@brftech/filex-core 0.30.1 → 0.32.0

package/src/types/ExplorerConfig.ts

@@ -77,6 +77,9 @@ export interface EndpointMap {
   restore: string | null;
   trashList: string | null;
   trashRestore: string | null;
+  /* wiring:e2 */
+  e2eEscrowChallenge: string | null;
+  e2eEscrowUsed: string | null;
 }
 
 export interface ExplorerConfig {
@@ -157,6 +160,12 @@ export interface ExplorerConfig {
   /** filex trash restore endpoint — `POST { node_id }`. */
   trashRestore?: string;
 
+  /* wiring:e2 */
+  /** E2E escrow proof-of-possession — `POST { path } → { id, challenge }`. */
+  e2eEscrowChallenge?: string;
+  /** E2E escrow use report — `POST { path, id, nonce }`. */
+  e2eEscrowUsed?: string;
+
   /** Public share base URL — `${shareBase}/${uuid}` */
   shareBase?: string;
 
@@ -268,6 +277,22 @@ export interface ExplorerConfig {
    *                          navigation panel starts expanded, the tab strip
    *                          and split pane are off, the gallery view mode and
    *                          the host's "How to connect" surface are hidden.
+   *   'drive'              — everything `simple` does, plus the shell an end
+   *                          user already knows: one primary "New" menu, one
+   *                          search field in the header (with its ⌘K/Ctrl+K
+   *                          escalation into the command palette), a filter row
+   *                          under the breadcrumb, Folders and Files as
+   *                          labelled sections in grid view, the details panel
+   *                          split into Details / Activity, and a storage line
+   *                          under the navigation.
+   *
+   * ⚠ `drive` is a SUPERSET of `simple`, not a sibling: everything `simple`
+   * turns off stays off, and the code asks `simpleUi` for those questions so a
+   * later change to `simple` cannot silently miss `drive`. It is a third value
+   * rather than a second boolean because "which chrome" is ONE question with
+   * three answers — a `driveShell: true` next to `uiProfile: 'standard'` would
+   * be a combination nobody can describe, and keeping that question single is
+   * why `uiProfile` was a preset to begin with.
    *
    * Why it exists (GitHub #14): the reporter's users are not in IT and read
    * split panes, tabs and mount instructions as a file manager they would have
@@ -279,7 +304,7 @@ export interface ExplorerConfig {
    * rest of the chrome differ. A viewer's own collapse choice, once made,
    * outranks the profile — it is a per-viewer preference, not a policy.
    */
-  uiProfile?: 'standard' | 'simple';
+  uiProfile?: 'standard' | 'simple' | 'drive';
 
   /**
    * Render the navigation panel (Upload · Recent / Starred / Shared with me /
@@ -318,12 +343,39 @@ export interface ExplorerConfig {
    * the bug this became: for a year the sole place to mint the token the FTPS
    * guide told you to use was the admin panel.
    *
+   * ⚠ Role is not the same question as `callerKind`. "API keys" IS hidden for
+   * an app token — not because of what that caller may do, but because there is
+   * no single person behind it whose keys they would be. See `callerKind`.
+   *
    * ⚠ The entries live in the panel, so `sideNav: false` takes them with it.
    * Hosts that want the surface without the panel mount `<filex-connections>`
    * (or `ConnectionsPanel`) on a page of their own.
    */
   connections?: boolean;
 
+  /**
+   * Who is behind this explorer — a person, or an integration?
+   *
+   * `'user'` (a signed-in human, or their own API token) draws everything.
+   * `'app'` suppresses the surfaces that only mean something for ONE person:
+   * **API keys**, **Recent**, **Starred** and **Shared with me**. Upload, the
+   * storage list, Trash and "How to connect" stay — an embed's users still
+   * upload files and still need mount instructions.
+   *
+   * Why it exists: a filex API token authenticates AS its owner, and the embeds
+   * we run authenticate every visitor with ONE shared token injected by the
+   * host's proxy. v0.30.0 put "API keys" in the panel, so under that token an
+   * embed visitor could list and revoke the credential the embed itself runs
+   * on — and "your Recent" meant the token owner's history shown to a stranger.
+   *
+   * Default: read from `GET /api/files/capabilities` (`caller_kind`), which is
+   * authoritative because only the server knows the token's kind (migration
+   * 00030). Set this only to answer BEFORE that request lands — a host that
+   * already knows it proxies with an app token spares its users the flash of a
+   * Starred row that then disappears. A value here wins over the server's.
+   */
+  callerKind?: 'user' | 'app';
+
 
   /** Default view. */
   viewMode?: 'list' | 'grid';

package/src/types/FileNode.ts

@@ -88,11 +88,34 @@ export interface Capabilities {
   /** Longest life a new share link may be given, in days (0 = no ceiling).
    *  Read by the share dialogs so they offer only expiries the server keeps. */
   share_max_ttl_days?: number;
+  /** Is the caller a person (`'user'` — a session OR their own API token) or an
+   *  integration (`'app'` — a host proxy, a bot, an MCP client)? The explorer
+   *  reads it to decide whether to draw the identity-bearing surfaces; see
+   *  ExplorerConfig.callerKind. Absent on a server older than the app/user
+   *  token split, which is why every reader treats "missing" as a person. */
+  caller_kind?: 'user' | 'app';
   external?: {
     onlyoffice?: ExternalServiceStatus;
     drawio?: ExternalServiceStatus;
     mermaid?: ExternalServiceStatus;
   };
+  /* wiring:e2 */
+  /** Whether this installation holds an escrow key for E2E-encrypted folders,
+   *  and the public half the browser wraps new folders' master keys to.
+   *
+   *  Published on purpose. Escrow means the operator can open the folders you
+   *  create here without your password, and someone about to create one is
+   *  entitled to know that BEFORE they create it. Fixed at install time
+   *  (FILEX_INSTALLATION_E2E_ESCROW_KEY), so this answer never changes for a
+   *  running installation. */
+  e2e_escrow?: {
+    enabled: boolean;
+    /** Short id of the escrow key (SHA-256(SPKI)[:8], hex). */
+    kid?: string;
+    alg?: string;
+    /** Base64 SPKI. Public material — it can only seal, never open. */
+    public_key?: string;
+  };
 }
 
 /** Single source of truth for "is the IdP/editor/diagram service ready?".