@vrtmrz/livesync-commonlib 0.1.30 → 0.1.32

package/README.md

@@ -33,6 +33,7 @@ The package is ESM-only and declares Node 20 or later. Browser entry points are
 | `@vrtmrz/livesync-commonlib/rpc`                   | Existing LiveSync RPC and PouchDB bridge migration                                | Transitional only; not part of the stable Commonlib 1.0 contract                            |
 | `@vrtmrz/livesync-commonlib/remote-configurations` | Multiple-remote profile creation, naming, and selection                           | Focused, package-tested pre-1.0 contract                                                    |
 | `@vrtmrz/livesync-commonlib/settings`              | New-Vault defaults, stored-setting fallbacks, and settings migration results      | Focused, package-tested pre-1.0 contract                                                    |
+| `@vrtmrz/livesync-commonlib/setup-uri`             | Encrypted Setup URI generation, availability, and import                          | Focused, package-tested pre-1.0 contract                                                    |
 | `@vrtmrz/livesync-commonlib/compat/*`              | Exact legacy imports still required by existing clients                           | Migration-only; paths may be removed as consumers migrate                                   |
 | `@vrtmrz/livesync-commonlib/package.json`          | Package metadata for tooling                                                      | Metadata export, not a runtime API                                                          |
 
@@ -113,6 +114,10 @@ New-Vault recommendations are deliberately separate from the conservative values
 
 See [the settings lifecycle guide](docs/settings-lifecycle.md) before initialising, importing, resetting, or migrating settings.
 
+## Setup URI sharing
+
+The focused Setup URI entry offers an Ephemeral mode bound to the current fixed seven-day window and a Persistent mode compatible with existing readers. Both use the same URI structure. See [the Setup URI sharing guide](docs/setup-uri.md) for the availability boundary, import behaviour, and compatibility limits.
+
 ## Remote connection profiles
 
 New profile-management code can create or update a CouchDB, Object Storage, or P2P connection through the focused remote-configurations entry. Profile IDs provide identity, display names remain editable presentation, and the active selection is explicit. Older flat connection fields remain a runtime projection and an import-compatibility boundary rather than the preferred persistence model.

package/dist/API/DirectFileManipulatorV2.d.ts

@@ -13,6 +13,8 @@ export type DirectFileManipulatorOptions = {
     passphrase: string | undefined;
     database: string;
     obfuscatePassphrase: string | undefined;
+    idDerivationVersion?: 0 | 1;
+    idDerivationKey?: string;
     encryptInternalMetadata?: boolean;
     useDynamicIterationCount?: boolean;
     customChunkSize?: number;

package/dist/API/DirectFileManipulatorV2.js

@@ -7,10 +7,8 @@ import {
   VER
 } from "../common/types.js";
 import { checkRemoteVersion } from "../pouchdb/negotiation.js";
-import {
-  ENCRYPTED_INTERNAL_METADATA_FEATURE,
-  usesEncryptedInternalMetadata
-} from "../pouchdb/remoteFeatureCompatibility.js";
+import { requiredRemoteFeatures, usesEncryptedInternalMetadata } from "../pouchdb/remoteFeatureCompatibility.js";
+import { assessRemoteDocumentIds } from "../pouchdb/remoteIdCompatibility.js";
 import { PouchDB } from "../pouchdb/pouchdb-http.js";
 import { LiveSyncLocalDB } from "../pouchdb/LiveSyncLocalDB.js";
 import { isErrorOfMissingDoc } from "../pouchdb/utils_couchdb.js";
@@ -57,7 +55,19 @@ class DirectFileManipulator {
       if (!await this.liveSyncLocalDB.initializeDatabase()) {
         throw new Error("Direct database initialisation was rejected.");
       }
-      const requiredFeatures = usesEncryptedInternalMetadata(this.settings) ? [ENCRYPTED_INTERNAL_METADATA_FEATURE] : [];
+      const idSettings = {
+        ...this.settings,
+        passphrase: this.options.obfuscatePassphrase || this.settings.passphrase
+      };
+      const idCompatibility = await assessRemoteDocumentIds(
+        this.liveSyncLocalDB.localDatabase,
+        idSettings,
+        (path) => this.services.path.path2idWithSettings(path, idSettings)
+      );
+      if (idCompatibility === "mismatched") {
+        throw new Error("Direct database document IDs do not match the configured ID key.");
+      }
+      const requiredFeatures = requiredRemoteFeatures(this.settings);
       if (!await checkRemoteVersion(
         this.liveSyncLocalDB.localDatabase,
         async () => false,
@@ -200,6 +210,8 @@ class DirectFileManipulator {
         minimumChunkSize: this.options.minimumChunkSize ?? DEFAULT_SETTINGS.minimumChunkSize,
         encrypt: this.options.passphrase ? true : false,
         passphrase: this.options.passphrase ?? "",
+        idDerivationVersion: this.options.idDerivationVersion ?? 0,
+        idDerivationKey: this.options.idDerivationKey ?? "",
         deleteMetadataOfDeletedFiles: DEFAULT_SETTINGS.deleteMetadataOfDeletedFiles,
         customChunkSize: this.options.customChunkSize ?? DEFAULT_SETTINGS.customChunkSize,
         doNotPaceReplication: DEFAULT_SETTINGS.doNotPaceReplication,

package/dist/API/processSetting.d.ts

@@ -26,6 +26,20 @@ export interface SplitQRCodeData {
  */
 export declare function encodeQR(settingString: string, format: OutputFormat): string | SplitQRCodeData;
 type ErasureProperties = keyof ObsidianLiveSyncSettings;
+export type TimeBoundSetupURIMode = "ephemeral" | "persistent";
+export interface TimeBoundSetupURIOptions {
+    mode?: TimeBoundSetupURIMode;
+    removeProperties?: ErasureProperties[];
+    skipDefaultValue?: boolean;
+}
+export interface TimeBoundSetupURIResult {
+    uri: string;
+    usableUntil: number | null;
+}
+/** Return the exclusive end of the current fixed Setup URI window. */
+export declare function getTimeBoundSetupURIUsableUntil(): number;
+/** Check the same fixed window that the Setup URI reader uses. */
+export declare function isTimeBoundSetupURIUsableNow(usableUntil: number | null): boolean;
 /**
  * Generate setup URI with encrypted settings
  * @param settingString Settings to encode
@@ -37,8 +51,12 @@ type ErasureProperties = keyof ObsidianLiveSyncSettings;
  * @returns Generated setup URI
  */
 export declare function encodeSettingsToSetupURI(settingString: ObsidianLiveSyncSettings, passphrase: string, removeProperties?: ErasureProperties[], skipDefaultValue?: boolean): Promise<string>;
+/** Generate a Setup URI for the current UTC window or in the existing persistent format. */
+export declare function encodeTimeBoundSetupURI(settingString: ObsidianLiveSyncSettings, passphrase: string, options?: TimeBoundSetupURIOptions): Promise<TimeBoundSetupURIResult>;
 export declare function decodeSettingsFromSetupURI(uri: string, passphrase: string): Promise<false | Omit<{
     encryptInternalMetadata: boolean;
+    idDerivationVersion: 0 | 1;
+    idDerivationKey: string;
     liveSync: boolean;
     syncOnSave: boolean;
     syncOnStart: boolean;
@@ -74,6 +92,7 @@ export declare function decodeSettingsFromSetupURI(uri: string, passphrase: stri
     disableMarkdownAutoMerge: boolean;
     configPassphraseStore: import("../common/types.js").ConfigPassphraseStore;
     encryptedPassphrase: string;
+    encryptedIdDerivationKey: string;
     encryptedCouchDBConnection: string;
     periodicReplication: boolean;
     periodicReplicationInterval: number;

package/dist/API/processSetting.js

@@ -9,8 +9,10 @@ import {
 } from "../common/types.js";
 import { decryptString, encryptString } from "../encryption/stringEncryption.js";
 import { LOG_LEVEL_VERBOSE, Logger } from "octagonal-wheels/common/logger";
+import { configuredIdKey } from "../common/idDerivation.js";
 function encodeSettingsToQRCodeData(settings) {
   settings = omitP2PRuntimeSettings(settings);
+  configuredIdKey(settings);
   const fullIndexes = Object.entries(KeyIndexOfSettings);
   let maxIndex = 0;
   for (const [, index] of fullIndexes) {
@@ -50,6 +52,7 @@ function decodeSettingsFromQRCodeData(qr) {
       LOG_LEVEL_VERBOSE
     );
   }
+  configuredIdKey(newSettings);
   return omitP2PRuntimeSettings(newSettings);
 }
 var OutputFormat = /* @__PURE__ */ ((OutputFormat2) => {
@@ -94,15 +97,47 @@ function encodeQR(settingString, format) {
     return { total, parts };
   }
 }
+const SETUP_URI_WINDOW_MS = 6048e5;
+function getTimeBoundSetupURIUsableUntil() {
+  const usableUntil = (setupURIWindow(Date.now()) + 1) * SETUP_URI_WINDOW_MS;
+  if (!Number.isSafeInteger(usableUntil)) throw new Error("Invalid Setup URI clock");
+  return usableUntil;
+}
+function isTimeBoundSetupURIUsableNow(usableUntil) {
+  if (usableUntil === null) return true;
+  if (!Number.isSafeInteger(usableUntil) || usableUntil < SETUP_URI_WINDOW_MS) return false;
+  try {
+    return setupURIWindow(Date.now()) === usableUntil / SETUP_URI_WINDOW_MS - 1;
+  } catch {
+    return false;
+  }
+}
+function setupURIWindow(now) {
+  if (!Number.isSafeInteger(now) || now < 0) throw new Error("Invalid Setup URI clock");
+  return Math.floor(now / SETUP_URI_WINDOW_MS);
+}
+async function ephemeralSetupURIPassphrase(passphrase, window) {
+  const text = new TextEncoder();
+  const keyBytes = await crypto.subtle.digest("SHA-256", text.encode(passphrase));
+  const key = await crypto.subtle.importKey("raw", keyBytes, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const context = JSON.stringify(["livesync/setup-uri", "tb1", "ephemeral", window]);
+  const signed = await crypto.subtle.sign("HMAC", key, text.encode(context));
+  return Array.from(new Uint8Array(signed), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 const necessaryErasureProperties = [
   "configPassphraseStore",
   "encryptedCouchDBConnection",
-  "encryptedPassphrase"
+  "encryptedPassphrase",
+  "encryptedIdDerivationKey"
 ];
 async function encodeSettingsToSetupURI(settingString, passphrase, removeProperties = ["pluginSyncExtendedSetting"], skipDefaultValue = false) {
   const setting = {
     ...omitP2PRuntimeSettings(settingString)
   };
+  configuredIdKey({
+    idDerivationVersion: setting.idDerivationVersion ?? 0,
+    idDerivationKey: setting.idDerivationKey ?? ""
+  });
   delete setting.P2P_managedType;
   delete setting.P2P_managedId;
   delete setting.P2P_managedToken;
@@ -124,15 +159,62 @@ async function encodeSettingsToSetupURI(settingString, passphrase, removePropert
   const uri = `${configURIBase}${encryptedSetting} `;
   return uri;
 }
+async function encodeTimeBoundSetupURI(settingString, passphrase, options = {}) {
+  const { mode = "ephemeral", removeProperties, skipDefaultValue } = options;
+  if (mode === "persistent") {
+    return {
+      uri: await encodeSettingsToSetupURI(settingString, passphrase, removeProperties, skipDefaultValue),
+      usableUntil: null
+    };
+  }
+  if (mode !== "ephemeral") throw new Error("Invalid Setup URI mode");
+  const window = setupURIWindow(Date.now());
+  const effectivePassphrase = await ephemeralSetupURIPassphrase(passphrase, window);
+  const uri = await encodeSettingsToSetupURI(settingString, effectivePassphrase, removeProperties, skipDefaultValue);
+  if (setupURIWindow(Date.now()) !== window) throw new Error("Setup URI window changed during generation");
+  return { uri, usableUntil: (window + 1) * SETUP_URI_WINDOW_MS };
+}
 async function decodeSettingsFromSetupURI(uri, passphrase) {
   const encryptedSetting = uri.substring(configURIBase.length);
-  const decrypted = await decryptString(decodeURIComponent(encryptedSetting), passphrase);
+  const encrypted = decodeURIComponent(encryptedSetting);
+  let decrypted;
+  if (encrypted.startsWith("%$")) {
+    let window;
+    try {
+      window = setupURIWindow(Date.now());
+    } catch {
+    }
+    const matches = [];
+    if (window !== void 0) {
+      const candidate = await ephemeralSetupURIPassphrase(passphrase, window);
+      try {
+        matches.push({ mode: "ephemeral", value: await decryptString(encrypted, candidate) });
+      } catch {
+      }
+    }
+    try {
+      matches.push({ mode: "persistent", value: await decryptString(encrypted, passphrase) });
+    } catch {
+    }
+    if (matches.length !== 1) throw new Error("Cannot open Setup URI");
+    const matched = matches[0];
+    if (matched.mode === "ephemeral" && setupURIWindow(Date.now()) !== window) {
+      throw new Error("Cannot open Setup URI");
+    }
+    decrypted = matched.value;
+  } else {
+    decrypted = await decryptString(encrypted, passphrase);
+  }
   try {
     const imported = JSON.parse(decrypted);
-    return omitP2PRuntimeSettings({
+    const settings = {
       ...imported,
-      encryptInternalMetadata: typeof imported.encryptInternalMetadata === "boolean" ? imported.encryptInternalMetadata : false
-    });
+      encryptInternalMetadata: typeof imported.encryptInternalMetadata === "boolean" ? imported.encryptInternalMetadata : false,
+      idDerivationVersion: imported.idDerivationVersion ?? 0,
+      idDerivationKey: imported.idDerivationKey ?? ""
+    };
+    configuredIdKey(settings);
+    return omitP2PRuntimeSettings(settings);
   } catch {
     Logger(`Failed to parse settings from decrypted data`, LOG_LEVEL_NOTICE);
     return false;
@@ -144,5 +226,8 @@ export {
   decodeSettingsFromSetupURI,
   encodeQR,
   encodeSettingsToQRCodeData,
-  encodeSettingsToSetupURI
+  encodeSettingsToSetupURI,
+  encodeTimeBoundSetupURI,
+  getTimeBoundSetupURIUsableUntil,
+  isTimeBoundSetupURIUsableNow
 };

package/dist/common/idDerivation.d.ts

@@ -0,0 +1,13 @@
+import type { EncryptionSettings } from "./models/setting.type.js";
+export declare const ID_DERIVATION_VERSION = 1;
+export declare const ID_RECOVERY_CODE_PREFIX = "sls-id-v1:";
+/** Derive a portable key once, when the source string is saved. */
+export declare function deriveIdKey(source: string): Promise<string>;
+/** Export a saved key in a format which can be imported without deriving it again. */
+export declare function formatIdRecoveryCode(key: string): string;
+/** Treat a tagged recovery code as a saved key; derive ordinary source strings. */
+export declare function deriveOrImportIdKey(input: string): Promise<string>;
+/** Return the independent ID key, rejecting an incomplete new-mode setting. */
+export declare function configuredIdKey(settings: Pick<EncryptionSettings, "idDerivationVersion" | "idDerivationKey">): string | false;
+/** Derive distinct identifiers for content and document paths from one saved key. */
+export declare function computeKeyedId(key: string, purpose: "chunk" | "document" | "peer-agreement" | "remote-agreement", value: string): Promise<string>;

package/dist/common/idDerivation.js

@@ -0,0 +1,75 @@
+import { getWebCrypto } from "../mods.js";
+import { hexStringToUint8Array, uint8ArrayToHexString } from "../string_and_binary/convert.js";
+const ID_DERIVATION_VERSION = 1;
+const ID_RECOVERY_CODE_PREFIX = "sls-id-v1:";
+const SOURCE_SALT = new TextEncoder().encode("self-hosted-livesync:id-source:v1");
+const SOURCE_ITERATIONS = 31e4;
+const HEX_KEY = /^[0-9a-f]{64}$/u;
+async function deriveIdKey(source) {
+  if (source.length === 0) {
+    throw new Error("An ID source is required.");
+  }
+  const crypto = await getWebCrypto();
+  const sourceKey = await crypto.subtle.importKey(
+    "raw",
+    new TextEncoder().encode(source.normalize("NFC")),
+    "PBKDF2",
+    false,
+    ["deriveBits"]
+  );
+  const bits = await crypto.subtle.deriveBits(
+    { name: "PBKDF2", hash: "SHA-256", salt: SOURCE_SALT, iterations: SOURCE_ITERATIONS },
+    sourceKey,
+    256
+  );
+  return uint8ArrayToHexString(new Uint8Array(bits));
+}
+function formatIdRecoveryCode(key) {
+  if (!HEX_KEY.test(key)) throw new Error("The configured ID key is invalid.");
+  return `${ID_RECOVERY_CODE_PREFIX}${key}`;
+}
+async function deriveOrImportIdKey(input) {
+  const candidate = input.trim();
+  if (candidate.startsWith(ID_RECOVERY_CODE_PREFIX)) {
+    const key = candidate.slice(ID_RECOVERY_CODE_PREFIX.length);
+    if (!HEX_KEY.test(key)) throw new Error("The ID recovery code is invalid.");
+    return key;
+  }
+  if (candidate.startsWith("sls-id-v")) throw new Error("The ID recovery code version is unsupported.");
+  return await deriveIdKey(input);
+}
+function configuredIdKey(settings) {
+  const version = settings.idDerivationVersion;
+  const key = settings.idDerivationKey;
+  if (version === 0 || version === void 0) {
+    if (key) throw new Error("An ID key requires a supported derivation version.");
+    return false;
+  }
+  if (version !== ID_DERIVATION_VERSION || !HEX_KEY.test(key)) {
+    throw new Error("The configured ID derivation is unavailable or invalid.");
+  }
+  return key;
+}
+async function computeKeyedId(key, purpose, value) {
+  if (!HEX_KEY.test(key)) throw new Error("The configured ID key is invalid.");
+  const crypto = await getWebCrypto();
+  const hmacKey = await crypto.subtle.importKey(
+    "raw",
+    hexStringToUint8Array(key),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const input = new TextEncoder().encode(`self-hosted-livesync:id-v1:${purpose}\0${value}`);
+  const digest = await crypto.subtle.sign("HMAC", hmacKey, input);
+  return uint8ArrayToHexString(new Uint8Array(digest));
+}
+export {
+  ID_DERIVATION_VERSION,
+  ID_RECOVERY_CODE_PREFIX,
+  computeKeyedId,
+  configuredIdKey,
+  deriveIdKey,
+  deriveOrImportIdKey,
+  formatIdRecoveryCode
+};

package/dist/common/models/db.definition.d.ts

@@ -43,6 +43,7 @@ export interface EntryMilestoneInfo extends DatabaseEntry {
     tweak_values: {
         [key: NodeKey]: TweakValues;
     };
+    encrypted_id_derivation_proof?: string;
 }
 export interface EntryNodeInfo extends DatabaseEntry {
     _id: typeof NODEINFO_DOCID;

package/dist/common/models/setting.const.defaults.js

@@ -56,6 +56,8 @@ const SETTINGS_SCHEMA_DEFAULTS = {
   syncOnFileOpen: false,
   encrypt: false,
   passphrase: "",
+  idDerivationVersion: 0,
+  idDerivationKey: "",
   usePathObfuscation: false,
   encryptInternalMetadata: false,
   doNotDeleteFolder: false,
@@ -104,6 +106,7 @@ const SETTINGS_SCHEMA_DEFAULTS = {
   syncAfterMerge: false,
   configPassphraseStore: "",
   encryptedPassphrase: "",
+  encryptedIdDerivationKey: "",
   encryptedCouchDBConnection: "",
   permitEmptyPassphrase: false,
   remoteConfigurations: {},

package/dist/common/models/setting.const.qr.js

@@ -177,7 +177,10 @@ const KeyIndexOfSettings = {
   // Do not encode into the QR Code.
   P2P_maxWirePayloadBytes: 163,
   P2P_connectionPath: 164,
-  encryptInternalMetadata: 165
+  encryptInternalMetadata: 165,
+  idDerivationVersion: 166,
+  idDerivationKey: 167,
+  encryptedIdDerivationKey: -1
 };
 export {
   KeyIndexOfSettings

package/dist/common/models/setting.type.d.ts

@@ -65,6 +65,8 @@ interface EncryptedUserSettings {
      * The encrypted passphrase used for E2EE.
      */
     encryptedPassphrase: string;
+    /** Encrypted copy of the independent ID key in local persisted settings. */
+    encryptedIdDerivationKey: string;
     /**
      * The encrypted connection details for CouchDB.
      */
@@ -585,6 +587,10 @@ export interface EncryptionSettings {
      * The passphrase used for E2EE.
      */
     passphrase: string;
+    /** Zero preserves the historical passphrase-derived ID scheme. */
+    idDerivationVersion: 0 | 1;
+    /** A 256-bit key encoded as lower-case hex; never the source string. */
+    idDerivationKey: string;
     /**
      * Indicates whether path obfuscation is used.
      * If not, the path will be stored as it is, as the document ID.

package/dist/common/models/tweak.compatibility.js

@@ -46,7 +46,7 @@ function transition(entries, sourceSide, targetSide) {
     const effectiveValueDiffers = source.effectiveValue !== target.effectiveValue;
     const shouldFillMissingTarget = !targetAdvertised && sourceAdvertised;
     if (source.effectiveValue === void 0 || !effectiveValueDiffers && !shouldFillMissingTarget) continue;
-    changes[entry.key] = source.effectiveValue;
+    if (entry.key !== "idDerivationVersion") changes[entry.key] = source.effectiveValue;
     if (entry.relation === "equal") continue;
     const effect = reconstructionForTransition(entry.key, target.effectiveValue, source.effectiveValue);
     if (effect === "none") continue;
@@ -67,6 +67,8 @@ function assessTweakCompatibility(current, preferred) {
   const currentValues = snapshotTweakValues(current);
   const preferredValues = snapshotTweakValues(preferred);
   let representationDiffers = false;
+  const currentUsesKeyedDocumentIds = currentValues.encrypt !== false && currentValues.usePathObfuscation !== false;
+  const preferredUsesKeyedDocumentIds = preferredValues.encrypt !== false && preferredValues.usePathObfuscation !== false;
   const entries = TweakCompatibilityRules.map((rule) => {
     const knownDefault = "knownDefault" in rule ? rule.knownDefault : void 0;
     const currentValue = assessedValue(currentValues, rule.key, knownDefault);
@@ -74,7 +76,9 @@ function assessTweakCompatibility(current, preferred) {
     const currentAdvertised = currentValue.present && currentValue.rawValue !== void 0;
     const preferredAdvertised = preferredValue.present && preferredValue.rawValue !== void 0;
     let relation;
-    if ((!currentAdvertised || !preferredAdvertised) && knownDefault === void 0) {
+    if (rule.key === "idDerivationVersion" && !currentUsesKeyedDocumentIds && !preferredUsesKeyedDocumentIds) {
+      relation = "equal";
+    } else if ((!currentAdvertised || !preferredAdvertised) && knownDefault === void 0) {
       relation = "unadvertised";
     } else {
       relation = currentValue.effectiveValue === preferredValue.effectiveValue ? "equal" : "different";

package/dist/common/models/tweak.definition.d.ts

@@ -20,6 +20,11 @@ export declare const TweakCompatibilityRules: readonly [{
     readonly key: "usePathObfuscation";
     readonly templateValue: false;
     readonly reconstruction: "required";
+}, {
+    readonly key: "idDerivationVersion";
+    readonly templateValue: 0;
+    readonly reconstruction: "required";
+    readonly knownDefault: 0;
 }, {
     readonly key: "encryptInternalMetadata";
     readonly templateValue: false;
@@ -112,6 +117,7 @@ export declare const TweakValuesTemplate: {
     tweakModified: number;
     usePluginSyncV2: boolean;
     encrypt: boolean;
+    idDerivationVersion: 0 | 1;
     usePathObfuscation: boolean;
     encryptInternalMetadata: boolean;
     E2EEAlgorithm: import("./setting.type.js").E2EEAlgorithm;
@@ -164,6 +170,7 @@ export declare const TweakValuesTemplate: {
     disableMarkdownAutoMerge?: boolean;
     configPassphraseStore?: import("./setting.type.js").ConfigPassphraseStore;
     encryptedPassphrase?: string;
+    encryptedIdDerivationKey?: string;
     encryptedCouchDBConnection?: string;
     periodicReplication?: boolean;
     periodicReplicationInterval?: number;
@@ -234,6 +241,7 @@ export declare const TweakValuesTemplate: {
     forcePathStyle?: boolean;
     remoteType?: import("./setting.type.js").RemoteType;
     passphrase?: string;
+    idDerivationKey?: string;
     doNotUseFixedRevisionForChunks?: boolean;
     checkIntegrityOnSave?: boolean;
     useHistory?: boolean;

package/dist/common/models/tweak.definition.js

@@ -5,6 +5,7 @@ const TweakCompatibilityRules = Object.freeze([
   { key: "longLineThreshold", templateValue: 250, reconstruction: "none" },
   { key: "encrypt", templateValue: false, reconstruction: "required" },
   { key: "usePathObfuscation", templateValue: false, reconstruction: "required" },
+  { key: "idDerivationVersion", templateValue: 0, reconstruction: "required", knownDefault: 0 },
   { key: "encryptInternalMetadata", templateValue: false, reconstruction: "none", knownDefault: false },
   { key: "enableCompression", templateValue: false, reconstruction: "none" },
   { key: "useEden", templateValue: false, reconstruction: "none" },
@@ -81,9 +82,9 @@ const TweakValuesRecommendedTemplate = {
 };
 const TweakValuesDefault = {
   ...Object.fromEntries(
-    TweakCompatibilityRules.filter((rule) => "knownDefault" in rule && rule.key !== "handleFilenameCaseSensitive").map(
-      ({ key, knownDefault }) => [key, knownDefault]
-    )
+    TweakCompatibilityRules.filter(
+      (rule) => "knownDefault" in rule && rule.key !== "handleFilenameCaseSensitive"
+    ).map(({ key, knownDefault }) => [key, knownDefault])
   ),
   tweakModified: DEFAULT_SETTINGS.tweakModified
 };

package/dist/common/settingConstants.d.ts

@@ -64,6 +64,7 @@ export declare const AllSettingDefault: {
     disableMarkdownAutoMerge: boolean;
     configPassphraseStore: import("./types.js").ConfigPassphraseStore;
     encryptedPassphrase: string;
+    encryptedIdDerivationKey: string;
     encryptedCouchDBConnection: string;
     periodicReplication: boolean;
     periodicReplicationInterval: number;
@@ -135,6 +136,8 @@ export declare const AllSettingDefault: {
     remoteType: import("./types.js").RemoteType;
     encrypt: boolean;
     passphrase: string;
+    idDerivationVersion: 0 | 1;
+    idDerivationKey: string;
     usePathObfuscation: boolean;
     encryptInternalMetadata: boolean;
     E2EEAlgorithm: import("./types.js").E2EEAlgorithm;

package/dist/common/utils.js

@@ -449,7 +449,9 @@ function pickEncryptionSettings(setting) {
     encrypt: setting.encrypt,
     passphrase: setting.passphrase,
     usePathObfuscation: setting.usePathObfuscation,
-    encryptInternalMetadata: setting.encryptInternalMetadata
+    encryptInternalMetadata: setting.encryptInternalMetadata,
+    idDerivationVersion: setting.idDerivationVersion,
+    idDerivationKey: setting.idDerivationKey
   };
 }
 function pickP2PSyncSettings(setting) {

package/dist/events/coreEvents.d.ts

@@ -7,6 +7,8 @@ export declare const EVENT_FILE_RENAMED = "file-renamed";
 export declare const EVENT_FILE_SAVED = "file-saved";
 export declare const EVENT_LEAF_ACTIVE_CHANGED = "leaf-active-changed";
 export declare const EVENT_DATABASE_REBUILT = "database-rebuilt";
+/** Emitted by `AppLifecycleService.markIsReady()` each time it establishes application readiness. */
+export declare const EVENT_APPLICATION_READY = "application-ready";
 export declare const EVENT_LOG_ADDED = "log-added";
 export declare const EVENT_REQUEST_OPEN_SETUP_URI = "request-open-setup-uri";
 export declare const EVENT_REQUEST_COPY_SETUP_URI = "request-copy-setup-uri";
@@ -37,6 +39,7 @@ declare global {
             old: FilePathWithPrefix;
         };
         [EVENT_DATABASE_REBUILT]: undefined;
+        [EVENT_APPLICATION_READY]: undefined;
         [EVENT_REQUEST_OPEN_P2P_SETTINGS]: undefined;
         [EVENT_LEAF_ACTIVE_CHANGED]: undefined;
         [EVENT_REQUEST_OPEN_SETUP_URI]: undefined;

package/dist/events/coreEvents.js

@@ -6,6 +6,7 @@ const EVENT_FILE_RENAMED = "file-renamed";
 const EVENT_FILE_SAVED = "file-saved";
 const EVENT_LEAF_ACTIVE_CHANGED = "leaf-active-changed";
 const EVENT_DATABASE_REBUILT = "database-rebuilt";
+const EVENT_APPLICATION_READY = "application-ready";
 const EVENT_LOG_ADDED = "log-added";
 const EVENT_REQUEST_OPEN_SETUP_URI = "request-open-setup-uri";
 const EVENT_REQUEST_COPY_SETUP_URI = "request-copy-setup-uri";
@@ -21,6 +22,7 @@ const EVENT_ON_UNRESOLVED_ERROR = "on-unresolved-error";
 const EVENT_REQUEST_CHECK_REMOTE_SIZE = "request-check-remote-size";
 const EVENT_CONFLICT_CANCELLED = "conflict-cancelled";
 export {
+  EVENT_APPLICATION_READY,
   EVENT_CONFLICT_CANCELLED,
   EVENT_DATABASE_REBUILT,
   EVENT_FILE_CHANGED,

package/dist/managers/EntryManager/EntryManagerImpls.js

@@ -228,6 +228,11 @@ function isTargetFile(host, filenameSrc) {
   return true;
 }
 async function prepareChunk({ chunkManager, hashManager }, piece) {
+  if (hashManager.usesIndependentIdKey()) {
+    const id = `${IDPrefixes.Chunk}${await hashManager.computeHash(piece)}`;
+    const cached = chunkManager.getCachedChunk(id);
+    return { isNew: !cached || cached.data !== piece, id, piece };
+  }
   const cachedChunkId = chunkManager.getChunkIDFromCache(piece);
   if (cachedChunkId !== false) {
     return { isNew: false, id: cachedChunkId, piece };
@@ -387,7 +392,11 @@ async function respondEntryFromMeta({ localDatabase, chunkManager }, settings, f
       }));
       edenChunks = Object.fromEntries(chunks2.map((e) => [e._id, e]));
     }
-    const { waitForDelivery, preventRemoteRequest } = computeChunkRetrievalMethod(waitForReady, settings, localOnly);
+    const { waitForDelivery, preventRemoteRequest } = computeChunkRetrievalMethod(
+      waitForReady,
+      settings,
+      localOnly
+    );
     const childrenKeys = [...meta.children];
     const chunks = await chunkManager.read(
       childrenKeys,

package/dist/managers/HashManager/HashManager.d.ts

@@ -43,6 +43,7 @@ export declare class HashManager extends HashManagerCore {
      * @returns The hash value (returned as a Promise)
      */
     computeHash(piece: string): Promise<string>;
+    usesIndependentIdKey(): boolean;
     /**
      * Computes the hash value without encryption.
      *

package/dist/managers/HashManager/HashManager.js

@@ -1,7 +1,8 @@
 import { FallbackWasmHashManager, XXHash32RawHashManager, XXHash64HashManager } from "./XXHashHashManager.js";
 import { FallbackPureJSHashManager, PureJSHashManager, SHA1HashManager } from "./PureJSHashManager.js";
-import { HashManagerCore } from "./HashManagerCore.js";
+import { HashEncryptedPrefix, HashManagerCore } from "./HashManagerCore.js";
 import { LOG_LEVEL_VERBOSE, Logger } from "../../common/logger.js";
+import { computeKeyedId, configuredIdKey } from "../../common/idDerivation.js";
 const HashManagers = [
   XXHash64HashManager,
   XXHash32RawHashManager,
@@ -71,8 +72,17 @@ class HashManager extends HashManagerCore {
    * @returns The hash value (returned as a Promise)
    */
   async computeHash(piece) {
+    const settings = this.options.settingService.currentSettings();
+    const key = configuredIdKey(settings);
+    if (settings.encrypt && key) {
+      return HashEncryptedPrefix + await computeKeyedId(key, "chunk", piece);
+    }
     return await this.manager.computeHash(piece);
   }
+  usesIndependentIdKey() {
+    const settings = this.options.settingService.currentSettings();
+    return settings.encrypt && configuredIdKey(settings) !== false;
+  }
   /**
    * Computes the hash value without encryption.
    *
@@ -89,6 +99,8 @@ class HashManager extends HashManagerCore {
    * @returns The hash value (returned as a Promise)
    */
   computeHashWithEncryption(piece) {
+    const key = configuredIdKey(this.options.settingService.currentSettings());
+    if (key) return computeKeyedId(key, "chunk", piece);
     return this.manager.computeHashWithEncryption(piece);
   }
 }

package/dist/pouchdb/LiveSyncDBFunctions.d.ts

@@ -1,6 +1,6 @@
 import { type EntryDoc, type EntryMilestoneInfo, type RemoteDBSettings, type ChunkVersionRange, type TweakValues, type DeviceInfo, type TweakAssessment } from "../common/types.js";
 export declare function getEffectiveTweakValues(setting: RemoteDBSettings): TweakValues;
-export type ENSURE_DB_RESULT = "OK" | "INCOMPATIBLE" | "LOCKED" | "NODE_LOCKED" | "NODE_CLEANED" | ["MISMATCHED", TweakValues];
+export type ENSURE_DB_RESULT = "OK" | "INCOMPATIBLE" | "ID_KEY_MISMATCH" | "LOCKED" | "NODE_LOCKED" | "NODE_CLEANED" | ["MISMATCHED", TweakValues];
 /**
  * Ensures that the remote database is compatible with the current device.
  *