selfstore 1.8.1 → 1.8.3

package/README.md

@@ -26,6 +26,11 @@ host.
 Docs, guides, a live demo and honest comparisons with the alternatives:
 **[selfstore.dev](https://selfstore.dev)**.
 
+Or run the whole pitch in a browser tab, nothing installed:
+**[open the playground in StackBlitz](https://stackblitz.com/github/selfstoredev/selfstore/tree/main/examples/playground)**
+- notes that survive a reload, a real file on the disk as their home, and a
+genuine encrypted ZIP ([source](examples/playground)).
+
 ## Going further is one call each
 
 ```ts

package/dist/advanced.d.ts

@@ -1,10 +1,12 @@
-import { B as BackupTarget } from './store-CbGrlMME.js';
-export { A as AuthExpiredError, a as BuiltinTargetKind, E as EncodeOptions, H as Header, K as KdfParams, L as LocalStore, b as LocalStoreOptions, c as LocalStoreState, M as MirrorState, d as Mode, e as PasswordCheck, f as PasswordPolicy, g as PasswordRequirement, P as PeerSource, h as PeerState, R as RESERVED_COLLECTION_PREFIX, i as RESERVED_STORE_MODES, j as RecipientStanza, k as ReplicaState, S as SelfstoreError, l as SelfstoreErrorCode, m as Severity, n as Snapshot, o as SnapshotFile, p as StatusAction, q as StatusDescriptor, r as StatusInput, s as StorageState, t as StoreError, u as StoreGroupConfig, v as SyncJournalEntry, w as SyncSource, T as TargetKind, x as checkPasswordPolicy, y as createLocalStore, z as deriveStatus, C as errorLabelKey, D as isAuthExpired, F as isReservedStoreMode, G as isSelfstoreError } from './store-CbGrlMME.js';
+import { B as BackupTarget } from './store-BiQ-BuVl.js';
+export { A as AuthExpiredError, a as BuiltinTargetKind, E as EncodeOptions, H as Header, K as KdfParams, L as LocalStore, b as LocalStoreOptions, c as LocalStoreState, M as MirrorState, d as Mode, e as PasswordCheck, f as PasswordPolicy, g as PasswordRequirement, P as PeerSource, h as PeerState, R as RESERVED_COLLECTION_PREFIX, i as RESERVED_STORE_MODES, j as RecipientStanza, k as ReplicaState, S as SelfstoreError, l as SelfstoreErrorCode, m as Severity, n as Snapshot, o as SnapshotFile, p as StatusAction, q as StatusDescriptor, r as StatusInput, s as StorageState, t as StoreError, u as StoreGroupConfig, v as SyncJournalEntry, w as SyncSource, T as TargetKind, x as checkPasswordPolicy, y as createLocalStore, z as deriveStatus, C as errorLabelKey, D as isAuthExpired, F as isReservedStoreMode, G as isSelfstoreError } from './store-BiQ-BuVl.js';
 import { K as KV } from './cache-ilsK3Tki.js';
 export { C as CachedFile, L as LocalCache, e as LockableCache, i as indexedDbCache, f as isLockableCache, m as memoryCache } from './cache-ilsK3Tki.js';
-export { d as datedName, e as exportSnapshot, g as gisDriveAuth, i as importSnapshot, a as inspect, b as isEncrypted, p as pickFromDisk, s as saveToDisk } from './local-ipQv_Pbv.js';
-import { c as connect$1, f as fromSession$1, p as preview, a as adopt, b as findOrCreateOwnFile, l as listBackups, d as createBackup, e as deleteBackup, r as renameBackup, g as connect$2, h as fromSession$2, i as connect$3, j as fromSession$3, k as peer } from './drive-DF08V8-L.js';
-export { D as DriveAuth, m as DriveBackupInfo, n as DriveOptions, S as S3Config, o as S3ConnectOptions, W as WebdavConfig, q as WebdavConnectOptions, s as WebdavPeerOptions } from './drive-DF08V8-L.js';
+export { d as datedName, e as exportSnapshot, g as gisDriveAuth, i as importSnapshot, a as inspect, b as isEncrypted, p as pickFromDisk, s as saveToDisk } from './local-C52j3DeH.js';
+import { c as connect$2, f as fromSession$2, a as connect$3, b as fromSession$3, p as peer } from './s3-DvsnA-FK.js';
+export { S as S3Config, d as S3ConnectOptions, W as WebdavConfig, e as WebdavConnectOptions, g as WebdavPeerOptions } from './s3-DvsnA-FK.js';
+import { c as connect$1, f as fromSession$1, p as preview, a as adopt, b as findOrCreateOwnFile, l as listBackups, d as createBackup, e as deleteBackup, r as renameBackup, g as account } from './drive-CTYvGg_7.js';
+export { h as DriveAccount, i as DriveAuth, j as DriveBackupInfo, D as DriveOptions } from './drive-CTYvGg_7.js';
 import './sync.js';
 
 /**
@@ -143,7 +145,8 @@ declare const s3Target: {
  *  file, adopt it as this device's backup, find-or-create the user's own file)
  *  and the backup-management ops (list the app's files with dates, create a
  *  named empty backup, rename one, delete one for good) - the raw pieces a "my
- *  backups" panel builds on. */
+ *  backups" panel builds on. `account()` names WHICH Google account holds them,
+ *  because a brand name is not an address. */
 declare const driveTarget: {
     connect: typeof connect$1;
     fromSession: typeof fromSession$1;
@@ -154,6 +157,7 @@ declare const driveTarget: {
     createBackup: typeof createBackup;
     deleteBackup: typeof deleteBackup;
     renameBackup: typeof renameBackup;
+    account: typeof account;
     FILE_ID_KEY: string;
 };
 

package/dist/advanced.js

@@ -1,12 +1,12 @@
-export { RESERVED_STORE_MODES, createLocalStore, deriveStatus, gisDriveAuth, indexedDbCache, isLockableCache, isReservedStoreMode, memoryCache } from './chunk-ZV2S3I76.js';
-export { datedName, pickFromDisk, saveToDisk } from './chunk-53WWPEML.js';
+export { RESERVED_STORE_MODES, createLocalStore, deriveStatus, gisDriveAuth, indexedDbCache, isLockableCache, isReservedStoreMode, memoryCache } from './chunk-ELDSPUTS.js';
+export { datedName, pickFromDisk, saveToDisk } from './chunk-DCEXWSM6.js';
 import './chunk-SKWHKM25.js';
-import { FILE_ID_KEY, renameBackup, deleteBackup, createBackup, listBackups, findOrCreateOwnFile, adopt, preview, fromSession, connect, openExisting, isOpenSupported, isSupported, fromSession2, connect2, fromSession4, connect4, peer, fromSession3, connect3 } from './chunk-XBPJRUA3.js';
-export { RESERVED_COLLECTION_PREFIX, checkPasswordPolicy, exportSnapshot, importSnapshot, inspect, isEncrypted } from './chunk-ZDHTKFAL.js';
-import './chunk-CT2HTWA7.js';
+import { openExisting, isOpenSupported, isSupported, fromSession as fromSession$1, connect as connect$1, fromSession3, connect3, peer, fromSession2, connect2 } from './chunk-TKWU52LK.js';
+import { FILE_ID_KEY, account, renameBackup, deleteBackup, createBackup, listBackups, findOrCreateOwnFile, adopt, preview, fromSession, connect } from './chunk-J5MFXJU6.js';
+export { RESERVED_COLLECTION_PREFIX, checkPasswordPolicy, exportSnapshot, importSnapshot, inspect, isEncrypted } from './chunk-MGDXR3RB.js';
 import './chunk-QBCU7OOP.js';
-import './chunk-CM3HSBCE.js';
-export { AuthExpiredError, SelfstoreError, errorLabelKey, isAuthExpired, isSelfstoreError } from './chunk-SFF7KKM4.js';
+import './chunk-O3Y6FORN.js';
+export { AuthExpiredError, SelfstoreError, errorLabelKey, isAuthExpired, isSelfstoreError } from './chunk-3OBJOMQ2.js';
 
 // src/persistence/installation.ts
 function isSafari(ua) {
@@ -36,8 +36,8 @@ function storageAdvice() {
 
 // src/entries/advanced.ts
 var fileTarget = {
-  connect: connect2,
-  fromSession: fromSession2,
+  connect: connect$1,
+  fromSession: fromSession$1,
   isSupported,
   isOpenSupported,
   /** Let the user point at an EXISTING backup file and adopt it as the
@@ -46,13 +46,13 @@ var fileTarget = {
   openExisting
 };
 var webdavTarget = {
-  connect: connect3,
-  fromSession: fromSession3,
+  connect: connect2,
+  fromSession: fromSession2,
   peer
 };
 var s3Target = {
-  connect: connect4,
-  fromSession: fromSession4
+  connect: connect3,
+  fromSession: fromSession3
 };
 var driveTarget = {
   connect,
@@ -64,6 +64,7 @@ var driveTarget = {
   createBackup,
   deleteBackup,
   renameBackup,
+  account,
   FILE_ID_KEY
 };
 

package/dist/advanced.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/persistence/installation.ts","../src/entries/advanced.ts"],"names":["connect","fromSession"],"mappings":";;;;;;;;;;;AAuCA,SAAS,SAAS,EAAA,EAAqB;AACtC,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,EAAE,CAAA,IAAK,CAAC,uBAAA,CAAwB,IAAA,CAAK,EAAE,CAAA,IAAK,CAAC,eAAA,CAAgB,IAAA,CAAK,EAAE,CAAA;AAC5F;AAEA,SAAS,YAAA,GAAwB;AAChC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,UAAA,GAAa,4BAA4B,GAAG,OAAA,KAAY,IAAA;AAEnF,EAAA,MAAM,GAAA,GAAO,UAAmD,UAAA,KAAe,IAAA;AAC/E,EAAA,OAAO,WAAA,IAAe,GAAA;AACvB;AAOO,SAAS,aAAA,GAA+B;AAC9C,EAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,OAAO,WAAW,WAAA,EAAa;AACtE,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAM;AAAA,EACzC;AACA,EAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,EAAA,IAAI,CAAC,QAAA,CAAS,SAAA,CAAU,SAAS,KAAK,SAAA,EAAW;AAChD,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAU;AAAA,EAClC;AACA,EAAA,MAAM,QAAQ,kBAAA,CAAmB,IAAA,CAAK,UAAU,SAAS,CAAA,IAAK,UAAU,cAAA,GAAiB,CAAA;AACzF,EAAA,OAAO;AAAA,IACN,IAAA,EAAM,mBAAA;AAAA,IACN,MAAA,EAAQ,QAAQ,wBAAA,GAA2B,iBAAA;AAAA,IAC3C,SAAA,EAAW;AAAA,GACZ;AACD;;;AC6DO,IAAM,UAAA,GAAa;AAAA,EACzB,OAAA,EAASA,QAAAA;AAAA,EACT,WAAA,EAAaC,YAAAA;AAAA,EACb,WAAA;AAAA,EACA,eAAA;AAAA;AAAA;AAAA;AAAA,EAIA;AACD;AAKO,IAAM,YAAA,GAAe;AAAA,EAC3B,OAAA,EAASD,QAAAA;AAAA,EACT,WAAA,EAAaC,YAAAA;AAAA,EACb;AACD;AAMO,IAAM,QAAA,GAAW;AAAA,EACvB,OAAA,EAASD,QAAAA;AAAA,EACT,WAAA,EAAaC;AACd;AAOO,IAAM,WAAA,GAAc;AAAA,EAC1B,OAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,mBAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA;AACD","file":"advanced.js","sourcesContent":["/**\n * Whether this browser will keep the local store, and what the user can do\n * about it.\n *\n * One browser does not merely inconvenience a local-first app, it DELETES its\n * data: Safari erases script-writable storage after seven days of browser use\n * without interaction with the site. Someone who closes for three weeks comes\n * back to an empty app, and nothing warned them - which is also the moment they\n * notice it last.\n *\n * Adding the app to the Dock or the Home Screen switches its storage to\n * persistent mode, which WebKit exempts from its eviction triggers. WebKit does\n * not write anywhere that this neutralises the inactivity rule by name, so this\n * module reports an advisory, never a guarantee.\n *\n * The library ships no user-facing copy: it names the situation, the host writes\n * the sentence.\n */\n\n/** What stands between this browser and keeping the data. */\nexport type StorageRisk =\n\t/** Nothing known against it: the store survives until the user clears it. */\n\t| 'none'\n\t/** Data is erased when the tab closes (private browsing). Refuse to set up here. */\n\t| 'ephemeral'\n\t/** Erased after a stretch of not opening the app, unless it is installed. */\n\t| 'evicted-when-idle';\n\nexport interface StorageAdvice {\n\trisk: StorageRisk;\n\t/** The gesture that removes the risk, when there is one. Stable key; the\n\t *  host owns the wording and the platform-specific instructions. */\n\tremedy?: 'install-to-dock' | 'install-to-home-screen';\n\t/** Already running as an installed app, so the remedy is done. */\n\tinstalled: boolean;\n}\n\n/** Real Safari, not Chrome or Edge on macOS - all three carry \"Safari\" in the\n *  user agent, and only Safari carries none of the others' tokens. */\nfunction isSafari(ua: string): boolean {\n\treturn /Safari\\//.test(ua) && !/Chrome|Chromium|Edg\\//.test(ua) && !/OPR\\/|Android/.test(ua);\n}\n\nfunction isStandalone(): boolean {\n\tif (typeof window === 'undefined') return false;\n\tconst displayMode = window.matchMedia?.('(display-mode: standalone)')?.matches === true;\n\t// iOS and iPadOS kept their own flag, older than display-mode.\n\tconst ios = (navigator as Navigator & { standalone?: boolean }).standalone === true;\n\treturn displayMode || ios;\n}\n\n/**\n * What this browser will do with the local store, and the one gesture that\n * changes it. Call it before setting up, and again in whatever screen owns the\n * data: the advice disappears on its own once the remedy is applied.\n */\nexport function storageAdvice(): StorageAdvice {\n\tif (typeof navigator === 'undefined' || typeof window === 'undefined') {\n\t\treturn { risk: 'none', installed: false };\n\t}\n\tconst installed = isStandalone();\n\tif (!isSafari(navigator.userAgent) || installed) {\n\t\treturn { risk: 'none', installed };\n\t}\n\tconst touch = /iPhone|iPad|iPod/.test(navigator.userAgent) || navigator.maxTouchPoints > 1;\n\treturn {\n\t\trisk: 'evicted-when-idle',\n\t\tremedy: touch ? 'install-to-home-screen' : 'install-to-dock',\n\t\tinstalled: false\n\t};\n}\n","/**\n * selfstore/advanced - the pull-model store and the machinery under it.\n *\n * The simple `selfstore()` facade (package root) owns its data. This entry\n * inverts that: with createLocalStore your app owns the data and hands the\n * store a gather/apply pair - use it when state lives in your own reactive\n * model (Svelte runes, Redux, signals) and the facade's collections would be\n * a second copy. Everything here also backs `store.advanced` on the simple\n * store: same machinery, same instance, so the two styles compose.\n *\n * Also here: the durable destinations (disk file, Google Drive, WebDAV) as\n * connectable targets, the BackupTarget contract for writing your own, the\n * caches, the headless status derivation, and the functional codec for the\n * backup file format (the fluent one lives at the package root).\n */\n\n// --- The pull-model store: your app owns the data ---\nexport {\n\tcreateLocalStore,\n\ttype LocalStore,\n\ttype LocalStoreOptions,\n\ttype LocalStoreState,\n\ttype StoreError,\n\ttype Mode,\n\ttype TargetKind,\n\ttype SyncSource,\n\ttype SyncJournalEntry,\n\ttype PeerState,\n\ttype MirrorState,\n\ttype ReplicaState,\n\ttype StoreGroupConfig\n} from '../persistence/store';\n\n// --- On-device caches (the store's working copy) ---\nexport {\n\tindexedDbCache,\n\tmemoryCache,\n\tisLockableCache,\n\ttype LocalCache,\n\ttype LockableCache,\n\ttype CachedFile,\n\ttype KV\n} from '../persistence/cache';\n\n// --- Headless status: map store state to your UI copy ---\nexport {\n\tderiveStatus,\n\ttype StatusDescriptor,\n\ttype StatusInput,\n\ttype Severity,\n\ttype StorageState,\n\ttype StatusAction\n} from '../persistence/status';\n\n// --- Will this browser keep the data, and what can the user do about it ---\nexport { storageAdvice, type StorageAdvice, type StorageRisk } from '../persistence/installation';\n\n// --- The target contract (write your own destination) ---\nexport {\n\tRESERVED_STORE_MODES,\n\tisReservedStoreMode,\n\ttype BackupTarget,\n\ttype BuiltinTargetKind,\n\ttype PeerSource\n} from '../persistence/target';\n\n// --- The backup file format, functional style (fluent lives at the root) ---\nexport {\n\texportSnapshot,\n\timportSnapshot,\n\tinspect,\n\tisEncrypted,\n\tRESERVED_COLLECTION_PREFIX,\n\ttype Snapshot,\n\ttype SnapshotFile,\n\ttype Header,\n\ttype KdfParams,\n\ttype RecipientStanza,\n\ttype EncodeOptions\n} from '../selfstore';\n\n// --- Password strength policy (the store enforces it; the UI previews it) ---\nexport {\n\tcheckPasswordPolicy,\n\ttype PasswordPolicy,\n\ttype PasswordCheck,\n\ttype PasswordRequirement\n} from '../selfstore';\n\n// --- The full error contract (AuthExpiredError is what a custom target or\n//     DriveAuth THROWS to signal genuine access loss; everything else it\n//     throws is treated as transient and retried) ---\nexport {\n\tSelfstoreError,\n\tAuthExpiredError,\n\tisSelfstoreError,\n\tisAuthExpired,\n\terrorLabelKey,\n\ttype SelfstoreErrorCode\n} from '../selfstore';\n\n// --- Durable destinations (opt-in), each implementing BackupTarget ---\n// Explicit namespace objects: every member is deliberately public, so a future\n// internal helper in a target module can never leak into the contract.\nimport {\n\tconnect as fileConnect,\n\tfromSession as fileFromSession,\n\tisSupported as fileIsSupported,\n\tisOpenSupported as fileIsOpenSupported,\n\topenExisting as fileOpenExisting\n} from '../persistence/targets/file';\nimport {\n\tconnect as webdavConnect,\n\tfromSession as webdavFromSession,\n\tpeer as webdavPeer\n} from '../persistence/targets/webdav';\nimport { connect as s3Connect, fromSession as s3FromSession } from '../persistence/targets/s3';\nimport {\n\tconnect as driveConnect,\n\tfromSession as driveFromSession,\n\tpreview as drivePreview,\n\tadopt as driveAdopt,\n\tfindOrCreateOwnFile as driveFindOrCreateOwnFile,\n\tlistBackups as driveListBackups,\n\tcreateBackup as driveCreateBackup,\n\tdeleteBackup as driveDeleteBackup,\n\trenameBackup as driveRenameBackup,\n\tFILE_ID_KEY as DRIVE_FILE_ID_KEY\n} from '../persistence/targets/drive';\n\n/** Disk-file destination (File System Access, Chromium). */\nexport const fileTarget = {\n\tconnect: fileConnect,\n\tfromSession: fileFromSession,\n\tisSupported: fileIsSupported,\n\tisOpenSupported: fileIsOpenSupported,\n\t/** Let the user point at an EXISTING backup file and adopt it as the\n\t *  destination. Gate on isOpenSupported(): unlike creating, this has no\n\t *  download fallback. */\n\topenExisting: fileOpenExisting\n};\n\n/** WebDAV destination (Nextcloud, ownCloud, any server the user controls), plus\n *  `peer()`: a read-only source over another member's shared WebDAV link, so a\n *  group can share read-write without Google Drive (see store.attachPeer). */\nexport const webdavTarget = {\n\tconnect: webdavConnect,\n\tfromSession: webdavFromSession,\n\tpeer: webdavPeer\n};\n\n/** S3-compatible destination (Amazon S3, Cloudflare R2, Backblaze B2, MinIO):\n *  the browser signs each request with SigV4 and writes one object on a bucket\n *  the user controls, no vendor broker. The bucket only ever holds the same\n *  end-to-end-encrypted .selfstore bytes. */\nexport const s3Target = {\n\tconnect: s3Connect,\n\tfromSession: s3FromSession\n};\n\n/** Google Drive destination, plus the shared-file primitives (preview a specific\n *  file, adopt it as this device's backup, find-or-create the user's own file)\n *  and the backup-management ops (list the app's files with dates, create a\n *  named empty backup, rename one, delete one for good) - the raw pieces a \"my\n *  backups\" panel builds on. */\nexport const driveTarget = {\n\tconnect: driveConnect,\n\tfromSession: driveFromSession,\n\tpreview: drivePreview,\n\tadopt: driveAdopt,\n\tfindOrCreateOwnFile: driveFindOrCreateOwnFile,\n\tlistBackups: driveListBackups,\n\tcreateBackup: driveCreateBackup,\n\tdeleteBackup: driveDeleteBackup,\n\trenameBackup: driveRenameBackup,\n\tFILE_ID_KEY: DRIVE_FILE_ID_KEY\n};\n\nexport type { FileConnectOptions } from '../persistence/targets/file';\nexport type { DriveAuth, DriveOptions, DriveBackupInfo } from '../persistence/targets/drive';\nexport type {\n\tWebdavConfig,\n\tWebdavConnectOptions,\n\tWebdavPeerOptions\n} from '../persistence/targets/webdav';\nexport type { S3Config, S3ConnectOptions } from '../persistence/targets/s3';\nexport { gisDriveAuth } from '../persistence/targets/drive-auth-gis';\nexport { saveToDisk, pickFromDisk, datedName } from '../selfstore/targets/local';\n"]}
+{"version":3,"sources":["../src/persistence/installation.ts","../src/entries/advanced.ts"],"names":["connect","fromSession"],"mappings":";;;;;;;;;;;AAuCA,SAAS,SAAS,EAAA,EAAqB;AACtC,EAAA,OAAO,UAAA,CAAW,IAAA,CAAK,EAAE,CAAA,IAAK,CAAC,uBAAA,CAAwB,IAAA,CAAK,EAAE,CAAA,IAAK,CAAC,eAAA,CAAgB,IAAA,CAAK,EAAE,CAAA;AAC5F;AAEA,SAAS,YAAA,GAAwB;AAChC,EAAA,IAAI,OAAO,MAAA,KAAW,WAAA,EAAa,OAAO,KAAA;AAC1C,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,UAAA,GAAa,4BAA4B,GAAG,OAAA,KAAY,IAAA;AAEnF,EAAA,MAAM,GAAA,GAAO,UAAmD,UAAA,KAAe,IAAA;AAC/E,EAAA,OAAO,WAAA,IAAe,GAAA;AACvB;AAOO,SAAS,aAAA,GAA+B;AAC9C,EAAA,IAAI,OAAO,SAAA,KAAc,WAAA,IAAe,OAAO,WAAW,WAAA,EAAa;AACtE,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAW,KAAA,EAAM;AAAA,EACzC;AACA,EAAA,MAAM,YAAY,YAAA,EAAa;AAC/B,EAAA,IAAI,CAAC,QAAA,CAAS,SAAA,CAAU,SAAS,KAAK,SAAA,EAAW;AAChD,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,SAAA,EAAU;AAAA,EAClC;AACA,EAAA,MAAM,QAAQ,kBAAA,CAAmB,IAAA,CAAK,UAAU,SAAS,CAAA,IAAK,UAAU,cAAA,GAAiB,CAAA;AACzF,EAAA,OAAO;AAAA,IACN,IAAA,EAAM,mBAAA;AAAA,IACN,MAAA,EAAQ,QAAQ,wBAAA,GAA2B,iBAAA;AAAA,IAC3C,SAAA,EAAW;AAAA,GACZ;AACD;;;AC8DO,IAAM,UAAA,GAAa;AAAA,EACzB,OAAA,EAASA,SAAAA;AAAA,EACT,WAAA,EAAaC,aAAAA;AAAA,EACb,WAAA;AAAA,EACA,eAAA;AAAA;AAAA;AAAA;AAAA,EAIA;AACD;AAKO,IAAM,YAAA,GAAe;AAAA,EAC3B,OAAA,EAASD,QAAAA;AAAA,EACT,WAAA,EAAaC,YAAAA;AAAA,EACb;AACD;AAMO,IAAM,QAAA,GAAW;AAAA,EACvB,OAAA,EAASD,QAAAA;AAAA,EACT,WAAA,EAAaC;AACd;AAQO,IAAM,WAAA,GAAc;AAAA,EAC1B,OAAA;AAAA,EACA,WAAA;AAAA,EACA,OAAA;AAAA,EACA,KAAA;AAAA,EACA,mBAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA;AAAA,EACA;AACD","file":"advanced.js","sourcesContent":["/**\n * Whether this browser will keep the local store, and what the user can do\n * about it.\n *\n * One browser does not merely inconvenience a local-first app, it DELETES its\n * data: Safari erases script-writable storage after seven days of browser use\n * without interaction with the site. Someone who closes for three weeks comes\n * back to an empty app, and nothing warned them - which is also the moment they\n * notice it last.\n *\n * Adding the app to the Dock or the Home Screen switches its storage to\n * persistent mode, which WebKit exempts from its eviction triggers. WebKit does\n * not write anywhere that this neutralises the inactivity rule by name, so this\n * module reports an advisory, never a guarantee.\n *\n * The library ships no user-facing copy: it names the situation, the host writes\n * the sentence.\n */\n\n/** What stands between this browser and keeping the data. */\nexport type StorageRisk =\n\t/** Nothing known against it: the store survives until the user clears it. */\n\t| 'none'\n\t/** Data is erased when the tab closes (private browsing). Refuse to set up here. */\n\t| 'ephemeral'\n\t/** Erased after a stretch of not opening the app, unless it is installed. */\n\t| 'evicted-when-idle';\n\nexport interface StorageAdvice {\n\trisk: StorageRisk;\n\t/** The gesture that removes the risk, when there is one. Stable key; the\n\t *  host owns the wording and the platform-specific instructions. */\n\tremedy?: 'install-to-dock' | 'install-to-home-screen';\n\t/** Already running as an installed app, so the remedy is done. */\n\tinstalled: boolean;\n}\n\n/** Real Safari, not Chrome or Edge on macOS - all three carry \"Safari\" in the\n *  user agent, and only Safari carries none of the others' tokens. */\nfunction isSafari(ua: string): boolean {\n\treturn /Safari\\//.test(ua) && !/Chrome|Chromium|Edg\\//.test(ua) && !/OPR\\/|Android/.test(ua);\n}\n\nfunction isStandalone(): boolean {\n\tif (typeof window === 'undefined') return false;\n\tconst displayMode = window.matchMedia?.('(display-mode: standalone)')?.matches === true;\n\t// iOS and iPadOS kept their own flag, older than display-mode.\n\tconst ios = (navigator as Navigator & { standalone?: boolean }).standalone === true;\n\treturn displayMode || ios;\n}\n\n/**\n * What this browser will do with the local store, and the one gesture that\n * changes it. Call it before setting up, and again in whatever screen owns the\n * data: the advice disappears on its own once the remedy is applied.\n */\nexport function storageAdvice(): StorageAdvice {\n\tif (typeof navigator === 'undefined' || typeof window === 'undefined') {\n\t\treturn { risk: 'none', installed: false };\n\t}\n\tconst installed = isStandalone();\n\tif (!isSafari(navigator.userAgent) || installed) {\n\t\treturn { risk: 'none', installed };\n\t}\n\tconst touch = /iPhone|iPad|iPod/.test(navigator.userAgent) || navigator.maxTouchPoints > 1;\n\treturn {\n\t\trisk: 'evicted-when-idle',\n\t\tremedy: touch ? 'install-to-home-screen' : 'install-to-dock',\n\t\tinstalled: false\n\t};\n}\n","/**\n * selfstore/advanced - the pull-model store and the machinery under it.\n *\n * The simple `selfstore()` facade (package root) owns its data. This entry\n * inverts that: with createLocalStore your app owns the data and hands the\n * store a gather/apply pair - use it when state lives in your own reactive\n * model (Svelte runes, Redux, signals) and the facade's collections would be\n * a second copy. Everything here also backs `store.advanced` on the simple\n * store: same machinery, same instance, so the two styles compose.\n *\n * Also here: the durable destinations (disk file, Google Drive, WebDAV) as\n * connectable targets, the BackupTarget contract for writing your own, the\n * caches, the headless status derivation, and the functional codec for the\n * backup file format (the fluent one lives at the package root).\n */\n\n// --- The pull-model store: your app owns the data ---\nexport {\n\tcreateLocalStore,\n\ttype LocalStore,\n\ttype LocalStoreOptions,\n\ttype LocalStoreState,\n\ttype StoreError,\n\ttype Mode,\n\ttype TargetKind,\n\ttype SyncSource,\n\ttype SyncJournalEntry,\n\ttype PeerState,\n\ttype MirrorState,\n\ttype ReplicaState,\n\ttype StoreGroupConfig\n} from '../persistence/store';\n\n// --- On-device caches (the store's working copy) ---\nexport {\n\tindexedDbCache,\n\tmemoryCache,\n\tisLockableCache,\n\ttype LocalCache,\n\ttype LockableCache,\n\ttype CachedFile,\n\ttype KV\n} from '../persistence/cache';\n\n// --- Headless status: map store state to your UI copy ---\nexport {\n\tderiveStatus,\n\ttype StatusDescriptor,\n\ttype StatusInput,\n\ttype Severity,\n\ttype StorageState,\n\ttype StatusAction\n} from '../persistence/status';\n\n// --- Will this browser keep the data, and what can the user do about it ---\nexport { storageAdvice, type StorageAdvice, type StorageRisk } from '../persistence/installation';\n\n// --- The target contract (write your own destination) ---\nexport {\n\tRESERVED_STORE_MODES,\n\tisReservedStoreMode,\n\ttype BackupTarget,\n\ttype BuiltinTargetKind,\n\ttype PeerSource\n} from '../persistence/target';\n\n// --- The backup file format, functional style (fluent lives at the root) ---\nexport {\n\texportSnapshot,\n\timportSnapshot,\n\tinspect,\n\tisEncrypted,\n\tRESERVED_COLLECTION_PREFIX,\n\ttype Snapshot,\n\ttype SnapshotFile,\n\ttype Header,\n\ttype KdfParams,\n\ttype RecipientStanza,\n\ttype EncodeOptions\n} from '../selfstore';\n\n// --- Password strength policy (the store enforces it; the UI previews it) ---\nexport {\n\tcheckPasswordPolicy,\n\ttype PasswordPolicy,\n\ttype PasswordCheck,\n\ttype PasswordRequirement\n} from '../selfstore';\n\n// --- The full error contract (AuthExpiredError is what a custom target or\n//     DriveAuth THROWS to signal genuine access loss; everything else it\n//     throws is treated as transient and retried) ---\nexport {\n\tSelfstoreError,\n\tAuthExpiredError,\n\tisSelfstoreError,\n\tisAuthExpired,\n\terrorLabelKey,\n\ttype SelfstoreErrorCode\n} from '../selfstore';\n\n// --- Durable destinations (opt-in), each implementing BackupTarget ---\n// Explicit namespace objects: every member is deliberately public, so a future\n// internal helper in a target module can never leak into the contract.\nimport {\n\tconnect as fileConnect,\n\tfromSession as fileFromSession,\n\tisSupported as fileIsSupported,\n\tisOpenSupported as fileIsOpenSupported,\n\topenExisting as fileOpenExisting\n} from '../persistence/targets/file';\nimport {\n\tconnect as webdavConnect,\n\tfromSession as webdavFromSession,\n\tpeer as webdavPeer\n} from '../persistence/targets/webdav';\nimport { connect as s3Connect, fromSession as s3FromSession } from '../persistence/targets/s3';\nimport {\n\tconnect as driveConnect,\n\tfromSession as driveFromSession,\n\tpreview as drivePreview,\n\tadopt as driveAdopt,\n\tfindOrCreateOwnFile as driveFindOrCreateOwnFile,\n\tlistBackups as driveListBackups,\n\tcreateBackup as driveCreateBackup,\n\tdeleteBackup as driveDeleteBackup,\n\trenameBackup as driveRenameBackup,\n\taccount as driveAccount,\n\tFILE_ID_KEY as DRIVE_FILE_ID_KEY\n} from '../persistence/targets/drive';\n\n/** Disk-file destination (File System Access, Chromium). */\nexport const fileTarget = {\n\tconnect: fileConnect,\n\tfromSession: fileFromSession,\n\tisSupported: fileIsSupported,\n\tisOpenSupported: fileIsOpenSupported,\n\t/** Let the user point at an EXISTING backup file and adopt it as the\n\t *  destination. Gate on isOpenSupported(): unlike creating, this has no\n\t *  download fallback. */\n\topenExisting: fileOpenExisting\n};\n\n/** WebDAV destination (Nextcloud, ownCloud, any server the user controls), plus\n *  `peer()`: a read-only source over another member's shared WebDAV link, so a\n *  group can share read-write without Google Drive (see store.attachPeer). */\nexport const webdavTarget = {\n\tconnect: webdavConnect,\n\tfromSession: webdavFromSession,\n\tpeer: webdavPeer\n};\n\n/** S3-compatible destination (Amazon S3, Cloudflare R2, Backblaze B2, MinIO):\n *  the browser signs each request with SigV4 and writes one object on a bucket\n *  the user controls, no vendor broker. The bucket only ever holds the same\n *  end-to-end-encrypted .selfstore bytes. */\nexport const s3Target = {\n\tconnect: s3Connect,\n\tfromSession: s3FromSession\n};\n\n/** Google Drive destination, plus the shared-file primitives (preview a specific\n *  file, adopt it as this device's backup, find-or-create the user's own file)\n *  and the backup-management ops (list the app's files with dates, create a\n *  named empty backup, rename one, delete one for good) - the raw pieces a \"my\n *  backups\" panel builds on. `account()` names WHICH Google account holds them,\n *  because a brand name is not an address. */\nexport const driveTarget = {\n\tconnect: driveConnect,\n\tfromSession: driveFromSession,\n\tpreview: drivePreview,\n\tadopt: driveAdopt,\n\tfindOrCreateOwnFile: driveFindOrCreateOwnFile,\n\tlistBackups: driveListBackups,\n\tcreateBackup: driveCreateBackup,\n\tdeleteBackup: driveDeleteBackup,\n\trenameBackup: driveRenameBackup,\n\taccount: driveAccount,\n\tFILE_ID_KEY: DRIVE_FILE_ID_KEY\n};\n\nexport type { FileConnectOptions } from '../persistence/targets/file';\nexport type {\n\tDriveAuth,\n\tDriveOptions,\n\tDriveBackupInfo,\n\tDriveAccount\n} from '../persistence/targets/drive';\nexport type {\n\tWebdavConfig,\n\tWebdavConnectOptions,\n\tWebdavPeerOptions\n} from '../persistence/targets/webdav';\nexport type { S3Config, S3ConnectOptions } from '../persistence/targets/s3';\nexport { gisDriveAuth } from '../persistence/targets/drive-auth-gis';\nexport { saveToDisk, pickFromDisk, datedName } from '../selfstore/targets/local';\n"]}

package/dist/backups.d.ts

@@ -1,182 +1,34 @@
-import { K as KV } from './cache-ilsK3Tki.js';
-import { B as BackupTarget, L as LocalStore } from './store-CbGrlMME.js';
-import { F as FlowStore } from './machine-ALMkT3mk.js';
+import { B as BackupsHost } from './manager-DZ1c_aSS.js';
+export { a as BackupFileInfo, b as BackupOwner, c as BackupRow, d as BackupsErrorCode, e as BackupsKeys, f as BackupsManager, g as BackupsNaming, h as BackupsSnapshot, K as KnownBackups, i as createBackupsManager } from './manager-DZ1c_aSS.js';
+import { D as DriveOptions } from './drive-CTYvGg_7.js';
+import './cache-ilsK3Tki.js';
+import './store-BiQ-BuVl.js';
 import './sync.js';
+import './machine-ALMkT3mk.js';
 
-/** What the destination reports about a listed file (one cheap metadata call). */
-interface BackupFileInfo {
-    id: string;
-    name: string;
-    /** RFC 3339 last-write timestamp, when the destination reports one. */
-    modifiedTime: string | null;
-}
-/** The destination I/O the manager drives - the host wires its own adapter
- *  (e.g. over the Drive target ops). Every method may throw; the manager turns
- *  failures into stable error codes. */
-interface BackupsHost {
-    /** The target kind the managed files live on (e.g. 'drive'): the manager
-     *  only stamps an active file while the store is attached to this kind. */
-    kind: string;
-    /** The kv key the attached file id is persisted under (the same one the
-     *  target's connect path reads first). */
-    activeIdKey: string;
-    /** List candidate backup files on the account. The manager applies the
-     *  naming rules on what comes back; internal files simply do not match. */
-    list(): Promise<BackupFileInfo[]>;
-    /** A target over a FIXED file id - never re-resolved by name. The fixed id
-     *  is what keeps two backups from silently merging mid-switch. */
-    open(fileId: string): BackupTarget;
-    /** Create an empty file under this name and return its id. Refuse a name
-     *  the account already carries (a duplicate poisons find-by-name). */
-    create(fileName: string): Promise<{
-        fileId: string;
-    }>;
-    /** Delete a file for good. */
-    remove(fileId: string): Promise<void>;
-    /** Rename a file in place (metadata only: the id must not change). */
-    rename?(fileId: string, fileName: string): Promise<void>;
-    /** Find (or create) the PERSONAL file by its canonical name, ignoring any
-     *  currently adopted id. Null when the user backs out of the session. */
-    findOrCreatePersonal(): Promise<{
-        fileId: string;
-        created: boolean;
-    } | null>;
-    /** Make sure a usable session exists before a remote call (re-consent when
-     *  it lapsed). False = the user refused; the gesture aborts as 'cancelled'.
-     *  Absent = sessions are the target's own business. */
-    ensureSession?(): Promise<boolean>;
-    /** Resolve the owner label of a file this account does not own, for the
-     *  shared registry ("shared by X"). Best-effort. */
-    fileOwner?(fileId: string): Promise<{
-        email: string | null;
-        name: string | null;
-    } | null>;
-    /** File ids that must never enter the registry even though the store may
-     *  attach them (e.g. a sharing engine's published copy file). */
-    excludedFileIds?(): Promise<(string | null | undefined)[]>;
-}
-/** How backup files are named on the destination. */
-interface BackupsNaming {
-    /** The personal, unnamed file ("App.zip"). Its label reads as null. */
-    canonicalName: string;
-    /** label -> file name. Default: "Stem (label).ext" derived from
-     *  canonicalName ("App.zip" + "family" -> "App (family).zip"). */
-    namedFileFor?(label: string): string;
-    /** file name -> parsed label; null = the personal file; undefined = not one
-     *  of ours (dropped from listings). Default matches the default namedFileFor. */
-    parseLabel?(name: string): string | null | undefined;
-}
-/** The kv keys the manager persists under - override to keep a pre-existing
- *  install's records. */
-interface BackupsKeys {
-    /** The known-backups registry. */
-    registry?: string;
-    /** fileId -> encrypted? map. */
-    encrypted?: string;
-    /** fileId -> shared? map. */
-    shared?: string;
-    /** Set while the ACTIVE file is not the personal one (another account's). */
-    joined?: string;
-    /** Cached owner label of that file. */
-    owner?: string;
-}
-/** Every backup this device has connected to: its own personal file and each
- *  OTHER account's file it was let into. Isolated snapshots, all of them. */
-interface KnownBackups {
-    personalFileId: string | null;
-    shared: {
-        fileId: string;
-        ownerEmail: string | null;
-        ownerName: string | null;
-    }[];
-}
-/** One row of the "my backups" list: a file this account owns. */
-interface BackupRow {
-    fileId: string;
-    name: string;
-    /** Parsed display label; null for the personal, unnamed file. */
-    label: string | null;
-    /** Last-write time, epoch ms (null when the destination did not say). */
-    modifiedAt: number | null;
-    /** true/false once known (opened, created or probed); null until then. */
-    encrypted: boolean | null;
-    /** true/false once learned (while this file was the active one); null
-     *  until then. A share link existing is the shared state. */
-    shared: boolean | null;
-}
-/** The owner label of a joined (another account's) file. */
-interface BackupOwner {
-    email: string | null;
-    name: string | null;
-}
-/** Stable failure codes; the host maps them to its own copy. */
-type BackupsErrorCode = 'cancelled' | 'gone' | 'failed';
-interface BackupsSnapshot {
-    registry: KnownBackups;
-    /** The file currently attached, when the store is on the managed kind. */
-    activeFileId: string | null;
-    /** The active file is not the personal one (someone else's). */
-    joined: boolean;
-    /** Who owns the joined file, when known. */
-    owner: BackupOwner | null;
-    /** The last gesture's failure, or null. Reset at each gesture start. */
-    lastError: BackupsErrorCode | null;
-}
-interface BackupsManager extends FlowStore<BackupsSnapshot> {
-    /** Boot: load registry + joined/owner from kv and stamp the active file.
-     *  Kv-only, no destination call. */
-    hydrate(): Promise<void>;
-    /** Re-read the registry and restamp the active file. Kv-only, cheap. */
-    refresh(): Promise<void>;
-    /** After an attach the manager did not make (a connect widget, a join):
-     *  record the now-active file in the registry and restamp joined/owner. */
-    markActive(fileId: string): Promise<void>;
-    /** Live list of this account's own files, per the naming rules, decorated
-     *  with the learned memories. One destination listing call. */
-    list(): Promise<BackupRow[]>;
-    /** Learn a listed file's encrypted bit without opening it for real: one
-     *  download + header read, remembered for good. Null when unreachable. */
-    probeEncryption(fileId: string): Promise<boolean | null>;
-    /** Record the ACTIVE file's live share state, keyed by file id, so its row
-     *  stays truthful after a switch away. */
-    noteShared(fileId: string, shared: boolean): Promise<void>;
-    /** Open a known backup: an isolated snapshot replaces the local data.
-     *  'encrypted' = collect its passphrase and call again with it. A file the
-     *  destination reports GONE is pruned from the registry (lastError 'gone'). */
-    openBackup(fileId: string, passphrase?: string | null): Promise<'ok' | 'encrypted' | 'failed'>;
-    /** Open (or create blank) the personal file. */
-    openPersonal(passphrase?: string | null): Promise<'ok' | 'encrypted' | 'failed'>;
-    /** Create a brand-new empty named backup and open it (starts blank - never
-     *  seeded from the currently loaded file). */
-    createNamed(label: string): Promise<'ok' | 'failed'>;
-    /** Record a file in the SHARED registry under the sharer's label, without
-     *  opening it. For a joined portfolio's dedicated wallet: the file may live
-     *  on this very account, yet it presents as "shared by X", never as mine. */
-    registerShared(fileId: string, owner: BackupOwner): Promise<void>;
-    /** Create a joined portfolio's dedicated wallet: a file under the given
-     *  name (outside the own-files naming on purpose), attached BLANK - never
-     *  seeded from the previously loaded silo - and recorded in the shared
-     *  registry under the sharer's label. The host stages the shared content
-     *  afterwards (restore the projection, then save). */
-    createShared(fileName: string, owner: BackupOwner): Promise<'ok' | 'failed'>;
-    /** Rename a file in place (id unchanged, so renaming the ACTIVE file never
-     *  detaches it). The host target refuses a name already carried. */
-    renameBackup(fileId: string, label: string): Promise<'ok' | 'failed'>;
-    /** Delete a file for good. Deleting the ACTIVE one detaches first (the app
-     *  goes device-only, local data stays), so nothing writes mid-delete. */
-    deleteBackup(fileId: string): Promise<boolean>;
-    /** Drop a KNOWN shared (another account's) file from this device's
-     *  registry. Forgetting only - the owner's file is never touched. */
-    forgetShared(fileId: string): Promise<void>;
-    /** The file name a label produces (the create form's preview line). */
-    fileNameFor(label: string): string;
-}
-declare function createBackupsManager(deps: {
-    store: LocalStore;
-    kv: KV;
-    host: BackupsHost;
-    naming: BackupsNaming;
-    keys?: BackupsKeys;
-}): BackupsManager;
+interface DriveBackupsHostOptions extends DriveOptions {
+    /** Narrow the listing server-side to names containing this fragment (the
+     *  app's own stem, typically). The manager still applies its naming rules on
+     *  what comes back, so this is a bandwidth hint and never a filter to rely
+     *  on for correctness. Default: the whole visible listing. */
+    nameContains?: string;
+}
+/**
+ * The Drive destination as a `BackupsHost`, ready for `createBackupsManager`
+ * (and therefore for `<selfstore-backups>`).
+ *
+ * ```ts
+ * const manager = createBackupsManager({
+ *   store: store.engine,
+ *   kv: store.kv,
+ *   host: driveBackupsHost({ auth, kv: store.kv, fileName: 'app.zip' }),
+ *   naming: { canonicalName: 'app.zip' }
+ * });
+ * ```
+ *
+ * The `drive.file` scope already narrows what a listing can see to the files
+ * this app created or was handed, so nothing here can enumerate a user's Drive.
+ */
+declare function driveBackupsHost(opts: DriveBackupsHostOptions): BackupsHost;
 
-export { type BackupFileInfo, type BackupOwner, type BackupRow, type BackupsErrorCode, type BackupsHost, type BackupsKeys, type BackupsManager, type BackupsNaming, type BackupsSnapshot, type KnownBackups, createBackupsManager };
+export { BackupsHost, type DriveBackupsHostOptions, driveBackupsHost };

package/dist/backups.js

@@ -1,5 +1,42 @@
-import { makeMachine } from './chunk-OIAXYI35.js';
-import './chunk-SFF7KKM4.js';
+import { makeMachine } from './chunk-W22V5CRM.js';
+import { FILE_ID_KEY, findOrCreateOwnFile, renameBackup, deleteBackup, createBackup, preview, listBackups } from './chunk-J5MFXJU6.js';
+import './chunk-MGDXR3RB.js';
+import './chunk-O3Y6FORN.js';
+import './chunk-3OBJOMQ2.js';
+
+// src/backups/drive-host.ts
+function driveBackupsHost(opts) {
+  return {
+    kind: "drive",
+    activeIdKey: FILE_ID_KEY,
+    async list() {
+      return listBackups({ auth: opts.auth, nameContains: opts.nameContains });
+    },
+    open(fileId) {
+      return preview(opts, fileId);
+    },
+    async create(fileName) {
+      return createBackup({ auth: opts.auth, fileName });
+    },
+    async remove(fileId) {
+      return deleteBackup({ auth: opts.auth, fileId });
+    },
+    async rename(fileId, fileName) {
+      return renameBackup({ auth: opts.auth, fileId, fileName });
+    },
+    async findOrCreatePersonal() {
+      return findOrCreateOwnFile(opts);
+    },
+    async ensureSession() {
+      try {
+        await opts.auth.token();
+        return true;
+      } catch {
+        return opts.auth.reconnect();
+      }
+    }
+  };
+}
 
 // src/backups/manager.ts
 var DEFAULT_KEYS = {
@@ -355,6 +392,6 @@ function createBackupsManager(deps) {
   };
 }
 
-export { createBackupsManager };
+export { createBackupsManager, driveBackupsHost };
 //# sourceMappingURL=backups.js.map
 //# sourceMappingURL=backups.js.map