selfstore 1.8.17 → 1.8.19

package/dist/flows.d.ts

@@ -1,11 +1,11 @@
-import { b as ConnectKind, S as StoreLike, C as ConnectTargets } from './connect-BaWYvB1w.js';
-export { c as ConnectFlow, a as ConnectFlowOptions, d as ConnectFlowOutcome, e as ConnectResolution, f as ConnectSnapshot, g as ConnectStep, h as Connector, F as FlowHost, R as ResumeOffer, i as connectFlow } from './connect-BaWYvB1w.js';
-import { S as StoreError, k as ReplicaState, B as BackupTarget } from './store-CCe8b5Eg.js';
+import { b as ConnectKind, S as StoreLike, C as ConnectTargets } from './connect-BTVzRJY8.js';
+export { c as ConnectFlow, a as ConnectFlowOptions, d as ConnectFlowOutcome, e as ConnectResolution, f as ConnectSnapshot, g as ConnectStep, h as Connector, F as FlowHost, R as ResumeOffer, i as connectFlow } from './connect-BTVzRJY8.js';
+import { S as StoreError, k as ReplicaState, B as BackupTarget } from './store-Cs6QIzzG.js';
 import { F as FlowStore } from './machine-ALMkT3mk.js';
 export { w as withDeadline } from './machine-ALMkT3mk.js';
-import { W as WebdavConfig, S as S3Config } from './s3-CCE6lc_U.js';
+import { W as WebdavConfig, S as S3Config } from './s3-0qqIyphl.js';
 import './cache-ilsK3Tki.js';
-import './drive-BUPsPaIu.js';
+import './drive-CY_Vsj7V.js';
 import './sync.js';
 
 /** The one replica this flow manages, as its id on the engine. */

package/dist/households.d.ts

@@ -1,4 +1,4 @@
-import { B as BackupTarget, P as PeerSource, L as LocalStore } from './store-CCe8b5Eg.js';
+import { B as BackupTarget, P as PeerSource, L as LocalStore } from './store-Cs6QIzzG.js';
 import { K as KV } from './cache-ilsK3Tki.js';
 import './sync.js';
 

package/dist/index.d.ts

@@ -1,12 +1,12 @@
-import { o as Snapshot, E as EncodeOptions, H as Header, f as PasswordPolicy, B as BackupTarget, r as StatusDescriptor, S as StoreError, c as LocalStoreState, L as LocalStore } from './store-CCe8b5Eg.js';
-export { d as Mode, e as PasswordCheck, g as PasswordRequirement, l as SelfstoreError, m as SelfstoreErrorCode, n as Severity, p as SnapshotFile, q as StatusAction, t as StorageState, T as TargetKind, x as checkPasswordPolicy, C as errorLabelKey, G as isSelfstoreError } from './store-CCe8b5Eg.js';
+import { o as Snapshot, E as EncodeOptions, H as Header, f as PasswordPolicy, B as BackupTarget, r as StatusDescriptor, S as StoreError, c as LocalStoreState, L as LocalStore } from './store-Cs6QIzzG.js';
+export { d as Mode, e as PasswordCheck, g as PasswordRequirement, l as SelfstoreError, m as SelfstoreErrorCode, n as Severity, p as SnapshotFile, q as StatusAction, t as StorageState, T as TargetKind, x as checkPasswordPolicy, C as errorLabelKey, G as isSelfstoreError } from './store-Cs6QIzzG.js';
 import { L as LocalCache, K as KV } from './cache-ilsK3Tki.js';
 import { SyncConfig } from './sync.js';
-import { R as ResumeOffer, C as ConnectTargets } from './connect-BaWYvB1w.js';
-import { f as BackupsManager } from './manager-CaMd6T1T.js';
-import { a as DriveAuth } from './drive-BUPsPaIu.js';
-import { W as WebdavConfig, S as S3Config } from './s3-CCE6lc_U.js';
-export { f as changePassword, g as gisDriveAuth, p as pickFromDisk, s as saveToDisk } from './local-Dt1hYNG4.js';
+import { R as ResumeOffer, C as ConnectTargets } from './connect-BTVzRJY8.js';
+import { f as BackupsManager } from './manager-DhoIbJyg.js';
+import { a as DriveAuth } from './drive-CY_Vsj7V.js';
+import { W as WebdavConfig, S as S3Config } from './s3-0qqIyphl.js';
+export { f as changePassword, g as gisDriveAuth, p as pickFromDisk, s as saveToDisk } from './local-Dh6eGiK9.js';
 import './machine-ALMkT3mk.js';
 
 declare const BACKUP_EXTENSION = ".zip";

package/dist/index.js

@@ -1,6 +1,5 @@
-import { indexedDbCache, memoryCache, gisDriveAuth, isLockableCache, createLocalStore } from './chunk-3BPGPSPX.js';
-export { gisDriveAuth } from './chunk-3BPGPSPX.js';
-import './chunk-SKWHKM25.js';
+import { indexedDbCache, memoryCache, gisDriveAuth, isLockableCache, createLocalStore } from './chunk-TQH7ZYID.js';
+export { gisDriveAuth } from './chunk-TQH7ZYID.js';
 import { saveToDisk } from './chunk-DCEXWSM6.js';
 export { pickFromDisk, saveToDisk } from './chunk-DCEXWSM6.js';
 import { fromSession as fromSession$1, fromSession2, isSupported, connect3, connect2, connect } from './chunk-TKWU52LK.js';
@@ -12,6 +11,7 @@ import './chunk-QBCU7OOP.js';
 import './chunk-O3Y6FORN.js';
 import { SelfstoreError } from './chunk-3OBJOMQ2.js';
 export { SelfstoreError, errorLabelKey, isSelfstoreError } from './chunk-3OBJOMQ2.js';
+import './chunk-SKWHKM25.js';
 
 // src/simple/simple.ts
 function idFieldOf(sync, collection) {

package/dist/{local-Dt1hYNG4.d.ts → local-Dh6eGiK9.d.ts}

@@ -1,5 +1,5 @@
-import { o as Snapshot, E as EncodeOptions, H as Header } from './store-CCe8b5Eg.js';
-import { a as DriveAuth } from './drive-BUPsPaIu.js';
+import { o as Snapshot, E as EncodeOptions, H as Header } from './store-Cs6QIzzG.js';
+import { a as DriveAuth } from './drive-CY_Vsj7V.js';
 
 /** Serialize a snapshot to a portable backup blob (compressed; encrypted if a password is given). */
 declare function exportSnapshot(snapshot: Snapshot, opts: EncodeOptions): Promise<Blob>;

package/dist/{manager-CaMd6T1T.d.ts → manager-DhoIbJyg.d.ts}

@@ -1,5 +1,5 @@
 import { K as KV } from './cache-ilsK3Tki.js';
-import { B as BackupTarget, L as LocalStore } from './store-CCe8b5Eg.js';
+import { B as BackupTarget, L as LocalStore } from './store-Cs6QIzzG.js';
 import { F as FlowStore } from './machine-ALMkT3mk.js';
 
 /** What the destination reports about a listed file (one cheap metadata call). */

package/dist/passkey.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Open a store with the device instead of the keyboard: Face, fingerprint or
+ * Windows Hello in place of typing the password.
+ *
+ * WHAT IT IS. A platform passkey carrying the WebAuthn PRF extension (FIDO2
+ * hmac-secret) yields a stable 32-byte secret - deterministic for that
+ * credential and a fixed per-app salt, and it never leaves the authenticator.
+ * That secret becomes an AES-256-GCM key, under which this module seals the
+ * app's own secret (typically the backup password). Unlocking is then: user
+ * verification -> PRF secret -> the password in the clear, in memory.
+ *
+ * WHAT IT IS NOT. It does not replace the password, it carries it. The
+ * password keeps opening everything, on every device, forever; this is a
+ * convenience bound to ONE browser profile on ONE machine. Losing the passkey
+ * costs a typed password, never data. That asymmetry is deliberate: a second
+ * independent key to the data would widen the blast radius of a stolen device,
+ * which is the opposite of what a locked cache is for.
+ *
+ * THE PROPERTY IT PRESERVES. The sealed blob is useless on its own: a copy of
+ * the browser profile does not open it, because the PRF secret lives in the
+ * authenticator and demands user verification. That is exactly the guarantee a
+ * lock-mode cache exists for, so enrolling does not weaken it.
+ *
+ * OPT-IN BY CONSTRUCTION. Nothing here runs unless an app calls
+ * `passkeyUnlock()`. An app that never does simply has no such feature, and an
+ * app that does still decides when to offer it - the recommended shape is an
+ * explicit control the user turns on, and can turn off again with `forget()`.
+ *
+ * Requires the PRF extension: recent Chrome/Edge, Safari 18+, recent Android;
+ * inside a native WebView it depends on the system WebView version. Nothing
+ * trusts that blindly - `available()` and `enroll()` feature-detect at runtime
+ * and FAIL CLOSED, so the option is only ever usable where a real secret comes
+ * back. Dependency-free, and guarded for SSR and no-WebAuthn environments.
+ */
+/** How the passkey is presented by the platform, and what it protects. */
+interface PasskeyUnlockOptions {
+    /**
+     * Shown by the operating system's passkey prompt and stored with the
+     * credential. The application name, as a person would read it.
+     */
+    appName: string;
+    /**
+     * Domain separator for the PRF evaluation - NOT a secret, and it may be a
+     * constant: the credential's own secret is what makes the derived key
+     * unique. Use a stable per-app string. Changing it rotates every
+     * passkey-derived key at once, which orphans every existing enrolment.
+     */
+    salt: string;
+    /** Where the sealed secret is kept on this device (default `selfstore.passkey`). */
+    storageKey?: string;
+}
+/** The device-unlock facade. Every method is safe to call anywhere: outside a
+ *  browser, or without WebAuthn, they report unavailable rather than throw. */
+interface PasskeyUnlock {
+    /**
+     * Whether a user-verifying platform authenticator exists at all. Necessary
+     * but NOT sufficient: only an actual `enroll()` proves the PRF extension
+     * works here. Use it to decide whether to show the control, not to promise
+     * that it will succeed.
+     */
+    available(): Promise<boolean>;
+    /** Whether this device currently holds a sealed secret to reveal. */
+    enrolled(): boolean;
+    /**
+     * Create a platform passkey and seal `secret` behind it. `false` when the
+     * user cancelled, or when PRF did not yield a key here - fail closed, the
+     * host keeps its password prompt and should say so rather than pretend.
+     */
+    enroll(secret: string): Promise<boolean>;
+    /**
+     * Ask for Face / fingerprint / Hello and return the sealed secret. `null`
+     * on cancel, on a missing enrolment, or on any failure; the host then falls
+     * back to asking for the password. Never throws.
+     */
+    reveal(): Promise<string | null>;
+    /**
+     * Drop the sealed secret from this device. The platform credential itself
+     * is NOT deleted - the operating system owns it, and only the user can
+     * remove it from their passkey manager. Say that in the interface rather
+     * than implying a full erasure.
+     */
+    forget(): void;
+}
+declare function passkeyUnlock(options: PasskeyUnlockOptions): PasskeyUnlock;
+
+export { type PasskeyUnlock, type PasskeyUnlockOptions, passkeyUnlock };

package/dist/passkey.js

@@ -0,0 +1,152 @@
+// src/passkey/passkey.ts
+var DEFAULT_STORAGE_KEY = "selfstore.passkey";
+var PRF_BYTES = 32;
+function toB64(bytes) {
+  const b = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let s = "";
+  for (const byte of b) s += String.fromCharCode(byte);
+  return btoa(s);
+}
+function fromB64(s) {
+  const bin = atob(s);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function webauthnUsable() {
+  return typeof window !== "undefined" && !!window.PublicKeyCredential && typeof navigator !== "undefined" && !!navigator.credentials && typeof crypto !== "undefined" && !!crypto.subtle;
+}
+function prfSecret(credential) {
+  const first = credential?.getClientExtensionResults()?.prf?.results?.first;
+  if (!first) return null;
+  const bytes = new Uint8Array(first);
+  return bytes.length === PRF_BYTES ? bytes : null;
+}
+function sealKey(secret) {
+  return crypto.subtle.importKey("raw", secret, "AES-GCM", false, [
+    "encrypt",
+    "decrypt"
+  ]);
+}
+function passkeyUnlock(options) {
+  const storageKey = options.storageKey ?? DEFAULT_STORAGE_KEY;
+  const prfSalt = new TextEncoder().encode(options.salt);
+  function read() {
+    try {
+      if (typeof localStorage === "undefined") return null;
+      const raw = localStorage.getItem(storageKey);
+      if (!raw) return null;
+      const parsed = JSON.parse(raw);
+      const complete = typeof parsed?.credentialId === "string" && typeof parsed?.iv === "string" && typeof parsed?.sealed === "string";
+      return complete ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+  function write(entry) {
+    try {
+      if (typeof localStorage === "undefined") return;
+      if (entry) localStorage.setItem(storageKey, JSON.stringify(entry));
+      else localStorage.removeItem(storageKey);
+    } catch {
+    }
+  }
+  async function derive(credentialId) {
+    try {
+      const assertion = await navigator.credentials.get({
+        publicKey: {
+          challenge: crypto.getRandomValues(new Uint8Array(32)),
+          allowCredentials: credentialId ? [{ type: "public-key", id: fromB64(credentialId) }] : [],
+          userVerification: "required",
+          extensions: { prf: { eval: { first: prfSalt } } },
+          timeout: 6e4
+        }
+      });
+      return prfSecret(assertion);
+    } catch {
+      return null;
+    }
+  }
+  async function create() {
+    const credential = await navigator.credentials.create({
+      publicKey: {
+        challenge: crypto.getRandomValues(new Uint8Array(32)),
+        rp: { name: options.appName, id: location.hostname },
+        user: {
+          id: crypto.getRandomValues(new Uint8Array(16)),
+          name: options.appName,
+          displayName: options.appName
+        },
+        pubKeyCredParams: [
+          { type: "public-key", alg: -7 },
+          { type: "public-key", alg: -257 }
+        ],
+        authenticatorSelection: {
+          authenticatorAttachment: "platform",
+          userVerification: "required",
+          residentKey: "required"
+        },
+        extensions: { prf: { eval: { first: prfSalt } } },
+        timeout: 6e4
+      }
+    });
+    if (!credential) return null;
+    const credentialId = toB64(credential.rawId);
+    const secret = prfSecret(credential) ?? await derive(credentialId);
+    return secret ? { credentialId, secret } : null;
+  }
+  return {
+    async available() {
+      try {
+        if (!webauthnUsable()) return false;
+        return await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();
+      } catch {
+        return false;
+      }
+    },
+    enrolled() {
+      return read() !== null;
+    },
+    async enroll(secret) {
+      if (!webauthnUsable()) return false;
+      try {
+        const created = await create();
+        if (!created) return false;
+        const iv = crypto.getRandomValues(new Uint8Array(12));
+        const sealed = await crypto.subtle.encrypt(
+          { name: "AES-GCM", iv },
+          await sealKey(created.secret),
+          new TextEncoder().encode(secret)
+        );
+        write({ credentialId: created.credentialId, iv: toB64(iv), sealed: toB64(sealed) });
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    async reveal() {
+      const entry = read();
+      if (!entry || !webauthnUsable()) return null;
+      const secret = await derive(entry.credentialId);
+      if (!secret) return null;
+      try {
+        const opened = await crypto.subtle.decrypt(
+          { name: "AES-GCM", iv: fromB64(entry.iv) },
+          await sealKey(secret),
+          fromB64(entry.sealed)
+        );
+        return new TextDecoder().decode(opened);
+      } catch {
+        write(null);
+        return null;
+      }
+    },
+    forget() {
+      write(null);
+    }
+  };
+}
+
+export { passkeyUnlock };
+//# sourceMappingURL=passkey.js.map
+//# sourceMappingURL=passkey.js.map

package/dist/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/passkey/passkey.ts"],"names":[],"mappings":";AAiGA,IAAM,mBAAA,GAAsB,mBAAA;AAC5B,IAAM,SAAA,GAAY,EAAA;AAElB,SAAS,MAAM,KAAA,EAAyC;AACvD,EAAA,MAAM,IAAI,KAAA,YAAiB,UAAA,GAAa,KAAA,GAAQ,IAAI,WAAW,KAAK,CAAA;AACpE,EAAA,IAAI,CAAA,GAAI,EAAA;AACR,EAAA,KAAA,MAAW,IAAA,IAAQ,CAAA,EAAG,CAAA,IAAK,MAAA,CAAO,aAAa,IAAI,CAAA;AACnD,EAAA,OAAO,KAAK,CAAC,CAAA;AACd;AAEA,SAAS,QAAQ,CAAA,EAAoC;AACpD,EAAA,MAAM,GAAA,GAAM,KAAK,CAAC,CAAA;AAClB,EAAA,MAAM,GAAA,GAAM,IAAI,UAAA,CAAW,GAAA,CAAI,MAAM,CAAA;AACrC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,CAAA,EAAA,EAAK,GAAA,CAAI,CAAC,CAAA,GAAI,GAAA,CAAI,UAAA,CAAW,CAAC,CAAA;AAC9D,EAAA,OAAO,GAAA;AACR;AAEA,SAAS,cAAA,GAA0B;AAClC,EAAA,OACC,OAAO,MAAA,KAAW,WAAA,IAClB,CAAC,CAAC,MAAA,CAAO,uBACT,OAAO,SAAA,KAAc,eACrB,CAAC,CAAC,UAAU,WAAA,IACZ,OAAO,WAAW,WAAA,IAClB,CAAC,CAAC,MAAA,CAAO,MAAA;AAEX;AAEA,SAAS,UAAU,UAAA,EAA2D;AAC7E,EAAA,MAAM,KAAA,GAAS,UAAA,EAAY,yBAAA,EAA0B,EAA8B,KAAK,OAAA,EACrF,KAAA;AACH,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,KAAK,CAAA;AAClC,EAAA,OAAO,KAAA,CAAM,MAAA,KAAW,SAAA,GAAY,KAAA,GAAQ,IAAA;AAC7C;AAQA,SAAS,QAAQ,MAAA,EAAwC;AACxD,EAAA,OAAO,OAAO,MAAA,CAAO,SAAA,CAAU,KAAA,EAAO,MAAA,EAAwB,WAAW,KAAA,EAAO;AAAA,IAC/E,SAAA;AAAA,IACA;AAAA,GACA,CAAA;AACF;AAEO,SAAS,cAAc,OAAA,EAA8C;AAC3E,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,mBAAA;AACzC,EAAA,MAAM,UAAU,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAQ,IAAI,CAAA;AAErD,EAAA,SAAS,IAAA,GAA+B;AACvC,IAAA,IAAI;AACH,MAAA,IAAI,OAAO,YAAA,KAAiB,WAAA,EAAa,OAAO,IAAA;AAChD,MAAA,MAAM,GAAA,GAAM,YAAA,CAAa,OAAA,CAAQ,UAAU,CAAA;AAC3C,MAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,MAAA,MAAM,QAAA,GACL,OAAO,MAAA,EAAQ,YAAA,KAAiB,QAAA,IAChC,OAAO,MAAA,EAAQ,EAAA,KAAO,QAAA,IACtB,OAAO,MAAA,EAAQ,MAAA,KAAW,QAAA;AAC3B,MAAA,OAAO,WAAW,MAAA,GAAS,IAAA;AAAA,IAC5B,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,IAAA;AAAA,IACR;AAAA,EACD;AAEA,EAAA,SAAS,MAAM,KAAA,EAAqC;AACnD,IAAA,IAAI;AACH,MAAA,IAAI,OAAO,iBAAiB,WAAA,EAAa;AACzC,MAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,YAAY,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,WAC5D,YAAA,CAAa,WAAW,UAAU,CAAA;AAAA,IACxC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACD;AAMA,EAAA,eAAe,OAAO,YAAA,EAAmD;AACxE,IAAA,IAAI;AACH,MAAA,MAAM,SAAA,GAAa,MAAM,SAAA,CAAU,WAAA,CAAY,GAAA,CAAI;AAAA,QAClD,SAAA,EAAW;AAAA,UACV,WAAW,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAAA,UACpD,gBAAA,EAAkB,YAAA,GACf,CAAC,EAAE,IAAA,EAAM,YAAA,EAAc,EAAA,EAAI,OAAA,CAAQ,YAAY,CAAA,EAAmB,CAAA,GAClE,EAAC;AAAA,UACJ,gBAAA,EAAkB,UAAA;AAAA,UAClB,UAAA,EAAY,EAAE,GAAA,EAAK,EAAE,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,EAAE,EAAE;AAAA,UAChD,OAAA,EAAS;AAAA;AACV,OACA,CAAA;AACD,MAAA,OAAO,UAAU,SAAS,CAAA;AAAA,IAC3B,CAAA,CAAA,MAAQ;AACP,MAAA,OAAO,IAAA;AAAA,IACR;AAAA,EACD;AAEA,EAAA,eAAe,MAAA,GAAuE;AACrF,IAAA,MAAM,UAAA,GAAc,MAAM,SAAA,CAAU,WAAA,CAAY,MAAA,CAAO;AAAA,MACtD,SAAA,EAAW;AAAA,QACV,WAAW,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAAA,QACpD,IAAI,EAAE,IAAA,EAAM,QAAQ,OAAA,EAAS,EAAA,EAAI,SAAS,QAAA,EAAS;AAAA,QACnD,IAAA,EAAM;AAAA,UACL,IAAI,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAAA,UAC7C,MAAM,OAAA,CAAQ,OAAA;AAAA,UACd,aAAa,OAAA,CAAQ;AAAA,SACtB;AAAA,QACA,gBAAA,EAAkB;AAAA,UACjB,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,EAAA,EAAG;AAAA,UAC9B,EAAE,IAAA,EAAM,YAAA,EAAc,GAAA,EAAK,IAAA;AAAK,SACjC;AAAA,QACA,sBAAA,EAAwB;AAAA,UACvB,uBAAA,EAAyB,UAAA;AAAA,UACzB,gBAAA,EAAkB,UAAA;AAAA,UAClB,WAAA,EAAa;AAAA,SACd;AAAA,QACA,UAAA,EAAY,EAAE,GAAA,EAAK,EAAE,MAAM,EAAE,KAAA,EAAO,OAAA,EAAQ,EAAE,EAAE;AAAA,QAChD,OAAA,EAAS;AAAA;AACV,KACA,CAAA;AACD,IAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AACxB,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,UAAA,CAAW,KAAK,CAAA;AAG3C,IAAA,MAAM,SAAS,SAAA,CAAU,UAAU,CAAA,IAAM,MAAM,OAAO,YAAY,CAAA;AAClE,IAAA,OAAO,MAAA,GAAS,EAAE,YAAA,EAAc,MAAA,EAAO,GAAI,IAAA;AAAA,EAC5C;AAEA,EAAA,OAAO;AAAA,IACN,MAAM,SAAA,GAA8B;AACnC,MAAA,IAAI;AACH,QAAA,IAAI,CAAC,cAAA,EAAe,EAAG,OAAO,KAAA;AAC9B,QAAA,OAAO,MAAM,MAAA,CAAO,mBAAA,CAAoB,6CAAA,EAA8C;AAAA,MACvF,CAAA,CAAA,MAAQ;AACP,QAAA,OAAO,KAAA;AAAA,MACR;AAAA,IACD,CAAA;AAAA,IAEA,QAAA,GAAoB;AACnB,MAAA,OAAO,MAAK,KAAM,IAAA;AAAA,IACnB,CAAA;AAAA,IAEA,MAAM,OAAO,MAAA,EAAkC;AAC9C,MAAA,IAAI,CAAC,cAAA,EAAe,EAAG,OAAO,KAAA;AAC9B,MAAA,IAAI;AACH,QAAA,MAAM,OAAA,GAAU,MAAM,MAAA,EAAO;AAC7B,QAAA,IAAI,CAAC,SAAS,OAAO,KAAA;AACrB,QAAA,MAAM,KAAK,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AACpD,QAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA;AAAA,UAClC,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG;AAAA,UACtB,MAAM,OAAA,CAAQ,OAAA,CAAQ,MAAM,CAAA;AAAA,UAC5B,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM;AAAA,SAChC;AACA,QAAA,KAAA,CAAM,EAAE,YAAA,EAAc,OAAA,CAAQ,YAAA,EAAc,EAAA,EAAI,KAAA,CAAM,EAAE,CAAA,EAAG,MAAA,EAAQ,KAAA,CAAM,MAAM,CAAA,EAAG,CAAA;AAClF,QAAA,OAAO,IAAA;AAAA,MACR,CAAA,CAAA,MAAQ;AACP,QAAA,OAAO,KAAA;AAAA,MACR;AAAA,IACD,CAAA;AAAA,IAEA,MAAM,MAAA,GAAiC;AACtC,MAAA,MAAM,QAAQ,IAAA,EAAK;AACnB,MAAA,IAAI,CAAC,KAAA,IAAS,CAAC,cAAA,IAAkB,OAAO,IAAA;AACxC,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA,CAAM,YAAY,CAAA;AAC9C,MAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,MAAA,IAAI;AACH,QAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,MAAA,CAAO,OAAA;AAAA,UAClC,EAAE,IAAA,EAAM,SAAA,EAAW,IAAI,OAAA,CAAQ,KAAA,CAAM,EAAE,CAAA,EAAkB;AAAA,UACzD,MAAM,QAAQ,MAAM,CAAA;AAAA,UACpB,OAAA,CAAQ,MAAM,MAAM;AAAA,SACrB;AACA,QAAA,OAAO,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,CAAA;AAAA,MACvC,CAAA,CAAA,MAAQ;AAIP,QAAA,KAAA,CAAM,IAAI,CAAA;AACV,QAAA,OAAO,IAAA;AAAA,MACR;AAAA,IACD,CAAA;AAAA,IAEA,MAAA,GAAe;AACd,MAAA,KAAA,CAAM,IAAI,CAAA;AAAA,IACX;AAAA,GACD;AACD","file":"passkey.js","sourcesContent":["/**\n * Open a store with the device instead of the keyboard: Face, fingerprint or\n * Windows Hello in place of typing the password.\n *\n * WHAT IT IS. A platform passkey carrying the WebAuthn PRF extension (FIDO2\n * hmac-secret) yields a stable 32-byte secret - deterministic for that\n * credential and a fixed per-app salt, and it never leaves the authenticator.\n * That secret becomes an AES-256-GCM key, under which this module seals the\n * app's own secret (typically the backup password). Unlocking is then: user\n * verification -> PRF secret -> the password in the clear, in memory.\n *\n * WHAT IT IS NOT. It does not replace the password, it carries it. The\n * password keeps opening everything, on every device, forever; this is a\n * convenience bound to ONE browser profile on ONE machine. Losing the passkey\n * costs a typed password, never data. That asymmetry is deliberate: a second\n * independent key to the data would widen the blast radius of a stolen device,\n * which is the opposite of what a locked cache is for.\n *\n * THE PROPERTY IT PRESERVES. The sealed blob is useless on its own: a copy of\n * the browser profile does not open it, because the PRF secret lives in the\n * authenticator and demands user verification. That is exactly the guarantee a\n * lock-mode cache exists for, so enrolling does not weaken it.\n *\n * OPT-IN BY CONSTRUCTION. Nothing here runs unless an app calls\n * `passkeyUnlock()`. An app that never does simply has no such feature, and an\n * app that does still decides when to offer it - the recommended shape is an\n * explicit control the user turns on, and can turn off again with `forget()`.\n *\n * Requires the PRF extension: recent Chrome/Edge, Safari 18+, recent Android;\n * inside a native WebView it depends on the system WebView version. Nothing\n * trusts that blindly - `available()` and `enroll()` feature-detect at runtime\n * and FAIL CLOSED, so the option is only ever usable where a real secret comes\n * back. Dependency-free, and guarded for SSR and no-WebAuthn environments.\n */\n\n/** How the passkey is presented by the platform, and what it protects. */\nexport interface PasskeyUnlockOptions {\n\t/**\n\t * Shown by the operating system's passkey prompt and stored with the\n\t * credential. The application name, as a person would read it.\n\t */\n\tappName: string;\n\t/**\n\t * Domain separator for the PRF evaluation - NOT a secret, and it may be a\n\t * constant: the credential's own secret is what makes the derived key\n\t * unique. Use a stable per-app string. Changing it rotates every\n\t * passkey-derived key at once, which orphans every existing enrolment.\n\t */\n\tsalt: string;\n\t/** Where the sealed secret is kept on this device (default `selfstore.passkey`). */\n\tstorageKey?: string;\n}\n\n/** The device-unlock facade. Every method is safe to call anywhere: outside a\n *  browser, or without WebAuthn, they report unavailable rather than throw. */\nexport interface PasskeyUnlock {\n\t/**\n\t * Whether a user-verifying platform authenticator exists at all. Necessary\n\t * but NOT sufficient: only an actual `enroll()` proves the PRF extension\n\t * works here. Use it to decide whether to show the control, not to promise\n\t * that it will succeed.\n\t */\n\tavailable(): Promise<boolean>;\n\t/** Whether this device currently holds a sealed secret to reveal. */\n\tenrolled(): boolean;\n\t/**\n\t * Create a platform passkey and seal `secret` behind it. `false` when the\n\t * user cancelled, or when PRF did not yield a key here - fail closed, the\n\t * host keeps its password prompt and should say so rather than pretend.\n\t */\n\tenroll(secret: string): Promise<boolean>;\n\t/**\n\t * Ask for Face / fingerprint / Hello and return the sealed secret. `null`\n\t * on cancel, on a missing enrolment, or on any failure; the host then falls\n\t * back to asking for the password. Never throws.\n\t */\n\treveal(): Promise<string | null>;\n\t/**\n\t * Drop the sealed secret from this device. The platform credential itself\n\t * is NOT deleted - the operating system owns it, and only the user can\n\t * remove it from their passkey manager. Say that in the interface rather\n\t * than implying a full erasure.\n\t */\n\tforget(): void;\n}\n\n/** PRF extension shapes are absent from some TS DOM libs; describe what we use. */\ntype PrfInputs = { prf?: { eval?: { first: BufferSource } } };\ntype PrfOutputs = { prf?: { results?: { first?: ArrayBuffer } } };\n\n/** What one device remembers: which credential to prefer, and the sealed secret. */\ninterface StoredEnrolment {\n\tcredentialId: string;\n\tiv: string;\n\tsealed: string;\n}\n\nconst DEFAULT_STORAGE_KEY = 'selfstore.passkey';\nconst PRF_BYTES = 32;\n\nfunction toB64(bytes: ArrayBuffer | Uint8Array): string {\n\tconst b = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);\n\tlet s = '';\n\tfor (const byte of b) s += String.fromCharCode(byte);\n\treturn btoa(s);\n}\n\nfunction fromB64(s: string): Uint8Array<ArrayBuffer> {\n\tconst bin = atob(s);\n\tconst out = new Uint8Array(bin.length);\n\tfor (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n\treturn out;\n}\n\nfunction webauthnUsable(): boolean {\n\treturn (\n\t\ttypeof window !== 'undefined' &&\n\t\t!!window.PublicKeyCredential &&\n\t\ttypeof navigator !== 'undefined' &&\n\t\t!!navigator.credentials &&\n\t\ttypeof crypto !== 'undefined' &&\n\t\t!!crypto.subtle\n\t);\n}\n\nfunction prfSecret(credential: PublicKeyCredential | null): Uint8Array | null {\n\tconst first = (credential?.getClientExtensionResults() as PrfOutputs | undefined)?.prf?.results\n\t\t?.first;\n\tif (!first) return null;\n\tconst bytes = new Uint8Array(first);\n\treturn bytes.length === PRF_BYTES ? bytes : null;\n}\n\n/**\n * The 32 bytes coming out of PRF are an HMAC output, so they are already\n * uniform: import them straight as an AES-GCM key rather than running a KDF\n * over them. Stretching high-entropy material buys nothing and would only make\n * every unlock slower.\n */\nfunction sealKey(secret: Uint8Array): Promise<CryptoKey> {\n\treturn crypto.subtle.importKey('raw', secret as BufferSource, 'AES-GCM', false, [\n\t\t'encrypt',\n\t\t'decrypt'\n\t]);\n}\n\nexport function passkeyUnlock(options: PasskeyUnlockOptions): PasskeyUnlock {\n\tconst storageKey = options.storageKey ?? DEFAULT_STORAGE_KEY;\n\tconst prfSalt = new TextEncoder().encode(options.salt);\n\n\tfunction read(): StoredEnrolment | null {\n\t\ttry {\n\t\t\tif (typeof localStorage === 'undefined') return null;\n\t\t\tconst raw = localStorage.getItem(storageKey);\n\t\t\tif (!raw) return null;\n\t\t\tconst parsed = JSON.parse(raw) as StoredEnrolment;\n\t\t\tconst complete =\n\t\t\t\ttypeof parsed?.credentialId === 'string' &&\n\t\t\t\ttypeof parsed?.iv === 'string' &&\n\t\t\t\ttypeof parsed?.sealed === 'string';\n\t\t\treturn complete ? parsed : null;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tfunction write(entry: StoredEnrolment | null): void {\n\t\ttry {\n\t\t\tif (typeof localStorage === 'undefined') return;\n\t\t\tif (entry) localStorage.setItem(storageKey, JSON.stringify(entry));\n\t\t\telse localStorage.removeItem(storageKey);\n\t\t} catch {\n\t\t\t/* storage blocked: the enrolment is simply not remembered */\n\t\t}\n\t}\n\n\t/**\n\t * Re-derive the PRF secret. With a credential id it targets that one; with\n\t * none, the platform offers the user's discoverable passkeys for this site.\n\t */\n\tasync function derive(credentialId?: string): Promise<Uint8Array | null> {\n\t\ttry {\n\t\t\tconst assertion = (await navigator.credentials.get({\n\t\t\t\tpublicKey: {\n\t\t\t\t\tchallenge: crypto.getRandomValues(new Uint8Array(32)),\n\t\t\t\t\tallowCredentials: credentialId\n\t\t\t\t\t\t? [{ type: 'public-key', id: fromB64(credentialId) as BufferSource }]\n\t\t\t\t\t\t: [],\n\t\t\t\t\tuserVerification: 'required',\n\t\t\t\t\textensions: { prf: { eval: { first: prfSalt } } } as PrfInputs,\n\t\t\t\t\ttimeout: 60_000\n\t\t\t\t}\n\t\t\t})) as PublicKeyCredential | null;\n\t\t\treturn prfSecret(assertion);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync function create(): Promise<{ credentialId: string; secret: Uint8Array } | null> {\n\t\tconst credential = (await navigator.credentials.create({\n\t\t\tpublicKey: {\n\t\t\t\tchallenge: crypto.getRandomValues(new Uint8Array(32)),\n\t\t\t\trp: { name: options.appName, id: location.hostname },\n\t\t\t\tuser: {\n\t\t\t\t\tid: crypto.getRandomValues(new Uint8Array(16)),\n\t\t\t\t\tname: options.appName,\n\t\t\t\t\tdisplayName: options.appName\n\t\t\t\t},\n\t\t\t\tpubKeyCredParams: [\n\t\t\t\t\t{ type: 'public-key', alg: -7 },\n\t\t\t\t\t{ type: 'public-key', alg: -257 }\n\t\t\t\t],\n\t\t\t\tauthenticatorSelection: {\n\t\t\t\t\tauthenticatorAttachment: 'platform',\n\t\t\t\t\tuserVerification: 'required',\n\t\t\t\t\tresidentKey: 'required'\n\t\t\t\t},\n\t\t\t\textensions: { prf: { eval: { first: prfSalt } } } as PrfInputs,\n\t\t\t\ttimeout: 60_000\n\t\t\t}\n\t\t})) as PublicKeyCredential | null;\n\t\tif (!credential) return null;\n\t\tconst credentialId = toB64(credential.rawId);\n\t\t// Some platforms hand the PRF result back from create(); most need a\n\t\t// second get(). Try the cheap path first to save the user one prompt.\n\t\tconst secret = prfSecret(credential) ?? (await derive(credentialId));\n\t\treturn secret ? { credentialId, secret } : null;\n\t}\n\n\treturn {\n\t\tasync available(): Promise<boolean> {\n\t\t\ttry {\n\t\t\t\tif (!webauthnUsable()) return false;\n\t\t\t\treturn await window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable();\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t},\n\n\t\tenrolled(): boolean {\n\t\t\treturn read() !== null;\n\t\t},\n\n\t\tasync enroll(secret: string): Promise<boolean> {\n\t\t\tif (!webauthnUsable()) return false;\n\t\t\ttry {\n\t\t\t\tconst created = await create();\n\t\t\t\tif (!created) return false;\n\t\t\t\tconst iv = crypto.getRandomValues(new Uint8Array(12));\n\t\t\t\tconst sealed = await crypto.subtle.encrypt(\n\t\t\t\t\t{ name: 'AES-GCM', iv },\n\t\t\t\t\tawait sealKey(created.secret),\n\t\t\t\t\tnew TextEncoder().encode(secret)\n\t\t\t\t);\n\t\t\t\twrite({ credentialId: created.credentialId, iv: toB64(iv), sealed: toB64(sealed) });\n\t\t\t\treturn true;\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t},\n\n\t\tasync reveal(): Promise<string | null> {\n\t\t\tconst entry = read();\n\t\t\tif (!entry || !webauthnUsable()) return null;\n\t\t\tconst secret = await derive(entry.credentialId);\n\t\t\tif (!secret) return null;\n\t\t\ttry {\n\t\t\t\tconst opened = await crypto.subtle.decrypt(\n\t\t\t\t\t{ name: 'AES-GCM', iv: fromB64(entry.iv) as BufferSource },\n\t\t\t\t\tawait sealKey(secret),\n\t\t\t\t\tfromB64(entry.sealed) as BufferSource\n\t\t\t\t);\n\t\t\t\treturn new TextDecoder().decode(opened);\n\t\t\t} catch {\n\t\t\t\t// A wrong key or a tampered blob: an unopenable enrolment is dead\n\t\t\t\t// weight that would fail at every attempt, so drop it and let the\n\t\t\t\t// host fall back to the password.\n\t\t\t\twrite(null);\n\t\t\t\treturn null;\n\t\t\t}\n\t\t},\n\n\t\tforget(): void {\n\t\t\twrite(null);\n\t\t}\n\t};\n}\n"]}

package/dist/{s3-CCE6lc_U.d.ts → s3-0qqIyphl.d.ts}

@@ -1,4 +1,4 @@
-import { B as BackupTarget, P as PeerSource } from './store-CCe8b5Eg.js';
+import { B as BackupTarget, P as PeerSource } from './store-Cs6QIzzG.js';
 import { K as KV } from './cache-ilsK3Tki.js';
 
 /**

package/dist/{store-CCe8b5Eg.d.ts → store-Cs6QIzzG.d.ts}

@@ -229,6 +229,13 @@ interface StatusInput {
     locked: boolean;
     /** Degraded file mode has changes awaiting a manual download. */
     pendingDownload: boolean;
+    /** A portable copy was written at some point, and whether anything has been
+     *  entered since. Without a durable destination, this is the difference
+     *  between "never saved anywhere" and "saved this morning". */
+    copy?: {
+        at: number | null;
+        stale: boolean;
+    };
 }
 /** Map the store's raw flags to a single, ranked status; the most important wins. */
 declare function deriveStatus(input: StatusInput): StatusDescriptor;

package/dist/widgets.d.ts

@@ -1,11 +1,11 @@
-import { S as StoreLike, F as FlowHost, C as ConnectTargets, a as ConnectFlowOptions, b as ConnectKind, c as ConnectFlow } from './connect-BaWYvB1w.js';
+import { S as StoreLike, F as FlowHost, C as ConnectTargets, a as ConnectFlowOptions, b as ConnectKind, c as ConnectFlow } from './connect-BTVzRJY8.js';
 import { ShareEngine, ShareLevel, ShareFlow, JoinEngine, JoinFlow, ReplicaFlow } from './flows.js';
-import { f as BackupsManager } from './manager-CaMd6T1T.js';
-import './store-CCe8b5Eg.js';
+import { f as BackupsManager } from './manager-DhoIbJyg.js';
+import './store-Cs6QIzzG.js';
 import './cache-ilsK3Tki.js';
 import './sync.js';
-import './drive-BUPsPaIu.js';
-import './s3-CCE6lc_U.js';
+import './drive-CY_Vsj7V.js';
+import './s3-0qqIyphl.js';
 import './machine-ALMkT3mk.js';
 
 /** Flat key -> string map; widgets merge a partial override over EN defaults. */

package/dist/widgets.js

@@ -2087,6 +2087,8 @@ var EN5 = {
   "status.justNow": "just now",
   "status.ephemeral": "Nothing is saved",
   "status.cacheOnly": "Never saved anywhere yet",
+  "status.copy": "Last copy written {when}. Nothing has changed since.",
+  "status.copyStale": "Last copy written {when}. What you typed since is not in it.",
   "status.saving": "Saving...",
   "status.saved": "Saved to {label}, at every change",
   "status.needsAttention": "Reconnect to continue",
@@ -2103,6 +2105,8 @@ var FR5 = {
   "status.justNow": "a l'instant",
   "status.ephemeral": "Rien n'est enregistr\xE9",
   "status.cacheOnly": "Vos donn\xE9es n'ont jamais \xE9t\xE9 enregistr\xE9es ailleurs",
+  "status.copy": "Derni\xE8re copie \xE9crite {when}. Rien n'a chang\xE9 depuis.",
+  "status.copyStale": "Derni\xE8re copie \xE9crite {when}. Vos saisies depuis n'y sont pas.",
   "status.saving": "Enregistrement...",
   "status.saved": "Enregistr\xE9 dans {label}, \xE0 chaque changement",
   "status.needsAttention": "Acc\xE8s \xE0 retrouver",
@@ -2152,16 +2156,20 @@ var SelfstoreStatusElement = class extends FlowWidget {
     const { status, targetKind, label } = host.engine.state;
     const sansLieu = (cle) => {
       const jumelle = `${cle}.placeless`;
-      const copie = this.t(jumelle);
-      return copie === jumelle ? this.t(cle) : copie;
+      const copie = this.t(jumelle, vars);
+      return copie === jumelle ? this.t(cle, vars) : copie;
     };
     const selonLeType = (cle) => {
       const jumelle = `${cle}.${targetKind}`;
-      const copie = this.t(jumelle, { label: label ?? "" });
+      const copie = this.t(jumelle, vars);
       return copie === jumelle ? null : copie;
     };
-    const { lastSavedAt } = host.engine.state;
-    const text = selonLeType(status.labelKey) ?? (label ? this.t(status.labelKey, { label }) : sansLieu(status.labelKey));
+    const { lastSavedAt, lastCopyAt } = host.engine.state;
+    const vars = {
+      label: label ?? "",
+      when: lastCopyAt ? this.since(lastCopyAt, this.t("status.justNow")) : ""
+    };
+    const text = selonLeType(status.labelKey) ?? (label ? this.t(status.labelKey, vars) : sansLieu(status.labelKey));
     const dot = h("span", {
       part: `status-dot sev-${status.severity}`,
       "aria-hidden": "true"