@lapis-notes/api 0.1.3 → 0.2.0

package/dist/sync-host.js

@@ -1,6 +1,7 @@
 import { TFile } from "./storage/fs";
 import { sha256 } from "@noble/hashes/sha2.js";
 import { bytesToHex } from "@noble/hashes/utils.js";
+import { ScopedSyncLocalRuntime } from "./sync-host-local";
 import { SyncHostSecurityService, } from "./sync-host-security";
 const ROOT_PREFIX = "sync-host:v1:";
 const DATABASE_GENERATION_KEY = `${ROOT_PREFIX}database-generation`;
@@ -71,19 +72,39 @@ export class SyncHostService {
     database;
     vault;
     clock;
-    options;
     #ready;
     #eventQueue = Promise.resolve();
     #runtimeIds = new Map();
     #origins = new Map();
     #security;
+    #selectSecurityProvider;
+    #securityProviders = new Map();
+    #delegatedRuntimes = new Map();
+    #localRuntimes = new Map();
+    #selectLocalProvider;
+    #guardLocalApply;
+    #securityCleanup = new Set();
+    #stopObserving;
+    #disposed = false;
+    #disposal;
+    options;
     constructor(database, vault, clock = Date.now, options = {}) {
         this.database = database;
         this.vault = vault;
         this.clock = clock;
-        this.options = options;
-        this.#security = new SyncHostSecurityService(database, (pluginId, runtimeId) => this.#assertRuntime(pluginId, runtimeId), options.security);
-        this.vault.on("all", (event, file, context) => {
+        const { securityStore, securityProvider, localProvider, guardLocalApply, ...retainedOptions } = options;
+        this.options =
+            securityStore === undefined &&
+                securityProvider === undefined &&
+                localProvider === undefined &&
+                guardLocalApply === undefined
+                ? options
+                : retainedOptions;
+        this.#selectSecurityProvider = securityProvider;
+        this.#selectLocalProvider = localProvider;
+        this.#guardLocalApply = guardLocalApply;
+        this.#security = new SyncHostSecurityService(securityStore === undefined ? database : securityStore, (pluginId, runtimeId) => this.#assertRuntime(pluginId, runtimeId), options.security);
+        const eventRef = this.vault.on("all", (event, file, context) => {
             if (!(file instanceof TFile) || !this.#isChangeKind(event))
                 return;
             const previousPath = typeof context.oldPath === "string" ? context.oldPath : undefined;
@@ -92,10 +113,12 @@ export class SyncHostService {
                 : undefined;
             this.#eventQueue = this.#eventQueue
                 .then(async () => {
+                await this.#ready;
                 await this.#recordFileChange(event, file, previousPath, originId);
             })
                 .catch(() => undefined);
         });
+        this.#stopObserving = () => this.vault.offref(eventRef);
         this.#ready = this.#initialize();
     }
     async ready() {
@@ -103,6 +126,8 @@ export class SyncHostService {
         await this.#eventQueue;
     }
     forPlugin(pluginId, grantedCapabilities) {
+        if (this.#disposed)
+            throw new Error("Sync host is disposed");
         const normalizedPluginId = requireBoundedString(pluginId, "Plugin ID", 128);
         const runtimeId = randomId();
         const runtimeIds = this.#runtimeIds.get(normalizedPluginId) ?? new Set();
@@ -116,7 +141,7 @@ export class SyncHostService {
                 throw new Error(`Plugin ${normalizedPluginId} is not granted ${capability}`);
             }
         };
-        return {
+        const capabilities = {
             files: {
                 getIdentity: async (path) => {
                     assertGranted("metadata:identity");
@@ -304,32 +329,157 @@ export class SyncHostService {
             }),
             generatedState: this.#generatedState(normalizedPluginId, runtimeId, () => assertGranted("plugin:generated-state")),
         };
+        if (this.#selectLocalProvider) {
+            const local = new ScopedSyncLocalRuntime({
+                runtimeId,
+                assertGranted,
+                selectProvider: () => this.#selectLocalProvider(normalizedPluginId),
+                guardApply: this.#guardLocalApply,
+            });
+            this.#localRuntimes.set(runtimeId, local);
+            Object.assign(capabilities, { local: local.capabilities });
+        }
+        let delegated;
+        let selected = false;
+        for (const group of [
+            "crypto",
+            "syncIdentity",
+            "pairing",
+            "membership",
+            "recovery",
+        ]) {
+            const local = capabilities[group];
+            const guarded = {};
+            for (const method of Object.keys(local)) {
+                guarded[method] = async (...args) => {
+                    assertGranted("crypto:nostr-sync");
+                    if (!selected) {
+                        const provider = this.#securityProvider(normalizedPluginId);
+                        if (provider) {
+                            this.#delegatedRuntimes.set(runtimeId, provider);
+                            delegated = provider.forRuntime(runtimeId);
+                            if (!delegated || typeof delegated !== "object")
+                                throw new Error("Invalid Sync security provider capabilities");
+                        }
+                        selected = true;
+                    }
+                    assertGranted("crypto:nostr-sync");
+                    const target = delegated ? delegated[group] : local;
+                    const operation = target && target[method];
+                    if (typeof operation !== "function")
+                        throw new Error(`Invalid Sync security provider operation: ${group}.${method}`);
+                    const result = await operation.apply(target, args);
+                    assertGranted("crypto:nostr-sync");
+                    return result;
+                };
+            }
+            Object.assign(capabilities, { [group]: guarded });
+        }
+        return capabilities;
     }
     revokePlugin(pluginId) {
+        const runtimes = this.#runtimeIds.get(pluginId);
         this.#runtimeIds.delete(pluginId);
         for (const [token, owner] of this.#origins) {
             if (owner.pluginId === pluginId)
                 this.#origins.delete(token);
         }
         this.#security.revokePlugin(pluginId);
+        const cleanups = [];
+        for (const runtimeId of runtimes ?? []) {
+            const provider = this.#delegatedRuntimes.get(runtimeId);
+            this.#delegatedRuntimes.delete(runtimeId);
+            const local = this.#localRuntimes.get(runtimeId);
+            this.#localRuntimes.delete(runtimeId);
+            if (!provider && !local)
+                continue;
+            let cleanup;
+            try {
+                // Local streams/operations must finish while native crypto custody still exists.
+                const localCleanup = local?.revoke();
+                cleanup = localCleanup
+                    ? (async () => {
+                        const result = await Promise.allSettled([localCleanup]);
+                        await provider?.revokeRuntime(runtimeId);
+                        if (result[0]?.status === "rejected")
+                            throw result[0].reason;
+                    })()
+                    : Promise.resolve(provider.revokeRuntime(runtimeId));
+            }
+            catch (error) {
+                cleanup = Promise.reject(error);
+            }
+            this.#securityCleanup.add(cleanup);
+            cleanups.push(cleanup);
+        }
+        return this.#drainSecurity(cleanups);
+    }
+    /** Invalidate first, then wait for every admitted host cleanup and file event. */
+    dispose() {
+        if (this.#disposal)
+            return this.#disposal;
+        this.#disposed = true;
+        this.#stopObserving();
+        const revocations = [...this.#runtimeIds.keys()].map((pluginId) => this.revokePlugin(pluginId));
+        this.#disposal = this.#drainSecurity([
+            ...revocations,
+            ...this.#securityCleanup,
+            this.ready(),
+        ]);
+        return this.#disposal;
+    }
+    async #drainSecurity(cleanups) {
+        const results = await Promise.allSettled(cleanups);
+        for (const cleanup of cleanups)
+            this.#securityCleanup.delete(cleanup);
+        const failed = results.find((result) => result.status === "rejected");
+        if (failed?.status === "rejected")
+            throw failed.reason;
+    }
+    #securityProvider(pluginId) {
+        if (!this.#securityProviders.has(pluginId)) {
+            const provider = this.#selectSecurityProvider?.(pluginId);
+            if (provider !== undefined &&
+                (!provider ||
+                    typeof provider.forRuntime !== "function" ||
+                    typeof provider.revokeRuntime !== "function"))
+                throw new Error("Invalid Sync security provider");
+            this.#securityProviders.set(pluginId, provider);
+        }
+        return this.#securityProviders.get(pluginId);
+    }
+    #assertLocalSecurity(pluginId) {
+        requireBoundedString(pluginId, "Plugin ID", 128);
+        if (this.#disposed)
+            throw new Error("Sync host is disposed");
+        if (this.#securityProvider(pluginId))
+            throw new Error(`Sync security for ${pluginId} is delegated to its host provider`);
     }
-    /** Host-controlled enrollment; this operation is intentionally absent from plugin facades. */
-    enrollPluginCrypto(pluginId, passphrase, request) {
+    /**
+     * Host-controlled enrollment; this operation is intentionally absent from
+     * plugin facades.
+     */
+    async enrollPluginCrypto(pluginId, passphrase, request) {
+        this.#assertLocalSecurity(pluginId);
         return this.#security.enroll(requireBoundedString(pluginId, "Plugin ID", 128), passphrase, request);
     }
     /** Host-controlled unlock; plugins can only observe locked state. */
-    unlockPluginCrypto(pluginId, passphrase) {
+    async unlockPluginCrypto(pluginId, passphrase) {
+        this.#assertLocalSecurity(pluginId);
         return this.#security.unlock(requireBoundedString(pluginId, "Plugin ID", 128), passphrase);
     }
     /** Host-controlled passkey or OS-credential enrollment. */
-    enrollPluginCryptoWithWrappingKey(pluginId, wrappingKey, descriptor, request) {
+    async enrollPluginCryptoWithWrappingKey(pluginId, wrappingKey, descriptor, request) {
+        this.#assertLocalSecurity(pluginId);
         return this.#security.enrollWithWrappingKey(requireBoundedString(pluginId, "Plugin ID", 128), wrappingKey, descriptor, request);
     }
     /** Host-controlled passkey or OS-credential unlock. */
-    unlockPluginCryptoWithWrappingKey(pluginId, wrappingKey) {
+    async unlockPluginCryptoWithWrappingKey(pluginId, wrappingKey) {
+        this.#assertLocalSecurity(pluginId);
         return this.#security.unlockWithWrappingKey(requireBoundedString(pluginId, "Plugin ID", 128), wrappingKey);
     }
     lockPluginCrypto(pluginId) {
+        this.#assertLocalSecurity(pluginId);
         this.#security.lock(requireBoundedString(pluginId, "Plugin ID", 128));
     }
     grantPluginNetworkOrigin(pluginId, origin, options) {

package/dist/sync-repository.d.ts

@@ -0,0 +1,106 @@
+/** Durable opaque sync data. Hosts keep this separate from disposable AppDatabase indexes. */
+export interface SealedSyncState {
+    version: number;
+    epoch: number;
+    ciphertext: Uint8Array;
+}
+export interface SyncRepository {
+    readonly blobs: {
+        has(hash: string): Promise<boolean>;
+        put(ciphertext: Uint8Array): Promise<{
+            hash: string;
+            size: number;
+        }>;
+        get(hash: string): Promise<Uint8Array>;
+    };
+    readState(): Promise<SealedSyncState | null>;
+    compareAndSwap(expectedVersion: number, next: SealedSyncState, authority?: SyncOperationAuthority): Promise<boolean>;
+}
+/** Expected endpoint authority for a guarded host operation, outside encrypted protocol data. */
+export interface SyncOperationAuthority {
+    vaultId: string;
+    devicePublicKey: string;
+    epoch: number;
+    membershipGeneration: number;
+}
+/** Immutable sealed records addressed by opaque 64-character lowercase hex keys. */
+export interface SealedSyncRecord {
+    epoch: number;
+    ciphertext: Uint8Array;
+}
+/** Optional repository extension for independently encrypted, indexed local records. */
+export interface SyncIndexedRepository extends SyncRepository {
+    readonly records: {
+        get(key: string): Promise<SealedSyncRecord | null>;
+        /** False preserves the existing record unchanged, including concurrent insertion. */
+        putIfAbsent(key: string, record: SealedSyncRecord): Promise<boolean>;
+    };
+}
+/** Captured by the owning host; a missing file is represented by null. */
+export interface SyncFileGeneration {
+    fileId: string;
+    contentGeneration: number;
+    hostFileId?: string;
+}
+export interface SyncFileMutation {
+    id: string;
+    kind: "write" | "remove";
+    path: string;
+    expected: SyncFileGeneration | null;
+    fileId: string;
+}
+/** Capture only protocol-neutral mutation data; file handles may carry read functions. */
+export declare function snapshotSyncFileMutation(input: SyncFileMutation): SyncFileMutation;
+export interface SyncFileMutationReceipt {
+    operation: SyncFileMutation;
+    result: SyncFileGeneration | null;
+}
+/** The host journals immutable operation IDs and verifies guards at mutation. */
+export interface SyncFileMutationAccess {
+    receipt(operationId: string, authority?: SyncOperationAuthority): Promise<SyncFileMutationReceipt | null>;
+    mutate(operation: SyncFileMutation, source?: ReadableStream<Uint8Array>, authority?: SyncOperationAuthority): Promise<SyncFileMutationReceipt>;
+}
+export interface SyncFileDescriptor extends SyncFileGeneration {
+    path: string;
+}
+export interface SyncGuardedFile extends SyncFileDescriptor {
+    openRead(): Promise<ReadableStream<Uint8Array>>;
+}
+/** Captured working files and durable encrypted state owned by the current host. */
+export interface SyncLocalHostCapabilities {
+    list(): Promise<SyncGuardedFile[]>;
+    readonly repository: SyncRepository;
+    readonly apply: SyncFileMutationAccess;
+}
+/** Trusted host adapter. Neither this controller nor storage paths enter plugin facades. */
+export interface SyncHostLocalProvider {
+    forRuntime(runtimeId: string): SyncLocalHostCapabilities;
+    revokeRuntime(runtimeId: string): void | Promise<void>;
+}
+/** The owning host protects editor state for the entire callback, including recovery. */
+export type SyncLocalApplyGuard = <T>(path: string | undefined, operation: () => Promise<T>) => Promise<T>;
+/** Minimal opaque crypto boundary; implementations retain all secret material. */
+export interface SyncVaultStateCrypto {
+    status(): Promise<{
+        state: "unenrolled" | "locked" | "unlocked";
+        suite: "lapis-sync-v1-xchacha20poly1305-schnorr";
+        vaultId?: string;
+        devicePublicKey?: string;
+        deviceState?: "active" | "revoked" | "recovery-pending";
+        currentEpoch?: number;
+        membershipGeneration?: number;
+    }>;
+    encryptObject(input: {
+        epoch: number;
+        type: "local-state";
+        plaintext: Uint8Array;
+    }): Promise<{
+        bytes: Uint8Array;
+        objectHash: string;
+    }>;
+    decryptObject(input: {
+        epoch: number;
+        type: "local-state";
+        envelope: Uint8Array;
+    }): Promise<Uint8Array>;
+}

package/dist/sync-repository.js

@@ -0,0 +1,18 @@
+/** Capture only protocol-neutral mutation data; file handles may carry read functions. */
+export function snapshotSyncFileMutation(input) {
+    return {
+        id: input.id,
+        kind: input.kind,
+        path: input.path,
+        fileId: input.fileId,
+        expected: input.expected === null
+            ? null
+            : {
+                fileId: input.expected.fileId,
+                contentGeneration: input.expected.contentGeneration,
+                ...(input.expected.hostFileId !== undefined
+                    ? { hostFileId: input.expected.hostFileId }
+                    : {}),
+            },
+    };
+}

package/dist/vault-change-views.d.ts

@@ -0,0 +1,4 @@
+import type { App } from "./context.svelte";
+import { TFile } from "./storage/fs";
+/** Project into existing owned views; no replacement editor or persistence path. */
+export declare function projectVaultChange(app: App, event: string, file: TFile, context: Record<string, unknown>, current: () => boolean): Promise<void>;

package/dist/vault-change-views.js

@@ -0,0 +1,43 @@
+import { TFile } from "./storage/fs";
+import { FileView } from "./view.svelte";
+/** Project into existing owned views; no replacement editor or persistence path. */
+export async function projectVaultChange(app, event, file, context, current) {
+    if (!current())
+        return;
+    if (context.external === true)
+        app.workspace.trigger("file-change", file, event);
+    if (event !== "rename" && event !== "delete")
+        return;
+    const oldPath = event === "rename" ? String(context.oldPath) : file.path;
+    if (app.fileEditingSessions.hasDirty(oldPath)) {
+        app.notifications.notify({
+            id: `vault-file-change:${oldPath}`,
+            title: "File changed on disk",
+            message: event === "rename"
+                ? `${oldPath} moved to ${file.path}. Local edits remain in the original view for recovery.`
+                : `${oldPath} was removed on disk. Local edits remain in the original view for recovery.`,
+            severity: "warning",
+            source: "vault",
+        });
+        return;
+    }
+    const leaves = [];
+    app.workspace.iterateAllLeaves((leaf) => {
+        if (leaf.view instanceof FileView && leaf.view.file?.path === oldPath)
+            leaves.push(leaf);
+    });
+    for (const leaf of leaves) {
+        if (!current() ||
+            !(leaf.view instanceof FileView) ||
+            leaf.view.file?.path !== oldPath)
+            continue;
+        if (event === "rename")
+            await leaf.view.onRename(file.copy());
+        else
+            await leaf.setViewState({ type: "empty", state: {} });
+        if (current())
+            app.workspace.requestSaveLayout();
+    }
+    if (current())
+        app.workspace.reconcileFileReference(oldPath, event === "rename" ? file : null);
+}

package/dist/vault-changes.d.ts

@@ -0,0 +1,37 @@
+import type { App } from "./context.svelte";
+/** One App owns watching, reconciliation and retirement for its live Vault. */
+export declare class VaultChangeService {
+    private readonly app;
+    private watcher;
+    private starting;
+    private stopping;
+    private processing;
+    private timer;
+    private generation;
+    private active;
+    private registered;
+    private dirty;
+    private uncertain;
+    private failures;
+    private readonly hints;
+    private stopProjection;
+    private readonly projections;
+    constructor(app: App);
+    start(): Promise<void>;
+    /**
+     * Retire callbacks synchronously, then drain registration, native IO and
+     * scans.
+     */
+    stop(): Promise<void>;
+    /**
+     * Flush pending hints now; explicit calls also retry a previously failed
+     * scan.
+     */
+    settle(): Promise<void>;
+    private live;
+    private clearTimer;
+    private report;
+    private schedule;
+    private changed;
+    private drain;
+}

package/dist/vault-changes.js

@@ -0,0 +1,228 @@
+import { DirectoryWatcher, TFile, } from "./storage/fs";
+import { projectVaultChange } from "./vault-change-views";
+/** One App owns watching, reconciliation and retirement for its live Vault. */
+export class VaultChangeService {
+    app;
+    watcher;
+    starting;
+    stopping;
+    processing;
+    timer;
+    generation = 0;
+    active = false;
+    registered = false;
+    dirty = false;
+    uncertain = false;
+    failures = 0;
+    hints = new Map();
+    stopProjection;
+    projections = new Set();
+    constructor(app) {
+        this.app = app;
+    }
+    start() {
+        if (this.starting)
+            return this.starting;
+        if (this.active)
+            return this.settle();
+        const run = async () => {
+            const retiring = this.stop();
+            const requested = this.generation;
+            await retiring;
+            if (this.generation !== requested)
+                return;
+            const generation = ++this.generation;
+            this.active = true;
+            this.dirty = true;
+            const watcher = new DirectoryWatcher(this.app.vault.adapter);
+            this.watcher = watcher;
+            const projection = this.app.vault.on("all", (event, file, context) => {
+                if (!this.live(generation) || !(file instanceof TFile))
+                    return;
+                const snapshot = file.copy(), details = { ...context };
+                const pending = this.app.fileEditingSessions.track(() => this.app.fileEditingSessions.afterMutations(() => projectVaultChange(this.app, event, snapshot, details, () => this.live(generation))));
+                this.projections.add(pending);
+                void pending
+                    .catch((error) => this.report(error))
+                    .finally(() => this.projections.delete(pending));
+            });
+            this.stopProjection = () => this.app.vault.offref(projection);
+            watcher.on("all", (event) => {
+                if (this.live(generation))
+                    this.changed(event, generation);
+            });
+            const subscription = watcher.watch("/", { recursive: true });
+            await subscription.ready;
+            if (!this.live(generation))
+                return;
+            this.registered = true;
+            await this.drain(generation);
+        };
+        const pending = run()
+            .catch(async (error) => {
+            this.active = false;
+            this.registered = false;
+            ++this.generation;
+            this.clearTimer();
+            this.stopProjection?.();
+            this.stopProjection = undefined;
+            try {
+                await this.watcher?.close();
+            }
+            catch (cleanup) {
+                throw new AggregateError([error, cleanup], "Vault watch startup and cleanup failed");
+            }
+            this.watcher = undefined;
+            throw error;
+        })
+            .finally(() => {
+            if (this.starting === pending)
+                this.starting = undefined;
+        });
+        this.starting = pending;
+        return pending;
+    }
+    /**
+     * Retire callbacks synchronously, then drain registration, native IO and
+     * scans.
+     */
+    stop() {
+        this.active = false;
+        this.registered = false;
+        ++this.generation;
+        this.clearTimer();
+        this.stopProjection?.();
+        this.stopProjection = undefined;
+        this.hints.clear();
+        this.dirty = false;
+        this.uncertain = false;
+        if (this.stopping)
+            return this.stopping;
+        const watcher = this.watcher;
+        const pending = Promise.allSettled([
+            watcher?.close(),
+            this.processing,
+            this.starting,
+            ...this.projections,
+        ])
+            .then((results) => {
+            const errors = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+            if (errors.length)
+                throw new AggregateError(errors, "Vault watch cleanup failed");
+            if (this.watcher === watcher)
+                this.watcher = undefined;
+        })
+            .finally(() => {
+            if (this.stopping === pending)
+                this.stopping = undefined;
+        });
+        this.stopping = pending;
+        return pending;
+    }
+    /**
+     * Flush pending hints now; explicit calls also retry a previously failed
+     * scan.
+     */
+    async settle() {
+        await this.starting;
+        this.clearTimer();
+        if (this.active && this.registered) {
+            await this.drain(this.generation);
+            while (this.projections.size)
+                await Promise.all([...this.projections]);
+        }
+    }
+    live(generation) {
+        return this.active && this.generation === generation;
+    }
+    clearTimer() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        this.timer = undefined;
+    }
+    report(error) {
+        this.app.notifications.notify({
+            id: "vault-watch-reconciliation",
+            title: "File changes need attention",
+            message: error instanceof Error ? error.message : String(error),
+            severity: "error",
+            source: "vault",
+        });
+    }
+    schedule(generation, delay = 40) {
+        if (!this.registered || this.timer || !this.live(generation))
+            return;
+        this.timer = setTimeout(() => {
+            this.timer = undefined;
+            void this.drain(generation).catch(() => { });
+        }, delay);
+    }
+    changed(event, generation) {
+        this.dirty = true;
+        if (event.type === "error") {
+            this.uncertain = true;
+            this.hints.clear();
+            this.report(event.error);
+        }
+        else if (!this.uncertain) {
+            const previous = event.previousPath
+                ? this.hints.get(event.previousPath)
+                : this.hints.get(event.path);
+            const hint = {
+                ...event,
+                previousPath: previous?.previousPath ?? event.previousPath,
+            };
+            if (event.previousPath)
+                this.hints.delete(event.previousPath);
+            this.hints.set(event.path, hint);
+            const bytes = [...this.hints.values()].reduce((sum, value) => sum +
+                new TextEncoder().encode(value.path + (value.previousPath ?? ""))
+                    .byteLength +
+                96, 0);
+            if (event.path === "/" ||
+                !event.path ||
+                this.hints.size > 2048 ||
+                bytes > 128 * 1024) {
+                this.uncertain = true;
+                this.hints.clear();
+            }
+        }
+        this.schedule(generation);
+    }
+    drain(generation) {
+        if (this.processing)
+            return this.processing;
+        const run = async () => {
+            while (this.live(generation) && this.dirty) {
+                const hints = this.uncertain ? [] : [...this.hints.values()];
+                this.hints.clear();
+                this.dirty = false;
+                this.uncertain = false;
+                try {
+                    await this.app.vault.reconcile(hints, () => this.live(generation), {
+                        external: true,
+                    });
+                    while (this.projections.size)
+                        await Promise.all([...this.projections]);
+                    this.failures = 0;
+                }
+                catch (error) {
+                    if (this.live(generation)) {
+                        this.dirty = true;
+                        this.uncertain = true;
+                        this.report(error);
+                        if (++this.failures <= 4)
+                            this.schedule(generation, 250 * 2 ** (this.failures - 1));
+                    }
+                    throw error;
+                }
+            }
+        };
+        const pending = run().finally(() => {
+            if (this.processing === pending)
+                this.processing = undefined;
+        });
+        this.processing = pending;
+        return pending;
+    }
+}