@telecrypt-io/storage 0.9.2 → 0.9.4

package/README.md

@@ -12,6 +12,9 @@ unmerged Matrix proposal.
 npm install @telecrypt-io/storage
 ```
 
+The SDK supports Node.js `24.21.0` as its exact engine version. Its release tooling uses the
+bundled npm `11.19.0`.
+
 ## Browser quick start
 
 The example below starts with an authenticated OIDC session. Obtain `userId`, `accessToken`, and

package/dist/TeleCryptIOStorage.d.ts

@@ -170,6 +170,7 @@ export declare class TeleCryptIOStorage {
     private getStateEvent;
     private getTreeOwnerId;
     private sendEncryptedMetadataMessage;
+    private requireEncryptedStorageRoom;
     private readEncryptedMetadataMessage;
     private writeTreeName;
     private getTreeMetadataEvent;

package/dist/TeleCryptIOStorage.js

@@ -1,4 +1,5 @@
 import { ClientEvent, createClient, EventType, JoinRule, MatrixEvent, MatrixError, MsgType, Preset, RoomCreateTypeField, RoomType, SyncState, UNSTABLE_MSC3088_ENABLED, UNSTABLE_MSC3088_PURPOSE, UNSTABLE_MSC3089_BRANCH, UNSTABLE_MSC3089_LEAF, UNSTABLE_MSC3089_TREE_SUBTYPE, } from "matrix-js-sdk";
+import { EventShieldReason, OnlySignedDevicesIsolationMode, } from "matrix-js-sdk/lib/crypto-api/index.js";
 import { Method } from "matrix-js-sdk/lib/http-api/method.js";
 import { ClientPrefix } from "matrix-js-sdk/lib/http-api/prefix.js";
 import { encryptAttachment, decryptAttachment } from "matrix-encrypt-attachment";
@@ -7,7 +8,7 @@ import { FileTooLargeError, RecoveryAlreadyConfiguredError, RecoveryRestoreError
 import { MAX_MEDIA_FILE_BYTES, MAX_MATRIX_IDENTIFIER_BYTES, validateCanonicalMatrixUserId, validateMatrixDeviceId, validateMatrixEventId, validateMatrixRoomId, } from "./core/constants.js";
 import { cancelResponseBody, raceWithAbort, readMediaResponseBody, readResponseBody, ResponseBodyReadError, } from "./core/http.js";
 import { sanitizeDiagnosticText } from "./core/oidc.js";
-import { validateName } from "./core/validation.js";
+import { isStorageTreeRoom, isStorageTreeState, STORAGE_ROOM_ENCRYPTION_ALGORITHM, validateName, } from "./core/validation.js";
 import { ConditionTimeoutError, waitForCondition } from "./core/poll.js";
 import { isTreeDeleted } from "./deletion-markers.js";
 import { DecryptionKeySafe } from "./key-safe.js";
@@ -484,9 +485,16 @@ export class TeleCryptIOStorage {
         return ownerId;
     }
     async sendEncryptedMetadataMessage(roomId, content) {
+        await this.refreshRoomState(roomId);
+        this.requireEncryptedStorageRoom(roomId);
         const response = await this.client.sendMessage(roomId, content);
         return validateMatrixEventId(response?.event_id, "storage metadata response event ID");
     }
+    requireEncryptedStorageRoom(roomId) {
+        if (!isStorageTreeRoom(this.client.getRoom(roomId))) {
+            throw new StorageError("storage room encryption is unavailable or unsupported");
+        }
+    }
     async readEncryptedMetadataMessage(roomId, eventId, allowRedacted = false) {
         const rawEvent = await this.client.fetchRoomEvent(roomId, eventId);
         const event = this.client.getEventMapper()(rawEvent);
@@ -507,6 +515,13 @@ export class TeleCryptIOStorage {
             event.getType() !== EventType.RoomMessage) {
             throw new StorageError("encrypted storage metadata is invalid or unavailable");
         }
+        const crypto = this.client.getCrypto();
+        if (!crypto)
+            throw new StorageError("encryption is not initialized");
+        const encryptionInfo = await crypto.getEncryptionInfoForEvent(event);
+        if (!encryptionInfo || encryptionInfo.shieldReason === EventShieldReason.MISMATCHED_SENDER) {
+            throw new UndecryptableFileError();
+        }
         return event;
     }
     async writeTreeName(roomId, name) {
@@ -591,7 +606,7 @@ export class TeleCryptIOStorage {
                     }
                     const wire = event.getWireContent();
                     if (event.isRedacted() || event.isDecryptionFailure() ||
-                        wire.algorithm !== "m.megolm.v1.aes-sha2" || typeof wire.session_id !== "string" || !wire.session_id) {
+                        wire.algorithm !== STORAGE_ROOM_ENCRYPTION_ALGORITHM || typeof wire.session_id !== "string" || !wire.session_id) {
                         throw new StorageError("encrypted storage session is unavailable");
                     }
                     sessionId = wire.session_id;
@@ -745,6 +760,7 @@ export class TeleCryptIOStorage {
         await this.refreshRoomState(treeId, { signal });
         if (signal?.aborted)
             throw new StorageError("operation cancelled");
+        this.requireEncryptedStorageRoom(treeId);
         const bytes = encryptedContents instanceof Uint8Array
             ? encryptedContents
             : new Uint8Array(encryptedContents);
@@ -916,8 +932,8 @@ export class TeleCryptIOStorage {
         const event = (type, key = "") => state.find((item) => item.type === type && item.state_key === key);
         const create = event(EventType.RoomCreate);
         const purpose = event(UNSTABLE_MSC3088_PURPOSE.name, UNSTABLE_MSC3089_TREE_SUBTYPE.name);
-        if (create?.content?.[RoomCreateTypeField] !== RoomType.Space ||
-            purpose?.content?.[UNSTABLE_MSC3088_ENABLED.name] !== true)
+        const encryption = event(EventType.RoomEncryption);
+        if (!isStorageTreeState(create?.content, purpose?.content, encryption?.content))
             return false;
         const userId = this.client.getUserId();
         if (!userId || create?.sender !== userId ||
@@ -1023,6 +1039,10 @@ export class TeleCryptIOStorage {
                 useIndexedDB: persistent,
                 cryptoDatabasePrefix: opts.cryptoDatabasePrefix ?? `telecrypt-io-storage::${opts.userId}::${opts.deviceId}`,
             }), opts.initTimeoutMs ?? 60000, "crypto init", opts.signal);
+            const crypto = client.getCrypto();
+            if (!crypto)
+                throw new StorageError("encryption is not initialized");
+            crypto.setDeviceIsolationMode(new OnlySignedDevicesIsolationMode());
             progress("Encryption ready — opening secure store…");
             storage = new TeleCryptIOStorage(client, opts, opts);
             if (opts.startClient === false) {
@@ -1559,7 +1579,7 @@ export class TeleCryptIOStorage {
                 {
                     type: EventType.RoomEncryption,
                     state_key: "",
-                    content: { algorithm: "m.megolm.v1.aes-sha2" },
+                    content: { algorithm: STORAGE_ROOM_ENCRYPTION_ALGORITHM },
                 },
             ],
         };
@@ -1572,8 +1592,9 @@ export class TeleCryptIOStorage {
                 throw new StorageError("operation cancelled");
             try {
                 const tree = this.client.unstableGetFileTreeSpace(roomId);
-                if (tree)
+                if (tree && isStorageTreeRoom(this.client.getRoom(roomId))) {
                     return this.decorateTreeSpace(tree);
+                }
             }
             catch (error) {
                 lastError = error;
@@ -1613,13 +1634,29 @@ export class TeleCryptIOStorage {
             return tree;
         this.decoratedTreeSpaces.add(tree);
         const originalGetDirectories = tree.getDirectories.bind(tree);
+        const originalGetDirectory = typeof tree.getDirectory === "function"
+            ? tree.getDirectory.bind(tree)
+            : undefined;
         const originalListFiles = typeof tree.listFiles === "function"
             ? tree.listFiles.bind(tree)
             : () => [];
         const originalGetFile = typeof tree.getFile === "function"
             ? tree.getFile.bind(tree)
             : () => null;
-        tree.getDirectories = () => originalGetDirectories().map((child) => this.decorateTreeSpace(child));
+        tree.getDirectories = () => originalGetDirectories()
+            .filter((child) => !isTreeDeleted(this.client, child.id) &&
+            isStorageTreeRoom(this.client.getRoom(child.id)))
+            .map((child) => this.decorateTreeSpace(child));
+        if (originalGetDirectory) {
+            tree.getDirectory = (roomId) => {
+                const child = originalGetDirectory(roomId);
+                return child &&
+                    !isTreeDeleted(this.client, child.id) &&
+                    isStorageTreeRoom(this.client.getRoom(child.id))
+                    ? this.decorateTreeSpace(child)
+                    : undefined;
+            };
+        }
         tree.createDirectory = (name) => this.createSubtree(tree, name);
         tree.setName = (name) => this.writeTreeName(tree.id, name);
         tree.listFiles = () => originalListFiles().map((branch) => this.decorateFileBranch(tree.id, branch));
@@ -1782,14 +1819,16 @@ export class TeleCryptIOStorage {
                 throw new StorageError("operation cancelled");
             if (isTreeDeleted(this.client, room.roomId))
                 continue;
-            const tree = this.client.unstableGetFileTreeSpace(room.roomId);
+            let tree = this.getTree(room.roomId);
             if (tree) {
                 // Existing owner sessions repair the persisted permissions on load;
                 // readers never attempt this owner-only mutation.
                 if (this.getStateEvent(room.roomId, EventType.RoomCreate, "")?.getSender() === this.client.getUserId()) {
                     await this.refreshRoomState(room.roomId, { signal });
+                    tree = this.getTree(room.roomId);
                 }
-                trees.push(this.decorateTreeSpace(tree));
+                if (tree)
+                    trees.push(tree);
             }
         }
         return trees;
@@ -1943,6 +1982,8 @@ export class TeleCryptIOStorage {
     getTree(roomId) {
         if (isTreeDeleted(this.client, roomId))
             return null;
+        if (!isStorageTreeRoom(this.client.getRoom(roomId)))
+            return null;
         const tree = this.client.unstableGetFileTreeSpace(roomId);
         return tree ? this.decorateTreeSpace(tree) : null;
     }

package/dist/core/oidc.d.ts

@@ -30,9 +30,9 @@ export interface OidcRegistrationClientMetadata {
 }
 /** The issuer-bound endpoints accepted by the token refresh adapter. */
 export type OidcTokenEndpointMetadata = Pick<OidcClientConfig, "issuer" | "token_endpoint" | "revocation_endpoint">;
-/** Keep provider diagnostics useful without allowing credentials, customer
- * identifiers, or control characters from an untrusted response to cross the
- * SDK boundary. */
+/** Redact recognized secret fields and identifiers in provider diagnostics.
+ * Structured JSON uses decoded property names at every depth; the text fallback
+ * is limited to patterns recognized in unstructured input. */
 export declare function sanitizeDiagnosticText(value: string): string;
 /** Validates an endpoint against the configured homeserver and optional issuer path. */
 export declare function assertOidcEndpoint(value: unknown, trustedHomeserver: string, name: string, issuer?: URL, allowQuery?: boolean): string;

package/dist/core/oidc.js

@@ -64,10 +64,8 @@ const DIAGNOSTIC_SECRET_FIELD = /(?:access[_-]?token|refresh[_-]?token|id[_-]?to
 const DIAGNOSTIC_EMAIL = /[A-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[A-Z0-9-]+(?:\.[A-Z0-9-]+)+/giu;
 const DIAGNOSTIC_MXID = /@[A-Z0-9._=+\-/]+:[A-Z0-9.-]+/giu;
 const DIAGNOSTIC_ULID = /\b[0-9A-HJKMNP-TV-Z]{26}\b/giu;
-/** Keep provider diagnostics useful without allowing credentials, customer
- * identifiers, or control characters from an untrusted response to cross the
- * SDK boundary. */
-export function sanitizeDiagnosticText(value) {
+/** Existing fallback for plain or malformed provider diagnostics. */
+function sanitizeUnstructuredDiagnosticText(value) {
     const quotedValue = `"(?:\\\\.|[^"\\\\])*"|'(?:\\\\.|[^'\\\\])*'|[^\\s,};\\]]+`;
     return value
         .replace(/(Bearer\s+)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s"',}]+)/giu, "$1<redacted>")
@@ -81,6 +79,21 @@ export function sanitizeDiagnosticText(value) {
         .replace(/[\r\n\u0000-\u001f\u007f-\u009f\u2028\u2029]/gu, " ")
         .trim();
 }
+/** Redact recognized secret fields and identifiers in provider diagnostics.
+ * Structured JSON uses decoded property names at every depth; the text fallback
+ * is limited to patterns recognized in unstructured input. */
+export function sanitizeDiagnosticText(value) {
+    try {
+        return JSON.stringify(JSON.parse(value), (key, item) => {
+            if (DIAGNOSTIC_SECRET_FIELD.test(key))
+                return "<redacted>";
+            return typeof item === "string" ? sanitizeUnstructuredDiagnosticText(item) : item;
+        });
+    }
+    catch {
+        return sanitizeUnstructuredDiagnosticText(value);
+    }
+}
 class OidcResponseError extends Error {
     status;
     constructor(operation, status, body, cause) {

package/dist/core/operations.js

@@ -11,12 +11,12 @@
  * platform-specific and stays with the caller.
  */
 import { readFileEventMetadata, withMatrixMutationAbort, withTreeMutation, } from "../TeleCryptIOStorage.js";
-import { EventType, MatrixError, RoomCreateTypeField, RoomType, UNSTABLE_MSC3088_ENABLED, UNSTABLE_MSC3088_PURPOSE, UNSTABLE_MSC3089_TREE_SUBTYPE, } from "matrix-js-sdk";
+import { EventType, MatrixError, } from "matrix-js-sdk";
 import { deleteOwnedMedia } from "../media.js";
 import { validateMatrixEventId } from "./constants.js";
 import { FileTooLargeError, MutationPartialError, MutationOutcomeUnknownError, NonEmptyTreeError, RoomCreationAmbiguousError, RoomCleanupIncompleteError, StorageError, } from "./errors.js";
 import { ConditionTimeoutError, waitForCondition } from "./poll.js";
-import { validateName } from "./validation.js";
+import { hasStorageTreeMarkersRoom, isStorageTreeRoom, validateName } from "./validation.js";
 import { prepareReaderHistorySharing } from "../sharing.js";
 import { isFileDeleted, isTreeDeleted, markFileDeleted, markTreeDeleted, } from "../deletion-markers.js";
 /**
@@ -660,14 +660,6 @@ function hasActiveSpaceParent(room) {
     const events = result == null ? [] : Array.isArray(result) ? result : [result];
     return events.some((event) => isActiveRelationEvent(event));
 }
-function isReviewedStorageTreeRoom(room) {
-    const createEvent = room?.currentState?.getStateEvents?.(EventType.RoomCreate, "");
-    const createContent = createEvent?.getContent?.();
-    const purposeEvent = room?.currentState?.getStateEvents?.(UNSTABLE_MSC3088_PURPOSE.name, UNSTABLE_MSC3089_TREE_SUBTYPE.name);
-    const purposeContent = purposeEvent?.getContent?.();
-    return (createContent?.[RoomCreateTypeField] === RoomType.Space &&
-        purposeContent?.[UNSTABLE_MSC3088_ENABLED.name] === true);
-}
 /** Rooms where this account is invited and the room looks like a file tree. */
 export async function listPendingInvites(storage, options) {
     await storage.keySafe.requireReady({ signal: options?.signal });
@@ -695,7 +687,7 @@ export async function listPendingInvites(storage, options) {
             }
             // Invite state may not have MSC3089 tree metadata yet — accept rooms whose
             // create event marks them as a file tree space.
-            if (isReviewedStorageTreeRoom(room)) {
+            if (isStorageTreeRoom(room)) {
                 invites.push({
                     id: room.roomId,
                     name: roomDisplayName(storage, room.roomId),
@@ -734,7 +726,7 @@ export async function declineInvite(storage, vaultId, options) {
             // requiring a joined TreeSpace object.
             if (!currentRoom ||
                 hasActiveSpaceParent(currentRoom) ||
-                !isReviewedStorageTreeRoom(currentRoom)) {
+                !hasStorageTreeMarkersRoom(currentRoom)) {
                 throw new StorageError("decline failed");
             }
             let membership;

package/dist/core/validation.d.ts

@@ -1,3 +1,18 @@
 /** Shared name contract used by SDK inputs and remote projections. */
 export declare function isValidName(value: unknown): value is string;
 export declare function validateName(value: unknown, label: string): asserts value is string;
+export declare const STORAGE_ROOM_ENCRYPTION_ALGORITHM = "m.megolm.v1.aes-sha2";
+interface StorageTreeRoomLike {
+    currentState?: {
+        getStateEvents?: (eventType: string, stateKey?: string) => unknown;
+    };
+}
+/** The shared Storage-room contract for both synced rooms and refreshed state. */
+export declare function isStorageTreeState(createContent: unknown, purposeContent: unknown, encryptionContent: unknown): boolean;
+/** The room markers needed for explicit invite cleanup before encryption is available. */
+export declare function hasStorageTreeMarkers(createContent: unknown, purposeContent: unknown): boolean;
+/** Checks the existing Storage markers and Megolm room encryption together. */
+export declare function isStorageTreeRoom(room: StorageTreeRoomLike | null | undefined): boolean;
+/** Checks only the room markers for explicit cleanup paths such as declining an invite. */
+export declare function hasStorageTreeMarkersRoom(room: StorageTreeRoomLike | null | undefined): boolean;
+export {};

package/dist/core/validation.js

@@ -1,3 +1,4 @@
+import { EventType, RoomCreateTypeField, RoomType, UNSTABLE_MSC3088_ENABLED, UNSTABLE_MSC3088_PURPOSE, UNSTABLE_MSC3089_TREE_SUBTYPE, } from "matrix-js-sdk";
 /** Shared name contract used by SDK inputs and remote projections. */
 export function isValidName(value) {
     return (typeof value === "string" &&
@@ -9,3 +10,47 @@ export function validateName(value, label) {
         throw new Error(`invalid ${label}`);
     }
 }
+export const STORAGE_ROOM_ENCRYPTION_ALGORITHM = "m.megolm.v1.aes-sha2";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** The shared Storage-room contract for both synced rooms and refreshed state. */
+export function isStorageTreeState(createContent, purposeContent, encryptionContent) {
+    return hasStorageTreeMarkers(createContent, purposeContent) &&
+        isRecord(encryptionContent) &&
+        encryptionContent.algorithm === STORAGE_ROOM_ENCRYPTION_ALGORITHM;
+}
+/** The room markers needed for explicit invite cleanup before encryption is available. */
+export function hasStorageTreeMarkers(createContent, purposeContent) {
+    return (isRecord(createContent) &&
+        createContent[RoomCreateTypeField] === RoomType.Space &&
+        isRecord(purposeContent) &&
+        purposeContent[UNSTABLE_MSC3088_ENABLED.name] === true);
+}
+function getStorageTreeState(room) {
+    const getContent = (eventType, stateKey) => {
+        const raw = room?.currentState?.getStateEvents?.(eventType, stateKey);
+        const event = Array.isArray(raw) ? raw[0] : raw;
+        if (typeof event !== "object" || event === null)
+            return undefined;
+        const getEventContent = event.getContent;
+        return typeof getEventContent === "function"
+            ? getEventContent.call(event)
+            : undefined;
+    };
+    return {
+        createContent: getContent(EventType.RoomCreate, ""),
+        purposeContent: getContent(UNSTABLE_MSC3088_PURPOSE.name, UNSTABLE_MSC3089_TREE_SUBTYPE.name),
+        encryptionContent: getContent(EventType.RoomEncryption, ""),
+    };
+}
+/** Checks the existing Storage markers and Megolm room encryption together. */
+export function isStorageTreeRoom(room) {
+    const state = getStorageTreeState(room);
+    return isStorageTreeState(state.createContent, state.purposeContent, state.encryptionContent);
+}
+/** Checks only the room markers for explicit cleanup paths such as declining an invite. */
+export function hasStorageTreeMarkersRoom(room) {
+    const state = getStorageTreeState(room);
+    return hasStorageTreeMarkers(state.createContent, state.purposeContent);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@telecrypt-io/storage",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "license": "BUSL-1.1",
   "type": "module",
   "packageManager": "npm@11.19.0",
@@ -22,7 +22,7 @@
     "LICENSE"
   ],
   "engines": {
-    "node": "24.20.0"
+    "node": "24.21.0"
   },
   "publishConfig": {
     "access": "public"
@@ -48,7 +48,7 @@
     "eslint": "10.9.0",
     "fake-indexeddb": "6.2.5",
     "typescript": "5.9.3",
-    "vitest": "4.1.11"
+    "vitest": "4.1.12"
   },
   "repository": {
     "type": "git",