@telecrypt-io/storage 0.1.3 → 0.2.1

package/README.md

@@ -8,7 +8,9 @@ Files are encrypted on the client before upload. The server stores only opaque c
 never holds the decryption keys. Shared folders let multiple people add and read files, and a
 Recovery Key restores your files on a new device — even if you lose the original.
 
-**Status:** published and usable — library, CLI, and a React web UI.
+**Status:** library source only. `@telecrypt-io/storage@0.2.0` is the current public release,
+published from this repository's protected `v0.2.0` tag with NPM Trusted Publishing/OIDC
+provenance. The older `0.1.3` release is the immutable legacy combined library-and-CLI package.
 
 ## Install
 
@@ -16,7 +18,7 @@ Recovery Key restores your files on a new device — even if you lose the origin
 npm install @telecrypt-io/storage
 ```
 
-This gives you both the `TeleCryptIOStorage` library and the `telecrypt-io` CLI.
+This gives you the `TeleCryptIOStorage` library and its browser-safe `core` API.
 
 ## Quick start
 
@@ -33,17 +35,10 @@ const folder = await core.createFolder(storage, "Photos");
 await core.uploadFile(storage, folder.id, "cat.jpg", bytes, "image/jpeg");
 ```
 
-**CLI:**
-
-```bash
-telecrypt-io storage login --homeserver https://your.server --user alice --password ...
-telecrypt-io storage folder create Photos
-telecrypt-io storage file upload <folderId> ./cat.jpg
-telecrypt-io storage folder share <folderId> @bob:your.server --role editor
-telecrypt-io storage recovery setup     # prints your Recovery Key — save it
-```
-
-**Web UI:** a React app lives in [`ui/`](./ui) (`cd ui && npm install && npm run dev`).
+The command-line client is sourced by
+[`TeleCrypt-io/storage-cli`](https://github.com/TeleCrypt-io/storage-cli). The static web
+application is sourced by
+[`TeleCrypt-io/storage.telecrypt.io`](https://github.com/TeleCrypt-io/storage.telecrypt.io).
 
 ## How it works
 
@@ -74,8 +69,7 @@ npm run synapse:down
 
 Tests run against a real local Synapse in podman, never against a production server.
 
-See [CLI.md](./CLI.md) for command reference and [RELEASING.md](./RELEASING.md) for release
-instructions.
+See [RELEASING.md](./RELEASING.md) for the guarded npm release procedure.
 
 ## Licence
 

package/dist/TeleCryptIOStorage.d.ts

@@ -117,6 +117,13 @@ export declare class TeleCryptIOStorage {
     constructor(client: MatrixClient);
     /** The underlying matrix-js-sdk client (e.g. to stop it, or for advanced/interop use). */
     getClient(): MatrixClient;
+    /**
+     * Refreshes a room's current state from the homeserver. The background sync
+     * loop is intentionally asynchronous, so a short-lived CLI process can
+     * otherwise list a stale state snapshot immediately after another process
+     * changed a file name or branch.
+     */
+    refreshRoomState(roomId: string): Promise<void>;
     /**
      * Recommended entry point: builds the MatrixClient with a persistent crypto
      * store and the secret-storage callback wiring `keys.*` needs, starts the

package/dist/TeleCryptIOStorage.js

@@ -1,4 +1,4 @@
-import { ClientEvent, createClient, SyncState } from "matrix-js-sdk";
+import { ClientEvent, createClient, MatrixEvent, SyncState } from "matrix-js-sdk";
 import { Method } from "matrix-js-sdk/lib/http-api/method.js";
 import { ClientPrefix } from "matrix-js-sdk/lib/http-api/prefix.js";
 import { encryptAttachment, decryptAttachment } from "matrix-encrypt-attachment";
@@ -12,6 +12,19 @@ export class TeleCryptIOStorage {
     getClient() {
         return this.client;
     }
+    /**
+     * Refreshes a room's current state from the homeserver. The background sync
+     * loop is intentionally asynchronous, so a short-lived CLI process can
+     * otherwise list a stale state snapshot immediately after another process
+     * changed a file name or branch.
+     */
+    async refreshRoomState(roomId) {
+        const room = this.client.getRoom(roomId);
+        if (!room)
+            throw new Error(`Unknown room: ${roomId}`);
+        const stateEvents = await this.client.roomState(roomId);
+        room.currentState.setStateEvents(stateEvents.map((event) => new MatrixEvent(event)));
+    }
     /**
      * Recommended entry point: builds the MatrixClient with a persistent crypto
      * store and the secret-storage callback wiring `keys.*` needs, starts the

package/dist/core/operations.js

@@ -148,6 +148,7 @@ export async function listMembers(storage, folderId) {
 }
 export async function listFiles(storage, folderId) {
     const tree = await resolveTree(storage, folderId);
+    await storage.refreshRoomState(folderId);
     return tree.listFiles().map((f) => ({ id: f.id, name: f.getName() }));
 }
 export async function listSubfolders(storage, folderId) {
@@ -173,6 +174,14 @@ export async function renameFile(storage, folderId, fileId, name) {
     const tree = await resolveTree(storage, folderId);
     const branch = await resolveFile(tree, fileId);
     await branch.setName(name);
+    // `setName` resolves when the homeserver accepts the state event, but a
+    // fresh CLI/UI process can still read the previous local room state for a
+    // short time. Do not report success until this client has observed the new
+    // name through its normal sync loop.
+    await waitForCondition(() => {
+        const current = tree.getFile(fileId);
+        return current?.getName() === name ? current : null;
+    }, { timeoutMs: 15000 });
     return { id: fileId, name };
 }
 export async function deleteFile(storage, folderId, fileId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telecrypt-io/storage",
-  "version": "0.1.3",
+  "version": "0.2.1",
   "license": "BUSL-1.1",
   "type": "module",
   "main": "dist/index.js",
@@ -15,9 +15,6 @@
       "import": "./dist/core/index.js"
     }
   },
-  "bin": {
-    "telecrypt-io": "dist/cli/index.js"
-  },
   "files": [
     "dist",
     "README.md",
@@ -37,10 +34,9 @@
     "synapse:down": "./throwaway_synapse/down.sh"
   },
   "dependencies": {
-    "commander": "15.0.0",
-    "fake-indexeddb": "6.2.5",
     "matrix-encrypt-attachment": "1.0.3",
-    "matrix-js-sdk": "41.9.0"
+    "matrix-js-sdk": "41.9.0",
+    "oidc-client-ts": "3.5.0"
   },
   "devDependencies": {
     "@playwright/test": "1.61.1",
@@ -48,16 +44,17 @@
     "@typescript-eslint/eslint-plugin": "8.64.0",
     "@typescript-eslint/parser": "8.64.0",
     "eslint": "10.8.0",
+    "fake-indexeddb": "6.2.5",
     "tsx": "4.23.1",
     "typescript": "5.9.3",
     "vitest": "4.1.10"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/TeleCrypt-io/secure-storage.git"
+    "url": "git+https://github.com/TeleCrypt-io/storage-sdk.git"
   },
-  "homepage": "https://github.com/TeleCrypt-io/secure-storage#readme",
+  "homepage": "https://github.com/TeleCrypt-io/storage-sdk#readme",
   "bugs": {
-    "url": "https://github.com/TeleCrypt-io/secure-storage/issues"
+    "url": "https://github.com/TeleCrypt-io/storage-sdk/issues"
   }
 }

package/dist/cli/cryptoSnapshot.d.ts

@@ -1,37 +0,0 @@
-interface IndexSpec {
-    name: string;
-    keyPath: string | string[];
-    unique: boolean;
-    multiEntry: boolean;
-}
-interface StoreSpec {
-    name: string;
-    keyPath: string | string[] | null;
-    autoIncrement: boolean;
-    indexes: IndexSpec[];
-}
-interface StoreRecord {
-    key?: unknown;
-    value: unknown;
-}
-interface DbSnapshot {
-    name: string;
-    version: number;
-    stores: StoreSpec[];
-    records: Record<string, StoreRecord[]>;
-}
-export interface CryptoSnapshot {
-    dbs: DbSnapshot[];
-}
-/** Dumps every IndexedDB database currently visible to this process. */
-export declare function exportIndexedDB(): Promise<CryptoSnapshot>;
-/** Recreates every database/store/index/record from a snapshot into the
- * current (assumed empty) IndexedDB factory. */
-export declare function importIndexedDB(snapshot: CryptoSnapshot): Promise<void>;
-export declare function loadSnapshotFromDisk(path: string): CryptoSnapshot | null;
-export declare function saveSnapshotToDisk(path: string, snapshot: CryptoSnapshot): void;
-/** Loads the on-disk snapshot (if any) into the current process's fake-indexeddb. */
-export declare function restoreCryptoStore(path: string): Promise<void>;
-/** Dumps the current process's fake-indexeddb to disk for the next process. */
-export declare function persistCryptoStore(path: string): Promise<void>;
-export {};

package/dist/cli/cryptoSnapshot.js

@@ -1,187 +0,0 @@
-/**
- * Cross-process crypto persistence for the process-per-command CLI.
- *
- * A CLI runs each command as a separate OS process. `TeleCryptIOStorage.create()`
- * initialises rust-crypto with `useIndexedDB: true`, but in Node the only
- * IndexedDB available is `fake-indexeddb`, which is a pure in-memory
- * implementation — it evaporates when the process exits. Left alone, every
- * CLI invocation would start with an empty crypto store and be unable to
- * decrypt anything a previous invocation wrote (including its own device's
- * megolm sessions), which also breaks cross-user sharing: userB's upload
- * process sends userA an olm-encrypted room key addressed to userA's device
- * identity; if that identity is regenerated every run, the key is
- * undecryptable and userA can never read userB's file no matter what backup
- * scheme is layered on top.
- *
- * Fix: snapshot fake-indexeddb's databases to disk after each command and
- * reload them before the next one runs, keyed to the profile directory. This
- * is Option 1 from the spec (disk-persistent crypto store) implemented via
- * generic export/import over the *public* IndexedDB API (databases(), cursors,
- * transactions) rather than poking fake-indexeddb's internals — so it isn't
- * coupled to fake-indexeddb's private representation and would keep working
- * against any spec-compliant IndexedDB implementation. Runtime crypto
- * behaviour is otherwise unchanged from what the library's own tests already
- * exercise (keys.test.ts, tree.test.ts 4.6 both run rust-crypto on
- * fake-indexeddb).
- *
- * Binary values (megolm session keys etc.) don't survive JSON, so the
- * snapshot is serialised with Node's structured-clone-capable `node:v8`
- * (de)serialize rather than JSON.
- */
-import * as fs from "node:fs";
-import * as v8 from "node:v8";
-function getIndexedDB() {
-    const idb = globalThis.indexedDB;
-    if (!idb) {
-        throw new Error("cryptoSnapshot: globalThis.indexedDB is not set — import 'fake-indexeddb/auto' before calling exportIndexedDB/importIndexedDB");
-    }
-    return idb;
-}
-function promisifyRequest(req) {
-    return new Promise((resolve, reject) => {
-        req.onsuccess = () => resolve(req.result);
-        req.onerror = () => reject(req.error);
-    });
-}
-function promisifyTxDone(tx) {
-    return new Promise((resolve, reject) => {
-        tx.oncomplete = () => resolve();
-        tx.onerror = () => reject(tx.error);
-        tx.onabort = () => reject(tx.error ?? new Error("IndexedDB transaction aborted"));
-    });
-}
-function readAllRecords(store) {
-    return new Promise((resolve, reject) => {
-        const out = [];
-        const outOfLine = store.keyPath === null;
-        const req = store.openCursor();
-        req.onerror = () => reject(req.error);
-        req.onsuccess = () => {
-            const cursor = req.result;
-            if (cursor) {
-                out.push(outOfLine
-                    ? { key: cursor.primaryKey, value: cursor.value }
-                    : { value: cursor.value });
-                cursor.continue();
-            }
-            else {
-                resolve(out);
-            }
-        };
-    });
-}
-/** Dumps every IndexedDB database currently visible to this process. */
-export async function exportIndexedDB() {
-    const idb = getIndexedDB();
-    const infos = await idb.databases();
-    const dbs = [];
-    for (const info of infos) {
-        if (!info.name)
-            continue;
-        const db = await promisifyRequest(idb.open(info.name, info.version));
-        try {
-            const storeNames = Array.from(db.objectStoreNames);
-            const stores = [];
-            const records = {};
-            if (storeNames.length > 0) {
-                const tx = db.transaction(storeNames, "readonly");
-                for (const storeName of storeNames) {
-                    const store = tx.objectStore(storeName);
-                    const indexes = Array.from(store.indexNames).map((iname) => {
-                        const idx = store.index(iname);
-                        return {
-                            name: idx.name,
-                            keyPath: idx.keyPath,
-                            unique: idx.unique,
-                            multiEntry: idx.multiEntry,
-                        };
-                    });
-                    stores.push({
-                        name: storeName,
-                        keyPath: store.keyPath,
-                        autoIncrement: store.autoIncrement,
-                        indexes,
-                    });
-                    records[storeName] = await readAllRecords(store);
-                }
-                await promisifyTxDone(tx);
-            }
-            dbs.push({ name: info.name, version: db.version, stores, records });
-        }
-        finally {
-            db.close();
-        }
-    }
-    return { dbs };
-}
-/** Recreates every database/store/index/record from a snapshot into the
- * current (assumed empty) IndexedDB factory. */
-export async function importIndexedDB(snapshot) {
-    const idb = getIndexedDB();
-    for (const dbSnap of snapshot.dbs) {
-        const db = await new Promise((resolve, reject) => {
-            const req = idb.open(dbSnap.name, Math.max(dbSnap.version, 1));
-            req.onupgradeneeded = () => {
-                const database = req.result;
-                for (const store of dbSnap.stores) {
-                    const os = database.createObjectStore(store.name, {
-                        keyPath: store.keyPath ?? undefined,
-                        autoIncrement: store.autoIncrement,
-                    });
-                    for (const idx of store.indexes) {
-                        os.createIndex(idx.name, idx.keyPath, {
-                            unique: idx.unique,
-                            multiEntry: idx.multiEntry,
-                        });
-                    }
-                }
-            };
-            req.onsuccess = () => resolve(req.result);
-            req.onerror = () => reject(req.error);
-        });
-        try {
-            const storeNames = dbSnap.stores.map((s) => s.name);
-            if (storeNames.length > 0) {
-                const tx = db.transaction(storeNames, "readwrite");
-                for (const store of dbSnap.stores) {
-                    const os = tx.objectStore(store.name);
-                    for (const rec of dbSnap.records[store.name] ?? []) {
-                        if (store.keyPath === null) {
-                            os.put(rec.value, rec.key);
-                        }
-                        else {
-                            os.put(rec.value);
-                        }
-                    }
-                }
-                await promisifyTxDone(tx);
-            }
-        }
-        finally {
-            db.close();
-        }
-    }
-}
-export function loadSnapshotFromDisk(path) {
-    if (!fs.existsSync(path))
-        return null;
-    const buf = fs.readFileSync(path);
-    if (buf.length === 0)
-        return null;
-    return v8.deserialize(buf);
-}
-export function saveSnapshotToDisk(path, snapshot) {
-    fs.writeFileSync(path, v8.serialize(snapshot), { mode: 0o600 });
-}
-/** Loads the on-disk snapshot (if any) into the current process's fake-indexeddb. */
-export async function restoreCryptoStore(path) {
-    const snapshot = loadSnapshotFromDisk(path);
-    if (snapshot) {
-        await importIndexedDB(snapshot);
-    }
-}
-/** Dumps the current process's fake-indexeddb to disk for the next process. */
-export async function persistCryptoStore(path) {
-    const snapshot = await exportIndexedDB();
-    saveSnapshotToDisk(path, snapshot);
-}

package/dist/cli/errors.d.ts

@@ -1 +0,0 @@
-export { CliError } from "../core/errors.js";

package/dist/cli/errors.js

@@ -1,3 +0,0 @@
-// Re-homed under src/core/errors.ts (platform-agnostic — no Node/CLI
-// dependencies), re-exported here so existing CLI imports keep working.
-export { CliError } from "../core/errors.js";

package/dist/cli/index.d.ts

@@ -1,2 +0,0 @@
-#!/usr/bin/env node
-import "fake-indexeddb/auto";