squidcloudctl 3.0.5 → 3.0.7

package/dist/lib/transfer.js

@@ -310,20 +310,37 @@ export async function downloadFile(target, destPath, onProgress) {
             const { detectChunkVersion, decryptAny, decryptV3, deriveRawKey } = await import('./crypto/res54.js');
             const master = deriveRawKey(defaultKey || '');
             const fileKeyRaw = noble.hkdf(sha2.sha256, master, new Uint8Array(0), enc.encode('v3-file-master' + target.id), 32);
+            let activeMaster = master;
             for (let i = 0; i < chunks.length; i++) {
                 const blob = await clusterDownloadChunk(chunks[i], target.userId || '');
                 const version = detectChunkVersion(blob);
                 let plain;
-                if (version === 3) {
-                    plain = decryptV3(blob, master, target.userId || '', target.id, i, chunks.length);
-                }
-                else if (version === 1 && !encrypted) {
+                if (version === 1 && !encrypted && !defaultKey) {
                     plain = blob;
                 }
                 else {
-                    plain = decryptAny(blob, defaultKey || '', {
-                        userId: target.userId, fileId: target.id, chunkIndex: i, totalChunks: chunks.length,
-                    }).plain;
+                    if (!defaultKey && byokCache === undefined) {
+                        byokCache = (await askByokKey(target.name)) ?? '';
+                    }
+                    const attemptKey = defaultKey || byokCache || '';
+                    try {
+                        if (version === 3) {
+                            const m2 = attemptKey ? deriveRawKey(attemptKey) : master;
+                            plain = decryptV3(blob, m2, target.userId || '', target.id, i, chunks.length);
+                            activeMaster = m2;
+                        }
+                        else {
+                            plain = decryptAny(blob, attemptKey, {
+                                userId: target.userId, fileId: target.id, chunkIndex: i, totalChunks: chunks.length,
+                            }).plain;
+                        }
+                    }
+                    catch (err) {
+                        if (!attemptKey)
+                            throw new Error('BYOK_KEY_REQUIRED: pass --key or run interactively');
+                        throw err;
+                    }
+                    void activeMaster;
                 }
                 void fileKeyRaw;
                 progress.update(i + 1, `chunk ${i + 1}/${chunks.length}`);
@@ -338,17 +355,52 @@ export async function downloadFile(target, destPath, onProgress) {
             return finalPath2;
         }
         catch (e) {
-            errors.push(`cluster: ${e instanceof Error ? e.message : String(e)}`);
+            const msg = e instanceof Error ? e.message : String(e);
+            if (msg.startsWith('VAULT_KEY_DRIFT'))
+                throw e;
+            if (msg.startsWith('WEB_SESSION_REQUIRED')) {
+                // No fresh web JWT — fall back to signed-mode + vault key (no JWT needed).
+                try {
+                    const key0 = defaultKey || tagsKey || '';
+                    const usable = key0 && !/^(managed_key|sha256:.*|byok_encrypted|byok_protected)$/.test(key0);
+                    const vaultKey = usable ? key0 : await fetchVaultKey(target.id);
+                    if (!vaultKey && !usable && encrypted)
+                        throw new Error(msg);
+                    const sres = await apiRaw(`/download/${target.id}?signed=true`);
+                    if (!sres.ok)
+                        throw new Error(`signed HTTP ${sres.status}`);
+                    const smeta = (await sres.json());
+                    if (!smeta?.success || !smeta.signed_urls?.length)
+                        throw new Error('signed: empty');
+                    return await fetchDecryptWrite(smeta.signed_urls, target, destPath, onProgress, vaultKey ?? undefined, chunks.length);
+                }
+                catch (e2) {
+                    errors.push(`signed: ${e2 instanceof Error ? e2.message : String(e2)}`);
+                }
+            }
+            errors.push(`cluster: ${msg}`);
         }
     }
     throw new Error(errors.join(' · ') || 'No downloadable strategy succeeded');
 }
+let byokCache;
+async function askByokKey(fileName) {
+    if (byokCache !== undefined)
+        return byokCache;
+    if (!process.stdin.isTTY || process.env.SQUIDCLOUD_NONINTERACTIVE === '1')
+        return null;
+    const readline = await import('node:readline');
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((res) => rl.question(`\u25cf decryption key for ${fileName}: `, (v) => { rl.close(); res(v); }));
+    byokCache = answer.trim() || null;
+    return byokCache;
+}
 async function resolveKey(fileId, tagsKey) {
     if (tagsKey && !/^(managed_key|sha256:\S+|byok_encrypted|byok_protected)$/.test(tagsKey))
         return tagsKey;
     return fetchVaultKey(fileId);
 }
-async function fetchDecryptWrite(urls, target, destPath, onProgress) {
+async function fetchDecryptWrite(urls, target, destPath, onProgress, preKey, declaredChunks) {
     const totalChunks = urls.length;
     const finalPath = destPath || target.name;
     const out = fs.createWriteStream(finalPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squidcloudctl",
-  "version": "3.0.5",
+  "version": "3.0.7",
   "description": "SquidCloud CLI (squidcloudctl) — encrypted storage, shares and secrets from your terminal",
   "main": "dist/bin/squidcloud.js",
   "bin": {