telstore 0.1.0 → 0.1.2

package/src/commands/config.js

@@ -12,7 +12,7 @@ const GAP = '  '
 function unknownKey(name) {
   if (isManagedByLogin(name)) {
     return new Error(
-      `"${name}" is managed by "npx telark login", not by config. ` +
+      `"${name}" is managed by "npx telstore login", not by config. ` +
         `Settings you can change: ${SETTING_KEYS.join(', ')}.`,
     )
   }
@@ -37,7 +37,7 @@ function listLines(values, source, stored) {
     return [key, `${spec.format(value)}${note}`, source(key) === 'settings' ? '' : '(default)']
   })
 
-  // Keys telark does not know are left in the file untouched, but a value that silently
+  // Keys telstore does not know are left in the file untouched, but a value that silently
   // does nothing is worse than one that is refused: show them, so a typo is visible from
   // the command rather than only from opening the file that also holds the session.
   const strays = Object.keys(stored).filter((key) => !SETTING_KEYS.includes(key))
@@ -50,8 +50,8 @@ function listLines(values, source, stored) {
   if (strays.length > 0) {
     lines.push('')
     lines.push(
-      `Ignored, telark does not know these: ${strays.join(', ')}. ` +
-        'Remove one with: npx telark config <name> --unset',
+      `Ignored, telstore does not know these: ${strays.join(', ')}. ` +
+        'Remove one with: npx telstore config <name> --unset',
     )
   }
 
@@ -65,21 +65,21 @@ export async function runConfig(args = [], options = {}, deps = {}) {
   if (extra.length > 0) {
     throw new Error(
       `Too many arguments: a setting takes one value, but got ${args.length}. ` +
-        `Did you mean: npx telark config ${name} "${[value, ...extra].join(' ')}"`,
+        `Did you mean: npx telstore config ${name} "${[value, ...extra].join(' ')}"`,
     )
   }
 
   // Both of these would otherwise be obeyed halfway and reported as a success: a listing
   // that quietly dropped the --unset, or an unset that quietly dropped the value beside it.
   if (options.unset && name === undefined) {
-    throw new Error('--unset needs the setting to drop. Try: npx telark config chat --unset')
+    throw new Error('--unset needs the setting to drop. Try: npx telstore config chat --unset')
   }
 
   if (options.unset && value !== undefined) {
     throw new Error(
       `--unset takes no value, but "${value}" was given. ` +
-        `Use "npx telark config ${name} --unset" to drop it, ` +
-        `or "npx telark config ${name} ${value}" to set it.`,
+        `Use "npx telstore config ${name} --unset" to drop it, ` +
+        `or "npx telstore config ${name} ${value}" to set it.`,
     )
   }
 

package/src/commands/delete.js

@@ -56,7 +56,7 @@ function stateMessageIds(record) {
         throw new Error(
           `The record of unfinished backup ${record.state.id} gives ` +
             `${JSON.stringify(msgId)} as the message id of chunk ${Number(index) + 1}, which ` +
-            `is not a message id. ${record.file} is damaged, so telark is not deleting ` +
+            `is not a message id. ${record.file} is damaged, so telstore is not deleting ` +
             'anything.',
         )
       }
@@ -106,7 +106,7 @@ export async function runDelete(backupId, options = {}, deps = {}) {
   if (records.length > 1) {
     throw new Error(
       `Two local records both claim to be backup ${backupId}: ` +
-        `${records.map((r) => r.file).join(' and ')}. telark will not guess which one to ` +
+        `${records.map((r) => r.file).join(' and ')}. telstore will not guess which one to ` +
         'drop — remove the wrong one by hand and run again.',
     )
   }
@@ -120,7 +120,7 @@ export async function runDelete(backupId, options = {}, deps = {}) {
     if (!manifestMessage && !record) {
       throw new Error(
         `No backup ${backupId} found in ${chatName(chat)}, and no unfinished record of it on ` +
-          'this machine. Check the id with "npx telark list", or use --to to point at the ' +
+          'this machine. Check the id with "npx telstore list", or use --to to point at the ' +
           'right chat.',
       )
     }
@@ -131,7 +131,7 @@ export async function runDelete(backupId, options = {}, deps = {}) {
     if (manifestMessage) {
       manifest = parseManifestJson(await readMessageBytes(client, manifestMessage))
 
-      // The manifest was found by the file name telark itself wrote, and that name is the
+      // The manifest was found by the file name telstore itself wrote, and that name is the
       // id this command was asked about. A body naming a different backup is a file that was
       // renamed or replaced, and its message ids point at somebody else's chunks — the one
       // mistake in this whole command that nothing can undo.
@@ -139,7 +139,7 @@ export async function runDelete(backupId, options = {}, deps = {}) {
         throw new Error(
           `The manifest named ${manifestFileName(backupId)} describes backup ` +
             `${JSON.stringify(manifest.id)}, not ${backupId}. Its message ids point at ` +
-            'another backup\'s chunks, so telark is not deleting anything.',
+            'another backup\'s chunks, so telstore is not deleting anything.',
         )
       }
 

package/src/commands/list.js

@@ -36,7 +36,7 @@ function utcDay(unixSeconds) {
 }
 
 // The card is text in a chat, which means a person can edit or predate it. The id is the
-// one field restore cannot be wrong about, so it always comes from the file name telark
+// one field restore cannot be wrong about, so it always comes from the file name telstore
 // wrote; the caption only decorates. A card that cannot be read back leaves the rest
 // unknown, because inventing it would describe a backup that does not exist.
 function toRow(message) {
@@ -106,14 +106,14 @@ export async function runList(options = {}, deps = {}) {
     .map(toRow)
 
   if (rows.length === 0) {
-    log(`No backups found in ${chatName(chat)}. Upload one with: npx telark <file>`)
+    log(`No backups found in ${chatName(chat)}. Upload one with: npx telstore <file>`)
     return rows
   }
 
   for (const line of renderTable(rows)) log(line)
 
   log('')
-  log(`${rows.length} backup${rows.length === 1 ? '' : 's'}. Restore with: npx telark restore <backup-id>`)
+  log(`${rows.length} backup${rows.length === 1 ? '' : 's'}. Restore with: npx telstore restore <backup-id>`)
 
   return rows
 }

package/src/commands/login.js

@@ -1,21 +1,12 @@
-import readline from 'node:readline/promises'
-import { stdin, stdout } from 'node:process'
-
 import { TelegramClient } from 'telegram'
 import { StringSession } from 'telegram/sessions/index.js'
 
 import { loadConfig, saveConfig, defaultConfigDir } from '../config.js'
 import { normalizeChatTarget } from '../chat.js'
-import { createLogger } from '../client.js'
-import { resolveSettings } from '../settings.js'
-
-function createPrompts() {
-  const rl = readline.createInterface({ input: stdin, output: stdout })
-  return {
-    ask: (question) => rl.question(question),
-    close: () => rl.close(),
-  }
-}
+import { closeQuietly, connect as realConnect, createLogger } from '../client.js'
+import { createPrompts } from '../prompt.js'
+import { knownSettings, resolveSettings } from '../settings.js'
+import { decodeToken, isSealedToken } from '../token.js'
 
 const LOGIN_ERROR_MESSAGES = {
   PHONE_NUMBER_INVALID: 'invalid phone number',
@@ -43,14 +34,96 @@ export function describeLoginError(err) {
 const createTelegramClient = (apiId, apiHash, options) =>
   new TelegramClient(new StringSession(''), apiId, apiHash, options)
 
+// The token never reaches here as an argument, and telstore refuses to pretend otherwise: a
+// token on the command line sits in the shell history of a machine the user does not trust,
+// and ignoring it silently would leave it there for nothing.
+function refuseArguments(args) {
+  if (args.length === 0) return
+
+  throw new Error(
+    'login takes no arguments. A session token is pasted at a prompt, never written on the ' +
+      'command line — there it stays in this machine\'s shell history and is visible in "ps" ' +
+      'for as long as the command runs. Run "npx telstore login --token" and paste it when asked.',
+  )
+}
+
+// Logging in with a token telstore printed elsewhere. The blob is stored exactly as it
+// arrived rather than opened and written back out: what makes this worth doing is that the
+// session never exists on this machine's disk in a form anyone can read.
+async function loginWithToken({ configDir, prompts, connectWith, shutdown, verbose, log }) {
+  const token = (await prompts.askSecret('Session token: ')).trim()
+  const passphrase = isSealedToken(token) ? await prompts.askSecret('Passphrase for the token: ') : ''
+
+  // Opened here, before anything is written, so a wrong passphrase is a sentence now rather
+  // than a failure at the start of a restore that was going to take twenty minutes.
+  const bundle = await decodeToken(token, passphrase)
+  const account = { apiId: bundle.apiId, apiHash: bundle.apiHash, session: bundle.session }
+
+  // A token says what the session was when it was made. Only Telegram can say whether that
+  // session is still alive, and finding out now is the difference between a login that failed
+  // and a login that appeared to work.
+  const client = await connectWith(account, { verbose })
+
+  let me
+  try {
+    me = await client.getMe()
+  } finally {
+    await closeQuietly(client, shutdown)
+  }
+
+  const config = await loadConfig(configDir)
+  // Built fresh rather than merged over what was there: a config holding both a sealed
+  // session and a plain one is refused on the next run, and merging is how it would come to
+  // hold both. Settings are the exception, because they are nobody's secret.
+  const next = passphrase === '' ? { ...account } : { sealed: token }
+  const settings = { ...config.settings, ...knownSettings(bundle.settings) }
+
+  if (Object.keys(settings).length > 0) next.settings = settings
+
+  await saveConfig(next, configDir)
+
+  log(`\nLogged in as ${me.username ? `@${me.username}` : me.firstName}.`)
+
+  if (passphrase === '') {
+    log(
+      `Config saved to ${configDir}/config.json. This token had no passphrase, so the session ` +
+        'is stored here in plain text, exactly as an ordinary login would store it.',
+    )
+    return
+  }
+
+  log(
+    `Config saved to ${configDir}/config.json, with the session sealed behind your ` +
+      'passphrase. Every command that talks to Telegram will ask for it.',
+  )
+}
+
 export async function runLogin({
   configDir = defaultConfigDir(),
-  prompts = createPrompts(),
+  args = [],
+  token = false,
+  prompts = null,
+  connectWith = realConnect,
   verbose = false,
   createClient = createTelegramClient,
   shutdown = (client) => client.destroy(),
   log = (line) => console.log(line),
 } = {}) {
+  refuseArguments(args)
+
+  // Opened here and not in the parameter list: a default argument runs on every call, so the
+  // refusal above would open a readline on stdin it never reads from and the process would
+  // hang with nothing left to do.
+  prompts = prompts ?? createPrompts()
+
+  if (token) {
+    try {
+      return await loginWithToken({ configDir, prompts, connectWith, shutdown, verbose, log })
+    } finally {
+      prompts.close()
+    }
+  }
+
   const config = await loadConfig(configDir)
   const storedChat = config.settings?.chat
   const loud = verbose || resolveSettings({}, config).values.verbose
@@ -80,7 +153,7 @@ export async function runLogin({
   await client.start({
     phoneNumber: () => prompts.ask('Phone number (e.g. +1...): '),
     phoneCode: () => prompts.ask('Verification code Telegram just sent: '),
-    password: () => prompts.ask('Two-step password (leave blank if not enabled): '),
+    password: () => prompts.askSecret('Two-step password (leave blank if not enabled): '),
     onError: (err) => console.error(`Login failed: ${describeLoginError(err)}`),
   })
 

package/src/commands/logout.js

@@ -1,11 +1,21 @@
-import { clearSession, defaultConfigDir } from '../config.js'
+import { clearSession, defaultConfigDir, loadConfig } from '../config.js'
+
+// The same true fact in both cases — the session outlives this machine — but not the same
+// sentence about what is left behind. An ordinary login keeps the api_id and api_hash beside
+// the session, and a sealed one keeps them inside it, so there the api_hash goes too. Saying
+// otherwise would describe a machine other than the one in front of the reader.
+export async function runLogout({ configDir = defaultConfigDir(), log = (line) => console.log(line) } = {}) {
+  const { sealed } = await loadConfig(configDir)
 
-export async function runLogout({ configDir = defaultConfigDir() } = {}) {
   await clearSession(configDir)
-  console.log(
-    'Removed the session stored on this machine. api_id, api_hash and the destination are kept.',
+
+  log(
+    sealed
+      ? 'Removed the sealed session stored on this machine. The api_id and api_hash were ' +
+          'inside it, so they are gone with it; the destination is kept.'
+      : 'Removed the session stored on this machine. api_id, api_hash and the destination are kept.',
   )
-  console.log(
+  log(
     'Note: this only deletes the local copy — the session is still alive on Telegram\'s side. ' +
       'To revoke access for good, open Telegram → Settings → Devices (Active sessions) ' +
       'and terminate that session.',

package/src/commands/restore.js

@@ -28,8 +28,8 @@ async function realGetMessage(client, peer, msgId) {
   return message ?? null
 }
 
-export async function realDownloadChunk(client, message, handle, offset, onProgress, retryOptions) {
-  return await downloadToFile(client, message, handle.fd, { offset, onProgress, retryOptions })
+export async function realDownloadChunk(client, message, handle, offset, onProgress, options) {
+  return await downloadToFile(client, message, handle.fd, { offset, onProgress, ...options })
 }
 
 // manifest.name comes from data downloaded off Telegram — don't trust it when picking
@@ -78,7 +78,7 @@ export async function runRestore(backupId, options = {}, deps = {}) {
     if (delayMs > LONG_WAIT_MS) {
       warn(
         `\nTelegram wants ${formatDuration(delayMs / 1000)} of waiting before the next part ` +
-          `(${err.message}). telark is waiting and will carry on by itself, leave it running.\n`,
+          `(${err.message}). telstore is waiting and will carry on by itself, leave it running.\n`,
       )
       return
     }
@@ -112,7 +112,7 @@ export async function runRestore(backupId, options = {}, deps = {}) {
     const partial = `${target}.partial`
 
     // Only ENOENT means "no file yet". Treating a permission or I/O error as absence
-    // would have telark overwrite the user's file without asking.
+    // would have telstore overwrite the user's file without asking.
     let exists = true
     try {
       await fs.stat(target)
@@ -165,7 +165,10 @@ export async function runRestore(backupId, options = {}, deps = {}) {
             handle,
             chunk.i * manifest.chunkSize,
             progress.advance,
-            { ...retryOptions, onRetry },
+            {
+              retryOptions: { ...retryOptions, onRetry },
+              concurrency: settings.downloadConcurrency,
+            },
           )
 
           if (size !== chunk.size) {

package/src/commands/status.js

@@ -1,12 +1,10 @@
-import path from 'node:path'
-
 import { countChunks } from '../chunking.js'
 import { describeChat } from '../chat.js'
 import { assertLoggedIn, closeQuietly, connect as realConnect } from '../client.js'
 import { configFile, defaultConfigDir, loadConfig } from '../config.js'
 import { formatBytes } from '../progress.js'
 import { resolveSettings } from '../settings.js'
-import { listStates } from '../state.js'
+import { canResume, listStates } from '../state.js'
 
 const LABEL_WIDTH = 'Destination'.length + 2
 
@@ -14,6 +12,66 @@ function row(label, value) {
   return `${label.padEnd(LABEL_WIDTH)}${value}`
 }
 
+// Each unfinished backup gets its own indented block, so the fields line up under a heading
+// that is the id — the one string `restore` and `delete` both take.
+const FIELD_WIDTH = 'Resume'.length + 3
+const CONTINUATION = ' '.repeat(FIELD_WIDTH + 2)
+
+function field(label, value) {
+  return `  ${label.padEnd(FIELD_WIDTH)}${value}`
+}
+
+// The Resume line is a command meant to be pasted, so anything a shell would take apart has
+// to come back quoted — a path with a space in it is the ordinary case, not an exotic one.
+const BARE_ARG = /^[A-Za-z0-9_@%+:,./-]+$/
+
+function shellArg(text) {
+  const value = String(text)
+
+  return BARE_ARG.test(value) ? value : `'${value.replaceAll("'", `'\\''`)}'`
+}
+
+// runUpload refuses to send the rest of a backup to a different chat, so the command has to
+// name the one the chunks are already in — unless the destination in force is that chat
+// anyway, where --to would just be noise. Not knowing the destination counts as not matching:
+// leaving --to out would be a guess about where a backup already in progress went.
+function resumeCommand(state, destination) {
+  const matches = destination !== null && state.chat === String(destination)
+
+  return `npx telstore ${shellArg(state.path)}${matches ? '' : ` --to ${shellArg(state.chat)}`}`
+}
+
+// Why a resume is off the table, in the words of the thing the user would have to fix. The
+// record is keyed on the file's path, size and mtime, so any of these means runUpload would
+// hash the file to a different key, find nothing, and start a second backup instead.
+const NO_RESUME = {
+  missing: 'the file is no longer there',
+  changed: 'the file has changed since the backup started',
+  'not-a-file': 'that path is no longer a file',
+  unreadable: 'the record does not name a file that can be read',
+}
+
+// A command is printed only when it will really resume. Printing one regardless would be
+// telling the user to run something that quietly starts a second backup and abandons every
+// chunk this one already sent — and those chunks are then findable only by this id, which
+// is worth saying while there are any.
+async function resumeLines(key, state, destination, done) {
+  const check = await canResume(key, state)
+
+  if (check.ok) return [field('Resume', resumeCommand(state, destination))]
+
+  const lines = [field('Resume', `not possible: ${NO_RESUME[check.reason]}.`)]
+
+  if (done > 0) {
+    lines.push(
+      `${CONTINUATION}${done} chunk${done === 1 ? ' is' : 's are'} already in the chat, ` +
+        'searchable by this id.',
+    )
+  }
+
+  return lines
+}
+
 function describeAccount(me) {
   const name = [me.firstName, me.lastName].filter(Boolean).join(' ')
   const handle = me.username ? ` (@${me.username})` : ''
@@ -72,13 +130,24 @@ export async function runStatus(options = {}, deps = {}) {
     settingsError = err.message
   }
 
+  // Which config this report is about, and whether the session in it can be read. Printed
+  // unconditionally: status never said where it looked before, and a row that shows up only
+  // when something is unusual reads as a warning rather than as a fact.
+  log(
+    row(
+      'Session',
+      config.sealed
+        ? `${configFile(configDir)} (sealed — opened with a passphrase)`
+        : configFile(configDir),
+    ),
+  )
   log(row('Account', await accountLine(config, settings?.verbose ?? false, { connect, disconnect })))
   log(
     row(
       'Destination',
       settingsError ??
         (settings.chat === null
-          ? 'none set — run "npx telark config chat @my_backups" to set one'
+          ? 'none set — run "npx telstore config chat @my_backups" to set one'
           : describeChat(settings.chat)),
     ),
   )
@@ -92,11 +161,20 @@ export async function runStatus(options = {}, deps = {}) {
 
   log(row('Unfinished', `${states.length} backup${states.length === 1 ? '' : 's'}`))
 
-  for (const state of states) {
+  // The destination is what decides whether the resume command needs a --to. A row that
+  // failed to parse leaves nothing to compare against, which is not the same as a match.
+  const destination = settings?.chat ?? null
+
+  for (const { key, state } of states) {
     const total = countChunks(state.size, state.chunkSize)
     const done = Object.keys(state.done ?? {}).length
 
-    log(`  ${state.id}  ${path.basename(state.path)}  ${done}/${total} chunks  ${formatBytes(state.size)}`)
-    log(`  → ${describeChat(state.chat)}`)
+    log('')
+    log(`  ${state.id}`)
+    log(field('File', `${state.path}  (${formatBytes(state.size)})`))
+    log(field('Chunks', `${done} of ${total} uploaded`))
+    log(field('Chat', describeChat(state.chat)))
+
+    for (const line of await resumeLines(key, state, destination, done)) log(line)
   }
 }

package/src/commands/token.js

@@ -0,0 +1,80 @@
+import { assertLoggedIn } from '../client.js'
+import { defaultConfigDir, loadConfig } from '../config.js'
+import { createPrompts } from '../prompt.js'
+import { unlockConfig } from '../session.js'
+import { knownSettings } from '../settings.js'
+import { encodeToken } from '../token.js'
+
+// Short enough that whoever holds the token can work through the possibilities faster than
+// scrypt can slow them down. Not a rule — a length minimum is a preference wearing a check's
+// clothes, and the main thing one teaches is to append digits — so this warns and goes on.
+const SHORT_PASSPHRASE = 12
+
+export async function runToken(args = [], options = {}, deps = {}) {
+  const {
+    configDir = defaultConfigDir(),
+    prompts = null,
+    log = (line) => console.log(line),
+    writeErr = (line) => process.stderr.write(line),
+  } = deps
+
+  const config = await loadConfig(configDir)
+
+  // Before anything is asked for. Someone who has never logged in should be told that, not
+  // asked to invent a passphrase for an account that is not there.
+  assertLoggedIn(config)
+
+  // Opened here rather than in the parameter list, so the command that refuses above never
+  // touches stdin. Every question in this run goes through this one interface: asking each
+  // through its own would leave the second one at end-of-input having read nothing.
+  const ask = prompts ?? createPrompts({ output: process.stderr })
+
+  try {
+    return await mint(config, ask, { log, writeErr })
+  } finally {
+    ask.close()
+  }
+}
+
+async function mint(config, ask, { log, writeErr }) {
+  const readSecret = (question) => ask.askSecret(question)
+  const account = await unlockConfig(config, { readSecret })
+
+  const passphrase = await readSecret('Passphrase to protect the token: ')
+  const again = await readSecret('Repeat it: ')
+
+  if (passphrase !== again) {
+    throw new Error('The two passphrases are different. Nothing was printed — run the command again.')
+  }
+
+  if (passphrase === '') {
+    writeErr(
+      'This token has no passphrase, so anyone who reads it can use your Telegram account. ' +
+        'Do not send it through anything that keeps a copy.\n',
+    )
+  } else if (passphrase.length < SHORT_PASSPHRASE) {
+    writeErr(
+      `That passphrase is ${passphrase.length} characters. Whoever holds the token can try ` +
+        'passphrases offline as fast as their hardware allows, and telstore can only make ' +
+        'each attempt cost about half a second.\n',
+    )
+  }
+
+  // The same true fact logout already states, said the same way: telstore cannot take a token
+  // back, and the session it carries outlives every copy of the token.
+  writeErr(
+    'This token carries your Telegram session. telstore cannot take it back — as with ' +
+      'logout, the session stays alive on Telegram\'s side until you open Telegram → ' +
+      'Settings → Devices (Active sessions) and terminate it. It is about to be printed ' +
+      'here, so it will sit in this terminal\'s scrollback until you clear it.\n\n',
+  )
+
+  // stdout carries the token and nothing else, the rule `config <name>` already follows, so
+  // this can be piped into a QR encoder with every warning above still on the screen.
+  log(
+    await encodeToken(
+      { ...account, settings: knownSettings(config.settings) },
+      passphrase,
+    ),
+  )
+}

package/src/commands/upload.js

@@ -95,7 +95,7 @@ export async function runUpload(filePath, options = {}, deps = {}) {
     file: configFile(configDir),
   })
   const chat = requireChat(settings)
-  const concurrency = settings.concurrency
+  const concurrency = settings.uploadConcurrency
 
   const key = stateKey(absPath, stat.size, stat.mtimeMs)
 
@@ -103,7 +103,7 @@ export async function runUpload(filePath, options = {}, deps = {}) {
 
   // The chunks already in the chat were cut at the size this backup started with, and
   // nothing can re-cut them. Carrying on at a different size would abandon every one of
-  // them in the chat, where telark can no longer find them — so an unfinished backup
+  // them in the chat, where telstore can no longer find them — so an unfinished backup
   // keeps its own chunk size, and a flag that disagrees is refused rather than obeyed.
   //
   // Only a flag is a disagreement. A configured chunkSize says what to use when nobody asks
@@ -164,10 +164,10 @@ export async function runUpload(filePath, options = {}, deps = {}) {
 
     // Only a new backup adds to the directory, so this is the one place it can grow.
     // The report goes out even when the caller asked for silence: this is not narration
-    // about a transfer, it is telark dropping the only record of someone else's chunks.
+    // about a transfer, it is telstore dropping the only record of someone else's chunks.
     for (const gone of await pruneStates(configDir)) {
       writeErr(
-        `\nDropped the record of unfinished backup ${gone.id}: telark keeps the ` +
+        `\nDropped the record of unfinished backup ${gone.id}: telstore keeps the ` +
           `${MAX_STATES} most recent. The chunks it sent are still in ${gone.chat}, ` +
           'searchable by that id, but that backup can no longer be resumed.\n',
       )
@@ -185,7 +185,7 @@ export async function runUpload(filePath, options = {}, deps = {}) {
     if (delayMs > LONG_WAIT_MS) {
       warn(
         `\nTelegram wants ${formatDuration(delayMs / 1000)} of waiting before the next send ` +
-          `(${err.message}). telark is waiting and will carry on by itself, leave it running.\n`,
+          `(${err.message}). telstore is waiting and will carry on by itself, leave it running.\n`,
       )
       return
     }
@@ -289,7 +289,7 @@ export async function runUpload(filePath, options = {}, deps = {}) {
       throw new Error(
         `${absPath} changed during the upload ` +
           `(size ${stat.size} → ${after.size}, mtime ${stat.mtimeMs} → ${after.mtimeMs}). ` +
-          'This backup mixes old and new data and cannot be trusted — telark is not sending the manifest. ' +
+          'This backup mixes old and new data and cannot be trusted — telstore is not sending the manifest. ' +
           'Wait until the file settles, then run again to create a new backup.',
       )
     }
@@ -316,7 +316,7 @@ export async function runUpload(filePath, options = {}, deps = {}) {
 
     await clearState(key, configDir)
 
-    log(`\nDone. Restore with:\n  npx telark restore ${state.id}`)
+    log(`\nDone. Restore with:\n  npx telstore restore ${state.id}`)
 
     return { id: state.id, chunks: chunks.length }
   } finally {

package/src/config.js

@@ -5,7 +5,7 @@ import path from 'node:path'
 const FILE_NAME = 'config.json'
 
 export function defaultConfigDir() {
-  return path.join(os.homedir(), '.telark')
+  return path.join(os.homedir(), '.telstore')
 }
 
 export function configFile(dir = defaultConfigDir()) {
@@ -19,7 +19,7 @@ function isPlainObject(value) {
 // `config.json` is hand-editable now that the `config` command invites people into it,
 // which puts it in the same category as a manifest or a state file: believed only after it
 // has been checked. A `settings` that is not an object would make every lookup below it
-// return undefined, and telark would then run happily on built-in defaults while the
+// return undefined, and telstore would then run happily on built-in defaults while the
 // user's own choices sat there ignored — so it is named and refused instead.
 export function checkConfigShape(raw, file) {
   if (!isPlainObject(raw)) {
@@ -32,11 +32,31 @@ export function checkConfigShape(raw, file) {
   if (raw.settings !== undefined && !isPlainObject(raw.settings)) {
     throw new Error(
       `"settings" in ${file} holds ${Array.isArray(raw.settings) ? 'a list' : typeof raw.settings}, ` +
-        'not a group of settings. telark will not guess what was meant — fix that entry, ' +
+        'not a group of settings. telstore will not guess what was meant — fix that entry, ' +
         'or remove it to fall back to the defaults.',
     )
   }
 
+  // What `login --token` leaves behind: the session and the api_hash sealed inside one blob
+  // that only a passphrase opens. It is read by `connect`, never by anything that writes.
+  if (raw.sealed !== undefined && typeof raw.sealed !== 'string') {
+    throw new Error(
+      `"sealed" in ${file} holds ${Array.isArray(raw.sealed) ? 'a list' : typeof raw.sealed}, ` +
+        'not a sealed session. Log in again with "npx telstore login --token", or remove that ' +
+        'entry and log in with a phone number.',
+    )
+  }
+
+  // Two sources of truth for one account, and nothing to say which one was meant. Guessing
+  // would mean connecting as an account the user did not choose — either the stale one they
+  // thought they had replaced, or the one they thought they had left behind.
+  if (raw.sealed !== undefined && (raw.session !== undefined || raw.apiHash !== undefined)) {
+    throw new Error(
+      `${file} holds both a sealed session and a plain one. telstore will not guess which ` +
+        'account was meant — delete the file and log in again.',
+    )
+  }
+
   return raw
 }
 
@@ -57,7 +77,7 @@ export async function loadConfig(dir = defaultConfigDir()) {
   } catch (err) {
     throw new Error(
       `Corrupt config file: ${file} is not valid JSON (${err.message}). ` +
-        'Fix the syntax to keep your session, or delete the file and run "telark login" again.',
+        'Fix the syntax to keep your session, or delete the file and run "telstore login" again.',
     )
   }
 
@@ -79,8 +99,12 @@ export async function saveConfig(config, dir = defaultConfigDir()) {
   await writeJsonAtomic(configFile(dir), config)
 }
 
+// Both shapes go, because they are the same thing written two ways. On a machine that logged
+// in with a token the api_hash lives inside the sealed blob, so keeping it "like an ordinary
+// logout does" would keep the entire account.
 export async function clearSession(dir = defaultConfigDir()) {
   const config = await loadConfig(dir)
   delete config.session
+  delete config.sealed
   await saveConfig(config, dir)
 }