@brftech/filex-core 0.6.0 → 0.7.1

package/src/lib/e2ecrypto.ts

@@ -0,0 +1,299 @@
+/**
+ * e2ecrypto — client-side crypto for E2E-encrypted folders (wiring:e2).
+ *
+ * WebCrypto ONLY — zero dependencies. Design doc: docs/E2E-ENCRYPTION.md.
+ *
+ * Scheme (v1):
+ *   folder password ─PBKDF2-SHA256(600k iter, per-folder 16B salt)─▶ KEK (AES-256-GCM)
+ *   per-file random 32B DEK (AES-256-GCM) encrypts the content one-shot;
+ *   the DEK is wrapped with the KEK and stored in the file's own header.
+ *
+ * File layout ('filexe2e' magic, fixed 97-byte header):
+ *   [0..8)   magic  "filexe2e"
+ *   [8]      version 0x01
+ *   [9..21)  wrapIV  (12B)  — GCM IV of the DEK wrap
+ *   [21..69) wrappedDEK (48B = 32B DEK + 16B GCM tag)
+ *   [69..81) dataIV  (12B)  — GCM IV of the content
+ *   [81..97) reserved (zeros; v2 chunking/metadata)
+ *   [97..)   ciphertext (content + 16B GCM tag)
+ *
+ * Folder marker `.filex-e2e.json` at the encrypted-folder root:
+ *   { v:1, salt:<b64 16B>, iter:600000, verify:<b64 12B IV || GCM('filex-e2e-verify-v1')> }
+ *
+ * The KEK NEVER leaves memory — no storage of any kind. Password loss is
+ * data loss by design (no recovery path exists anywhere).
+ */
+
+export const E2E_MARKER_NAME = '.filex-e2e.json';
+export const E2E_MAGIC = 'filexe2e';
+export const E2E_VERSION = 1;
+export const E2E_DEFAULT_ITERATIONS = 600_000;
+export const E2E_MIN_ITERATIONS = 600_000;
+/** MVP single-shot in-memory ceiling — larger uploads are refused with a warning. */
+export const E2E_MAX_FILE_BYTES = 200 * 1024 * 1024;
+export const E2E_MIN_PASSWORD_LEN = 8;
+
+const VERIFY_PLAINTEXT = 'filex-e2e-verify-v1';
+const MAGIC_BYTES = new TextEncoder().encode(E2E_MAGIC); // 8 bytes
+const HEADER_LEN = 97;
+const WRAP_IV_OFF = 9;
+const WRAPPED_DEK_OFF = 21;
+const WRAPPED_DEK_LEN = 48;
+const DATA_IV_OFF = 69;
+const IV_LEN = 12;
+
+export interface E2eMarker {
+  v: number;
+  salt: string; // base64
+  iter: number;
+  verify: string; // base64: 12B IV || AES-GCM ciphertext of VERIFY_PLAINTEXT
+}
+
+/** Thrown on wrong password / corrupted ciphertext (GCM tag mismatch). */
+export class E2eDecryptError extends Error {
+  constructor(msg = 'e2e: decrypt failed') {
+    super(msg);
+    this.name = 'E2eDecryptError';
+  }
+}
+
+// ---------------------------------------------------------------------
+// base64 helpers (no deps)
+// ---------------------------------------------------------------------
+
+export function bytesToB64(b: Uint8Array): string {
+  let s = '';
+  for (let i = 0; i < b.length; i++) s += String.fromCharCode(b[i]);
+  return btoa(s);
+}
+
+export function b64ToBytes(s: string): Uint8Array {
+  const raw = atob(s);
+  const out = new Uint8Array(raw.length);
+  for (let i = 0; i < raw.length; i++) out[i] = raw.charCodeAt(i);
+  return out;
+}
+
+// ---------------------------------------------------------------------
+// Key derivation
+// ---------------------------------------------------------------------
+
+/**
+ * Derive the folder KEK from a password. Returns a NON-extractable
+ * AES-256-GCM CryptoKey — it can encrypt/decrypt but never be exported,
+ * so even a same-origin script can't read the raw key material back.
+ */
+export async function deriveKek(
+  password: string,
+  salt: Uint8Array,
+  iterations: number,
+): Promise<CryptoKey> {
+  const material = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(password),
+    'PBKDF2',
+    false,
+    ['deriveKey'],
+  );
+  return crypto.subtle.deriveKey(
+    // Copy into a fresh ArrayBuffer-backed view — TS 5.9 BufferSource typing
+    // rejects Uint8Array<ArrayBufferLike> that may wrap a SharedArrayBuffer.
+    { name: 'PBKDF2', salt: new Uint8Array(salt).buffer as ArrayBuffer, iterations, hash: 'SHA-256' },
+    material,
+    { name: 'AES-GCM', length: 256 },
+    false, // non-extractable
+    ['encrypt', 'decrypt'],
+  );
+}
+
+// ---------------------------------------------------------------------
+// Marker create / verify
+// ---------------------------------------------------------------------
+
+/** Create a fresh folder marker for `password` (also returns the derived KEK). */
+export async function createMarker(
+  password: string,
+  iterations: number = E2E_DEFAULT_ITERATIONS,
+): Promise<{ marker: E2eMarker; kek: CryptoKey }> {
+  const iter = Math.max(E2E_MIN_ITERATIONS, iterations);
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const kek = await deriveKek(password, salt, iter);
+  const iv = crypto.getRandomValues(new Uint8Array(IV_LEN));
+  const ct = new Uint8Array(
+    await crypto.subtle.encrypt(
+      { name: 'AES-GCM', iv: iv.buffer as ArrayBuffer },
+      kek,
+      new TextEncoder().encode(VERIFY_PLAINTEXT),
+    ),
+  );
+  const verify = new Uint8Array(IV_LEN + ct.length);
+  verify.set(iv, 0);
+  verify.set(ct, IV_LEN);
+  return {
+    marker: { v: E2E_VERSION, salt: bytesToB64(salt), iter, verify: bytesToB64(verify) },
+    kek,
+  };
+}
+
+/** Parse marker JSON text; returns null when the shape is not a v1 marker. */
+export function parseMarker(text: string): E2eMarker | null {
+  try {
+    const m = JSON.parse(text) as E2eMarker;
+    if (!m || m.v !== E2E_VERSION) return null;
+    if (typeof m.salt !== 'string' || typeof m.verify !== 'string') return null;
+    if (typeof m.iter !== 'number' || m.iter < 1) return null;
+    return m;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Check `password` against a folder marker. Resolves to the derived KEK on
+ * success, or `null` on a wrong password (GCM tag mismatch on the verify
+ * blob). Never talks to any server.
+ */
+export async function verifyPassword(
+  marker: E2eMarker,
+  password: string,
+): Promise<CryptoKey | null> {
+  const salt = b64ToBytes(marker.salt);
+  const kek = await deriveKek(password, salt, marker.iter);
+  const verify = b64ToBytes(marker.verify);
+  if (verify.length <= IV_LEN) return null;
+  try {
+    const pt = await crypto.subtle.decrypt(
+      { name: 'AES-GCM', iv: verify.slice(0, IV_LEN).buffer as ArrayBuffer },
+      kek,
+      verify.slice(IV_LEN).buffer as ArrayBuffer,
+    );
+    if (new TextDecoder().decode(pt) !== VERIFY_PLAINTEXT) return null;
+    return kek;
+  } catch {
+    return null; // wrong password
+  }
+}
+
+// ---------------------------------------------------------------------
+// Magic sniff
+// ---------------------------------------------------------------------
+
+/** True when the buffer starts with the 'filexe2e' magic. */
+export function hasMagic(buf: ArrayBuffer | Uint8Array): boolean {
+  const b = buf instanceof Uint8Array ? buf : new Uint8Array(buf);
+  if (b.length < MAGIC_BYTES.length) return false;
+  for (let i = 0; i < MAGIC_BYTES.length; i++) {
+    if (b[i] !== MAGIC_BYTES[i]) return false;
+  }
+  return true;
+}
+
+// ---------------------------------------------------------------------
+// File encrypt / decrypt (one-shot MVP)
+// ---------------------------------------------------------------------
+
+/**
+ * Encrypt `content` under the folder KEK: mints a fresh DEK, encrypts the
+ * content one-shot, wraps the DEK with the KEK and prepends the fixed
+ * 'filexe2e' header. Throws when content exceeds E2E_MAX_FILE_BYTES.
+ */
+export async function encryptFile(kek: CryptoKey, content: ArrayBuffer): Promise<ArrayBuffer> {
+  if (content.byteLength > E2E_MAX_FILE_BYTES) {
+    throw new Error('e2e: file exceeds the 200MB single-shot limit');
+  }
+  const rawDek = crypto.getRandomValues(new Uint8Array(32));
+  const dek = await crypto.subtle.importKey('raw', rawDek.buffer as ArrayBuffer, { name: 'AES-GCM' }, false, [
+    'encrypt',
+  ]);
+  const wrapIV = crypto.getRandomValues(new Uint8Array(IV_LEN));
+  const dataIV = crypto.getRandomValues(new Uint8Array(IV_LEN));
+  const wrappedDek = new Uint8Array(
+    await crypto.subtle.encrypt({ name: 'AES-GCM', iv: wrapIV.buffer as ArrayBuffer }, kek, rawDek.buffer as ArrayBuffer),
+  );
+  const ct = new Uint8Array(
+    await crypto.subtle.encrypt({ name: 'AES-GCM', iv: dataIV.buffer as ArrayBuffer }, dek, content),
+  );
+  // Zero the raw DEK copy as a hygiene measure (best-effort — GC may have
+  // other copies, but don't leave the obvious one around).
+  rawDek.fill(0);
+
+  const out = new Uint8Array(HEADER_LEN + ct.length);
+  out.set(MAGIC_BYTES, 0);
+  out[8] = E2E_VERSION;
+  out.set(wrapIV, WRAP_IV_OFF);
+  out.set(wrappedDek, WRAPPED_DEK_OFF); // 48 bytes
+  out.set(dataIV, DATA_IV_OFF);
+  // [81..97) reserved zeros
+  out.set(ct, HEADER_LEN);
+  return out.buffer;
+}
+
+/**
+ * Decrypt a 'filexe2e' blob with the folder KEK. Throws E2eDecryptError on
+ * a wrong key / tampered data, and a plain Error when the header is not an
+ * e2e file at all.
+ */
+export async function decryptFile(kek: CryptoKey, data: ArrayBuffer): Promise<ArrayBuffer> {
+  const b = new Uint8Array(data);
+  if (!hasMagic(b) || b.length < HEADER_LEN) {
+    throw new Error('e2e: not an encrypted file');
+  }
+  if (b[8] !== E2E_VERSION) {
+    throw new Error(`e2e: unsupported version ${b[8]}`);
+  }
+  const wrapIV = b.slice(WRAP_IV_OFF, WRAP_IV_OFF + IV_LEN);
+  const wrappedDek = b.slice(WRAPPED_DEK_OFF, WRAPPED_DEK_OFF + WRAPPED_DEK_LEN);
+  const dataIV = b.slice(DATA_IV_OFF, DATA_IV_OFF + IV_LEN);
+  let rawDek: ArrayBuffer;
+  try {
+    rawDek = await crypto.subtle.decrypt(
+      { name: 'AES-GCM', iv: wrapIV.buffer as ArrayBuffer },
+      kek,
+      wrappedDek.buffer as ArrayBuffer,
+    );
+  } catch {
+    throw new E2eDecryptError('e2e: DEK unwrap failed (wrong password?)');
+  }
+  const dek = await crypto.subtle.importKey('raw', rawDek, { name: 'AES-GCM' }, false, ['decrypt']);
+  try {
+    return await crypto.subtle.decrypt(
+      { name: 'AES-GCM', iv: dataIV.buffer as ArrayBuffer },
+      dek,
+      b.slice(HEADER_LEN).buffer as ArrayBuffer,
+    );
+  } catch {
+    throw new E2eDecryptError('e2e: content decrypt failed');
+  }
+}
+
+// ---------------------------------------------------------------------
+// In-memory session key ring
+// ---------------------------------------------------------------------
+
+/**
+ * Tiny per-explorer key ring: encrypted-folder root (wire path) → KEK.
+ * Lives ONLY in memory — "Kilitle" drops the entry, a reload drops all.
+ */
+export function createKeyRing() {
+  const keys = new Map<string, CryptoKey>();
+  return {
+    get(root: string): CryptoKey | undefined {
+      return keys.get(root);
+    },
+    set(root: string, kek: CryptoKey): void {
+      keys.set(root, kek);
+    },
+    /** Drop one folder's key ("Kilitle"). */
+    lock(root: string): void {
+      keys.delete(root);
+    },
+    has(root: string): boolean {
+      return keys.has(root);
+    },
+    clear(): void {
+      keys.clear();
+    },
+  };
+}
+
+export type E2eKeyRing = ReturnType<typeof createKeyRing>;

package/src/locales/en.ts

@@ -365,4 +365,38 @@ export const en: Record<string, string> = {
   'inspector.comments.placeholder': 'Write a comment…',
   'inspector.comments.send': 'Send',
   'inspector.comments.delete': 'Delete comment',
+  /* wiring:e2 — end-to-end encrypted folders */
+  'e2e.create.title': 'Create encrypted folder',
+  'e2e.create.option': 'Create encrypted folder…',
+  'e2e.create.pw_placeholder': 'Folder password (min 8 characters)',
+  'e2e.create.pw2_placeholder': 'Repeat the password',
+  'e2e.create.warn_title': 'NO WAY BACK',
+  'e2e.create.warn_body':
+    'Files open ONLY with this password. The password is NEVER stored on the server; if you forget it the content is lost forever. There is no recovery — not even an admin can open it.',
+  'e2e.create.ack': 'I understand: if I lose the password my data cannot be recovered.',
+  'e2e.create.ack_required': 'Please confirm the warning to continue.',
+  'e2e.create.pw_short': 'Password must be at least 8 characters.',
+  'e2e.create.pw_mismatch': 'Passwords do not match.',
+  'e2e.create.bad_name': 'Invalid folder name.',
+  'e2e.create.create': 'Create encrypted folder',
+  'e2e.create.busy': 'Creating…',
+  'e2e.create.done': 'Encrypted folder created',
+  'e2e.create.failed': 'Could not create the encrypted folder',
+  'e2e.create.nested': 'You cannot create an encrypted folder inside another one.',
+  'e2e.locked.title': 'This folder is end-to-end encrypted',
+  'e2e.locked.hint': 'Enter the folder password to see its contents. The password stays in this tab’s memory only.',
+  'e2e.locked.pw_placeholder': 'Folder password',
+  'e2e.locked.unlock': 'Unlock',
+  'e2e.locked.busy': 'Verifying…',
+  'e2e.unlock.wrong': 'Wrong password.',
+  'e2e.unlock.marker_missing': 'Could not read the key file (.filex-e2e.json).',
+  'e2e.strip.label': 'Encrypted folder — unlocked',
+  'e2e.strip.lock': 'Lock',
+  'e2e.locked_toast': 'Folder locked',
+  'e2e.upload.too_big': 'Files over 200 MB cannot be uploaded to an encrypted folder (MVP limit)',
+  'e2e.upload.locked': 'Unlock the folder first',
+  'e2e.decrypting': 'Decrypting…',
+  'e2e.decrypt_failed': 'Could not decrypt the file (password changed or file corrupted).',
+  'e2e.download.failed': 'Could not download the encrypted file.',
+  /* /wiring:e2 */
 };

package/src/locales/tr.ts

@@ -365,4 +365,38 @@ export const tr: Record<string, string> = {
   'inspector.comments.placeholder': 'Yorum yaz…',
   'inspector.comments.send': 'Gönder',
   'inspector.comments.delete': 'Yorumu sil',
+  /* wiring:e2 — uçtan uca şifreli klasörler */
+  'e2e.create.title': 'Şifreli klasör oluştur',
+  'e2e.create.option': 'Şifreli klasör oluştur…',
+  'e2e.create.pw_placeholder': 'Klasör parolası (en az 8 karakter)',
+  'e2e.create.pw2_placeholder': 'Parolayı tekrar girin',
+  'e2e.create.warn_title': 'GERİ DÖNÜŞÜ YOK',
+  'e2e.create.warn_body':
+    'Dosyalar yalnız bu parolayla açılır. Parola sunucuda TUTULMAZ; unutursanız içerik sonsuza dek kaybolur. Kurtarma yolu yoktur — yönetici dahil kimse açamaz.',
+  'e2e.create.ack': 'Anladım: parolayı kaybedersem verilerim kurtarılamaz.',
+  'e2e.create.ack_required': 'Devam etmek için uyarıyı onaylayın.',
+  'e2e.create.pw_short': 'Parola en az 8 karakter olmalı.',
+  'e2e.create.pw_mismatch': 'Parolalar birbirini tutmuyor.',
+  'e2e.create.bad_name': 'Geçersiz klasör adı.',
+  'e2e.create.create': 'Şifreli klasörü oluştur',
+  'e2e.create.busy': 'Oluşturuluyor…',
+  'e2e.create.done': 'Şifreli klasör oluşturuldu',
+  'e2e.create.failed': 'Şifreli klasör oluşturulamadı',
+  'e2e.create.nested': 'Şifreli klasörün içine ikinci bir şifreli klasör açılamaz.',
+  'e2e.locked.title': 'Bu klasör uçtan uca şifreli',
+  'e2e.locked.hint': 'İçeriği görmek için klasör parolasını girin. Parola yalnız bu sekmede, bellekte tutulur.',
+  'e2e.locked.pw_placeholder': 'Klasör parolası',
+  'e2e.locked.unlock': 'Kilidi aç',
+  'e2e.locked.busy': 'Doğrulanıyor…',
+  'e2e.unlock.wrong': 'Parola yanlış.',
+  'e2e.unlock.marker_missing': 'Şifre dosyası (.filex-e2e.json) okunamadı.',
+  'e2e.strip.label': 'Şifreli klasör — kilit açık',
+  'e2e.strip.lock': 'Kilitle',
+  'e2e.locked_toast': 'Klasör kilitlendi',
+  'e2e.upload.too_big': '200 MB üstü dosyalar şifreli klasöre yüklenemez (MVP sınırı)',
+  'e2e.upload.locked': 'Önce klasörün kilidini açın',
+  'e2e.decrypting': 'Çözülüyor…',
+  'e2e.decrypt_failed': 'Dosya çözülemedi (parola değişmiş ya da dosya bozulmuş olabilir).',
+  'e2e.download.failed': 'Şifreli dosya indirilemedi.',
+  /* /wiring:e2 */
 };

package/src/modals/NewFolderModal.vue

@@ -7,11 +7,17 @@ import Modal from './Modal.vue';
 const props = defineProps<{
   open: boolean;
   locale: LocaleCode;
+  /* wiring:e2 — hosts hide the encrypted option (e.g. already inside an
+   * encrypted folder / feature-gated embeds). Default: shown. */
+  encryptedOption?: boolean;
 }>();
 
 const emit = defineEmits<{
   (e: 'close'): void;
   (e: 'submit', name: string): void;
+  /* wiring:e2 — user picked "Create encrypted folder…" — the parent swaps
+   * this modal for EncryptedFolderModal. */
+  (e: 'encrypted'): void;
 }>();
 
 const { t } = useLocale(() => props.locale);
@@ -51,6 +57,18 @@ function submit() {
         @keydown.enter.prevent="submit"
       />
       <p v-if="err" class="fe-form__error">{{ err }}</p>
+      <!-- wiring:e2 — encrypted-folder entry point lives inside the normal
+           new-folder flow so every trigger (toolbar / context menu / palette)
+           reaches it without extra wiring. -->
+      <button
+        v-if="encryptedOption !== false"
+        type="button"
+        class="fe-e2e-optlink"
+        @click="emit('encrypted')"
+      >
+        🔒 {{ t('e2e.create.option') }}
+      </button>
+      <!-- /wiring:e2 -->
     </form>
     <template #actions>
       <button type="button" class="fe-btn" @click="emit('close')">

package/src/modals/PreviewModal.vue

@@ -46,6 +46,11 @@ const props = defineProps<{
   pdfSaveUrl?: string | null;
   /** Standalone full-screen viewer route — `?path=…&storage=…&type=…`. */
   viewerBaseUrl?: string | null;
+  /* wiring:e2 — false hides the "Düzenle" / "Yeni Sekmede Aç" buttons.
+   * The standalone route fetches RAW server bytes, which inside an
+   * E2E-encrypted folder is ciphertext (and its save path could clobber
+   * the encrypted blob) — the host disables the escape hatches there. */
+  newTabEnabled?: boolean;
   /** Drop the dialog chrome (backdrop tint, header bar, footer actions)
    *  so the viewer fills the full viewport. Used by the standalone
    *  /files/edit route where the browser tab IS the container — a
@@ -1020,13 +1025,13 @@ function loadOnlyOfficeScript(base: string): Promise<void> {
     </div>
     <template #actions>
       <button
-        v-if="file && openMode === 'view' && canEditKind"
+        v-if="file && openMode === 'view' && canEditKind && newTabEnabled !== false /* wiring:e2 */"
         type="button"
         class="fe-btn fe-btn--primary"
         @click="openEditInNewTab"
       >✏ {{ t('viewer.edit') }}</button>
       <button
-        v-if="file"
+        v-if="file && newTabEnabled !== false /* wiring:e2 */"
         type="button"
         class="fe-btn"
         @click="openInNewTab"

package/src/styles/base.css

@@ -4,6 +4,7 @@
   position: relative;
   display: flex;
   flex-direction: column;
+  box-sizing: border-box;
   min-height: 420px;
   height: 100%;
   background: var(--fe-bg);
@@ -3099,7 +3100,12 @@ filex-explorer {
   flex: 1 1 auto;
   min-width: 0;
   overflow-x: auto;
-  scrollbar-width: thin;
+  /* Tab overflow scrolls (wheel / drag / keyboard) but never shows a
+   * scrollbar strip under the tabs — the 30px bar cannot fit one. */
+  scrollbar-width: none;
+}
+.fe-tabs__scroll::-webkit-scrollbar {
+  display: none;
 }
 .fe-tabs__tab {
   display: flex;
@@ -3615,3 +3621,122 @@ filex-explorer {
   opacity: 0.6;
 }
 /* === /wiring:d3 === */
+
+/* === wiring:e2 — uçtan uca şifreli klasörler === */
+/* Kilit açık şeridi (presence şeridiyle aynı yatay dil). */
+.fe-e2e-strip {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  padding: 4px 12px;
+  font-size: 12.5px;
+  color: var(--fe-text-muted);
+  border-bottom: 1px solid var(--fe-border);
+  background: var(--fe-bg-elev);
+}
+.fe-e2e-strip__icon {
+  font-size: 13px;
+  line-height: 1;
+}
+.fe-e2e-strip__label {
+  flex: 1;
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+.fe-e2e-strip__btn {
+  padding: 2px 10px;
+  font-size: 12px;
+}
+
+/* Kilit ekranı: fe-state dilinin üstüne parola formu. */
+.fe-e2e-lock__form {
+  display: flex;
+  gap: 8px;
+  align-items: stretch;
+  margin-top: 12px;
+  width: min(340px, 100%);
+}
+.fe-e2e-lock__input {
+  flex: 1;
+  min-width: 0;
+}
+
+/* Şifreli klasör oluşturma modalı. */
+.fe-e2e-form {
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+}
+.fe-e2e-warn {
+  border: 1px solid var(--fe-danger);
+  border-radius: var(--fe-radius-sm);
+  padding: 8px 10px;
+  font-size: 12.5px;
+  color: var(--fe-text);
+  background: color-mix(in srgb, var(--fe-danger) 8%, transparent);
+}
+.fe-e2e-warn strong {
+  display: block;
+  color: var(--fe-danger);
+  margin-bottom: 2px;
+}
+.fe-e2e-warn p {
+  margin: 0;
+  color: var(--fe-text-muted);
+}
+.fe-e2e-ack {
+  display: flex;
+  align-items: flex-start;
+  gap: 8px;
+  font-size: 12.5px;
+  color: var(--fe-text);
+  cursor: pointer;
+}
+.fe-e2e-ack input {
+  margin-top: 2px;
+  accent-color: var(--fe-primary);
+}
+
+/* NewFolderModal içindeki "şifreli klasör" giriş linki. */
+.fe-e2e-optlink {
+  margin-top: 10px;
+  padding: 0;
+  border: none;
+  background: none;
+  font: inherit;
+  font-size: 12.5px;
+  color: var(--fe-primary);
+  cursor: pointer;
+  text-align: left;
+}
+.fe-e2e-optlink:hover {
+  text-decoration: underline;
+}
+/* === /wiring:e2 === */
+
+/* === ui-fix — toolbar tek satır + katlama + ölçüm şeridi ============= */
+.fe:not(.fe--narrow) .fe-toolbar {
+  flex-wrap: nowrap;
+}
+.fe:not(.fe--narrow) .fe-toolbar__primary {
+  flex: 1 1 auto;
+  min-width: 0;
+  flex-wrap: nowrap;
+  overflow: hidden;
+  position: relative;
+}
+.fe-toolbar__measure {
+  position: absolute;
+  visibility: hidden;
+  pointer-events: none;
+  height: 0;
+  overflow: hidden;
+  display: flex;
+  gap: 8px;
+  white-space: nowrap;
+}
+.fe-toolbar__measure .fe-btn {
+  flex: none;
+}
+/* === /ui-fix ========================================================= */

package/src/styles/variables.css

@@ -13,7 +13,7 @@
   --fe-text: #1a1e27;
   --fe-text-muted: #5a6475;
   --fe-text-on-primary: #ffffff;
-  --fe-primary: #3b82f6;
+  --fe-primary: #2f6fe0; /* ui-fix: beyaz metinle WCAG AA (eski #3b82f6 = 3.68) */
   --fe-primary-hover: #2563eb;
   --fe-danger: #dc2626;
   --fe-danger-hover: #b91c1c;
@@ -102,7 +102,7 @@
   --fe-icon-archive: #78716c;
   --fe-icon-code: #4f46e5;
   --fe-icon-text: #64748b;
-  --fe-icon-unknown: #94a3b8;
+  --fe-icon-unknown: #64748b; /* ui-fix: acik temada 3:1 UI kontrasti */
 }
 
 /* Dark values — same selector strategy as the palette blocks above. */

package/src/types/FileNode.ts

@@ -42,6 +42,9 @@ export interface FileNode {
    *  projectFileNodes emits it when a storage has RBAC on). '' / undefined =
    *  ACL not enforced. Used to gate edit/manage affordances client-side. */
   perm?: 'none' | 'viewer' | 'editor' | 'owner';
+  /* wiring:e2 — dir rows: true when the folder is E2E-encrypted (carries a
+   * `.filex-e2e.json` marker). Drives the 🔒 badge in the listings. */
+  e2e?: boolean;
   /** Generic — any additional fields the backend wants to inline. */
   [k: string]: unknown;
 }