@lapis-notes/api 0.1.3 → 0.1.4

package/dist/sync-host.js

@@ -1,6 +1,7 @@
 import { TFile } from "./storage/fs";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { bytesToHex } from "@noble/hashes/utils.js";
+import { ScopedSyncLocalRuntime } from "./sync-host-local";
 import { SyncHostSecurityService, } from "./sync-host-security";
 const ROOT_PREFIX = "sync-host:v1:";
 const DATABASE_GENERATION_KEY = `${ROOT_PREFIX}database-generation`;
@@ -71,19 +72,39 @@ export class SyncHostService {
     database;
     vault;
     clock;
-    options;
     #ready;
     #eventQueue = Promise.resolve();
     #runtimeIds = new Map();
     #origins = new Map();
     #security;
+    #selectSecurityProvider;
+    #securityProviders = new Map();
+    #delegatedRuntimes = new Map();
+    #localRuntimes = new Map();
+    #selectLocalProvider;
+    #guardLocalApply;
+    #securityCleanup = new Set();
+    #stopObserving;
+    #disposed = false;
+    #disposal;
+    options;
     constructor(database, vault, clock = Date.now, options = {}) {
         this.database = database;
         this.vault = vault;
         this.clock = clock;
-        this.options = options;
-        this.#security = new SyncHostSecurityService(database, (pluginId, runtimeId) => this.#assertRuntime(pluginId, runtimeId), options.security);
-        this.vault.on("all", (event, file, context) => {
+        const { securityStore, securityProvider, localProvider, guardLocalApply, ...retainedOptions } = options;
+        this.options =
+            securityStore === undefined &&
+                securityProvider === undefined &&
+                localProvider === undefined &&
+                guardLocalApply === undefined
+                ? options
+                : retainedOptions;
+        this.#selectSecurityProvider = securityProvider;
+        this.#selectLocalProvider = localProvider;
+        this.#guardLocalApply = guardLocalApply;
+        this.#security = new SyncHostSecurityService(securityStore === undefined ? database : securityStore, (pluginId, runtimeId) => this.#assertRuntime(pluginId, runtimeId), options.security);
+        const eventRef = this.vault.on("all", (event, file, context) => {
             if (!(file instanceof TFile) || !this.#isChangeKind(event))
                 return;
             const previousPath = typeof context.oldPath === "string" ? context.oldPath : undefined;
@@ -96,6 +117,7 @@ export class SyncHostService {
             })
                 .catch(() => undefined);
         });
+        this.#stopObserving = () => this.vault.offref(eventRef);
         this.#ready = this.#initialize();
     }
     async ready() {
@@ -103,6 +125,8 @@ export class SyncHostService {
         await this.#eventQueue;
     }
     forPlugin(pluginId, grantedCapabilities) {
+        if (this.#disposed)
+            throw new Error("Sync host is disposed");
         const normalizedPluginId = requireBoundedString(pluginId, "Plugin ID", 128);
         const runtimeId = randomId();
         const runtimeIds = this.#runtimeIds.get(normalizedPluginId) ?? new Set();
@@ -116,7 +140,7 @@ export class SyncHostService {
                 throw new Error(`Plugin ${normalizedPluginId} is not granted ${capability}`);
             }
         };
-        return {
+        const capabilities = {
             files: {
                 getIdentity: async (path) => {
                     assertGranted("metadata:identity");
@@ -304,32 +328,154 @@ export class SyncHostService {
             }),
             generatedState: this.#generatedState(normalizedPluginId, runtimeId, () => assertGranted("plugin:generated-state")),
         };
+        if (this.#selectLocalProvider) {
+            const local = new ScopedSyncLocalRuntime({
+                runtimeId,
+                assertGranted,
+                selectProvider: () => this.#selectLocalProvider(normalizedPluginId),
+                guardApply: this.#guardLocalApply,
+            });
+            this.#localRuntimes.set(runtimeId, local);
+            Object.assign(capabilities, { local: local.capabilities });
+        }
+        let delegated;
+        let selected = false;
+        for (const group of [
+            "crypto",
+            "syncIdentity",
+            "pairing",
+            "membership",
+            "recovery",
+        ]) {
+            const local = capabilities[group];
+            const guarded = {};
+            for (const method of Object.keys(local)) {
+                guarded[method] = async (...args) => {
+                    assertGranted("crypto:nostr-sync");
+                    if (!selected) {
+                        const provider = this.#securityProvider(normalizedPluginId);
+                        if (provider) {
+                            this.#delegatedRuntimes.set(runtimeId, provider);
+                            delegated = provider.forRuntime(runtimeId);
+                            if (!delegated || typeof delegated !== "object")
+                                throw new Error("Invalid Sync security provider capabilities");
+                        }
+                        selected = true;
+                    }
+                    assertGranted("crypto:nostr-sync");
+                    const target = delegated ? delegated[group] : local;
+                    const operation = target && target[method];
+                    if (typeof operation !== "function")
+                        throw new Error(`Invalid Sync security provider operation: ${group}.${method}`);
+                    const result = await operation.apply(target, args);
+                    assertGranted("crypto:nostr-sync");
+                    return result;
+                };
+            }
+            Object.assign(capabilities, { [group]: guarded });
+        }
+        return capabilities;
     }
     revokePlugin(pluginId) {
+        const runtimes = this.#runtimeIds.get(pluginId);
         this.#runtimeIds.delete(pluginId);
         for (const [token, owner] of this.#origins) {
             if (owner.pluginId === pluginId)
                 this.#origins.delete(token);
         }
         this.#security.revokePlugin(pluginId);
+        const cleanups = [];
+        for (const runtimeId of runtimes ?? []) {
+            const provider = this.#delegatedRuntimes.get(runtimeId);
+            this.#delegatedRuntimes.delete(runtimeId);
+            const local = this.#localRuntimes.get(runtimeId);
+            this.#localRuntimes.delete(runtimeId);
+            if (!provider && !local)
+                continue;
+            let cleanup;
+            try {
+                // Local streams/operations must finish while native crypto custody still exists.
+                const localCleanup = local?.revoke();
+                cleanup = localCleanup
+                    ? (async () => {
+                        const result = await Promise.allSettled([localCleanup]);
+                        await provider?.revokeRuntime(runtimeId);
+                        if (result[0]?.status === "rejected")
+                            throw result[0].reason;
+                    })()
+                    : Promise.resolve(provider.revokeRuntime(runtimeId));
+            }
+            catch (error) {
+                cleanup = Promise.reject(error);
+            }
+            this.#securityCleanup.add(cleanup);
+            cleanups.push(cleanup);
+        }
+        return this.#drainSecurity(cleanups);
+    }
+    /** Invalidate first, then wait for every admitted host cleanup and file event. */
+    dispose() {
+        if (this.#disposal)
+            return this.#disposal;
+        this.#disposed = true;
+        this.#stopObserving();
+        const revocations = [...this.#runtimeIds.keys()].map((pluginId) => this.revokePlugin(pluginId));
+        this.#disposal = this.#drainSecurity([
+            ...revocations,
+            ...this.#securityCleanup,
+            this.ready(),
+        ]);
+        return this.#disposal;
+    }
+    async #drainSecurity(cleanups) {
+        const results = await Promise.allSettled(cleanups);
+        for (const cleanup of cleanups)
+            this.#securityCleanup.delete(cleanup);
+        const failed = results.find((result) => result.status === "rejected");
+        if (failed?.status === "rejected")
+            throw failed.reason;
+    }
+    #securityProvider(pluginId) {
+        if (!this.#securityProviders.has(pluginId)) {
+            const provider = this.#selectSecurityProvider?.(pluginId);
+            if (provider !== undefined &&
+                (!provider ||
+                    typeof provider.forRuntime !== "function" ||
+                    typeof provider.revokeRuntime !== "function"))
+                throw new Error("Invalid Sync security provider");
+            this.#securityProviders.set(pluginId, provider);
+        }
+        return this.#securityProviders.get(pluginId);
+    }
+    #assertLocalSecurity(pluginId) {
+        requireBoundedString(pluginId, "Plugin ID", 128);
+        if (this.#disposed)
+            throw new Error("Sync host is disposed");
+        if (this.#securityProvider(pluginId))
+            throw new Error(`Sync security for ${pluginId} is delegated to its host provider`);
     }
     /** Host-controlled enrollment; this operation is intentionally absent from plugin facades. */
-    enrollPluginCrypto(pluginId, passphrase, request) {
+    async enrollPluginCrypto(pluginId, passphrase, request) {
+        this.#assertLocalSecurity(pluginId);
         return this.#security.enroll(requireBoundedString(pluginId, "Plugin ID", 128), passphrase, request);
     }
     /** Host-controlled unlock; plugins can only observe locked state. */
-    unlockPluginCrypto(pluginId, passphrase) {
+    async unlockPluginCrypto(pluginId, passphrase) {
+        this.#assertLocalSecurity(pluginId);
         return this.#security.unlock(requireBoundedString(pluginId, "Plugin ID", 128), passphrase);
     }
     /** Host-controlled passkey or OS-credential enrollment. */
-    enrollPluginCryptoWithWrappingKey(pluginId, wrappingKey, descriptor, request) {
+    async enrollPluginCryptoWithWrappingKey(pluginId, wrappingKey, descriptor, request) {
+        this.#assertLocalSecurity(pluginId);
         return this.#security.enrollWithWrappingKey(requireBoundedString(pluginId, "Plugin ID", 128), wrappingKey, descriptor, request);
     }
     /** Host-controlled passkey or OS-credential unlock. */
-    unlockPluginCryptoWithWrappingKey(pluginId, wrappingKey) {
+    async unlockPluginCryptoWithWrappingKey(pluginId, wrappingKey) {
+        this.#assertLocalSecurity(pluginId);
         return this.#security.unlockWithWrappingKey(requireBoundedString(pluginId, "Plugin ID", 128), wrappingKey);
     }
     lockPluginCrypto(pluginId) {
+        this.#assertLocalSecurity(pluginId);
         this.#security.lock(requireBoundedString(pluginId, "Plugin ID", 128));
     }
     grantPluginNetworkOrigin(pluginId, origin, options) {

package/dist/sync-repository.d.ts

@@ -0,0 +1,106 @@
+/** Durable opaque sync data. Hosts keep this separate from disposable AppDatabase indexes. */
+export interface SealedSyncState {
+    version: number;
+    epoch: number;
+    ciphertext: Uint8Array;
+}
+export interface SyncRepository {
+    readonly blobs: {
+        has(hash: string): Promise<boolean>;
+        put(ciphertext: Uint8Array): Promise<{
+            hash: string;
+            size: number;
+        }>;
+        get(hash: string): Promise<Uint8Array>;
+    };
+    readState(): Promise<SealedSyncState | null>;
+    compareAndSwap(expectedVersion: number, next: SealedSyncState, authority?: SyncOperationAuthority): Promise<boolean>;
+}
+/** Expected endpoint authority for a guarded host operation, outside encrypted protocol data. */
+export interface SyncOperationAuthority {
+    vaultId: string;
+    devicePublicKey: string;
+    epoch: number;
+    membershipGeneration: number;
+}
+/** Immutable sealed records addressed by opaque 64-character lowercase hex keys. */
+export interface SealedSyncRecord {
+    epoch: number;
+    ciphertext: Uint8Array;
+}
+/** Optional repository extension for independently encrypted, indexed local records. */
+export interface SyncIndexedRepository extends SyncRepository {
+    readonly records: {
+        get(key: string): Promise<SealedSyncRecord | null>;
+        /** False preserves the existing record unchanged, including concurrent insertion. */
+        putIfAbsent(key: string, record: SealedSyncRecord): Promise<boolean>;
+    };
+}
+/** Captured by the owning host; a missing file is represented by null. */
+export interface SyncFileGeneration {
+    fileId: string;
+    contentGeneration: number;
+    hostFileId?: string;
+}
+export interface SyncFileMutation {
+    id: string;
+    kind: "write" | "remove";
+    path: string;
+    expected: SyncFileGeneration | null;
+    fileId: string;
+}
+/** Capture only protocol-neutral mutation data; file handles may carry read functions. */
+export declare function snapshotSyncFileMutation(input: SyncFileMutation): SyncFileMutation;
+export interface SyncFileMutationReceipt {
+    operation: SyncFileMutation;
+    result: SyncFileGeneration | null;
+}
+/** The host journals immutable operation IDs and verifies guards at mutation. */
+export interface SyncFileMutationAccess {
+    receipt(operationId: string, authority?: SyncOperationAuthority): Promise<SyncFileMutationReceipt | null>;
+    mutate(operation: SyncFileMutation, source?: ReadableStream<Uint8Array>, authority?: SyncOperationAuthority): Promise<SyncFileMutationReceipt>;
+}
+export interface SyncFileDescriptor extends SyncFileGeneration {
+    path: string;
+}
+export interface SyncGuardedFile extends SyncFileDescriptor {
+    openRead(): Promise<ReadableStream<Uint8Array>>;
+}
+/** Captured working files and durable encrypted state owned by the current host. */
+export interface SyncLocalHostCapabilities {
+    list(): Promise<SyncGuardedFile[]>;
+    readonly repository: SyncRepository;
+    readonly apply: SyncFileMutationAccess;
+}
+/** Trusted host adapter. Neither this controller nor storage paths enter plugin facades. */
+export interface SyncHostLocalProvider {
+    forRuntime(runtimeId: string): SyncLocalHostCapabilities;
+    revokeRuntime(runtimeId: string): void | Promise<void>;
+}
+/** The owning host protects editor state for the entire callback, including recovery. */
+export type SyncLocalApplyGuard = <T>(path: string | undefined, operation: () => Promise<T>) => Promise<T>;
+/** Minimal opaque crypto boundary; implementations retain all secret material. */
+export interface SyncVaultStateCrypto {
+    status(): Promise<{
+        state: "unenrolled" | "locked" | "unlocked";
+        suite: "lapis-sync-v1-xchacha20poly1305-schnorr";
+        vaultId?: string;
+        devicePublicKey?: string;
+        deviceState?: "active" | "revoked" | "recovery-pending";
+        currentEpoch?: number;
+        membershipGeneration?: number;
+    }>;
+    encryptObject(input: {
+        epoch: number;
+        type: "local-state";
+        plaintext: Uint8Array;
+    }): Promise<{
+        bytes: Uint8Array;
+        objectHash: string;
+    }>;
+    decryptObject(input: {
+        epoch: number;
+        type: "local-state";
+        envelope: Uint8Array;
+    }): Promise<Uint8Array>;
+}

package/dist/sync-repository.js

@@ -0,0 +1,18 @@
+/** Capture only protocol-neutral mutation data; file handles may carry read functions. */
+export function snapshotSyncFileMutation(input) {
+    return {
+        id: input.id,
+        kind: input.kind,
+        path: input.path,
+        fileId: input.fileId,
+        expected: input.expected === null
+            ? null
+            : {
+                fileId: input.expected.fileId,
+                contentGeneration: input.expected.contentGeneration,
+                ...(input.expected.hostFileId !== undefined
+                    ? { hostFileId: input.expected.hostFileId }
+                    : {}),
+            },
+    };
+}

package/dist/view.svelte.js

@@ -1,5 +1,4 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
-import { DateTime } from "luxon";
 import { Editor } from "./editor.svelte";
 import { mount, unmount } from "svelte";
 import EmptyViewComponent from "./components/empty-view/empty-view.svelte";
@@ -330,22 +329,34 @@ export class TextFileView extends FileView {
         return this.app.vault.adapter;
     }
     async onLoadFile(file) {
-        return this.app.telemetry.measureAsync("view.text_file.on_load_file", async (span) => {
+        const application = this.app;
+        return application.telemetry.measureAsync("view.text_file.on_load_file", async (span) => {
             span.setAttribute("view.type", this.getViewType());
             span.setAttribute("file.extension", file.extension);
-            const contents = await this.app.telemetry.measureAsync("vault.read", async () => this.app.vault.read(file), {
+            const published = await this.editor.loadDocument(file, () => application.telemetry.measureAsync("vault.read", async () => application.vault.read(file), {
                 attributes: {
                     "file.extension": file.extension,
                     "view.type": this.getViewType(),
                 },
                 slowThresholdMs: 100,
+            }), (contents) => {
+                if (this.app !== application || this.editor.app !== application)
+                    throw new Error("Editor document load authority changed");
+                const previousFile = this.file, previousData = this.data;
+                try {
+                    this.file = file.copy();
+                    this.editor.extensions = application.editorExtensions(file.extension, { ...this.getState(), file: file.path });
+                    this.data = contents;
+                    this.setViewData(contents, true);
+                }
+                catch (error) {
+                    this.file = previousFile;
+                    this.data = previousData;
+                    throw error;
+                }
             });
-            this.file = file.copy();
-            this.editor.file = file;
-            await this.setState({ ...this.getState(), file: file.path });
-            this.editor.extensions = this.app.editorExtensions(this.file.extension, this.getState());
-            this.data = contents;
-            this.setViewData(contents, true);
+            if (published && this.editor.file === file)
+                await this.setState({ ...this.getState(), file: file.path });
         }, {
             attributes: {
                 "view.type": this.getViewType(),
@@ -364,18 +375,16 @@ export class TextFileView extends FileView {
         return Promise.resolve();
     }
     onUnloadFile(file) {
+        this.editor.cancelDocumentLoad();
         this.setState({ ...this.getState(), file: "" });
         return Promise.resolve();
     }
-    save(clear) {
-        return this.app.vault
-            .modify(this.file, this.data, {
-            mtime: DateTime.now().toMillis(),
-        })
-            .then(() => {
-            if (clear) {
-                this.clear();
-            }
-        });
+    async save(clear) {
+        const target = this.editor.file;
+        this.editor.save();
+        await this.editor.flushChanges();
+        this.data = this.editor.data;
+        if (clear && this.editor.file === target)
+            this.clear();
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lapis-notes/api",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Lapis Notes API",
   "license": "Apache-2.0",
   "repository": {
@@ -224,6 +224,21 @@
       "types": "./dist/build-tools/vite.d.ts",
       "import": "./dist/build-tools/vite.js",
       "default": "./dist/build-tools/vite.js"
+    },
+    "./sync-repository": {
+      "types": "./dist/sync-repository.d.ts",
+      "import": "./dist/sync-repository.js",
+      "default": "./dist/sync-repository.js"
+    },
+    "./sync-security-host": {
+      "types": "./dist/sync-host-security.d.ts",
+      "import": "./dist/sync-host-security.js",
+      "default": "./dist/sync-host-security.js"
+    },
+    "./metadata-store": {
+      "types": "./dist/metadata-store.d.ts",
+      "import": "./dist/metadata-store.js",
+      "default": "./dist/metadata-store.js"
     }
   },
   "devDependencies": {
@@ -266,6 +281,7 @@
     "check": "pnpm --dir ../.. check:no-tailwind packages/api/src/lib/components && pnpm check:svelte && pnpm check:types",
     "check:svelte": "svelte-check --fail-on-warnings --output human",
     "check:types": "tsc --noEmit -p tsconfig.types.json",
+    "check:pack-types": "tsc -p tsconfig.contracts.json",
     "dev": "pnpm --dir ../.. storybook",
     "storybook": "pnpm --dir ../.. storybook",
     "test": "vitest run",