@brftech/filex-core 0.31.0 → 0.32.0

package/src/lib/e2ecrypto.ts

@@ -40,10 +40,19 @@
  *   - No key, password or recovery key is ever stored, logged or sent to a
  *     server. The FMK lives in an in-memory key ring and dies with the tab.
  *   - `deriveKek` imports non-extractable. Raw KEK bytes are produced ONLY
- *     by `deriveKekBits`, only while upgrading a v1 marker, and only long
- *     enough to wrap them into the new slots.
+ *     by `deriveKekBits`, only for a marker whose FMK *is* the KEK
+ *     (`upgradeMarkerV1`, and `addEscrowSlot` on a folder it produced), and
+ *     only long enough to wrap them into a slot.
  *   - A folder created while escrow was off carries no escrow slot, so the
- *     escrow key cannot open it. That is arithmetic, not policy.
+ *     escrow key cannot open it, and nothing the OPERATOR does changes
+ *     that — not enabling escrow, not adopting it, not any admin action or
+ *     future version. That is arithmetic, not policy: adding a slot needs
+ *     the folder master key, and the server has never held a credential
+ *     that produces one.
+ *   - The folder's OWNER can, from inside, with the password:
+ *     `addEscrowSlot`. That is the only door, it opens from one side only,
+ *     and it is the reason `escrowAvailability` says "not as things stand"
+ *     rather than "never".
  *
  * File layout ('filexe2e' magic, fixed 97-byte header) — UNCHANGED in v2:
  *   [0..8)   magic  "filexe2e"
@@ -114,6 +123,23 @@ export interface E2eMarker {
   rk?: E2eRecoverySlot;
   /** v2 only, optional: the operator escrow slot. */
   esc?: E2eEscrowSlot;
+  /**
+   * v2 only, optional: an ISO timestamp recording that this folder's owner
+   * was OFFERED an escrow slot and said no.
+   *
+   * It lives in the marker rather than in browser storage because the unit
+   * of the decision is the FOLDER, not the device: the same person opening
+   * the folder from their phone must not be asked again, and a decision
+   * that vanished when someone cleared their site data would be no decision
+   * at all. It travels with the folder through a move, a backup and a
+   * restore, for the same reason the key slots do.
+   *
+   * It holds no key material and hides nothing from the operator — it is a
+   * record of an answer, and its only effect is that filex stops asking.
+   * `addEscrowSlot` clears it, so a decline is reversible by the one person
+   * who can reverse it.
+   */
+  esc_declined?: string;
 }
 
 /** Thrown on wrong password / corrupted ciphertext (GCM tag mismatch). */
@@ -500,6 +526,126 @@ export async function upgradeMarkerV1(
   return { marker: next, fmk: kek, recoveryKey };
 }
 
+/**
+ * Give an EXISTING v2 folder an escrow slot, in place, using the folder
+ * password its owner has just typed.
+ *
+ * ── Why this exists ─────────────────────────────────────────────────
+ *
+ * Escrow used to be all-or-nothing at install time, and then adoptable but
+ * never retroactive: on any installation that had been running for a while,
+ * escrow covered only folders nobody had created yet. On a real deployment
+ * the folders that matter already exist, so "new folders only" means escrow
+ * covers nothing anyone cares about.
+ *
+ * The server still cannot do this, and that has not changed: adding a slot
+ * needs the folder master key, which needs a credential the server has never
+ * held. What CAN do it is the browser, at the one moment the password is in
+ * memory — exactly where `upgradeMarkerV1` already lives. Same moment, same
+ * shape, different slot.
+ *
+ * ⚠⚠ Accepting hands the operator of this installation a second, permanent
+ * way into this folder. It is the folder's owner who decides, from inside,
+ * with the password; no configuration change and no admin action can do it
+ * for them. The caller MUST say that in those words before calling this —
+ * see `e2e.escrowoffer.*` in the locales.
+ *
+ * ⚠ v2 only. A v1 marker has no slots at all; the path for those is
+ * `upgradeMarkerV1`, which already seals an escrow slot when the
+ * installation has a key and already discloses it. Two doors into the same
+ * room would be two chances to get the disclosure wrong.
+ *
+ * ⚠ No file is re-encrypted, moved or rewritten. Only `.filex-e2e.json`
+ * changes, and only by gaining `esc` (and losing `esc_declined`).
+ */
+export async function addEscrowSlot(
+  marker: E2eMarker,
+  password: string,
+  escrowPublicKey: string,
+): Promise<E2eMarker> {
+  if (marker.v !== 2) throw new Error('e2e: not a v2 marker');
+  if (marker.esc) throw new Error('e2e: this folder already has an escrow slot');
+  if (!escrowPublicKey) throw new Error('e2e: no escrow public key');
+
+  const salt = b64ToBytes(marker.salt);
+  const kek = await deriveKek(password, salt, marker.iter);
+  // Prove the password before touching anything, exactly as the v1 upgrade
+  // does. A wrong password here must not produce a marker at all — half a
+  // marker is a folder nobody can open.
+  const proof = await gcmOpen(kek, marker.verify);
+  if (!proof || new TextDecoder().decode(proof) !== VERIFY_PLAINTEXT) {
+    throw new E2eDecryptError('e2e: wrong password');
+  }
+
+  // The raw FMK, by mode. `wrapped` keeps a random FMK in `fmk_pw`, so the
+  // bytes come back from a GCM open and no extractable KEK is ever derived.
+  // `kek` (a v1 folder upgraded in place) defines the FMK AS the password
+  // key, so those very bytes are what the slot has to wrap — the one case
+  // that needs `deriveKekBits`, for the same reason `upgradeMarkerV1` does.
+  let rawFmk: Uint8Array;
+  if (marker.fmk === 'wrapped') {
+    const opened = marker.fmk_pw ? await gcmOpen(kek, marker.fmk_pw) : null;
+    if (!opened || opened.length !== FMK_LEN) {
+      throw new E2eDecryptError('e2e: could not unwrap the folder master key');
+    }
+    rawFmk = opened;
+  } else {
+    rawFmk = await deriveKekBits(password, salt, marker.iter);
+  }
+
+  const esc = await sealEscrowSlot(rawFmk, escrowPublicKey);
+  rawFmk.fill(0);
+
+  const next: E2eMarker = { ...marker, esc };
+  // A decline that is now moot. Leaving it would make the record say two
+  // contradictory things about the same folder.
+  delete next.esc_declined;
+  return next;
+}
+
+/**
+ * Record that this folder's owner was offered an escrow slot and declined.
+ *
+ * A refusal is a decision, not a delay: without this the offer would come
+ * back on every single unlock, which is how people learn to click past
+ * security dialogs without reading them. Nothing about the folder's keys
+ * changes — the only effect is that filex stops asking.
+ *
+ * Reversible by `addEscrowSlot`, which is the way back for somebody who
+ * says no today and changes their mind next month.
+ */
+export function declineEscrowSlot(marker: E2eMarker, when: string): E2eMarker {
+  return { ...marker, esc_declined: when };
+}
+
+/**
+ * Whether this folder's owner should be offered an escrow slot, and whether
+ * they have already answered.
+ *
+ *   'n/a'       nothing to offer: the installation has no escrow key, the
+ *               folder already has a slot, or the marker is v1 (whose path
+ *               is `upgradeMarkerV1`).
+ *   'offer'     the offer applies and no answer has been recorded.
+ *   'declined'  the offer applies and the owner said no. Do not ask again;
+ *               leave a way back.
+ *
+ * ⚠ This deliberately does NOT look at whether the folder is unlocked. That
+ * is the caller's business, and it matters: the offer may only be shown
+ * after an unlock actually succeeded, because accepting needs the password
+ * and because asking someone who cannot open the folder to give away a key
+ * to it is asking the wrong person.
+ */
+export type EscrowOfferState = 'n/a' | 'offer' | 'declined';
+
+export function escrowOfferState(
+  m: E2eMarker | null,
+  installationKid: string | null | undefined,
+): EscrowOfferState {
+  if (!installationKid) return 'n/a';
+  if (!m || m.v !== 2 || m.esc) return 'n/a';
+  return m.esc_declined ? 'declined' : 'offer';
+}
+
 /** Parse marker JSON text; returns null when the shape is not a marker we read. */
 export function parseMarker(text: string): E2eMarker | null {
   try {
@@ -527,6 +673,48 @@ export function markerHasEscrow(m: E2eMarker | null): boolean {
   return !!m && m.v === 2 && !!m.esc;
 }
 
+/**
+ * Why the escrow door is, or is not, on offer for this folder.
+ *
+ *   'off'        this installation has no escrow key at all.
+ *   'available'  the folder is sealed to THIS installation's escrow key.
+ *   'predates'   the installation has an escrow key, and this folder has no
+ *                escrow slot: it was created before escrow existed here.
+ *   'other-key'  the folder carries an escrow slot sealed to a DIFFERENT
+ *                key id — it came from another installation, via a restore
+ *                or a copied data directory.
+ *
+ * ⚠ 'predates' exists because escrow can be ADOPTED by an installation
+ * that already has folders (FILEX_INSTALLATION_E2E_ESCROW_ADOPT), and
+ * adoption is not retroactive: the folder's master key was wrapped to its
+ * recovery paths when the folder was created. Before this distinction
+ * existed the dialog simply showed no Escrow tab, which is true but says
+ * nothing — an admin who knows escrow is on reads a missing tab as a bug,
+ * tries the key anyway, and learns the real answer from a failure. The UI
+ * has to say it instead.
+ *
+ * ⚠⚠ 'predates' means "not as things stand", NOT "never". The folder's
+ * owner can add a slot from inside with the password (`addEscrowSlot`,
+ * offered at unlock). Any wording built on this state has to leave that
+ * door visible, or it tells an operator their escrow key can never reach a
+ * folder whose owner could hand it over this afternoon.
+ *
+ * ⚠ 'other-key' was a quieter lie: the dialog labelled the escrow field
+ * with the INSTALLATION's key id whatever the folder's slot said, so a
+ * folder restored from another install looked openable by the key the
+ * operator has, and was not.
+ */
+export type EscrowAvailability = 'off' | 'available' | 'predates' | 'other-key';
+
+export function escrowAvailability(
+  m: E2eMarker | null,
+  installationKid: string | null | undefined,
+): EscrowAvailability {
+  if (!installationKid) return 'off';
+  if (!markerHasEscrow(m)) return 'predates';
+  return m!.esc!.kid === installationKid ? 'available' : 'other-key';
+}
+
 /**
  * Check `password` against a folder marker. Resolves to the derived KEK on
  * success, or `null` on a wrong password (GCM tag mismatch on the verify

package/src/lib/fileFilters.ts

@@ -0,0 +1,143 @@
+/**
+ * surucu:d1 — the filter row's model, kept out of the components so the
+ * predicate has one definition and can be tested without a DOM.
+ *
+ * ⚠ EVERY filter here answers from a field the listing row ALREADY carries
+ * (`type`, `extension`, `mime_type`, `size`, `last_modified`). That is not a
+ * shortcut, it is the constraint: `GET /api/files/manager?action=index` reads
+ * no `mime` / `min_size` / `modified_after` / `owner` parameter — it returns
+ * the whole directory and ignores anything else you send it (handlers/manager.go
+ * `List`, the complete parameter list is `action`, `path`, `filter`, `storage`,
+ * `parent`, `cache`). A control wired to a parameter the server does not read
+ * looks like it works and quietly changes nothing, which is worse than not
+ * shipping it.
+ *
+ * Because the endpoint has no `limit`/`offset` either, the listing in hand IS
+ * the folder — so filtering it client-side is complete for the folder, not a
+ * filter over "the first page". That is exactly why these three are honest and
+ * a People/owner filter is not: `nodes.owner_id` exists for quota accounting,
+ * is nil for anything a sync discovered, and is serialized by nothing
+ * (handlers/shared.go: "There is no per-node owner").
+ */
+import type { FileNode } from '../types/FileNode';
+import { iconFamilyFor, type IconFamily } from './fileIcons';
+
+export type TypeFilter =
+  | 'any'
+  | 'folder'
+  | 'document'
+  | 'spreadsheet'
+  | 'presentation'
+  | 'pdf'
+  | 'image'
+  | 'video'
+  | 'audio'
+  | 'archive'
+  | 'code';
+
+export type ModifiedFilter = 'any' | 'today' | '7d' | '30d' | 'year';
+
+export type SizeFilter = 'any' | 'lt1' | '1to10' | '10to100' | 'gt100';
+
+export interface DriveFilters {
+  type: TypeFilter;
+  modified: ModifiedFilter;
+  size: SizeFilter;
+}
+
+export const EMPTY_FILTERS: DriveFilters = { type: 'any', modified: 'any', size: 'any' };
+
+export function filtersActive(f: DriveFilters): boolean {
+  return f.type !== 'any' || f.modified !== 'any' || f.size !== 'any';
+}
+
+export function activeFilterCount(f: DriveFilters): number {
+  return (f.type !== 'any' ? 1 : 0) + (f.modified !== 'any' ? 1 : 0) + (f.size !== 'any' ? 1 : 0);
+}
+
+/** Families a type choice accepts. `iconFamilyFor` is the taxonomy the icons
+ *  already use, so a row's filter group and its glyph can never disagree. */
+const TYPE_FAMILIES: Record<Exclude<TypeFilter, 'any'>, IconFamily[]> = {
+  folder: ['folder'],
+  document: ['doc', 'text'],
+  spreadsheet: ['sheet'],
+  presentation: ['slides'],
+  pdf: ['pdf'],
+  image: ['image'],
+  video: ['video'],
+  audio: ['audio'],
+  archive: ['archive'],
+  code: ['code'],
+};
+
+/** MIME fallback — a file with no extension still has a `mime_type` from the
+ *  backend sniffer, and "IMG_0042" with no suffix is a real thing people have. */
+const MIME_PREFIXES: Partial<Record<Exclude<TypeFilter, 'any'>, string[]>> = {
+  image: ['image/'],
+  video: ['video/'],
+  audio: ['audio/'],
+  pdf: ['application/pdf'],
+  document: ['text/plain', 'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessing'],
+  spreadsheet: ['text/csv', 'application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheet'],
+  presentation: ['application/vnd.ms-powerpoint', 'application/vnd.openxmlformats-officedocument.presentation'],
+  archive: ['application/zip', 'application/x-tar', 'application/gzip', 'application/x-7z'],
+};
+
+function matchesType(n: FileNode, t: TypeFilter): boolean {
+  if (t === 'any') return true;
+  if (t === 'folder') return n.type === 'dir';
+  if (n.type === 'dir') return false;
+  if (TYPE_FAMILIES[t].includes(iconFamilyFor(n))) return true;
+  const mime = (n.mime_type || '').toLowerCase();
+  return !!mime && (MIME_PREFIXES[t] ?? []).some((p) => mime.startsWith(p));
+}
+
+/** `now` is a parameter so a test can pin the clock instead of sleeping. */
+function matchesModified(n: FileNode, f: ModifiedFilter, now: number): boolean {
+  if (f === 'any') return true;
+  const ms = typeof n.last_modified === 'number' ? n.last_modified : 0;
+  // No timestamp = no answer. Dropping the row would hide files whose driver
+  // gave us nothing; keeping it would put them in "Today". Hiding is the
+  // honest one: the row does not satisfy "modified today", it is unknown.
+  if (!ms) return false;
+  if (f === 'year') {
+    return new Date(ms).getFullYear() === new Date(now).getFullYear();
+  }
+  if (f === 'today') {
+    const start = new Date(now);
+    start.setHours(0, 0, 0, 0);
+    return ms >= start.getTime();
+  }
+  const days = f === '7d' ? 7 : 30;
+  return ms >= now - days * 86_400_000;
+}
+
+const MB = 1024 * 1024;
+
+function matchesSize(n: FileNode, f: SizeFilter): boolean {
+  if (f === 'any') return true;
+  // ⚠ Folders drop out of every size choice rather than passing through. A
+  // directory row's `size` is 0 from the projector, so "under 1 MB" would
+  // otherwise list every folder in the drive — an answer that looks like a
+  // measurement and is not one.
+  if (n.type === 'dir') return false;
+  const s = typeof n.size === 'number' ? n.size : 0;
+  if (f === 'lt1') return s < MB;
+  if (f === '1to10') return s >= MB && s < 10 * MB;
+  if (f === '10to100') return s >= 10 * MB && s < 100 * MB;
+  return s >= 100 * MB;
+}
+
+export function applyFilters(
+  files: FileNode[],
+  f: DriveFilters,
+  now: number = Date.now(),
+): FileNode[] {
+  // No active filter → the SAME array reference, so an unfiltered explorer
+  // renders exactly what it rendered before this file existed.
+  if (!filtersActive(f)) return files;
+  return files.filter(
+    (n) =>
+      matchesType(n, f.type) && matchesModified(n, f.modified, now) && matchesSize(n, f.size),
+  );
+}

package/src/lib/listing.ts

@@ -120,14 +120,61 @@ export function makeTrashRow(adapter: string): FileNode {
  * Inject the virtual `.trash` row at the front of a root listing when
  * enabled. Returns true if a row was added (so the caller can hydrate
  * it). Mutates `files` in place. Single source for both panes.
+ *
+ * ⚠ `isSearchResult` is not optional politeness — it is the one thing
+ * `dirname` cannot tell you. A search answers with the SCOPE it searched, so
+ * `?action=search&path=main://&filter=brief` comes back with
+ * `dirname: "main://"`, identical to the folder listing of the same path
+ * (measured). Without this flag the sentinel is unshifted into the search
+ * results, and a search for "brief" answers with `brief.md` and a folder
+ * called Trash that is not a folder, is not a hit, and cannot be searched for.
+ * Same family as the `.trash` / `.shared` sentinel bugs fixed in v0.31.0: a
+ * virtual row rendered somewhere it has no meaning.
+ *
+ * Both flags default to `false`, i.e. to the historical behaviour: a caller
+ * that never searches and has no panel — which is what an embed with
+ * `sideNav: false` is — keeps the row it has always had by saying nothing.
  */
+export interface TrashRowContext {
+  /**
+   * This listing is the answer to a SEARCH, not the contents of a folder.
+   *
+   * ⚠ The one thing `dirname` cannot tell you: a search answers with the scope
+   * it searched, so `?action=search&path=main://&filter=notes` comes back
+   * carrying `dirname: "main://"`, byte-identical to that folder's listing
+   * (measured). Without this the sentinel lands among the hits.
+   */
+  isSearchResult?: boolean;
+  /**
+   * The navigation panel is already offering Trash as a destination.
+   *
+   * ⚠ This row only ever existed because a listing had no other way into the
+   * bin. Once the panel carries a Trash entry that reason is gone and the row
+   * is a second door to the same place — drawn as a 0-byte folder that is not
+   * a folder, sitting among real ones, while the panel's own Trash entry is
+   * three inches to its left. Owner's decision, this release: do not offer the
+   * same door twice.
+   *
+   * ⚠ It is a question about the PANEL, not about the profile. The duplication
+   * is exactly as wrong in `standard` with the panel on as it is in `drive`;
+   * keying it to `uiProfile` would be a rule about the wrong thing.
+   */
+  navOffersTrash?: boolean;
+}
+
 export function injectTrashRow(
   files: FileNode[],
   adapter: string,
   dirname: string,
   trashVisible: boolean,
+  ctx: TrashRowContext = {},
 ): boolean {
+  // The host's own switch, and still the outer gate: `trashVisible: false`
+  // means no Trash anywhere — no row here, and no entry in the panel either,
+  // so this must be answered before anything about the panel is considered.
   if (!trashVisible) return false;
+  if (ctx.navOffersTrash) return false;
+  if (ctx.isSearchResult) return false;
   if (isTrashListing(dirname)) return false;
   if (!isStorageRootDir(dirname)) return false;
   files.unshift(makeTrashRow(adapter));

package/src/locales/en.ts

@@ -467,6 +467,10 @@ export const en: Record<string, string> = {
   'e2e.recover.escrow_warn_body':
     'Opening a folder with the escrow key notifies its owner. Use it only when you are entitled to.',
   'e2e.recover.escrow_kid': 'Escrow key',
+  'e2e.recover.escrow_predates':
+    'This installation has an escrow key, but this folder does not. It was created before escrow was turned on here, so its master key was never wrapped to the escrow identity. The escrow key will not open it. Nothing the operator can do changes that — adding a slot needs this folder\u2019s password, which the server has never had. The folder\u2019s owner can grant it: unlock with the password, then choose to give the operator a key. Until they do, use the password or the recovery key.',
+  'e2e.recover.escrow_other_key':
+    'This folder carries an escrow key from a DIFFERENT installation. It was created elsewhere and restored here, so this installation\u2019s escrow key does not open it. Only the private key belonging to the escrow key it was sealed to can.',
   'e2e.recover.escrow_placeholder': 'Paste the escrow private key (PKCS#8, base64 or PEM)',
   'e2e.recover.bad_format':
     'That does not look like a recovery key. It is 32 characters in eight groups of four.',
@@ -481,6 +485,25 @@ export const en: Record<string, string> = {
   'e2e.recover.escrow_done': 'Unlocked with the escrow key — the owner has been notified',
   'e2e.recover.unlock': 'Unlock',
   'e2e.recover.busy': 'Unlocking…',
+  'e2e.escrowoffer.title': 'Give the operator a key to this folder?',
+  'e2e.escrowoffer.body':
+    'This folder was created before key escrow was turned on here, so the operator of this installation cannot open it. Right now — while your password is in memory — filex can seal this folder to the escrow key. Your files are not re-encrypted or moved; only the key file changes.',
+  'e2e.escrowoffer.consequence':
+    'What this means: the operator gains a second, permanent way into this folder, without your password. You are notified when that key is used, but that notification is an announcement rather than a control.',
+  'e2e.escrowoffer.learn_more': 'What escrow can and cannot do',
+  'e2e.escrowoffer.password_label': 'Folder password',
+  'e2e.escrowoffer.password_required': 'Enter the folder password.',
+  'e2e.escrowoffer.wrong_password': 'That is not this folder\u2019s password.',
+  'e2e.escrowoffer.accept': 'Give the operator a key',
+  'e2e.escrowoffer.decline': 'No, keep it to myself',
+  'e2e.escrowoffer.cancel': 'Cancel',
+  'e2e.escrowoffer.busy': 'Sealing…',
+  'e2e.escrowoffer.done': 'The operator can now open this folder with the escrow key',
+  'e2e.escrowoffer.declined_toast': 'Kept to yourself. filex will not ask again for this folder.',
+  'e2e.escrowoffer.decline_failed':
+    'Could not record your answer, so filex will ask again next time. Nothing about the folder changed.',
+  'e2e.escrowoffer.failed': 'Could not give the operator a key to this folder',
+  'e2e.escrowoffer.strip_action': 'Escrow key…',
   'e2e.upgrade.title': 'This folder has no recovery key',
   'e2e.upgrade.body':
     'It was created before recovery keys existed, so its password is the only way in. Right now — and only right now, while the password is in memory — filex can add one. Your files are not re-encrypted or moved.',
@@ -943,4 +966,64 @@ export const en: Record<string, string> = {
   'conn.tokens.expiryNever': 'never',
   'conn.tokens.capNote': 'Your account and its permissions are the ceiling — asking for more than you have is refused, not granted.',
   /* === /gezinti:g1 === */
+
+  /* === surucu:d1 — the Drive shell (uiProfile: 'drive', GitHub #14) ===== */
+  'drive.new': 'New',
+  'drive.new.upload': 'Upload files',
+  'drive.new.folder': 'New folder',
+  'drive.new.request': 'Request files',
+  'drive.search.placeholder': 'Search in {scope}',
+  'drive.search.placeholder_all': 'Search your files',
+  'drive.search.hint_title': 'Search everywhere and run commands ({combo})',
+  'drive.storage.used': '{used} of {total} used',
+  'drive.storage.used_unlimited': '{used} used',
+  'drive.storage.label': 'Storage',
+  'drive.section.folders': 'Folders',
+  'drive.section.files': 'Files',
+  'filter.aria': 'Filters',
+  'filter.type': 'Type',
+  'filter.type.any': 'Any type',
+  'filter.type.folder': 'Folders',
+  'filter.type.document': 'Documents',
+  'filter.type.spreadsheet': 'Spreadsheets',
+  'filter.type.presentation': 'Presentations',
+  'filter.type.pdf': 'PDFs',
+  'filter.type.image': 'Images',
+  'filter.type.video': 'Videos',
+  'filter.type.audio': 'Audio',
+  'filter.type.archive': 'Archives',
+  'filter.type.code': 'Code',
+  'filter.modified': 'Modified',
+  'filter.modified.any': 'Any time',
+  'filter.modified.today': 'Today',
+  'filter.modified.7d': 'Last 7 days',
+  'filter.modified.30d': 'Last 30 days',
+  'filter.modified.year': 'This year',
+  'filter.size': 'Size',
+  'filter.size.any': 'Any size',
+  'filter.size.lt1': 'Under 1 MB',
+  'filter.size.1to10': '1 - 10 MB',
+  'filter.size.10to100': '10 - 100 MB',
+  'filter.size.gt100': 'Over 100 MB',
+  'filter.clear': 'Clear filters',
+  'filter.empty.title': 'Nothing here matches those filters',
+  'filter.empty.hint': 'Clear a filter, or search everywhere with the field above.',
+  'filter.count': '{shown} of {total}',
+  'inspector.tab.details': 'Details',
+  'inspector.tab.activity': 'Activity',
+  'inspector.people': 'People with access',
+  'inspector.people.you': 'You',
+  'inspector.people.inherited': 'from a parent folder',
+  'inspector.people.empty': 'Only you, and anyone with a link below.',
+  'inspector.people.manage': 'Manage access',
+  'inspector.link': 'Shared link',
+  'inspector.link.none': 'Not shared',
+  'inspector.link.create': 'Create link',
+  'inspector.link.copy': 'Copy link',
+  'inspector.activity.empty': 'No activity recorded for this item yet.',
+  'inspector.activity.hint': 'Versions are written when a file changes; comments are written by people.',
+  'inspector.activity.version': 'Version {n} saved',
+  'inspector.activity.comment': 'Comment by {who}',
+  'inspector.activity.select': 'Select a file or folder to see its activity.',
+  /* === /surucu:d1 === */
 };

package/src/locales/tr.ts

@@ -467,6 +467,10 @@ export const tr: Record<string, string> = {
   'e2e.recover.escrow_warn_body':
     'Emanet anahtarıyla açılan klasörün sahibine bildirim gönderilir. Yalnız yetkiniz olduğunda kullanın.',
   'e2e.recover.escrow_kid': 'Emanet anahtarı',
+  'e2e.recover.escrow_predates':
+    'Bu kurulumun emanet anahtarı var ama bu klasörün yok. Klasör, emanet burada açılmadan önce oluşturulmuş; ana anahtarı emanet kimliğine hiç sarmalanmadı. Emanet anahtarı bu klasörü açmaz. İşletmecinin yapabileceği hiçbir şey bunu değiştirmez — sarmalama için klasörün parolası gerekir ve sunucu onu hiçbir zaman görmedi. Klasörün sahibi verebilir: parolayla kilidi açıp işletmeciye anahtar vermeyi seçebilir. O yapılana kadar parolayı ya da kurtarma anahtarını kullanın.',
+  'e2e.recover.escrow_other_key':
+    'Bu klasör BAŞKA bir kurulumun emanet anahtarını taşıyor. Başka yerde oluşturulup buraya geri yüklenmiş, bu yüzden bu kurulumun emanet anahtarı onu açmaz. Yalnızca sarmalandığı emanet anahtarının özel yarısı açabilir.',
   'e2e.recover.escrow_placeholder': 'Emanet özel anahtarını yapıştırın (PKCS#8, base64 ya da PEM)',
   'e2e.recover.bad_format':
     'Bu bir kurtarma anahtarına benzemiyor. Dörtlü sekiz grup, toplam 32 karakter olmalı.',
@@ -481,6 +485,25 @@ export const tr: Record<string, string> = {
   'e2e.recover.escrow_done': 'Emanet anahtarıyla açıldı — klasör sahibine bildirildi',
   'e2e.recover.unlock': 'Kilidi aç',
   'e2e.recover.busy': 'Açılıyor…',
+  'e2e.escrowoffer.title': 'İşletmeciye bu klasörün anahtarı verilsin mi?',
+  'e2e.escrowoffer.body':
+    'Bu klasör, burada anahtar emaneti açılmadan önce oluşturulmuş; bu yüzden kurulumun işletmecisi onu açamıyor. Şu anda — parolanız bellekteyken — filex bu klasörü emanet anahtarına sarmalayabilir. Dosyalarınız yeniden şifrelenmez, hiçbir yere taşınmaz; yalnızca anahtar dosyası değişir.',
+  'e2e.escrowoffer.consequence':
+    'Bunun anlamı: işletmeci, parolanız olmadan bu klasöre giren ikinci ve kalıcı bir yol kazanır. O anahtar kullanıldığında size bildirim gelir, ama bu bildirim bir denetim değil yalnızca bir duyurudur.',
+  'e2e.escrowoffer.learn_more': 'Emanet anahtarı neyi yapar, neyi yapamaz',
+  'e2e.escrowoffer.password_label': 'Klasör parolası',
+  'e2e.escrowoffer.password_required': 'Klasör parolasını girin.',
+  'e2e.escrowoffer.wrong_password': 'Bu, bu klasörün parolası değil.',
+  'e2e.escrowoffer.accept': 'İşletmeciye anahtar ver',
+  'e2e.escrowoffer.decline': 'Hayır, bende kalsın',
+  'e2e.escrowoffer.cancel': 'Vazgeç',
+  'e2e.escrowoffer.busy': 'Sarmalanıyor…',
+  'e2e.escrowoffer.done': 'İşletmeci artık bu klasörü emanet anahtarıyla açabilir',
+  'e2e.escrowoffer.declined_toast': 'Sizde kaldı. filex bu klasör için bir daha sormayacak.',
+  'e2e.escrowoffer.decline_failed':
+    'Cevabınız kaydedilemedi, bu yüzden filex bir dahakine yine soracak. Klasörde hiçbir şey değişmedi.',
+  'e2e.escrowoffer.failed': 'İşletmeciye bu klasörün anahtarı verilemedi',
+  'e2e.escrowoffer.strip_action': 'Emanet anahtarı…',
   'e2e.upgrade.title': 'Bu klasörün kurtarma anahtarı yok',
   'e2e.upgrade.body':
     'Kurtarma anahtarları eklenmeden önce oluşturulmuş, bu yüzden tek giriş yolu parolası. Şu anda — ve yalnız şu anda, parola bellekteyken — filex bir tane ekleyebilir. Dosyalarınız yeniden şifrelenmez, hiçbir yere taşınmaz.',
@@ -946,4 +969,64 @@ export const tr: Record<string, string> = {
   'conn.tokens.expiryNever': 'süresiz',
   'conn.tokens.capNote': 'Tavan hesabın ve yetkilerin — sahip olduğundan fazlasını istemek reddedilir, verilmez.',
   /* === /gezinti:g1 === */
+
+  /* === surucu:d1 — Sürücü kabuğu (uiProfile: 'drive', GitHub #14) ======== */
+  'drive.new': 'Yeni',
+  'drive.new.upload': 'Dosya yükle',
+  'drive.new.folder': 'Yeni klasör',
+  'drive.new.request': 'Dosya iste',
+  'drive.search.placeholder': '{scope} içinde ara',
+  'drive.search.placeholder_all': 'Dosyalarında ara',
+  'drive.search.hint_title': 'Her yerde ara ve komut çalıştır ({combo})',
+  'drive.storage.used': '{total} alanın {used} kadarı dolu',
+  'drive.storage.used_unlimited': '{used} kullanılıyor',
+  'drive.storage.label': 'Depolama',
+  'drive.section.folders': 'Klasörler',
+  'drive.section.files': 'Dosyalar',
+  'filter.aria': 'Süzgeçler',
+  'filter.type': 'Tür',
+  'filter.type.any': 'Her tür',
+  'filter.type.folder': 'Klasörler',
+  'filter.type.document': 'Belgeler',
+  'filter.type.spreadsheet': 'Hesap tabloları',
+  'filter.type.presentation': 'Sunumlar',
+  'filter.type.pdf': 'PDF’ler',
+  'filter.type.image': 'Görseller',
+  'filter.type.video': 'Videolar',
+  'filter.type.audio': 'Ses dosyaları',
+  'filter.type.archive': 'Arşivler',
+  'filter.type.code': 'Kod',
+  'filter.modified': 'Değiştirilme',
+  'filter.modified.any': 'Her zaman',
+  'filter.modified.today': 'Bugün',
+  'filter.modified.7d': 'Son 7 gün',
+  'filter.modified.30d': 'Son 30 gün',
+  'filter.modified.year': 'Bu yıl',
+  'filter.size': 'Boyut',
+  'filter.size.any': 'Her boyut',
+  'filter.size.lt1': '1 MB altı',
+  'filter.size.1to10': '1 - 10 MB',
+  'filter.size.10to100': '10 - 100 MB',
+  'filter.size.gt100': '100 MB üstü',
+  'filter.clear': 'Süzgeçleri temizle',
+  'filter.empty.title': 'Bu süzgeçlere uyan bir şey yok',
+  'filter.empty.hint': 'Bir süzgeci kaldır ya da yukarıdaki alandan her yerde ara.',
+  'filter.count': '{total} ögeden {shown} tanesi',
+  'inspector.tab.details': 'Ayrıntılar',
+  'inspector.tab.activity': 'Etkinlik',
+  'inspector.people': 'Erişimi olan kişiler',
+  'inspector.people.you': 'Sen',
+  'inspector.people.inherited': 'üst klasörden',
+  'inspector.people.empty': 'Yalnızca sen ve aşağıdaki bağlantıya sahip olanlar.',
+  'inspector.people.manage': 'Erişimi yönet',
+  'inspector.link': 'Paylaşım bağlantısı',
+  'inspector.link.none': 'Paylaşılmadı',
+  'inspector.link.create': 'Bağlantı oluştur',
+  'inspector.link.copy': 'Bağlantıyı kopyala',
+  'inspector.activity.empty': 'Bu öge için henüz etkinlik kaydı yok.',
+  'inspector.activity.hint': 'Sürümler dosya değiştikçe, yorumlar ise insanlar yazdıkça birikir.',
+  'inspector.activity.version': '{n}. sürüm kaydedildi',
+  'inspector.activity.comment': '{who} yorum yaptı',
+  'inspector.activity.select': 'Etkinliğini görmek için bir dosya ya da klasör seç.',
+  /* === /surucu:d1 === */
 };