feat(fula-crypto/js): A6b Method-2 recipient bindings (unwrap + owner-file decrypt) — 0.6.19

[ehsan6sha]

What

Method-2 RECIPIENT-side bindings so the hosted Cloudflare Worker (wasm) can consume a collaboration share without re-implementing any fula:v4 crypto in TypeScript. Sibling of #86's wrap_secret_for_recipient producer.

fula-crypto (sharing.rs) — thin compositions of existing primitives (ShareRecipient::accept_share, Aead, ChunkedDecoder), no new crypto:

• unwrap_secret_for_recipient → recover the exact 32-byte group link secret
• describe_shared_file → non-secret framing {chunked, num_chunks, encryption_version}
• decrypt_shared_file_single_block / _chunked → owner (encType:fula) decrypt, byte-mirroring the native MCP read path (AAD fula:v4:content:{key} / per-chunk fula:v4:chunk:{key}:{i}, share nonce, version-gate tristate)

fula-js (lib.rs) — the 4 wasm bindings (unwrapSecretForRecipient, describeSharedFile, decryptSharedFileSingleBlock, decryptSharedFileChunked), all fail-closed.

read.rs — production read path is UNCHANGED; only a #[cfg(test)] no-drift cross-check was added (native cores vs shared cores must stay byte-identical).

Version bumped 0.6.18 → 0.6.19 (workspace-wide).

Why

The local MCP uses native fula-crypto, but the hosted Worker (wasm) had no way to unwrap a v5 ShareToken → it was fail-closed (rejecting the production token shape). These bindings unblock the Worker (#70).

Verification

• cargo test -p fula-mcp: 84 lib + 9 KAT pass, incl. the no-drift cross-check (now covering all 3 version arms Some(≥4)/Some(<4)/None) and the new KATs.
• cargo check -p fula-js --target wasm32-unknown-unknown: clean.
• cargo check -p fula-flutter: clean (Send+Sync gate).

Review gate

Crypto change reviewed on the actual diff by GLM-5.2 + MiMo v2.5 Pro + built-in advisor → unanimous SHIP, zero security / fail-open findings (every fail-closed path verified: key length, recipient binding, tamper, expiry, single-vs-chunked routing, nonce, wasm conversion). Kimi/Codex/Cursor were quota-exhausted today (noted; resets not waitable).

Test-coverage findings (GLM F1/F2) were applied post-review (test-only): the 3-arm no-drift cross-check + KATs for version-downgrade rejection (empirically proving encryption_version is bound in the v5 AAD), empty-plaintext, and single-chunk.

Follow-up (tracked, non-blocking)

• F3: unify read.rs to call the shared sharing::decrypt_accepted_single_block / assemble_accepted_chunked and delete the private copies (the no-drift cross-check now fully covers the arms, so this is safe to defer).
• Stage-3 note (Worker): bound num_chunks at the Worker fetch layer (a pathological — but authenticated — token could drive a large fetch loop; native has the same property).

🤖 Generated with Claude Code