squidcloudctl 3.0.2 → 3.0.4

package/dist/bin/squidcloud.js

@@ -82,6 +82,8 @@ const OPTIONS = {
     'files ls': [['--refresh', 'Bypass the local listing cache']],
     'files up': [['--folder <ref>', 'Target folder id or name'], ['--quiet', 'Suppress progress output']],
     'files dl': [['-o, --out <path>', 'Output path']],
+    'storage dl': [['-o, --out <path>', 'Output path']],
+    'files list': [['--refresh', 'Bypass listing cache']],
     'storage ls': [['--folder <ref>', 'List inside a folder'], ['--search <q>', 'Filter by name']],
     'share create': [
         ['--expires <dur>', 'Expiry like 24h / 7d / 30d'],

package/dist/commands/files/download.js

@@ -14,7 +14,7 @@ export default async function filesDownload(...args) {
     const { entry } = await resolveFileRef(ref);
     if (!isJsonMode())
         console.log(`\n  ${chalk.dim(`fetching ${entry.name}…`)}`);
-    const finalPath = await downloadFile({ id: entry.id, name: entry.name }, opts.out ? path.resolve(String(opts.out)) : undefined);
+    const finalPath = await downloadFile({ id: entry.id, name: entry.name, userId: entry.user_id }, opts.out ? path.resolve(String(opts.out)) : undefined);
     const size = fs.statSync(finalPath).size;
     if (isJsonMode())
         console.log(JSON.stringify({ file: finalPath, bytes: size, id: entry.id }, null, 2));

package/dist/lib/crypto/res54.js

@@ -0,0 +1,94 @@
+import { gcm } from '@noble/ciphers/aes.js';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { randomBytes } from '@noble/hashes/utils.js';
+/* res54 chunk-format support for the CLI — mirrors the platform's
+   encryption-v3 / v2 / legacy layouts exactly so every stored file
+   decrypts locally without server-side help. */
+export const V3_MAGIC = new Uint8Array([0x52, 0x45, 0x03]);
+const KEY_LEN = 32;
+const IV_LEN = 12;
+export function utf8(n) {
+    return typeof n === 'string' ? new TextEncoder().encode(n) : n;
+}
+function concat(...parts) {
+    const total = parts.reduce((s, p) => s + p.length, 0);
+    const out = new Uint8Array(total);
+    let o = 0;
+    for (const p of parts) {
+        out.set(p, o);
+        o += p.length;
+    }
+    return out;
+}
+function u32le(n) {
+    const b = new Uint8Array(4);
+    new DataView(b.buffer).setUint32(0, n, true);
+    return b;
+}
+/** Platform key normalisation: key.slice(0,32).padEnd(32,'0') as UTF-8 bytes. */
+export function deriveRawKey(keyString) {
+    return utf8(keyString.slice(0, 32).padEnd(32, '0'));
+}
+function hkdfExpand(ikm, info, len) {
+    return hkdf(sha256, ikm, new Uint8Array(0), info, len);
+}
+export function detectChunkVersion(blob) {
+    if (blob.length > 3 && blob[0] === V3_MAGIC[0] && blob[1] === V3_MAGIC[1] && blob[2] === V3_MAGIC[2])
+        return 3;
+    if (blob.length > 4 + 12 + 16) {
+        const adLen = new DataView(blob.buffer, blob.byteOffset).getUint32(0, true);
+        if (adLen >= 8 && adLen <= 128 && blob.length > 4 + adLen + 12)
+            return 2;
+    }
+    return 1;
+}
+/** v3: [magic3][origLen u32le][iv12][AES-GCM ct||tag] */
+export function decryptV3(blob, masterRaw, userId, fileId, chunkIndex, totalChunks) {
+    const fileKeyRaw = hkdfExpand(masterRaw, concat(utf8('v3-file-master'), utf8(fileId)), KEY_LEN);
+    const idx = u32le(chunkIndex);
+    const chunkKey = hkdfExpand(fileKeyRaw, concat(utf8('v3-chunk'), idx), KEY_LEN);
+    const iv = blob.slice(7, 7 + IV_LEN);
+    const ct = blob.slice(7 + IV_LEN);
+    const aad = utf8(`res54-v3|${userId}|${fileId}|${chunkIndex}|${totalChunks}`);
+    const aes = gcm(chunkKey, iv, aad);
+    return aes.decrypt(ct);
+}
+/** v2: [4B adLen LE][AD][12B iv][ct] — key = raw utf8 of key string */
+export function decryptV2(blob, keyRaw) {
+    const adLen = new DataView(blob.buffer, blob.byteOffset).getUint32(0, true);
+    const ad = blob.slice(4, 4 + adLen);
+    const iv = blob.slice(4 + adLen, 4 + adLen + 12);
+    const ct = blob.slice(4 + adLen + 12);
+    const aes = gcm(keyRaw, iv, ad);
+    return aes.decrypt(ct);
+}
+/** legacy: [12B iv][ct] */
+export function decryptLegacy(blob, keyRaw) {
+    const aes = gcm(keyRaw, blob.slice(0, 12));
+    return aes.decrypt(blob.slice(12));
+}
+/** Try every known format; throws only if none succeed. */
+export function decryptAny(blob, keyString, ctx) {
+    const attempts = [];
+    const version = detectChunkVersion(blob);
+    const keyRaw = deriveRawKey(keyString);
+    if (version === 3 && ctx?.userId && ctx.fileId) {
+        attempts.push(() => decryptV3(blob, keyRaw, ctx.userId, ctx.fileId, ctx.chunkIndex ?? 0, ctx.totalChunks ?? 1));
+    }
+    attempts.push(() => decryptV2(blob, keyRaw));
+    attempts.push(() => decryptLegacy(blob, keyRaw));
+    let lastErr = null;
+    for (const attempt of attempts) {
+        try {
+            return { plain: attempt(), version };
+        }
+        catch (e) {
+            lastErr = e;
+        }
+    }
+    throw new Error(`Decryption failed (${blob.length}B, v${version})${lastErr ? `: ${lastErr instanceof Error ? lastErr.message : String(lastErr)}` : ''}`);
+}
+export function generateKeyHex() {
+    return Buffer.from(randomBytes(32)).toString('hex');
+}

package/dist/lib/transfer.js

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
-import { apiRaw, apiPost } from './api/client.js';
+import { apiRaw, apiGet, apiPost } from './api/client.js';
 const CONCURRENCY = 4;
 const CHUNK_RETRIES = 3;
 function humanBytes(n) {
@@ -21,9 +21,8 @@ export function renderProgressBar(current, total, width = 26) {
     if (total <= 0)
         return '░'.repeat(width);
     const filled = Math.round((current / total) * width);
-    return '█'.repeat(filled) + '░'.repeat(Math.max(0, width - filled));
+    return '█'.repeat(Math.max(0, Math.min(width, filled))) + '░'.repeat(Math.max(0, width - filled));
 }
-/** Single-line live progress renderer for TTYs. */
 export class TransferProgress {
     label;
     totalBytes;
@@ -41,21 +40,18 @@ export class TransferProgress {
         const pct = this.totalBytes > 0 ? Math.min(100, (currentBytes / this.totalBytes) * 100) : 0;
         const elapsed = (Date.now() - this.startedAt) / 1000;
         const bps = elapsed > 0 ? currentBytes / elapsed : 0;
-        const eta = bps > 0 && currentBytes > 0 ? (this.totalBytes - currentBytes) / bps : Infinity;
-        const etaText = Number.isFinite(eta)
-            ? eta > 90 ? `${Math.round(eta / 60)}m` : `${Math.round(eta)}s`
-            : '—';
+        const eta = bps > 0 && currentBytes > 0 && currentBytes < this.totalBytes
+            ? (this.totalBytes - currentBytes) / bps : Infinity;
+        const etaText = Number.isFinite(eta) ? (eta > 90 ? `${Math.round(eta / 60)}m` : `${Math.round(eta)}s`) : '—';
         const line = `${this.label} ${renderProgressBar(currentBytes, this.totalBytes)} ${pct.toFixed(0)}%  ${humanBytes(currentBytes)}/${humanBytes(this.totalBytes)}  ${humanBytes(bps)}/s  eta ${etaText}${extra ? `  ${extra}` : ''}`;
         if (line !== this.lastLine) {
             process.stdout.write(`\r\x1b[2K${line}`);
             this.lastLine = line;
         }
     }
-    finish(ok) {
+    finish() {
         if (this.enabled)
             process.stdout.write('\r\x1b[2K');
-        if (!ok && !this.enabled)
-            return;
     }
 }
 export async function uploadFile(filePath, opts = {}) {
@@ -78,16 +74,15 @@ export async function uploadFile(filePath, opts = {}) {
     const data = await fs.promises.readFile(filePath);
     const chunkSize = init.chunk_size || 512 * 1024;
     const totalChunks = Math.max(1, Math.ceil(data.length / chunkSize));
-    let completedBytes = 0;
-    // Parallel chunk PUTs against signed cluster URLs — same dispatch shape as the web app.
     const urlByIndex = new Map(init.urls.map((u) => [u.index, u]));
     const queue = Array.from({ length: totalChunks }, (_, i) => i);
+    let completedBytes = 0;
     let done = 0;
     const worker = async () => {
-        while (queue.length > 0) {
+        for (;;) {
             const idx = queue.shift();
             if (idx === undefined)
-                break;
+                return;
             const target = urlByIndex.get(idx);
             if (!target?.upload_url)
                 throw new Error(`Missing upload URL for chunk ${idx}`);
@@ -97,20 +92,20 @@ export async function uploadFile(filePath, opts = {}) {
             let attempt = 0;
             for (;;) {
                 try {
-                    const res = await fetch(target.upload_url, {
+                    const r = await fetch(target.upload_url, {
                         method: 'PUT',
                         headers: { 'Content-Type': 'application/octet-stream' },
                         body: new Uint8Array(slice),
                     });
-                    if (!res.ok)
-                        throw new Error(`Chunk ${idx} rejected (HTTP ${res.status})`);
+                    if (!r.ok)
+                        throw new Error(`chunk ${idx} HTTP ${r.status}`);
                     break;
                 }
                 catch (err) {
                     attempt++;
                     if (attempt >= CHUNK_RETRIES)
                         throw err;
-                    await new Promise((r) => setTimeout(r, 500 * Math.pow(2, attempt)));
+                    await new Promise((r2) => setTimeout(r2, 500 * 2 ** attempt));
                 }
             }
             done++;
@@ -120,38 +115,262 @@ export async function uploadFile(filePath, opts = {}) {
         }
     };
     await Promise.all(Array.from({ length: Math.min(CONCURRENCY, totalChunks) }, worker));
-    progress.finish(true);
+    progress.finish();
     const complete = await apiPost('/upload/complete', {
         upload_id: init.upload_id,
         chunk_size: chunkSize,
     });
-    return {
-        id: complete?.id || complete?.file_id || init.file_id,
-        name,
-        size: stat.size,
-    };
+    return { id: complete?.id || complete?.file_id || init.file_id, name, size: stat.size };
+}
+const isUsableKey = (k) => !!k && !/^(managed_key|sha256:.*|byok_encrypted|byok_protected)$/.test(k);
+async function fetchVaultKey(fileId) {
+    const { SUPABASE_URL } = await import('./auth/constants.js');
+    const { authToken, anonKey } = await import('./auth/oauth-session.js');
+    if (!authToken)
+        return null;
+    try {
+        const r = await fetch(`${SUPABASE_URL}/functions/v1/file-key`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${authToken}`,
+                ...(anonKey ? { apikey: anonKey } : {}),
+            },
+            body: JSON.stringify({ fileId }),
+        });
+        if (r.status === 500) {
+            const t = await r.text().catch(() => '');
+            if (/decrypt file key/i.test(t)) {
+                throw new Error('VAULT_KEY_DRIFT: the SQUIDVEIL_MASTER_KEY secret has drifted since this file was uploaded - restore it in Supabase > Edge Functions > Secrets to decrypt managed files.');
+            }
+        }
+        const d = (await r.json());
+        return d?.success && d.key ? d.key : null;
+    }
+    catch (err) {
+        if (err instanceof Error && err.message.startsWith('VAULT_KEY_DRIFT'))
+            throw err;
+        return null;
+    }
+}
+async function getBridgeKey() {
+    if (process.env.SQUIDCLOUD_API_KEY)
+        return process.env.SQUIDCLOUD_API_KEY;
+    const fs2 = await import('node:fs');
+    const os2 = await import('node:os');
+    const path2 = await import('node:path');
+    const keyFile = path2.join(os2.homedir(), '.squidcloud', 'bridge-key.json');
+    try {
+        const cached = JSON.parse(fs2.readFileSync(keyFile, 'utf8'));
+        if (cached?.key?.startsWith('cb_'))
+            return cached.key;
+    }
+    catch { }
+    const created = await apiPost('/keys', {
+        name: 'cli-bridge-' + new Date().toISOString().slice(0, 10),
+    });
+    const key = created?.raw_key;
+    if (!key)
+        throw new Error('Could not provision bridge key');
+    try {
+        fs2.mkdirSync(path2.dirname(keyFile), { recursive: true });
+        fs2.writeFileSync(keyFile, JSON.stringify({ key, id: created?.key?.id }), { mode: 0o600 });
+    }
+    catch { }
+    return key;
+}
+function parseTags(rawTags) {
+    let cur = rawTags;
+    for (let i = 0; i < 3; i++) {
+        if (typeof cur === 'string') {
+            try {
+                cur = JSON.parse(cur);
+            }
+            catch {
+                break;
+            }
+        }
+        else if (Array.isArray(cur)) {
+            cur = cur[0];
+        }
+        else
+            break;
+    }
+    if (cur && typeof cur === 'object' && Array.isArray(cur.chunks)) {
+        const t = cur;
+        return { chunks: t.chunks, encryptionKey: t.encryptionKey };
+    }
+    return { chunks: [] };
+}
+async function bridgeResolve(apiKey, chunks) {
+    const { SUPABASE_URL } = await import('./auth/constants.js');
+    const { authToken, anonKey } = await import('./auth/oauth-session.js');
+    if (!apiKey && !authToken)
+        throw new Error('Not authenticated');
+    const r = await fetch(`${SUPABASE_URL}/functions/v1/squidfs-bridge`, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),
+            ...(anonKey ? { apikey: anonKey } : {}),
+        },
+        body: JSON.stringify({ api_key: apiKey ?? '', action: 'resolve_download', chunks }),
+    });
+    const d = (await r.json());
+    if (!r.ok || !d.success || !Array.isArray(d.urls))
+        throw new Error(d.error || `bridge HTTP ${r.status}`);
+    const map = new Map();
+    for (const u of d.urls)
+        if (u.downloadUrl)
+            map.set(u.index ?? 0, u.downloadUrl);
+    return chunks.map((c) => {
+        const u = map.get(c.index);
+        if (!u)
+            throw new Error(`bridge missing URL for chunk ${c.index}`);
+        return u;
+    });
+}
+export async function downloadFile(target, destPath, onProgress) {
+    const errors = [];
+    // Authoritative chunk list (also covers SquidFS-written files).
+    let chunks = [];
+    let tagsKey;
+    let encrypted = false;
+    try {
+        const metaRow = await apiGet(`/files/${target.id}/metadata`);
+        const row = metaRow.file ?? {};
+        encrypted = row.encrypted === true;
+        const parsed = parseTags(row.tags);
+        chunks = parsed.chunks;
+        tagsKey = parsed.encryptionKey;
+        if (!target.userId && typeof row.user_id === 'string')
+            target.userId = row.user_id;
+    }
+    catch { /* metadata optional */ }
+    const hasB2 = chunks.length > 0 && chunks.every((c) => c.repo === 'b2');
+    const hasBridgeOnly = chunks.length > 0 && !hasB2;
+    // 1) Signed API mode for platform-stored chunks.
+    if (hasB2 || chunks.length === 0) {
+        try {
+            const res = await apiRaw(`/download/${target.id}?signed=true`);
+            if (res.ok) {
+                const meta = (await res.json());
+                if (meta?.success && Array.isArray(meta.signed_urls) && meta.signed_urls.length > 0) {
+                    return await fetchDecryptWrite(meta.signed_urls, target, destPath, onProgress);
+                }
+                errors.push('signed: empty urls');
+            }
+            else {
+                errors.push(`signed: HTTP ${res.status}`);
+            }
+        }
+        catch (e) {
+            errors.push(`signed: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    // 2) Bridge mode (SquidFS-origin files).
+    if (hasBridgeOnly) {
+        try {
+            const apiKey = process.env.SQUIDCLOUD_API_KEY ?? null;
+            const urls = await bridgeResolve(apiKey, chunks.map((c) => ({ path: c.path, index: c.index, bucket: c.bucket })));
+            return await fetchDecryptWrite(urls, target, destPath, onProgress);
+        }
+        catch (e) {
+            errors.push(`bridge: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    // 3) Plain server-decrypted stream (non-distributed storage).
+    if (!encrypted && chunks.length === 0) {
+        try {
+            return await streamPlain(`/download/${target.id}`, target.name, destPath, onProgress);
+        }
+        catch (e) {
+            errors.push(`plain: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    throw new Error(errors.join(' · ') || 'No downloadable strategy succeeded');
+}
+async function resolveKey(fileId, tagsKey) {
+    if (tagsKey && !/^(managed_key|sha256:\S+|byok_encrypted|byok_protected)$/.test(tagsKey))
+        return tagsKey;
+    return fetchVaultKey(fileId);
+}
+async function fetchDecryptWrite(urls, target, destPath, onProgress) {
+    const totalChunks = urls.length;
+    const finalPath = destPath || target.name;
+    const out = fs.createWriteStream(finalPath);
+    const progress = new TransferProgress('download', target.size ?? 0, process.stdout.isTTY);
+    let keyString;
+    for (let i = 0; i < totalChunks; i++) {
+        const r = await fetch(urls[i % urls.length]);
+        if (!r.ok)
+            throw new Error(`chunk ${i} HTTP ${r.status}`);
+        const blob = new Uint8Array(await r.arrayBuffer());
+        const { detectChunkVersion, decryptAny } = await import('./crypto/res54.js');
+        const version = detectChunkVersion(blob);
+        if (version === 1 && blob.length <= 28) {
+            out.write(Buffer.from(blob));
+            continue;
+        }
+        if (keyString === undefined) {
+            keyString = (await resolveKey(target.id)) ?? '';
+            if (!keyString) {
+                out.end();
+                throw new Error('Encrypted file but its key is unavailable (BYOK without key?)');
+            }
+        }
+        let plain;
+        try {
+            plain = decryptAny(blob, keyString, {
+                userId: target.userId,
+                fileId: target.id,
+                chunkIndex: i,
+                totalChunks,
+            }).plain;
+        }
+        catch (err) {
+            if (version === 1) {
+                plain = blob;
+            }
+            else {
+                out.end();
+                throw err;
+            }
+        }
+        progress.update(i + 1, `chunk ${i + 1}/${totalChunks}`);
+        void onProgress;
+        const buf = Buffer.from(plain);
+        if (!out.write(buf))
+            await new Promise((r2) => out.once('drain', () => r2()));
+    }
+    out.end();
+    await new Promise((resolve, reject) => {
+        out.on('finish', () => resolve());
+        out.on('error', reject);
+    });
+    progress.finish();
+    return finalPath;
 }
-export async function downloadFile(fileRef, destPath, onProgress) {
-    const res = await apiRaw(`/download/${fileRef.id}`);
+async function streamPlain(reqPath, fallbackName, destPath, onProgress) {
+    const res = await apiRaw(reqPath);
     if (!res.ok) {
-        const text = await res.text().catch(() => '');
-        throw new Error(text.slice(0, 300) || `Download failed (HTTP ${res.status})`);
+        const t = await res.text().catch(() => '');
+        throw new Error(t.slice(0, 300) || `Download failed (HTTP ${res.status})`);
     }
     const total = Number(res.headers.get('content-length')) || 0;
     const progress = new TransferProgress('download', total, process.stdout.isTTY);
     const nodeStream = Readable.fromWeb(res.body);
     const header = res.headers.get('content-disposition') || '';
-    const match = header.match(/filename="?([^";]+)"?/i);
-    const fileName = match?.[1] || fileRef.name;
-    const finalPath = destPath || fileName;
+    const m = header.match(/filename="?([^";]+)"?/i);
+    const finalPath = destPath || m?.[1] || fallbackName;
     let received = 0;
-    nodeStream.on('data', (chunk) => {
-        received += chunk.length;
+    nodeStream.on('data', (c) => {
+        received += c.length;
         onProgress?.({ current: received, total: total || received, stage: 'downloading' });
         progress.update(received);
     });
     await pipeline(nodeStream, fs.createWriteStream(finalPath));
-    progress.finish(true);
+    progress.finish();
     return finalPath;
 }
 function guessMime(name) {
@@ -166,3 +385,4 @@ function guessMime(name) {
     };
     return table[ext] || 'application/octet-stream';
 }
+export { apiPost };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squidcloudctl",
-  "version": "3.0.2",
+  "version": "3.0.4",
   "description": "SquidCloud CLI (squidcloudctl) — encrypted storage, shares and secrets from your terminal",
   "main": "dist/bin/squidcloud.js",
   "bin": {