 @@ export interface AppManifest {
     kinds: Record<string, {
         plaintext_fields: readonly string[] | "all";
     }>;
+    api_tokens?: Partial<TokenPolicy>;
 }
 /**
  * The manifests bundled into this client, as the server bundles them. `EntityKind` (and so
- * {@link PLAINTEXT_FIELDS}) is todo's kinds: this store syncs todo. Another app's client reads its
- * kinds from its own manifest here (journal's encrypt every field).
+ * {@link PLAINTEXT_FIELDS}) holds every bundled app's kinds, as `atlas_core::EntityKind` does;
+ * which of them a client syncs is its session's app scope. Journal's and the vault's kinds
+ * encrypt every field.
  */
 export declare const BUNDLED_MANIFESTS: readonly AppManifest[];
+/**
+ * The policy of a token for all of `apps` (bundled ids), the strictest of theirs as the server
+ * takes it: an expiry required if any requires one, the shortest lifetime, and read-only by
+ * default if any is. A client making a token reads it to ask for an expiry and write access.
+ */
+export declare function tokenPolicyFor(apps: readonly string[]): TokenPolicy;
 /** The bundled app owning the kind with this wire name, if any. */
 export declare function appOfKind(kind: string): AppManifest | undefined;
 export declare const PLAINTEXT_FIELDS: Readonly<Record<EntityKind, readonly string[] | "all">>;
+/**
+ * Whether a value of `entity`.`field` is end-to-end encrypted, for any wire kind: a kind no
+ * bundled manifest names encrypts everything.
+ */
+export declare function shouldEncryptKindField(entity: string, field: string): boolean;
 export declare function shouldEncryptField(entity: EntityKind, field: string): boolean;

package/dist/index.js

@@ -1099,6 +1099,7 @@ import { x25519 as x255193 } from "@noble/curves/ed25519.js";
 import { sha256 as sha2566 } from "@noble/hashes/sha2.js";
 import { hkdf as hkdf5 } from "@noble/hashes/hkdf.js";
 var TODO_APP = "todo";
+var JOURNAL_APP = "journal";
 var KEY_BYTES = 32;
 var json = (parts) => utf8ToBytes(JSON.stringify(parts));
 var rootAad = (userId, slot) => json(["atlas-root-key", 1, userId.toLowerCase(), slot]);
@@ -1475,12 +1476,50 @@ var todo_default = {
     }
   }
 };
+// ../../manifests/vault.json
+var vault_default = {
+  _doc: "The Atlas Vault app manifest: a password manager, end-to-end encrypted, held to a stricter threat model than todo. Its kinds are namespaced `vault.<kind>`. Vault v1 is personal: the server never fans its ops out to another account and reads none of their fields, so every field value is encrypted (no plaintext_fields), including the item type, its folder and its timestamps. `vault.item` is one item (login, note, card, identity, ssh_key, api_key: name, typed fields, urls, notes, tags, folder, favorite, secret field history), `vault.folder` one folder, `vault.preference` one of the app's settings. `api_tokens` is the policy for API tokens that include the app, which the server enforces: an expiry is required, at most `max_lifetime_days` after creation, and a token is read-only unless its creator opts in to writes. Bump `version` whenever the kinds, their plaintext fields or the token policy change.",
+  app: "vault",
+  name: "Atlas Vault",
+  version: 1,
+  kinds: {
+    "vault.item": { plaintext_fields: [] },
+    "vault.folder": { plaintext_fields: [] },
+    "vault.preference": { plaintext_fields: [] }
+  },
+  api_tokens: {
+    expiry_required: true,
+    max_lifetime_days: 365,
+    write_by_default: false
+  }
+};
 
 // src/fieldPolicy.ts
 var BUNDLED_MANIFESTS = Object.freeze([
   todo_default,
-  journal_default
+  journal_default,
+  vault_default
 ]);
+function tokenPolicyFor(apps) {
+  const policy = {
+    expiry_required: false,
+    max_lifetime_days: null,
+    write_by_default: true
+  };
+  for (const app of apps) {
+    const p = BUNDLED_MANIFESTS.find((m) => m.app === app)?.api_tokens;
+    if (!p)
+      continue;
+    if (p.expiry_required)
+      policy.expiry_required = true;
+    if (p.max_lifetime_days != null) {
+      policy.max_lifetime_days = policy.max_lifetime_days == null ? p.max_lifetime_days : Math.min(policy.max_lifetime_days, p.max_lifetime_days);
+    }
+    if (p.write_by_default === false)
+      policy.write_by_default = false;
+  }
+  return policy;
+}
 function appOfKind(kind) {
   return BUNDLED_MANIFESTS.find((m) => Object.prototype.hasOwnProperty.call(m.kinds, kind));
 }
@@ -1498,7 +1537,12 @@ var ENTITY_KINDS = {
   focus_session: true,
   habit: true,
   habit_checkin: true,
-  attachment: true
+  attachment: true,
+  "journal.entry": true,
+  "journal.preference": true,
+  "vault.item": true,
+  "vault.folder": true,
+  "vault.preference": true
 };
 function loadTable(manifests) {
   const table = {};
@@ -1515,6 +1559,12 @@ function loadTable(manifests) {
   return Object.freeze(table);
 }
 var PLAINTEXT_FIELDS = loadTable(BUNDLED_MANIFESTS);
+function shouldEncryptKindField(entity, field) {
+  const plain = appOfKind(entity)?.kinds[entity]?.plaintext_fields;
+  if (plain === "all")
+    return false;
+  return !plain?.includes(field);
+}
 function shouldEncryptField(entity, field) {
   const plain = PLAINTEXT_FIELDS[entity];
   if (plain === "all")
@@ -6635,6 +6685,7 @@ export {
   HlcClock,
   IndexedDbPersistence,
   InvalidApiTokenError,
+  JOURNAL_APP,
   KEY_TRUST_ID,
   Keyring,
   LEGACY_DISCOVERY,
@@ -6824,6 +6875,7 @@ export {
   setPbkdf2Provider,
   sharedProjectIds,
   shouldEncryptField,
+  shouldEncryptKindField,
   signDelivery,
   signInWithPasskey,
   signingPublicKey,
@@ -6832,6 +6884,7 @@ export {
   toEncryptedWire,
   toWireReport,
   todoAppKeyRow,
+  tokenPolicyFor,
   unpadPlaintext,
   unpinMemberKey,
   unsealKey,

package/dist/types.d.ts

@@ -330,6 +330,10 @@ export interface ApiTokenView {
     apps?: string[];
     created_at: number;
     last_used_at?: number;
+    /** When the token stops working; absent when it never does. An expired token stays listed until revoked. */
+    expires_at?: number;
+    /** Whether its sessions may write (absent from servers predating read-only tokens: they may). */
+    write?: boolean;
 }
 /** One non-todo app's key and X25519 identity wrapped for an API token (`wrapAppKeysForApiToken`). */
 export interface ApiTokenAppKeyWraps {
@@ -365,6 +369,14 @@ export interface CreateApiTokenPayload {
         ct: string;
     };
     app_keys?: Record<string, ApiTokenAppKeyWraps>;
+    /**
+     * When the token stops working (unix ms). The apps' policy ({@link tokenPolicyFor}) may require
+     * one and cap how far out it is: a vault token needs one at most 365 days ahead (needs the
+     * `api_token_policies` capability).
+     */
+    expires_at?: number;
+    /** Whether its sessions may write; the policy's default when absent (a vault token is read-only). */
+    write?: boolean;
 }
 /** `POST /auth/api-token/session`: an access token (no refresh token) and the token's wraps. */
 export interface ApiTokenSessionResponse {
@@ -393,6 +405,10 @@ export interface ApiTokenSessionResponse {
         iv: string;
         ct: string;
     };
+    /** When the token expires (unix ms); `expires_in` ends no later. Absent when it never does. */
+    expires_at?: number;
+    /** Whether the session may write; a read-only one gets 403 `api_token_read_only` on writes. */
+    write?: boolean;
 }
 export interface MemberView {
     user_id: string;
@@ -442,7 +458,17 @@ export type Operation = {
 });
 export type EntityKind = "task" | "project" | "section" | "label" | "comment" | "preference" | "saved_filter" | "reminder" | "project_member" | "activity" | "focus_session" | "habit" | "habit_checkin"
 /** Metadata only; ciphertext travels via `/attachments/blobs/:sha256`. */
- | "attachment";
+ | "attachment"
+/**
+ * Atlas Journal's kinds (`manifests/journal.json`), namespaced `<app>.<kind>` like every app's
+ * after todo. Personal and fully encrypted: no plaintext field, no project scope. A journal
+ * client syncs them in a journal-scoped session (`ApiClientOptions.apps`).
+ */
+ | JournalEntityKind
+/** Atlas Vault (`manifests/vault.json`): personal, every field encrypted. */
+ | "vault.item" | "vault.folder" | "vault.preference";
+/** Atlas Journal's entity kinds: `journal.entry` (one entry) and `journal.preference` (a setting). */
+export type JournalEntityKind = "journal.entry" | "journal.preference";
 export interface CreateTaskInput {
     title: string;
     notes?: string;

package/package.json

@@ -1,16 +1,16 @@
 {
   "name": "@atlastodo/client-core",
-  "version": "0.1.11-rc.5",
+  "version": "0.1.11-rc.8",
   "description": "Atlas core client: hybrid logical clocks, the op log and per-field LWW merge, end-to-end encryption, the local store and the sync client",
   "license": "AGPL-3.0-only",
-  "homepage": "https://github.com/atlastodo/atlas-todo/tree/main/packages/client-core",
+  "homepage": "https://github.com/atlastodo/atlas/tree/main/packages/client-core",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/atlastodo/atlas-todo.git",
+    "url": "git+https://github.com/atlastodo/atlas.git",
     "directory": "packages/client-core"
   },
   "bugs": {
-    "url": "https://github.com/atlastodo/atlas-todo/issues"
+    "url": "https://github.com/atlastodo/atlas/issues"
   },
   "type": "module",
   "main": "./dist/index.js",
@@ -36,6 +36,7 @@
       "api_token_vectors.json",
       "conflict_vectors.json",
       "envelope_vectors.json",
+      "field_policy_vectors.json",
       "identity_vectors.json",
       "passkey_vectors.json",
       "password_kdf_vectors.json",

package/test-vectors/api_token_vectors.json

@@ -34,6 +34,20 @@
             "iv": "dXrtP9iobV/5dQK7",
             "ct": "YVQDhrVqw2A7XxrJ1DBI/qTTTVQ0FlPSaGNiMxAE5GyMh3JDOvj6Sl4JjdNi0xQY"
           }
+        },
+        "vault": {
+          "app_key": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+          "app_private_key": "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
+          "wrapped_key": {
+            "v": 1,
+            "iv": "wm+GsbI61xROnC8+",
+            "ct": "3wMTljSLoopA53SXjhbdhPFksiuOdMXNmj7HGqiU+ByMqb794Vb57+NVh0Br9FZv"
+          },
+          "wrapped_private_key": {
+            "v": 1,
+            "iv": "/QKoOwtHubDapdW1",
+            "ct": "UFyTM//C7trgffAR2i0JDdLwtRf6I/9l+eq6oixMefK3KtXZixSE6RF5Flrdzf7C"
+          }
         }
       }
     }

package/test-vectors/field_policy_vectors.json

@@ -0,0 +1,52 @@
+{
+  "_doc": "What the bundled app manifests (manifests/*.json) decide, asserted by packages/client-core/src/fieldPolicy.test.ts and crates/atlas-client (field_policy.rs). `fields`: whether a value of `entity`.`field` leaves the device end-to-end encrypted (`encrypted`); a kind no manifest names, and any field a manifest does not list, is encrypted. Todo keeps only the ids the server routes and checks access by in plaintext; journal and vault keep nothing, so the server sees no vault item's type, name, folder, URL, timestamp or secret. `token_policies`: the API token policy of a token for `apps`, the strictest of their manifests' `api_tokens` (`max_lifetime_days` null is no limit).",
+  "fields": [
+    { "entity": "task", "field": "title", "encrypted": true },
+    { "entity": "task", "field": "project_id", "encrypted": false },
+    { "entity": "task", "field": "assignee_id", "encrypted": false },
+    { "entity": "task", "field": "a_field_nobody_declared", "encrypted": true },
+    { "entity": "comment", "field": "task_id", "encrypted": false },
+    { "entity": "attachment", "field": "blob_sha", "encrypted": false },
+    { "entity": "project_member", "field": "anything", "encrypted": false },
+    { "entity": "journal.entry", "field": "body", "encrypted": true },
+    { "entity": "journal.entry", "field": "date", "encrypted": true },
+    { "entity": "journal.entry", "field": "project_id", "encrypted": true },
+    { "entity": "vault.item", "field": "type", "encrypted": true },
+    { "entity": "vault.item", "field": "name", "encrypted": true },
+    { "entity": "vault.item", "field": "fields", "encrypted": true },
+    { "entity": "vault.item", "field": "urls", "encrypted": true },
+    { "entity": "vault.item", "field": "notes", "encrypted": true },
+    { "entity": "vault.item", "field": "tags", "encrypted": true },
+    { "entity": "vault.item", "field": "folder", "encrypted": true },
+    { "entity": "vault.item", "field": "favorite", "encrypted": true },
+    { "entity": "vault.item", "field": "history", "encrypted": true },
+    { "entity": "vault.item", "field": "created_at", "encrypted": true },
+    { "entity": "vault.item", "field": "updated_at", "encrypted": true },
+    { "entity": "vault.item", "field": "deleted_at", "encrypted": true },
+    { "entity": "vault.item", "field": "project_id", "encrypted": true },
+    { "entity": "vault.item", "field": "task_id", "encrypted": true },
+    { "entity": "vault.folder", "field": "name", "encrypted": true },
+    { "entity": "vault.folder", "field": "deleted_at", "encrypted": true },
+    { "entity": "vault.preference", "field": "value", "encrypted": true },
+    { "entity": "notes.note", "field": "body", "encrypted": true },
+    { "entity": "notes.note", "field": "project_id", "encrypted": true }
+  ],
+  "token_policies": [
+    {
+      "apps": ["todo"],
+      "policy": { "expiry_required": false, "max_lifetime_days": null, "write_by_default": true }
+    },
+    {
+      "apps": ["journal"],
+      "policy": { "expiry_required": false, "max_lifetime_days": null, "write_by_default": true }
+    },
+    {
+      "apps": ["vault"],
+      "policy": { "expiry_required": true, "max_lifetime_days": 365, "write_by_default": false }
+    },
+    {
+      "apps": ["todo", "journal", "vault"],
+      "policy": { "expiry_required": true, "max_lifetime_days": 365, "write_by_default": false }
+    }
+  ]
+}