@glance-apps/sync 1.0.3 → 1.1.1

package/CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.1] - 2026-06-03
+
+### Fixed
+
+- **WebDAV — 405 on MKCOL treated as directory-already-exists**: `mkcolWithParents`
+  now handles HTTP 405 (Method Not Allowed) the same as 409/404, triggering the
+  parent-directory creation fallback. Some WebDAV servers (e.g. certain nginx
+  configurations) return 405 rather than 409 when MKCOL is called on a path that
+  already exists as a collection.
+
+## [1.1.0] - 2026-05-25
+
+### Added
+
+- `deriveKeyForSalt(salt: Uint8Array): Promise<CryptoKey>` — derives a fresh
+  non-extractable AES-256-GCM key from the cached passphrase and a caller-supplied
+  salt (PBKDF2-SHA-256, 310 000 iterations). Intended as the `deriveKey` callback
+  for `@glance-apps/intents` per-envelope key derivation (Phase 2.6): the intents
+  emitter generates a random salt per envelope, embeds it in the envelope, and
+  calls this to obtain the encryption key; the poller extracts the salt from the
+  envelope and calls this again to obtain the decryption key — enabling cross-app
+  decryption without sharing a per-app session key.
+
+  Throws with `err.code === 'PASSPHRASE_REQUIRED'` when no passphrase is held in
+  the current session. Note that this guard is on `_sessionPassphrase`, **not** on
+  `hasEncryptionReady()`: after `initSessionKey()` restores a key from device
+  storage the session key is ready but the passphrase is not. Callers that want to
+  gate on passphrase availability should check `getSyncPassphrase() !== null`.
+
+  `getSessionKey()` (added in 1.0.2) is **not removed**; it remains exported for
+  any consumer that wants the cached per-app `CryptoKey` directly.
+
 ## [1.0.3] - 2026-05-23
 
 ### Fixed
@@ -75,7 +107,9 @@ entire sync infrastructure can be shared across the GLANCE app family.
 - TypeScript declarations in `types/index.d.ts`.
 - WebDAV CORS proxy handler in `api/webdav-proxy.js`.
 
-[Unreleased]: https://github.com/glance-apps/glance-sync/compare/v1.0.3...HEAD
+[Unreleased]: https://github.com/glance-apps/glance-sync/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/glance-apps/glance-sync/compare/v1.1.0...v1.1.1
+[1.1.0]: https://github.com/glance-apps/glance-sync/compare/v1.0.3...v1.1.0
 [1.0.3]: https://github.com/glance-apps/glance-sync/compare/v1.0.2...v1.0.3
 [1.0.2]: https://github.com/glance-apps/glance-sync/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/glance-apps/glance-sync/compare/v1.0.0...v1.0.1

package/README.md

@@ -147,7 +147,8 @@ Pass `encryptionEnabled: true` in the sync config object stored via `engine.setC
 | `isEncryptedEnvelope(value)` | Type guard — returns `true` if the value looks like an `EncryptedEnvelope`. |
 | `setSyncPassphrase(p)` / `getSyncPassphrase()` | Store/retrieve the passphrase in session memory (not persisted). |
 | `hasEncryptionReady()` | Returns `true` if the session key is loaded. |
-| `getSessionKey()` | Returns the cached non-extractable `CryptoKey`, or `null` if no key is loaded — intended for sibling packages (e.g., `@glance-apps/intents`) that need to reuse the same key. |
+| `getSessionKey()` | Returns the cached non-extractable `CryptoKey`, or `null` if no key is loaded. |
+| `deriveKeyForSalt(salt)` | Derives a fresh non-extractable AES-256-GCM key from the cached passphrase and a caller-supplied 16-byte salt (PBKDF2-SHA-256, 310 000 iterations). Intended as the `deriveKey` callback for `@glance-apps/intents` per-envelope encryption: pass `sync.deriveKeyForSalt` to `buildEncryptedEnvelope` / `parseEncryptedEnvelope` so each envelope is independently rekeyed. Throws with `err.code === 'PASSPHRASE_REQUIRED'` when no passphrase is in session — gate on `getSyncPassphrase() !== null` before using it. |
 
 ### Transport & providers
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glance-apps/sync",
-  "version": "1.0.3",
+  "version": "1.1.1",
   "license": "MIT",
   "type": "module",
   "main": "src/index.js",

package/src/crypto.js

@@ -19,6 +19,45 @@ export function getSyncPassphrase()  { return _sessionPassphrase; }
 export function hasEncryptionReady() { return _sessionKey !== null; }
 export function getSessionKey()      { return _sessionKey; }
 
+/**
+ * Derives a fresh AES-256-GCM key from the cached passphrase and the supplied
+ * salt. Intended for per-envelope key derivation in `@glance-apps/intents`:
+ * callers generate a new random salt per envelope, embed it in the envelope,
+ * and call this to get the encryption key — enabling cross-app decryption with
+ * the same passphrase but a fresh salt on every write.
+ *
+ * Uses identical PBKDF2 parameters as the rest of this module (SHA-256,
+ * 310 000 iterations, AES-256-GCM). The returned key is non-extractable because
+ * it is ephemeral and never stored.
+ *
+ * Throws with `err.code === 'PASSPHRASE_REQUIRED'` when no passphrase is
+ * held in the current session (e.g. after `initSessionKey()` restores from
+ * device storage without the user re-entering their passphrase). Note: this
+ * is a different condition from `hasEncryptionReady()` — callers that want to
+ * gate on passphrase availability should check `getSyncPassphrase() !== null`.
+ *
+ * @param {Uint8Array} salt - 16-byte salt to derive the key from
+ * @returns {Promise<CryptoKey>}
+ */
+export async function deriveKeyForSalt(salt) {
+  if (!_sessionPassphrase) {
+    const err = new Error('Encryption passphrase not available. Please enter your sync passphrase.');
+    err.code = 'PASSPHRASE_REQUIRED';
+    throw err;
+  }
+  const enc         = new TextEncoder();
+  const keyMaterial = await crypto.subtle.importKey(
+    'raw', enc.encode(_sessionPassphrase), 'PBKDF2', false, ['deriveKey']
+  );
+  return crypto.subtle.deriveKey(
+    { name: 'PBKDF2', salt, iterations: 310_000, hash: 'SHA-256' },
+    keyMaterial,
+    { name: 'AES-GCM', length: 256 },
+    false,
+    ['encrypt', 'decrypt']
+  );
+}
+
 // ---------------------------------------------------------------------------
 // IndexedDB key store
 // ---------------------------------------------------------------------------

package/src/index.js

@@ -17,6 +17,7 @@ export {
   clearEncryptionKey,
   hasEncryptionReady,
   getSessionKey,
+  deriveKeyForSalt,
   isEncryptedEnvelope,
   initSessionKey,
 } from './crypto.js';

package/src/providers.js

@@ -102,7 +102,7 @@ async function parseDownloadResponse(res, engineConfig) {
 
 async function mkcolWithParents(dirUrl, authHeaders, wf) {
   const res = await wf('MKCOL', dirUrl, authHeaders);
-  if (res.status === 409 || res.status === 404) {
+  if (res.status === 409 || res.status === 404 || res.status === 405) {
     // Derive parent by stripping the last path segment via URL() to avoid
     // producing malformed strings on root-level inputs.
     let parent;

package/types/index.d.ts

@@ -156,6 +156,17 @@ export function setSyncPassphrase(passphrase: string | null): void;
 export function getSyncPassphrase(): string | null;
 export function hasEncryptionReady(): boolean;
 export function getSessionKey(): CryptoKey | null;
+/**
+ * Derives a fresh non-extractable AES-256-GCM key from the cached passphrase
+ * and the supplied salt (PBKDF2-SHA-256, 310 000 iterations). Intended for
+ * per-envelope key derivation in `@glance-apps/intents`: pass this function as
+ * the `deriveKey` callback to `buildEncryptedEnvelope` / `parseEncryptedEnvelope`.
+ *
+ * Throws with `err.code === 'PASSPHRASE_REQUIRED'` when no passphrase is held
+ * in the current session. Gate on `getSyncPassphrase() !== null` (not
+ * `hasEncryptionReady()`) before passing this as a callback.
+ */
+export function deriveKeyForSalt(salt: Uint8Array): Promise<CryptoKey>;
 export function encryptData<T>(data: T, config?: CryptoConfig): Promise<EncryptedEnvelope>;
 export function decryptData<T = unknown>(envelope: EncryptedEnvelope, config?: CryptoConfig): Promise<T>;
 export function isEncryptedEnvelope(value: unknown): value is EncryptedEnvelope;