@telecrypt-io/storage 0.8.0 → 0.9.2

package/dist/TeleCryptIOStorage.js

@@ -1,14 +1,18 @@
-import { ClientEvent, createClient, EventType, MatrixEvent, MatrixError, MsgType, Preset, RoomCreateTypeField, RoomType, SyncState, UNSTABLE_MSC3088_ENABLED, UNSTABLE_MSC3088_PURPOSE, UNSTABLE_MSC3089_BRANCH, UNSTABLE_MSC3089_LEAF, UNSTABLE_MSC3089_TREE_SUBTYPE, } from "matrix-js-sdk";
+import { ClientEvent, createClient, EventType, JoinRule, MatrixEvent, MatrixError, MsgType, Preset, RoomCreateTypeField, RoomType, SyncState, UNSTABLE_MSC3088_ENABLED, UNSTABLE_MSC3088_PURPOSE, UNSTABLE_MSC3089_BRANCH, UNSTABLE_MSC3089_LEAF, UNSTABLE_MSC3089_TREE_SUBTYPE, } from "matrix-js-sdk";
 import { Method } from "matrix-js-sdk/lib/http-api/method.js";
 import { ClientPrefix } from "matrix-js-sdk/lib/http-api/prefix.js";
 import { encryptAttachment, decryptAttachment } from "matrix-encrypt-attachment";
 import { decodeRecoveryKey } from "matrix-js-sdk/lib/crypto-api/recovery-key.js";
-import { FileTooLargeError, RecoveryAlreadyConfiguredError, RecoveryRestoreError, RecoverySetupAmbiguousError, RecoverySetupError, RecoveryRestoreAmbiguousError, MutationOutcomeUnknownError, RoomCreationAmbiguousError, RoomCleanupIncompleteError, StorageError, UndecryptableFileError, } from "./core/errors.js";
+import { FileTooLargeError, RecoveryAlreadyConfiguredError, RecoveryRestoreError, RecoverySetupAmbiguousError, RecoverySetupError, RecoveryRestoreAmbiguousError, MutationOutcomeUnknownError, MutationPartialError, RoomCreationAmbiguousError, RoomCleanupIncompleteError, StorageError, UndecryptableFileError, } from "./core/errors.js";
 import { MAX_MEDIA_FILE_BYTES, MAX_MATRIX_IDENTIFIER_BYTES, validateCanonicalMatrixUserId, validateMatrixDeviceId, validateMatrixEventId, validateMatrixRoomId, } from "./core/constants.js";
 import { cancelResponseBody, raceWithAbort, readMediaResponseBody, readResponseBody, ResponseBodyReadError, } from "./core/http.js";
 import { sanitizeDiagnosticText } from "./core/oidc.js";
 import { validateName } from "./core/validation.js";
+import { ConditionTimeoutError, waitForCondition } from "./core/poll.js";
 import { isTreeDeleted } from "./deletion-markers.js";
+import { DecryptionKeySafe } from "./key-safe.js";
+import { prepareReaderHistorySharing } from "./sharing.js";
+import { deleteOwnedMedia } from "./media.js";
 const STORAGE_METADATA_EVENT_TYPE = "io.telecrypt.storage.metadata";
 const STORAGE_METADATA_MSGTYPE = "io.telecrypt.storage.metadata";
 const GENERIC_TREE_NAME = "Encrypted storage";
@@ -356,7 +360,7 @@ function parseMatrixStateResponse(value) {
 function parseMatrixPowerLevels(value) {
     if (!isRecord(value))
         throw new Error("invalid Matrix power-level response");
-    for (const name of ["users_default", "events_default"]) {
+    for (const name of ["users_default", "events_default", "state_default"]) {
         const field = value[name];
         if (field !== undefined && (typeof field !== "number" || !Number.isFinite(field))) {
             throw new Error("invalid Matrix power-level response");
@@ -406,12 +410,18 @@ export async function withTreeMutation(client, operation, signal) {
 }
 export class TeleCryptIOStorage {
     client;
+    syncOptions;
     decoratedTreeSpaces = new WeakSet();
     decoratedFileBranches = new WeakMap();
     treeNames = new Map();
     fileNames = new Map();
-    constructor(client) {
+    keySafe;
+    syncStarted = false;
+    syncInFlight;
+    constructor(client, options = {}, syncOptions = {}) {
         this.client = client;
+        this.syncOptions = syncOptions;
+        this.keySafe = new DecryptionKeySafe(client, (key, operation, signal) => this.withSecretStorageKey(key, operation, signal), options, (signal) => this.startSync(signal));
         // Advanced callers may construct a MatrixClient themselves. The SDK does
         // not mutate matrix-js-sdk internals: configure that client with the
         // supported createClient({ fetchFn, localTimeoutMs }) options, or use
@@ -421,6 +431,41 @@ export class TeleCryptIOStorage {
     getClient() {
         return this.client;
     }
+    /** Start Matrix room sync after crypto setup, for example after the current
+     * login has checked or restored its Decryption Key Safe. */
+    async startSync(signal) {
+        if (this.syncStarted)
+            return;
+        if (this.syncInFlight)
+            return this.syncInFlight;
+        const start = (async () => {
+            try {
+                TeleCryptIOStorage.throwIfAborted(signal);
+                const timeoutMs = this.syncOptions.syncTimeoutMs ?? 15000;
+                this.syncOptions.onProgress?.("Starting Matrix client…");
+                await TeleCryptIOStorage.withTimeout(this.client.startClient({ initialSyncLimit: this.syncOptions.initialSyncLimit ?? 10 }), timeoutMs, "client start", signal);
+                this.syncOptions.onProgress?.("Waiting for first sync with homeserver…");
+                await TeleCryptIOStorage.waitForFirstSync(this.client, timeoutMs, signal);
+                TeleCryptIOStorage.throwIfAborted(signal);
+                this.syncStarted = true;
+                this.syncOptions.onProgress?.("Sync complete.");
+            }
+            catch (error) {
+                try {
+                    this.client.stopClient();
+                }
+                catch (stopError) {
+                    throw new AggregateError([error, stopError], "Matrix sync startup and cleanup failed");
+                }
+                throw error;
+            }
+            finally {
+                this.syncInFlight = undefined;
+            }
+        })();
+        this.syncInFlight = start;
+        return start;
+    }
     fileNameKey(treeId, fileId) {
         return `${treeId}\u0000${fileId}`;
     }
@@ -473,8 +518,7 @@ export class TeleCryptIOStorage {
         await this.client.sendStateEvent(roomId, STORAGE_METADATA_EVENT_TYPE, { event_id: metadataEventId }, "");
         this.treeNames.set(roomId, name);
     }
-    /** Resolves an encrypted vault/folder name through its pointer state event. */
-    async getTreeName(roomId, options) {
+    async getTreeMetadataEvent(roomId, options) {
         if (options?.signal?.aborted)
             throw new StorageError("operation cancelled");
         await this.refreshRoomState(roomId, options);
@@ -487,9 +531,22 @@ export class TeleCryptIOStorage {
             throw new StorageError("encrypted storage name is unavailable");
         }
         const metadataEventId = validateMatrixEventId(pointerContent.event_id, "storage metadata event ID");
+        const event = await this.readEncryptedMetadataMessage(roomId, metadataEventId);
+        const content = event.getContent();
+        if (!isRecord(content) ||
+            content.msgtype !== STORAGE_METADATA_MSGTYPE ||
+            typeof content.body !== "string" ||
+            Object.hasOwn(content, "file_event_id")) {
+            throw new StorageError("encrypted storage name is invalid or unavailable");
+        }
+        validateName(content.body, "name");
+        return event;
+    }
+    /** Resolves an encrypted vault/folder name through its pointer state event. */
+    async getTreeName(roomId, options) {
         let event;
         try {
-            event = await this.readEncryptedMetadataMessage(roomId, metadataEventId);
+            event = await this.getTreeMetadataEvent(roomId, options);
         }
         catch (error) {
             // A new device can list storage before restoring room keys. Keep the
@@ -499,16 +556,78 @@ export class TeleCryptIOStorage {
             throw error;
         }
         const content = event.getContent();
-        if (!isRecord(content) ||
-            content.msgtype !== STORAGE_METADATA_MSGTYPE ||
-            typeof content.body !== "string" ||
-            Object.hasOwn(content, "file_event_id")) {
-            throw new StorageError("encrypted storage name is invalid or unavailable");
-        }
-        validateName(content.body, "name");
         this.treeNames.set(roomId, content.body);
         return content.body;
     }
+    /**
+     * Waits for the current encrypted vault/folder name, or file metadata, to
+     * have its session in the active native key backup. Checks the exact session
+     * even when encryption reuses a key and the backup engine emits no new event.
+     */
+    async waitForKeyBackup(treeId, fileId, options) {
+        validateMatrixRoomId(treeId);
+        if (fileId !== undefined)
+            validateMatrixEventId(fileId, "file event ID");
+        const timeoutMs = matrixRequestTimeout({ timeoutMs: options?.timeoutMs ?? options?.localTimeoutMs ?? 20_000 });
+        const signal = matrixRequestSignal(options);
+        const crypto = this.client.getCrypto();
+        if (!crypto)
+            throw new StorageError("crypto is not initialized");
+        let sessionId;
+        try {
+            await waitForCondition(async (signal) => {
+                if (!sessionId) {
+                    let event;
+                    if (fileId === undefined) {
+                        event = await this.getTreeMetadataEvent(treeId, { signal });
+                    }
+                    else {
+                        const metadataId = await this.getFileMetadataEventId(treeId, fileId, { signal });
+                        if (!metadataId)
+                            throw new StorageError("encrypted file name is unavailable");
+                        event = metadataId === fileId
+                            ? await this.getOriginalFileEvent(treeId, fileId)
+                            : await this.getFileRenameMetadataEvent(treeId, fileId, metadataId);
+                    }
+                    const wire = event.getWireContent();
+                    if (event.isRedacted() || event.isDecryptionFailure() ||
+                        wire.algorithm !== "m.megolm.v1.aes-sha2" || typeof wire.session_id !== "string" || !wire.session_id) {
+                        throw new StorageError("encrypted storage session is unavailable");
+                    }
+                    sessionId = wire.session_id;
+                }
+                if (signal?.aborted)
+                    throw new StorageError("operation cancelled");
+                const version = await crypto.getActiveSessionBackupVersion();
+                if (!version)
+                    return null;
+                let backup;
+                try {
+                    backup = await this.client.http.authedRequest(Method.Get, `/room_keys/keys/${encodeURIComponent(treeId)}/${encodeURIComponent(sessionId)}`, { version }, undefined, { prefix: ClientPrefix.V3, abortSignal: signal });
+                }
+                catch (error) {
+                    if (error instanceof MatrixError && error.httpStatus === 404 && error.errcode === "M_NOT_FOUND")
+                        return null;
+                    throw error;
+                }
+                const sessionData = isRecord(backup) ? backup.session_data : undefined;
+                if (!isRecord(backup) || !Number.isSafeInteger(backup.first_message_index) ||
+                    backup.first_message_index < 0 || !isRecord(sessionData) ||
+                    ["ciphertext", "ephemeral", "mac"].some((key) => typeof sessionData[key] !== "string" || !sessionData[key])) {
+                    throw new StorageError("server key backup session is invalid");
+                }
+                return true;
+            }, { timeoutMs, signal });
+        }
+        catch (error) {
+            if (signal?.aborted)
+                throw new StorageError("operation cancelled", { cause: error });
+            if (error instanceof ConditionTimeoutError) {
+                throw new StorageError("key backup did not settle before timeout; retry key backup", { cause: error });
+            }
+            throw error;
+        }
+    }
     async writeFileName(treeId, fileId, name) {
         validateName(name, "file name");
         validateMatrixEventId(fileId, "file event ID");
@@ -619,30 +738,128 @@ export class TeleCryptIOStorage {
         }
         return event;
     }
-    async createEncryptedFile(treeId, name, encryptedContents, info, additionalContent) {
+    async createEncryptedFile(treeId, name, encryptedContents, info, additionalContent, signal) {
         validateFileName(name);
+        // Authoritative room refresh also repairs legacy owner permissions before
+        // publishing new encrypted content to an existing vault.
+        await this.refreshRoomState(treeId, { signal });
+        if (signal?.aborted)
+            throw new StorageError("operation cancelled");
         const bytes = encryptedContents instanceof Uint8Array
             ? encryptedContents
             : new Uint8Array(encryptedContents);
         const body = bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength);
-        const uploaded = await this.client.uploadContent(body, { includeFilename: false });
-        if (typeof uploaded.content_uri !== "string" || uploaded.content_uri.length === 0) {
-            throw new StorageError("encrypted media upload returned no content URI");
-        }
-        const fileInfo = { ...info, url: uploaded.content_uri };
-        const fileContent = {
-            ...additionalContent,
-            msgtype: MsgType.File,
-            body: name,
-            url: uploaded.content_uri,
-            file: fileInfo,
-            [UNSTABLE_MSC3089_LEAF.name]: {},
-        };
-        const sent = await this.client.sendMessage(treeId, fileContent);
-        const fileEventId = validateMatrixEventId(sent?.event_id, "file upload response event ID");
-        await this.client.sendStateEvent(treeId, UNSTABLE_MSC3089_BRANCH.name, { active: true, metadata_event_id: fileEventId }, fileEventId);
-        this.fileNames.set(this.fileNameKey(treeId, fileEventId), name);
-        return { event_id: fileEventId };
+        let mediaId;
+        let fileId;
+        try {
+            const uploaded = await this.client.uploadContent(body, { includeFilename: false });
+            if (typeof uploaded.content_uri !== "string" || uploaded.content_uri.length === 0) {
+                throw new StorageError("encrypted media upload returned no content URI");
+            }
+            mediaId = uploaded.content_uri;
+            if (signal?.aborted)
+                throw new StorageError("operation cancelled");
+            const fileContent = {
+                ...additionalContent,
+                msgtype: MsgType.File,
+                body: name,
+                url: mediaId,
+                file: { ...info, url: mediaId },
+                [UNSTABLE_MSC3089_LEAF.name]: {},
+            };
+            const sent = await this.client.sendMessage(treeId, fileContent);
+            fileId = validateMatrixEventId(sent?.event_id, "file upload response event ID");
+            if (signal?.aborted)
+                throw new StorageError("operation cancelled");
+            await this.client.sendStateEvent(treeId, UNSTABLE_MSC3089_BRANCH.name, { active: true, metadata_event_id: fileId }, fileId);
+            if (signal?.aborted)
+                throw new StorageError("operation cancelled");
+            this.fileNames.set(this.fileNameKey(treeId, fileId), name);
+            return { event_id: fileId };
+        }
+        catch (error) {
+            const rejected = error instanceof MatrixError &&
+                error.httpStatus !== undefined && error.httpStatus >= 400 && error.httpStatus < 500 && error.httpStatus !== 408;
+            if (!mediaId) {
+                if (rejected)
+                    throw error;
+                throw new MutationOutcomeUnknownError("file upload", { cause: error });
+            }
+            let cause = error;
+            if (rejected) {
+                try {
+                    await this.cleanupFileUpload(treeId, mediaId, fileId);
+                }
+                catch (cleanupError) {
+                    cause = new AggregateError([error, cleanupError], "file upload failed and cleanup is incomplete");
+                }
+                if (cause === error) {
+                    throw new StorageError("file upload was rejected; uploaded media and attachment were removed", { cause: error });
+                }
+            }
+            throw new MutationPartialError("file upload", fileId ? [mediaId, fileId] : [mediaId], `upload outcome needs reconciliation in ${treeId}; keep these media and attachment IDs and use cleanupFileUpload before uploading again`, { cause, treeId });
+        }
+    }
+    /**
+     * Discards a partial upload using its MutationPartialError.completedIds:
+     * [mediaId, fileId?]. Explicit cleanup also covers an unacknowledged listing.
+     * Keep the same IDs after failure and retry this operation, not the upload.
+     */
+    async cleanupFileUpload(treeId, mediaId, fileId, options) {
+        validateMatrixRoomId(treeId);
+        if (!/^mxc:\/\/[^/]+\/[^/?#]+$/u.test(mediaId))
+            throw new StorageError("invalid media identifier");
+        if (fileId !== undefined)
+            validateMatrixEventId(fileId, "file upload event ID");
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), matrixRequestTimeout(options));
+        const abort = () => controller.abort(options?.signal?.reason);
+        if (options?.signal?.aborted)
+            abort();
+        else
+            options?.signal?.addEventListener("abort", abort, { once: true });
+        try {
+            await raceWithAbort((async () => {
+                if (controller.signal.aborted)
+                    throw new StorageError("operation cancelled");
+                let attachment;
+                let listing = null;
+                if (fileId) {
+                    const raw = await this.client.fetchRoomEvent(treeId, fileId);
+                    attachment = this.client.getEventMapper()(raw);
+                    await this.client.decryptEventIfNeeded(attachment);
+                    const content = attachment.getContent();
+                    if (attachment.getId() !== fileId || attachment.getRoomId() !== treeId ||
+                        attachment.getSender() !== this.client.getUserId() ||
+                        (!attachment.isRedacted() && (attachment.getWireType() !== EventType.RoomMessageEncrypted ||
+                            attachment.getType() !== EventType.RoomMessage || content.msgtype !== MsgType.File ||
+                            !isRecord(content.file) || content.file.url !== mediaId))) {
+                        throw new StorageError("partial upload attachment does not match the current user and media");
+                    }
+                    await this.refreshRoomState(treeId, { signal: controller.signal });
+                    listing = this.getStateEvent(treeId, UNSTABLE_MSC3089_BRANCH.name, fileId);
+                    if (listing && !listing.isRedacted() &&
+                        (listing.getSender() !== this.client.getUserId() || listing.getContent().metadata_event_id !== fileId)) {
+                        throw new StorageError("file changed after upload; use ordinary file deletion");
+                    }
+                }
+                if (controller.signal.aborted)
+                    throw new StorageError("operation cancelled");
+                await deleteOwnedMedia(this.client, [mediaId], controller.signal);
+                if (listing && !listing.isRedacted()) {
+                    await withMatrixMutationAbort(() => this.client.redactEvent(treeId, listing.getId()), controller.signal);
+                }
+                if (attachment && !attachment.isRedacted()) {
+                    await withMatrixMutationAbort(() => this.client.redactEvent(treeId, fileId), controller.signal);
+                }
+                if (fileId)
+                    this.fileNames.delete(this.fileNameKey(treeId, fileId));
+            })(), controller.signal, () => new MutationOutcomeUnknownError("file upload cleanup"));
+        }
+        finally {
+            clearTimeout(timeout);
+            options?.signal?.removeEventListener("abort", abort);
+        }
     }
     /**
      * Refreshes a room's current state from the homeserver. The background sync
@@ -661,6 +878,11 @@ export class TeleCryptIOStorage {
             abortSignal: matrixRequestSignal(options),
         });
         const parsedStateEvents = parseMatrixStateResponse(stateEvents);
+        if (await this.repairOwnedTreePermissions(roomId, parsedStateEvents, options)) {
+            // Read the accepted native state back instead of fabricating a local
+            // permission snapshot. An interrupted repair retries on the next load.
+            return this.refreshRoomState(roomId, options);
+        }
         if (typeof room.currentState.setStateEvents === "function") {
             const refreshed = parsedStateEvents.map((event) => new MatrixEvent(event));
             // RoomState.setStateEvents overwrites matching tuples, but deliberately
@@ -688,6 +910,49 @@ export class TeleCryptIOStorage {
             room.currentState.setStateEvents(refreshed);
         }
     }
+    async repairOwnedTreePermissions(roomId, state, options) {
+        if (isTreeDeleted(this.client, roomId))
+            return false;
+        const event = (type, key = "") => state.find((item) => item.type === type && item.state_key === key);
+        const create = event(EventType.RoomCreate);
+        const purpose = event(UNSTABLE_MSC3088_PURPOSE.name, UNSTABLE_MSC3089_TREE_SUBTYPE.name);
+        if (create?.content?.[RoomCreateTypeField] !== RoomType.Space ||
+            purpose?.content?.[UNSTABLE_MSC3088_ENABLED.name] !== true)
+            return false;
+        const userId = this.client.getUserId();
+        if (!userId || create?.sender !== userId ||
+            event(EventType.RoomMember, userId)?.content?.membership !== "join") {
+            return false;
+        }
+        const rawPower = event(EventType.RoomPowerLevels)?.content;
+        const power = parseMatrixPowerLevels(rawPower);
+        const ownerLevel = power.events?.[EventType.RoomPowerLevels] ?? 100;
+        if ((power.users?.[userId] ?? power.users_default ?? 0) < ownerLevel)
+            return false;
+        const events = { ...power.events };
+        let changed = (power.state_default ?? 50) < 100;
+        for (const type of [EventType.RoomJoinRules, UNSTABLE_MSC3088_PURPOSE.name]) {
+            if (events[type] !== undefined && events[type] < 100) {
+                events[type] = 100;
+                changed = true;
+            }
+        }
+        if (changed) {
+            await withMatrixMutationAbort(() => this.client.sendStateEvent(roomId, EventType.RoomPowerLevels, {
+                ...rawPower,
+                state_default: Math.max(power.state_default ?? 50, 100),
+                events,
+            }, ""), matrixRequestSignal(options));
+        }
+        const joinRules = event(EventType.RoomJoinRules)?.content;
+        if (joinRules?.join_rule !== "invite") {
+            await withMatrixMutationAbort(() => this.client.sendStateEvent(roomId, EventType.RoomJoinRules, {
+                join_rule: JoinRule.Invite,
+            }, ""), matrixRequestSignal(options));
+            changed = true;
+        }
+        return changed;
+    }
     /**
      * Recommended entry point: builds the MatrixClient with a persistent crypto
      * store and the secret-storage callback wiring `keys.*` needs, starts the
@@ -747,10 +1012,11 @@ export class TeleCryptIOStorage {
         return TeleCryptIOStorage.bootstrap(client, opts);
     }
     /** Shared post-construction bootstrap for `create()`/`createFromOidc()`:
-     * persistent crypto store, first sync, wrap in a `TeleCryptIOStorage`. */
+     * persistent crypto store, optional first sync, wrap in a `TeleCryptIOStorage`. */
     static async bootstrap(client, opts) {
         const progress = opts.onProgress ?? (() => { });
         const persistent = opts.persistentCryptoStore ?? true;
+        let storage;
         try {
             progress("Loading encryption engine (WASM)…");
             await TeleCryptIOStorage.withTimeout(client.initRustCrypto({
@@ -758,27 +1024,35 @@ export class TeleCryptIOStorage {
                 cryptoDatabasePrefix: opts.cryptoDatabasePrefix ?? `telecrypt-io-storage::${opts.userId}::${opts.deviceId}`,
             }), opts.initTimeoutMs ?? 60000, "crypto init", opts.signal);
             progress("Encryption ready — opening secure store…");
-            progress("Starting Matrix client…");
-            // Mark this before awaiting: startClient can start its sync loop and then
-            // reject while reporting an error from the initial request.
-            await TeleCryptIOStorage.withTimeout(client.startClient({ initialSyncLimit: opts.initialSyncLimit ?? 10 }), opts.syncTimeoutMs ?? 15000, "client start", opts.signal);
-            progress("Waiting for first sync with homeserver…");
-            await TeleCryptIOStorage.waitForFirstSync(client, opts.syncTimeoutMs ?? 15000, opts.signal);
-            TeleCryptIOStorage.throwIfAborted(opts.signal);
-            progress("Sync complete.");
-            return new TeleCryptIOStorage(client);
+            storage = new TeleCryptIOStorage(client, opts, opts);
+            if (opts.startClient === false) {
+                // Rust Crypto starts checking server-side backup state during init. A
+                // short-lived caller (the CLI login transaction) may close this
+                // client before that background check finishes, so drain it before
+                // returning the sync-deferred client.
+                const crypto = client.getCrypto();
+                if (crypto) {
+                    await TeleCryptIOStorage.withTimeout(crypto.checkKeyBackupAndEnable(), opts.syncTimeoutMs ?? 15000, "crypto backup check", opts.signal);
+                }
+            }
+            else {
+                await storage.startSync(opts.signal);
+            }
+            return storage;
         }
         catch (error) {
             // stopClient is idempotent in matrix-js-sdk and is also required after
             // init/timeout failures: crypto startup can have installed listeners or
             // a sync task before the awaited operation rejects.
-            try {
-                client.stopClient();
-            }
-            catch (cleanupError) {
-                throw new AggregateError([error, cleanupError], "storage bootstrap and client cleanup failed", {
-                    cause: error,
-                });
+            if (!storage) {
+                try {
+                    client.stopClient();
+                }
+                catch (cleanupError) {
+                    throw new AggregateError([error, cleanupError], "storage bootstrap and client cleanup failed", {
+                        cause: error,
+                    });
+                }
             }
             throw error;
         }
@@ -992,12 +1266,7 @@ export class TeleCryptIOStorage {
         if (signal?.aborted)
             throw new StorageError("operation cancelled");
         try {
-            await withRecoveryCryptoDeadline(() => crypto.bootstrapCrossSigning({
-                // No existing verified device to interactively re-authenticate against
-                // for this account, so there is nothing to feed into `makeRequest`;
-                // matches the working pattern already proven in keys.test.ts.
-                authUploadDeviceSigningKeys: async () => undefined,
-            }), signal, "cross-signing bootstrap");
+            await withRecoveryCryptoDeadline(() => crypto.bootstrapCrossSigning({}), signal, "cross-signing bootstrap");
         }
         catch (error) {
             // Cross-signing setup can commit server-side state before a transport
@@ -1261,7 +1530,7 @@ export class TeleCryptIOStorage {
                 kick: 100,
                 ban: 100,
                 redact: 100,
-                state_default: 0,
+                state_default: 100,
                 events_default: 0,
                 users_default: 0,
                 events: {
@@ -1358,7 +1627,7 @@ export class TeleCryptIOStorage {
             const branch = originalGetFile(fileId);
             return branch ? this.decorateFileBranch(tree.id, branch) : null;
         };
-        tree.createFile = (name, encryptedContents, info, additionalContent) => this.createEncryptedFile(tree.id, name, encryptedContents, info, additionalContent);
+        tree.createFile = (name, encryptedContents, info, additionalContent, signal) => this.createEncryptedFile(tree.id, name, encryptedContents, info, additionalContent, signal);
         return tree;
     }
     decorateFileBranch(treeId, branch) {
@@ -1514,8 +1783,14 @@ export class TeleCryptIOStorage {
             if (isTreeDeleted(this.client, room.roomId))
                 continue;
             const tree = this.client.unstableGetFileTreeSpace(room.roomId);
-            if (tree)
+            if (tree) {
+                // Existing owner sessions repair the persisted permissions on load;
+                // readers never attempt this owner-only mutation.
+                if (this.getStateEvent(room.roomId, EventType.RoomCreate, "")?.getSender() === this.client.getUserId()) {
+                    await this.refreshRoomState(room.roomId, { signal });
+                }
                 trees.push(this.decorateTreeSpace(tree));
+            }
         }
         return trees;
     }
@@ -1527,6 +1802,9 @@ export class TeleCryptIOStorage {
             const currentParent = this.getTree(parent.id);
             if (!currentParent)
                 throw new Error("createSubtree: parent is unavailable");
+            const readers = (await this.listMembers(currentParent, { signal: effectiveSignal }))
+                .filter((member) => member.role === "viewer" &&
+                (member.membership === "join" || member.membership === "invite"));
             const tree = await this.createTreeSpace(name, "createSubtree", effectiveSignal);
             let parentLinkAttempted = false;
             let parentLinkEventId;
@@ -1553,7 +1831,6 @@ export class TeleCryptIOStorage {
                 if (this.client.getRoom(tree.id)) {
                     await this.refreshRoomState(tree.id, { signal: effectiveSignal });
                 }
-                return tree;
             }
             catch (error) {
                 // Compensation is independent of the caller's cancelled deadline.
@@ -1645,6 +1922,22 @@ export class TeleCryptIOStorage {
                 }
                 throw error;
             }
+            // The folder and both links now exist. A failed invitation must leave
+            // that known folder available for reconciliation instead of deleting a
+            // room to which another reader may already have received access.
+            try {
+                for (const reader of readers) {
+                    if (effectiveSignal?.aborted)
+                        throw new StorageError("operation cancelled");
+                    const verifyHistorySharing = await prepareReaderHistorySharing(this.client, reader.userId);
+                    await withMatrixMutationAbort(() => tree.invite(reader.userId), effectiveSignal);
+                    await verifyHistorySharing();
+                }
+            }
+            catch (error) {
+                throw new MutationPartialError("create folder", [tree.id], "the folder was created, but reader access is incomplete; retry sharing the parent vault with its readers", { cause: error });
+            }
+            return tree;
         }, signal);
     }
     getTree(roomId) {
@@ -1733,19 +2026,19 @@ export class TeleCryptIOStorage {
             throw new StorageError("operation cancelled");
         let response;
         try {
-            response = await withMatrixMutationAbort(() => tree.createFile(name, new Uint8Array(encrypted.data), encrypted.info, { info: { mimetype, size: data.byteLength } }), signal, "file upload");
+            // Let the in-flight request settle so the uploader can retain returned
+            // media/event IDs on cancellation, then stop before the next write.
+            response = await tree.createFile(name, new Uint8Array(encrypted.data), encrypted.info, { info: { mimetype, size: data.byteLength } }, signal);
         }
         catch (error) {
-            // A transport failure after the encrypted event was submitted cannot be
-            // distinguished from a failure before commit. Do not let a caller retry
-            // this operation and create a duplicate file; only the explicit typed
-            // mutation outcome is safe to propagate unchanged.
-            if (error instanceof MutationOutcomeUnknownError)
+            // Preserve acknowledged upload stages after cancellation as well.
+            if (error instanceof MutationOutcomeUnknownError || error instanceof MutationPartialError)
+                throw error;
+            if (error instanceof StorageError || error instanceof MatrixError)
                 throw error;
+            // An unclassified transport failure can still follow a committed event.
             throw new MutationOutcomeUnknownError("file upload", { cause: error });
         }
-        if (signal?.aborted)
-            throw new StorageError("operation cancelled");
         try {
             return validateMatrixEventId(response?.event_id, "file upload response event ID");
         }
@@ -1786,7 +2079,7 @@ export class TeleCryptIOStorage {
         const mimetype = eventMetadata.mimetype ?? "application/octet-stream";
         const mxcUrl = info.url;
         const clientAny = this.client;
-        const accessToken = clientAny.getAccessToken();
+        let accessToken = clientAny.getAccessToken();
         validateMatrixToken(accessToken);
         let trustedOrigin;
         try {
@@ -1820,6 +2113,7 @@ export class TeleCryptIOStorage {
         else
             signal?.addEventListener("abort", abortExternal, { once: true });
         let ciphertext;
+        let retriedAuthentication = false;
         try {
             for (;;) {
                 const res = await raceWithAbort(fetch(currentUrl, {
@@ -1862,13 +2156,22 @@ export class TeleCryptIOStorage {
                 if (!res.ok) {
                     const statusFailure = new Error(`media download failed: ${res.status}`);
                     let detail = "";
+                    let unknownToken = false;
                     try {
                         // Error responses are diagnostics, not product media. Consume the
                         // complete body so no provider detail is discarded, then apply
                         // the SDK's shared secret/control-character sanitizer before it
                         // crosses the SDK boundary.
                         const body = await readResponseBody(res, controller.signal);
-                        detail = sanitizeDiagnosticText(new TextDecoder().decode(body.bytes));
+                        const responseText = new TextDecoder().decode(body.bytes);
+                        detail = sanitizeDiagnosticText(responseText);
+                        if (res.status === 401) {
+                            try {
+                                const errorBody = JSON.parse(responseText);
+                                unknownToken = isRecord(errorBody) && errorBody.errcode === "M_UNKNOWN_TOKEN";
+                            }
+                            catch { /* Non-Matrix errors retain the complete diagnostic below. */ }
+                        }
                     }
                     catch (bodyError) {
                         const partial = bodyError instanceof ResponseBodyReadError
@@ -1879,6 +2182,20 @@ export class TeleCryptIOStorage {
                             : bodyError;
                         throw new AggregateError([statusFailure, readFailure], "media download failed while reading the response body", { cause: statusFailure });
                     }
+                    if (unknownToken && !retriedAuthentication) {
+                        retriedAuthentication = true;
+                        // Matrix's authenticated transport owns token refresh, including
+                        // concurrent refreshes and persistence. Its media request path
+                        // buffers the whole body and follows redirects, so use a small
+                        // authenticated read to renew the session, then retry our bounded
+                        // streaming download once with the current token.
+                        await raceWithAbort(this.client.whoami(), controller.signal, () => signal?.aborted
+                            ? new StorageError("operation cancelled")
+                            : new Error("media download timed out"));
+                        accessToken = clientAny.getAccessToken();
+                        validateMatrixToken(accessToken);
+                        continue;
+                    }
                     throw new Error(`${statusFailure.message}${detail === "" ? "" : `: ${detail}`}`);
                 }
                 if (!res.body) {