lsh-framework 2.2.1 → 2.2.3

package/dist/lib/ipfs-secrets-storage.js

@@ -74,10 +74,11 @@ export class IPFSSecretsStorage {
                     logger.info(`   ☁️  Synced to Storacha network`);
                     // Upload registry file if this is a git repo
                     // This allows detection on new machines without local metadata
+                    // Include the secrets CID so other hosts can fetch the latest version
                     if (gitRepo) {
                         try {
-                            await storacha.uploadRegistry(gitRepo, environment);
-                            logger.debug(`   📝 Registry uploaded for ${gitRepo}`);
+                            await storacha.uploadRegistry(gitRepo, environment, cid);
+                            logger.debug(`   📝 Registry uploaded for ${gitRepo} (CID: ${cid})`);
                         }
                         catch (regError) {
                             // Registry upload failed, but secrets are still uploaded
@@ -106,10 +107,35 @@ export class IPFSSecretsStorage {
     async pull(environment, encryptionKey, gitRepo) {
         try {
             const metadataKey = this.getMetadataKey(gitRepo, environment);
-            const metadata = this.metadata[metadataKey];
+            let metadata = this.metadata[metadataKey];
             if (!metadata) {
                 throw new Error(`No secrets found for environment: ${environment}`);
             }
+            // Check if there's a newer version in the registry (for git repos)
+            if (gitRepo) {
+                try {
+                    const storacha = getStorachaClient();
+                    if (storacha.isEnabled() && await storacha.isAuthenticated()) {
+                        const latestCid = await storacha.getLatestCID(gitRepo);
+                        if (latestCid && latestCid !== metadata.cid) {
+                            logger.info(`   🔄 Found newer version in registry (CID: ${latestCid})`);
+                            // Update metadata with latest CID
+                            metadata = {
+                                ...metadata,
+                                cid: latestCid,
+                                timestamp: new Date().toISOString(),
+                            };
+                            this.metadata[metadataKey] = metadata;
+                            this.saveMetadata();
+                        }
+                    }
+                }
+                catch (error) {
+                    // Registry check failed, continue with local metadata
+                    const err = error;
+                    logger.debug(`   Registry check failed: ${err.message}`);
+                }
+            }
             // Try to load from local cache
             let cachedData = await this.loadLocally(metadata.cid);
             // If not in cache, try downloading from Storacha

package/dist/lib/storacha-client.js

@@ -235,9 +235,9 @@ export class StorachaClient {
     }
     /**
      * Upload registry file for a repo
-     * Registry files mark that secrets exist for a repo without exposing the secrets themselves
+     * Registry files mark that secrets exist and include the latest secrets CID
      */
-    async uploadRegistry(repoName, environment) {
+    async uploadRegistry(repoName, environment, secretsCid) {
         if (!this.isEnabled()) {
             throw new Error('Storacha is not enabled');
         }
@@ -247,8 +247,9 @@ export class StorachaClient {
         const registry = {
             repoName,
             environment,
+            cid: secretsCid, // Include the secrets CID
             timestamp: new Date().toISOString(),
-            version: '2.2.1',
+            version: '2.2.2',
         };
         const content = JSON.stringify(registry, null, 2);
         const buffer = Buffer.from(content, 'utf-8');
@@ -258,9 +259,74 @@ export class StorachaClient {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const file = new File([uint8Array], filename, { type: 'application/json' });
         const cid = await client.uploadFile(file);
-        logger.debug(`📝 Uploaded registry for ${repoName}: ${cid}`);
+        logger.debug(`📝 Uploaded registry for ${repoName} (secrets CID: ${secretsCid}): ${cid}`);
         return cid.toString();
     }
+    /**
+     * Get the latest secrets CID from registry
+     * Returns the CID of the latest secrets if registry exists, null otherwise
+     */
+    async getLatestCID(repoName) {
+        if (!this.isEnabled()) {
+            return null;
+        }
+        if (!await this.isAuthenticated()) {
+            return null;
+        }
+        try {
+            const client = await this.getClient();
+            // Only check recent uploads (limit to 20 for performance)
+            const pageSize = 20;
+            // Get first page of uploads
+            const results = await client.capability.upload.list({
+                cursor: '',
+                size: pageSize,
+            });
+            // Collect all registry files for this repo
+            const registries = [];
+            for (const upload of results.results) {
+                try {
+                    const cid = upload.root.toString();
+                    // Download with timeout
+                    const downloadPromise = this.download(cid);
+                    const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 5000));
+                    const content = await Promise.race([downloadPromise, timeoutPromise]);
+                    // Skip large files (registry should be < 1KB)
+                    if (content.length > 1024) {
+                        continue;
+                    }
+                    // Try to parse as JSON
+                    const json = JSON.parse(content.toString('utf-8'));
+                    // Check if it's an LSH registry file for our repo
+                    if (json.repoName === repoName && json.version && json.cid && json.timestamp) {
+                        registries.push({
+                            cid: cid,
+                            timestamp: json.timestamp,
+                            secretsCid: json.cid,
+                        });
+                    }
+                }
+                catch {
+                    // Not an LSH registry file or failed to download
+                    continue;
+                }
+            }
+            // Sort by timestamp (newest first) and return the most recent secrets CID
+            if (registries.length > 0) {
+                registries.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
+                const latest = registries[0];
+                logger.debug(`✅ Found latest CID for ${repoName}: ${latest.secretsCid} (timestamp: ${latest.timestamp})`);
+                return latest.secretsCid;
+            }
+            // No registry found
+            return null;
+        }
+        catch (error) {
+            const err = error;
+            logger.debug(`Failed to get latest CID: ${err.message}`);
+            return null;
+        }
+    }
     /**
      * Check if registry exists for a repo by listing uploads
      * Returns true if a registry file for this repo exists in Storacha

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {