dignity.js 0.2.0 → 0.4.0

package/dist/dignity.esm.js

@@ -2454,7 +2454,8 @@ var require_message_security_service = __commonJS({
       broadcastPasswords: {},
       resolveBroadcastPassword: null,
       powSteps: 22,
-      trustedPeerKeys: {}
+      trustedPeerKeys: {},
+      kdfIterations: 1e5
     };
     function stableStringify(value) {
       if (value === null || typeof value !== "object") {
@@ -2481,6 +2482,33 @@ var require_message_security_service = __commonJS({
     function utf8ToBytes(value) {
       return naclUtil.decodeUTF8(value);
     }
+    async function deriveBroadcastKey(password, salt, iterations) {
+      const subtle = globalThis.crypto && globalThis.crypto.subtle;
+      if (subtle) {
+        const keyMaterial = await subtle.importKey(
+          "raw",
+          utf8ToBytes(password),
+          "PBKDF2",
+          false,
+          ["deriveBits"]
+        );
+        const bits = await subtle.deriveBits(
+          { name: "PBKDF2", salt, iterations, hash: "SHA-256" },
+          keyMaterial,
+          256
+        );
+        return new Uint8Array(bits);
+      }
+      try {
+        const { pbkdf2Sync } = __require("crypto");
+        return new Uint8Array(pbkdf2Sync(password, Buffer.from(salt), iterations, 32, "sha256"));
+      } catch (_ignored) {
+        return hash32(concatBytes(utf8ToBytes(password), salt));
+      }
+    }
+    function legacyBroadcastKey(password, salt) {
+      return hash32(concatBytes(utf8ToBytes(password), salt));
+    }
     function normalizePeerPublicKey(publicKey) {
       if (!publicKey || typeof publicKey !== "object") {
         throw new Error("Public key must be an object with signingPublicKey and encryptionPublicKey");
@@ -2641,7 +2669,7 @@ var require_message_security_service = __commonJS({
         if (envelope.security && envelope.security.signing && envelope.security.signing.enabled && this.options.signingEnabled) {
           this.verifySignature(envelope);
         }
-        const payload = this.decryptPayload(envelope);
+        const payload = await this.decryptPayload(envelope);
         return {
           ignored: false,
           messageType: envelope.messageType,
@@ -2706,7 +2734,8 @@ var require_message_security_service = __commonJS({
         const nonce = nacl.randomBytes(nacl.secretbox.nonceLength);
         const salt = nacl.randomBytes(16);
         const password = this.resolveBroadcastPassword(scope);
-        const key = hash32(concatBytes(utf8ToBytes(password), salt));
+        const iterations = this.options.kdfIterations || DEFAULT_SECURITY_OPTIONS.kdfIterations;
+        const key = await deriveBroadcastKey(password, salt, iterations);
         const encrypted = nacl.secretbox(plainText, nonce, key);
         return {
           payload: naclUtil.encodeBase64(encrypted),
@@ -2715,11 +2744,13 @@ var require_message_security_service = __commonJS({
             mode: "broadcast",
             scope,
             nonce: naclUtil.encodeBase64(nonce),
-            salt: naclUtil.encodeBase64(salt)
+            salt: naclUtil.encodeBase64(salt),
+            kdf: "pbkdf2",
+            kdfIterations: iterations
           }
         };
       }
-      decryptPayload(envelope) {
+      async decryptPayload(envelope) {
         const encryption = envelope.security ? envelope.security.encryption : null;
         if (!encryption || !encryption.enabled || !this.options.encryptionEnabled) {
           return envelope.payload;
@@ -2730,7 +2761,13 @@ var require_message_security_service = __commonJS({
           const password = this.resolveBroadcastPassword(scope);
           const salt = naclUtil.decodeBase64(encryption.salt);
           const nonce = naclUtil.decodeBase64(encryption.nonce);
-          const key = hash32(concatBytes(utf8ToBytes(password), salt));
+          let key;
+          if (encryption.kdf === "pbkdf2") {
+            const iterations = encryption.kdfIterations || DEFAULT_SECURITY_OPTIONS.kdfIterations;
+            key = await deriveBroadcastKey(password, salt, iterations);
+          } else {
+            key = legacyBroadcastKey(password, salt);
+          }
           const decrypted = nacl.secretbox.open(encryptedBuffer, nonce, key);
           if (!decrypted) {
             throw new Error("Unable to decrypt broadcast payload");
@@ -2824,6 +2861,8 @@ var require_message_security_service = __commonJS({
     module.exports = {
       MessageSecurityService,
       stableStringify,
+      deriveBroadcastKey,
+      legacyBroadcastKey,
       DEFAULT_SECURITY_OPTIONS
     };
   }
@@ -2961,6 +3000,21 @@ var require_dignity_p2p = __commonJS({
         if (existing.ownerId !== this.nodeId) {
           throw new Error(`Only owner ${existing.ownerId} can update object ${id}`);
         }
+        if (typeof options.expectedVersion === "number" && existing.version !== options.expectedVersion) {
+          this.emitConflict({
+            kind: "update",
+            collection: collectionName,
+            id,
+            expectedVersion: options.expectedVersion,
+            currentVersion: existing.version,
+            phase: "local"
+          });
+          const error = new Error(
+            `Version conflict on ${collectionName}/${id}: expected ${options.expectedVersion}, current ${existing.version}`
+          );
+          error.code = "VERSION_CONFLICT";
+          throw error;
+        }
         const operation = {
           opId: this.idGenerator(),
           kind: "update",
@@ -2981,6 +3035,27 @@ var require_dignity_p2p = __commonJS({
         });
         return this.read(collectionName, id);
       }
+      async updateWithRetry(collectionName, id, patchFn, options = {}) {
+        const maxAttempts = typeof options.maxAttempts === "number" ? options.maxAttempts : 5;
+        for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+          const current = this.read(collectionName, id);
+          if (!current) {
+            throw new Error(`Object ${id} does not exist in ${collectionName}`);
+          }
+          const patch = await patchFn(current);
+          try {
+            return await this.update(collectionName, id, patch, {
+              ...options,
+              expectedVersion: current.version
+            });
+          } catch (error) {
+            if (error.code !== "VERSION_CONFLICT" || attempt === maxAttempts - 1) {
+              throw error;
+            }
+          }
+        }
+        throw new Error(`Unable to update ${collectionName}/${id} after ${maxAttempts} attempts`);
+      }
       async remove(collectionName, id, options = {}) {
         const existing = this.getCollection(collectionName).get(id);
         if (!existing || existing.deletedAt) {
@@ -3258,6 +3333,29 @@ var require_dignity_p2p = __commonJS({
       isPeerBanned(peerId) {
         return this.getBanInfo(peerId) !== null;
       }
+      emitConflict(details) {
+        this.emit("conflict", details);
+      }
+      restoreRecord(collectionName, record) {
+        if (!record || !record.id) {
+          return false;
+        }
+        const collection = this.getCollection(collectionName);
+        const current = collection.get(record.id);
+        if (current && current.version >= record.version) {
+          return false;
+        }
+        collection.set(record.id, {
+          id: record.id,
+          ownerId: record.ownerId,
+          data: { ...record.data || {} },
+          createdAt: record.createdAt,
+          updatedAt: record.updatedAt,
+          deletedAt: record.deletedAt || null,
+          version: record.version
+        });
+        return true;
+      }
       applyOperation(operation) {
         if (!operation || !operation.opId || this.appliedOperations.has(operation.opId)) {
           return false;
@@ -3288,6 +3386,15 @@ var require_dignity_p2p = __commonJS({
           return false;
         }
         if (typeof operation.baseVersion === "number" && operation.baseVersion !== current.version) {
+          this.emitConflict({
+            kind: operation.kind,
+            collection: operation.collectionName,
+            id: operation.id,
+            expectedVersion: operation.baseVersion,
+            currentVersion: current.version,
+            phase: "remote",
+            operation
+          });
           return false;
         }
         if (operation.kind === "update") {
@@ -10375,6 +10482,163 @@ var require_in_memory_network = __commonJS({
   }
 });
 
+// src/persistence/indexeddb-persistence.js
+var require_indexeddb_persistence = __commonJS({
+  "src/persistence/indexeddb-persistence.js"(exports, module) {
+    var IndexedDBPersistence = class {
+      constructor({
+        dbName = "dignity",
+        storeName = "records",
+        collections = null,
+        indexedDB = typeof globalThis !== "undefined" ? globalThis.indexedDB : null
+      } = {}) {
+        this.dbName = dbName;
+        this.storeName = storeName;
+        this.collections = collections;
+        this.indexedDB = indexedDB;
+        this.node = null;
+        this.changeHandler = null;
+      }
+      recordKey(collection, id) {
+        return `${collection}:${id}`;
+      }
+      shouldPersist(collection) {
+        if (!this.collections) {
+          return true;
+        }
+        return this.collections.includes(collection);
+      }
+      openDb() {
+        if (!this.indexedDB) {
+          return Promise.reject(new Error("IndexedDB is not available"));
+        }
+        return new Promise((resolve, reject) => {
+          const request = this.indexedDB.open(this.dbName, 1);
+          request.onupgradeneeded = () => {
+            const db = request.result;
+            if (!db.objectStoreNames.contains(this.storeName)) {
+              db.createObjectStore(this.storeName, { keyPath: "key" });
+            }
+          };
+          request.onsuccess = () => resolve(request.result);
+          request.onerror = () => reject(request.error || new Error("Unable to open IndexedDB"));
+        });
+      }
+      runTransaction(mode, handler) {
+        return this.openDb().then((db) => new Promise((resolve, reject) => {
+          const transaction = db.transaction(this.storeName, mode);
+          const store = transaction.objectStore(this.storeName);
+          Promise.resolve(handler(store)).then(resolve).catch(reject);
+          transaction.oncomplete = () => db.close();
+          transaction.onerror = () => reject(transaction.error || new Error("IndexedDB transaction failed"));
+          transaction.onabort = () => reject(transaction.error || new Error("IndexedDB transaction aborted"));
+        }));
+      }
+      serializeRecord(collection, id) {
+        const record = this.node.getCollection(collection).get(id);
+        if (!record) {
+          return null;
+        }
+        return {
+          key: this.recordKey(collection, id),
+          collection,
+          id,
+          ownerId: record.ownerId,
+          data: { ...record.data },
+          createdAt: record.createdAt,
+          updatedAt: record.updatedAt,
+          deletedAt: record.deletedAt,
+          version: record.version
+        };
+      }
+      async persistRecord(collection, id) {
+        if (!this.node || !this.shouldPersist(collection)) {
+          return;
+        }
+        const serialized = this.serializeRecord(collection, id);
+        const key = this.recordKey(collection, id);
+        if (!serialized) {
+          await this.runTransaction("readwrite", (store) => new Promise((resolve, reject) => {
+            const request = store.delete(key);
+            request.onsuccess = () => resolve();
+            request.onerror = () => reject(request.error);
+          }));
+          return;
+        }
+        await this.runTransaction("readwrite", (store) => new Promise((resolve, reject) => {
+          const request = store.put(serialized);
+          request.onsuccess = () => resolve();
+          request.onerror = () => reject(request.error);
+        }));
+      }
+      persistChange(event) {
+        if (!event || !event.collection || !event.id) {
+          return;
+        }
+        this.persistRecord(event.collection, event.id).catch((error) => {
+          this.node.emit("warning", {
+            type: "persistence-failed",
+            collection: event.collection,
+            id: event.id,
+            error
+          });
+        });
+      }
+      async loadAllRecords() {
+        return this.runTransaction("readonly", (store) => new Promise((resolve, reject) => {
+          const request = store.getAll();
+          request.onsuccess = () => resolve(request.result || []);
+          request.onerror = () => reject(request.error);
+        }));
+      }
+      async hydrate() {
+        if (!this.node) {
+          throw new Error("IndexedDBPersistence requires an attached node before hydrate");
+        }
+        const storedRecords = await this.loadAllRecords();
+        for (const stored of storedRecords) {
+          if (!this.shouldPersist(stored.collection)) {
+            continue;
+          }
+          this.node.restoreRecord(stored.collection, {
+            id: stored.id,
+            ownerId: stored.ownerId,
+            data: stored.data,
+            createdAt: stored.createdAt,
+            updatedAt: stored.updatedAt,
+            deletedAt: stored.deletedAt,
+            version: stored.version
+          });
+        }
+      }
+      async attach(node) {
+        if (!node) {
+          throw new Error("IndexedDBPersistence.attach requires a DignityP2P node");
+        }
+        this.node = node;
+        await this.hydrate();
+        this.changeHandler = (event) => this.persistChange(event);
+        node.on("change", this.changeHandler);
+      }
+      async detach() {
+        if (this.node && this.changeHandler) {
+          this.node.off("change", this.changeHandler);
+        }
+        this.changeHandler = null;
+        this.node = null;
+      }
+      async clear() {
+        await this.runTransaction("readwrite", (store) => new Promise((resolve, reject) => {
+          const request = store.clear();
+          request.onsuccess = () => resolve();
+          request.onerror = () => reject(request.error);
+        }));
+      }
+    };
+    module.exports = IndexedDBPersistence;
+  }
+});
+
 // src/index.js
 var require_index = __commonJS({
   "src/index.js"(exports, module) {
@@ -10387,6 +10651,7 @@ var require_index = __commonJS({
       InMemoryNetworkHub,
       InMemoryNetworkAdapter
     } = require_in_memory_network();
+    var IndexedDBPersistence = require_indexeddb_persistence();
     var {
       DEFAULT_CLOUDFLARE_SIGNALING_URLS,
       DEFAULT_SIGNALING_FALLBACK_URLS
@@ -10405,6 +10670,7 @@ var require_index = __commonJS({
       PeerJSSignalingProvider,
       InMemoryNetworkHub,
       InMemoryNetworkAdapter,
+      IndexedDBPersistence,
       DEFAULT_CLOUDFLARE_SIGNALING_URLS,
       DEFAULT_SIGNALING_FALLBACK_URLS,
       VDF,