@glance-apps/sync 0.2.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glance-apps/sync",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "license": "MIT",
   "type": "module",
   "main": "src/index.js",
@@ -20,6 +20,7 @@
     "url": "git+https://github.com/glance-apps/glance-sync.git"
   },
   "devDependencies": {
+    "fake-indexeddb": "^6.2.5",
     "vitest": "^3.1.4"
   }
 }

package/src/crypto.js

@@ -1 +1,362 @@
-// Placeholder — encryption module is extracted in Step 3.
+// Client-side encryption for cloud sync and remote backup files.
+// Uses Web Crypto API exclusively — no external dependencies.
+// Architecture: passphrase → PBKDF2 → AES-256-GCM key → encrypts JSON blob.
+//
+// Parameterizations vs. dayGLANCE original:
+//   - KEY_DB_NAME is now passed as `cryptoDBName` (no hardcoded app name)
+//   - Android Keystore detection uses injected `nativeGetSyncKey` function
+//     instead of probing window globals by name
+
+// ---------------------------------------------------------------------------
+// Session state (in-memory only, never persisted)
+// ---------------------------------------------------------------------------
+let _sessionPassphrase = null; // string | null
+let _sessionKey = null;        // CryptoKey | null
+let _sessionSalt = null;       // Uint8Array | null — the salt used to derive _sessionKey
+
+export function setSyncPassphrase(p) { _sessionPassphrase = p; }
+export function getSyncPassphrase()  { return _sessionPassphrase; }
+export function hasEncryptionReady() { return _sessionKey !== null; }
+
+// ---------------------------------------------------------------------------
+// IndexedDB key store
+// ---------------------------------------------------------------------------
+const KEY_DB_VERSION = 1;
+const KEY_STORE      = 'keys';
+const SYNC_KEY_ID    = 'sync-key';
+
+function openKeyDB(cryptoDBName) {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(cryptoDBName, KEY_DB_VERSION);
+    req.onupgradeneeded = (e) => {
+      const db = e.target.result;
+      if (!db.objectStoreNames.contains(KEY_STORE)) {
+        db.createObjectStore(KEY_STORE, { keyPath: 'id' });
+      }
+    };
+    req.onsuccess = () => resolve(req.result);
+    req.onerror  = () => reject(req.error);
+  });
+}
+
+async function saveKeyToIndexedDB(cryptoDBName, cryptoKey, salt) {
+  const db     = await openKeyDB(cryptoDBName);
+  const rawKey = await crypto.subtle.exportKey('raw', cryptoKey);
+  return new Promise((resolve, reject) => {
+    const tx = db.transaction(KEY_STORE, 'readwrite');
+    tx.objectStore(KEY_STORE).put({ id: SYNC_KEY_ID, rawKey, salt: Array.from(salt) });
+    tx.oncomplete = () => resolve();
+    tx.onerror    = () => reject(tx.error);
+  });
+}
+
+async function loadKeyFromIndexedDB(cryptoDBName) {
+  try {
+    const db     = await openKeyDB(cryptoDBName);
+    const record = await new Promise((resolve, reject) => {
+      const tx  = db.transaction(KEY_STORE, 'readonly');
+      const req = tx.objectStore(KEY_STORE).get(SYNC_KEY_ID);
+      req.onsuccess = () => resolve(req.result);
+      req.onerror   = () => reject(req.error);
+    });
+    if (!record) return null;
+    const key = await crypto.subtle.importKey(
+      'raw', record.rawKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']
+    );
+    return { key, salt: new Uint8Array(record.salt) };
+  } catch {
+    return null;
+  }
+}
+
+async function clearKeyFromIndexedDB(cryptoDBName) {
+  try {
+    const db = await openKeyDB(cryptoDBName);
+    await new Promise((resolve, reject) => {
+      const tx = db.transaction(KEY_STORE, 'readwrite');
+      tx.objectStore(KEY_STORE).delete(SYNC_KEY_ID);
+      tx.oncomplete = () => resolve();
+      tx.onerror    = () => reject(tx.error);
+    });
+  } catch { /* ignore */ }
+}
+
+// ---------------------------------------------------------------------------
+// Android Keystore bridge
+// ---------------------------------------------------------------------------
+// The native bridge is injected as a function reference rather than probing
+// window globals by name — no app-specific global detection here.
+
+async function loadKeyFromNative(nativeGetSyncKey) {
+  try {
+    const b64 = await nativeGetSyncKey();
+    if (!b64) return null;
+    const record = JSON.parse(atob(b64));
+    const key = await crypto.subtle.importKey(
+      'raw', new Uint8Array(record.rawKey), { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']
+    );
+    return { key, salt: new Uint8Array(record.salt) };
+  } catch {
+    return null;
+  }
+}
+
+async function saveKeyToNative(nativeStoreSyncKey, cryptoKey, salt) {
+  if (!nativeStoreSyncKey) return;
+  const rawKey = await crypto.subtle.exportKey('raw', cryptoKey);
+  const record = { rawKey: Array.from(new Uint8Array(rawKey)), salt: Array.from(salt) };
+  nativeStoreSyncKey(btoa(JSON.stringify(record)));
+}
+
+async function clearKeyFromNative(nativeStoreSyncKey) {
+  try {
+    if (nativeStoreSyncKey) {
+      nativeStoreSyncKey(null);
+    }
+  } catch { /* ignore */ }
+}
+
+// ---------------------------------------------------------------------------
+// PBKDF2 key derivation
+// ---------------------------------------------------------------------------
+async function deriveKey(passphrase, salt) {
+  const enc         = new TextEncoder();
+  const keyMaterial = await crypto.subtle.importKey(
+    'raw', enc.encode(passphrase), 'PBKDF2', false, ['deriveKey']
+  );
+  return crypto.subtle.deriveKey(
+    { name: 'PBKDF2', salt, iterations: 310_000, hash: 'SHA-256' },
+    keyMaterial,
+    { name: 'AES-GCM', length: 256 },
+    true,
+    ['encrypt', 'decrypt']
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Public lifecycle API
+// ---------------------------------------------------------------------------
+
+/**
+ * Called on app load. Attempts to restore the session key from device storage
+ * (IndexedDB on browser, native bridge on mobile) without requiring the user
+ * to re-enter their passphrase.
+ *
+ * @param {object} config
+ * @param {string} config.cryptoDBName  - IndexedDB database name for key storage
+ * @param {Function|null} [config.nativeGetSyncKey]  - native bridge getter (Android Keystore)
+ * @returns {Promise<boolean>} true if key was restored, false if passphrase required
+ */
+export async function initSessionKey({ cryptoDBName, nativeGetSyncKey = null } = {}) {
+  try {
+    let result;
+    if (nativeGetSyncKey != null) {
+      result = await loadKeyFromNative(nativeGetSyncKey);
+    } else {
+      result = await loadKeyFromIndexedDB(cryptoDBName);
+    }
+    if (result) {
+      _sessionKey  = result.key;
+      _sessionSalt = result.salt;
+      return true;
+    }
+  } catch { /* storage unavailable */ }
+  return false;
+}
+
+/**
+ * First-time setup on a fresh device: derives a key from the passphrase with a
+ * freshly generated salt and caches it in device storage.
+ * Call this when the user configures encryption for the first time.
+ *
+ * @param {string} passphrase
+ * @param {object} config
+ * @param {string} config.cryptoDBName
+ * @param {Function|null} [config.nativeGetSyncKey]
+ * @param {Function|null} [config.nativeStoreSyncKey]
+ */
+export async function setupEncryptionKey(passphrase, { cryptoDBName, nativeGetSyncKey = null, nativeStoreSyncKey = null } = {}) {
+  const salt = crypto.getRandomValues(new Uint8Array(16));
+  const key  = await deriveKey(passphrase, salt);
+  _sessionPassphrase = passphrase;
+  _sessionSalt       = salt;
+  if (nativeGetSyncKey != null) {
+    await saveKeyToNative(nativeStoreSyncKey, key, salt);
+  } else {
+    await saveKeyToIndexedDB(cryptoDBName, key, salt);
+  }
+  // Re-import as non-extractable so the live in-memory key cannot be exported via Web Crypto API.
+  const rawKey = await crypto.subtle.exportKey('raw', key);
+  _sessionKey = await crypto.subtle.importKey(
+    'raw', rawKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']
+  );
+}
+
+/**
+ * Clears the cached key from device storage and session memory.
+ * Call this when the user disables encryption.
+ *
+ * @param {object} config
+ * @param {string} config.cryptoDBName
+ * @param {Function|null} [config.nativeGetSyncKey]
+ * @param {Function|null} [config.nativeStoreSyncKey]
+ */
+export async function clearEncryptionKey({ cryptoDBName, nativeGetSyncKey = null, nativeStoreSyncKey = null } = {}) {
+  _sessionPassphrase = null;
+  _sessionKey        = null;
+  _sessionSalt       = null;
+  if (nativeGetSyncKey != null) {
+    await clearKeyFromNative(nativeStoreSyncKey);
+  } else {
+    await clearKeyFromIndexedDB(cryptoDBName);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function packBytes(...arrays) {
+  const total = arrays.reduce((n, a) => n + a.length, 0);
+  const out   = new Uint8Array(total);
+  let   offset = 0;
+  for (const a of arrays) { out.set(a, offset); offset += a.length; }
+  return out;
+}
+
+function toBase64(bytes) {
+  // Chunk to avoid "Maximum call stack size exceeded" for large payloads —
+  // spreading a large Uint8Array as function arguments hits the engine's
+  // argument-count limit (~65 K in V8).
+  let binary = '';
+  const chunk = 8192;
+  for (let i = 0; i < bytes.length; i += chunk) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + chunk));
+  }
+  return btoa(binary);
+}
+
+function fromBase64(b64) {
+  return Uint8Array.from(atob(b64), c => c.charCodeAt(0));
+}
+
+// ---------------------------------------------------------------------------
+// Encrypt / decrypt
+// ---------------------------------------------------------------------------
+
+/**
+ * Encrypts a plain JS object and returns an envelope object ready for JSON.stringify.
+ *
+ * Envelope format:
+ *   { v: 1, enc: "AES-GCM-256", data: "<base64>" }
+ *
+ * The base64 blob encodes:
+ *   [ 16 bytes: PBKDF2 salt ] [ 12 bytes: AES-GCM IV ] [ N bytes: ciphertext ]
+ *
+ * @param {object} data - plain JS object to encrypt
+ * @param {object} config
+ * @param {string} config.cryptoDBName
+ * @param {Function|null} [config.nativeGetSyncKey]
+ * @param {Function|null} [config.nativeStoreSyncKey]
+ */
+export async function encryptData(data, config = {}) {
+  // First use: lazily set up the key so the caller doesn't need to distinguish
+  // between "first device" and "subsequent upload" scenarios.
+  if (!_sessionKey) {
+    if (_sessionPassphrase) {
+      await setupEncryptionKey(_sessionPassphrase, config);
+    } else {
+      throw new Error('Encryption key not available. Please enter your sync passphrase.');
+    }
+  }
+
+  const plaintext  = new TextEncoder().encode(JSON.stringify(data));
+  const iv         = crypto.getRandomValues(new Uint8Array(12));
+  const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, _sessionKey, plaintext);
+
+  const packed = packBytes(_sessionSalt, iv, new Uint8Array(ciphertext));
+  return { v: 1, enc: 'AES-GCM-256', data: toBase64(packed) };
+}
+
+/**
+ * Decrypts an envelope object produced by encryptData.
+ * Throws on wrong passphrase, tampered data, or missing key.
+ *
+ * Cross-device recovery path: if no cached key but _sessionPassphrase is set,
+ * derives the key from the passphrase + salt embedded in the ciphertext, then
+ * caches it in device storage for future sessions.
+ *
+ * @param {object} envelope - encrypted envelope from encryptData
+ * @param {object} config
+ * @param {string} config.cryptoDBName
+ * @param {Function|null} [config.nativeGetSyncKey]
+ * @param {Function|null} [config.nativeStoreSyncKey]
+ */
+export async function decryptData(envelope, config = {}) {
+  if (!envelope || !envelope.data) throw new Error('Invalid encrypted envelope');
+  if (envelope.v !== 1) throw new Error(`Unknown encryption version: ${envelope.v}`);
+
+  const packed     = fromBase64(envelope.data);
+  const salt       = packed.slice(0, 16);
+  const iv         = packed.slice(16, 28);
+  const ciphertext = packed.slice(28);
+
+  let key = _sessionKey;
+
+  // If the cached key was derived from a different salt (e.g. user re-configured
+  // encryption, generating a new salt), it cannot decrypt this file. Force
+  // re-derivation so the file's embedded salt always dictates which key is used.
+  if (key && _sessionSalt) {
+    const saltMatch = salt.length === _sessionSalt.length &&
+      salt.every((b, i) => b === _sessionSalt[i]);
+    if (!saltMatch) key = null;
+  }
+
+  let keyWasDerived = false;
+  if (!key) {
+    if (_sessionPassphrase) {
+      // Cross-device recovery or salt mismatch: derive key from passphrase + salt from file.
+      // Do NOT cache yet — only persist after we confirm the key actually decrypts the file.
+      key = await deriveKey(_sessionPassphrase, salt);
+      keyWasDerived = true;
+    } else {
+      const err = new Error('Encryption key not available. Please enter your sync passphrase.');
+      err.code = 'PASSPHRASE_REQUIRED';
+      throw err;
+    }
+  }
+
+  try {
+    const plaintext = await crypto.subtle.decrypt({ name: 'AES-GCM', iv }, key, ciphertext);
+    // Decryption succeeded — safe to promote and cache the derived key.
+    if (keyWasDerived) {
+      _sessionKey  = key;
+      _sessionSalt = salt;
+      const { nativeGetSyncKey = null, nativeStoreSyncKey = null, cryptoDBName } = config;
+      if (nativeGetSyncKey != null) {
+        await saveKeyToNative(nativeStoreSyncKey, key, salt);
+      } else {
+        await saveKeyToIndexedDB(cryptoDBName, key, salt);
+      }
+    }
+    return JSON.parse(new TextDecoder().decode(plaintext));
+  } catch (err) {
+    if (err.name === 'OperationError') {
+      throw new Error('Decryption failed — wrong passphrase or corrupted data.');
+    }
+    throw err;
+  }
+}
+
+/**
+ * Returns true if the value looks like an encrypted envelope produced by
+ * encryptData. Used to decide whether to call decryptData on downloaded files.
+ */
+export function isEncryptedEnvelope(value) {
+  return (
+    value !== null &&
+    typeof value === 'object' &&
+    value.v === 1 &&
+    value.enc === 'AES-GCM-256' &&
+    typeof value.data === 'string'
+  );
+}

package/src/index.js

@@ -7,3 +7,19 @@ export {
   mergeSyncData,
   pruneTombstones,
 } from './merge.js';
+
+export {
+  encryptData,
+  decryptData,
+  setupEncryptionKey,
+  setSyncPassphrase,
+  getSyncPassphrase,
+  clearEncryptionKey,
+  hasEncryptionReady,
+  isEncryptedEnvelope,
+  initSessionKey,
+} from './crypto.js';
+
+// webdavFetch and createProviders are internal to the engine (Step 6) but
+// exported here so shims can wire them before the engine exists.
+export { webdavFetch, createProviders } from './providers.js';

package/src/providers.js

@@ -1 +1,317 @@
-// Placeholder — WebDAV providers are extracted in Step 4.
+// WebDAV provider objects and transport routing for cloud sync.
+// No hardcoded app names, paths, or platform globals — all injected via config.
+
+import { encryptData, decryptData, isEncryptedEnvelope } from './crypto.js';
+
+// btoa() throws InvalidCharacterError for codepoints > 255 (CJK, emoji, etc.).
+const toBase64 = (str) => btoa(String.fromCharCode(...new TextEncoder().encode(str)));
+
+// ---------------------------------------------------------------------------
+// Transport routing
+// ---------------------------------------------------------------------------
+
+/**
+ * Creates the transport-selecting WebDAV fetcher for a given engine config.
+ * Returns an async function with the same signature as the original webdavFetch.
+ *
+ * Transport priority:
+ *   1. nativeHttpRequest != null  → Android HTTP bridge (direct, no CORS)
+ *   2. electronProxyFetch != null → Electron main-process net.fetch
+ *   3. fallback                   → server-side CORS proxy at proxyUrl
+ *
+ * iOS note: pass nativeHttpRequest = null on iOS (the iOS DayGlanceNative Proxy
+ * makes every property truthy, so callers must apply the !DayGlanceIOS guard
+ * before deciding whether to pass a function here).
+ *
+ * @param {object}        config
+ * @param {Function|null} config.nativeHttpRequest  - Android bridge fn, or null
+ * @param {Function|null} config.electronProxyFetch - Electron proxy fn, or null
+ * @param {string}        [config.proxyUrl='']      - base URL for CORS proxy
+ */
+export const webdavFetch = (config) => async (method, targetUrl, authHeaders, body, extraHeaders = {}) => {
+  if (config.nativeHttpRequest != null) {
+    // Android: call the target URL directly via the native HTTP bridge.
+    const headers = { ...extraHeaders };
+    if (authHeaders['X-WebDAV-Auth']) {
+      headers['Authorization'] = authHeaders['X-WebDAV-Auth'];
+    } else {
+      Object.assign(headers, authHeaders);
+    }
+    if (body !== undefined && body !== null) {
+      headers['Content-Type'] = extraHeaders['Content-Type'] || 'application/octet-stream';
+    }
+    const result = config.nativeHttpRequest(method, targetUrl, headers, body ?? '');
+    if (!result) throw new Error('Native HTTP bridge unavailable');
+    return {
+      status: result.status,
+      ok: result.ok,
+      statusText: result.error || '',
+      headers: { get: (h) => (h.toLowerCase() === 'etag' ? result.headers?.etag ?? null : null) },
+      json: async () => {
+        try { return JSON.parse(result.body); }
+        catch { throw new Error(`Server returned non-JSON response (status ${result.status})`); }
+      },
+      text: async () => result.body,
+    };
+  }
+
+  if (config.electronProxyFetch != null) {
+    // Electron: route through the main process (net.fetch has no CORS restrictions).
+    const headers = { ...extraHeaders };
+    if (authHeaders['X-WebDAV-Auth']) {
+      headers['Authorization'] = authHeaders['X-WebDAV-Auth'];
+    } else {
+      Object.assign(headers, authHeaders);
+    }
+    if (body !== undefined && body !== null) {
+      headers['Content-Type'] = extraHeaders['Content-Type'] || 'application/octet-stream';
+    }
+    const result = await config.electronProxyFetch(method, targetUrl, headers, body ?? null);
+    if (!result) throw new Error('Electron network bridge unavailable');
+    return {
+      status: result.status,
+      ok: result.ok,
+      statusText: result.statusText,
+      headers: { get: (h) => (h.toLowerCase() === 'etag' ? result.headers?.etag ?? null : null) },
+      json: async () => {
+        try { return JSON.parse(result.body); }
+        catch { throw new Error(`Server returned non-JSON response (status ${result.status})`); }
+      },
+      text: async () => result.body,
+    };
+  }
+
+  // Web / iOS: route through the server-side CORS proxy.
+  return fetch(`${config.proxyUrl ?? ''}/api/webdav-proxy/?url=${encodeURIComponent(targetUrl)}`, {
+    method,
+    headers: { ...authHeaders, ...extraHeaders },
+    ...(body !== undefined && body !== null ? { body } : {}),
+  });
+};
+
+// ---------------------------------------------------------------------------
+// Internal helpers
+// ---------------------------------------------------------------------------
+
+async function parseDownloadResponse(res, engineConfig) {
+  const parsed = await res.json();
+  const payload = isEncryptedEnvelope(parsed) ? await decryptData(parsed, engineConfig) : parsed;
+  const etag = res.headers.get('etag') || null;
+  return { payload, etag };
+}
+
+async function mkcolWithParents(dirUrl, authHeaders, wf) {
+  const res = await wf('MKCOL', dirUrl, authHeaders);
+  if (res.status === 409 || res.status === 404) {
+    // Derive parent by stripping the last path segment via URL() to avoid
+    // producing malformed strings on root-level inputs.
+    let parent;
+    try {
+      const u = new URL(dirUrl);
+      const stripped = u.pathname.replace(/\/+$/, '').replace(/\/[^/]+$/, '/');
+      if (!stripped || stripped === u.pathname.replace(/\/+$/, '')) return;
+      u.pathname = stripped;
+      parent = u.toString();
+    } catch { return; }
+    if (parent && parent !== dirUrl) {
+      await mkcolWithParents(parent, authHeaders, wf);
+      await wf('MKCOL', dirUrl, authHeaders);
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Provider factory
+// ---------------------------------------------------------------------------
+
+/**
+ * Creates the cloud sync provider objects for the given engine config.
+ * Provider methods keep the same per-call signature as dayGLANCE's original
+ * cloudSyncProviders — callers pass user credentials via `config`.
+ *
+ * @param {object} engineConfig
+ * @param {string}        engineConfig.appFolderName       - e.g. 'dayglance'
+ * @param {string}        engineConfig.syncFilename        - e.g. 'dayglance-sync.json'
+ * @param {Function|null} engineConfig.nativeHttpRequest   - Android bridge, or null
+ * @param {Function|null} engineConfig.electronProxyFetch  - Electron proxy, or null
+ * @param {string}        [engineConfig.proxyUrl='']       - CORS proxy base URL
+ * @param {string}        engineConfig.cryptoDBName        - IndexedDB name for key storage
+ * @param {Function|null} [engineConfig.nativeGetSyncKey]  - Android crypto key bridge
+ * @param {Function|null} [engineConfig.nativeStoreSyncKey]
+ */
+export function createProviders(engineConfig) {
+  const { appFolderName, syncFilename } = engineConfig;
+  const wf = webdavFetch(engineConfig);
+
+  const parseDownload = (res) => parseDownloadResponse(res, engineConfig);
+  const mkcol = (dirUrl, authHeaders) => mkcolWithParents(dirUrl, authHeaders, wf);
+
+  return {
+    nextcloud: {
+      name: 'Nextcloud / WebDAV',
+      getFileUrl: (config) =>
+        `${config.nextcloudUrl.replace(/\/+$/, '')}/remote.php/dav/files/${encodeURIComponent(config.username)}/${appFolderName}/${syncFilename}`,
+      getDirUrl: (config) =>
+        `${config.nextcloudUrl.replace(/\/+$/, '')}/remote.php/dav/files/${encodeURIComponent(config.username)}/${appFolderName}/`,
+      getAuthHeaders: (config) => ({
+        'X-WebDAV-Auth': 'Basic ' + toBase64(config.username + ':' + config.appPassword)
+      }),
+      async upload(config, data, etag = null) {
+        const fileUrl = this.getFileUrl(config);
+        const dirUrl = this.getDirUrl(config);
+        const authHeaders = this.getAuthHeaders(config);
+        const payload = config.encryptionEnabled ? await encryptData(data, engineConfig) : data;
+        const body = JSON.stringify(payload);
+        const extraHeaders = { 'Content-Type': 'application/json' };
+        if (etag) extraHeaders['If-Match'] = etag;
+        const doUpload = () => wf('PUT', fileUrl, authHeaders, body, extraHeaders);
+        let res = await doUpload();
+        if (res.status === 404 || res.status === 409) {
+          await mkcol(dirUrl, authHeaders);
+          res = await doUpload();
+        }
+        if (res.status === 403) throw new Error('FORBIDDEN');
+        if (res.status === 412) throw new Error('PRECONDITION_FAILED');
+        if (!res.ok) throw new Error(`Upload failed: ${res.status} ${res.statusText}`);
+        return true;
+      },
+      async download(config) {
+        const fileUrl = this.getFileUrl(config);
+        const authHeaders = this.getAuthHeaders(config);
+        const res = await wf('GET', fileUrl, authHeaders);
+        if (res.status === 404) return null;
+        if (res.status === 403) throw new Error('FORBIDDEN');
+        if (!res.ok) throw new Error(`Download failed: ${res.status} ${res.statusText}`);
+        return parseDownload(res);
+      },
+      async test(config) {
+        const dirUrl = this.getDirUrl(config);
+        const authHeaders = this.getAuthHeaders(config);
+        const res = await wf('PROPFIND', dirUrl, authHeaders, undefined, { 'Depth': '0' });
+        if (res.status === 200 || res.status === 207 || res.status === 404) return { success: true };
+        if (res.status === 401) return { success: false, error: 'Invalid credentials. Check your username and app password.' };
+        if (res.status === 403) return { success: false, error: "Access forbidden (403). If using a self-hosted server, it may be blocking requests from Vercel's IP addresses." };
+        return { success: false, error: `Unexpected response: ${res.status}${res.statusText ? ' ' + res.statusText : ''}` };
+      },
+      configFields: [
+        { key: 'nextcloudUrl', label: 'Nextcloud URL', type: 'url', placeholder: 'https://cloud.example.com' },
+        { key: 'username', label: 'Username', type: 'text', placeholder: 'your-username' },
+        { key: 'appPassword', label: 'App Password', type: 'password', placeholder: 'xxxxx-xxxxx-xxxxx-xxxxx-xxxxx' }
+      ],
+      helpText: 'Go to Nextcloud Settings → Security → Devices & sessions → Create new app password'
+    },
+
+    koofr: {
+      name: 'Koofr',
+      getFileUrl: () => `https://app.koofr.net/dav/Koofr/${appFolderName}/${syncFilename}`,
+      getDirUrl: () => `https://app.koofr.net/dav/Koofr/${appFolderName}/`,
+      getAuthHeaders: (config) => ({
+        'X-WebDAV-Auth': 'Basic ' + toBase64(config.username + ':' + config.appPassword)
+      }),
+      async upload(config, data, etag = null) {
+        const fileUrl = this.getFileUrl();
+        const dirUrl = this.getDirUrl();
+        const authHeaders = this.getAuthHeaders(config);
+        const payload = config.encryptionEnabled ? await encryptData(data, engineConfig) : data;
+        const body = JSON.stringify(payload);
+        const extraHeaders = { 'Content-Type': 'application/json' };
+        if (etag) extraHeaders['If-Match'] = etag;
+        const doUpload = () => wf('PUT', fileUrl, authHeaders, body, extraHeaders);
+        let res = await doUpload();
+        if (res.status === 404 || res.status === 409) {
+          await mkcol(dirUrl, authHeaders);
+          res = await doUpload();
+        }
+        if (res.status === 403) throw new Error('FORBIDDEN');
+        if (res.status === 412) throw new Error('PRECONDITION_FAILED');
+        if (!res.ok) throw new Error(`Upload failed: ${res.status} ${res.statusText}`);
+        return true;
+      },
+      async download(config) {
+        const fileUrl = this.getFileUrl();
+        const authHeaders = this.getAuthHeaders(config);
+        const res = await wf('GET', fileUrl, authHeaders);
+        if (res.status === 404) return null;
+        if (res.status === 403) throw new Error('FORBIDDEN');
+        if (!res.ok) throw new Error(`Download failed: ${res.status} ${res.statusText}`);
+        return parseDownload(res);
+      },
+      async test(config) {
+        const dirUrl = this.getDirUrl();
+        const authHeaders = this.getAuthHeaders(config);
+        const res = await wf('PROPFIND', dirUrl, authHeaders, undefined, { 'Depth': '0' });
+        if (res.status === 200 || res.status === 207 || res.status === 404) return { success: true };
+        if (res.status === 401) return { success: false, error: 'Invalid credentials. Use your Koofr email and an app password, not your account password.' };
+        if (res.status === 403) {
+          // nativeHttpRequest != null means the Android HTTP bridge is available,
+          // which bypasses Koofr's server-side block on Vercel proxy IPs.
+          const onAndroid = engineConfig.nativeHttpRequest != null;
+          if (!onAndroid) return { success: false, error: "Koofr is blocking requests from the web app's server. Use the Android app — it connects to Koofr directly." };
+          return { success: false, error: 'Access forbidden. Check that your app password is correct and has not been revoked.' };
+        }
+        return { success: false, error: `Unexpected response: ${res.status}${res.statusText ? ' ' + res.statusText : ''}` };
+      },
+      configFields: [
+        { key: 'username', label: 'Email', type: 'text', placeholder: 'you@example.com' },
+        { key: 'appPassword', label: 'App Password', type: 'password', placeholder: 'your-app-password' },
+      ],
+      helpText: "Go to Koofr → Preferences → App passwords → New app password. Use your Koofr email as the username. Note: sync works on the Android app (direct connection); the web app may be blocked by Koofr's server-side restrictions.",
+    },
+
+    webdav: {
+      name: 'Generic WebDAV',
+      getFileUrl: (config) =>
+        `${config.webdavUrl.replace(/\/+$/, '')}/${syncFilename}`,
+      getDirUrl: (config) =>
+        `${config.webdavUrl.replace(/\/+$/, '')}/`,
+      getAuthHeaders: (config) => ({
+        'X-WebDAV-Auth': 'Basic ' + toBase64(config.username + ':' + config.appPassword)
+      }),
+      async upload(config, data, etag = null) {
+        const fileUrl = this.getFileUrl(config);
+        const dirUrl = this.getDirUrl(config);
+        const authHeaders = this.getAuthHeaders(config);
+        const payload = config.encryptionEnabled ? await encryptData(data, engineConfig) : data;
+        const body = JSON.stringify(payload);
+        const extraHeaders = { 'Content-Type': 'application/json' };
+        if (etag) extraHeaders['If-Match'] = etag;
+        const doUpload = () => wf('PUT', fileUrl, authHeaders, body, extraHeaders);
+        let res = await doUpload();
+        if (res.status === 404 || res.status === 409) {
+          await mkcol(dirUrl, authHeaders);
+          res = await doUpload();
+        }
+        if (res.status === 403) throw new Error('FORBIDDEN');
+        if (res.status === 412) throw new Error('PRECONDITION_FAILED');
+        if (!res.ok) throw new Error(`Upload failed: ${res.status} ${res.statusText}`);
+        return true;
+      },
+      async download(config) {
+        const fileUrl = this.getFileUrl(config);
+        const authHeaders = this.getAuthHeaders(config);
+        const res = await wf('GET', fileUrl, authHeaders);
+        if (res.status === 404) return null;
+        if (res.status === 403) throw new Error('FORBIDDEN');
+        if (!res.ok) throw new Error(`Download failed: ${res.status} ${res.statusText}`);
+        return parseDownload(res);
+      },
+      async test(config) {
+        // GET the sync file rather than PROPFIND — Apache mod_dav and other strict
+        // servers return 400 for a bodyless PROPFIND (RFC 4918 requires XML body).
+        const fileUrl = this.getFileUrl(config);
+        const authHeaders = this.getAuthHeaders(config);
+        const res = await wf('GET', fileUrl, authHeaders);
+        if (res.status === 200 || res.status === 404) return { success: true };
+        if (res.status === 401) return { success: false, error: 'Invalid credentials. Check your username and password.' };
+        if (res.status === 403) return { success: false, error: 'Access forbidden (403). Check that the WebDAV URL and path are correct.' };
+        return { success: false, error: `Unexpected response: ${res.status}${res.statusText ? ' ' + res.statusText : ''}` };
+      },
+      configFields: [
+        { key: 'webdavUrl', label: 'WebDAV URL', type: 'url', placeholder: 'https://dav.example.com/dayGLANCE/' },
+        { key: 'username', label: 'Username', type: 'text', placeholder: 'your-username' },
+        { key: 'appPassword', label: 'Password / App Password', type: 'password', placeholder: 'your-password' }
+      ],
+      helpText: 'Enter the full URL of the WebDAV folder where dayGLANCE should store its sync file. pCloud, Seafile, and most self-hosted WebDAV providers are supported.'
+    }
+  };
+}