6 Commits

Include renames

Author	SHA1	Message	Date
sneak	096a8cf5a7	Validate session snapshots and wipe keys on logout (closes #10) ... Client.fromJSON checks every snapshot field and each key's decoded length and throws an error naming the bad field. toJSON reads the token through a new ApiClient.getAuthToken and throws when there is none. logout zeroes the key buffers in place; collectionsSince re-checks for logout after its request so it never decrypts with zeroed keys. The CLI now reports a corrupt session file separately from a missing one. Model: opus-5-5	2026-09-22 23:42:28 +00:00
clawbot	42a6c17d49	Resumable, deletion-aware collection and file enumeration (closes #38) ... Adds collectionsSince/filesSince taking a starting cursor, returning the resumable max-updationTime cursor and a separate list of tombstoned ids; filesSince throws instead of looping when the server reports hasMore without advancing (closes #7). listCollections/listFiles stay as thin, unaffected wrappers. Model: opus-4-8	2026-09-22 12:37:09 +02:00
sneak	cb9ac29cb4	Red: listCollections must drop deleted-collection tombstones ... /collections/v2 is a sync API: deleted collections remain in the response forever with isDeleted: true, and their /collections/v2/diff endpoint returns HTTP 404. A long-lived account accumulates hundreds of tombstones, so any caller that iterates listCollections() output (backup, backup-metadata) dies on the first one.	2026-06-10 11:49:11 -07:00
sneak	59e0aa7d47	Red: shared collections arrive as sealed boxes with no keyDecryptionNonce ... Collections shared with the account are not encrypted with the master key: the sharer only knows the recipient's public key, so the server delivers encryptedKey as crypto_box_seal to that key and omits keyDecryptionNonce entirely. decryptCollection assumed the owned-only wire format and crashed on fromBase64(undefined) for any account with an incoming shared album, taking down listCollections and every command built on it (backup, backup-metadata, ...). The previous "shared" fixture was unfaithful (secretbox + nonce with a foreign ownerID, a shape the server never sends), which is why the suite stayed green. These tests model the real wire format and change decryptCollection to take the full key material {masterKey, publicKey, secretKey} so it can unseal shared collection keys.	2026-06-10 11:41:36 -07:00
sneak	d8a4b0291e	Rename quack to quak ... German for 'quack', matching the Ente (German for 'duck') naming. All references updated: package name, CLI binary, X-Client-Package header, test descriptions, temp dir prefixes, README, Makefile docker tag.	2026-05-13 18:02:55 -07:00
sneak	ca6857d3fe	Client class red: literate usage tests and stub ... test/client/usage.test.ts is a tutorial-as-test-suite that walks through the entire quack API in order: login, whoami, listCollections, listFiles, downloadFile, downloadThumbnail, toJSON/fromJSON, logout. Each it() block is a self-contained example with prose commentary explaining what the code does and why, with code samples showing the API as a consumer would use it. The mock server performs real SRP and crypto so the test data is structurally identical to production. 8 tests, all failing against the stub.	2026-05-13 17:59:18 -07:00