@inkandswitch/patchwork-bootloader 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @inkandswitch/patchwork-bootloader
 
+## 0.7.1
+
+### Patch Changes
+
+- 5462610: Move keyhive out of `syncServers` and into its own top-level site option: `keyhive?: boolean | { syncServer?, useIdFactory? }`. `keyhive: true` enables it against the `"subduction"` relay; the object form picks a different relay (or a custom `{url, contactCardJson, peerId}` identity) and turns individual behaviour off. `keyhive.useIdFactory: false` drops the `idFactory` ARK injects into the repo config, so document ids are generated the Repo's own way instead of derived from keyhive. It reaches both the tab repo and the automerge protocol handler worker through the `__SYNC_SERVER__` define.
+
+  `syncServers` is now just URLs — `subduction` and `classic`, no longer mutually exclusive with anything. Sites passing `syncServers: { keyhive: X }` should pass `keyhive: { syncServer: X }` instead; `syncServers.subduction` still overrides the URL a named relay implies.
+
+- 5462610: Persist the Subduction signer so every context on an origin presents the same identity. The seed lives in the shared IndexedDB, so tabs and the automerge protocol handler worker adopt one signer instead of each minting a fresh `MemorySigner` on load. Generating it takes a Web Lock, so a cold profile opening two contexts at once still settles on one seed.
+
+  `@inkandswitch/patchwork-bootloader/signer` is a new export: `loadOrCreateSigner(storage)` returns the origin's `MemorySigner`, generating and storing a seed the first time.
+
 ## 0.7.0
 
 ### Minor Changes

package/dist/automerge-protocol-handler-worker.js

@@ -13,7 +13,6 @@ import { initializeWasm, hasHeads } from "@automerge/automerge/slim";
 // eslint-disable-next-line
 // @ts-ignore — initSync is a wasm-bindgen runtime helper not in the .d.ts
 import { initSync as initSubductionSync } from "@automerge/automerge-subduction/slim";
-import { MemorySigner } from "@automerge/automerge-subduction/slim";
 import { Repo, isValidAutomergeUrl, parseAutomergeUrl, stringifyAutomergeUrl, } from "@automerge/automerge-repo/slim";
 import { resolvePath } from "@inkandswitch/patchwork-filesystem";
 import { IndexedDBWorkerStorageAdapter } from "@automerge/automerge-repo-storage-indexeddb/IndexedDBWorkerStorageAdapter";
@@ -21,6 +20,7 @@ import { WebSocketWorkerClientAdapter } from "@automerge/automerge-repo-network-
 import { initializeAutomergeRepoKeyhive, initKeyhiveWasm, } from "@automerge/automerge-repo-keyhive";
 import { DEFAULT_CLASSIC_SYNC_SERVER } from "./sync-config.js";
 import { siblingAdapters } from "./siblings.js";
+import { loadOrCreateSigner } from "./signer.js";
 import { keyhiveStorageName, storagePrefix } from "./storage.js";
 import { startWorkerControl } from "./worker-control.js";
 import { HANDOFF_CHANNEL, } from "./types.js";
@@ -57,16 +57,17 @@ async function buildRepo() {
     log("wasm initialized");
     const { repo, hive } = syncServer.keyhive
         ? await buildKeyhiveRepo(syncServer.keyhive)
-        : { repo: buildPlainRepo() };
+        : { repo: await buildPlainRepo() };
     self.repo = repo;
     if (hive)
         self.hive = hive;
     return repo;
 }
-function buildPlainRepo() {
+async function buildPlainRepo() {
+    const storage = new IndexedDBWorkerStorageAdapter();
     return new Repo({
-        signer: new MemorySigner(),
-        storage: new IndexedDBWorkerStorageAdapter(),
+        signer: await loadOrCreateSigner(storage),
+        storage,
         peerId: `${storagePrefix}-resolver-${Math.random().toString(36).slice(2)}`,
         subductionWebsocketEndpoints: [syncServer.url],
         subductionAdapters: siblingAdapters(),
@@ -76,7 +77,9 @@ function buildPlainRepo() {
 async function buildKeyhiveRepo(keyhiveSyncServer) {
     initKeyhiveWasm();
     const { hive, repo } = await initializeAutomergeRepoKeyhive({
-        createRepo: (config) => new Repo(config),
+        // ARK injects an `idFactory` deriving document ids from keyhive. A site
+        // can opt out of it with `keyhive: { useIdFactory: false }`.
+        createRepo: ({ idFactory, ...config }) => new Repo(syncServer.useIdFactory === false ? config : { ...config, idFactory }),
         storage: new IndexedDBWorkerStorageAdapter(keyhiveStorageName),
         peerIdSuffix: `${storagePrefix}-resolver` + Math.random().toString(36).slice(2),
         automaticArchiveIngestion: true,

package/dist/signer.d.ts

@@ -0,0 +1,17 @@
+import type { StorageAdapterInterface } from "@automerge/automerge-repo/slim";
+import { MemorySigner } from "@automerge/automerge-subduction/slim";
+/**
+ * The Subduction identity every Repo on this origin presents: each tab and the
+ * automerge protocol handler worker sign as the same peer. The seed is kept in
+ * the same IndexedDB they already share, so it survives a reload and a new tab
+ * picks it up rather than minting its own.
+ *
+ * Keyhive sites don't come through here — their signer is derived from the
+ * keyhive active keypair, which ARK keeps in the keyhive storage those same
+ * contexts share.
+ *
+ * The lock is for a cold profile. Without it two contexts both find nothing,
+ * both generate, and both go on using the seed they made while only one of
+ * them is the seed in storage.
+ */
+export declare function loadOrCreateSigner(storage: StorageAdapterInterface): Promise<MemorySigner>;

package/dist/signer.js

@@ -0,0 +1,27 @@
+import { MemorySigner } from "@automerge/automerge-subduction/slim";
+const SIGNER_KEY = ["patchwork", "subduction-signer"];
+const SIGNER_LOCK = "patchwork-subduction-signer";
+/**
+ * The Subduction identity every Repo on this origin presents: each tab and the
+ * automerge protocol handler worker sign as the same peer. The seed is kept in
+ * the same IndexedDB they already share, so it survives a reload and a new tab
+ * picks it up rather than minting its own.
+ *
+ * Keyhive sites don't come through here — their signer is derived from the
+ * keyhive active keypair, which ARK keeps in the keyhive storage those same
+ * contexts share.
+ *
+ * The lock is for a cold profile. Without it two contexts both find nothing,
+ * both generate, and both go on using the seed they made while only one of
+ * them is the seed in storage.
+ */
+export async function loadOrCreateSigner(storage) {
+    return navigator.locks.request(SIGNER_LOCK, async () => {
+        const stored = await storage.load(SIGNER_KEY);
+        if (stored)
+            return MemorySigner.fromBytes(stored);
+        const seed = crypto.getRandomValues(new Uint8Array(32));
+        await storage.save(SIGNER_KEY, seed);
+        return MemorySigner.fromBytes(seed);
+    });
+}

package/package.json

@@ -5,7 +5,7 @@
     "url": "git+https://github.com/inkandswitch/patchwork-system.git",
     "directory": "core/bootloader"
   },
-  "version": "0.7.0",
+  "version": "0.7.1",
   "author": "chee",
   "type": "module",
   "license": "MIT",
@@ -30,6 +30,10 @@
       "import": "./dist/siblings.js",
       "types": "./dist/siblings.d.ts"
     },
+    "./signer": {
+      "import": "./dist/signer.js",
+      "types": "./dist/signer.d.ts"
+    },
     "./storage": {
       "import": "./dist/storage.js",
       "types": "./dist/storage.d.ts"
@@ -78,8 +82,8 @@
     "solid-js": "^1.9.13",
     "tinyargs": "^0.1.4",
     "@inkandswitch/patchwork-elements": "^6.0.2",
-    "@inkandswitch/patchwork-filesystem": "^0.2.9",
     "@inkandswitch/patchwork-plugins": "^1.2.4",
+    "@inkandswitch/patchwork-filesystem": "^0.2.9",
     "@inkandswitch/patchwork-providers": "^0.5.2"
   },
   "peerDependencies": {

package/src/automerge-protocol-handler-worker.ts

@@ -13,7 +13,6 @@ import { initializeWasm, hasHeads } from "@automerge/automerge/slim";
 // eslint-disable-next-line
 // @ts-ignore — initSync is a wasm-bindgen runtime helper not in the .d.ts
 import { initSync as initSubductionSync } from "@automerge/automerge-subduction/slim";
-import { MemorySigner } from "@automerge/automerge-subduction/slim";
 
 import {
   Repo,
@@ -37,6 +36,7 @@ import {
 
 import { DEFAULT_CLASSIC_SYNC_SERVER } from "./sync-config.js";
 import { siblingAdapters } from "./siblings.js";
+import { loadOrCreateSigner } from "./signer.js";
 import { keyhiveStorageName, storagePrefix } from "./storage.js";
 import { startWorkerControl } from "./worker-control.js";
 import {
@@ -51,6 +51,7 @@ import {
 declare const __SYNC_SERVER__: {
   url: string;
   keyhive?: SyncServerSelection;
+  useIdFactory?: boolean;
 };
 
 const syncServer =
@@ -95,17 +96,18 @@ async function buildRepo(): Promise<Repo> {
 
   const { repo, hive } = syncServer.keyhive
     ? await buildKeyhiveRepo(syncServer.keyhive)
-    : { repo: buildPlainRepo() };
+    : { repo: await buildPlainRepo() };
 
   (self as any).repo = repo;
   if (hive) (self as any).hive = hive;
   return repo;
 }
 
-function buildPlainRepo(): Repo {
+async function buildPlainRepo(): Promise<Repo> {
+  const storage = new IndexedDBWorkerStorageAdapter();
   return new Repo({
-    signer: new MemorySigner(),
-    storage: new IndexedDBWorkerStorageAdapter(),
+    signer: await loadOrCreateSigner(storage),
+    storage,
     peerId:
       `${storagePrefix}-resolver-${Math.random().toString(36).slice(2)}` as PeerId,
     subductionWebsocketEndpoints: [syncServer.url],
@@ -119,7 +121,12 @@ async function buildKeyhiveRepo(
 ): Promise<{ repo: Repo; hive: AutomergeRepoKeyhive }> {
   initKeyhiveWasm();
   const { hive, repo } = await initializeAutomergeRepoKeyhive({
-    createRepo: (config) => new Repo(config),
+    // ARK injects an `idFactory` deriving document ids from keyhive. A site
+    // can opt out of it with `keyhive: { useIdFactory: false }`.
+    createRepo: ({ idFactory, ...config }) =>
+      new Repo(
+        syncServer.useIdFactory === false ? config : { ...config, idFactory }
+      ),
     storage: new IndexedDBWorkerStorageAdapter(keyhiveStorageName),
     peerIdSuffix:
       `${storagePrefix}-resolver` + Math.random().toString(36).slice(2),

package/src/signer.ts

@@ -0,0 +1,32 @@
+import type { StorageAdapterInterface } from "@automerge/automerge-repo/slim";
+import { MemorySigner } from "@automerge/automerge-subduction/slim";
+
+const SIGNER_KEY = ["patchwork", "subduction-signer"];
+const SIGNER_LOCK = "patchwork-subduction-signer";
+
+/**
+ * The Subduction identity every Repo on this origin presents: each tab and the
+ * automerge protocol handler worker sign as the same peer. The seed is kept in
+ * the same IndexedDB they already share, so it survives a reload and a new tab
+ * picks it up rather than minting its own.
+ *
+ * Keyhive sites don't come through here — their signer is derived from the
+ * keyhive active keypair, which ARK keeps in the keyhive storage those same
+ * contexts share.
+ *
+ * The lock is for a cold profile. Without it two contexts both find nothing,
+ * both generate, and both go on using the seed they made while only one of
+ * them is the seed in storage.
+ */
+export async function loadOrCreateSigner(
+  storage: StorageAdapterInterface
+): Promise<MemorySigner> {
+  return navigator.locks.request(SIGNER_LOCK, async () => {
+    const stored = await storage.load(SIGNER_KEY);
+    if (stored) return MemorySigner.fromBytes(stored);
+
+    const seed = crypto.getRandomValues(new Uint8Array(32));
+    await storage.save(SIGNER_KEY, seed);
+    return MemorySigner.fromBytes(seed);
+  });
+}