powerbin 0.1.0 → 0.1.1

package/README.md

@@ -46,9 +46,14 @@ for invalid arguments or a malformed link.
 
 ## One-time behavior
 
-Running `reveal` consumes the link. There is no confirmation prompt. Missing or
-malformed keys are rejected before contacting the server. A validly encoded but
-incorrect key can still consume the message before decryption fails.
+Running `reveal` checks compatibility without consuming the link, then claims it
+once. There is no confirmation prompt. Version 0.1.1 and later require the server
+to report `protocol_version: 2` in its availability response. Older servers and
+legacy v1 links are rejected before the consuming request. Update the PowerBin
+server and browser app together, reload the browser, and create a fresh link.
+
+Missing or malformed keys are rejected before contacting the server. A validly
+encoded but incorrect key can still consume the message before decryption fails.
 
 The CLI never retries or follows redirects for the consuming request. If the
 response is lost after the server claims the message, it cannot be recovered.

package/dist/client.js

@@ -91,11 +91,47 @@ async function responseBody(response) {
     }
     return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
 }
-/** A single consuming request. Loading crypto and validating the URL happen first. */
+async function checkProtocol(link, timeoutMs) {
+    let response;
+    try {
+        response = await fetch(link.endpoint.slice(0, -'/reveal'.length), {
+            method: 'GET',
+            headers: { Accept: 'application/json' },
+            redirect: 'manual',
+            signal: AbortSignal.timeout(timeoutMs)
+        });
+    }
+    catch {
+        throw new CliError('The link availability check was lost or timed out. This request did not consume the message.');
+    }
+    if (response.status >= 300 && response.status < 400) {
+        await response.body?.cancel().catch(() => { });
+        throw new CliError('The service redirected the availability check. No redirect was followed. This request did not consume the message.');
+    }
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => { });
+        const reason = [400, 401, 403, 404, 410, 429].includes(response.status)
+            ? statusError(response.status).message
+            : 'The server could not check this link.';
+        throw new CliError(`${reason} This request did not consume the message.`);
+    }
+    let metadata;
+    try {
+        metadata = JSON.parse(await responseBody(response));
+    }
+    catch {
+        throw new CliError('The link metadata response was incomplete or invalid. This request did not consume the message.');
+    }
+    if (!metadata || typeof metadata !== 'object' || !('protocol_version' in metadata) || metadata.protocol_version !== 2) {
+        throw new CliError('This link/server uses an unsupported encryption format. Update PowerBin server/browser, then create a new link. This request did not consume the message.');
+    }
+}
+/** Check compatibility without consuming, then make a single consuming request. */
 export async function revealLink(input, options = {}) {
     const link = parseLink(input);
     try {
         const crypto = loadCrypto();
+        await checkProtocol(link, options.timeoutMs ?? 15_000);
         let response;
         try {
             response = await fetch(link.endpoint, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "powerbin",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Reveal and burn PowerBin one-time messages from your terminal, with local decryption.",
   "license": "CC0-1.0",
   "type": "module",