cursedbelt-server 1.0.0

package/dist/server/jobs/types.d.ts

@@ -0,0 +1,167 @@
+import type { Database } from 'bun:sqlite';
+/**
+ * The cursedbelt job runner's public types — the engine both apps share.
+ *
+ * cursedbelt owns the *mechanism* (durable cron scheduling, restart-surviving
+ * pollers, the due-row fire queue, run auditing); the *job definitions* —
+ * reminder delivery, recurrence materialization, backup, metrics flush, caSync —
+ * stay app-business and consume these primitives.
+ *
+ * Three primitives cover every in-process scheduled-work shape:
+ *   - {@link JobRunner}  — durable cron jobs (plainjob-backed; survive restart).
+ *   - PollingJob         — a periodic timer that records its last successful run.
+ *   - FireQueue          — the "select due rows → deliver → mark sent" pattern.
+ *
+ * (cwip/taskq is the *other* model — lease-locked, multi-process, cross-machine —
+ * and stays in cwip. These primitives are single-server / in-process only.)
+ */
+/**
+ * A minimal structured logger (winston-compatible, so it can be passed straight
+ * through to the underlying plainjob queue/worker). Consumers inject their app
+ * logger; the default ({@link defaultJobLogger}) writes warn/info/error to the
+ * console and silences `debug` (plainjob logs at debug every poll).
+ */
+export interface JobLogger {
+    error(message: string, ...meta: unknown[]): void;
+    warn(message: string, ...meta: unknown[]): void;
+    info(message: string, ...meta: unknown[]): void;
+    debug(message: string, ...meta: unknown[]): void;
+}
+/** Everything a job handler is handed when it runs. */
+export interface JobContext {
+    /** The shared SQLite connection (same instance the app uses). */
+    db: Database;
+    /**
+     * Aborted when the runner/poller is stopped, or when a {@link JobDef.timeout}
+     * elapses. Long-running handlers should observe it and short-circuit; a promise
+     * cannot be force-killed, so cooperation is the only way to stop work early.
+     */
+    signal: AbortSignal;
+    logger: JobLogger;
+}
+/** A durable, cron-scheduled job registered with a {@link JobRunner}. */
+export interface JobDef {
+    /** Unique name — the audit key (`job_runs.job_name`) and plainjob job type. */
+    name: string;
+    /**
+     * Cron expression. 5-field (minute precision) or 6-field with a leading
+     * seconds column — e.g. `0 3 * * *` is 3am daily, and a seconds step of the
+     * form `(asterisk-slash-10) * * * * *` fires every 10s. Omit for a job that is
+     * only ever fired manually via {@link JobRunner.runOnce}.
+     */
+    cron?: string;
+    /** The work. Rejecting (or timing out) records an `error` run. */
+    run(context: JobContext): Promise<void> | void;
+    /**
+     * Max run time in ms before the context signal is aborted and the run is
+     * recorded as a timeout error. Default {@link DEFAULT_JOB_TIMEOUT_MS}. Set a
+     * larger value (or `0` to disable) for legitimately long jobs like backups.
+     */
+    timeout?: number;
+}
+/** A single row of a job's run history (newest first via {@link JobRunner.getLastRun}). */
+export interface JobRunRecord {
+    startedAt: string;
+    /** Null while the run is still in flight (or if the process died mid-run). */
+    endedAt?: string;
+    /** `running` | `ok` | `error`. */
+    status: string;
+    /** Present only on an `error` run. */
+    error?: string;
+}
+export interface CreateJobRunnerOptions {
+    logger?: JobLogger;
+    /**
+     * How often each worker polls for due cron jobs, in ms. Default 1000. Set lower
+     * only if you need sub-second cron precision; the cost is one cheap SQLite query
+     * per worker per interval.
+     */
+    pollIntervalMs?: number;
+    /**
+     * Bounds on the runner's persisted history. Without bounds a high-frequency
+     * cron (e.g. a 5s engine janitor) grows `job_runs` and plainjob's internal
+     * `plainjob_jobs` forever — thousands of rows per day on a completely idle
+     * daemon. Retention is ON by default ({@link DEFAULT_JOB_RETENTION});
+     * override a field to tune it, or set a field to `0` to disable that bound.
+     */
+    retention?: JobRetentionOptions;
+}
+/** Retention bounds for {@link JobRunner} history. `0` disables that bound. */
+export interface JobRetentionOptions {
+    /** Delete `job_runs` audit rows older than this. Default 7 days. */
+    auditMaxAgeMs?: number;
+    /**
+     * Keep at most this many newest `job_runs` rows PER job name — the bound that
+     * matters for sub-minute crons, where an age window alone still admits tens of
+     * thousands of rows. Default 2000.
+     */
+    auditMaxRowsPerJob?: number;
+    /** Minimum gap between prune passes (pruning is lazy, after a run finishes). Default 1 hour. */
+    pruneIntervalMs?: number;
+    /** plainjob maintenance: remove its internal done-job rows older than this. Default 6 hours. */
+    doneJobsMaxAgeMs?: number;
+    /** plainjob maintenance: remove its internal failed-job rows older than this. Default 7 days. */
+    failedJobsMaxAgeMs?: number;
+}
+/** Default {@link JobRetentionOptions} — bounded history out of the box. */
+export declare const DEFAULT_JOB_RETENTION: Required<JobRetentionOptions>;
+/**
+ * The durable cron job runner — a thin facade over plainjob (SQLite-backed, no
+ * Redis). Schedules persist in the shared DB, so a registered cron survives a
+ * restart. (plainjob does NOT retroactively fire a cron missed while the process
+ * was down; for "must catch up on boot" work use a PollingJob with `runOnBoot`.)
+ */
+export interface JobRunner {
+    /** Register a job. Call before {@link start}; registering a cron after start spins its worker up immediately. */
+    register(job: JobDef): void;
+    /** Begin processing: one worker per cron job starts polling. Idempotent. */
+    start(): void;
+    /** Stop all workers (signaling in-flight handlers) and release the queue. Does NOT close the shared DB. */
+    stop(): Promise<void>;
+    /** Run a registered job once, right now (admin/manual trigger). Bypasses the schedule; still audited. Throws ApiError(404) if unknown. */
+    runOnce(name: string): Promise<void>;
+    /** The most recent run of `name`, or null if it has never run. */
+    getLastRun(name: string): JobRunRecord | null;
+}
+/** A periodic timer started/stopped as a unit. Returned by `createPollingJob`/`createFireQueue`. */
+export interface PollingJob {
+    name: string;
+    /** Start the timer (and fire once immediately unless `runOnBoot` is false). Idempotent. */
+    start(): void;
+    /** Stop the timer and signal any in-flight run via its abort signal. */
+    stop(): void;
+}
+export interface PollingJobOpts {
+    name: string;
+    /** Fire cadence in ms. */
+    intervalMs: number;
+    /** Fire once immediately on {@link PollingJob.start}. Default true. */
+    runOnBoot?: boolean;
+    /** The shared SQLite connection. `job_state.last_run_at` is upserted after each successful run. */
+    db: Database;
+    run(context: JobContext): Promise<void> | void;
+    logger?: JobLogger;
+}
+/** A {@link PollingJob} specialized for the "deliver every due row" pattern. */
+export type FireQueue = PollingJob;
+export interface FireQueueOpts<T> {
+    name: string;
+    db: Database;
+    /** Poll cadence in ms. Default {@link DEFAULT_FIRE_INTERVAL_MS} (30s). */
+    intervalMs?: number;
+    /** Fire once immediately on start. Default true. */
+    runOnBoot?: boolean;
+    /** Return the rows currently due for delivery. */
+    getDue(db: Database): T[];
+    /** Deliver one item. Throwing skips `markSent` for that item and routes to `onError`; the loop continues. */
+    deliver(item: T, db: Database): Promise<void> | void;
+    /** Mark one item delivered (only called after a successful `deliver`). */
+    markSent(item: T, db: Database): void;
+    /** Per-item failure hook (the loop still continues to the next item). */
+    onError?(item: T, err: unknown): void;
+    logger?: JobLogger;
+}
+/** Default per-run timeout for a cron {@link JobDef} (1 minute). */
+export declare const DEFAULT_JOB_TIMEOUT_MS = 60000;
+/** Default poll cadence for a {@link FireQueue} (30 seconds). */
+export declare const DEFAULT_FIRE_INTERVAL_MS = 30000;

package/dist/server/jobs/types.js

@@ -0,0 +1,12 @@
+/** Default {@link JobRetentionOptions} — bounded history out of the box. */
+export const DEFAULT_JOB_RETENTION = {
+    auditMaxAgeMs: 7 * 24 * 60 * 60 * 1000,
+    auditMaxRowsPerJob: 2000,
+    pruneIntervalMs: 60 * 60 * 1000,
+    doneJobsMaxAgeMs: 6 * 60 * 60 * 1000,
+    failedJobsMaxAgeMs: 7 * 24 * 60 * 60 * 1000,
+};
+/** Default per-run timeout for a cron {@link JobDef} (1 minute). */
+export const DEFAULT_JOB_TIMEOUT_MS = 60_000;
+/** Default poll cadence for a {@link FireQueue} (30 seconds). */
+export const DEFAULT_FIRE_INTERVAL_MS = 30_000;

package/dist/server/master-lock/guard.d.ts

@@ -0,0 +1,53 @@
+import { type LockPageOptions } from "./lockPage";
+import type { MasterLock } from "./masterLock";
+export interface MasterLockGuardOptions extends LockPageOptions {
+    /**
+     * The lock this guard enforces.
+     *
+     * A {@link MasterLock} for an app with one app-wide password (collections, the
+     * binary-server inspector). A FUNCTION for an app where each person has their own
+     * (`principals.ts`): it is handed the request and returns that caller's lock.
+     *
+     * 🔴 The function must resolve the principal from the request's own verified session
+     * and NOTHING else. A resolver that reads a header, a query parameter or a body field
+     * hands the caller the choice of whose lock to be measured against, which is the one
+     * way this feature can be turned inside out. Returning `null` means "no principal" —
+     * the guard then stands aside for ordinary paths (the app's own sign-in owns the
+     * request) and refuses `/__lock/*` outright, since there is nobody to unlock for.
+     */
+    lock: MasterLock | ((req: Request) => MasterLock | null);
+    /**
+     * Paths that stay reachable while locked, beyond `/__lock/*`.
+     *
+     * 🔴 This is where a MACHINE surface is kept out of the lock, and getting it wrong is
+     * the one way this feature can break something else. binary-server's inspector is a
+     * UI and is locked whole; binary-server's STORE serves the fleet's bytes and is a
+     * different process that never mounts this at all. Within one process, a health check
+     * or a token-authenticated ingest route belongs here — a page does not.
+     */
+    allow?: (url: URL, req: Request) => boolean;
+    /**
+     * What makes this app's unlock cookie ITS OWN — `master_lock_<appKey>`.
+     *
+     * 🔴 Set it on every app that can ever share a hostname with another locked app, which
+     * on this fleet means every app: they are all `localhost:<port>` on the owner's Mac, and
+     * a cookie is scoped by HOST, not by origin. Left unset the cookie is the bare
+     * `master_lock`, and two such apps overwrite each other's token — see
+     * `masterLockCookieName` for what that silently breaks. Defaults to {@link appLabel},
+     * so an app that already names itself is fixed without being changed.
+     */
+    appKey?: string;
+    /**
+     * Is this connection HTTPS, so the cookie may carry `Secure`?
+     *
+     * Defaults to reading `x-forwarded-proto` then the URL — right for both a satellite
+     * behind nginx and a loopback daemon speaking plain http, where a `Secure` cookie would
+     * simply never be stored and the site could never be unlocked.
+     */
+    secure?: (url: URL, req: Request) => boolean;
+}
+export interface MasterLockGuard {
+    /** `Response` when handled, `null` when the app should serve the request. */
+    handle(req: Request): Promise<Response | null>;
+}
+export declare function createMasterLockGuard(options: MasterLockGuardOptions): MasterLockGuard;

package/dist/server/master-lock/guard.js

@@ -0,0 +1,205 @@
+/**
+ * The guard — one decision function, so a Hono app and a bare `Bun.serve` handler cannot
+ * end up enforcing two different rules.
+ *
+ * `handle(req)` answers a `Response` when it has taken responsibility for the request, and
+ * `null` when the app should serve it as usual. That shape is what lets it be middleware in
+ * one app and an early `return` in another without either of them re-deciding anything.
+ *
+ * 🔴 Registration order is the security property, exactly as it is for the SSO gate this
+ * sits behind. Mount it so that it runs BEFORE any route that serves content, and AFTER
+ * whatever proves the caller is allowed in the building at all — the master password is a
+ * second wall, not a replacement for the first.
+ */
+import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX, MASTER_LOCK_STATE_HEADER, masterLockCookieName, } from "cursedbelt-core/master-lock";
+import { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage";
+const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma: "no-cache" };
+/**
+ * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without
+ * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
+ * script does the POST), and the page cannot be framed.
+ */
+const LOCK_CSP = "default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
+    "img-src data:; form-action 'none'; base-uri 'none'; frame-ancestors 'none'";
+export function createMasterLockGuard(options) {
+    const resolve = typeof options.lock === "function" ? options.lock : () => options.lock;
+    const isSecure = options.secure ?? defaultSecure;
+    const cookieName = masterLockCookieName(options.appKey ?? options.appLabel);
+    const cookie = (token, secure) => 
+    // No Max-Age: a SESSION cookie, so closing the browser drops it. The server-side
+    // idle clock is the real expiry — this only keeps the token out of a profile that
+    // somebody else might open tomorrow.
+    `${cookieName}=${token}; Path=/; HttpOnly; SameSite=Strict${secure ? "; Secure" : ""}`;
+    const clearCookie = (secure) => `${cookieName}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${secure ? "; Secure" : ""}`;
+    /** The ONE refusal. Identical for wrong, throttled, unconfigured and not-unlocked. */
+    const refuse = (retryAfterMs = 0) => Response.json({ error: "locked", retryAfterMs }, { status: 401, headers: { ...noStore, [MASTER_LOCK_STATE_HEADER]: "locked" } });
+    /**
+     * 🔴 May THIS request through — and the difference between the two modes is the whole
+     * security property of the per-person wall.
+     *
+     * **App-wide**: `unlocked` is enough. The site has one user and one unlock; the token
+     * is how a caller with no cookie jar says "it's still me", not a per-browser
+     * credential. Reading the ambient state is the behaviour `apps/collections` and the
+     * binary-server inspector have always had.
+     *
+     * **Per-person**: the token is REQUIRED. `unlocked` there means only "somebody's
+     * device is open", and honouring that would make the unlock ambient — measured while
+     * building this (2026-08-25): with `unlocked ||` in front, one browser unlocking meant
+     * every OTHER browser signed in as that person walked straight through, having typed
+     * nothing. The owner's phone would ride his desk's unlock, and an invented
+     * `x-master-lock` value would be accepted because the check never looked at it. Two
+     * tests in `principals.spec.ts` fail on the `||`, which is why it is gone.
+     */
+    const opens = (lock, req) => lock.isEnrollable ? lock.presents(req) : lock.unlocked || lock.presents(req);
+    async function handleOwnRoute(req, url, lock) {
+        const path = url.pathname;
+        const secure = isSecure(url, req);
+        if (req.method === "GET" || req.method === "HEAD") {
+            if (path === MASTER_LOCK_PATHS.style) {
+                return new Response(LOCK_STYLE, {
+                    headers: { "content-type": "text/css; charset=utf-8", ...noStore },
+                });
+            }
+            if (path === MASTER_LOCK_PATHS.script) {
+                return new Response(LOCK_SCRIPT, {
+                    headers: { "content-type": "text/javascript; charset=utf-8", ...noStore },
+                });
+            }
+            if (path === MASTER_LOCK_PATHS.status) {
+                return Response.json(lock.status(), { headers: noStore });
+            }
+            if (path === MASTER_LOCK_PATHS.page || path === MASTER_LOCK_PREFIX) {
+                // Already open FOR THIS CALLER, so there is nothing to type — send them to
+                // the app rather than showing a password box that would do nothing. Per
+                // person this must be the caller's own state, not the site's: bouncing a
+                // locked-out phone to `/` because the desk is open is an infinite loop.
+                if (opens(lock, req))
+                    return Response.redirect(new URL("/", url), 303);
+                return lockPage(options, lock);
+            }
+            return new Response("not found", { status: 404, headers: noStore });
+        }
+        if (req.method !== "POST") {
+            return new Response("method not allowed", { status: 405, headers: noStore });
+        }
+        if (path === MASTER_LOCK_PATHS.enroll) {
+            const body = await readJson(req);
+            const result = await lock.enroll({
+                kdf: body?.kdf,
+                verifier: typeof body?.verifier === "string" ? body.verifier : "",
+            });
+            // Every refusal is the SAME refusal, as everywhere else here: "you may not
+            // enroll" and "somebody already did" must not be distinguishable, or the route
+            // becomes a way to ask whether a given account has a master password yet.
+            if (!result.ok)
+                return refuse();
+            return Response.json({ ok: true, idleMs: lock.idleMs }, { headers: { ...noStore, "set-cookie": cookie(result.token, secure) } });
+        }
+        if (path === MASTER_LOCK_PATHS.unlock) {
+            const body = await readJson(req);
+            const verifier = typeof body?.verifier === "string" ? body.verifier : "";
+            const result = await lock.unlock(verifier);
+            if (!result.ok)
+                return refuse(result.retryAfterMs);
+            return Response.json({ ok: true, idleMs: lock.idleMs }, { headers: { ...noStore, "set-cookie": cookie(result.token, secure) } });
+        }
+        // Everything below CHANGES something and therefore needs the site already open.
+        if (!lock.presents(req))
+            return refuse();
+        if (path === MASTER_LOCK_PATHS.ping) {
+            lock.touch(req);
+            return Response.json({ ok: true, remainingMs: lock.remainingMs }, { headers: noStore });
+        }
+        if (path === MASTER_LOCK_PATHS.lock) {
+            lock.lock();
+            return Response.json({ ok: true }, { headers: { ...noStore, "set-cookie": clearCookie(secure) } });
+        }
+        if (path === MASTER_LOCK_PATHS.settings) {
+            const body = await readJson(req);
+            const idleMs = lock.setIdleMs(Number(body?.idleMs));
+            return Response.json({ ok: true, idleMs }, { headers: noStore });
+        }
+        if (path === MASTER_LOCK_PATHS.change) {
+            const body = await readJson(req);
+            const result = await lock.change({
+                currentVerifier: typeof body?.currentVerifier === "string" ? body.currentVerifier : "",
+                kdf: body?.kdf,
+                verifier: typeof body?.verifier === "string" ? body.verifier : "",
+            });
+            if (!result.ok) {
+                return Response.json({ error: result.reason }, { status: 400, headers: noStore });
+            }
+            // The rotation locked the site; drop the cookie with it so the page it came from
+            // does not sit there holding a token that stopped meaning anything.
+            return Response.json({ ok: true }, { headers: { ...noStore, "set-cookie": clearCookie(secure) } });
+        }
+        return new Response("not found", { status: 404, headers: noStore });
+    }
+    return {
+        async handle(req) {
+            const url = new URL(req.url);
+            const own = url.pathname === MASTER_LOCK_PREFIX || url.pathname.startsWith(`${MASTER_LOCK_PREFIX}/`);
+            const lock = resolve(req);
+            if (!lock) {
+                // No principal. On the app's own paths the caller is not signed in and the
+                // app's sign-in owns the request; on `/__lock/*` there is nobody to unlock
+                // FOR, and answering the ordinary refusal keeps that indistinguishable from
+                // being locked.
+                return own ? refuse() : null;
+            }
+            if (own)
+                return handleOwnRoute(req, url, lock);
+            if (options.allow?.(url, req))
+                return null;
+            if (opens(lock, req))
+                return null;
+            // A document request is answered IN PLACE with the lock page — same URL, status
+            // 200 — so unlocking reloads to where they were going instead of dumping them at
+            // the root. Everything else gets the uniform refusal.
+            if (wantsDocument(req))
+                return lockPage(options, lock);
+            return refuse();
+        },
+    };
+}
+function lockPage(options, lock) {
+    return new Response(lockPageHtml({ ...options, enroll: lock.awaitingEnrollment }), {
+        status: 200,
+        headers: {
+            "content-type": "text/html; charset=utf-8",
+            "content-security-policy": LOCK_CSP,
+            "x-content-type-options": "nosniff",
+            [MASTER_LOCK_STATE_HEADER]: "locked",
+            ...noStore,
+        },
+    });
+}
+/** Is this the browser asking for a PAGE, as opposed to the app asking for data? */
+function wantsDocument(req) {
+    if (req.method !== "GET")
+        return false;
+    // `Sec-Fetch-Dest` is the browser's own answer and beats guessing from `Accept`; every
+    // engine this fleet runs on sends it. `Accept` is the fallback for curl and for a
+    // request that arrived through something that stripped it.
+    const dest = req.headers.get("sec-fetch-dest");
+    if (dest)
+        return dest === "document" || dest === "iframe";
+    return (req.headers.get("accept") ?? "").includes("text/html");
+}
+async function readJson(req) {
+    try {
+        const body = await req.json();
+        if (body === null || typeof body !== "object" || Array.isArray(body))
+            return null;
+        return body;
+    }
+    catch {
+        return null;
+    }
+}
+function defaultSecure(url, req) {
+    const forwarded = req.headers.get("x-forwarded-proto");
+    if (forwarded)
+        return forwarded.split(",")[0]?.trim() === "https";
+    return url.protocol === "https:";
+}

package/dist/server/master-lock/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `cursedbelt-server/master-lock` — the server half of the sitewide master-password lock.
+ *
+ * What the feature is, what it deliberately is NOT, and the four decisions behind it are in
+ * `masterLock.ts`'s module note. Read that first.
+ *
+ * Adopting it in an app is three things:
+ *   1. a {@link MasterLock} built over whatever key/value the app already has,
+ *   2. `createMasterLockGuard(...).handle(req)` in front of everything the app serves,
+ *   3. `cursedbelt/react/master-lock` in the header, for the manual lock and the rotation.
+ *
+ * Removing it is deleting those three. That is the shape the owner asked for: *"the reusable
+ * functionality for this should be in a place that makes it easy to share to add or remove
+ * from apps in the code, such as cb."*
+ */
+export { type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard } from "./guard";
+export { LOCK_SCRIPT, LOCK_STYLE, type LockPageOptions, lockPageHtml } from "./lockPage";
+export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, type MasterLockDirectoryOptions, masterLockPrincipalKey, } from "./principals";
+export { MasterLock, type MasterLockEnrollResult, type MasterLockOptions, type MasterLockRecord, type MasterLockStore, type MasterLockUnlockResult, readRecord, } from "./masterLock";
+export { DEFAULT_SEED_IDLE_MS, generateStagePassword, type MintMasterLockSeedOptions, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed";
+export { MASTER_LOCK_SETTING_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store";

package/dist/server/master-lock/index.js

@@ -0,0 +1,21 @@
+/**
+ * `cursedbelt-server/master-lock` — the server half of the sitewide master-password lock.
+ *
+ * What the feature is, what it deliberately is NOT, and the four decisions behind it are in
+ * `masterLock.ts`'s module note. Read that first.
+ *
+ * Adopting it in an app is three things:
+ *   1. a {@link MasterLock} built over whatever key/value the app already has,
+ *   2. `createMasterLockGuard(...).handle(req)` in front of everything the app serves,
+ *   3. `cursedbelt/react/master-lock` in the header, for the manual lock and the rotation.
+ *
+ * Removing it is deleting those three. That is the shape the owner asked for: *"the reusable
+ * functionality for this should be in a place that makes it easy to share to add or remove
+ * from apps in the code, such as cb."*
+ */
+export { createMasterLockGuard } from "./guard";
+export { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage";
+export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey, } from "./principals";
+export { MasterLock, readRecord, } from "./masterLock";
+export { DEFAULT_SEED_IDLE_MS, generateStagePassword, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed";
+export { MASTER_LOCK_SETTING_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store";

package/dist/server/master-lock/lockPage.d.ts

@@ -0,0 +1,34 @@
+/** Everything the page needs to know about the app it is standing in front of. */
+export interface LockPageOptions {
+    /** What to call this app — "Collections", "binary-server inspector". */
+    appLabel: string;
+    /** Shown under the title. Defaults to the sentence that explains the second wall. */
+    note?: string;
+    /**
+     * Render the CHOOSE-a-password form rather than the type-it form.
+     *
+     * Set by the guard from `lock.awaitingEnrollment`, i.e. per-person mode with no record
+     * for this account yet. It is a rendering hint and nothing more — the server refuses
+     * `POST /__lock/enroll` on its own record's state, so a page asking to enroll cannot
+     * make enrollment legal.
+     */
+    enroll?: boolean;
+}
+/**
+ * The document. Deliberately says the app's NAME and nothing else about it — whoever is
+ * looking already reached the origin, so the hostname told them that much, and a page that
+ * would not say which app it is cannot tell the owner which password to type.
+ */
+export declare function lockPageHtml(options: LockPageOptions): string;
+/** The stylesheet. Follows the viewer's theme and commits to nothing else. */
+export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n";
+/**
+ * The page's script.
+ *
+ * Derives in the browser and sends only the verifier — the password itself never crosses
+ * the network, which is what makes "saved nowhere" true rather than aspirational.
+ *
+ * 600,000 PBKDF2 rounds take a beat on a phone, so the button says so; a page that looks
+ * frozen gets clicked again, and every extra click is another 600k rounds.
+ */
+export declare const LOCK_SCRIPT: string;