squidcloudctl 3.0.3 → 3.0.5

package/dist/bin/upload-v3.txt

@@ -0,0 +1 @@
+upload test v3

package/dist/lib/transfer.js

@@ -138,10 +138,18 @@ async function fetchVaultKey(fileId) {
             },
             body: JSON.stringify({ fileId }),
         });
+        if (r.status === 500) {
+            const t = await r.text().catch(() => '');
+            if (/decrypt file key/i.test(t)) {
+                throw new Error('VAULT_KEY_DRIFT: the SQUIDVEIL_MASTER_KEY secret has drifted since this file was uploaded - restore it in Supabase > Edge Functions > Secrets to decrypt managed files.');
+            }
+        }
         const d = (await r.json());
         return d?.success && d.key ? d.key : null;
     }
-    catch {
+    catch (err) {
+        if (err instanceof Error && err.message.startsWith('VAULT_KEY_DRIFT'))
+            throw err;
         return null;
     }
 }
@@ -222,9 +230,56 @@ async function bridgeResolve(apiKey, chunks) {
         return u;
     });
 }
+/** Frontend-parity chunk transport: squidcloud-cluster issues the signed
+    object URL for each chunk. Requires a real Supabase JWT (sb_token from
+    browser login). */
+async function getSupabaseJwt() {
+    const { sbToken, sbTokenExpiresAt } = await import('./auth/oauth-session.js');
+    if (sbToken && (!sbTokenExpiresAt || Date.now() < sbTokenExpiresAt))
+        return sbToken;
+    throw new Error('WEB_SESSION_REQUIRED: this download needs a short-lived web session token. Run `squidcloudctl login` again, then retry.');
+}
+async function clusterDownloadChunk(chunk, userId) {
+    const { SUPABASE_URL } = await import('./auth/constants.js');
+    const jwt = await getSupabaseJwt();
+    const r = await fetch(`${SUPABASE_URL}/functions/v1/squidcloud-cluster`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${jwt}` },
+        body: JSON.stringify({
+            action: 'download',
+            path: chunk.path,
+            repo: chunk.repo,
+            clusterId: chunk.clusterId,
+            bucket: chunk.bucket,
+            userId,
+        }),
+    });
+    const text = await r.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`cluster HTTP ${r.status}: ${text.slice(0, 120)}`);
+    }
+    if (!r.ok)
+        throw new Error(data?.error || `cluster HTTP ${r.status}`);
+    if (data.legacy) {
+        const decoded = Buffer.from(String(data.content).replace(/\s/g, ''), 'base64').toString('utf8');
+        const parsed = JSON.parse(decoded);
+        const b64 = parsed.v === '2.3' ? parsed.d : parsed.chunkData;
+        return new Uint8Array(Buffer.from(String(b64), 'base64'));
+    }
+    if (!data.downloadUrl)
+        throw new Error('No download URL received');
+    const obj = await fetch(data.downloadUrl);
+    if (!obj.ok)
+        throw new Error(`CDN HTTP ${obj.status}`);
+    return new Uint8Array(await obj.arrayBuffer());
+}
 export async function downloadFile(target, destPath, onProgress) {
     const errors = [];
-    // Authoritative chunk list (also covers SquidFS-written files).
+    // Parse metadata exactly like the web app.
     let chunks = [];
     let tagsKey;
     let encrypted = false;
@@ -238,46 +293,52 @@ export async function downloadFile(target, destPath, onProgress) {
         if (!target.userId && typeof row.user_id === 'string')
             target.userId = row.user_id;
     }
-    catch { /* metadata optional */ }
-    const hasB2 = chunks.length > 0 && chunks.every((c) => c.repo === 'b2');
-    const hasBridgeOnly = chunks.length > 0 && !hasB2;
-    // 1) Signed API mode for platform-stored chunks.
-    if (hasB2 || chunks.length === 0) {
+    catch { /* optional */ }
+    // Frontend key-resolution order.
+    let defaultKey = tagsKey;
+    if (defaultKey === 'managed_key')
+        defaultKey = (await fetchVaultKey(target.id)) ?? undefined;
+    // ── Strategy A: exact frontend transport (squidcloud-cluster) ──
+    if (chunks.length > 0) {
         try {
-            const res = await apiRaw(`/download/${target.id}?signed=true`);
-            if (res.ok) {
-                const meta = (await res.json());
-                if (meta?.success && Array.isArray(meta.signed_urls) && meta.signed_urls.length > 0) {
-                    return await fetchDecryptWrite(meta.signed_urls, target, destPath, onProgress);
+            const finalPath2 = destPath || target.name;
+            const out = fs.createWriteStream(finalPath2);
+            const progress = new TransferProgress('download', target.size ?? 0, process.stdout.isTTY);
+            const noble = await import('@noble/hashes/hkdf.js');
+            const sha2 = await import('@noble/hashes/sha2.js');
+            const enc = new TextEncoder();
+            const { detectChunkVersion, decryptAny, decryptV3, deriveRawKey } = await import('./crypto/res54.js');
+            const master = deriveRawKey(defaultKey || '');
+            const fileKeyRaw = noble.hkdf(sha2.sha256, master, new Uint8Array(0), enc.encode('v3-file-master' + target.id), 32);
+            for (let i = 0; i < chunks.length; i++) {
+                const blob = await clusterDownloadChunk(chunks[i], target.userId || '');
+                const version = detectChunkVersion(blob);
+                let plain;
+                if (version === 3) {
+                    plain = decryptV3(blob, master, target.userId || '', target.id, i, chunks.length);
                 }
-                errors.push('signed: empty urls');
-            }
-            else {
-                errors.push(`signed: HTTP ${res.status}`);
+                else if (version === 1 && !encrypted) {
+                    plain = blob;
+                }
+                else {
+                    plain = decryptAny(blob, defaultKey || '', {
+                        userId: target.userId, fileId: target.id, chunkIndex: i, totalChunks: chunks.length,
+                    }).plain;
+                }
+                void fileKeyRaw;
+                progress.update(i + 1, `chunk ${i + 1}/${chunks.length}`);
+                void onProgress;
+                const buf = Buffer.from(plain);
+                if (!out.write(buf))
+                    await new Promise((r2) => out.once('drain', () => r2()));
             }
+            out.end();
+            await new Promise((resolve, reject) => { out.on('finish', () => resolve()); out.on('error', reject); });
+            progress.finish();
+            return finalPath2;
         }
         catch (e) {
-            errors.push(`signed: ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }
-    // 2) Bridge mode (SquidFS-origin files).
-    if (hasBridgeOnly) {
-        try {
-            const apiKey = process.env.SQUIDCLOUD_API_KEY ?? null;
-            const urls = await bridgeResolve(apiKey, chunks.map((c) => ({ path: c.path, index: c.index, bucket: c.bucket })));
-            return await fetchDecryptWrite(urls, target, destPath, onProgress);
-        }
-        catch (e) {
-            errors.push(`bridge: ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }
-    // 3) Plain server-decrypted stream (non-distributed storage).
-    if (!encrypted && chunks.length === 0) {
-        try {
-            return await streamPlain(`/download/${target.id}`, target.name, destPath, onProgress);
-        }
-        catch (e) {
-            errors.push(`plain: ${e instanceof Error ? e.message : String(e)}`);
+            errors.push(`cluster: ${e instanceof Error ? e.message : String(e)}`);
         }
     }
     throw new Error(errors.join(' · ') || 'No downloadable strategy succeeded');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squidcloudctl",
-  "version": "3.0.3",
+  "version": "3.0.5",
   "description": "SquidCloud CLI (squidcloudctl) — encrypted storage, shares and secrets from your terminal",
   "main": "dist/bin/squidcloud.js",
   "bin": {