selfstore 1.0.0

package/dist/flows.d.ts

@@ -0,0 +1,306 @@
+import { t as StoreError, B as BackupTarget, L as LocalStore, k as ReplicaState } from './store-ChIGEOph.js';
+import { K as KV } from './cache-De5_sALA.js';
+import { W as WebdavConfig, S as S3Config, D as DriveAuth } from './drive-Bv94UM8b.js';
+import { F as FlowStore } from './machine-ALMkT3mk.js';
+export { w as withDeadline } from './machine-ALMkT3mk.js';
+import './sync.js';
+
+type ConnectKind = 'drive' | 'file' | 'webdav' | 's3';
+/** Produce a connected BackupTarget, or null when the user cancelled the
+ *  gesture (consent refused, picker closed). Custom connectors slot custom
+ *  targets - or test fakes - into the same journey. */
+type Connector = () => Promise<BackupTarget | null>;
+/** Which destinations the flow offers, and how to open each one. The offer
+ *  renders in this OBJECT's insertion order: the host decides which
+ *  destination leads by how it writes the object, not by a ranking here. */
+interface ConnectTargets {
+    /** Google Drive: the auth strategy (e.g. gisDriveAuth), or a custom connector. */
+    drive?: DriveAuth | Connector;
+    /** Local file via the browser's picker (true), or a custom connector. On
+     *  browsers without the File System Access API the flow degrades to the
+     *  manual download mode by itself. The object form offers TWO gestures on
+     *  the same destination: `create` (save picker: start or overwrite a backup
+     *  file) and `open` (open picker: adopt an EXISTING backup file - it then
+     *  goes through the same inspect/password/resolution journey). */
+    file?: true | Connector | {
+        create?: true | Connector;
+        open?: true | Connector;
+    };
+    /** WebDAV: true renders a 'form' step and expects submitWebdav(config);
+     *  a fixed WebdavConfig skips the form; or a custom connector. */
+    webdav?: true | WebdavConfig | Connector;
+    /** S3-compatible bucket (Amazon S3, R2, B2, MinIO): true renders a 'form'
+     *  step and expects submitS3(config); a fixed S3Config skips the form; or a
+     *  custom connector. Offer it alongside `webdav` and the widget groups both
+     *  under one "your server" entry with a WebDAV/S3 toggle. */
+    s3?: true | S3Config | Connector;
+}
+/** What the flows need from the store. The simple store exposes this as
+ *  `store.flowHost`; an advanced-store app builds it by hand. */
+interface FlowHost {
+    engine: LocalStore;
+    kv: KV;
+    /** Backup file name on the destination (the simple store uses `app.zip`). */
+    backupName: string;
+}
+interface ConnectFlowOptions {
+    /** Declare when this device holds data worth a question: only then does an
+     *  existing backup raise the 'conflict' step with the destructive choices.
+     *  Default: never - the flow applies defaultResolution. */
+    hasLocalData?: () => boolean;
+    /** How to reconcile with a destination that already holds a backup when the
+     *  conflict step is not raised. Default 'merge' - the only choice that
+     *  loses nothing on either side. 'resume' adopts the backup (the
+     *  destination wins; this device's working copy is replaced), 'replace'
+     *  overwrites the backup with this device. An encrypted backup still asks
+     *  for its password first, whatever the resolution; an empty destination
+     *  is not concerned (this device's data simply becomes its content). */
+    defaultResolution?: ConnectResolution;
+    /** Skip the password step on an encrypted backup: adopt it AS is (resume)
+     *  and complete with the store locked - nothing readable, nothing
+     *  clobbered - for the host to unlock on its own surface (engine.unlock)
+     *  after the connect. Adoption is forced whatever defaultResolution says:
+     *  without the proven key a merge is impossible and a replace would
+     *  destroy a backup no one proved they own. Hosts that let a device
+     *  holding real local data connect should keep the password-first
+     *  journey - adoption replaces the working copy. */
+    deferUnlock?: boolean;
+    /** Deadline for each network leg (inspect, trial-read, attach), ms. */
+    deadlineMs?: number;
+}
+type ConnectStep = 'choose' | 'form' | 'authorizing' | 'password' | 'conflict' | 'connected' | 'error';
+/** How to reconcile with a destination that already holds a backup. */
+type ConnectResolution = 'merge' | 'resume' | 'replace';
+/** What connecting did. 'merged': both sides folded. 'started': empty
+ *  destination now holds this device's data. 'resumed': the backup won,
+ *  this device adopted it. 'replaced': this device won, the backup was
+ *  overwritten. 'manual': degraded download-on-demand file mode. */
+type ConnectFlowOutcome = 'merged' | 'started' | 'resumed' | 'replaced' | 'manual';
+interface ConnectSnapshot {
+    step: ConnectStep;
+    /** The destinations to offer, in the order given. */
+    kinds: readonly ConnectKind[];
+    /** The destination being connected (null while choosing). */
+    kind: ConnectKind | null;
+    /** Set when step === 'connected'. */
+    outcome: ConnectFlowOutcome | null;
+    /** Known after inspection: the destination already holds a backup. */
+    hasBackup: boolean;
+    /** ...and that backup is encrypted. */
+    encrypted: boolean;
+    /** The last submitPassword() was wrong (stay on 'password', say so). */
+    passwordError: boolean;
+    /** An async leg is in flight (render a spinner, disable the actions). */
+    busy: boolean;
+    /** Set when step === 'error': show `labelKey`, log `message`. */
+    error: StoreError | null;
+}
+interface ConnectFlow extends FlowStore<ConnectSnapshot> {
+    /** Pick a destination. Call it inside the user's click: the consent popup /
+     *  file picker opens synchronously from the gesture. Ignored while a leg is
+     *  already in flight (one popup per gesture). For a `file` target declared
+     *  with the object form, `variant` picks the gesture: 'create' (default,
+     *  save picker) or 'open' (adopt an existing backup file). */
+    choose(kind: ConnectKind, variant?: 'create' | 'open'): void;
+    /** 'form' step (webdav: true): submit the server config. */
+    submitWebdav(config: WebdavConfig): void;
+    /** 'form' step (s3: true): submit the bucket config. */
+    submitS3(config: S3Config): void;
+    /** 'password' step: prove the backup's password. Wrong password sets
+     *  passwordError and stays here; nothing is attached either way. */
+    submitPassword(password: string): void;
+    /** 'password' step escape hatch: give up on a forgotten password and start a
+     *  fresh backup over the protected one. The encrypted backup is overwritten
+     *  by this device's data (possibly empty) and lost for good - the only way
+     *  out when the password cannot be recovered. */
+    overwrite(): void;
+    /** 'conflict' step: pick the reconciliation. */
+    resolveConflict(how: ConnectResolution): void;
+    /** Abandon the journey in progress: back to 'choose'. A late resolution of
+     *  the abandoned leg is discarded. */
+    cancel(): void;
+    /** 'error' step: back to 'choose' to try again. */
+    retry(): void;
+}
+declare function connectFlow(store: FlowHost | {
+    flowHost: FlowHost;
+}, targets: ConnectTargets, options?: ConnectFlowOptions): ConnectFlow;
+
+/** The one replica this flow manages, as its id on the engine. */
+declare const REPLICA_ID = "replica";
+type ReplicaStep = 'idle' | 'choose' | 'form-webdav' | 'form-s3';
+interface ReplicaSnapshot {
+    step: ReplicaStep;
+    /** The kinds the host offers, in ConnectTargets order. */
+    kinds: ConnectKind[];
+    busy: boolean;
+    error: StoreError | null;
+    /** The live engine entry (label, lastPublishAt, lastError), null when none. */
+    replica: ReplicaState | null;
+}
+interface ReplicaFlowOptions {
+    /** File name of the copy on its destination. Default: the primary backup
+     *  name with `.replica` before the extension ("App.zip" -> "App.replica.zip"),
+     *  which a same-account Drive never confuses with the primary file and the
+     *  backups panel never lists as a backup of its own. */
+    fileName?: string;
+    /** Rebuild the target of a custom Connector kind on restore() (built-in
+     *  kinds rebuild by themselves). Without it, custom kinds are not restored. */
+    restoreTarget?: (kind: ConnectKind) => Promise<BackupTarget | null>;
+}
+interface ReplicaFlow extends FlowStore<ReplicaSnapshot> {
+    /** Show the destination choice (from the user's gesture). */
+    open(): void;
+    /** Back to idle; never an error. */
+    cancel(): void;
+    /** Run a destination (inside the user's click - pickers and consent popups
+     *  open from it). `webdav: true` / `s3: true` route to their form step. */
+    pick(kind: ConnectKind): void;
+    /** 'form-webdav' step: submit the server config. */
+    submitWebdav(config: WebdavConfig): void;
+    /** 'form-s3' step: submit the bucket config. */
+    submitS3(config: S3Config): void;
+    /** Detach the copy and forget its session. Never deletes remote data. */
+    remove(): Promise<void>;
+    /** Silent reboot: re-attach the copy recorded by a past session, if any.
+     *  Never throws - an unreachable destination retries at the next boot. */
+    restore(): Promise<void>;
+    /** Detach from the engine (the replica itself stays attached). */
+    dispose(): void;
+}
+declare function replicaFlow(store: FlowHost | {
+    flowHost: FlowHost;
+}, targets: ConnectTargets, options?: ReplicaFlowOptions): ReplicaFlow;
+
+type ShareLevel = 'read' | 'write';
+interface ShareLinkInfo {
+    /** Engine-scoped stable id (revoke keys on it). */
+    id: string;
+    /** The invitation URL to hand out. */
+    url: string;
+    level: ShareLevel;
+}
+interface ShareMemberInfo {
+    /** Engine-scoped stable id (removeMember keys on it). */
+    id: string;
+    label?: string;
+    /** This row is the local user. */
+    self?: boolean;
+    /** This row owns the share (the app may render a badge, the flow does not care). */
+    owner?: boolean;
+}
+/** The app-side port the flow drives. Implementations wrap whatever transport
+ *  the app shares through; every method may throw (SelfstoreError preferred,
+ *  anything is normalized). */
+interface ShareEngine {
+    /** The current truth: active links and members. */
+    list(): Promise<{
+        links: ShareLinkInfo[];
+        members: ShareMemberInfo[];
+    }>;
+    createLink(opts: {
+        level: ShareLevel;
+    }): Promise<ShareLinkInfo>;
+    revokeLink(id: string): Promise<void>;
+    /** Optional: engines without member management simply omit it. */
+    removeMember?(id: string): Promise<void>;
+    /** Optional: END the whole share in one gesture - every link dead, every
+     *  member out. Engines whose transport has such a move (an invitation to
+     *  kill, a file to re-privatize) expose it; the widget renders the action
+     *  only then. */
+    revokeAll?(): Promise<void>;
+}
+type ShareBusy = 'refresh' | 'create' | 'revoke' | 'remove' | 'revoke-all' | null;
+interface ShareSnapshot {
+    links: readonly ShareLinkInfo[];
+    members: readonly ShareMemberInfo[];
+    /** The operation in flight, or null. */
+    busy: ShareBusy;
+    /** The last refresh failed: the lists shown are the last-known good ones. */
+    stale: boolean;
+    /** The last operation's problem (the lists are never cleared by an error). */
+    error: StoreError | null;
+    /** True once the engine offers removeMember (render the row action at all). */
+    canRemoveMembers: boolean;
+    /** True once the engine offers revokeAll (render the end-the-share action). */
+    canRevokeAll: boolean;
+}
+interface ShareFlow extends FlowStore<ShareSnapshot> {
+    /** Re-list from the engine. Failure keeps the last-known lists (stale). */
+    refresh(): Promise<void>;
+    /** Create an invitation link. Resolves to it, or null when refused (an
+     *  operation was already in flight). */
+    createLink(opts: {
+        level: ShareLevel;
+    }): Promise<ShareLinkInfo | null>;
+    /** Revoke a link. The link leaves the snapshot only once the engine
+     *  confirmed. Resolves to whether it did. */
+    revokeLink(id: string): Promise<boolean>;
+    /** Remove a member (never yourself - refused up front). Resolves to whether
+     *  the engine confirmed. */
+    removeMember(id: string): Promise<boolean>;
+    /** End the whole share: every link and member leaves the snapshot only
+     *  once the engine confirmed. Resolves to whether it did. */
+    revokeAll(): Promise<boolean>;
+}
+declare function shareFlow(engine: ShareEngine, options?: {
+    deadlineMs?: number;
+}): ShareFlow;
+
+/** What the user is about to join - enough to render an honest question. */
+interface JoinPreview {
+    /** The share's display name, when the link carries one. */
+    label?: string;
+    /** Who shared it (a name, an email - whatever the engine knows). */
+    from?: string;
+    level?: ShareLevel;
+}
+/** How joining ended, other than plain failure:
+ *  'joined'    - this device now follows the share.
+ *  'mismatch'  - this device already follows a DIFFERENT share: joining a
+ *                second one is refused (leave the first, or use another
+ *                device/profile).
+ *  'no-invite' - the invitation is spent, expired, or aimed at another
+ *                account (switching accounts may be the fix). */
+type JoinOutcome = 'joined' | 'mismatch' | 'no-invite';
+/** The app-side port: how a link is read and honoured on this transport. */
+interface JoinEngine {
+    /** Read-only look at the invitation. Must change NOTHING. */
+    preview(link: string): Promise<JoinPreview>;
+    /** Consume the invitation and wire the share. Resolve null when the user
+     *  backed out of a popup the engine had to open (an account chooser, a
+     *  consent screen): the flow returns to 'ready' silently - backing out of
+     *  a human gesture is not an error, here as everywhere in these flows. */
+    join(link: string): Promise<JoinOutcome | null>;
+    /** Optional: re-run the account chooser (the invite may belong to another
+     *  account). The flow re-previews after it. */
+    switchAccount?(): Promise<void>;
+}
+type JoinStep = 'previewing' | 'ready' | 'joining' | 'joined' | 'mismatch' | 'no-invite' | 'error';
+interface JoinSnapshot {
+    /** The invitation this flow was opened with - held here so the UI can
+     *  always find it again. */
+    link: string;
+    step: JoinStep;
+    /** Set once previewed (kept through errors, so retry re-renders context). */
+    preview: JoinPreview | null;
+    /** The engine offers an account switch. */
+    canSwitchAccount: boolean;
+    busy: boolean;
+    /** Set when step === 'error': show `labelKey`, log `message`. */
+    error: StoreError | null;
+}
+interface JoinFlow extends FlowStore<JoinSnapshot> {
+    /** Say yes: consume the invitation. Only from 'ready'. */
+    accept(): void;
+    /** Re-run the account chooser, then preview again under the new account.
+     *  Available from 'ready', 'no-invite' and 'error' when the engine offers it. */
+    switchAccount(): void;
+    /** From 'error': preview again and resume the journey. */
+    retry(): void;
+}
+declare function joinFlow(link: string, engine: JoinEngine, options?: {
+    deadlineMs?: number;
+}): JoinFlow;
+
+export { type ConnectFlow, type ConnectFlowOptions, type ConnectFlowOutcome, type ConnectKind, type ConnectResolution, type ConnectSnapshot, type ConnectStep, type ConnectTargets, type Connector, type FlowHost, FlowStore, type JoinEngine, type JoinFlow, type JoinOutcome, type JoinPreview, type JoinSnapshot, type JoinStep, REPLICA_ID, type ReplicaFlow, type ReplicaFlowOptions, type ReplicaSnapshot, type ReplicaStep, type ShareBusy, type ShareEngine, type ShareFlow, type ShareLevel, type ShareLinkInfo, type ShareMemberInfo, type ShareSnapshot, connectFlow, joinFlow, replicaFlow, shareFlow };

package/dist/flows.js

@@ -0,0 +1,153 @@
+export { connectFlow, joinFlow, shareFlow } from './chunk-ATUPHVLG.js';
+import { connect, connect2, connect4, connect3, fromSession, fromSession2, fromSession3, fromSession4 } from './chunk-CUWB5EWF.js';
+import './chunk-JB4JHM7V.js';
+import { makeMachine, toStoreError } from './chunk-SGISYMT5.js';
+export { withDeadline } from './chunk-SGISYMT5.js';
+import './chunk-OWLX6PNT.js';
+import './chunk-QBCU7OOP.js';
+import './chunk-FDPAKHQS.js';
+import './chunk-VBFMMR7Q.js';
+
+// src/flows/replica.ts
+var REPLICA_ID = "replica";
+var SCOPE = "replica:";
+var RECORD_KEY = "record";
+function scopedKv(kv, prefix) {
+  return {
+    get: (key) => kv.get(prefix + key),
+    set: (key, value) => kv.set(prefix + key, value),
+    del: (key) => kv.del(prefix + key)
+  };
+}
+function replicaFileName(backupName) {
+  const dot = backupName.lastIndexOf(".");
+  return dot > 0 ? `${backupName.slice(0, dot)}.replica${backupName.slice(dot)}` : `${backupName}.replica`;
+}
+function replicaFlow(store, targets, options = {}) {
+  const host = "flowHost" in store ? store.flowHost : store;
+  const engine = host.engine;
+  const skv = scopedKv(host.kv, SCOPE);
+  const fileName = options.fileName ?? replicaFileName(host.backupName);
+  const kinds = Object.keys(targets).filter(
+    (k) => (k === "drive" || k === "file" || k === "webdav" || k === "s3") && targets[k] != null
+  );
+  const current = () => engine.state.replicas.find((r) => r.id === REPLICA_ID) ?? null;
+  const m = makeMachine({
+    step: "idle",
+    kinds,
+    busy: false,
+    error: null,
+    replica: current()
+  });
+  const unsub = engine.subscribe(() => m.set({ replica: current() }));
+  let attached = null;
+  function connectorFor(kind) {
+    const spec = targets[kind];
+    if (spec == null) return null;
+    if (typeof spec === "function") return spec;
+    if (kind === "drive") {
+      const auth = spec;
+      return () => connect({ auth, kv: skv, fileName });
+    }
+    if (kind === "file") {
+      return () => connect2({ kv: skv, fileName });
+    }
+    if (kind === "s3") {
+      const config2 = spec;
+      return () => connect4({ kv: skv, config: config2 });
+    }
+    const config = spec;
+    return () => connect3({ kv: skv, config });
+  }
+  async function run(kind, connector) {
+    m.set({ busy: true, error: null });
+    try {
+      const target = await connector();
+      if (!target) {
+        m.set({ busy: false });
+        return;
+      }
+      if (current()) engine.detachReplica(REPLICA_ID);
+      engine.attachReplica(target, { id: REPLICA_ID });
+      attached = target;
+      await skv.set(RECORD_KEY, { kind });
+      m.set({ step: "idle", busy: false, error: null, replica: current() });
+    } catch (e) {
+      m.set({ busy: false, error: toStoreError(e) });
+    }
+  }
+  async function builtinFromSession(kind) {
+    if (kind === "drive") {
+      const spec = targets.drive;
+      if (spec == null || typeof spec === "function") return null;
+      return fromSession({ auth: spec, kv: skv, fileName });
+    }
+    if (kind === "file") return fromSession2({ kv: skv });
+    if (kind === "webdav") return fromSession3({ kv: skv });
+    return fromSession4({ kv: skv });
+  }
+  return {
+    get snapshot() {
+      return m.snapshot;
+    },
+    subscribe: m.subscribe,
+    open() {
+      if (m.snapshot.busy) return;
+      m.set({ step: "choose", error: null });
+    },
+    cancel() {
+      m.set({ step: "idle", busy: false, error: null });
+    },
+    pick(kind) {
+      if (m.snapshot.busy) return;
+      const spec = targets[kind];
+      if (spec == null) return;
+      if (kind === "webdav" && spec === true) {
+        m.set({ step: "form-webdav", error: null });
+        return;
+      }
+      if (kind === "s3" && spec === true) {
+        m.set({ step: "form-s3", error: null });
+        return;
+      }
+      const connector = connectorFor(kind);
+      if (connector) void run(kind, connector);
+    },
+    submitWebdav(config) {
+      if (m.snapshot.busy) return;
+      void run("webdav", () => connect3({ kv: skv, config }));
+    },
+    submitS3(config) {
+      if (m.snapshot.busy) return;
+      void run("s3", () => connect4({ kv: skv, config }));
+    },
+    async remove() {
+      const target = attached;
+      attached = null;
+      if (current()) engine.detachReplica(REPLICA_ID);
+      await skv.del(RECORD_KEY);
+      await target?.disconnect().catch(() => void 0);
+      m.set({ step: "idle", busy: false, error: null, replica: current() });
+    },
+    async restore() {
+      try {
+        if (current()) return;
+        const record = await skv.get(RECORD_KEY);
+        if (!record) return;
+        const target = await options.restoreTarget?.(record.kind) ?? await builtinFromSession(record.kind);
+        if (!target) return;
+        engine.attachReplica(target, { id: REPLICA_ID });
+        attached = target;
+        m.set({ replica: current() });
+      } catch {
+      }
+    },
+    dispose() {
+      unsub();
+    }
+  };
+}
+
+export { REPLICA_ID, replicaFlow };
+//# sourceMappingURL=flows.js.map
+//# sourceMappingURL=flows.js.map

package/dist/flows.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/flows/replica.ts"],"names":["connect","config","fromSession"],"mappings":";;;;;;;;;;;AAyBO,IAAM,UAAA,GAAa;AAK1B,IAAM,KAAA,GAAQ,UAAA;AACd,IAAM,UAAA,GAAa,QAAA;AAqDnB,SAAS,QAAA,CAAS,IAAQ,MAAA,EAAoB;AAC7C,EAAA,OAAO;AAAA,IACN,KAAK,CAAc,GAAA,KAAgB,EAAA,CAAG,GAAA,CAAO,SAAS,GAAG,CAAA;AAAA,IACzD,GAAA,EAAK,CAAC,GAAA,EAAa,KAAA,KAAmB,GAAG,GAAA,CAAI,MAAA,GAAS,KAAK,KAAK,CAAA;AAAA,IAChE,KAAK,CAAC,GAAA,KAAgB,EAAA,CAAG,GAAA,CAAI,SAAS,GAAG;AAAA,GAC1C;AACD;AAEA,SAAS,gBAAgB,UAAA,EAA4B;AACpD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,OAAO,GAAA,GAAM,CAAA,GACV,CAAA,EAAG,UAAA,CAAW,MAAM,CAAA,EAAG,GAAG,CAAC,CAAA,QAAA,EAAW,WAAW,KAAA,CAAM,GAAG,CAAC,CAAA,CAAA,GAC3D,GAAG,UAAU,CAAA,QAAA,CAAA;AACjB;AAEO,SAAS,WAAA,CACf,KAAA,EACA,OAAA,EACA,OAAA,GAA8B,EAAC,EACjB;AACd,EAAA,MAAM,IAAA,GAAO,UAAA,IAAc,KAAA,GAAQ,KAAA,CAAM,QAAA,GAAW,KAAA;AACpD,EAAA,MAAM,SAAS,IAAA,CAAK,MAAA;AACpB,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,IAAA,CAAK,EAAA,EAAI,KAAK,CAAA;AACnC,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAY,eAAA,CAAgB,KAAK,UAAU,CAAA;AACpE,EAAA,MAAM,KAAA,GAAS,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,CAAoB,MAAA;AAAA,IACrD,CAAC,CAAA,KAAA,CAAO,CAAA,KAAM,OAAA,IAAW,CAAA,KAAM,MAAA,IAAU,CAAA,KAAM,QAAA,IAAY,CAAA,KAAM,IAAA,KAAS,OAAA,CAAQ,CAAC,CAAA,IAAK;AAAA,GACzF;AAEA,EAAA,MAAM,OAAA,GAAU,MACf,MAAA,CAAO,KAAA,CAAM,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,EAAA,KAAO,UAAU,CAAA,IAAK,IAAA;AAE3D,EAAA,MAAM,IAAI,WAAA,CAA6B;AAAA,IACtC,IAAA,EAAM,MAAA;AAAA,IACN,KAAA;AAAA,IACA,IAAA,EAAM,KAAA;AAAA,IACN,KAAA,EAAO,IAAA;AAAA,IACP,SAAS,OAAA;AAAQ,GACjB,CAAA;AAGD,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,CAAE,GAAA,CAAI,EAAE,OAAA,EAAS,OAAA,EAAQ,EAAG,CAAC,CAAA;AAGlE,EAAA,IAAI,QAAA,GAAgC,IAAA;AAEpC,EAAA,SAAS,aAAa,IAAA,EAAqC;AAC1D,IAAA,MAAM,IAAA,GAAO,QAAQ,IAAI,CAAA;AACzB,IAAA,IAAI,IAAA,IAAQ,MAAM,OAAO,IAAA;AACzB,IAAA,IAAI,OAAO,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA;AACvC,IAAA,IAAI,SAAS,OAAA,EAAS;AACrB,MAAA,MAAM,IAAA,GAAO,IAAA;AACb,MAAA,OAAO,MAAM,OAAA,CAAa,EAAE,MAAM,EAAA,EAAI,GAAA,EAAK,UAAU,CAAA;AAAA,IACtD;AACA,IAAA,IAAI,SAAS,MAAA,EAAQ;AACpB,MAAA,OAAO,MAAMA,QAAAA,CAAY,EAAE,EAAA,EAAI,GAAA,EAAK,UAAU,CAAA;AAAA,IAC/C;AACA,IAAA,IAAI,SAAS,IAAA,EAAM;AAClB,MAAA,MAAMC,OAAAA,GAAS,IAAA;AACf,MAAA,OAAO,MAAMD,QAAAA,CAAU,EAAE,IAAI,GAAA,EAAK,MAAA,EAAAC,SAAQ,CAAA;AAAA,IAC3C;AACA,IAAA,MAAM,MAAA,GAAS,IAAA;AACf,IAAA,OAAO,MAAMD,QAAAA,CAAc,EAAE,EAAA,EAAI,GAAA,EAAK,QAAQ,CAAA;AAAA,EAC/C;AAEA,EAAA,eAAe,GAAA,CAAI,MAAmB,SAAA,EAAqC;AAC1E,IAAA,CAAA,CAAE,IAAI,EAAE,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,MAAM,CAAA;AACjC,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,MAAM,SAAA,EAAU;AAC/B,MAAA,IAAI,CAAC,MAAA,EAAQ;AAEZ,QAAA,CAAA,CAAE,GAAA,CAAI,EAAE,IAAA,EAAM,KAAA,EAAO,CAAA;AACrB,QAAA;AAAA,MACD;AACA,MAAA,IAAI,OAAA,EAAQ,EAAG,MAAA,CAAO,aAAA,CAAc,UAAU,CAAA;AAC9C,MAAA,MAAA,CAAO,aAAA,CAAc,MAAA,EAAQ,EAAE,EAAA,EAAI,YAAY,CAAA;AAC/C,MAAA,QAAA,GAAW,MAAA;AACX,MAAA,MAAM,GAAA,CAAI,GAAA,CAAI,UAAA,EAAY,EAAE,MAA8B,CAAA;AAC1D,MAAA,CAAA,CAAE,GAAA,CAAI,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,OAAA,EAAQ,EAAG,CAAA;AAAA,IACrE,SAAS,CAAA,EAAG;AACX,MAAA,CAAA,CAAE,GAAA,CAAI,EAAE,IAAA,EAAM,KAAA,EAAO,OAAO,YAAA,CAAa,CAAC,GAAG,CAAA;AAAA,IAC9C;AAAA,EACD;AAEA,EAAA,eAAe,mBAAmB,IAAA,EAAiD;AAClF,IAAA,IAAI,SAAS,OAAA,EAAS;AACrB,MAAA,MAAM,OAAO,OAAA,CAAQ,KAAA;AACrB,MAAA,IAAI,IAAA,IAAQ,IAAA,IAAQ,OAAO,IAAA,KAAS,YAAY,OAAO,IAAA;AACvD,MAAA,OAAO,YAAiB,EAAE,IAAA,EAAM,MAAM,EAAA,EAAI,GAAA,EAAK,UAAU,CAAA;AAAA,IAC1D;AACA,IAAA,IAAI,SAAS,MAAA,EAAQ,OAAOE,aAAgB,EAAE,EAAA,EAAI,KAAK,CAAA;AACvD,IAAA,IAAI,SAAS,QAAA,EAAU,OAAOA,aAAkB,EAAE,EAAA,EAAI,KAAK,CAAA;AAC3D,IAAA,OAAOA,YAAAA,CAAc,EAAE,EAAA,EAAI,GAAA,EAAK,CAAA;AAAA,EACjC;AAEA,EAAA,OAAO;AAAA,IACN,IAAI,QAAA,GAAW;AACd,MAAA,OAAO,CAAA,CAAE,QAAA;AAAA,IACV,CAAA;AAAA,IACA,WAAW,CAAA,CAAE,SAAA;AAAA,IAEb,IAAA,GAAO;AACN,MAAA,IAAI,CAAA,CAAE,SAAS,IAAA,EAAM;AACrB,MAAA,CAAA,CAAE,IAAI,EAAE,IAAA,EAAM,QAAA,EAAU,KAAA,EAAO,MAAM,CAAA;AAAA,IACtC,CAAA;AAAA,IAEA,MAAA,GAAS;AACR,MAAA,CAAA,CAAE,GAAA,CAAI,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,KAAA,EAAO,KAAA,EAAO,MAAM,CAAA;AAAA,IACjD,CAAA;AAAA,IAEA,KAAK,IAAA,EAAM;AACV,MAAA,IAAI,CAAA,CAAE,SAAS,IAAA,EAAM;AACrB,MAAA,MAAM,IAAA,GAAO,QAAQ,IAAI,CAAA;AACzB,MAAA,IAAI,QAAQ,IAAA,EAAM;AAClB,MAAA,IAAI,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,IAAA,EAAM;AACvC,QAAA,CAAA,CAAE,IAAI,EAAE,IAAA,EAAM,aAAA,EAAe,KAAA,EAAO,MAAM,CAAA;AAC1C,QAAA;AAAA,MACD;AACA,MAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,IAAA,EAAM;AACnC,QAAA,CAAA,CAAE,IAAI,EAAE,IAAA,EAAM,SAAA,EAAW,KAAA,EAAO,MAAM,CAAA;AACtC,QAAA;AAAA,MACD;AACA,MAAA,MAAM,SAAA,GAAY,aAAa,IAAI,CAAA;AACnC,MAAA,IAAI,SAAA,EAAW,KAAK,GAAA,CAAI,IAAA,EAAM,SAAS,CAAA;AAAA,IACxC,CAAA;AAAA,IAEA,aAAa,MAAA,EAAQ;AACpB,MAAA,IAAI,CAAA,CAAE,SAAS,IAAA,EAAM;AACrB,MAAA,KAAK,GAAA,CAAI,UAAU,MAAMF,QAAAA,CAAc,EAAE,EAAA,EAAI,GAAA,EAAK,MAAA,EAAQ,CAAC,CAAA;AAAA,IAC5D,CAAA;AAAA,IAEA,SAAS,MAAA,EAAQ;AAChB,MAAA,IAAI,CAAA,CAAE,SAAS,IAAA,EAAM;AACrB,MAAA,KAAK,GAAA,CAAI,MAAM,MAAMA,QAAAA,CAAU,EAAE,EAAA,EAAI,GAAA,EAAK,MAAA,EAAQ,CAAC,CAAA;AAAA,IACpD,CAAA;AAAA,IAEA,MAAM,MAAA,GAAS;AACd,MAAA,MAAM,MAAA,GAAS,QAAA;AACf,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,IAAI,OAAA,EAAQ,EAAG,MAAA,CAAO,aAAA,CAAc,UAAU,CAAA;AAC9C,MAAA,MAAM,GAAA,CAAI,IAAI,UAAU,CAAA;AAGxB,MAAA,MAAM,MAAA,EAAQ,UAAA,EAAW,CAAE,KAAA,CAAM,MAAM,MAAS,CAAA;AAChD,MAAA,CAAA,CAAE,GAAA,CAAI,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,KAAA,EAAO,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,OAAA,EAAQ,EAAG,CAAA;AAAA,IACrE,CAAA;AAAA,IAEA,MAAM,OAAA,GAAU;AACf,MAAA,IAAI;AACH,QAAA,IAAI,SAAQ,EAAG;AACf,QAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,GAAA,CAAmB,UAAU,CAAA;AACtD,QAAA,IAAI,CAAC,MAAA,EAAQ;AACb,QAAA,MAAM,MAAA,GACJ,MAAM,OAAA,CAAQ,aAAA,GAAgB,MAAA,CAAO,IAAI,CAAA,IAAO,MAAM,kBAAA,CAAmB,MAAA,CAAO,IAAI,CAAA;AACtF,QAAA,IAAI,CAAC,MAAA,EAAQ;AACb,QAAA,MAAA,CAAO,aAAA,CAAc,MAAA,EAAQ,EAAE,EAAA,EAAI,YAAY,CAAA;AAC/C,QAAA,QAAA,GAAW,MAAA;AACX,QAAA,CAAA,CAAE,GAAA,CAAI,EAAE,OAAA,EAAS,OAAA,IAAW,CAAA;AAAA,MAC7B,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACD,CAAA;AAAA,IAEA,OAAA,GAAU;AACT,MAAA,KAAA,EAAM;AAAA,IACP;AAAA,GACD;AACD","file":"flows.js","sourcesContent":["// The backup-copy journey: attach ONE replica (a second destination receiving\n// the same encrypted backup as the primary home) behind a small state machine\n// the widgets can render. Reuses the connect flow's target specs, but there is\n// no password step, no conflict step and no deadline: a replica carries the\n// primary's bytes as-is, and every connector may contain a human gesture.\n\nimport type { BackupTarget } from '../persistence/target';\nimport type { KV } from '../persistence/cache';\nimport type { ReplicaState, StoreError } from '../persistence/store';\nimport { makeMachine, toStoreError, type FlowStore } from './machine';\nimport type { ConnectKind, ConnectTargets, Connector, FlowHost } from './connect';\nimport {\n\tconnect as driveConnect,\n\tfromSession as driveFromSession,\n\ttype DriveAuth\n} from '../persistence/targets/drive';\nimport { connect as fileConnect, fromSession as fileFromSession } from '../persistence/targets/file';\nimport {\n\tconnect as webdavConnect,\n\tfromSession as webdavFromSession,\n\ttype WebdavConfig\n} from '../persistence/targets/webdav';\nimport { connect as s3Connect, fromSession as s3FromSession, type S3Config } from '../persistence/targets/s3';\n\n/** The one replica this flow manages, as its id on the engine. */\nexport const REPLICA_ID = 'replica';\n\n// The replica's target session lives in the SAME kv as the primary's, so every\n// key is prefixed: a second driveTarget (say) must never read or clobber the\n// primary connection's session keys.\nconst SCOPE = 'replica:';\nconst RECORD_KEY = 'record';\n\n/** What survives a reboot: which provider the copy lives on. The target's own\n *  session (file id, handle, server config) is persisted by the target module\n *  itself, under the scoped kv. */\ninterface ReplicaRecord {\n\tkind: ConnectKind;\n}\n\nexport type ReplicaStep = 'idle' | 'choose' | 'form-webdav' | 'form-s3';\n\nexport interface ReplicaSnapshot {\n\tstep: ReplicaStep;\n\t/** The kinds the host offers, in ConnectTargets order. */\n\tkinds: ConnectKind[];\n\tbusy: boolean;\n\terror: StoreError | null;\n\t/** The live engine entry (label, lastPublishAt, lastError), null when none. */\n\treplica: ReplicaState | null;\n}\n\nexport interface ReplicaFlowOptions {\n\t/** File name of the copy on its destination. Default: the primary backup\n\t *  name with `.replica` before the extension (\"App.zip\" -> \"App.replica.zip\"),\n\t *  which a same-account Drive never confuses with the primary file and the\n\t *  backups panel never lists as a backup of its own. */\n\tfileName?: string;\n\t/** Rebuild the target of a custom Connector kind on restore() (built-in\n\t *  kinds rebuild by themselves). Without it, custom kinds are not restored. */\n\trestoreTarget?: (kind: ConnectKind) => Promise<BackupTarget | null>;\n}\n\nexport interface ReplicaFlow extends FlowStore<ReplicaSnapshot> {\n\t/** Show the destination choice (from the user's gesture). */\n\topen(): void;\n\t/** Back to idle; never an error. */\n\tcancel(): void;\n\t/** Run a destination (inside the user's click - pickers and consent popups\n\t *  open from it). `webdav: true` / `s3: true` route to their form step. */\n\tpick(kind: ConnectKind): void;\n\t/** 'form-webdav' step: submit the server config. */\n\tsubmitWebdav(config: WebdavConfig): void;\n\t/** 'form-s3' step: submit the bucket config. */\n\tsubmitS3(config: S3Config): void;\n\t/** Detach the copy and forget its session. Never deletes remote data. */\n\tremove(): Promise<void>;\n\t/** Silent reboot: re-attach the copy recorded by a past session, if any.\n\t *  Never throws - an unreachable destination retries at the next boot. */\n\trestore(): Promise<void>;\n\t/** Detach from the engine (the replica itself stays attached). */\n\tdispose(): void;\n}\n\nfunction scopedKv(kv: KV, prefix: string): KV {\n\treturn {\n\t\tget: <T = unknown>(key: string) => kv.get<T>(prefix + key),\n\t\tset: (key: string, value: unknown) => kv.set(prefix + key, value),\n\t\tdel: (key: string) => kv.del(prefix + key)\n\t};\n}\n\nfunction replicaFileName(backupName: string): string {\n\tconst dot = backupName.lastIndexOf('.');\n\treturn dot > 0\n\t\t? `${backupName.slice(0, dot)}.replica${backupName.slice(dot)}`\n\t\t: `${backupName}.replica`;\n}\n\nexport function replicaFlow(\n\tstore: FlowHost | { flowHost: FlowHost },\n\ttargets: ConnectTargets,\n\toptions: ReplicaFlowOptions = {}\n): ReplicaFlow {\n\tconst host = 'flowHost' in store ? store.flowHost : store;\n\tconst engine = host.engine;\n\tconst skv = scopedKv(host.kv, SCOPE);\n\tconst fileName = options.fileName ?? replicaFileName(host.backupName);\n\tconst kinds = (Object.keys(targets) as ConnectKind[]).filter(\n\t\t(k) => (k === 'drive' || k === 'file' || k === 'webdav' || k === 's3') && targets[k] != null\n\t);\n\n\tconst current = (): ReplicaState | null =>\n\t\tengine.state.replicas.find((r) => r.id === REPLICA_ID) ?? null;\n\n\tconst m = makeMachine<ReplicaSnapshot>({\n\t\tstep: 'idle',\n\t\tkinds,\n\t\tbusy: false,\n\t\terror: null,\n\t\treplica: current()\n\t});\n\n\t// Follow the engine: every publish (or publish failure) refreshes the entry.\n\tconst unsub = engine.subscribe(() => m.set({ replica: current() }));\n\n\t// Held for remove(): disconnect() lets the target forget its own session.\n\tlet attached: BackupTarget | null = null;\n\n\tfunction connectorFor(kind: ConnectKind): Connector | null {\n\t\tconst spec = targets[kind];\n\t\tif (spec == null) return null;\n\t\tif (typeof spec === 'function') return spec;\n\t\tif (kind === 'drive') {\n\t\t\tconst auth = spec as DriveAuth;\n\t\t\treturn () => driveConnect({ auth, kv: skv, fileName });\n\t\t}\n\t\tif (kind === 'file') {\n\t\t\treturn () => fileConnect({ kv: skv, fileName });\n\t\t}\n\t\tif (kind === 's3') {\n\t\t\tconst config = spec as S3Config; // 's3: true' goes through the form step\n\t\t\treturn () => s3Connect({ kv: skv, config });\n\t\t}\n\t\tconst config = spec as WebdavConfig; // 'webdav: true' goes through the form step\n\t\treturn () => webdavConnect({ kv: skv, config });\n\t}\n\n\tasync function run(kind: ConnectKind, connector: Connector): Promise<void> {\n\t\tm.set({ busy: true, error: null });\n\t\ttry {\n\t\t\tconst target = await connector();\n\t\t\tif (!target) {\n\t\t\t\t// Cancelled picker/consent: stay where the user was, no error.\n\t\t\t\tm.set({ busy: false });\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (current()) engine.detachReplica(REPLICA_ID); // swap, never a dup-id throw\n\t\t\tengine.attachReplica(target, { id: REPLICA_ID });\n\t\t\tattached = target;\n\t\t\tawait skv.set(RECORD_KEY, { kind } satisfies ReplicaRecord);\n\t\t\tm.set({ step: 'idle', busy: false, error: null, replica: current() });\n\t\t} catch (e) {\n\t\t\tm.set({ busy: false, error: toStoreError(e) });\n\t\t}\n\t}\n\n\tasync function builtinFromSession(kind: ConnectKind): Promise<BackupTarget | null> {\n\t\tif (kind === 'drive') {\n\t\t\tconst spec = targets.drive;\n\t\t\tif (spec == null || typeof spec === 'function') return null;\n\t\t\treturn driveFromSession({ auth: spec, kv: skv, fileName });\n\t\t}\n\t\tif (kind === 'file') return fileFromSession({ kv: skv });\n\t\tif (kind === 'webdav') return webdavFromSession({ kv: skv });\n\t\treturn s3FromSession({ kv: skv });\n\t}\n\n\treturn {\n\t\tget snapshot() {\n\t\t\treturn m.snapshot;\n\t\t},\n\t\tsubscribe: m.subscribe,\n\n\t\topen() {\n\t\t\tif (m.snapshot.busy) return;\n\t\t\tm.set({ step: 'choose', error: null });\n\t\t},\n\n\t\tcancel() {\n\t\t\tm.set({ step: 'idle', busy: false, error: null });\n\t\t},\n\n\t\tpick(kind) {\n\t\t\tif (m.snapshot.busy) return;\n\t\t\tconst spec = targets[kind];\n\t\t\tif (spec == null) return;\n\t\t\tif (kind === 'webdav' && spec === true) {\n\t\t\t\tm.set({ step: 'form-webdav', error: null });\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (kind === 's3' && spec === true) {\n\t\t\t\tm.set({ step: 'form-s3', error: null });\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst connector = connectorFor(kind);\n\t\t\tif (connector) void run(kind, connector);\n\t\t},\n\n\t\tsubmitWebdav(config) {\n\t\t\tif (m.snapshot.busy) return;\n\t\t\tvoid run('webdav', () => webdavConnect({ kv: skv, config }));\n\t\t},\n\n\t\tsubmitS3(config) {\n\t\t\tif (m.snapshot.busy) return;\n\t\t\tvoid run('s3', () => s3Connect({ kv: skv, config }));\n\t\t},\n\n\t\tasync remove() {\n\t\t\tconst target = attached;\n\t\t\tattached = null;\n\t\t\tif (current()) engine.detachReplica(REPLICA_ID);\n\t\t\tawait skv.del(RECORD_KEY);\n\t\t\t// Forget locally only - a BackupTarget's disconnect never deletes\n\t\t\t// remote data, so the copy stays where it is for a manual recovery.\n\t\t\tawait target?.disconnect().catch(() => undefined);\n\t\t\tm.set({ step: 'idle', busy: false, error: null, replica: current() });\n\t\t},\n\n\t\tasync restore() {\n\t\t\ttry {\n\t\t\t\tif (current()) return;\n\t\t\t\tconst record = await skv.get<ReplicaRecord>(RECORD_KEY);\n\t\t\t\tif (!record) return;\n\t\t\t\tconst target =\n\t\t\t\t\t(await options.restoreTarget?.(record.kind)) ?? (await builtinFromSession(record.kind));\n\t\t\t\tif (!target) return; // unreachable or custom kind: retry next boot\n\t\t\t\tengine.attachReplica(target, { id: REPLICA_ID });\n\t\t\t\tattached = target;\n\t\t\t\tm.set({ replica: current() });\n\t\t\t} catch {\n\t\t\t\t// Silent reboot by contract: the record stays, the next boot retries.\n\t\t\t}\n\t\t},\n\n\t\tdispose() {\n\t\t\tunsub();\n\t\t}\n\t};\n}\n"]}

package/dist/groups.d.ts

@@ -0,0 +1,39 @@
+import { G as GroupIdentity, K as KV } from './cache-De5_sALA.js';
+export { a as GROUP_KEYING, b as GroupManifest, c as GroupMember, S as SignedManifest, g as generateIdentity, d as groupCryptoAvailable, k as keyId, n as newGroupId, o as openManifest, p as publicIdentity, s as signManifest } from './cache-De5_sALA.js';
+
+interface IdentityVault {
+    /** The stored identity, or null when none exists yet. On a protected
+     *  vault this throws PASSWORD_REQUIRED rather than returning null - a
+     *  locked identity exists, and null would invite loadOrCreate to mint a
+     *  second one over it. */
+    load(): Promise<GroupIdentity | null>;
+    /** Seal and store an identity, overwriting any previous one. Throws
+     *  PASSWORD_REQUIRED on a protected vault: a locked identity is never
+     *  silently replaced (unprotect() or clear() first). */
+    save(identity: GroupIdentity): Promise<void>;
+    /** load(), creating and storing a fresh identity when absent. Same
+     *  PASSWORD_REQUIRED rule as load(). */
+    loadOrCreate(): Promise<GroupIdentity>;
+    /** Forget the identity on this device. Allowed even when protected -
+     *  forgetting leaks nothing, and it is the honest lost-passphrase escape
+     *  hatch (re-import from another device, or get re-invited). */
+    clear(): Promise<void>;
+    isProtected(): Promise<boolean>;
+    /** Decrypt a protected vault and return the identity. Stateless: the
+     *  caller holds it in memory, the stored value stays sealed. Wrong
+     *  passphrase and tampered blob are one DECRYPT_FAILED; hostile KDF
+     *  params are refused before any derivation. */
+    unlock(passphrase: string): Promise<GroupIdentity>;
+    /** Reseal the identity under Argon2id(passphrase); an empty vault gets a
+     *  fresh identity, created-and-protected in one step. Changing the
+     *  passphrase is unprotect(old) then protect(new) - an already-protected
+     *  vault throws PASSWORD_REQUIRED, never a silent rekey. */
+    protect(passphrase: string): Promise<void>;
+    /** Unlock with `passphrase`, then reseal under the device key. A wrong
+     *  passphrase throws DECRYPT_FAILED and leaves the vault untouched. */
+    unprotect(passphrase: string): Promise<void>;
+}
+/** An identity vault over the app's kv (e.g. `indexedDbCache(app).kv`). */
+declare function identityVault(kv: KV): IdentityVault;
+
+export { GroupIdentity, type IdentityVault, identityVault };

package/dist/groups.js

@@ -0,0 +1,103 @@
+import { generateIdentity } from './chunk-OWLX6PNT.js';
+export { GROUP_KEYING, generateIdentity, groupCryptoAvailable, keyId, newGroupId, openManifest, publicIdentity, signManifest } from './chunk-OWLX6PNT.js';
+import { seal, isEnvelope, unseal, newDeviceKey } from './chunk-QBCU7OOP.js';
+import { assertKdfBounds, deriveKey, freshKdfParams } from './chunk-FDPAKHQS.js';
+import { SelfstoreError } from './chunk-VBFMMR7Q.js';
+
+// src/persistence/identity.ts
+var VAULT_KEY = "groupVaultKey";
+var IDENTITY_KEY = "groupIdentity";
+var utf8 = { enc: new TextEncoder(), dec: new TextDecoder() };
+function isVaultLock(v) {
+  return typeof v === "object" && v !== null && v.selfstoreVaultLock === 1;
+}
+var encode = (identity) => utf8.enc.encode(JSON.stringify(identity));
+var decode = (bytes) => JSON.parse(utf8.dec.decode(bytes));
+function identityVault(kv) {
+  async function vaultKey() {
+    const existing = await kv.get(VAULT_KEY);
+    if (existing) return existing;
+    const fresh = await newDeviceKey();
+    await kv.set(VAULT_KEY, fresh);
+    return fresh;
+  }
+  async function sealDevice(identity) {
+    await kv.set(IDENTITY_KEY, await seal(await vaultKey(), encode(identity)));
+  }
+  async function load() {
+    const stored = await kv.get(IDENTITY_KEY);
+    if (isVaultLock(stored)) {
+      throw new SelfstoreError(
+        "PASSWORD_REQUIRED",
+        "The identity vault is passphrase-protected. Call unlock(passphrase) - load()/loadOrCreate() never open or replace a locked identity."
+      );
+    }
+    if (!isEnvelope(stored)) return null;
+    return decode(await unseal(await vaultKey(), stored));
+  }
+  async function save(identity) {
+    if (isVaultLock(await kv.get(IDENTITY_KEY))) {
+      throw new SelfstoreError(
+        "PASSWORD_REQUIRED",
+        "The identity vault is passphrase-protected; save() never overwrites a locked identity. unprotect(passphrase) first, or clear() to forget it."
+      );
+    }
+    await sealDevice(identity);
+  }
+  async function unlock(passphrase) {
+    const stored = await kv.get(IDENTITY_KEY);
+    if (!isVaultLock(stored)) {
+      throw new TypeError("unlock(): the vault is not passphrase-protected (check isProtected()).");
+    }
+    if (!stored.kdf || !isEnvelope(stored.envelope)) {
+      throw new SelfstoreError("BAD_FORMAT", "Missing or malformed vault lock parameters.");
+    }
+    assertKdfBounds(stored.kdf);
+    try {
+      return decode(await unseal(await deriveKey(passphrase, stored.kdf), stored.envelope));
+    } catch (e) {
+      if (e instanceof SelfstoreError) throw e;
+      throw new SelfstoreError("DECRYPT_FAILED", "Wrong passphrase or tampered identity vault.");
+    }
+  }
+  async function protect(passphrase) {
+    if (!passphrase) throw new TypeError("protect(): a non-empty passphrase is required.");
+    const stored = await kv.get(IDENTITY_KEY);
+    if (isVaultLock(stored)) {
+      throw new SelfstoreError(
+        "PASSWORD_REQUIRED",
+        "The identity vault is already passphrase-protected. To change the passphrase: unprotect(oldPassphrase), then protect(newPassphrase)."
+      );
+    }
+    const identity = isEnvelope(stored) ? decode(await unseal(await vaultKey(), stored)) : await generateIdentity();
+    const kdf = freshKdfParams();
+    const envelope = await seal(await deriveKey(passphrase, kdf), encode(identity));
+    await kv.set(IDENTITY_KEY, { selfstoreVaultLock: 1, kdf, envelope });
+  }
+  return {
+    load,
+    save,
+    unlock,
+    protect,
+    async loadOrCreate() {
+      const existing = await load();
+      if (existing) return existing;
+      const fresh = await generateIdentity();
+      await save(fresh);
+      return fresh;
+    },
+    async clear() {
+      await kv.del(IDENTITY_KEY);
+    },
+    async isProtected() {
+      return isVaultLock(await kv.get(IDENTITY_KEY));
+    },
+    async unprotect(passphrase) {
+      await sealDevice(await unlock(passphrase));
+    }
+  };
+}
+
+export { identityVault };
+//# sourceMappingURL=groups.js.map
+//# sourceMappingURL=groups.js.map