Tizian 「ティツィアーン」
3bc0bae6e3
ADR 0017's step 1, on libsodium (sodium 4.1.0+1, whose build hook compiles the libsodium 1.0.22 it ships: a C compiler and make wherever it builds): - Argon2id (64 MiB, 3 passes, kept with the account and never below that) makes a master key, which libsodium's KDF splits into SRP's secret (x) and the key-encryption key. - The account's X25519 and Ed25519 key pairs, their private halves wrapped with XChaCha20-Poly1305 under the KEK and under the recovery key, bound to their public keys. - A 24-word BIP-39 recovery phrase (the English list, MIT) and the recovery key derived from it. - Data keys sealed to the account with crypto_box_seal, bound to their IDs; content in ADR 0002's envelope, encrypted with a data key and signed with Ed25519 (detached), bound to a context the caller names. - Secrets in libsodium's guarded memory where its API takes them. - Tests: libsodium's Argon2id known answers, BIP-39's English vectors, round trips and every refusal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
112 lines
4.8 KiB
YAML
112 lines
4.8 KiB
YAML
# The Halkyon project: every app and the packages they share, one pub workspace.
|
|
#
|
|
# `_` is the conventional name of a pub workspace's root, which is never published or
|
|
# imported, so the naming lint doesn't apply to it.
|
|
name: _ # ignore: package_names
|
|
publish_to: none
|
|
|
|
environment:
|
|
sdk: '^3.13.0'
|
|
|
|
# Every package of every Halkyon app and the packages they share (ADR 0015): one
|
|
# resolution, one lockfile, one version of each dependency across the apps.
|
|
workspace:
|
|
- apps/learn/halkyon_learn_client
|
|
- apps/learn/halkyon_learn_server
|
|
- apps/learn/halkyon_learn_flutter
|
|
- apps/learn/halkyon_learn_curator
|
|
- apps/todo/halkyon_todo_client
|
|
- apps/todo/halkyon_todo_server
|
|
- apps/todo/halkyon_todo_flutter
|
|
- packages/halkyon_app
|
|
- packages/halkyon_base_client
|
|
- packages/halkyon_base_server
|
|
- packages/halkyon_core
|
|
- packages/halkyon_interop
|
|
- packages/halkyon_keys
|
|
- packages/halkyon_ui
|
|
- packages/halkyon_ui/example
|
|
|
|
dev_dependencies:
|
|
# The tools' (tool/check.dart, tool/release.dart) options, and their tests (test/).
|
|
args: ^2.7.0
|
|
# The release tool's checksums, its calls to Forgejo's API, and the pubspecs it reads.
|
|
crypto: ^3.0.7
|
|
http: ^1.6.0
|
|
# Referenced by analysis_options.yaml in this directory.
|
|
leancode_lint: ^27.0.0
|
|
# Runs scripts across the workspace's packages (`melos:` below): `dart run melos …`.
|
|
melos: ^8.9.0
|
|
path: ^1.9.1
|
|
test: ^1.31.1
|
|
yaml: ^3.1.4
|
|
|
|
dependency_overrides:
|
|
# Learn's flutter_launcher_icons (0.14.4, its latest, from June 2025) asks for
|
|
# cli_util ^0.4.1, Melos for 0.5 or later. Of cli_util it uses only the logger
|
|
# (`Logger.standard`, `Logger.verbose`, `Ansi`, `Progress`), the same in 0.5.2.
|
|
# Drop this once flutter_launcher_icons allows 0.5.
|
|
cli_util: ^0.5.2
|
|
# The offline sync package's shared part from our fork: v0.0.10 with seven
|
|
# changes. Byte payloads compared as bytes: v0.0.10 compares them byte by byte
|
|
# through a UUID parse that throws for each byte, so a sync touching a few thousand
|
|
# cards kept the server busy for minutes, answering nobody, while its client timed
|
|
# out and sent everything again (2026-10-12). onInboundMerge, called only when
|
|
# changes from the remote peer were merged: onMergeSuccess fires for a space this
|
|
# device only pushed to, so every repository read everything again after each
|
|
# save's sync (2026-10-17). A local delete, and a merge only inserting new rows
|
|
# or only deleting rows, skip the foreign key projection pass when they can't
|
|
# change it: the pass loaded nearly every synced row, 8 s for one delete and 9.5 s
|
|
# for each rating another device made, in a library of 8,000 cards (2026-10-17).
|
|
# Such a merge writes its new rows up to 1,000 to a statement: a first push of
|
|
# that library took the server 35 s, now 5 (2026-10-17). And projections are
|
|
# rebuilt once after the synced tables changed, not on every session and merge
|
|
# (upstream #150). Pinned to a signed commit of the fork's branch
|
|
# halkyon/batch-inserts (on halkyon/fast-merge-deletes, on halkyon/fast-merges,
|
|
# on halkyon/fast-deletes, on halkyon/inbound-merges, on halkyon/byte-payloads);
|
|
# drop each change once a release of the package has it.
|
|
serverpod_offline_sync:
|
|
git:
|
|
url: https://code.halkyon.app/project-halkyon/serverpod-offline-sync.git
|
|
path: packages/serverpod_offline_sync
|
|
ref: 949a6645e08af27bb61c96d7ddc2b6d145fed554
|
|
|
|
# Melos (https://melos.invertase.dev): its scripts run across the workspace's packages,
|
|
# `dart run melos run <name>`, and take Melos' filters, such as
|
|
# `--diff=origin/main --include-dependents` for only what changed since main and what
|
|
# depends on it. tool/check.dart runs the tests through them.
|
|
melos:
|
|
scripts:
|
|
analyze:
|
|
description: Analyses the whole workspace, infos fatal too, as CI does.
|
|
run: dart analyze --fatal-infos
|
|
test:dart:
|
|
description: The tests of the packages without Flutter (servers, curator, the
|
|
shared Dart packages). Each server's start a PostgreSQL of their own on one
|
|
port, so one package at a time.
|
|
exec:
|
|
command: dart test
|
|
concurrency: 1
|
|
packageFilters:
|
|
flutter: false
|
|
dirExists: test
|
|
test:flutter:
|
|
description: The tests of the Flutter packages, those needing a running server
|
|
left out (`flutter test -t requires-server` runs them by hand).
|
|
exec:
|
|
command: flutter test -x requires-server
|
|
concurrency: 1
|
|
packageFilters:
|
|
flutter: true
|
|
dirExists: test
|
|
generate:
|
|
description: Serverpod's code generation in every server package (the CLI on
|
|
the PATH, at the version CI pins).
|
|
exec:
|
|
command: serverpod --no-analytics generate
|
|
concurrency: 1
|
|
packageFilters:
|
|
fileExists: config/generator.yaml
|
|
check:
|
|
description: Every check a push has to pass (tool/check.dart).
|
|
run: dart run tool/check.dart
|