chore(release): publish

- @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]
 - @standardnotes/[email protected]

packages/api/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.26.31](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/api
+
 ## [1.26.30](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-23)
 
 **Note:** Version bump only for package @standardnotes/api

packages/api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/api",
-  "version": "1.26.30",
+  "version": "1.26.31",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/clipper/CHANGELOG.md

@@ -3,6 +3,22 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.1.115](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
+## [1.1.114](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
+## [1.1.113](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
+## [1.1.112](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/clipper
+
 ## [1.1.111](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
 
 **Note:** Version bump only for package @standardnotes/clipper

packages/clipper/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@standardnotes/clipper",
   "description": "Web clipper browser extension for Standard Notes",
-  "version": "1.1.111",
+  "version": "1.1.115",
   "private": true,
   "scripts": {
     "build-mv2": "yarn clean && webpack --config ./webpack.config.prod.js",

packages/desktop/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.108.46](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+### Reverts
+
+* Revert "chore: upgrade desktop deps" ([ef2d1b9](https://github.com/standardnotes/app/commit/ef2d1b9228c90a9cb9cf88535526a312bb28fca4))
+
+## [3.108.45](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/desktop
+
+## [3.108.44](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/desktop
+
+## [3.108.43](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/desktop
+
 ## [3.108.42](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
 
 **Note:** Version bump only for package @standardnotes/desktop

packages/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@standardnotes/desktop",
   "main": "./app/dist/index.js",
-  "version": "3.108.42",
+  "version": "3.108.46",
   "license": "AGPL-3.0-or-later",
   "author": "Standard Notes.",
   "private": true,

packages/encryption/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.21.54](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/encryption
+
 ## [1.21.53](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-23)
 
 **Note:** Version bump only for package @standardnotes/encryption

packages/encryption/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/encryption",
-  "version": "1.21.53",
+  "version": "1.21.54",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/encryption/src/Domain/Operator/004/UseCase/KeySystem/CreateRandomKeySystemRootKey.ts

@@ -3,7 +3,7 @@ import { V004Algorithm } from '../../../../Algorithm'
 import {
   KeySystemRootKeyInterface,
   KeySystemRootKeyParamsInterface,
-  KeySystemRootKeyPasswordType,
+  KeySystemPasswordType,
 } from '@standardnotes/models'
 import { ProtocolVersion } from '@standardnotes/common'
 import { DeriveKeySystemRootKeyUseCase } from './DeriveKeySystemRootKey'
@@ -20,7 +20,7 @@ export class CreateRandomKeySystemRootKey {
 
     const keyParams: KeySystemRootKeyParamsInterface = {
       systemIdentifier: dto.systemIdentifier,
-      passwordType: KeySystemRootKeyPasswordType.Randomized,
+      passwordType: KeySystemPasswordType.Randomized,
       creationTimestamp: new Date().getTime(),
       seed,
       version,

packages/encryption/src/Domain/Operator/004/UseCase/KeySystem/CreateUserInputKeySystemRootKey.ts

@@ -4,7 +4,7 @@ import {
   KeySystemIdentifier,
   KeySystemRootKeyInterface,
   KeySystemRootKeyParamsInterface,
-  KeySystemRootKeyPasswordType,
+  KeySystemPasswordType,
 } from '@standardnotes/models'
 import { ProtocolVersion } from '@standardnotes/common'
 import { DeriveKeySystemRootKeyUseCase } from './DeriveKeySystemRootKey'
@@ -19,7 +19,7 @@ export class CreateUserInputKeySystemRootKey {
 
     const keyParams: KeySystemRootKeyParamsInterface = {
       systemIdentifier: dto.systemIdentifier,
-      passwordType: KeySystemRootKeyPasswordType.UserInputted,
+      passwordType: KeySystemPasswordType.UserInputted,
       creationTimestamp: new Date().getTime(),
       seed,
       version,

packages/filepicker/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.28.63](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/filepicker
+
 ## [1.28.62](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-23)
 
 **Note:** Version bump only for package @standardnotes/filepicker

packages/filepicker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/filepicker",
-  "version": "1.28.62",
+  "version": "1.28.63",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/files/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.16.9](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/files
+
 ## [1.16.8](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-23)
 
 **Note:** Version bump only for package @standardnotes/files

packages/files/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/files",
-  "version": "1.16.8",
+  "version": "1.16.9",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/mobile/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [3.56.26](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/mobile
+
+## [3.56.25](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/mobile
+
+## [3.56.24](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/mobile
+
+## [3.56.23](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/mobile
+
+## [3.56.22](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
+
+**Note:** Version bump only for package @standardnotes/mobile
+
 ## [3.56.21](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
 
 **Note:** Version bump only for package @standardnotes/mobile

packages/mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/mobile",
-  "version": "3.56.21",
+  "version": "3.56.26",
   "author": "Standard Notes.",
   "private": true,
   "license": "AGPL-3.0-or-later",

packages/mobile/src/ReceivedSharedItemsHandler.ts

@@ -144,7 +144,7 @@ export class ReceivedSharedItemsHandler {
 
   sendFileToWebView = async (item: ReceivedAndroidFile | ReceivedIosFile) => {
     const path = isReceivedAndroidFile(item) ? item.contentUri : item.path
-    const data = await readFile(path, 'base64')
+    const data = await readFile(decodeURIComponent(path), 'base64')
     const file = {
       name: item.fileName || item.path,
       data,

packages/models/CHANGELOG.md

@@ -3,6 +3,10 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.46.13](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/models
+
 ## [1.46.12](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-23)
 
 **Note:** Version bump only for package @standardnotes/models

packages/models/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/models",
-  "version": "1.46.12",
+  "version": "1.46.13",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/models/src/Domain/Local/KeyParams/KeySystemPasswordType.ts

@@ -1,4 +1,4 @@
-export enum KeySystemRootKeyPasswordType {
+export enum KeySystemPasswordType {
   UserInputted = 'user_inputted',
   Randomized = 'randomized',
 }

packages/models/src/Domain/Local/KeyParams/KeySystemRootKeyParamsInterface.ts

@@ -1,6 +1,6 @@
 import { ProtocolVersion } from '@standardnotes/common'
 import { KeySystemIdentifier } from '../../Syncable/KeySystemRootKey/KeySystemIdentifier'
-import { KeySystemRootKeyPasswordType } from './KeySystemRootKeyPasswordType'
+import { KeySystemPasswordType } from './KeySystemPasswordType'
 
 /**
  * Key params are public data that contain information about how a root key was created.
@@ -11,6 +11,6 @@ export interface KeySystemRootKeyParamsInterface {
   systemIdentifier: KeySystemIdentifier
   seed: string
   version: ProtocolVersion
-  passwordType: KeySystemRootKeyPasswordType
+  passwordType: KeySystemPasswordType
   creationTimestamp: number
 }

packages/models/src/Domain/Runtime/Collection/Collection.spec.ts

@@ -0,0 +1,127 @@
+import {
+  Collection,
+  DecryptedCollectionElement,
+  DeletedCollectionElement,
+  EncryptedCollectionElement,
+} from './Collection'
+import { FullyFormedPayloadInterface } from '../../Abstract/Payload'
+
+class TestCollection<P extends FullyFormedPayloadInterface = FullyFormedPayloadInterface> extends Collection<
+  P,
+  DecryptedCollectionElement,
+  EncryptedCollectionElement,
+  DeletedCollectionElement
+> {}
+
+describe('Collection', () => {
+  let collection: TestCollection
+
+  beforeEach(() => {
+    collection = new TestCollection()
+  })
+
+  it('should initialize correctly', () => {
+    expect(collection.map).toEqual({})
+    expect(collection.typedMap).toEqual({})
+    expect(collection.referenceMap).toBeDefined()
+    expect(collection.conflictMap).toBeDefined()
+  })
+
+  it('should set and get element correctly', () => {
+    const testElement = {
+      uuid: 'test-uuid',
+      content_type: 'test-type',
+      content: {},
+      references: [],
+    } as unknown as FullyFormedPayloadInterface
+
+    collection.set(testElement)
+    const element = collection.find('test-uuid')
+
+    expect(element).toBe(testElement)
+  })
+
+  it('should check existence of an element correctly', () => {
+    const testElement = {
+      uuid: 'test-uuid',
+      content_type: 'test-type',
+      content: {},
+      references: [],
+    } as unknown as FullyFormedPayloadInterface
+
+    collection.set(testElement)
+    const hasElement = collection.has('test-uuid')
+
+    expect(hasElement).toBe(true)
+  })
+
+  it('should return all elements', () => {
+    const testElement1 = {
+      uuid: 'test-uuid-1',
+      content_type: 'test-type',
+      content: {},
+      references: [],
+    } as unknown as FullyFormedPayloadInterface
+
+    const testElement2 = {
+      uuid: 'test-uuid-2',
+      content_type: 'test-type',
+      content: {},
+      references: [],
+    } as unknown as FullyFormedPayloadInterface
+
+    collection.set(testElement1)
+    collection.set(testElement2)
+
+    const allElements = collection.all()
+
+    expect(allElements).toEqual([testElement1, testElement2])
+  })
+
+  it('should add uuid to invalidsIndex if element is error decrypting', () => {
+    const testElement = {
+      uuid: 'test-uuid',
+      content_type: 'test-type',
+      content: 'encrypted content',
+      errorDecrypting: true,
+    } as unknown as FullyFormedPayloadInterface
+
+    collection.set(testElement)
+
+    expect(collection.invalidsIndex.has(testElement.uuid)).toBe(true)
+  })
+
+  it('should add uuid to invalidsIndex if element is encrypted', () => {
+    const testElement = {
+      uuid: 'test-uuid',
+      content_type: 'test-type',
+      content: 'encrypted content',
+    } as unknown as FullyFormedPayloadInterface
+
+    collection.set(testElement)
+
+    expect(collection.invalidsIndex.has(testElement.uuid)).toBe(true)
+  })
+
+  it('should remove uuid from invalidsIndex if element is not encrypted', () => {
+    const testElement1 = {
+      uuid: 'test-uuid-1',
+      content_type: 'test-type',
+      content: 'encrypted content',
+      errorDecrypting: true,
+    } as unknown as FullyFormedPayloadInterface
+
+    const testElement2 = {
+      uuid: 'test-uuid-1',
+      content_type: 'test-type',
+      content: {},
+      references: [],
+    } as unknown as FullyFormedPayloadInterface
+
+    collection.set(testElement1)
+    expect(collection.invalidsIndex.has(testElement1.uuid)).toBe(true)
+
+    collection.set(testElement2)
+    expect(collection.invalidsIndex.has(testElement2.uuid)).toBe(false)
+  })
+})

packages/models/src/Domain/Runtime/Collection/Collection.ts

@@ -59,7 +59,7 @@ export abstract class Collection<
   }
 
   isErrorDecryptingElement = (e: Decrypted | Encrypted | Deleted): e is Encrypted => {
-    return this.isEncryptedElement(e) && e.errorDecrypting === true
+    return this.isEncryptedElement(e)
   }
 
   isDeletedElement = (e: Decrypted | Encrypted | Deleted): e is Deleted => {
@@ -78,10 +78,10 @@ export abstract class Collection<
     conflictMapCopy?: UuidMap,
   ) {
     if (copy) {
-      this.map = mapCopy!
-      this.typedMap = typedMapCopy!
-      this.referenceMap = referenceMapCopy!
-      this.conflictMap = conflictMapCopy!
+      this.map = mapCopy as Record<string, Element>
+      this.typedMap = typedMapCopy as Record<string, Element[]>
+      this.referenceMap = referenceMapCopy as UuidMap
+      this.conflictMap = conflictMapCopy as UuidMap
     } else {
       this.referenceMap = new UuidMap()
       this.conflictMap = new UuidMap()

packages/models/src/Domain/Syncable/VaultListing/VaultListing.ts

@@ -2,7 +2,7 @@ import { ConflictStrategy, DecryptedItem } from '../../Abstract/Item'
 import { DecryptedPayloadInterface } from '../../Abstract/Payload'
 import { HistoryEntryInterface } from '../../Runtime/History'
 import { KeySystemRootKeyParamsInterface } from '../../Local/KeyParams/KeySystemRootKeyParamsInterface'
-import { KeySystemRootKeyPasswordType } from '../../Local/KeyParams/KeySystemRootKeyPasswordType'
+import { KeySystemPasswordType } from '../../Local/KeyParams/KeySystemPasswordType'
 import { SharedVaultListingInterface, VaultListingInterface } from './VaultListingInterface'
 import { VaultListingContent } from './VaultListingContent'
 import { KeySystemRootKeyStorageMode } from '../KeySystemRootKey/KeySystemRootKeyStorageMode'
@@ -44,7 +44,7 @@ export class VaultListing extends DecryptedItem<VaultListingContent> implements
     return incomingKeyTimestamp > baseKeyTimestamp ? ConflictStrategy.KeepApply : ConflictStrategy.KeepBase
   }
 
-  get keyPasswordType(): KeySystemRootKeyPasswordType {
+  get keyPasswordType(): KeySystemPasswordType {
     return this.rootKeyParams.passwordType
   }
 

packages/models/src/Domain/Syncable/VaultListing/VaultListingInterface.ts

@@ -1,6 +1,6 @@
 import { KeySystemIdentifier } from '../KeySystemRootKey/KeySystemIdentifier'
 import { KeySystemRootKeyParamsInterface } from '../../Local/KeyParams/KeySystemRootKeyParamsInterface'
-import { KeySystemRootKeyPasswordType } from '../../Local/KeyParams/KeySystemRootKeyPasswordType'
+import { KeySystemPasswordType } from '../../Local/KeyParams/KeySystemPasswordType'
 import { KeySystemRootKeyStorageMode } from '../KeySystemRootKey/KeySystemRootKeyStorageMode'
 import { VaultListingSharingInfo } from './VaultListingSharingInfo'
 import { VaultListingContent } from './VaultListingContent'
@@ -17,7 +17,7 @@ export interface VaultListingInterface extends DecryptedItemInterface<VaultListi
 
   sharing?: VaultListingSharingInfo
 
-  get keyPasswordType(): KeySystemRootKeyPasswordType
+  get keyPasswordType(): KeySystemPasswordType
   isSharedVaultListing(): this is SharedVaultListingInterface
 
   get key_system_identifier(): undefined

packages/models/src/Domain/index.ts

@@ -37,7 +37,7 @@ export * from './Device/Platform'
 
 export * from './Local/KeyParams/RootKeyParamsInterface'
 export * from './Local/KeyParams/KeySystemRootKeyParamsInterface'
-export * from './Local/KeyParams/KeySystemRootKeyPasswordType'
+export * from './Local/KeyParams/KeySystemPasswordType'
 export * from './Local/RootKey/KeychainTypes'
 export * from './Local/RootKey/RootKeyContent'
 export * from './Local/RootKey/RootKeyInterface'

packages/releases/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.4.398](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/releases
+
+## [1.4.397](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/releases
+
+## [1.4.396](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/releases
+
+## [1.4.395](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/releases
+
+## [1.4.394](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
+
+**Note:** Version bump only for package @standardnotes/releases
+
 ## [1.4.393](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
 
 **Note:** Version bump only for package @standardnotes/releases

packages/releases/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/releases",
-  "version": "1.4.393",
+  "version": "1.4.398",
   "license": "AGPL-3.0-or-later",
   "main": "dist/releases.json",
   "types": "dist/index.d.ts",

packages/services/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.63.11](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/services
+
+## [1.63.10](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/services
+
+## [1.63.9](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/services
+
 ## [1.63.8](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
 
 **Note:** Version bump only for package @standardnotes/services

packages/services/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/services",
-  "version": "1.63.8",
+  "version": "1.63.11",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/services/src/Domain/Application/ApplicationInterface.ts

@@ -1,3 +1,5 @@
+import { VaultUserServiceInterface, VaultInviteServiceInterface } from '@standardnotes/services'
+import { VaultLockServiceInterface } from './../VaultLock/VaultLockServiceInterface'
 import { HistoryServiceInterface } from './../History/HistoryServiceInterface'
 import { InternalEventBusInterface } from './../Internal/InternalEventBusInterface'
 import { PreferenceServiceInterface } from './../Preferences/PreferenceServiceInterface'
@@ -5,7 +7,7 @@ import { AsymmetricMessageServiceInterface } from './../AsymmetricMessage/Asymme
 import { SyncOptions } from './../Sync/SyncOptions'
 import { ImportDataReturnType } from './../Mutator/ImportDataUseCase'
 import { ChallengeServiceInterface } from './../Challenge/ChallengeServiceInterface'
-import { VaultServiceInterface } from './../Vaults/VaultServiceInterface'
+import { VaultServiceInterface } from '../Vault/VaultServiceInterface'
 import { ApplicationIdentifier } from '@standardnotes/common'
 import {
   BackupFile,
@@ -95,24 +97,27 @@ export interface ApplicationInterface {
     syncOptions?: SyncOptions,
   ): Promise<void>
 
-  get features(): FeaturesClientInterface
-  get componentManager(): ComponentManagerInterface
-  get items(): ItemManagerInterface
-  get mutator(): MutatorClientInterface
-  get user(): UserClientInterface
-  get files(): FilesClientInterface
-  get subscriptions(): SubscriptionManagerInterface
-  get fileBackups(): BackupServiceInterface | undefined
-  get sessions(): SessionsClientInterface
-  get homeServer(): HomeServerServiceInterface | undefined
-  get vaults(): VaultServiceInterface
-  get challenges(): ChallengeServiceInterface
   get alerts(): AlertService
   get asymmetric(): AsymmetricMessageServiceInterface
-  get preferences(): PreferenceServiceInterface
-  get events(): InternalEventBusInterface
-  get history(): HistoryServiceInterface
+  get challenges(): ChallengeServiceInterface
+  get componentManager(): ComponentManagerInterface
   get encryption(): EncryptionProviderInterface
+  get events(): InternalEventBusInterface
+  get features(): FeaturesClientInterface
+  get fileBackups(): BackupServiceInterface | undefined
+  get files(): FilesClientInterface
+  get history(): HistoryServiceInterface
+  get homeServer(): HomeServerServiceInterface | undefined
+  get items(): ItemManagerInterface
+  get mutator(): MutatorClientInterface
+  get preferences(): PreferenceServiceInterface
+  get sessions(): SessionsClientInterface
+  get subscriptions(): SubscriptionManagerInterface
+  get user(): UserClientInterface
+  get vaults(): VaultServiceInterface
+  get vaultLocks(): VaultLockServiceInterface
+  get vaultUsers(): VaultUserServiceInterface
+  get vaultInvites(): VaultInviteServiceInterface
 
   readonly identifier: ApplicationIdentifier
   readonly platform: Platform

packages/services/src/Domain/AsymmetricMessage/AsymmetricMessageService.spec.ts

@@ -1,14 +1,12 @@
+import { GetVault } from './../Vault/UseCase/GetVault'
 import { SessionsClientInterface } from './../Session/SessionsClientInterface'
 import { EncryptionProviderInterface } from './../Encryption/EncryptionProviderInterface'
 import { GetUntrustedPayload } from './UseCase/GetUntrustedPayload'
 import { GetInboundMessages } from './UseCase/GetInboundMessages'
 import { GetOutboundMessages } from './UseCase/GetOutboundMessages'
-import { SendOwnContactChangeMessage } from './UseCase/SendOwnContactChangeMessage'
 import { HandleRootKeyChangedMessage } from './UseCase/HandleRootKeyChangedMessage'
-import { GetVault } from './../Vaults/UseCase/GetVault'
 import { GetTrustedPayload } from './UseCase/GetTrustedPayload'
 import { ReplaceContactData } from './../Contacts/UseCase/ReplaceContactData'
-import { GetAllContacts } from './../Contacts/UseCase/GetAllContacts'
 import { FindContact } from './../Contacts/UseCase/FindContact'
 import { CreateOrEditContact } from './../Contacts/UseCase/CreateOrEditContact'
 import { MutatorClientInterface } from './../Mutator/MutatorClientInterface'
@@ -42,12 +40,10 @@ describe('AsymmetricMessageService', () => {
     encryption = {} as jest.Mocked<EncryptionProviderInterface>
     const createOrEditContact = {} as jest.Mocked<CreateOrEditContact>
     const findContact = {} as jest.Mocked<FindContact>
-    const getAllContacts = {} as jest.Mocked<GetAllContacts>
     const replaceContactData = {} as jest.Mocked<ReplaceContactData>
     const getTrustedPayload = {} as jest.Mocked<GetTrustedPayload>
     const getVault = {} as jest.Mocked<GetVault>
     const handleRootKeyChangedMessage = {} as jest.Mocked<HandleRootKeyChangedMessage>
-    const sendOwnContactChangedMessage = {} as jest.Mocked<SendOwnContactChangeMessage>
     const getOutboundMessagesUseCase = {} as jest.Mocked<GetOutboundMessages>
     const getInboundMessagesUseCase = {} as jest.Mocked<GetInboundMessages>
     const getUntrustedPayload = {} as jest.Mocked<GetUntrustedPayload>
@@ -68,12 +64,10 @@ describe('AsymmetricMessageService', () => {
       messageServer,
       createOrEditContact,
       findContact,
-      getAllContacts,
       replaceContactData,
       getTrustedPayload,
       getVault,
       handleRootKeyChangedMessage,
-      sendOwnContactChangedMessage,
       getOutboundMessagesUseCase,
       getInboundMessagesUseCase,
       getUntrustedPayload,

packages/services/src/Domain/AsymmetricMessage/AsymmetricMessageService.ts

@@ -22,17 +22,14 @@ import {
 import { HandleRootKeyChangedMessage } from './UseCase/HandleRootKeyChangedMessage'
 import { SessionEvent } from '../Session/SessionEvent'
 import { AsymmetricMessageServer } from '@standardnotes/api'
-import { UserKeyPairChangedEventData } from '../Session/UserKeyPairChangedEventData'
-import { SendOwnContactChangeMessage } from './UseCase/SendOwnContactChangeMessage'
 import { GetOutboundMessages } from './UseCase/GetOutboundMessages'
 import { GetInboundMessages } from './UseCase/GetInboundMessages'
-import { GetVault } from '../Vaults/UseCase/GetVault'
+import { GetVault } from '../Vault/UseCase/GetVault'
 import { AsymmetricMessageServiceInterface } from './AsymmetricMessageServiceInterface'
 import { GetUntrustedPayload } from './UseCase/GetUntrustedPayload'
 import { FindContact } from '../Contacts/UseCase/FindContact'
 import { CreateOrEditContact } from '../Contacts/UseCase/CreateOrEditContact'
 import { ReplaceContactData } from '../Contacts/UseCase/ReplaceContactData'
-import { GetAllContacts } from '../Contacts/UseCase/GetAllContacts'
 import { EncryptionProviderInterface } from '../Encryption/EncryptionProviderInterface'
 
 export class AsymmetricMessageService
@@ -46,12 +43,10 @@ export class AsymmetricMessageService
     private messageServer: AsymmetricMessageServer,
     private _createOrEditContact: CreateOrEditContact,
     private _findContact: FindContact,
-    private _getAllContacts: GetAllContacts,
     private _replaceContactData: ReplaceContactData,
     private _getTrustedPayload: GetTrustedPayload,
     private _getVault: GetVault,
     private _handleRootKeyChangedMessage: HandleRootKeyChangedMessage,
-    private _sendOwnContactChangedMessage: SendOwnContactChangeMessage,
     private _getOutboundMessagesUseCase: GetOutboundMessages,
     private _getInboundMessagesUseCase: GetInboundMessages,
     private _getUntrustedPayload: GetUntrustedPayload,
@@ -60,11 +55,26 @@ export class AsymmetricMessageService
     super(eventBus)
   }
 
+  public override deinit(): void {
+    super.deinit()
+    ;(this.messageServer as unknown) = undefined
+    ;(this.encryption as unknown) = undefined
+    ;(this.mutator as unknown) = undefined
+    ;(this._createOrEditContact as unknown) = undefined
+    ;(this._findContact as unknown) = undefined
+    ;(this._replaceContactData as unknown) = undefined
+    ;(this._getTrustedPayload as unknown) = undefined
+    ;(this._getVault as unknown) = undefined
+    ;(this._handleRootKeyChangedMessage as unknown) = undefined
+    ;(this._getOutboundMessagesUseCase as unknown) = undefined
+    ;(this._getInboundMessagesUseCase as unknown) = undefined
+    ;(this._getUntrustedPayload as unknown) = undefined
+  }
+
   async handleEvent(event: InternalEventInterface): Promise<void> {
     switch (event.type) {
       case SessionEvent.UserKeyPairChanged:
         void this.messageServer.deleteAllInboundMessages()
-        void this.sendOwnContactChangeEventToAllContacts(event.payload as UserKeyPairChangedEventData)
         break
       case SyncEvent.ReceivedAsymmetricMessages:
         void this.handleRemoteReceivedAsymmetricMessages(event.payload as SyncEventReceivedAsymmetricMessagesData)
@@ -89,31 +99,6 @@ export class AsymmetricMessageService
     await this.handleRemoteReceivedAsymmetricMessages(messages)
   }
 
-  private async sendOwnContactChangeEventToAllContacts(data: UserKeyPairChangedEventData): Promise<void> {
-    if (!data.previous) {
-      return
-    }
-
-    const contacts = this._getAllContacts.execute()
-    if (contacts.isFailed()) {
-      return
-    }
-
-    for (const contact of contacts.getValue()) {
-      if (contact.isMe) {
-        continue
-      }
-
-      await this._sendOwnContactChangedMessage.execute({
-        senderOldKeyPair: data.previous.encryption,
-        senderOldSigningKeyPair: data.previous.signing,
-        senderNewKeyPair: data.current.encryption,
-        senderNewSigningKeyPair: data.current.signing,
-        contact,
-      })
-    }
-  }
-
   sortServerMessages(messages: AsymmetricMessageServerHash[]): AsymmetricMessageServerHash[] {
     const SortedPriorityTypes = [AsymmetricMessagePayloadType.SenderKeypairChanged]
 
@@ -288,22 +273,4 @@ export class AsymmetricMessageService
   ): Promise<void> {
     await this._handleRootKeyChangedMessage.execute(trustedPayload)
   }
-
-  public override deinit(): void {
-    super.deinit()
-    ;(this.messageServer as unknown) = undefined
-    ;(this.encryption as unknown) = undefined
-    ;(this.mutator as unknown) = undefined
-    ;(this._createOrEditContact as unknown) = undefined
-    ;(this._findContact as unknown) = undefined
-    ;(this._getAllContacts as unknown) = undefined
-    ;(this._replaceContactData as unknown) = undefined
-    ;(this._getTrustedPayload as unknown) = undefined
-    ;(this._getVault as unknown) = undefined
-    ;(this._handleRootKeyChangedMessage as unknown) = undefined
-    ;(this._sendOwnContactChangedMessage as unknown) = undefined
-    ;(this._getOutboundMessagesUseCase as unknown) = undefined
-    ;(this._getInboundMessagesUseCase as unknown) = undefined
-    ;(this._getUntrustedPayload as unknown) = undefined
-  }
 }

packages/services/src/Domain/AsymmetricMessage/UseCase/HandleRootKeyChangedMessage.ts

@@ -10,7 +10,7 @@ import {
 } from '@standardnotes/models'
 
 import { ContentType } from '@standardnotes/domain-core'
-import { GetVault } from '../../Vaults/UseCase/GetVault'
+import { GetVault } from '../../Vault/UseCase/GetVault'
 import { EncryptionProviderInterface } from '../../Encryption/EncryptionProviderInterface'
 
 export class HandleRootKeyChangedMessage {

packages/services/src/Domain/AsymmetricMessage/UseCase/ResendAllMessages.ts

@@ -32,7 +32,7 @@ export class ResendAllMessages implements UseCaseInterface<void> {
 
     for (const message of messages.data.messages) {
       const recipient = this.findContact.execute({ userUuid: message.user_uuid })
-      if (recipient) {
+      if (recipient.isFailed()) {
         errors.push(`Contact not found for invite ${message.user_uuid}`)
         continue
       }
@@ -41,7 +41,7 @@ export class ResendAllMessages implements UseCaseInterface<void> {
         keys: params.keys,
         previousKeys: params.previousKeys,
         message: message,
-        recipient,
+        recipient: recipient.getValue(),
       })
 
       await this.messageServer.deleteMessage({

packages/services/src/Domain/Contacts/ContactService.ts

@@ -1,3 +1,4 @@
+import { SendOwnContactChangeMessage } from './UseCase/SendOwnContactChangeMessage'
 import { DeleteContact } from './UseCase/DeleteContact'
 import { MutatorClientInterface } from './../Mutator/MutatorClientInterface'
 import { UserKeyPairChangedEventData } from './../Session/UserKeyPairChangedEventData'
@@ -42,6 +43,7 @@ export class ContactService
     private _createOrEditContact: CreateOrEditContact,
     private _editContact: EditContact,
     private _validateItemSigner: ValidateItemSigner,
+    private _sendOwnContactChangedMessage: SendOwnContactChangeMessage,
     eventBus: InternalEventBusInterface,
   ) {
     super(eventBus)
@@ -52,11 +54,36 @@ export class ContactService
   async handleEvent(event: InternalEventInterface): Promise<void> {
     if (event.type === SessionEvent.UserKeyPairChanged) {
       const data = event.payload as UserKeyPairChangedEventData
-
       await this.selfContactManager.updateWithNewPublicKeySet({
         encryption: data.current.encryption.publicKey,
         signing: data.current.signing.publicKey,
       })
+      void this.sendOwnContactChangeEventToAllContacts(event.payload as UserKeyPairChangedEventData)
+    }
+  }
+
+  private async sendOwnContactChangeEventToAllContacts(data: UserKeyPairChangedEventData): Promise<void> {
+    if (!data.previous) {
+      return
+    }
+
+    const contacts = this._getAllContacts.execute()
+    if (contacts.isFailed()) {
+      return
+    }
+
+    for (const contact of contacts.getValue()) {
+      if (contact.isMe) {
+        continue
+      }
+
+      await this._sendOwnContactChangedMessage.execute({
+        senderOldKeyPair: data.previous.encryption,
+        senderOldSigningKeyPair: data.previous.signing,
+        senderNewKeyPair: data.current.encryption,
+        senderNewSigningKeyPair: data.current.signing,
+        contact,
+      })
     }
   }
 

packages/services/src/Domain/Contacts/UseCase/SendOwnContactChangeMessage.ts

@@ -5,7 +5,7 @@ import {
   AsymmetricMessageSenderKeypairChanged,
 } from '@standardnotes/models'
 import { PkcKeyPair } from '@standardnotes/sncrypto-common'
-import { SendMessage } from './SendMessage'
+import { SendMessage } from '../../AsymmetricMessage/UseCase/SendMessage'
 import { EncryptMessage } from '../../Encryption/UseCase/Asymmetric/EncryptMessage'
 import { Result, UseCaseInterface } from '@standardnotes/domain-core'
 

packages/services/src/Domain/Contacts/UseCase/ValidateItemSigner.ts

@@ -112,7 +112,6 @@ export class ValidateItemSigner {
     const signerPublicKey = signatureResult.publicKey
 
     const trustedContact = this.findContact.execute({ signingPublicKey: signerPublicKey })
-
     if (trustedContact.isFailed()) {
       return ItemSignatureValidationResult.NotTrusted
     }

packages/services/src/Domain/Encryption/UseCase/ItemsKey/CreateNewItemsKeyWithRollback.ts

@@ -2,24 +2,24 @@ import { ItemsKeyMutator } from '@standardnotes/encryption'
 import { MutatorClientInterface } from '../../../Mutator/MutatorClientInterface'
 import { ItemManagerInterface } from '../../../Item/ItemManagerInterface'
 import { CreateNewDefaultItemsKey } from './CreateNewDefaultItemsKey'
-import { RemoveItemsLocally } from '../../../UseCase/RemoveItemsLocally'
+import { DiscardItemsLocally } from '../../../UseCase/DiscardItemsLocally'
 import { FindDefaultItemsKey } from './FindDefaultItemsKey'
 
 export class CreateNewItemsKeyWithRollback {
   constructor(
     private mutator: MutatorClientInterface,
     private items: ItemManagerInterface,
-    private createDefaultItemsKey: CreateNewDefaultItemsKey,
-    private removeItemsLocally: RemoveItemsLocally,
-    private findDefaultItemsKey: FindDefaultItemsKey,
+    private _createDefaultItemsKey: CreateNewDefaultItemsKey,
+    private _discardItemsLocally: DiscardItemsLocally,
+    private _findDefaultItemsKey: FindDefaultItemsKey,
   ) {}
 
   async execute(): Promise<() => Promise<void>> {
-    const currentDefaultItemsKey = this.findDefaultItemsKey.execute(this.items.getDisplayableItemsKeys()).getValue()
-    const newDefaultItemsKey = await this.createDefaultItemsKey.execute()
+    const currentDefaultItemsKey = this._findDefaultItemsKey.execute(this.items.getDisplayableItemsKeys()).getValue()
+    const newDefaultItemsKey = await this._createDefaultItemsKey.execute()
 
     const rollback = async () => {
-      await this.removeItemsLocally.execute([newDefaultItemsKey])
+      await this._discardItemsLocally.execute([newDefaultItemsKey])
 
       if (currentDefaultItemsKey) {
         await this.mutator.changeItem<ItemsKeyMutator>(currentDefaultItemsKey, (mutator) => {

packages/services/src/Domain/Item/ItemManagerInterface.ts

@@ -80,7 +80,7 @@ export interface ItemManagerInterface extends AbstractService {
   ): T[]
   subItemsMatchingPredicates<T extends DecryptedItemInterface>(items: T[], predicates: PredicateInterface<T>[]): T[]
   removeAllItemsFromMemory(): Promise<void>
-  removeItemsLocally(items: AnyItemInterface[]): void
+  removeItemsFromMemory(items: AnyItemInterface[]): void
   getDirtyItems(): (DecryptedItemInterface | DeletedItemInterface)[]
   getTagLongTitle(tag: SNTag): string
   getSortedTagsForItem(item: DecryptedItemInterface<ItemContent>): SNTag[]

packages/services/src/Domain/KeySystem/KeySystemKeyManager.ts

@@ -1,3 +1,4 @@
+import { RemoveItemsFromMemory } from './../Storage/UseCase/RemoveItemsFromMemory'
 import { InternalEventHandlerInterface } from './../Internal/InternalEventHandlerInterface'
 import { MutatorClientInterface } from './../Mutator/MutatorClientInterface'
 import { ApplicationStage } from './../Application/ApplicationStage'
@@ -36,11 +37,20 @@ export class KeySystemKeyManager
     private readonly items: ItemManagerInterface,
     private readonly mutator: MutatorClientInterface,
     private readonly storage: StorageServiceInterface,
+    private readonly _removeItemsFromMemory: RemoveItemsFromMemory,
     eventBus: InternalEventBusInterface,
   ) {
     super(eventBus)
   }
 
+  public override deinit(): void {
+    ;(this.items as unknown) = undefined
+    ;(this.mutator as unknown) = undefined
+    ;(this.storage as unknown) = undefined
+    ;(this._removeItemsFromMemory as unknown) = undefined
+    super.deinit()
+  }
+
   async handleEvent(event: InternalEventInterface): Promise<void> {
     if (event.type === ApplicationEvent.ApplicationStageChanged) {
       const stage = (event.payload as ApplicationStageChangedEventPayload).stage
@@ -60,9 +70,28 @@ export class KeySystemKeyManager
     const keyPayloads = keyRawPayloads.map((rawPayload) => new DecryptedPayload<KeySystemRootKeyContent>(rawPayload))
 
     const keys = keyPayloads.map((payload) => new KeySystemRootKey(payload))
-    keys.forEach((key) => {
+
+    for (const key of keys) {
       this.rootKeyMemoryCache[key.systemIdentifier] = key
-    })
+    }
+  }
+
+  public getRootKeyFromStorageForVault(
+    keySystemIdentifier: KeySystemIdentifier,
+  ): KeySystemRootKeyInterface | undefined {
+    const payload = this.storage.getValue<DecryptedTransferPayload<KeySystemRootKeyContent>>(
+      this.storageKeyForRootKey(keySystemIdentifier),
+    )
+
+    if (!payload) {
+      return undefined
+    }
+
+    const keyPayload = new DecryptedPayload<KeySystemRootKeyContent>(payload)
+
+    const key = new KeySystemRootKey(keyPayload)
+
+    return key
   }
 
   private storageKeyForRootKey(systemIdentifier: KeySystemIdentifier): string {
@@ -73,17 +102,14 @@ export class KeySystemKeyManager
    * When the key system root key changes, we must re-encrypt all vault items keys
    * with this new key system root key (by simply re-syncing).
    */
-  public async reencryptKeySystemItemsKeysForVault(keySystemIdentifier: KeySystemIdentifier): Promise<void> {
+  public async queueVaultItemsKeysForReencryption(keySystemIdentifier: KeySystemIdentifier): Promise<void> {
     const keySystemItemsKeys = this.getKeySystemItemsKeys(keySystemIdentifier)
     if (keySystemItemsKeys.length > 0) {
       await this.mutator.setItemsDirty(keySystemItemsKeys)
     }
   }
 
-  public intakeNonPersistentKeySystemRootKey(
-    key: KeySystemRootKeyInterface,
-    storage: KeySystemRootKeyStorageMode,
-  ): void {
+  public cacheKey(key: KeySystemRootKeyInterface, storage: KeySystemRootKeyStorageMode): void {
     this.rootKeyMemoryCache[key.systemIdentifier] = key
 
     if (storage === KeySystemRootKeyStorageMode.Local) {
@@ -91,7 +117,7 @@ export class KeySystemKeyManager
     }
   }
 
-  public undoIntakeNonPersistentKeySystemRootKey(systemIdentifier: KeySystemIdentifier): void {
+  public removeKeyFromCache(systemIdentifier: KeySystemIdentifier): void {
     delete this.rootKeyMemoryCache[systemIdentifier]
     void this.storage.removeValue(this.storageKeyForRootKey(systemIdentifier))
   }
@@ -100,11 +126,11 @@ export class KeySystemKeyManager
     return this.items.getItems(ContentType.TYPES.KeySystemRootKey)
   }
 
-  public clearMemoryOfKeysRelatedToVault(vault: VaultListingInterface): void {
+  public async wipeVaultKeysFromMemory(vault: VaultListingInterface): Promise<void> {
     delete this.rootKeyMemoryCache[vault.systemIdentifier]
 
     const itemsKeys = this.getKeySystemItemsKeys(vault.systemIdentifier)
-    this.items.removeItemsLocally(itemsKeys)
+    await this._removeItemsFromMemory.execute(itemsKeys)
   }
 
   public getSyncedKeySystemRootKeysForVault(systemIdentifier: KeySystemIdentifier): KeySystemRootKeyInterface[] {
@@ -131,19 +157,6 @@ export class KeySystemKeyManager
     await this.mutator.setItemsToBeDeleted(keys)
   }
 
-  public getKeySystemRootKeyWithToken(
-    systemIdentifier: KeySystemIdentifier,
-    rootKeyToken: string,
-  ): KeySystemRootKeyInterface | undefined {
-    const keys = this.getAllKeySystemRootKeysForVault(systemIdentifier).filter((key) => key.token === rootKeyToken)
-
-    if (keys.length > 1) {
-      throw new Error('Multiple synced key system root keys found for token')
-    }
-
-    return keys[0]
-  }
-
   public getPrimaryKeySystemRootKey(systemIdentifier: KeySystemIdentifier): KeySystemRootKeyInterface | undefined {
     const keys = this.getAllKeySystemRootKeysForVault(systemIdentifier)
 

packages/services/src/Domain/KeySystem/KeySystemKeyManagerInterface.ts

@@ -16,17 +16,13 @@ export interface KeySystemKeyManagerInterface {
   getAllKeySystemRootKeysForVault(systemIdentifier: KeySystemIdentifier): KeySystemRootKeyInterface[]
   getSyncedKeySystemRootKeysForVault(systemIdentifier: KeySystemIdentifier): KeySystemRootKeyInterface[]
   getAllSyncedKeySystemRootKeys(): KeySystemRootKeyInterface[]
-  getKeySystemRootKeyWithToken(
-    systemIdentifier: KeySystemIdentifier,
-    keyIdentifier: string,
-  ): KeySystemRootKeyInterface | undefined
   getPrimaryKeySystemRootKey(systemIdentifier: KeySystemIdentifier): KeySystemRootKeyInterface | undefined
-  reencryptKeySystemItemsKeysForVault(keySystemIdentifier: KeySystemIdentifier): Promise<void>
+  queueVaultItemsKeysForReencryption(keySystemIdentifier: KeySystemIdentifier): Promise<void>
 
-  intakeNonPersistentKeySystemRootKey(key: KeySystemRootKeyInterface, storage: KeySystemRootKeyStorageMode): void
-  undoIntakeNonPersistentKeySystemRootKey(systemIdentifier: KeySystemIdentifier): void
+  cacheKey(key: KeySystemRootKeyInterface, storage: KeySystemRootKeyStorageMode): void
+  removeKeyFromCache(systemIdentifier: KeySystemIdentifier): void
 
-  clearMemoryOfKeysRelatedToVault(vault: VaultListingInterface): void
+  wipeVaultKeysFromMemory(vault: VaultListingInterface): Promise<void>
   deleteNonPersistentSystemRootKeysForVault(systemIdentifier: KeySystemIdentifier): Promise<void>
   deleteAllSyncedKeySystemRootKeys(systemIdentifier: KeySystemIdentifier): Promise<void>
 }

packages/services/src/Domain/SharedVaults/SharedVaultService.spec.ts

@@ -1,3 +1,4 @@
+import { DiscardItemsLocally } from './../UseCase/DiscardItemsLocally'
 import { InternalEventBusInterface } from './../Internal/InternalEventBusInterface'
 import { GetOwnedSharedVaults } from './UseCase/GetOwnedSharedVaults'
 import { IsVaultOwner } from './../VaultUser/UseCase/IsVaultOwner'
@@ -11,7 +12,7 @@ import { SendVaultDataChangedMessage } from './UseCase/SendVaultDataChangedMessa
 import { NotifyVaultUsersOfKeyRotation } from './UseCase/NotifyVaultUsersOfKeyRotation'
 import { HandleKeyPairChange } from './../Contacts/UseCase/HandleKeyPairChange'
 import { CreateSharedVault } from './UseCase/CreateSharedVault'
-import { GetVault } from './../Vaults/UseCase/GetVault'
+import { GetVault } from './../Vault/UseCase/GetVault'
 import { SharedVaultService } from './SharedVaultService'
 import { SyncServiceInterface } from '../Sync/SyncServiceInterface'
 import { ItemManagerInterface } from '../Item/ItemManagerInterface'
@@ -42,6 +43,7 @@ describe('SharedVaultService', () => {
     const convertToSharedVault = {} as jest.Mocked<ConvertToSharedVault>
     const deleteSharedVaultUseCase = {} as jest.Mocked<DeleteSharedVault>
     const isVaultAdmin = {} as jest.Mocked<IsVaultOwner>
+    const discardItemsLocally = {} as jest.Mocked<DiscardItemsLocally>
 
     const eventBus = {} as jest.Mocked<InternalEventBusInterface>
     eventBus.addEventHandler = jest.fn()
@@ -62,6 +64,7 @@ describe('SharedVaultService', () => {
       convertToSharedVault,
       deleteSharedVaultUseCase,
       isVaultAdmin,
+      discardItemsLocally,
       eventBus,
     )
   })

packages/services/src/Domain/SharedVaults/SharedVaultService.ts

@@ -1,3 +1,4 @@
+import { DiscardItemsLocally } from './../UseCase/DiscardItemsLocally'
 import { UserKeyPairChangedEventData } from './../Session/UserKeyPairChangedEventData'
 import { ClientDisplayableError, UserEventType } from '@standardnotes/responses'
 import {
@@ -21,13 +22,13 @@ import { InternalEventInterface } from '../Internal/InternalEventInterface'
 import { UserEventServiceEvent, UserEventServiceEventPayload } from '../UserEvent/UserEventServiceEvent'
 import { DeleteThirdPartyVault } from './UseCase/DeleteExternalSharedVault'
 import { DeleteSharedVault } from './UseCase/DeleteSharedVault'
-import { VaultServiceEvent, VaultServiceEventPayload } from '../Vaults/VaultServiceEvent'
+import { VaultServiceEvent, VaultServiceEventPayload } from '../Vault/VaultServiceEvent'
 import { ShareContactWithVault } from './UseCase/ShareContactWithVault'
 import { NotifyVaultUsersOfKeyRotation } from './UseCase/NotifyVaultUsersOfKeyRotation'
 import { CreateSharedVault } from './UseCase/CreateSharedVault'
 import { SendVaultDataChangedMessage } from './UseCase/SendVaultDataChangedMessage'
 import { ConvertToSharedVault } from './UseCase/ConvertToSharedVault'
-import { GetVault } from '../Vaults/UseCase/GetVault'
+import { GetVault } from '../Vault/UseCase/GetVault'
 import { ContentType } from '@standardnotes/domain-core'
 import { HandleKeyPairChange } from '../Contacts/UseCase/HandleKeyPairChange'
 import { FindContact } from '../Contacts/UseCase/FindContact'
@@ -55,6 +56,7 @@ export class SharedVaultService
     private _convertToSharedVault: ConvertToSharedVault,
     private _deleteSharedVault: DeleteSharedVault,
     private _isVaultAdmin: IsVaultOwner,
+    private _discardItemsLocally: DiscardItemsLocally,
     eventBus: InternalEventBusInterface,
   ) {
     super(eventBus)
@@ -132,7 +134,7 @@ export class SharedVaultService
       case UserEventType.SharedVaultItemRemoved: {
         const item = this.items.findItem(event.eventPayload.itemUuid)
         if (item) {
-          this.items.removeItemsLocally([item])
+          void this._discardItemsLocally.execute([item])
         }
         break
       }

packages/services/src/Domain/SharedVaults/UseCase/ConvertToSharedVault.ts

@@ -2,7 +2,7 @@ import { SharedVaultListingInterface, VaultListingInterface, VaultListingMutator
 import { ClientDisplayableError, isErrorResponse } from '@standardnotes/responses'
 import { SharedVaultServerInterface } from '@standardnotes/api'
 import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
-import { MoveItemsToVault } from '../../Vaults/UseCase/MoveItemsToVault'
+import { MoveItemsToVault } from '../../Vault/UseCase/MoveItemsToVault'
 import { MutatorClientInterface } from '../../Mutator/MutatorClientInterface'
 
 export class ConvertToSharedVault {

packages/services/src/Domain/SharedVaults/UseCase/CreateSharedVault.ts

@@ -7,8 +7,8 @@ import {
 import { ClientDisplayableError, isErrorResponse } from '@standardnotes/responses'
 import { SharedVaultServerInterface } from '@standardnotes/api'
 import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
-import { CreateVault } from '../../Vaults/UseCase/CreateVault'
-import { MoveItemsToVault } from '../../Vaults/UseCase/MoveItemsToVault'
+import { CreateVault } from '../../Vault/UseCase/CreateVault'
+import { MoveItemsToVault } from '../../Vault/UseCase/MoveItemsToVault'
 import { MutatorClientInterface } from '../../Mutator/MutatorClientInterface'
 
 export class CreateSharedVault {

packages/services/src/Domain/SharedVaults/UseCase/DeleteExternalSharedVault.ts

@@ -2,7 +2,7 @@ import { SyncServiceInterface } from './../../Sync/SyncServiceInterface'
 import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
 import { AnyItemInterface, VaultListingInterface } from '@standardnotes/models'
 import { MutatorClientInterface } from '../../Mutator/MutatorClientInterface'
-import { RemoveItemsLocally } from '../../UseCase/RemoveItemsLocally'
+import { DiscardItemsLocally } from '../../UseCase/DiscardItemsLocally'
 import { KeySystemKeyManagerInterface } from '../../KeySystem/KeySystemKeyManagerInterface'
 
 export class DeleteThirdPartyVault {
@@ -11,7 +11,7 @@ export class DeleteThirdPartyVault {
     private mutator: MutatorClientInterface,
     private keys: KeySystemKeyManagerInterface,
     private sync: SyncServiceInterface,
-    private removeItemsLocally: RemoveItemsLocally,
+    private _discardItemsLocally: DiscardItemsLocally,
   ) {}
 
   async execute(vault: VaultListingInterface): Promise<void> {
@@ -33,7 +33,7 @@ export class DeleteThirdPartyVault {
 
     const itemsKeys = this.keys.getKeySystemItemsKeys(vault.systemIdentifier)
 
-    await this.removeItemsLocally.execute([...vaultItems, ...itemsKeys])
+    await this._discardItemsLocally.execute([...vaultItems, ...itemsKeys])
   }
 
   private async deleteDataOwnedByThisUser(vault: VaultListingInterface): Promise<void> {

packages/services/src/Domain/SharedVaults/UseCase/DeleteSharedVault.ts

@@ -2,7 +2,7 @@ import { ClientDisplayableError, isErrorResponse } from '@standardnotes/response
 import { SharedVaultServerInterface } from '@standardnotes/api'
 import { SharedVaultListingInterface } from '@standardnotes/models'
 import { SyncServiceInterface } from '../../Sync/SyncServiceInterface'
-import { DeleteVault } from '../../Vaults/UseCase/DeleteVault'
+import { DeleteVault } from '../../Vault/UseCase/DeleteVault'
 
 export class DeleteSharedVault {
   constructor(

packages/services/src/Domain/SharedVaults/UseCase/GetSharedVaults.ts

@@ -1,4 +1,4 @@
-import { GetVaults } from './../../Vaults/UseCase/GetVaults'
+import { GetVaults } from '../../Vault/UseCase/GetVaults'
 import { Result, SyncUseCaseInterface } from '@standardnotes/domain-core'
 import { SharedVaultListingInterface } from '@standardnotes/models'
 

packages/services/src/Domain/Storage/StorageServiceInterface.ts

@@ -14,14 +14,17 @@ export interface StorageServiceInterface {
   getAllKeys(mode?: StorageValueModes): string[]
   getValue<T>(key: string, mode?: StorageValueModes, defaultValue?: T): T
   canDecryptWithKey(key: RootKeyInterface): Promise<boolean>
-  savePayload(payload: PayloadInterface): Promise<void>
-  savePayloads(decryptedPayloads: PayloadInterface[]): Promise<void>
   setValue<T>(key: string, value: T, mode?: StorageValueModes): void
   removeValue(key: string, mode?: StorageValueModes): Promise<void>
   setPersistencePolicy(persistencePolicy: StoragePersistencePolicies): Promise<void>
   clearAllData(): Promise<void>
+
+  getRawPayloads(uuids: string[]): Promise<FullyFormedTransferPayload[]>
+  savePayload(payload: PayloadInterface): Promise<void>
+  savePayloads(decryptedPayloads: PayloadInterface[]): Promise<void>
   deletePayloads(payloads: FullyFormedPayloadInterface[]): Promise<void>
   deletePayloadsWithUuids(uuids: string[]): Promise<void>
+
   clearAllPayloads(): Promise<void>
   isEphemeralSession(): boolean
 }

packages/services/src/Domain/Storage/UseCase/RemoveItemsFromMemory.spec.ts

@@ -0,0 +1,48 @@
+import { RemoveItemsFromMemory } from './RemoveItemsFromMemory'
+import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
+import { StorageServiceInterface } from '../StorageServiceInterface'
+import { PayloadManagerInterface } from '../../Payloads/PayloadManagerInterface'
+import { PayloadEmitSource, DecryptedItemInterface } from '@standardnotes/models'
+import { Uuids } from '@standardnotes/utils'
+
+describe('RemoveItemsFromMemory', () => {
+  let storage: StorageServiceInterface
+  let items: ItemManagerInterface
+  let payloads: PayloadManagerInterface
+  let removeItemsFromMemory: RemoveItemsFromMemory
+
+  beforeEach(() => {
+    storage = {
+      getRawPayloads: jest.fn().mockImplementation(() => Promise.resolve([])),
+    } as unknown as StorageServiceInterface
+
+    items = {
+      removeItemsFromMemory: jest.fn(),
+    } as unknown as ItemManagerInterface
+
+    payloads = {
+      emitPayloads: jest.fn().mockImplementation(() => Promise.resolve()),
+    } as unknown as PayloadManagerInterface
+
+    removeItemsFromMemory = new RemoveItemsFromMemory(storage, items, payloads)
+  })
+
+  it('should execute removeItemsFromMemory use case correctly', async () => {
+    const testItems: DecryptedItemInterface[] = [
+      <DecryptedItemInterface>{
+        uuid: 'uuid1',
+        content_type: 'type1',
+      },
+      <DecryptedItemInterface>{
+        uuid: 'uuid2',
+        content_type: 'type2',
+      },
+    ]
+
+    await removeItemsFromMemory.execute(testItems)
+
+    expect(items.removeItemsFromMemory).toHaveBeenCalledWith(testItems)
+    expect(storage.getRawPayloads).toHaveBeenCalledWith(Uuids(testItems))
+    expect(payloads.emitPayloads).toHaveBeenCalledWith([], PayloadEmitSource.LocalDatabaseLoaded)
+  })
+})

packages/services/src/Domain/Storage/UseCase/RemoveItemsFromMemory.ts

@@ -0,0 +1,26 @@
+import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
+import { Result, UseCaseInterface } from '@standardnotes/domain-core'
+import { StorageServiceInterface } from '../StorageServiceInterface'
+import { CreatePayload, DecryptedItemInterface, PayloadEmitSource, PayloadSource } from '@standardnotes/models'
+import { Uuids } from '@standardnotes/utils'
+import { PayloadManagerInterface } from '../../Payloads/PayloadManagerInterface'
+
+export class RemoveItemsFromMemory implements UseCaseInterface<void> {
+  constructor(
+    private storage: StorageServiceInterface,
+    private items: ItemManagerInterface,
+    private payloads: PayloadManagerInterface,
+  ) {}
+
+  async execute(items: DecryptedItemInterface[]): Promise<Result<void>> {
+    this.items.removeItemsFromMemory(items)
+
+    const rawPayloads = await this.storage.getRawPayloads(Uuids(items))
+
+    const encryptedPayloads = rawPayloads.map((payload) => CreatePayload(payload, PayloadSource.LocalDatabaseLoaded))
+
+    await this.payloads.emitPayloads(encryptedPayloads, PayloadEmitSource.LocalDatabaseLoaded)
+
+    return Result.ok()
+  }
+}

packages/services/src/Domain/UseCase/DiscardItemsLocally.ts

@@ -3,11 +3,11 @@ import { ItemManagerInterface } from '../Item/ItemManagerInterface'
 import { AnyItemInterface } from '@standardnotes/models'
 import { Uuids } from '@standardnotes/utils'
 
-export class RemoveItemsLocally {
+export class DiscardItemsLocally {
   constructor(private readonly items: ItemManagerInterface, private readonly storage: StorageServiceInterface) {}
 
   async execute(items: AnyItemInterface[]): Promise<void> {
-    this.items.removeItemsLocally(items)
+    this.items.removeItemsFromMemory(items)
 
     await this.storage.deletePayloadsWithUuids(Uuids(items))
   }

packages/services/src/Domain/Vault/UseCase/ChangeVaultKeyOptions.ts

@@ -0,0 +1,208 @@
+import { MutatorClientInterface, SyncServiceInterface } from '@standardnotes/services'
+import {
+  KeySystemPasswordType,
+  KeySystemRootKeyStorageMode,
+  VaultListingInterface,
+  VaultListingMutator,
+} from '@standardnotes/models'
+import { ChangeVaultKeyOptionsDTO } from './ChangeVaultKeyOptionsDTO'
+import { GetVault } from './GetVault'
+import { EncryptionProviderInterface } from '../../Encryption/EncryptionProviderInterface'
+import { KeySystemKeyManagerInterface } from '../../KeySystem/KeySystemKeyManagerInterface'
+import { Result, UseCaseInterface } from '@standardnotes/domain-core'
+
+export class ChangeVaultKeyOptions implements UseCaseInterface<void> {
+  constructor(
+    private mutator: MutatorClientInterface,
+    private sync: SyncServiceInterface,
+    private encryption: EncryptionProviderInterface,
+    private keys: KeySystemKeyManagerInterface,
+    private getVault: GetVault,
+  ) {}
+
+  async execute(dto: ChangeVaultKeyOptionsDTO): Promise<Result<void>> {
+    if (dto.newPasswordType) {
+      const result = await this.handleNewPasswordType(dto)
+      if (result.isFailed()) {
+        return result
+      }
+    }
+
+    if (dto.newStorageMode) {
+      const result = await this.handleNewStorageMode(dto)
+      if (result.isFailed()) {
+        return result
+      }
+    }
+
+    await this.sync.sync()
+
+    return Result.ok()
+  }
+
+  private async handleNewPasswordType(dto: ChangeVaultKeyOptionsDTO): Promise<Result<void>> {
+    if (!dto.newPasswordType) {
+      return Result.ok()
+    }
+
+    if (dto.vault.keyPasswordType === dto.newPasswordType.passwordType) {
+      return Result.fail('Vault password type is already set to this type')
+    }
+
+    if (dto.newPasswordType.passwordType === KeySystemPasswordType.UserInputted) {
+      if (!dto.newPasswordType.userInputtedPassword) {
+        return Result.fail('User inputted password is required')
+      }
+      const useStorageMode = dto.newStorageMode ?? dto.vault.keyStorageMode
+      const result = await this.changePasswordTypeToUserInputted(
+        dto.vault,
+        dto.newPasswordType.userInputtedPassword,
+        useStorageMode,
+      )
+      if (result.isFailed()) {
+        return result
+      }
+    } else if (dto.newPasswordType.passwordType === KeySystemPasswordType.Randomized) {
+      const result = await this.changePasswordTypeToRandomized(dto.vault)
+      if (result.isFailed()) {
+        return result
+      }
+    }
+
+    return Result.ok()
+  }
+
+  private async handleNewStorageMode(dto: ChangeVaultKeyOptionsDTO): Promise<Result<void>> {
+    if (!dto.newStorageMode) {
+      return Result.ok()
+    }
+
+    const result = this.getVault.execute({ keySystemIdentifier: dto.vault.systemIdentifier })
+    if (result.isFailed()) {
+      return Result.fail('Vault not found')
+    }
+
+    const latestVault = result.getValue()
+
+    if (latestVault.rootKeyParams.passwordType !== KeySystemPasswordType.UserInputted) {
+      return Result.fail('Vault uses randomized password and cannot change its storage preference')
+    }
+
+    if (dto.newStorageMode === latestVault.keyStorageMode) {
+      return Result.fail('Vault already uses this storage preference')
+    }
+
+    if (
+      dto.newStorageMode === KeySystemRootKeyStorageMode.Local ||
+      dto.newStorageMode === KeySystemRootKeyStorageMode.Ephemeral
+    ) {
+      const result = await this.changeStorageModeToLocalOrEphemeral(latestVault, dto.newStorageMode)
+      if (result.isFailed()) {
+        return result
+      }
+    } else if (dto.newStorageMode === KeySystemRootKeyStorageMode.Synced) {
+      const result = await this.changeStorageModeToSynced(latestVault)
+      if (result.isFailed()) {
+        return result
+      }
+    }
+
+    return Result.ok()
+  }
+
+  private async changePasswordTypeToUserInputted(
+    vault: VaultListingInterface,
+    userInputtedPassword: string,
+    storageMode: KeySystemRootKeyStorageMode,
+  ): Promise<Result<void>> {
+    const newRootKey = this.encryption.createUserInputtedKeySystemRootKey({
+      systemIdentifier: vault.systemIdentifier,
+      userInputtedPassword: userInputtedPassword,
+    })
+
+    if (storageMode === KeySystemRootKeyStorageMode.Synced) {
+      await this.mutator.insertItem(newRootKey, true)
+    } else {
+      this.keys.cacheKey(newRootKey, storageMode)
+    }
+
+    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+      mutator.rootKeyParams = newRootKey.keyParams
+    })
+
+    await this.keys.queueVaultItemsKeysForReencryption(vault.systemIdentifier)
+
+    return Result.ok()
+  }
+
+  private async changePasswordTypeToRandomized(vault: VaultListingInterface): Promise<Result<void>> {
+    if (vault.keyStorageMode !== KeySystemRootKeyStorageMode.Synced) {
+      this.keys.removeKeyFromCache(vault.systemIdentifier)
+
+      await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+        mutator.keyStorageMode = KeySystemRootKeyStorageMode.Synced
+      })
+    }
+
+    const newRootKey = this.encryption.createRandomizedKeySystemRootKey({
+      systemIdentifier: vault.systemIdentifier,
+    })
+
+    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+      mutator.rootKeyParams = newRootKey.keyParams
+    })
+
+    await this.mutator.insertItem(newRootKey, true)
+
+    await this.keys.queueVaultItemsKeysForReencryption(vault.systemIdentifier)
+
+    return Result.ok()
+  }
+
+  private async changeStorageModeToLocalOrEphemeral(
+    vault: VaultListingInterface,
+    newStorageMode: KeySystemRootKeyStorageMode,
+  ): Promise<Result<void>> {
+    const primaryKey = this.keys.getPrimaryKeySystemRootKey(vault.systemIdentifier)
+    if (!primaryKey) {
+      return Result.fail('No primary key found')
+    }
+
+    if (newStorageMode === KeySystemRootKeyStorageMode.Ephemeral) {
+      this.keys.removeKeyFromCache(vault.systemIdentifier)
+    }
+
+    this.keys.cacheKey(primaryKey, newStorageMode)
+    await this.keys.deleteAllSyncedKeySystemRootKeys(vault.systemIdentifier)
+
+    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+      mutator.keyStorageMode = newStorageMode
+    })
+
+    await this.sync.sync()
+
+    return Result.ok()
+  }
+
+  private async changeStorageModeToSynced(vault: VaultListingInterface): Promise<Result<void>> {
+    const allRootKeys = this.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+    const syncedRootKeys = this.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+    this.keys.removeKeyFromCache(vault.systemIdentifier)
+
+    for (const key of allRootKeys) {
+      const existingSyncedKey = syncedRootKeys.find((syncedKey) => syncedKey.token === key.token)
+      if (existingSyncedKey) {
+        continue
+      }
+
+      await this.mutator.insertItem(key)
+    }
+
+    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
+      mutator.keyStorageMode = KeySystemRootKeyStorageMode.Synced
+    })
+
+    return Result.ok()
+  }
+}

packages/services/src/Domain/Vault/UseCase/ChangeVaultKeyOptionsDTO.ts

@@ -0,0 +1,10 @@
+import { KeySystemPasswordType, KeySystemRootKeyStorageMode, VaultListingInterface } from '@standardnotes/models'
+
+export type ChangeVaultKeyOptionsDTO = {
+  vault: VaultListingInterface
+  newPasswordType:
+    | { passwordType: KeySystemPasswordType.Randomized }
+    | { passwordType: KeySystemPasswordType.UserInputted; userInputtedPassword: string }
+    | undefined
+  newStorageMode: KeySystemRootKeyStorageMode | undefined
+}

packages/services/src/Domain/Vault/UseCase/CreateVault.ts

@@ -1,8 +1,8 @@
-import { SyncServiceInterface } from './../../Sync/SyncServiceInterface'
+import { SyncServiceInterface } from '../../Sync/SyncServiceInterface'
 import { UuidGenerator } from '@standardnotes/utils'
 import {
   KeySystemRootKeyParamsInterface,
-  KeySystemRootKeyPasswordType,
+  KeySystemPasswordType,
   VaultListingContentSpecialized,
   VaultListingInterface,
   KeySystemRootKeyStorageMode,
@@ -44,9 +44,7 @@ export class CreateVault {
       keySystemIdentifier,
       vaultName: dto.vaultName,
       vaultDescription: dto.vaultDescription,
-      passwordType: dto.userInputtedPassword
-        ? KeySystemRootKeyPasswordType.UserInputted
-        : KeySystemRootKeyPasswordType.Randomized,
+      passwordType: dto.userInputtedPassword ? KeySystemPasswordType.UserInputted : KeySystemPasswordType.Randomized,
       rootKeyParams: rootKey.keyParams,
       storage: dto.storagePreference,
     })
@@ -60,7 +58,7 @@ export class CreateVault {
     keySystemIdentifier: string
     vaultName: string
     vaultDescription?: string
-    passwordType: KeySystemRootKeyPasswordType
+    passwordType: KeySystemPasswordType
     rootKeyParams: KeySystemRootKeyParamsInterface
     storage: KeySystemRootKeyStorageMode
   }): Promise<VaultListingInterface> {
@@ -109,7 +107,7 @@ export class CreateVault {
     if (dto.storagePreference === KeySystemRootKeyStorageMode.Synced) {
       await this.mutator.insertItem(newRootKey, true)
     } else {
-      this.keys.intakeNonPersistentKeySystemRootKey(newRootKey, dto.storagePreference)
+      this.keys.cacheKey(newRootKey, dto.storagePreference)
     }
 
     return newRootKey

packages/services/src/Domain/Vault/UseCase/GetVault.ts

@@ -1,5 +1,5 @@
 import { VaultListingInterface } from '@standardnotes/models'
-import { ItemManagerInterface } from './../../Item/ItemManagerInterface'
+import { ItemManagerInterface } from '../../Item/ItemManagerInterface'
 import { ContentType, Result, SyncUseCaseInterface } from '@standardnotes/domain-core'
 
 export class GetVault implements SyncUseCaseInterface<VaultListingInterface> {

packages/services/src/Domain/Vault/UseCase/RotateVaultKey.ts

@@ -3,7 +3,7 @@ import { ClientDisplayableError, isClientDisplayableError } from '@standardnotes
 import {
   KeySystemIdentifier,
   KeySystemRootKeyInterface,
-  KeySystemRootKeyPasswordType,
+  KeySystemPasswordType,
   KeySystemRootKeyStorageMode,
   VaultListingInterface,
   VaultListingMutator,
@@ -31,7 +31,7 @@ export class RotateVaultKey {
 
     let newRootKey: KeySystemRootKeyInterface | undefined
 
-    if (currentRootKey.keyParams.passwordType === KeySystemRootKeyPasswordType.UserInputted) {
+    if (currentRootKey.keyParams.passwordType === KeySystemPasswordType.UserInputted) {
       if (!params.userInputtedPassword) {
         throw new Error('Cannot rotate key system root key; user inputted password required')
       }
@@ -40,7 +40,7 @@ export class RotateVaultKey {
         systemIdentifier: params.vault.systemIdentifier,
         userInputtedPassword: params.userInputtedPassword,
       })
-    } else if (currentRootKey.keyParams.passwordType === KeySystemRootKeyPasswordType.Randomized) {
+    } else if (currentRootKey.keyParams.passwordType === KeySystemPasswordType.Randomized) {
       newRootKey = this.encryption.createRandomizedKeySystemRootKey({
         systemIdentifier: params.vault.systemIdentifier,
       })
@@ -53,7 +53,7 @@ export class RotateVaultKey {
     if (params.vault.keyStorageMode === KeySystemRootKeyStorageMode.Synced) {
       await this.mutator.insertItem(newRootKey, true)
     } else {
-      this.keys.intakeNonPersistentKeySystemRootKey(newRootKey, params.vault.keyStorageMode)
+      this.keys.cacheKey(newRootKey, params.vault.keyStorageMode)
     }
 
     await this.mutator.changeItem<VaultListingMutator>(params.vault, (mutator) => {
@@ -73,7 +73,7 @@ export class RotateVaultKey {
       errors.push(updateKeySystemItemsKeyResult)
     }
 
-    await this.keys.reencryptKeySystemItemsKeysForVault(params.vault.systemIdentifier)
+    await this.keys.queueVaultItemsKeysForReencryption(params.vault.systemIdentifier)
 
     return errors
   }

packages/services/src/Domain/Vault/VaultService.ts

@@ -3,14 +3,13 @@ import {
   DecryptedItemInterface,
   FileItem,
   KeySystemIdentifier,
-  KeySystemRootKeyPasswordType,
   KeySystemRootKeyStorageMode,
   VaultListingInterface,
   VaultListingMutator,
   isNote,
 } from '@standardnotes/models'
 import { VaultServiceInterface } from './VaultServiceInterface'
-import { ChangeVaultOptionsDTO } from './ChangeVaultOptionsDTO'
+import { ChangeVaultKeyOptionsDTO } from './UseCase/ChangeVaultKeyOptionsDTO'
 import { VaultServiceEvent, VaultServiceEventPayload } from './VaultServiceEvent'
 import { CreateVault } from './UseCase/CreateVault'
 import { AbstractService } from '../Service/AbstractService'
@@ -25,23 +24,19 @@ import { GetVault } from './UseCase/GetVault'
 import { ChangeVaultKeyOptions } from './UseCase/ChangeVaultKeyOptions'
 import { MutatorClientInterface } from '../Mutator/MutatorClientInterface'
 import { AlertService } from '../Alert/AlertService'
-import { ContentType } from '@standardnotes/domain-core'
-import { EncryptionProviderInterface } from '../Encryption/EncryptionProviderInterface'
-import { KeySystemKeyManagerInterface } from '../KeySystem/KeySystemKeyManagerInterface'
 import { GetVaults } from './UseCase/GetVaults'
+import { VaultLockServiceInterface } from '../VaultLock/VaultLockServiceInterface'
+import { Result } from '@standardnotes/domain-core'
 
 export class VaultService
   extends AbstractService<VaultServiceEvent, VaultServiceEventPayload[VaultServiceEvent]>
   implements VaultServiceInterface
 {
-  private lockMap = new Map<VaultListingInterface['uuid'], boolean>()
-
   constructor(
     private sync: SyncServiceInterface,
     private items: ItemManagerInterface,
     private mutator: MutatorClientInterface,
-    private encryption: EncryptionProviderInterface,
-    private keys: KeySystemKeyManagerInterface,
+    private vaultLocks: VaultLockServiceInterface,
     private alerts: AlertService,
     private _getVault: GetVault,
     private _getVaults: GetVaults,
@@ -49,29 +44,34 @@ export class VaultService
     private _moveItemsToVault: MoveItemsToVault,
     private _createVault: CreateVault,
     private _removeItemFromVault: RemoveItemFromVault,
-    private _deleteVaultUse: DeleteVault,
+    private _deleteVault: DeleteVault,
     private _rotateVaultKey: RotateVaultKey,
     eventBus: InternalEventBusInterface,
   ) {
     super(eventBus)
+  }
 
-    items.addObserver(
-      [ContentType.TYPES.KeySystemItemsKey, ContentType.TYPES.KeySystemRootKey, ContentType.TYPES.VaultListing],
-      () => {
-        void this.recomputeAllVaultsLockingState()
-      },
-    )
+  override deinit(): void {
+    super.deinit()
+    ;(this.sync as unknown) = undefined
+    ;(this.items as unknown) = undefined
+    ;(this.mutator as unknown) = undefined
+    ;(this.vaultLocks as unknown) = undefined
+    ;(this.alerts as unknown) = undefined
+    ;(this._getVault as unknown) = undefined
+    ;(this._getVaults as unknown) = undefined
+    ;(this._changeVaultKeyOptions as unknown) = undefined
+    ;(this._moveItemsToVault as unknown) = undefined
+    ;(this._createVault as unknown) = undefined
+    ;(this._removeItemFromVault as unknown) = undefined
+    ;(this._deleteVault as unknown) = undefined
+    ;(this._rotateVaultKey as unknown) = undefined
   }
 
   getVaults(): VaultListingInterface[] {
     return this._getVaults.execute().getValue()
   }
 
-  getLockedvaults(): VaultListingInterface[] {
-    const vaults = this.getVaults()
-    return vaults.filter((vault) => this.isVaultLocked(vault))
-  }
-
   public getVault(dto: { keySystemIdentifier: KeySystemIdentifier }): VaultListingInterface | undefined {
     const result = this._getVault.execute(dto)
     if (result.isFailed()) {
@@ -90,16 +90,12 @@ export class VaultService
     return vault
   }
 
-  async createRandomizedVault(dto: {
-    name: string
-    description?: string
-    storagePreference: KeySystemRootKeyStorageMode
-  }): Promise<VaultListingInterface> {
+  async createRandomizedVault(dto: { name: string; description?: string }): Promise<VaultListingInterface> {
     return this.createVaultWithParameters({
       name: dto.name,
       description: dto.description,
       userInputtedPassword: undefined,
-      storagePreference: dto.storagePreference,
+      storagePreference: KeySystemRootKeyStorageMode.Synced,
     })
   }
 
@@ -132,7 +128,7 @@ export class VaultService
     vault: VaultListingInterface,
     item: DecryptedItemInterface,
   ): Promise<DecryptedItemInterface | undefined> {
-    if (this.isVaultLocked(vault)) {
+    if (this.vaultLocks.isVaultLocked(vault)) {
       throw new Error('Attempting to add item to locked vault')
     }
 
@@ -162,7 +158,7 @@ export class VaultService
       throw new Error('Cannot find vault to remove item from')
     }
 
-    if (this.isVaultLocked(vault)) {
+    if (this.vaultLocks.isVaultLocked(vault)) {
       throw new Error('Attempting to remove item from locked vault')
     }
 
@@ -175,7 +171,7 @@ export class VaultService
       throw new Error('Shared vault must be deleted through SharedVaultService')
     }
 
-    const error = await this._deleteVaultUse.execute(vault)
+    const error = await this._deleteVault.execute(vault)
 
     if (isClientDisplayableError(error)) {
       return false
@@ -199,15 +195,15 @@ export class VaultService
     return updatedVault
   }
 
-  async rotateVaultRootKey(vault: VaultListingInterface): Promise<void> {
-    if (this.computeVaultLockState(vault) === 'locked') {
+  async rotateVaultRootKey(vault: VaultListingInterface, vaultPassword?: string): Promise<void> {
+    if (this.vaultLocks.isVaultLocked(vault)) {
       throw new Error('Cannot rotate root key of locked vault')
     }
 
     await this._rotateVaultKey.execute({
       vault,
       sharedVaultUuid: vault.isSharedVaultListing() ? vault.sharing.sharedVaultUuid : undefined,
-      userInputtedPassword: undefined,
+      userInputtedPassword: vaultPassword,
     })
 
     await this.notifyEventSync(VaultServiceEvent.VaultRootKeyRotated, { vault })
@@ -232,110 +228,17 @@ export class VaultService
     return this.getVault({ keySystemIdentifier: latestItem.key_system_identifier })
   }
 
-  async changeVaultOptions(dto: ChangeVaultOptionsDTO): Promise<void> {
-    if (this.isVaultLocked(dto.vault)) {
+  async changeVaultOptions(dto: ChangeVaultKeyOptionsDTO): Promise<Result<void>> {
+    if (this.vaultLocks.isVaultLocked(dto.vault)) {
       throw new Error('Attempting to change vault options on a locked vault')
     }
 
-    await this._changeVaultKeyOptions.execute(dto)
+    const result = await this._changeVaultKeyOptions.execute(dto)
 
     if (dto.newPasswordType) {
       await this.notifyEventSync(VaultServiceEvent.VaultRootKeyRotated, { vault: dto.vault })
     }
-  }
 
-  public isVaultLocked(vault: VaultListingInterface): boolean {
-    return this.lockMap.get(vault.uuid) === true
-  }
-
-  public async lockNonPersistentVault(vault: VaultListingInterface): Promise<void> {
-    if (vault.keyStorageMode === KeySystemRootKeyStorageMode.Synced) {
-      throw new Error('Vault uses synced root key and cannot be locked')
-    }
-
-    this.keys.clearMemoryOfKeysRelatedToVault(vault)
-
-    this.lockMap.set(vault.uuid, true)
-    void this.notifyEventSync(VaultServiceEvent.VaultLocked, { vault })
-  }
-
-  public async unlockNonPersistentVault(vault: VaultListingInterface, password: string): Promise<boolean> {
-    if (vault.keyPasswordType !== KeySystemRootKeyPasswordType.UserInputted) {
-      throw new Error('Vault uses randomized password and cannot be unlocked with user inputted password')
-    }
-
-    if (vault.keyStorageMode === KeySystemRootKeyStorageMode.Synced) {
-      throw new Error('Vault uses synced root key and cannot be unlocked with user inputted password')
-    }
-
-    const derivedRootKey = this.encryption.deriveUserInputtedKeySystemRootKey({
-      keyParams: vault.rootKeyParams,
-      userInputtedPassword: password,
-    })
-
-    this.keys.intakeNonPersistentKeySystemRootKey(derivedRootKey, vault.keyStorageMode)
-
-    await this.encryption.decryptErroredPayloads()
-
-    if (this.computeVaultLockState(vault) === 'locked') {
-      this.keys.undoIntakeNonPersistentKeySystemRootKey(vault.systemIdentifier)
-      return false
-    }
-
-    this.lockMap.set(vault.uuid, false)
-    void this.notifyEventSync(VaultServiceEvent.VaultUnlocked, { vault })
-
-    return true
-  }
-
-  private recomputeAllVaultsLockingState = async (): Promise<void> => {
-    const vaults = this.getVaults()
-
-    for (const vault of vaults) {
-      const locked = this.computeVaultLockState(vault) === 'locked'
-
-      if (this.lockMap.get(vault.uuid) !== locked) {
-        this.lockMap.set(vault.uuid, locked)
-
-        if (locked) {
-          void this.notifyEvent(VaultServiceEvent.VaultLocked, { vault })
-        } else {
-          void this.notifyEvent(VaultServiceEvent.VaultUnlocked, { vault })
-        }
-      }
-    }
-  }
-
-  private computeVaultLockState(vault: VaultListingInterface): 'locked' | 'unlocked' {
-    const rootKey = this.keys.getPrimaryKeySystemRootKey(vault.systemIdentifier)
-    if (!rootKey) {
-      return 'locked'
-    }
-
-    const itemsKey = this.keys.getPrimaryKeySystemItemsKey(vault.systemIdentifier)
-    if (!itemsKey) {
-      return 'locked'
-    }
-
-    return 'unlocked'
-  }
-
-  override deinit(): void {
-    super.deinit()
-    ;(this.sync as unknown) = undefined
-    ;(this.items as unknown) = undefined
-    ;(this.mutator as unknown) = undefined
-    ;(this.encryption as unknown) = undefined
-    ;(this.alerts as unknown) = undefined
-    ;(this._getVault as unknown) = undefined
-    ;(this._getVaults as unknown) = undefined
-    ;(this._changeVaultKeyOptions as unknown) = undefined
-    ;(this._moveItemsToVault as unknown) = undefined
-    ;(this._createVault as unknown) = undefined
-    ;(this._removeItemFromVault as unknown) = undefined
-    ;(this._deleteVaultUse as unknown) = undefined
-    ;(this._rotateVaultKey as unknown) = undefined
-
-    this.lockMap.clear()
+    return result
   }
 }

packages/services/src/Domain/Vault/VaultServiceEvent.ts

@@ -2,18 +2,10 @@ import { VaultListingInterface } from '@standardnotes/models'
 
 export enum VaultServiceEvent {
   VaultRootKeyRotated = 'VaultRootKeyRotated',
-  VaultUnlocked = 'VaultUnlocked',
-  VaultLocked = 'VaultLocked',
 }
 
 export type VaultServiceEventPayload = {
   [VaultServiceEvent.VaultRootKeyRotated]: {
     vault: VaultListingInterface
   }
-  [VaultServiceEvent.VaultUnlocked]: {
-    vault: VaultListingInterface
-  }
-  [VaultServiceEvent.VaultLocked]: {
-    vault: VaultListingInterface
-  }
 }

packages/services/src/Domain/Vault/VaultServiceInterface.ts

@@ -6,15 +6,12 @@ import {
 } from '@standardnotes/models'
 import { AbstractService } from '../Service/AbstractService'
 import { VaultServiceEvent, VaultServiceEventPayload } from './VaultServiceEvent'
-import { ChangeVaultOptionsDTO } from './ChangeVaultOptionsDTO'
+import { ChangeVaultKeyOptionsDTO } from './UseCase/ChangeVaultKeyOptionsDTO'
+import { Result } from '@standardnotes/domain-core'
 
 export interface VaultServiceInterface
   extends AbstractService<VaultServiceEvent, VaultServiceEventPayload[VaultServiceEvent]> {
-  createRandomizedVault(dto: {
-    name: string
-    description?: string
-    storagePreference: KeySystemRootKeyStorageMode
-  }): Promise<VaultListingInterface>
+  createRandomizedVault(dto: { name: string; description?: string }): Promise<VaultListingInterface>
   createUserInputtedPasswordVault(dto: {
     name: string
     description?: string
@@ -24,7 +21,6 @@ export interface VaultServiceInterface
 
   getVaults(): VaultListingInterface[]
   getVault(dto: { keySystemIdentifier: KeySystemIdentifier }): VaultListingInterface | undefined
-  getLockedvaults(): VaultListingInterface[]
   deleteVault(vault: VaultListingInterface): Promise<boolean>
 
   moveItemToVault(
@@ -39,9 +35,6 @@ export interface VaultServiceInterface
     vault: VaultListingInterface,
     params: { name: string; description: string },
   ): Promise<VaultListingInterface>
-  rotateVaultRootKey(vault: VaultListingInterface): Promise<void>
-  changeVaultOptions(dto: ChangeVaultOptionsDTO): Promise<void>
-
-  isVaultLocked(vault: VaultListingInterface): boolean
-  unlockNonPersistentVault(vault: VaultListingInterface, password: string): Promise<boolean>
+  rotateVaultRootKey(vault: VaultListingInterface, vaultPassword?: string): Promise<void>
+  changeVaultOptions(dto: ChangeVaultKeyOptionsDTO): Promise<Result<void>>
 }

packages/services/src/Domain/VaultInvite/VaultInviteService.ts

@@ -9,7 +9,7 @@ import { GetUntrustedPayload } from './../AsymmetricMessage/UseCase/GetUntrusted
 import { GetTrustedPayload } from './../AsymmetricMessage/UseCase/GetTrustedPayload'
 import { InviteRecord } from './InviteRecord'
 import { VaultUserServiceInterface } from './../VaultUser/VaultUserServiceInterface'
-import { GetVault } from './../Vaults/UseCase/GetVault'
+import { GetVault } from '../Vault/UseCase/GetVault'
 import { InviteToVault } from './UseCase/InviteToVault'
 import { GetVaultContacts } from '../VaultUser/UseCase/GetVaultContacts'
 import { SyncServiceInterface } from './../Sync/SyncServiceInterface'

packages/services/src/Domain/VaultLock/VaultLockService.ts

@@ -0,0 +1,133 @@
+import { GetVaults } from '../Vault/UseCase/GetVaults'
+import { KeySystemPasswordType, KeySystemRootKeyStorageMode, VaultListingInterface } from '@standardnotes/models'
+import { VaultLockServiceInterface } from './VaultLockServiceInterface'
+import { VaultLockServiceEvent, VaultLockServiceEventPayload } from './VaultLockServiceEvent'
+import { AbstractService } from '../Service/AbstractService'
+import { ItemManagerInterface } from '../Item/ItemManagerInterface'
+import { InternalEventBusInterface } from '../Internal/InternalEventBusInterface'
+import { ContentType } from '@standardnotes/domain-core'
+import { EncryptionProviderInterface } from '../Encryption/EncryptionProviderInterface'
+import { KeySystemKeyManagerInterface } from '../KeySystem/KeySystemKeyManagerInterface'
+
+export class VaultLockService
+  extends AbstractService<VaultLockServiceEvent, VaultLockServiceEventPayload[VaultLockServiceEvent]>
+  implements VaultLockServiceInterface
+{
+  private lockMap = new Map<VaultListingInterface['uuid'], boolean>()
+
+  constructor(
+    items: ItemManagerInterface,
+    private encryption: EncryptionProviderInterface,
+    private keys: KeySystemKeyManagerInterface,
+    private _getVaults: GetVaults,
+    eventBus: InternalEventBusInterface,
+  ) {
+    super(eventBus)
+
+    items.addObserver(
+      [ContentType.TYPES.KeySystemItemsKey, ContentType.TYPES.KeySystemRootKey, ContentType.TYPES.VaultListing],
+      () => {
+        void this.recomputeAllVaultsLockingState()
+      },
+    )
+  }
+
+  override deinit(): void {
+    super.deinit()
+    ;(this.encryption as unknown) = undefined
+    ;(this.keys as unknown) = undefined
+    ;(this._getVaults as unknown) = undefined
+
+    this.lockMap.clear()
+  }
+
+  public getLockedvaults(): VaultListingInterface[] {
+    const vaults = this._getVaults.execute().getValue()
+    return vaults.filter((vault) => this.isVaultLocked(vault))
+  }
+
+  public isVaultLocked(vault: VaultListingInterface): boolean {
+    return this.lockMap.get(vault.uuid) === true
+  }
+
+  public isVaultLockable(vault: VaultListingInterface): boolean {
+    return vault.keyPasswordType === KeySystemPasswordType.UserInputted
+  }
+
+  public async lockNonPersistentVault(vault: VaultListingInterface): Promise<void> {
+    if (vault.keyStorageMode === KeySystemRootKeyStorageMode.Synced) {
+      throw new Error('Vault uses synced key storage and cannot be locked')
+    }
+
+    if (vault.keyPasswordType !== KeySystemPasswordType.UserInputted) {
+      throw new Error('Vault uses randomized password and cannot be locked')
+    }
+
+    await this.keys.wipeVaultKeysFromMemory(vault)
+
+    this.lockMap.set(vault.uuid, true)
+
+    void this.notifyEventSync(VaultLockServiceEvent.VaultLocked, { vault })
+  }
+
+  public async unlockNonPersistentVault(vault: VaultListingInterface, password: string): Promise<boolean> {
+    if (vault.keyPasswordType !== KeySystemPasswordType.UserInputted) {
+      throw new Error('Vault uses randomized password and cannot be unlocked with user inputted password')
+    }
+
+    if (vault.keyStorageMode === KeySystemRootKeyStorageMode.Synced) {
+      throw new Error('Vault uses synced root key and cannot be unlocked with user inputted password')
+    }
+
+    const derivedRootKey = this.encryption.deriveUserInputtedKeySystemRootKey({
+      keyParams: vault.rootKeyParams,
+      userInputtedPassword: password,
+    })
+
+    this.keys.cacheKey(derivedRootKey, vault.keyStorageMode)
+
+    await this.encryption.decryptErroredPayloads()
+
+    if (this.computeVaultLockState(vault) === 'locked') {
+      this.keys.removeKeyFromCache(vault.systemIdentifier)
+      return false
+    }
+
+    this.lockMap.set(vault.uuid, false)
+    void this.notifyEventSync(VaultLockServiceEvent.VaultUnlocked, { vault })
+
+    return true
+  }
+
+  private recomputeAllVaultsLockingState = async (): Promise<void> => {
+    const vaults = this._getVaults.execute().getValue()
+
+    for (const vault of vaults) {
+      const locked = this.computeVaultLockState(vault) === 'locked'
+
+      if (this.lockMap.get(vault.uuid) !== locked) {
+        this.lockMap.set(vault.uuid, locked)
+
+        if (locked) {
+          void this.notifyEvent(VaultLockServiceEvent.VaultLocked, { vault })
+        } else {
+          void this.notifyEvent(VaultLockServiceEvent.VaultUnlocked, { vault })
+        }
+      }
+    }
+  }
+
+  private computeVaultLockState(vault: VaultListingInterface): 'locked' | 'unlocked' {
+    const rootKey = this.keys.getPrimaryKeySystemRootKey(vault.systemIdentifier)
+    if (!rootKey) {
+      return 'locked'
+    }
+
+    const itemsKey = this.keys.getPrimaryKeySystemItemsKey(vault.systemIdentifier)
+    if (!itemsKey) {
+      return 'locked'
+    }
+
+    return 'unlocked'
+  }
+}

packages/services/src/Domain/VaultLock/VaultLockServiceEvent.ts

@@ -0,0 +1,15 @@
+import { VaultListingInterface } from '@standardnotes/models'
+
+export enum VaultLockServiceEvent {
+  VaultUnlocked = 'VaultUnlocked',
+  VaultLocked = 'VaultLocked',
+}
+
+export type VaultLockServiceEventPayload = {
+  [VaultLockServiceEvent.VaultUnlocked]: {
+    vault: VaultListingInterface
+  }
+  [VaultLockServiceEvent.VaultLocked]: {
+    vault: VaultListingInterface
+  }
+}

packages/services/src/Domain/VaultLock/VaultLockServiceInterface.ts

@@ -0,0 +1,12 @@
+import { VaultListingInterface } from '@standardnotes/models'
+import { AbstractService } from '../Service/AbstractService'
+import { VaultLockServiceEvent, VaultLockServiceEventPayload } from './VaultLockServiceEvent'
+
+export interface VaultLockServiceInterface
+  extends AbstractService<VaultLockServiceEvent, VaultLockServiceEventPayload[VaultLockServiceEvent]> {
+  getLockedvaults(): VaultListingInterface[]
+  isVaultLocked(vault: VaultListingInterface): boolean
+  isVaultLockable(vault: VaultListingInterface): boolean
+  lockNonPersistentVault(vault: VaultListingInterface): Promise<void>
+  unlockNonPersistentVault(vault: VaultListingInterface, password: string): Promise<boolean>
+}

packages/services/src/Domain/VaultUser/VaultUserService.ts

@@ -1,8 +1,9 @@
+import { VaultLockServiceInterface } from './../VaultLock/VaultLockServiceInterface'
 import { LeaveVault } from './UseCase/LeaveSharedVault'
-import { GetVault } from './../Vaults/UseCase/GetVault'
+import { GetVault } from '../Vault/UseCase/GetVault'
 import { InternalEventBusInterface } from './../Internal/InternalEventBusInterface'
 import { RemoveVaultMember } from './UseCase/RemoveSharedVaultMember'
-import { VaultServiceInterface } from './../Vaults/VaultServiceInterface'
+import { VaultServiceInterface } from '../Vault/VaultServiceInterface'
 import { SessionsClientInterface } from './../Session/SessionsClientInterface'
 import { GetVaultUsers } from './UseCase/GetVaultUsers'
 import { SharedVaultListingInterface } from '@standardnotes/models'
@@ -17,6 +18,7 @@ export class VaultUserService extends AbstractService<VaultUserServiceEvent> imp
   constructor(
     private session: SessionsClientInterface,
     private vaults: VaultServiceInterface,
+    private vaultLocks: VaultLockServiceInterface,
     private _getVaultUsers: GetVaultUsers,
     private _removeVaultMember: RemoveVaultMember,
     private _isVaultOwner: IsVaultOwner,
@@ -66,7 +68,7 @@ export class VaultUserService extends AbstractService<VaultUserServiceEvent> imp
       throw new Error('Only vault admins can remove users')
     }
 
-    if (this.vaults.isVaultLocked(sharedVault)) {
+    if (this.vaultLocks.isVaultLocked(sharedVault)) {
       throw new Error('Cannot remove user from locked vault')
     }
 

packages/services/src/Domain/Vaults/ChangeVaultOptionsDTO.ts

@@ -1,10 +0,0 @@
-import { KeySystemRootKeyPasswordType, KeySystemRootKeyStorageMode, VaultListingInterface } from '@standardnotes/models'
-
-export type ChangeVaultOptionsDTO = {
-  vault: VaultListingInterface
-  newPasswordType:
-    | { passwordType: KeySystemRootKeyPasswordType.Randomized }
-    | { passwordType: KeySystemRootKeyPasswordType.UserInputted; userInputtedPassword: string }
-    | undefined
-  newKeyStorageMode: KeySystemRootKeyStorageMode | undefined
-}

packages/services/src/Domain/Vaults/UseCase/ChangeVaultKeyOptions.ts

@@ -1,150 +0,0 @@
-import { MutatorClientInterface, SyncServiceInterface } from '@standardnotes/services'
-import {
-  KeySystemRootKeyPasswordType,
-  KeySystemRootKeyStorageMode,
-  VaultListingInterface,
-  VaultListingMutator,
-} from '@standardnotes/models'
-import { ChangeVaultOptionsDTO } from '../ChangeVaultOptionsDTO'
-import { GetVault } from './GetVault'
-import { EncryptionProviderInterface } from '../../Encryption/EncryptionProviderInterface'
-import { KeySystemKeyManagerInterface } from '../../KeySystem/KeySystemKeyManagerInterface'
-
-export class ChangeVaultKeyOptions {
-  constructor(
-    private mutator: MutatorClientInterface,
-    private sync: SyncServiceInterface,
-    private encryption: EncryptionProviderInterface,
-    private keys: KeySystemKeyManagerInterface,
-    private getVault: GetVault,
-  ) {}
-
-  async execute(dto: ChangeVaultOptionsDTO): Promise<void> {
-    const useStorageMode = dto.newKeyStorageMode ?? dto.vault.keyStorageMode
-
-    if (dto.newPasswordType) {
-      if (dto.vault.keyPasswordType === dto.newPasswordType.passwordType) {
-        throw new Error('Vault password type is already set to this type')
-      }
-
-      if (dto.newPasswordType.passwordType === KeySystemRootKeyPasswordType.UserInputted) {
-        if (!dto.newPasswordType.userInputtedPassword) {
-          throw new Error('User inputted password is required')
-        }
-        await this.changePasswordTypeToUserInputted(dto.vault, dto.newPasswordType.userInputtedPassword, useStorageMode)
-      } else if (dto.newPasswordType.passwordType === KeySystemRootKeyPasswordType.Randomized) {
-        await this.changePasswordTypeToRandomized(dto.vault, useStorageMode)
-      }
-    }
-
-    if (dto.newKeyStorageMode) {
-      const result = this.getVault.execute({ keySystemIdentifier: dto.vault.systemIdentifier })
-
-      if (result.isFailed()) {
-        throw new Error('Vault not found')
-      }
-
-      const latestVault = result.getValue()
-
-      if (latestVault.rootKeyParams.passwordType !== KeySystemRootKeyPasswordType.UserInputted) {
-        throw new Error('Vault uses randomized password and cannot change its storage preference')
-      }
-
-      if (dto.newKeyStorageMode === latestVault.keyStorageMode) {
-        throw new Error('Vault already uses this storage preference')
-      }
-
-      if (
-        dto.newKeyStorageMode === KeySystemRootKeyStorageMode.Local ||
-        dto.newKeyStorageMode === KeySystemRootKeyStorageMode.Ephemeral
-      ) {
-        await this.changeStorageModeToLocalOrEphemeral(latestVault, dto.newKeyStorageMode)
-      } else if (dto.newKeyStorageMode === KeySystemRootKeyStorageMode.Synced) {
-        await this.changeStorageModeToSynced(latestVault)
-      }
-    }
-
-    await this.sync.sync()
-  }
-
-  private async changePasswordTypeToUserInputted(
-    vault: VaultListingInterface,
-    userInputtedPassword: string,
-    storageMode: KeySystemRootKeyStorageMode,
-  ): Promise<void> {
-    const newRootKey = this.encryption.createUserInputtedKeySystemRootKey({
-      systemIdentifier: vault.systemIdentifier,
-      userInputtedPassword: userInputtedPassword,
-    })
-
-    if (storageMode === KeySystemRootKeyStorageMode.Synced) {
-      await this.mutator.insertItem(newRootKey, true)
-    } else {
-      this.keys.intakeNonPersistentKeySystemRootKey(newRootKey, storageMode)
-    }
-
-    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
-      mutator.rootKeyParams = newRootKey.keyParams
-    })
-
-    await this.keys.reencryptKeySystemItemsKeysForVault(vault.systemIdentifier)
-  }
-
-  private async changePasswordTypeToRandomized(
-    vault: VaultListingInterface,
-    storageMode: KeySystemRootKeyStorageMode,
-  ): Promise<void> {
-    const newRootKey = this.encryption.createRandomizedKeySystemRootKey({
-      systemIdentifier: vault.systemIdentifier,
-    })
-
-    if (storageMode !== KeySystemRootKeyStorageMode.Synced) {
-      throw new Error('Cannot change to randomized password if root key storage is not synced')
-    }
-
-    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
-      mutator.rootKeyParams = newRootKey.keyParams
-    })
-
-    await this.mutator.insertItem(newRootKey, true)
-
-    await this.keys.reencryptKeySystemItemsKeysForVault(vault.systemIdentifier)
-  }
-
-  private async changeStorageModeToLocalOrEphemeral(
-    vault: VaultListingInterface,
-    newKeyStorageMode: KeySystemRootKeyStorageMode,
-  ): Promise<void> {
-    const primaryKey = this.keys.getPrimaryKeySystemRootKey(vault.systemIdentifier)
-    if (!primaryKey) {
-      throw new Error('No primary key found')
-    }
-
-    this.keys.intakeNonPersistentKeySystemRootKey(primaryKey, newKeyStorageMode)
-    await this.keys.deleteAllSyncedKeySystemRootKeys(vault.systemIdentifier)
-
-    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
-      mutator.keyStorageMode = newKeyStorageMode
-    })
-
-    await this.sync.sync()
-  }
-
-  private async changeStorageModeToSynced(vault: VaultListingInterface): Promise<void> {
-    const allRootKeys = this.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
-    const syncedRootKeys = this.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
-
-    for (const key of allRootKeys) {
-      const existingSyncedKey = syncedRootKeys.find((syncedKey) => syncedKey.token === key.token)
-      if (existingSyncedKey) {
-        continue
-      }
-
-      await this.mutator.insertItem(key)
-    }
-
-    await this.mutator.changeItem<VaultListingMutator>(vault, (mutator) => {
-      mutator.keyStorageMode = KeySystemRootKeyStorageMode.Synced
-    })
-  }
-}

packages/services/src/Domain/index.ts

@@ -21,7 +21,7 @@ export * from './AsymmetricMessage/UseCase/ProcessAcceptedVaultInvite'
 export * from './AsymmetricMessage/UseCase/ResendAllMessages'
 export * from './AsymmetricMessage/UseCase/ResendMessage'
 export * from './AsymmetricMessage/UseCase/SendMessage'
-export * from './AsymmetricMessage/UseCase/SendOwnContactChangeMessage'
+export * from './Contacts/UseCase/SendOwnContactChangeMessage'
 export * from './Auth/AuthClientInterface'
 export * from './Auth/AuthManager'
 export * from './Authenticator/AuthenticatorClientInterface'
@@ -153,6 +153,7 @@ export * from './Storage/KeyValueStoreInterface'
 export * from './Storage/StorageKeys'
 export * from './Storage/StorageServiceInterface'
 export * from './Storage/StorageTypes'
+export * from './Storage/UseCase/RemoveItemsFromMemory'
 export * from './Strings/InfoStrings'
 export * from './Strings/Messages'
 export * from './Subscription/AppleIAPProductId'
@@ -166,7 +167,7 @@ export * from './Sync/SyncOptions'
 export * from './Sync/SyncQueueStrategy'
 export * from './Sync/SyncServiceInterface'
 export * from './Sync/SyncSource'
-export * from './UseCase/RemoveItemsLocally'
+export * from './UseCase/DiscardItemsLocally'
 export * from './User/AccountEvent'
 export * from './User/AccountEventData'
 export * from './User/CredentialsChangeFunctionResponse'
@@ -187,18 +188,21 @@ export * from './VaultInvite/UseCase/SendVaultInvite'
 export * from './VaultInvite/VaultInviteService'
 export * from './VaultInvite/VaultInviteServiceEvent'
 export * from './VaultInvite/VaultInviteServiceInterface'
-export * from './Vaults/ChangeVaultOptionsDTO'
-export * from './Vaults/UseCase/ChangeVaultKeyOptions'
-export * from './Vaults/UseCase/CreateVault'
-export * from './Vaults/UseCase/DeleteVault'
-export * from './Vaults/UseCase/GetVault'
-export * from './Vaults/UseCase/GetVaults'
-export * from './Vaults/UseCase/MoveItemsToVault'
-export * from './Vaults/UseCase/RemoveItemFromVault'
-export * from './Vaults/UseCase/RotateVaultKey'
-export * from './Vaults/VaultService'
-export * from './Vaults/VaultServiceEvent'
-export * from './Vaults/VaultServiceInterface'
+export * from './Vault/UseCase/ChangeVaultKeyOptionsDTO'
+export * from './Vault/UseCase/ChangeVaultKeyOptions'
+export * from './Vault/UseCase/CreateVault'
+export * from './Vault/UseCase/DeleteVault'
+export * from './Vault/UseCase/GetVault'
+export * from './Vault/UseCase/GetVaults'
+export * from './Vault/UseCase/MoveItemsToVault'
+export * from './Vault/UseCase/RemoveItemFromVault'
+export * from './Vault/UseCase/RotateVaultKey'
+export * from './Vault/VaultService'
+export * from './Vault/VaultServiceEvent'
+export * from './Vault/VaultServiceInterface'
+export * from './VaultLock/VaultLockService'
+export * from './VaultLock/VaultLockServiceEvent'
+export * from './VaultLock/VaultLockServiceInterface'
 export * from './VaultUser/UseCase/GetVaultContacts'
 export * from './VaultUser/UseCase/GetVaultContacts'
 export * from './VaultUser/UseCase/GetVaultUsers'

packages/snjs/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [2.202.15](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/snjs
+
+## [2.202.14](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/snjs
+
+## [2.202.13](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/snjs
+
 ## [2.202.12](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
 
 **Note:** Version bump only for package @standardnotes/snjs

packages/snjs/lib/Application/Application.ts

@@ -75,6 +75,7 @@ import {
   VaultInviteServiceInterface,
   UserEventServiceEvent,
   VaultServiceEvent,
+  VaultLockServiceInterface,
 } from '@standardnotes/services'
 import {
   PayloadEmitSource,
@@ -1324,18 +1325,6 @@ export class SNApplication implements ApplicationInterface, AppGroupManagedAppli
     return this.dependencies.get<HomeServerServiceInterface | undefined>(TYPES.HomeServerService)
   }
 
-  public get vaults(): VaultServiceInterface {
-    return this.dependencies.get<VaultServiceInterface>(TYPES.VaultService)
-  }
-
-  public get contacts(): ContactServiceInterface {
-    return this.dependencies.get<ContactServiceInterface>(TYPES.ContactService)
-  }
-
-  public get sharedVaults(): SharedVaultServiceInterface {
-    return this.dependencies.get<SharedVaultServiceInterface>(TYPES.SharedVaultService)
-  }
-
   public get preferences(): PreferenceServiceInterface {
     return this.dependencies.get<PreferenceServiceInterface>(TYPES.PreferencesService)
   }
@@ -1352,6 +1341,14 @@ export class SNApplication implements ApplicationInterface, AppGroupManagedAppli
     return this.dependencies.get<InternalEventBusInterface>(TYPES.InternalEventBus)
   }
 
+  public get vaults(): VaultServiceInterface {
+    return this.dependencies.get<VaultServiceInterface>(TYPES.VaultService)
+  }
+
+  public get vaultLocks(): VaultLockServiceInterface {
+    return this.dependencies.get<VaultLockServiceInterface>(TYPES.VaultLockService)
+  }
+
   public get vaultUsers(): VaultUserServiceInterface {
     return this.dependencies.get<VaultUserServiceInterface>(TYPES.VaultUserService)
   }
@@ -1360,6 +1357,14 @@ export class SNApplication implements ApplicationInterface, AppGroupManagedAppli
     return this.dependencies.get<VaultInviteServiceInterface>(TYPES.VaultInviteService)
   }
 
+  public get contacts(): ContactServiceInterface {
+    return this.dependencies.get<ContactServiceInterface>(TYPES.ContactService)
+  }
+
+  public get sharedVaults(): SharedVaultServiceInterface {
+    return this.dependencies.get<SharedVaultServiceInterface>(TYPES.SharedVaultService)
+  }
+
   private get migrations(): MigrationService {
     return this.dependencies.get<MigrationService>(TYPES.MigrationService)
   }

packages/snjs/lib/Application/Dependencies/Dependencies.ts

@@ -47,7 +47,7 @@ import {
   IntegrityService,
   InternalEventBus,
   KeySystemKeyManager,
-  RemoveItemsLocally,
+  DiscardItemsLocally,
   RevisionManager,
   SelfContactManager,
   StatusService,
@@ -117,6 +117,8 @@ import {
   GetOwnedSharedVaults,
   ContactBelongsToVault,
   DeleteContact,
+  VaultLockService,
+  RemoveItemsFromMemory,
 } from '@standardnotes/services'
 import { ItemManager } from '../../Services/Items/ItemManager'
 import { PayloadManager } from '../../Services/Payloads/PayloadManager'
@@ -221,8 +223,16 @@ export class Dependencies {
       return new DecryptBackupFile(this.get(TYPES.EncryptionService))
     })
 
-    this.factory.set(TYPES.RemoveItemsLocally, () => {
-      return new RemoveItemsLocally(this.get(TYPES.ItemManager), this.get(TYPES.DiskStorageService))
+    this.factory.set(TYPES.DiscardItemsLocally, () => {
+      return new DiscardItemsLocally(this.get(TYPES.ItemManager), this.get(TYPES.DiskStorageService))
+    })
+
+    this.factory.set(TYPES.RemoveItemsFromMemory, () => {
+      return new RemoveItemsFromMemory(
+        this.get(TYPES.DiskStorageService),
+        this.get(TYPES.ItemManager),
+        this.get(TYPES.PayloadManager),
+      )
     })
 
     this.factory.set(TYPES.FindContact, () => {
@@ -441,7 +451,7 @@ export class Dependencies {
         this.get(TYPES.MutatorService),
         this.get(TYPES.KeySystemKeyManager),
         this.get(TYPES.SyncService),
-        this.get(TYPES.RemoveItemsLocally),
+        this.get(TYPES.DiscardItemsLocally),
       )
     })
 
@@ -554,7 +564,7 @@ export class Dependencies {
         this.get(TYPES.MutatorService),
         this.get(TYPES.ItemManager),
         this.get(TYPES.CreateNewDefaultItemsKey),
-        this.get(TYPES.RemoveItemsLocally),
+        this.get(TYPES.DiscardItemsLocally),
         this.get(TYPES.FindDefaultItemsKey),
       )
     })
@@ -650,6 +660,7 @@ export class Dependencies {
       return new VaultUserService(
         this.get(TYPES.SessionManager),
         this.get(TYPES.VaultService),
+        this.get(TYPES.VaultLockService),
         this.get(TYPES.GetVaultUsers),
         this.get(TYPES.RemoveVaultMember),
         this.get(TYPES.IsVaultOwner),
@@ -691,12 +702,10 @@ export class Dependencies {
         this.get(TYPES.AsymmetricMessageServer),
         this.get(TYPES.CreateOrEditContact),
         this.get(TYPES.FindContact),
-        this.get(TYPES.GetAllContacts),
         this.get(TYPES.ReplaceContactData),
         this.get(TYPES.GetTrustedPayload),
         this.get(TYPES.GetVault),
         this.get(TYPES.HandleRootKeyChangedMessage),
-        this.get(TYPES.SendOwnContactChangeMessage),
         this.get(TYPES.GetOutboundMessages),
         this.get(TYPES.GetInboundMessages),
         this.get(TYPES.GetUntrustedPayload),
@@ -721,6 +730,17 @@ export class Dependencies {
         this.get(TYPES.ConvertToSharedVault),
         this.get(TYPES.DeleteSharedVault),
         this.get(TYPES.IsVaultOwner),
+        this.get(TYPES.DiscardItemsLocally),
+        this.get(TYPES.InternalEventBus),
+      )
+    })
+
+    this.factory.set(TYPES.VaultLockService, () => {
+      return new VaultLockService(
+        this.get(TYPES.ItemManager),
+        this.get(TYPES.EncryptionService),
+        this.get(TYPES.KeySystemKeyManager),
+        this.get(TYPES.GetVaults),
         this.get(TYPES.InternalEventBus),
       )
     })
@@ -730,8 +750,7 @@ export class Dependencies {
         this.get(TYPES.SyncService),
         this.get(TYPES.ItemManager),
         this.get(TYPES.MutatorService),
-        this.get(TYPES.EncryptionService),
-        this.get(TYPES.KeySystemKeyManager),
+        this.get(TYPES.VaultLockService),
         this.get(TYPES.AlertService),
         this.get(TYPES.GetVault),
         this.get(TYPES.GetVaults),
@@ -770,6 +789,7 @@ export class Dependencies {
         this.get(TYPES.CreateOrEditContact),
         this.get(TYPES.EditContact),
         this.get(TYPES.ValidateItemSigner),
+        this.get(TYPES.SendOwnContactChangeMessage),
         this.get(TYPES.InternalEventBus),
       )
     })
@@ -1210,6 +1230,7 @@ export class Dependencies {
         this.get(TYPES.ItemManager),
         this.get(TYPES.MutatorService),
         this.get(TYPES.DiskStorageService),
+        this.get(TYPES.RemoveItemsFromMemory),
         this.get(TYPES.InternalEventBus),
       )
     })

packages/snjs/lib/Application/Dependencies/Types.ts

@@ -62,6 +62,7 @@ export const TYPES = {
   VaultUserService: Symbol.for('VaultUserService'),
   VaultInviteService: Symbol.for('VaultInviteService'),
   VaultUserCache: Symbol.for('VaultUserCache'),
+  VaultLockService: Symbol.for('VaultLockService'),
 
   // Servers
   RevisionServer: Symbol.for('RevisionServer'),
@@ -88,7 +89,7 @@ export const TYPES = {
   GetRevision: Symbol.for('GetRevision'),
   DeleteRevision: Symbol.for('DeleteRevision'),
   ImportDataUseCase: Symbol.for('ImportDataUseCase'),
-  RemoveItemsLocally: Symbol.for('RemoveItemsLocally'),
+  DiscardItemsLocally: Symbol.for('DiscardItemsLocally'),
   FindContact: Symbol.for('FindContact'),
   GetAllContacts: Symbol.for('GetAllContacts'),
   CreateOrEditContact: Symbol.for('CreateOrEditContact'),
@@ -149,6 +150,7 @@ export const TYPES = {
   EncryptTypeAPayloadWithKeyLookup: Symbol.for('EncryptTypeAPayloadWithKeyLookup'),
   DecryptBackupFile: Symbol.for('DecryptBackupFile'),
   IsVaultOwner: Symbol.for('IsVaultOwner'),
+  RemoveItemsFromMemory: Symbol.for('RemoveItemsFromMemory'),
 
   // Mappers
   SessionStorageMapper: Symbol.for('SessionStorageMapper'),

packages/snjs/lib/Migrations/Versions/2_20_0.ts

@@ -18,7 +18,7 @@ export class Migration2_20_0 extends Migration {
     const items = this.services.itemManager.getItems(contentType)
 
     for (const item of items) {
-      this.services.itemManager.removeItemLocally(item)
+      this.services.itemManager.removeItemFromMemory(item)
       await this.services.storageService.deletePayloadWithUuid(item.uuid)
     }
   }

packages/snjs/lib/Migrations/Versions/2_36_0.ts

@@ -18,7 +18,7 @@ export class Migration2_36_0 extends Migration {
     const items = this.services.itemManager.getItems(contentType)
 
     for (const item of items) {
-      this.services.itemManager.removeItemLocally(item)
+      this.services.itemManager.removeItemFromMemory(item)
       await this.services.storageService.deletePayloadWithUuid(item.uuid)
     }
   }

packages/snjs/lib/Services/Items/ItemManager.ts

@@ -816,14 +816,14 @@ export class ItemManager extends Services.AbstractService implements Services.It
   /**
    * Important: Caller must coordinate with storage service separately to delete item from persistent database.
    */
-  public removeItemLocally(item: Models.AnyItemInterface): void {
-    this.removeItemsLocally([item])
+  public removeItemFromMemory(item: Models.AnyItemInterface): void {
+    this.removeItemsFromMemory([item])
   }
 
   /**
    * Important: Caller must coordinate with storage service separately to delete item from persistent database.
    */
-  public removeItemsLocally(items: Models.AnyItemInterface[]): void {
+  public removeItemsFromMemory(items: Models.AnyItemInterface[]): void {
     this.collection.discard(items)
     this.payloadManager.removePayloadLocally(items.map((item) => item.payload))
 

packages/snjs/lib/Services/Storage/DiskStorageService.ts

@@ -69,7 +69,7 @@ export class DiskStorageService
   private values!: StorageValuesObject
 
   constructor(
-    private deviceInterface: DeviceInterface,
+    private device: DeviceInterface,
     private identifier: string,
     protected override internalEventBus: InternalEventBusInterface,
   ) {
@@ -82,7 +82,7 @@ export class DiskStorageService
   }
 
   public override deinit() {
-    ;(this.deviceInterface as unknown) = undefined
+    ;(this.device as unknown) = undefined
     ;(this.encryptionProvider as unknown) = undefined
     this.storagePersistable = false
     super.deinit()
@@ -104,9 +104,9 @@ export class DiskStorageService
     this.persistencePolicy = persistencePolicy
 
     if (this.persistencePolicy === StoragePersistencePolicies.Ephemeral) {
-      await this.deviceInterface.clearNamespacedKeychainValue(this.identifier)
-      await this.deviceInterface.removeAllDatabaseEntries(this.identifier)
-      await this.deviceInterface.removeRawStorageValuesForIdentifier(this.identifier)
+      await this.device.clearNamespacedKeychainValue(this.identifier)
+      await this.device.removeAllDatabaseEntries(this.identifier)
+      await this.device.removeRawStorageValuesForIdentifier(this.identifier)
       await this.clearAllPayloads()
     }
   }
@@ -116,7 +116,7 @@ export class DiskStorageService
   }
 
   public async initializeFromDisk(): Promise<void> {
-    const value = await this.deviceInterface.getRawStorageValue(this.getPersistenceKey())
+    const value = await this.device.getRawStorageValue(this.getPersistenceKey())
     const values = value ? JSON.parse(value as string) : undefined
 
     await this.setInitialValues(values)
@@ -240,7 +240,7 @@ export class DiskStorageService
         return values
       }
 
-      await this.deviceInterface?.setRawStorageValue(this.getPersistenceKey(), JSON.stringify(values))
+      await this.device?.setRawStorageValue(this.getPersistenceKey(), JSON.stringify(values))
 
       return values
     })
@@ -385,7 +385,11 @@ export class DiskStorageService
   }
 
   public async getAllRawPayloads(): Promise<FullyFormedTransferPayload[]> {
-    return this.deviceInterface.getAllDatabaseEntries(this.identifier)
+    return this.device.getAllDatabaseEntries(this.identifier)
+  }
+
+  public async getRawPayloads(uuids: string[]): Promise<FullyFormedTransferPayload[]> {
+    return this.device.getDatabaseEntries(this.identifier, uuids)
   }
 
   public async savePayload(payload: FullyFormedPayloadInterface): Promise<void> {
@@ -440,7 +444,7 @@ export class DiskStorageService
     const exportedDeleted = deleted.map(CreateDeletedLocalStorageContextPayload)
 
     return this.executeCriticalFunction(async () => {
-      return this.deviceInterface?.saveDatabaseEntries(
+      return this.device?.saveDatabaseEntries(
         [...exportedEncrypted, ...exportedDecrypted, ...exportedDeleted],
         this.identifier,
       )
@@ -453,19 +457,19 @@ export class DiskStorageService
 
   public async deletePayloadsWithUuids(uuids: string[]): Promise<void> {
     await this.executeCriticalFunction(async () => {
-      await Promise.all(uuids.map((uuid) => this.deviceInterface.removeDatabaseEntry(uuid, this.identifier)))
+      await Promise.all(uuids.map((uuid) => this.device.removeDatabaseEntry(uuid, this.identifier)))
     })
   }
 
   public async deletePayloadWithUuid(uuid: string) {
     return this.executeCriticalFunction(async () => {
-      await this.deviceInterface.removeDatabaseEntry(uuid, this.identifier)
+      await this.device.removeDatabaseEntry(uuid, this.identifier)
     })
   }
 
   public async clearAllPayloads() {
     return this.executeCriticalFunction(async () => {
-      return this.deviceInterface.removeAllDatabaseEntries(this.identifier)
+      return this.device.removeAllDatabaseEntries(this.identifier)
     })
   }
 
@@ -474,9 +478,9 @@ export class DiskStorageService
       await this.clearValues()
       await this.clearAllPayloads()
 
-      await this.deviceInterface.removeRawStorageValue(namespacedKey(this.identifier, RawStorageKey.SnjsVersion))
+      await this.device.removeRawStorageValue(namespacedKey(this.identifier, RawStorageKey.SnjsVersion))
 
-      await this.deviceInterface.removeRawStorageValue(this.getPersistenceKey())
+      await this.device.removeRawStorageValue(this.getPersistenceKey())
     })
   }
 }

packages/snjs/mocha/TestRegistry/VaultTests.js

@@ -11,6 +11,7 @@ export const VaultTests = {
     'vaults/signatures.test.js',
     'vaults/shared_vaults.test.js',
     'vaults/invites.test.js',
+    'vaults/key-management.test.js',
     'vaults/items.test.js',
     'vaults/conflicts.test.js',
     'vaults/deletion.test.js',

packages/snjs/mocha/auth.test.js

@@ -449,7 +449,7 @@ describe('basic auth', function () {
     }
 
     const mutatorSpy = sinon.spy(this.application.mutator, 'setItemToBeDeleted')
-    const removeItemsSpy = sinon.spy(this.application.items, 'removeItemsLocally')
+    const removeItemsSpy = sinon.spy(this.application.items, 'removeItemsFromMemory')
     const deletePayloadsSpy = sinon.spy(this.application.storage, 'deletePayloadsWithUuids')
 
     await this.context.changePassword('new-password')

packages/snjs/mocha/item_manager.test.js

@@ -201,7 +201,7 @@ describe('item manager', function () {
       observed.push({ changed, inserted, removed, ignored })
     })
     const note = await createNote()
-    await application.items.removeItemLocally(note)
+    await application.items.removeItemFromMemory(note)
 
     expect(observed.length).to.equal(1)
     expect(application.items.findItem(note.uuid)).to.not.be.ok

packages/snjs/mocha/keys.test.js

@@ -190,7 +190,7 @@ describe('keys', function () {
 
     const itemsKey = this.application.encryption.itemsKeyForEncryptedPayload(encryptedPayload)
 
-    await this.application.items.removeItemLocally(itemsKey)
+    await this.application.items.removeItemFromMemory(itemsKey)
 
     const erroredPayload = await this.application.encryption.decryptSplitSingle({
       usesItemsKeyWithKeyLookup: {

packages/snjs/mocha/lib/AppContext.js

@@ -49,10 +49,6 @@ export class AppContext {
     )
   }
 
-  get vaults() {
-    return this.application.vaults
-  }
-
   get sessions() {
     return this.application.sessions
   }
@@ -97,6 +93,14 @@ export class AppContext {
     return this.application.sharedVaults
   }
 
+  get vaults() {
+    return this.application.vaults
+  }
+
+  get vaultLocks() {
+    return this.application.vaultLocks
+  }
+
   get vaultUsers() {
     return this.application.vaultUsers
   }
@@ -354,64 +358,39 @@ export class AppContext {
     })
   }
 
-  resolveWhenAsymmetricMessageProcessingCompletes() {
+  resolveWhenAsyncFunctionCompletes(object, functionName) {
     return new Promise((resolve) => {
-      const objectToSpy = this.asymmetric
-      sinon.stub(objectToSpy, 'handleRemoteReceivedAsymmetricMessages').callsFake(async (messages) => {
-        objectToSpy.handleRemoteReceivedAsymmetricMessages.restore()
-        const result = await objectToSpy.handleRemoteReceivedAsymmetricMessages(messages)
+      sinon.stub(object, functionName).callsFake(async (params) => {
+        object[functionName].restore()
+        const result = await object[functionName](params)
         resolve()
         return result
       })
     })
   }
 
+  resolveWhenAsymmetricMessageProcessingCompletes() {
+    return this.resolveWhenAsyncFunctionCompletes(this.asymmetric, 'handleRemoteReceivedAsymmetricMessages')
+  }
+
   resolveWhenUserMessagesProcessingCompletes() {
-    return new Promise((resolve) => {
-      const objectToSpy = this.application.dependencies.get(TYPES.UserEventService)
-      sinon.stub(objectToSpy, 'handleReceivedUserEvents').callsFake(async (params) => {
-        objectToSpy.handleReceivedUserEvents.restore()
-        const result = await objectToSpy.handleReceivedUserEvents(params)
-        resolve()
-        return result
-      })
-    })
+    const objectToSpy = this.application.dependencies.get(TYPES.UserEventService)
+    return this.resolveWhenAsyncFunctionCompletes(objectToSpy, 'handleReceivedUserEvents')
   }
 
   resolveWhenAllInboundAsymmetricMessagesAreDeleted() {
-    return new Promise((resolve) => {
-      const objectToSpy = this.application.dependencies.get(TYPES.AsymmetricMessageServer)
-      sinon.stub(objectToSpy, 'deleteAllInboundMessages').callsFake(async (params) => {
-        objectToSpy.deleteAllInboundMessages.restore()
-        const result = await objectToSpy.deleteAllInboundMessages(params)
-        resolve()
-        return result
-      })
-    })
+    const objectToSpy = this.application.dependencies.get(TYPES.AsymmetricMessageServer)
+    return this.resolveWhenAsyncFunctionCompletes(objectToSpy, 'deleteAllInboundMessages')
   }
 
   resolveWhenAllInboundSharedVaultInvitesAreDeleted() {
-    return new Promise((resolve) => {
-      const objectToSpy = this.application.vaultInvites.invitesServer
-      sinon.stub(objectToSpy, 'deleteAllInboundInvites').callsFake(async (params) => {
-        objectToSpy.deleteAllInboundInvites.restore()
-        const result = await objectToSpy.deleteAllInboundInvites(params)
-        resolve()
-        return result
-      })
-    })
+    const objectToSpy = this.application.vaultInvites.invitesServer
+    return this.resolveWhenAsyncFunctionCompletes(objectToSpy, 'deleteAllInboundInvites')
   }
 
   resolveWhenSharedVaultServiceSendsContactShareMessage() {
-    return new Promise((resolve) => {
-      const objectToSpy = this.sharedVaults
-      sinon.stub(objectToSpy, 'shareContactWithVaults').callsFake(async (contact) => {
-        objectToSpy.shareContactWithVaults.restore()
-        const result = await objectToSpy.shareContactWithVaults(contact)
-        resolve()
-        return result
-      })
-    })
+    const objectToSpy = this.sharedVaults
+    return this.resolveWhenAsyncFunctionCompletes(objectToSpy, 'shareContactWithVaults')
   }
 
   resolveWhenSharedVaultKeyRotationInvitesGetSent(targetVault) {

packages/snjs/mocha/lib/Collaboration.js

@@ -82,6 +82,27 @@ export const createSharedVaultWithUnacceptedButTrustedInvite = async (
   return { sharedVault, contact, contactContext, deinitContactContext, invite }
 }
 
+export const createSharedVaultAndInviteContact = async (
+  createInContext,
+  inviteContext,
+  inviteContact,
+  permissions = SharedVaultPermission.Write,
+) => {
+  const sharedVault = await createSharedVault(createInContext)
+
+  await createInContext.vaultInvites.inviteContactToSharedVault(sharedVault, inviteContact, permissions)
+
+  const promise = inviteContext.awaitNextSyncSharedVaultFromScratchEvent()
+
+  await inviteContext.sync()
+
+  await acceptAllInvites(inviteContext)
+
+  await promise
+
+  return { sharedVault }
+}
+
 export const createSharedVaultWithUnacceptedAndUntrustedInvite = async (
   context,
   permissions = SharedVaultPermission.Write,
@@ -113,7 +134,6 @@ export const inviteNewPartyToSharedVault = async (context, sharedVault, permissi
 export const createPrivateVault = async (context) => {
   const privateVault = await context.vaults.createRandomizedVault({
     name: 'My Private Vault',
-    storagePreference: KeySystemRootKeyStorageMode.Synced,
   })
 
   return privateVault

packages/snjs/mocha/lib/web_device_interface.js

@@ -63,6 +63,16 @@ export default class WebDeviceInterface {
     return models
   }
 
+  async getDatabaseEntries(identifier, ids) {
+    const models = []
+    for (const id of ids) {
+      const key = this._keyForPayloadId(id, identifier)
+      const model = JSON.parse(localStorage[key])
+      models.push(model)
+    }
+    return models
+  }
+
   async getDatabaseLoadChunks(options, identifier) {
     const entries = await this.getAllDatabaseEntries(identifier)
     const {

packages/snjs/mocha/sync_tests/integrity.test.js

@@ -53,7 +53,7 @@ describe('sync integrity', () => {
     const didEnterOutOfSync = awaitSyncEventPromise(this.application, SyncEvent.EnterOutOfSync)
     await this.application.sync.sync({ checkIntegrity: true })
 
-    await this.application.items.removeItemLocally(item)
+    await this.application.items.removeItemFromMemory(item)
     await this.application.sync.sync({ checkIntegrity: true, awaitAll: true })
 
     await didEnterOutOfSync
@@ -70,7 +70,7 @@ describe('sync integrity', () => {
     const didExitOutOfSync = awaitSyncEventPromise(this.application, SyncEvent.ExitOutOfSync)
 
     await this.application.sync.sync({ checkIntegrity: true })
-    await this.application.items.removeItemLocally(item)
+    await this.application.items.removeItemFromMemory(item)
     await this.application.sync.sync({ checkIntegrity: true, awaitAll: true })
 
     await Promise.all([didEnterOutOfSync, didExitOutOfSync])

packages/snjs/mocha/test.html

@@ -61,7 +61,7 @@
       await loadTests(MainRegistry.VaultTests.files);
     }
 
-    if (!MainRegistry.VaultTests.enabled.exclusive) {
+    if (!MainRegistry.VaultTests.enabled || !MainRegistry.VaultTests.enabled.exclusive) {
       await loadTests(MainRegistry.BaseTests);
     }
 

packages/snjs/mocha/vaults/asymmetric-messages.test.js

@@ -69,7 +69,7 @@ describe('asymmetric messages', function () {
       },
     }
 
-    await service.sendOwnContactChangeEventToAllContacts(eventData)
+    await context.contacts.sendOwnContactChangeEventToAllContacts(eventData)
 
     const deleteFunction = sinon.spy(contactContext.asymmetric, 'deleteMessageAfterProcessing')
 
@@ -239,14 +239,20 @@ describe('asymmetric messages', function () {
   it('should send sender keypair changed message to trusted contacts', async () => {
     const { contactContext, deinitContactContext } = await Collaboration.createSharedVaultWithAcceptedInvite(context)
 
+    contactContext.lockSyncing()
+
+    const sendPromise = context.resolveWhenAsyncFunctionCompletes(
+      context.contacts,
+      'sendOwnContactChangeEventToAllContacts',
+    )
     await context.changePassword('new password')
+    await sendPromise
 
     const firstPartySpy = sinon.spy(context.asymmetric, 'handleTrustedSenderKeypairChangedMessage')
     const secondPartySpy = sinon.spy(contactContext.asymmetric, 'handleTrustedSenderKeypairChangedMessage')
 
-    await context.sync()
-
     const completedProcessingMessagesPromise = contactContext.resolveWhenAsymmetricMessageProcessingCompletes()
+    contactContext.unlockSyncing()
     await contactContext.sync()
     await completedProcessingMessagesPromise
 

packages/snjs/mocha/vaults/deletion.test.js

@@ -153,6 +153,16 @@ describe('shared vault deletion', function () {
   })
 
   it('being removed from a shared vault should delete respective vault listing', async () => {
-    console.error('TODO: implement test')
+    const { sharedVault, contactContext, deinitContactContext } =
+      await Collaboration.createSharedVaultWithAcceptedInvite(context)
+
+    await context.vaultUsers.removeUserFromSharedVault(sharedVault, contactContext.userUuid)
+
+    await contactContext.sync()
+
+    const vault = contactContext.vaults.getVault({ keySystemIdentifier: sharedVault.systemIdentifier })
+    expect(vault).to.be.undefined
+
+    await deinitContactContext()
   })
 })

packages/snjs/mocha/vaults/invites.test.js

@@ -200,10 +200,6 @@ describe('shared vault invites', function () {
     await deinitContactContext()
   })
 
-  it('when inviter keypair changes, recipient should still be able to trust and decrypt previous invite', async () => {
-    console.error('TODO: implement test')
-  })
-
   it('should delete all inbound invites after changing user password', async () => {
     /** Invites to user are encrypted with old keypair and are no longer decryptable */
     const { contactContext, deinitContactContext } =

packages/snjs/mocha/vaults/items.test.js

@@ -117,6 +117,28 @@ describe('shared vault items', function () {
   })
 
   it('adding item to vault while belonging to other vault should move the item to new vault', async () => {
-    console.error('TODO: implement test')
+    const { note, sharedVault, contactContext, contact, deinitContactContext } =
+      await Collaboration.createSharedVaultWithAcceptedInviteAndNote(context)
+
+    const { sharedVault: otherSharedVault } = await Collaboration.createSharedVaultAndInviteContact(
+      context,
+      contactContext,
+      contact,
+    )
+
+    const updatedNote = await Collaboration.moveItemToVault(context, otherSharedVault, note)
+
+    expect(updatedNote.key_system_identifier).to.equal(otherSharedVault.systemIdentifier)
+    expect(updatedNote.shared_vault_uuid).to.equal(otherSharedVault.sharing.sharedVaultUuid)
+
+    await contactContext.sync()
+
+    const receivedNote = contactContext.items.findItem(note.uuid)
+    expect(receivedNote).to.not.be.undefined
+    expect(receivedNote.title).to.equal(note.title)
+    expect(receivedNote.key_system_identifier).to.equal(otherSharedVault.systemIdentifier)
+    expect(receivedNote.shared_vault_uuid).to.equal(otherSharedVault.sharing.sharedVaultUuid)
+
+    await deinitContactContext()
   })
 })

packages/snjs/mocha/vaults/key-management.test.js

@@ -0,0 +1,438 @@
+import * as Factory from '../lib/factory.js'
+
+chai.use(chaiAsPromised)
+const expect = chai.expect
+
+describe('vault key management', function () {
+  this.timeout(Factory.TwentySecondTimeout)
+
+  let context
+
+  afterEach(async function () {
+    await context.deinit()
+    localStorage.clear()
+  })
+
+  beforeEach(async function () {
+    localStorage.clear()
+
+    context = await Factory.createAppContextWithRealCrypto()
+
+    await context.launch()
+  })
+
+  describe('locking', () => {
+    it('should throw if attempting to add item to locked vault', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      await context.vaultLocks.lockNonPersistentVault(vault)
+
+      const item = await context.createSyncedNote('test note', 'test note text')
+
+      await Factory.expectThrowsAsync(
+        () => context.vaults.moveItemToVault(vault, item),
+        'Attempting to add item to locked vault',
+      )
+    })
+
+    it('should throw if attempting to remove item from locked vault', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      const item = await context.createSyncedNote('test note', 'test note text')
+
+      await context.vaults.moveItemToVault(vault, item)
+
+      await context.vaultLocks.lockNonPersistentVault(vault)
+
+      await Factory.expectThrowsAsync(
+        () => context.vaults.removeItemFromVault(item),
+        'Attempting to remove item from locked vault',
+      )
+    })
+
+    it('should lock non-persistent vault', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      await context.vaultLocks.lockNonPersistentVault(vault)
+
+      expect(context.vaultLocks.isVaultLocked(vault)).to.be.true
+    })
+
+    it('should not be able to lock user-inputted vault with synced key', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Synced,
+      })
+
+      await Factory.expectThrowsAsync(
+        () => context.vaultLocks.lockNonPersistentVault(vault),
+        'Vault uses synced key storage and cannot be locked',
+      )
+    })
+
+    it('should not be able to lock randomized vault', async () => {
+      const vault = await context.vaults.createRandomizedVault({
+        name: 'test vault',
+        description: 'test vault description',
+      })
+
+      await Factory.expectThrowsAsync(
+        () => context.vaultLocks.lockNonPersistentVault(vault),
+        'Vault uses synced key storage and cannot be locked',
+      )
+    })
+
+    it('should throw if attempting to change password of locked vault', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      await context.vaultLocks.lockNonPersistentVault(vault)
+
+      await Factory.expectThrowsAsync(
+        () => context.vaults.changeVaultOptions({ vault }),
+        'Attempting to change vault options on a locked vault',
+      )
+    })
+  })
+
+  describe('key rotation and persistence', () => {
+    it('rotating ephemeral vault should not persist keys', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      await context.vaults.rotateVaultRootKey(vault, 'test password')
+
+      const syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+      expect(syncedKeys.length).to.equal(0)
+
+      const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+      expect(storedKey).to.be.undefined
+    })
+
+    it('rotating local vault should not sync keys', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Local,
+      })
+
+      await context.vaults.rotateVaultRootKey(vault, 'test password')
+
+      const syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+      expect(syncedKeys.length).to.equal(0)
+
+      const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+      expect(storedKey).to.not.be.undefined
+    })
+
+    it('rotating synced vault should sync new key', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Synced,
+      })
+
+      await context.vaults.rotateVaultRootKey(vault, 'test password')
+
+      const syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+      expect(syncedKeys.length).to.equal(2)
+
+      const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+      expect(storedKey).to.be.undefined
+    })
+  })
+
+  describe('memory management', () => {
+    it('locking a vault should clear decrypted items keys from memory', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      const itemsKeys = context.keys.getKeySystemItemsKeys(vault.systemIdentifier)
+      expect(itemsKeys.length).to.equal(1)
+
+      await context.vaultLocks.lockNonPersistentVault(vault)
+
+      const itemsKeysAfterLock = context.keys.getKeySystemItemsKeys(vault.systemIdentifier)
+      expect(itemsKeysAfterLock.length).to.equal(0)
+    })
+
+    it('locking then unlocking a vault should bring items keys back into memory', async () => {
+      const vault = await context.vaults.createUserInputtedPasswordVault({
+        name: 'test vault',
+        description: 'test vault description',
+        userInputtedPassword: 'test password',
+        storagePreference: KeySystemRootKeyStorageMode.Ephemeral,
+      })
+
+      await context.vaultLocks.lockNonPersistentVault(vault)
+      await context.vaultLocks.unlockNonPersistentVault(vault, 'test password')
+
+      const itemsKeys = context.keys.getKeySystemItemsKeys(vault.systemIdentifier)
+      expect(itemsKeys.length).to.equal(1)
+
+      const rootKeys = context.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+      expect(rootKeys.length).to.equal(1)
+    })
+  })
+
+  describe('changeVaultOptions', () => {
+    describe('change storage type', () => {
+      it('should not be able to change randomized vault from synced to local', async () => {
+        const vault = await context.vaults.createRandomizedVault({
+          name: 'test vault',
+          description: 'test vault description',
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Local,
+        })
+
+        expect(result.isFailed()).to.be.true
+        expect(result.getError()).to.equal('Vault uses randomized password and cannot change its storage preference')
+      })
+
+      it('should not be able to change randomized vault from synced to ephemeral', async () => {
+        const vault = await context.vaults.createRandomizedVault({
+          name: 'test vault',
+          description: 'test vault description',
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Local,
+        })
+
+        expect(result.isFailed()).to.be.true
+        expect(result.getError()).to.equal('Vault uses randomized password and cannot change its storage preference')
+      })
+
+      it('should change user password vault from synced to local', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Synced,
+        })
+
+        let syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Local,
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(syncedKeys.length).to.equal(0)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.not.be.undefined
+      })
+
+      it('should change user password vault from synced to ephemeral', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Synced,
+        })
+
+        let syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Ephemeral,
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(syncedKeys.length).to.equal(0)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.be.undefined
+
+        const memKeys = context.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(memKeys.length).to.equal(1)
+      })
+
+      it('should change user password vault from local to synced', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Local,
+        })
+
+        let syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Synced,
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(syncedKeys.length).to.equal(1)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.be.undefined
+
+        const memKeys = context.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(memKeys.length).to.equal(1)
+      })
+
+      it('should change user password vault from local to ephemeral', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Local,
+        })
+
+        let syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newStorageMode: KeySystemRootKeyStorageMode.Ephemeral,
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        syncedKeys = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(syncedKeys.length).to.equal(0)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.be.undefined
+
+        const memKeys = context.keys.getAllKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(memKeys.length).to.equal(1)
+      })
+    })
+
+    describe('change password type', () => {
+      it('should fail to change password type from randomized to user inputted if password is not supplied', async () => {
+        const vault = await context.vaults.createRandomizedVault({
+          name: 'test vault',
+          description: 'test vault description',
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newPasswordType: {
+            passwordType: KeySystemPasswordType.UserInputted,
+          },
+        })
+
+        expect(result.isFailed()).to.be.true
+      })
+
+      it('should change password type from randomized to user inputted', async () => {
+        const vault = await context.vaults.createRandomizedVault({
+          name: 'test vault',
+          description: 'test vault description',
+        })
+
+        const rootKeysBeforeChange = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(rootKeysBeforeChange.length).to.equal(1)
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newPasswordType: {
+            passwordType: KeySystemPasswordType.UserInputted,
+            userInputtedPassword: 'test password',
+          },
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        const rootKeysAfterChange = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(rootKeysAfterChange.length).to.equal(2)
+
+        expect(rootKeysAfterChange[0].itemsKey).to.not.equal(rootKeysAfterChange[1].itemsKey)
+      })
+
+      it('should change password type from user inputted to randomized', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Local,
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newPasswordType: {
+            passwordType: KeySystemPasswordType.Randomized,
+          },
+        })
+
+        expect(result.isFailed()).to.be.false
+
+        const rootKeysAfterChange = context.keys.getSyncedKeySystemRootKeysForVault(vault.systemIdentifier)
+        expect(rootKeysAfterChange.length).to.equal(1)
+
+        const storedKey = context.keys.getRootKeyFromStorageForVault(vault.systemIdentifier)
+        expect(storedKey).to.be.undefined
+
+        const updatedVault = context.vaults.getVault({ keySystemIdentifier: vault.systemIdentifier })
+        expect(updatedVault.keyStorageMode).to.equal(KeySystemRootKeyStorageMode.Synced)
+      })
+
+      it('should fail to change password type from user inputted to randomized if storage mode is not synced', async () => {
+        const vault = await context.vaults.createUserInputtedPasswordVault({
+          name: 'test vault',
+          description: 'test vault description',
+          userInputtedPassword: 'test password',
+          storagePreference: KeySystemRootKeyStorageMode.Local,
+        })
+
+        const result = await context.vaults.changeVaultOptions({
+          vault,
+          newPasswordType: {
+            passwordType: KeySystemPasswordType.Randomized,
+          },
+          newStorageMode: KeySystemRootKeyStorageMode.Local,
+        })
+
+        expect(result.isFailed()).to.be.true
+
+        expect(result.getError()).to.equal('Vault uses randomized password and cannot change its storage preference')
+      })
+    })
+  })
+})

packages/snjs/mocha/vaults/key_rotation.test.js

@@ -29,7 +29,7 @@ describe('shared vault key rotation', function () {
 
     contactContext.lockSyncing()
 
-    const spy = sinon.spy(context.keys, 'reencryptKeySystemItemsKeysForVault')
+    const spy = sinon.spy(context.keys, 'queueVaultItemsKeysForReencryption')
 
     const promise = context.resolveWhenSharedVaultKeyRotationInvitesGetSent(sharedVault)
     await context.vaults.rotateVaultRootKey(sharedVault)
@@ -229,36 +229,4 @@ describe('shared vault key rotation', function () {
 
     await deinitContactContext()
   })
-
-  it('should throw if attempting to change password of locked vault', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should respect storage preference when rotating key system root key', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should change storage preference from synced to local', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should change storage preference from local to synced', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should resync key system items key if it is encrypted with noncurrent key system root key', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should change password type from user inputted to randomized', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should change password type from randomized to user inputted', async () => {
-    console.error('TODO: implement')
-  })
-
-  it('should not be able to change storage mode of third party vault', async () => {
-    console.error('TODO: implement')
-  })
 })

packages/snjs/mocha/vaults/keypair-change.test.js

@@ -24,18 +24,139 @@ describe('keypair change', function () {
   })
 
   it('contacts should be able to handle receiving multiple keypair changed messages and trust them in order', async () => {
-    console.error('TODO: implement test')
+    const { note, contactContext, deinitContactContext } =
+      await Collaboration.createSharedVaultWithAcceptedInviteAndNote(context)
+
+    contactContext.lockSyncing()
+
+    const publicKeyChain = []
+    const signingPublicKeyChain = []
+
+    publicKeyChain.push(context.publicKey)
+    signingPublicKeyChain.push(context.signingPublicKey)
+
+    await context.changePassword('new_password')
+    publicKeyChain.push(context.publicKey)
+    signingPublicKeyChain.push(context.signingPublicKey)
+
+    await context.changePassword('new_password-2')
+    publicKeyChain.push(context.publicKey)
+    signingPublicKeyChain.push(context.signingPublicKey)
+
+    await context.changePassword('new_password-3')
+    publicKeyChain.push(context.publicKey)
+    signingPublicKeyChain.push(context.signingPublicKey)
+
+    await context.changeNoteTitleAndSync(note, 'new title')
+
+    contactContext.unlockSyncing()
+    const promise = contactContext.resolveWhenAsymmetricMessageProcessingCompletes()
+    await contactContext.sync()
+    await promise
+
+    const originatorContact = contactContext.contacts.findContact(context.userUuid)
+    let currentKeySet = originatorContact.publicKeySet
+    for (let i = publicKeyChain.length - 1; i >= 0; i--) {
+      const publicKey = publicKeyChain[i]
+      const signingPublicKey = signingPublicKeyChain[i]
+      expect(currentKeySet.encryption).to.equal(publicKey)
+      expect(currentKeySet.signing).to.equal(signingPublicKey)
+      currentKeySet = currentKeySet.previousKeySet
+    }
+
+    const receivedNote = contactContext.items.findItem(note.uuid)
+    expect(receivedNote.title).to.equal('new title')
+    expect(receivedNote.signatureData.required).to.be.true
+    expect(receivedNote.signatureData.result.passes).to.be.true
+
+    await deinitContactContext()
   })
 
   it('should not trust messages sent with previous key pair', async () => {
-    console.error('TODO: implement test')
+    const { sharedVault, contactContext, deinitContactContext } =
+      await Collaboration.createSharedVaultWithAcceptedInviteAndNote(context)
+
+    contactContext.lockSyncing()
+
+    const previousKeyPair = context.encryption.getKeyPair()
+    const previousSigningKeyPair = context.encryption.getSigningKeyPair()
+
+    await context.changePassword('new_password')
+
+    sinon.stub(context.encryption, 'getKeyPair').returns(previousKeyPair)
+    sinon.stub(context.encryption, 'getSigningKeyPair').returns(previousSigningKeyPair)
+
+    await context.vaults.changeVaultNameAndDescription(sharedVault, {
+      name: 'New Name',
+      description: 'New Description',
+    })
+
+    contactContext.unlockSyncing()
+    const promise = contactContext.resolveWhenAsymmetricMessageProcessingCompletes()
+    await contactContext.sync()
+    await promise
+
+    const updatedVault = contactContext.vaults.getVault({ keySystemIdentifier: sharedVault.systemIdentifier })
+    expect(updatedVault.name).to.equal(sharedVault.name)
+    expect(updatedVault.description).to.equal(sharedVault.description)
+    expect(updatedVault.name).to.not.equal('New Name')
+    expect(updatedVault.description).to.not.equal('New Description')
+
+    await deinitContactContext()
   })
 
   it('should reupload invites after rotating keypair', async () => {
-    console.error('TODO: implement test')
+    const { contactContext, deinitContactContext } =
+      await Collaboration.createSharedVaultWithUnacceptedButTrustedInvite(context)
+
+    contactContext.lockSyncing()
+
+    const invite = (await contactContext.vaultInvites.downloadInboundInvites())[0]
+
+    const promise = context.resolveWhenAsyncFunctionCompletes(
+      context.application.dependencies.get(TYPES.SendVaultInvite),
+      'execute',
+    )
+    await context.changePassword('new_password')
+    await promise
+
+    const updatedInvite = (await contactContext.vaultInvites.downloadInboundInvites())[0]
+    expect(updatedInvite.uuid).to.not.equal(invite.uuid)
+    expect(updatedInvite.created_at_timestamp).to.not.equal(invite.created_at_timestamp)
+
+    await deinitContactContext()
   })
 
   it('should reupload asymmetric messages after rotating keypair', async () => {
-    console.error('TODO: implement test')
+    const { sharedVault, contactContext, deinitContactContext } =
+      await Collaboration.createSharedVaultWithAcceptedInviteAndNote(context)
+
+    contactContext.lockSyncing()
+
+    await context.vaults.changeVaultNameAndDescription(sharedVault, {
+      name: 'New Name',
+      description: 'New Description',
+    })
+
+    const originalMessages = await contactContext.asymmetric.getInboundMessages()
+    expect(originalMessages.length).to.equal(1)
+    const originalMessage = originalMessages[0]
+
+    const promise = context.resolveWhenAsyncFunctionCompletes(
+      context.application.dependencies.get(TYPES.HandleKeyPairChange),
+      'execute',
+    )
+    await context.changePassword('new_password')
+    await promise
+
+    const updatedMessages = await contactContext.asymmetric.getInboundMessages()
+    const expectedMessages = ['keypair-change', 'vault-change']
+    expect(updatedMessages.length).to.equal(expectedMessages.length)
+
+    expect(updatedMessages.some((message) => message.uuid === originalMessage.uuid)).to.be.false
+    expect(updatedMessages.some((message) => message.created_at_timestamp === originalMessage.created_at_timestamp)).to
+      .be.false
+
+    await deinitContactContext()
   })
 })

packages/snjs/mocha/vaults/vaults.test.js

@@ -24,25 +24,10 @@ describe('vaults', function () {
     vaults = context.vaults
   })
 
-  describe('locking', () => {
-    it('should throw if attempting to add item to locked vault', async () => {
-      console.error('TODO: implement')
-    })
-
-    it('should throw if attempting to remove item from locked vault', async () => {
-      console.error('TODO: implement')
-    })
-
-    it('locking vault should remove root key and items keys from memory', async () => {
-      console.error('TODO: implement')
-    })
-  })
-
   describe('offline', function () {
     it('should be able to create an offline vault', async () => {
       const vault = await vaults.createRandomizedVault({
         name: 'My Vault',
-        storagePreference: KeySystemRootKeyStorageMode.Synced,
       })
 
       expect(vault.systemIdentifier).to.not.be.undefined
@@ -59,7 +44,6 @@ describe('vaults', function () {
       await context.application.addPasscode('123')
       const vault = await vaults.createRandomizedVault({
         name: 'My Vault',
-        storagePreference: KeySystemRootKeyStorageMode.Synced,
       })
 
       expect(vault.systemIdentifier).to.not.be.undefined
@@ -75,7 +59,6 @@ describe('vaults', function () {
     it('should add item to offline vault', async () => {
       const vault = await vaults.createRandomizedVault({
         name: 'My Vault',
-        storagePreference: KeySystemRootKeyStorageMode.Synced,
       })
       const item = await context.createSyncedNote()
 
@@ -89,7 +72,6 @@ describe('vaults', function () {
       const appIdentifier = context.identifier
       const vault = await vaults.createRandomizedVault({
         name: 'My Vault',
-        storagePreference: KeySystemRootKeyStorageMode.Synced,
       })
       const note = await context.createSyncedNote('foo', 'bar')
       await vaults.moveItemToVault(vault, note)
@@ -110,7 +92,6 @@ describe('vaults', function () {
         const appIdentifier = context.identifier
         const vault = await vaults.createRandomizedVault({
           name: 'My Vault',
-          storagePreference: KeySystemRootKeyStorageMode.Synced,
         })
         const note = await context.createSyncedNote('foo', 'bar')
         await vaults.moveItemToVault(vault, note)
@@ -138,7 +119,6 @@ describe('vaults', function () {
         const appIdentifier = context.identifier
         const vault = await vaults.createRandomizedVault({
           name: 'My Vault',
-          storagePreference: KeySystemRootKeyStorageMode.Synced,
         })
         const note = await context.createSyncedNote('foo', 'bar')
         await vaults.moveItemToVault(vault, note)
@@ -168,7 +148,6 @@ describe('vaults', function () {
     it('should create a vault', async () => {
       const vault = await vaults.createRandomizedVault({
         name: 'My Vault',
-        storagePreference: KeySystemRootKeyStorageMode.Synced,
       })
       expect(vault).to.not.be.undefined
 
@@ -184,7 +163,6 @@ describe('vaults', function () {
       const note = await context.createSyncedNote('foo', 'bar')
       const vault = await vaults.createRandomizedVault({
         name: 'My Vault',
-        storagePreference: KeySystemRootKeyStorageMode.Synced,
       })
 
       await vaults.moveItemToVault(vault, note)
@@ -198,7 +176,6 @@ describe('vaults', function () {
         const appIdentifier = context.identifier
         const vault = await vaults.createRandomizedVault({
           name: 'My Vault',
-          storagePreference: KeySystemRootKeyStorageMode.Synced,
         })
         const note = await context.createSyncedNote('foo', 'bar')
         await vaults.moveItemToVault(vault, note)
@@ -219,7 +196,6 @@ describe('vaults', function () {
       it('rotating a key system root key should create a new vault items key', async () => {
         const vault = await vaults.createRandomizedVault({
           name: 'My Vault',
-          storagePreference: KeySystemRootKeyStorageMode.Synced,
         })
 
         const keySystemItemsKey = context.keys.getKeySystemItemsKeys(vault.systemIdentifier)[0]
@@ -235,7 +211,6 @@ describe('vaults', function () {
       it('deleting a vault should delete all its items', async () => {
         const vault = await vaults.createRandomizedVault({
           name: 'My Vault',
-          storagePreference: KeySystemRootKeyStorageMode.Synced,
         })
         const note = await context.createSyncedNote('foo', 'bar')
         await vaults.moveItemToVault(vault, note)

packages/snjs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@standardnotes/snjs",
-  "version": "2.202.12",
+  "version": "2.202.15",
   "engines": {
     "node": ">=16.0.0 <17.0.0"
   },

packages/ui-services/CHANGELOG.md

@@ -3,6 +3,18 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.28.13](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/ui-services
+
+## [1.28.12](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-26)
+
+**Note:** Version bump only for package @standardnotes/ui-services
+
+## [1.28.11](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-25)
+
+**Note:** Version bump only for package @standardnotes/ui-services
+
 ## [1.28.10](https://github.com/standardnotes/app/compare/@standardnotes/[email protected]...@standardnotes/[email protected]) (2023-07-24)
 
 **Note:** Version bump only for package @standardnotes/ui-services