
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
@picassio/sync-core
Advanced tools
Platform-neutral contracts and crash-safe ordered client state machine for WebObsidian Sync Protocol 1.0
Shared, platform-neutral Sync Protocol 1.0 contracts and deterministic client state machine for WebObsidian Central Sync. It includes strict Zod schemas/types, path policy, SHA-256 helpers, replay/conflict primitives, golden fixtures, and ordered manifest/catch-up/apply-intent/offline-queue orchestration.
import { OrderedSyncClient, HandshakeResponseSchema, PROTOCOL_VERSION } from '@picassio/sync-core';
Adapters provide persistence, transport, and local materialization; this package performs no filesystem,
Obsidian, browser, or credential storage itself. A client must durably record an apply intent before local
materialization and advance/acknowledge its cursor only afterward. Wake and polling work flush durable local
operations before pulling remote events. Adapters that maintain a separate dirty-path marker can call enqueue(),
durably clear that marker, and then call flush() so the server echo cannot race the local preparation boundary.
Servers advertising ordered-batch-stop-v1 allow ordered publication in protocol-sized batches; older servers
remain at one operation/request. Optional lifecycle observers expose safe bootstrap/progress boundaries only after
the corresponding persistence transition.
MIT licensed. Protocol 1.0 is pre-stable until the corresponding WebObsidian stable release is published.
FAQs
Platform-neutral contracts and crash-safe ordered client state machine for WebObsidian Sync Protocol 1.0
We found that @picassio/sync-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.