squidcloudctl 3.0.6 → 3.0.8

package/dist/bin/squidcloud.js

@@ -107,6 +107,7 @@ const OPTIONS = {
         ['--max-body <size>', 'Body cap like 512mb / 64mb'],
         ['--allow-ips <ips>', 'Comma-separated allowlist'],
     ],
+    'fs webdav': [['--port <n>', 'WebDAV port (default 8099)']],
     'fs mount': [
         ['--mount <path>', 'FUSE mount point'],
         ['--webdav', 'Force WebDAV mode'],

package/dist/lib/transfer.js

@@ -154,30 +154,35 @@ async function fetchVaultKey(fileId) {
     }
 }
 async function getBridgeKey() {
-    if (process.env.SQUIDCLOUD_API_KEY)
-        return process.env.SQUIDCLOUD_API_KEY;
+    if (process.env.SQUIDCLOUD_API_KEY) {
+        const k = process.env.SQUIDCLOUD_API_KEY;
+        return k.startsWith('cb_') ? k : `cb_${k}`;
+    }
     const fs2 = await import('node:fs');
     const os2 = await import('node:os');
     const path2 = await import('node:path');
     const keyFile = path2.join(os2.homedir(), '.squidcloud', 'bridge-key.json');
     try {
         const cached = JSON.parse(fs2.readFileSync(keyFile, 'utf8'));
-        if (cached?.key?.startsWith('cb_'))
-            return cached.key;
+        const k = cached?.key ?? '';
+        if (k.startsWith('cb_'))
+            return k;
+        if (k.length >= 32)
+            return `cb_${k}`;
     }
     catch { }
     const created = await apiPost('/keys', {
         name: 'cli-bridge-' + new Date().toISOString().slice(0, 10),
     });
-    const key = created?.raw_key;
-    if (!key)
-        throw new Error('Could not provision bridge key');
+    const raw = created?.raw_key;
+    if (!raw)
+        throw new Error('Could not provision a bridge API key');
     try {
         fs2.mkdirSync(path2.dirname(keyFile), { recursive: true });
-        fs2.writeFileSync(keyFile, JSON.stringify({ key, id: created?.key?.id }), { mode: 0o600 });
+        fs2.writeFileSync(keyFile, JSON.stringify({ key: `cb_${raw}`, minted_at: Date.now() }), { mode: 0o600 });
     }
     catch { }
-    return key;
+    return `cb_${raw}`;
 }
 function parseTags(rawTags) {
     let cur = rawTags;
@@ -358,9 +363,40 @@ export async function downloadFile(target, destPath, onProgress) {
             const msg = e instanceof Error ? e.message : String(e);
             if (msg.startsWith('VAULT_KEY_DRIFT'))
                 throw e;
+            if (msg.startsWith('WEB_SESSION_REQUIRED')) {
+                // No fresh web JWT — fall back to signed-mode + vault key (no JWT needed).
+                try {
+                    const key0 = defaultKey || tagsKey || '';
+                    const usable = key0 && !/^(managed_key|sha256:.*|byok_encrypted|byok_protected)$/.test(key0);
+                    const vaultKey = usable ? key0 : await fetchVaultKey(target.id);
+                    if (!vaultKey && !usable && encrypted)
+                        throw new Error(msg);
+                    const sres = await apiRaw(`/download/${target.id}?signed=true`);
+                    if (!sres.ok)
+                        throw new Error(`signed HTTP ${sres.status}`);
+                    const smeta = (await sres.json());
+                    if (!smeta?.success || !smeta.signed_urls?.length)
+                        throw new Error('signed: empty');
+                    return await fetchDecryptWrite(smeta.signed_urls, target, destPath, onProgress, vaultKey ?? undefined, chunks.length);
+                }
+                catch (e2) {
+                    errors.push(`signed: ${e2 instanceof Error ? e2.message : String(e2)}`);
+                }
+            }
             errors.push(`cluster: ${msg}`);
         }
     }
+    // ── Strategy C: SquidFS bridge (files written through the mount) ──
+    if (chunks.length > 0 && chunks.some((c) => c.repo !== 'b2')) {
+        try {
+            const apiKey = await getBridgeKey();
+            const urls = await bridgeResolve(apiKey, chunks.map((c) => ({ path: c.path, index: c.index, bucket: c.bucket })));
+            return await fetchDecryptWrite(urls, target, destPath, onProgress);
+        }
+        catch (e) {
+            errors.push(`squidfs-bridge: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
     throw new Error(errors.join(' · ') || 'No downloadable strategy succeeded');
 }
 let byokCache;
@@ -380,7 +416,7 @@ async function resolveKey(fileId, tagsKey) {
         return tagsKey;
     return fetchVaultKey(fileId);
 }
-async function fetchDecryptWrite(urls, target, destPath, onProgress) {
+async function fetchDecryptWrite(urls, target, destPath, onProgress, preKey, declaredChunks) {
     const totalChunks = urls.length;
     const finalPath = destPath || target.name;
     const out = fs.createWriteStream(finalPath);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "squidcloudctl",
-  "version": "3.0.6",
+  "version": "3.0.8",
   "description": "SquidCloud CLI (squidcloudctl) — encrypted storage, shares and secrets from your terminal",
   "main": "dist/bin/squidcloud.js",
   "bin": {