@seed-hypermedia/client 0.0.25 → 0.0.27

package/dist/base64.d.ts

@@ -0,0 +1,23 @@
+import 'core-js/modules/es.uint8-array.from-base64.js';
+import 'core-js/modules/es.uint8-array.to-base64.js';
+declare global {
+    interface Uint8Array {
+        toBase64(options?: {
+            alphabet?: 'base64' | 'base64url';
+            omitPadding?: boolean;
+        }): string;
+    }
+    interface Uint8ArrayConstructor {
+        fromBase64(string: string, options?: {
+            alphabet?: 'base64' | 'base64url';
+        }): Uint8Array;
+    }
+}
+/**
+ * Encode Uint8Array to base64url string.
+ */
+export declare function encode(data: Uint8Array): string;
+/**
+ * Decode base64url string to Uint8Array.
+ */
+export declare function decode(data: string): Uint8Array;

package/dist/{chunk-KDTQQR2L.mjs → chunk-F2YINBVV.mjs}

@@ -1,3 +1,9 @@
+var __defProp = Object.defineProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
 // src/hm-types.ts
 import * as z from "zod";
 var BlockRangeSchema = z.object({
@@ -600,7 +606,18 @@ var HMDraftContentSchema = z.object({
   // EditorBlock validation is handled elsewhere
   deps: z.array(z.string().min(1)).default([]),
   navigation: z.array(HMNavigationItemSchema).optional(),
-  cursorPosition: z.number().optional()
+  cursorPosition: z.number().optional(),
+  /**
+   * Block IDs the local user touched since starting this draft. Used by the
+   * auto-rebase classifier to distinguish locally-edited blocks from incoming
+   * remote edits. Persisted so reload-after-rebase keeps the touch history.
+   */
+  mineTouchedIds: z.array(z.string()).optional(),
+  /**
+   * Snapshot of the published HMBlockNode[] tree at the time the draft was
+   * started (or last rebased). Acts as the merge base for three-way diff.
+   */
+  baseBlocks: z.array(z.any()).optional()
 });
 var HMDraftMetaBaseSchema = z.object({
   id: z.string(),
@@ -1187,6 +1204,7 @@ function isSurrogate(s, i) {
 }
 
 export {
+  __export,
   BlockRangeSchema,
   unpackedHmIdSchema,
   HMBlockChildrenTypeSchema,

package/dist/encryption.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Default Argon2id parameters for password-based key derivation.
+ */
+export declare const DEFAULT_PARAMS: {
+    memoryCost: number;
+    timeCost: number;
+    parallelism: number;
+};
+/**
+ * Argon2id parameters for key derivation.
+ */
+export interface Argon2Params {
+    memoryCost: number;
+    timeCost: number;
+    parallelism: number;
+}
+/**
+ * Derives a 256-bit key from a password using Argon2id.
+ */
+export declare function deriveKeyFromPassword(password: string, salt: Uint8Array, params?: Argon2Params): Promise<Uint8Array>;
+/**
+ * Encrypts bytes with XChaCha20-Poly1305 using the first 32 bytes of the provided key.
+ * Returns the nonce prefixed to the ciphertext.
+ */
+export declare function encrypt(plaintext: Uint8Array, key: Uint8Array, nonce?: Uint8Array<ArrayBuffer>): Promise<Uint8Array>;
+/**
+ * Decrypts nonce-prefixed XChaCha20-Poly1305 ciphertext using the first 32 bytes of the provided key.
+ */
+export declare function decrypt(data: Uint8Array, key: Uint8Array): Promise<Uint8Array>;

package/dist/hm-types.d.ts

@@ -12297,6 +12297,17 @@ export declare const HMDraftContentSchema: z.ZodObject<{
         text: string;
     }>, "many">>;
     cursorPosition: z.ZodOptional<z.ZodNumber>;
+    /**
+     * Block IDs the local user touched since starting this draft. Used by the
+     * auto-rebase classifier to distinguish locally-edited blocks from incoming
+     * remote edits. Persisted so reload-after-rebase keeps the touch history.
+     */
+    mineTouchedIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * Snapshot of the published HMBlockNode[] tree at the time the draft was
+     * started (or last rebased). Acts as the merge base for three-way diff.
+     */
+    baseBlocks: z.ZodOptional<z.ZodArray<z.ZodAny, "many">>;
 }, "strip", z.ZodTypeAny, {
     content: any[];
     deps: string[];
@@ -12307,6 +12318,8 @@ export declare const HMDraftContentSchema: z.ZodObject<{
         text: string;
     }[] | undefined;
     cursorPosition?: number | undefined;
+    mineTouchedIds?: string[] | undefined;
+    baseBlocks?: any[] | undefined;
 }, {
     content: any[];
     deps?: string[] | undefined;
@@ -12317,6 +12330,8 @@ export declare const HMDraftContentSchema: z.ZodObject<{
         text: string;
     }[] | undefined;
     cursorPosition?: number | undefined;
+    mineTouchedIds?: string[] | undefined;
+    baseBlocks?: any[] | undefined;
 }>;
 export type HMDraftContent = z.infer<typeof HMDraftContentSchema>;
 export declare const HMDraftMetaSchema: z.ZodEffects<z.ZodObject<{

package/dist/hm-types.mjs

@@ -165,7 +165,7 @@ import {
   toNumber,
   unpackHmId,
   unpackedHmIdSchema
-} from "./chunk-KDTQQR2L.mjs";
+} from "./chunk-F2YINBVV.mjs";
 export {
   BlockRangeSchema,
   BoldAnnotationSchema,

package/dist/index.d.ts

@@ -40,4 +40,6 @@ export { editorBlockToHMBlock, editorBlocksToHMBlockNodes } from './editorblock-
 export { hmBlocksToEditorContent, hmBlockToEditorBlock, annotationContains } from './hmblock-to-editorblock';
 export { AnnotationSet, addSpanToAnnotation, pushSpanToAnnotation } from './unicode';
 export type { MutableAnnotation, SpanAnnotation } from './unicode';
+export * as keyfile from './keyfile';
+export * as keyEncryption from './encryption';
 export type { EditorBlock, EditorBaseBlock, EditorBlockProps, EditorBlockType, EditorParagraphBlock, EditorHeadingBlock, EditorCodeBlock, EditorImageBlock, EditorVideoBlock, EditorFileBlock, EditorButtonBlock, EditorEmbedBlock, EditorWebEmbedBlock, EditorMathBlock, EditorNostrBlock, EditorQueryBlock, EditorUnknownBlock, EditorText, EditorLink, EditorInlineEmbed, EditorInlineStyles, EditorAnnotationType, HMInlineContent, MediaBlockProps, DraftMediaRef, SearchResult, } from './editor-types';

package/dist/index.mjs

@@ -4,6 +4,7 @@ import {
   HMBlockSchema,
   HMRequestSchema,
   HYPERMEDIA_SCHEME,
+  __export,
   codePointLength,
   entityQueryPathToHmIdPath,
   getHMQueryString,
@@ -16,7 +17,7 @@ import {
   serializeBlockRange,
   toNumber,
   unpackHmId
-} from "./chunk-KDTQQR2L.mjs";
+} from "./chunk-F2YINBVV.mjs";
 
 // src/capability.ts
 import { encode as cborEncode2 } from "@ipld/dag-cbor";
@@ -1416,8 +1417,8 @@ function buildHierarchy(elements) {
   return blocks;
 }
 async function teiToBlocks(teiXml, opts = {}) {
-  const { load } = await import("cheerio");
-  const $ = load(teiXml, { xml: true });
+  const { load: load2 } = await import("cheerio");
+  const $ = load2(teiXml, { xml: true });
   const title = extractTitle($);
   const displayAuthor = extractAuthors($);
   const summary = extractAbstract($);
@@ -4019,6 +4020,175 @@ function annotationContains(annotation, pos) {
 function isText(entry) {
   return (entry == null ? void 0 : entry.type) && entry.type == "text" && typeof entry.text == "string";
 }
+
+// src/keyfile.ts
+var keyfile_exports = {};
+__export(keyfile_exports, {
+  create: () => create,
+  decrypt: () => decrypt2,
+  load: () => load,
+  parse: () => parse,
+  principalStringFromSeed: () => principalStringFromSeed,
+  stringify: () => stringify
+});
+import { ed25519 } from "@noble/curves/ed25519.js";
+import { base58btc as base58btc5 } from "multiformats/bases/base58";
+
+// src/base64.ts
+import "core-js/modules/es.uint8-array.from-base64.js";
+import "core-js/modules/es.uint8-array.to-base64.js";
+function encode2(data) {
+  return data.toBase64({ alphabet: "base64url", omitPadding: true });
+}
+function decode(data) {
+  return Uint8Array.fromBase64(data, { alphabet: "base64url" });
+}
+
+// src/encryption.ts
+var encryption_exports = {};
+__export(encryption_exports, {
+  DEFAULT_PARAMS: () => DEFAULT_PARAMS,
+  decrypt: () => decrypt,
+  deriveKeyFromPassword: () => deriveKeyFromPassword,
+  encrypt: () => encrypt
+});
+import { xchacha20poly1305 } from "@noble/ciphers/chacha.js";
+import { argon2id } from "hash-wasm";
+var DEFAULT_PARAMS = {
+  memoryCost: 65536,
+  timeCost: 3,
+  parallelism: 4
+};
+async function deriveKeyFromPassword(password, salt, params = DEFAULT_PARAMS) {
+  const hash = await argon2id({
+    password,
+    salt,
+    parallelism: params.parallelism,
+    iterations: params.timeCost,
+    memorySize: params.memoryCost,
+    hashLength: 32,
+    outputType: "binary"
+  });
+  return new Uint8Array(hash);
+}
+async function encrypt(plaintext, key, nonce = crypto.getRandomValues(new Uint8Array(24))) {
+  const xc = xchacha20poly1305(key.subarray(0, 32), nonce);
+  const ciphertext = xc.encrypt(plaintext);
+  const output = new Uint8Array(nonce.length + ciphertext.length);
+  output.set(nonce);
+  output.set(ciphertext, nonce.length);
+  return output;
+}
+async function decrypt(data, key) {
+  const nonce = data.subarray(0, 24);
+  const ciphertext = data.subarray(24);
+  const xc = xchacha20poly1305(key.subarray(0, 32), nonce);
+  return xc.decrypt(ciphertext);
+}
+
+// src/keyfile.ts
+var ED25519_VARINT_PREFIX = new Uint8Array([237, 1]);
+function principalStringFromSeed(seed) {
+  const pub = ed25519.getPublicKey(seed);
+  const principal = new Uint8Array(ED25519_VARINT_PREFIX.length + pub.length);
+  principal.set(ED25519_VARINT_PREFIX, 0);
+  principal.set(pub, ED25519_VARINT_PREFIX.length);
+  return base58btc5.encode(principal);
+}
+async function create(input) {
+  const createTime = input.createTime ?? (/* @__PURE__ */ new Date()).toISOString();
+  const includedProfile = input.profile && (input.profile.name || input.profile.description) ? input.profile : void 0;
+  if (!input.password) {
+    return {
+      createTime,
+      publicKey: input.publicKey,
+      keyB64: encode2(input.key),
+      ...includedProfile ? { profile: includedProfile } : {}
+    };
+  }
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const derivedKey = await deriveKeyFromPassword(input.password, salt, DEFAULT_PARAMS);
+  const encrypted = await encrypt(input.key, derivedKey);
+  return {
+    createTime,
+    publicKey: input.publicKey,
+    keyB64: encode2(encrypted),
+    encryption: {
+      kdf: "argon2id",
+      argon2: {
+        memoryCost: DEFAULT_PARAMS.memoryCost,
+        timeCost: DEFAULT_PARAMS.timeCost,
+        parallelism: DEFAULT_PARAMS.parallelism,
+        saltB64: encode2(salt)
+      },
+      cipher: "xchacha20poly1305"
+    },
+    ...includedProfile ? { profile: includedProfile } : {}
+  };
+}
+function parse(json) {
+  const value = JSON.parse(json);
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Invalid key file payload");
+  }
+  return value;
+}
+function stringify(payload) {
+  return `${JSON.stringify(payload, null, 2)}
+`;
+}
+async function decrypt2(payload, password) {
+  if (!payload.keyB64) {
+    throw new Error("keyB64 is required");
+  }
+  if (!payload.encryption) {
+    return decode(payload.keyB64);
+  }
+  if (!password) {
+    throw new Error("password is required for encrypted key files");
+  }
+  if (payload.encryption.kdf !== "argon2id") {
+    throw new Error(`unsupported key derivation function "${payload.encryption.kdf}"`);
+  }
+  if (payload.encryption.cipher !== "xchacha20poly1305") {
+    throw new Error(`unsupported cipher "${payload.encryption.cipher}"`);
+  }
+  if (!payload.encryption.argon2) {
+    throw new Error("argon2 parameters are required");
+  }
+  if (!payload.encryption.argon2.memoryCost || !payload.encryption.argon2.timeCost || !payload.encryption.argon2.parallelism) {
+    throw new Error("argon2 parameters must be greater than zero");
+  }
+  if (!payload.encryption.argon2.saltB64) {
+    throw new Error("saltB64 is required for encrypted key files");
+  }
+  const derivedKey = await deriveKeyFromPassword(
+    password,
+    decode(payload.encryption.argon2.saltB64),
+    {
+      memoryCost: payload.encryption.argon2.memoryCost,
+      timeCost: payload.encryption.argon2.timeCost,
+      parallelism: payload.encryption.argon2.parallelism
+    }
+  );
+  return decrypt(decode(payload.keyB64), derivedKey);
+}
+async function load(json, password) {
+  const payload = parse(json);
+  const seed = await decrypt2(payload, password);
+  if (seed.length !== 32) {
+    throw new Error(`invalid private key length: expected 32 bytes, got ${seed.length}`);
+  }
+  const publicKey = principalStringFromSeed(seed);
+  if (payload.publicKey && payload.publicKey !== publicKey) {
+    throw new Error("publicKey does not match private key");
+  }
+  return {
+    payload,
+    seed,
+    publicKey
+  };
+}
 export {
   AnnotationSet,
   DEFAULT_GROBID_URL,
@@ -4069,6 +4239,8 @@ export {
   hmIdPathToEntityQueryPath,
   isGrobidAvailable,
   isSurrogate,
+  encryption_exports as keyEncryption,
+  keyfile_exports as keyfile,
   markdownBlockNodesToHMBlockNodes,
   matchBlockIds,
   packBaseId,

package/dist/keyfile.d.ts

@@ -0,0 +1,72 @@
+/**
+ * Derives the base58btc-multibase principal string for the given 32-byte ed25519 seed.
+ */
+export declare function principalStringFromSeed(seed: Uint8Array): string;
+/**
+ * Profile metadata included in exported key files for human readability.
+ */
+export interface Profile {
+    name?: string;
+    description?: string;
+}
+/**
+ * Argon2id parameters recorded in encrypted key files.
+ */
+export interface Argon2 {
+    memoryCost: number;
+    timeCost: number;
+    parallelism: number;
+    saltB64: string;
+}
+/**
+ * Encryption metadata recorded in encrypted key files.
+ */
+export interface Encryption {
+    kdf: 'argon2id';
+    argon2: Argon2;
+    cipher: 'xchacha20poly1305';
+}
+/**
+ * Exported payload written to `.hmkey.json` files.
+ */
+export interface Payload {
+    createTime: string;
+    publicKey: string;
+    keyB64: string;
+    encryption?: Encryption;
+    profile?: Profile;
+}
+/**
+ * Validated key material read from a serialized `.hmkey.json` file.
+ */
+export interface LoadedPayload {
+    payload: Payload;
+    seed: Uint8Array;
+    publicKey: string;
+}
+/**
+ * Creates a `.hmkey.json` payload from raw key bytes.
+ */
+export declare function create(input: {
+    publicKey: string;
+    key: Uint8Array;
+    password?: string;
+    profile?: Profile;
+    createTime?: string;
+}): Promise<Payload>;
+/**
+ * Parses a serialized `.hmkey.json` payload.
+ */
+export declare function parse(json: string): Payload;
+/**
+ * Serializes a `.hmkey.json` payload with a trailing newline.
+ */
+export declare function stringify(payload: Payload): string;
+/**
+ * Decrypts or decodes the raw key bytes from a `.hmkey.json` payload.
+ */
+export declare function decrypt(payload: Payload, password?: string): Promise<Uint8Array>;
+/**
+ * Parses, decrypts, and validates a serialized `.hmkey.json` payload.
+ */
+export declare function load(json: string, password?: string): Promise<LoadedPayload>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seed-hypermedia/client",
-  "version": "0.0.25",
+  "version": "0.0.27",
   "repository": {
     "type": "git",
     "url": "https://github.com/seed-hypermedia/seed",
@@ -46,8 +46,12 @@
   },
   "dependencies": {
     "@ipld/dag-cbor": "^9.2.5",
+    "@noble/ciphers": "^2.1.1",
+    "@noble/curves": "^2.0.1",
     "blockstore-core": "^5.0.2",
     "cheerio": "^1.2.0",
+    "core-js": "^3.48.0",
+    "hash-wasm": "^4.12.0",
     "ipfs-unixfs-importer": "^15.3.2",
     "multiformats": "^13.4.1",
     "superjson": "2.2.1",

package/src/index.ts

@@ -86,6 +86,9 @@ export {editorBlockToHMBlock, editorBlocksToHMBlockNodes} from './editorblock-to
 export {hmBlocksToEditorContent, hmBlockToEditorBlock, annotationContains} from './hmblock-to-editorblock'
 export {AnnotationSet, addSpanToAnnotation, pushSpanToAnnotation} from './unicode'
 export type {MutableAnnotation, SpanAnnotation} from './unicode'
+
+export * as keyfile from './keyfile'
+export * as keyEncryption from './encryption'
 export type {
   EditorBlock,
   EditorBaseBlock,