@vrtmrz/livesync-commonlib 0.1.31 → 0.1.33

package/dist/replication/trystero/TrysteroReplicator.d.ts

@@ -1,4 +1,4 @@
-import { type EntryDoc, type ObsidianLiveSyncSettings } from "../../common/types.js";
+import { type EntryDoc, type ObsidianLiveSyncSettings, type P2PSyncSetting } from "../../common/types.js";
 import { type LOG_LEVEL } from "octagonal-wheels/common/logger";
 import { type ProgressInfo } from "../../pouchdb/ReplicatorShim.js";
 import type { Confirm } from "../../interfaces/Confirm.js";
@@ -115,9 +115,9 @@ export declare class TrysteroReplicator {
     private readonly fallbackAutomationCoordinator;
     server?: P2PHost;
     replicationStatus(): {};
-    get settings(): import("../../common/types.js").P2PSyncSetting;
+    get settings(): P2PSyncSetting;
     /** Latest room-local policy settings supplied by the owning host. */
-    get currentSettings(): import("../../common/types.js").P2PSyncSetting;
+    get currentSettings(): P2PSyncSetting;
     get db(): PouchDB.Database<EntryDoc>;
     get deviceName(): string;
     get platform(): string;
@@ -140,12 +140,376 @@ export declare class TrysteroReplicator {
     _onSetup: boolean;
     setOnSetup(): void;
     clearOnSetup(): void;
-    getTweakSettings(fromPeerId: string): Promise<Partial<ObsidianLiveSyncSettings>>;
+    getTweakSettings(fromPeerId: string): Promise<{
+        idDerivationVersion: 0 | 1;
+        idDerivationProof: string;
+        liveSync?: boolean;
+        syncOnSave?: boolean;
+        syncOnStart?: boolean;
+        syncOnFileOpen?: boolean;
+        syncOnEditorSave?: boolean;
+        keepReplicationActiveInBackground?: boolean;
+        allowSleepDuringSynchronisation?: boolean;
+        allowSleepDuringSynchronisationOnDesktop?: boolean;
+        syncMinimumInterval?: number;
+        showVerboseLog?: boolean;
+        lessInformationInLog?: boolean;
+        showLongerLogInsideEditor?: boolean;
+        showStatusOnEditor?: boolean;
+        showStatusOnStatusbar?: boolean;
+        showOnlyIconsOnEditor?: boolean;
+        hideFileWarningNotice?: boolean;
+        networkWarningStyle?: "" | "icon" | "hidden";
+        displayLanguage?: import("../../common/models/setting.type.js").I18N_LANGS;
+        trashInsteadDelete?: boolean;
+        doNotDeleteFolder?: boolean;
+        batchSave?: boolean;
+        batchSaveMinimumDelay?: number;
+        batchSaveMaximumDelay?: number;
+        syncMaxSizeInMB?: number;
+        useIgnoreFiles?: boolean;
+        ignoreFiles?: string;
+        processSizeMismatchedFiles?: boolean;
+        syncOnlyRegEx?: import("../../common/types.js").CustomRegExpSourceList<"|[]|">;
+        syncIgnoreRegEx?: import("../../common/types.js").CustomRegExpSourceList<"|[]|">;
+        syncAfterMerge?: boolean;
+        resolveConflictsByNewerFile?: boolean;
+        writeDocumentsIfConflicted?: boolean;
+        disableMarkdownAutoMerge?: boolean;
+        configPassphraseStore?: import("../../common/types.js").ConfigPassphraseStore;
+        encryptedPassphrase?: string;
+        encryptedIdDerivationKey?: string;
+        encryptedCouchDBConnection?: string;
+        periodicReplication?: boolean;
+        periodicReplicationInterval?: number;
+        syncInternalFiles?: boolean;
+        syncInternalFilesBeforeReplication?: boolean;
+        syncInternalFilesInterval?: number;
+        syncInternalFilesIgnorePatterns?: import("../../common/types.js").CustomRegExpSourceList<",">;
+        syncInternalFilesTargetPatterns?: import("../../common/types.js").CustomRegExpSourceList<",">;
+        watchInternalFileChanges?: boolean;
+        suppressNotifyHiddenFilesChange?: boolean;
+        syncInternalFileOverwritePatterns?: import("../../common/types.js").CustomRegExpSourceList<",">;
+        usePluginSync?: boolean;
+        usePluginSettings?: boolean;
+        showOwnPlugins?: boolean;
+        autoSweepPlugins?: boolean;
+        autoSweepPluginsPeriodic?: boolean;
+        notifyPluginOrSettingUpdated?: boolean;
+        deviceAndVaultName?: string;
+        usePluginSyncV2?: boolean;
+        usePluginEtc?: boolean;
+        pluginSyncExtendedSetting?: Record<import("../../common/types.js").PluginSyncSettingEntry["key"], import("../../common/types.js").PluginSyncSettingEntry>;
+        useAdvancedMode?: boolean;
+        usePowerUserMode?: boolean;
+        useEdgeCaseMode?: boolean;
+        notifyThresholdOfRemoteStorageSize?: number;
+        disableWorkerForGeneratingChunks?: boolean;
+        processSmallFilesInUIThread?: boolean;
+        savingDelay?: number;
+        gcDelay?: number;
+        skipOlderFilesOnSync?: boolean;
+        useIndexedDBAdapter?: boolean;
+        enableDebugTools?: boolean;
+        writeLogToTheFile?: boolean;
+        settingSyncFile?: string;
+        writeCredentialsForSettingSync?: boolean;
+        notifyAllSettingSyncFile?: boolean;
+        suspendFileWatching?: boolean;
+        suspendParseReplicationResult?: boolean;
+        doNotSuspendOnFetching?: boolean;
+        maxMTimeForReflectEvents?: number;
+        versionUpFlash?: string;
+        settingVersion?: number;
+        isConfigured?: boolean;
+        lastReadUpdates?: number;
+        doctorProcessedVersion?: string;
+        remoteConfigurations?: Record<string, import("../../remoteConfigurations.js").RemoteConfiguration>;
+        activeConfigurationId?: string;
+        P2P_ActiveRemoteConfigurationId?: string;
+        couchDB_URI?: string;
+        couchDB_USER?: string;
+        couchDB_PASSWORD?: string;
+        couchDB_DBNAME?: string;
+        couchDB_CustomHeaders?: string;
+        useJWT?: boolean;
+        jwtAlgorithm?: import("../../common/models/auth.type.js").JWTAlgorithm;
+        jwtKey?: string;
+        jwtKid?: string;
+        jwtSub?: string;
+        jwtExpDuration?: number;
+        useRequestAPI?: boolean;
+        accessKey?: string;
+        secretKey?: string;
+        bucket?: string;
+        region?: string;
+        endpoint?: string;
+        useCustomRequestHandler?: boolean;
+        bucketCustomHeaders?: string;
+        bucketPrefix?: string;
+        forcePathStyle?: boolean;
+        remoteType?: import("../../common/types.js").RemoteType;
+        encrypt?: boolean;
+        passphrase?: string;
+        idDerivationKey?: string;
+        usePathObfuscation?: boolean;
+        encryptInternalMetadata?: boolean;
+        E2EEAlgorithm?: import("../../common/types.js").E2EEAlgorithm;
+        hashAlg?: import("../../common/types.js").HashAlgorithm;
+        minimumChunkSize?: number;
+        customChunkSize?: number;
+        longLineThreshold?: number;
+        useSegmenter?: boolean;
+        enableChunkSplitterV2?: boolean;
+        doNotUseFixedRevisionForChunks?: boolean;
+        chunkSplitterVersion?: import("../../common/types.js").ChunkSplitterVersion;
+        useEden?: boolean;
+        maxChunksInEden?: number;
+        maxTotalLengthInEden?: number;
+        maxAgeInEden?: number;
+        tweakModified?: number | undefined;
+        checkIntegrityOnSave?: boolean;
+        useHistory?: boolean;
+        disableRequestURI?: boolean;
+        sendChunksBulk?: boolean;
+        sendChunksBulkMaxSize?: number;
+        useDynamicIterationCount?: boolean;
+        doNotPaceReplication?: boolean;
+        readChunksOnline?: boolean;
+        useOnlyLocalChunk?: boolean;
+        concurrencyOfReadChunksOnline?: number;
+        minimumIntervalOfReadChunksOnline?: number;
+        enableCompression?: boolean;
+        batch_size?: number;
+        batches_limit?: number;
+        ignoreVersionCheck?: boolean;
+        disableCheckingConfigMismatch?: boolean;
+        autoAcceptCompatibleTweak?: boolean | undefined;
+        hashCacheMaxCount?: number;
+        hashCacheMaxAmount?: number;
+        permitEmptyPassphrase?: boolean;
+        handleFilenameCaseSensitive?: boolean;
+        checkConflictOnlyOnOpen?: boolean;
+        showMergeDialogOnlyOnActive?: boolean;
+        additionalSuffixOfDatabaseName?: string | undefined;
+        useTimeouts?: boolean;
+        deleteMetadataOfDeletedFiles?: boolean;
+        automaticallyDeleteMetadataOfDeletedFiles?: number;
+        P2P_AutoAccepting?: import("../../common/types.js").AutoAccepting;
+        P2P_AutoSyncPeers?: string;
+        P2P_AutoWatchPeers?: string;
+        P2P_SyncOnReplication?: string;
+        P2P_RebuildFrom?: string;
+        P2P_AutoAcceptingPeers?: string;
+        P2P_AutoDenyingPeers?: string;
+        P2P_IsHeadless?: boolean;
+        P2P_iceServers?: readonly RTCIceServer[];
+        P2P_iceServersExpiresAt?: number;
+        P2P_Enabled?: boolean;
+        P2P_relays?: string;
+        P2P_roomID?: string;
+        P2P_passphrase?: string;
+        P2P_AppID?: string;
+        P2P_AutoStart?: boolean;
+        P2P_AutoBroadcast?: boolean;
+        P2P_DevicePeerName?: string;
+        P2P_turnServers?: string;
+        P2P_turnUsername?: string;
+        P2P_turnCredential?: string;
+        P2P_managedType?: string;
+        P2P_managedId?: string;
+        P2P_managedToken?: string;
+        P2P_maxWirePayloadBytes?: number;
+        P2P_connectionPath?: import("../../common/types.js").P2PConnectionPath;
+        P2P_useDiagRTC?: boolean;
+    }>;
     private handleSynchronisationRequest;
     getCommands(): {
         reqSync: (fromPeerId: string) => Promise<P2PReplicationWireResult>;
         "!reqAuth": (fromPeerId: string) => Promise<boolean>;
-        getTweakSettings: (fromPeerId: string) => Promise<Partial<ObsidianLiveSyncSettings>>;
+        getTweakSettings: (fromPeerId: string) => Promise<{
+            idDerivationVersion: 0 | 1;
+            idDerivationProof: string;
+            liveSync?: boolean;
+            syncOnSave?: boolean;
+            syncOnStart?: boolean;
+            syncOnFileOpen?: boolean;
+            syncOnEditorSave?: boolean;
+            keepReplicationActiveInBackground?: boolean;
+            allowSleepDuringSynchronisation?: boolean;
+            allowSleepDuringSynchronisationOnDesktop?: boolean;
+            syncMinimumInterval?: number;
+            showVerboseLog?: boolean;
+            lessInformationInLog?: boolean;
+            showLongerLogInsideEditor?: boolean;
+            showStatusOnEditor?: boolean;
+            showStatusOnStatusbar?: boolean;
+            showOnlyIconsOnEditor?: boolean;
+            hideFileWarningNotice?: boolean;
+            networkWarningStyle?: "" | "icon" | "hidden";
+            displayLanguage?: import("../../common/models/setting.type.js").I18N_LANGS;
+            trashInsteadDelete?: boolean;
+            doNotDeleteFolder?: boolean;
+            batchSave?: boolean;
+            batchSaveMinimumDelay?: number;
+            batchSaveMaximumDelay?: number;
+            syncMaxSizeInMB?: number;
+            useIgnoreFiles?: boolean;
+            ignoreFiles?: string;
+            processSizeMismatchedFiles?: boolean;
+            syncOnlyRegEx?: import("../../common/types.js").CustomRegExpSourceList<"|[]|">;
+            syncIgnoreRegEx?: import("../../common/types.js").CustomRegExpSourceList<"|[]|">;
+            syncAfterMerge?: boolean;
+            resolveConflictsByNewerFile?: boolean;
+            writeDocumentsIfConflicted?: boolean;
+            disableMarkdownAutoMerge?: boolean;
+            configPassphraseStore?: import("../../common/types.js").ConfigPassphraseStore;
+            encryptedPassphrase?: string;
+            encryptedIdDerivationKey?: string;
+            encryptedCouchDBConnection?: string;
+            periodicReplication?: boolean;
+            periodicReplicationInterval?: number;
+            syncInternalFiles?: boolean;
+            syncInternalFilesBeforeReplication?: boolean;
+            syncInternalFilesInterval?: number;
+            syncInternalFilesIgnorePatterns?: import("../../common/types.js").CustomRegExpSourceList<",">;
+            syncInternalFilesTargetPatterns?: import("../../common/types.js").CustomRegExpSourceList<",">;
+            watchInternalFileChanges?: boolean;
+            suppressNotifyHiddenFilesChange?: boolean;
+            syncInternalFileOverwritePatterns?: import("../../common/types.js").CustomRegExpSourceList<",">;
+            usePluginSync?: boolean;
+            usePluginSettings?: boolean;
+            showOwnPlugins?: boolean;
+            autoSweepPlugins?: boolean;
+            autoSweepPluginsPeriodic?: boolean;
+            notifyPluginOrSettingUpdated?: boolean;
+            deviceAndVaultName?: string;
+            usePluginSyncV2?: boolean;
+            usePluginEtc?: boolean;
+            pluginSyncExtendedSetting?: Record<import("../../common/types.js").PluginSyncSettingEntry["key"], import("../../common/types.js").PluginSyncSettingEntry>;
+            useAdvancedMode?: boolean;
+            usePowerUserMode?: boolean;
+            useEdgeCaseMode?: boolean;
+            notifyThresholdOfRemoteStorageSize?: number;
+            disableWorkerForGeneratingChunks?: boolean;
+            processSmallFilesInUIThread?: boolean;
+            savingDelay?: number;
+            gcDelay?: number;
+            skipOlderFilesOnSync?: boolean;
+            useIndexedDBAdapter?: boolean;
+            enableDebugTools?: boolean;
+            writeLogToTheFile?: boolean;
+            settingSyncFile?: string;
+            writeCredentialsForSettingSync?: boolean;
+            notifyAllSettingSyncFile?: boolean;
+            suspendFileWatching?: boolean;
+            suspendParseReplicationResult?: boolean;
+            doNotSuspendOnFetching?: boolean;
+            maxMTimeForReflectEvents?: number;
+            versionUpFlash?: string;
+            settingVersion?: number;
+            isConfigured?: boolean;
+            lastReadUpdates?: number;
+            doctorProcessedVersion?: string;
+            remoteConfigurations?: Record<string, import("../../remoteConfigurations.js").RemoteConfiguration>;
+            activeConfigurationId?: string;
+            P2P_ActiveRemoteConfigurationId?: string;
+            couchDB_URI?: string;
+            couchDB_USER?: string;
+            couchDB_PASSWORD?: string;
+            couchDB_DBNAME?: string;
+            couchDB_CustomHeaders?: string;
+            useJWT?: boolean;
+            jwtAlgorithm?: import("../../common/models/auth.type.js").JWTAlgorithm;
+            jwtKey?: string;
+            jwtKid?: string;
+            jwtSub?: string;
+            jwtExpDuration?: number;
+            useRequestAPI?: boolean;
+            accessKey?: string;
+            secretKey?: string;
+            bucket?: string;
+            region?: string;
+            endpoint?: string;
+            useCustomRequestHandler?: boolean;
+            bucketCustomHeaders?: string;
+            bucketPrefix?: string;
+            forcePathStyle?: boolean;
+            remoteType?: import("../../common/types.js").RemoteType;
+            encrypt?: boolean;
+            passphrase?: string;
+            idDerivationKey?: string;
+            usePathObfuscation?: boolean;
+            encryptInternalMetadata?: boolean;
+            E2EEAlgorithm?: import("../../common/types.js").E2EEAlgorithm;
+            hashAlg?: import("../../common/types.js").HashAlgorithm;
+            minimumChunkSize?: number;
+            customChunkSize?: number;
+            longLineThreshold?: number;
+            useSegmenter?: boolean;
+            enableChunkSplitterV2?: boolean;
+            doNotUseFixedRevisionForChunks?: boolean;
+            chunkSplitterVersion?: import("../../common/types.js").ChunkSplitterVersion;
+            useEden?: boolean;
+            maxChunksInEden?: number;
+            maxTotalLengthInEden?: number;
+            maxAgeInEden?: number;
+            tweakModified?: number | undefined;
+            checkIntegrityOnSave?: boolean;
+            useHistory?: boolean;
+            disableRequestURI?: boolean;
+            sendChunksBulk?: boolean;
+            sendChunksBulkMaxSize?: number;
+            useDynamicIterationCount?: boolean;
+            doNotPaceReplication?: boolean;
+            readChunksOnline?: boolean;
+            useOnlyLocalChunk?: boolean;
+            concurrencyOfReadChunksOnline?: number;
+            minimumIntervalOfReadChunksOnline?: number;
+            enableCompression?: boolean;
+            batch_size?: number;
+            batches_limit?: number;
+            ignoreVersionCheck?: boolean;
+            disableCheckingConfigMismatch?: boolean;
+            autoAcceptCompatibleTweak?: boolean | undefined;
+            hashCacheMaxCount?: number;
+            hashCacheMaxAmount?: number;
+            permitEmptyPassphrase?: boolean;
+            handleFilenameCaseSensitive?: boolean;
+            checkConflictOnlyOnOpen?: boolean;
+            showMergeDialogOnlyOnActive?: boolean;
+            additionalSuffixOfDatabaseName?: string | undefined;
+            useTimeouts?: boolean;
+            deleteMetadataOfDeletedFiles?: boolean;
+            automaticallyDeleteMetadataOfDeletedFiles?: number;
+            P2P_AutoAccepting?: import("../../common/types.js").AutoAccepting;
+            P2P_AutoSyncPeers?: string;
+            P2P_AutoWatchPeers?: string;
+            P2P_SyncOnReplication?: string;
+            P2P_RebuildFrom?: string;
+            P2P_AutoAcceptingPeers?: string;
+            P2P_AutoDenyingPeers?: string;
+            P2P_IsHeadless?: boolean;
+            P2P_iceServers?: readonly RTCIceServer[];
+            P2P_iceServersExpiresAt?: number;
+            P2P_Enabled?: boolean;
+            P2P_relays?: string;
+            P2P_roomID?: string;
+            P2P_passphrase?: string;
+            P2P_AppID?: string;
+            P2P_AutoStart?: boolean;
+            P2P_AutoBroadcast?: boolean;
+            P2P_DevicePeerName?: string;
+            P2P_turnServers?: string;
+            P2P_turnUsername?: string;
+            P2P_turnCredential?: string;
+            P2P_managedType?: string;
+            P2P_managedId?: string;
+            P2P_managedToken?: string;
+            P2P_maxWirePayloadBytes?: number;
+            P2P_connectionPath?: import("../../common/types.js").P2PConnectionPath;
+            P2P_useDiagRTC?: boolean;
+        }>;
         onProgress: (fromPeerId: string) => Promise<{
             error: import("../../rpc/index.js").RpcErrorShape;
         }>;

package/dist/replication/trystero/TrysteroReplicator.js

@@ -24,6 +24,9 @@ import { sha1 } from "octagonal-wheels/hash/purejs";
 import { getRelaySockets, pauseRelayReconnection, resumeRelayReconnection } from "@trystero-p2p/nostr";
 import { P2PAutomationCoordinator } from "./P2PAutomationCoordinator.js";
 import { compatGlobal } from "../../common/coreEnvFunctions.js";
+import { computeKeyedId, configuredIdKey } from "../../common/idDerivation.js";
+import { getWebCrypto } from "../../mods.js";
+import { uint8ArrayToHexString } from "../../string_and_binary/convert.js";
 import {
   fromP2PReplicationWireResult,
   toP2PReplicationWireResult,
@@ -216,7 +219,14 @@ class TrysteroReplicator {
         delete allSettings[key];
       }
     }
-    return allSettings;
+    const idSettings = this.currentSettings;
+    const idDerivationVersion = idSettings.idDerivationVersion ?? 0;
+    const idKey = configuredIdKey({ idDerivationVersion, idDerivationKey: idSettings.idDerivationKey ?? "" });
+    return {
+      ...allSettings,
+      idDerivationVersion,
+      idDerivationProof: idKey && idSettings.encrypt && idSettings.usePathObfuscation ? await computeKeyedId(idKey, "peer-agreement", fromPeerId) : ""
+    };
   }
   async handleSynchronisationRequest(fromPeerId, signal) {
     if (this._onSetup) {
@@ -706,7 +716,13 @@ ${info.lastSeq} / ${info.maxSeqInBatch})`,
       const decryptedConfig = JSON.parse(
         await decrypt(encryptedConfig, passphrase)
       );
-      return omitP2PRuntimeSettings(decryptedConfig);
+      const settings = {
+        ...decryptedConfig,
+        idDerivationVersion: decryptedConfig.idDerivationVersion ?? 0,
+        idDerivationKey: decryptedConfig.idDerivationKey ?? ""
+      };
+      configuredIdKey(settings);
+      return omitP2PRuntimeSettings(settings);
     } catch (e) {
       Logger("Error while decrypting the configuration", LOG_LEVEL_NOTICE);
       Logger(e, LOG_LEVEL_VERBOSE);
@@ -731,9 +747,12 @@ ${info.lastSeq} / ${info.maxSeqInBatch})`,
       return true;
     }
     const connection = this.server.getConnection(peerId);
-    const tweakValues = await connection.invokeRemoteObjectFunction("getTweakSettings", [this.server.serverPeerId], 5e3, signal);
+    const challengeBytes = new Uint8Array(16);
+    (await getWebCrypto()).getRandomValues(challengeBytes);
+    const challenge = uint8ArrayToHexString(challengeBytes);
+    const tweakValues = await connection.invokeRemoteObjectFunction("getTweakSettings", [challenge], 5e3, signal);
     if (signal?.aborted) return false;
-    const thisTweakValues = await this.getTweakSettings("");
+    const thisTweakValues = await this.getTweakSettings(challenge);
     if (thisTweakValues.passphrase !== tweakValues.passphrase) {
       Logger(
         "Replication cancelled: Passphrase is not matched\nCannot replicate to a remote database until the problem is resolved.",
@@ -741,6 +760,14 @@ ${info.lastSeq} / ${info.maxSeqInBatch})`,
       );
       return false;
     }
+    if (thisTweakValues.encrypt !== tweakValues.encrypt || thisTweakValues.usePathObfuscation !== tweakValues.usePathObfuscation) {
+      Logger("Replication cancelled: The encryption or path obfuscation settings do not match this peer.", logLevel);
+      return false;
+    }
+    if (thisTweakValues.encrypt && thisTweakValues.usePathObfuscation && ((thisTweakValues.idDerivationVersion ?? 0) !== (tweakValues.idDerivationVersion ?? 0) || (thisTweakValues.idDerivationProof ?? "") !== (tweakValues.idDerivationProof ?? ""))) {
+      Logger("Replication cancelled: The ID derivation settings do not match this peer.", logLevel);
+      return false;
+    }
     const tweakAssessment = assessTweakCompatibility(thisTweakValues, tweakValues);
     if (!tweakAssessment.representationDiffers) return true;
     Logger(

package/dist/services/base/AppLifecycleService.d.ts

@@ -119,6 +119,8 @@ export declare abstract class AppLifecycleService<T extends ServiceContext = Ser
     isReady(): boolean;
     /**
      * Mark the plug-in as ready.
+     * Establishing readiness emits `EVENT_APPLICATION_READY` on the context's event channel, so a host can
+     * continue work it held while the plug-in was not ready. Marking a plug-in which is already ready emits nothing.
      */
     markIsReady(): void;
     /**

package/dist/services/base/AppLifecycleService.js

@@ -1,3 +1,4 @@
+import { EVENT_APPLICATION_READY } from "../../events/coreEvents.js";
 import { handlers } from "../lib/HandlerUtils.js";
 import { ServiceBase } from "./ServiceBase.js";
 class AppLifecycleService extends ServiceBase {
@@ -107,9 +108,13 @@ class AppLifecycleService extends ServiceBase {
   }
   /**
    * Mark the plug-in as ready.
+   * Establishing readiness emits `EVENT_APPLICATION_READY` on the context's event channel, so a host can
+   * continue work it held while the plug-in was not ready. Marking a plug-in which is already ready emits nothing.
    */
   markIsReady() {
+    if (this._isReady) return;
     this._isReady = true;
+    this.context.events.emitEvent(EVENT_APPLICATION_READY);
   }
   /**
    * Reset the ready state of the plug-in.

package/dist/services/base/IService.d.ts

@@ -60,6 +60,7 @@ export interface IAPIService {
 export interface IPathService {
     id2path(id: DocumentID, entry?: EntryHasPath, stripPrefix?: boolean): FilePathWithPrefix;
     path2id(filename: FilePathWithPrefix | FilePath, prefix?: string): Promise<DocumentID>;
+    path2idWithSettings(filename: FilePathWithPrefix | FilePath, setting: Pick<RemoteDBSettings, "encrypt" | "usePathObfuscation" | "passphrase" | "handleFilenameCaseSensitive" | "idDerivationVersion" | "idDerivationKey">, prefix?: string): Promise<DocumentID>;
     getPath(entry: AnyEntry): FilePathWithPrefix;
     markChangesAreSame(old: UXFileInfo | AnyEntry | FilePathWithPrefix, newMtime: number, oldMtime: number): boolean | undefined;
     unmarkChanges(file: AnyEntry | FilePathWithPrefix | UXFileInfoStub): void;

package/dist/services/base/PathService.d.ts

@@ -1,4 +1,4 @@
-import type { DocumentID, EntryHasPath, FilePathWithPrefix, FilePath, AnyEntry, UXFileInfo, UXFileInfoStub } from "../../common/types.js";
+import type { DocumentID, EntryHasPath, FilePathWithPrefix, FilePath, AnyEntry, RemoteDBSettings, UXFileInfo, UXFileInfoStub } from "../../common/types.js";
 import type { IPathService, ISettingService } from "./IService.js";
 import { ServiceBase, type ServiceContext } from "./ServiceBase.js";
 import type { BASE_IS_NEW, EVEN, TARGET_IS_NEW } from "../../common/models/shared.const.symbols.js";
@@ -36,6 +36,8 @@ export declare abstract class PathService<T extends ServiceContext = ServiceCont
      * @param prefix The prefix to use for the document ID.
      */
     path2id(filename: FilePathWithPrefix | FilePath, prefix?: string): Promise<DocumentID>;
+    /** Convert a path using the caller's settings snapshot and this host's path normalisation. */
+    path2idWithSettings(filename: FilePathWithPrefix | FilePath, setting: Pick<RemoteDBSettings, "encrypt" | "usePathObfuscation" | "passphrase" | "handleFilenameCaseSensitive" | "idDerivationVersion" | "idDerivationKey">, prefix?: string): Promise<DocumentID>;
     getPath(entry: AnyEntry): FilePathWithPrefix;
     abstract markChangesAreSame(old: UXFileInfo | AnyEntry | FilePathWithPrefix, newMtime: number, oldMtime: number): boolean | undefined;
     abstract unmarkChanges(file: AnyEntry | FilePathWithPrefix | UXFileInfoStub): void;

package/dist/services/base/PathService.js

@@ -1,5 +1,6 @@
 import { ServiceBase } from "./ServiceBase.js";
 import { addPrefix, expandFilePathPrefix, id2path_base, path2id_base } from "../../string_and_binary/path.js";
+import { configuredIdKey } from "../../common/idDerivation.js";
 import { isInternalMetadata, stripInternalMetadataPrefix } from "../../common/typeUtils.js";
 class PathService extends ServiceBase {
   settingService;
@@ -17,10 +18,10 @@ class PathService extends ServiceBase {
     const [prefix, path] = expandFilePathPrefix(filename);
     return prefix + this.normalizePath(path);
   }
-  async _path2id(filename, obfuscatePassphrase, caseInsensitive) {
+  async _path2id(filename, obfuscatePassphrase, caseInsensitive, idDerivationKey) {
     const [prefix, path] = expandFilePathPrefix(filename);
     const fixedPath = prefix + this.normalizePath(path);
-    const out = await path2id_base(fixedPath, obfuscatePassphrase, caseInsensitive);
+    const out = await path2id_base(fixedPath, obfuscatePassphrase, caseInsensitive, idDerivationKey);
     return out;
   }
   /**
@@ -44,13 +45,17 @@ class PathService extends ServiceBase {
    * @param prefix The prefix to use for the document ID.
    */
   async path2id(filename, prefix) {
+    return this.path2idWithSettings(filename, this.settings, prefix);
+  }
+  /** Convert a path using the caller's settings snapshot and this host's path normalisation. */
+  async path2idWithSettings(filename, setting, prefix) {
     const destPath = addPrefix(filename, prefix ?? "");
-    const setting = this.settings;
     const pathObfuscationPassphrase = this.getPathObfuscationPassphrase?.() ?? (setting.usePathObfuscation ? setting.passphrase : false);
     return await this._path2id(
       destPath,
       pathObfuscationPassphrase,
-      !setting.handleFilenameCaseSensitive
+      !setting.handleFilenameCaseSensitive,
+      setting.encrypt && configuredIdKey(setting) || void 0
     );
   }
   getPath(entry) {

package/dist/services/base/SettingService.js

@@ -21,6 +21,7 @@ import {
   migrateP2PActiveRemoteConfigurationIdInPlace
 } from "../../serviceFeatures/remoteConfig.js";
 import { ConnectionStringParser } from "../../common/ConnectionString.js";
+import { configuredIdKey } from "../../common/idDerivation.js";
 class SettingService extends ServiceBase {
   deviceAndVaultName = "";
   APIService;
@@ -152,6 +153,32 @@ class SettingService extends ServiceBase {
       Object.assign(settings, patch);
       Object.assign(this.settings, patch);
     }
+    const idKey = configuredIdKey(settings);
+    if (settings.idDerivationVersion === 1) {
+      if (idKey === false) {
+        throw new Error("The configured ID derivation key is unavailable.");
+      }
+      let passphrase = this.usedPassphrase;
+      if (passphrase === "") {
+        passphrase = await this.getPassphrase(settings);
+      }
+      if (passphrase === false || passphrase === "") {
+        const message = "Failed to retrieve a passphrase for the ID derivation key. Settings were not saved.";
+        this._log(message, LOG_LEVEL_URGENT);
+        throw new Error(message);
+      }
+      const encryptedIdKey = await encryptString(idKey, passphrase + SALT_OF_PASSPHRASE);
+      if (encryptedIdKey === "") {
+        const message = "Failed to encrypt the ID derivation key. Settings were not saved.";
+        this._log(message, LOG_LEVEL_URGENT);
+        throw new Error(message);
+      }
+      settings.encryptedIdDerivationKey = encryptedIdKey;
+      settings.idDerivationKey = "";
+      this.usedPassphrase = passphrase;
+    } else {
+      settings.encryptedIdDerivationKey = "";
+    }
     settings.deviceAndVaultName = "";
     if (settings.P2P_DevicePeerName && settings.P2P_DevicePeerName.trim() !== "") {
       this._log("Saving device peer name to small config");
@@ -435,7 +462,27 @@ class SettingService extends ServiceBase {
    * @param settings The settings to decrypt.
    */
   async decryptSettings(settings) {
+    if (settings.idDerivationVersion !== 1) {
+      configuredIdKey(settings);
+    } else if (!settings.encryptedIdDerivationKey) {
+      throw new Error("The configured ID derivation key is missing or unavailable.");
+    }
     const passphrase = await this.getPassphrase(settings);
+    if (settings.idDerivationVersion === 1) {
+      if (passphrase === false || passphrase === "") {
+        throw new Error("The configured ID derivation key cannot be decrypted without a passphrase.");
+      }
+      const decryptedIdKey = await this.decryptConfigurationItem(settings.encryptedIdDerivationKey, passphrase);
+      if (decryptedIdKey === false) {
+        throw new Error("The configured ID derivation key could not be decrypted.");
+      }
+      try {
+        configuredIdKey({ ...settings, idDerivationKey: decryptedIdKey });
+      } catch {
+        throw new Error("The configured ID derivation key is invalid.");
+      }
+      settings.idDerivationKey = decryptedIdKey;
+    }
     if (passphrase === false) {
       this._log("No passphrase found for data.json! Verify configuration before syncing.", LOG_LEVEL_URGENT);
       const hasEncryptedRemoteConfigurations = Object.values(settings.remoteConfigurations || {}).some(

package/dist/settings.d.ts

@@ -6,8 +6,9 @@
 export { DEFAULT_SETTINGS, NEW_VAULT_SETTINGS, P2P_DEFAULT_SETTINGS, SETTINGS_SCHEMA_DEFAULTS, createNewVaultSettings, } from "./common/models/setting.const.defaults.js";
 export { PREFERRED_BASE, PREFERRED_JOURNAL_SYNC, PREFERRED_SETTING_CLOUDANT, PREFERRED_SETTING_SELF_HOSTED, } from "./common/models/setting.const.preferred.js";
 export { CURRENT_SETTING_VERSION } from "./common/models/setting.const.js";
+export { deriveIdKey, deriveOrImportIdKey, formatIdRecoveryCode, configuredIdKey, ID_DERIVATION_VERSION, ID_RECOVERY_CODE_PREFIX, } from "./common/idDerivation.js";
 export { prepareSettingsForLoad, SettingsMigrationReviewCodes, type PreparedSettings, type SettingsMigrationReviewCode, type SettingsMigrationReviewReason, type SettingsMigrationState, } from "./common/models/setting.lifecycle.js";
 export { assessTweakCompatibility } from "./common/models/tweak.compatibility.js";
 export type { TweakAssessment, TweakAssessmentEntry, TweakAssessmentRelation, TweakAssessmentValue, TweakTransition, TweakTransitionReason, } from "./common/models/tweak.compatibility.js";
 export type { TweakReconstruction, TweakValues } from "./common/models/tweak.definition.js";
-export type { ObsidianLiveSyncSettings, RemoteDBSettings, RemoteTypeSettings, } from "./common/models/setting.type.js";
+export type { ObsidianLiveSyncSettings, RemoteDBSettings, RemoteTypeSettings } from "./common/models/setting.type.js";