@brftech/filex-core 0.31.0 → 0.33.0

package/src/composables/usePendingOps.ts

@@ -4,7 +4,7 @@
  * Backend POST /files/{copy,move,delete} returns `{op}` immediately
  * (status='pending') and the actual S3 work runs in a worker. The
  * client polls `/files/ops` every 2s while there's anything still
- * pending or running so the user gets live feedback ("3/5 kopyalandı").
+ * pending or running so the user gets live feedback ("3/5 copied").
  *
  * Polling is reference-counted: callers `register(op)` after starting a
  * new op; an interval ticks while the registered set has any non-

package/src/composables/useTabs.ts

@@ -1,5 +1,5 @@
 /**
- * useTabs — wiring:d1 sekmeler (çalışma alanı tab şeridi).
+ * useTabs — wiring:d1 tabs (the workspace tab strip).
  *
  * A LAYER ABOVE FileExplorer's location state, never a replacement for
  * it: each tab is a location snapshot `{ id, path, viewMode, split }`.

package/src/composables/useUploadChunked.ts

@@ -85,10 +85,17 @@ export interface UploadOptions {
   onDone?: (job: UploadJob, result: UploadResult) => void;
   onError?: (job: UploadJob, err: Error) => void;
   /**
-   * Wait for the backend transfer before resolving. Default false: the node is
-   * listed the moment the commit is accepted, which is the whole point of
-   * staging. `true` is for a caller that must not report success until the
-   * bytes are on the driver.
+   * Wait for the backend transfer before resolving. Defaults to TRUE, because
+   * "the server has the bytes" and "the storage has the bytes" are different
+   * claims and only the second one is an upload.
+   *
+   * ⚠ It used to default to false and no caller ever set it, so the job went
+   * straight to `done` on the 202 — a transfer that failed afterwards in the
+   * ops worker left the user looking at a finished upload for a file that was
+   * never stored (issue #16: every file over the chunk threshold, on every S3
+   * backend). The `transferring` phase is short for a healthy storage and is
+   * the only place a failure can still be shown, so it is the default; pass
+   * false to opt out where the wait is genuinely unwanted.
    */
   waitForTransfer?: boolean;
 }
@@ -389,7 +396,7 @@ export function useUploadChunked(
       job.opId = result?.op_id;
       job.nodeId = result?.node_id;
 
-      if (opts.waitForTransfer && result?.op_id && api.endpoints.opsShow) {
+      if (opts.waitForTransfer !== false && result?.op_id && api.endpoints.opsShow) {
         job.status = 'transferring';
         report();
         await waitForOp(result.op_id);
@@ -484,17 +491,31 @@ export function useUploadChunked(
       if (!tmpl) return;
       const url = tmpl.replace('{id}', String(opId));
       let delay = 200;
+      // ⚠ A tray read that keeps failing must not park the upload in
+      // `transferring` for ever. One hiccup is not a verdict, but a row we
+      // cannot read at all (purged, or the endpoint is gone) is unknowable, so
+      // after a bounded run of failures the wait ends and the job settles the
+      // way it did before the wait existed — optimistic, but not hung.
+      let misses = 0;
       for (;;) {
         if (cancelled) throw new DOMException('Aborted by user', 'AbortError');
         try {
           const op = await api.jsonFetch<{ status?: string; error?: string }>(url);
           if (op?.status === 'ok') return;
           if (op?.status === 'failed' || op?.status === 'partial') {
-            throw new Error(op.error || 'transfer failed');
+            throw new TransferFailedError(op.error || 'transfer failed');
           }
+          misses = 0;
         } catch (err) {
-          if ((err as Error).message === 'transfer failed' || (err as Error).name === 'AbortError') throw err;
+          // ⚠ The verdict is told apart from the hiccup by TYPE, not by
+          // message. It used to be `message === 'transfer failed'`, which only
+          // matched when the server sent NO error text: the moment it sent a
+          // real one — which is every interesting failure — the throw above was
+          // swallowed here and the poll span for ever. Harmless while nothing
+          // set waitForTransfer; a hang the moment anything did.
+          if (err instanceof TransferFailedError || (err as Error).name === 'AbortError') throw err;
           /* a hiccup reading the tray is not a failed transfer */
+          if (++misses >= MAX_OP_POLL_MISSES) return;
         }
         await sleep(delay);
         delay = Math.min(delay * 2, 2000);
@@ -514,6 +535,17 @@ export function useUploadChunked(
   };
 }
 
+/** How many consecutive unreadable op polls end the transfer wait (~7s). */
+const MAX_OP_POLL_MISSES = 6;
+
+/** The backend said the transfer failed — as opposed to "I could not ask". */
+class TransferFailedError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'TransferFailedError';
+  }
+}
+
 function sleep(ms: number): Promise<void> {
   return new Promise((r) => setTimeout(r, ms));
 }

package/src/index.ts

@@ -98,7 +98,7 @@ export {
 } from './composables/useMonacoLoader';
 
 // ——— Locale catalogue (consumers may merge their own keys) ———
-export { messages, tr, en } from './locales';
+export { messages, tr, en, resolveLocale, detectLocale } from './locales';
 
 /* wiring:c1 — theme registry + gallery (hosts can list/apply themes programmatically) */
 export {
@@ -150,7 +150,7 @@ export type { TabState, TabSplit, TabsApi } from './composables/useTabs';
 export { default as TabBar } from './components/TabBar.vue';
 export { default as SecondaryPane } from './components/SecondaryPane.vue';
 /* /wiring:d1 */
-/* wiring:e2 — uçtan uca şifreli klasörler (WebCrypto; docs/E2E-ENCRYPTION.md) */
+/* wiring:e2 — end-to-end encrypted folders (WebCrypto; docs/E2E-ENCRYPTION.md) */
 export {
   E2E_MARKER_NAME,
   E2E_MAGIC,
@@ -173,6 +173,10 @@ export {
   unlockWithEscrowKey,
   markerHasRecovery,
   markerHasEscrow,
+  escrowAvailability,
+  escrowOfferState,
+  addEscrowSlot,
+  declineEscrowSlot,
   generateRecoveryKey,
   formatRecoveryKey,
   parseRecoveryKey,
@@ -190,6 +194,8 @@ export type {
   E2eFmkMode,
   E2eRecoverySlot,
   E2eEscrowSlot,
+  EscrowAvailability,
+  EscrowOfferState,
   CreateFolderOptions,
   CreatedFolder,
 } from './lib/e2ecrypto';

package/src/lib/e2ecrypto.ts

@@ -40,10 +40,19 @@
  *   - No key, password or recovery key is ever stored, logged or sent to a
  *     server. The FMK lives in an in-memory key ring and dies with the tab.
  *   - `deriveKek` imports non-extractable. Raw KEK bytes are produced ONLY
- *     by `deriveKekBits`, only while upgrading a v1 marker, and only long
- *     enough to wrap them into the new slots.
+ *     by `deriveKekBits`, only for a marker whose FMK *is* the KEK
+ *     (`upgradeMarkerV1`, and `addEscrowSlot` on a folder it produced), and
+ *     only long enough to wrap them into a slot.
  *   - A folder created while escrow was off carries no escrow slot, so the
- *     escrow key cannot open it. That is arithmetic, not policy.
+ *     escrow key cannot open it, and nothing the OPERATOR does changes
+ *     that — not enabling escrow, not adopting it, not any admin action or
+ *     future version. That is arithmetic, not policy: adding a slot needs
+ *     the folder master key, and the server has never held a credential
+ *     that produces one.
+ *   - The folder's OWNER can, from inside, with the password:
+ *     `addEscrowSlot`. That is the only door, it opens from one side only,
+ *     and it is the reason `escrowAvailability` says "not as things stand"
+ *     rather than "never".
  *
  * File layout ('filexe2e' magic, fixed 97-byte header) — UNCHANGED in v2:
  *   [0..8)   magic  "filexe2e"
@@ -114,6 +123,23 @@ export interface E2eMarker {
   rk?: E2eRecoverySlot;
   /** v2 only, optional: the operator escrow slot. */
   esc?: E2eEscrowSlot;
+  /**
+   * v2 only, optional: an ISO timestamp recording that this folder's owner
+   * was OFFERED an escrow slot and said no.
+   *
+   * It lives in the marker rather than in browser storage because the unit
+   * of the decision is the FOLDER, not the device: the same person opening
+   * the folder from their phone must not be asked again, and a decision
+   * that vanished when someone cleared their site data would be no decision
+   * at all. It travels with the folder through a move, a backup and a
+   * restore, for the same reason the key slots do.
+   *
+   * It holds no key material and hides nothing from the operator — it is a
+   * record of an answer, and its only effect is that filex stops asking.
+   * `addEscrowSlot` clears it, so a decline is reversible by the one person
+   * who can reverse it.
+   */
+  esc_declined?: string;
 }
 
 /** Thrown on wrong password / corrupted ciphertext (GCM tag mismatch). */
@@ -500,6 +526,126 @@ export async function upgradeMarkerV1(
   return { marker: next, fmk: kek, recoveryKey };
 }
 
+/**
+ * Give an EXISTING v2 folder an escrow slot, in place, using the folder
+ * password its owner has just typed.
+ *
+ * ── Why this exists ─────────────────────────────────────────────────
+ *
+ * Escrow used to be all-or-nothing at install time, and then adoptable but
+ * never retroactive: on any installation that had been running for a while,
+ * escrow covered only folders nobody had created yet. On a real deployment
+ * the folders that matter already exist, so "new folders only" means escrow
+ * covers nothing anyone cares about.
+ *
+ * The server still cannot do this, and that has not changed: adding a slot
+ * needs the folder master key, which needs a credential the server has never
+ * held. What CAN do it is the browser, at the one moment the password is in
+ * memory — exactly where `upgradeMarkerV1` already lives. Same moment, same
+ * shape, different slot.
+ *
+ * ⚠⚠ Accepting hands the operator of this installation a second, permanent
+ * way into this folder. It is the folder's owner who decides, from inside,
+ * with the password; no configuration change and no admin action can do it
+ * for them. The caller MUST say that in those words before calling this —
+ * see `e2e.escrowoffer.*` in the locales.
+ *
+ * ⚠ v2 only. A v1 marker has no slots at all; the path for those is
+ * `upgradeMarkerV1`, which already seals an escrow slot when the
+ * installation has a key and already discloses it. Two doors into the same
+ * room would be two chances to get the disclosure wrong.
+ *
+ * ⚠ No file is re-encrypted, moved or rewritten. Only `.filex-e2e.json`
+ * changes, and only by gaining `esc` (and losing `esc_declined`).
+ */
+export async function addEscrowSlot(
+  marker: E2eMarker,
+  password: string,
+  escrowPublicKey: string,
+): Promise<E2eMarker> {
+  if (marker.v !== 2) throw new Error('e2e: not a v2 marker');
+  if (marker.esc) throw new Error('e2e: this folder already has an escrow slot');
+  if (!escrowPublicKey) throw new Error('e2e: no escrow public key');
+
+  const salt = b64ToBytes(marker.salt);
+  const kek = await deriveKek(password, salt, marker.iter);
+  // Prove the password before touching anything, exactly as the v1 upgrade
+  // does. A wrong password here must not produce a marker at all — half a
+  // marker is a folder nobody can open.
+  const proof = await gcmOpen(kek, marker.verify);
+  if (!proof || new TextDecoder().decode(proof) !== VERIFY_PLAINTEXT) {
+    throw new E2eDecryptError('e2e: wrong password');
+  }
+
+  // The raw FMK, by mode. `wrapped` keeps a random FMK in `fmk_pw`, so the
+  // bytes come back from a GCM open and no extractable KEK is ever derived.
+  // `kek` (a v1 folder upgraded in place) defines the FMK AS the password
+  // key, so those very bytes are what the slot has to wrap — the one case
+  // that needs `deriveKekBits`, for the same reason `upgradeMarkerV1` does.
+  let rawFmk: Uint8Array;
+  if (marker.fmk === 'wrapped') {
+    const opened = marker.fmk_pw ? await gcmOpen(kek, marker.fmk_pw) : null;
+    if (!opened || opened.length !== FMK_LEN) {
+      throw new E2eDecryptError('e2e: could not unwrap the folder master key');
+    }
+    rawFmk = opened;
+  } else {
+    rawFmk = await deriveKekBits(password, salt, marker.iter);
+  }
+
+  const esc = await sealEscrowSlot(rawFmk, escrowPublicKey);
+  rawFmk.fill(0);
+
+  const next: E2eMarker = { ...marker, esc };
+  // A decline that is now moot. Leaving it would make the record say two
+  // contradictory things about the same folder.
+  delete next.esc_declined;
+  return next;
+}
+
+/**
+ * Record that this folder's owner was offered an escrow slot and declined.
+ *
+ * A refusal is a decision, not a delay: without this the offer would come
+ * back on every single unlock, which is how people learn to click past
+ * security dialogs without reading them. Nothing about the folder's keys
+ * changes — the only effect is that filex stops asking.
+ *
+ * Reversible by `addEscrowSlot`, which is the way back for somebody who
+ * says no today and changes their mind next month.
+ */
+export function declineEscrowSlot(marker: E2eMarker, when: string): E2eMarker {
+  return { ...marker, esc_declined: when };
+}
+
+/**
+ * Whether this folder's owner should be offered an escrow slot, and whether
+ * they have already answered.
+ *
+ *   'n/a'       nothing to offer: the installation has no escrow key, the
+ *               folder already has a slot, or the marker is v1 (whose path
+ *               is `upgradeMarkerV1`).
+ *   'offer'     the offer applies and no answer has been recorded.
+ *   'declined'  the offer applies and the owner said no. Do not ask again;
+ *               leave a way back.
+ *
+ * ⚠ This deliberately does NOT look at whether the folder is unlocked. That
+ * is the caller's business, and it matters: the offer may only be shown
+ * after an unlock actually succeeded, because accepting needs the password
+ * and because asking someone who cannot open the folder to give away a key
+ * to it is asking the wrong person.
+ */
+export type EscrowOfferState = 'n/a' | 'offer' | 'declined';
+
+export function escrowOfferState(
+  m: E2eMarker | null,
+  installationKid: string | null | undefined,
+): EscrowOfferState {
+  if (!installationKid) return 'n/a';
+  if (!m || m.v !== 2 || m.esc) return 'n/a';
+  return m.esc_declined ? 'declined' : 'offer';
+}
+
 /** Parse marker JSON text; returns null when the shape is not a marker we read. */
 export function parseMarker(text: string): E2eMarker | null {
   try {
@@ -527,6 +673,48 @@ export function markerHasEscrow(m: E2eMarker | null): boolean {
   return !!m && m.v === 2 && !!m.esc;
 }
 
+/**
+ * Why the escrow door is, or is not, on offer for this folder.
+ *
+ *   'off'        this installation has no escrow key at all.
+ *   'available'  the folder is sealed to THIS installation's escrow key.
+ *   'predates'   the installation has an escrow key, and this folder has no
+ *                escrow slot: it was created before escrow existed here.
+ *   'other-key'  the folder carries an escrow slot sealed to a DIFFERENT
+ *                key id — it came from another installation, via a restore
+ *                or a copied data directory.
+ *
+ * ⚠ 'predates' exists because escrow can be ADOPTED by an installation
+ * that already has folders (FILEX_INSTALLATION_E2E_ESCROW_ADOPT), and
+ * adoption is not retroactive: the folder's master key was wrapped to its
+ * recovery paths when the folder was created. Before this distinction
+ * existed the dialog simply showed no Escrow tab, which is true but says
+ * nothing — an admin who knows escrow is on reads a missing tab as a bug,
+ * tries the key anyway, and learns the real answer from a failure. The UI
+ * has to say it instead.
+ *
+ * ⚠⚠ 'predates' means "not as things stand", NOT "never". The folder's
+ * owner can add a slot from inside with the password (`addEscrowSlot`,
+ * offered at unlock). Any wording built on this state has to leave that
+ * door visible, or it tells an operator their escrow key can never reach a
+ * folder whose owner could hand it over this afternoon.
+ *
+ * ⚠ 'other-key' was a quieter lie: the dialog labelled the escrow field
+ * with the INSTALLATION's key id whatever the folder's slot said, so a
+ * folder restored from another install looked openable by the key the
+ * operator has, and was not.
+ */
+export type EscrowAvailability = 'off' | 'available' | 'predates' | 'other-key';
+
+export function escrowAvailability(
+  m: E2eMarker | null,
+  installationKid: string | null | undefined,
+): EscrowAvailability {
+  if (!installationKid) return 'off';
+  if (!markerHasEscrow(m)) return 'predates';
+  return m!.esc!.kid === installationKid ? 'available' : 'other-key';
+}
+
 /**
  * Check `password` against a folder marker. Resolves to the derived KEK on
  * success, or `null` on a wrong password (GCM tag mismatch on the verify

package/src/lib/fileFilters.ts

@@ -0,0 +1,143 @@
+/**
+ * surucu:d1 — the filter row's model, kept out of the components so the
+ * predicate has one definition and can be tested without a DOM.
+ *
+ * ⚠ EVERY filter here answers from a field the listing row ALREADY carries
+ * (`type`, `extension`, `mime_type`, `size`, `last_modified`). That is not a
+ * shortcut, it is the constraint: `GET /api/files/manager?action=index` reads
+ * no `mime` / `min_size` / `modified_after` / `owner` parameter — it returns
+ * the whole directory and ignores anything else you send it (handlers/manager.go
+ * `List`, the complete parameter list is `action`, `path`, `filter`, `storage`,
+ * `parent`, `cache`). A control wired to a parameter the server does not read
+ * looks like it works and quietly changes nothing, which is worse than not
+ * shipping it.
+ *
+ * Because the endpoint has no `limit`/`offset` either, the listing in hand IS
+ * the folder — so filtering it client-side is complete for the folder, not a
+ * filter over "the first page". That is exactly why these three are honest and
+ * a People/owner filter is not: `nodes.owner_id` exists for quota accounting,
+ * is nil for anything a sync discovered, and is serialized by nothing
+ * (handlers/shared.go: "There is no per-node owner").
+ */
+import type { FileNode } from '../types/FileNode';
+import { iconFamilyFor, type IconFamily } from './fileIcons';
+
+export type TypeFilter =
+  | 'any'
+  | 'folder'
+  | 'document'
+  | 'spreadsheet'
+  | 'presentation'
+  | 'pdf'
+  | 'image'
+  | 'video'
+  | 'audio'
+  | 'archive'
+  | 'code';
+
+export type ModifiedFilter = 'any' | 'today' | '7d' | '30d' | 'year';
+
+export type SizeFilter = 'any' | 'lt1' | '1to10' | '10to100' | 'gt100';
+
+export interface DriveFilters {
+  type: TypeFilter;
+  modified: ModifiedFilter;
+  size: SizeFilter;
+}
+
+export const EMPTY_FILTERS: DriveFilters = { type: 'any', modified: 'any', size: 'any' };
+
+export function filtersActive(f: DriveFilters): boolean {
+  return f.type !== 'any' || f.modified !== 'any' || f.size !== 'any';
+}
+
+export function activeFilterCount(f: DriveFilters): number {
+  return (f.type !== 'any' ? 1 : 0) + (f.modified !== 'any' ? 1 : 0) + (f.size !== 'any' ? 1 : 0);
+}
+
+/** Families a type choice accepts. `iconFamilyFor` is the taxonomy the icons
+ *  already use, so a row's filter group and its glyph can never disagree. */
+const TYPE_FAMILIES: Record<Exclude<TypeFilter, 'any'>, IconFamily[]> = {
+  folder: ['folder'],
+  document: ['doc', 'text'],
+  spreadsheet: ['sheet'],
+  presentation: ['slides'],
+  pdf: ['pdf'],
+  image: ['image'],
+  video: ['video'],
+  audio: ['audio'],
+  archive: ['archive'],
+  code: ['code'],
+};
+
+/** MIME fallback — a file with no extension still has a `mime_type` from the
+ *  backend sniffer, and "IMG_0042" with no suffix is a real thing people have. */
+const MIME_PREFIXES: Partial<Record<Exclude<TypeFilter, 'any'>, string[]>> = {
+  image: ['image/'],
+  video: ['video/'],
+  audio: ['audio/'],
+  pdf: ['application/pdf'],
+  document: ['text/plain', 'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessing'],
+  spreadsheet: ['text/csv', 'application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheet'],
+  presentation: ['application/vnd.ms-powerpoint', 'application/vnd.openxmlformats-officedocument.presentation'],
+  archive: ['application/zip', 'application/x-tar', 'application/gzip', 'application/x-7z'],
+};
+
+function matchesType(n: FileNode, t: TypeFilter): boolean {
+  if (t === 'any') return true;
+  if (t === 'folder') return n.type === 'dir';
+  if (n.type === 'dir') return false;
+  if (TYPE_FAMILIES[t].includes(iconFamilyFor(n))) return true;
+  const mime = (n.mime_type || '').toLowerCase();
+  return !!mime && (MIME_PREFIXES[t] ?? []).some((p) => mime.startsWith(p));
+}
+
+/** `now` is a parameter so a test can pin the clock instead of sleeping. */
+function matchesModified(n: FileNode, f: ModifiedFilter, now: number): boolean {
+  if (f === 'any') return true;
+  const ms = typeof n.last_modified === 'number' ? n.last_modified : 0;
+  // No timestamp = no answer. Dropping the row would hide files whose driver
+  // gave us nothing; keeping it would put them in "Today". Hiding is the
+  // honest one: the row does not satisfy "modified today", it is unknown.
+  if (!ms) return false;
+  if (f === 'year') {
+    return new Date(ms).getFullYear() === new Date(now).getFullYear();
+  }
+  if (f === 'today') {
+    const start = new Date(now);
+    start.setHours(0, 0, 0, 0);
+    return ms >= start.getTime();
+  }
+  const days = f === '7d' ? 7 : 30;
+  return ms >= now - days * 86_400_000;
+}
+
+const MB = 1024 * 1024;
+
+function matchesSize(n: FileNode, f: SizeFilter): boolean {
+  if (f === 'any') return true;
+  // ⚠ Folders drop out of every size choice rather than passing through. A
+  // directory row's `size` is 0 from the projector, so "under 1 MB" would
+  // otherwise list every folder in the drive — an answer that looks like a
+  // measurement and is not one.
+  if (n.type === 'dir') return false;
+  const s = typeof n.size === 'number' ? n.size : 0;
+  if (f === 'lt1') return s < MB;
+  if (f === '1to10') return s >= MB && s < 10 * MB;
+  if (f === '10to100') return s >= 10 * MB && s < 100 * MB;
+  return s >= 100 * MB;
+}
+
+export function applyFilters(
+  files: FileNode[],
+  f: DriveFilters,
+  now: number = Date.now(),
+): FileNode[] {
+  // No active filter → the SAME array reference, so an unfiltered explorer
+  // renders exactly what it rendered before this file existed.
+  if (!filtersActive(f)) return files;
+  return files.filter(
+    (n) =>
+      matchesType(n, f.type) && matchesModified(n, f.modified, now) && matchesSize(n, f.size),
+  );
+}

package/src/lib/listing.ts

@@ -120,14 +120,61 @@ export function makeTrashRow(adapter: string): FileNode {
  * Inject the virtual `.trash` row at the front of a root listing when
  * enabled. Returns true if a row was added (so the caller can hydrate
  * it). Mutates `files` in place. Single source for both panes.
+ *
+ * ⚠ `isSearchResult` is not optional politeness — it is the one thing
+ * `dirname` cannot tell you. A search answers with the SCOPE it searched, so
+ * `?action=search&path=main://&filter=brief` comes back with
+ * `dirname: "main://"`, identical to the folder listing of the same path
+ * (measured). Without this flag the sentinel is unshifted into the search
+ * results, and a search for "brief" answers with `brief.md` and a folder
+ * called Trash that is not a folder, is not a hit, and cannot be searched for.
+ * Same family as the `.trash` / `.shared` sentinel bugs fixed in v0.31.0: a
+ * virtual row rendered somewhere it has no meaning.
+ *
+ * Both flags default to `false`, i.e. to the historical behaviour: a caller
+ * that never searches and has no panel — which is what an embed with
+ * `sideNav: false` is — keeps the row it has always had by saying nothing.
  */
+export interface TrashRowContext {
+  /**
+   * This listing is the answer to a SEARCH, not the contents of a folder.
+   *
+   * ⚠ The one thing `dirname` cannot tell you: a search answers with the scope
+   * it searched, so `?action=search&path=main://&filter=notes` comes back
+   * carrying `dirname: "main://"`, byte-identical to that folder's listing
+   * (measured). Without this the sentinel lands among the hits.
+   */
+  isSearchResult?: boolean;
+  /**
+   * The navigation panel is already offering Trash as a destination.
+   *
+   * ⚠ This row only ever existed because a listing had no other way into the
+   * bin. Once the panel carries a Trash entry that reason is gone and the row
+   * is a second door to the same place — drawn as a 0-byte folder that is not
+   * a folder, sitting among real ones, while the panel's own Trash entry is
+   * three inches to its left. Owner's decision, this release: do not offer the
+   * same door twice.
+   *
+   * ⚠ It is a question about the PANEL, not about the profile. The duplication
+   * is exactly as wrong in `standard` with the panel on as it is in `drive`;
+   * keying it to `uiProfile` would be a rule about the wrong thing.
+   */
+  navOffersTrash?: boolean;
+}
+
 export function injectTrashRow(
   files: FileNode[],
   adapter: string,
   dirname: string,
   trashVisible: boolean,
+  ctx: TrashRowContext = {},
 ): boolean {
+  // The host's own switch, and still the outer gate: `trashVisible: false`
+  // means no Trash anywhere — no row here, and no entry in the panel either,
+  // so this must be answered before anything about the panel is considered.
   if (!trashVisible) return false;
+  if (ctx.navOffersTrash) return false;
+  if (ctx.isSearchResult) return false;
   if (isTrashListing(dirname)) return false;
   if (!isStorageRootDir(dirname)) return false;
   files.unshift(makeTrashRow(adapter));

package/src/lib/themes.ts

@@ -105,7 +105,7 @@ export const THEMES: ThemeDef[] = [
     },
   },
   {
-    // Gece Mavisi — deep indigo/navy.
+    // Night Blue — deep indigo/navy.
     id: 'night',
     nameKey: 'theme.name.night',
     light: {
@@ -140,7 +140,7 @@ export const THEMES: ThemeDef[] = [
     },
   },
   {
-    // Orman — calm greens.
+    // Forest — calm greens.
     id: 'forest',
     nameKey: 'theme.name.forest',
     light: {
@@ -175,7 +175,7 @@ export const THEMES: ThemeDef[] = [
     },
   },
   {
-    // Kehribar — warm amber/bronze.
+    // Amber — warm amber/bronze.
     id: 'amber',
     nameKey: 'theme.name.amber',
     light: {
@@ -210,7 +210,7 @@ export const THEMES: ThemeDef[] = [
     },
   },
   {
-    // Leylak — soft purple.
+    // Lilac — soft purple.
     id: 'lilac',
     nameKey: 'theme.name.lilac',
     light: {
@@ -245,7 +245,7 @@ export const THEMES: ThemeDef[] = [
     },
   },
   {
-    // Yüksek Kontrast — black/white with strong borders, saturated accents.
+    // High Contrast — black/white with strong borders, saturated accents.
     id: 'contrast',
     nameKey: 'theme.name.contrast',
     light: {
@@ -284,7 +284,7 @@ export const THEMES: ThemeDef[] = [
     },
   },
   {
-    // Yumuşak Gri — desaturated, quiet neutral.
+    // Soft Gray — desaturated, quiet neutral.
     id: 'gray',
     nameKey: 'theme.name.gray',
     light: {
@@ -319,7 +319,7 @@ export const THEMES: ThemeDef[] = [
     },
   },
   {
-    // Terminal Yeşili — phosphor green, monospace face for the full CRT vibe.
+    // Terminal Green — phosphor green, monospace face for the full CRT vibe.
     id: 'terminal',
     nameKey: 'theme.name.terminal',
     light: {

package/src/lib/transfer.ts

@@ -3,14 +3,14 @@
  *
  * Three gestures land on the same wire call — drag a row onto a folder, paste
  * after Ctrl+X, paste after Ctrl+C — and they do NOT mean the same thing once
- * the two ends live in different depolar:
+ * the two ends live in different storages:
  *
  *   • Ctrl+C → paste is a copy, wherever it lands.
- *   • Ctrl+X → paste is a move, wherever it lands. Across depolar the server
+ *   • Ctrl+X → paste is a move, wherever it lands. Across storages the server
  *     streams the bytes over and then deletes the original; before v0.27.0 the
  *     explorer quietly downgraded this to a copy and the user was left with the
  *     file in both places, believing they had moved it.
- *   • Dragging is a move inside one depo and a COPY across two — the rule
+ *   • Dragging is a move inside one storage and a COPY across two — the rule
  *     Explorer and Finder have taught everyone: a drag between drives copies.
  *
  * Kept as a pure function so both the pane path and the clipboard path ask the
@@ -23,13 +23,13 @@ export function wireAdapterOf(p: string): string {
   return i === -1 ? '' : p.slice(0, i);
 }
 
-/** What the caller asked for. `auto` is a drag: let the depolar decide. */
+/** What the caller asked for. `auto` is a drag: let the storages decide. */
 export type TransferIntent = 'auto' | 'copy' | 'move';
 
 export interface TransferPlan {
   /** What to actually ask the server for. */
   kind: 'copy' | 'move';
-  /** True when at least one source lives in another depo than the target. */
+  /** True when at least one source lives in another storage than the target. */
   cross: boolean;
 }
 
@@ -40,7 +40,7 @@ export function resolveTransfer(
 ): TransferPlan {
   const target = wireAdapterOf(targetWire);
   // A source with no prefix is a legacy embedder's bare path: it can only mean
-  // "the same depo I am looking at", so it never counts as crossing.
+  // "the same storage I am looking at", so it never counts as crossing.
   const cross = sources.some((p) => {
     const a = wireAdapterOf(p);
     return a !== '' && target !== '' && a !== target;