@vrtmrz/livesync-commonlib 0.1.41 → 0.1.43

package/dist/diagnostics/usage.js

@@ -0,0 +1,241 @@
+function asRecord(value) {
+  return value;
+}
+function getRevisionNumber(revision) {
+  const generation = revision.split("-")[0];
+  return `${generation ? Number.parseInt(generation) : 0}`;
+}
+function getRevisionHash(revision) {
+  const hash = revision.split("-")[1];
+  if (hash === void 0) throw new Error("invalid revision");
+  return hash.substring(0, 6);
+}
+function getRevisionInfos(value) {
+  if (!Array.isArray(value)) return [];
+  return value;
+}
+function getChildren(value) {
+  const children = value ?? [];
+  if (!Array.isArray(children) || !children.every((child) => typeof child === "string")) {
+    throw new Error("invalid chunk references");
+  }
+  return new Set(children);
+}
+function getStringField(value) {
+  if (typeof value !== "string") throw new Error("invalid document field");
+  return value;
+}
+async function analyseDatabaseUsage(options) {
+  const { source, signal, onProgress } = options;
+  const errors = [];
+  const documentMap = /* @__PURE__ */ new Map();
+  const chunkMap = /* @__PURE__ */ new Map();
+  const progress = { idsProcessed: 0, revisionsProcessed: 0 };
+  let startUpdateSeq;
+  let endUpdateSeq;
+  let enumerationFailed = false;
+  const reportProgress = () => onProgress?.({ ...progress });
+  const isCancelled = () => signal?.aborted === true;
+  let cancelled = isCancelled();
+  if (!cancelled) {
+    try {
+      const info = await source.info();
+      startUpdateSeq = info.update_seq;
+      if (startUpdateSeq === void 0) errors.push({ code: "start_update_seq_unavailable" });
+    } catch {
+      errors.push({ code: "start_info_read_failed" });
+    }
+    if (isCancelled()) cancelled = true;
+  }
+  try {
+    if (!cancelled && !isCancelled()) {
+      for await (const id of source.enumerateIds()) {
+        if (isCancelled()) {
+          cancelled = true;
+          break;
+        }
+        let revisionInfos = [];
+        let revisionList;
+        let revisionListReadFailed = false;
+        try {
+          revisionList = await source.get(id, { revs: true, revs_info: true, conflicts: true });
+        } catch {
+          if (!isCancelled()) {
+            errors.push({ code: "revision_list_read_failed", id });
+            revisionListReadFailed = true;
+          }
+        }
+        if (isCancelled()) {
+          cancelled = true;
+          break;
+        }
+        if (revisionList) revisionInfos = getRevisionInfos(asRecord(revisionList)._revs_info);
+        else if (!revisionListReadFailed) {
+          errors.push({ code: "revision_list_read_failed", id });
+        }
+        progress.idsProcessed++;
+        reportProgress();
+        for (const revisionInfo of revisionInfos) {
+          if (isCancelled()) {
+            cancelled = true;
+            break;
+          }
+          if (revisionInfo.status !== "available") continue;
+          const revision = typeof revisionInfo.rev === "string" ? revisionInfo.rev : void 0;
+          if (revision === void 0) {
+            errors.push({ code: "revision_document_invalid", id });
+            continue;
+          }
+          progress.revisionsProcessed++;
+          let rawDocument;
+          try {
+            rawDocument = await source.get(id, { rev: revision });
+          } catch {
+            if (isCancelled()) {
+              cancelled = true;
+              reportProgress();
+              break;
+            }
+            errors.push({ code: "revision_read_failed", id, revision });
+            reportProgress();
+            continue;
+          }
+          if (isCancelled()) {
+            cancelled = true;
+            reportProgress();
+            break;
+          }
+          if (!rawDocument) {
+            errors.push({ code: "revision_not_found", id, revision });
+            reportProgress();
+            continue;
+          }
+          try {
+            const document = asRecord(rawDocument);
+            if ("children" in document) {
+              const documentId = getStringField(document._id);
+              const documentRevision = getStringField(document._rev);
+              const path = getStringField(document.path);
+              const chunks = getChildren(document.children);
+              const revisions = documentMap.get(documentId) ?? [];
+              revisions.push({
+                id: documentId,
+                revision: documentRevision,
+                path,
+                chunks,
+                uniqueChunks: /* @__PURE__ */ new Set(),
+                sharedChunks: /* @__PURE__ */ new Set()
+              });
+              documentMap.set(documentId, revisions);
+            } else if (document.type === "leaf") {
+              const chunkId = getStringField(document._id);
+              if (!chunkMap.has(chunkId) && !document._deleted) {
+                if (typeof document.data !== "string") throw new Error("invalid chunk data");
+                chunkMap.set(chunkId, { length: document.data.length, refCount: 0 });
+              }
+            }
+          } catch {
+            errors.push({ code: "revision_document_invalid", id, revision });
+          }
+          reportProgress();
+        }
+        if (isCancelled()) cancelled = true;
+        if (cancelled) break;
+      }
+    } else if (isCancelled()) {
+      cancelled = true;
+    }
+  } catch {
+    if (isCancelled()) cancelled = true;
+    else {
+      enumerationFailed = true;
+      errors.push({ code: "id_enumeration_failed" });
+    }
+  }
+  for (const revisions of documentMap.values()) {
+    for (const document of revisions) {
+      for (const chunkId of document.chunks) {
+        const chunk = chunkMap.get(chunkId);
+        if (!chunk) continue;
+        if (chunk.refCount === 0) document.uniqueChunks.add(chunkId);
+        else document.sharedChunks.add(chunkId);
+        chunk.refCount++;
+      }
+    }
+  }
+  const totalSize = (ids) => {
+    let size = 0;
+    for (const id of ids) size += chunkMap.get(id)?.length ?? 0;
+    return size;
+  };
+  const rows = [];
+  for (const revisions of documentMap.values()) {
+    for (const document of revisions) {
+      const revisionNumber = getRevisionNumber(document.revision);
+      let revisionHash;
+      try {
+        revisionHash = getRevisionHash(document.revision);
+      } catch {
+        errors.push({ code: "revision_document_invalid", id: document.id, revision: document.revision });
+        continue;
+      }
+      rows.push({
+        title: `${document.path} (${document.revision})`,
+        id: document.id,
+        path: document.path,
+        revision: document.revision,
+        rev: revisionNumber,
+        revHash: revisionHash,
+        uniqueChunkCount: document.uniqueChunks.size,
+        sharedChunkCount: document.sharedChunks.size,
+        uniqueChunkSize: totalSize(document.uniqueChunks),
+        sharedChunkSize: totalSize(document.sharedChunks)
+      });
+    }
+  }
+  const orphanChunks = [...chunkMap.entries()].filter(([, chunk]) => chunk.refCount === 0);
+  rows.push({
+    title: "__orphan",
+    id: "__orphan",
+    path: "__orphan",
+    revision: "1-xxxxx",
+    rev: "1",
+    revHash: "xxxxx",
+    uniqueChunkCount: orphanChunks.length,
+    sharedChunkCount: 0,
+    uniqueChunkSize: orphanChunks.reduce((size, [, chunk]) => size + chunk.length, 0),
+    sharedChunkSize: 0
+  });
+  if (!cancelled && !isCancelled()) {
+    try {
+      const info = await source.info();
+      endUpdateSeq = info.update_seq;
+      if (endUpdateSeq === void 0) errors.push({ code: "end_update_seq_unavailable" });
+    } catch {
+      errors.push({ code: "end_info_read_failed" });
+    }
+  }
+  if (isCancelled()) cancelled = true;
+  const changedDuringRun = startUpdateSeq === void 0 || endUpdateSeq === void 0 ? void 0 : startUpdateSeq !== endUpdateSeq;
+  const snapshotUncertain = startUpdateSeq === void 0 || endUpdateSeq === void 0;
+  const hasDocumentRows = rows.length > 1;
+  let status;
+  if (cancelled) status = "cancelled";
+  else if (changedDuringRun === true || snapshotUncertain) status = "partial";
+  else if (enumerationFailed && !hasDocumentRows) status = "failed";
+  else if (errors.length > 0) status = "partial";
+  else status = "complete";
+  return {
+    version: 1,
+    kind: "usage",
+    status,
+    ...startUpdateSeq === void 0 ? {} : { startUpdateSeq },
+    ...endUpdateSeq === void 0 ? {} : { endUpdateSeq },
+    ...changedDuringRun === void 0 ? {} : { changedDuringRun },
+    rows,
+    errors
+  };
+}
+export {
+  analyseDatabaseUsage
+};

package/dist/hashing.d.ts

@@ -1,3 +1,4 @@
 /** Chunk ID calculation using the same hash manager as database writes. */
 export { HashManager } from "./managers/HashManager/HashManager.js";
 export type { HashManagerCoreOptions } from "./managers/HashManager/HashManagerCore.js";
+export { computeFileContentHash } from "./common/fileContentHash.js";

package/dist/hashing.js

@@ -1,4 +1,6 @@
 import { HashManager } from "./managers/HashManager/HashManager.js";
+import { computeFileContentHash } from "./common/fileContentHash.js";
 export {
-  HashManager
+  HashManager,
+  computeFileContentHash
 };

package/dist/interfaces/FileReflectionProvenance.d.ts

@@ -5,6 +5,10 @@ export type FileReflectionProvenanceRecord = {
     revision: string;
     /** Raw modification time of the saved snapshot or storage observed after reflection. */
     observedStorageMtime?: number;
+    /** Algorithm-tagged hash of the exact saved or reflected bytes, independent of revision retention. */
+    contentHash?: string;
+    /** Byte length of the hashed snapshot. Old records may omit both content fields. */
+    contentSize?: number;
 };
 export interface FileReflectionProvenance {
     get(path: FilePathWithPrefix): Promise<FileReflectionProvenanceRecord | undefined>;

package/dist/managers/EntryManager/EntryManager.d.ts

@@ -38,4 +38,5 @@ export declare class EntryManager {
     putDBEntryWithLiveBaseRevision(note: SavingEntry, baseRevision: string, onlyChunks?: boolean): Promise<false | PouchDB.Core.Response>;
     /** Store unknown ancestry as a fresh root; return the Metadata write result or `false`. */
     putDBEntryAsIndependentRoot(note: SavingEntry): Promise<false | PouchDB.Core.Response>;
+    private checkPathIdentity;
 }

package/dist/managers/EntryManager/EntryManager.js

@@ -1,6 +1,7 @@
 import {
   REMOTE_COUCHDB
 } from "../../common/types.js";
+import { assertDatabasePathIdentity } from "../../pouchdb/pathIdentityCompatibility.js";
 import {
   deleteDBEntryByPath,
   getDBEntryByPath,
@@ -65,21 +66,29 @@ class EntryManager {
     return await getDBEntryFromMeta(this.serviceHost, this, meta, dump, waitForReady, localOnly);
   }
   async deleteDBEntry(path, opt) {
+    await this.checkPathIdentity();
     return await deleteDBEntryByPath(this.serviceHost, this, path, opt);
   }
   async storeDeletionAtRevision(path, baseRevision) {
+    await this.checkPathIdentity();
     return await storeDeletionByPathAtRevision(this.serviceHost, this, path, baseRevision);
   }
   async putDBEntry(note, onlyChunks, conflictBaseRev) {
+    await this.checkPathIdentity();
     return await putDBEntry(this.serviceHost, this, note, onlyChunks, conflictBaseRev);
   }
   async putDBEntryWithLiveBaseRevision(note, baseRevision, onlyChunks) {
+    await this.checkPathIdentity();
     return await putDBEntryWithLiveBaseRevision(this.serviceHost, this, note, baseRevision, onlyChunks);
   }
   /** Store unknown ancestry as a fresh root; return the Metadata write result or `false`. */
   async putDBEntryAsIndependentRoot(note) {
+    await this.checkPathIdentity();
     return await putDBEntryAsIndependentRoot(this.serviceHost, this, note);
   }
+  async checkPathIdentity() {
+    await assertDatabasePathIdentity(this.localDatabase, this.options.settingService.currentSettings(), true);
+  }
 }
 export {
   EntryManager

package/dist/pouchdb/StreamingFetch.d.ts

@@ -36,7 +36,9 @@ export declare class StreamingFetchFailure extends Error {
 }
 export declare function isRetryableStreamingFetchFailure(error: unknown): error is StreamingFetchFailure;
 /** Check remote feature requirements before Fast Fetch opens or resets the local database. */
-export declare function checkRemoteFeaturesForInitialSync(remoteDbUrl: string, authHeader: string, customHeaders?: Record<string, string>): Promise<void>;
+export declare function checkRemoteFeaturesForInitialSync(remoteDbUrl: string, authHeader: string, customHeaders?: Record<string, string>, settings?: {
+    pathNormalizationVersion?: number;
+}): Promise<void>;
 export type FetchChangesForInitialSyncProgress = {
     totalFetched: number;
     totalValidFetched: number;

package/dist/pouchdb/StreamingFetch.js

@@ -2,6 +2,7 @@ import { _fetch } from "../common/coreEnvFunctions.js";
 import { LOG_LEVEL_VERBOSE, Logger } from "octagonal-wheels/common/logger";
 import { VERSIONING_DOCID } from "../common/types.js";
 import { assessRemoteFeatureDocument, describeRemoteFeatureRejection } from "./remoteFeatureCompatibility.js";
+import { assertMatchingPathIdentityFeature } from "./pathIdentityCompatibility.js";
 const FAST_FETCH_CHANGES_PAGE_LIMIT = 1e4;
 const FAST_FETCH_CHANGES_PAGE_TIMEOUT_MS = 1e3;
 class StreamingFetchFailure extends Error {
@@ -75,7 +76,7 @@ async function readResponseText(response, operation) {
     throw transportFailure(operation, error);
   }
 }
-async function checkRemoteFeaturesForInitialSync(remoteDbUrl, authHeader, customHeaders) {
+async function checkRemoteFeaturesForInitialSync(remoteDbUrl, authHeader, customHeaders, settings = {}) {
   const headers = new Headers(customHeaders);
   headers.set("Accept", "application/json");
   headers.set("Authorization", authHeader);
@@ -97,6 +98,7 @@ async function checkRemoteFeaturesForInitialSync(remoteDbUrl, authHeader, custom
   const row = result.rows[0];
   if (result.total_rows === 0 && row.error === "not_found") return;
   const assessment = assessRemoteFeatureDocument(row.doc);
+  assertMatchingPathIdentityFeature(row.doc, settings);
   if (assessment.status === "supported" || assessment.status === "older-generation") return;
   throw new StreamingFetchFailure("protocol", describeRemoteFeatureRejection(assessment), false);
 }

package/dist/pouchdb/encryption.d.ts

@@ -1,12 +1,14 @@
+import { Logger } from "../common/logger.js";
 import { type EntryDoc, type AnyEntry, type EntryLeaf, type DocumentID, type E2EEAlgorithm } from "../common/types.js";
 import { encryptWorker, decryptWorker, encryptHKDFWorker, decryptHKDFWorker } from "#worker";
 export declare const encrypt: typeof encryptWorker;
 export declare const decrypt: typeof decryptWorker;
 export declare const encryptHKDF: typeof encryptHKDFWorker;
 export declare const decryptHKDF: typeof decryptHKDFWorker;
+export declare function isEncryptedMeta<T extends AnyEntry>(doc: T): boolean;
 export declare let preprocessOutgoing: (doc: AnyEntry | EntryLeaf) => Promise<AnyEntry | EntryLeaf>;
 export declare let preprocessIncoming: (doc: EntryDoc) => Promise<EntryDoc>;
-export declare function getConfiguredFunctionsForEncryption(passphrase: string, useDynamicIterationCount: boolean, migrationDecrypt: boolean, getPBKDF2Salt: () => Promise<Uint8Array<ArrayBuffer>>, algorithm: E2EEAlgorithm, encryptInternalMetadata?: boolean): {
+export declare function getConfiguredFunctionsForEncryption(passphrase: string, useDynamicIterationCount: boolean, migrationDecrypt: boolean, getPBKDF2Salt: () => Promise<Uint8Array<ArrayBuffer>>, algorithm: E2EEAlgorithm, encryptInternalMetadata?: boolean, log?: typeof Logger): {
     incoming: (doc: AnyEntry | EntryLeaf) => Promise<AnyEntry | EntryLeaf>;
     outgoing: (doc: EntryDoc) => Promise<AnyEntry | EntryLeaf>;
 };

package/dist/pouchdb/encryption.js

@@ -32,20 +32,20 @@ function getEncryptionVersion(data) {
   }
   return EncryptionVersions.UNENCRYPTED;
 }
-async function tryDecryptV1AsFallback(encryptedData, passphrase, useDynamicIterationCount) {
+async function tryDecryptV1AsFallback(encryptedData, passphrase, useDynamicIterationCount, log = Logger) {
   try {
     return await decrypt(encryptedData, passphrase, useDynamicIterationCount);
   } catch (ex) {
     try {
-      Logger(
+      log(
         "Failed to decrypt with V1 method. Fallback to disable useDynamicIterationCount.",
         LOG_LEVEL_VERBOSE
       );
-      Logger(ex, LOG_LEVEL_VERBOSE);
+      log(ex, LOG_LEVEL_VERBOSE);
       return await decrypt(encryptedData, passphrase, false);
     } catch (ex2) {
-      Logger("Completely failed to decrypt with V1 method.", LOG_LEVEL_VERBOSE);
-      Logger(ex2, LOG_LEVEL_VERBOSE);
+      log("Completely failed to decrypt with V1 method.", LOG_LEVEL_VERBOSE);
+      log(ex2, LOG_LEVEL_VERBOSE);
       return false;
     }
   }
@@ -153,7 +153,7 @@ async function incomingEncryptHKDF(doc, passphrase, useDynamicIterationCount, ge
   }
   return saveDoc;
 }
-async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase, useDynamicIterationCount, getPBKDF2Salt) {
+async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase, useDynamicIterationCount, getPBKDF2Salt, log) {
   const loadDoc = {
     ...doc
   };
@@ -165,21 +165,26 @@ async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase,
         loadDoc.data = await decryptHKDF(loadDoc.data, passphrase, pbkdf2salt);
         delete loadDoc.e_;
       } else if (encryptionVersion === EncryptionVersions.ENCRYPTED) {
-        const decryptedData = await tryDecryptV1AsFallback(loadDoc.data, passphrase, useDynamicIterationCount);
+        const decryptedData = await tryDecryptV1AsFallback(
+          loadDoc.data,
+          passphrase,
+          useDynamicIterationCount,
+          log
+        );
         if (decryptedData === false) {
-          Logger(MESSAGE_FALLBACK_DECRYPT_FAILED, LOG_LEVEL_NOTICE);
+          log(MESSAGE_FALLBACK_DECRYPT_FAILED, LOG_LEVEL_NOTICE);
           throw new Error(MESSAGE_FALLBACK_DECRYPT_FAILED);
         }
         loadDoc.data = decryptedData;
         delete loadDoc.e_;
       } else if (encryptionVersion === EncryptionVersions.UNENCRYPTED) {
       } else {
-        Logger("Unknown encryption version. Cannot decrypt.", LOG_LEVEL_NOTICE);
+        log("Unknown encryption version. Cannot decrypt.", LOG_LEVEL_NOTICE);
         throw new Error("Unknown encryption version. Cannot decrypt.");
       }
     } catch (ex) {
-      Logger(DECRYPTION_HKDF_FAILED, LOG_LEVEL_NOTICE);
-      Logger(ex);
+      log(DECRYPTION_HKDF_FAILED, LOG_LEVEL_NOTICE);
+      log(ex);
       throw ex;
     }
   }
@@ -192,16 +197,16 @@ async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase,
           loadDoc[key] = metadata[key];
         }
       } catch (ex) {
-        Logger(`${DECRYPTION_HKDF_FAILED} on Path`, LOG_LEVEL_NOTICE);
-        Logger(ex);
+        log(`${DECRYPTION_HKDF_FAILED} on Path`, LOG_LEVEL_NOTICE);
+        log(ex);
         throw ex;
       }
     } else {
       const path = getPath(loadDoc);
       if (isPathProbablyObfuscated(path)) {
-        const decryptedPath = await tryDecryptV1AsFallback(path, passphrase, useDynamicIterationCount);
+        const decryptedPath = await tryDecryptV1AsFallback(path, passphrase, useDynamicIterationCount, log);
         if (decryptedPath === false) {
-          Logger(`${MESSAGE_FALLBACK_DECRYPT_FAILED} on Path`, LOG_LEVEL_NOTICE);
+          log(`${MESSAGE_FALLBACK_DECRYPT_FAILED} on Path`, LOG_LEVEL_NOTICE);
           throw new Error(MESSAGE_FALLBACK_DECRYPT_FAILED);
         }
         loadDoc.path = decryptedPath;
@@ -215,7 +220,8 @@ async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase,
       const decryptedEden = await tryDecryptV1AsFallback(
         loadDoc.eden[EDEN_ENCRYPTED_KEY].data,
         passphrase,
-        useDynamicIterationCount
+        useDynamicIterationCount,
+        log
       );
       if (decryptedEden === false) throw new Error(MESSAGE_FALLBACK_DECRYPT_FAILED);
       readEden = {
@@ -224,8 +230,8 @@ async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase,
       };
       edenDecrypted = true;
     } catch (ex) {
-      Logger(`${DECRYPTION_FALLBACK_FAILED} on Eden`, LOG_LEVEL_NOTICE);
-      Logger(ex);
+      log(`${DECRYPTION_FALLBACK_FAILED} on Eden`, LOG_LEVEL_NOTICE);
+      log(ex);
       throw ex;
     }
   }
@@ -243,8 +249,8 @@ async function outgoingDecryptHKDF(doc, migrationDecrypt, decrypted, passphrase,
       };
       edenDecrypted = true;
     } catch (ex) {
-      Logger(`${DECRYPTION_HKDF_FAILED} on Eden`, LOG_LEVEL_NOTICE);
-      Logger(ex);
+      log(`${DECRYPTION_HKDF_FAILED} on Eden`, LOG_LEVEL_NOTICE);
+      log(ex);
       throw ex;
     }
   }
@@ -296,7 +302,7 @@ async function incomingEncryptV1(doc, passphrase, useDynamicIterationCount) {
   }
   return saveDoc;
 }
-async function outgoingDecryptV1(doc, migrationDecrypt, decrypted, passphrase, useDynamicIterationCount) {
+async function outgoingDecryptV1(doc, migrationDecrypt, decrypted, passphrase, useDynamicIterationCount, log) {
   const loadDoc = {
     ...doc
   };
@@ -361,15 +367,15 @@ async function outgoingDecryptV1(doc, migrationDecrypt, decrypted, passphrase, u
           if (migrationDecrypt && ex2 instanceof SyntaxError) {
             return loadDoc;
           }
-          Logger("Decryption failed.", LOG_LEVEL_NOTICE);
-          Logger(ex2, LOG_LEVEL_VERBOSE);
-          Logger(`id:${loadDoc._id}-${loadDoc._rev?.substring(0, 10)}`, LOG_LEVEL_VERBOSE);
+          log("Decryption failed.", LOG_LEVEL_NOTICE);
+          log(ex2, LOG_LEVEL_VERBOSE);
+          log(`id:${loadDoc._id}-${loadDoc._rev?.substring(0, 10)}`, LOG_LEVEL_VERBOSE);
           throw ex2;
         }
       } else {
-        Logger("Decryption failed.", LOG_LEVEL_NOTICE);
-        Logger(ex, LOG_LEVEL_VERBOSE);
-        Logger(`id:${loadDoc._id}-${loadDoc._rev?.substring(0, 10)}`, LOG_LEVEL_VERBOSE);
+        log("Decryption failed.", LOG_LEVEL_NOTICE);
+        log(ex, LOG_LEVEL_VERBOSE);
+        log(`id:${loadDoc._id}-${loadDoc._rev?.substring(0, 10)}`, LOG_LEVEL_VERBOSE);
         throw ex;
       }
     }
@@ -382,7 +388,7 @@ let preprocessOutgoing = async (doc) => {
 let preprocessIncoming = async (doc) => {
   return await Promise.resolve(doc);
 };
-function getConfiguredFunctionsForEncryption(passphrase, useDynamicIterationCount, migrationDecrypt, getPBKDF2Salt, algorithm, encryptInternalMetadata = false) {
+function getConfiguredFunctionsForEncryption(passphrase, useDynamicIterationCount, migrationDecrypt, getPBKDF2Salt, algorithm, encryptInternalMetadata = false, log = Logger) {
   const decryptedCache = /* @__PURE__ */ new Map();
   const incoming = (doc) => algorithm === E2EEAlgorithms.V2 ? incomingEncryptHKDF(doc, passphrase, useDynamicIterationCount, getPBKDF2Salt, encryptInternalMetadata) : incomingEncryptV1(doc, passphrase, useDynamicIterationCount);
   const outgoing = (doc) => algorithm !== E2EEAlgorithms.ForceV1 ? outgoingDecryptHKDF(
@@ -391,8 +397,9 @@ function getConfiguredFunctionsForEncryption(passphrase, useDynamicIterationCoun
     decryptedCache,
     passphrase,
     useDynamicIterationCount,
-    getPBKDF2Salt
-  ) : outgoingDecryptV1(doc, migrationDecrypt, decryptedCache, passphrase, useDynamicIterationCount);
+    getPBKDF2Salt,
+    log
+  ) : outgoingDecryptV1(doc, migrationDecrypt, decryptedCache, passphrase, useDynamicIterationCount, log);
   return {
     incoming,
     outgoing
@@ -459,6 +466,7 @@ export {
   encrypt,
   encryptHKDF,
   getConfiguredFunctionsForEncryption,
+  isEncryptedMeta,
   preprocessIncoming,
   preprocessOutgoing,
   shouldDecryptEden,

package/dist/pouchdb/pathIdentityCompatibility.d.ts

@@ -0,0 +1,8 @@
+import { type EntryDoc } from "../common/types.js";
+type PathIdentitySettings = {
+    pathNormalizationVersion?: number;
+};
+export declare function assertMatchingPathIdentityFeature(document: unknown, settings: PathIdentitySettings): void;
+/** Refuse an implicit migration. A fresh database may declare its identity before its first Metadata write. */
+export declare function assertDatabasePathIdentity(database: PouchDB.Database<EntryDoc>, settings: PathIdentitySettings, declare?: boolean): Promise<void>;
+export {};

package/dist/pouchdb/pathIdentityCompatibility.js

@@ -0,0 +1,64 @@
+import { VERSIONING_DOCID } from "../common/types.js";
+import { getPathNormalizationVersion } from "../common/pathNormalization.js";
+import {
+  assessRemoteFeatureDocument,
+  NFC_PATH_IDENTITY_FEATURE,
+  REMOTE_FEATURE_GENERATION
+} from "./remoteFeatureCompatibility.js";
+import { isErrorOfMissingDoc } from "./utils_couchdb.js";
+import { bumpRemoteVersion } from "./negotiation.js";
+function assertMatchingPathIdentityFeature(document, settings) {
+  const assessment = assessRemoteFeatureDocument(document);
+  const declared = assessment.status === "supported" && assessment.usedFeatures.includes(NFC_PATH_IDENTITY_FEATURE);
+  if (declared !== (getPathNormalizationVersion(settings) === 1)) {
+    throw new Error(
+      "The database and settings use different path identity versions. Rebuild from the authoritative Vault or Fetch with matching settings before synchronising."
+    );
+  }
+}
+async function hasMetadata(database) {
+  let startkey;
+  for (; ; ) {
+    const result = await database.allDocs({
+      include_docs: true,
+      limit: 100,
+      ...startkey ? { startkey, skip: 1 } : {}
+    });
+    for (const row of result.rows) {
+      if (row.doc?.type === "plain" || row.doc?.type === "newnote") return true;
+    }
+    if (result.rows.length < 100) return false;
+    startkey = result.rows[result.rows.length - 1].id;
+  }
+}
+async function assertDatabasePathIdentity(database, settings, declare = false) {
+  let document;
+  try {
+    document = await database.get(VERSIONING_DOCID);
+  } catch (error) {
+    if (!isErrorOfMissingDoc(error)) throw error;
+  }
+  const assessment = assessRemoteFeatureDocument(document);
+  const declared = assessment.status === "supported" && assessment.usedFeatures.includes(NFC_PATH_IDENTITY_FEATURE);
+  if (getPathNormalizationVersion(settings) === 0) {
+    if (declared) assertMatchingPathIdentityFeature(document, settings);
+    return;
+  }
+  if (declared) return;
+  if (await hasMetadata(database)) {
+    try {
+      document = await database.get(VERSIONING_DOCID);
+    } catch (error) {
+      if (!isErrorOfMissingDoc(error)) throw error;
+    }
+    assertMatchingPathIdentityFeature(document, settings);
+    return;
+  }
+  if (declare && !await bumpRemoteVersion(database, REMOTE_FEATURE_GENERATION, [NFC_PATH_IDENTITY_FEATURE])) {
+    throw new Error("The database path identity could not be declared. Synchronisation has been stopped.");
+  }
+}
+export {
+  assertDatabasePathIdentity,
+  assertMatchingPathIdentityFeature
+};

package/dist/pouchdb/remoteFeatureCompatibility.d.ts

@@ -1,6 +1,7 @@
 export declare const REMOTE_FEATURE_GENERATION = 13;
 export declare const ENCRYPTED_INTERNAL_METADATA_FEATURE = "encrypted-internal-metadata-v1";
 export declare const INDEPENDENT_ID_DERIVATION_FEATURE = "independent-id-derivation-v1";
+export declare const NFC_PATH_IDENTITY_FEATURE = "nfc-path-identity-v1";
 export declare const supportedFeatures: Set<string>;
 export declare function requiredRemoteFeatures(setting: {
     encrypt?: boolean;
@@ -9,6 +10,7 @@ export declare function requiredRemoteFeatures(setting: {
     encryptInternalMetadata?: boolean;
     idDerivationVersion: 0 | 1;
     idDerivationKey: string;
+    pathNormalizationVersion?: number;
 }): string[];
 export declare function usesEncryptedInternalMetadata(setting: {
     encrypt?: boolean;

package/dist/pouchdb/remoteFeatureCompatibility.js

@@ -1,12 +1,19 @@
 import { E2EEAlgorithms, VERSIONING_DOCID } from "../common/types.js";
 import { configuredIdKey } from "../common/idDerivation.js";
+import { getPathNormalizationVersion } from "../common/pathNormalization.js";
 const REMOTE_FEATURE_GENERATION = 13;
 const ENCRYPTED_INTERNAL_METADATA_FEATURE = "encrypted-internal-metadata-v1";
 const INDEPENDENT_ID_DERIVATION_FEATURE = "independent-id-derivation-v1";
-const supportedFeatures = /* @__PURE__ */ new Set([ENCRYPTED_INTERNAL_METADATA_FEATURE, INDEPENDENT_ID_DERIVATION_FEATURE]);
+const NFC_PATH_IDENTITY_FEATURE = "nfc-path-identity-v1";
+const supportedFeatures = /* @__PURE__ */ new Set([
+  ENCRYPTED_INTERNAL_METADATA_FEATURE,
+  INDEPENDENT_ID_DERIVATION_FEATURE,
+  NFC_PATH_IDENTITY_FEATURE
+]);
 function requiredRemoteFeatures(setting) {
   const features = [];
   if (usesEncryptedInternalMetadata(setting)) features.push(ENCRYPTED_INTERNAL_METADATA_FEATURE);
+  if (getPathNormalizationVersion(setting) === 1) features.push(NFC_PATH_IDENTITY_FEATURE);
   if (setting.encrypt && configuredIdKey(setting)) features.push(INDEPENDENT_ID_DERIVATION_FEATURE);
   return features;
 }
@@ -54,6 +61,7 @@ function describeRemoteFeatureRejection(assessment) {
 export {
   ENCRYPTED_INTERNAL_METADATA_FEATURE,
   INDEPENDENT_ID_DERIVATION_FEATURE,
+  NFC_PATH_IDENTITY_FEATURE,
   REMOTE_FEATURE_GENERATION,
   assessRemoteFeatureDocument,
   describeRemoteFeatureRejection,