@vrtmrz/livesync-commonlib 0.1.29 → 0.1.31

package/dist/pouchdb/encryption.js

@@ -6,6 +6,8 @@ import {
 import { isEncryptedChunkEntry, isSyncInfoEntry, isObfuscatedEntry } from "../common/utils.js";
 import { isPathProbablyObfuscated, obfuscatePath } from "octagonal-wheels/encryption/encryption";
 import { getPath } from "../string_and_binary/path.js";
+import { ICHeader, ICXHeader, PSCHeader } from "../common/models/fileaccess.const.js";
+import { PREFIX_OBFUSCATED } from "../common/types.js";
 import { encryptWorker, decryptWorker, encryptHKDFWorker, decryptHKDFWorker } from "#worker";
 const encrypt = encryptWorker;
 const decrypt = decryptWorker;
@@ -52,6 +54,11 @@ const ENCRYPTED_META_PREFIX = "/\\:";
 function isEncryptedMeta(doc) {
   return "path" in doc && doc.path.startsWith(ENCRYPTED_META_PREFIX);
 }
+function isInternalObfuscatedEntry(doc) {
+  return [ICHeader, ICXHeader, PSCHeader].some(
+    (prefix) => doc._id.startsWith(`${prefix}${PREFIX_OBFUSCATED}`)
+  );
+}
 async function encryptMetaWithHKDF(doc, passphrase, pbkdf2Salt) {
   if (isEncryptedMeta(doc)) {
     return doc.path;
@@ -80,7 +87,7 @@ const MESSAGE_FALLBACK_DECRYPT_FAILED = "Failed to decrypt the data with V1 meth
 const ENCRYPTION_HKDF_FAILED = "Encryption with HKDF failed.";
 const DECRYPTION_HKDF_FAILED = "Decryption with HKDF failed.";
 const DECRYPTION_FALLBACK_FAILED = "Decryption with fallback failed.";
-async function incomingEncryptHKDF(doc, passphrase, useDynamicIterationCount, getPBKDF2Salt) {
+async function incomingEncryptHKDF(doc, passphrase, useDynamicIterationCount, getPBKDF2Salt, encryptInternalMetadata) {
   const saveDoc = {
     ...doc
   };
@@ -124,7 +131,7 @@ async function incomingEncryptHKDF(doc, passphrase, useDynamicIterationCount, ge
       throw ex;
     }
   }
-  if (isObfuscatedEntry(saveDoc)) {
+  if (isObfuscatedEntry(saveDoc) || encryptInternalMetadata && isInternalObfuscatedEntry(saveDoc)) {
     const pbkdf2salt = await getPBKDF2Salt();
     if (!isEncryptedMeta(saveDoc)) {
       try {
@@ -176,7 +183,7 @@ async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase,
       throw ex;
     }
   }
-  if (isObfuscatedEntry(loadDoc)) {
+  if (isObfuscatedEntry(loadDoc) || isInternalObfuscatedEntry(loadDoc) && isEncryptedMeta(loadDoc)) {
     if (isEncryptedMeta(loadDoc)) {
       const pbkdf2salt = await getPBKDF2Salt();
       try {
@@ -375,9 +382,9 @@ let preprocessOutgoing = async (doc) => {
 let preprocessIncoming = async (doc) => {
   return await Promise.resolve(doc);
 };
-function getConfiguredFunctionsForEncryption(passphrase, useDynamicIterationCount, migrationDecrypt, getPBKDF2Salt, algorithm) {
+function getConfiguredFunctionsForEncryption(passphrase, useDynamicIterationCount, migrationDecrypt, getPBKDF2Salt, algorithm, encryptInternalMetadata = false) {
   const decryptedCache = /* @__PURE__ */ new Map();
-  const incoming = (doc) => algorithm === E2EEAlgorithms.V2 ? incomingEncryptHKDF(doc, passphrase, useDynamicIterationCount, getPBKDF2Salt) : incomingEncryptV1(doc, passphrase, useDynamicIterationCount);
+  const incoming = (doc) => algorithm === E2EEAlgorithms.V2 ? incomingEncryptHKDF(doc, passphrase, useDynamicIterationCount, getPBKDF2Salt, encryptInternalMetadata) : incomingEncryptV1(doc, passphrase, useDynamicIterationCount);
   const outgoing = (doc) => algorithm !== E2EEAlgorithms.ForceV1 ? outgoingDecryptHKDF(
     doc,
     migrationDecrypt,
@@ -391,13 +398,14 @@ function getConfiguredFunctionsForEncryption(passphrase, useDynamicIterationCoun
     outgoing
   };
 }
-const enableEncryption = (db, passphrase, useDynamicIterationCount, migrationDecrypt, getPBKDF2Salt, algorithm) => {
+const enableEncryption = (db, passphrase, useDynamicIterationCount, migrationDecrypt, getPBKDF2Salt, algorithm, encryptInternalMetadata = false) => {
   const { incoming, outgoing } = getConfiguredFunctionsForEncryption(
     passphrase,
     useDynamicIterationCount,
     migrationDecrypt,
     getPBKDF2Salt,
-    algorithm
+    algorithm,
+    encryptInternalMetadata
   );
   db.transform({
     incoming,

package/dist/pouchdb/negotiation.d.ts

@@ -1,5 +1,6 @@
-export declare const checkRemoteVersion: (db: PouchDB.Database, migrate: (from: number, to: number) => Promise<boolean>, barrier?: number) => Promise<boolean>;
-export declare const bumpRemoteVersion: (db: PouchDB.Database, barrier?: number) => Promise<boolean>;
+export declare const checkRemoteVersion: (db: PouchDB.Database, migrate: (from: number, to: number) => Promise<boolean>, barrier?: number, requiredFeatures?: readonly string[]) => Promise<boolean>;
+export declare const bumpRemoteVersion: (db: PouchDB.Database, barrier?: number, usedFeatures?: readonly string[]) => Promise<boolean>;
+export declare function declareRemoteFeatures(db: PouchDB.Database, requiredFeatures: readonly string[]): Promise<boolean>;
 export declare const checkSyncInfo: (db: PouchDB.Database) => Promise<boolean>;
 /**
  * Counts the number of remote (potentially) compromised chunks in the database.

package/dist/pouchdb/negotiation.js

@@ -1,53 +1,104 @@
-import { LOG_LEVEL_INFO, Logger } from "../common/logger.js";
+import { LOG_LEVEL_INFO, LOG_LEVEL_NOTICE, Logger } from "../common/logger.js";
 import {
   LOG_LEVEL_VERBOSE,
   SYNCINFO_ID,
   VER,
   VERSIONING_DOCID
 } from "../common/types.js";
-import { resolveWithIgnoreKnownError } from "../common/utils.js";
 import { isErrorOfMissingDoc } from "./utils_couchdb.js";
-const checkRemoteVersion = async (db, migrate, barrier = VER) => {
+import {
+  assessRemoteFeatureDocument,
+  describeRemoteFeatureRejection,
+  ENCRYPTED_INTERNAL_METADATA_FEATURE,
+  REMOTE_FEATURE_GENERATION
+} from "./remoteFeatureCompatibility.js";
+const checkRemoteVersion = async (db, migrate, barrier = VER, requiredFeatures = []) => {
   try {
     const versionInfo = await db.get(VERSIONING_DOCID);
-    if (versionInfo.type != "versioninfo") {
-      return false;
+    const assessment = assessRemoteFeatureDocument(versionInfo);
+    if (assessment.status === "older-generation") {
+      if (assessment.version >= barrier) return true;
+      if (!await migrate(assessment.version, barrier)) return false;
+      if (!await bumpRemoteVersion(db, barrier)) return false;
+      return requiredFeatures.length === 0 || await declareRemoteFeatures(db, requiredFeatures);
     }
-    const version = versionInfo.version;
-    if (version < barrier) {
-      const versionUpResult = await migrate(version, barrier);
-      if (versionUpResult) {
-        await bumpRemoteVersion(db);
-        return true;
-      }
+    if (assessment.status !== "supported") {
+      Logger(describeRemoteFeatureRejection(assessment), LOG_LEVEL_NOTICE);
+      return false;
     }
-    if (version == barrier) return true;
-    return false;
+    if (versionInfo.version < barrier) return false;
+    return requiredFeatures.length === 0 || await declareRemoteFeatures(db, requiredFeatures);
   } catch (ex) {
     if (isErrorOfMissingDoc(ex)) {
-      if (await bumpRemoteVersion(db)) {
-        return true;
-      }
-      return false;
+      const info = await db.info();
+      if (info.doc_count > 0) return false;
+      return await bumpRemoteVersion(db, requiredFeatures.length ? REMOTE_FEATURE_GENERATION : VER, requiredFeatures);
     }
     throw ex;
   }
 };
-const bumpRemoteVersion = async (db, barrier = VER) => {
-  const vi = {
-    _id: VERSIONING_DOCID,
-    version: barrier,
-    type: "versioninfo"
-    // pbkdf2salt: "", // this will be set later.
-  };
-  const versionInfo = await resolveWithIgnoreKnownError(db.get(VERSIONING_DOCID), vi);
-  if (versionInfo.type != "versioninfo") {
-    return false;
+const bumpRemoteVersion = async (db, barrier = VER, usedFeatures = []) => {
+  for (let attempt = 0; attempt < 4; attempt++) {
+    let current;
+    try {
+      current = await db.get(VERSIONING_DOCID);
+    } catch (error) {
+      if (!isErrorOfMissingDoc(error)) throw error;
+    }
+    if (current) {
+      const assessment = assessRemoteFeatureDocument(current);
+      if (assessment.status !== "supported" && assessment.status !== "older-generation") {
+        Logger(describeRemoteFeatureRejection(assessment), LOG_LEVEL_NOTICE);
+        return false;
+      }
+      if (current.version >= barrier) {
+        return usedFeatures.length === 0 || await declareRemoteFeatures(db, usedFeatures);
+      }
+    }
+    const next = {
+      ...current,
+      _id: VERSIONING_DOCID,
+      version: barrier,
+      type: "versioninfo",
+      ...barrier >= REMOTE_FEATURE_GENERATION ? { used_features: [...new Set(usedFeatures)] } : {}
+    };
+    try {
+      await db.put(next);
+      return true;
+    } catch (error) {
+      if (typeof error !== "object" || error === null || !("status" in error) || error.status !== 409) {
+        throw error;
+      }
+    }
   }
-  vi._rev = versionInfo._rev;
-  await db.put(vi);
-  return true;
+  return false;
 };
+async function declareRemoteFeatures(db, requiredFeatures) {
+  const requested = [...new Set(requiredFeatures)];
+  if (requested.some((name) => name !== ENCRYPTED_INTERNAL_METADATA_FEATURE)) {
+    throw new Error("A writer requested an unsupported remote feature.");
+  }
+  if (requested.length === 0) return true;
+  for (let attempt = 0; attempt < 4; attempt++) {
+    const current = await db.get(VERSIONING_DOCID);
+    const assessment = assessRemoteFeatureDocument(current);
+    if (assessment.status !== "supported") {
+      Logger(describeRemoteFeatureRejection(assessment), LOG_LEVEL_NOTICE);
+      return false;
+    }
+    const usedFeatures = [.../* @__PURE__ */ new Set([...assessment.usedFeatures, ...requested])];
+    if (current.version === REMOTE_FEATURE_GENERATION && usedFeatures.length === assessment.usedFeatures.length) {
+      return true;
+    }
+    try {
+      await db.put({ ...current, version: REMOTE_FEATURE_GENERATION, used_features: usedFeatures });
+      return true;
+    } catch (ex) {
+      if (typeof ex !== "object" || ex === null || !("status" in ex) || ex.status !== 409) throw ex;
+    }
+  }
+  return false;
+}
 const checkSyncInfo = async (db) => {
   try {
     const syncinfo = await db.get(SYNCINFO_ID);
@@ -105,5 +156,6 @@ export {
   bumpRemoteVersion,
   checkRemoteVersion,
   checkSyncInfo,
-  countCompromisedChunks
+  countCompromisedChunks,
+  declareRemoteFeatures
 };

package/dist/pouchdb/remoteFeatureCompatibility.d.ts

@@ -0,0 +1,25 @@
+export declare const REMOTE_FEATURE_GENERATION = 13;
+export declare const ENCRYPTED_INTERNAL_METADATA_FEATURE = "encrypted-internal-metadata-v1";
+export declare function usesEncryptedInternalMetadata(setting: {
+    encrypt?: boolean;
+    usePathObfuscation?: boolean;
+    E2EEAlgorithm?: string;
+    encryptInternalMetadata?: boolean;
+}): boolean;
+export type RemoteFeatureAssessment = {
+    status: "supported";
+    usedFeatures: readonly string[];
+} | {
+    status: "older-generation";
+    version: number;
+} | {
+    status: "unsupported-generation";
+    version: number;
+} | {
+    status: "unknown-features";
+    identifiers: readonly string[];
+} | {
+    status: "invalid-control";
+};
+export declare function assessRemoteFeatureDocument(document: unknown): RemoteFeatureAssessment;
+export declare function describeRemoteFeatureRejection(assessment: RemoteFeatureAssessment): string;

package/dist/pouchdb/remoteFeatureCompatibility.js

@@ -0,0 +1,52 @@
+import { E2EEAlgorithms, VERSIONING_DOCID } from "../common/types.js";
+const REMOTE_FEATURE_GENERATION = 13;
+const ENCRYPTED_INTERNAL_METADATA_FEATURE = "encrypted-internal-metadata-v1";
+const supportedFeatures = /* @__PURE__ */ new Set([ENCRYPTED_INTERNAL_METADATA_FEATURE]);
+function usesEncryptedInternalMetadata(setting) {
+  return setting.encryptInternalMetadata === true && setting.encrypt === true && setting.usePathObfuscation === true && setting.E2EEAlgorithm === E2EEAlgorithms.V2;
+}
+function assessRemoteFeatureDocument(document) {
+  if (typeof document !== "object" || document === null) return { status: "invalid-control" };
+  const value = document;
+  if (value._id !== VERSIONING_DOCID || value.type !== "versioninfo" || value._deleted === true) {
+    return { status: "invalid-control" };
+  }
+  if (typeof value.version !== "number" || !Number.isSafeInteger(value.version) || value.version < 0) {
+    return { status: "invalid-control" };
+  }
+  const version = value.version;
+  if (version < 12) {
+    return "used_features" in value ? { status: "invalid-control" } : { status: "older-generation", version };
+  }
+  if (version > REMOTE_FEATURE_GENERATION) return { status: "unsupported-generation", version };
+  if (version === 12) {
+    return "used_features" in value ? { status: "invalid-control" } : { status: "supported", usedFeatures: [] };
+  }
+  if (!Array.isArray(value.used_features) || !value.used_features.every((name) => typeof name === "string" && name.length > 0)) {
+    return { status: "invalid-control" };
+  }
+  const usedFeatures = [...new Set(value.used_features)];
+  const identifiers = usedFeatures.filter((name) => !supportedFeatures.has(name));
+  return identifiers.length > 0 ? { status: "unknown-features", identifiers } : { status: "supported", usedFeatures };
+}
+function describeRemoteFeatureRejection(assessment) {
+  switch (assessment.status) {
+    case "unknown-features":
+      return `Unknown features are in use: ${assessment.identifiers.join(", ")}`;
+    case "unsupported-generation":
+      return `Unsupported remote database generation: ${assessment.version}`;
+    case "invalid-control":
+      return "The remote database version document is invalid.";
+    case "older-generation":
+      return `The remote database requires migration from generation ${assessment.version}.`;
+    case "supported":
+      return "";
+  }
+}
+export {
+  ENCRYPTED_INTERNAL_METADATA_FEATURE,
+  REMOTE_FEATURE_GENERATION,
+  assessRemoteFeatureDocument,
+  describeRemoteFeatureRejection,
+  usesEncryptedInternalMetadata
+};

package/dist/replication/couchdb/LiveSyncReplicator.js

@@ -6,7 +6,6 @@ import {
   LOG_LEVEL_NOTICE,
   LOG_LEVEL_VERBOSE,
   DEVICE_ID_PREFERRED,
-  TweakValuesTemplate,
   DOCID_SYNC_PARAMETERS,
   DEFAULT_SYNC_PARAMETERS,
   ProtocolVersions,
@@ -16,17 +15,20 @@ import {
 import {
   resolveWithIgnoreKnownError,
   globalConcurrencyController,
-  extractObject,
   wrapException,
   sizeToHumanReadable,
   arrayToChunkedArray,
   parseHeaderValues
 } from "../../common/utils.js";
 import { Logger } from "../../common/logger.js";
-import { checkRemoteVersion, countCompromisedChunks } from "../../pouchdb/negotiation.js";
+import { checkRemoteVersion, countCompromisedChunks, declareRemoteFeatures } from "../../pouchdb/negotiation.js";
+import {
+  ENCRYPTED_INTERNAL_METADATA_FEATURE,
+  usesEncryptedInternalMetadata
+} from "../../pouchdb/remoteFeatureCompatibility.js";
 import { isErrorOfMissingDoc } from "../../pouchdb/utils_couchdb.js";
 import { preprocessOutgoing } from "../../pouchdb/encryption.js";
-import { ensureDatabaseIsCompatible } from "../../pouchdb/LiveSyncDBFunctions.js";
+import { ensureDatabaseIsCompatible, getEffectiveTweakValues } from "../../pouchdb/LiveSyncDBFunctions.js";
 import {
   LiveSyncAbstractReplicator
 } from "../LiveSyncAbstractReplicator.js";
@@ -456,9 +458,8 @@ class LiveSyncCouchDBReplicator extends LiveSyncAbstractReplicator {
       return await this.withRemoteConnection(d, async (db) => this.sendChunks(setting, db, showResult, fromSeq));
     }
     const connectivity = await this.checkReplicationConnectivity(setting, false, false, false, false);
-    if (connectivity !== false) {
-      await this.closeRemoteConnection(connectivity);
-    }
+    if (connectivity === false) return false;
+    await this.closeRemoteConnection(connectivity);
     Logger(`Bulk sending chunks to remote database...`, showResult ? LOG_LEVEL_NOTICE : LOG_LEVEL_INFO, "fetch");
     const remoteMilestone = await remoteDB.get(MILESTONE_DOCID);
     const remoteID = remoteMilestone?.created ?? 0;
@@ -966,6 +967,12 @@ ${sendingDocs}/(${sentDocsCount} done)`,
           this.preferredTweakValue = ensure[1];
           return false;
         }
+        if (usesEncryptedInternalMetadata(setting) && !await declareRemoteFeatures(dbRet.db, [ENCRYPTED_INTERNAL_METADATA_FEATURE])) {
+          recordCompatibilityDecision?.(
+            centralCompatibilityRejected(CENTRAL_COMPATIBILITY_REJECTION_REASONS.INCOMPATIBLE_VERSION)
+          );
+          return false;
+        }
         recordCompatibilityDecision?.(CENTRAL_COMPATIBILITY_ACCEPTED);
       }
       const syncOptionBase = {
@@ -1306,7 +1313,11 @@ ${sendingDocs}/(${sentDocsCount} done)`,
       customHeaders,
       settings.useRequestAPI,
       async () => await this.getReplicationPBKDF2Salt(settings),
-      { ...connectionOptions, encryptionAlgorithm: settings.E2EEAlgorithm }
+      {
+        ...connectionOptions,
+        encryptionAlgorithm: settings.E2EEAlgorithm,
+        encryptInternalMetadata: usesEncryptedInternalMetadata(settings)
+      }
     );
   }
   async openOwnedConnection(settings, performSetup = false) {
@@ -1380,6 +1391,7 @@ ${sendingDocs}/(${sentDocsCount} done)`,
       return false;
     }
     return await this.withRemoteConnection(ret, async (db) => {
+      if (!await checkRemoteVersion(db, this.migrate.bind(this), VER)) return false;
       const remoteChunks = await db.allDocs({ keys: missingChunks, include_docs: true });
       const errorRows = remoteChunks.rows.filter((e) => "error" in e);
       if (errorRows.length > 0) {
@@ -1452,7 +1464,7 @@ ${sendingDocs}/(${sentDocsCount} done)`,
       }
       try {
         const remoteMilestone = await db.get(MILESTONE_DOCID);
-        remoteMilestone.tweak_values[DEVICE_ID_PREFERRED] = extractObject(TweakValuesTemplate, { ...setting });
+        remoteMilestone.tweak_values[DEVICE_ID_PREFERRED] = getEffectiveTweakValues(setting);
         await db.put(remoteMilestone);
         Logger(`Preferred tweak values has been registered`, LOG_LEVEL_VERBOSE);
       } catch (ex) {

package/dist/replication/index.d.ts

@@ -8,3 +8,5 @@ export { CENTRAL_REMOTE_ADMINISTRATION_ACTIONS, CENTRAL_REMOTE_ADMINISTRATION_FA
 export type { MilestoneCentralRemoteAdministrationObservation, CentralRemoteAdministrationAction, CentralRemoteAdministrationFailureReason, CentralRemoteAdministrationObservation, CentralRemoteAdministrationRequest, CentralRemoteAdministrationReplicator, CentralRemoteAdministrationResult, CentralRemoteAdministrationRunner, CentralRemoteAdministrationVerificationFailed, CentralRemoteAdministrationVerified, } from "./CentralRemoteAdministration.js";
 export { CENTRAL_COMPATIBILITY_REJECTION_REASONS } from "./CentralCompatibility.js";
 export type { CentralCompatibilityRecoveryHint, CentralCompatibilityRejectionReason } from "./CentralCompatibility.js";
+export { assessRemoteFeatureDocument, describeRemoteFeatureRejection, ENCRYPTED_INTERNAL_METADATA_FEATURE, REMOTE_FEATURE_GENERATION, usesEncryptedInternalMetadata, } from "../pouchdb/remoteFeatureCompatibility.js";
+export type { RemoteFeatureAssessment } from "../pouchdb/remoteFeatureCompatibility.js";

package/dist/replication/index.js

@@ -35,6 +35,13 @@ import {
   centralRemoteAdministrationVerified
 } from "./CentralRemoteAdministration.js";
 import { CENTRAL_COMPATIBILITY_REJECTION_REASONS } from "./CentralCompatibility.js";
+import {
+  assessRemoteFeatureDocument,
+  describeRemoteFeatureRejection,
+  ENCRYPTED_INTERNAL_METADATA_FEATURE,
+  REMOTE_FEATURE_GENERATION,
+  usesEncryptedInternalMetadata
+} from "../pouchdb/remoteFeatureCompatibility.js";
 export {
   CAPABILITY_NOT_APPLICABLE,
   CAPABILITY_NOT_IMPLEMENTED,
@@ -46,19 +53,23 @@ export {
   CENTRAL_REMOTE_ADMINISTRATION_OBSERVATION_KINDS,
   CENTRAL_REMOTE_ADMINISTRATION_RESULT_STATUSES,
   CENTRAL_REMOTE_REPLICATION_READINESS,
+  ENCRYPTED_INTERNAL_METADATA_FEATURE,
   NO_INTERACTION,
   NO_REMOTE_RESOURCE_CAPABILITIES,
   PEER_REPLICATION_READINESS,
   PROVIDER_OWNED_CENTRAL_REMOTE_REPLICATION_READINESS,
+  REMOTE_FEATURE_GENERATION,
   REMOTE_RESOURCE_KINDS,
   REPLICATION_CANCELLED,
   REPLICATION_COMPLETED,
   REPLICATION_PROGRESS_PRESENTATIONS,
   USER_INITIATED_REPLICATION_AUTHORITY,
   applyCentralRemoteAdministrationMutation,
+  assessRemoteFeatureDocument,
   centralRemoteAdministrationVerificationFailed,
   centralRemoteAdministrationVerified,
   defineReplicatorProviderDefinitions,
+  describeRemoteFeatureRejection,
   isCentralRemoteAdministrationVerified,
   isReplicationCompleted,
   milestoneSatisfiesCentralRemoteAdministration,
@@ -70,5 +81,6 @@ export {
   supportedOpenReplicationContinuous,
   supportedOpenReplicationOneShot,
   supportedOpenReplicationUnattended,
-  supportedStopActiveTransfer
+  supportedStopActiveTransfer,
+  usesEncryptedInternalMetadata
 };

package/dist/replication/journal/LiveSyncJournalReplicator.js

@@ -2,7 +2,6 @@ import {
   LOG_LEVEL_NOTICE,
   LOG_LEVEL_VERBOSE,
   DEVICE_ID_PREFERRED,
-  TweakValuesTemplate,
   RemotePreferredTweakNotConfiguredReasons,
   RemotePreferredTweakStatuses
 } from "../../common/types.js";
@@ -11,7 +10,7 @@ import { JournalSyncCore } from "./JournalSyncCore.js";
 import { MinioStorageAdapter } from "./objectstore/MinioStorageAdapter.js";
 import { LiveSyncAbstractReplicator } from "../LiveSyncAbstractReplicator.js";
 import { ensureRemoteIsCompatible } from "../../pouchdb/LiveSyncDBFunctions.js";
-import { extractObject } from "../../common/utils.js";
+import { getEffectiveTweakValues } from "../../pouchdb/LiveSyncDBFunctions.js";
 import { JournalStorageReadStatuses } from "./objectstore/JournalStorageAdapter.js";
 import {
   CENTRAL_COMPATIBILITY_ACCEPTED,
@@ -462,9 +461,7 @@ ${ex.message}`, LOG_LEVEL_NOTICE);
       if (!remoteMilestone) {
         throw new Error("Missing remote milestone");
       }
-      remoteMilestone.tweak_values[DEVICE_ID_PREFERRED] = extractObject(TweakValuesTemplate, {
-        ...setting
-      });
+      remoteMilestone.tweak_values[DEVICE_ID_PREFERRED] = getEffectiveTweakValues(setting);
       Logger(`Preferred tweak values have been registered`, LOG_LEVEL_VERBOSE);
       if (!await trialClient.uploadJson(MILSTONE_DOCID, remoteMilestone)) {
         throw new Error("Could not upload remote milestone");

package/dist/serviceModules/Rebuilder.js

@@ -5,7 +5,11 @@ import { LOG_LEVEL_NOTICE, LOG_LEVEL_VERBOSE } from "octagonal-wheels/common/log
 import { delay } from "octagonal-wheels/promises";
 import { EVENT_DATABASE_REBUILT } from "../events/coreEvents.js";
 import { ServiceModuleBase } from "./ServiceModuleBase.js";
-import { fetchChangesForInitialSync, isRetryableStreamingFetchFailure } from "../pouchdb/StreamingFetch.js";
+import {
+  checkRemoteFeaturesForInitialSync,
+  fetchChangesForInitialSync,
+  isRetryableStreamingFetchFailure
+} from "../pouchdb/StreamingFetch.js";
 import { getConfiguredFunctionsForEncryption } from "../pouchdb/encryption.js";
 import { AuthorizationHeaderGenerator, generateCredentialObject } from "../replication/httplib.js";
 import { isRemediationModeActive, parseHeaderValues } from "../common/utils.js";
@@ -384,8 +388,13 @@ Are you sure you wish to proceed?`;
     });
   }
   async performFetchLocalDBFast(settings, autoResume) {
-    this.appLifecycle.resetIsReady();
     const remote = settings.couchDB_URI.replace(/\/+$/, "") + (settings.couchDB_DBNAME == "" ? "" : "/" + settings.couchDB_DBNAME);
+    const authHeader = await new AuthorizationHeaderGenerator().getAuthorizationHeader(
+      generateCredentialObject(settings)
+    );
+    const customHeaders = parseHeaderValues(settings.couchDB_CustomHeaders);
+    await checkRemoteFeaturesForInitialSync(remote, authHeader, customHeaders);
+    this.appLifecycle.resetIsReady();
     let checkpoint = this.getFastFetchCheckpoint(remote);
     await this.suspendReflectingDatabase();
     await this.control.applySettings();
@@ -431,10 +440,6 @@ Are you sure you wish to proceed?`;
         () => securitySeed.read(),
         settings.E2EEAlgorithm
       );
-      const authHeader = await new AuthorizationHeaderGenerator().getAuthorizationHeader(
-        generateCredentialObject(settings)
-      );
-      const customHeaders = parseHeaderValues(settings.couchDB_CustomHeaders);
       for (let attempt = 0; ; attempt++) {
         try {
           await fetchChangesForInitialSync(

package/dist/services/base/CommonlibMessages.d.ts

@@ -83,6 +83,8 @@ export declare const commonlibEnglishMessages: {
     readonly "Enable this if your Object Storage doesn't support CORS": "Enable this if your Object Storage doesn't support CORS";
     readonly "Enable this option to automatically apply the most recent change to documents even when it conflicts": "Enable this option to automatically apply the most recent change to documents even when it conflicts";
     readonly "Encrypt contents on the remote database. If you use the plugin's synchronization feature, enabling this is recommended.": "Encrypt contents on the remote database. If you use the plugin's synchronization feature, enabling this is recommended.";
+    readonly "Encrypt internal file Properties": "Encrypt internal file Properties";
+    readonly "Encrypt file properties (paths, times, sizes, and Chunk references) used by Hidden File Sync and Customisation Sync. This affects future writes; manually rebuild the remote database to protect existing properties. Requires E2EE V2, Property Encryption, and compatible clients on every device.": "Encrypt file properties (paths, times, sizes, and Chunk references) used by Hidden File Sync and Customisation Sync. This affects future writes; manually rebuild the remote database to protect existing properties. Requires E2EE V2, Property Encryption, and compatible clients on every device.";
     readonly "Encrypting sensitive configuration items": "Encrypting sensitive configuration items";
     readonly "Encryption passphrase. If changed, you should overwrite the server's database with the new (encrypted) files.": "Encryption passphrase. If changed, you should overwrite the server's database with the new (encrypted) files.";
     readonly "End-to-End Encryption": "End-to-End Encryption";

package/dist/services/base/CommonlibMessages.js

@@ -77,6 +77,8 @@ const commonlibEnglishMessages = {
   "Enable this if your Object Storage doesn't support CORS": "Enable this if your Object Storage doesn't support CORS",
   "Enable this option to automatically apply the most recent change to documents even when it conflicts": "Enable this option to automatically apply the most recent change to documents even when it conflicts",
   "Encrypt contents on the remote database. If you use the plugin's synchronization feature, enabling this is recommended.": "Encrypt contents on the remote database. If you use the plugin's synchronization feature, enabling this is recommended.",
+  "Encrypt internal file Properties": "Encrypt internal file Properties",
+  "Encrypt file properties (paths, times, sizes, and Chunk references) used by Hidden File Sync and Customisation Sync. This affects future writes; manually rebuild the remote database to protect existing properties. Requires E2EE V2, Property Encryption, and compatible clients on every device.": "Encrypt file properties (paths, times, sizes, and Chunk references) used by Hidden File Sync and Customisation Sync. This affects future writes; manually rebuild the remote database to protect existing properties. Requires E2EE V2, Property Encryption, and compatible clients on every device.",
   "Encrypting sensitive configuration items": "Encrypting sensitive configuration items",
   "Encryption passphrase. If changed, you should overwrite the server's database with the new (encrypted) files.": "Encryption passphrase. If changed, you should overwrite the server's database with the new (encrypted) files.",
   "End-to-End Encryption": "End-to-End Encryption",

package/dist/services/base/RemoteConnection.d.ts

@@ -6,6 +6,8 @@ import type { E2EEAlgorithm } from "../../common/types.js";
 export interface RemoteConnectionOpenOptions {
     /** Encryption algorithm captured with the settings which own this connection. */
     readonly encryptionAlgorithm?: E2EEAlgorithm;
+    /** Apply HKDF Metadata encryption to obfuscated internal entries on writes. */
+    readonly encryptInternalMetadata?: boolean;
     /**
      * Cancels abort-capable requests made through the connection when the
      * owning operation is cancelled.

package/dist/services/base/RemoteService.js

@@ -297,7 +297,15 @@ class RemoteService extends ServiceBase {
       replicationFilter(db, compression);
       disableEncryption();
       if (passphrase !== "false" && typeof passphrase === "string") {
-        enableEncryption(db, passphrase, useDynamicIterationCount, false, getPBKDF2Salt, encryptionAlgorithm);
+        enableEncryption(
+          db,
+          passphrase,
+          useDynamicIterationCount,
+          false,
+          getPBKDF2Salt,
+          encryptionAlgorithm,
+          connectionOptions.encryptInternalMetadata ?? false
+        );
       }
     } catch (ex) {
       await closeAfterConnectionFailure();

package/dist/services/base/SettingService.d.ts

@@ -110,6 +110,8 @@ export declare abstract class SettingService<T extends ServiceContext = ServiceC
     clearUsedPassphrase(): void;
     decryptConfigurationItem(encrypted: string, passphrase: string): Promise<string | false>;
     encryptConfigurationItem(src: string, settings: ObsidianLiveSyncSettings): Promise<string>;
+    private encryptPlainConfigurationItem;
+    private encryptConfigurationItemWith;
     /**
      * Decrypt the given settings.
      * @param settings The settings to decrypt.

package/dist/services/base/SettingService.js

@@ -13,6 +13,7 @@ import { ServiceBase } from "./ServiceBase.js";
 import { createInstanceLogFunction } from "../lib/logUtils.js";
 import { isCloudantURI } from "../../pouchdb/utils_couchdb.js";
 import { decryptString, encryptString } from "../../encryption/stringEncryption.js";
+import { encryptWithEphemeralSalt } from "octagonal-wheels/encryption/hkdf";
 import {
   activateP2PRemoteConfiguration,
   activateRemoteConfiguration,
@@ -207,7 +208,7 @@ class SettingService extends ServiceBase {
         settings.endpoint = "";
       }
       if (settings.encrypt && settings.passphrase != "") {
-        settings.encryptedPassphrase = await this.encryptConfigurationItem(settings.passphrase, settings);
+        settings.encryptedPassphrase = await this.encryptPlainConfigurationItem(settings.passphrase, settings);
         settings.passphrase = "";
       }
       await this.encryptRemoteConfigurationUris(settings);
@@ -405,8 +406,14 @@ class SettingService extends ServiceBase {
     return false;
   }
   async encryptConfigurationItem(src, settings) {
+    return this.encryptConfigurationItemWith(src, settings, encryptString);
+  }
+  async encryptPlainConfigurationItem(src, settings) {
+    return this.encryptConfigurationItemWith(src, settings, encryptWithEphemeralSalt);
+  }
+  async encryptConfigurationItemWith(src, settings, encrypt) {
     if (this.usedPassphrase != "") {
-      return await encryptString(src, this.usedPassphrase + SALT_OF_PASSPHRASE);
+      return await encrypt(src, this.usedPassphrase + SALT_OF_PASSPHRASE);
     }
     const passphrase = await this.getPassphrase(settings);
     if (passphrase === false) {
@@ -416,7 +423,7 @@ class SettingService extends ServiceBase {
       );
       return "";
     }
-    const dec = await encryptString(src, passphrase + SALT_OF_PASSPHRASE);
+    const dec = await encrypt(src, passphrase + SALT_OF_PASSPHRASE);
     if (dec) {
       this.usedPassphrase = passphrase;
       return dec;