selfstore 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Florian Mousseau
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,364 @@
+# selfstore
+
+**Local-first storage for browser apps, batteries included.** Your data lives
+on the user's device, syncs across their devices without a server, and leaves
+as a portable encrypted backup they actually own.
+
+```ts
+import { selfstore } from 'selfstore';
+
+const store = await selfstore('todo-app');
+
+await store.put('todos', { id: 't1', text: 'ship it' });
+store.all('todos');            // [{ id: 't1', text: 'ship it' }]
+store.onChange(render);        // local writes AND merges from other devices
+```
+
+That is a working app: saving to IndexedDB, debounced auto-save on every
+mutation, and the browser sync moments (tab focus, network return, tab hide,
+a slow interval) are already wired. No schema ceremony, no server, nothing to
+host.
+
+Docs, guides, a live demo and honest comparisons with the alternatives:
+**[selfstore.dev](https://selfstore.dev)**.
+
+## Going further is one call each
+
+```ts
+// Multi-device sync: connect a destination the USER owns.
+await store.connectDrive(gisDriveAuth({ clientId }));  // Google Drive
+await store.connectFile();                             // a file on disk (Chromium)
+await store.connectWebdav({ url, username, password: appPassword }); // Nextcloud & friends
+
+// End-to-end encryption of everything that leaves the device.
+await store.protect('a passphrase the user chose');
+
+// A portable encrypted .zip the user can walk away with.
+await store.downloadBackup();
+```
+
+`connectDrive` / `connectFile` / `connectWebdav` all resolve to what actually
+happened: `'merged'` (the destination already held data; both sides were
+folded together, nothing lost), `'started'` (it was empty; this device's data
+now lives there), `'cancelled'` (the user closed the picker), or `'manual'`
+(no File System Access; offer `downloadBackup()` instead). If the destination
+holds an encrypted backup and no password was given, the call throws
+`PASSWORD_REQUIRED` BEFORE touching anything, so you can prompt and retry.
+
+## The one rule
+
+Records need a non-empty **string `id`**: it is what the multi-device merge
+keys on. `put()` enforces it immediately with a clear error instead of letting
+the record silently never sync. A different field name is one option away:
+
+```ts
+const store = await selfstore('crm', { sync: { ids: { contacts: 'uuid' } } });
+```
+
+Everything else about your records is your business: plain JSON in, plain JSON
+out, no proxies, no injected fields, no ORM to fight.
+
+## Status and errors are headless
+
+The store never ships UI copy. It exposes a status descriptor
+(`store.status`: `severity`, optional `action`, a stable `labelKey` like
+`status.synced`) and typed errors (`store.error`: `{ code, labelKey }`, keys
+like `error.authExpired`). You map the keys to your own wording and language;
+the raw English `message` is for logs only.
+
+```ts
+store.subscribe(() => statusBar.textContent = t(store.status.labelKey));
+```
+
+Transient trouble (offline, a cold-started backend, a 5xx) never raises a
+scary reconnect dialog: the edit stays safe in the local cache and the next
+save or sync retries. Only a GENUINE loss of access (token revoked, permission
+withdrawn) surfaces as `AUTH_EXPIRED` with a `reconnect` action.
+
+| Code | Meaning |
+|---|---|
+| `BAD_FORMAT` | Not a backup file, or corrupt framing. |
+| `UNSUPPORTED_VERSION` | Written by a newer format generation, cipher or KDF. |
+| `PASSWORD_REQUIRED` | Encrypted backup opened without a password. |
+| `DECRYPT_FAILED` | Wrong password, or tampered/corrupt ciphertext. |
+| `TOO_LARGE` | An archive entry exceeds the zip-bomb guard (512 MiB). |
+| `AUTH_EXPIRED` | Access to the destination genuinely lost; a user gesture reconnects. |
+| `TARGET_UNAVAILABLE` | Transient: offline, cold start, 5xx. Retried automatically. |
+| `TARGET_WRITE_FAILED` | The destination refused or failed the write (non-auth). |
+| `NOT_CONNECTED` | The target has no connected destination. |
+| `ENCRYPTION_REQUIRED` | `requireEncryption` is set: a plaintext attach, backup or export is refused. |
+| `WEAK_PASSWORD` | The password fails the store's `passwordPolicy`. |
+| `UNEXPECTEDLY_UNENCRYPTED` | Downgrade guard: expected encrypted, found plaintext. |
+| `SCHEMA_TOO_NEW` | Data written by a newer app schema; update the app to sync. |
+
+Branch on `err.code`, never parse messages. New codes may be ADDED in a minor
+release, so keep a `default` branch in exhaustive switches.
+
+## Backup files, on their own
+
+The backup is a real ZIP, specified independently of this library
+([SPEC.md](./SPEC.md), with a ~120-line Python reference reader and canonical
+test vectors): unencrypted it opens in any archive tool; encrypted it is still
+a valid ZIP holding the AES-256-GCM ciphertext, the cleartext parameters and a
+readme - never a mystery blob. Working with backup FILES needs no store:
+
+```ts
+import { backup, restore, changePassword } from 'selfstore';
+
+// Write: fluent and STAGED - an illegal order does not compile.
+const blob = await backup({ collections: { notes }, files: [] })
+  .as('my-app', '1.2.0')
+  .encryptedWith(password)  // omit for a plain, browsable ZIP
+  .withReadme('Import this file into MyApp with your password.')
+  .toBlob();                // or .toBytes(), or .toDisk('my-backup.zip')
+
+// Read
+const meta = await restore(file).meta();          // cleartext, no password needed
+if (await restore(file).isEncrypted()) { /* ask the user */ }
+const snap = await restore(file).withPassword(password).read();
+
+// Rotate, add or remove the password
+const rekeyed = await changePassword(blob, { from: 'old', to: 'new' });
+```
+
+## When you need more: the deeper layers
+
+The package root stays small on purpose. The machinery underneath is public
+too, as subpaths of the same install:
+
+| Import | What it is | Reach for it when |
+|---|---|---|
+| `selfstore` | the simple store + backup files | almost always: start here |
+| `selfstore/flows` | the user journeys (connect a destination, share panel, join an invitation) as headless, tested state machines | you are building the connect/share/join UI and want the ordering and failure rules - one popup per gesture, password proven before attach, merge by default - already right |
+| `selfstore/widgets` | the same journeys as drop-in web components (`<selfstore-connect>`, `<selfstore-share>`, `<selfstore-join>`) - framework-free, themable via CSS custom properties and `::part()`, reworded/localized via a `labels` map | you want the screens ready-made and your app's look on top |
+| `selfstore/advanced` | the pull-model store (`createLocalStore`), custom `BackupTarget`s, caches, headless status derivation, functional codec | your state lives in its own reactive model (Svelte runes, Redux), or you are writing a destination (S3, your KV...) |
+| `selfstore/groups` | passwordless group encryption: per-member identities, sealed envelopes, signed membership manifests | several PEOPLE share one encrypted store without a shared password ([PEERS.md](./PEERS.md)) |
+| `selfstore/sync` | the bare merge engine (HLC + per-collection strategies, no CRDT runtime) | you only want the algorithm inside your own persistence ([SYNC docs in SPEC.md](./SPEC.md)) |
+
+`store.advanced` on the simple store IS the `selfstore/advanced` store - same
+instance - so the two styles compose instead of competing: start simple, reach
+down for one advanced call (`attachPeer`, `setGroup`, a custom target), keep
+the rest.
+
+```ts
+import { createLocalStore, indexedDbCache } from 'selfstore/advanced';
+
+const store = createLocalStore({
+  app: 'my-app',
+  schemaVersion: 1,
+  gather: () => state.toSnapshot(),   // YOUR app owns the data
+  apply: (snap) => state.load(snap),
+  cache: indexedDbCache('my-app')
+});
+await store.init();
+onEveryChange(store.schedule);
+```
+
+## Local-first, demonstrably
+
+selfstore exists so an app can *prove* its local-first claims instead of
+asserting them:
+
+- **No server anywhere in the loop.** Save, backup, restore and merge all run
+  in the browser. There is nothing to host and nothing that sees the data.
+- **The user owns a real file.** See "Backup files" above: a genuine,
+  documented ZIP, readable by anything that follows the spec.
+- **Encrypted the moment it leaves the device.** Cleartext at rest locally (so
+  you keep queries and DevTools), end-to-end encrypted as soon as it goes to a
+  file or the cloud: AES-256-GCM over an Argon2id-derived key, parameters
+  stored per file so old backups keep decrypting when defaults improve.
+- **Offline is the normal case, not a fallback.** The working copy is
+  IndexedDB; durable homes and merges catch up whenever the device is back
+  online.
+- **Leaving is easy.** The format is stable across generations; a file written
+  years ago by another app still reads.
+
+## Multi-device merge, no CRDT runtime
+
+A Hybrid Logical Clock plus pluggable per-collection strategies converge two
+replicas deterministically, while your objects stay plain JSON. The default -
+records keyed by `id`, later edit per record wins, deletes propagate as
+tombstones - fits most apps; `sync: { strategies }` tunes it per collection:
+
+| Strategy | Semantics |
+|---|---|
+| `lww-set` | records keyed by id; later write per id wins; deletes tombstoned |
+| `lww-map` | field-by-field merge: concurrent edits to different fields both survive; same field goes to the later clock; deletes stay record-level |
+| `grow-set` | append-only, entries immutable per id; union, never a conflict |
+| `lww-register` | a single value; later write wins |
+| `manual` | surface concurrent same-id edits (via `MergeResult.conflicts`) instead of resolving |
+
+**Guarantees (seeded-fuzz tested):** every two-way merge is symmetric and
+idempotent; `lww-set` and `grow-set` (used within their contracts) are also
+order-independent across replicas. **Honest limits:** LWW resolves a
+concurrent same-record (or same-field) edit by KEEPING THE LATER CLOCK - the
+losing value is surfaced in the sync journal's conflicts, not merged. In
+`lww-map`, a record deleted on one replica while another edits one of its
+fields resurrects with the surviving side's fields only. Change detection
+hashes content with 32-bit FNV-1a: a collision (~2^-32 per edit) would miss an
+edit. If concurrent-edit losslessness is your requirement, embed a real CRDT
+document (Yjs/Automerge) as a binary file in the snapshot.
+
+## Sharing between people: peers
+
+Share a store between several people WITHOUT anyone granting write access:
+each member publishes their own copy on their own storage, shares it
+read-only, and attaches the other members' links as peers
+(`store.advanced.attachPeer(source)`). Every converge folds each peer's copy
+in as one more replica and publishes the merged state back: one writer per
+file (no write races), copies converge to the union (every member is a full
+backup of the group), gossip is transitive (a star around one member is
+enough). Peer problems are recorded per peer on `state.peers` and never gate
+your own saves.
+
+Group crypto, two options: ONE shared passphrase (exchanged once out of band),
+or **passwordless groups** (`selfstore/groups`): a keypair per member, every
+copy Ed25519-signed by its author and sealed per recipient (X25519 envelopes),
+membership governed by an admin-signed manifest with rollback protection. The
+full model, the failure table and the operational notes live in
+[PEERS.md](./PEERS.md); the trust analysis in
+[THREAT-MODEL.md](./THREAT-MODEL.md).
+
+## Destinations
+
+Built in: **disk file** (File System Access, truly zero backend, Chromium),
+**Google Drive** (bring a `DriveAuth`; `gisDriveAuth` is the client-only
+reference - occasional re-consent; a tiny refresh-token broker buys "connected
+for good"; the cloud only ever sees opaque encrypted bytes), **WebDAV**
+(Nextcloud and friends; credentials sealed at rest under a non-extractable
+device key), and **S3-compatible buckets** (Amazon S3, Cloudflare R2, Backblaze
+B2, MinIO): the browser signs each request with SigV4 itself, no vendor SDK, the
+secret sealed at rest like the WebDAV credentials.
+
+Yours: implement `BackupTarget { kind / save / load / isReady / reconnect /
+disconnect }` from `selfstore/advanced` with any `kind` string (say `'ipfs'`)
+and hand it to `store.connectTarget(...)`. Signal a genuine loss of access by
+throwing `AuthExpiredError`; anything else you throw is treated as transient
+and retried. `examples/custom-target.ts` is a complete one in ~30 lines.
+
+> Honest scope: a disk file needs **no backend**; Drive client-only needs no
+> backend but re-consents roughly hourly (third-party cookies); a permanent
+> Drive connection needs a small refresh-token broker. WebDAV and S3 need only
+> a CORS rule on the server/bucket for your app origin.
+
+For resilience, `store.addReplica(target)` keeps a SECOND destination in sync
+with the same backup - Drive as the primary, an S3 bucket as the synced copy -
+so losing one home never loses the data. For locked-down deployments,
+`createLocalStore({ requireEncryption, passwordPolicy })` refuses a plaintext
+backup and a weak password at the engine (not just the UI); offering only
+`webdav` / `s3` in the connect widget, and not mounting the share/join widgets,
+keeps an app on the user's own storage with no sharing surface at all.
+
+## Framework bindings
+
+`store.subscribe(fn)` plus reading state is the whole contract, and the state
+snapshot is referentially stable between changes - so every framework binds in
+a few lines and there is deliberately NO adapter package to install:
+
+```ts
+// React. The THIRD argument matters: without it useSyncExternalStore throws
+// during SSR (Next, Remix...).
+import { useSyncExternalStore } from 'react';
+const s = useSyncExternalStore(store.subscribe, () => store.state, () => store.state);
+
+// Svelte (3, 4 and 5). The store contract is structural - this object IS a
+// readable, no svelte import needed; use it as $persistence in components.
+const persistence = {
+  subscribe(run: (s: typeof store.state) => void) {
+    run(store.state);
+    return store.subscribe(() => run(store.state));
+  }
+};
+
+// Vue, Solid, anything else: subscribe on mount, read store.state, call the
+// returned unsubscriber on unmount.
+```
+
+## Security model
+
+- Confidentiality and integrity come from AES-256-GCM: a wrong password, a
+  flipped ciphertext byte or altered KDF/IV parameters all fail decryption.
+  There is no partially-valid read.
+- The KDF is Argon2id (memory-hard), 46 MiB / 3 passes by default, parameters
+  stored per file. It runs in a Web Worker (shipped as
+  `selfstore/kdf-worker`), falling back to the main thread with byte-identical
+  results wherever workers cannot load.
+- The cosmetic header fields (`app`, `appVersion`, `createdAt`) are cleartext
+  and NOT authenticated; never base a security decision on them.
+- Passwords are JavaScript strings: the platform gives no way to zeroize them.
+  Derived keys are non-extractable WebCrypto keys.
+- Decompression is guarded: any archive entry declaring more than 512 MiB is
+  refused before inflation (`TOO_LARGE`), and a backup declaring absurd
+  Argon2id parameters is rejected before the KDF runs.
+- WebDAV Basic-auth credentials are refused over plain http (loopback aside);
+  S3 requests are refused over plain http as well (loopback aside).
+- The local IndexedDB cache is sealed at rest: the collections snapshot and file
+  blobs are AES-256-GCM-encrypted under a non-extractable per-device key (only
+  the small sync bookkeeping stays in the clear). Defense-in-depth against
+  disk forensics and partial exfiltration, not against a full-profile copy or
+  code in the origin - see T13 in the threat model.
+- Ultra-sensitive `cacheLock`: seal that cache under a key held in memory only
+  (a password, or an app key such as a passkey PRF), never on disk, so even a
+  full-profile copy cannot read it. One unlock per session - `cacheLock` on the
+  simple facade, or `indexedDbCache(name, { lock: true })` at the store layer.
+  Still bounded by the origin (unlocked, code in the page decrypts).
+- Opt-in hardening for sensitive deployments: `requireEncryption` refuses to
+  write or export a plaintext backup, and `passwordPolicy` refuses a password
+  weaker than a length / character-class rule - both enforced at the store, so
+  the app cannot forget to check.
+- The full analysis - assets, trust boundaries, threats and explicit non-goals
+  (XSS, rollback replay, metadata) - is in [THREAT-MODEL.md](./THREAT-MODEL.md).
+
+## When not to use selfstore
+
+Honest limits: everything fits in memory (backups measured in MB, not GB;
+there is no streaming path and no delta sync - every converge ships the whole
+state); the merge targets one person's devices and small groups, not real-time
+collaboration (use a CRDT library for that); there is no undo or history - an
+LWW overwrite is final locally, so keep dated backup copies if you want time
+travel (`backup(...).toDisk()` makes that a one-liner); and it is a browser
+library (Node >= 20 works for tests, but the client is the point).
+
+Other current limits, documented with open eyes: multi-tab coordination is
+data-only (connections and mode switches apply to other tabs on reload;
+`multiTab: false` opts out); deletion tombstones grow unless you opt in to
+compaction (`tombstoneHorizonMs` on the advanced store - safe only if the
+horizon exceeds the longest a device stays offline); binary files merge by id
+union (no clocks: use content-addressed ids and tie file lifetime to a
+record). In Vite DEV, if the KDF worker 404s under dependency pre-bundling,
+add `optimizeDeps: { exclude: ['selfstore'] }`.
+
+## Testing your integration
+
+The simple store already runs in plain Node/vitest with no browser and no
+mocks: without IndexedDB it lands on an in-memory cache, and
+`await selfstore('app', { cache: memoryCache() })` (cache from
+`selfstore/advanced`) makes the sharing explicit - two stores over one
+`memoryCache()` simulate a reopen; a ~15-line in-memory `BackupTarget` (a Blob
+variable) exercises the full save/sync/restore loop. That is exactly how
+selfstore tests itself.
+
+## For AI agents
+
+`llms.txt` at the package root summarizes the API with canonical snippets, and
+[RECIPES.md](./RECIPES.md) has copy-paste tasks (the `examples/` folder holds
+the same mini-apps, typechecked). Rules of thumb: every record needs a
+**string `id`** (the simple store enforces it; the advanced one only logs);
+always branch on `err.code`, never parse error messages; treat
+`DECRYPT_FAILED` as "wrong password or corrupted file" (indistinguishable by
+design); an empty password means "not encrypted"; collection names starting
+with `__` are reserved.
+
+## Install
+
+```sh
+npm install selfstore
+```
+
+ESM only, TypeScript types included, browser-first. `fflate` and `hash-wasm`
+are loaded lazily via dynamic import, so they stay out of your critical bundle
+until the first compress/encrypt.
+
+## License
+
+MIT (c) Florian Mousseau

package/dist/advanced.d.ts

@@ -0,0 +1,90 @@
+import { B as BackupTarget } from './store-ChIGEOph.js';
+export { A as AuthExpiredError, a as BuiltinTargetKind, E as EncodeOptions, H as Header, K as KdfParams, L as LocalStore, b as LocalStoreOptions, c as LocalStoreState, M as MirrorState, d as Mode, P as PasswordCheck, e as PasswordPolicy, f as PasswordRequirement, g as PeerSource, h as PeerState, R as RESERVED_COLLECTION_PREFIX, i as RESERVED_STORE_MODES, j as RecipientStanza, k as ReplicaState, S as SelfstoreError, l as SelfstoreErrorCode, m as Severity, n as Snapshot, o as SnapshotFile, p as StatusAction, q as StatusDescriptor, r as StatusInput, s as StorageState, t as StoreError, u as StoreGroupConfig, v as SyncJournalEntry, w as SyncSource, T as TargetKind, x as checkPasswordPolicy, y as createLocalStore, z as deriveStatus, C as errorLabelKey, D as isAuthExpired, F as isReservedStoreMode, G as isSelfstoreError } from './store-ChIGEOph.js';
+import { K as KV } from './cache-De5_sALA.js';
+export { C as CachedFile, L as LocalCache, e as LockableCache, i as indexedDbCache, f as isLockableCache, m as memoryCache } from './cache-De5_sALA.js';
+export { e as exportSnapshot, g as gisDriveAuth, i as importSnapshot, a as inspect, b as isEncrypted, p as pickFromDisk, s as saveToDisk } from './local-2py_vGGy.js';
+import { c as connect$1, f as fromSession$1, p as preview, a as adopt, b as findOrCreateOwnFile, l as listBackups, d as createBackup, e as deleteBackup, r as renameBackup, g as connect$2, h as fromSession$2, i as connect$3, j as fromSession$3, k as peer } from './drive-Bv94UM8b.js';
+export { D as DriveAuth, m as DriveBackupInfo, n as DriveOptions, S as S3Config, o as S3ConnectOptions, W as WebdavConfig, q as WebdavConnectOptions, s as WebdavPeerOptions } from './drive-Bv94UM8b.js';
+import './sync.js';
+
+/**
+ * Disk-file backup target (Chromium only). The user picks a backup file once via
+ * the File System Access API; the store then re-writes that real file on every
+ * change. The handle is persisted through the injected KV, so the target stays
+ * storage-agnostic. The browser re-confirms write permission once per session
+ * (a one-click reconnect).
+ */
+
+interface FileConnectOptions {
+    /** Where the picked file handle is persisted across sessions. */
+    kv: KV;
+    /** Suggested name for the backup file the user creates/picks. */
+    fileName: string;
+}
+/** True when the browser supports picking a re-writable file (Chromium). */
+declare function isSupported(): boolean;
+/** Prompt the user to choose/create the backup file. Persists the handle for
+ *  next sessions. Returns the target, or null if cancelled. */
+declare function connect(opts: FileConnectOptions): Promise<BackupTarget | null>;
+/** Rebuild the target from the handle persisted in a past session, or null. */
+declare function fromSession(opts: {
+    kv: KV;
+}): Promise<BackupTarget | null>;
+
+/**
+ * selfstore/advanced - the pull-model store and the machinery under it.
+ *
+ * The simple `selfstore()` facade (package root) owns its data. This entry
+ * inverts that: with createLocalStore your app owns the data and hands the
+ * store a gather/apply pair - use it when state lives in your own reactive
+ * model (Svelte runes, Redux, signals) and the facade's collections would be
+ * a second copy. Everything here also backs `store.advanced` on the simple
+ * store: same machinery, same instance, so the two styles compose.
+ *
+ * Also here: the durable destinations (disk file, Google Drive, WebDAV) as
+ * connectable targets, the BackupTarget contract for writing your own, the
+ * caches, the headless status derivation, and the functional codec for the
+ * backup file format (the fluent one lives at the package root).
+ */
+
+/** Disk-file destination (File System Access, Chromium). */
+declare const fileTarget: {
+    connect: typeof connect;
+    fromSession: typeof fromSession;
+    isSupported: typeof isSupported;
+};
+/** WebDAV destination (Nextcloud, ownCloud, any server the user controls), plus
+ *  `peer()`: a read-only source over another member's shared WebDAV link, so a
+ *  group can share read-write without Google Drive (see store.attachPeer). */
+declare const webdavTarget: {
+    connect: typeof connect$3;
+    fromSession: typeof fromSession$3;
+    peer: typeof peer;
+};
+/** S3-compatible destination (Amazon S3, Cloudflare R2, Backblaze B2, MinIO):
+ *  the browser signs each request with SigV4 and writes one object on a bucket
+ *  the user controls, no vendor broker. The bucket only ever holds the same
+ *  end-to-end-encrypted .selfstore bytes. */
+declare const s3Target: {
+    connect: typeof connect$2;
+    fromSession: typeof fromSession$2;
+};
+/** Google Drive destination, plus the shared-file primitives (preview a specific
+ *  file, adopt it as this device's backup, find-or-create the user's own file)
+ *  and the backup-management ops (list the app's files with dates, create a
+ *  named empty backup, rename one, delete one for good) - the raw pieces a "my
+ *  backups" panel builds on. */
+declare const driveTarget: {
+    connect: typeof connect$1;
+    fromSession: typeof fromSession$1;
+    preview: typeof preview;
+    adopt: typeof adopt;
+    findOrCreateOwnFile: typeof findOrCreateOwnFile;
+    listBackups: typeof listBackups;
+    createBackup: typeof createBackup;
+    deleteBackup: typeof deleteBackup;
+    renameBackup: typeof renameBackup;
+    FILE_ID_KEY: string;
+};
+
+export { BackupTarget, type FileConnectOptions, KV, driveTarget, fileTarget, s3Target, webdavTarget };

package/dist/advanced.js

@@ -0,0 +1,41 @@
+export { RESERVED_STORE_MODES, createLocalStore, deriveStatus, gisDriveAuth, indexedDbCache, isLockableCache, isReservedStoreMode, memoryCache } from './chunk-N4RPMX3Y.js';
+export { pickFromDisk, saveToDisk } from './chunk-BJ3RUMGI.js';
+import './chunk-IBIEKK36.js';
+import { FILE_ID_KEY, renameBackup, deleteBackup, createBackup, listBackups, findOrCreateOwnFile, adopt, preview, fromSession, connect, isSupported, fromSession2, connect2, fromSession4, connect4, peer, fromSession3, connect3 } from './chunk-CUWB5EWF.js';
+export { RESERVED_COLLECTION_PREFIX, checkPasswordPolicy, exportSnapshot, importSnapshot, inspect, isEncrypted } from './chunk-JB4JHM7V.js';
+import './chunk-OWLX6PNT.js';
+import './chunk-QBCU7OOP.js';
+import './chunk-FDPAKHQS.js';
+export { AuthExpiredError, SelfstoreError, errorLabelKey, isAuthExpired, isSelfstoreError } from './chunk-VBFMMR7Q.js';
+
+// src/entries/advanced.ts
+var fileTarget = {
+  connect: connect2,
+  fromSession: fromSession2,
+  isSupported
+};
+var webdavTarget = {
+  connect: connect3,
+  fromSession: fromSession3,
+  peer
+};
+var s3Target = {
+  connect: connect4,
+  fromSession: fromSession4
+};
+var driveTarget = {
+  connect,
+  fromSession,
+  preview,
+  adopt,
+  findOrCreateOwnFile,
+  listBackups,
+  createBackup,
+  deleteBackup,
+  renameBackup,
+  FILE_ID_KEY
+};
+
+export { driveTarget, fileTarget, s3Target, webdavTarget };
+//# sourceMappingURL=advanced.js.map
+//# sourceMappingURL=advanced.js.map

package/dist/advanced.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/entries/advanced.ts"],"names":["connect","fromSession"],"mappings":";;;;;;;;;;;AA8HO,IAAM,UAAA,GAAa;AAAA,EACzB,OAAA,EAASA,QAAAA;AAAA,EACT,WAAA,EAAaC,YAAAA;AAAA,EACb;AACD;AAKO,IAAM,YAAA,GAAe;AAAA,EAC3B,OAAA,EAASD,QAAAA;AAAA,EACT,WAAA,EAAaC,YAAAA;AAAA,EACb;AACD;AAMO,IAAM,QAAA,GAAW;AAAA,EACvB,OAAA,EAASD,QAAAA;AAAA,EACT,WAAA,EAAaC;AACd;AAOO,IAAM,WAAA,GAAc;AAAA,EAC1B,OAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,mBAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA;AACD","file":"advanced.js","sourcesContent":["/**\n * selfstore/advanced - the pull-model store and the machinery under it.\n *\n * The simple `selfstore()` facade (package root) owns its data. This entry\n * inverts that: with createLocalStore your app owns the data and hands the\n * store a gather/apply pair - use it when state lives in your own reactive\n * model (Svelte runes, Redux, signals) and the facade's collections would be\n * a second copy. Everything here also backs `store.advanced` on the simple\n * store: same machinery, same instance, so the two styles compose.\n *\n * Also here: the durable destinations (disk file, Google Drive, WebDAV) as\n * connectable targets, the BackupTarget contract for writing your own, the\n * caches, the headless status derivation, and the functional codec for the\n * backup file format (the fluent one lives at the package root).\n */\n\n// --- The pull-model store: your app owns the data ---\nexport {\n\tcreateLocalStore,\n\ttype LocalStore,\n\ttype LocalStoreOptions,\n\ttype LocalStoreState,\n\ttype StoreError,\n\ttype Mode,\n\ttype TargetKind,\n\ttype SyncSource,\n\ttype SyncJournalEntry,\n\ttype PeerState,\n\ttype MirrorState,\n\ttype ReplicaState,\n\ttype StoreGroupConfig\n} from '../persistence/store';\n\n// --- On-device caches (the store's working copy) ---\nexport {\n\tindexedDbCache,\n\tmemoryCache,\n\tisLockableCache,\n\ttype LocalCache,\n\ttype LockableCache,\n\ttype CachedFile,\n\ttype KV\n} from '../persistence/cache';\n\n// --- Headless status: map store state to your UI copy ---\nexport {\n\tderiveStatus,\n\ttype StatusDescriptor,\n\ttype StatusInput,\n\ttype Severity,\n\ttype StorageState,\n\ttype StatusAction\n} from '../persistence/status';\n\n// --- The target contract (write your own destination) ---\nexport {\n\tRESERVED_STORE_MODES,\n\tisReservedStoreMode,\n\ttype BackupTarget,\n\ttype BuiltinTargetKind,\n\ttype PeerSource\n} from '../persistence/target';\n\n// --- The backup file format, functional style (fluent lives at the root) ---\nexport {\n\texportSnapshot,\n\timportSnapshot,\n\tinspect,\n\tisEncrypted,\n\tRESERVED_COLLECTION_PREFIX,\n\ttype Snapshot,\n\ttype SnapshotFile,\n\ttype Header,\n\ttype KdfParams,\n\ttype RecipientStanza,\n\ttype EncodeOptions\n} from '../selfstore';\n\n// --- Password strength policy (the store enforces it; the UI previews it) ---\nexport {\n\tcheckPasswordPolicy,\n\ttype PasswordPolicy,\n\ttype PasswordCheck,\n\ttype PasswordRequirement\n} from '../selfstore';\n\n// --- The full error contract (AuthExpiredError is what a custom target or\n//     DriveAuth THROWS to signal genuine access loss; everything else it\n//     throws is treated as transient and retried) ---\nexport {\n\tSelfstoreError,\n\tAuthExpiredError,\n\tisSelfstoreError,\n\tisAuthExpired,\n\terrorLabelKey,\n\ttype SelfstoreErrorCode\n} from '../selfstore';\n\n// --- Durable destinations (opt-in), each implementing BackupTarget ---\n// Explicit namespace objects: every member is deliberately public, so a future\n// internal helper in a target module can never leak into the contract.\nimport {\n\tconnect as fileConnect,\n\tfromSession as fileFromSession,\n\tisSupported as fileIsSupported\n} from '../persistence/targets/file';\nimport {\n\tconnect as webdavConnect,\n\tfromSession as webdavFromSession,\n\tpeer as webdavPeer\n} from '../persistence/targets/webdav';\nimport { connect as s3Connect, fromSession as s3FromSession } from '../persistence/targets/s3';\nimport {\n\tconnect as driveConnect,\n\tfromSession as driveFromSession,\n\tpreview as drivePreview,\n\tadopt as driveAdopt,\n\tfindOrCreateOwnFile as driveFindOrCreateOwnFile,\n\tlistBackups as driveListBackups,\n\tcreateBackup as driveCreateBackup,\n\tdeleteBackup as driveDeleteBackup,\n\trenameBackup as driveRenameBackup,\n\tFILE_ID_KEY as DRIVE_FILE_ID_KEY\n} from '../persistence/targets/drive';\n\n/** Disk-file destination (File System Access, Chromium). */\nexport const fileTarget = {\n\tconnect: fileConnect,\n\tfromSession: fileFromSession,\n\tisSupported: fileIsSupported\n};\n\n/** WebDAV destination (Nextcloud, ownCloud, any server the user controls), plus\n *  `peer()`: a read-only source over another member's shared WebDAV link, so a\n *  group can share read-write without Google Drive (see store.attachPeer). */\nexport const webdavTarget = {\n\tconnect: webdavConnect,\n\tfromSession: webdavFromSession,\n\tpeer: webdavPeer\n};\n\n/** S3-compatible destination (Amazon S3, Cloudflare R2, Backblaze B2, MinIO):\n *  the browser signs each request with SigV4 and writes one object on a bucket\n *  the user controls, no vendor broker. The bucket only ever holds the same\n *  end-to-end-encrypted .selfstore bytes. */\nexport const s3Target = {\n\tconnect: s3Connect,\n\tfromSession: s3FromSession\n};\n\n/** Google Drive destination, plus the shared-file primitives (preview a specific\n *  file, adopt it as this device's backup, find-or-create the user's own file)\n *  and the backup-management ops (list the app's files with dates, create a\n *  named empty backup, rename one, delete one for good) - the raw pieces a \"my\n *  backups\" panel builds on. */\nexport const driveTarget = {\n\tconnect: driveConnect,\n\tfromSession: driveFromSession,\n\tpreview: drivePreview,\n\tadopt: driveAdopt,\n\tfindOrCreateOwnFile: driveFindOrCreateOwnFile,\n\tlistBackups: driveListBackups,\n\tcreateBackup: driveCreateBackup,\n\tdeleteBackup: driveDeleteBackup,\n\trenameBackup: driveRenameBackup,\n\tFILE_ID_KEY: DRIVE_FILE_ID_KEY\n};\n\nexport type { FileConnectOptions } from '../persistence/targets/file';\nexport type { DriveAuth, DriveOptions, DriveBackupInfo } from '../persistence/targets/drive';\nexport type {\n\tWebdavConfig,\n\tWebdavConnectOptions,\n\tWebdavPeerOptions\n} from '../persistence/targets/webdav';\nexport type { S3Config, S3ConnectOptions } from '../persistence/targets/s3';\nexport { gisDriveAuth } from '../persistence/targets/drive-auth-gis';\nexport { saveToDisk, pickFromDisk } from '../selfstore/targets/local';\n"]}