@vrtmrz/livesync-commonlib 0.1.28 → 0.1.29

package/dist/pouchdb/encryption.js

@@ -177,11 +177,10 @@ async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase,
     }
   }
   if (isObfuscatedEntry(loadDoc)) {
-    const path = getPath(loadDoc);
     if (isEncryptedMeta(loadDoc)) {
       const pbkdf2salt = await getPBKDF2Salt();
       try {
-        const metadata = await decryptMetaWithHKDF(path, passphrase, pbkdf2salt);
+        const metadata = await decryptMetaWithHKDF(loadDoc.path, passphrase, pbkdf2salt);
         for (const key of Object.keys(metadata)) {
           loadDoc[key] = metadata[key];
         }
@@ -190,13 +189,16 @@ async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase,
         Logger(ex);
         throw ex;
       }
-    } else if (isPathProbablyObfuscated(path)) {
-      const decryptedPath = await tryDecryptV1AsFallback(path, passphrase, useDynamicIterationCount);
-      if (decryptedPath === false) {
-        Logger(`${MESSAGE_FALLBACK_DECRYPT_FAILED} on Path`, LOG_LEVEL_NOTICE);
-        throw new Error(MESSAGE_FALLBACK_DECRYPT_FAILED);
+    } else {
+      const path = getPath(loadDoc);
+      if (isPathProbablyObfuscated(path)) {
+        const decryptedPath = await tryDecryptV1AsFallback(path, passphrase, useDynamicIterationCount);
+        if (decryptedPath === false) {
+          Logger(`${MESSAGE_FALLBACK_DECRYPT_FAILED} on Path`, LOG_LEVEL_NOTICE);
+          throw new Error(MESSAGE_FALLBACK_DECRYPT_FAILED);
+        }
+        loadDoc.path = decryptedPath;
       }
-      loadDoc.path = decryptedPath;
     }
   }
   let readEden = {};

package/docs/development.md

@@ -87,6 +87,8 @@ The unreleased watcher deletion checks and the separate database-to-storage refl
 
 File-path parsing recognises only the leading `i:`, `ix:`, and `ps:` namespaces. Colons elsewhere belong to the path, including the complete remainder after one namespace. Document-ID parsing additionally recognises `h:` and `f:`; those document IDs are not ordinary storage paths. Keep normalisation, selection patterns, and database lookup on the complete path. `pathPrefixes.unit.spec.ts`, `typeUtils.unit.spec.ts`, and `PathService.unit.spec.ts` cover these conversions, and `ServiceFileHandlerBase.colonPaths.unit.spec.ts` exercises storage and reflection with real PouchDB Metadata and Chunks. Host filename restrictions remain a separate contract: a host must not interpret an unsupported name as permission to write a shortened one.
 
+Before HKDF decryption, an obfuscated Metadata document's `path` field contains an encrypted payload beginning `/\:` rather than a logical file path or a document ID. Read that field directly for decryption; apply path and ID conversion only after obtaining the decoded path. `encryption.unit.spec.ts` covers this round trip, the legacy V1 path fallback, and decoded PouchDB replication events. `StreamingFetch.unit.spec.ts` covers decryption before the initial fetch writes and checkpoints a document.
+
 The revision-tree safety rules are documented in [Conflict resolution and file provenance](conflict-resolution.md). `ConflictManager.unit.spec.ts` owns common-ancestor and conservative merge behaviour, deterministic pair selection for multiple live leaves, and reconstruction from the committed tree between stages. `EntryManagerImpls.unit.spec.ts` owns the distinction between force-writing below an exact revision and conditionally advancing a current live leaf through PouchDB's ordinary revision check. `ServiceDatabaseFileAccessBase.unit.spec.ts` owns all-branch content discovery, short-circuiting history existence checks after an exact match, exact-revision logical deletion, and the public live-base result and event boundary. `ServiceFileHandlerBase.unit.spec.ts` owns the injected provenance policy for edit, deletion, and rename operations, together with user-selected reflection, child creation, strict matching, matching-provenance cleanup after exact branch deletion, and stale-revision refusal. `LiveSyncLocalDB.unit.spec.ts` owns chunk reachability across current winners, shared chunks, live conflicts, available merge ancestry, conflict resolution, and PouchDB replication of collection and recreation. Extend the relevant sides when changing conflict resolution, compaction handling, provenance, chunk collection, or database-to-storage overwrite protection.
 
 `LiveSyncReplicator.unit.spec.ts` owns the CouchDB remote-chunk batch contract: a mixed `_all_docs` result must return each available document even when another keyed row reports an error. `ChunkFetcher.unit.spec.ts` owns the consumer behaviour: it writes valid returned chunks and emits `missingChunkRemote` only for requested IDs which are absent from the returned set. Extend both sides when changing remote chunk acquisition or missing-chunk delivery.

package/docs/proven-in-use.md

@@ -10,6 +10,8 @@ The code paths below identify the maintained Self-hosted LiveSync composition po
 
 Unreleased colon-path regression tests establish that Commonlib preserves ordinary file paths through Metadata storage, Chunk retrieval, and storage reflection, with path obfuscation enabled or disabled. They use real PouchDB with injected storage. This result does not establish which filenames a host's file-creation API accepts; that boundary requires host runtime verification.
 
+Commonlib's encryption tests verify that an obfuscated Metadata document retains its document ID while its HKDF-encrypted path and file properties round-trip, that V1-obfuscated paths remain readable through the fallback, and that PouchDB replication presents a decoded path to both local storage and change events. The Fast Fetch test verifies decryption before storage and checkpointing. On 26th September 2026, a local packed candidate of this fix passed LiveSync 1.0.31's `npm run check` and unit tests, as well as real Obsidian two-Vault synchronisation, encrypted CLI-to-Obsidian transfer, and encrypted Metadata retrieval through Fast Fetch during manual CouchDB onboarding.
+
 The plug-in extends the neutral `ServiceContext` with Obsidian-owned capabilities in `src/modules/services/ObsidianServiceContext.ts`. One context instance carries the LiveSync-owned translator and event hub through the Service Hub rather than placing those dependencies in Commonlib globals. Commonlib supplies its typed English fallback when another host omits the translator.
 
 The consumer contract in `test/contracts/serviceContext.ts` checks shared result semantics and exact context identity across the composed services. The real-Obsidian suite documented in `test/e2e-obsidian/README.md` then covers plug-in loading, representative Svelte dialogue mounts, Vault reflection, CouchDB and Object Storage synchronisation, a two-device P2P Setup URI round-trip, two-Vault behaviour, and other Obsidian-owned boundaries.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vrtmrz/livesync-commonlib",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Shared data, storage, and replication primitives for Self-hosted LiveSync clients.",
   "type": "module",
   "types": "./dist/index.d.ts",