@glance-apps/sync 1.2.0 → 1.2.1

package/CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.1] - 2026-06-14
+
+### Fixed
+
+- **DB sync transport: row field renamed `ciphertext` to `envelope`** to match the
+  GLANCEvault batch and list endpoints. The encrypted rows exchanged with the
+  vault are now `{ entityId, envelope, createdAt }`; the field rename is applied
+  across the push row, the pull read, the vault client and engine types, the
+  tests, and the docs. The base64 encoding is unchanged: the value is still
+  `base64(IV || AES-GCM output)` produced by `encryptEntity`.
+
 ## [1.2.0] - 2026-06-13
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glance-apps/sync",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "license": "MIT",
   "type": "module",
   "main": "src/index.js",

package/src/dbCrypto.js

@@ -257,7 +257,7 @@ export async function clearDbRootKey({ cryptoDBName, nativeGetSyncKey = null, na
 
 /**
  * Encrypts one entity into a base64 ciphertext string for the row's
- * `ciphertext` field. The output encodes [ 12-byte IV ][ AES-GCM ciphertext ].
+ * `envelope` field. The output encodes [ 12-byte IV ][ AES-GCM ciphertext ].
  *
  * @param {*} entity        - plain JS value to encrypt (serialised with JSON)
  * @param {string} entityId - stable entity UUID, used as HKDF context
@@ -280,7 +280,7 @@ export async function encryptEntity(entity, entityId, rootKey = _rootKey) {
 /**
  * Decrypts a base64 ciphertext produced by encryptEntity back into the entity.
  *
- * @param {string} ciphertextB64 - the row's `ciphertext` field
+ * @param {string} ciphertextB64 - the row's `envelope` field
  * @param {string} entityId      - stable entity UUID, used as HKDF context
  * @param {CryptoKey} [rootKey]  - explicit root key (defaults to the session key)
  * @returns {Promise<*>} the decrypted entity

package/src/dbEngine.js

@@ -202,8 +202,8 @@ export const createDbSyncEngine = (config) => {
       if (entity == null) {
         deletes.push(entityId);
       } else {
-        const ciphertext = await encryptEntity(entity, entityId);
-        upserts.push({ entityId, ciphertext, createdAt: Date.now() });
+        const envelope = await encryptEntity(entity, entityId);
+        upserts.push({ entityId, envelope, createdAt: Date.now() });
       }
     }
 
@@ -256,7 +256,7 @@ export const createDbSyncEngine = (config) => {
         }
 
         await ensureRootKey();
-        const remoteEntity = await decryptEntity(R.ciphertext, R.entityId);
+        const remoteEntity = await decryptEntity(R.envelope, R.entityId);
         const local = await getLocalEntity(R.entityId);
 
         if (local == null) {

package/src/vaultClient.js

@@ -75,7 +75,7 @@ export function createVaultClient({ vaultUrl, vaultToken, fetchImpl } = {}) {
 
   return {
     /**
-     * Upserts a batch of rows. Each row is { entityId, ciphertext, createdAt }.
+     * Upserts a batch of rows. Each row is { entityId, envelope, createdAt }.
      * @returns {Promise<{ written: number, maxSeq: number }>}
      */
     async batch(app, { accountId, rows }) {

package/types/index.d.ts

@@ -366,10 +366,10 @@ export function hasDbRootKey(): boolean;
 export function encryptEntity(entity: unknown, entityId: string, rootKey?: CryptoKey): Promise<string>;
 export function decryptEntity<T = unknown>(ciphertext: string, entityId: string, rootKey?: CryptoKey): Promise<T>;
 
-// Row exchanged with GLANCEvault. ciphertext is base64(IV || AES-GCM output).
+// Row exchanged with GLANCEvault. envelope is base64(IV || AES-GCM output).
 export interface VaultRow {
   entityId: string;
-  ciphertext: string;
+  envelope: string;
   createdAt: number;
 }
 
@@ -377,7 +377,7 @@ export interface VaultPulledRow extends Partial<VaultRow> {
   entityId: string;
   seq: number;
   deleted?: boolean;
-  ciphertext?: string;
+  envelope?: string;
 }
 
 export interface VaultClient {