@brftech/filex-core 0.42.2 → 0.43.0

package/src/lib/serviceGate.ts

@@ -0,0 +1,104 @@
+/**
+ * serviceGate — what an action that needs an OPTIONAL external service
+ * (ONLYOFFICE, draw.io, the converter…) becomes when that service is missing.
+ *
+ * ⚠⚠ The owner's rule, 2026-09-21, after `Config fetch 503: {"error":
+ * "onlyoffice not configured"}` was shown to a person who had clicked "Open" on
+ * a .docx on an install with no document server:
+ *
+ *     "disabled with a reason for administrators, hidden for everybody else"
+ *
+ * An administrator CAN fix it, so a greyed entry that says what is missing and
+ * where to set it up is useful to them. For everybody else it is a button that
+ * can never work and only invites a click, so it is not offered at all. And
+ * nobody, ever, is shown a raw status or a JSON body.
+ *
+ * ⚠ One function, so every entry that depends on a service answers the same
+ * way (filex lesson #67: a rule written twice drifts the first time one copy is
+ * touched). "Is this caller an administrator" is the server's answer
+ * (`capabilities.caller_admin` — the same checks the admin routes apply,
+ * supertenant included), never a guess made in the browser.
+ */
+
+/** The fields a `ContextAction` takes from the gate. */
+export interface ServiceGate {
+  hidden?: boolean;
+  disabled?: boolean;
+  title?: string;
+}
+
+/**
+ * `available` — the service is configured and healthy.
+ * `callerAdmin` — this caller could go and configure it.
+ * `reason` — the sentence an administrator reads (what is missing, where to
+ * fix it), already translated.
+ */
+export function gateOnService(available: boolean, callerAdmin: boolean, reason: string): ServiceGate {
+  if (available) return {};
+  if (callerAdmin) return { disabled: true, title: reason };
+  return { hidden: true };
+}
+
+/**
+ * The extensions the document server opens. ⚠ The ONE list: the preview
+ * modal decides "this is an office document" from it and the explorer's menu
+ * decides "Open needs ONLYOFFICE" from it — two lists would let a .rtf be
+ * previewed as office and still offered an Open that cannot work.
+ */
+/**
+ * THE LEGACY CONVERTER — the iframe service behind `FILEX_CONVERT_URL` /
+ * External services → Converter — against the Convert APP.
+ *
+ * ⚠⚠ ONE of everything. With both in place an administrator's menu on a .docx
+ * read "Dönüştür" (the service, greyed, "not set up") right above
+ * "Dönüştür…" (the app): two entries with one name and two behaviours (QA,
+ * 2026-09-21). The release plan's rule, made unbreakable by construction:
+ *
+ *   - the Convert app is offered on this instance → the legacy entry is never
+ *     offered, to anybody, on any file (not "on files the app does not take":
+ *     the two would still meet on the next file);
+ *   - the legacy service is not configured → not offered either, not even
+ *     greyed for an administrator: its replacement is the app, and pointing
+ *     at a retiring service to "set it up" sends them the wrong way;
+ *   - configured but not answering → the usual split (gateOnService):
+ *     greyed with the reason for an administrator, hidden for everybody else;
+ *   - configured and answering → offered; an administrator reads that it is
+ *     being retired and what replaces it.
+ */
+export interface LegacyConvertInput {
+  /** The Convert app has an action on this instance (lib/pluginMenu `convertAppOffered`). */
+  appOffered: boolean;
+  /** The legacy service is switched on (or the host passed its own URL). */
+  configured: boolean;
+  /** …and it answers its health check. */
+  healthy: boolean;
+  callerAdmin: boolean;
+  /** Why it is greyed: configured but not answering. */
+  unhealthyReason: string;
+  /** What an administrator reads on a working entry: it is being retired. */
+  adminNote: string;
+}
+
+export function legacyConvertGate(o: LegacyConvertInput): ServiceGate {
+  if (o.appOffered || !o.configured) return { hidden: true };
+  const g = gateOnService(o.healthy, o.callerAdmin, o.unhealthyReason);
+  if (g.hidden || g.disabled) return g;
+  return o.callerAdmin ? { title: o.adminNote } : {};
+}
+
+export const OFFICE_EXTS: readonly string[] = [
+  'docx',
+  'doc',
+  'xlsx',
+  'xls',
+  'pptx',
+  'ppt',
+  'odt',
+  'ods',
+  'odp',
+  'rtf',
+];
+
+export function isOfficeExt(ext: string | null | undefined): boolean {
+  return OFFICE_EXTS.includes(String(ext ?? '').toLowerCase());
+}

package/src/lib/shareTtl.ts

@@ -9,7 +9,21 @@
 // from the same rule. A surface that clamps differently would mean the same
 // product behaves two ways.
 
-import { formatInstant } from '../composables/useLocale'; /* zaman:z1 */
+import { formatWhen, translate } from '../composables/useLocale'; /* zaman:z1 */
+
+/**
+ * A catalogue string for a bare locale code — this is a module, not a
+ * component, so it cannot call `useLocale`. ⚠ Through `translate`, which is
+ * `t()`'s own lookup: a language pack's words reach these lines too (they were
+ * `tr ? … : …` pairs, which a pack could not translate and which printed
+ * TURKISH under any language that was not English), and "{days} days" takes
+ * its form by the pack language's plural rule, not English's. It had a copy
+ * of `t()`'s lookup, and the copy read English's `_one` under a pack that had
+ * written only the plain form.
+ */
+function say(locale: string, key: string, vars: Record<string, string | number> = {}): string {
+  return translate(locale, key, vars);
+}
 
 export interface ExpiryOption {
   /** Days; 0 = never. */
@@ -76,11 +90,11 @@ export function expiryInputMax(maxDays: number | undefined, now: Date = new Date
 /** "Valid until 30 Aug 2026, 14:05" / "Does not expire" from the server's `expires_at`. */
 export function validUntilLine(
   expiresAt: string | null | undefined,
-  locale: 'tr' | 'en',
+  locale: string,
   /** The explorer whose clock applies (lib/timezone EXPLORER_CLOCK). */
   clock?: symbol,
 ): string {
-  if (!expiresAt) return locale === 'tr' ? 'Bu bağlantının süresi yoktur.' : 'This link does not expire.';
+  if (!expiresAt) return say(locale, 'share.ttl.never');
   const d = new Date(expiresAt);
   // zaman:z1 — the viewer's chosen clock, not the browser's. "Valid until
   // 14:05" is a deadline, and a deadline printed in somebody else's zone is
@@ -90,19 +104,19 @@ export function validUntilLine(
   // then map the tag itself, to 'en-GB', while useLocale mapped it to
   // 'en-US': the same deadline was spelled "20 Sept 2026, 13:53" in the share
   // dialog and "Sep 20, 2026, 1:53 PM" in the listing behind it.
-  const when = Number.isNaN(d.getTime())
-    ? expiresAt
-    : formatInstant(d, locale, { dateStyle: 'medium', timeStyle: 'short' }, clock);
-  return locale === 'tr' ? `Bu bağlantı ${when} tarihine kadar geçerli.` : `This link is valid until ${when}.`;
+  //
+  // ⚠ And the FORMAT is the explorer's (`formatWhen`), not a `dateStyle:
+  // 'medium'` pair of its own: that printed "21 Eyl 2026 15:02" beside the
+  // listing's "21 Eyl 2026, 14:50" (QA, 2026-09-21).
+  const when = Number.isNaN(d.getTime()) ? expiresAt : formatWhen(d, locale, { time: true }, clock);
+  return say(locale, 'share.ttl.until', { when });
 }
 
 /** The hint under an expiry control: what the server will allow at most. */
-export function ttlCeilingHint(maxDays: number | undefined, locale: 'tr' | 'en'): string {
+export function ttlCeilingHint(maxDays: number | undefined, locale: string): string {
   const max = maxDays && maxDays > 0 ? Math.floor(maxDays) : 0;
   if (!max) return '';
-  return locale === 'tr'
-    ? `Bağlantılar en fazla ${max} gün geçerli olabilir (sunucu ayarı).`
-    : `Links can be valid for at most ${max} day${max === 1 ? '' : 's'} (server setting).`;
+  return say(locale, 'share.ttl.ceiling', { days: max });
 }
 
 /**

package/src/lib/signFonts.ts

@@ -0,0 +1,85 @@
+/**
+ * signFonts — the closed set of faces a signature may be written in.
+ *
+ * A typed signature and a `pdf-fields` text field both let the signer choose
+ * how their words are drawn, and the choice TRAVELS: it rides back to the
+ * plugin as `font` (see docs/APP-PLUGINS-API.md → `pdf-fields` props), which
+ * then stamps the PDF in that face. So the browser and the stamping plugin
+ * have to agree on a small, stable vocabulary — five keys, not a free-text
+ * CSS family — and this file is that vocabulary.
+ *
+ * ⚠ ONE definition, three readers: the signature pad's "type" mode, the
+ * pdf-fields overlay and anything that later re-renders a stored value. A
+ * second copy is how a signature typed in Caveat comes back in Inter.
+ *
+ * ⚠ The faces themselves are self-hosted (`styles/sign-fonts.css` +
+ * `assets/fonts/`), never a CDN: see that stylesheet's note for why a signing
+ * screen in particular must not phone out for a font.
+ */
+
+/** The wire value of a `font` choice. */
+export type SignFontKey = 'caveat' | 'dancing-script' | 'homemade-apple' | 'inter' | 'source-serif';
+
+export interface SignFont {
+  key: SignFontKey;
+  /** What the person sees in the picker — a font's name is not translated. */
+  name: string;
+  /** Handwriting faces are offered first; the formal pair closes the list. */
+  kind: 'hand' | 'formal';
+  /** The class `styles/sign-fonts.css` declares for this key. */
+  className: string;
+  /**
+   * The same stack as a string, for a canvas `ctx.font` (canvas takes no
+   * class). ⚠ `inter` resolves through `var(--fe-font)` in CSS but a canvas
+   * cannot read a custom property, so its literal stack is spelled out here
+   * and kept in step with `styles/variables.css`.
+   */
+  stack: string;
+}
+
+/** Handwriting first, formal last — the order the picker draws. */
+export const SIGN_FONTS: readonly SignFont[] = [
+  { key: 'caveat', name: 'Caveat', kind: 'hand', className: 'fe-signfont--caveat', stack: "'Caveat', cursive" },
+  {
+    key: 'dancing-script',
+    name: 'Dancing Script',
+    kind: 'hand',
+    className: 'fe-signfont--dancing-script',
+    stack: "'Dancing Script', cursive",
+  },
+  {
+    key: 'homemade-apple',
+    name: 'Homemade Apple',
+    kind: 'hand',
+    className: 'fe-signfont--homemade-apple',
+    stack: "'Homemade Apple', cursive",
+  },
+  {
+    key: 'inter',
+    name: 'Inter',
+    kind: 'formal',
+    className: 'fe-signfont--inter',
+    stack: 'Inter, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif',
+  },
+  {
+    key: 'source-serif',
+    name: 'Source Serif 4',
+    kind: 'formal',
+    className: 'fe-signfont--source-serif',
+    stack: "'Source Serif 4', Georgia, 'Times New Roman', serif",
+  },
+];
+
+/** The face a screen starts on when the plugin named none. */
+export const DEFAULT_SIGN_FONT: SignFontKey = 'caveat';
+
+/** The named face, or the default — never `undefined`, so no caller branches. */
+export function signFont(key: unknown): SignFont {
+  const k = String(key ?? '');
+  return SIGN_FONTS.find((f) => f.key === k) ?? SIGN_FONTS.find((f) => f.key === DEFAULT_SIGN_FONT)!;
+}
+
+/** Is this one of the five? (A value off the wire is not trusted.) */
+export function isSignFontKey(v: unknown): v is SignFontKey {
+  return typeof v === 'string' && SIGN_FONTS.some((f) => f.key === v);
+}

package/src/lib/signaturePad.ts

@@ -0,0 +1,111 @@
+/**
+ * signaturePad — the `signature-pad` node's rules without a canvas.
+ *
+ * Which modes a surface offers, how big an uploaded picture may be and how
+ * it is fitted, what the value on the wire looks like. The component draws;
+ * this decides, so the decisions can be tested on their own.
+ */
+import { DEFAULT_SIGN_FONT, isSignFontKey, type SignFontKey } from './signFonts';
+
+export const SIGNATURE_MODES = ['draw', 'type', 'upload'] as const;
+export type SignatureMode = (typeof SIGNATURE_MODES)[number];
+
+/** `data.values[id]` of a signed pad. */
+export interface SignatureValue {
+  png_b64: string;
+  mode: SignatureMode;
+  /**
+   * `type` mode only: which of the five faces the signer picked
+   * (`lib/signFonts`).
+   *
+   * ⚠ It travels even though the PNG is already rendered in that face,
+   * because the plugin may re-render the name at print resolution rather
+   * than upscale a 600×200 bitmap — and it cannot ask the screen which
+   * font was used after the fact.
+   */
+  font?: SignFontKey;
+}
+
+/** An uploaded picture may weigh this much. */
+export const SIGNATURE_UPLOAD_MAX_BYTES = 200 * 1024;
+/** The box every signature is fitted into (CSS px). */
+export const SIGNATURE_MAX_WIDTH = 600;
+export const SIGNATURE_MAX_HEIGHT = 200;
+/** The pad's own size when the node names none. */
+export const SIGNATURE_DEFAULT_WIDTH = 480;
+export const SIGNATURE_DEFAULT_HEIGHT = 160;
+
+/** Ink is black whatever the theme: it ends up on paper, not on a screen. */
+export const SIGNATURE_INK = '#111111';
+/**
+ * The face a typed signature is drawn in when the signer has not chosen one.
+ *
+ * ⚠⚠ It is a KEY from `lib/signFonts`, not a CSS stack any more. The stack
+ * that used to live here named fonts the machine might happen to have
+ * ('Segoe Script', 'Apple Chancery', …), so the same name signed on a Mac,
+ * on Windows and on a phone came out in three different hands — and on a
+ * machine with none of them, in the browser's generic cursive. The five faces
+ * are shipped with the package now, so every signer gets the one they picked.
+ */
+export const SIGNATURE_FONT_DEFAULT: SignFontKey = DEFAULT_SIGN_FONT;
+
+export function isSignatureMode(v: unknown): v is SignatureMode {
+  return typeof v === 'string' && (SIGNATURE_MODES as readonly string[]).includes(v);
+}
+
+/** The modes the node offers, in the catalogue's order; every mode when it names none. */
+export function signatureModes(raw: unknown): SignatureMode[] {
+  if (!Array.isArray(raw)) return [...SIGNATURE_MODES];
+  const picked = raw.filter(isSignatureMode);
+  return picked.length ? SIGNATURE_MODES.filter((m) => picked.includes(m)) : [...SIGNATURE_MODES];
+}
+
+export function isSignatureValue(v: unknown): v is SignatureValue {
+  const o = v as SignatureValue | null;
+  return !!o && typeof o === 'object' && typeof o.png_b64 === 'string' && o.png_b64 !== '' && isSignatureMode(o.mode);
+}
+
+/** The face a value was typed in, or the default. Never `undefined`. */
+export function signatureFontOf(v: unknown): SignFontKey {
+  const o = v as SignatureValue | null;
+  return o && isSignFontKey(o.font) ? o.font : SIGNATURE_FONT_DEFAULT;
+}
+
+/** The pad's drawing size: the node's numbers, bounded, else the defaults. */
+export function padSize(width: unknown, height: unknown): { width: number; height: number } {
+  const w = Number(width);
+  const h = Number(height);
+  return {
+    width: Number.isFinite(w) && w > 0 ? Math.min(SIGNATURE_MAX_WIDTH, Math.max(120, Math.round(w))) : SIGNATURE_DEFAULT_WIDTH,
+    height: Number.isFinite(h) && h > 0 ? Math.min(SIGNATURE_MAX_HEIGHT, Math.max(60, Math.round(h))) : SIGNATURE_DEFAULT_HEIGHT,
+  };
+}
+
+/** `w×h` scaled down (never up) to fit inside `maxW×maxH`, aspect kept. */
+export function fitWithin(w: number, h: number, maxW: number, maxH: number): { width: number; height: number } {
+  if (!(w > 0) || !(h > 0)) return { width: maxW, height: maxH };
+  const k = Math.min(1, maxW / w, maxH / h);
+  return { width: Math.max(1, Math.round(w * k)), height: Math.max(1, Math.round(h * k)) };
+}
+
+/** `data:image/png;base64,AAAA` → `AAAA`. Anything without the prefix is returned as is. */
+export function stripDataUrl(s: string): string {
+  const i = s.indexOf('base64,');
+  return i >= 0 ? s.slice(i + 'base64,'.length) : s;
+}
+
+export type UploadVerdict = 'ok' | 'too_big' | 'bad_type';
+
+/** PNG or JPEG, at most the ceiling. */
+export function uploadVerdict(file: { type: string; size: number }): UploadVerdict {
+  if (file.type !== 'image/png' && file.type !== 'image/jpeg') return 'bad_type';
+  if (file.size > SIGNATURE_UPLOAD_MAX_BYTES) return 'too_big';
+  return 'ok';
+}
+
+/** The largest font size (px) at which `text` fits `maxWidth`, measured by the caller. */
+export function fitFontSize(measure: (px: number) => number, maxWidth: number, maxHeight: number): number {
+  let px = Math.min(96, Math.floor(maxHeight * 0.6));
+  while (px > 12 && measure(px) > maxWidth) px -= 2;
+  return px;
+}

package/src/lib/sortOrder.ts

@@ -26,8 +26,11 @@
  *   · the RULES (`byActiveKey`, `compareNodes`, folders-first, the two click
  *     vocabularies) — written once, closed over each store;
  *   · the LOCALE the `type` key sorts in — one alphabet for the whole bundle;
- *   · the persisted GLOBAL DEFAULT (`filex.list-sort`) — "the last sort a
- *     person chose", which is one fact no matter which pane they chose it in.
+ *   · the DEFAULT a folder nobody configured opens with — the person's, else
+ *     the instance's (`lib/viewPrefs`). ⚠ Since v0.43 it is NOT "the last sort
+ *     a person chose": a choice belongs to the folder it was made in, and
+ *     nothing in this file writes the default (see the note where `persist`
+ *     used to be).
  *
  * ⚠ Panes find their store by INJECTION (`provideSortStore` / `useSortStore`),
  * not by a prop threaded through every view: `ListView` and `FilterBar` are
@@ -61,6 +64,10 @@ import type { LocaleCode } from '../types/ExplorerConfig';
 import { messages } from '../locales';
 import { typeLabelKey } from './fileIcons';
 import { byFoldersFirst } from './listing';
+/* ⚠ The DEFAULT a folder nobody configured opens with (the person's, else the
+ * instance's). `viewPrefs` imports only TYPES from this file, so there is no
+ * runtime cycle between the two. */
+import { defaultFolderView, onViewPrefsApplied, viewPrefsReady } from './viewPrefs';
 
 export type SortKey = 'name' | 'type' | 'modified' | 'size';
 export type SortDir = 'asc' | 'desc';
@@ -247,48 +254,71 @@ export interface SortStore {
   sortListing(files: FileNode[], order?: ListingOrder): FileNode[];
 }
 
-function persist(key: SortKey, dir: SortDir): void {
-  try {
-    localStorage.setItem(SORT_LS_KEY, JSON.stringify({ key, dir }));
-  } catch {
-    /* quota / private mode — the in-memory refs still moved */
-  }
-}
+/*
+ * A person CHOSE a sort — and that is ALL it is. There is no `persist` here
+ * any more.
+ *
+ * ⚠⚠ This used to write the choice as the GLOBAL DEFAULT (on the account and
+ * into `filex.list-sort`), under the rule "your last choice becomes the
+ * default for every folder you have never set up". That rule was the leak the
+ * owner reported on 2026-09-21 — "Explore içindeki değişikliklerimiz o klasör
+ * özelinde olmalı; tüm klasörlerde görünüm değişikliği geçerli oluyor": sort
+ * folder A by size and every untouched folder came up sorted by size. A
+ * choice now belongs to the folder it was made in, and the explorer records
+ * it there (FileExplorer → `rememberFolder`); the default is set on purpose,
+ * in the person's settings, and nothing in this file writes it.
+ *
+ * ⚠ `filex.list-sort` is still READ (`readStored`) — for the first paint only,
+ * as the cache of the resolved default that `lib/viewPrefs` keeps. Writing a
+ * click into it would paint the next page load in the last folder's sort
+ * before the document corrected it: the same leak, for half a second.
+ */
+
+/**
+ * Every store this module has handed out.
+ *
+ * ⚠ Needed so a document arriving from the SERVER can reach the panes that
+ * are already on screen — the main one, the split one, an embed's. Without
+ * it the account's answer would only apply to panes created after it landed,
+ * which is "it works if you navigate first".
+ */
+const liveStores = new Set<SortStore>();
 
 /**
- * A fresh sort store, seeded from the global default.
+ * The default each store was last put on — its creation seed, then whatever
+ * the account's answer moved it to. "Still following the default" means the
+ * store holds exactly this.
  *
- * ⚠⚠ Every store WRITES the global default when a person chooses in it, and
- * that is the point rather than an oversight: `filex.list-sort` is defined as
- * "the last sort a person chose", and a choice made in the right-hand pane is
- * still a choice. What must not happen — and does not, because the refs are
- * per store — is the OTHER pane moving when it does. Measured 2026-09-13:
- * sorting the split pane by Size left the main pane on Name ↑ and made Size
- * the arrangement the next unconfigured folder opens in.
+ * ⚠ Per store, and NOT a fresh read of the first-paint cache: by the time the
+ * document is announced, `lib/viewPrefs` has already rewritten that cache with
+ * the NEW default, so a comparison against it would see every store as
+ * "somebody chose something" and move none of them.
+ */
+const followed = new WeakMap<SortStore, { key: SortKey; dir: SortDir }>();
+
+/**
+ * A fresh sort store, seeded from the DEFAULT (the first-paint cache of it
+ * until the account's answer lands).
+ *
+ * ⚠ A choice made in one store moves only that store's refs: the split pane
+ * sorting by Size leaves the main pane on Name ↑ (measured 2026-09-13), and
+ * since v0.43 it no longer changes what any other folder opens with either.
  */
 export function createSortStore(): SortStore {
-  const stored = readStored();
+  const stored = defaultSort();
   const key = ref<SortKey>(stored.key);
   const dir = ref<SortDir>(stored.dir);
 
   function setSort(k: SortKey, d?: SortDir): void {
     key.value = k;
     dir.value = d ?? defaultSortDir(k);
-    persist(key.value, dir.value);
   }
 
   /**
-   * tablo:t1 — RESTORE a sort that was already the person's, without recording
-   * it as a fresh choice.
-   *
-   * ⚠⚠ The difference from `setSort` is the whole point and it is not
-   * cosmetic. `filex.list-sort` is the GLOBAL default — "what a folder I have
-   * never set up opens as" — and per-folder memory (`lib/viewPrefs`) is
-   * layered on top of it. If applying a folder's remembered sort went through
-   * `setSort`, walking into one folder that is sorted by size would quietly
-   * make Size the default for every folder in the product, and the person
-   * would have no idea which folder did it. Restoring is not choosing; only a
-   * choice writes the default.
+   * tablo:t1 — RESTORE a sort (a folder's memory, or the default) without
+   * recording it as a fresh choice. The explorer's recorder tells the two
+   * apart by comparing against what it last applied, so a restore can never
+   * write itself into the folder it was restored into.
    */
   function applySort(k: SortKey, d: SortDir): void {
     key.value = k;
@@ -297,7 +327,6 @@ export function createSortStore(): SortStore {
 
   function toggleSortDir(): void {
     dir.value = dir.value === 'asc' ? 'desc' : 'asc';
-    persist(key.value, dir.value);
   }
 
   /**
@@ -322,7 +351,7 @@ export function createSortStore(): SortStore {
     return order === 'relevance' ? byFoldersFirst : compareNodesFn;
   }
 
-  return {
+  const store: SortStore = {
     key,
     dir,
     setSort,
@@ -334,6 +363,9 @@ export function createSortStore(): SortStore {
     sortListing: (files: FileNode[], order: ListingOrder = 'sort') =>
       [...(files || [])].sort(compareInOrderFn(order)),
   };
+  liveStores.add(store);
+  followed.set(store, { ...stored });
+  return store;
 }
 
 /**
@@ -387,16 +419,46 @@ export function applySort(key: SortKey, dir: SortDir): void {
 }
 
 /**
- * tablo:t1 — THE GLOBAL DEFAULT: the sort a folder nobody has configured opens
- * in. Re-read from storage rather than mirrored in a second ref, because
- * `setSort` writes there and `applySort` deliberately does not — so the stored
- * value IS "the last sort a person chose", which is exactly the definition of
- * the default, and a mirror could only drift from it.
+ * THE DEFAULT SORT — what a folder nobody has configured opens in: the
+ * person's default, else the instance's, else this browser's cached copy of
+ * it (until the document lands), else filex's own (Name ↑).
+ *
+ * ⚠ Once the document has landed the cache is NOT consulted: an account with
+ * no default of its own must get filex's default, not whatever the cache held
+ * from the last person or the last release.
  */
-export function globalSort(): { key: SortKey; dir: SortDir } {
+export function defaultSort(): { key: SortKey; dir: SortDir } {
+  const d = defaultFolderView();
+  if (d.k) return { key: d.k, dir: d.d ?? defaultSortDir(d.k) };
+  if (viewPrefsReady()) return { key: DEFAULT_KEY, dir: defaultSortDir(DEFAULT_KEY) };
   return readStored();
 }
 
+/** ⚠ DEPRECATED name for `defaultSort` — kept so an embedder importing it
+ *  keeps compiling. It is no longer "the last sort a person chose". */
+export const globalSort = defaultSort;
+
+/**
+ * The account's document landed (or another browser's newer one did): move
+ * every store that is still following the DEFAULT onto the resolved one.
+ *
+ * ⚠⚠ "Still following" is the whole subtlety. A store whose sort was restored
+ * from a folder's own memory, or chosen in this tab a second ago, must not be
+ * yanked — so the move happens only where the store still holds what this
+ * browser's cache said, i.e. where nobody has chosen anything since the page
+ * opened. (The explorer's main pane is re-applied by the explorer itself,
+ * folder memory included; this reaches the other stores.)
+ */
+onViewPrefsApplied(() => {
+  const want = defaultSort();
+  for (const store of liveStores) {
+    const was = followed.get(store);
+    if (!was || store.key.value !== was.key || store.dir.value !== was.dir) continue;
+    store.applySort(want.key, want.dir);
+    followed.set(store, { ...want });
+  }
+});
+
 export function toggleSortDir(): void {
   defaultStore.toggleSortDir();
 }

package/src/lib/star.ts

@@ -14,10 +14,14 @@
  * one). Same trap as `loadStarred`/`fetchNavRows` in FileExplorer.
  */
 
+import { requestFailure } from './errorWords';
+
 export interface StarRequestOptions {
   apiBase?: string;
   authHeaders?: () => Record<string, string> | Promise<Record<string, string>>;
   authCredentials?: RequestCredentials;
+  /** The language a refusal is said in (lib/errorWords). */
+  locale?: string;
 }
 
 /** Toggle the starred flag for ONE node. Throws on a non-2xx answer so the
@@ -38,5 +42,7 @@ export async function setNodeStarred(
     credentials: opts.authCredentials ?? 'same-origin',
     body: JSON.stringify({ node_id: nodeId, starred }),
   });
-  if (!res.ok) throw new Error(`star toggle failed: ${res.status}`);
+  // Said (lib/errorWords), not "star toggle failed: 403" — the caller that
+  // shows it passes the language it speaks.
+  if (!res.ok) throw requestFailure(res.status, await res.text().catch(() => ''), opts.locale);
 }

package/src/lib/surfaceCell.ts

@@ -0,0 +1,41 @@
+/**
+ * surfaceCell — a plugin list's cell, as the reader reads it.
+ *
+ * A `list` column may say what its cells ARE (`format: "date" | "datetime"`),
+ * and then the app hands over the machine's value — `2026-09-29`,
+ * `2026-09-29T14:03:00Z` — and the host prints it the way the explorer prints
+ * every date: in the reader's language, on the reader's clock. The value stays
+ * what the column sorts by.
+ *
+ * ⚠⚠ Why the host and not the app (v0.43.0 wave 2, 2026-09-22): the
+ * Signatures page's "Son tarih" read "2026-09-29" a column away from the
+ * explorer's "22 Eyl 2026, 14:01". An app formatting dates itself means one
+ * more date format per app — the one thing "one format, the explorer's" rules
+ * out — and it cannot know the reader's chosen time zone.
+ *
+ * ⚠ No formatter of its own: a calendar DAY goes through useLocale's
+ * `formatCalendarDay` (UTC, so no time zone can move a due date to the day
+ * before), an instant through the reader's own `formatDate`. Anything the
+ * format does not recognise is shown as it came (a dash, a word).
+ */
+import { formatCalendarDay } from '../composables/useLocale';
+
+export type SurfaceCellFormat = 'date' | 'datetime';
+
+/**
+ * The cell's text. `formatInstant` is the reader's own date formatter
+ * (useLocale().formatDate), which knows their language AND their clock.
+ */
+export function formatSurfaceCell(
+  raw: string,
+  format: string | undefined,
+  locale: string,
+  formatInstant: (ms: number, opts?: { time?: boolean }) => string,
+): string {
+  if (!raw || (format !== 'date' && format !== 'datetime')) return raw;
+  const day = formatCalendarDay(raw, locale);
+  if (day) return day;
+  const ms = Date.parse(raw.trim());
+  if (Number.isNaN(ms)) return raw;
+  return formatInstant(ms, { time: format === 'datetime' }) || raw;
+}