@brftech/filex-core 0.30.1 → 0.31.0

package/src/styles/base.css

@@ -542,6 +542,11 @@ filex-explorer {
   opacity: 0.7;
 }
 .fe-grid__thumb {
+  /* yildiz:s1 — positioning context for the star chip in the corner. The
+     gallery's thumb already had one; this one did not, so an absolutely
+     placed chip would have resolved against whatever ancestor happened to be
+     positioned (the grid, or the explorer root) and landed in the wrong tile. */
+  position: relative;
   display: flex;
   align-items: center;
   justify-content: center;
@@ -3836,6 +3841,153 @@ filex-explorer {
 .fe-e2e-optlink:hover {
   text-decoration: underline;
 }
+
+/* --- wiring:e2 recovery ---------------------------------------------
+   Unscoped and fe-prefixed on purpose: a scoped <style> in an SFC does not
+   survive the web-component build, so every class a core component uses has
+   to live here. */
+
+/* The shown-once key. Monospace, big, wrapping — it exists to be read off
+   the screen and typed somewhere else, so legibility beats compactness. */
+.fe-e2e-rk {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+.fe-e2e-rk__lead {
+  margin: 0;
+  font-size: 13px;
+  color: var(--fe-text-muted);
+}
+.fe-e2e-rk__key {
+  display: block;
+  padding: 12px 14px;
+  border: 1px solid var(--fe-border);
+  border-radius: var(--fe-radius-sm);
+  background: var(--fe-bg-elev);
+  color: var(--fe-text);
+  font-family: var(--fe-font-mono, ui-monospace, SFMono-Regular, Menlo, monospace);
+  font-size: 15px;
+  letter-spacing: 0.04em;
+  line-height: 1.7;
+  word-break: break-all;
+  user-select: all;
+  text-align: center;
+}
+.fe-e2e-rk__actions {
+  display: flex;
+  gap: 8px;
+}
+.fe-e2e-rk__escrow {
+  border: 1px solid var(--fe-border);
+  border-left: 3px solid var(--fe-warning, var(--fe-primary));
+  border-radius: var(--fe-radius-sm);
+  padding: 8px 10px;
+  font-size: 12.5px;
+}
+.fe-e2e-rk__escrow strong {
+  display: block;
+  margin-bottom: 2px;
+  color: var(--fe-text);
+}
+.fe-e2e-rk__escrow p {
+  margin: 0;
+  color: var(--fe-text-muted);
+}
+.fe-e2e-rk__kid code {
+  font-size: 11.5px;
+}
+
+/* Unlock-without-the-password dialog. */
+.fe-e2e-recover {
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+.fe-e2e-recover__none {
+  margin: 0;
+  font-size: 13px;
+  color: var(--fe-text-muted);
+}
+.fe-e2e-recover__hint {
+  margin: 0;
+  font-size: 12.5px;
+  color: var(--fe-text-muted);
+}
+.fe-e2e-recover__tabs {
+  display: flex;
+  gap: 4px;
+  padding: 3px;
+  border: 1px solid var(--fe-border);
+  border-radius: var(--fe-radius-lg);
+  background: var(--fe-bg-elev);
+}
+.fe-e2e-recover__tab {
+  flex: 1;
+  padding: 6px 10px;
+  border: 0;
+  border-radius: calc(var(--fe-radius-lg) - 4px);
+  background: transparent;
+  color: var(--fe-text-muted);
+  font: inherit;
+  font-size: 12.5px;
+  cursor: pointer;
+}
+.fe-e2e-recover__tab--on {
+  background: var(--fe-bg);
+  color: var(--fe-text);
+  font-weight: 600;
+}
+.fe-e2e-recover__key {
+  font-family: var(--fe-font-mono, ui-monospace, SFMono-Regular, Menlo, monospace);
+  letter-spacing: 0.04em;
+  text-align: center;
+}
+.fe-e2e-recover__escrow {
+  font-family: var(--fe-font-mono, ui-monospace, SFMono-Regular, Menlo, monospace);
+  font-size: 11.5px;
+  resize: vertical;
+  min-height: 90px;
+}
+
+/* The offer to give a pre-recovery folder a recovery key. A strip, not a
+   modal: it must be visible and dismissible, never something that blocks
+   the folder the user came here to open. */
+.fe-e2e-upgrade {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 14px;
+  flex-wrap: wrap;
+  margin: 0 0 10px;
+  padding: 10px 12px;
+  border: 1px solid var(--fe-border);
+  border-left: 3px solid var(--fe-primary);
+  border-radius: var(--fe-radius-sm);
+  background: color-mix(in srgb, var(--fe-primary) 6%, transparent);
+}
+.fe-e2e-upgrade__text {
+  flex: 1 1 320px;
+  min-width: 0;
+}
+.fe-e2e-upgrade__text strong {
+  display: block;
+  font-size: 13px;
+  color: var(--fe-text);
+}
+.fe-e2e-upgrade__text p {
+  margin: 4px 0 0;
+  font-size: 12.5px;
+  color: var(--fe-text-muted);
+}
+.fe-e2e-upgrade__escrow {
+  color: var(--fe-danger) !important;
+}
+.fe-e2e-upgrade__actions {
+  display: flex;
+  gap: 8px;
+  flex: none;
+}
 /* === /wiring:e2 === */
 
 /* === ui-fix — toolbar tek satır + katlama + ölçüm şeridi ============= */
@@ -4220,6 +4372,106 @@ filex-explorer {
   letter-spacing: 0.02em;
 }
 
+/* === etiket:t1 — the Tags section ==================================== */
+/* A tag row is an ordinary panel item; only its label wraps differently,
+   because a tag is user text and can be long. */
+.fe-sidenav__item--tag .fe-sidenav__text {
+  text-transform: none;
+}
+/* "Show all (12)" / "Show fewer" — a link, not a button: it changes what this
+   section shows, it is not a destination. */
+.fe-sidenav__more {
+  display: block;
+  width: 100%;
+  margin: 2px 0 0;
+  padding: 5px 10px;
+  border: 0;
+  border-radius: 999px;
+  background: transparent;
+  color: var(--fe-primary);
+  font: inherit;
+  font-size: 12.5px;
+  text-align: left;
+  cursor: pointer;
+}
+.fe-sidenav__more:hover {
+  background: var(--fe-bg-hover);
+}
+.fe-sidenav__more:focus-visible {
+  outline: 2px solid var(--fe-primary);
+  outline-offset: 1px;
+}
+/* "No tags yet — add them from a file's menu." */
+.fe-sidenav__hint {
+  margin: 2px 0 4px;
+  padding: 0 10px;
+  font-size: 11.5px;
+  line-height: 1.45;
+  color: var(--fe-text-muted);
+}
+
+/* === yildiz:s1 — the star chip on a grid / gallery tile =============== */
+/* Positioned by the card, painted by StarButton (.filex-star-btn.is-card).
+   ⚠ The rules live HERE and not in the SFC: the panel's styles do too, and
+   these are about the CARD's geometry, which is this file's business. */
+.fe-grid__star,
+.fe-gal__star {
+  position: absolute;
+  top: 6px;
+  right: 6px;
+  z-index: 2;
+  /* Hidden until the tile is hovered or something inside it is focused —
+     EXCEPT when the file is starred, which is the whole point: the mark has
+     to be visible without hovering every tile to find it (see .is-starred
+     below). */
+  opacity: 0;
+  transition: opacity 120ms ease;
+}
+.fe-grid__card:hover .fe-grid__star,
+.fe-grid__card:focus-within .fe-grid__star,
+.fe-gal__card:hover .fe-gal__star,
+.fe-gal__card:focus-within .fe-gal__star,
+.fe-grid__star:focus-within,
+.fe-gal__star:focus-within,
+.fe-grid__star:has(.is-starred),
+.fe-gal__star:has(.is-starred) {
+  opacity: 1;
+}
+/* `:has()` is the modern half of the rule above; this is the same thing for
+   engines without it — a starred chip paints itself. Both are needed: the
+   parent wrapper carries the opacity, the child cannot raise it on its own. */
+.filex-star-btn.is-card.is-starred {
+  opacity: 1;
+}
+/* The chip itself: a round translucent puck, legible over a photo thumbnail
+   as well as over a flat icon tile. */
+.filex-star-btn.is-card {
+  width: 26px;
+  height: 26px;
+  padding: 0;
+  justify-content: center;
+  border-radius: 999px;
+  background: rgba(17, 24, 39, 0.55);
+  color: #fff;
+  backdrop-filter: blur(2px);
+}
+.filex-star-btn.is-card:hover {
+  background: rgba(17, 24, 39, 0.78);
+  color: var(--filex-accent-amber, #f59e0b);
+}
+.filex-star-btn.is-card.is-starred {
+  color: var(--filex-accent-amber, #f59e0b);
+}
+.filex-star-btn.is-card:focus-visible {
+  outline: 2px solid var(--fe-primary);
+  outline-offset: 1px;
+}
+/* The gallery's meta strip covers the tile's foot on hover and is
+   aria-hidden; the star sits above it and stays clickable. */
+.fe-gal__star {
+  z-index: 3;
+}
+
 /* Narrow (<560px): a drawer over the listing, never a column. At 390px a
    232px column leaves 158px for the files, and a 56px rail still takes an
    eighth of the screen from a listing that is already tight. */

package/src/types/ExplorerConfig.ts

@@ -77,6 +77,9 @@ export interface EndpointMap {
   restore: string | null;
   trashList: string | null;
   trashRestore: string | null;
+  /* wiring:e2 */
+  e2eEscrowChallenge: string | null;
+  e2eEscrowUsed: string | null;
 }
 
 export interface ExplorerConfig {
@@ -157,6 +160,12 @@ export interface ExplorerConfig {
   /** filex trash restore endpoint — `POST { node_id }`. */
   trashRestore?: string;
 
+  /* wiring:e2 */
+  /** E2E escrow proof-of-possession — `POST { path } → { id, challenge }`. */
+  e2eEscrowChallenge?: string;
+  /** E2E escrow use report — `POST { path, id, nonce }`. */
+  e2eEscrowUsed?: string;
+
   /** Public share base URL — `${shareBase}/${uuid}` */
   shareBase?: string;
 
@@ -318,12 +327,39 @@ export interface ExplorerConfig {
    * the bug this became: for a year the sole place to mint the token the FTPS
    * guide told you to use was the admin panel.
    *
+   * ⚠ Role is not the same question as `callerKind`. "API keys" IS hidden for
+   * an app token — not because of what that caller may do, but because there is
+   * no single person behind it whose keys they would be. See `callerKind`.
+   *
    * ⚠ The entries live in the panel, so `sideNav: false` takes them with it.
    * Hosts that want the surface without the panel mount `<filex-connections>`
    * (or `ConnectionsPanel`) on a page of their own.
    */
   connections?: boolean;
 
+  /**
+   * Who is behind this explorer — a person, or an integration?
+   *
+   * `'user'` (a signed-in human, or their own API token) draws everything.
+   * `'app'` suppresses the surfaces that only mean something for ONE person:
+   * **API keys**, **Recent**, **Starred** and **Shared with me**. Upload, the
+   * storage list, Trash and "How to connect" stay — an embed's users still
+   * upload files and still need mount instructions.
+   *
+   * Why it exists: a filex API token authenticates AS its owner, and the embeds
+   * we run authenticate every visitor with ONE shared token injected by the
+   * host's proxy. v0.30.0 put "API keys" in the panel, so under that token an
+   * embed visitor could list and revoke the credential the embed itself runs
+   * on — and "your Recent" meant the token owner's history shown to a stranger.
+   *
+   * Default: read from `GET /api/files/capabilities` (`caller_kind`), which is
+   * authoritative because only the server knows the token's kind (migration
+   * 00030). Set this only to answer BEFORE that request lands — a host that
+   * already knows it proxies with an app token spares its users the flash of a
+   * Starred row that then disappears. A value here wins over the server's.
+   */
+  callerKind?: 'user' | 'app';
+
 
   /** Default view. */
   viewMode?: 'list' | 'grid';

package/src/types/FileNode.ts

@@ -88,11 +88,34 @@ export interface Capabilities {
   /** Longest life a new share link may be given, in days (0 = no ceiling).
    *  Read by the share dialogs so they offer only expiries the server keeps. */
   share_max_ttl_days?: number;
+  /** Is the caller a person (`'user'` — a session OR their own API token) or an
+   *  integration (`'app'` — a host proxy, a bot, an MCP client)? The explorer
+   *  reads it to decide whether to draw the identity-bearing surfaces; see
+   *  ExplorerConfig.callerKind. Absent on a server older than the app/user
+   *  token split, which is why every reader treats "missing" as a person. */
+  caller_kind?: 'user' | 'app';
   external?: {
     onlyoffice?: ExternalServiceStatus;
     drawio?: ExternalServiceStatus;
     mermaid?: ExternalServiceStatus;
   };
+  /* wiring:e2 */
+  /** Whether this installation holds an escrow key for E2E-encrypted folders,
+   *  and the public half the browser wraps new folders' master keys to.
+   *
+   *  Published on purpose. Escrow means the operator can open the folders you
+   *  create here without your password, and someone about to create one is
+   *  entitled to know that BEFORE they create it. Fixed at install time
+   *  (FILEX_INSTALLATION_E2E_ESCROW_KEY), so this answer never changes for a
+   *  running installation. */
+  e2e_escrow?: {
+    enabled: boolean;
+    /** Short id of the escrow key (SHA-256(SPKI)[:8], hex). */
+    kid?: string;
+    alg?: string;
+    /** Base64 SPKI. Public material — it can only seal, never open. */
+    public_key?: string;
+  };
 }
 
 /** Single source of truth for "is the IdP/editor/diagram service ready?".