@vrtmrz/livesync-commonlib 0.1.28 → 0.1.30

package/README.md

@@ -119,6 +119,10 @@ New profile-management code can create or update a CouchDB, Object Storage, or P
 
 See [the remote configuration profile guide](docs/remote-configurations.md) for creation, activation, P2P selection, legacy import, persistence, and verification responsibilities.
 
+## Remote database feature compatibility
+
+CouchDB stores the representations already in use as feature identifiers in its version document. Assess that document before synchronisation or direct file operations, and retain unknown identifiers for host diagnostics. See [the remote feature compatibility contract](docs/remote-feature-compatibility.md) for the wire format, update rules, and recovery boundaries.
+
 ## Contract scope
 
 The package is currently an infrastructure and compatibility boundary. The context, rooted-storage, standard-I/O, and revision-tree safety contracts have focused cross-platform, instance-isolation, or real-PouchDB tests. Platform details which cannot be shared, such as file timestamp fidelity and browser permission handling, remain host concerns and are documented separately.
@@ -127,7 +131,7 @@ The package is currently an infrastructure and compatibility boundary. The conte
 
 The accepted replacement direction is an asynchronously created file client with stable `list`, `get`, `put`, `delete`, `watch`, and `close` operations. The operation result, conflict, concurrency, watch checkpoint, retry, and error contracts still require focused decisions and tests before that client can be published.
 
-Package developers should read [the developer guide](docs/development.md). The focused contracts are described in [the storage guide](docs/platform-storage.md), [the standard-I/O guide](docs/platform-standard-io.md), [the settings lifecycle guide](docs/settings-lifecycle.md), [the remote configuration profile guide](docs/remote-configurations.md), [the conflict-resolution guide](docs/conflict-resolution.md), and [the P2P transport lifecycle guide](docs/p2p-transport-lifecycle.md).
+Package developers should read [the developer guide](docs/development.md). The focused contracts are described in [the storage guide](docs/platform-storage.md), [the standard-I/O guide](docs/platform-standard-io.md), [the settings lifecycle guide](docs/settings-lifecycle.md), [the remote configuration profile guide](docs/remote-configurations.md), [the remote feature compatibility contract](docs/remote-feature-compatibility.md), [the conflict-resolution guide](docs/conflict-resolution.md), and [the P2P transport lifecycle guide](docs/p2p-transport-lifecycle.md).
 
 ## Proven in maintained hosts
 

package/dist/API/DirectFileManipulatorV2.d.ts

@@ -13,6 +13,7 @@ export type DirectFileManipulatorOptions = {
     passphrase: string | undefined;
     database: string;
     obfuscatePassphrase: string | undefined;
+    encryptInternalMetadata?: boolean;
     useDynamicIterationCount?: boolean;
     customChunkSize?: number;
     minimumChunkSize?: number;

package/dist/API/DirectFileManipulatorV2.js

@@ -3,8 +3,14 @@ import {
   DEFAULT_SYNC_PARAMETERS,
   ProtocolVersions,
   DOCID_SYNC_PARAMETERS,
-  E2EEAlgorithms
+  E2EEAlgorithms,
+  VER
 } from "../common/types.js";
+import { checkRemoteVersion } from "../pouchdb/negotiation.js";
+import {
+  ENCRYPTED_INTERNAL_METADATA_FEATURE,
+  usesEncryptedInternalMetadata
+} from "../pouchdb/remoteFeatureCompatibility.js";
 import { PouchDB } from "../pouchdb/pouchdb-http.js";
 import { LiveSyncLocalDB } from "../pouchdb/LiveSyncLocalDB.js";
 import { isErrorOfMissingDoc } from "../pouchdb/utils_couchdb.js";
@@ -51,6 +57,15 @@ class DirectFileManipulator {
       if (!await this.liveSyncLocalDB.initializeDatabase()) {
         throw new Error("Direct database initialisation was rejected.");
       }
+      const requiredFeatures = usesEncryptedInternalMetadata(this.settings) ? [ENCRYPTED_INTERNAL_METADATA_FEATURE] : [];
+      if (!await checkRemoteVersion(
+        this.liveSyncLocalDB.localDatabase,
+        async () => false,
+        VER,
+        requiredFeatures
+      )) {
+        throw new Error("Direct database version or features are not compatible.");
+      }
       this.liveSyncLocalDB.refreshSettings();
       this.ready.resolve();
     } catch (error) {
@@ -162,7 +177,8 @@ class DirectFileManipulator {
         this.options.useDynamicIterationCount ?? false,
         false,
         async () => await this.getReplicationPBKDF2Salt(this.getSettings()),
-        this.options.E2EEAlgorithm ?? E2EEAlgorithms.V2
+        this.options.E2EEAlgorithm ?? E2EEAlgorithms.V2,
+        usesEncryptedInternalMetadata(this.settings)
       );
     }
     return Promise.resolve(true);
@@ -209,6 +225,7 @@ class DirectFileManipulator {
         enableCompression: this.options.enableCompression ?? DEFAULT_SETTINGS.enableCompression,
         handleFilenameCaseSensitive: this.options.handleFilenameCaseSensitive ?? DEFAULT_SETTINGS.handleFilenameCaseSensitive,
         usePathObfuscation: !!this.options.obfuscatePassphrase,
+        encryptInternalMetadata: this.options.encryptInternalMetadata ?? false,
         E2EEAlgorithm: this.options.E2EEAlgorithm ?? E2EEAlgorithms.V2
       }
     };

package/dist/API/processSetting.d.ts

@@ -37,5 +37,183 @@ type ErasureProperties = keyof ObsidianLiveSyncSettings;
  * @returns Generated setup URI
  */
 export declare function encodeSettingsToSetupURI(settingString: ObsidianLiveSyncSettings, passphrase: string, removeProperties?: ErasureProperties[], skipDefaultValue?: boolean): Promise<string>;
-export declare function decodeSettingsFromSetupURI(uri: string, passphrase: string): Promise<false | Omit<ObsidianLiveSyncSettings, "P2P_iceServers" | "P2P_iceServersExpiresAt">>;
+export declare function decodeSettingsFromSetupURI(uri: string, passphrase: string): Promise<false | Omit<{
+    encryptInternalMetadata: boolean;
+    liveSync: boolean;
+    syncOnSave: boolean;
+    syncOnStart: boolean;
+    syncOnFileOpen: boolean;
+    syncOnEditorSave: boolean;
+    keepReplicationActiveInBackground: boolean;
+    allowSleepDuringSynchronisation: boolean;
+    allowSleepDuringSynchronisationOnDesktop: boolean;
+    syncMinimumInterval: number;
+    showVerboseLog: boolean;
+    lessInformationInLog: boolean;
+    showLongerLogInsideEditor: boolean;
+    showStatusOnEditor: boolean;
+    showStatusOnStatusbar: boolean;
+    showOnlyIconsOnEditor: boolean;
+    hideFileWarningNotice: boolean;
+    networkWarningStyle: "" | "icon" | "hidden";
+    displayLanguage: import("../common/models/setting.type.js").I18N_LANGS;
+    trashInsteadDelete: boolean;
+    doNotDeleteFolder: boolean;
+    batchSave: boolean;
+    batchSaveMinimumDelay: number;
+    batchSaveMaximumDelay: number;
+    syncMaxSizeInMB: number;
+    useIgnoreFiles: boolean;
+    ignoreFiles: string;
+    processSizeMismatchedFiles: boolean;
+    syncOnlyRegEx: import("../common/types.js").CustomRegExpSourceList<"|[]|">;
+    syncIgnoreRegEx: import("../common/types.js").CustomRegExpSourceList<"|[]|">;
+    syncAfterMerge: boolean;
+    resolveConflictsByNewerFile: boolean;
+    writeDocumentsIfConflicted: boolean;
+    disableMarkdownAutoMerge: boolean;
+    configPassphraseStore: import("../common/types.js").ConfigPassphraseStore;
+    encryptedPassphrase: string;
+    encryptedCouchDBConnection: string;
+    periodicReplication: boolean;
+    periodicReplicationInterval: number;
+    syncInternalFiles: boolean;
+    syncInternalFilesBeforeReplication: boolean;
+    syncInternalFilesInterval: number;
+    syncInternalFilesIgnorePatterns: import("../common/types.js").CustomRegExpSourceList<",">;
+    syncInternalFilesTargetPatterns: import("../common/types.js").CustomRegExpSourceList<",">;
+    watchInternalFileChanges: boolean;
+    suppressNotifyHiddenFilesChange: boolean;
+    syncInternalFileOverwritePatterns: import("../common/types.js").CustomRegExpSourceList<",">;
+    usePluginSync: boolean;
+    usePluginSettings: boolean;
+    showOwnPlugins: boolean;
+    autoSweepPlugins: boolean;
+    autoSweepPluginsPeriodic: boolean;
+    notifyPluginOrSettingUpdated: boolean;
+    deviceAndVaultName: string;
+    usePluginSyncV2: boolean;
+    usePluginEtc: boolean;
+    pluginSyncExtendedSetting: Record<import("../common/types.js").PluginSyncSettingEntry["key"], import("../common/types.js").PluginSyncSettingEntry>;
+    useAdvancedMode: boolean;
+    usePowerUserMode: boolean;
+    useEdgeCaseMode: boolean;
+    notifyThresholdOfRemoteStorageSize: number;
+    disableWorkerForGeneratingChunks: boolean;
+    processSmallFilesInUIThread: boolean;
+    savingDelay: number;
+    gcDelay: number;
+    skipOlderFilesOnSync: boolean;
+    useIndexedDBAdapter: boolean;
+    enableDebugTools: boolean;
+    writeLogToTheFile: boolean;
+    settingSyncFile: string;
+    writeCredentialsForSettingSync: boolean;
+    notifyAllSettingSyncFile: boolean;
+    suspendFileWatching: boolean;
+    suspendParseReplicationResult: boolean;
+    doNotSuspendOnFetching: boolean;
+    maxMTimeForReflectEvents: number;
+    versionUpFlash: string;
+    settingVersion: number;
+    isConfigured?: boolean;
+    lastReadUpdates: number;
+    doctorProcessedVersion: string;
+    remoteConfigurations: Record<string, import("../remoteConfigurations.js").RemoteConfiguration>;
+    activeConfigurationId: string;
+    P2P_ActiveRemoteConfigurationId: string;
+    couchDB_URI: string;
+    couchDB_USER: string;
+    couchDB_PASSWORD: string;
+    couchDB_DBNAME: string;
+    couchDB_CustomHeaders: string;
+    useJWT: boolean;
+    jwtAlgorithm: import("../common/models/auth.type.js").JWTAlgorithm;
+    jwtKey: string;
+    jwtKid: string;
+    jwtSub: string;
+    jwtExpDuration: number;
+    useRequestAPI: boolean;
+    accessKey: string;
+    secretKey: string;
+    bucket: string;
+    region: string;
+    endpoint: string;
+    useCustomRequestHandler: boolean;
+    bucketCustomHeaders: string;
+    bucketPrefix: string;
+    forcePathStyle: boolean;
+    remoteType: import("../common/types.js").RemoteType;
+    encrypt: boolean;
+    passphrase: string;
+    usePathObfuscation: boolean;
+    E2EEAlgorithm: import("../common/types.js").E2EEAlgorithm;
+    hashAlg: import("../common/types.js").HashAlgorithm;
+    minimumChunkSize: number;
+    customChunkSize: number;
+    longLineThreshold: number;
+    useSegmenter: boolean;
+    enableChunkSplitterV2: boolean;
+    doNotUseFixedRevisionForChunks: boolean;
+    chunkSplitterVersion: import("../common/types.js").ChunkSplitterVersion;
+    useEden: boolean;
+    maxChunksInEden: number;
+    maxTotalLengthInEden: number;
+    maxAgeInEden: number;
+    tweakModified: number | undefined;
+    checkIntegrityOnSave: boolean;
+    useHistory: boolean;
+    disableRequestURI: boolean;
+    sendChunksBulk: boolean;
+    sendChunksBulkMaxSize: number;
+    useDynamicIterationCount: boolean;
+    doNotPaceReplication: boolean;
+    readChunksOnline: boolean;
+    useOnlyLocalChunk: boolean;
+    concurrencyOfReadChunksOnline: number;
+    minimumIntervalOfReadChunksOnline: number;
+    enableCompression: boolean;
+    batch_size: number;
+    batches_limit: number;
+    ignoreVersionCheck: boolean;
+    disableCheckingConfigMismatch: boolean;
+    autoAcceptCompatibleTweak: boolean | undefined;
+    hashCacheMaxCount: number;
+    hashCacheMaxAmount: number;
+    permitEmptyPassphrase: boolean;
+    handleFilenameCaseSensitive: boolean;
+    checkConflictOnlyOnOpen: boolean;
+    showMergeDialogOnlyOnActive: boolean;
+    additionalSuffixOfDatabaseName: string | undefined;
+    useTimeouts: boolean;
+    deleteMetadataOfDeletedFiles: boolean;
+    automaticallyDeleteMetadataOfDeletedFiles: number;
+    P2P_AutoAccepting: import("../common/types.js").AutoAccepting;
+    P2P_AutoSyncPeers: string;
+    P2P_AutoWatchPeers: string;
+    P2P_SyncOnReplication: string;
+    P2P_RebuildFrom: string;
+    P2P_AutoAcceptingPeers: string;
+    P2P_AutoDenyingPeers: string;
+    P2P_IsHeadless?: boolean;
+    P2P_iceServers?: readonly RTCIceServer[];
+    P2P_iceServersExpiresAt?: number;
+    P2P_Enabled: boolean;
+    P2P_relays: string;
+    P2P_roomID: string;
+    P2P_passphrase: string;
+    P2P_AppID: string;
+    P2P_AutoStart: boolean;
+    P2P_AutoBroadcast: boolean;
+    P2P_DevicePeerName?: string;
+    P2P_turnServers: string;
+    P2P_turnUsername: string;
+    P2P_turnCredential: string;
+    P2P_managedType?: string;
+    P2P_managedId?: string;
+    P2P_managedToken?: string;
+    P2P_maxWirePayloadBytes?: number;
+    P2P_connectionPath?: import("../common/types.js").P2PConnectionPath;
+    P2P_useDiagRTC?: boolean;
+}, "P2P_iceServers" | "P2P_iceServersExpiresAt">>;
 export {};

package/dist/API/processSetting.js

@@ -128,7 +128,11 @@ async function decodeSettingsFromSetupURI(uri, passphrase) {
   const encryptedSetting = uri.substring(configURIBase.length);
   const decrypted = await decryptString(decodeURIComponent(encryptedSetting), passphrase);
   try {
-    return omitP2PRuntimeSettings(JSON.parse(decrypted));
+    const imported = JSON.parse(decrypted);
+    return omitP2PRuntimeSettings({
+      ...imported,
+      encryptInternalMetadata: typeof imported.encryptInternalMetadata === "boolean" ? imported.encryptInternalMetadata : false
+    });
   } catch {
     Logger(`Failed to parse settings from decrypted data`, LOG_LEVEL_NOTICE);
     return false;

package/dist/common/configForDoc.d.ts

@@ -52,6 +52,7 @@ export declare const DoctorRegulationV0_24_30: DoctorRegulation;
 export declare const DoctorRegulationV0_25_0: DoctorRegulation;
 export declare const DoctorRegulationV0_25_27: DoctorRegulation;
 export declare const DoctorRegulationV1_0_0: DoctorRegulation;
+export declare const DoctorRegulationV1_0_33: DoctorRegulation;
 export declare const DoctorRegulation: DoctorRegulation;
 export declare function checkUnsuitableValues(setting: Partial<ObsidianLiveSyncSettings>, regulation?: DoctorRegulation): DoctorRegulation;
 export declare const RebuildOptions: {

package/dist/common/configForDoc.js

@@ -127,7 +127,19 @@ const DoctorRegulationV1_0_0 = {
     enableCompression: void 0
   }
 };
-const DoctorRegulation = DoctorRegulationV1_0_0;
+const DoctorRegulationV1_0_33 = {
+  version: "1.0.33",
+  rules: {
+    ...DoctorRegulationV1_0_0.rules,
+    encryptInternalMetadata: {
+      value: true,
+      level: 2 /* Recommended */,
+      detectionFunc: (settings) => settings.remoteType === REMOTE_COUCHDB && settings.encrypt === true && settings.usePathObfuscation === true && settings.E2EEAlgorithm === E2EEAlgorithms.V2,
+      reason: "E2EE V2 and Property Encryption can also protect file properties used by Hidden File Sync and Customisation Sync. This affects future writes; manually rebuild the remote database to protect existing properties, and update every synchronising client before enabling it, including devices currently running LiveSync."
+    }
+  }
+};
+const DoctorRegulation = DoctorRegulationV1_0_33;
 function checkUnsuitableValues(setting, regulation = DoctorRegulation) {
   const result = {
     version: regulation.version,
@@ -234,7 +246,8 @@ async function performDoctorConsultation(env, settings, {
         [0 /* Must */]: translate("Doctor.Level.Must")
       };
       const level = value.level ? levelMap[value.level] : "Unknown";
-      const options = [OPT_FIX];
+      const fix = key === "encryptInternalMetadata" ? "Enable without rebuilding \u2014 update every other device first" : OPT_FIX;
+      const options = [fix];
       let askRebuild = false;
       let askRebuildLocal = false;
       if (value.requireRebuild) {
@@ -280,12 +293,12 @@ async function performDoctorConsultation(env, settings, {
             current: `${++idx}`,
             total: `${issueItems.length}`
           }),
-          defaultAction: OPT_FIX
+          defaultAction: fix
         }
       );
-      if (ret == OPT_FIX || ret == OPTION_FIX_WITHOUT_REBUILD) {
+      if (ret == fix || ret == OPTION_FIX_WITHOUT_REBUILD) {
         applySettings[key] = value.value;
-        if (ret == OPT_FIX) {
+        if (ret == fix) {
           shouldRebuild = shouldRebuild || askRebuild || false;
           shouldRebuildLocal = shouldRebuildLocal || askRebuildLocal || false;
         }
@@ -300,9 +313,12 @@ async function performDoctorConsultation(env, settings, {
         ...applySettings
       };
     }
+    const newlyApplicableMetadataRule = checkUnsuitableValues(settings).rules.encryptInternalMetadata !== void 0;
     if (skipped == 0) {
-      settings.doctorProcessedVersion = r.version;
-      isModified = true;
+      if (!newlyApplicableMetadataRule) {
+        settings.doctorProcessedVersion = r.version;
+        isModified = true;
+      }
     } else {
       if (await env.confirm.askYesNoDialog(translate("Doctor.Message.SomeSkipped"), {
         title: translate("Doctor.Dialogue.TitleAlmostDone"),
@@ -322,6 +338,7 @@ export {
   DoctorRegulationV0_25_0,
   DoctorRegulationV0_25_27,
   DoctorRegulationV1_0_0,
+  DoctorRegulationV1_0_33,
   RebuildOptions,
   RuleLevel,
   checkUnsuitableValues,

package/dist/common/models/db.type.d.ts

@@ -126,6 +126,7 @@ export type EntryChunkPack = DatabaseEntry & {
 export interface EntryVersionInfo extends DatabaseEntry {
     type: EntryTypes["VERSION_INFO"];
     version: number;
+    used_features?: string[];
 }
 export interface EntryHasPath {
     path: FilePathWithPrefix | FilePath;

package/dist/common/models/setting.const.defaults.js

@@ -57,6 +57,7 @@ const SETTINGS_SCHEMA_DEFAULTS = {
   encrypt: false,
   passphrase: "",
   usePathObfuscation: false,
+  encryptInternalMetadata: false,
   doNotDeleteFolder: false,
   resolveConflictsByNewerFile: false,
   batchSave: false,
@@ -195,6 +196,7 @@ const SETTINGS_SCHEMA_DEFAULTS = {
 const NEW_VAULT_SETTINGS = {
   ...SETTINGS_SCHEMA_DEFAULTS,
   ...PREFERRED_BASE,
+  encryptInternalMetadata: true,
   remoteConfigurations: {},
   pluginSyncExtendedSetting: {}
 };

package/dist/common/models/setting.const.qr.js

@@ -176,7 +176,8 @@ const KeyIndexOfSettings = {
   P2P_useDiagRTC: -1,
   // Do not encode into the QR Code.
   P2P_maxWirePayloadBytes: 163,
-  P2P_connectionPath: 164
+  P2P_connectionPath: 164,
+  encryptInternalMetadata: 165
 };
 export {
   KeyIndexOfSettings

package/dist/common/models/setting.lifecycle.js

@@ -106,13 +106,15 @@ function prepareSettingsForLoad(storedSettings) {
   }
   const normalisedFilenameCase = typeof migrated.handleFilenameCaseSensitive !== "boolean";
   if (normalisedFilenameCase) migrated = { ...migrated, handleFilenameCaseSensitive: false };
+  const normalisedInternalMetadata = typeof migrated.encryptInternalMetadata !== "boolean";
+  if (normalisedInternalMetadata) migrated = { ...migrated, encryptInternalMetadata: false };
   return {
     settings: cloneSettings(migrated, SETTINGS_SCHEMA_DEFAULTS),
     sourceVersion,
     targetVersion,
     isNewVault: false,
     isFromFutureSchema: false,
-    changed: sourceVersion !== targetVersion || normalisedConfiguredState || normalisedFilenameCase,
+    changed: sourceVersion !== targetVersion || normalisedConfiguredState || normalisedFilenameCase || normalisedInternalMetadata,
     requiresSyncReview: reviewReasons.length > 0,
     reviewReasons
   };

package/dist/common/models/setting.type.d.ts

@@ -590,6 +590,8 @@ export interface EncryptionSettings {
      * If not, the path will be stored as it is, as the document ID.
      */
     usePathObfuscation: boolean;
+    /** Encrypt the Metadata of obfuscated internal files and Customisation Sync entries. */
+    encryptInternalMetadata: boolean;
     /**
      * The algorithm used for hashing the passphrase.
      * This is used for E2EE.

package/dist/common/models/shared.definition.configNames.js

@@ -16,6 +16,10 @@ const configurationNames = {
     name: "Property Encryption",
     desc: "If enabled, the file properties will be encrypted in the remote database. This is useful for protecting sensitive information in file paths, sizes, and IDs of its chunks. If you are using V1 E2EE, this only obfuscates the file path."
   },
+  encryptInternalMetadata: {
+    name: "Encrypt internal file Properties",
+    desc: "Encrypt file properties (paths, times, sizes, and Chunk references) used by Hidden File Sync and Customisation Sync. This affects future writes; manually rebuild the remote database to protect existing properties. Requires E2EE V2, Property Encryption, and compatible clients on every device."
+  },
   enableCompression: {
     name: "Data Compression",
     level: LEVEL_ADVANCED

package/dist/common/models/tweak.definition.d.ts

@@ -20,6 +20,11 @@ export declare const TweakCompatibilityRules: readonly [{
     readonly key: "usePathObfuscation";
     readonly templateValue: false;
     readonly reconstruction: "required";
+}, {
+    readonly key: "encryptInternalMetadata";
+    readonly templateValue: false;
+    readonly reconstruction: "none";
+    readonly knownDefault: false;
 }, {
     readonly key: "enableCompression";
     readonly templateValue: false;
@@ -108,6 +113,7 @@ export declare const TweakValuesTemplate: {
     usePluginSyncV2: boolean;
     encrypt: boolean;
     usePathObfuscation: boolean;
+    encryptInternalMetadata: boolean;
     E2EEAlgorithm: import("./setting.type.js").E2EEAlgorithm;
     hashAlg: import("./setting.type.js").HashAlgorithm;
     minimumChunkSize: number;

package/dist/common/models/tweak.definition.js

@@ -5,6 +5,7 @@ const TweakCompatibilityRules = Object.freeze([
   { key: "longLineThreshold", templateValue: 250, reconstruction: "none" },
   { key: "encrypt", templateValue: false, reconstruction: "required" },
   { key: "usePathObfuscation", templateValue: false, reconstruction: "required" },
+  { key: "encryptInternalMetadata", templateValue: false, reconstruction: "none", knownDefault: false },
   { key: "enableCompression", templateValue: false, reconstruction: "none" },
   { key: "useEden", templateValue: false, reconstruction: "none" },
   { key: "customChunkSize", templateValue: 0, reconstruction: "recommended", compatibleLossyOrder: 1 },

package/dist/common/settingConstants.d.ts

@@ -136,6 +136,7 @@ export declare const AllSettingDefault: {
     encrypt: boolean;
     passphrase: string;
     usePathObfuscation: boolean;
+    encryptInternalMetadata: boolean;
     E2EEAlgorithm: import("./types.js").E2EEAlgorithm;
     hashAlg: import("./types.js").HashAlgorithm;
     minimumChunkSize: number;

package/dist/common/utils.js

@@ -448,7 +448,8 @@ function pickEncryptionSettings(setting) {
     E2EEAlgorithm: setting.E2EEAlgorithm,
     encrypt: setting.encrypt,
     passphrase: setting.passphrase,
-    usePathObfuscation: setting.usePathObfuscation
+    usePathObfuscation: setting.usePathObfuscation,
+    encryptInternalMetadata: setting.encryptInternalMetadata
   };
 }
 function pickP2PSyncSettings(setting) {

package/dist/pouchdb/LiveSyncDBFunctions.d.ts

@@ -1,4 +1,5 @@
 import { type EntryDoc, type EntryMilestoneInfo, type RemoteDBSettings, type ChunkVersionRange, type TweakValues, type DeviceInfo, type TweakAssessment } from "../common/types.js";
+export declare function getEffectiveTweakValues(setting: RemoteDBSettings): TweakValues;
 export type ENSURE_DB_RESULT = "OK" | "INCOMPATIBLE" | "LOCKED" | "NODE_LOCKED" | "NODE_CLEANED" | ["MISMATCHED", TweakValues];
 /**
  * Ensures that the remote database is compatible with the current device.

package/dist/pouchdb/LiveSyncDBFunctions.js

@@ -1,10 +1,18 @@
 import {
   MILESTONE_DOCID as MILESTONE_DOC_ID,
   TweakValuesTemplate,
-  DEVICE_ID_PREFERRED
+  DEVICE_ID_PREFERRED,
+  REMOTE_COUCHDB
 } from "../common/types.js";
 import { extractObject, isObjectDifferent, resolveWithIgnoreKnownError } from "../common/utils.js";
 import { assessTweakCompatibility } from "../common/models/tweak.compatibility.js";
+import { usesEncryptedInternalMetadata } from "./remoteFeatureCompatibility.js";
+function getEffectiveTweakValues(setting) {
+  return {
+    ...extractObject(TweakValuesTemplate, setting),
+    encryptInternalMetadata: setting.remoteType === REMOTE_COUCHDB && usesEncryptedInternalMetadata(setting)
+  };
+}
 async function ensureRemoteIsCompatible(infoSrc, setting, deviceNodeID, currentVersionRange, nodeDeviceInfo, updateCallback, recordTweakAssessment) {
   const now = Date.now();
   const baseMilestone = {
@@ -25,7 +33,7 @@ async function ensureRemoteIsCompatible(infoSrc, setting, deviceNodeID, currentV
   };
   let remoteMilestone = infoSrc;
   if (!remoteMilestone) remoteMilestone = baseMilestone;
-  const currentTweakValues = extractObject(TweakValuesTemplate, setting);
+  const currentTweakValues = getEffectiveTweakValues(setting);
   remoteMilestone.node_chunk_info = { ...baseMilestone.node_chunk_info, ...remoteMilestone.node_chunk_info };
   let writeMilestone = remoteMilestone.node_chunk_info[deviceNodeID].min != currentVersionRange.min || remoteMilestone.node_chunk_info[deviceNodeID].max != currentVersionRange.max || isObjectDifferent(remoteMilestone.tweak_values?.[deviceNodeID], currentTweakValues) || typeof remoteMilestone._rev == "undefined" || !(DEVICE_ID_PREFERRED in remoteMilestone.tweak_values);
   if (!remoteMilestone.node_info) {
@@ -119,5 +127,6 @@ async function ensureDatabaseIsCompatible(db, setting, deviceNodeID, currentVers
 }
 export {
   ensureDatabaseIsCompatible,
-  ensureRemoteIsCompatible
+  ensureRemoteIsCompatible,
+  getEffectiveTweakValues
 };

package/dist/pouchdb/StreamingFetch.d.ts

@@ -35,6 +35,8 @@ export declare class StreamingFetchFailure extends Error {
     readonly status?: number;
 }
 export declare function isRetryableStreamingFetchFailure(error: unknown): error is StreamingFetchFailure;
+/** Check remote feature requirements before Fast Fetch opens or resets the local database. */
+export declare function checkRemoteFeaturesForInitialSync(remoteDbUrl: string, authHeader: string, customHeaders?: Record<string, string>): Promise<void>;
 export type FetchChangesForInitialSyncProgress = {
     totalFetched: number;
     totalValidFetched: number;

package/dist/pouchdb/StreamingFetch.js

@@ -1,5 +1,7 @@
 import { _fetch } from "../common/coreEnvFunctions.js";
 import { LOG_LEVEL_VERBOSE, Logger } from "octagonal-wheels/common/logger";
+import { VERSIONING_DOCID } from "../common/types.js";
+import { assessRemoteFeatureDocument, describeRemoteFeatureRejection } from "./remoteFeatureCompatibility.js";
 const FAST_FETCH_CHANGES_PAGE_LIMIT = 1e4;
 const FAST_FETCH_CHANGES_PAGE_TIMEOUT_MS = 1e3;
 class StreamingFetchFailure extends Error {
@@ -73,6 +75,31 @@ async function readResponseText(response, operation) {
     throw transportFailure(operation, error);
   }
 }
+async function checkRemoteFeaturesForInitialSync(remoteDbUrl, authHeader, customHeaders) {
+  const headers = new Headers(customHeaders);
+  headers.set("Accept", "application/json");
+  headers.set("Authorization", authHeader);
+  const url = new URL(`${remoteDbUrl}/_all_docs`);
+  url.searchParams.set("keys", JSON.stringify([VERSIONING_DOCID]));
+  url.searchParams.set("include_docs", "true");
+  const operation = "check remote feature requirements";
+  const response = await fetchResponse(url.toString(), { headers }, operation);
+  const text = await readResponseText(response, operation);
+  let result;
+  try {
+    result = JSON.parse(text);
+  } catch (cause) {
+    throw new StreamingFetchFailure("protocol", "The remote feature response is invalid.", false, { cause });
+  }
+  if (!Array.isArray(result?.rows) || result.rows.length !== 1 || result.rows[0]?.key !== VERSIONING_DOCID) {
+    throw new StreamingFetchFailure("protocol", "The remote feature response is invalid.", false);
+  }
+  const row = result.rows[0];
+  if (result.total_rows === 0 && row.error === "not_found") return;
+  const assessment = assessRemoteFeatureDocument(row.doc);
+  if (assessment.status === "supported" || assessment.status === "older-generation") return;
+  throw new StreamingFetchFailure("protocol", describeRemoteFeatureRejection(assessment), false);
+}
 async function saveCheckpoint(onCheckpoint, sequence) {
   try {
     await onCheckpoint?.(sequence);
@@ -478,6 +505,7 @@ async function fetchChangesForInitialSync(downloadToDB, remoteDbUrl, authHeader,
 }
 export {
   StreamingFetchFailure,
+  checkRemoteFeaturesForInitialSync,
   fetchChangesForInitialSync,
   isRetryableStreamingFetchFailure
 };

package/dist/pouchdb/encryption.d.ts

@@ -6,11 +6,11 @@ export declare const encryptHKDF: typeof encryptHKDFWorker;
 export declare const decryptHKDF: typeof decryptHKDFWorker;
 export declare let preprocessOutgoing: (doc: AnyEntry | EntryLeaf) => Promise<AnyEntry | EntryLeaf>;
 export declare let preprocessIncoming: (doc: EntryDoc) => Promise<EntryDoc>;
-export declare function getConfiguredFunctionsForEncryption(passphrase: string, useDynamicIterationCount: boolean, migrationDecrypt: boolean, getPBKDF2Salt: () => Promise<Uint8Array<ArrayBuffer>>, algorithm: E2EEAlgorithm): {
+export declare function getConfiguredFunctionsForEncryption(passphrase: string, useDynamicIterationCount: boolean, migrationDecrypt: boolean, getPBKDF2Salt: () => Promise<Uint8Array<ArrayBuffer>>, algorithm: E2EEAlgorithm, encryptInternalMetadata?: boolean): {
     incoming: (doc: AnyEntry | EntryLeaf) => Promise<AnyEntry | EntryLeaf>;
     outgoing: (doc: EntryDoc) => Promise<AnyEntry | EntryLeaf>;
 };
-export declare const enableEncryption: (db: PouchDB.Database<EntryDoc>, passphrase: string, useDynamicIterationCount: boolean, migrationDecrypt: boolean, getPBKDF2Salt: () => Promise<Uint8Array<ArrayBuffer>>, algorithm: E2EEAlgorithm) => void;
+export declare const enableEncryption: (db: PouchDB.Database<EntryDoc>, passphrase: string, useDynamicIterationCount: boolean, migrationDecrypt: boolean, getPBKDF2Salt: () => Promise<Uint8Array<ArrayBuffer>>, algorithm: E2EEAlgorithm, encryptInternalMetadata?: boolean) => void;
 export declare function disableEncryption(): void;
 export declare const EDEN_ENCRYPTED_KEY: DocumentID;
 export declare const EDEN_ENCRYPTED_KEY_HKDF: DocumentID;