chore(deps-dev): bump typescript from 6.0.3 to 7.0.2

Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

package.json

@@ -15,6 +15,7 @@
     "domains:sync": "node scripts/sync-global-domains.mjs",
     "i18n": "node scripts/i18n-validate.cjs",
     "i18n:validate": "node scripts/i18n-validate.cjs",
+    "test:config-compatibility": "tsx --test scripts/config-compatibility.test.ts",
     "test:web-crypto": "tsx --test scripts/web-crypto-availability.test.ts",
     "test:webauthn-mobile": "node --test scripts/webauthn-mobile-connector.test.mjs",
     "test:webauthn-connector": "node --test scripts/webauthn-connector.test.mjs && tsx --test scripts/webauthn-connector-headers.test.ts",
@@ -50,30 +51,31 @@
     "undici": ">=7.28.0",
     "@babel/core": ">=7.29.6",
     "esbuild": ">=0.28.1",
-    "ws": "8.21.0"
+    "ws": "8.21.0",
+    "sharp": "0.35.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260630.1",
-    "@preact/preset-vite": "^2.10.6",
-    "@types/node": "^26.1.1",
-    "autoprefixer": "^10.5.4",
-    "opencc-js": "^1.4.1",
-    "postcss": "^8.5.22",
+    "@preact/preset-vite": "^2.10.5",
+    "@types/node": "^26.0.1",
+    "autoprefixer": "^10.5.2",
+    "opencc-js": "^1.3.2",
+    "postcss": "^8.5.23",
     "tailwindcss": "^3.4.19",
-    "tsx": "^4.23.1",
-    "typescript": "^6.0.3",
-    "vite": "^8.1.5",
-    "wrangler": "^4.113.0"
+    "tsx": "^4.22.4",
+    "typescript": "^7.0.2",
+    "vite": "^8.1.3",
+    "wrangler": "^4.105.0"
   },
   "dependencies": {
     "@noble/hashes": "^2.2.0",
     "@simplewebauthn/server": "^13.3.2",
-    "@tanstack/react-query": "^5.101.4",
-    "@zip.js/zip.js": "^2.8.33",
+    "@tanstack/react-query": "^5.101.2",
+    "@zip.js/zip.js": "^2.8.26",
     "fflate": "^0.8.3",
     "jsqr": "1.4.0",
-    "lucide-preact": "^1.25.0",
-    "preact": "^10.29.7",
+    "lucide-preact": "^1.22.0",
+    "preact": "^10.29.3",
     "qrcode-generator": "^2.0.4",
     "wouter": "^3.10.0"
   }

scripts/config-compatibility.test.ts

@@ -0,0 +1,12 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildConfigResponse } from '../src/config-response';
+
+test('config enables the official Bitwarden desktop settings dialog', () => {
+  const body = buildConfigResponse('https://vault.example.test');
+
+  assert.equal(body.featureStates['desktop-ui-settings-dialog'], true);
+  assert.equal(body.environment.vault, 'https://vault.example.test');
+  assert.equal(body.object, 'config');
+});

src/config-response.ts

@@ -0,0 +1,53 @@
+import { LIMITS } from './config/limits';
+
+function buildIconServiceTemplate(origin: string): string {
+  return `${origin}/icons/{}/icon.png`;
+}
+
+function buildIconServiceCsp(origin: string): string {
+  return `img-src 'self' data: ${origin}`;
+}
+
+export function buildConfigResponse(origin: string) {
+  const fillAssistBase = `${origin}/fill-assist/`;
+  return {
+    version: LIMITS.compatibility.bitwardenServerVersion,
+    gitHash: 'nodewarden',
+    server: null,
+    environment: {
+      cloudRegion: 'self-hosted',
+      vault: origin,
+      api: origin + '/api',
+      identity: origin + '/identity',
+      notifications: origin + '/notifications',
+      icons: origin,
+      sso: '',
+      fillAssistRules: fillAssistBase,
+    },
+    push: {
+      pushTechnology: 0,
+      vapidPublicKey: null,
+    },
+    communication: null,
+    settings: {
+      disableUserRegistration: false,
+      suppressOnboardingInterstitials: false,
+    },
+    _icon_service_url: buildIconServiceTemplate(origin),
+    _icon_service_csp: buildIconServiceCsp(origin),
+    featureStates: {
+      'cipher-key-encryption': LIMITS.compatibility.cipherKeyEncryptionFeatureEnabled,
+      'desktop-ui-settings-dialog': true,
+      'duo-redirect': true,
+      'email-verification': true,
+      'fill-assist-targeting-rules': true,
+      'pm-19051-send-email-verification': false,
+      'pm-19148-innovation-archive': true,
+      'pm-4516-devices-add-last-activity-date': true,
+      'pm-30529-webauthn-related-origins': true,
+      'unauth-ui-refresh': true,
+      'web-push': false,
+    },
+    object: 'config',
+  };
+}

src/config/limits.ts

@@ -156,7 +156,9 @@
   compatibility: {
     // Single source of truth for /config.version and /api/version.
     // /config.version 与 /api/version 的统一版本号来源。
-    bitwardenServerVersion: '2026.4.1',
+    // Vaultwarden 1.37.0 advertises 2026.6.0 after aligning its API response
+    // with the response contract required by Bitwarden 2026.7.x clients.
+    bitwardenServerVersion: '2026.6.0',
     // Official 2026.4.x clients need this flag to receive and use cipher.key.
     // Hiding existing item keys makes item-key encrypted vault data unreadable.
     // 官方 2026.4.x 客户端需要该开关来接收并使用 cipher.key。

src/handlers/identity.ts

@@ -206,6 +206,16 @@ function buildPreloginResponse(
     kdfIterations,
     kdfMemory,
     kdfParallelism,
+    // Current official servers expose the consolidated KDF model alongside
+    // the legacy flat fields. Keep both shapes while clients migrate.
+    kdfSettings: {
+      kdfType,
+      iterations: kdfIterations,
+      memory: kdfMemory,
+      parallelism: kdfParallelism,
+    },
+    salt: null,
+    // Preserve the historic NodeWarden aliases for older integrations.
     KdfSettings: {
       KdfType: kdfType,
       Iterations: kdfIterations,

src/router-public.ts

@@ -36,6 +36,7 @@ import { jsonResponse, unsupportedResponse } from './utils/response';
 import { StorageService } from './services/storage';
 import type { Env } from './types';
 import { getConfiguredWebAuthnAllowedOrigins } from './utils/origins';
+import { buildConfigResponse } from './config-response';
 
 type PublicRateLimiter = (category?: string, maxRequests?: number) => Promise<Response | null>;
 type JwtUnsafeReason = 'missing' | 'too_short' | null;
@@ -95,60 +96,6 @@ function handleMissingWebsiteIcon(): Response {
   });
 }
 
-function buildIconServiceBase(origin: string): string {
-  return `${origin}/icons`;
-}
-
-function buildIconServiceTemplate(origin: string): string {
-  return `${buildIconServiceBase(origin)}/{}/icon.png`;
-}
-
-function buildIconServiceCsp(origin: string): string {
-  return `img-src 'self' data: ${origin}`;
-}
-
-function buildConfigResponse(origin: string) {
-  const fillAssistBase = `${origin}/fill-assist/`;
-  return {
-    version: LIMITS.compatibility.bitwardenServerVersion,
-    gitHash: 'nodewarden',
-    server: null,
-    environment: {
-      cloudRegion: 'self-hosted',
-      vault: origin,
-      api: origin + '/api',
-      identity: origin + '/identity',
-      notifications: origin + '/notifications',
-      icons: origin,
-      sso: '',
-      fillAssistRules: fillAssistBase,
-    },
-    push: {
-      pushTechnology: 0,
-      vapidPublicKey: null,
-    },
-    communication: null,
-    settings: {
-      disableUserRegistration: false,
-    },
-    _icon_service_url: buildIconServiceTemplate(origin),
-    _icon_service_csp: buildIconServiceCsp(origin),
-    featureStates: {
-      'cipher-key-encryption': LIMITS.compatibility.cipherKeyEncryptionFeatureEnabled,
-      'duo-redirect': true,
-      'email-verification': true,
-      'fill-assist-targeting-rules': true,
-      'pm-19051-send-email-verification': false,
-      'pm-19148-innovation-archive': true,
-      'pm-4516-devices-add-last-activity-date': true,
-      'pm-30529-webauthn-related-origins': true,
-      'unauth-ui-refresh': true,
-      'web-push': false,
-    },
-    object: 'config',
-  };
-}
-
 function normalizeIconHost(rawHost: string): string | null {
   let decoded: string;
   try {

src/utils/user-decryption.ts

@@ -17,8 +17,12 @@ export function buildAccountKeys(user: Pick<User, 'privateKey' | 'publicKey'>):
       wrappedPrivateKey: user.privateKey,
       publicKey,
       signedPublicKey: null,
+      object: 'publicKeyEncryptionKeyPair',
       Object: 'publicKeyEncryptionKeyPair',
     },
+    securityState: null,
+    signatureKeyPair: null,
+    object: 'privateKeys',
     Object: 'privateKeys',
   };
 }