cursedbelt 2.8.0 → 3.0.0

package/dist/server/master-lock/guard.js

@@ -1,206 +0,0 @@
-/**
- * The guard — one decision function, so a Hono app and a bare `Bun.serve` handler cannot
- * end up enforcing two different rules.
- *
- * `handle(req)` answers a `Response` when it has taken responsibility for the request, and
- * `null` when the app should serve it as usual. That shape is what lets it be middleware in
- * one app and an early `return` in another without either of them re-deciding anything.
- *
- * 🔴 Registration order is the security property, exactly as it is for the SSO gate this
- * sits behind. Mount it so that it runs BEFORE any route that serves content, and AFTER
- * whatever proves the caller is allowed in the building at all — the master password is a
- * second wall, not a replacement for the first.
- */
-import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX, MASTER_LOCK_STATE_HEADER, masterLockCookieName, } from "../../core/master-lock";
-import { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage";
-const noStore = { "cache-control": "no-store, no-cache, must-revalidate", pragma: "no-cache" };
-/**
- * The lock page's own CSP. Strict enough to stand in front of `apps/vault`'s wall without
- * loosening it: nothing loads from anywhere but this origin, the form posts nowhere (the
- * script does the POST), and the page cannot be framed.
- */
-const LOCK_CSP = "default-src 'none'; style-src 'self'; script-src 'self'; connect-src 'self'; " +
-    "img-src data:; form-action 'none'; base-uri 'none'; frame-ancestors 'none'";
-export function createMasterLockGuard(options) {
-    const resolve = typeof options.lock === "function" ? options.lock : () => options.lock;
-    const isSecure = options.secure ?? defaultSecure;
-    const cookieName = masterLockCookieName(options.appKey ?? options.appLabel);
-    const cookie = (token, secure) => 
-    // No Max-Age: a SESSION cookie, so closing the browser drops it. The server-side
-    // idle clock is the real expiry — this only keeps the token out of a profile that
-    // somebody else might open tomorrow.
-    `${cookieName}=${token}; Path=/; HttpOnly; SameSite=Strict${secure ? "; Secure" : ""}`;
-    const clearCookie = (secure) => `${cookieName}=; Path=/; HttpOnly; SameSite=Strict; Max-Age=0${secure ? "; Secure" : ""}`;
-    /** The ONE refusal. Identical for wrong, throttled, unconfigured and not-unlocked. */
-    const refuse = (retryAfterMs = 0) => Response.json({ error: "locked", retryAfterMs }, { status: 401, headers: { ...noStore, [MASTER_LOCK_STATE_HEADER]: "locked" } });
-    /**
-     * 🔴 May THIS request through — and the difference between the two modes is the whole
-     * security property of the per-person wall.
-     *
-     * **App-wide**: `unlocked` is enough. The site has one user and one unlock; the token
-     * is how a caller with no cookie jar says "it's still me", not a per-browser
-     * credential. Reading the ambient state is the behaviour `apps/collections` and the
-     * binary-server inspector have always had.
-     *
-     * **Per-person**: the token is REQUIRED. `unlocked` there means only "somebody's
-     * device is open", and honouring that would make the unlock ambient — measured while
-     * building this (2026-08-25): with `unlocked ||` in front, one browser unlocking meant
-     * every OTHER browser signed in as that person walked straight through, having typed
-     * nothing. The owner's phone would ride his desk's unlock, and an invented
-     * `x-master-lock` value would be accepted because the check never looked at it. Two
-     * tests in `principals.spec.ts` fail on the `||`, which is why it is gone.
-     */
-    const opens = (lock, req) => lock.isEnrollable ? lock.presents(req) : lock.unlocked || lock.presents(req);
-    async function handleOwnRoute(req, url, lock) {
-        const path = url.pathname;
-        const secure = isSecure(url, req);
-        if (req.method === "GET" || req.method === "HEAD") {
-            if (path === MASTER_LOCK_PATHS.style) {
-                return new Response(LOCK_STYLE, {
-                    headers: { "content-type": "text/css; charset=utf-8", ...noStore },
-                });
-            }
-            if (path === MASTER_LOCK_PATHS.script) {
-                return new Response(LOCK_SCRIPT, {
-                    headers: { "content-type": "text/javascript; charset=utf-8", ...noStore },
-                });
-            }
-            if (path === MASTER_LOCK_PATHS.status) {
-                return Response.json(lock.status(), { headers: noStore });
-            }
-            if (path === MASTER_LOCK_PATHS.page || path === MASTER_LOCK_PREFIX) {
-                // Already open FOR THIS CALLER, so there is nothing to type — send them to
-                // the app rather than showing a password box that would do nothing. Per
-                // person this must be the caller's own state, not the site's: bouncing a
-                // locked-out phone to `/` because the desk is open is an infinite loop.
-                if (opens(lock, req))
-                    return Response.redirect(new URL("/", url), 303);
-                return lockPage(options, lock);
-            }
-            return new Response("not found", { status: 404, headers: noStore });
-        }
-        if (req.method !== "POST") {
-            return new Response("method not allowed", { status: 405, headers: noStore });
-        }
-        if (path === MASTER_LOCK_PATHS.enroll) {
-            const body = await readJson(req);
-            const result = await lock.enroll({
-                kdf: body?.kdf,
-                verifier: typeof body?.verifier === "string" ? body.verifier : "",
-            });
-            // Every refusal is the SAME refusal, as everywhere else here: "you may not
-            // enroll" and "somebody already did" must not be distinguishable, or the route
-            // becomes a way to ask whether a given account has a master password yet.
-            if (!result.ok)
-                return refuse();
-            return Response.json({ ok: true, idleMs: lock.idleMs }, { headers: { ...noStore, "set-cookie": cookie(result.token, secure) } });
-        }
-        if (path === MASTER_LOCK_PATHS.unlock) {
-            const body = await readJson(req);
-            const verifier = typeof body?.verifier === "string" ? body.verifier : "";
-            const result = await lock.unlock(verifier);
-            if (!result.ok)
-                return refuse(result.retryAfterMs);
-            return Response.json({ ok: true, idleMs: lock.idleMs }, { headers: { ...noStore, "set-cookie": cookie(result.token, secure) } });
-        }
-        // Everything below CHANGES something and therefore needs the site already open.
-        if (!lock.presents(req))
-            return refuse();
-        if (path === MASTER_LOCK_PATHS.ping) {
-            lock.touch(req);
-            return Response.json({ ok: true, remainingMs: lock.remainingMs }, { headers: noStore });
-        }
-        if (path === MASTER_LOCK_PATHS.lock) {
-            lock.lock();
-            return Response.json({ ok: true }, { headers: { ...noStore, "set-cookie": clearCookie(secure) } });
-        }
-        if (path === MASTER_LOCK_PATHS.settings) {
-            const body = await readJson(req);
-            const idleMs = lock.setIdleMs(Number(body?.idleMs));
-            return Response.json({ ok: true, idleMs }, { headers: noStore });
-        }
-        if (path === MASTER_LOCK_PATHS.change) {
-            const body = await readJson(req);
-            const result = await lock.change({
-                currentVerifier: typeof body?.currentVerifier === "string" ? body.currentVerifier : "",
-                kdf: body?.kdf,
-                verifier: typeof body?.verifier === "string" ? body.verifier : "",
-            });
-            if (!result.ok) {
-                return Response.json({ error: result.reason }, { status: 400, headers: noStore });
-            }
-            // The rotation locked the site; drop the cookie with it so the page it came from
-            // does not sit there holding a token that stopped meaning anything.
-            return Response.json({ ok: true }, { headers: { ...noStore, "set-cookie": clearCookie(secure) } });
-        }
-        return new Response("not found", { status: 404, headers: noStore });
-    }
-    return {
-        async handle(req) {
-            const url = new URL(req.url);
-            const own = url.pathname === MASTER_LOCK_PREFIX || url.pathname.startsWith(`${MASTER_LOCK_PREFIX}/`);
-            const lock = resolve(req);
-            if (!lock) {
-                // No principal. On the app's own paths the caller is not signed in and the
-                // app's sign-in owns the request; on `/__lock/*` there is nobody to unlock
-                // FOR, and answering the ordinary refusal keeps that indistinguishable from
-                // being locked.
-                return own ? refuse() : null;
-            }
-            if (own)
-                return handleOwnRoute(req, url, lock);
-            if (options.allow?.(url, req))
-                return null;
-            if (opens(lock, req))
-                return null;
-            // A document request is answered IN PLACE with the lock page — same URL, status
-            // 200 — so unlocking reloads to where they were going instead of dumping them at
-            // the root. Everything else gets the uniform refusal.
-            if (wantsDocument(req))
-                return lockPage(options, lock);
-            return refuse();
-        },
-    };
-}
-function lockPage(options, lock) {
-    return new Response(lockPageHtml({ ...options, enroll: lock.awaitingEnrollment }), {
-        status: 200,
-        headers: {
-            "content-type": "text/html; charset=utf-8",
-            "content-security-policy": LOCK_CSP,
-            "x-content-type-options": "nosniff",
-            [MASTER_LOCK_STATE_HEADER]: "locked",
-            ...noStore,
-        },
-    });
-}
-/** Is this the browser asking for a PAGE, as opposed to the app asking for data? */
-function wantsDocument(req) {
-    if (req.method !== "GET")
-        return false;
-    // `Sec-Fetch-Dest` is the browser's own answer and beats guessing from `Accept`; every
-    // engine this fleet runs on sends it. `Accept` is the fallback for curl and for a
-    // request that arrived through something that stripped it.
-    const dest = req.headers.get("sec-fetch-dest");
-    if (dest)
-        return dest === "document" || dest === "iframe";
-    return (req.headers.get("accept") ?? "").includes("text/html");
-}
-async function readJson(req) {
-    try {
-        const body = await req.json();
-        if (body === null || typeof body !== "object" || Array.isArray(body))
-            return null;
-        return body;
-    }
-    catch {
-        return null;
-    }
-}
-function defaultSecure(url, req) {
-    const forwarded = req.headers.get("x-forwarded-proto");
-    if (forwarded)
-        return forwarded.split(",")[0]?.trim() === "https";
-    return url.protocol === "https:";
-}
-//# sourceMappingURL=guard.js.map

package/dist/server/master-lock/guard.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../../../src/server/master-lock/guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACN,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,oBAAoB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAwB,YAAY,EAAE,MAAM,YAAY,CAAC;AAkDzF,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,qCAAqC,EAAE,MAAM,EAAE,UAAU,EAAW,CAAC;AAExG;;;;GAIG;AACH,MAAM,QAAQ,GACb,+EAA+E;IAC/E,4EAA4E,CAAC;AAO9E,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACpE,MAAM,OAAO,GACZ,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAkB,CAAC;IACtF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IACjD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE5E,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAe,EAAU,EAAE;IACzD,iFAAiF;IACjF,kFAAkF;IAClF,qCAAqC;IACrC,GAAG,UAAU,IAAI,KAAK,sCAAsC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxF,MAAM,WAAW,GAAG,CAAC,MAAe,EAAU,EAAE,CAC/C,GAAG,UAAU,kDAAkD,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAE3F,sFAAsF;IACtF,MAAM,MAAM,GAAG,CAAC,YAAY,GAAG,CAAC,EAAY,EAAE,CAC7C,QAAQ,CAAC,IAAI,CACZ,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,EACjC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,CAAC,wBAAwB,CAAC,EAAE,QAAQ,EAAE,EAAE,CAC9E,CAAC;IAEH;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,KAAK,GAAG,CAAC,IAAgB,EAAE,GAAY,EAAW,EAAE,CACzD,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE9E,KAAK,UAAU,cAAc,CAAC,GAAY,EAAE,GAAQ,EAAE,IAAgB;QACrE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAElC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YACnD,IAAI,IAAI,KAAK,iBAAiB,CAAC,KAAK,EAAE,CAAC;gBACtC,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE;oBAC/B,OAAO,EAAE,EAAE,cAAc,EAAE,yBAAyB,EAAE,GAAG,OAAO,EAAE;iBAClE,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE;oBAChC,OAAO,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,GAAG,OAAO,EAAE;iBACzE,CAAC,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;gBACvC,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,IAAI,IAAI,KAAK,iBAAiB,CAAC,IAAI,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACpE,2EAA2E;gBAC3E,wEAAwE;gBACxE,yEAAyE;gBACzE,wEAAwE;gBACxE,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;oBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;gBACvE,OAAO,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChC,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC3B,OAAO,IAAI,QAAQ,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,IAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;gBAChC,GAAG,EAAE,IAAI,EAAE,GAAY;gBACvB,QAAQ,EAAE,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;aACjE,CAAC,CAAC;YACH,2EAA2E;YAC3E,+EAA+E;YAC/E,0EAA0E;YAC1E,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACjC,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CACvE,CAAC;QACH,CAAC;QAED,IAAI,IAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACnD,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EACjC,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,EAAE,CACvE,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,EAAE,CAAC;QAEzC,IAAI,IAAI,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,EAAE,EAAE,IAAI,EAAE,EACZ,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,CAC9D,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,CAAC,QAAQ,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACpD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;gBAChC,eAAe,EAAE,OAAO,IAAI,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;gBACtF,GAAG,EAAE,IAAI,EAAE,GAAY;gBACvB,QAAQ,EAAE,OAAO,IAAI,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;aACjE,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBAChB,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,iFAAiF;YACjF,oEAAoE;YACpE,OAAO,QAAQ,CAAC,IAAI,CACnB,EAAE,EAAE,EAAE,IAAI,EAAE,EACZ,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,CAC9D,CAAC;QACH,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,OAAO;QACN,KAAK,CAAC,MAAM,CAAC,GAAY;YACxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,GAAG,GACR,GAAG,CAAC,QAAQ,KAAK,kBAAkB,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,kBAAkB,GAAG,CAAC,CAAC;YAC1F,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,2EAA2E;gBAC3E,4EAA4E;gBAC5E,gBAAgB;gBAChB,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9B,CAAC;YACD,IAAI,GAAG;gBAAE,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3C,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAElC,gFAAgF;YAChF,iFAAiF;YACjF,sDAAsD;YACtD,IAAI,aAAa,CAAC,GAAG,CAAC;gBAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACvD,OAAO,MAAM,EAAE,CAAC;QACjB,CAAC;KACD,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAwB,EAAE,IAAgB;IAC3D,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,EAAE;QAClF,MAAM,EAAE,GAAG;QACX,OAAO,EAAE;YACR,cAAc,EAAE,0BAA0B;YAC1C,yBAAyB,EAAE,QAAQ;YACnC,wBAAwB,EAAE,SAAS;YACnC,CAAC,wBAAwB,CAAC,EAAE,QAAQ;YACpC,GAAG,OAAO;SACV;KACD,CAAC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CAAC,GAAY;IAClC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACvC,uFAAuF;IACvF,kFAAkF;IAClF,2DAA2D;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC/C,IAAI,IAAI;QAAE,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAY;IACnC,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAClF,OAAO,IAA+B,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,GAAQ,EAAE,GAAY;IAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvD,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,OAAO,CAAC;IAClE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;AAClC,CAAC"}

package/dist/server/master-lock/index.d.ts

@@ -1,22 +0,0 @@
-/**
- * `cursedbelt/server/master-lock` — the server half of the sitewide master-password lock.
- *
- * What the feature is, what it deliberately is NOT, and the four decisions behind it are in
- * `masterLock.ts`'s module note. Read that first.
- *
- * Adopting it in an app is three things:
- *   1. a {@link MasterLock} built over whatever key/value the app already has,
- *   2. `createMasterLockGuard(...).handle(req)` in front of everything the app serves,
- *   3. `cursedbelt/react/master-lock` in the header, for the manual lock and the rotation.
- *
- * Removing it is deleting those three. That is the shape the owner asked for: *"the reusable
- * functionality for this should be in a place that makes it easy to share to add or remove
- * from apps in the code, such as cb."*
- */
-export { type MasterLockGuard, type MasterLockGuardOptions, createMasterLockGuard } from "./guard";
-export { LOCK_SCRIPT, LOCK_STYLE, type LockPageOptions, lockPageHtml } from "./lockPage";
-export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, type MasterLockDirectoryOptions, masterLockPrincipalKey, } from "./principals";
-export { MasterLock, type MasterLockEnrollResult, type MasterLockOptions, type MasterLockRecord, type MasterLockStore, type MasterLockUnlockResult, readRecord, } from "./masterLock";
-export { DEFAULT_SEED_IDLE_MS, generateStagePassword, type MintMasterLockSeedOptions, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed";
-export { MASTER_LOCK_SETTING_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store";
-//# sourceMappingURL=index.d.ts.map

package/dist/server/master-lock/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/master-lock/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,KAAK,eAAe,EAAE,KAAK,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,eAAe,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EACN,gCAAgC,EAChC,mBAAmB,EACnB,KAAK,0BAA0B,EAC/B,sBAAsB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,UAAU,EACV,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,UAAU,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,yBAAyB,EAC9B,kBAAkB,EAClB,uBAAuB,GACvB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACN,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,SAAS,CAAC"}

package/dist/server/master-lock/index.js

@@ -1,22 +0,0 @@
-/**
- * `cursedbelt/server/master-lock` — the server half of the sitewide master-password lock.
- *
- * What the feature is, what it deliberately is NOT, and the four decisions behind it are in
- * `masterLock.ts`'s module note. Read that first.
- *
- * Adopting it in an app is three things:
- *   1. a {@link MasterLock} built over whatever key/value the app already has,
- *   2. `createMasterLockGuard(...).handle(req)` in front of everything the app serves,
- *   3. `cursedbelt/react/master-lock` in the header, for the manual lock and the rotation.
- *
- * Removing it is deleting those three. That is the shape the owner asked for: *"the reusable
- * functionality for this should be in a place that makes it easy to share to add or remove
- * from apps in the code, such as cb."*
- */
-export { createMasterLockGuard } from "./guard";
-export { LOCK_SCRIPT, LOCK_STYLE, lockPageHtml } from "./lockPage";
-export { MASTER_LOCK_PRINCIPAL_KEY_PREFIX, MasterLockDirectory, masterLockPrincipalKey, } from "./principals";
-export { MasterLock, readRecord, } from "./masterLock";
-export { DEFAULT_SEED_IDLE_MS, generateStagePassword, mintMasterLockSeed, serializeMasterLockSeed, } from "./seed";
-export { MASTER_LOCK_SETTING_KEY, createKvMasterLockStore, createMemoryMasterLockStore, } from "./store";
-//# sourceMappingURL=index.js.map

package/dist/server/master-lock/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/server/master-lock/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAqD,qBAAqB,EAAE,MAAM,SAAS,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,UAAU,EAAwB,YAAY,EAAE,MAAM,YAAY,CAAC;AACzF,OAAO,EACN,gCAAgC,EAChC,mBAAmB,EAEnB,sBAAsB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,UAAU,EAMV,UAAU,GACV,MAAM,cAAc,CAAC;AACtB,OAAO,EACN,oBAAoB,EACpB,qBAAqB,EAErB,kBAAkB,EAClB,uBAAuB,GACvB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACN,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,SAAS,CAAC"}

package/dist/server/master-lock/lockPage.d.ts

@@ -1,35 +0,0 @@
-/** Everything the page needs to know about the app it is standing in front of. */
-export interface LockPageOptions {
-    /** What to call this app — "Collections", "binary-server inspector". */
-    appLabel: string;
-    /** Shown under the title. Defaults to the sentence that explains the second wall. */
-    note?: string;
-    /**
-     * Render the CHOOSE-a-password form rather than the type-it form.
-     *
-     * Set by the guard from `lock.awaitingEnrollment`, i.e. per-person mode with no record
-     * for this account yet. It is a rendering hint and nothing more — the server refuses
-     * `POST /__lock/enroll` on its own record's state, so a page asking to enroll cannot
-     * make enrollment legal.
-     */
-    enroll?: boolean;
-}
-/**
- * The document. Deliberately says the app's NAME and nothing else about it — whoever is
- * looking already reached the origin, so the hostname told them that much, and a page that
- * would not say which app it is cannot tell the owner which password to type.
- */
-export declare function lockPageHtml(options: LockPageOptions): string;
-/** The stylesheet. Follows the viewer's theme and commits to nothing else. */
-export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n";
-/**
- * The page's script.
- *
- * Derives in the browser and sends only the verifier — the password itself never crosses
- * the network, which is what makes "saved nowhere" true rather than aspirational.
- *
- * 600,000 PBKDF2 rounds take a beat on a phone, so the button says so; a page that looks
- * frozen gets clicked again, and every extra click is another 600k rounds.
- */
-export declare const LOCK_SCRIPT: string;
-//# sourceMappingURL=lockPage.d.ts.map

package/dist/server/master-lock/lockPage.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"lockPage.d.ts","sourceRoot":"","sources":["../../../src/server/master-lock/lockPage.ts"],"names":[],"mappings":"AAwBA,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC/B,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;CACjB;AASD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,CAqD7D;AAED,8EAA8E;AAC9E,eAAO,MAAM,UAAU,21DA2BtB,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,QAqKvB,CAAC"}

package/dist/server/master-lock/lockPage.js

@@ -1,282 +0,0 @@
-/**
- * The lock page — the ONLY thing a locked app serves.
- *
- * ── Why it is authored here as strings ──────────────────────────────────────
- * It has to render before any of the app exists: no bundle, no framework, no design system,
- * no fonts, nothing fetched from anywhere. That is the requirement — *"a user logged in as
- * me cannot see anything about the site, not even text or images, nothing at all"* — and the
- * honest way to meet it is for the locked response to have nothing of the app in it.
- *
- * ── Why the CSS and JS are separate routes, not inline ──────────────────────
- * `apps/vault`'s CSP wall forbids inline script, and any app adopting this lock deserves to
- * keep a wall that strict. Two same-origin files cost one round trip each and let the page
- * ship under `script-src 'self'` with no nonce plumbing.
- *
- * ── 🔴 The derivation in `LOCK_SCRIPT` is a HAND COPY of `deriveMasterLockVerifier` ──────
- * It cannot import it: this file is served to a browser as plain text, outside every build.
- * A copy that drifts derives a verifier that can never match, and the symptom would be "my
- * correct password is refused" — the same shape of bug that cost `apps/collections` a day.
- * So `lockPage.spec.ts` EVALUATES the script's function out of this source and asserts it
- * agrees with the TypeScript one on a fixed vector. Change one, the spec fails until you
- * change the other.
- */
-import { MASTER_LOCK_PATHS } from "../../core/master-lock";
-const escapeHtml = (value) => value.replace(/[&<>"']/g, (ch) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[ch] ?? ch);
-/**
- * The document. Deliberately says the app's NAME and nothing else about it — whoever is
- * looking already reached the origin, so the hostname told them that much, and a page that
- * would not say which app it is cannot tell the owner which password to type.
- */
-export function lockPageHtml(options) {
-    const label = escapeHtml(options.appLabel);
-    const enroll = options.enroll === true;
-    const note = escapeHtml(options.note ??
-        (enroll
-            ? "You are signed in, but this site needs a master password of your own. " +
-                "Choose one now. Nobody else can see it and nobody else can reset it — " +
-                "if you forget it, it cannot be recovered."
-            : "This site is locked. Signing in is not enough — enter the master password to continue."));
-    return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="robots" content="noindex, nofollow">
-<title>Locked · ${label}</title>
-<link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🔒</text></svg>">
-<link rel="stylesheet" href="${MASTER_LOCK_PATHS.style}">
-</head>
-<body data-mode="${enroll ? "enroll" : "unlock"}">
-<main class="card" aria-labelledby="ml-title">
-  <div class="glyph" aria-hidden="true">${enroll ? "🔑" : "🔒"}</div>
-  <h1 id="ml-title">${label}</h1>
-  <p class="note">${note}</p>
-  <form id="ml-form" autocomplete="off">
-    <label class="field">
-      <span>${enroll ? "New master password" : "Master password"}</span>
-      <input id="ml-input" type="password" name="master-password"
-             autocomplete="${enroll ? "new-password" : "current-password"}"
-             autofocus required spellcheck="false" enterkeyhint="${enroll ? "next" : "go"}"${enroll ? ' minlength="10"' : ""}>
-    </label>${enroll
-        ? `
-    <label class="field">
-      <span>Confirm master password</span>
-      <input id="ml-confirm" type="password" name="confirm-master-password"
-             autocomplete="new-password" required spellcheck="false" enterkeyhint="go"
-             minlength="10">
-    </label>`
-        : ""}
-    <button id="ml-submit" type="submit">${enroll ? "Set master password" : "Unlock"}</button>
-  </form>
-  <p id="ml-status" class="status" role="status" aria-live="polite"></p>
-</main>
-<script type="module" src="${MASTER_LOCK_PATHS.script}"></script>
-</body>
-</html>
-`;
-}
-/** The stylesheet. Follows the viewer's theme and commits to nothing else. */
-export const LOCK_STYLE = `:root{color-scheme:light dark;
-  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;
-  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;
-  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}
-@media (prefers-color-scheme:dark){:root{
-  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;
-  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;
-  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}
-*{box-sizing:border-box}
-body{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;
-  background:var(--ml-bg);color:var(--ml-text);
-  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif}
-.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);
-  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}
-.glyph{font-size:30px;line-height:1;margin-bottom:10px}
-h1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}
-.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}
-.field{display:block;text-align:left;margin-bottom:14px}
-.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}
-input{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;
-  background:var(--ml-bg);color:inherit;font:inherit}
-input:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}
-button{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);
-  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}
-button[disabled]{opacity:.6;cursor:progress}
-.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}
-.status[data-tone="error"]{color:var(--ml-danger)}
-`;
-/**
- * The page's script.
- *
- * Derives in the browser and sends only the verifier — the password itself never crosses
- * the network, which is what makes "saved nowhere" true rather than aspirational.
- *
- * 600,000 PBKDF2 rounds take a beat on a phone, so the button says so; a page that looks
- * frozen gets clicked again, and every extra click is another 600k rounds.
- */
-export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
-
-const form = document.getElementById("ml-form");
-const input = document.getElementById("ml-input");
-const confirmInput = document.getElementById("ml-confirm");
-const submit = document.getElementById("ml-submit");
-const status = document.getElementById("ml-status");
-
-function say(message, tone) {
-  status.textContent = message;
-  if (tone) status.setAttribute("data-tone", tone);
-  else status.removeAttribute("data-tone");
-}
-
-// ── derivation ───────────────────────────────────────────────────────────────
-// 🔴 Byte-identical to deriveMasterLockVerifier in cursedbelt/master-lock. Pinned by
-// lockPage.spec.ts, which evaluates THIS function and compares. Do not "tidy" it apart.
-function unb64u(text) {
-  const padded = text.replace(/-/g, "+").replace(/_/g, "/");
-  const binary = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
-  const out = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
-  return out;
-}
-function b64u(bytes) {
-  let binary = "";
-  for (const byte of bytes) binary += String.fromCharCode(byte);
-  return btoa(binary).replace(/\\+/g, "-").replace(/\\//g, "_").replace(/=+$/, "");
-}
-async function pbkdf2(material, salt, iterations) {
-  const key = await crypto.subtle.importKey("raw", material, "PBKDF2", false, ["deriveBits"]);
-  const bits = await crypto.subtle.deriveBits(
-    { name: "PBKDF2", salt: salt, iterations: iterations, hash: "SHA-256" }, key, 256);
-  return new Uint8Array(bits);
-}
-async function deriveVerifier(password, kdf) {
-  const salt = unb64u(kdf.salt);
-  const bytes = new TextEncoder().encode(password);
-  const kek = await pbkdf2(bytes, salt, kdf.iter);
-  const joined = new Uint8Array(kek.length + bytes.length);
-  joined.set(kek, 0);
-  joined.set(bytes, kek.length);
-  return b64u(await pbkdf2(joined, salt, 1));
-}
-globalThis.__masterLockDerive = deriveVerifier;
-
-// ── the page ─────────────────────────────────────────────────────────────────
-// 🔴 Everything below this line touches \`document\` beyond \`getElementById\`, and
-// lockPage.spec.ts cuts the source at the marker above to evaluate the derivation with a
-// stub. Keep page state here, not in the prelude, or that test throws instead of running.
-//
-// Rendered by the server from THIS principal's own record. The server re-decides it on
-// every POST, so this only chooses which form to submit — it cannot grant anything.
-const enrolling = document.body.dataset.mode === "enroll";
-
-/** The shortest password worth calling one. Matched by the input's own minlength, and
- *  checked here too because a pasted value can beat the constraint on some engines. */
-const MIN_LENGTH = 10;
-
-let kdf = null;
-let busy = false;
-
-async function loadStatus() {
-  try {
-    const res = await fetch(paths.status, { credentials: "same-origin" });
-    if (!res.ok) return;
-    const body = await res.json();
-    kdf = body.kdf;
-    if (body.enrollable) { /* the choose-a-password form is already rendered */ }
-    else if (!body.configured) say("No master password is set for this app.", "error");
-    else if (body.retryAfterMs > 0) countdown(body.retryAfterMs);
-    else if (!body.locked) location.reload();
-  } catch { /* offline: the submit below reports it */ }
-}
-
-let timer = null;
-function countdown(ms) {
-  if (timer) clearInterval(timer);
-  let left = Math.ceil(ms / 1000);
-  const tick = () => {
-    if (left <= 0) { clearInterval(timer); timer = null; say(""); submit.disabled = false; return; }
-    say("Too many attempts. Try again in " + left + "s.", "error");
-    left -= 1;
-  };
-  submit.disabled = true;
-  tick();
-  timer = setInterval(tick, 1000);
-}
-
-/** Fresh params for a password nobody has chosen before. Byte-identical to
- *  newMasterLockKdfParams — pinned by lockPage.spec.ts alongside the derivation. */
-function newKdf() {
-  const salt = new Uint8Array(16);
-  crypto.getRandomValues(salt);
-  return { v: 1, alg: "PBKDF2-SHA256", iter: 600000, salt: b64u(salt) };
-}
-
-async function doEnroll(password) {
-  const params = newKdf();
-  const verifier = await deriveVerifier(password, params);
-  const res = await fetch(paths.enroll, {
-    method: "POST",
-    credentials: "same-origin",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ kdf: params, verifier: verifier }),
-  });
-  if (res.ok) { say("Master password set."); location.reload(); return true; }
-  // The server collapses every enrollment refusal into one, so this cannot say more
-  // than "reload and see" without inventing a distinction the server refused to draw.
-  say("This site could not accept that right now. Reload and try again.", "error");
-  return false;
-}
-
-async function doUnlock(password) {
-  const verifier = await deriveVerifier(password, kdf);
-  const res = await fetch(paths.unlock, {
-    method: "POST",
-    credentials: "same-origin",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ verifier: verifier }),
-  });
-  if (res.ok) { say("Unlocked."); location.reload(); return true; }
-  const body = await res.json().catch(() => ({}));
-  input.value = "";
-  input.focus();
-  if (body && body.retryAfterMs > 0) { countdown(body.retryAfterMs); return false; }
-  say("That is not the master password.", "error");
-  return false;
-}
-
-form.addEventListener("submit", async (event) => {
-  event.preventDefault();
-  if (busy || submit.disabled) return;
-  const password = input.value;
-  if (!password) return;
-  if (enrolling) {
-    if (password.length < MIN_LENGTH) {
-      say("Use at least " + MIN_LENGTH + " characters.", "error");
-      return;
-    }
-    if (confirmInput && confirmInput.value !== password) {
-      say("Those two do not match.", "error");
-      confirmInput.value = "";
-      confirmInput.focus();
-      return;
-    }
-  } else if (!kdf) {
-    await loadStatus();
-    if (!kdf) { say("Cannot reach this site right now.", "error"); return; }
-  }
-  busy = true;
-  submit.disabled = true;
-  say(enrolling ? "Setting…" : "Checking…");
-  try {
-    const done = enrolling ? await doEnroll(password) : await doUnlock(password);
-    if (!done) submit.disabled = false;
-  } catch {
-    say("Cannot reach this site right now.", "error");
-    submit.disabled = false;
-  } finally {
-    busy = false;
-  }
-});
-
-loadStatus();
-`;
-//# sourceMappingURL=lockPage.js.map

package/dist/server/master-lock/lockPage.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lockPage.js","sourceRoot":"","sources":["../../../src/server/master-lock/lockPage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAmB3D,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAC5C,KAAK,CAAC,OAAO,CACZ,UAAU,EACV,CAAC,EAAE,EAAE,EAAE,CACN,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CACpF,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAwB;IACpD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,UAAU,CACtB,OAAO,CAAC,IAAI;QACX,CAAC,MAAM;YACN,CAAC,CAAC,wEAAwE;gBACzE,wEAAwE;gBACxE,2CAA2C;YAC5C,CAAC,CAAC,wFAAwF,CAAC,CAC7F,CAAC;IACF,OAAO;;;;;;kBAMU,KAAK;;+BAEQ,iBAAiB,CAAC,KAAK;;mBAEnC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;;0CAEL,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;sBACxC,KAAK;oBACP,IAAI;;;cAGV,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB;;6BAEnC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kBAAkB;mEACN,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAC1E,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAC/B;cAEP,MAAM;QACJ,CAAC,CAAC;;;;;;aAMG;QACL,CAAC,CAAC,EACN;2CACuC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,QAAQ;;;;6BAIvD,iBAAiB,CAAC,MAAM;;;CAGpD,CAAC;AACF,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BzB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqK5E,CAAC"}