Merge current main and Maintenance keys into settings localisation

src/modules/coreFeatures/ModuleResolveMismatchedTweaks.ts

@@ -99,6 +99,17 @@ function resolutionSettingsSignature(settings: ObsidianLiveSyncSettings): string
 }
 
 export class ModuleResolvingMismatchedTweaks extends AbstractModule {
+    private requiresIdConfigurationReview(assessment: TweakAssessment): boolean {
+        if (!assessment.entries.some(({ key, relation }) => key === "idDerivationVersion" && relation === "different")) {
+            return false;
+        }
+        Logger(
+            "The document ID configurations differ. Import the correct Setup URI, or configure the matching ID key, before synchronising.",
+            LOG_LEVEL_NOTICE
+        );
+        return true;
+    }
+
     private _selectNewerTweakSide(current: TweakValues, preferred: Partial<TweakValues>): "REMOTE" | "CURRENT" {
         Logger(`Modified: ${current.tweakModified} (current) vs ${preferred.tweakModified} (preferred)`);
         const currentModified = current.tweakModified;
@@ -196,6 +207,7 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
         assessment = assessTweakCompatibility(this.settings, preferred)
     ): Promise<[TweakValues | boolean, boolean]> {
         if (assessment.alignment === "matched") return [false, false];
+        if (this.requiresIdConfigurationReview(assessment)) return [false, false];
         const acceptedSettings = settingsAfterAdoption(assessment, "adoptPreferred");
         const autoAcceptSide = await this._shouldAutoAcceptCompatibleLossy(assessment);
         if (autoAcceptSide === "REMOTE") return [acceptedSettings, false];
@@ -363,6 +375,7 @@ export class ModuleResolvingMismatchedTweaks extends AbstractModule {
         const trialSignature = JSON.stringify(trialSetting);
         const currentSignature = resolutionSettingsSignature(this.settings);
         const assessment = assessTweakCompatibility(trialSetting, preferred);
+        if (this.requiresIdConfigurationReview(assessment)) return { result: false, requireFetch: false };
         if (assessment.alignment === "matched") {
             this._log("The settings in the remote database are the same as the local database.", LOG_LEVEL_NOTICE);
             return { result: false, requireFetch: false };

src/modules/coreFeatures/ModuleResolveMismatchedTweaks.unit.spec.ts

@@ -7,7 +7,7 @@ import {
     type TweakValues,
 } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import { extractObject } from "octagonal-wheels/object";
-import { assessTweakCompatibility } from "@vrtmrz/livesync-commonlib/settings";
+import { assessTweakCompatibility, configuredIdKey } from "@vrtmrz/livesync-commonlib/settings";
 import { ModuleResolvingMismatchedTweaks } from "./ModuleResolveMismatchedTweaks";
 import { setLang } from "@/common/translation";
 import {
@@ -74,6 +74,68 @@ function createModule(settingsOverride: Partial<typeof DEFAULT_SETTINGS> = {}) {
 }
 
 describe("ModuleResolvingMismatchedTweaks", () => {
+    it.each([0, 1] as const)(
+        "keeps ID configuration %s when automatically aligning Chunk settings",
+        async (idDerivationVersion) => {
+            const idDerivationKey = idDerivationVersion === 1 ? "ab".repeat(32) : "";
+            const { module, core, askSelectStringDialogue } = createModule({
+                encrypt: true,
+                usePathObfuscation: false,
+                idDerivationVersion,
+                idDerivationKey,
+                autoAcceptCompatibleTweak: true,
+                hashAlg: "xxhash64",
+                tweakModified: 1,
+            });
+            const preferred: TweakValues = {
+                ...extractObject(TweakValuesTemplate, core.settings),
+                idDerivationVersion: idDerivationVersion === 1 ? 0 : 1,
+                hashAlg: "xxhash32",
+                tweakModified: 2,
+            };
+            core._services.tweakValue = {
+                checkAndAskResolvingMismatched: module._checkAndAskResolvingMismatchedTweaks.bind(module),
+            };
+            core._services.setting.saveSettingData.mockImplementation(async () => {
+                configuredIdKey(core.settings);
+            });
+
+            await expect(module._askResolvingMismatchedTweaks(preferred, async () => true)).resolves.toBe("CHECKAGAIN");
+
+            expect(core.settings).toMatchObject({ idDerivationVersion, idDerivationKey, hashAlg: "xxhash32" });
+            expect(askSelectStringDialogue).not.toHaveBeenCalled();
+        }
+    );
+
+    it.each(["active", "trial"] as const)(
+        "withholds ordinary tweak adoption for different document ID modes (%s)",
+        async (route) => {
+            const { module, core, askSelectStringDialogue } = createModule({
+                encrypt: true,
+                usePathObfuscation: true,
+                idDerivationVersion: 0,
+                idDerivationKey: "",
+            });
+            const preferred: TweakValues = {
+                ...extractObject(TweakValuesTemplate, core.settings),
+                idDerivationVersion: 1,
+            };
+
+            if (route === "active") {
+                await expect(module._checkAndAskResolvingMismatchedTweaks(preferred)).resolves.toEqual([false, false]);
+            } else {
+                await expect(module._askUseRemoteConfiguration(core.settings, preferred)).resolves.toEqual({
+                    result: false,
+                    requireFetch: false,
+                });
+            }
+
+            expect(askSelectStringDialogue).not.toHaveBeenCalled();
+            expect(core._services.setting.saveSettingData).not.toHaveBeenCalled();
+            expect(core.settings).toMatchObject({ idDerivationVersion: 0, idDerivationKey: "" });
+        }
+    );
+
     it("compatibility: offers ordinary application for a missing legacy filename-case setting", async () => {
         const { module, askSelectStringDialogue } = createModule({
             autoAcceptCompatibleTweak: false,

src/modules/features/ModuleLog.ts

@@ -10,7 +10,7 @@ import {
 import { scheduleTask } from "octagonal-wheels/concurrency/task";
 import { fireAndForget, isDirty, throttle } from "@vrtmrz/livesync-commonlib/compat/common/utils";
 import {
-    collectingChunks,
+    chunkFetchCounts,
     pluginScanningCount,
     hiddenFilesEventCount,
     hiddenFilesProcessingCount,
@@ -36,7 +36,11 @@ import {
     formatRemoteActivityStatusLabel,
     getTrackedRequestCount,
 } from "./RemoteActivityStatus.ts";
-import { createMinimumVisibleActivityCount, createPaddedCounterLabel } from "./StatusBarDisplay.ts";
+import {
+    createChunkFetchCounterLabel,
+    createMinimumVisibleActivityCount,
+    createPaddedCounterLabel,
+} from "./StatusBarDisplay.ts";
 import type { LiveSyncCore } from "@/main.ts";
 import { LiveSyncError } from "@vrtmrz/livesync-commonlib/compat/common/LSError";
 import { isValidPath } from "@/common/utils.ts";
@@ -140,7 +144,7 @@ export class ModuleLog extends AbstractObsidianModule {
         const labelStorageCount = registerDisplay(
             createPaddedCounterLabel(this.services.replication.storageApplyingCount, `💾`)
         );
-        const labelChunkCount = registerDisplay(createPaddedCounterLabel(collectingChunks, `🧩`));
+        const labelChunkCount = registerDisplay(createChunkFetchCounterLabel(chunkFetchCounts));
         const labelPluginScanCount = registerDisplay(createPaddedCounterLabel(pluginScanningCount, `🔌`));
         const labelConflictProcessCount = registerDisplay(
             createPaddedCounterLabel(this.services.conflict.conflictProcessQueueCount, `🔩`)

src/modules/features/ModuleObsidianSettingAsMarkdown.credentials.unit.spec.ts

@@ -0,0 +1,323 @@
+import { describe, expect, it, vi } from "vitest";
+import { parse, stringify } from "yaml";
+import {
+    DEFAULT_SETTINGS,
+    REMOTE_MINIO,
+    type ObsidianLiveSyncSettings,
+} from "@vrtmrz/livesync-commonlib/compat/common/types";
+import { ConnectionStringParser } from "@vrtmrz/livesync-commonlib/compat/common/ConnectionString";
+import { CLOUDFLARE_TURN_TYPE } from "@/integrations/cloudflare/settings";
+import { ModuleObsidianSettingsAsMarkdown } from "./ModuleObsidianSettingAsMarkdown";
+
+vi.mock("@/deps", async () => {
+    const yaml = await import("yaml");
+    return { parseYaml: yaml.parse, stringifyYaml: yaml.stringify };
+});
+
+function createHarness(includeCredentials = false, existingFile = false) {
+    const settings: ObsidianLiveSyncSettings = {
+        ...structuredClone(DEFAULT_SETTINGS),
+        remoteType: REMOTE_MINIO,
+        remoteConfigurations: {},
+        activeConfigurationId: "",
+        settingSyncFile: "LiveSync/synthetic-settings.md",
+        writeCredentialsForSettingSync: includeCredentials,
+        accessKey: "synthetic-export-access-key",
+        secretKey: "synthetic-export-secret-key",
+        couchDB_PASSWORD: "synthetic-export-couch-password",
+        encryptedCouchDBConnection: "synthetic-encrypted-connection",
+    };
+    const files = new Map<string, string>();
+    if (existingFile) {
+        files.set(
+            settings.settingSyncFile,
+            "Synthetic note\n````yaml:livesync-setting\n" + stringify(settings) + "\n````\n"
+        );
+    }
+    const storageAccess = {
+        isExists: vi.fn(async (path: string) => files.has(path)),
+        ensureDir: vi.fn(async () => true),
+        readFileText: vi.fn(async (path: string) => files.get(path) ?? ""),
+        writeFileAuto: vi.fn(async (path: string, data: string) => {
+            files.set(path, data);
+            return true;
+        }),
+    };
+    const module = Object.assign(Object.create(ModuleObsidianSettingsAsMarkdown.prototype), {
+        core: { settings, storageAccess },
+        _log: vi.fn(),
+    }) as ModuleObsidianSettingsAsMarkdown;
+    return { module, settings, files, storageAccess };
+}
+
+describe("ModuleObsidianSettingsAsMarkdown", () => {
+    it.each([false, true])(
+        "respects the sharing option for new and existing files (existing: %s)",
+        async (existingFile) => {
+            const { module, settings, files, storageAccess } = createHarness(false, existingFile);
+            settings.P2P_managedType = CLOUDFLARE_TURN_TYPE;
+            await module.saveSettingToMarkdown(settings.settingSyncFile);
+            const content = files.get(settings.settingSyncFile)!;
+            expect(storageAccess.writeFileAuto).toHaveBeenCalled();
+            const written = parse(module.extractSettingFromWholeText(content).body);
+            expect(written).not.toHaveProperty("couchDB_PASSWORD");
+            expect(content).not.toContain(settings.encryptedCouchDBConnection);
+            expect(Object.keys(written).filter((key) => ["accessKey", "secretKey"].includes(key))).toEqual([]);
+            expect(content).not.toContain(settings.accessKey);
+            expect(content).not.toContain(settings.secretKey);
+            expect(module._log).toHaveBeenCalledWith(
+                "When credential export is disabled, connection profiles are omitted. To share them, export the settings manually from the settings screen.",
+                expect.any(Number)
+            );
+        }
+    );
+
+    it("exports complete connection settings when sharing is enabled", async () => {
+        const { module, settings, files } = createHarness(true);
+        settings.couchDB_USER = "synthetic-export-couch-user";
+        settings.passphrase = "synthetic-export-passphrase";
+        settings.idDerivationKey = "synthetic-export-id-key";
+        settings.jwtKey = "synthetic-export-jwt-key";
+        settings.jwtKid = "synthetic-export-jwt-kid";
+        settings.jwtSub = "synthetic-export-jwt-subject";
+        settings.couchDB_CustomHeaders = "X-Couch-Export: synthetic-couch-header";
+        settings.bucketCustomHeaders = "X-Bucket-Export: synthetic-bucket-header";
+        settings.P2P_passphrase = "synthetic-export-p2p-passphrase";
+        settings.P2P_managedType = CLOUDFLARE_TURN_TYPE;
+        settings.P2P_managedId = "synthetic-managed-turn-key-id";
+        settings.P2P_managedToken = "synthetic-managed-turn-token";
+        const activeUri = ConnectionStringParser.serialize({
+            type: "s3",
+            settings: { ...settings, endpoint: "https://active.synthetic.invalid" },
+        });
+        const inactiveUri = ConnectionStringParser.serialize({
+            type: "s3",
+            settings: {
+                ...settings,
+                endpoint: "https://inactive.synthetic.invalid",
+                accessKey: "synthetic-inactive-access-key",
+                secretKey: "synthetic-inactive-secret-key",
+            },
+        });
+        const managedTurnUri = ConnectionStringParser.serialize({
+            type: "p2p",
+            settings: {
+                ...settings,
+                P2P_roomID: "synthetic-managed-turn-room",
+                P2P_relays: "wss://relay.synthetic.invalid",
+            },
+        });
+        settings.activeConfigurationId = "object-storage-active";
+        settings.P2P_ActiveRemoteConfigurationId = "p2p-managed";
+        settings.remoteConfigurations = {
+            "object-storage-active": {
+                id: "object-storage-active",
+                name: "Synthetic active profile",
+                uri: activeUri,
+                isEncrypted: false,
+            },
+            "object-storage-inactive": {
+                id: "object-storage-inactive",
+                name: "Synthetic inactive profile",
+                uri: inactiveUri,
+                isEncrypted: false,
+            },
+            "p2p-managed": {
+                id: "p2p-managed",
+                name: "Synthetic managed P2P profile",
+                uri: managedTurnUri,
+                isEncrypted: false,
+            },
+        };
+        const originalSettings = structuredClone(settings);
+        await module.saveSettingToMarkdown(settings.settingSyncFile);
+        const content = files.get(settings.settingSyncFile)!;
+        const written = parse(module.extractSettingFromWholeText(content).body);
+        expect(written.accessKey).toBe(settings.accessKey);
+        expect(written.secretKey).toBe(settings.secretKey);
+        expect(written.couchDB_USER).toBe(settings.couchDB_USER);
+        expect(written.couchDB_PASSWORD).toBe(settings.couchDB_PASSWORD);
+        expect(written.passphrase).toBe(settings.passphrase);
+        expect(written.idDerivationKey).toBe(settings.idDerivationKey);
+        expect(written.jwtKey).toBe(settings.jwtKey);
+        expect(written.jwtKid).toBe(settings.jwtKid);
+        expect(written.jwtSub).toBe(settings.jwtSub);
+        expect(written.couchDB_CustomHeaders).toBe(settings.couchDB_CustomHeaders);
+        expect(written.bucketCustomHeaders).toBe(settings.bucketCustomHeaders);
+        expect(written.P2P_passphrase).toBe(settings.P2P_passphrase);
+        expect(written.remoteConfigurations).toEqual(settings.remoteConfigurations);
+        expect(written.activeConfigurationId).toBe(settings.activeConfigurationId);
+        expect(written.P2P_ActiveRemoteConfigurationId).toBe(settings.P2P_ActiveRemoteConfigurationId);
+        expect(written).not.toHaveProperty("P2P_managedType");
+        expect(written).not.toHaveProperty("P2P_managedId");
+        expect(written).not.toHaveProperty("P2P_managedToken");
+        expect(content).toContain(
+            "When credential export is disabled, connection profiles are omitted. To share them, export the settings manually from the settings screen."
+        );
+        expect(content).not.toContain(settings.encryptedCouchDBConnection);
+        expect(settings).toEqual(originalSettings);
+        expect(module._log).not.toHaveBeenCalledWith(
+            expect.stringContaining("When credential export is disabled"),
+            expect.any(Number)
+        );
+    });
+
+    it("applies the sharing option to active and inactive profiles", async () => {
+        const { module, settings, files } = createHarness(false);
+        const activeUri = ConnectionStringParser.serialize({
+            type: "s3",
+            settings: { ...settings, endpoint: "https://active.synthetic.invalid" },
+        });
+        const inactiveUri = ConnectionStringParser.serialize({
+            type: "s3",
+            settings: {
+                ...settings,
+                endpoint: "https://inactive.synthetic.invalid",
+                accessKey: "synthetic-inactive-access-key",
+                secretKey: "synthetic-inactive-secret-key",
+            },
+        });
+        const secrets = [
+            settings.accessKey,
+            settings.secretKey,
+            "synthetic-inactive-access-key",
+            "synthetic-inactive-secret-key",
+        ];
+        settings.accessKey = "";
+        settings.secretKey = "";
+        settings.activeConfigurationId = "active";
+        settings.remoteConfigurations = {
+            active: { id: "active", name: "Synthetic active profile", uri: activeUri, isEncrypted: false },
+            inactive: { id: "inactive", name: "Synthetic inactive profile", uri: inactiveUri, isEncrypted: false },
+        };
+        settings.P2P_ActiveRemoteConfigurationId = "p2p-active";
+        await module.saveSettingToMarkdown(settings.settingSyncFile);
+        const content = files.get(settings.settingSyncFile)!;
+        const written = parse(module.extractSettingFromWholeText(content).body);
+        expect(written).not.toHaveProperty("remoteConfigurations");
+        expect(written).not.toHaveProperty("activeConfigurationId");
+        expect(written).not.toHaveProperty("P2P_ActiveRemoteConfigurationId");
+        expect(secrets.filter((value) => content.includes(value))).toEqual([]);
+    });
+
+    it("retains local connections when importing ordinary settings", async () => {
+        const filename = "LiveSync/synthetic-settings.md";
+        const activeUri = ConnectionStringParser.serialize({
+            type: "s3",
+            settings: {
+                ...DEFAULT_SETTINGS,
+                endpoint: "https://active.synthetic.invalid",
+                accessKey: "synthetic-profile-access-key",
+                secretKey: "synthetic-profile-secret-key",
+            },
+        });
+        const inactiveUri = ConnectionStringParser.serialize({
+            type: "s3",
+            settings: {
+                ...DEFAULT_SETTINGS,
+                endpoint: "https://inactive.synthetic.invalid",
+                accessKey: "synthetic-inactive-access-key",
+                secretKey: "synthetic-inactive-secret-key",
+            },
+        });
+        const currentSettings: ObsidianLiveSyncSettings = {
+            ...structuredClone(DEFAULT_SETTINGS),
+            remoteType: REMOTE_MINIO,
+            settingSyncFile: filename,
+            writeCredentialsForSettingSync: false,
+            accessKey: "synthetic-local-access-key",
+            secretKey: "synthetic-local-secret-key",
+            couchDB_USER: "synthetic-local-user",
+            couchDB_PASSWORD: "synthetic-local-password",
+            couchDB_CustomHeaders: "X-Couch-Local: synthetic-couch-header",
+            bucketCustomHeaders: "X-Bucket-Local: synthetic-bucket-header",
+            jwtKey: "synthetic-local-jwt-key",
+            jwtKid: "synthetic-local-kid",
+            jwtSub: "synthetic-local-subject",
+            passphrase: "synthetic-local-passphrase",
+            idDerivationVersion: 1,
+            idDerivationKey: "ab".repeat(32),
+            activeConfigurationId: "object-storage-active",
+            P2P_ActiveRemoteConfigurationId: "p2p-active",
+            P2P_AutoStart: false,
+            remoteConfigurations: {
+                "object-storage-active": {
+                    id: "object-storage-active",
+                    name: "Synthetic active profile",
+                    uri: activeUri,
+                    isEncrypted: false,
+                },
+                "object-storage-inactive": {
+                    id: "object-storage-inactive",
+                    name: "Synthetic inactive profile",
+                    uri: inactiveUri,
+                    isEncrypted: false,
+                },
+            },
+        };
+        const markdownSettings = {
+            settingSyncFile: filename,
+            writeCredentialsForSettingSync: false,
+            P2P_AutoStart: true,
+        };
+        const document = "Synthetic note\n````yaml:livesync-setting\n" + stringify(markdownSettings) + "\n````\n";
+        const files = new Map([[filename, document]]);
+        const storageAccess = {
+            isExists: vi.fn(async (path: string) => files.has(path)),
+            readFileText: vi.fn(async (path: string) => files.get(path) ?? ""),
+        };
+        let openApplyDialogue: ((anchor: HTMLAnchorElement) => void) | undefined;
+        let applySettings: (() => void) | undefined;
+        const askSelectStringDialogue = vi.fn(async () => "Apply settings");
+        const applyExternalSettings = vi.fn(async (_settings: ObsidianLiveSyncSettings) => undefined);
+        const module = Object.assign(Object.create(ModuleObsidianSettingsAsMarkdown.prototype), {
+            core: {
+                settings: currentSettings,
+                storageAccess,
+                confirm: {
+                    askInPopup: vi.fn((_key: string, _text: string, callback: (anchor: HTMLAnchorElement) => void) => {
+                        openApplyDialogue = callback;
+                    }),
+                    askSelectStringDialogue,
+                },
+                rebuilder: { scheduleRebuild: vi.fn(), scheduleFetch: vi.fn() },
+                _services: {
+                    setting: {
+                        applyExternalSettings,
+                        clearUsedPassphrase: vi.fn(),
+                    },
+                    appLifecycle: { performRestart: vi.fn() },
+                },
+            },
+            _log: vi.fn(),
+        }) as ModuleObsidianSettingsAsMarkdown;
+
+        await module.checkAndApplySettingFromMarkdown(filename, false);
+        expect(openApplyDialogue).toBeDefined();
+        openApplyDialogue?.({
+            set text(_value: string) {},
+            addEventListener: (_type: string, listener: EventListenerOrEventListenerObject) => {
+                applySettings = listener as () => void;
+            },
+        } as HTMLAnchorElement);
+        applySettings?.();
+        await vi.waitFor(() => expect(applyExternalSettings).toHaveBeenCalledOnce());
+
+        const appliedSettings = applyExternalSettings.mock.calls[0]![0];
+        expect(appliedSettings.P2P_AutoStart).toBe(true);
+        expect(appliedSettings.accessKey).toBe(currentSettings.accessKey);
+        expect(appliedSettings.secretKey).toBe(currentSettings.secretKey);
+        expect(appliedSettings.couchDB_USER).toBe(currentSettings.couchDB_USER);
+        expect(appliedSettings.couchDB_PASSWORD).toBe(currentSettings.couchDB_PASSWORD);
+        expect(appliedSettings.couchDB_CustomHeaders).toBe(currentSettings.couchDB_CustomHeaders);
+        expect(appliedSettings.bucketCustomHeaders).toBe(currentSettings.bucketCustomHeaders);
+        expect(appliedSettings.jwtKey).toBe(currentSettings.jwtKey);
+        expect(appliedSettings.jwtKid).toBe(currentSettings.jwtKid);
+        expect(appliedSettings.jwtSub).toBe(currentSettings.jwtSub);
+        expect(appliedSettings.remoteConfigurations).toEqual(currentSettings.remoteConfigurations);
+        expect(appliedSettings.activeConfigurationId).toBe(currentSettings.activeConfigurationId);
+        expect(appliedSettings.P2P_ActiveRemoteConfigurationId).toBe(currentSettings.P2P_ActiveRemoteConfigurationId);
+        expect(appliedSettings.idDerivationVersion).toBe(currentSettings.idDerivationVersion);
+        expect(appliedSettings.idDerivationKey).toBe(currentSettings.idDerivationKey);
+    });
+});

src/modules/features/ModuleObsidianSettingAsMarkdown.ts

@@ -7,11 +7,12 @@ import {
 import { isObjectDifferent } from "octagonal-wheels/object";
 import { EVENT_SETTING_SAVED, eventHub } from "@/common/events";
 import { fireAndForget } from "octagonal-wheels/promises";
+import { type FilePathWithPrefix, type ObsidianLiveSyncSettings } from "@vrtmrz/livesync-commonlib/compat/common/types";
 import {
-    DEFAULT_SETTINGS,
-    type FilePathWithPrefix,
-    type ObsidianLiveSyncSettings,
-} from "@vrtmrz/livesync-commonlib/compat/common/types";
+    createMarkdownSettings,
+    mergeMarkdownSettings,
+    type MarkdownSettings,
+} from "@vrtmrz/livesync-commonlib/settings";
 import { parseYaml, stringifyYaml, type Editor, type MarkdownView } from "@/deps";
 import { LOG_LEVEL_DEBUG, LOG_LEVEL_INFO, LOG_LEVEL_NOTICE, LOG_LEVEL_VERBOSE } from "octagonal-wheels/common/logger";
 import { AbstractModule } from "@/modules/AbstractModule.ts";
@@ -132,15 +133,8 @@ export class ModuleObsidianSettingsAsMarkdown extends AbstractModule {
             return;
         }
 
-        let settingToApply = { ...DEFAULT_SETTINGS } as ObsidianLiveSyncSettings;
-        settingToApply = { ...settingToApply, ...newSetting };
+        const settingToApply = mergeMarkdownSettings(newSetting, this.settings);
         preserveManagedTurnProfilesOnMarkdownImport(newSetting, this.settings, settingToApply);
-        if (!settingToApply?.writeCredentialsForSettingSync) {
-            //New setting does not contains credentials.
-            settingToApply.couchDB_USER = this.settings.couchDB_USER;
-            settingToApply.couchDB_PASSWORD = this.settings.couchDB_PASSWORD;
-            settingToApply.passphrase = this.settings.passphrase;
-        }
         const oldSetting = this.generateSettingForMarkdown(
             this.settings,
             settingToApply.writeCredentialsForSettingSync
@@ -196,33 +190,21 @@ export class ModuleObsidianSettingsAsMarkdown extends AbstractModule {
         );
     }
 
-    generateSettingForMarkdown(
-        settings?: ObsidianLiveSyncSettings,
-        keepCredential?: boolean
-    ): Partial<ObsidianLiveSyncSettings> {
+    generateSettingForMarkdown(settings?: ObsidianLiveSyncSettings, keepCredential?: boolean): MarkdownSettings {
         const saveData = { ...(settings ? settings : this.settings) } as Partial<ObsidianLiveSyncSettings>;
-        delete saveData.encryptedCouchDBConnection;
-        delete saveData.encryptedPassphrase;
-        delete saveData.additionalSuffixOfDatabaseName;
-        if (!saveData.writeCredentialsForSettingSync && !keepCredential) {
-            delete saveData.couchDB_USER;
-            delete saveData.couchDB_PASSWORD;
-            delete saveData.passphrase;
-            delete saveData.jwtKey;
-            delete saveData.jwtKid;
-            delete saveData.jwtSub;
-            delete saveData.couchDB_CustomHeaders;
-            delete saveData.bucketCustomHeaders;
+        const credentialsIncluded = saveData.writeCredentialsForSettingSync || keepCredential === true;
+        if (!credentialsIncluded) {
+            omitManagedTurnProfilesFromMarkdown(saveData);
         }
-        omitManagedTurnProfilesFromMarkdown(saveData);
-        return saveData;
+        const includeCredentials = keepCredential === undefined ? undefined : credentialsIncluded;
+        return createMarkdownSettings(saveData, includeCredentials);
     }
 
     async saveSettingToMarkdown(filename: string) {
         const saveData = this.generateSettingForMarkdown();
-        if (hasManagedTurnSettings(this.settings)) {
+        if (!this.settings.writeCredentialsForSettingSync && hasManagedTurnSettings(this.settings)) {
             this._log(
-                "Share TURN provider credentials through an encrypted Setup URI. Connection profiles are omitted from Markdown settings.",
+                "When credential export is disabled, connection profiles are omitted. To share them, export the settings manually from the settings screen.",
                 LOG_LEVEL_INFO
             );
         }
@@ -238,6 +220,8 @@ If the name of this file matches the value of the "settingSyncFile" setting insi
 We can perform a command in this file.
 - \`Parse setting file\` : load the setting from the file.
 
+When credential export is disabled, connection profiles are omitted. To share them, export the settings manually from the settings screen.
+
 **Note** Please handle it with all of your care if you have configured to write credentials in.
 
 

src/modules/features/SettingDialogue/ObsidianLiveSyncSettingTab.ts

@@ -569,6 +569,7 @@ export class ObsidianLiveSyncSettingTab extends PluginSettingTab {
         }
     }
 
+    // Internal Metadata encryption affects future Metadata writes and is not a rebuild requirement.
     isNeedRebuildLocal() {
         return this.isSomeDirty([
             "useIndexedDBAdapter",

src/modules/features/SettingDialogue/PaneMaintenance.ts

@@ -24,7 +24,9 @@ export function paneMaintenance(
         paneEl,
         "div",
         {
-            text: $msg("The remote database is locked for synchronization to prevent vault corruption because this device isn't marked as 'resolved'. Please backup your vault, reset the local database, and select 'Mark this device as resolved'. This warning will persist until the device is confirmed as resolved by replication."),
+            text: $msg(
+                "The remote database is locked for synchronisation to prevent vault corruption because this device is not marked as 'resolved'. Please back up your vault, reset the local database, and select 'Mark this device as resolved'. This warning will persist until replication confirms the device is resolved."
+            ),
             cls: "op-warn",
         },
         (c) => {
@@ -32,7 +34,7 @@ export function paneMaintenance(
                 c,
                 "button",
                 {
-                    text: $msg("I've made a backup, mark this device 'resolved'"),
+                    text: $msg("I have made a backup, mark this device as resolved"),
                     cls: "mod-warning",
                 },
                 (e) => {
@@ -51,7 +53,9 @@ export function paneMaintenance(
         paneEl,
         "div",
         {
-            text: $msg("To prevent unwanted vault corruption, the remote database has been locked for synchronization. (This device is marked 'resolved') When all your devices are marked 'resolved', unlock the database. This warning kept showing until confirming the device is resolved by the replication"),
+            text: $msg(
+                "To prevent unwanted vault corruption, the remote database has been locked for synchronisation. (This device is marked as 'resolved'.) When all your devices are marked as 'resolved', unlock the database. This warning will continue to appear until replication confirms the device is resolved."
+            ),
             cls: "op-warn",
         },
         (c) =>
@@ -59,7 +63,7 @@ export function paneMaintenance(
                 c,
                 "button",
                 {
-                    text: $msg("I'm ready, unlock the database"),
+                    text: $msg("I am ready, unlock the database"),
                     cls: "mod-warning",
                 },
                 (e) => {
@@ -293,97 +297,101 @@ export function paneMaintenance(
     //     }
     // );
 
-    void addPanel(paneEl, $msg("Rebuilding Operations (Remote Only)"), () => {}, this.onlyOnCouchDBOrMinIO).then((paneEl) => {
-        new Setting(paneEl)
-            .setName($msg("Perform cleanup"))
-            .setDesc(
-                $msg(
-                    "Reduces storage space by discarding all non-latest revisions. This requires the same amount of free space on the remote server and the local client."
+    void addPanel(paneEl, $msg("Rebuilding Operations (Remote Only)"), () => {}, this.onlyOnCouchDBOrMinIO).then(
+        (paneEl) => {
+            new Setting(paneEl)
+                .setName($msg("Perform cleanup"))
+                .setDesc(
+                    $msg(
+                        "Reduces storage space by discarding all non-latest revisions. This requires the same amount of free space on the remote server and the local client."
+                    )
                 )
-            )
-            .addButton((button) =>
-                button
-                    .setButtonText($msg("Perform"))
-                    .setDisabled(false)
-                    .onClick(async () => {
-                        const replicator = this.core.replicator as LiveSyncCouchDBReplicator;
-                        Logger(`Cleanup has been began`, LOG_LEVEL_NOTICE, "compaction");
-                        if (await replicator.compactRemote(this.editingSettings)) {
-                            Logger(`Cleanup has been completed!`, LOG_LEVEL_NOTICE, "compaction");
-                        } else {
-                            Logger(`Cleanup has been failed!`, LOG_LEVEL_NOTICE, "compaction");
-                        }
-                    })
-            )
-            .addOnUpdate(this.onlyOnCouchDB);
+                .addButton((button) =>
+                    button
+                        .setButtonText($msg("Perform"))
+                        .setDisabled(false)
+                        .onClick(async () => {
+                            const replicator = this.core.replicator as LiveSyncCouchDBReplicator;
+                            Logger(`Cleanup has been began`, LOG_LEVEL_NOTICE, "compaction");
+                            if (await replicator.compactRemote(this.editingSettings)) {
+                                Logger(`Cleanup has been completed!`, LOG_LEVEL_NOTICE, "compaction");
+                            } else {
+                                Logger(`Cleanup has been failed!`, LOG_LEVEL_NOTICE, "compaction");
+                            }
+                        })
+                )
+                .addOnUpdate(this.onlyOnCouchDB);
 
-        new Setting(paneEl)
-            .setName($msg("Overwrite remote"))
-            .setDesc($msg("Overwrite remote with local DB and passphrase."))
-            .addButton((button) =>
-                setButtonDestructiveState(button)
-                    .setButtonText($msg("Send"))
-                    .setDisabled(false)
-                    .onClick(async () => {
-                        await this.rebuildDB("remoteOnly");
-                    })
-            );
+            new Setting(paneEl)
+                .setName($msg("Overwrite remote"))
+                .setDesc($msg("Overwrite remote with local DB and passphrase."))
+                .addButton((button) =>
+                    setButtonDestructiveState(button)
+                        .setButtonText($msg("Send"))
+                        .setDisabled(false)
+                        .onClick(async () => {
+                            await this.rebuildDB("remoteOnly");
+                        })
+                );
 
-        new Setting(paneEl)
-            .setName($msg("Reset all journal counter"))
-            .setDesc($msg("Initialise all journal history, On the next sync, every item will be received and sent."))
-            .addButton((button) =>
-                setButtonDestructiveState(button)
-                    .setButtonText($msg("Reset all"))
-                    .setDisabled(false)
-                    .onClick(async () => {
-                        await this.getMinioJournalSyncClient().resetCheckpointInfo();
-                        Logger(`Journal exchange history has been cleared.`, LOG_LEVEL_NOTICE);
-                    })
-            )
-            .addOnUpdate(this.onlyOnMinIO);
+            new Setting(paneEl)
+                .setName($msg("Reset all journal counter"))
+                .setDesc(
+                    $msg("Initialise all journal history, On the next sync, every item will be received and sent.")
+                )
+                .addButton((button) =>
+                    setButtonDestructiveState(button)
+                        .setButtonText($msg("Reset all"))
+                        .setDisabled(false)
+                        .onClick(async () => {
+                            await this.getMinioJournalSyncClient().resetCheckpointInfo();
+                            Logger(`Journal exchange history has been cleared.`, LOG_LEVEL_NOTICE);
+                        })
+                )
+                .addOnUpdate(this.onlyOnMinIO);
 
-        new Setting(paneEl)
-            .setName($msg("Purge all journal counter"))
-            .setDesc($msg("Purge all download/upload cache."))
-            .addButton((button) =>
-                setButtonDestructiveState(button)
-                    .setButtonText($msg("Reset all"))
-                    .setDisabled(false)
-                    .onClick(() => {
-                        this.getMinioJournalSyncClient().resetAllCaches();
-                        Logger(`Journal download/upload cache has been cleared.`, LOG_LEVEL_NOTICE);
-                    })
-            )
-            .addOnUpdate(this.onlyOnMinIO);
+            new Setting(paneEl)
+                .setName($msg("Purge all journal counter"))
+                .setDesc($msg("Purge all download/upload cache."))
+                .addButton((button) =>
+                    setButtonDestructiveState(button)
+                        .setButtonText($msg("Reset all"))
+                        .setDisabled(false)
+                        .onClick(() => {
+                            this.getMinioJournalSyncClient().resetAllCaches();
+                            Logger(`Journal download/upload cache has been cleared.`, LOG_LEVEL_NOTICE);
+                        })
+                )
+                .addOnUpdate(this.onlyOnMinIO);
 
-        new Setting(paneEl)
-            .setName($msg("Fresh Start Wipe"))
-            .setDesc($msg("Delete all data on the remote server."))
-            .addButton((button) =>
-                setButtonDestructiveState(button)
-                    .setButtonText($msg("Delete"))
-                    .setDisabled(false)
-                    .onClick(async () => {
-                        await this.getMinioJournalSyncClient().updateCheckPointInfo((info) => ({
-                            ...info,
-                            receivedFiles: new Set(),
-                            knownIDs: new Set(),
-                            lastLocalSeq: 0,
-                            sentIDs: new Set(),
-                            sentFiles: new Set(),
-                        }));
-                        const reset = await this.resetRemoteBucket();
-                        Logger(
-                            reset
-                                ? `Deleted all data on remote server`
-                                : `Fresh Start Wipe did not complete. Keep all synchronising devices stopped and run it again.`,
-                            LOG_LEVEL_NOTICE
-                        );
-                    })
-            )
-            .addOnUpdate(this.onlyOnMinIO);
-    });
+            new Setting(paneEl)
+                .setName($msg("Fresh Start Wipe"))
+                .setDesc($msg("Delete all data on the remote server."))
+                .addButton((button) =>
+                    setButtonDestructiveState(button)
+                        .setButtonText($msg("Delete"))
+                        .setDisabled(false)
+                        .onClick(async () => {
+                            await this.getMinioJournalSyncClient().updateCheckPointInfo((info) => ({
+                                ...info,
+                                receivedFiles: new Set(),
+                                knownIDs: new Set(),
+                                lastLocalSeq: 0,
+                                sentIDs: new Set(),
+                                sentFiles: new Set(),
+                            }));
+                            const reset = await this.resetRemoteBucket();
+                            Logger(
+                                reset
+                                    ? `Deleted all data on remote server`
+                                    : `Fresh Start Wipe did not complete. Keep all synchronising devices stopped and run it again.`,
+                                LOG_LEVEL_NOTICE
+                            );
+                        })
+                )
+                .addOnUpdate(this.onlyOnMinIO);
+        }
+    );
 
     void addPanel(paneEl, $msg("Reset")).then((paneEl) => {
         new Setting(paneEl)

src/modules/features/SettingDialogue/PaneRemoteConfig.ts

@@ -47,6 +47,12 @@ function getSettingsFromEditingSettings(editingSettings: AllSettings): ObsidianL
     }
     return workObj;
 }
+
+function syncIdDerivationSettings(target: Partial<ObsidianLiveSyncSettings>, source: ObsidianLiveSyncSettings): void {
+    target.idDerivationVersion = source.idDerivationVersion;
+    target.idDerivationKey = source.idDerivationKey;
+}
+
 function createRemoteConfigurationId(): string {
     return `remote-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
@@ -116,7 +122,28 @@ export function paneRemoteConfig(
                         .onClick(async () => {
                             const setupManager = this.core.getModule(SetupManager);
                             const originalSettings = getSettingsFromEditingSettings(this.editingSettings);
-                            await setupManager.onlyE2EEConfiguration(UserMode.Update, originalSettings);
+                            const originalIdDerivationVersion = this.core.settings.idDerivationVersion;
+                            const originalIdDerivationKey = this.core.settings.idDerivationKey;
+                            const applied = await setupManager.onlyE2EEConfiguration(UserMode.Update, originalSettings);
+                            if (applied) {
+                                this.editingSettings.encryptInternalMetadata =
+                                    this.core.settings.encryptInternalMetadata;
+                                if (this.initialSettings) {
+                                    this.initialSettings.encryptInternalMetadata =
+                                        this.core.settings.encryptInternalMetadata;
+                                }
+                                this.requestUpdate();
+                            }
+                            if (
+                                this.core.settings.idDerivationVersion !== originalIdDerivationVersion ||
+                                this.core.settings.idDerivationKey !== originalIdDerivationKey
+                            ) {
+                                syncIdDerivationSettings(this.editingSettings, this.core.settings);
+                                if (this.initialSettings) {
+                                    syncIdDerivationSettings(this.initialSettings, this.core.settings);
+                                }
+                                this.requestUpdate();
+                            }
                             updateE2EESummary();
                         })
                         .setButtonText($msg("Configure"))
@@ -155,9 +182,11 @@ export function paneRemoteConfig(
                 const currentConfigs = cloneRemoteConfigurations(this.core.settings.remoteConfigurations);
                 this.editingSettings.remoteConfigurations = currentConfigs;
                 this.editingSettings.activeConfigurationId = this.core.settings.activeConfigurationId;
+                syncIdDerivationSettings(this.editingSettings, this.core.settings);
                 if (this.initialSettings) {
                     this.initialSettings.remoteConfigurations = cloneRemoteConfigurations(currentConfigs);
                     this.initialSettings.activeConfigurationId = this.core.settings.activeConfigurationId;
+                    syncIdDerivationSettings(this.initialSettings, this.core.settings);
                 }
             };
             const persistRemoteConfigurations = async (synchroniseActiveRemote: boolean = false) => {
@@ -243,7 +272,10 @@ export function paneRemoteConfig(
                 ...DEFAULT_SETTINGS,
                 encrypt: this.editingSettings.encrypt,
                 usePathObfuscation: this.editingSettings.usePathObfuscation,
+                encryptInternalMetadata: this.editingSettings.encryptInternalMetadata,
                 passphrase: this.editingSettings.passphrase,
+                idDerivationVersion: this.editingSettings.idDerivationVersion,
+                idDerivationKey: this.editingSettings.idDerivationKey,
                 configPassphraseStore: this.editingSettings.configPassphraseStore,
             });
             const addRemoteConfiguration = async () => {

src/modules/features/SettingDialogue/PaneRemoteConfig.unit.spec.ts

@@ -2,6 +2,7 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 
 const runtime = vi.hoisted(() => ({
     buttonClasses: [] as string[],
+    clickHandlers: [] as Array<() => Promise<void> | void>,
     panels: [] as Array<{ destroy: ReturnType<typeof vi.fn> }>,
     settingClasses: [] as string[],
 }));
@@ -51,7 +52,8 @@ vi.mock("./LiveSyncSetting.ts", () => ({
                 setDestructive() {
                     return this;
                 },
-                onClick() {
+                onClick(callback: () => Promise<void> | void) {
+                    runtime.clickHandlers.push(callback);
                     return this;
                 },
                 setButtonText() {
@@ -97,6 +99,7 @@ vi.mock("@vrtmrz/livesync-commonlib/compat/common/ConnectionString", () => ({
     },
 }));
 vi.mock("@/modules/features/SetupWizard/dialogs/SetupRemote.svelte", () => ({ default: {} }));
+vi.mock("@/modules/features/SetupWizard/dialogs/SetupRemoteE2EE.svelte", () => ({ default: {} }));
 vi.mock("@/modules/features/SetupWizard/dialogs/SetupRemoteCouchDB.svelte", () => ({ default: {} }));
 vi.mock("@/modules/features/SetupWizard/dialogs/SetupRemoteBucket.svelte", () => ({ default: {} }));
 vi.mock("@/modules/features/SetupWizard/dialogs/SetupRemoteP2P.svelte", () => ({ default: {} }));
@@ -114,6 +117,7 @@ function createPanelElement(): HTMLElement {
 
 afterEach(() => {
     runtime.buttonClasses.length = 0;
+    runtime.clickHandlers.length = 0;
     runtime.panels.length = 0;
     runtime.settingClasses.length = 0;
     vi.clearAllMocks();
@@ -148,4 +152,93 @@ describe("paneRemoteConfig", () => {
 
         expect(runtime.panels[0].destroy).toHaveBeenCalledOnce();
     });
+
+    it("applies an internal Metadata preference change without scheduling setup initialisation", async () => {
+        const originalSettings = {
+            encrypt: true,
+            passphrase: "passphrase",
+            E2EEAlgorithm: "v2",
+            usePathObfuscation: true,
+            encryptInternalMetadata: false,
+            remoteConfigurations: {},
+        };
+        const setupManager = {
+            onlyE2EEConfiguration: vi.fn(async () => {
+                host.core.settings.encryptInternalMetadata = true;
+                return true;
+            }),
+        };
+        const host = {
+            editingSettings: { ...originalSettings },
+            initialSettings: { ...originalSettings },
+            core: {
+                settings: { ...originalSettings },
+                getModule: vi.fn(() => setupManager),
+            },
+            lifetimeComponent: { register: vi.fn() },
+            requestUpdate: vi.fn(),
+        };
+        const addPanel = vi.fn((_parent: HTMLElement, heading: string) => ({
+            then(callback: (paneEl: HTMLElement) => void) {
+                if (heading === "E2EE Configuration") {
+                    callback(createPanelElement());
+                }
+            },
+        }));
+
+        paneRemoteConfig.call(host as never, {} as HTMLElement, { addPanel } as never);
+        await runtime.clickHandlers[0]();
+
+        expect(setupManager.onlyE2EEConfiguration).toHaveBeenCalledOnce();
+        expect(host.editingSettings.encryptInternalMetadata).toBe(true);
+        expect(host.initialSettings.encryptInternalMetadata).toBe(true);
+        expect(host.requestUpdate).toHaveBeenCalledOnce();
+    });
+
+    it("copies applied ID derivation settings into both dialogue buffers", async () => {
+        const nextIdKey = "ab".repeat(32);
+        const originalSettings = {
+            encrypt: true,
+            passphrase: "passphrase",
+            E2EEAlgorithm: "v2",
+            usePathObfuscation: true,
+            encryptInternalMetadata: false,
+            idDerivationVersion: 0,
+            idDerivationKey: "",
+            remoteConfigurations: {},
+        };
+        const setupManager = {
+            onlyE2EEConfiguration: vi.fn(() => {
+                host.core.settings.idDerivationVersion = 1;
+                host.core.settings.idDerivationKey = nextIdKey;
+                return Promise.resolve(false);
+            }),
+        };
+        const host = {
+            editingSettings: { ...originalSettings },
+            initialSettings: { ...originalSettings },
+            core: {
+                settings: { ...originalSettings },
+                getModule: vi.fn(() => setupManager),
+            },
+            lifetimeComponent: { register: vi.fn() },
+            requestUpdate: vi.fn(),
+        };
+        const addPanel = vi.fn((_parent: HTMLElement, heading: string) => ({
+            then(callback: (paneEl: HTMLElement) => void) {
+                if (heading === "E2EE Configuration") {
+                    callback(createPanelElement());
+                }
+            },
+        }));
+
+        paneRemoteConfig.call(host as never, {} as HTMLElement, { addPanel } as never);
+        await runtime.clickHandlers[0]();
+
+        expect(host.editingSettings.idDerivationVersion).toBe(1);
+        expect(host.editingSettings.idDerivationKey).toBe(nextIdKey);
+        expect(host.initialSettings.idDerivationVersion).toBe(1);
+        expect(host.initialSettings.idDerivationKey).toBe(nextIdKey);
+        expect(host.requestUpdate).toHaveBeenCalledOnce();
+    });
 });

src/modules/features/SettingDialogue/PaneSelector.ts

@@ -32,7 +32,9 @@ export function paneSelector(this: ObsidianLiveSyncSettingTab, paneEl: HTMLEleme
 
         const nonSyncFilesSetting = new Setting(paneEl)
             .setName($msg("Non-Synchronising files"))
-            .setDesc($msg("(RegExp) If this is set, any changes to local and remote files that match this will be skipped."));
+            .setDesc(
+                $msg("(RegExp) If this is set, any changes to local and remote files that match this will be skipped.")
+            );
 
         const nonSyncFilesControl = mount(MultipleRegExpControl, {
             target: nonSyncFilesSetting.controlEl,

src/modules/features/SettingDialogue/settingUtils.ts

@@ -68,6 +68,7 @@ export function getE2EEConfigSummary(setting: ObsidianLiveSyncSettings, showAdva
 export function getSummaryFromPartialSettings(setting: Partial<ObsidianLiveSyncSettings>, showAdvanced = false) {
     const outputSummary: Record<string, string> = {};
     for (const key of Object.keys(setting) as (keyof ObsidianLiveSyncSettings)[]) {
+        if (key === "idDerivationKey" || key === "encryptedIdDerivationKey") continue;
         const config = getConfig(key as AllSettingItemKey);
         if (!config) continue;
         if (config.isAdvanced && !showAdvanced) continue;

src/modules/features/SetupManager.ts

@@ -1,6 +1,5 @@
 import {
     type BucketSyncSetting,
-    type EncryptionSettings,
     type ObsidianLiveSyncSettings,
     type P2PSyncSetting,
     LOG_LEVEL_NOTICE,
@@ -36,6 +35,7 @@ import type {
     SetupRemoteCouchDBResultType,
     SetupRemoteCouchDBInitialData,
     SetupRemoteE2EEResultType,
+    SetupRemoteE2EEInitialData,
     SetupRemoteP2PInitialData,
     SetupRemoteP2PResultType,
     SetupRemoteResultType,
@@ -58,6 +58,20 @@ function copySettingsForRemoteProfileUpdate(settings: ObsidianLiveSyncSettings):
     };
 }
 
+function normaliseImportedIdDerivationSettings(settings: ObsidianLiveSyncSettings): ObsidianLiveSyncSettings {
+    // Setup URIs are complete imports even when their encoder omitted default-valued fields.
+    // Fill each missing half so a receiving device cannot supply the unrelated saved key.
+    return {
+        ...settings,
+        idDerivationVersion: Object.prototype.hasOwnProperty.call(settings, "idDerivationVersion")
+            ? settings.idDerivationVersion
+            : 0,
+        idDerivationKey: Object.prototype.hasOwnProperty.call(settings, "idDerivationKey")
+            ? settings.idDerivationKey
+            : "",
+    };
+}
+
 /**
  * User modes for onboarding and setup
  */
@@ -219,7 +233,7 @@ export class SetupManager extends AbstractModule {
             return false;
         }
         this._log("Setup URI dialog closed.", LOG_LEVEL_VERBOSE);
-        return await this.onConfirmApplySettingsFromWizard(newSetting, userMode);
+        return await this.onConfirmApplySettingsFromWizard(normaliseImportedIdDerivationSettings(newSetting), userMode);
     }
 
     /**
@@ -328,14 +342,44 @@ export class SetupManager extends AbstractModule {
      * @returns
      */
     async onlyE2EEConfiguration(userMode: UserMode, currentSetting: ObsidianLiveSyncSettings): Promise<boolean> {
-        const e2eeConf = await this.dialogManager.openWithExplicitCancel<SetupRemoteE2EEResultType, EncryptionSettings>(
+        const e2eeConf = await this.dialogManager.openWithExplicitCancel<
+            SetupRemoteE2EEResultType,
+            SetupRemoteE2EEInitialData
+        >(
             SetupRemoteE2EE,
-            currentSetting
+            { settings: currentSetting, newVault: userMode === UserMode.NewUser }
         );
         if (e2eeConf === "cancelled") {
             this._log("E2EE configuration cancelled.", LOG_LEVEL_NOTICE);
             return false;
         }
+        const onlyInternalMetadataPreferenceChanged =
+            currentSetting.encryptInternalMetadata !== e2eeConf.encryptInternalMetadata &&
+            currentSetting.encrypt === e2eeConf.encrypt &&
+            currentSetting.passphrase === e2eeConf.passphrase &&
+            currentSetting.E2EEAlgorithm === e2eeConf.E2EEAlgorithm &&
+            currentSetting.usePathObfuscation === e2eeConf.usePathObfuscation &&
+            currentSetting.idDerivationVersion === e2eeConf.idDerivationVersion &&
+            currentSetting.idDerivationKey === e2eeConf.idDerivationKey;
+        if (userMode === UserMode.Update && onlyInternalMetadataPreferenceChanged) {
+            if (e2eeConf.encryptInternalMetadata && currentSetting.remoteType === REMOTE_COUCHDB) {
+                const proceed = "Enable without rebuilding — update every other device first";
+                const choice = await this.core.confirm.askSelectStringDialogue(
+                    "A manual remote Rebuild is strongly recommended to protect existing file properties. " +
+                        "Before continuing without rebuilding, update every other synchronising device to a version " +
+                        "which supports this option, including devices currently running LiveSync. " +
+                        "Existing properties remain unchanged until they are rewritten or rebuilt.",
+                    [proceed, "Cancel"],
+                    { title: "Encrypt internal file Properties", defaultAction: "Cancel" }
+                );
+                if (choice !== proceed) return false;
+            }
+            await this.services.setting.applyPartial(
+                { encryptInternalMetadata: e2eeConf.encryptInternalMetadata },
+                true
+            );
+            return true;
+        }
         const newSetting = {
             ...currentSetting,
             ...e2eeConf,
@@ -350,9 +394,12 @@ export class SetupManager extends AbstractModule {
      * @returns
      */
     async onConfigureManually(originalSetting: ObsidianLiveSyncSettings, userMode: UserMode): Promise<boolean> {
-        const e2eeConf = await this.dialogManager.openWithExplicitCancel<SetupRemoteE2EEResultType, EncryptionSettings>(
+        const e2eeConf = await this.dialogManager.openWithExplicitCancel<
+            SetupRemoteE2EEResultType,
+            SetupRemoteE2EEInitialData
+        >(
             SetupRemoteE2EE,
-            originalSetting
+            { settings: originalSetting, newVault: userMode === UserMode.NewUser }
         );
         if (e2eeConf === "cancelled") {
             this._log("Manual configuration cancelled.", LOG_LEVEL_NOTICE);
@@ -496,7 +543,13 @@ export class SetupManager extends AbstractModule {
      * @returns Promise that resolves to true if settings applied successfully, false otherwise
      */
     async decodeQR(qr: string) {
-        const newSettings = decodeSettingsFromQRCodeData(qr);
+        let newSettings: ObsidianLiveSyncSettings;
+        try {
+            newSettings = normaliseImportedIdDerivationSettings(decodeSettingsFromQRCodeData(qr));
+        } catch {
+            this._log("The QR configuration could not be decoded or contains unsupported settings.", LOG_LEVEL_NOTICE);
+            return false;
+        }
         return await this.onConfirmApplySettingsFromWizard(newSettings, UserMode.Unknown);
     }
 

src/modules/features/SetupManager.unit.spec.ts

@@ -193,6 +193,58 @@ describe("SetupManager", () => {
         expect(setting.currentSettings().activeConfigurationId).toBe("legacy-couchdb");
     });
 
+    it("compatibility: treats omitted ID derivation fields in a Setup URI as legacy defaults", async () => {
+        const { manager, setting, dialogManager } = createSetupManager();
+        const savedKey = "12".repeat(32);
+        setting.settings = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            idDerivationVersion: 1,
+            idDerivationKey: savedKey,
+        };
+        const imported = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+        } as Partial<ObsidianLiveSyncSettings>;
+        delete imported.idDerivationVersion;
+        delete imported.idDerivationKey;
+        vi.spyOn(setting, "adjustSettings").mockImplementation((settings) => Promise.resolve(settings));
+        dialogManager.openWithExplicitCancel.mockResolvedValueOnce(imported).mockResolvedValueOnce("cancelled");
+
+        await manager.onUseSetupURI(UserMode.Unknown, "mock-config://legacy-settings");
+
+        const mergedSettings = vi.mocked(setting.adjustSettings).mock.calls[0][0];
+        expect(mergedSettings.idDerivationVersion).toBe(0);
+        expect(mergedSettings.idDerivationKey).toBe("");
+        expect(setting.currentSettings().idDerivationKey).toBe(savedKey);
+    });
+
+    it("does not inherit the missing half of a partially present Setup URI ID configuration", async () => {
+        const { manager, setting, dialogManager } = createSetupManager();
+        const savedKey = "34".repeat(32);
+        setting.settings = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            idDerivationVersion: 1,
+            idDerivationKey: savedKey,
+        };
+        const imported = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            idDerivationVersion: 1,
+        } as Partial<ObsidianLiveSyncSettings>;
+        delete imported.idDerivationKey;
+        vi.spyOn(setting, "adjustSettings").mockImplementation((settings) => Promise.resolve(settings));
+        dialogManager.openWithExplicitCancel.mockResolvedValueOnce(imported).mockResolvedValueOnce("cancelled");
+
+        await manager.onUseSetupURI(UserMode.Unknown, "mock-config://partial-settings");
+
+        const mergedSettings = vi.mocked(setting.adjustSettings).mock.calls[0][0];
+        expect(mergedSettings.idDerivationVersion).toBe(1);
+        expect(mergedSettings.idDerivationKey).toBe("");
+        expect(setting.currentSettings().idDerivationKey).toBe(savedKey);
+    });
+
     it("compatibility: normalises imported flat remote settings from QR data before applying", async () => {
         const { manager, setting, dialogManager } = createSetupManager();
         vi.mocked(decodeSettingsFromQRCodeData).mockReturnValue(createLegacyRemoteSetting());
@@ -208,6 +260,79 @@ describe("SetupManager", () => {
         expect(setting.currentSettings().activeConfigurationId).toBe("legacy-couchdb");
     });
 
+    it("compatibility: applies legacy defaults when QR data omits ID derivation fields", async () => {
+        const { manager, setting, dialogManager } = createSetupManager();
+        const savedKey = "56".repeat(32);
+        setting.settings = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            idDerivationVersion: 1,
+            idDerivationKey: savedKey,
+        };
+        const imported = { ...createLegacyRemoteSetting(), isConfigured: true } as Partial<ObsidianLiveSyncSettings>;
+        delete imported.idDerivationVersion;
+        delete imported.idDerivationKey;
+        vi.mocked(decodeSettingsFromQRCodeData).mockReturnValue(imported as ObsidianLiveSyncSettings);
+        vi.spyOn(setting, "adjustSettings").mockImplementation((settings) => Promise.resolve(settings));
+        dialogManager.openWithExplicitCancel.mockResolvedValueOnce("cancelled");
+
+        await manager.decodeQR("qr-data");
+
+        const mergedSettings = vi.mocked(setting.adjustSettings).mock.calls[0][0];
+        expect(mergedSettings.idDerivationVersion).toBe(0);
+        expect(mergedSettings.idDerivationKey).toBe("");
+        expect(setting.currentSettings().idDerivationKey).toBe(savedKey);
+    });
+
+    it("rejects invalid QR settings before applying them", async () => {
+        const { manager, setting } = createSetupManager();
+        vi.mocked(decodeSettingsFromQRCodeData).mockImplementationOnce(() => {
+            throw new Error("Invalid ID derivation key");
+        });
+        const applyExternalSettings = vi.spyOn(setting, "applyExternalSettings");
+
+        await expect(manager.decodeQR("invalid-qr")).resolves.toBe(false);
+        expect(applyExternalSettings).not.toHaveBeenCalled();
+    });
+
+    it("requires the normal Fetch choice when ID derivation changes with the Metadata preference", async () => {
+        const { manager, setting, dialogManager, core } = createSetupManager();
+        const currentSettings: ObsidianLiveSyncSettings = {
+            ...createLegacyRemoteSetting(),
+            isConfigured: true,
+            encrypt: true,
+            passphrase: "e2ee-passphrase",
+            usePathObfuscation: true,
+            encryptInternalMetadata: false,
+            idDerivationVersion: 0,
+            idDerivationKey: "",
+        };
+        const nextIdKey = "78".repeat(32);
+        setting.settings = currentSettings;
+        const applyPartial = vi.spyOn(setting, "applyPartial");
+        core.confirm = {
+            askSelectStringDialogue: vi.fn(() =>
+                Promise.resolve("Enable without rebuilding — update every other device first")
+            ),
+        };
+        dialogManager.openWithExplicitCancel
+            .mockResolvedValueOnce({
+                ...currentSettings,
+                encryptInternalMetadata: true,
+                idDerivationVersion: 1,
+                idDerivationKey: nextIdKey,
+            })
+            .mockResolvedValueOnce("existing-user")
+            .mockResolvedValueOnce("apply");
+
+        await manager.onlyE2EEConfiguration(UserMode.Update, currentSettings);
+
+        expect(applyPartial).not.toHaveBeenCalled();
+        expect(core.rebuilder.scheduleFetch).toHaveBeenCalledWith(expect.any(Function));
+        expect(setting.currentSettings().idDerivationVersion).toBe(1);
+        expect(setting.currentSettings().idDerivationKey).toBe(nextIdKey);
+    });
+
     it("reserves Rebuild before saving a new-user configuration", async () => {
         const { manager, setting, dialogManager, core } = createSetupManager();
         setting.settings = { ...setting.currentSettings(), isConfigured: false };
@@ -659,3 +784,23 @@ describe("SetupManager", () => {
         expect(setting.currentSettings().P2P_ActiveRemoteConfigurationId).toBe("existing");
     });
 });
+
+describe("internal Metadata configuration", () => {
+    it.each([true, false])(
+        "applies the preference only after accepting the no-Rebuild warning (%s)",
+        async (accept) => {
+            const { manager, setting, dialogManager, core } = createSetupManager();
+            const current = { ...setting.settings, encryptInternalMetadata: false, remoteType: REMOTE_COUCHDB };
+            dialogManager.openWithExplicitCancel.mockResolvedValue({ ...current, encryptInternalMetadata: true });
+            const ask = vi.fn(async (_message: string, choices: string[]) => (accept ? choices[0] : "Cancel"));
+            core.confirm = { askSelectStringDialogue: ask };
+            const apply = vi.spyOn(setting, "applyPartial").mockResolvedValue(undefined);
+            await expect(manager.onlyE2EEConfiguration(UserMode.Update, current)).resolves.toBe(accept);
+            expect(ask.mock.calls[0][1][0]).toContain("update every other device first");
+            expect(ask.mock.calls[0][0]).toContain("currently running LiveSync");
+            expect(apply).toHaveBeenCalledTimes(accept ? 1 : 0);
+            expect(core.rebuilder.scheduleRebuild).not.toHaveBeenCalled();
+            expect(core.rebuilder.scheduleFetch).not.toHaveBeenCalled();
+        }
+    );
+});

src/modules/features/SetupWizard/dialogs/OutroAskUserMode.svelte

@@ -48,9 +48,7 @@
 <Instruction>
     <Question>{translateMessage("Please select your situation.")}</Question>
     <Option
-        title={translateMessage(
-            "I am setting up a new server for the first time / I want to reset my existing server."
-        )}
+        title={translateMessage("⚠️ Initialise or overwrite the remote")}
         bind:value={userType}
         selectedValue={TYPE_NEW}
     >
@@ -61,7 +59,7 @@
         </InfoNote>
     </Option>
     <Option
-        title={translateMessage("My remote server is already set up. I want to join this device.")}
+        title={translateMessage("🔗 Join this device")}
         bind:value={userType}
         selectedValue={TYPE_EXISTING}
     >
@@ -72,9 +70,7 @@
         </InfoNote>
     </Option>
     <Option
-        title={translateMessage(
-            "The remote is already set up, and the configuration is compatible (or got compatible by this operation)."
-        )}
+        title={translateMessage("⚙️ Apply settings only (advanced)")}
         bind:value={userType}
         selectedValue={TYPE_COMPATIBLE_EXISTING}
     >

src/modules/features/SetupWizard/dialogs/SetupRemoteE2EE.svelte

@@ -13,38 +13,144 @@
         E2EEAlgorithms,
         type EncryptionSettings,
     } from "@vrtmrz/livesync-commonlib/compat/common/types";
+    import {
+        deriveIdKey,
+        deriveOrImportIdKey,
+        formatIdRecoveryCode,
+        ID_DERIVATION_VERSION,
+        ID_RECOVERY_CODE_PREFIX,
+    } from "@vrtmrz/livesync-commonlib/settings";
     import { onMount } from "svelte";
     import type { GuestDialogProps } from "@/modules/services/LiveSyncUI/svelteDialog";
     import { copyTo, pickEncryptionSettings } from "@vrtmrz/livesync-commonlib/compat/common/utils";
-    import { TYPE_CANCELLED, type SetupRemoteE2EEResultType } from "./setupDialogTypes";
+    import {
+        TYPE_CANCELLED,
+        type SetupRemoteE2EEInitialData,
+        type SetupRemoteE2EEResultType,
+    } from "./setupDialogTypes";
     import { $msg as translateMessage } from "@/common/translation";
 
-    type Props = GuestDialogProps<SetupRemoteE2EEResultType, EncryptionSettings>;
+    type Props = GuestDialogProps<SetupRemoteE2EEResultType, SetupRemoteE2EEInitialData>;
+    type IdConfigurationChoice = "keep" | "random" | "custom";
+    type IdCustomChoice = "passphrase" | "source" | "recovery";
     const { setResult, getInitialData }: Props = $props();
     let default_encryption: EncryptionSettings = {
         encrypt: true,
         passphrase: "",
         E2EEAlgorithm: DEFAULT_SETTINGS.E2EEAlgorithm,
         usePathObfuscation: true,
-    } as EncryptionSettings;
+        encryptInternalMetadata: true,
+        idDerivationVersion: 0,
+        idDerivationKey: "",
+    };
 
     let encryptionSettings = $state<EncryptionSettings>({ ...default_encryption });
+    let newVault = $state(false);
+    let idConfigurationChoice = $state<IdConfigurationChoice>("keep");
+    let idCustomChoice = $state<IdCustomChoice>("source");
+    let idDerivationSource = $state("");
+    let idDerivationError = $state("");
+    let recoveryCodeVisible = $state(false);
+    let recoveryCodeCopied = $state(false);
+
+    const idDerivationConfigured = $derived(
+        encryptionSettings.idDerivationVersion === ID_DERIVATION_VERSION &&
+            typeof encryptionSettings.idDerivationKey === "string" &&
+            encryptionSettings.idDerivationKey.length > 0
+    );
+    const recoveryCode = $derived.by(() =>
+        idDerivationConfigured ? formatIdRecoveryCode(encryptionSettings.idDerivationKey) : ""
+    );
 
     onMount(() => {
         if (getInitialData) {
             const initialData = getInitialData();
             if (initialData) {
-                copyTo(initialData, encryptionSettings);
+                copyTo(initialData.settings, encryptionSettings);
+                newVault = initialData.newVault;
             }
         }
+        idConfigurationChoice = !idDerivationConfigured && newVault ? "random" : "keep";
     });
     let e2eeValid = $derived.by(() => {
         if (!encryptionSettings.encrypt) return true;
         return encryptionSettings.passphrase.trim().length >= 1;
     });
+    let canEncryptInternalMetadata = $derived(
+        encryptionSettings.encrypt &&
+            encryptionSettings.E2EEAlgorithm === E2EEAlgorithms.V2 &&
+            encryptionSettings.usePathObfuscation
+    );
 
-    function commit() {
-        setResult(pickEncryptionSettings(encryptionSettings));
+    function resetIdDerivationSource() {
+        idDerivationSource = "";
+        idDerivationError = "";
+    }
+
+    function toggleEncryption(enabled: boolean) {
+        encryptionSettings.encrypt = enabled;
+        if (!enabled) resetIdDerivationSource();
+    }
+
+    function selectIdConfiguration() {
+        recoveryCodeVisible = false;
+        recoveryCodeCopied = false;
+        resetIdDerivationSource();
+    }
+
+    function selectIdCustomSource() {
+        resetIdDerivationSource();
+    }
+
+    async function copyRecoveryCode() {
+        try {
+            await navigator.clipboard.writeText(recoveryCode);
+            recoveryCodeCopied = true;
+        } catch {
+            idDerivationError = translateMessage("The recovery code could not be copied. Select and copy the visible code instead.");
+        }
+    }
+
+    async function commit() {
+        idDerivationError = "";
+        const result = pickEncryptionSettings(encryptionSettings);
+
+        if (encryptionSettings.encrypt && idConfigurationChoice !== "keep") {
+            let source = idDerivationSource;
+            if (idConfigurationChoice === "random") {
+                const bytes = crypto.getRandomValues(new Uint8Array(32));
+                source = Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+            } else if (idCustomChoice === "passphrase") {
+                source = encryptionSettings.passphrase;
+            }
+            if (source.length === 0) {
+                if (!idDerivationConfigured) {
+                    idDerivationError = translateMessage("An ID source is required to enable this option.");
+                    return;
+                }
+            } else {
+                try {
+                    result.idDerivationKey =
+                        idConfigurationChoice === "custom" && idCustomChoice !== "passphrase"
+                            ? await importOrDeriveEnteredIdKey(source, idCustomChoice)
+                            : await deriveIdKey(source);
+                    result.idDerivationVersion = ID_DERIVATION_VERSION;
+                } catch {
+                    idDerivationError = translateMessage("The ID source or recovery code is invalid. Check it and try again.");
+                    return;
+                }
+            }
+        }
+
+        idDerivationSource = "";
+        setResult(result);
+    }
+
+    async function importOrDeriveEnteredIdKey(source: string, choice: IdCustomChoice): Promise<string> {
+        if (choice === "recovery" && !source.trim().startsWith(ID_RECOVERY_CODE_PREFIX)) {
+            throw new Error("An ID recovery code is required.");
+        }
+        return await deriveOrImportIdKey(source);
     }
 </script>
 
@@ -52,7 +158,11 @@
     <DialogHeader title={translateMessage("End-to-End Encryption")} />
     <Guidance>{translateMessage("Please configure your end-to-end encryption settings.")}</Guidance>
     <InputRow label={translateMessage("End-to-End Encryption")}>
-        <input type="checkbox" bind:checked={encryptionSettings.encrypt} />
+        <input
+            type="checkbox"
+            checked={encryptionSettings.encrypt}
+            onchange={(event) => toggleEncryption(event.currentTarget.checked)}
+        />
     </InputRow>
     <InfoNote title={translateMessage("Strongly Recommended")}>
         {translateMessage(
@@ -87,6 +197,182 @@
         </InfoNote>
     {/if}
 
+    <fieldset class="sls-id-choices" disabled={!encryptionSettings.encrypt}>
+        <legend>{translateMessage("ID generation")}</legend>
+        <label class="sls-id-choice">
+            <input
+                type="radio"
+                name="id-derivation-choice"
+                value="keep"
+                bind:group={idConfigurationChoice}
+                onchange={selectIdConfiguration}
+            />
+            <div class="sls-id-choice-text">
+                <span>{translateMessage("Keep current configuration")}</span>
+                <small class="sls-current-id-configuration">
+                    {#if idDerivationConfigured}
+                        {translateMessage(
+                            encryptionSettings.encrypt
+                                ? "Current configuration: a saved ID key is used."
+                                : "Current configuration: the saved ID key is retained while E2EE is off."
+                        )}
+                    {:else}
+                        {translateMessage(
+                            "Current configuration: no ID key is saved. With E2EE enabled, keeping it uses legacy IDs tied to the E2EE passphrase."
+                        )}
+                    {/if}
+                </small>
+            </div>
+        </label>
+        <label class="sls-id-choice">
+            <input
+                type="radio"
+                name="id-derivation-choice"
+                value="random"
+                bind:group={idConfigurationChoice}
+                onchange={selectIdConfiguration}
+            />
+            <span>{translateMessage("Generate a random ID key")}</span>
+        </label>
+        <label class="sls-id-choice">
+            <input
+                type="radio"
+                name="id-derivation-choice"
+                value="custom"
+                bind:group={idConfigurationChoice}
+                onchange={selectIdConfiguration}
+            />
+            <span>{translateMessage("Set an ID key")}</span>
+        </label>
+    </fieldset>
+    {#if encryptionSettings.encrypt && idConfigurationChoice === "keep" && !idDerivationConfigured}
+        <InfoNote warning>
+            {translateMessage("Changing the E2EE passphrase changes IDs generated by the legacy configuration.")}
+        </InfoNote>
+    {/if}
+    {#if (encryptionSettings.encrypt && idConfigurationChoice !== "keep") || idDerivationConfigured}
+        {#if encryptionSettings.encrypt}
+            <InfoNote>
+                {translateMessage(
+                    "This uses a saved key for new Chunk IDs and obfuscated Metadata document IDs, so changing the E2EE passphrase does not derive a new key automatically."
+                )}
+            </InfoNote>
+        {/if}
+        {#if idDerivationConfigured}
+            <InfoNote title={translateMessage("Configured")}>
+                {translateMessage("The saved ID key is configured. Its source cannot be shown again.")}
+            </InfoNote>
+            <button type="button" onclick={() => (recoveryCodeVisible = !recoveryCodeVisible)}>
+                {translateMessage(recoveryCodeVisible ? "Hide current recovery code" : "Show current recovery code")}
+            </button>
+            {#if recoveryCodeVisible}
+                <InputRow label={translateMessage("Current ID recovery code")}>
+                    <input type="text" readonly value={recoveryCode} aria-label={translateMessage("Current ID recovery code")} />
+                    <button type="button" onclick={copyRecoveryCode}>{translateMessage("Copy recovery code")}</button>
+                </InputRow>
+                {#if recoveryCodeCopied}
+                    <InfoNote>{translateMessage("Recovery code copied.")}</InfoNote>
+                {/if}
+            {/if}
+        {/if}
+        {#if encryptionSettings.encrypt}
+            {#if idConfigurationChoice === "custom"}
+                <fieldset class="sls-id-choices sls-id-custom-choices">
+                    <legend>{translateMessage("How to set the ID key")}</legend>
+                    <label class="sls-id-choice">
+                        <input
+                            type="radio"
+                            name="id-custom-choice"
+                            value="passphrase"
+                            bind:group={idCustomChoice}
+                            onchange={selectIdCustomSource}
+                        />
+                        <span>{translateMessage("Derive from current E2EE passphrase")}</span>
+                    </label>
+                    <label class="sls-id-choice">
+                        <input
+                            type="radio"
+                            name="id-custom-choice"
+                            value="source"
+                            bind:group={idCustomChoice}
+                            onchange={selectIdCustomSource}
+                        />
+                        <span>{translateMessage("Enter an ID source")}</span>
+                    </label>
+                    <label class="sls-id-choice">
+                        <input
+                            type="radio"
+                            name="id-custom-choice"
+                            value="recovery"
+                            bind:group={idCustomChoice}
+                            onchange={selectIdCustomSource}
+                        />
+                        <span>{translateMessage("Import an ID recovery code")}</span>
+                    </label>
+                </fieldset>
+                {#if idCustomChoice === "source" || idCustomChoice === "recovery"}
+                    <InputRow
+                        label={translateMessage(idCustomChoice === "source" ? "ID source" : "ID recovery code")}
+                    >
+                        <Password
+                            name="id-derivation-source"
+                            placeholder={translateMessage(
+                                idCustomChoice === "source" ? "Enter an ID source" : "Enter an ID recovery code"
+                            )}
+                            bind:value={idDerivationSource}
+                        />
+                    </InputRow>
+                {/if}
+            {/if}
+            {#if idDerivationConfigured && idConfigurationChoice !== "keep"}
+                <InfoNote>
+                    {translateMessage("The displayed recovery code belongs to the current key. Reopen this dialogue after saving to copy the replacement key.")}
+                </InfoNote>
+            {/if}
+            {#if idConfigurationChoice === "custom" && idCustomChoice === "source"}
+                <InfoNote>
+                    {translateMessage("Choose a long, unpredictable source. It is used once and cannot be shown again after saving. A recovery code can be displayed on this device later. This input also accepts a tagged recovery code.")}
+                </InfoNote>
+            {:else if idConfigurationChoice === "custom" && idCustomChoice === "recovery"}
+                <InfoNote>
+                    {translateMessage("Paste a tagged recovery code from an existing device to restore the same ID key.")}
+                </InfoNote>
+            {:else if idConfigurationChoice === "random"}
+                <InfoNote warning>
+                    {translateMessage("For recovery after losing every device, save the recovery code after setup or choose an ID source you can reproduce.")}
+                </InfoNote>
+            {:else if idConfigurationChoice === "custom" && idCustomChoice === "passphrase"}
+                <InfoNote warning>
+                    {translateMessage(
+                        "The ID key is derived from the current E2EE passphrase and saved separately. Changing that passphrase later does not change the saved ID key. To reduce the risk of guessing that passphrase from known IDs, use a separate, unpredictable ID source instead."
+                    )}
+                </InfoNote>
+            {/if}
+            {#if idDerivationConfigured && idConfigurationChoice === "custom" && idCustomChoice !== "passphrase"}
+                <InfoNote>{translateMessage("Leave this input empty to keep the saved ID key.")}</InfoNote>
+            {/if}
+        {/if}
+        <InfoNote error visible={idDerivationError !== ""}>{idDerivationError}</InfoNote>
+    {/if}
+
+    <InputRow label="Encrypt internal file Properties">
+        <input
+            type="checkbox"
+            bind:checked={encryptionSettings.encryptInternalMetadata}
+            disabled={!canEncryptInternalMetadata}
+        />
+    </InputRow>
+    <InfoNote>
+        This option encrypts file properties used by Hidden File Sync and Customisation Sync.
+        <br />
+        It applies only to CouchDB and requires End-to-End Encryption, the V2 algorithm, and Property Encryption
+        (Obfuscate Properties). The remote type is selected later in this setup wizard.
+        <br />
+        It protects properties written after the option is enabled; existing properties are not rewritten. A manual remote
+        Rebuild is strongly recommended to protect existing properties. Update every other synchronising device to a compatible
+        version before enabling this option, including devices currently running LiveSync.
+    </InfoNote>
+
     <ExtraItems title={translateMessage("Advanced")}>
         <InputRow label={translateMessage("Encryption Algorithm")}>
             <select bind:value={encryptionSettings.E2EEAlgorithm} disabled={!encryptionSettings.encrypt}>
@@ -138,4 +424,41 @@
         width: auto;
         min-width: 8em;
     }
+    .sls-id-choices {
+        border: 0;
+        display: flex;
+        flex-direction: column;
+        gap: 0.35em;
+        margin: 0;
+        min-width: 0;
+        padding: 0;
+    }
+    .sls-id-choices legend {
+        margin-bottom: 0.35em;
+    }
+    .sls-id-choices:disabled {
+        opacity: 0.6;
+    }
+    .sls-id-custom-choices {
+        margin-left: 1.5em;
+    }
+    .sls-id-choice {
+        align-items: flex-start;
+        display: flex;
+        gap: 0.5em;
+    }
+    .sls-id-choice input[type="radio"] {
+        flex: none;
+        margin-top: 0.25em;
+    }
+    .sls-id-choice-text {
+        display: flex;
+        flex-direction: column;
+    }
+    .sls-current-id-configuration {
+        color: var(--text-muted);
+        display: block;
+        font-size: var(--font-ui-smaller);
+        margin-top: 0.15em;
+    }
 </style>

src/modules/features/SetupWizard/dialogs/setupDialogTypes.ts

@@ -110,6 +110,10 @@ export type SetupRemoteResultType = typeof TYPE_COUCHDB | typeof TYPE_BUCKET | t
 export type UseSetupURIResultType = typeof TYPE_CANCELLED | ObsidianLiveSyncSettings;
 
 export type SetupRemoteE2EEResultType = typeof TYPE_CANCELLED | EncryptionSettings;
+export type SetupRemoteE2EEInitialData = {
+    settings: EncryptionSettings;
+    newVault: boolean;
+};
 
 export type SetupRemoteBucketResultType = typeof TYPE_CANCELLED | BucketSyncSetting;
 

src/modules/features/StatusBarDisplay.ts

@@ -131,3 +131,50 @@ export function createPaddedCounterLabel(
         source.offChanged(update);
     });
 }
+
+/**
+ * Displays the disjoint initial and retry chunk-fetch counts with the same
+ * padding and inactive linger behaviour as the other status counters.
+ */
+export function createChunkFetchCounterLabel(
+    source: ReactiveValue<{ initial: number; retrying: number }>
+): DisposableReactiveValue<string> {
+    const initialCount = reactiveSource(0);
+    const retryingCount = reactiveSource(0);
+    const initialLabel = createPaddedCounterLabel(initialCount, "🛄");
+    const retryingLabel = createPaddedCounterLabel(retryingCount, "🔁");
+    const formatted = reactiveSource(`${initialLabel.value}${retryingLabel.value}`);
+    let updatingCounts = false;
+    let disposed = false;
+
+    const updateLabel = () => {
+        if (updatingCounts || disposed) return;
+        formatted.value = `${initialLabel.value}${retryingLabel.value}`;
+    };
+    initialLabel.onChanged(updateLabel);
+    retryingLabel.onChanged(updateLabel);
+
+    const updateCounts = () => {
+        if (disposed) return;
+        updatingCounts = true;
+        try {
+            initialCount.value = source.value.initial;
+            retryingCount.value = source.value.retrying;
+        } finally {
+            updatingCounts = false;
+            updateLabel();
+        }
+    };
+    source.onChanged(updateCounts);
+    updateCounts();
+
+    return asDisposableReactiveValue(formatted, () => {
+        if (disposed) return;
+        disposed = true;
+        source.offChanged(updateCounts);
+        initialLabel.offChanged(updateLabel);
+        retryingLabel.offChanged(updateLabel);
+        initialLabel.dispose();
+        retryingLabel.dispose();
+    });
+}

src/modules/features/StatusBarDisplay.unit.spec.ts

@@ -3,6 +3,7 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import {
     STATUS_COUNTER_INACTIVE_LINGER_MS,
+    createChunkFetchCounterLabel,
     createMinimumVisibleActivityCount,
     createPaddedCounterLabel,
 } from "./StatusBarDisplay.ts";
@@ -137,3 +138,41 @@ describe("createPaddedCounterLabel", () => {
         expect(display.value).toBe(" 📄\u20070");
     });
 });
+
+describe("createChunkFetchCounterLabel", () => {
+    beforeEach(() => {
+        vi.useFakeTimers();
+    });
+
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+
+    it("keeps initial and retry counts separate across an unchanged-total handoff", () => {
+        const counts = reactiveSource({ initial: 2, retrying: 5 });
+        const display = createChunkFetchCounterLabel(counts);
+        const withoutPadding = () => display.value.replace(/\u2007/g, "");
+        const transitionSnapshots: string[] = [];
+        const observeTransitions = () => transitionSnapshots.push(withoutPadding());
+
+        expect(withoutPadding()).toBe(" 🛄2 🔁5");
+
+        display.onChanged(observeTransitions);
+        counts.value = { initial: 0, retrying: 7 };
+        expect(withoutPadding()).toBe(" 🛄0 🔁7");
+        expect(transitionSnapshots).toEqual([" 🛄0 🔁7"]);
+        display.offChanged(observeTransitions);
+        vi.advanceTimersByTime(STATUS_COUNTER_INACTIVE_LINGER_MS - 1);
+        expect(withoutPadding()).toBe(" 🛄0 🔁7");
+        vi.advanceTimersByTime(1);
+        expect(withoutPadding()).toBe(" 🔁7");
+
+        counts.value = { initial: 0, retrying: 0 };
+        expect(withoutPadding()).toBe(" 🔁0");
+        display.dispose();
+        vi.advanceTimersByTime(STATUS_COUNTER_INACTIVE_LINGER_MS);
+        counts.value = { initial: 1, retrying: 0 };
+
+        expect(withoutPadding()).toBe(" 🔁0");
+    });
+});

src/modules/services/LiveSyncUI/dialogues/DialogueToCopy.svelte

@@ -57,4 +57,9 @@
     textarea {
         resize: none;
     }
+
+    button {
+        min-width: 44px;
+        min-height: 44px;
+    }
 </style>