@telecrypt-io/storage 0.7.2 → 0.9.0

package/dist/core/operations.js

@@ -11,9 +11,10 @@
  * platform-specific and stays with the caller.
  */
 import { readFileEventMetadata, withMatrixMutationAbort, withTreeMutation, } from "../TeleCryptIOStorage.js";
-import { EventType, MatrixError, RoomCreateTypeField, RoomType, UNSTABLE_MSC3089_BRANCH, UNSTABLE_MSC3088_ENABLED, UNSTABLE_MSC3088_PURPOSE, UNSTABLE_MSC3089_TREE_SUBTYPE, } from "matrix-js-sdk";
+import { EventType, MatrixError, RoomCreateTypeField, RoomType, UNSTABLE_MSC3088_ENABLED, UNSTABLE_MSC3088_PURPOSE, UNSTABLE_MSC3089_TREE_SUBTYPE, } from "matrix-js-sdk";
 import { ClientPrefix } from "matrix-js-sdk/lib/http-api/prefix.js";
 import { Method } from "matrix-js-sdk/lib/http-api/method.js";
+import { validateMatrixEventId } from "./constants.js";
 import { FileTooLargeError, MutationPartialError, MutationOutcomeUnknownError, NonEmptyTreeError, RoomCreationAmbiguousError, RoomCleanupIncompleteError, StorageError, } from "./errors.js";
 import { ConditionTimeoutError, waitForCondition } from "./poll.js";
 import { validateName } from "./validation.js";
@@ -237,8 +238,6 @@ async function refreshDeletionRooms(storage, rootId, signal) {
         throw new StorageError("could not enumerate storage parent safely");
     const parentIds = new Set();
     for (const event of parentEvents) {
-        if (!isActiveRelationEvent(event))
-            continue;
         const parentId = relationStateKey(event);
         if (!parentId)
             throw new StorageError("could not enumerate storage parent safely");
@@ -250,11 +249,6 @@ async function refreshDeletionRooms(storage, rootId, signal) {
     const parents = [...parentIds];
     if (parents[0]) {
         await storage.refreshRoomState(parents[0], { signal });
-        const childEvents = readRelationEvents(client, parents[0], EventType.SpaceChild, rootId);
-        if (childEvents === null ||
-            !childEvents.some((event) => isActiveRelationEvent(event) && relationStateKey(event, rootId) === rootId)) {
-            throw new StorageError("storage parent relation is inconsistent");
-        }
     }
     if (signal?.aborted)
         throw new StorageError("operation cancelled");
@@ -309,7 +303,8 @@ function isActiveRelationEvent(event) {
         !Array.isArray(content) &&
         Object.keys(content).length > 0);
 }
-function activeTreeDirectories(client, tree) {
+async function activeTreeDirectories(storage, tree, signal) {
+    const client = storage.getClient();
     const childEvents = readRelationEvents(client, tree.id, EventType.SpaceChild);
     if (childEvents === null)
         throw new StorageError("storage folder state is unavailable");
@@ -322,35 +317,69 @@ function activeTreeDirectories(client, tree) {
             throw new StorageError("storage folder state is inconsistent");
         activeChildIds.add(childId);
     }
-    const knownChildren = new Map(tree.getDirectories().map((child) => [child.id, child]));
-    return [...activeChildIds].map((childId) => {
-        const child = knownChildren.get(childId);
-        if (!child)
-            throw new StorageError("storage folder state is inconsistent");
-        return child;
-    });
+    const directories = await Promise.all([...activeChildIds].map(async (childId) => {
+        if (isMarkedTreeDeleted(storage, childId))
+            return null;
+        try {
+            // The parent room's relationship state can arrive before Matrix SDK's
+            // MSC3089 TreeSpace projection includes that child. Resolve the exact
+            // room named by the active relation instead of treating that brief
+            // projection lag as corrupt folder state.
+            return await waitForCondition(() => storage.getTree(childId), { timeoutMs: 15000, signal });
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw new StorageError("operation cancelled");
+            if (error instanceof ConditionTimeoutError) {
+                throw new StorageError("storage folder state is inconsistent");
+            }
+            throw new StorageError("storage folder state lookup failed", { cause: error });
+        }
+    }));
+    return directories.filter((directory) => directory !== null);
 }
 async function unlinkExternalParents(storage, rootId, externalParents, signal) {
     const client = storage.getClient();
-    let mutationAttempted = false;
+    const completedRelationEventIds = [];
+    const redactRelation = async (roomId, eventType, stateKey) => {
+        await storage.refreshRoomState(roomId, { signal });
+        if (signal?.aborted)
+            throw new StorageError("operation cancelled");
+        const events = readRelationEvents(client, roomId, eventType, stateKey);
+        if (events === null)
+            throw new StorageError("storage folder state is unavailable");
+        const event = events[0];
+        if (!event || !isActiveRelationEvent(event))
+            return;
+        const currentUserId = client.getUserId();
+        if (!currentUserId || event.getSender?.() !== currentUserId) {
+            throw new StorageError("storage folder relation was not authored by the owner");
+        }
+        const eventId = validateMatrixEventId(event.getId?.(), "storage folder relation event ID");
+        await withRateLimitRetry(() => withMatrixMutationAbort(() => client.redactEvent(roomId, eventId), signal), signal);
+        if (!completedRelationEventIds.includes(eventId))
+            completedRelationEventIds.push(eventId);
+        await storage.refreshRoomState(roomId, { signal });
+        const remaining = readRelationEvents(client, roomId, eventType, stateKey);
+        if (remaining === null || remaining.some((candidate) => isActiveRelationEvent(candidate))) {
+            throw new StorageError("delete graph unlink could not be verified");
+        }
+    };
     try {
         for (const parentId of externalParents) {
             if (signal?.aborted)
                 throw new StorageError("operation cancelled");
-            // Empty state-event content is the MSC3089-supported unlink form. Redaction
-            // is not used here because it can be delayed or rejected independently of
-            // the relation update.
-            mutationAttempted = true;
-            await withRateLimitRetry(() => withMatrixMutationAbort(() => client.sendStateEvent(parentId, EventType.SpaceChild, {}, rootId), signal), signal);
-            if (signal?.aborted)
-                throw new StorageError("operation cancelled");
-            await withRateLimitRetry(() => withMatrixMutationAbort(() => client.sendStateEvent(rootId, EventType.SpaceParent, {}, parentId), signal), signal);
+            // Redact owner-authored relations one room at a time. If the process stops
+            // after the parent-side redaction, the redacted state key remains visible
+            // and the next call continues with the child-side relation.
+            await redactRelation(parentId, EventType.SpaceChild, rootId);
+            await redactRelation(rootId, EventType.SpaceParent, parentId);
             await storage.refreshRoomState(parentId, { signal });
             await storage.refreshRoomState(rootId, { signal });
             const childLink = readRelationEvents(client, parentId, EventType.SpaceChild, rootId);
             const parentLink = readRelationEvents(client, rootId, EventType.SpaceParent, parentId);
-            if (!childLink ||
-                !parentLink ||
+            if (childLink === null ||
+                parentLink === null ||
                 childLink.some((event) => isActiveRelationEvent(event)) ||
                 parentLink.some((event) => isActiveRelationEvent(event))) {
                 throw new StorageError("delete graph unlink could not be verified");
@@ -358,45 +387,14 @@ async function unlinkExternalParents(storage, rootId, externalParents, signal) {
         }
     }
     catch (error) {
-        if (!mutationAttempted && error instanceof StorageError && error.message === "operation cancelled") {
+        if (error instanceof MutationOutcomeUnknownError || error instanceof MutationPartialError)
             throw error;
-        }
-        // Unlinking is a two-room transaction. A failed second state update must
-        // not leave a still-live vault detached from its external parent. Best
-        // effort is insufficient here: surface a distinct failure if the repair
-        // itself cannot be completed so callers never mistake a partial mutation
-        // for a successful delete.
-        try {
-            await relinkExternalParents(storage, rootId, externalParents, new AbortController().signal);
-        }
-        catch (cleanupError) {
-            throw new StorageError("delete graph unlink cleanup is incomplete", {
-                cause: new AggregateError([error, cleanupError], "delete graph unlink and relink both failed", { cause: error }),
-            });
+        if (completedRelationEventIds.length > 0) {
+            throw new MutationPartialError("delete folder links", completedRelationEventIds, "some parent links were removed; retry deleting the same folder to finish unlinking", { cause: error });
         }
         throw error;
     }
 }
-async function relinkExternalParents(storage, rootId, externalParents, signal) {
-    const client = storage.getClient();
-    const via = client.getDomain();
-    if (!via)
-        throw new StorageError("delete graph relink is unavailable");
-    for (const parentId of externalParents) {
-        if (signal?.aborted)
-            throw new StorageError("operation cancelled");
-        await withRateLimitRetry(() => withMatrixMutationAbort(() => client.sendStateEvent(parentId, EventType.SpaceChild, { via: [via] }, rootId), signal), signal);
-        await withRateLimitRetry(() => withMatrixMutationAbort(() => client.sendStateEvent(rootId, EventType.SpaceParent, { via: [via] }, parentId), signal), signal);
-        await storage.refreshRoomState(parentId, { signal });
-        await storage.refreshRoomState(rootId, { signal });
-        const childLink = readRelationEvents(client, parentId, EventType.SpaceChild, rootId);
-        const parentLink = readRelationEvents(client, rootId, EventType.SpaceParent, parentId);
-        if (!childLink?.some((event) => isActiveRelationEvent(event)) ||
-            !parentLink?.some((event) => isActiveRelationEvent(event))) {
-            throw new StorageError("delete graph relink could not be verified");
-        }
-    }
-}
 function isGoneError(error) {
     return (error instanceof MatrixError &&
         (error.errcode === "M_NOT_FOUND" || error.errcode === "M_UNKNOWN"));
@@ -409,12 +407,25 @@ async function deleteRoomDeterministically(storage, roomId, signal) {
     };
     try {
         const client = storage.getClient();
-        const tree = storage.getTree(roomId);
-        if (!tree)
-            throw new StorageError("storage room is unavailable for deletion");
         const self = client.getUserId();
         if (!self)
             throw new StorageError("Matrix user identity is unavailable");
+        const ownMembership = await storage.getRoomMembership(roomId, undefined, { signal });
+        if (ownMembership === "leave" || ownMembership === "ban") {
+            try {
+                await withRateLimitRetry(() => withMatrixMutationAbort(() => client.forget(roomId), signal), signal);
+            }
+            catch (error) {
+                if (!isGoneError(error))
+                    throw error;
+            }
+            removeRoomFromLocalStore(client, roomId);
+            markTreeDeleted(client, roomId);
+            return;
+        }
+        const tree = storage.getTree(roomId);
+        if (!tree)
+            throw new StorageError("storage room is unavailable for deletion");
         const members = await storage.listMembers(tree, { signal });
         if (members.some((member) => member.userId !== self && member.role === "owner" &&
             (member.membership === "join" || member.membership === "invite" || member.membership === "knock"))) {
@@ -444,7 +455,6 @@ async function deleteRoomDeterministically(storage, roomId, signal) {
                 throw error;
             }
         }
-        const ownMembership = await storage.getRoomMembership(roomId, undefined, { signal });
         if (ownMembership === "join" || ownMembership === "invite" || ownMembership === "knock") {
             try {
                 await withRateLimitRetry(() => withMatrixMutationAbort(() => client.leave(roomId), signal), signal);
@@ -483,9 +493,6 @@ async function deleteRoomDeterministically(storage, roomId, signal) {
 function removeRoomFromLocalStore(client, roomId) {
     client.store?.removeRoom(roomId);
 }
-function isActiveMembership(membership) {
-    return membership === "join" || membership === "invite";
-}
 function isRevocableMembership(membership) {
     return membership === "join" || membership === "invite" || membership === "knock";
 }
@@ -501,6 +508,7 @@ function toArrayBuffer(bytes) {
     return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
 }
 export async function createVault(storage, name, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         let tree;
         try {
@@ -520,9 +528,14 @@ export async function createVault(storage, name, options) {
 }
 /** Top-level vaults only — excludes subdirectories of an existing tree. */
 export async function listVaults(storage, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const trees = await storage.listTrees(signal);
-        return trees.filter((t) => t.isTopLevel).map((t) => ({ id: t.id, name: t.room.name }));
+        const topLevel = trees.filter((tree) => tree.isTopLevel);
+        return Promise.all(topLevel.map(async (tree) => ({
+            id: tree.id,
+            name: await storage.getTreeName(tree.id, { signal }),
+        })));
     });
 }
 /** Current account's effective role for a vault, or null while it is unavailable. */
@@ -534,6 +547,7 @@ export function getMyVaultRole(storage, vaultId) {
     return tree.getPermissions(userId);
 }
 export async function joinVault(storage, vaultId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         let membership;
         try {
@@ -555,8 +569,27 @@ export async function joinVault(storage, vaultId, options) {
         }
         if (membership === "join")
             return { vaultId, joined: true };
+        const client = storage.getClient();
+        const userId = client.getUserId();
+        if (userId && client.getRoom(vaultId)?.getMember(userId)?.membership !== "invite") {
+            // MatrixClient.joinRoom reads the inviter from its local invite-room
+            // state. A to-device history bundle can arrive first in the initial
+            // sync, before that stripped invite state has reached the room store;
+            // joining without it skips Matrix JS SDK's pending-bundle acceptance.
+            try {
+                await waitForCondition(() => client.getRoom(vaultId)?.getMember(userId)?.membership === "invite" ? true : null, { timeoutMs: 15000, signal });
+            }
+            catch (err) {
+                if (signal.aborted)
+                    throw new StorageError("operation cancelled");
+                if (err instanceof ConditionTimeoutError) {
+                    throw new StorageError("the room invitation has not reached this login yet; retry joining", { cause: err });
+                }
+                throw err;
+            }
+        }
         try {
-            await withRateLimitRetry(() => withMatrixMutationAbort(() => storage.getClient().joinRoom(vaultId), signal), signal);
+            await withRateLimitRetry(() => withMatrixMutationAbort(() => client.joinRoom(vaultId), signal), signal);
         }
         catch (err) {
             if (err instanceof MutationOutcomeUnknownError)
@@ -574,17 +607,8 @@ export async function joinVault(storage, vaultId, options) {
         return { vaultId, joined: true };
     }, "mutation");
 }
-function roomDisplayName(storage, roomId, fallbackName) {
-    const client = storage.getClient();
-    const room = client.getRoom(roomId);
-    if (fallbackName?.trim())
-        return fallbackName.trim();
-    if (room?.name)
-        return room.name;
-    const userId = client.getUserId();
-    if (room && userId)
-        return room.getDefaultRoomName(userId);
-    return roomId;
+function roomDisplayName(_storage, _roomId, _fallbackName) {
+    return "Encrypted storage";
 }
 function hasActiveSpaceParent(room) {
     const result = room.currentState?.getStateEvents?.(EventType.SpaceParent);
@@ -601,6 +625,7 @@ function isReviewedStorageTreeRoom(room) {
 }
 /** Rooms where this account is invited and the room looks like a file tree. */
 export async function listPendingInvites(storage, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const client = storage.getClient();
         const rooms = client.getRooms();
@@ -637,6 +662,7 @@ export async function listPendingInvites(storage, options) {
 }
 /** Decline a vault invite (same as leaving before join). */
 export async function declineInvite(storage, vaultId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const client = storage.getClient();
         try {
@@ -730,6 +756,7 @@ export async function declineInvite(storage, vaultId, options) {
 }
 /** Invites `userId` to the vault as a reader. */
 export async function shareVault(storage, vaultId, userId, role, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     if (role !== "viewer") {
         throw new StorageError("storage sharing supports viewers only");
     }
@@ -752,6 +779,15 @@ export async function shareVault(storage, vaultId, userId, role, options) {
                 if (currentMembers.some((member) => member.userId === userId && member.role === "owner")) {
                     throw new StorageError("share will not demote an existing owner");
                 }
+                const client = storage.getClient();
+                const crypto = client.getCrypto();
+                if (!crypto)
+                    throw new StorageError("sharing requires initialized encryption");
+                const recipient = await client.downloadKeysForUsers([userId]);
+                const devices = Object.keys(recipient.device_keys?.[userId] ?? {});
+                if (!recipient.master_keys?.[userId] || !recipient.self_signing_keys?.[userId] || devices.length === 0) {
+                    throw new StorageError("The reader must set up or unlock their Decryption Key Safe before sharing");
+                }
                 for (const [index, space] of spaces.entries()) {
                     ensureOperationActive(operation.signal);
                     const members = index === 0
@@ -765,28 +801,21 @@ export async function shareVault(storage, vaultId, userId, role, options) {
                         : await storage.getRoomMembership(space.id, userId, {
                             signal: operation.signal,
                         });
-                    if (isActiveMembership(currentMembership ?? ""))
+                    if (currentMembership === "join")
                         continue;
-                    try {
-                        await withRateLimitRetry(() => withMatrixMutationAbort(() => space.invite(userId), operation.signal), operation.signal);
-                        completedRoomIds.add(space.id);
-                    }
-                    catch (error) {
-                        if (!(error instanceof MatrixError) || error.errcode !== "M_FORBIDDEN")
-                            throw error;
-                        // Synapse may race another invite/join and answer M_FORBIDDEN. Only
-                        // suppress that typed condition after re-reading authoritative
-                        // membership; never infer it from provider-controlled error text.
-                        const membership = await storage.getRoomMembership(space.id, userId, {
-                            signal: operation.signal,
-                        });
-                        if (!isActiveMembership(membership ?? ""))
-                            throw new StorageError("share failed");
+                    // Native invite shares the encrypted history before inviting. Retry
+                    // pending invitations too: an earlier attempt may have sent only an
+                    // invitation. In particular, never swallow a media-upload 403 merely
+                    // because an invitation already exists.
+                    await withRateLimitRetry(() => withMatrixMutationAbort(() => space.invite(userId), operation.signal), operation.signal);
+                    completedRoomIds.add(space.id);
+                    const statuses = await Promise.all(devices.map((id) => crypto.getDeviceVerificationStatus(userId, id)));
+                    if (!statuses.some((status) => status?.signedByOwner)) {
+                        throw new StorageError("The invitation was sent, but history keys could not be shared; the reader must unlock their Decryption Key Safe, then retry sharing");
                     }
                 }
                 // Storage rooms have one immutable owner power level and readers use
-                // the room's default user level. Inviting is the complete sharing
-                // operation; changing per-user power levels would create editors and
+                // the room's default user level. Changing per-user power levels would create editors and
                 // let metadata authorship drift away from the owner.
             }
             catch (error) {
@@ -799,6 +828,7 @@ export async function shareVault(storage, vaultId, userId, role, options) {
                     (error.message === "share failed" ||
                         error.message.includes("owner") ||
                         error.message.includes("current user") ||
+                        error.message.includes("Decryption Key Safe") ||
                         error.message === "operation cancelled")) {
                     throw error;
                 }
@@ -813,6 +843,7 @@ export async function shareVault(storage, vaultId, userId, role, options) {
     }
 }
 export async function unshareVault(storage, vaultId, userId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     const operation = createOperationDeadline(options);
     const completedRoomIds = new Set();
     try {
@@ -887,6 +918,7 @@ export async function unshareVault(storage, vaultId, userId, options) {
     }
 }
 export async function listMembers(storage, vaultId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, vaultId, signal);
         try {
@@ -900,6 +932,7 @@ export async function listMembers(storage, vaultId, options) {
     });
 }
 export async function listFiles(storage, treeId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, treeId, signal);
         try {
@@ -908,7 +941,10 @@ export async function listFiles(storage, treeId, options) {
             const files = tree
                 .listFiles()
                 .filter((file) => !isMarkedFileDeleted(storage, tree.id, file.id));
-            return files.map((f) => ({ id: f.id, name: f.getName() }));
+            return await Promise.all(files.map(async (file) => ({
+                id: file.id,
+                name: await storage.getFileName(tree.id, file.id, { signal, refreshState: false }),
+            })));
         }
         catch (error) {
             if (signal.aborted)
@@ -919,16 +955,21 @@ export async function listFiles(storage, treeId, options) {
 }
 /** Lists the direct child folders of a vault or folder. */
 export async function listSubfolders(storage, parentId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, parentId, signal);
         await storage.refreshRoomState(parentId, { signal });
         ensureOperationActive(signal);
-        const directories = activeTreeDirectories(storage.getClient(), tree)
+        const directories = (await activeTreeDirectories(storage, tree, signal))
             .filter((directory) => !isMarkedTreeDeleted(storage, directory.id));
-        return directories.map((d) => ({ id: d.id, name: d.room.name }));
+        return Promise.all(directories.map(async (directory) => ({
+            id: directory.id,
+            name: await storage.getTreeName(directory.id, { signal }),
+        })));
     });
 }
 export async function createSubfolder(storage, parentId, name, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     validateName(name, "name");
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, parentId, signal);
@@ -957,11 +998,9 @@ async function renameTree(storage, treeId, name, options) {
             await waitForCondition(async () => {
                 ensureOperationActive(signal);
                 const current = storage.getTree(treeId);
-                if (current?.room.name === name)
-                    return current;
-                await storage.refreshRoomState(treeId, { signal });
-                const refreshed = storage.getTree(treeId);
-                return refreshed?.room.name === name ? refreshed : null;
+                if (!current)
+                    return null;
+                return (await storage.getTreeName(treeId, { signal })) === name ? current : null;
             }, { timeoutMs: 15000, signal });
         }
         catch (error) {
@@ -976,10 +1015,12 @@ async function renameTree(storage, treeId, name, options) {
 }
 /** Renames a top-level Vault. */
 export async function renameVault(storage, vaultId, name, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return renameTree(storage, vaultId, name, options);
 }
 /** Renames a nested folder. */
 export async function renameFolder(storage, folderId, name, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return renameTree(storage, folderId, name, options);
 }
 async function deleteTree(storage, treeId, options) {
@@ -990,6 +1031,20 @@ async function deleteTree(storage, treeId, options) {
         const pending = withTreeMutation(client, async () => {
             if (isTreeDeleted(client, treeId))
                 return { id: treeId, deleted: true };
+            const ownMembership = await storage.getRoomMembership(treeId, undefined, {
+                signal: operation.signal,
+            });
+            if (ownMembership === "leave" || ownMembership === "ban") {
+                try {
+                    await deleteRoomDeterministically(storage, treeId, operation.signal);
+                }
+                catch (error) {
+                    if (error instanceof StorageError)
+                        throw error;
+                    throw new StorageError("delete cleanup failed", { cause: error });
+                }
+                return { id: treeId, deleted: true };
+            }
             const tree = await resolveTree(storage, treeId, operation.signal);
             let externalParents;
             try {
@@ -1015,14 +1070,6 @@ async function deleteTree(storage, treeId, options) {
                 await deleteRoomDeterministically(storage, tree.id, operation.signal);
             }
             catch (error) {
-                try {
-                    await relinkExternalParents(storage, tree.id, externalParents, new AbortController().signal);
-                }
-                catch (cleanupError) {
-                    throw new StorageError("delete cleanup is incomplete", {
-                        cause: new AggregateError([error, cleanupError], "delete and external-parent relink both failed", { cause: error }),
-                    });
-                }
                 if (error instanceof StorageError)
                     throw error;
                 throw new StorageError("delete failed", { cause: error });
@@ -1037,13 +1084,16 @@ async function deleteTree(storage, treeId, options) {
 }
 /** Deletes a top-level Vault. */
 export async function deleteVault(storage, vaultId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return deleteTree(storage, vaultId, options);
 }
 /** Deletes a nested folder. */
 export async function deleteFolder(storage, folderId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return deleteTree(storage, folderId, options);
 }
 export async function renameFile(storage, treeId, fileId, name, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     validateName(name, "file name");
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, treeId, signal);
@@ -1054,9 +1104,11 @@ export async function renameFile(storage, treeId, fileId, name, options) {
             // fresh CLI/UI process can still read the previous local room state for a
             // short time. Do not report success until this client has observed the new
             // name through its normal sync loop.
-            await waitForCondition(() => {
+            await waitForCondition(async () => {
                 const current = tree.getFile(fileId);
-                return current?.getName() === name ? current : null;
+                if (!current)
+                    return null;
+                return (await storage.getFileName(treeId, fileId, { signal })) === name ? current : null;
             }, { timeoutMs: 15000, signal });
         }
         catch (error) {
@@ -1091,53 +1143,83 @@ async function deleteFileMedia(storage, mediaIds, signal) {
     }
 }
 export async function deleteFile(storage, treeId, fileId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, treeId, signal);
-        const branch = await resolveFile(storage, tree, fileId, signal);
-        let fileInfo;
+        if (isMarkedFileDeleted(storage, tree.id, fileId))
+            return { id: fileId, deleted: true };
+        await storage.refreshRoomState(treeId, { signal });
+        const branch = tree.getFile(fileId);
+        if (!branch)
+            throw new StorageError("file not found");
+        let originalEvent;
         try {
-            fileInfo = await branch.getFileInfo();
+            originalEvent = await storage.getOriginalFileEvent(tree.id, fileId, true);
         }
         catch (error) {
             throw new StorageError("could not resolve encrypted file safely", { cause: error });
         }
-        const mediaId = fileInfo?.info?.url;
+        if (originalEvent.isRedacted()) {
+            if (branch.isActive === false) {
+                markFileDeleted(storage.getClient(), tree.id, fileId);
+                return { id: fileId, deleted: true };
+            }
+            throw new StorageError("file listing is active but its attachment event is redacted");
+        }
+        const originalContent = originalEvent.getContent();
+        const fileDescriptor = typeof originalContent === "object" &&
+            originalContent !== null &&
+            !Array.isArray(originalContent) &&
+            "file" in originalContent &&
+            typeof originalContent.file === "object" &&
+            originalContent.file !== null &&
+            !Array.isArray(originalContent.file)
+            ? originalContent.file
+            : undefined;
+        const mediaId = fileDescriptor?.url;
         if (typeof mediaId !== "string" || mediaId.length === 0) {
             throw new StorageError("encrypted file has no media identifier");
         }
         await deleteFileMedia(storage, [mediaId], signal);
-        const completedIds = [];
+        const completedIds = [mediaId];
         try {
             const client = storage.getClient();
-            // MSC3089 uses the file event ID as the branch state key, but the current
-            // listing is a separate state event. Redact that current listing after
-            // clearing the branch state; redacting only the file event leaves the
-            // listing visible and is especially harmful when a user is suspended.
-            const listingEventId = branch.indexEvent?.getId?.() ?? branch.id;
-            if (typeof listingEventId !== "string" || listingEventId.length === 0) {
+            const metadataEventId = await storage.getFileMetadataEventId(tree.id, fileId, { signal });
+            if (metadataEventId && metadataEventId !== fileId) {
+                const metadataEvent = await storage.getFileRenameMetadataEvent(tree.id, fileId, metadataEventId);
+                if (!metadataEvent.isRedacted()) {
+                    await withRateLimitRetry(() => withMatrixMutationAbort(() => client.redactEvent(tree.id, metadataEventId), signal, "delete file rename metadata"), signal);
+                }
+                completedIds.push(metadataEventId);
+            }
+            const currentBranch = tree.getFile(fileId);
+            const indexEvent = currentBranch?.indexEvent;
+            const listingEventId = indexEvent?.getId();
+            if (!indexEvent || typeof listingEventId !== "string" || listingEventId.length === 0) {
                 throw new StorageError("encrypted file has no listing event identifier");
             }
-            await withRateLimitRetry(() => withMatrixMutationAbort(() => client.sendStateEvent(tree.id, UNSTABLE_MSC3089_BRANCH.name, {}, branch.id), signal, "delete file state"), signal);
-            await withRateLimitRetry(() => withMatrixMutationAbort(() => client.redactEvent(tree.id, listingEventId), signal, "delete file event"), signal);
+            if (!indexEvent.isRedacted()) {
+                if (indexEvent.getSender() !== client.getUserId()) {
+                    throw new StorageError("file listing was not authored by the owner");
+                }
+                await withRateLimitRetry(() => withMatrixMutationAbort(() => client.redactEvent(tree.id, listingEventId), signal, "delete file listing"), signal);
+            }
             completedIds.push(listingEventId);
+            await withRateLimitRetry(() => withMatrixMutationAbort(() => client.redactEvent(tree.id, fileId), signal, "delete file attachment event"), signal);
+            completedIds.push(fileId);
         }
         catch (error) {
-            if (error instanceof MutationOutcomeUnknownError)
-                throw error;
-            if (signal.aborted) {
-                throw new MutationPartialError("delete file", completedIds, "media was deleted but Matrix event cleanup was cancelled", { cause: error });
-            }
-            throw new MutationPartialError("delete file", completedIds, "media was deleted but Matrix event cleanup stopped", { cause: error });
+            throw new MutationPartialError("delete file", completedIds, "file media and the listed completed steps were deleted; retry with the original file ID to finish Matrix cleanup", { cause: error });
         }
         try {
             await waitForCondition(async () => {
                 await storage.refreshRoomState(tree.id, { signal });
                 ensureOperationActive(signal);
                 const current = tree.getFile(fileId);
-                // Matrix SDK keeps a redacted branch event in room state as an
-                // inactive branch. Treat both an absent branch and that redacted
-                // inactive branch as confirmed deletion.
-                return !current || current.isActive === false ? true : null;
+                if (current && current.isActive !== false)
+                    return null;
+                const attachment = await storage.getOriginalFileEvent(tree.id, fileId, true);
+                return attachment.isRedacted() ? true : null;
             }, { timeoutMs: 15000, signal });
         }
         catch (error) {
@@ -1146,12 +1228,13 @@ export async function deleteFile(storage, treeId, fileId, options) {
             const detail = "Matrix deletion completed but the file state could not be verified";
             throw new MutationPartialError("delete file", completedIds, detail, { cause: error });
         }
-        markFileDeleted(storage.getClient(), tree.id, branch.id);
+        markFileDeleted(storage.getClient(), tree.id, fileId);
         ensureOperationActive(signal);
         return { id: fileId, deleted: true };
     }, "mutation");
 }
 export async function uploadFile(storage, treeId, name, bytes, mimetype, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, treeId, signal);
         const fileId = await withRateLimitRetry(() => storage.uploadFile(tree, name, toArrayBuffer(bytes), mimetype, signal), signal).catch((error) => {
@@ -1187,6 +1270,7 @@ export async function uploadFile(storage, treeId, name, bytes, mimetype, options
     }, "mutation");
 }
 export async function downloadFile(storage, treeId, fileId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, treeId, signal);
         const branch = await resolveFile(storage, tree, fileId, signal);
@@ -1205,7 +1289,7 @@ export async function downloadFile(storage, treeId, fileId, options) {
         return {
             bytes: new Uint8Array(result.data),
             mimetype: result.mimetype,
-            name: branch.getName(),
+            name: await storage.getFileName(tree.id, fileId, { signal }),
         };
     });
 }
@@ -1221,17 +1305,18 @@ function tsToIso(ts) {
     return new Date(ts).toISOString();
 }
 export async function getFileDetails(storage, treeId, fileId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, async (signal) => {
         const tree = await resolveTree(storage, treeId, signal);
-        const branch = await resolveFile(storage, tree, fileId, signal);
-        const name = branch.getName();
+        await resolveFile(storage, tree, fileId, signal);
+        const name = await storage.getFileName(tree.id, fileId, { signal });
         let mimetype = null;
         let size = null;
         let createdAt = null;
         let updatedAt = null;
         try {
             ensureOperationActive(signal);
-            const event = await branch.getFileEvent();
+            const event = await storage.getOriginalFileEvent(tree.id, fileId);
             const metadata = readFileEventMetadata(event.getContent());
             mimetype = metadata.mimetype;
             size = metadata.size;
@@ -1250,7 +1335,7 @@ export async function getFileDetails(storage, treeId, fileId, options) {
     });
 }
 async function getTreeDetails(storage, treeId, signal) {
-    const tree = await resolveTree(storage, treeId, signal);
+    await resolveTree(storage, treeId, signal);
     if (signal?.aborted)
         throw new StorageError("operation cancelled");
     const client = storage.getClient();
@@ -1268,7 +1353,7 @@ async function getTreeDetails(storage, treeId, signal) {
         }
     }
     return {
-        name: tree.room.name || roomDisplayName(storage, treeId),
+        name: await storage.getTreeName(treeId, { signal }),
         id: treeId,
         createdAt,
         memberCount,
@@ -1276,9 +1361,11 @@ async function getTreeDetails(storage, treeId, signal) {
 }
 /** Returns details for a top-level Vault. */
 export async function getVaultDetails(storage, vaultId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, (signal) => getTreeDetails(storage, vaultId, signal));
 }
 /** Returns details for a nested folder. */
 export async function getFolderDetails(storage, folderId, options) {
+    await storage.keySafe.requireReady({ signal: options?.signal });
     return withOperationDeadline(options, (signal) => getTreeDetails(storage, folderId, signal));
 }