feat(files): @shade/files 0.3.0 — E2EE filesystem RPC primitive
M-Files-1..6 land the full files-RPC layer + everything 0.3.0 needs to
ship. Apps keep their own UI; this layer ships the typed RPC, the
streams bridge for content I/O, and production hooks (rate limit,
retention, fingerprint gate, metrics).
@shade/files (NEW)
- Standard ops: list/stat/mkdir/delete/move/read/write/getThumbnail with
Zod-validated wire schemas + clean user-handler types.
- Custom ops: typed via TypeScript declaration merging on CustomOpsMap
+ per-op Zod schemas; client.custom('app.foo', {...}) is fully typed.
- Content I/O: inline (≤ 256 KiB plaintext) base64-in-RPC; streams
(> 256 KiB) ride @shade/transfer via userMetadata.shadeFilesWriteId
/ shadeFilesReadStreamId correlation. Server-side TransformStream
bridges accept inbound transfers immediately (engine rejects chunks
that arrive before accept) and park the readable for the matching
RPC.
- Directory ops: walk(path, opts) async-iterable depth-first walker;
uploadDirectory()/downloadDirectory() with bounded concurrency pool
(default 4, cap 16), aggregated progress, abort.
- Production hooks (callback-based, vendor-neutral): rate-limit (op +
byte), idempotency cache (LRU + TTL + in-flight de-dupe), path
policy (traversal + percent-decode hardening), fingerprint gate
(required/optional/reject), pluggable Ed25519 sig verification with
±5 min replay window, onMetric sink (standard names).
- React hooks (subpath @shade/files/react): ShadeFilesProvider,
useShadeFiles, useFileList, useFileTransfer/Upload/Download.
- Shade.files.serve(handler) + Shade.files.client(peer) high-level
entrypoint in @shade/sdk; lazy + memoized; one handler per Shade.
Wire format bump
- @shade/proto wire VERSION 0x01 → 0x02. Length prefixes changed from
u16 to u32. The previous u16 silently truncated payloads above
64 KiB — a hard correctness ceiling that blocked inline file ops
up to 256 KiB. Wire-incompatible with 0.2.x peers; new sessions
only. Cross-platform Kotlin port (android/shade-android) updated to
match; test-vectors/wire-format.json regenerated.
Concurrency safety
- ShadeSessionManager.encrypt/.decrypt now run under per-peer mutex.
Concurrent decryptions of the same peer raced ratchet state
(manifested as sporadic "Failed to decrypt — wrong key or tampered
data" under load — surfaced once concurrent uploadDirectory pumped
many writes in flight). Encrypt was already serialized via
Shade.send's encryptChains; decrypt is now serialized at the
manager layer too.
@shade/streams extension
- StreamMetadata.userMetadata?: Record<string, string> for
application-level key/value pairs that round-trip verbatim through
stream-init plaintext. Used by @shade/files for write/read
correlation; available to any consumer.
@shade/sdk extension
- Shade.files getter (lazy + memoized).
- BackgroundHooks.onPruneFiles + periodic timer (default 5 min) +
BackgroundTasks.setHook(name, fn) for runtime hook registration.
Bundles in-flight 0.2.0 work
- packages/shade-streams/, packages/shade-transfer/, related
shade-sdk streams-bridge + shade-widgets transfer hooks were
uncommitted prior to this session. Including them keeps the
workspace consistent at 0.3.0 since @shade/files depends on them.
Tests
- 74 new tests in @shade/files (572 → 646 workspace pass; 0 fail;
3× stable). Coverage spans unit (inline-threshold + concurrency),
integration (read-write inline + streams up to 1 MiB, walk +
upload/download directory, custom-op, metrics, SDK namespace
end-to-end), and security (tampered-envelope sig verification,
replay window, fingerprint gate, rate-limit + quota).
Release artifacts
- All packages bumped to 0.3.0 via scripts/bump-version.ts.
- scripts/publish-all.ts PACKAGES updated with shade-files in
topological order (after shade-transfer, before shade-sdk).
- bun run publish:dry clean (14 packed, 0 failed).
- examples/08-files-browser/ — three-process CLI demo (prekey + Bob
server + Alice CLI) covering list/stat/mkdir/delete/upload/download.
- docs/files.md — full API + design doc.
- CHANGELOG.md 0.3.0 entry.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 14:00:01 +02:00
|
|
|
// Schemas — Zod runtime + compile-time types
|
|
|
|
|
export * from './schemas/index.js';
|
|
|
|
|
|
|
|
|
|
// Protocol primitives — kinds, correlation, canonical bytes, envelope codec
|
|
|
|
|
export {
|
|
|
|
|
SHADE_FILES_VERSION,
|
|
|
|
|
KIND_PREFIX,
|
|
|
|
|
SUPPORTED_KINDS,
|
|
|
|
|
isSupportedKind,
|
|
|
|
|
} from './protocol/version.js';
|
|
|
|
|
export type { SupportedKind } from './protocol/version.js';
|
|
|
|
|
export {
|
|
|
|
|
KIND_LIST_V1,
|
|
|
|
|
KIND_STAT_V1,
|
|
|
|
|
KIND_MKDIR_V1,
|
|
|
|
|
KIND_DELETE_V1,
|
|
|
|
|
KIND_MOVE_V1,
|
|
|
|
|
KIND_READ_V1,
|
|
|
|
|
KIND_WRITE_V1,
|
|
|
|
|
KIND_GET_THUMBNAIL_V1,
|
|
|
|
|
KIND_CUSTOM_V1,
|
|
|
|
|
KIND_ERROR_V1,
|
|
|
|
|
KIND_CANCEL_V1,
|
|
|
|
|
responseKindOf,
|
|
|
|
|
opOfKind,
|
|
|
|
|
MUTATION_OPS,
|
|
|
|
|
} from './protocol/kinds.js';
|
|
|
|
|
export type { StandardOp } from './protocol/kinds.js';
|
|
|
|
|
export {
|
|
|
|
|
generateRequestId,
|
|
|
|
|
generateIdempotencyKey,
|
|
|
|
|
base64UrlEncode,
|
|
|
|
|
base64UrlDecode,
|
|
|
|
|
} from './protocol/correlate.js';
|
|
|
|
|
export {
|
|
|
|
|
canonicalRpcBytes,
|
|
|
|
|
canonicalJsonStringify,
|
|
|
|
|
hashArgs,
|
|
|
|
|
bytesToHex,
|
|
|
|
|
bytesToBase64,
|
|
|
|
|
base64ToBytes,
|
|
|
|
|
} from './protocol/canonical.js';
|
|
|
|
|
export {
|
|
|
|
|
encodeEnvelope,
|
|
|
|
|
looksLikeFileEnvelope,
|
|
|
|
|
tryParseEnvelope,
|
|
|
|
|
classify,
|
|
|
|
|
} from './protocol/envelope-codec.js';
|
|
|
|
|
export type { ClassifiedEnvelope } from './protocol/envelope-codec.js';
|
|
|
|
|
|
|
|
|
|
// RPC channel — wires Shade.send/onMessage to the file-RPC routing layer
|
|
|
|
|
export { ShadeFileRpcChannel } from './rpc/channel.js';
|
|
|
|
|
export type { RpcChannelHooks } from './rpc/channel.js';
|
|
|
|
|
export { PendingRpcRegistry } from './rpc/pending.js';
|
|
|
|
|
export type { RegisterOptions } from './rpc/pending.js';
|
|
|
|
|
|
|
|
|
|
// Server side
|
|
|
|
|
export { createFileHandler, INTERNAL_SYMBOL } from './server/handler.js';
|
|
|
|
|
export type {
|
|
|
|
|
FileHandler,
|
|
|
|
|
FileHandlerConfig,
|
|
|
|
|
FileHandlerOps,
|
|
|
|
|
} from './server/handler.js';
|
|
|
|
|
export type { OpContext, OpKind } from './server/handler-context.js';
|
|
|
|
|
export { validatePath } from './server/path-policy.js';
|
|
|
|
|
export type { PathPolicy, PathValidationResult } from './server/path-policy.js';
|
|
|
|
|
export { IdempotencyCache } from './server/idempotency-cache.js';
|
|
|
|
|
export type { IdempotencyCacheOptions } from './server/idempotency-cache.js';
|
|
|
|
|
export { RateLimiter } from './server/rate-limiter.js';
|
|
|
|
|
export type { RateLimitConfig } from './server/rate-limiter.js';
|
|
|
|
|
export { createCursorBuilder } from './server/cursor.js';
|
|
|
|
|
export type { CursorBuilder } from './server/cursor.js';
|
|
|
|
|
export {
|
|
|
|
|
createServerStreamsBridge,
|
|
|
|
|
META_KEY_READ_STREAM_ID,
|
|
|
|
|
META_KEY_WRITE_ID,
|
|
|
|
|
} from './server/streams-bridge.js';
|
|
|
|
|
export type {
|
|
|
|
|
ServerStreamsBridge,
|
|
|
|
|
StreamsBridgeShade,
|
|
|
|
|
CreateServerStreamsBridgeOptions,
|
|
|
|
|
ParkedWrite,
|
|
|
|
|
AwaitWriteOptions,
|
|
|
|
|
} from './server/streams-bridge.js';
|
|
|
|
|
export type {
|
|
|
|
|
UserReadResult,
|
|
|
|
|
UserReadResultInline,
|
|
|
|
|
UserReadResultStreams,
|
|
|
|
|
UserWriteArgs,
|
|
|
|
|
UserWriteContent,
|
|
|
|
|
UserWriteContentInline,
|
|
|
|
|
UserWriteContentStreams,
|
|
|
|
|
UserThumbnailResult,
|
|
|
|
|
} from './server/io-types.js';
|
|
|
|
|
export {
|
|
|
|
|
assertThumbnailFormat,
|
|
|
|
|
isThumbnailFormat,
|
|
|
|
|
} from './server/thumbnail.js';
|
|
|
|
|
export type { ThumbnailFormat } from './server/thumbnail.js';
|
|
|
|
|
|
|
|
|
|
// Client side
|
|
|
|
|
export { createFileClient } from './client/client.js';
|
|
|
|
|
export type {
|
|
|
|
|
FileClient,
|
|
|
|
|
BaseOpts,
|
|
|
|
|
CreateFileClientOptions,
|
|
|
|
|
ReadOpts,
|
|
|
|
|
WriteOpts,
|
|
|
|
|
ReadOutput,
|
|
|
|
|
ReadInlineOutput,
|
|
|
|
|
ReadStreamsOutput,
|
|
|
|
|
ThumbnailResult,
|
|
|
|
|
} from './client/client.js';
|
|
|
|
|
export {
|
|
|
|
|
createClientStreamsBridge,
|
|
|
|
|
} from './client/streams-bridge.js';
|
|
|
|
|
export type {
|
|
|
|
|
ClientStreamsBridge,
|
|
|
|
|
CreateClientStreamsBridgeOptions,
|
|
|
|
|
AwaitReadOptions,
|
|
|
|
|
ParkedRead,
|
|
|
|
|
} from './client/streams-bridge.js';
|
|
|
|
|
export {
|
|
|
|
|
decideInline,
|
|
|
|
|
INLINE_THRESHOLD,
|
|
|
|
|
} from './client/inline-threshold.js';
|
|
|
|
|
export type {
|
|
|
|
|
InlineDecision,
|
|
|
|
|
WriteSource,
|
|
|
|
|
} from './client/inline-threshold.js';
|
|
|
|
|
|
|
|
|
|
// Directory ops — walk + bulk transfers
|
|
|
|
|
export { walk } from './client/walk.js';
|
|
|
|
|
export type { WalkOpts, WalkItem } from './client/walk.js';
|
|
|
|
|
export { uploadDirectory } from './client/upload-directory.js';
|
|
|
|
|
export type { UploadDirectoryOptions } from './client/upload-directory.js';
|
|
|
|
|
export { downloadDirectory } from './client/download-directory.js';
|
|
|
|
|
export type { DownloadDirectoryOptions } from './client/download-directory.js';
|
|
|
|
|
export { runWithConcurrency } from './client/concurrency.js';
|
|
|
|
|
export type { ConcurrentMapOptions } from './client/concurrency.js';
|
|
|
|
|
export {
|
|
|
|
|
DEFAULT_BULK_CONCURRENCY,
|
|
|
|
|
MAX_BULK_CONCURRENCY,
|
|
|
|
|
} from './client/directory-types.js';
|
|
|
|
|
export type {
|
|
|
|
|
BulkOpts,
|
|
|
|
|
BulkTransferEvent,
|
|
|
|
|
BulkTransferHandle,
|
|
|
|
|
BulkTransferResult,
|
|
|
|
|
DirectoryHandleLike,
|
|
|
|
|
FileHandleLike,
|
|
|
|
|
FileLike,
|
|
|
|
|
WritableStreamLike,
|
|
|
|
|
} from './client/directory-types.js';
|
|
|
|
|
export { createMemoryDirectory } from './client/memory-directory.js';
|
|
|
|
|
|
|
|
|
|
// Custom-op registry typing (declaration-merged by consumers)
|
|
|
|
|
export type {
|
|
|
|
|
CustomOpDef,
|
|
|
|
|
CustomOpsMap,
|
|
|
|
|
CustomOpRegistration,
|
|
|
|
|
CustomOpRegistrations,
|
|
|
|
|
} from './server/custom-ops.js';
|
|
|
|
|
|
|
|
|
|
// Production hooks: metrics
|
|
|
|
|
export {
|
|
|
|
|
METRIC_BYTES_IN,
|
|
|
|
|
METRIC_BYTES_OUT,
|
|
|
|
|
METRIC_FINGERPRINT_REJECT_TOTAL,
|
|
|
|
|
METRIC_IDEMPOTENCY_CONFLICT_TOTAL,
|
|
|
|
|
METRIC_IDEMPOTENCY_HIT_TOTAL,
|
|
|
|
|
METRIC_OP_DURATION_MS,
|
|
|
|
|
METRIC_OP_TOTAL,
|
|
|
|
|
METRIC_RATE_LIMIT_REJECT_TOTAL,
|
|
|
|
|
METRIC_SIGNATURE_REJECT_TOTAL,
|
|
|
|
|
NOOP_METRIC_SINK,
|
|
|
|
|
} from './server/metrics.js';
|
|
|
|
|
export type { MetricSink, MetricTags } from './server/metrics.js';
|
|
|
|
|
|
|
|
|
|
export { MAX_SIGNATURE_AGE_MS } from './server/handler.js';
|
|
|
|
|
|
|
|
|
|
// High-level SDK integration entrypoint
|
|
|
|
|
export { createFilesNamespace } from './integration/files-namespace.js';
|
|
|
|
|
export type { FilesNamespace } from './integration/files-namespace.js';
|
|
|
|
|
|
release(v4.1.0): browser-friendly HTTP RPC for @shade/files
Default shade.files.client(peer) requires both peers to be mutually
addressable over HTTP — the response round-trips through
Shade.deliverControlEnvelope (POST to peer's /v1/transfer/control).
Browser tabs can't host an HTTP server, so they couldn't consume
@shade/files at all. Dispatch's filutforsker (admin-panel browser UI)
is the canonical use-case.
This release adds a parallel request-response transport: one POST per
RPC, encrypted envelope in the body, encrypted response in the same
HTTP response. No inbound channel needed on the client.
### New API
- shade.files.rpcRoute(opts?) — Hono app exposing POST /rpc.
- shade.files.httpClient(peer, opts) — request-response FileClient.
- FilesNamespace.serve(handler, { inlineOnly: true }) — skip streams-
bridge (and its configureTransfers pre-condition); also skip
channel-based dispatch so requests aren't double-dispatched.
### Limitations (v1)
Inline only (≤ 256 KiB). Streamed reads/writes throw clear errors
directing to shade.files.client(peer) on a server-to-server deploy.
### Tests
7 integration tests in tests/integration/http-rpc.test.ts covering
round-trip + negative cases (sender header, empty/garbage body,
maxBodyBytes, rpcRoute-without-serve).
### Symmetry
Mirrors @shade/server's shade-auth-middleware: encrypted envelope in
request body, decrypted via existing ratchet, response in same HTTP
roundtrip. No WebSocket, no SSE, no outbound from server.
Wire-compatible. Source-compatible. Lockstep bump to 4.1.0.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-03 22:08:14 +02:00
|
|
|
// Request-response HTTP transport — for browser-style consumers
|
|
|
|
|
// (one HTTP POST per RPC, no inbound channel needed). See
|
|
|
|
|
// `docs/files.md § HTTP RPC`.
|
|
|
|
|
export { createFilesRpcRoute } from './server/rpc-route.js';
|
|
|
|
|
export type { FilesRpcRouteOptions } from './server/rpc-route.js';
|
|
|
|
|
export { createFilesHttpClient } from './client/http-client.js';
|
|
|
|
|
export type { FilesHttpClientOptions } from './client/http-client.js';
|
|
|
|
|
|
|
|
|
|
// Shared structural surface @shade/files needs from a Shade instance —
|
|
|
|
|
// exposed so consumers building custom Shade-shaped bridges can verify
|
|
|
|
|
// they implement every required member.
|
|
|
|
|
export type { ShadeBridge } from './integration/shade-bridge.js';
|
|
|
|
|
|
feat(files): @shade/files 0.3.0 — E2EE filesystem RPC primitive
M-Files-1..6 land the full files-RPC layer + everything 0.3.0 needs to
ship. Apps keep their own UI; this layer ships the typed RPC, the
streams bridge for content I/O, and production hooks (rate limit,
retention, fingerprint gate, metrics).
@shade/files (NEW)
- Standard ops: list/stat/mkdir/delete/move/read/write/getThumbnail with
Zod-validated wire schemas + clean user-handler types.
- Custom ops: typed via TypeScript declaration merging on CustomOpsMap
+ per-op Zod schemas; client.custom('app.foo', {...}) is fully typed.
- Content I/O: inline (≤ 256 KiB plaintext) base64-in-RPC; streams
(> 256 KiB) ride @shade/transfer via userMetadata.shadeFilesWriteId
/ shadeFilesReadStreamId correlation. Server-side TransformStream
bridges accept inbound transfers immediately (engine rejects chunks
that arrive before accept) and park the readable for the matching
RPC.
- Directory ops: walk(path, opts) async-iterable depth-first walker;
uploadDirectory()/downloadDirectory() with bounded concurrency pool
(default 4, cap 16), aggregated progress, abort.
- Production hooks (callback-based, vendor-neutral): rate-limit (op +
byte), idempotency cache (LRU + TTL + in-flight de-dupe), path
policy (traversal + percent-decode hardening), fingerprint gate
(required/optional/reject), pluggable Ed25519 sig verification with
±5 min replay window, onMetric sink (standard names).
- React hooks (subpath @shade/files/react): ShadeFilesProvider,
useShadeFiles, useFileList, useFileTransfer/Upload/Download.
- Shade.files.serve(handler) + Shade.files.client(peer) high-level
entrypoint in @shade/sdk; lazy + memoized; one handler per Shade.
Wire format bump
- @shade/proto wire VERSION 0x01 → 0x02. Length prefixes changed from
u16 to u32. The previous u16 silently truncated payloads above
64 KiB — a hard correctness ceiling that blocked inline file ops
up to 256 KiB. Wire-incompatible with 0.2.x peers; new sessions
only. Cross-platform Kotlin port (android/shade-android) updated to
match; test-vectors/wire-format.json regenerated.
Concurrency safety
- ShadeSessionManager.encrypt/.decrypt now run under per-peer mutex.
Concurrent decryptions of the same peer raced ratchet state
(manifested as sporadic "Failed to decrypt — wrong key or tampered
data" under load — surfaced once concurrent uploadDirectory pumped
many writes in flight). Encrypt was already serialized via
Shade.send's encryptChains; decrypt is now serialized at the
manager layer too.
@shade/streams extension
- StreamMetadata.userMetadata?: Record<string, string> for
application-level key/value pairs that round-trip verbatim through
stream-init plaintext. Used by @shade/files for write/read
correlation; available to any consumer.
@shade/sdk extension
- Shade.files getter (lazy + memoized).
- BackgroundHooks.onPruneFiles + periodic timer (default 5 min) +
BackgroundTasks.setHook(name, fn) for runtime hook registration.
Bundles in-flight 0.2.0 work
- packages/shade-streams/, packages/shade-transfer/, related
shade-sdk streams-bridge + shade-widgets transfer hooks were
uncommitted prior to this session. Including them keeps the
workspace consistent at 0.3.0 since @shade/files depends on them.
Tests
- 74 new tests in @shade/files (572 → 646 workspace pass; 0 fail;
3× stable). Coverage spans unit (inline-threshold + concurrency),
integration (read-write inline + streams up to 1 MiB, walk +
upload/download directory, custom-op, metrics, SDK namespace
end-to-end), and security (tampered-envelope sig verification,
replay window, fingerprint gate, rate-limit + quota).
Release artifacts
- All packages bumped to 0.3.0 via scripts/bump-version.ts.
- scripts/publish-all.ts PACKAGES updated with shade-files in
topological order (after shade-transfer, before shade-sdk).
- bun run publish:dry clean (14 packed, 0 failed).
- examples/08-files-browser/ — three-process CLI demo (prekey + Bob
server + Alice CLI) covering list/stat/mkdir/delete/upload/download.
- docs/files.md — full API + design doc.
- CHANGELOG.md 0.3.0 entry.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-02 14:00:01 +02:00
|
|
|
// Integration helpers — wire handler + pending registry onto a channel
|
|
|
|
|
export { attachFileHandler } from './integration/wire-server.js';
|
|
|
|
|
export { attachClientRouting } from './integration/wire-client.js';
|
|
|
|
|
|
|
|
|
|
// Path utilities
|
|
|
|
|
export {
|
|
|
|
|
posixNormalize,
|
|
|
|
|
posixJoin,
|
|
|
|
|
posixDirname,
|
|
|
|
|
posixBasename,
|
|
|
|
|
decodePercentEscapes,
|
|
|
|
|
isPathInside,
|
|
|
|
|
} from './utils/path.js';
|