@atlastodo/client-core 0.1.13 → 0.1.14-rc.1

package/dist/legacy.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The migration of rows written before sync protocol 7 (docs/decisions/0006): their plaintext kind,
+ * field names and links stay on the server until the client that holds them re-encodes them and
+ * drops the originals.
+ *
+ * The server lists what the partition still holds (`GET /sync/legacy/keys`). A key a current copy
+ * already covers (another device or member re-encoded it) is dropped as it is. Any other is
+ * re-encoded from this device's copy: every visible field and the tombstone, each with its original
+ * stamp, so the re-encoded copy changes nothing on any device, then dropped
+ * (`POST /sync/legacy/drop`). The local store is not written. An entity this device cannot re-encode
+ * yet (a value no key opens, a scope without its key, an activity of another member, a shared
+ * project of another owner) stays until a later pass or its owner's client.
+ */
+import type { LocalStore } from "./store.js";
+import type { EntityKind, Operation } from "./types.js";
+export interface LegacyKey {
+    entity: string;
+    entity_id: string;
+    covered: boolean;
+}
+export interface LegacyKeysPage {
+    entities: LegacyKey[];
+    next?: string;
+}
+export interface LegacyTransport {
+    legacyKeys(next?: string): Promise<LegacyKeysPage>;
+    dropLegacy(keys: {
+        entity: string;
+        entity_id: string;
+    }[]): Promise<number>;
+    syncPush(ops: Operation[]): Promise<{
+        deferred?: string[];
+    }>;
+    /** Whether this account may write every field of the entity (its role, its activity). */
+    mayReencode?(kind: EntityKind, entityId: string): boolean;
+}
+export interface LegacyMigration {
+    /** Entities re-encoded and dropped. */
+    reencoded: number;
+    /** Keys dropped as they were, already covered by a current copy. */
+    covered: number;
+    /** Keys left for a later pass. */
+    left: number;
+}
+/** One pass over the partition's legacy keys. Throws what the transport throws. */
+export declare function migrateLegacy(store: LocalStore, transport: LegacyTransport): Promise<LegacyMigration>;

package/dist/realtime.d.ts

@@ -41,9 +41,10 @@ export interface RealtimeClientOptions {
 }
 /**
  * Sent on every request (`x-atlas-sync-protocol`) and in the WebSocket URL; the server answers 426
- * below its minimum. 4: `__enc: 2`, 5: ticket instead of token in the URL, 6: key rotations.
+ * below its minimum. 4: `__enc: 2`, 5: ticket instead of token in the URL, 6: key rotations, 7: wire
+ * kinds, scopes and field tags (docs/decisions/0006).
  */
-export declare const SYNC_PROTOCOL = 6;
+export declare const SYNC_PROTOCOL = 7;
 /** The protocol rides as a param since headers are unavailable. */
 export declare function buildSyncWsUrl(baseUrl: string, ticket: string, since: number): string;
 export declare class RealtimeClient {

package/dist/scope.d.ts

@@ -81,7 +81,7 @@ export interface Repair {
     reason: "key" | "plaintext";
     keyId?: string;
     scope?: KeyScope;
-    version?: 1 | 2;
+    version?: 1 | 2 | 3;
 }
 /** A current value under a rotation-retired key is history and stays. */
 export declare function confirmRepairs(store: ScopeStore, keyring: Keyring, userId: string | undefined, repairs: readonly Repair[]): Repair[];

package/dist/store.d.ts

@@ -1,10 +1,15 @@
 /**
  * Local-first store. Entities are bags of fields resolved by field-level LWW over HLC (as on the
  * server). Local mutations stamp an HLC and enqueue an {@link Operation}; remote ops merge idempotently.
+ *
+ * What the sync decoder could not attribute to a real kind waits under its wire kind (sync protocol
+ * 7): a value no key here opened ({@link SealedPlaceholder}, revived by {@link LocalStore.reviveSealed})
+ * and a tombstone of an entity not seen yet, which the entity takes over when it arrives.
  */
 import { type Hlc } from "./hlc.js";
 import type { PersistedOp, Persistence } from "./persistence.js";
 import type { EntityKind, Operation } from "./types.js";
+import { type SealedPlaceholder } from "./wire.js";
 /** Superseded ops tolerated in the log before a hydrate compacts it (see `LocalStore.compact`). */
 export declare const COMPACT_AFTER_SUPERSEDED = 1000;
 /** The server's `MAX_FUTURE_SKEW_MS`: a later timestamp would pin the clock and get every local op refused. */
@@ -123,6 +128,10 @@ export declare class LocalStore {
     private emit;
     private merge;
     private mergeInto;
+    /** A tombstone that arrived before its entity's kind was known, now the entity's. */
+    private inheritTombstone;
+    /** The real kind of the entity held by this id, or null. */
+    kindOf(entityId: string): EntityKind | null;
     private state;
     private allStates;
     revision(entity: EntityKind): number;
@@ -132,6 +141,8 @@ export declare class LocalStore {
     exists(entity: EntityKind, entityId: string): boolean;
     rawField(entity: EntityKind, entityId: string, field: string): unknown;
     fieldTs(entity: EntityKind, entityId: string, field: string): Hlc | null;
+    /** The entity's tombstone stamp, or null. */
+    tombstoneTs(entity: EntityKind, entityId: string): Hlc | null;
     visibleFieldStates(entity: EntityKind, entityId: string): {
         field: string;
         value: unknown;
@@ -143,6 +154,17 @@ export declare class LocalStore {
         value: unknown;
         keyId: string;
     }>(open: (entity: EntityKind, entityId: string, field: string, envelope: unknown) => O | null): (O & RevivedField)[];
+    /**
+     * Opens the values that arrived sealed under a wire kind (protocol 7) with the keys now held:
+     * each becomes its real kind's field at the same timestamp, and the sealed copy goes. Nothing is
+     * pushed.
+     */
+    reviveSealed<O extends {
+        kind: EntityKind;
+        field: string;
+        value: unknown;
+        keyId: string;
+    }>(open: (wire: string, entityId: string, wireField: string, sealed: SealedPlaceholder) => O | null): (O & RevivedField)[];
     private visibleFields;
     unsyncedOps(): Operation[];
     /** Rebuilds their entities from the remaining ops so they stop masking the server's values. */

package/dist/sync-client.d.ts

@@ -7,6 +7,7 @@ import { ApiError } from "./api.js";
 import { type RealtimeSocket } from "./realtime.js";
 import type { BootstrapProgress, PageRepairs } from "./persistence.js";
 import { type Repair } from "./scope.js";
+import { type LegacyKeysPage, type LegacyMigration } from "./legacy.js";
 import type { LocalStore } from "./store.js";
 import type { Operation } from "./types.js";
 /** Ops per push request; the server caps a push by body size and op count. */
@@ -45,7 +46,16 @@ export interface SyncTransport {
         repairs?: Repair[];
     };
     confirmRepairs?(repairs: Repair[]): Repair[];
+    /** With both, rows written before protocol 7 are re-encoded and dropped (`migrateLegacy`). */
+    legacyKeys?(next?: string): Promise<LegacyKeysPage>;
+    dropLegacy?(keys: {
+        entity: string;
+        entity_id: string;
+    }[]): Promise<number>;
+    mayReencode?(kind: Operation["entity"], entityId: string): boolean;
 }
+/** A pass that left keys it could not re-encode yet runs again after this long. */
+export declare const LEGACY_RETRY_MS: number;
 export type SyncStatus = "idle" | "syncing" | "offline" | "throttled" | "live-ws";
 export declare const THROTTLE_BASE_MS = 5000;
 export declare const THROTTLE_MAX_MS: number;
@@ -68,6 +78,8 @@ export interface SyncClientOptions {
     /** Omit for polling only. The poll reconciles messages the hub dropped for a lagging device. */
     realtime?: SyncRealtimeOptions;
     onRemoteApplied?: (ops: Operation[]) => void;
+    /** After each pass of the protocol 6 migration that found something to do. */
+    onLegacyMigrated?: (result: LegacyMigration) => void;
 }
 export interface SyncResult {
     pushed: number;
@@ -112,6 +124,9 @@ export declare class SyncClient {
     private clockSkew;
     private resumeTimer;
     private epoch;
+    /** Done: the partition holds no protocol 6 rows this device can move; else the next pass's time. */
+    private legacyDone;
+    private legacyNextAt;
     constructor(store: LocalStore, transport: SyncTransport, opts?: SyncClientOptions);
     currentCursor(): number;
     currentStatus(): SyncStatus;
@@ -131,6 +146,8 @@ export declare class SyncClient {
     private throttle;
     private requestSync;
     private run;
+    /** One pass of the protocol 6 migration, when due. Never fails the cycle. */
+    private migrateLegacyRows;
     /** Applies all pages at once so listeners render only the converged state. */
     private pullPhase;
     private resetFromServer;

package/dist/types.d.ts

@@ -431,13 +431,19 @@ export interface InviteView {
         email: string;
         display_name: string;
     } | null;
-    /** Fields may be envelopes readable only with `sealed_key`. */
+    /**
+     * The project's fields as the inviter's rows written before sync protocol 7 hold them, each an
+     * envelope readable only with `sealed_key`, or null. Null once those rows are migrated: see
+     * `preview`.
+     */
     project: {
         name: unknown;
         icon: unknown;
         color: unknown;
         kind: unknown;
     };
+    /** What the inviter sealed under the project key for the invitee (`openInvitePreview`). */
+    preview?: import("./crypto/index.js").SealedInvitePreview | null;
     sealed_key: {
         key_id: string;
         encrypted_pek: unknown;

package/dist/wire.d.ts

@@ -0,0 +1,100 @@
+/**
+ * The sync wire format, protocol 7 (docs/decisions/0006): what an {@link Operation} looks like to
+ * the server, and back.
+ *
+ * On the wire an op names a wire kind (`todo.sealed`, …) instead of its real kind, the scope whose
+ * key encrypted it (`scope`: a project id, or null for the account's own key), and a field that is
+ * an opaque per-entity tag unless the manifest makes it public. The real kind and field travel
+ * inside the value's v3 envelope. Rows written before protocol 7 (legacy kinds, real kind names on
+ * the wire) are read as before, and re-encoded by the migration (`migrateLegacy`), never by a
+ * repair, which would move their timestamps.
+ */
+import { type FieldEnvelopeV3, type KeyScope, type Keyring } from "./crypto/index.js";
+import type { Repair, ScopeKey } from "./scope.js";
+import type { EntityKind, Operation } from "./types.js";
+export type WireOp = {
+    id: string;
+    /** A wire kind, or a real kind name on a row written before protocol 7. */
+    entity: string;
+    entity_id: string;
+    /** The project whose key encrypted the op; null for the account's own key. */
+    scope?: string | null;
+    /** The account that pushed it, as the server says; null for the server's own ops. */
+    pushed_by?: string | null;
+    ts: {
+        wall_ms: number;
+        counter: number;
+        node: string;
+    };
+} & ({
+    op: "set";
+    field: string;
+    value: unknown;
+} | {
+    op: "delete";
+});
+/** A v3 value no key here opened yet: kept where it arrived, with the scope it was written in. */
+export type SealedPlaceholder = FieldEnvelopeV3 & {
+    scope: string | null;
+};
+export declare function isSealedPlaceholder(v: unknown): v is SealedPlaceholder;
+/** Whether `name` is a wire kind of the current protocol (not a legacy or server-authored one). */
+export declare function isSealedWireKind(name: string): boolean;
+/** The wire name of `field` of `kind` entity `entityId` under `key`: its tag, or the field itself
+ * when public. */
+export declare function wireFieldOf(key: Uint8Array, kind: string, entityId: string, field: string): string;
+/**
+ * Encode `op` for the wire with `k`, the key of its scope. Throws for a kind no manifest names
+ * (the server would refuse it) and for server-authored kinds.
+ */
+export declare function encodeOp(op: Operation, k: ScopeKey): WireOp;
+export interface OpenedSealed {
+    kind: EntityKind;
+    field: string;
+    value: unknown;
+    keyId: string;
+    scope: KeyScope;
+}
+/**
+ * Open a v3 value that arrived as `wire`.`wireField` of `entityId` in `scope`. Null unless a held
+ * key of that scope opens it there, its plaintext names a kind of that wire kind, and the wire field
+ * is that field's tag (or the field itself, when public).
+ */
+export declare function openSealed(keyring: Keyring, wire: string, entityId: string, wireField: string, scope: string | null, envelope: FieldEnvelopeV3): OpenedSealed | null;
+/** Where the decoder finds an entity's real kind and its own entities. */
+export interface DecodeStore {
+    /** The real kind of an entity this device holds, if it holds one by that id. */
+    kindOf(entityId: string): EntityKind | null;
+}
+export interface DecodeContext {
+    /** Null decodes nothing: every current value stays sealed. */
+    keyring: Keyring | null;
+    store: DecodeStore;
+    /** The legacy (protocol 6) decode of one op: the old envelope rules. */
+    openLegacy(op: Operation & {
+        op: "set";
+    }): Operation | null;
+}
+export interface DecodedOp {
+    op: Operation;
+    /** For a value opened from a v3 envelope: the key and scope it opened with. */
+    opened?: {
+        keyId: string;
+        scope: KeyScope;
+    };
+    /** The op arrived under a legacy kind. */
+    legacy: boolean;
+}
+/**
+ * Decode one page of wire ops. A delete names no real kind: it takes the kind of the entity this
+ * device or the same page knows by its id, else stays under its wire kind until one arrives
+ * (`LocalStore` hands such a tombstone on). A value no held key opens stays a
+ * {@link SealedPlaceholder} under its wire kind and tag; `reviveLockedValues` opens it once a key
+ * arrives.
+ */
+export declare function decodeOps(wireOps: readonly WireOp[], ctx: DecodeContext): DecodedOp[];
+/**
+ * A key repair for a v3 value that opened under a scope other than its entity's (`expected`) or
+ * with a key other than the canonical one: `confirmRepairs` decides whether to re-write it.
+ */
+export declare function sealedRepair(d: DecodedOp, expected: KeyScope | null, isCanonical: (keyId: string, scope: KeyScope) => boolean): Repair | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlastodo/client-core",
-  "version": "0.1.13",
+  "version": "0.1.14-rc.1",
   "description": "Atlas core client: hybrid logical clocks, the op log and per-field LWW merge, end-to-end encryption, the local store and the sync client",
   "license": "AGPL-3.0-only",
   "homepage": "https://github.com/atlastodo/atlas/tree/main/packages/client-core",

package/test-vectors/envelope_vectors.json

@@ -1,5 +1,5 @@
 {
-  "_doc": "Field envelopes and key wraps (packages/client-core/src/crypto/field.ts, envelope.ts, keyring.ts, identity.ts, asym.ts). AES-256-GCM is deterministic given the IV, so a reimplementation must both open each `envelope`/wrap and reproduce its `ct` from the recorded `iv`. Field v2: plaintext = JSON of `value`, ISO/IEC 7816-4 padded to `paddedLength` (0x80 then zeros; at least 32 bytes, then powers of two up to 1 KiB, then whole KiB); associated data = UTF-8 of JSON.stringify([\"atlas-field\", 2, entity, entity_id, field, scope, kid]). Field v1: JSON of value, unpadded, no associated data. PEK wrap v2: associated data JSON.stringify([\"atlas-pek-wrap\", 2, project_id]); the unbound form has none. project_key_id = hex of the first 16 bytes of SHA-256(\"atlas-pek-id-v1\" || pek). Signing key wrap: associated data JSON.stringify([\"atlas-signing-key-wrap\", 1, lowercase public key hex]). Sealed: X25519 with an ephemeral key, HKDF-SHA256(no salt, info 'atlas-seal-v1'), AES-256-GCM without associated data. Asserted by packages/client-core/src/crypto/envelope-vectors.test.ts and crates/atlas-client.",
+  "_doc": "Field envelopes and key wraps (packages/client-core/src/crypto/field.ts, envelope.ts, keyring.ts, identity.ts, asym.ts). AES-256-GCM is deterministic given the IV, so a reimplementation must both open each `envelope`/wrap and reproduce its `ct` from the recorded `iv`. Field v2: plaintext = JSON of `value`, ISO/IEC 7816-4 padded to `paddedLength` (0x80 then zeros; at least 32 bytes, then powers of two up to 1 KiB, then whole KiB); associated data = UTF-8 of JSON.stringify([\"atlas-field\", 2, entity, entity_id, field, scope, kid]). Field v3 (sync protocol 7, docs/decisions/0006): plaintext = JSON of [kind, field, value], padded as v2 but to at least 64 bytes (`padding_v3`); associated data = UTF-8 of JSON.stringify([\"atlas-field\", 3, wire_entity, entity_id, wire_field, scope, kid]), where wire_field is the tag or a public name. Field tags: tag_key = HKDF-SHA256(ikm key, no salt, info 'atlas-field-tag-v1', 32 bytes); tag = hex of the first 16 bytes of HMAC-SHA256(tag_key, UTF-8 of JSON.stringify([\"atlas-field-tag\", 1, entity_id, kind, field])). Field v1: JSON of value, unpadded, no associated data. PEK wrap v2: associated data JSON.stringify([\"atlas-pek-wrap\", 2, project_id]); the unbound form has none. project_key_id = hex of the first 16 bytes of SHA-256(\"atlas-pek-id-v1\" || pek). Signing key wrap: associated data JSON.stringify([\"atlas-signing-key-wrap\", 1, lowercase public key hex]). Sealed: X25519 with an ephemeral key, HKDF-SHA256(no salt, info 'atlas-seal-v1'), AES-256-GCM without associated data. Asserted by packages/client-core/src/crypto/envelope-vectors.test.ts and crates/atlas-client.",
   "padding": [
     {
       "n": 0,
@@ -309,5 +309,174 @@
         "ct": "0DIwXsDjSjvwJtoy2dkoUv0FliHcWGcF+yCdz6Dg9ftpREyMIQljYNTSPxjAtBtH"
       }
     }
-  }
+  },
+  "field_v3": [
+    {
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "scope": "personal",
+      "entity": "todo.sealed",
+      "entity_id": "0b7c3f4e-9a1d-4c2b-8e5f-6a7b8c9d0e1f",
+      "field": "1016533f5038961939f84e4de968f7ca",
+      "kind": "task",
+      "real_field": "title",
+      "value": "Buy milk",
+      "envelope": {
+        "__enc": 3,
+        "kid": "dek",
+        "iv": "AAECAwQFBgcICQoL",
+        "ct": "HCCieraO4DevNf7/3YxaQaGU8k3QFjYQU0W4BR1pALIBEK78r8ESmHSkf+2Ihyg47llgjVrWo9o/lyoZGOP17gyymbCdZV+TFLMtpIs5VG8="
+      }
+    },
+    {
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "scope": "personal",
+      "entity": "todo.sealed",
+      "entity_id": "0b7c3f4e-9a1d-4c2b-8e5f-6a7b8c9d0e1f",
+      "field": "d8f50043473bd8b76d68b625fb6a3aea",
+      "kind": "task",
+      "real_field": "is_completed",
+      "value": true,
+      "envelope": {
+        "__enc": 3,
+        "kid": "dek",
+        "iv": "DA0ODxAREhMUFRYX",
+        "ct": "w9wduQwd3n8VQzuK8uRLlzlmmYuSXxfe6defvWSgwPos92ol4cUmYR/zDlLurBrajFa70an0FLNO/3pcuu1KuExVasrmycgCPcLULcZAsno="
+      }
+    },
+    {
+      "key": "f0e1d2c3b4a5968778695a4b3c2d1e0f00112233445566778899aabbccddeeff",
+      "scope": "project:8f9e0d1c-2b3a-4f5e-8d7c-6b5a49382716",
+      "entity": "todo.sealed",
+      "entity_id": "5d6e7f80-1a2b-4c3d-9e8f-0a1b2c3d4e5f",
+      "field": "83f03fc82fcb43d0e619d152872e5473",
+      "kind": "comment",
+      "real_field": "body",
+      "value": {
+        "mentions": [],
+        "text": "Looks good"
+      },
+      "envelope": {
+        "__enc": 3,
+        "kid": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
+        "iv": "GBkaGxwdHh8gISIj",
+        "ct": "gM0BOi3BReVqddhqLwhPCwV0kuvTv6bYHRoRgQydJjMyL35iHh3mMqFiua3j+VojoKlqiag/ErJLBG46yLqjUCE7lh7EjjVu2Fpfla1m89w="
+      }
+    },
+    {
+      "key": "f0e1d2c3b4a5968778695a4b3c2d1e0f00112233445566778899aabbccddeeff",
+      "scope": "project:8f9e0d1c-2b3a-4f5e-8d7c-6b5a49382716",
+      "entity": "todo.project",
+      "entity_id": "8f9e0d1c-2b3a-4f5e-8d7c-6b5a49382716",
+      "field": "archived_at",
+      "kind": "project",
+      "real_field": "archived_at",
+      "value": 1767225600000,
+      "envelope": {
+        "__enc": 3,
+        "kid": "a1b2c3d4e5f60718293a4b5c6d7e8f90",
+        "iv": "JCUmJygpKissLS4v",
+        "ct": "ziPpSJ2/s+FmTFVoCEiT0qOWycJ9b01Q3jZBdkoi+Nas+Fkl5HXIW+R7YEp1nTOWUF1A3TDFFo+vSVg28cnavZZrVx3Hpg48rpBM0L/sj0M="
+      }
+    },
+    {
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "scope": "personal",
+      "entity": "vault.sealed",
+      "entity_id": "0b7c3f4e-9a1d-4c2b-8e5f-6a7b8c9d0e1f",
+      "field": "2a2a666e3a097cba81ac5ab96938b0de",
+      "kind": "vault.item",
+      "real_field": "notes",
+      "value": null,
+      "envelope": {
+        "__enc": 3,
+        "kid": "dek",
+        "iv": "MDEyMzQ1Njc4OTo7",
+        "ct": "6BdHoZwDPi1DR+uBMLUcBvNTKiThEipwS9IMzOizfj5DYAxkLMCbp64kEkl6xtMtrkxdSSuxxSetQGFUQEhR9MS7KHMeOLdxaZlLD9nMEFs="
+      }
+    }
+  ],
+  "field_tags": [
+    {
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "tag_key": "572bd3fbe1e9c7e9726d8aad148784bcf83f473cfa0a69065e35b092dbc13fcb",
+      "entity_id": "0b7c3f4e-9a1d-4c2b-8e5f-6a7b8c9d0e1f",
+      "kind": "task",
+      "field": "title",
+      "tag": "1016533f5038961939f84e4de968f7ca"
+    },
+    {
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "tag_key": "572bd3fbe1e9c7e9726d8aad148784bcf83f473cfa0a69065e35b092dbc13fcb",
+      "entity_id": "0b7c3f4e-9a1d-4c2b-8e5f-6a7b8c9d0e1f",
+      "kind": "task",
+      "field": "project_id",
+      "tag": "71a930596b7083c6af5498a40a73e20f"
+    },
+    {
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "tag_key": "572bd3fbe1e9c7e9726d8aad148784bcf83f473cfa0a69065e35b092dbc13fcb",
+      "entity_id": "5d6e7f80-1a2b-4c3d-9e8f-0a1b2c3d4e5f",
+      "kind": "task",
+      "field": "title",
+      "tag": "fe3259da59051bd1b8f20291bc3d7d1b"
+    },
+    {
+      "key": "f0e1d2c3b4a5968778695a4b3c2d1e0f00112233445566778899aabbccddeeff",
+      "tag_key": "346fb253d66eba03ea9300e99e109d69b1f8e1f7b4ce2677a089a9e969eae88e",
+      "entity_id": "0b7c3f4e-9a1d-4c2b-8e5f-6a7b8c9d0e1f",
+      "kind": "task",
+      "field": "title",
+      "tag": "5d9f33dc8e6c3acf5e7c6a81cc3b1703"
+    },
+    {
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "tag_key": "572bd3fbe1e9c7e9726d8aad148784bcf83f473cfa0a69065e35b092dbc13fcb",
+      "entity_id": "0b7c3f4e-9a1d-4c2b-8e5f-6a7b8c9d0e1f",
+      "kind": "preference",
+      "field": "pin:8f9e0d1c-2b3a-4f5e-8d7c-6b5a49382716:5d6e7f80-1a2b-4c3d-9e8f-0a1b2c3d4e5f",
+      "tag": "c3682378312dc5e6ceaad26593274006"
+    },
+    {
+      "key": "000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f",
+      "tag_key": "572bd3fbe1e9c7e9726d8aad148784bcf83f473cfa0a69065e35b092dbc13fcb",
+      "entity_id": "0b7c3f4e-9a1d-4c2b-8e5f-6a7b8c9d0e1f",
+      "kind": "journal.entry",
+      "field": "body",
+      "tag": "d7f595d8d67e04b6380c408ea90fbf71"
+    }
+  ],
+  "padding_v3": [
+    {
+      "n": 0,
+      "padded": 64
+    },
+    {
+      "n": 30,
+      "padded": 64
+    },
+    {
+      "n": 62,
+      "padded": 64
+    },
+    {
+      "n": 63,
+      "padded": 64
+    },
+    {
+      "n": 64,
+      "padded": 128
+    },
+    {
+      "n": 100,
+      "padded": 128
+    },
+    {
+      "n": 1023,
+      "padded": 1024
+    },
+    {
+      "n": 1024,
+      "padded": 2048
+    }
+  ]
 }