cursedbelt 2.8.0 → 3.0.0

package/dist/core/master-lock/kdf.d.ts

@@ -1,64 +0,0 @@
-/**
- * The master-password derivation — deliberately BYTE-IDENTICAL to `apps/vault`'s.
- *
- * ── Why identical, and not merely similar ───────────────────────────────────
- * The owner's instruction for this feature was *"set the master password to be the same
- * as the vault master password for now … apply the verification like vault uses so I can
- * type in the same master password I have on the vault and it works"*. Nobody — not the
- * vault, not an agent, not this code — knows that password. The only way an app can accept
- * it on day one is to be seeded with the vault's own KDF params and the vault's own stored
- * `argon2id(verifier)`, and for that seed to mean anything the derivation has to agree to
- * the byte. So this is a deliberate DUPLICATE of `apps/vault/src/crypto/kdf.ts`, pinned by
- * `kdf.spec.ts` against the same fixed (salt, password) → verifier vector that file pins.
- *
- * It is not imported from the vault because the dependency would point the wrong way: a
- * satellite app is a consumer of this package, and `cursedbelt` may never import one.
- *
- * ── The two outputs ────────────────────────────────────────────────────────
- *   KEK      = PBKDF2-SHA256(password, salt, 600_000) → 256 bits
- *   verifier = PBKDF2-SHA256(KEK ‖ password, salt, 1), base64url
- *
- * The extra round exists so the value the server sees is one step past the key. Here there
- * IS no encryption key — this lock guards a UI, and the bytes behind it are plaintext at
- * rest by nature (see the module note in `../../server/master-lock/masterLock.ts`). The KEK
- * is computed only because dropping it would change the verifier and break the whole point
- * of the paragraph above.
- *
- * The server stores `argon2id(verifier)`, never the verifier, and the password never leaves
- * the browser.
- */
-/** The pinned v1 parameters. Iterations may only ever be RAISED, and only by a change. */
-export declare const MASTER_LOCK_KDF: {
-    readonly v: 1;
-    readonly alg: "PBKDF2-SHA256";
-    readonly iter: 600000;
-    readonly saltBytes: 16;
-};
-/** The versioned KDF descriptor. Every field is PUBLIC — it is served to the lock page
- *  before anyone has proved anything, exactly as the vault serves it. */
-export interface MasterLockKdfParams {
-    readonly v: 1;
-    readonly alg: "PBKDF2-SHA256";
-    readonly iter: number;
-    /** base64url of the random salt. */
-    readonly salt: string;
-}
-/** Is this a KDF descriptor this build knows how to derive under? Used at the seam where
- *  params arrive from a database, an env seed or the network — all three are outside this
- *  module's control, and a silently-wrong `iter` derives a verifier that can never match. */
-export declare function isMasterLockKdfParams(value: unknown): value is MasterLockKdfParams;
-/** Fresh params for a NEW master password: today's pinned numbers, a random salt. */
-export declare function newMasterLockKdfParams(): MasterLockKdfParams;
-/**
- * Derive the unlock verifier from a typed master password.
- *
- * Runs in the BROWSER (the lock page and the change-password dialog) and in `bun test`.
- * `crypto.subtle` ships PBKDF2 natively in both, which is why it is PBKDF2 and not argon2 —
- * the same reasoning the vault records at length.
- */
-export declare function deriveMasterLockVerifier(masterPassword: string, params: MasterLockKdfParams): Promise<string>;
-/** base64url, unpadded — the vault's `b64u`. */
-export declare function b64u(bytes: Uint8Array): string;
-/** The inverse of {@link b64u}. */
-export declare function unb64u(text: string): Uint8Array;
-//# sourceMappingURL=kdf.d.ts.map

package/dist/core/master-lock/kdf.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"kdf.d.ts","sourceRoot":"","sources":["../../../src/core/master-lock/kdf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,0FAA0F;AAC1F,eAAO,MAAM,eAAe;;;;;CAKlB,CAAC;AAEX;yEACyE;AACzE,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;IACd,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACtB;AAID;;6FAE6F;AAC7F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAalF;AAED,qFAAqF;AACrF,wBAAgB,sBAAsB,IAAI,mBAAmB,CAI5D;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC7C,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,mBAAmB,GACzB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAmCD,gDAAgD;AAChD,wBAAgB,IAAI,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAI9C;AAED,mCAAmC;AACnC,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAM/C"}

package/dist/core/master-lock/kdf.js

@@ -1,118 +0,0 @@
-/**
- * The master-password derivation — deliberately BYTE-IDENTICAL to `apps/vault`'s.
- *
- * ── Why identical, and not merely similar ───────────────────────────────────
- * The owner's instruction for this feature was *"set the master password to be the same
- * as the vault master password for now … apply the verification like vault uses so I can
- * type in the same master password I have on the vault and it works"*. Nobody — not the
- * vault, not an agent, not this code — knows that password. The only way an app can accept
- * it on day one is to be seeded with the vault's own KDF params and the vault's own stored
- * `argon2id(verifier)`, and for that seed to mean anything the derivation has to agree to
- * the byte. So this is a deliberate DUPLICATE of `apps/vault/src/crypto/kdf.ts`, pinned by
- * `kdf.spec.ts` against the same fixed (salt, password) → verifier vector that file pins.
- *
- * It is not imported from the vault because the dependency would point the wrong way: a
- * satellite app is a consumer of this package, and `cursedbelt` may never import one.
- *
- * ── The two outputs ────────────────────────────────────────────────────────
- *   KEK      = PBKDF2-SHA256(password, salt, 600_000) → 256 bits
- *   verifier = PBKDF2-SHA256(KEK ‖ password, salt, 1), base64url
- *
- * The extra round exists so the value the server sees is one step past the key. Here there
- * IS no encryption key — this lock guards a UI, and the bytes behind it are plaintext at
- * rest by nature (see the module note in `../../server/master-lock/masterLock.ts`). The KEK
- * is computed only because dropping it would change the verifier and break the whole point
- * of the paragraph above.
- *
- * The server stores `argon2id(verifier)`, never the verifier, and the password never leaves
- * the browser.
- */
-/** The pinned v1 parameters. Iterations may only ever be RAISED, and only by a change. */
-export const MASTER_LOCK_KDF = {
-    v: 1,
-    alg: "PBKDF2-SHA256",
-    iter: 600_000,
-    saltBytes: 16,
-};
-const B64_ALPHABET = /^[0-9A-Za-z_-]+$/;
-/** Is this a KDF descriptor this build knows how to derive under? Used at the seam where
- *  params arrive from a database, an env seed or the network — all three are outside this
- *  module's control, and a silently-wrong `iter` derives a verifier that can never match. */
-export function isMasterLockKdfParams(value) {
-    if (value === null || typeof value !== "object")
-        return false;
-    const p = value;
-    return (p.v === 1 &&
-        p.alg === "PBKDF2-SHA256" &&
-        typeof p.iter === "number" &&
-        Number.isInteger(p.iter) &&
-        p.iter >= 1 &&
-        typeof p.salt === "string" &&
-        p.salt.length > 0 &&
-        B64_ALPHABET.test(p.salt));
-}
-/** Fresh params for a NEW master password: today's pinned numbers, a random salt. */
-export function newMasterLockKdfParams() {
-    const salt = new Uint8Array(MASTER_LOCK_KDF.saltBytes);
-    crypto.getRandomValues(salt);
-    return { v: MASTER_LOCK_KDF.v, alg: MASTER_LOCK_KDF.alg, iter: MASTER_LOCK_KDF.iter, salt: b64u(salt) };
-}
-/**
- * Derive the unlock verifier from a typed master password.
- *
- * Runs in the BROWSER (the lock page and the change-password dialog) and in `bun test`.
- * `crypto.subtle` ships PBKDF2 natively in both, which is why it is PBKDF2 and not argon2 —
- * the same reasoning the vault records at length.
- */
-export async function deriveMasterLockVerifier(masterPassword, params) {
-    if (!isMasterLockKdfParams(params)) {
-        throw new Error(`unsupported master-lock KDF params: ${JSON.stringify(params)}`);
-    }
-    const salt = unb64u(params.salt);
-    const kek = await pbkdf2(utf8(masterPassword), salt, params.iter);
-    // Same salt as the KEK, by design: it individualises the verifier without a second
-    // stored value. One round, over KEK ‖ password.
-    const verifier = await pbkdf2(concat(kek, utf8(masterPassword)), salt, 1);
-    return b64u(verifier);
-}
-async function pbkdf2(material, salt, iterations) {
-    const key = await crypto.subtle.importKey("raw", buf(material), "PBKDF2", false, ["deriveBits"]);
-    const bits = await crypto.subtle.deriveBits({ name: "PBKDF2", salt: buf(salt), iterations, hash: "SHA-256" }, key, 256);
-    return new Uint8Array(bits);
-}
-// ── bytes ───────────────────────────────────────────────────────────────────
-// Local rather than imported: this module is the one piece that must stay derivable with
-// nothing behind it, and `atob`/`btoa` exist in every runtime it runs in.
-/** A copy whose backing store is a plain `ArrayBuffer` — what `BufferSource` wants, and
- *  what a `Uint8Array` over a `SharedArrayBuffer` is not. */
-function buf(bytes) {
-    const out = new ArrayBuffer(bytes.byteLength);
-    new Uint8Array(out).set(bytes);
-    return out;
-}
-function utf8(text) {
-    return new TextEncoder().encode(text);
-}
-function concat(a, b) {
-    const out = new Uint8Array(a.length + b.length);
-    out.set(a, 0);
-    out.set(b, a.length);
-    return out;
-}
-/** base64url, unpadded — the vault's `b64u`. */
-export function b64u(bytes) {
-    let binary = "";
-    for (const byte of bytes)
-        binary += String.fromCharCode(byte);
-    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-/** The inverse of {@link b64u}. */
-export function unb64u(text) {
-    const padded = text.replace(/-/g, "+").replace(/_/g, "/");
-    const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
-    const out = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i += 1)
-        out[i] = binary.charCodeAt(i);
-    return out;
-}
-//# sourceMappingURL=kdf.js.map

package/dist/core/master-lock/kdf.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"kdf.js","sourceRoot":"","sources":["../../../src/core/master-lock/kdf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,CAAC,EAAE,CAAC;IACJ,GAAG,EAAE,eAAe;IACpB,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,EAAE;CACJ,CAAC;AAYX,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAExC;;6FAE6F;AAC7F,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACN,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,GAAG,KAAK,eAAe;QACzB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACxB,CAAC,CAAC,IAAI,IAAI,CAAC;QACX,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACjB,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CACzB,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,sBAAsB;IACrC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACzG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,cAAsB,EACtB,MAA2B;IAE3B,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAClE,mFAAmF;IACnF,gDAAgD;IAChD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAoB,EAAE,IAAgB,EAAE,UAAkB;IAC/E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAC1C,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,EAChE,GAAG,EACH,GAAG,CACH,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,+EAA+E;AAC/E,yFAAyF;AACzF,0EAA0E;AAE1E;6DAC6D;AAC7D,SAAS,GAAG,CAAC,KAAiB;IAC7B,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACzB,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,CAAa,EAAE,CAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACd,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,IAAI,CAAC,KAAiB;IACrC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,MAAM,CAAC,IAAY;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/core/master-lock/policy.d.ts

@@ -1,33 +0,0 @@
-/**
- * The numbers — how long an unlock survives being ignored, and how hard it is to guess at.
- *
- * Pure functions with no clock and no I/O of their own, so every edge of the schedule is a
- * unit test rather than a wait. The engine in `../../server/master-lock/` supplies `now`.
- */
-/** The owner's default: *"default to 5 minutes if I haven't configured it"*. */
-export declare const DEFAULT_IDLE_MS: number;
-/** Short enough to be a real lock, long enough that typing a password is not the task. */
-export declare const MIN_IDLE_MS = 30000;
-/** A day. Past this the timer is not what is protecting anything — the manual lock is. */
-export declare const MAX_IDLE_MS: number;
-/** Clamp a submitted idle timeout into the usable band. A value that is not a finite
- *  number at all falls back to the default rather than to a bound: a corrupt record must
- *  not silently become "locks in 30 seconds" or "never locks". */
-export declare function clampIdleMs(value: unknown): number;
-/** Consecutive failures that cost nothing. */
-export declare const FREE_ATTEMPTS = 5;
-/** The first enforced wait once those are spent. Doubles thereafter. */
-export declare const BASE_DELAY_MS = 30000;
-/** The ceiling on that wait. */
-export declare const MAX_DELAY_MS: number;
-/**
- * How long must pass after `failures` consecutive failures before another attempt is
- * evaluated. `failures` includes the one that just happened.
- *
- *   ≤5 → 0 · 6 → 30s · 7 → 60s · 8 → 2m · … · ≥11 → 15m (capped)
- */
-export declare function delayAfter(failures: number): number;
-/** Milliseconds still to wait, given the failure count, when the last one happened, and
- *  now. `0` means "evaluate it". */
-export declare function windowRemaining(failures: number, lastFailureAt: number, now: number): number;
-//# sourceMappingURL=policy.d.ts.map

package/dist/core/master-lock/policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/core/master-lock/policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,gFAAgF;AAChF,eAAO,MAAM,eAAe,QAAa,CAAC;AAC1C,0FAA0F;AAC1F,eAAO,MAAM,WAAW,QAAS,CAAC;AAClC,0FAA0F;AAC1F,eAAO,MAAM,WAAW,QAAmB,CAAC;AAE5C;;kEAEkE;AAClE,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGlD;AAOD,8CAA8C;AAC9C,eAAO,MAAM,aAAa,IAAI,CAAC;AAC/B,wEAAwE;AACxE,eAAO,MAAM,aAAa,QAAS,CAAC;AACpC,gCAAgC;AAChC,eAAO,MAAM,YAAY,QAAc,CAAC;AAExC;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAMnD;AAED;oCACoC;AACpC,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAI5F"}

package/dist/core/master-lock/policy.js

@@ -1,53 +0,0 @@
-/**
- * The numbers — how long an unlock survives being ignored, and how hard it is to guess at.
- *
- * Pure functions with no clock and no I/O of their own, so every edge of the schedule is a
- * unit test rather than a wait. The engine in `../../server/master-lock/` supplies `now`.
- */
-/** The owner's default: *"default to 5 minutes if I haven't configured it"*. */
-export const DEFAULT_IDLE_MS = 5 * 60_000;
-/** Short enough to be a real lock, long enough that typing a password is not the task. */
-export const MIN_IDLE_MS = 30_000;
-/** A day. Past this the timer is not what is protecting anything — the manual lock is. */
-export const MAX_IDLE_MS = 24 * 60 * 60_000;
-/** Clamp a submitted idle timeout into the usable band. A value that is not a finite
- *  number at all falls back to the default rather than to a bound: a corrupt record must
- *  not silently become "locks in 30 seconds" or "never locks". */
-export function clampIdleMs(value) {
-    if (typeof value !== "number" || !Number.isFinite(value))
-        return DEFAULT_IDLE_MS;
-    return Math.min(MAX_IDLE_MS, Math.max(MIN_IDLE_MS, Math.round(value)));
-}
-// ── The guess throttle ──────────────────────────────────────────────────────
-// The same schedule `apps/vault`'s unlock guard implements, and for the same reason: the
-// owner mistypes, an attacker iterates. Never a lockout — the owner locking themselves out
-// of their own laptop is a worse outcome than a slow attacker.
-/** Consecutive failures that cost nothing. */
-export const FREE_ATTEMPTS = 5;
-/** The first enforced wait once those are spent. Doubles thereafter. */
-export const BASE_DELAY_MS = 30_000;
-/** The ceiling on that wait. */
-export const MAX_DELAY_MS = 15 * 60_000;
-/**
- * How long must pass after `failures` consecutive failures before another attempt is
- * evaluated. `failures` includes the one that just happened.
- *
- *   ≤5 → 0 · 6 → 30s · 7 → 60s · 8 → 2m · … · ≥11 → 15m (capped)
- */
-export function delayAfter(failures) {
-    if (failures <= FREE_ATTEMPTS)
-        return 0;
-    // Clamp the EXPONENT, not the product: a client that keeps hammering must not shift
-    // past a finite number into Infinity.
-    const exponent = Math.min(failures - FREE_ATTEMPTS - 1, 32);
-    return Math.min(BASE_DELAY_MS * 2 ** exponent, MAX_DELAY_MS);
-}
-/** Milliseconds still to wait, given the failure count, when the last one happened, and
- *  now. `0` means "evaluate it". */
-export function windowRemaining(failures, lastFailureAt, now) {
-    const delay = delayAfter(failures);
-    if (delay === 0)
-        return 0;
-    return Math.max(0, lastFailureAt + delay - now);
-}
-//# sourceMappingURL=policy.js.map

package/dist/core/master-lock/policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/core/master-lock/policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,MAAM,CAAC;AAC1C,0FAA0F;AAC1F,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;AAClC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE5C;;kEAEkE;AAClE,MAAM,UAAU,WAAW,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC;IACjF,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,+EAA+E;AAC/E,yFAAyF;AACzF,2FAA2F;AAC3F,+DAA+D;AAE/D,8CAA8C;AAC9C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC;AACpC,gCAAgC;AAChC,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AAExC;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,QAAgB;IAC1C,IAAI,QAAQ,IAAI,aAAa;QAAE,OAAO,CAAC,CAAC;IACxC,oFAAoF;IACpF,sCAAsC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,aAAa,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,CAAC,IAAI,QAAQ,EAAE,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED;oCACoC;AACpC,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,aAAqB,EAAE,GAAW;IACnF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC;AACjD,CAAC"}

package/dist/core/master-lock/presence.d.ts

@@ -1,53 +0,0 @@
-/**
- * "Somebody is still here" — evidence the idle watcher accepts that is not a keypress.
- *
- * ── The owner's ask (2026-08-25) ────────────────────────────────────────────
- * *"apps that lock like collections with a master password should not lock when I am
- * watching a video even if the timer runs out."*
- *
- * The idle watcher is deliberately built on INTERACTION rather than on traffic — see
- * `MasterLockProvider`'s module note, which is right and stays. Watching a film is the
- * one activity that produces no interaction at all and is nevertheless the most
- * attentive thing a person does with these apps. Ninety minutes of sitting still was
- * indistinguishable from ninety minutes of an empty room, and the empty room is what
- * the feature is for, so the wrong one won.
- *
- * ── 🔴 Why this is a predicate over ELEMENTS and not a flag an app sets ─────
- * A `watching` flag would need collections, flix, music, family and every future
- * player to remember to raise it, and to lower it on pause, on end, on unmount and on
- * a navigation — five chances each to leave the site permanently unlockable, which is
- * strictly worse than locking too eagerly. The DOM already knows: a `<video>` that is
- * playing is playing. Nothing to raise, nothing to lower, and a player that unmounts
- * takes its evidence with it.
- *
- * ── 🔴 Why a decorative loop is NOT presence ────────────────────────────────
- * The failure mode that would make this a security hole is an ambient background clip
- * — muted, looping, autoplaying, running forever with nobody in the building. That is
- * a recognisable signature (`muted` AND `loop`) and it is refused. A film the owner is
- * actually watching is not both at once; a muted film that loops is not something this
- * fleet renders. Where a component knows better than the heuristic, it says so:
- * `data-master-lock-presence="watch"` counts unconditionally, `"ignore"` never does.
- */
-/** The attribute a component uses to overrule the heuristic below. */
-export declare const PRESENCE_ATTRIBUTE = "data-master-lock-presence";
-/** The subset of `HTMLMediaElement` this needs — declared so the predicate is
- *  testable without a DOM and cannot drift into reading anything else. */
-export interface PresenceMedia {
-    paused: boolean;
-    ended: boolean;
-    muted: boolean;
-    loop: boolean;
-    /** Seconds. `0` for a stream that has not started, `NaN` before metadata. */
-    duration: number;
-    getAttribute(name: string): string | null;
-}
-/**
- * Is this one element evidence that a person is watching or listening right now?
- *
- * Order matters: the explicit attribute wins over everything, because a component that
- * says "ignore me" is describing itself better than any heuristic can.
- */
-export declare function isPresenceMedia(element: PresenceMedia): boolean;
-/** Is ANY of them? The whole question the idle watcher asks each tick. */
-export declare function isSomebodyWatching(elements: Iterable<PresenceMedia>): boolean;
-//# sourceMappingURL=presence.d.ts.map

package/dist/core/master-lock/presence.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"presence.d.ts","sourceRoot":"","sources":["../../../src/core/master-lock/presence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,8BAA8B,CAAC;AAE9D;0EAC0E;AAC1E,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CAC1C;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAU/D;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,OAAO,CAK7E"}

package/dist/core/master-lock/presence.js

@@ -1,62 +0,0 @@
-/**
- * "Somebody is still here" — evidence the idle watcher accepts that is not a keypress.
- *
- * ── The owner's ask (2026-08-25) ────────────────────────────────────────────
- * *"apps that lock like collections with a master password should not lock when I am
- * watching a video even if the timer runs out."*
- *
- * The idle watcher is deliberately built on INTERACTION rather than on traffic — see
- * `MasterLockProvider`'s module note, which is right and stays. Watching a film is the
- * one activity that produces no interaction at all and is nevertheless the most
- * attentive thing a person does with these apps. Ninety minutes of sitting still was
- * indistinguishable from ninety minutes of an empty room, and the empty room is what
- * the feature is for, so the wrong one won.
- *
- * ── 🔴 Why this is a predicate over ELEMENTS and not a flag an app sets ─────
- * A `watching` flag would need collections, flix, music, family and every future
- * player to remember to raise it, and to lower it on pause, on end, on unmount and on
- * a navigation — five chances each to leave the site permanently unlockable, which is
- * strictly worse than locking too eagerly. The DOM already knows: a `<video>` that is
- * playing is playing. Nothing to raise, nothing to lower, and a player that unmounts
- * takes its evidence with it.
- *
- * ── 🔴 Why a decorative loop is NOT presence ────────────────────────────────
- * The failure mode that would make this a security hole is an ambient background clip
- * — muted, looping, autoplaying, running forever with nobody in the building. That is
- * a recognisable signature (`muted` AND `loop`) and it is refused. A film the owner is
- * actually watching is not both at once; a muted film that loops is not something this
- * fleet renders. Where a component knows better than the heuristic, it says so:
- * `data-master-lock-presence="watch"` counts unconditionally, `"ignore"` never does.
- */
-/** The attribute a component uses to overrule the heuristic below. */
-export const PRESENCE_ATTRIBUTE = "data-master-lock-presence";
-/**
- * Is this one element evidence that a person is watching or listening right now?
- *
- * Order matters: the explicit attribute wins over everything, because a component that
- * says "ignore me" is describing itself better than any heuristic can.
- */
-export function isPresenceMedia(element) {
-    const declared = element.getAttribute(PRESENCE_ATTRIBUTE);
-    if (declared === "ignore")
-        return false;
-    if (element.paused || element.ended)
-        return false;
-    if (declared === "watch")
-        return true;
-    // The decorative-loop signature. See the module note.
-    if (element.muted && element.loop)
-        return false;
-    // A clip with no duration yet is a stream still negotiating, not a person watching.
-    // `Infinity` is a live stream, which counts.
-    return element.duration > 0;
-}
-/** Is ANY of them? The whole question the idle watcher asks each tick. */
-export function isSomebodyWatching(elements) {
-    for (const element of elements) {
-        if (isPresenceMedia(element))
-            return true;
-    }
-    return false;
-}
-//# sourceMappingURL=presence.js.map

package/dist/core/master-lock/presence.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"presence.js","sourceRoot":"","sources":["../../../src/core/master-lock/presence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAc9D;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAsB;IACrD,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC;IAC1D,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACtC,sDAAsD;IACtD,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAChD,oFAAoF;IACpF,6CAA6C;IAC7C,OAAO,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,QAAiC;IACnE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,eAAe,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC"}

package/dist/core/master-lock/wire.d.ts

@@ -1,140 +0,0 @@
-/**
- * The wire — paths and payloads shared by the lock page, the in-app controls and the server.
- *
- * One module both halves import, so a rename cannot make the browser talk to a route that
- * no longer exists.
- */
-import type { MasterLockKdfParams } from "./kdf";
-/**
- * The mount prefix. Everything under it is reachable while LOCKED (it is how you unlock);
- * everything else on the origin is not.
- *
- * `__` because a path a user could plausibly want must never collide with it: collections
- * routes on the hash, and the binary-server inspector owns `/api`, `/raw` and `/preview`.
- */
-export declare const MASTER_LOCK_PREFIX = "/__lock";
-export declare const MASTER_LOCK_PATHS: {
-    /** The lock page itself. Also what a locked HTML request is answered with, in place. */
-    readonly page: "/__lock/";
-    readonly style: "/__lock/lock.css";
-    readonly script: "/__lock/lock.js";
-    /** Readable while locked — it carries the KDF params the browser needs to derive. */
-    readonly status: "/__lock/status";
-    readonly unlock: "/__lock/unlock";
-    /** Slides the idle window. Sent on real INTERACTION only — see the engine. */
-    readonly ping: "/__lock/ping";
-    readonly lock: "/__lock/lock";
-    readonly change: "/__lock/change";
-    readonly settings: "/__lock/settings";
-    /**
-     * Set the FIRST master password for a principal that has none.
-     *
-     * Reachable while locked, like {@link MASTER_LOCK_PATHS.unlock}, and for the same
-     * reason: it is the only way in. It is refused outright unless the lock is
-     * `enrollable` AND has no record — so it can never overwrite a password, only
-     * create the one that was never set. Rotation is `change`, which demands the
-     * current one.
-     */
-    readonly enroll: "/__lock/enroll";
-};
-/**
- * The base name of the cookie the unlock token rides in. Callers want
- * {@link masterLockCookieName}, not this.
- *
- * 🔴 **A cookie is scoped by HOST, never by ORIGIN**, and this constant used to carry a
- * comment claiming the opposite — *"each app is its own origin, so unlocking one never
- * unlocks another … falls out of the browser's own rules"*. It does not. The browser
- * ignores the PORT when deciding which cookies to send, so two locked apps on `localhost`
- * share one jar and each unlock overwrites the other's token.
- *
- * Found 2026-09-11 by walking the feature in a browser, which is the only way it shows:
- * production is fine (collections and the inspector are different hostnames), but on the
- * Mac — where every app is `localhost:<port>` — opening the binary-server inspector left
- * `collections` holding a token its own server had never minted. Nothing is DISCLOSED by
- * that, because an app-wide lock reads the ambient `unlocked` state, so the site stayed
- * exactly as visible as it already was. What broke is every route that requires
- * `presents(req)`, and it broke SILENTLY:
- *
- *   · `POST /__lock/lock`     — "Lock this site" did nothing but reload an open page
- *   · `POST /__lock/settings` — the idle timeout could not be changed
- *   · `POST /__lock/change`   — the master password could not be rotated
- *   · `POST /__lock/ping`     — activity stopped sliding the idle clock
- *
- * i.e. three of the owner's clauses, on the machine his whole reason for asking is about.
- * The name is now per app, so the collision cannot happen on any host.
- */
-export declare const MASTER_LOCK_COOKIE = "master_lock";
-/**
- * The cookie name for ONE app — `master_lock` for an app that names no key, and
- * `master_lock_<key>` for one that does.
- *
- * The bare name is kept as the no-key answer so an app that has not been given a key
- * behaves exactly as it did, and so a single locked app on a host needs no migration.
- * `presentedTokens` reads every `master_lock*` cookie a request carries, so a browser
- * holding several presents them all and each app matches only its own live tokens —
- * which is the same constant-time comparison that already decided this.
- */
-export declare function masterLockCookieName(appKey?: string): string;
-/** Non-browser callers (a smoke, a curl) may present the token here instead. */
-export declare const MASTER_LOCK_HEADER = "x-master-lock";
-/** Set on every refusal this feature authors, so a client can tell "you are locked out"
- *  apart from every other 401 an app might answer with. */
-export declare const MASTER_LOCK_STATE_HEADER = "x-master-lock-state";
-/** What `GET /__lock/status` answers. Readable by anyone who got past the app's own auth,
- *  and it discloses nothing: a salt, an iteration count and a verdict.
- *
- *  @surface output — this DTO is PRODUCED by `MasterLock.status()` and only ever
- *  read by consumers (`res.json() as MasterLockStatus` in `MasterLockProvider`);
- *  nothing in the fleet constructs one. So adding a required field to it is
- *  additive, and without this annotation it is the residual false MAJOR that
- *  Phase −1's M-B measured and had no cheap fix for (F4). `release/surface.ts`
- *  records the annotation; `release/classify.ts` honours it. */
-export interface MasterLockStatus {
-    /** Is a master password set at all? False only on an app that was never seeded,
-     *  or — in per-person mode — for a person who has not chosen one yet. */
-    configured: boolean;
-    /**
-     * May the caller set a first master password right now (`POST /__lock/enroll`)?
-     *
-     * True only in per-person mode and only while `configured` is false. It is what
-     * lets the lock page show "choose your master password" instead of a box that
-     * nothing can open — the state a NEW person is in the first time they sign in.
-     *
-     * 🔴 Never true once a record exists, so it is not a road to overwriting one.
-     */
-    enrollable: boolean;
-    locked: boolean;
-    /** The params to derive under. `null` when unconfigured. */
-    kdf: MasterLockKdfParams | null;
-    /** The idle timeout in force, so the page can count down with the server. */
-    idleMs: number;
-    /** Milliseconds of idleness left before this session lapses; `0` when locked. */
-    remainingMs: number;
-    /** Milliseconds until another guess will be evaluated. `0` normally. */
-    retryAfterMs: number;
-}
-export interface MasterLockUnlockRequest {
-    verifier: string;
-}
-/** Choosing a first master password: fresh params, and the verifier under them. */
-export interface MasterLockEnrollRequest {
-    kdf: MasterLockKdfParams;
-    verifier: string;
-}
-export interface MasterLockChangeRequest {
-    /** Derived under the CURRENT params — proof that the person changing it is the person
-     *  who knows it, re-typed rather than inherited from the open session. */
-    currentVerifier: string;
-    /** The NEW params (a fresh salt) and the verifier derived under them. */
-    kdf: MasterLockKdfParams;
-    verifier: string;
-}
-export interface MasterLockSettingsRequest {
-    idleMs: number;
-}
-/** Why an unlock was refused. `wrong` and `throttled` are deliberately answered with the
- *  SAME status and shape on the wire; the distinction exists so the page can show a
- *  countdown, and it is only ever sent once the caller has already proved they are past
- *  the app's own auth. */
-export type MasterLockRefusal = "wrong" | "throttled" | "unconfigured" | "locked";
-//# sourceMappingURL=wire.d.ts.map

package/dist/core/master-lock/wire.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../../src/core/master-lock/wire.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,OAAO,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C,eAAO,MAAM,iBAAiB;IAC7B,wFAAwF;;;;IAIxF,qFAAqF;;;IAGrF,8EAA8E;;;;;IAK9E;;;;;;;;OAQG;;CAEM,CAAC;AAEX;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAM5D;AACD,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAClD;2DAC2D;AAC3D,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D;;;;;;;;gEAQgE;AAChE,MAAM,WAAW,gBAAgB;IAChC;6EACyE;IACzE,UAAU,EAAE,OAAO,CAAC;IACpB;;;;;;;;OAQG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,GAAG,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAChC,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,mFAAmF;AACnF,MAAM,WAAW,uBAAuB;IACvC,GAAG,EAAE,mBAAmB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACvC;8EAC0E;IAC1E,eAAe,EAAE,MAAM,CAAC;IACxB,yEAAyE;IACzE,GAAG,EAAE,mBAAmB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACzC,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;0BAG0B;AAC1B,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,WAAW,GAAG,cAAc,GAAG,QAAQ,CAAC"}