Add backup-related error messages and improve UI styles

- Updated English, Spanish, Russian, Simplified Chinese, and Traditional Chinese locale files to include new error messages related to backup and restore processes.
- Added prefix and suffix strings for the "cached empty" message to enhance clarity in user prompts.
- Enhanced the management CSS with new styles for the backup browser refresh prompt to improve layout and user experience.

.codegraph/.gitignore

@@ -1,17 +1,5 @@
-# CodeGraph data files
-# These are local to each machine and should not be committed
-
-# Database
-*.db
-*.db-wal
-*.db-shm
-
-# Cache
-cache/
-
-# Logs
-*.log
-
-# Hook markers
-.dirty
-*.pid
+# CodeGraph data files — local to each machine, not for committing.
+# Ignore everything in .codegraph/ except this file itself, so transient
+# files (the database, daemon.pid, sockets, logs) never show up in git.
+*
+!.gitignore

.gitignore

@@ -18,6 +18,7 @@ build/
 .idea/
 *.swp
 *.swo
+docs/
 
 # OS
 .DS_Store
@@ -55,3 +56,9 @@ NodeWarden-compat/
 .codex-upstream/bitwarden-browser/
 
 .reasonix/
+
+# Compatibility analysis documents
+BITWARDEN_COMPATIBILITY_ANALYSIS.md
+.mcp.json
+opencode.jsonc
+.cursor/

README.md

@@ -37,7 +37,7 @@
 | **PWA 支持** | ⚠️ 基础 | ✅ | **可安装、离线使用、App快捷方式** |
 | **Web Vault 离线查看** | ❌ | ✅ | **网页端支持离线查看保险库** |
 | **Passkey 登录** | ✅ | ✅ | **支持WebAuthn/FIDO2无密码登录** |
-| 全量同步 `/api/sync` | ✅ | ✅ | 已针对官方客户端做兼容优化 |
+| 实时同步 | ✅ | ✅ | 网页端、浏览器扩展、电脑端和手机端实时同步 |
 | 附件上传 / 下载 | ✅ | ✅ | Cloudflare R2 或 KV |
 | Send | ✅ | ✅ | 支持文本与文件 Send |
 | 导入 / 导出 | ✅ | ✅ | 支持 Bitwarden JSON / CSV / **ZIP 导入（包括附件）** |

README_EN.md

@@ -40,7 +40,7 @@
 | **PWA Support** | ⚠️ Basic | ✅ | **Installable, offline-capable, app shortcuts** |
 | **Web Vault Offline Access** | ❌ | ✅ | **Web client supports offline vault viewing** |
 | **Passkey Login** | ✅ | ✅ | **WebAuthn/FIDO2 passwordless login** |
-| Full sync `/api/sync` | ✅ | ✅ | Compatibility optimized for official clients |
+| Real-time sync | ✅ | ✅ | Web, browser extension, desktop, and mobile clients stay in sync in real time |
 | Attachment upload / download | ✅ | ✅ | Cloudflare R2 or KV |
 | Send | ✅ | ✅ | Supports both text and file Sends |
 | Import / Export | ✅ | ✅ | Supports Bitwarden JSON / CSV / **ZIP import with attachments** |

SECURITY.md

@@ -0,0 +1,76 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Thank you for helping keep NodeWarden safe.
+
+Please **do not report security vulnerabilities through public GitHub issues, discussions, pull requests, or chat groups**.
+
+Use GitHub Private Vulnerability Reporting instead:
+
+1. Open the NodeWarden repository on GitHub.
+2. Go to **Security and quality**.
+3. Click **Report a vulnerability**.
+4. Submit the report privately.
+
+NodeWarden is independent from Bitwarden. Please do not report NodeWarden-specific issues to the official Bitwarden team.
+
+## What to Include
+
+Please include as much detail as possible:
+
+* A clear description of the vulnerability.
+* Steps to reproduce.
+* Affected version, commit, or deployment method.
+* Affected area, such as login, sync, vault data, attachments, Send, import/export, backup/restore, Passkey, WebAuthn, or API routes.
+* Expected behavior and actual behavior.
+* Security impact, such as authentication bypass, authorization bypass, replay, cross-user access, token misuse, data leakage, or secret exposure.
+* Proof of concept, logs, screenshots, or request examples, if safe to share privately.
+
+Please redact real passwords, tokens, private keys, recovery keys, vault data, and other secrets before submitting.
+
+## Scope
+
+Security reports are welcome for issues affecting NodeWarden itself, including:
+
+* Authentication and session handling.
+* User authorization and cross-user access.
+* Vault data, cipher sync, attachments, and Send.
+* Import, export, backup, and restore.
+* Passkey, WebAuthn, and two-factor authentication.
+* Secret handling and provider credentials.
+* Cloudflare Workers, D1, R2, KV, WebDAV, or S3 behavior caused by NodeWarden code or documentation.
+
+## Out of Scope
+
+The following are usually out of scope:
+
+* Issues only affecting third-party services or user infrastructure.
+* Misconfigured personal deployments not caused by NodeWarden defaults.
+* Social engineering or phishing.
+* Denial-of-service testing.
+* Scanner-only reports without a practical exploit path.
+* Reports that only mention outdated dependencies without showing real impact.
+
+## Response
+
+NodeWarden is maintained on a best-effort basis.
+
+We aim to acknowledge valid private reports within 72 hours, investigate the issue, and release a fix or mitigation when appropriate.
+
+Please do not publicly disclose vulnerability details before a fix or mitigation is available.
+
+## Supported Versions
+
+Security fixes are generally provided for the latest release and the latest code on the default branch.
+
+| Version        | Supported              |
+| -------------- | ---------------------- |
+| Latest release | Yes                    |
+| `main` branch  | Yes                    |
+| Older releases | Best effort            |
+| Modified forks | Not directly supported |
+
+## Rewards
+
+NodeWarden does not currently operate a paid bug bounty program.

docs/passkey-login-research.md

@@ -1,785 +0,0 @@
-# NodeWarden Passkey 登录研究记录
-
-记录日期：2026-06-09  
-研究范围：NodeWarden 自己的 server、web 登录/注册链路，以及官方 Bitwarden server、web、browser extension 对账户 passkey 登录的实现方式。
-
-## 结论先放前面
-
-NodeWarden 现在已经有完整的主密码注册、主密码登录、刷新 token、2FA、设备记录、官方客户端兼容的 `UserDecryptionOptions`，也支持 vault item 里的 `login.fido2Credentials` 字段。但它还没有“账户 passkey 登录”。现有 `src/utils/passkey.ts` 只有 base64url、challenge、clientData 解析这类工具函数，不能完成 FIDO2/WebAuthn 服务端注册和认证验证。
-
-要支持“自己的 web 用 passkey 登录”和“官方/自定义浏览器扩展也能 passkey 登录”，不能只加一个登录按钮。必须补齐四块：
-
-1. Server 端新增账户 WebAuthn credential 表、challenge/token 防重放机制、FIDO2 attestation/assertion 验证、`grant_type=webauthn`。
-2. Server 响应里按 Bitwarden 形状返回 PRF 解密材料：登录 token 响应用单个 `UserDecryptionOptions.WebAuthnPrfOption`，sync 响应用多个 `UserDecryption.WebAuthnPrfOptions`。
-3. NodeWarden web 新增 passkey 注册、管理、登录和 PRF 解锁 vault key 的客户端流程。
-4. 扩展兼容要跟官方 Bitwarden endpoint 和 response shape 对齐。官方 browser extension 当前只在 Chromium 系浏览器开放 passkey 登录，因为 Firefox/Safari 扩展环境还不能按官方代码需要的方式覆盖 RP ID。
-
-下面按代码链路展开。
-
-## 术语边界
-
-这里有三个容易混淆的东西，文档后面严格区分：
-
-- 账户 passkey 登录：用户不用主密码，使用 WebAuthn/passkey 完成账号认证，并且用 PRF 解开 vault user key。官方 Bitwarden 叫 `WebAuthnLogin`。
-- Vault item 里的 passkey：某个登录条目保存网站 passkey/FIDO2 credential 数据，对应 NodeWarden 的 `cipher.login.fido2Credentials`。这是“保险库保存别的网站 passkey”，不是“登录 NodeWarden 账号”。
-- WebAuthn 2FA：主密码登录之后用安全密钥做第二因素。官方旧 web repo 里主要是这一类，不等于 passkey 登录。
-
-## NodeWarden 现状
-
-### 路由和入口
-
-NodeWarden 后端是 Cloudflare Workers + D1。主入口 `src/index.ts` 初始化存储后进入 router。认证边界在：
-
-- `src/router-public.ts`：公开接口，包含 `/identity/connect/token`、`/identity/accounts/prelogin`、`/api/accounts/register`。
-- `src/router-authenticated.ts`：需要 access token 的接口，包含 profile、change password、TOTP、sync、vault、devices。
-- `src/handlers/identity.ts`：OAuth/token 兼容入口。
-- `src/handlers/accounts.ts`：注册、profile、密码变更、TOTP、API key 等账户接口。
-
-目前公开路由没有：
-
-- `GET /identity/accounts/webauthn/assertion-options`
-- `POST /identity/connect/token` 的 `grant_type=webauthn`
-- `POST /api/webauthn/attestation-options`
-- `POST /api/webauthn/assertion-options`
-- `GET/POST/PUT /api/webauthn`
-
-### 注册链路
-
-NodeWarden 自己 web 的注册入口在 `webapp/src/lib/api/auth.ts` 的 `registerAccount()`：
-
-- 使用邮箱作为 salt，用 PBKDF2 派生 master key。
-- 再用 PBKDF2(masterKey, password, 1) 得到 client master password hash。
-- 随机生成 64 字节 vault symmetric key。
-- 用 masterKey 经 HKDF 拆成 enc/mac，把 vault key 加密成 Bitwarden `Key`。
-- 生成 RSA-OAEP key pair，把 private key 用 vault symmetric key 加密。
-- POST `/api/accounts/register`，提交 `email`、`name`、`masterPasswordHash`、`key`、KDF 参数、invite code、`keys.publicKey`、`keys.encryptedPrivateKey`。
-
-后端 `src/handlers/accounts.ts` 的 `handleRegister()`：
-
-- 第一个用户自动成为 admin，后续用户需要 invite。
-- 校验 `JWT_SECRET`、邮箱、KDF 下限、加密字符串形状、公钥/私钥。
-- 不直接保存 client hash，而是 `AuthService.hashPasswordServer(masterPasswordHash, email)` 后保存到 `users.master_password_hash`。
-- 保存 `users.key`、`users.private_key`、`users.public_key`、KDF 参数、`security_stamp`。
-
-结论：账户 passkey 注册不是替代账号注册，而是“用户已登录后在安全设置里新增一个可登录 credential”。仍然需要已有 vault user key 来生成 PRF keyset。
-
-### 主密码登录链路
-
-NodeWarden 自己 web 的登录入口是 `webapp/src/lib/app-auth.ts` 的 `performPasswordLogin()`：
-
-- 先 `deriveLoginHashLocally()` 得到 masterKey 和 client hash。
-- 调 `loginWithPassword()` POST `/identity/connect/token`。
-- token 成功后 `completeLogin()` 用 `token.Key` 和本地 masterKey 解开 vault key。
-- 保存离线解锁记录。
-
-`webapp/src/lib/api/auth.ts` 也有 `deriveLoginHash()` 和 `getPreloginKdfConfig()` 会调用 `/identity/accounts/prelogin`，但当前 `performPasswordLogin()` 走的是本地 fallback iterations。passkey 登录不应复用这条 masterKey 路径，因为 passkey 登录没有主密码，拿不到 password-derived masterKey。
-
-后端 `src/handlers/identity.ts` 的 `handleToken()` 当前支持：
-
-- `grant_type=password`
-- `grant_type=client_credentials`
-- `grant_type=refresh_token`
-
-密码登录成功后会：
-
-- 验证 IP 登录频率和用户状态。
-- `AuthService.verifyPassword()` 验证 client hash。
-- 处理 TOTP 或 remember 2FA token。
-- 记录/更新 device。
-- 生成 access token 和 refresh token。
-- 返回 `Key`、`PrivateKey`、`AccountKeys`、KDF 参数、`UserDecryptionOptions`。
-
-### UserDecryptionOptions 和 sync
-
-NodeWarden 的 `src/utils/user-decryption.ts` 当前只构造主密码解锁：
-
-- `HasMasterPassword: true`
-- `MasterPasswordUnlock`
-- `TrustedDeviceOption: null`
-- `KeyConnectorOption: null`
-
-`src/types/index.ts` 的 sync 类型里预留了 `UserDecryption.WebAuthnPrfOption?: null`，但当前 `src/handlers/sync.ts` 实际只返回 `MasterPasswordUnlock`，没有账户 passkey PRF 解密选项。
-
-passkey 登录必须新增两类 shape：
-
-- 登录 token 响应：`UserDecryptionOptions.WebAuthnPrfOption`，只返回本次认证所用 credential 的 PRF 解密材料。
-- sync 响应：`UserDecryption.WebAuthnPrfOptions`，返回该用户所有已启用 PRF keyset 的 passkey 解密材料，供官方客户端锁定/解锁和 key rotation 使用。
-
-### 现有 passkey 相关代码
-
-NodeWarden 已支持 vault item 里的 FIDO2/passkey 字段：
-
-- `src/types/index.ts`：`CipherLogin.fido2Credentials`
-- `src/handlers/ciphers.ts`：读写 cipher 时保留/规范化 `fido2Credentials`
-- `webapp/src/lib/api/vault.ts`：加密/解密 vault item 内的 `fido2Credentials`
-- `webapp/src/lib/types.ts`：`CipherLoginPasskey`
-
-这部分是“保存网站 passkey”，不是账户登录。
-
-`src/utils/passkey.ts` 只有：
-
-- `bytesToBase64Url()`
-- `base64UrlToBytes()`
-- `randomChallenge()`
-- `parseClientDataJSON()`
-
-缺少的核心能力：
-
-- attestation verification
-- assertion verification
-- authenticator public key 格式处理
-- signature verification
-- sign counter 更新
-- userHandle 与 user id 绑定验证
-- origin/RP ID 验证
-- challenge 过期和防重放
-
-### 数据库和备份影响
-
-NodeWarden schema 在这些地方需要同步：
-
-- `migrations/0001_init.sql`
-- `src/services/storage-schema.ts`
-- `wrangler.toml` migrations
-- `src/services/backup-archive.ts`
-- `src/services/backup-import.ts`
-- `shared/backup-schema` 相关类型
-
-当前表里没有账户 passkey credential，也没有 WebAuthn challenge 表。`devices` 表保存设备 trust/key 信息，不适合混入 passkey credential，因为 WebAuthn credential 需要自己的 public key、credential id、counter、AAGUID、PRF keyset 等字段。
-
-## 官方 Bitwarden server 参考
-
-上游代码位置：
-
-- `.codex-upstream/bitwarden-server`
-- 研究时 HEAD：`574f3fd`
-
-官方 server 里也有两个 WebAuthn 概念：
-
-- 传统 WebAuthn 2FA：`TwoFactorController`、`WebAuthnTokenProvider`
-- 账户 passkey 登录：`WebAuthnLogin`
-
-本项目要参考的是后者。
-
-### 公开 passkey 登录入口
-
-`src/Identity/Controllers/AccountsController.cs`
-
-- `GET /accounts/webauthn/assertion-options`
-- 返回 `WebAuthnLoginAssertionOptionsResponseModel`
-- response 包含：
-  - `options`
-  - `token`
-- token 使用 `WebAuthnLoginAssertionOptionsTokenable`
-- scope 为 `Authentication`
-- token 生命周期约 17 分钟
-
-`src/Identity/IdentityServer/RequestValidators/WebAuthnGrantValidator.cs`
-
-- 新增 OAuth extension grant：`grant_type=webauthn`
-- 从 form 读取：
-  - `token`
-  - `deviceResponse`
-- 解开 token，校验 scope 必须是 `Authentication`
-- 反序列化 `AuthenticatorAssertionRawResponse`
-- 调用 `AssertWebAuthnLoginCredential`
-- 把成功认证的 credential 传给 `UserDecryptionOptionsBuilder.WithWebAuthnLoginCredential(credential)`
-- 之后走通用登录成功逻辑，返回 access/refresh token 和账号加密状态。
-
-`src/Identity/IdentityServer/ApiClient.cs`
-
-- official identity client 的 allowed grant types 包含 `WebAuthnGrantValidator.GrantType`。
-
-`TwoFactorAuthenticationValidator` 里有一个重要行为：FIDO2 user verification 已经被视为第二因素，所以 passkey 登录成功后官方不会再要求额外 2FA。NodeWarden 之后需要明确策略：要兼容官方客户端，应把 passkey 登录视作已满足 2FA，否则官方 `LoginViaWebAuthnComponent` 会显示“不支持 passkey 2FA”的错误。
-
-### 账户 passkey 管理接口
-
-`src/Api/Auth/Controllers/WebAuthnController.cs`
-
-官方 authenticated API：
-
-- `GET /webauthn`：列出账户 passkey credentials。
-- `POST /webauthn/attestation-options`：主密码/secret verification 后生成 credential create options 和 token。
-- `POST /webauthn/assertion-options`：主密码/secret verification 后生成 assertion options 和 token，用于给已有 credential 启用/更新 PRF keyset。
-- `POST /webauthn`：保存新 credential。
-- `PUT /webauthn`：更新 credential 的 PRF encryption keyset。
-- `POST /webauthn/{id}/delete`：删除 credential。
-
-官方创建 credential 时保存：
-
-- `name`
-- `token`
-- `deviceResponse`
-- `supportsPrf`
-- 可选 `encryptedUserKey`
-- 可选 `encryptedPublicKey`
-- 可选 `encryptedPrivateKey`
-
-官方最多允许 5 个账户 passkey credentials。
-
-### 官方 WebAuthnCredential 表
-
-`src/Core/Auth/Entities/WebAuthnCredential.cs`
-
-字段：
-
-- `Id`
-- `UserId`
-- `Name`
-- `PublicKey`
-- `CredentialId`
-- `Counter`
-- `Type`
-- `AaGuid`
-- `EncryptedUserKey`
-- `EncryptedPrivateKey`
-- `EncryptedPublicKey`
-- `SupportsPrf`
-- `CreationDate`
-- `RevisionDate`
-
-SQLite migration：`util/SqliteMigrations/Migrations/20231213032045_WebAuthnLoginCredentials.cs`
-
-表名是 `WebAuthnCredential`，对 `User` 做 cascade delete，并按 `UserId` 建索引。
-
-`GetPrfStatus()`：
-
-- `Unsupported`：`SupportsPrf` 为 false。
-- `Supported`：credential 支持 PRF，但还没有完整 encrypted keyset。
-- `Enabled`：`EncryptedUserKey`、`EncryptedPrivateKey`、`EncryptedPublicKey` 都存在。
-
-### 官方创建和认证策略
-
-`GetWebAuthnLoginCredentialCreateOptionsCommand.cs`
-
-- 使用 Fido2NetLib。
-- `user.id` 是用户 id bytes。
-- `user.name/displayName` 使用用户邮箱。
-- 排除当前用户已有 credential ids。
-- `residentKey: required`
-- `userVerification: required`
-- `attestation: none`
-
-`GetWebAuthnLoginCredentialAssertionOptionsCommand.cs`
-
-- `allowCredentials` 传空数组。
-- `userVerification: required`
-- 空 allow list 代表使用 discoverable credentials，也就是 passkey 登录页可以不先输入邮箱。
-
-`CreateWebAuthnLoginCredentialCommand.cs`
-
-- 限制每用户最多 5 个。
-- 检查 credential id 在该用户下不能重复。
-- FIDO `MakeNewCredentialAsync` 验证 attestation。
-- 保存 credential id/public key/counter/type/AAGUID/PRF keyset。
-
-`AssertWebAuthnLoginCredentialCommand.cs`
-
-- 先用 challenge cache 防重放。
-- 从 assertion response 的 `userHandle` 解析出 user id。
-- 加载该用户所有 WebAuthn credentials。
-- 用 credential id 找到记录。
-- FIDO `MakeAssertionAsync` 验证签名、challenge、origin、RP ID、user verification。
-- 成功后更新 counter。
-
-### 官方 PRF 解密协议
-
-`src/Core/Auth/Models/Api/Response/UserDecryptionOptions.cs`
-
-`WebAuthnPrfDecryptionOption` 字段：
-
-- `EncryptedPrivateKey`
-- `EncryptedUserKey`
-- `CredentialId`
-- `Transports`
-
-`src/Identity/IdentityServer/UserDecryptionOptionsBuilder.cs`
-
-- `WithWebAuthnLoginCredential()` 只在 credential 的 PRF status 是 `Enabled` 时加入 `WebAuthnPrfOption`。
-- 如果 credential 没有 PRF keyset，passkey 只能认证账号，不能解开 vault。
-
-`src/Api/Vault/Models/Response/SyncResponseModel.cs`
-
-- sync response 会把所有 enabled PRF credentials 放进 `UserDecryption.WebAuthnPrfOptions`。
-
-## 官方 Bitwarden web/browser client 参考
-
-上游代码位置：
-
-- `.codex-upstream/bitwarden-clients`
-- `.codex-upstream/bitwarden-browser`
-- 两者研究时 HEAD 都是 `825f9be`，browser repo 内容和 clients monorepo 对应。
-
-旧的 `.codex-upstream/bitwarden-web` 主要有 WebAuthn connector 和 2FA 设置页，没有现代账户 passkey 登录主流程。账户 passkey 登录应以 `bitwarden-clients` 为准。
-
-### 登录按钮可见性
-
-`libs/auth/src/angular/login/default-login-component.service.ts`
-
-- 默认只对 `ClientType.Web` 开启 passkey 登录。
-
-`apps/browser/src/auth/popup/login/extension-login-component.service.ts`
-
-- browser extension 覆盖逻辑：只对 Chromium 开启。
-- 注释说明 Firefox 和 Safari 不能在扩展里覆盖 relying party ID。
-- 官方代码引用了 W3C webextensions issue 238、Mozilla bug 1956484、Apple forum thread 774351。
-
-结论：NodeWarden 后端即使完全兼容官方 passkey API，官方扩展也只有 Chromium 系会显示 passkey 登录入口。
-
-### Passkey 登录页
-
-`libs/angular/src/auth/login-via-webauthn/login-via-webauthn.component.ts`
-
-流程：
-
-1. 进入 `/login-with-passkey` 后自动开始认证。
-2. 调 `webAuthnLoginService.getCredentialAssertionOptions()`。
-3. 调 `webAuthnLoginService.assertCredential(options)` 触发 `navigator.credentials.get()`。
-4. 调 `webAuthnLoginService.logIn(assertion)` 走 identity token grant。
-5. 如果 `authResult.requiresTwoFactor` 为 true，显示“客户端不支持 passkey 2FA”错误。
-6. 只有本地 `keyService.userKey$(authResult.userId)` 已经拿到 user key，才运行 login success handler。
-7. 成功路由：
-   - Web：`/vault`
-   - Browser：`/tabs/vault`
-   - Desktop：`/vault`
-
-Browser popout 下还会在成功后重新打开普通 popup 并关闭 popout。
-
-### 客户端 passkey 登录请求
-
-`libs/common/src/auth/services/webauthn-login/webauthn-login-api.service.ts`
-
-- GET `${identityUrl}/accounts/webauthn/assertion-options`
-- 如果 NodeWarden 的 identityUrl 是站点 origin + `/identity`，实际路径就是 `/identity/accounts/webauthn/assertion-options`。
-
-`libs/common/src/auth/services/webauthn-login/webauthn-login.service.ts`
-
-- `navigator.credentials.get({ publicKey: options })`
-- 会主动加 PRF extension：
-  - salt 是 `SHA-256("passwordless-login")`
-  - extension shape 是 `extensions.prf.eval.first`
-- 从 `credential.getClientExtensionResults().prf.results.first` 取 PRF 输出。
-- 用 `WebAuthnLoginPrfKeyService.createSymmetricKeyFromPrf()` 转成 PRF key。
-- 构造 `WebAuthnLoginAssertionResponseRequest`。
-- 明确检查 `deviceResponse.extensions` 里不能含 `prf`，避免把 PRF 输出泄漏给服务端。
-
-`libs/common/src/auth/services/webauthn-login/webauthn-login-prf-key.service.ts`
-
-- salt 常量：`passwordless-login`
-- 先 SHA-256。
-- 再用 HKDF expand 拆成 64 字节：
-  - `"enc"` 32 bytes
-  - `"mac"` 32 bytes
-
-`libs/common/src/auth/models/request/identity-token/webauthn-login-token.request.ts`
-
-form encoded token 请求字段：
-
-- `grant_type=webauthn`
-- `token=<server assertion options token>`
-- `deviceResponse=<JSON string>`
-- 还会带 common device request 字段。
-
-`libs/common/src/auth/services/webauthn-login/request/webauthn-login-assertion-response.request.ts`
-
-`deviceResponse` shape：
-
-- `id`
-- `rawId`
-- `type`
-- `extensions: {}`
-- `response.authenticatorData`
-- `response.signature`
-- `response.clientDataJSON`
-- `response.userHandle`
-
-全部二进制字段使用 base64url。
-
-### 客户端如何用 PRF 解 vault key
-
-`libs/auth/src/common/login-strategies/webauthn-login.strategy.ts`
-
-- `setMasterKey()` 是空实现，因为 passkey 登录没有主密码 masterKey。
-- `setUserKey()`：
-  - 如果 token response 有 `key`，保存为 master-key-encrypted user key，兼容主密码解锁。
-  - 如果 `userDecryptionOptions.webAuthnPrfOption` 存在，且本地 assertion 得到了 `prfKey`：
-    1. 用 PRF key unwrap `encryptedPrivateKey`。
-    2. 用 private key decapsulate `encryptedUserKey`。
-    3. 得到 user key，写入 `keyService`。
-
-核心约束：服务端永远看不到 PRF 输出。服务端只保存和返回被 PRF 相关密钥加密后的 keyset。
-
-### 官方 web 设置页注册 passkey
-
-`apps/web/src/app/auth/core/services/webauthn-login/webauthn-login-admin-api.service.ts`
-
-调用的 API：
-
-- `POST /webauthn/attestation-options`
-- `POST /webauthn/assertion-options`
-- `POST /webauthn`
-- `GET /webauthn`
-- `POST /webauthn/{id}/delete`
-- `PUT /webauthn`
-
-`apps/web/src/app/auth/core/services/webauthn-login/webauthn-login-admin.service.ts`
-
-创建流程：
-
-1. 用户做 secret verification。
-2. 请求 attestation options。
-3. `navigator.credentials.create({ publicKey: options })`，并带 `extensions.prf = {}`。
-4. 从 client extension results 判断 `supportsPrf`。
-5. 如果要用于 vault encryption，再立即做一次 `navigator.credentials.get()`：
-   - `allowCredentials` 锁定刚创建的 credential。
-   - 使用同一个 challenge、rpId、timeout、userVerification。
-   - 带 PRF eval salt。
-6. 用 PRF key 和当前 user key 创建 rotateable keyset。
-7. 保存 credential，带上 `encryptedUserKey`、`encryptedPublicKey`、`encryptedPrivateKey`。
-
-删除流程需要 secret verification。启用 encryption 的流程是对已有 credential 做 assertion，再创建并 PUT keyset。
-
-`apps/web/src/app/auth/core/enums/webauthn-login-credential-prf-status.enum.ts`
-
-- `Enabled = 0`
-- `Supported = 1`
-- `Unsupported = 2`
-
-## NodeWarden 应实现的协议形状
-
-### 公开登录流程
-
-目标兼容官方客户端和 NodeWarden 自己 web：
-
-1. `GET /identity/accounts/webauthn/assertion-options`
-   - 生成 discoverable credential assertion options。
-   - `allowCredentials: []`
-   - `userVerification: "required"`
-   - 返回 `{ options, token }`。
-   - token 绑定 challenge、scope=`Authentication`、RP ID、origin/audience、过期时间。
-
-2. Browser/web 调 `navigator.credentials.get()`。
-   - NodeWarden 自己 web 也要使用 PRF extension。
-   - PRF salt 必须和官方一致：`SHA-256("passwordless-login")`。
-
-3. `POST /identity/connect/token`
-   - 支持 `grant_type=webauthn`。
-   - 接收 `token`、`deviceResponse`、device fields。
-   - 解 token，校验 challenge/scope/过期。
-   - 验证 assertion。
-   - 从 `userHandle` 找到 user id。
-   - 从 credential id 找到 passkey record。
-   - 更新 counter。
-   - 记录/更新 device。
-   - 返回 access/refresh token、`AccountKeys`、`UserDecryptionOptions.WebAuthnPrfOption`。
-
-如果用户启用了 TOTP，建议为了官方兼容先遵循 Bitwarden：passkey 的 user verification 视作已满足第二因素。否则官方 passkey 登录页会进入 unsupported 2FA 错误状态。
-
-### 账户 passkey 管理流程
-
-建议对齐官方 API，同时在 NodeWarden 内部可挂到 `/api/webauthn`：
-
-- `GET /api/webauthn`
-- `POST /api/webauthn/attestation-options`
-- `POST /api/webauthn/assertion-options`
-- `POST /api/webauthn`
-- `PUT /api/webauthn`
-- `POST /api/webauthn/:id/delete`
-
-为了官方客户端兼容，可能还需要接受无 `/api` 前缀的 aliases：
-
-- `/webauthn`
-- `/webauthn/attestation-options`
-- `/webauthn/assertion-options`
-- `/webauthn/:id/delete`
-
-NodeWarden 自己 web 可以直接用 `/api/webauthn`，官方 web/browser 客户端会按它自己的 API base 组装 `/webauthn`。
-
-### 建议新增表
-
-按 NodeWarden 命名风格，建议用小写 snake_case：
-
-```sql
-CREATE TABLE IF NOT EXISTS webauthn_credentials (
-  id TEXT PRIMARY KEY,
-  user_id TEXT NOT NULL,
-  name TEXT NOT NULL,
-  public_key TEXT NOT NULL,
-  credential_id TEXT NOT NULL,
-  counter INTEGER NOT NULL DEFAULT 0,
-  type TEXT,
-  aa_guid TEXT,
-  transports TEXT,
-  encrypted_user_key TEXT,
-  encrypted_public_key TEXT,
-  encrypted_private_key TEXT,
-  supports_prf INTEGER NOT NULL DEFAULT 0,
-  created_at TEXT NOT NULL,
-  updated_at TEXT NOT NULL,
-  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS idx_webauthn_credentials_user_credential
-  ON webauthn_credentials(user_id, credential_id);
-
-CREATE INDEX IF NOT EXISTS idx_webauthn_credentials_user
-  ON webauthn_credentials(user_id);
-```
-
-如果要更严格防止同一个 credential id 被跨用户重复注册，也可以加全局 unique index `credential_id`。官方代码至少检查同用户唯一；实际安全上更建议全局唯一，因为 credential id 本身应该唯一标识 authenticator credential。
-
-PRF status 不必落库为枚举，可以由字段计算：
-
-- `supports_prf = 0` => `Unsupported`
-- `supports_prf = 1` 且三段 encrypted key 不全 => `Supported`
-- `supports_prf = 1` 且三段 encrypted key 全存在 => `Enabled`
-
-### Challenge/token 存储
-
-官方 server 用 protected token 携带 options，再用 challenge cache 防重放。NodeWarden 在 Workers/D1 里建议组合：
-
-- token：HMAC/JWT 样式，绑定 `scope`、`challenge`、`userId?`、`rpId`、`createdAt`、`expiresAt`。
-- D1 表或 KV：记录 challenge 是否使用过，至少字段 `challenge_hash`、`scope`、`user_id`、`expires_at`、`used_at`。
-- 登录 assertion options 是公开接口，不绑定 user id；create/update/delete 管理流程应绑定 user id。
-- 验证成功后立即 mark used。
-
-建议 scopes：
-
-- `Authentication`
-- `CreateCredential`
-- `UpdateKeySet`
-
-官方还有 `PrfRegistration` 语义，NodeWarden 可以用 `CreateCredential` 覆盖，只要 token 逻辑严谨即可。
-
-### 服务端 WebAuthn 验证库
-
-NodeWarden 当前没有 FIDO2/WebAuthn 服务端验证依赖。不要手写签名和 attestation 解析。
-
-候选：`@simplewebauthn/server`。官方文档当前说明它提供 `generateRegistrationOptions`、`verifyRegistrationResponse`、`generateAuthenticationOptions`、`verifyAuthenticationResponse`，并记录了 RP ID、origin、credential public key、counter、transports 等数据结构。文档地址：https://simplewebauthn.dev/docs/packages/server
-
-注意：NodeWarden 跑在 Cloudflare Workers，不是普通 Node server。正式选库前需要做一次构建/runtime 验证，确认包不会依赖 Workers 不支持的 Node API。这个验证属于实现阶段，不在本研究文档里写测试程序。
-
-## NodeWarden web 需要改的地方
-
-### 登录页
-
-当前登录 UI 在 `webapp/src/components/AuthViews.tsx`，状态和行为主要由 `webapp/src/App.tsx`、`webapp/src/lib/app-auth.ts` 管。
-
-新增：
-
-- 登录页增加“使用 passkey 登录”按钮。
-- 新增 `performPasskeyLogin()`：
-  1. GET `/identity/accounts/webauthn/assertion-options`
-  2. 转换 server options 里的 base64url challenge/user id/credential id 为 ArrayBuffer。
-  3. `navigator.credentials.get()`，带 PRF salt。
-  4. POST `/identity/connect/token`，`grant_type=webauthn`。
-  5. 从 response 的 `UserDecryptionOptions.WebAuthnPrfOption` 取 encrypted keyset。
-  6. 用本地 PRF key 解出 user key。
-  7. 构造 `SessionState` 并进入 app。
-
-不能复用 `completeLogin(token, email, masterKey, fallbackKdfIterations)`，因为它要求 masterKey。应新增 passkey 专用 complete 函数。
-
-### 设置页
-
-当前账户/安全相关 UI 在 `webapp/src/components/SettingsPage.tsx` 一带。
-
-新增：
-
-- Passkey 列表。
-- 新建 passkey dialog。
-- 删除 passkey。
-- 对支持 PRF 但未启用 encryption 的 passkey，提供“启用用于登录解锁”的操作。
-
-自己 web 的新建流程要和官方一致：
-
-1. 已登录状态下先验证主密码或现有 session secret。
-2. 请求 attestation options。
-3. `navigator.credentials.create()` 带 `extensions.prf = {}`。
-4. 如果用户希望这个 passkey 可直接解锁 vault，再对刚创建 credential 做一次 `navigator.credentials.get()` 获取 PRF 输出。
-5. 用 PRF key 加密/封装当前 user key，发送到 server 保存。
-
-### 客户端加密能力
-
-NodeWarden web 当前已经有：
-
-- PBKDF2
-- HKDF expand
-- Bitwarden EncString 加解密
-- RSA-OAEP private key 加密
-
-但 passkey PRF keyset 需要和官方策略对齐：
-
-- PRF key 是 64 字节 symmetric key，前 32 enc、后 32 mac。
-- `encryptedPrivateKey` 用 PRF key wrap 一个 decapsulation private key。
-- `encryptedUserKey` 用对应 public key encapsulate user key。
-- `encryptedPublicKey` 用于 key rotation。
-
-这里需要认真复用或补齐 NodeWarden 现有 crypto helper，避免做出和官方客户端无法互解的 keyset。
-
-## 扩展兼容要求
-
-### 官方 browser extension
-
-官方 extension passkey 登录入口在：
-
-- `apps/browser/src/auth/popup/login/extension-login-component.service.ts`
-- 只在 Chromium 开启。
-
-如果要官方/派生扩展能对 NodeWarden passkey 登录：
-
-- identity URL 必须能访问 `/accounts/webauthn/assertion-options`。
-- token URL 必须支持 `grant_type=webauthn`。
-- API URL 必须能访问 `/webauthn` 管理接口。
-- response 大小写和字段名要同时照顾 PascalCase/camelCase，NodeWarden 当前 token response 已经在一些字段上双写，这个风格应继续沿用。
-- passkey 登录成功时必须返回可解开 vault 的 `webAuthnPrfOption`，否则官方组件虽然认证成功，也不会进入可用 vault。
-
-### RP ID 和 origin
-
-自己的 web：
-
-- RP ID 通常是站点 host，例如 `vault.example.com`。
-- origin 是 `https://vault.example.com`。
-
-官方 browser extension：
-
-- 扩展页面 origin 是 `chrome-extension://...`。
-- 官方之所以只开 Chromium，是因为 Chromium extension 具备它需要的 RP ID 覆盖能力。
-- NodeWarden server 验证 assertion 时必须允许正确的 origin/RP ID 组合。这里不能简单只接受当前 request origin，否则扩展登录会失败。
-
-建议配置化：
-
-- `WEBAUTHN_RP_ID`
-- `WEBAUTHN_RP_NAME`
-- `WEBAUTHN_ALLOWED_ORIGINS`
-
-默认可以从 request URL 推导 web origin，但生产建议显式配置。
-
-## 安全约束
-
-- 所有账户 passkey 必须 `userVerification: required`。
-- 登录 assertion 使用 discoverable credential，`userHandle` 必须能解析成 user id 并和 credential 记录一致。
-- challenge 必须有过期时间和一次性使用标记。
-- PRF 输出绝不能传给 server，也不能写入日志。
-- token 里要绑定 scope，防止 attestation token 被拿去 authentication 用。
-- counter 要更新。遇到 counter 异常时至少记录 audit event，是否阻断要结合 multi-device passkey 现实处理。
-- 每用户 credential 数量限制建议沿用官方 5 个。
-- 删除/新增/启用 encryption 必须要求已登录用户二次验证。
-- 密码变更、user key rotation 后，所有 enabled PRF credentials 的 keyset 也要 rotation，否则 passkey 登录会解不开新 vault key。
-- 备份导出/导入必须包含账户 passkey 表，否则恢复后 passkey 登录会全部失效。
-- 审计日志建议新增：
-  - `auth.passkey.login.success`
-  - `auth.passkey.login.failed`
-  - `account.passkey.create`
-  - `account.passkey.delete`
-  - `account.passkey.encryption.enable`
-  - `account.passkey.rotate`
-
-## 建议实施顺序
-
-### 第一阶段：后端基础
-
-1. 新增 `webauthn_credentials` 和 challenge 表。
-2. 新增 storage repo。
-3. 接入 WebAuthn 服务端验证库。
-4. 实现 assertion options 和 `grant_type=webauthn`。
-5. token response 加 `WebAuthnPrfOption` shape。
-
-这阶段先能让“已有手工塞入的 enabled credential”完成登录验证，但还不做 UI。
-
-### 第二阶段：账户 passkey 管理 API
-
-1. 实现 `/api/webauthn` 和 `/webauthn` aliases。
-2. 实现 attestation options、save credential、list、delete、enable/update encryption。
-3. 加 audit event。
-4. 接入 backup export/import。
-5. sync response 加 `WebAuthnPrfOptions`。
-
-### 第三阶段：NodeWarden 自己 web
-
-1. 登录页 passkey 按钮和 `performPasskeyLogin()`。
-2. Passkey 设置页。
-3. PRF keyset 创建、保存、删除、启用 encryption。
-4. 浏览器能力判断和错误提示。
-
-### 第四阶段：扩展兼容
-
-1. 用官方 browser extension 的 Chromium passkey 登录流程校对 endpoint。
-2. 校对 `/config` 里 identity/api/web vault URL。
-3. 校对 RP ID、allowed origins。
-4. 必要时加兼容字段或 alias route。
-
-按用户要求，本阶段只需要代码跑通不报错；不在这里写可视化测试或测试程序。
-
-## 待实现清单
-
-- [ ] 设计并落库 `webauthn_credentials`。
-- [ ] 设计并落库 WebAuthn challenge/replay cache。
-- [ ] 选定并验证 Workers 可用的 WebAuthn server library。
-- [ ] `GET /identity/accounts/webauthn/assertion-options`。
-- [ ] `POST /identity/connect/token` 支持 `grant_type=webauthn`。
-- [ ] `UserDecryptionOptions.WebAuthnPrfOption`。
-- [ ] `UserDecryption.WebAuthnPrfOptions`。
-- [ ] `/api/webauthn` 管理接口。
-- [ ] `/webauthn` 官方客户端 alias。
-- [ ] NodeWarden web passkey 登录入口。
-- [ ] NodeWarden web passkey 管理页。
-- [ ] key rotation 时同步 rotate PRF keysets。
-- [ ] backup export/import 覆盖新表。
-- [ ] audit logs 覆盖 passkey 管理和登录。
-
-## 关键文件索引
-
-NodeWarden：
-
-- `src/router-public.ts`
-- `src/router-authenticated.ts`
-- `src/handlers/accounts.ts`
-- `src/handlers/identity.ts`
-- `src/handlers/sync.ts`
-- `src/services/auth.ts`
-- `src/services/storage-schema.ts`
-- `src/services/storage-user-repo.ts`
-- `src/services/storage-device-repo.ts`
-- `src/utils/passkey.ts`
-- `src/utils/user-decryption.ts`
-- `src/types/index.ts`
-- `webapp/src/lib/api/auth.ts`
-- `webapp/src/lib/app-auth.ts`
-- `webapp/src/components/AuthViews.tsx`
-- `webapp/src/components/SettingsPage.tsx`
-
-Bitwarden server：
-
-- `.codex-upstream/bitwarden-server/src/Identity/Controllers/AccountsController.cs`
-- `.codex-upstream/bitwarden-server/src/Identity/IdentityServer/RequestValidators/WebAuthnGrantValidator.cs`
-- `.codex-upstream/bitwarden-server/src/Identity/IdentityServer/ApiClient.cs`
-- `.codex-upstream/bitwarden-server/src/Api/Auth/Controllers/WebAuthnController.cs`
-- `.codex-upstream/bitwarden-server/src/Core/Auth/Entities/WebAuthnCredential.cs`
-- `.codex-upstream/bitwarden-server/src/Core/Auth/UserFeatures/WebAuthnLogin/Implementations/GetWebAuthnLoginCredentialCreateOptionsCommand.cs`
-- `.codex-upstream/bitwarden-server/src/Core/Auth/UserFeatures/WebAuthnLogin/Implementations/GetWebAuthnLoginCredentialAssertionOptionsCommand.cs`
-- `.codex-upstream/bitwarden-server/src/Core/Auth/UserFeatures/WebAuthnLogin/Implementations/CreateWebAuthnLoginCredentialCommand.cs`
-- `.codex-upstream/bitwarden-server/src/Core/Auth/UserFeatures/WebAuthnLogin/Implementations/AssertWebAuthnLoginCredentialCommand.cs`
-- `.codex-upstream/bitwarden-server/src/Core/Auth/Models/Api/Response/UserDecryptionOptions.cs`
-- `.codex-upstream/bitwarden-server/util/SqliteMigrations/Migrations/20231213032045_WebAuthnLoginCredentials.cs`
-
-Bitwarden clients/browser：
-
-- `.codex-upstream/bitwarden-clients/libs/auth/src/angular/login/default-login-component.service.ts`
-- `.codex-upstream/bitwarden-clients/apps/browser/src/auth/popup/login/extension-login-component.service.ts`
-- `.codex-upstream/bitwarden-clients/libs/angular/src/auth/login-via-webauthn/login-via-webauthn.component.ts`
-- `.codex-upstream/bitwarden-clients/libs/common/src/auth/services/webauthn-login/webauthn-login-api.service.ts`
-- `.codex-upstream/bitwarden-clients/libs/common/src/auth/services/webauthn-login/webauthn-login.service.ts`
-- `.codex-upstream/bitwarden-clients/libs/common/src/auth/services/webauthn-login/webauthn-login-prf-key.service.ts`
-- `.codex-upstream/bitwarden-clients/libs/common/src/auth/models/request/identity-token/webauthn-login-token.request.ts`
-- `.codex-upstream/bitwarden-clients/libs/common/src/auth/services/webauthn-login/request/webauthn-login-response.request.ts`
-- `.codex-upstream/bitwarden-clients/libs/common/src/auth/services/webauthn-login/request/webauthn-login-assertion-response.request.ts`
-- `.codex-upstream/bitwarden-clients/libs/auth/src/common/login-strategies/webauthn-login.strategy.ts`
-- `.codex-upstream/bitwarden-clients/apps/web/src/app/auth/core/services/webauthn-login/webauthn-login-admin-api.service.ts`
-- `.codex-upstream/bitwarden-clients/apps/web/src/app/auth/core/services/webauthn-login/webauthn-login-admin.service.ts`
-- `.codex-upstream/bitwarden-clients/apps/web/src/app/auth/core/services/webauthn-login/request/save-credential.request.ts`
-- `.codex-upstream/bitwarden-clients/apps/web/src/app/auth/core/services/webauthn-login/request/enable-credential-encryption.request.ts`
-- `.codex-upstream/bitwarden-clients/apps/web/src/app/auth/core/services/webauthn-login/request/webauthn-login-attestation-response.request.ts`
-- `.codex-upstream/bitwarden-clients/apps/web/src/app/auth/core/enums/webauthn-login-credential-prf-status.enum.ts`
-- `.codex-upstream/bitwarden-clients/libs/common/src/auth/models/response/user-decryption-options/webauthn-prf-decryption-option.response.ts`
-- `.codex-upstream/bitwarden-clients/libs/auth/src/common/models/domain/user-decryption-options.ts`
-

migrations/0001_init.sql

@@ -176,6 +176,8 @@ CREATE TABLE IF NOT EXISTS devices (
   encrypted_user_key TEXT,
   encrypted_public_key TEXT,
   encrypted_private_key TEXT,
+  push_uuid TEXT,
+  push_token TEXT,
   banned INTEGER NOT NULL DEFAULT 0,
   banned_at TEXT,
   device_note TEXT,
@@ -187,6 +189,34 @@ CREATE TABLE IF NOT EXISTS devices (
 );
 CREATE INDEX IF NOT EXISTS idx_devices_user_updated ON devices(user_id, updated_at);
 CREATE INDEX IF NOT EXISTS idx_devices_user_last_seen ON devices(user_id, last_seen_at);
+CREATE INDEX IF NOT EXISTS idx_devices_user_push ON devices(user_id, push_token);
+
+CREATE TABLE IF NOT EXISTS auth_requests (
+  id TEXT PRIMARY KEY,
+  user_id TEXT NOT NULL,
+  organization_id TEXT,
+  type INTEGER NOT NULL,
+  request_device_identifier TEXT NOT NULL,
+  request_device_type INTEGER NOT NULL,
+  request_ip_address TEXT,
+  request_country_name TEXT,
+  response_device_identifier TEXT,
+  access_code TEXT NOT NULL,
+  public_key TEXT NOT NULL,
+  key TEXT,
+  master_password_hash TEXT,
+  approved INTEGER,
+  creation_date TEXT NOT NULL,
+  response_date TEXT,
+  authentication_date TEXT,
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_auth_requests_user_created
+  ON auth_requests(user_id, creation_date);
+CREATE INDEX IF NOT EXISTS idx_auth_requests_user_pending
+  ON auth_requests(user_id, approved, response_date, authentication_date, creation_date);
+CREATE INDEX IF NOT EXISTS idx_auth_requests_device_pending
+  ON auth_requests(user_id, request_device_identifier, creation_date);
 
 CREATE TABLE IF NOT EXISTS trusted_two_factor_device_tokens (
   token TEXT PRIMARY KEY,
@@ -198,6 +228,16 @@ CREATE TABLE IF NOT EXISTS trusted_two_factor_device_tokens (
 CREATE INDEX IF NOT EXISTS idx_trusted_two_factor_device_tokens_user_device
   ON trusted_two_factor_device_tokens(user_id, device_identifier);
 
+CREATE TABLE IF NOT EXISTS totp_login_replays (
+  user_id TEXT NOT NULL,
+  time_counter INTEGER NOT NULL,
+  consumed_at INTEGER NOT NULL,
+  PRIMARY KEY (user_id, time_counter),
+  FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+);
+CREATE INDEX IF NOT EXISTS idx_totp_login_replays_consumed_at
+  ON totp_login_replays(consumed_at);
+
 CREATE TABLE IF NOT EXISTS webauthn_credentials (
   id TEXT PRIMARY KEY,
   user_id TEXT NOT NULL,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodewarden",
-  "version": "1.6.0",
+  "version": "1.7.1",
   "description": "Minimal Bitwarden-compatible server running on Cloudflare Workers",
   "author": "shuaiplus",
   "license": "LGPL-3.0",
@@ -42,6 +42,11 @@
       }
     }
   },
+  "overrides": {
+    "undici": ">=7.28.0",
+    "@babel/core": ">=7.29.6",
+    "esbuild": ">=0.28.1"
+  },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260131.0",
     "@preact/preset-vite": "^2.10.3",

shared/app-version.ts

@@ -1 +1 @@
-export const APP_VERSION = '1.6.0';
+export const APP_VERSION = '1.7.1';

shared/backup-schema.ts

@@ -9,15 +9,18 @@
 export const BACKUP_DEFAULT_TIMEZONE = 'UTC';
 export const BACKUP_DEFAULT_RETENTION_COUNT = 30;
 export const BACKUP_DEFAULT_S3_REGION = 'auto';
-export const BACKUP_DEFAULT_REMOTE_PATH = 'nodewarden';
+export const BACKUP_DEFAULT_S3_ROOT_PATH = '';
+export const BACKUP_DEFAULT_WEBDAV_REMOTE_PATH = 'nodewarden';
 export const BACKUP_DEFAULT_INTERVAL_HOURS = 24;
 export const BACKUP_DEFAULT_START_TIME = '03:00';
 
 export type BackupDestinationType = 's3' | 'webdav';
+export type S3BackupAddressingStyle = 'path-style' | 'virtual-hosted-style';
 
 export interface S3BackupDestination {
   endpoint: string;
   bucket: string;
+  addressingStyle: S3BackupAddressingStyle;
   region: string;
   accessKeyId: string;
   secretAccessKey: string;
@@ -103,17 +106,18 @@ export function createDefaultBackupDestinationConfig(type: BackupDestinationType
     return {
       endpoint: '',
       bucket: '',
+      addressingStyle: 'path-style',
       region: BACKUP_DEFAULT_S3_REGION,
       accessKeyId: '',
       secretAccessKey: '',
-      rootPath: BACKUP_DEFAULT_REMOTE_PATH,
+      rootPath: BACKUP_DEFAULT_S3_ROOT_PATH,
     };
   }
   return {
     baseUrl: '',
     username: '',
     password: '',
-    remotePath: BACKUP_DEFAULT_REMOTE_PATH,
+    remotePath: BACKUP_DEFAULT_WEBDAV_REMOTE_PATH,
   };
 }
 

src/durable/backup-transfer-runner.ts

@@ -209,6 +209,7 @@ export class BackupTransferRunner {
     }
 
     let completed = 0;
+    const failures: Array<{ destinationId: string; error: string }> = [];
     try {
       await this.touchJob(token);
       const storage = new StorageService(this.env.DB);
@@ -230,21 +231,30 @@ export class BackupTransferRunner {
         scanStartMs = now.getTime();
         for (const destination of dueDestinations) {
           await this.touchJob(token);
-          await executeConfiguredBackup(
-            this.env,
-            storage,
-            null,
-            'scheduled',
-            destination.id,
-            () => this.touchJob(token)
-          );
-          completed += 1;
+          try {
+            await executeConfiguredBackup(
+              this.env,
+              storage,
+              null,
+              'scheduled',
+              destination.id,
+              () => this.touchJob(token)
+            );
+            completed += 1;
+          } catch (error) {
+            failures.push({
+              destinationId: destination.id,
+              error: error instanceof Error ? error.message : 'Scheduled backup failed',
+            });
+          }
         }
       }
 
       return new Response(JSON.stringify({
         ok: true,
         completed,
+        failed: failures.length,
+        failures,
       }), {
         status: 200,
         headers: {
@@ -318,7 +328,8 @@ export class BackupTransferRunner {
         replaceExisting,
         !checksumOk,
         body.auditMetadata || null,
-        targetDeviceIdentifier
+        targetDeviceIdentifier,
+        () => this.touchJob(token)
       );
 
       return new Response(JSON.stringify(result.result), {

src/durable/notifications-hub.ts

@@ -1,17 +1,32 @@
 import { DurableObject, waitUntil } from 'cloudflare:workers';
 import type { Env } from '../types';
+import { notifyMobilePush } from '../services/push-relay';
 
 const SIGNALR_RECORD_SEPARATOR = 0x1e;
 const SIGNALR_HANDSHAKE_ACK = new Uint8Array([0x7b, 0x7d, SIGNALR_RECORD_SEPARATOR]);
+const SIGNALR_UPDATE_TYPE_SYNC_CIPHER_UPDATE = 0;
+const SIGNALR_UPDATE_TYPE_SYNC_CIPHER_CREATE = 1;
+const SIGNALR_UPDATE_TYPE_SYNC_FOLDER_DELETE = 3;
+const SIGNALR_UPDATE_TYPE_SYNC_CIPHERS = 4;
 const SIGNALR_UPDATE_TYPE_SYNC_VAULT = 5;
+const SIGNALR_UPDATE_TYPE_SYNC_FOLDER_CREATE = 7;
+const SIGNALR_UPDATE_TYPE_SYNC_FOLDER_UPDATE = 8;
+const SIGNALR_UPDATE_TYPE_SYNC_CIPHER_DELETE = 9;
 const SIGNALR_UPDATE_TYPE_LOG_OUT = 11;
-const SIGNALR_UPDATE_TYPE_DEVICE_STATUS = 12;
-const SIGNALR_UPDATE_TYPE_BACKUP_RESTORE_PROGRESS = 13;
+const SIGNALR_UPDATE_TYPE_SYNC_SEND_CREATE = 12;
+const SIGNALR_UPDATE_TYPE_SYNC_SEND_UPDATE = 13;
+const SIGNALR_UPDATE_TYPE_SYNC_SEND_DELETE = 14;
+const SIGNALR_UPDATE_TYPE_AUTH_REQUEST = 15;
+const SIGNALR_UPDATE_TYPE_AUTH_REQUEST_RESPONSE = 16;
+const SIGNALR_UPDATE_TYPE_BACKUP_RESTORE_PROGRESS = 102;
 
 type HubProtocol = 'json' | 'messagepack';
+type HubKind = 'user' | 'anonymous-auth-request';
 
 interface WsAttachment {
-  userId: string;
+  kind: HubKind;
+  userId: string | null;
+  authRequestId: string | null;
   handshakeComplete: boolean;
   protocol: HubProtocol;
   deviceIdentifier: string | null;
@@ -137,11 +152,12 @@ function frameSignalRBinary(payload: Uint8Array): Uint8Array {
 function buildSignalRJsonInvocation(
   updateType: number,
   payload: Record<string, unknown>,
-  contextId: string | null
+  contextId: string | null,
+  target: string = 'ReceiveMessage'
 ): string {
   return JSON.stringify({
     type: 1,
-    target: 'ReceiveMessage',
+    target,
     arguments: [
         {
           ContextId: contextId,
@@ -155,15 +171,16 @@ function buildSignalRJsonInvocation(
 function buildSignalRMessagePackInvocation(
   updateType: number,
   messagePayload: Record<string, unknown>,
-  contextId: string | null
+  contextId: string | null,
+  target: string = 'ReceiveMessage'
 ): Uint8Array {
   // SignalR MessagePack hub protocol uses an array-based invocation shape:
-  // [type, headers, invocationId, target, arguments]
+  // [type, headers, invocationId, target, arguments, streamIds]
   const encodedPayload = encodeMsgPack([
     1,
     {},
     null,
-    'ReceiveMessage',
+    target,
     [
       {
         ContextId: contextId,
@@ -171,6 +188,7 @@ function buildSignalRMessagePackInvocation(
         Payload: messagePayload,
       },
     ],
+    [],
   ]);
   return frameSignalRBinary(encodedPayload);
 }
@@ -201,7 +219,9 @@ export class NotificationsHub extends DurableObject<Env> {
       const revisionDate = String(body?.revisionDate || '').trim() || new Date().toISOString();
       const userId = String(request.headers.get('X-NodeWarden-UserId') || body?.userId || '').trim();
       const contextId = String(body?.contextId || '').trim() || null;
-      const updateType = Number(body?.updateType || SIGNALR_UPDATE_TYPE_SYNC_VAULT) || SIGNALR_UPDATE_TYPE_SYNC_VAULT;
+      const rawUpdateType = body?.updateType;
+      const parsedUpdateType = typeof rawUpdateType === 'number' ? rawUpdateType : Number(rawUpdateType);
+      const updateType = Number.isFinite(parsedUpdateType) ? parsedUpdateType : SIGNALR_UPDATE_TYPE_SYNC_VAULT;
       const targetDeviceIdentifier = String(body?.targetDeviceIdentifier || '').trim() || null;
       const payload = body?.payload && typeof body.payload === 'object'
         ? body.payload
@@ -213,6 +233,20 @@ export class NotificationsHub extends DurableObject<Env> {
       return new Response(null, { status: 204 });
     }
 
+    if (url.pathname === '/internal/auth-request-response' && request.method === 'POST') {
+      const body = (await request.json().catch(() => null)) as {
+        userId?: string;
+        authRequestId?: string;
+        contextId?: string | null;
+      } | null;
+      const userId = String(body?.userId || '').trim();
+      const authRequestId = String(body?.authRequestId || '').trim();
+      if (!userId || !authRequestId) return new Response('Invalid auth request notification', { status: 400 });
+
+      this.broadcastAuthRequestResponse(userId, authRequestId, String(body?.contextId || '').trim() || null);
+      return new Response(null, { status: 204 });
+    }
+
     if (url.pathname === '/internal/online' && request.method === 'GET') {
       return new Response(JSON.stringify({ deviceIdentifiers: this.getOnlineDeviceIdentifiers() }), {
         status: 200,
@@ -222,7 +256,7 @@ export class NotificationsHub extends DurableObject<Env> {
       });
     }
 
-    if (url.pathname !== '/notifications/hub') {
+    if (url.pathname !== '/notifications/hub' && url.pathname !== '/notifications/anonymous-hub') {
       return new Response('Not found', { status: 404 });
     }
 
@@ -232,8 +266,13 @@ export class NotificationsHub extends DurableObject<Env> {
 
     const requestUserId = String(url.searchParams.get('nw_uid') || '').trim();
     const requestDeviceIdentifier = String(url.searchParams.get('nw_did') || '').trim() || null;
+    const requestAuthRequestId = String(url.searchParams.get('nw_auth_request_id') || '').trim() || null;
+    const isAnonymousAuthRequestHub = url.pathname === '/notifications/anonymous-hub';
 
-    if (!requestUserId) {
+    if (!isAnonymousAuthRequestHub && !requestUserId) {
+      return new Response('Unauthorized', { status: 401 });
+    }
+    if (isAnonymousAuthRequestHub && !requestAuthRequestId) {
       return new Response('Unauthorized', { status: 401 });
     }
 
@@ -248,7 +287,9 @@ export class NotificationsHub extends DurableObject<Env> {
     this.ctx.acceptWebSocket(server, tags);
 
     server.serializeAttachment({
-      userId: requestUserId,
+      kind: isAnonymousAuthRequestHub ? 'anonymous-auth-request' : 'user',
+      userId: isAnonymousAuthRequestHub ? null : requestUserId,
+      authRequestId: requestAuthRequestId,
       handshakeComplete: false,
       protocol: 'messagepack',
       deviceIdentifier: requestDeviceIdentifier,
@@ -274,7 +315,6 @@ export class NotificationsHub extends DurableObject<Env> {
           attachment.handshakeComplete = true;
           ws.serializeAttachment(attachment);
           ws.send(SIGNALR_HANDSHAKE_ACK);
-          this.broadcastDeviceStatus(attachment.userId);
           return;
         } catch {
           // Ignore malformed pre-handshake payloads.
@@ -293,26 +333,22 @@ export class NotificationsHub extends DurableObject<Env> {
   }
 
   async webSocketClose(ws: WebSocket, code: number, reason: string, wasClean: boolean): Promise<void> {
-    const attachment = ws.deserializeAttachment() as WsAttachment | null;
-    const shouldBroadcast = !!attachment?.handshakeComplete;
-    if (shouldBroadcast && attachment?.userId) {
-      this.broadcastDeviceStatus(attachment.userId);
-    }
+    void ws;
+    void code;
+    void reason;
+    void wasClean;
   }
 
   async webSocketError(ws: WebSocket, error: unknown): Promise<void> {
-    const attachment = ws.deserializeAttachment() as WsAttachment | null;
-    const shouldBroadcast = !!attachment?.handshakeComplete;
-    if (shouldBroadcast && attachment?.userId) {
-      this.broadcastDeviceStatus(attachment.userId);
-    }
+    void ws;
+    void error;
   }
 
   private getOnlineDeviceIdentifiers(): string[] {
     const out = new Set<string>();
     for (const ws of this.ctx.getWebSockets()) {
       const attachment = ws.deserializeAttachment() as WsAttachment | null;
-      if (!attachment?.handshakeComplete || !attachment.deviceIdentifier) continue;
+      if (!attachment?.handshakeComplete || attachment.kind !== 'user' || !attachment.deviceIdentifier) continue;
       out.add(attachment.deviceIdentifier);
     }
     return Array.from(out);
@@ -349,16 +385,45 @@ export class NotificationsHub extends DurableObject<Env> {
     }
   }
 
-  private broadcastDeviceStatus(userId: string): void {
-    this.broadcastMessage(
-      SIGNALR_UPDATE_TYPE_DEVICE_STATUS,
-      {
+  private broadcastAuthRequestResponse(userId: string, authRequestId: string, contextId: string | null): void {
+    for (const ws of this.ctx.getWebSockets()) {
+      const attachment = ws.deserializeAttachment() as WsAttachment | null;
+      if (
+        !attachment?.handshakeComplete ||
+        attachment.kind !== 'anonymous-auth-request' ||
+        attachment.authRequestId !== authRequestId
+      ) {
+        continue;
+      }
+
+      const payload = {
         UserId: userId,
-        Date: new Date().toISOString(),
-      },
-      null,
-      null
-    );
+        Id: authRequestId,
+      };
+      try {
+        if (attachment.protocol === 'json') {
+          ws.send(buildSignalRJsonInvocation(
+            SIGNALR_UPDATE_TYPE_AUTH_REQUEST_RESPONSE,
+            payload,
+            contextId,
+            'AuthRequestResponseRecieved'
+          ));
+        } else {
+          ws.send(buildSignalRMessagePackInvocation(
+            SIGNALR_UPDATE_TYPE_AUTH_REQUEST_RESPONSE,
+            payload,
+            contextId,
+            'AuthRequestResponseRecieved'
+          ));
+        }
+      } catch {
+        try {
+          ws.close(1011, 'Notification send failed');
+        } catch {
+          // ignore close races
+        }
+      }
+    }
   }
 }
 
@@ -371,6 +436,243 @@ export function notifyUserVaultSync(
   waitUntil(notifyUserUpdate(env, userId, SIGNALR_UPDATE_TYPE_SYNC_VAULT, revisionDate, contextId ?? null, null));
 }
 
+export function notifyUserCiphersSync(
+  env: Env,
+  userId: string,
+  revisionDate: string,
+  contextId?: string | null
+): void {
+  waitUntil(notifyUserUpdate(env, userId, SIGNALR_UPDATE_TYPE_SYNC_CIPHERS, revisionDate, contextId ?? null, null));
+}
+
+export function notifyUserCipherCreate(
+  env: Env,
+  payload: {
+    userId: string;
+    cipherId: string;
+    revisionDate: string;
+    organizationId?: string | null;
+    collectionIds?: string[] | null;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_CIPHER_CREATE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.cipherId,
+      OrganizationId: payload.organizationId ?? null,
+      CollectionIds: Array.isArray(payload.collectionIds) ? payload.collectionIds : null,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
+export function notifyUserCipherUpdate(
+  env: Env,
+  payload: {
+    userId: string;
+    cipherId: string;
+    revisionDate: string;
+    organizationId?: string | null;
+    collectionIds?: string[] | null;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_CIPHER_UPDATE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.cipherId,
+      OrganizationId: payload.organizationId ?? null,
+      CollectionIds: Array.isArray(payload.collectionIds) ? payload.collectionIds : null,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
+export function notifyUserCipherDelete(
+  env: Env,
+  payload: {
+    userId: string;
+    cipherId: string;
+    revisionDate: string;
+    organizationId?: string | null;
+    collectionIds?: string[] | null;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_CIPHER_DELETE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.cipherId,
+      OrganizationId: payload.organizationId ?? null,
+      CollectionIds: Array.isArray(payload.collectionIds) ? payload.collectionIds : null,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
+export function notifyUserFolderCreate(
+  env: Env,
+  payload: {
+    userId: string;
+    folderId: string;
+    revisionDate: string;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_FOLDER_CREATE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.folderId,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
+export function notifyUserFolderUpdate(
+  env: Env,
+  payload: {
+    userId: string;
+    folderId: string;
+    revisionDate: string;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_FOLDER_UPDATE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.folderId,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
+export function notifyUserFolderDelete(
+  env: Env,
+  payload: {
+    userId: string;
+    folderId: string;
+    revisionDate: string;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_FOLDER_DELETE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.folderId,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
+export function notifyUserSendCreate(
+  env: Env,
+  payload: {
+    userId: string;
+    sendId: string;
+    revisionDate: string;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_SEND_CREATE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.sendId,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
+export function notifyUserSendUpdate(
+  env: Env,
+  payload: {
+    userId: string;
+    sendId: string;
+    revisionDate: string;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_SEND_UPDATE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.sendId,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
+export function notifyUserSendDelete(
+  env: Env,
+  payload: {
+    userId: string;
+    sendId: string;
+    revisionDate: string;
+    contextId?: string | null;
+  }
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    payload.userId,
+    SIGNALR_UPDATE_TYPE_SYNC_SEND_DELETE,
+    payload.revisionDate,
+    payload.contextId ?? null,
+    null,
+    {
+      UserId: payload.userId,
+      Id: payload.sendId,
+      RevisionDate: payload.revisionDate,
+    }
+  ));
+}
+
 export function notifyUserLogout(
   env: Env,
   userId: string,
@@ -392,13 +694,59 @@ export async function getOnlineUserDevices(env: Env, userId: string): Promise<st
   }
 }
 
+export async function notifyAuthRequestResponse(
+  env: Env,
+  userId: string,
+  authRequestId: string,
+  contextId?: string | null
+): Promise<void> {
+  try {
+    const id = env.NOTIFICATIONS_HUB.idFromName(authRequestId);
+    const stub = env.NOTIFICATIONS_HUB.get(id);
+    await stub.fetch('https://notifications/internal/auth-request-response', {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      body: JSON.stringify({
+        userId,
+        authRequestId,
+        contextId: contextId || null,
+      }),
+    });
+  } catch (error) {
+    console.error('Failed to broadcast auth request response notification:', error);
+  }
+}
+
+export function notifyUserAuthRequest(
+  env: Env,
+  userId: string,
+  authRequestId: string,
+  contextId?: string | null
+): void {
+  waitUntil(notifyUserUpdate(
+    env,
+    userId,
+    SIGNALR_UPDATE_TYPE_AUTH_REQUEST,
+    new Date().toISOString(),
+    contextId ?? null,
+    null,
+    {
+      UserId: userId,
+      Id: authRequestId,
+    }
+  ));
+}
+
 async function notifyUserUpdate(
   env: Env,
   userId: string,
   updateType: number,
   revisionDate: string,
   contextId: string | null,
-  targetDeviceIdentifier: string | null
+  targetDeviceIdentifier: string | null,
+  payloadOverride?: Record<string, unknown> | null
 ): Promise<void> {
   try {
     const id = env.NOTIFICATIONS_HUB.idFromName(userId);
@@ -414,12 +762,22 @@ async function notifyUserUpdate(
         contextId: contextId || null,
         updateType,
         targetDeviceIdentifier: targetDeviceIdentifier || null,
-        payload: {
+        payload: payloadOverride || {
           UserId: userId,
           Date: revisionDate,
         },
       }),
     });
+    await notifyMobilePush(env, {
+      userId,
+      updateType,
+      revisionDate,
+      contextId,
+      payload: payloadOverride || {
+        UserId: userId,
+        Date: revisionDate,
+      },
+    });
   } catch (error) {
     console.error('Failed to broadcast realtime notification:', error);
   }

src/handlers/accounts.ts

@@ -1,4 +1,4 @@
-import { Env, User, ProfileResponse, DEFAULT_DEV_SECRET } from '../types';
+import { Env, User, DEFAULT_DEV_SECRET } from '../types';
 import { StorageService } from '../services/storage';
 import { AuthService } from '../services/auth';
 import { RateLimitService, getClientIdentifier } from '../services/ratelimit';
@@ -9,6 +9,11 @@ import { LIMITS } from '../config/limits';
 import { isTotpEnabled, verifyTotpToken } from '../utils/totp';
 import { createRecoveryCode, recoveryCodeEquals } from '../utils/recovery-code';
 import { buildAccountKeys } from '../utils/user-decryption';
+import { buildProfileResponse } from '../utils/profile-response';
+
+const TWO_FACTOR_PROVIDER_AUTHENTICATOR = 0;
+const TOTP_USER_VERIFICATION_TOKEN_TTL_MS = 10 * 60 * 1000;
+const TOTP_BASE32_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
 
 // CONTRACT:
 // users.master_password_hash is server-side login verification only. It does
@@ -64,6 +69,77 @@ function normalizeTotpSecret(input: string): string {
   return out;
 }
 
+function randomBase32Secret(length: number = 32): string {
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  let out = '';
+  for (const byte of bytes) {
+    out += TOTP_BASE32_ALPHABET[byte % TOTP_BASE32_ALPHABET.length];
+  }
+  return out;
+}
+
+function base64UrlEncodeBytes(data: Uint8Array): string {
+  const base64 = btoa(String.fromCharCode(...data));
+  return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function base64UrlDecodeBytes(input: string): Uint8Array {
+  let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
+  while (base64.length % 4) base64 += '=';
+  const binary = atob(base64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+async function hmacSha256(secret: string, data: string): Promise<Uint8Array> {
+  const key = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign']
+  );
+  return new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(data)));
+}
+
+async function createTotpUserVerificationToken(env: Env, user: User, key: string): Promise<string> {
+  const payload = {
+    sub: user.id,
+    key,
+    stamp: user.securityStamp,
+    exp: Date.now() + TOTP_USER_VERIFICATION_TOKEN_TTL_MS,
+  };
+  const payloadB64 = base64UrlEncodeBytes(new TextEncoder().encode(JSON.stringify(payload)));
+  const signatureB64 = base64UrlEncodeBytes(await hmacSha256(env.JWT_SECRET, payloadB64));
+  return `${payloadB64}.${signatureB64}`;
+}
+
+async function verifyTotpUserVerificationToken(env: Env, user: User, key: string, token: string): Promise<boolean> {
+  try {
+    const [payloadB64, signatureB64] = String(token || '').split('.');
+    if (!payloadB64 || !signatureB64) return false;
+    const expected = base64UrlEncodeBytes(await hmacSha256(env.JWT_SECRET, payloadB64));
+    if (expected !== signatureB64) return false;
+    const payload = JSON.parse(new TextDecoder().decode(base64UrlDecodeBytes(payloadB64))) as {
+      sub?: string;
+      key?: string;
+      stamp?: string;
+      exp?: number;
+    };
+    return (
+      payload.sub === user.id &&
+      payload.key === key &&
+      payload.stamp === user.securityStamp &&
+      typeof payload.exp === 'number' &&
+      payload.exp >= Date.now()
+    );
+  } catch {
+    return false;
+  }
+}
+
 function normalizeRecoveryCodeInput(input: string): string {
   return String(input || '').toUpperCase().replace(/[^A-Z2-7]/g, '');
 }
@@ -91,34 +167,67 @@ async function verifyUserSecret(
   return auth.verifyPassword(normalized, user.masterPasswordHash, user.email);
 }
 
-function toProfile(user: User, env: Env): ProfileResponse {
-  void env;
+function readBodyString(body: Record<string, unknown>, names: string[]): string {
+  for (const name of names) {
+    const value = body[name];
+    if (typeof value === 'string') return value;
+  }
+  return '';
+}
+
+function readNestedString(source: unknown, path: string[]): string {
+  let current = source;
+  for (const key of path) {
+    if (!current || typeof current !== 'object') return '';
+    current = (current as Record<string, unknown>)[key];
+  }
+  return typeof current === 'string' ? current : '';
+}
+
+function readNestedNumber(source: unknown, path: string[]): number | undefined {
+  let current = source;
+  for (const key of path) {
+    if (!current || typeof current !== 'object') return undefined;
+    current = (current as Record<string, unknown>)[key];
+  }
+  return typeof current === 'number' ? current : undefined;
+}
+
+async function readRequestBody(request: Request): Promise<Record<string, unknown>> {
+  const contentType = request.headers.get('content-type') || '';
+  if (contentType.includes('application/x-www-form-urlencoded')) {
+    const formData = await request.formData();
+    return Object.fromEntries(formData.entries()) as Record<string, unknown>;
+  }
+  return await request.json();
+}
+
+function masterPasswordPolicyResponse(): Record<string, unknown> {
+  return {
+    minComplexity: 0,
+    minLength: 0,
+    requireUpper: false,
+    requireLower: false,
+    requireNumbers: false,
+    requireSpecial: false,
+    enforceOnLogin: false,
+    object: 'masterPasswordPolicy',
+  };
+}
+
+function keysResponse(user: User): Record<string, unknown> {
   const accountKeys = buildAccountKeys(user);
   return {
-    id: user.id,
-    name: user.name,
-    email: user.email,
-    emailVerified: true,
-    premium: true,
-    premiumFromOrganization: false,
-    usesKeyConnector: false,
-    masterPasswordHint: user.masterPasswordHint,
-    culture: 'en-US',
-    twoFactorEnabled: !!user.totpSecret,
+    Key: user.key,
+    PublicKey: user.publicKey ?? '',
+    PrivateKey: user.privateKey ?? '',
+    AccountKeys: accountKeys,
+    Object: 'keys',
     key: user.key,
-    privateKey: user.privateKey,
+    publicKey: user.publicKey ?? '',
+    privateKey: user.privateKey ?? '',
     accountKeys,
-    securityStamp: user.securityStamp || user.id,
-    organizations: [],
-    providers: [],
-    providerOrganizations: [],
-    forcePasswordReset: false,
-    avatarColor: null,
-    creationDate: user.createdAt,
-    verifyDevices: user.verifyDevices,
-    role: user.role,
-    status: user.status,
-    object: 'profile',
+    object: 'keys',
   };
 }
 
@@ -244,20 +353,31 @@ export async function handleRegister(request: Request, env: Env): Promise<Respon
     return errorResponse('Invite code is required', 403);
   }
 
+  const inviteMarked = await storage.markInviteUsed(inviteCode, user.id);
+  if (!inviteMarked) {
+    return errorResponse('Invite code is invalid or expired', 403);
+  }
+
   try {
     await storage.createUser(user);
   } catch (error) {
+    await storage.revertInviteUsed(inviteCode, user.id);
     const msg = error instanceof Error ? error.message.toLowerCase() : String(error).toLowerCase();
     if (msg.includes('unique') || msg.includes('constraint')) {
       return errorResponse('Email already registered', 409);
     }
+    console.error('Registration failed after invite reservation:', error);
     throw error;
   }
 
-  const inviteMarked = await storage.markInviteUsed(inviteCode, user.id);
-  if (!inviteMarked) {
-    await storage.deleteUserById(user.id);
-    return errorResponse('Invite code is invalid or expired', 403);
+  try {
+    const assigned = await storage.assignInviteUsedBy(inviteCode, user.id);
+    if (!assigned) {
+      console.warn('Invite used_by was not assigned after registration', { inviteCode, userId: user.id });
+    }
+  } catch (error) {
+    // The invite is already consumed. Do not reactivate it after the user row exists.
+    console.error('Invite used_by assignment failed after registration:', error);
   }
 
   await writeAuditEvent(storage, {
@@ -353,7 +473,7 @@ export async function handleGetProfile(request: Request, env: Env, userId: strin
   const storage = new StorageService(env.DB);
   const user = await storage.getUserById(userId);
   if (!user) return errorResponse('User not found', 404);
-  return jsonResponse(toProfile(user, env));
+  return jsonResponse(buildProfileResponse(user, env));
 }
 
 // PUT /api/accounts/profile
@@ -392,7 +512,7 @@ export async function handleUpdateProfile(request: Request, env: Env, userId: st
     },
   });
 
-  return jsonResponse(toProfile(user, env));
+  return jsonResponse(buildProfileResponse(user, env));
 }
 
 // PUT/POST /api/accounts/verify-devices
@@ -406,6 +526,7 @@ export async function handleSetVerifyDevices(request: Request, env: Env, userId:
     secret?: string;
     masterPasswordHash?: string;
     verifyDevices?: boolean;
+    VerifyDevices?: boolean;
   };
   try {
     body = await request.json();
@@ -413,7 +534,8 @@ export async function handleSetVerifyDevices(request: Request, env: Env, userId:
     return errorResponse('Invalid JSON', 400);
   }
 
-  if (typeof body.verifyDevices !== 'boolean') {
+  const verifyDevices = typeof body.verifyDevices === 'boolean' ? body.verifyDevices : body.VerifyDevices;
+  if (typeof verifyDevices !== 'boolean') {
     return errorResponse('verifyDevices must be true or false', 400);
   }
 
@@ -422,7 +544,7 @@ export async function handleSetVerifyDevices(request: Request, env: Env, userId:
     return errorResponse('User verification failed.', 400);
   }
 
-  user.verifyDevices = body.verifyDevices;
+  user.verifyDevices = verifyDevices;
   user.updatedAt = new Date().toISOString();
   await storage.saveUser(user);
   await writeAuditEvent(storage, {
@@ -441,6 +563,19 @@ export async function handleSetVerifyDevices(request: Request, env: Env, userId:
   return new Response(null, { status: 200 });
 }
 
+// GET /api/accounts/keys
+export async function handleGetKeys(request: Request, env: Env, userId: string): Promise<Response> {
+  void request;
+  const storage = new StorageService(env.DB);
+  const user = await storage.getUserById(userId);
+
+  if (!user) {
+    return errorResponse('User not found', 404);
+  }
+
+  return jsonResponse(keysResponse(user));
+}
+
 // POST /api/accounts/keys
 export async function handleSetKeys(request: Request, env: Env, userId: string): Promise<Response> {
   const storage = new StorageService(env.DB);
@@ -501,7 +636,7 @@ export async function handleSetKeys(request: Request, env: Env, userId: string):
     },
   });
 
-  return handleGetProfile(request, env, userId);
+  return jsonResponse(keysResponse(user));
 }
 
 // POST/PUT /api/accounts/password
@@ -515,6 +650,7 @@ export async function handleChangePassword(request: Request, env: Env, userId: s
     masterPasswordHash?: string;
     currentPasswordHash?: string;
     newMasterPasswordHash?: string;
+    masterPasswordHint?: string | null;
     key?: string;
     newKey?: string;
     encryptedPrivateKey?: string;
@@ -525,6 +661,8 @@ export async function handleChangePassword(request: Request, env: Env, userId: s
     kdfIterations?: number;
     kdfMemory?: number;
     kdfParallelism?: number;
+    authenticationData?: Record<string, unknown>;
+    unlockData?: Record<string, unknown>;
   };
   try {
     body = await request.json();
@@ -537,10 +675,16 @@ export async function handleChangePassword(request: Request, env: Env, userId: s
   const valid = await auth.verifyPassword(currentHash, user.masterPasswordHash, user.email);
   if (!valid) return errorResponse('Invalid password', 400);
 
-  if (!body.newMasterPasswordHash) {
+  const newMasterPasswordHash =
+    body.newMasterPasswordHash ||
+    readNestedString(body, ['authenticationData', 'masterPasswordAuthenticationHash']);
+  if (!newMasterPasswordHash) {
     return errorResponse('newMasterPasswordHash is required', 400);
   }
-  const nextKey = body.newKey || body.key;
+  const nextKey =
+    body.newKey ||
+    body.key ||
+    readNestedString(body, ['unlockData', 'masterKeyWrappedUserKey']);
   const nextPrivateKey = body.newEncryptedPrivateKey || body.encryptedPrivateKey;
   const nextPublicKey = body.newPublicKey || body.publicKey;
   if (nextKey && !looksLikeEncString(nextKey)) {
@@ -550,17 +694,24 @@ export async function handleChangePassword(request: Request, env: Env, userId: s
     return errorResponse('new encryptedPrivateKey is not a valid encrypted string', 400);
   }
 
-  const kdfErr = validateKdfParams(body.kdf ?? user.kdfType, body.kdfIterations, body.kdfMemory, body.kdfParallelism);
+  const nextKdf = body.kdf ?? readNestedNumber(body, ['unlockData', 'kdf', 'kdfType']) ?? user.kdfType;
+  const nextKdfIterations = body.kdfIterations ?? readNestedNumber(body, ['unlockData', 'kdf', 'iterations']);
+  const nextKdfMemory = body.kdfMemory ?? readNestedNumber(body, ['unlockData', 'kdf', 'memory']);
+  const nextKdfParallelism = body.kdfParallelism ?? readNestedNumber(body, ['unlockData', 'kdf', 'parallelism']);
+  const kdfErr = validateKdfParams(nextKdf, nextKdfIterations, nextKdfMemory, nextKdfParallelism);
   if (kdfErr) return errorResponse(kdfErr, 400);
 
-  user.masterPasswordHash = await auth.hashPasswordServer(body.newMasterPasswordHash, user.email);
+  user.masterPasswordHash = await auth.hashPasswordServer(newMasterPasswordHash, user.email);
   if (nextKey) user.key = nextKey;
   if (nextPrivateKey) user.privateKey = nextPrivateKey;
   if (nextPublicKey) user.publicKey = nextPublicKey;
-  if (typeof body.kdf === 'number') user.kdfType = body.kdf;
-  if (typeof body.kdfIterations === 'number') user.kdfIterations = body.kdfIterations;
-  if (typeof body.kdfMemory === 'number') user.kdfMemory = body.kdfMemory;
-  if (typeof body.kdfParallelism === 'number') user.kdfParallelism = body.kdfParallelism;
+  if (typeof nextKdf === 'number') user.kdfType = nextKdf;
+  if (typeof nextKdfIterations === 'number') user.kdfIterations = nextKdfIterations;
+  if (typeof nextKdfMemory === 'number') user.kdfMemory = nextKdfMemory;
+  if (typeof nextKdfParallelism === 'number') user.kdfParallelism = nextKdfParallelism;
+  if (typeof body.masterPasswordHint === 'string' || body.masterPasswordHint === null) {
+    user.masterPasswordHint = body.masterPasswordHint;
+  }
   user.securityStamp = generateUUID();
   user.updatedAt = new Date().toISOString();
   await storage.saveUser(user);
@@ -592,8 +743,166 @@ export async function handleGetTotpStatus(request: Request, env: Env, userId: st
   });
 }
 
+function twoFactorProviderResponse(type: number, enabled: boolean): Record<string, unknown> {
+  return {
+    Enabled: enabled,
+    Type: type,
+    Object: 'twoFactorProvider',
+  };
+}
+
+function twoFactorAuthenticatorResponse(
+  enabled: boolean,
+  key: string,
+  userVerificationToken?: string
+): Record<string, unknown> {
+  return {
+    Enabled: enabled,
+    Key: key,
+    UserVerificationToken: userVerificationToken ?? null,
+    Object: 'twoFactorAuthenticator',
+  };
+}
+
+// GET /api/two-factor
+export async function handleGetTwoFactorProviders(request: Request, env: Env, userId: string): Promise<Response> {
+  void request;
+  const storage = new StorageService(env.DB);
+  const user = await storage.getUserById(userId);
+  if (!user) return errorResponse('User not found', 404);
+
+  const data = user.totpSecret
+    ? [twoFactorProviderResponse(TWO_FACTOR_PROVIDER_AUTHENTICATOR, true)]
+    : [];
+
+  return jsonResponse({
+    Data: data,
+    ContinuationToken: null,
+    Object: 'list',
+  });
+}
+
+// POST /api/two-factor/get-authenticator
+export async function handleGetTwoFactorAuthenticator(request: Request, env: Env, userId: string): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  const auth = new AuthService(env);
+  const user = await storage.getUserById(userId);
+  if (!user) return errorResponse('User not found', 404);
+
+  let body: Record<string, unknown>;
+  try {
+    body = await readRequestBody(request);
+  } catch {
+    return errorResponse('Invalid JSON', 400);
+  }
+
+  const secret = readBodyString(body, ['masterPasswordHash', 'MasterPasswordHash', 'otp', 'OTP', 'secret', 'Secret']);
+  const verified = await verifyUserSecret(auth, user, secret);
+  if (!verified) return errorResponse('User verification failed.', 400);
+
+  const key = normalizeTotpSecret(user.totpSecret || '') || randomBase32Secret();
+  const userVerificationToken = await createTotpUserVerificationToken(env, user, key);
+  return jsonResponse(twoFactorAuthenticatorResponse(!!user.totpSecret, key, userVerificationToken));
+}
+
+// PUT/POST /api/two-factor/authenticator
+export async function handlePutTwoFactorAuthenticator(request: Request, env: Env, userId: string): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  const user = await storage.getUserById(userId);
+  if (!user) return errorResponse('User not found', 404);
+
+  let body: Record<string, unknown>;
+  try {
+    body = await readRequestBody(request);
+  } catch {
+    return errorResponse('Invalid JSON', 400);
+  }
+
+  const key = normalizeTotpSecret(readBodyString(body, ['key', 'Key']));
+  const token = readBodyString(body, ['token', 'Token']).trim();
+  const userVerificationToken = readBodyString(body, ['userVerificationToken', 'UserVerificationToken']);
+  if (!key || !token || !userVerificationToken) {
+    return errorResponse('Key, token and userVerificationToken are required', 400);
+  }
+  if (!await verifyTotpUserVerificationToken(env, user, key, userVerificationToken)) {
+    return errorResponse('User verification failed.', 400);
+  }
+  if (!isTotpEnabled(key)) return errorResponse('Invalid TOTP secret', 400);
+  if (!await verifyTotpToken(key, token)) return errorResponse('Invalid token.', 400);
+
+  user.totpSecret = key;
+  if (!user.totpRecoveryCode) {
+    user.totpRecoveryCode = createRecoveryCode();
+  }
+  user.updatedAt = new Date().toISOString();
+  await storage.saveUser(user);
+  await storage.deleteRefreshTokensByUserId(user.id);
+  AuthService.invalidateUserCache(user.id);
+  await writeAuditEvent(storage, {
+    actorUserId: user.id,
+    action: 'account.totp.enable',
+    category: 'security',
+    level: 'security',
+    targetType: 'user',
+    targetId: user.id,
+    metadata: auditRequestMetadata(request),
+  });
+
+  return jsonResponse(twoFactorAuthenticatorResponse(true, key));
+}
+
+// DELETE /api/two-factor/authenticator and PUT/POST /api/two-factor/disable
+export async function handleDisableTwoFactorProvider(request: Request, env: Env, userId: string): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  const auth = new AuthService(env);
+  const user = await storage.getUserById(userId);
+  if (!user) return errorResponse('User not found', 404);
+
+  let body: Record<string, unknown>;
+  try {
+    body = await readRequestBody(request);
+  } catch {
+    return errorResponse('Invalid JSON', 400);
+  }
+
+  const typeRaw = body.type ?? body.Type ?? TWO_FACTOR_PROVIDER_AUTHENTICATOR;
+  const type = typeof typeRaw === 'number' ? typeRaw : Number.parseInt(String(typeRaw), 10);
+  if (type !== TWO_FACTOR_PROVIDER_AUTHENTICATOR) {
+    return errorResponse('Two-factor provider is not supported by this server.', 400);
+  }
+
+  const key = normalizeTotpSecret(readBodyString(body, ['key', 'Key']));
+  const userVerificationToken = readBodyString(body, ['userVerificationToken', 'UserVerificationToken']);
+  const secret = readBodyString(body, ['masterPasswordHash', 'MasterPasswordHash', 'otp', 'OTP', 'secret', 'Secret']);
+  let verified = false;
+  if (key && userVerificationToken) {
+    verified = await verifyTotpUserVerificationToken(env, user, key, userVerificationToken);
+  }
+  if (!verified) {
+    verified = await verifyUserSecret(auth, user, secret);
+  }
+  if (!verified) return errorResponse('User verification failed.', 400);
+
+  user.totpSecret = null;
+  user.updatedAt = new Date().toISOString();
+  await storage.saveUser(user);
+  await storage.deleteRefreshTokensByUserId(user.id);
+  AuthService.invalidateUserCache(user.id);
+  await writeAuditEvent(storage, {
+    actorUserId: user.id,
+    action: 'account.totp.disable',
+    category: 'security',
+    level: 'security',
+    targetType: 'user',
+    targetId: user.id,
+    metadata: auditRequestMetadata(request),
+  });
+
+  return jsonResponse(twoFactorProviderResponse(TWO_FACTOR_PROVIDER_AUTHENTICATOR, false));
+}
+
 // PUT /api/accounts/totp
-// enable: { enabled: true, secret: "...", token: "123456" }
+// enable: { enabled: true, secret: "...", token: "123456", masterPasswordHash?: "...", userVerificationToken?: "..." }
 // disable: { enabled: false, masterPasswordHash: "..." }
 export async function handleSetTotpStatus(request: Request, env: Env, userId: string): Promise<Response> {
   const storage = new StorageService(env.DB);
@@ -601,7 +910,13 @@ export async function handleSetTotpStatus(request: Request, env: Env, userId: st
   const user = await storage.getUserById(userId);
   if (!user) return errorResponse('User not found', 404);
 
-  let body: { enabled?: boolean; secret?: string; token?: string; masterPasswordHash?: string };
+  let body: {
+    enabled?: boolean;
+    secret?: string;
+    token?: string;
+    masterPasswordHash?: string;
+    userVerificationToken?: string;
+  };
   try {
     body = await request.json();
   } catch {
@@ -610,12 +925,24 @@ export async function handleSetTotpStatus(request: Request, env: Env, userId: st
 
   if (body.enabled === true) {
     const normalizedSecret = normalizeTotpSecret(body.secret || '');
+    const masterPasswordHash = readBodyString(body, ['masterPasswordHash', 'MasterPasswordHash']);
+    const userVerificationToken = readBodyString(body, ['userVerificationToken', 'UserVerificationToken']);
     if (!isTotpEnabled(normalizedSecret)) {
       return errorResponse('Invalid TOTP secret', 400);
     }
     if (!body.token) {
       return errorResponse('TOTP token is required', 400);
     }
+    let verifiedUser = false;
+    if (userVerificationToken) {
+      verifiedUser = await verifyTotpUserVerificationToken(env, user, normalizedSecret, userVerificationToken);
+    }
+    if (!verifiedUser && masterPasswordHash) {
+      verifiedUser = await auth.verifyPassword(masterPasswordHash, user.masterPasswordHash, user.email);
+    }
+    if (!verifiedUser) {
+      return errorResponse('User verification failed.', 400);
+    }
     const verified = await verifyTotpToken(normalizedSecret, body.token);
     if (!verified) {
       return errorResponse('Invalid TOTP token', 400);
@@ -699,7 +1026,9 @@ export async function handleGetTotpRecoveryCode(request: Request, env: Env, user
   }
 
   return jsonResponse({
+    Code: user.totpRecoveryCode,
     code: user.totpRecoveryCode,
+    Object: 'twoFactorRecover',
     object: 'twoFactorRecover',
   });
 }
@@ -809,23 +1138,26 @@ export async function handleVerifyPassword(request: Request, env: Env, userId: s
     return errorResponse('User not found', 404);
   }
 
-  let body: { masterPasswordHash?: string };
+  let body: { masterPasswordHash?: string; authenticationData?: Record<string, unknown> };
   try {
     body = await request.json();
   } catch {
     return errorResponse('Invalid JSON', 400);
   }
 
-  if (!body.masterPasswordHash) {
+  const masterPasswordHash =
+    body.masterPasswordHash ||
+    readNestedString(body, ['authenticationData', 'masterPasswordAuthenticationHash']);
+  if (!masterPasswordHash) {
     return errorResponse('masterPasswordHash is required', 400);
   }
 
-  const valid = await auth.verifyPassword(body.masterPasswordHash, user.masterPasswordHash, user.email);
+  const valid = await auth.verifyPassword(masterPasswordHash, user.masterPasswordHash, user.email);
   if (!valid) {
     return errorResponse('Invalid password', 400);
   }
 
-  return new Response(null, { status: 200 });
+  return jsonResponse(masterPasswordPolicyResponse());
 }
 
 // POST /api/accounts/api-key

src/handlers/attachments.ts

@@ -1,9 +1,10 @@
-import { Env, Attachment, DEFAULT_DEV_SECRET } from '../types';
-import { notifyUserVaultSync } from '../durable/notifications-hub';
+import { Env, Attachment, Cipher, DEFAULT_DEV_SECRET } from '../types';
+import { notifyUserCipherUpdate, notifyUserVaultSync } from '../durable/notifications-hub';
 import { StorageService } from '../services/storage';
 import { jsonResponse, errorResponse } from '../utils/response';
 import { buildDirectUploadUrl, getSafeJwtSecret, parseDirectUploadPayload } from '../utils/direct-upload';
 import { generateUUID } from '../utils/uuid';
+import { sanitizeDownloadContentType } from '../utils/content-type';
 import {
   createAttachmentUploadToken,
   createFileDownloadToken,
@@ -31,6 +32,38 @@ function notifyVaultSyncForRequest(
   notifyUserVaultSync(env, userId, revisionDate, readActingDeviceIdentifier(request));
 }
 
+function normalizeOptionalId(value: unknown): string | null {
+  if (value == null) return null;
+  const normalized = String(value).trim();
+  return normalized ? normalized : null;
+}
+
+function notifyCipherUpdateForRequest(
+  request: Request,
+  env: Env,
+  cipher: Cipher,
+  revisionDate: string
+): void {
+  notifyUserCipherUpdate(env, {
+    userId: cipher.userId,
+    cipherId: cipher.id,
+    revisionDate,
+    organizationId: normalizeOptionalId((cipher as any).organizationId ?? null),
+    collectionIds: Array.isArray((cipher as any).collectionIds)
+      ? (cipher as any).collectionIds.map((id: unknown) => String(id || '').trim()).filter(Boolean)
+      : null,
+    contextId: readActingDeviceIdentifier(request),
+  });
+}
+
+function contentDispositionAttachment(fileName: string | null | undefined): string {
+  const fallback = 'attachment';
+  const value = String(fileName || fallback)
+    .replace(/[\r\n"]/g, '_')
+    .trim() || fallback;
+  return `attachment; filename="${value}"`;
+}
+
 async function writeAttachmentAudit(
   storage: StorageService,
   request: Request,
@@ -75,6 +108,7 @@ async function runWithConcurrency<T>(
 async function processAttachmentUpload(
   request: Request,
   env: Env,
+  cipher: Cipher,
   attachment: Attachment,
   cipherId: string
 ): Promise<Response> {
@@ -116,6 +150,7 @@ async function processAttachmentUpload(
   const revisionInfo = await storage.updateCipherRevisionDate(cipherId);
   if (revisionInfo) {
     notifyVaultSyncForRequest(request, env, revisionInfo.userId, revisionInfo.revisionDate);
+    notifyCipherUpdateForRequest(request, env, cipher, revisionInfo.revisionDate);
   }
 
   return new Response(null, { status: 201 });
@@ -176,6 +211,7 @@ export async function handleCreateAttachment(
   const revisionInfo = await storage.updateCipherRevisionDate(cipherId);
   if (revisionInfo) {
     notifyVaultSyncForRequest(request, env, revisionInfo.userId, revisionInfo.revisionDate);
+    notifyCipherUpdateForRequest(request, env, cipher, revisionInfo.revisionDate);
   }
 
   // Get updated cipher for response
@@ -219,7 +255,7 @@ export async function handleUploadAttachment(
     return errorResponse('Attachment not found', 404);
   }
 
-  return processAttachmentUpload(request, env, attachment, cipherId);
+  return processAttachmentUpload(request, env, cipher, attachment, cipherId);
 }
 
 export async function handlePublicUploadAttachment(
@@ -257,7 +293,7 @@ export async function handlePublicUploadAttachment(
     return errorResponse('Attachment not found', 404);
   }
 
-  return processAttachmentUpload(request, env, attachment, cipherId);
+  return processAttachmentUpload(request, env, cipher, attachment, cipherId);
 }
 
 // GET /api/ciphers/{cipherId}/attachment/{attachmentId}
@@ -348,6 +384,7 @@ export async function handleUpdateAttachmentMetadata(
   const revisionInfo = await storage.updateCipherRevisionDate(cipherId);
   if (revisionInfo) {
     notifyVaultSyncForRequest(request, env, revisionInfo.userId, revisionInfo.revisionDate);
+    notifyCipherUpdateForRequest(request, env, cipher, revisionInfo.revisionDate);
   }
 
   return jsonResponse({
@@ -413,9 +450,11 @@ export async function handlePublicDownloadAttachment(
 
   return new Response(object.body, {
     headers: {
-      'Content-Type': object.contentType || 'application/octet-stream',
+      'Content-Type': sanitizeDownloadContentType(object.contentType),
       'Content-Length': String(object.size),
+      'Content-Disposition': contentDispositionAttachment(attachment.fileName),
       'Cache-Control': 'private, no-cache',
+      'X-Content-Type-Options': 'nosniff',
     },
   });
 }
@@ -453,6 +492,7 @@ export async function handleDeleteAttachment(
   const revisionInfo = await storage.updateCipherRevisionDate(cipherId);
   if (revisionInfo) {
     notifyVaultSyncForRequest(request, env, revisionInfo.userId, revisionInfo.revisionDate);
+    notifyCipherUpdateForRequest(request, env, cipher, revisionInfo.revisionDate);
     await writeAttachmentAudit(storage, request, revisionInfo.userId, 'attachment.delete', {
       id: attachmentId,
       cipherId,
@@ -463,9 +503,13 @@ export async function handleDeleteAttachment(
   // Get updated cipher for response
   const updatedCipher = await storage.getCipher(cipherId);
   const attachments = await storage.getAttachmentsByCipher(cipherId);
+  const cipherResponse = cipherToResponse(updatedCipher!, attachments);
 
   return jsonResponse({
-    cipher: cipherToResponse(updatedCipher!, attachments),
+    Cipher: cipherResponse,
+    cipher: cipherResponse,
+    Object: 'deleteAttachment',
+    object: 'deleteAttachment',
   });
 }
 

src/handlers/auth-requests.ts

@@ -0,0 +1,285 @@
+import type { AuthRequestRecord, AuthRequestType, Env } from '../types';
+import { StorageService } from '../services/storage';
+import { generateUUID } from '../utils/uuid';
+import { readAuthRequestDeviceInfo, readActingDeviceIdentifier } from '../utils/device';
+import { errorResponse, jsonResponse } from '../utils/response';
+import { isAuthRequestExpired } from '../services/storage-auth-request-repo';
+import { notifyAuthRequestResponse, notifyUserAuthRequest } from '../durable/notifications-hub';
+
+const AUTH_REQUEST_TYPE_AUTHENTICATE_AND_UNLOCK = 0;
+const AUTH_REQUEST_TYPE_UNLOCK = 1;
+const AUTH_REQUEST_TYPE_ADMIN_APPROVAL = 2;
+
+function normalizeText(value: unknown, maxLength: number): string {
+  return String(value ?? '').trim().slice(0, maxLength);
+}
+
+function isSerializedEncString(value: unknown): value is string {
+  const text = String(value || '').trim();
+  if (!text) return false;
+  const parts = text.split('.');
+  if (parts.length !== 2) return false;
+  const type = Number(parts[0]);
+  const bodyParts = parts[1].split('|');
+  if (type === 2) return bodyParts.length === 3 && bodyParts.every(Boolean);
+  if (type === 3 || type === 4) return bodyParts.length === 1 && !!bodyParts[0];
+  if (type === 5 || type === 6) return bodyParts.length === 2 && bodyParts.every(Boolean);
+  return false;
+}
+
+function getClientIp(request: Request): string | null {
+  return (
+    request.headers.get('CF-Connecting-IP') ||
+    request.headers.get('X-Forwarded-For')?.split(',')[0]?.trim() ||
+    null
+  );
+}
+
+function getCountryName(request: Request): string | null {
+  return request.headers.get('CF-IPCountry') || null;
+}
+
+function deviceTypeName(type: number): string {
+  const names: Record<number, string> = {
+    0: 'Android',
+    1: 'iOS',
+    2: 'Chrome Extension',
+    3: 'Firefox Extension',
+    4: 'Opera Extension',
+    5: 'Edge Extension',
+    6: 'Windows Desktop',
+    7: 'macOS Desktop',
+    8: 'Linux Desktop',
+    9: 'Chrome',
+    10: 'Firefox',
+    11: 'Opera',
+    12: 'Edge',
+    13: 'Internet Explorer',
+    14: 'Unknown Browser',
+    15: 'Android',
+    16: 'Windows UWP',
+    17: 'Safari',
+    18: 'Vivaldi',
+    19: 'Vivaldi Extension',
+    20: 'Safari Extension',
+    21: 'SDK',
+    22: 'Server',
+    23: 'Windows CLI',
+    24: 'macOS CLI',
+    25: 'Linux CLI',
+    26: 'DuckDuckGo',
+  };
+  return names[type] || `Device ${type}`;
+}
+
+function buildOrigin(request: Request): string {
+  return new URL(request.url).host;
+}
+
+function toAuthRequestResponse(request: Request, authRequest: AuthRequestRecord, requestDeviceId?: string | null) {
+  return {
+    id: authRequest.id,
+    Id: authRequest.id,
+    publicKey: authRequest.publicKey,
+    PublicKey: authRequest.publicKey,
+    requestDeviceIdentifier: authRequest.requestDeviceIdentifier,
+    RequestDeviceIdentifier: authRequest.requestDeviceIdentifier,
+    requestDeviceTypeValue: authRequest.requestDeviceType,
+    RequestDeviceTypeValue: authRequest.requestDeviceType,
+    requestDeviceType: deviceTypeName(authRequest.requestDeviceType),
+    RequestDeviceType: deviceTypeName(authRequest.requestDeviceType),
+    requestIpAddress: authRequest.requestIpAddress,
+    RequestIpAddress: authRequest.requestIpAddress,
+    requestCountryName: authRequest.requestCountryName,
+    RequestCountryName: authRequest.requestCountryName,
+    key: authRequest.key,
+    Key: authRequest.key,
+    masterPasswordHash: authRequest.masterPasswordHash,
+    MasterPasswordHash: authRequest.masterPasswordHash,
+    creationDate: authRequest.creationDate,
+    CreationDate: authRequest.creationDate,
+    responseDate: authRequest.responseDate,
+    ResponseDate: authRequest.responseDate,
+    requestApproved: authRequest.approved ?? false,
+    RequestApproved: authRequest.approved ?? false,
+    requestDeviceId: requestDeviceId ?? null,
+    RequestDeviceId: requestDeviceId ?? null,
+    origin: buildOrigin(request),
+    Origin: buildOrigin(request),
+    object: 'auth-request',
+    Object: 'auth-request',
+  };
+}
+
+function listResponse<T>(data: T[]) {
+  return {
+    data,
+    Data: data,
+    object: 'list',
+    Object: 'list',
+    continuationToken: null,
+    ContinuationToken: null,
+  };
+}
+
+async function readJsonBody(request: Request): Promise<Record<string, any> | null> {
+  try {
+    const body = await request.json();
+    return body && typeof body === 'object' ? body as Record<string, any> : null;
+  } catch {
+    return null;
+  }
+}
+
+function readBodyValue(body: Record<string, any>, names: string[]): unknown {
+  for (const name of names) {
+    if (body[name] !== undefined) return body[name];
+  }
+  return undefined;
+}
+
+function isSupportedAuthRequestType(value: number): value is AuthRequestType {
+  return value === AUTH_REQUEST_TYPE_AUTHENTICATE_AND_UNLOCK || value === AUTH_REQUEST_TYPE_UNLOCK || value === AUTH_REQUEST_TYPE_ADMIN_APPROVAL;
+}
+
+export async function handleCreateAuthRequest(request: Request, env: Env): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  const body = await readJsonBody(request);
+  if (!body) return errorResponse('Invalid request payload', 400);
+
+  const email = normalizeText(readBodyValue(body, ['email', 'Email']), 320).toLowerCase();
+  const publicKey = normalizeText(readBodyValue(body, ['publicKey', 'PublicKey']), 8192);
+  const accessCode = normalizeText(readBodyValue(body, ['accessCode', 'AccessCode']), 25);
+  const requestedType = Number(readBodyValue(body, ['type', 'Type']));
+  const type = Number.isFinite(requestedType) ? requestedType : AUTH_REQUEST_TYPE_AUTHENTICATE_AND_UNLOCK;
+  const deviceInfo = readAuthRequestDeviceInfo(
+    {
+      deviceIdentifier: normalizeText(readBodyValue(body, ['deviceIdentifier', 'DeviceIdentifier']), 128),
+      deviceName: normalizeText(readBodyValue(body, ['deviceName', 'DeviceName']), 128),
+      deviceType: String(readBodyValue(body, ['deviceType', 'DeviceType']) ?? ''),
+    },
+    request
+  );
+
+  if (!email || !publicKey || !accessCode || !deviceInfo.deviceIdentifier) {
+    return errorResponse('Email, public key, device identifier, and access code are required.', 400);
+  }
+  if (!isSupportedAuthRequestType(type) || type === AUTH_REQUEST_TYPE_ADMIN_APPROVAL) {
+    return errorResponse('Invalid auth request type.', 400);
+  }
+
+  const user = await storage.getUser(email);
+  if (!user || user.status !== 'active') {
+    return errorResponse('User or known device not found.', 400);
+  }
+
+  await storage.pruneExpiredAuthRequests();
+  const now = new Date().toISOString();
+  const authRequest: AuthRequestRecord = {
+    id: generateUUID(),
+    userId: user.id,
+    organizationId: null,
+    type,
+    requestDeviceIdentifier: deviceInfo.deviceIdentifier,
+    requestDeviceType: deviceInfo.deviceType,
+    requestIpAddress: getClientIp(request),
+    requestCountryName: getCountryName(request),
+    responseDeviceIdentifier: null,
+    accessCode,
+    publicKey,
+    key: null,
+    masterPasswordHash: null,
+    approved: null,
+    creationDate: now,
+    responseDate: null,
+    authenticationDate: null,
+  };
+  await storage.createAuthRequest(authRequest);
+  notifyUserAuthRequest(env, user.id, authRequest.id, deviceInfo.deviceIdentifier);
+  return jsonResponse(toAuthRequestResponse(request, authRequest));
+}
+
+export async function handleGetAuthRequest(request: Request, env: Env, userId: string, id: string): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  const authRequest = await storage.getAuthRequestById(id);
+  if (!authRequest || authRequest.userId !== userId) return errorResponse('Not found', 404);
+  return jsonResponse(toAuthRequestResponse(request, authRequest));
+}
+
+export async function handleGetAuthRequestResponse(request: Request, env: Env, id: string): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  const url = new URL(request.url);
+  const accessCode = normalizeText(url.searchParams.get('code'), 25);
+  const authRequest = await storage.getAuthRequestById(id);
+  if (!authRequest || authRequest.accessCode !== accessCode || isAuthRequestExpired(authRequest)) {
+    return errorResponse('Not found', 404);
+  }
+  return jsonResponse(toAuthRequestResponse(request, authRequest));
+}
+
+export async function handleListAuthRequests(request: Request, env: Env, userId: string): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  const authRequests = await storage.listAuthRequestsByUserId(userId);
+  return jsonResponse(listResponse(authRequests.map((authRequest) => toAuthRequestResponse(request, authRequest))));
+}
+
+export async function handleListPendingAuthRequests(request: Request, env: Env, userId: string): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  await storage.pruneExpiredAuthRequests();
+  const authRequests = await storage.listPendingAuthRequestsByUserId(userId);
+  const rows = await Promise.all(authRequests.map(async (authRequest) => {
+    const device = await storage.getDevice(userId, authRequest.requestDeviceIdentifier);
+    return toAuthRequestResponse(request, authRequest, device?.deviceIdentifier ?? authRequest.requestDeviceIdentifier);
+  }));
+  return jsonResponse(listResponse(rows));
+}
+
+export async function handleUpdateAuthRequest(request: Request, env: Env, userId: string, id: string): Promise<Response> {
+  const storage = new StorageService(env.DB);
+  const body = await readJsonBody(request);
+  if (!body) return errorResponse('Invalid request payload', 400);
+
+  const authRequest = await storage.getAuthRequestById(id);
+  if (!authRequest || authRequest.userId !== userId || isAuthRequestExpired(authRequest)) {
+    return errorResponse('Not found', 404);
+  }
+  if (authRequest.approved !== null || authRequest.responseDate || authRequest.authenticationDate) {
+    return errorResponse('Auth request has already been answered.', 409);
+  }
+
+  const latestForUser = await storage.listPendingAuthRequestsByUserId(userId);
+  const latestForDevice = latestForUser.find((item) => item.requestDeviceIdentifier === authRequest.requestDeviceIdentifier);
+  if (latestForDevice?.id !== authRequest.id) {
+    return errorResponse('This request is no longer valid. Make sure to approve the most recent request.', 400);
+  }
+
+  const approved = Boolean(readBodyValue(body, ['requestApproved', 'RequestApproved']));
+  const key = normalizeText(readBodyValue(body, ['key', 'Key']), 20000);
+  const masterPasswordHash = normalizeText(readBodyValue(body, ['masterPasswordHash', 'MasterPasswordHash']), 20000) || null;
+  const responseDeviceIdentifier =
+    normalizeText(readBodyValue(body, ['deviceIdentifier', 'DeviceIdentifier']), 128) ||
+    readActingDeviceIdentifier(request) ||
+    'web';
+
+  if (approved && !key) {
+    return errorResponse('Encrypted key is required to approve the request.', 400);
+  }
+  if (approved && !isSerializedEncString(key)) {
+    return errorResponse('Encrypted key is not a valid encrypted string.', 400);
+  }
+
+  const updated = await storage.updateAuthRequestResponse(id, userId, {
+    approved,
+    responseDeviceIdentifier,
+    key,
+    masterPasswordHash,
+  });
+  if (!updated) return errorResponse('Auth request has already been answered.', 409);
+  const updatedRequest = await storage.getAuthRequestById(id);
+  // Match Bitwarden upstream behavior: only approval wakes the originating anonymous
+  // client. Denials are not pushed to avoid leaking that a login attempt was rejected.
+  if (approved) {
+    await notifyAuthRequestResponse(env, userId, id);
+  }
+  return jsonResponse(toAuthRequestResponse(request, updatedRequest || authRequest));
+}

src/handlers/backup.ts

@@ -21,6 +21,7 @@ import {
   repairBackupSettings,
   requireBackupDestination,
   saveBackupSettings,
+  updateBackupDestinationRuntime,
 } from '../services/backup-config';
 import {
   type BackupImportExecutionResult,
@@ -40,15 +41,51 @@ import {
   uploadBackupArchive,
 } from '../services/backup-uploader';
 import { StorageService } from '../services/storage';
+import { AuthService } from '../services/auth';
 import { auditRequestMetadata, writeAuditEvent } from '../services/audit-events';
 import { getBlobObject } from '../services/blob-store';
 import { notifyUserBackupProgress, notifyUserBackupRestoreProgress } from '../durable/notifications-hub';
+import { verifyPasskeyUserVerificationToken } from '../utils/user-verification-token';
 import { unzipSync } from 'fflate';
 
 function isAdmin(user: User): boolean {
   return user.role === 'admin' && user.status === 'active';
 }
 
+async function requireBackupUserVerification(actorUser: User, masterPasswordHash: string, env: Env): Promise<Response | null> {
+  const normalized = String(masterPasswordHash || '').trim();
+  if (!normalized) {
+    return errorResponse('masterPasswordHash is required', 400);
+  }
+  const auth = new AuthService(env);
+  const valid = await auth.verifyPassword(normalized, actorUser.masterPasswordHash, actorUser.email);
+  if (!valid) {
+    return errorResponse('Invalid password', 400);
+  }
+  return null;
+}
+
+async function requireBackupRepairVerification(
+  actorUser: User,
+  body: { masterPasswordHash?: string; userVerificationToken?: string },
+  env: Env
+): Promise<Response | null> {
+  const masterPasswordHash = String(body.masterPasswordHash || '').trim();
+  if (masterPasswordHash) {
+    return requireBackupUserVerification(actorUser, masterPasswordHash, env);
+  }
+
+  const userVerificationToken = String(body.userVerificationToken || '').trim();
+  if (!userVerificationToken) {
+    return errorResponse('masterPasswordHash or userVerificationToken is required', 400);
+  }
+  const valid = await verifyPasskeyUserVerificationToken(env, userVerificationToken, actorUser.id, 'backup.settings.repair');
+  if (!valid) {
+    return errorResponse('Invalid user verification token', 400);
+  }
+  return null;
+}
+
 async function writeAuditLog(
   storage: StorageService,
   actorUserId: string | null,
@@ -224,6 +261,30 @@ async function uploadRemoteAttachmentChunk(
   }
 }
 
+async function verifyUploadedBackupArchive(
+  session: RemoteBackupTransferSession,
+  archive: BackupArchiveBundle
+): Promise<'metadata' | 'download'> {
+  try {
+    const stat = await session.stat(archive.fileName);
+    if (stat?.size === archive.bytes.byteLength) {
+      return 'metadata';
+    }
+  } catch {
+    // Fall through to a full read-back verification when lightweight metadata is unavailable.
+  }
+
+  const remoteFile = await session.download(archive.fileName);
+  const checksumOk = await verifyBackupArchiveFileNameChecksum(remoteFile.bytes, archive.fileName);
+  if (!checksumOk) {
+    throw new Error('Remote backup ZIP checksum verification failed');
+  }
+  if (remoteFile.bytes.byteLength !== archive.bytes.byteLength) {
+    throw new Error('Remote backup ZIP size verification failed');
+  }
+  return 'download';
+}
+
 export async function executeConfiguredBackup(
   env: Env,
   storage: StorageService,
@@ -251,12 +312,14 @@ export async function executeConfiguredBackup(
   const destination = requireBackupDestination(currentSettings, destinationId);
 
   const now = new Date();
-  destination.runtime.lastAttemptAt = now.toISOString();
-  destination.runtime.lastAttemptLocalDate = getBackupLocalDateKey(now, destination.schedule.timezone);
-  destination.runtime.lastErrorAt = null;
-  destination.runtime.lastErrorMessage = null;
   await touchLease();
-  await saveBackupSettings(storage, env, currentSettings);
+  destination.runtime = await updateBackupDestinationRuntime(storage, destination.id, (runtime) => ({
+    ...runtime,
+    lastAttemptAt: now.toISOString(),
+    lastAttemptLocalDate: getBackupLocalDateKey(now, destination.schedule.timezone),
+    lastErrorAt: null,
+    lastErrorMessage: null,
+  }));
 
   try {
     await touchLease();
@@ -318,6 +381,7 @@ export async function executeConfiguredBackup(
       }
     }
     let upload: Awaited<ReturnType<typeof uploadBackupArchive>> | null = null;
+    let uploadVerificationMethod: 'metadata' | 'download' | null = null;
     for (let attempt = 1; attempt <= maxArchiveUploadAttempts; attempt++) {
       await touchLease();
       await progress?.({
@@ -337,14 +401,7 @@ export async function executeConfiguredBackup(
           stageTitle: 'txt_backup_remote_run_progress_verify_title',
           stageDetail: 'txt_backup_remote_run_progress_verify_detail',
         });
-        const remoteFile = await remoteSession.download(archive.fileName);
-        const checksumOk = await verifyBackupArchiveFileNameChecksum(remoteFile.bytes, archive.fileName);
-        if (!checksumOk) {
-          throw new Error('Remote backup ZIP checksum verification failed');
-        }
-        if (remoteFile.bytes.byteLength !== archive.bytes.byteLength) {
-          throw new Error('Remote backup ZIP size verification failed');
-        }
+        uploadVerificationMethod = await verifyUploadedBackupArchive(remoteSession, archive);
         break;
       } catch (error) {
         await remoteSession.deleteFile(archive.fileName).catch(() => undefined);
@@ -373,14 +430,16 @@ export async function executeConfiguredBackup(
       pruneErrorMessage = error instanceof Error ? error.message : 'Old backup cleanup failed';
     }
 
-    destination.runtime.lastSuccessAt = new Date().toISOString();
-    destination.runtime.lastErrorAt = null;
-    destination.runtime.lastErrorMessage = null;
-    destination.runtime.lastUploadedFileName = archive.fileName;
-    destination.runtime.lastUploadedSizeBytes = archive.bytes.byteLength;
-    destination.runtime.lastUploadedDestination = upload.remotePath;
     await touchLease();
-    await saveBackupSettings(storage, env, currentSettings);
+    destination.runtime = await updateBackupDestinationRuntime(storage, destination.id, (runtime) => ({
+      ...runtime,
+      lastSuccessAt: new Date().toISOString(),
+      lastErrorAt: null,
+      lastErrorMessage: null,
+      lastUploadedFileName: archive.fileName,
+      lastUploadedSizeBytes: archive.bytes.byteLength,
+      lastUploadedDestination: upload.remotePath,
+    }));
 
     await touchLease();
     await writeAuditLog(storage, actorUserId, `admin.backup.remote.${trigger}`, 'backup', null, {
@@ -390,6 +449,7 @@ export async function executeConfiguredBackup(
       fileName: archive.fileName,
       fileBytes: archive.bytes.byteLength,
       uploadVerificationAttempts: maxArchiveUploadAttempts,
+      uploadVerificationMethod,
       prunedFileCount,
       pruneError: pruneErrorMessage,
       ...(auditMetadata || {}),
@@ -412,15 +472,18 @@ export async function executeConfiguredBackup(
       provider: upload.provider,
     };
   } catch (error) {
-    destination.runtime.lastErrorAt = new Date().toISOString();
-    destination.runtime.lastErrorMessage = error instanceof Error ? error.message : 'Backup upload failed';
+    const errorMessage = error instanceof Error ? error.message : 'Backup upload failed';
     await touchLease();
-    await saveBackupSettings(storage, env, currentSettings);
+    destination.runtime = await updateBackupDestinationRuntime(storage, destination.id, (runtime) => ({
+      ...runtime,
+      lastErrorAt: new Date().toISOString(),
+      lastErrorMessage: errorMessage,
+    }));
 
     await touchLease();
     await writeAuditLog(storage, actorUserId, `admin.backup.remote.${trigger}.failed`, 'backup', null, {
       ...getBackupDestinationSummary(destination),
-      error: destination.runtime.lastErrorMessage,
+      error: errorMessage,
       ...(auditMetadata || {}),
     });
     await progress?.({
@@ -431,7 +494,7 @@ export async function executeConfiguredBackup(
       stageDetail: 'txt_backup_remote_run_progress_failed_detail',
       done: true,
       ok: false,
-      error: destination.runtime.lastErrorMessage,
+      error: errorMessage,
     });
     throw error;
   }
@@ -619,12 +682,18 @@ export async function importAndAuditRemoteBackupFile(
   replaceExisting: boolean,
   checksumMismatchAccepted: boolean,
   auditMetadata: Record<string, unknown> | null = null,
-  targetDeviceIdentifier: string | null = null
+  targetDeviceIdentifier: string | null = null,
+  keepAlive?: (() => Promise<void>) | null
 ): Promise<BackupImportExecutionResult> {
+  const touchLease = async () => {
+    await keepAlive?.();
+  };
   const restoreFileName = remoteFile.fileName || remotePath.split('/').pop() || remotePath;
+  await touchLease();
   const externalAttachmentBlobNames = collectExternalRemoteAttachmentBlobNames(remoteFile.bytes);
   const externalAttachmentCache = new Map<string, Uint8Array | null>();
   const progress: BackupRestoreProgressReporter = async (event) => {
+    await touchLease();
     await notifyUserBackupRestoreProgress(
       env,
       actorUserId,
@@ -642,6 +711,7 @@ export async function importAndAuditRemoteBackupFile(
     replaceExisting,
     {
       loadAttachment: async (blobName) => {
+        await touchLease();
         const normalized = String(blobName || '').trim();
         if (!normalized) return null;
         if (externalAttachmentCache.has(normalized)) {
@@ -664,6 +734,7 @@ export async function importAndAuditRemoteBackupFile(
         } catch {
           externalAttachmentCache.set(normalized, await downloadRemoteAttachmentViaDurableObject(env, destination, normalized).catch(() => null));
         }
+        await touchLease();
         return externalAttachmentCache.get(normalized) || null;
       },
     },
@@ -787,13 +858,16 @@ export async function handleGetAdminBackupSettings(request: Request, env: Env, a
 export async function handleUpdateAdminBackupSettings(request: Request, env: Env, actorUser: User): Promise<Response> {
   if (!isAdmin(actorUser)) return errorResponse('Forbidden', 403);
 
-  let body: BackupSettingsInput;
+  let body: BackupSettingsInput & { masterPasswordHash?: string };
   try {
-    body = await request.json<BackupSettingsInput>();
+    body = await request.json<BackupSettingsInput & { masterPasswordHash?: string }>();
   } catch {
     return errorResponse('Backup settings payload is invalid', 400);
   }
 
+  const verificationError = await requireBackupUserVerification(actorUser, String(body.masterPasswordHash || ''), env);
+  if (verificationError) return verificationError;
+
   const storage = new StorageService(env.DB);
   let previous;
   try {
@@ -837,13 +911,16 @@ export async function handleGetAdminBackupSettingsRepairState(request: Request,
 export async function handleRepairAdminBackupSettings(request: Request, env: Env, actorUser: User): Promise<Response> {
   if (!isAdmin(actorUser)) return errorResponse('Forbidden', 403);
 
-  let body: BackupSettingsInput;
+  let body: BackupSettingsInput & { masterPasswordHash?: string; userVerificationToken?: string };
   try {
-    body = await request.json<BackupSettingsInput>();
+    body = await request.json<BackupSettingsInput & { masterPasswordHash?: string; userVerificationToken?: string }>();
   } catch {
     return errorResponse('Backup settings repair payload is invalid', 400);
   }
 
+  const verificationError = await requireBackupRepairVerification(actorUser, body, env);
+  if (verificationError) return verificationError;
+
   const storage = new StorageService(env.DB);
   let previous;
   try {
@@ -871,15 +948,18 @@ export async function handleRunAdminConfiguredBackup(request: Request, env: Env,
   if (!isAdmin(actorUser)) return errorResponse('Forbidden', 403);
 
   try {
-    let body: { destinationId?: string } | null = null;
+    let body: { destinationId?: string; masterPasswordHash?: string } | null = null;
     try {
       if ((request.headers.get('Content-Type') || '').includes('application/json')) {
-        body = await request.json<{ destinationId?: string }>();
+        body = await request.json<{ destinationId?: string; masterPasswordHash?: string }>();
       }
     } catch {
       return errorResponse('Backup run payload is invalid', 400);
     }
 
+    const verificationError = await requireBackupUserVerification(actorUser, String(body?.masterPasswordHash || ''), env);
+    if (verificationError) return verificationError;
+
     const outcome = await runConfiguredBackupInDurableObject(env, {
       actorUserId: actorUser.id,
       auditMetadata: auditRequestMetadata(request),
@@ -928,12 +1008,21 @@ export async function handleListAdminRemoteBackups(request: Request, env: Env, a
 export async function handleDownloadAdminRemoteBackup(request: Request, env: Env, actorUser: User): Promise<Response> {
   if (!isAdmin(actorUser)) return errorResponse('Forbidden', 403);
 
+  let body: { destinationId?: string; path?: string; masterPasswordHash?: string };
+  try {
+    body = await request.json<{ destinationId?: string; path?: string; masterPasswordHash?: string }>();
+  } catch {
+    return errorResponse('Remote backup download payload is invalid', 400);
+  }
+
+  const verificationError = await requireBackupUserVerification(actorUser, String(body.masterPasswordHash || ''), env);
+  if (verificationError) return verificationError;
+
   const storage = new StorageService(env.DB);
   try {
     const settings = await loadBackupSettings(storage, env, 'UTC');
-    const url = new URL(request.url);
-    const path = ensureRemoteRestoreCandidate(url.searchParams.get('path') || '');
-    const destination = requireBackupDestination(settings, url.searchParams.get('destinationId') || null);
+    const path = ensureRemoteRestoreCandidate(String(body.path || ''));
+    const destination = requireBackupDestination(settings, body.destinationId || null);
     const remoteFile = await downloadRemoteBackupFile(destination, path);
     return new Response(remoteFile.bytes, {
       status: 200,
@@ -994,13 +1083,22 @@ export async function handleDeleteAdminRemoteBackup(request: Request, env: Env,
 export async function handleRestoreAdminRemoteBackup(request: Request, env: Env, actorUser: User): Promise<Response> {
   if (!isAdmin(actorUser)) return errorResponse('Forbidden', 403);
 
-  let body: { destinationId?: string; path?: string; replaceExisting?: boolean; allowChecksumMismatch?: boolean };
+  let body: {
+    destinationId?: string;
+    path?: string;
+    replaceExisting?: boolean;
+    allowChecksumMismatch?: boolean;
+    masterPasswordHash?: string;
+  };
   try {
     body = await request.json<{ destinationId?: string; path?: string; replaceExisting?: boolean }>();
   } catch {
     return errorResponse('Remote restore payload is invalid', 400);
   }
 
+  const verificationError = await requireBackupUserVerification(actorUser, String(body.masterPasswordHash || ''), env);
+  if (verificationError) return verificationError;
+
   try {
     const path = ensureRemoteRestoreCandidate(String(body.path || ''));
     const targetDeviceIdentifier = String(request.headers.get('X-NodeWarden-Acting-Device-Id') || '').trim() || null;
@@ -1028,14 +1126,16 @@ export async function handleAdminExportBackup(request: Request, env: Env, actorU
 
   const storage = new StorageService(env.DB);
   const targetDeviceIdentifier = String(request.headers.get('X-NodeWarden-Acting-Device-Id') || '').trim() || null;
-  let body: { includeAttachments?: boolean } | null = null;
+  let body: { includeAttachments?: boolean; masterPasswordHash?: string } | null = null;
   try {
     if ((request.headers.get('Content-Type') || '').includes('application/json')) {
-      body = await request.json<{ includeAttachments?: boolean }>();
+      body = await request.json<{ includeAttachments?: boolean; masterPasswordHash?: string }>();
     }
   } catch {
     return errorResponse('Backup export payload is invalid', 400);
   }
+  const verificationError = await requireBackupUserVerification(actorUser, String(body?.masterPasswordHash || ''), env);
+  if (verificationError) return verificationError;
   let archive: BackupArchiveBundle;
   try {
     const progress = async (event: {
@@ -1140,6 +1240,9 @@ export async function handleAdminImportBackup(request: Request, env: Env, actorU
     return errorResponse('Backup file is required', 400);
   }
 
+  const verificationError = await requireBackupUserVerification(actorUser, String(formData.get('masterPasswordHash') || ''), env);
+  if (verificationError) return verificationError;
+
   const replaceExisting = String(formData.get('replaceExisting') || '').trim() === '1';
   const allowChecksumMismatch = String(formData.get('allowChecksumMismatch') || '').trim() === '1';
   let archiveBytes: Uint8Array;

src/handlers/ciphers.ts

@@ -11,7 +11,13 @@ import {
   PasswordHistory,
 } from '../types';
 import { StorageService } from '../services/storage';
-import { notifyUserVaultSync } from '../durable/notifications-hub';
+import {
+  notifyUserCipherCreate,
+  notifyUserCipherDelete,
+  notifyUserCipherUpdate,
+  notifyUserCiphersSync,
+  notifyUserVaultSync,
+} from '../durable/notifications-hub';
 import { jsonResponse, errorResponse } from '../utils/response';
 import { generateUUID } from '../utils/uuid';
 import { deleteAllAttachmentsForCipher, deleteAllAttachmentsForCiphers } from './attachments';
@@ -42,6 +48,22 @@ function normalizeOptionalId(value: unknown): string | null {
   return normalized ? normalized : null;
 }
 
+function readBooleanOrFallback(value: unknown, fallback: boolean): boolean {
+  return typeof value === 'boolean' ? value : fallback;
+}
+
+function buildCipherPermissions(passthrough: Record<string, unknown>): { delete: boolean; restore: boolean } {
+  const raw = passthrough.permissions;
+  const source = raw && typeof raw === 'object' && !Array.isArray(raw)
+    ? raw as Record<string, unknown>
+    : null;
+
+  return {
+    delete: readBooleanOrFallback(source?.delete, true),
+    restore: readBooleanOrFallback(source?.restore, true),
+  };
+}
+
 function notifyVaultSyncForRequest(
   request: Request,
   env: Env,
@@ -51,6 +73,60 @@ function notifyVaultSyncForRequest(
   notifyUserVaultSync(env, userId, revisionDate, readActingDeviceIdentifier(request));
 }
 
+function notifyCipherCreateForRequest(
+  request: Request,
+  env: Env,
+  cipher: Cipher,
+  revisionDate: string
+): void {
+  notifyUserCipherCreate(env, {
+    userId: cipher.userId,
+    cipherId: cipher.id,
+    revisionDate,
+    organizationId: normalizeOptionalId((cipher as any).organizationId ?? null),
+    collectionIds: Array.isArray((cipher as any).collectionIds)
+      ? (cipher as any).collectionIds.map((id: unknown) => String(id || '').trim()).filter(Boolean)
+      : null,
+    contextId: readActingDeviceIdentifier(request),
+  });
+}
+
+function notifyCipherUpdateForRequest(
+  request: Request,
+  env: Env,
+  cipher: Cipher,
+  revisionDate: string
+): void {
+  notifyUserCipherUpdate(env, {
+    userId: cipher.userId,
+    cipherId: cipher.id,
+    revisionDate,
+    organizationId: normalizeOptionalId((cipher as any).organizationId ?? null),
+    collectionIds: Array.isArray((cipher as any).collectionIds)
+      ? (cipher as any).collectionIds.map((id: unknown) => String(id || '').trim()).filter(Boolean)
+      : null,
+    contextId: readActingDeviceIdentifier(request),
+  });
+}
+
+function notifyCipherDeleteForRequest(
+  request: Request,
+  env: Env,
+  cipher: Cipher,
+  revisionDate: string
+): void {
+  notifyUserCipherDelete(env, {
+    userId: cipher.userId,
+    cipherId: cipher.id,
+    revisionDate,
+    organizationId: normalizeOptionalId((cipher as any).organizationId ?? null),
+    collectionIds: Array.isArray((cipher as any).collectionIds)
+      ? (cipher as any).collectionIds.map((id: unknown) => String(id || '').trim()).filter(Boolean)
+      : null,
+    contextId: readActingDeviceIdentifier(request),
+  });
+}
+
 function getAliasedProp(source: any, aliases: string[]): { present: boolean; value: any } {
   if (!source || typeof source !== 'object') return { present: false, value: undefined };
   for (const key of aliases) {
@@ -141,6 +217,12 @@ function optionalEncString(value: unknown): string | null {
   return isValidEncString(value) ? value.trim() : null;
 }
 
+function optionalEncStringWithin(value: unknown, maxLength: number): string | null {
+  const normalized = optionalEncString(value);
+  if (!normalized) return null;
+  return normalized.length <= maxLength ? normalized : null;
+}
+
 function shouldAcceptCipherKey(value: unknown): boolean {
   return value == null || value === '' || isValidEncString(value);
 }
@@ -151,13 +233,16 @@ function normalizeCipherKeyForStorage(value: unknown): string | null {
 
 function sanitizeEncryptedObject<T extends Record<string, any>>(
   source: T | null | undefined,
-  encryptedKeys: readonly string[]
+  encryptedKeys: readonly string[] | Record<string, number>
 ): T | null {
   if (!source || typeof source !== 'object') return source ?? null;
   const next: Record<string, any> = { ...source };
-  for (const key of encryptedKeys) {
+  const entries = Array.isArray(encryptedKeys)
+    ? encryptedKeys.map((key) => [key, 10000] as const)
+    : Object.entries(encryptedKeys);
+  for (const [key, maxLength] of entries) {
     if (!Object.prototype.hasOwnProperty.call(next, key)) continue;
-    next[key] = optionalEncString(next[key]);
+    next[key] = optionalEncStringWithin(next[key], maxLength);
   }
   return next as T;
 }
@@ -188,7 +273,12 @@ export function normalizeCipherLoginForCompatibility(
 ): any {
   const normalized = normalizeCipherLoginForStorage(login);
   if (!normalized || typeof normalized !== 'object') return normalized ?? null;
-  const next = sanitizeEncryptedObject(normalized, ['username', 'password', 'totp', 'uri']);
+  const next = sanitizeEncryptedObject(normalized, {
+    username: 1000,
+    password: 5000,
+    totp: 1000,
+    uri: 10000,
+  });
   if (!next) return null;
   next.uris = normalizeCipherLoginUrisForCompatibility(next.uris, {
     requiresUriChecksum,
@@ -214,23 +304,19 @@ function normalizeCipherLoginUrisForCompatibility(
     const hasChecksum = isValidEncString(next.uriChecksum);
     const hasMatch = next.match != null;
 
-    if (hasUri && hasChecksum) {
+    if (hasUri && String(next.uri).trim().length > 10000) continue;
+    if (hasChecksum && String(next.uriChecksum).trim().length > 10000) {
+      next.uriChecksum = null;
+    }
+
+    if (hasUri && isValidEncString(next.uriChecksum)) {
       out.push(next);
       continue;
     }
 
     if (hasUri && !hasChecksum) {
-      if (options.preserveRepairableUris) {
-        // Preserve the encrypted URI so NodeWarden Web can decrypt it and repair
-        // the missing checksum. Dropping it here makes the URI appear lost and
-        // can turn a display-only compatibility issue into data loss on save.
-        out.push({ ...next, uriChecksum: null });
-        continue;
-      }
-      // Bitwarden browser clients using the SDK drop item-key encrypted URIs
-      // whose checksum is missing/invalid. User-key encrypted legacy/import
-      // entries bypass this validation and can safely keep the URI.
-      if (options.requiresUriChecksum) continue;
+      // Official Bitwarden treats UriChecksum as nullable encrypted metadata.
+      // Keep the URI intact and let clients that can repair checksums do so.
       out.push({ ...next, uriChecksum: null });
       continue;
     }
@@ -243,14 +329,27 @@ function normalizeCipherLoginUrisForCompatibility(
   return out.length ? out : null;
 }
 
-function hasMissingLoginUriChecksum(cipher: Cipher): boolean {
-  if (!cipher.key || !cipher.login || typeof cipher.login !== 'object') return false;
-  const uris = (cipher.login as any).uris;
-  if (!Array.isArray(uris)) return false;
-  return uris.some((uri: any) => {
-    if (!uri || typeof uri !== 'object') return false;
-    return isValidEncString(uri.uri) && !isValidEncString(uri.uriChecksum);
-  });
+export function validateCipherEncryptedFieldsForCompatibility(cipher: Cipher): string | null {
+  if (cipher.name != null && !optionalEncStringWithin(cipher.name, 1000)) return 'Cipher name must be an encrypted string up to 1000 characters.';
+  if (cipher.notes != null && !optionalEncStringWithin(cipher.notes, 10000)) return 'Cipher notes must be an encrypted string up to 10000 characters.';
+
+  const login = cipher.login as any;
+  if (login && typeof login === 'object') {
+    if (login.username != null && !optionalEncStringWithin(login.username, 1000)) return 'Login username must be an encrypted string up to 1000 characters.';
+    if (login.password != null && !optionalEncStringWithin(login.password, 5000)) return 'Login password must be an encrypted string up to 5000 characters.';
+    if (login.totp != null && !optionalEncStringWithin(login.totp, 1000)) return 'Login TOTP must be an encrypted string up to 1000 characters.';
+    if (login.uri != null && !optionalEncStringWithin(login.uri, 10000)) return 'Login URI must be an encrypted string up to 10000 characters.';
+
+    if (Array.isArray(login.uris)) {
+      for (const uri of login.uris) {
+        if (!uri || typeof uri !== 'object') continue;
+        if (uri.uri != null && !optionalEncStringWithin(uri.uri, 10000)) return 'Login URI must be an encrypted string up to 10000 characters.';
+        if (uri.uriChecksum != null && !optionalEncStringWithin(uri.uriChecksum, 10000)) return 'Login URI checksum must be an encrypted string up to 10000 characters.';
+      }
+    }
+  }
+
+  return null;
 }
 
 function normalizeFido2CredentialsForCompatibility(credentials: any): any[] | null {
@@ -589,7 +688,14 @@ export function cipherToResponse(
     !!responseCipherKey,
     !!options.preserveRepairableUris
   );
-  const normalizedCard = sanitizeEncryptedObject((passthrough as any).card ?? null, ['cardholderName', 'brand', 'number', 'expMonth', 'expYear', 'code']);
+  const normalizedCard = sanitizeEncryptedObject((passthrough as any).card ?? null, {
+    cardholderName: 1000,
+    brand: 1000,
+    number: 1000,
+    expMonth: 1000,
+    expYear: 1000,
+    code: 1000,
+  });
   const normalizedIdentity = sanitizeEncryptedObject((passthrough as any).identity ?? null, [
     'title',
     'firstName',
@@ -615,6 +721,7 @@ export function cipherToResponse(
     ? normalizeCipherSecureNoteForCompatibility((passthrough as any).secureNote ?? null) ?? { type: 0 }
     : null;
   const responseAttachments = applyCipherEmbeddedAttachmentMetadata(cipher, attachments);
+  const responsePermissions = buildCipherPermissions(passthrough);
 
   return {
     // Pass through ALL stored cipher fields (known + unknown)
@@ -628,12 +735,9 @@ export function cipherToResponse(
     revisionDate: updatedAt,
     deletedDate: deletedAt,
     archivedDate: archivedAt ?? null,
-    edit: true,
-    viewPassword: true,
-    permissions: {
-      delete: true,
-      restore: true,
-    },
+    edit: readBooleanOrFallback((passthrough as any).edit, true),
+    viewPassword: readBooleanOrFallback((passthrough as any).viewPassword, true),
+    permissions: responsePermissions,
     object: 'cipherDetails',
     collectionIds: Array.isArray((passthrough as any).collectionIds) ? (passthrough as any).collectionIds : [],
     attachments: formatAttachments(responseAttachments),
@@ -647,6 +751,7 @@ export function cipherToResponse(
     passwordHistory: normalizePasswordHistoryForCompatibility((passthrough as any).passwordHistory),
     sshKey: normalizedSshKey,
     key: responseCipherKey,
+    data: typeof (passthrough as any).data === 'string' ? (passthrough as any).data : null,
     encryptedFor: (passthrough as any).encryptedFor ?? null,
   };
 }
@@ -772,6 +877,8 @@ export async function handleCreateCipher(request: Request, env: Env, userId: str
   const createFields = getAliasedProp(cipherData, ['fields', 'Fields']);
   cipher.fields = createFields.present ? (createFields.value ?? null) : (cipher.fields ?? null);
   normalizeCipherForStorage(cipher);
+  const compatibilityError = validateCipherEncryptedFieldsForCompatibility(cipher);
+  if (compatibilityError) return errorResponse(compatibilityError, 400);
 
   // Prevent referencing a folder owned by another user.
   if (cipher.folderId) {
@@ -779,13 +886,10 @@ export async function handleCreateCipher(request: Request, env: Env, userId: str
     if (!folderOk) return errorResponse('Folder not found', 404);
   }
 
-  if (hasMissingLoginUriChecksum(cipher)) {
-    return errorResponse('Login URI checksum is required for item-key encrypted ciphers. Refresh NodeWarden and save the item again.', 400);
-  }
-
   await storage.saveCipher(cipher);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyCipherCreateForRequest(request, env, cipher, revisionDate);
   const responseOptions = cipherResponseOptionsForRequest(request);
 
   return jsonResponse(
@@ -835,10 +939,6 @@ export async function handleUpdateCipher(request: Request, env: Env, userId: str
     return errorResponse('The client copy of this cipher is out of date. Resync the client and try again.', 400);
   }
 
-  if (!shouldPreserveRepairableCipherUris(request) && incomingLogin.present && hasMissingLoginUriChecksum(existingCipher)) {
-    return errorResponse('This item has login URIs that must be repaired in NodeWarden Web before updating from this client. Open NodeWarden Web once, then resync.', 400);
-  }
-
   const nextType = Number(cipherData.type) || existingCipher.type;
 
   // Opaque passthrough: merge existing stored data with ALL incoming client fields.
@@ -887,6 +987,8 @@ export async function handleUpdateCipher(request: Request, env: Env, userId: str
     cipher.fields = null;
   }
   normalizeCipherForStorage(cipher);
+  const compatibilityError = validateCipherEncryptedFieldsForCompatibility(cipher);
+  if (compatibilityError) return errorResponse(compatibilityError, 400);
 
   // Prevent referencing a folder owned by another user.
   if (cipher.folderId) {
@@ -894,14 +996,11 @@ export async function handleUpdateCipher(request: Request, env: Env, userId: str
     if (!folderOk) return errorResponse('Folder not found', 404);
   }
 
-  if (hasMissingLoginUriChecksum(cipher)) {
-    return errorResponse('Login URI checksum is required for item-key encrypted ciphers. Refresh NodeWarden and save the item again.', 400);
-  }
-
   await syncIncomingAttachmentMetadata(storage, cipher.id, cipherData);
   await storage.saveCipher(cipher);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyCipherUpdateForRequest(request, env, cipher, revisionDate);
   const attachments = await storage.getAttachmentsByCipher(cipher.id);
   const responseOptions = cipherResponseOptionsForRequest(request);
 
@@ -926,6 +1025,7 @@ export async function handleDeleteCipher(request: Request, env: Env, userId: str
   await storage.saveCipher(cipher);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyCipherDeleteForRequest(request, env, cipher, revisionDate);
   await writeCipherAudit(storage, request, userId, 'cipher.delete.soft', {
     id: cipher.id,
     type: cipher.type,
@@ -955,6 +1055,7 @@ export async function handleDeleteCipherCompat(request: Request, env: Env, userI
     await storage.deleteCipher(id, userId);
     const revisionDate = await storage.updateRevisionDate(userId);
     notifyVaultSyncForRequest(request, env, userId, revisionDate);
+    notifyCipherDeleteForRequest(request, env, cipher, revisionDate);
     await writeCipherAudit(storage, request, userId, 'cipher.delete.permanent', {
       id,
       type: cipher.type,
@@ -982,6 +1083,7 @@ export async function handlePermanentDeleteCipher(request: Request, env: Env, us
   await storage.deleteCipher(id, userId);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyCipherDeleteForRequest(request, env, cipher, revisionDate);
   await writeCipherAudit(storage, request, userId, 'cipher.delete.permanent', {
     id,
     type: cipher.type,
@@ -1006,6 +1108,7 @@ export async function handleRestoreCipher(request: Request, env: Env, userId: st
   await storage.saveCipher(cipher);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyCipherUpdateForRequest(request, env, cipher, revisionDate);
 
   return jsonResponse(
     cipherToResponse(cipher, [], cipherResponseOptionsForRequest(request))
@@ -1045,6 +1148,7 @@ export async function handlePartialUpdateCipher(request: Request, env: Env, user
   await storage.saveCipher(cipher);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyCipherUpdateForRequest(request, env, cipher, revisionDate);
 
   return jsonResponse(
     cipherToResponse(cipher, [], cipherResponseOptionsForRequest(request))
@@ -1121,6 +1225,7 @@ export async function handleArchiveCipher(request: Request, env: Env, userId: st
   await storage.saveCipher(cipher);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyCipherUpdateForRequest(request, env, cipher, revisionDate);
 
   const attachments = await storage.getAttachmentsByCipher(cipher.id);
   return jsonResponse(
@@ -1169,6 +1274,7 @@ export async function handleBulkArchiveCiphers(request: Request, env: Env, userI
   const revisionDate = await storage.bulkArchiveCiphers(ids, userId);
   if (revisionDate) {
     notifyVaultSyncForRequest(request, env, userId, revisionDate);
+    notifyUserCiphersSync(env, userId, revisionDate, readActingDeviceIdentifier(request));
   }
 
   return buildCipherListResponse(request, storage, userId, ids);
@@ -1193,6 +1299,7 @@ export async function handleBulkUnarchiveCiphers(request: Request, env: Env, use
   const revisionDate = await storage.bulkUnarchiveCiphers(ids, userId);
   if (revisionDate) {
     notifyVaultSyncForRequest(request, env, userId, revisionDate);
+    notifyUserCiphersSync(env, userId, revisionDate, readActingDeviceIdentifier(request));
   }
 
   return buildCipherListResponse(request, storage, userId, ids);
@@ -1216,6 +1323,7 @@ export async function handleBulkDeleteCiphers(request: Request, env: Env, userId
   const revisionDate = await storage.bulkSoftDeleteCiphers(body.ids, userId);
   if (revisionDate) {
     notifyVaultSyncForRequest(request, env, userId, revisionDate);
+    notifyUserCiphersSync(env, userId, revisionDate, readActingDeviceIdentifier(request));
     await writeCipherAudit(storage, request, userId, 'cipher.delete.soft.bulk', {
       count: body.ids.length,
     });
@@ -1242,6 +1350,7 @@ export async function handleBulkRestoreCiphers(request: Request, env: Env, userI
   const revisionDate = await storage.bulkRestoreCiphers(body.ids, userId);
   if (revisionDate) {
     notifyVaultSyncForRequest(request, env, userId, revisionDate);
+    notifyUserCiphersSync(env, userId, revisionDate, readActingDeviceIdentifier(request));
   }
 
   return new Response(null, { status: 204 });
@@ -1278,6 +1387,7 @@ export async function handleBulkPermanentDeleteCiphers(request: Request, env: En
   const revisionDate = await storage.bulkDeleteCiphers(ownedIds, userId);
   if (revisionDate) {
     notifyVaultSyncForRequest(request, env, userId, revisionDate);
+    notifyUserCiphersSync(env, userId, revisionDate, readActingDeviceIdentifier(request));
     await writeCipherAudit(storage, request, userId, 'cipher.delete.permanent.bulk', {
       count: ownedIds.length,
       requestedCount: ids.length,

src/handlers/devices.ts

@@ -3,6 +3,7 @@ import { Env } from '../types';
 import { getOnlineUserDevices, notifyUserLogout } from '../durable/notifications-hub';
 import { AuthService } from '../services/auth';
 import { auditRequestMetadata, writeAuditEvent } from '../services/audit-events';
+import { registerMobilePushDevice, unregisterMobilePushDevice } from '../services/push-relay';
 import { StorageService } from '../services/storage';
 import { errorResponse, jsonResponse } from '../utils/response';
 import { readKnownDeviceProbe } from '../utils/device';
@@ -223,6 +224,8 @@ export async function handleGetAuthorizedDevices(request: Request, env: Env, use
       encryptedUserKey: null,
       encryptedPublicKey: null,
       encryptedPrivateKey: null,
+      pushUuid: null,
+      pushToken: null,
       devicePendingAuthRequest: null,
       deviceNote: null,
       lastSeenAt: null,
@@ -325,10 +328,12 @@ export async function handleDeleteDevice(
   if (!normalized) return errorResponse('Invalid device identifier', 400);
 
   const storage = new StorageService(env.DB);
+  const device = await storage.getDevice(userId, normalized);
   await storage.deleteTrustedTwoFactorTokensByDevice(userId, normalized);
   await storage.deleteRefreshTokensByDevice(userId, normalized);
   const deleted = await storage.deleteDevice(userId, normalized);
   if (deleted) {
+    await unregisterMobilePushDevice(env, device?.pushUuid);
     AuthService.invalidateDeviceCache(userId, normalized);
     notifyUserLogout(env, userId, normalized);
   }
@@ -537,10 +542,12 @@ export async function handleDeactivateDevice(
   if (!normalized) return errorResponse('Invalid device identifier', 400);
 
   const storage = new StorageService(env.DB);
+  const device = await storage.getDevice(userId, normalized);
   await storage.deleteTrustedTwoFactorTokensByDevice(userId, normalized);
   await storage.deleteRefreshTokensByDevice(userId, normalized);
   const deleted = await storage.deleteDevice(userId, normalized);
   if (deleted) {
+    await unregisterMobilePushDevice(env, device?.pushUuid);
     AuthService.invalidateDeviceCache(userId, normalized);
     notifyUserLogout(env, userId, normalized);
   }
@@ -557,18 +564,36 @@ export async function handleDeactivateDevice(
 }
 
 // PUT /api/devices/identifier/{deviceIdentifier}/token
-// Bitwarden mobile reports push token updates to this endpoint.
-// NodeWarden does not implement push notifications, so accept and no-op.
+// Bitwarden mobile reports APNs/FCM push token updates to this endpoint.
 export async function handleUpdateDeviceToken(
   request: Request,
   env: Env,
   userId: string,
   deviceIdentifier: string
 ): Promise<Response> {
-  void request;
-  void env;
-  void userId;
-  void deviceIdentifier;
+  const normalized = normalizeIdentifier(deviceIdentifier);
+  if (!normalized) return errorResponse('Invalid device identifier', 400);
+
+  const body = await readJsonBody(request);
+  const pushToken = String(body?.pushToken ?? body?.PushToken ?? '').trim();
+  if (!pushToken) return errorResponse('Invalid push token', 400);
+
+  const storage = new StorageService(env.DB);
+  const device = await storage.getDevice(userId, normalized);
+  if (!device) return errorResponse('Device not found', 404);
+
+  const pushUuid = device.pushUuid || generateUUID();
+  const updated = await storage.updateDevicePushToken(userId, normalized, pushUuid, pushToken);
+  if (updated) {
+    await registerMobilePushDevice(env, {
+      userId,
+      deviceIdentifier: normalized,
+      type: device.type,
+      pushUuid,
+      pushToken,
+    });
+  }
+
   return new Response(null, { status: 200 });
 }
 
@@ -594,9 +619,15 @@ export async function handleClearDeviceToken(
   deviceIdentifier: string
 ): Promise<Response> {
   void request;
-  void env;
-  void userId;
-  void deviceIdentifier;
+  const normalized = normalizeIdentifier(deviceIdentifier);
+  if (!normalized) return errorResponse('Invalid device identifier', 400);
+
+  const storage = new StorageService(env.DB);
+  const cleared = await storage.clearDevicePushToken(userId, normalized);
+  if (cleared?.pushUuid) {
+    await unregisterMobilePushDevice(env, cleared.pushUuid);
+  }
+
   return new Response(null, { status: 200 });
 }
 

src/handlers/folders.ts

@@ -1,5 +1,10 @@
 import { Env, Folder, FolderResponse } from '../types';
-import { notifyUserVaultSync } from '../durable/notifications-hub';
+import {
+  notifyUserFolderCreate,
+  notifyUserFolderDelete,
+  notifyUserFolderUpdate,
+  notifyUserVaultSync,
+} from '../durable/notifications-hub';
 import { StorageService } from '../services/storage';
 import { jsonResponse, errorResponse } from '../utils/response';
 import { readActingDeviceIdentifier } from '../utils/device';
@@ -111,6 +116,12 @@ export async function handleCreateFolder(request: Request, env: Env, userId: str
   await storage.saveFolder(folder);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyUserFolderCreate(env, {
+    userId,
+    folderId: folder.id,
+    revisionDate,
+    contextId: readActingDeviceIdentifier(request),
+  });
 
   return jsonResponse(folderToResponse(folder), 200);
 }
@@ -139,6 +150,12 @@ export async function handleUpdateFolder(request: Request, env: Env, userId: str
   await storage.saveFolder(folder);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyUserFolderUpdate(env, {
+    userId,
+    folderId: folder.id,
+    revisionDate,
+    contextId: readActingDeviceIdentifier(request),
+  });
 
   return jsonResponse(folderToResponse(folder));
 }
@@ -156,6 +173,12 @@ export async function handleDeleteFolder(request: Request, env: Env, userId: str
   await storage.deleteFolder(id, userId);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifyUserFolderDelete(env, {
+    userId,
+    folderId: id,
+    revisionDate,
+    contextId: readActingDeviceIdentifier(request),
+  });
   await writeFolderAudit(storage, request, userId, 'folder.delete', {
     id,
   });
@@ -179,9 +202,23 @@ export async function handleBulkDeleteFolders(request: Request, env: Env, userId
     return errorResponse('Folder ids are required', 400);
   }
 
+  const folders = (
+    await Promise.all(ids.map(async (id) => {
+      const folder = await storage.getFolder(id);
+      return folder && folder.userId === userId ? folder : null;
+    }))
+  ).filter((folder): folder is Folder => !!folder);
   const revisionDate = await storage.bulkDeleteFolders(ids, userId);
   if (revisionDate) {
     notifyVaultSyncForRequest(request, env, userId, revisionDate);
+    for (const folder of folders) {
+      notifyUserFolderDelete(env, {
+        userId,
+        folderId: folder.id,
+        revisionDate,
+        contextId: readActingDeviceIdentifier(request),
+      });
+    }
     await writeFolderAudit(storage, request, userId, 'folder.delete.bulk', {
       count: ids.length,
     });

src/handlers/identity.ts

@@ -4,12 +4,13 @@ import { AuthService } from '../services/auth';
 import { RateLimitService, getClientIdentifier } from '../services/ratelimit';
 import { jsonResponse, errorResponse, identityErrorResponse } from '../utils/response';
 import { LIMITS } from '../config/limits';
-import { isTotpEnabled, verifyTotpToken } from '../utils/totp';
+import { findMatchingTotpCounter, isTotpEnabled } from '../utils/totp';
 import { createRefreshToken } from '../utils/jwt';
 import { readAuthRequestDeviceInfo } from '../utils/device';
 import { createRecoveryCode, recoveryCodeEquals } from '../utils/recovery-code';
 import { generateUUID } from '../utils/uuid';
 import { issueSendAccessToken } from './sends';
+import { registerMobilePushDevice } from '../services/push-relay';
 import {
   buildAccountKeys,
   buildUserDecryptionOptions,
@@ -19,15 +20,18 @@ import {
   assertAccountPasskeyCredential,
   buildAccountPasskeyTokenUserDecryptionOption,
 } from './account-passkeys';
+import { isAuthRequestExpired } from '../services/storage-auth-request-repo';
+import { createPasskeyUserVerificationToken } from '../utils/user-verification-token';
 
 const TWO_FACTOR_REMEMBER_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 const TWO_FACTOR_PROVIDER_AUTHENTICATOR = 0;
 const TWO_FACTOR_PROVIDER_REMEMBER = 5;
+const TWO_FACTOR_PROVIDER_RECOVERY_CODE = 8;
 const WEB_REFRESH_COOKIE = 'nodewarden_web_refresh';
-// Android client (2026.2.x) deserializes TwoFactorProviders2 keys with -1 for recovery code.
-// Keep request parsing backward-compatible with historical provider values (8 / 100).
+// Some UI surfaces use -1 for the recovery-code settings dialog. Login itself follows
+// the official Identity provider enum (RecoveryCode = 8), while request parsing remains
+// compatible with older/local provider values.
 const TWO_FACTOR_PROVIDER_RECOVERY_CODE_RESPONSE = '-1';
-const TWO_FACTOR_PROVIDER_RECOVERY_CODE_LEGACY = 8;
 const TWO_FACTOR_PROVIDER_RECOVERY_CODE_ANDROID_REQUEST = 100;
 
 function resolveTotpSecret(userSecret: string | null): string | null {
@@ -48,6 +52,44 @@ async function resolveDeviceSession(
   return { identifier: deviceInfo.deviceIdentifier, sessionStamp };
 }
 
+function readDevicePushToken(body: Record<string, string>): string {
+  return String(readBodyValue(body, ['devicePushToken', 'DevicePushToken', 'device_push_token']) || '').trim();
+}
+
+async function persistIdentityDevicePushToken(
+  env: Env,
+  storage: StorageService,
+  userId: string,
+  deviceSession: { identifier: string; sessionStamp: string } | null,
+  deviceType: number,
+  body: Record<string, string>
+): Promise<void> {
+  if (!deviceSession) return;
+  const pushToken = readDevicePushToken(body);
+  if (!pushToken) return;
+
+  const device = await storage.getDevice(userId, deviceSession.identifier);
+  if (!device) return;
+
+  const pushUuid = device.pushUuid || generateUUID();
+  await storage.updateDevicePushToken(userId, deviceSession.identifier, pushUuid, pushToken);
+  const registered = await registerMobilePushDevice(env, {
+    userId,
+    deviceIdentifier: deviceSession.identifier,
+    type: device.type || deviceType,
+    pushUuid,
+    pushToken,
+  });
+  console.info('Mobile push token updated from identity token request', {
+    userId,
+    deviceIdentifier: deviceSession.identifier,
+    deviceType: device.type || deviceType,
+    pushUuid,
+    pushTokenLength: pushToken.length,
+    relayRegistered: registered,
+  });
+}
+
 function shouldUseWebSession(request: Request): boolean {
   return String(request.headers.get('X-NodeWarden-Web-Session') || '').trim() === '1';
 }
@@ -76,6 +118,14 @@ function constantTimeEquals(a: string, b: string): boolean {
   return diff === 0;
 }
 
+function readBodyValue(body: Record<string, string>, names: string[]): string | undefined {
+  for (const name of names) {
+    const value = body[name];
+    if (value != null) return value;
+  }
+  return undefined;
+}
+
 function buildRefreshCookie(request: Request, refreshToken: string, maxAgeSeconds: number): string {
   const isHttps = new URL(request.url).protocol === 'https:';
   const parts = [
@@ -130,19 +180,32 @@ function buildPreloginResponse(
   };
 }
 
-function twoFactorRequiredResponse(message: string = 'Two factor required.', includeRecoveryCode: boolean = false): Response {
-  const providers = includeRecoveryCode
-    ? [String(TWO_FACTOR_PROVIDER_AUTHENTICATOR), TWO_FACTOR_PROVIDER_RECOVERY_CODE_RESPONSE]
-    : [String(TWO_FACTOR_PROVIDER_AUTHENTICATOR)];
-  const providers2: Record<string, null> = {};
-  for (const provider of providers) providers2[provider] = null;
+function masterPasswordPolicyResponse(): TokenResponse['MasterPasswordPolicy'] {
+  return {
+    minComplexity: 0,
+    minLength: 0,
+    requireUpper: false,
+    requireLower: false,
+    requireNumbers: false,
+    requireSpecial: false,
+    enforceOnLogin: false,
+    Object: 'masterPasswordPolicy',
+    object: 'masterPasswordPolicy',
+  };
+}
+
+function twoFactorRequiredResponse(message: string = 'Two factor required.'): Response {
+  // Match Bitwarden Identity: TwoFactorProviders2 lists enabled 2FA providers only.
+  // Clients expose recovery-code entry points themselves; Android 2026.4 fails to
+  // parse the challenge if an unknown recovery provider key such as "8" is included.
+  const providers = [String(TWO_FACTOR_PROVIDER_AUTHENTICATOR)];
+  const providers2: Record<string, { Email: null }> = {};
+  for (const provider of providers) providers2[provider] = { Email: null };
   const customResponse = {
     TwoFactorProviders: providers,
     TwoFactorProviders2: providers2,
     SsoEmail2faSessionToken: null,
-    MasterPasswordPolicy: {
-      Object: 'masterPasswordPolicy',
-    },
+    MasterPasswordPolicy: masterPasswordPolicyResponse(),
   };
 
   // Bitwarden clients rely on these fields to trigger the 2FA UI flow.
@@ -228,9 +291,10 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
     // Login with password
     const email = body.username?.toLowerCase();
     const passwordHash = body.password;
-    const twoFactorToken = body.twoFactorToken;
-    const twoFactorProvider = body.twoFactorProvider;
-    const twoFactorRemember = body.twoFactorRemember;
+    const authRequestId = readBodyValue(body, ['authRequest', 'AuthRequest']);
+    const twoFactorToken = readBodyValue(body, ['twoFactorToken', 'TwoFactorToken']);
+    const twoFactorProvider = readBodyValue(body, ['twoFactorProvider', 'TwoFactorProvider']);
+    const twoFactorRemember = readBodyValue(body, ['twoFactorRemember', 'TwoFactorRemember']);
     const loginIdentifier = clientIdentifier;
     const deviceInfo = readAuthRequestDeviceInfo(body, request);
 
@@ -272,11 +336,34 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
       return identityErrorResponse('Account is disabled', 'invalid_grant', 400);
     }
 
-    const valid = await auth.verifyPassword(passwordHash, user.masterPasswordHash, user.email);
+    let validatedAuthRequestId: string | null = null;
+    let authRequestLoginKey: string | null = null;
+    let valid = false;
+    const normalizedAuthRequestId = String(authRequestId || '').trim();
+    if (normalizedAuthRequestId) {
+      const authRequest = await storage.getAuthRequestById(normalizedAuthRequestId);
+      valid = !!(
+        authRequest &&
+        authRequest.userId === user.id &&
+        authRequest.type === 0 &&
+        authRequest.approved === true &&
+        authRequest.responseDate &&
+        !authRequest.authenticationDate &&
+        !isAuthRequestExpired(authRequest) &&
+        !!authRequest.key &&
+        constantTimeEquals(authRequest.accessCode, passwordHash)
+      );
+      if (valid) {
+        validatedAuthRequestId = authRequest!.id;
+        authRequestLoginKey = authRequest!.key;
+      }
+    } else {
+      valid = await auth.verifyPassword(passwordHash, user.masterPasswordHash, user.email);
+    }
     if (!valid) {
       await safeWriteAuditEvent(env, {
         actorUserId: user.id,
-        action: 'auth.login.failed.bad_password',
+        action: normalizedAuthRequestId ? 'auth.login.failed.bad_auth_request' : 'auth.login.failed.bad_password',
         category: 'auth',
         level: 'warn',
         targetType: 'user',
@@ -298,7 +385,6 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
     let trustedTwoFactorTokenToReturn: string | undefined;
     const effectiveTotpSecret = resolveTotpSecret(user.totpSecret);
     if (effectiveTotpSecret) {
-      const canUseRecoveryCode = !!user.totpRecoveryCode;
       const normalizedTwoFactorProvider = String(twoFactorProvider ?? '').trim();
       const normalizedTwoFactorToken = String(twoFactorToken ?? '').trim();
       let rememberRequested = ['1', 'true', 'True', 'TRUE', 'on', 'yes', 'Yes', 'YES'].includes(String(twoFactorRemember || '').trim());
@@ -308,7 +394,7 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
       // Upstream-compatible behavior: if 2FA is required and either provider or token is missing,
       // respond with a 2FA challenge payload.
       if (!hasProvider || !hasToken) {
-        return twoFactorRequiredResponse('Two factor required.', canUseRecoveryCode);
+        return twoFactorRequiredResponse('Two factor required.');
       }
 
       let passedByRememberToken = false;
@@ -323,16 +409,20 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
 
         // Remember token missing/invalid/expired should re-enter the 2FA challenge flow.
         if (!passedByRememberToken) {
-          return twoFactorRequiredResponse('Two factor required.', canUseRecoveryCode);
+          return twoFactorRequiredResponse('Two factor required.');
         }
       } else if (normalizedTwoFactorProvider === String(TWO_FACTOR_PROVIDER_AUTHENTICATOR)) {
-        const totpOk = await verifyTotpToken(effectiveTotpSecret, normalizedTwoFactorToken);
-        if (!totpOk) {
+        const matchedCounter = await findMatchingTotpCounter(effectiveTotpSecret, normalizedTwoFactorToken);
+        if (matchedCounter == null) {
+          return recordFailedTwoFactorAndBuildResponse(rateLimit, loginIdentifier);
+        }
+        const consumed = await storage.consumeTotpLoginCounter(user.id, matchedCounter);
+        if (!consumed) {
           return recordFailedTwoFactorAndBuildResponse(rateLimit, loginIdentifier);
         }
       } else if (
         normalizedTwoFactorProvider === TWO_FACTOR_PROVIDER_RECOVERY_CODE_RESPONSE ||
-        normalizedTwoFactorProvider === String(TWO_FACTOR_PROVIDER_RECOVERY_CODE_LEGACY) ||
+        normalizedTwoFactorProvider === String(TWO_FACTOR_PROVIDER_RECOVERY_CODE) ||
         normalizedTwoFactorProvider === String(TWO_FACTOR_PROVIDER_RECOVERY_CODE_ANDROID_REQUEST)
       ) {
         if (!recoveryCodeEquals(normalizedTwoFactorToken, user.totpRecoveryCode)) {
@@ -371,10 +461,14 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
         deviceInfo.deviceType,
         deviceSession.sessionStamp
       );
+      await persistIdentityDevicePushToken(env, storage, user.id, deviceSession, deviceInfo.deviceType, body);
     }
 
     // Successful login - clear failed attempts
     await rateLimit.clearLoginAttempts(loginIdentifier);
+    if (validatedAuthRequestId) {
+      await storage.markAuthRequestAuthenticated(validatedAuthRequestId);
+    }
 
     const accessToken = await auth.generateAccessToken(user, deviceSession);
     const refreshToken = await auth.generateRefreshToken(user.id, deviceSession);
@@ -402,7 +496,7 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
       token_type: 'Bearer',
       ...(shouldUseWebSession(request) ? { web_session: true } : { refresh_token: refreshToken }),
       ...(trustedTwoFactorTokenToReturn ? { TwoFactorToken: trustedTwoFactorTokenToReturn } : {}),
-      Key: user.key,
+      Key: authRequestLoginKey || user.key,
       PrivateKey: user.privateKey,
       AccountKeys: accountKeys,
       accountKeys: accountKeys,
@@ -412,9 +506,7 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
       KdfParallelism: user.kdfParallelism,
       ForcePasswordReset: false,
       ResetMasterPassword: false,
-      MasterPasswordPolicy: {
-        Object: 'masterPasswordPolicy',
-      },
+      MasterPasswordPolicy: masterPasswordPolicyResponse(),
       ApiUseKeyConnector: false,
       scope: 'api offline_access',
       unofficialServer: true,
@@ -492,12 +584,14 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
         deviceInfo.deviceType,
         deviceSession.sessionStamp
       );
+      await persistIdentityDevicePushToken(env, storage, user.id, deviceSession, deviceInfo.deviceType, body);
     }
 
     await rateLimit.clearLoginAttempts(loginIdentifier);
 
     const accessToken = await auth.generateAccessToken(user, deviceSession);
     const refreshToken = await auth.generateRefreshToken(user.id, deviceSession);
+    const userVerificationToken = await createPasskeyUserVerificationToken(env, user.id, 'backup.settings.repair');
     const accountKeys = buildAccountKeys(user);
     const webAuthnPrfOption = buildAccountPasskeyTokenUserDecryptionOption(credential);
     const userDecryptionOptions = buildUserDecryptionOptions(user, webAuthnPrfOption);
@@ -532,12 +626,12 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
       KdfParallelism: user.kdfParallelism,
       ForcePasswordReset: false,
       ResetMasterPassword: false,
-      MasterPasswordPolicy: {
-        Object: 'masterPasswordPolicy',
-      },
+      MasterPasswordPolicy: masterPasswordPolicyResponse(),
       ApiUseKeyConnector: false,
       scope: 'api offline_access',
       unofficialServer: true,
+      UserVerificationToken: userVerificationToken,
+      userVerificationToken,
       UserDecryptionOptions: userDecryptionOptions,
       userDecryptionOptions: userDecryptionOptions,
     };
@@ -622,6 +716,7 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
         deviceInfo.deviceType,
         deviceSession.sessionStamp
       );
+      await persistIdentityDevicePushToken(env, storage, user.id, deviceSession, deviceInfo.deviceType, body);
     }
 
     // Successful login - clear failed attempts
@@ -662,9 +757,7 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
       KdfParallelism: user.kdfParallelism,
       ForcePasswordReset: false,
       ResetMasterPassword: false,
-      MasterPasswordPolicy: {
-        Object: 'masterPasswordPolicy',
-      },
+      MasterPasswordPolicy: masterPasswordPolicyResponse(),
       ApiUseKeyConnector: false,
       scope: 'api offline_access',
       unofficialServer: true,
@@ -802,9 +895,7 @@ export async function handleToken(request: Request, env: Env): Promise<Response>
       KdfParallelism: user.kdfParallelism,
       ForcePasswordReset: false,
       ResetMasterPassword: false,
-      MasterPasswordPolicy: {
-        Object: 'masterPasswordPolicy',
-      },
+      MasterPasswordPolicy: masterPasswordPolicyResponse(),
       ApiUseKeyConnector: false,
       scope: 'api offline_access',
       unofficialServer: true,

src/handlers/import.ts

@@ -5,7 +5,7 @@ import { errorResponse, jsonResponse } from '../utils/response';
 import { readActingDeviceIdentifier } from '../utils/device';
 import { generateUUID } from '../utils/uuid';
 import { LIMITS } from '../config/limits';
-import { normalizeCipherLoginForStorage, normalizeCipherSshKeyForCompatibility } from './ciphers';
+import { normalizeCipherLoginForStorage, normalizeCipherSshKeyForCompatibility, validateCipherEncryptedFieldsForCompatibility } from './ciphers';
 
 // Bitwarden client import request format
 interface CiphersImportRequest {
@@ -252,6 +252,10 @@ export async function handleCiphersImport(request: Request, env: Env, userId: st
       deletedAt: null,
     };
     cipher.login = normalizeCipherLoginForStorage(cipher.login);
+    const compatibilityError = validateCipherEncryptedFieldsForCompatibility(cipher);
+    if (compatibilityError) {
+      return errorResponse(`Cipher ${i + 1}: ${compatibilityError}`, 400);
+    }
 
     cipherRows.push(cipher);
     cipherMapRows.push({ index: i, sourceId, id: cipher.id });

src/handlers/notifications.ts

@@ -56,3 +56,18 @@ export async function handleNotificationsHub(request: Request, env: Env): Promis
   }
   return stub.fetch(new Request(forwardedUrl.toString(), request));
 }
+
+export async function handleAnonymousNotificationsHub(request: Request, env: Env): Promise<Response> {
+  const url = new URL(request.url);
+  const authRequestId = String(url.searchParams.get('Token') || url.searchParams.get('token') || '').trim();
+  if (!authRequestId) return errorResponse('Token is required', 400);
+  if (request.headers.get('Upgrade')?.toLowerCase() !== 'websocket') {
+    return errorResponse('Expected websocket', 426);
+  }
+
+  const id = env.NOTIFICATIONS_HUB.idFromName(authRequestId);
+  const stub = env.NOTIFICATIONS_HUB.get(id);
+  const forwardedUrl = new URL(request.url);
+  forwardedUrl.searchParams.set('nw_auth_request_id', authRequestId);
+  return stub.fetch(new Request(forwardedUrl.toString(), request));
+}

src/handlers/sends-private.ts

@@ -16,6 +16,9 @@ import {
   formatSize,
   getAliasedProp,
   normalizeEmails,
+  notifySendCreateForRequest,
+  notifySendDeleteForRequest,
+  notifySendUpdateForRequest,
   notifyVaultSyncForRequest,
   parseDate,
   parseFileLength,
@@ -99,6 +102,7 @@ async function processSendFileUpload(
   const storage = new StorageService(env.DB);
   const revisionDate = await storage.updateRevisionDate(send.userId);
   notifyVaultSyncForRequest(request, env, send.userId, revisionDate);
+  notifySendUpdateForRequest(request, env, send.id, send.userId, revisionDate);
 
   return new Response(null, { status: 201 });
 }
@@ -249,6 +253,7 @@ export async function handleCreateSend(request: Request, env: Env, userId: strin
   await storage.saveSend(send);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifySendCreateForRequest(request, env, send.id, userId, revisionDate);
 
   return jsonResponse(sendToResponse(send));
 }
@@ -372,6 +377,7 @@ export async function handleCreateFileSendV2(request: Request, env: Env, userId:
   await storage.saveSend(send);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifySendCreateForRequest(request, env, send.id, userId, revisionDate);
   const jwtSecret = getSafeJwtSecret(env);
   if (!jwtSecret) {
     return errorResponse('Server configuration error', 500);
@@ -619,6 +625,7 @@ export async function handleUpdateSend(request: Request, env: Env, userId: strin
   await storage.saveSend(send);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifySendUpdateForRequest(request, env, send.id, userId, revisionDate);
 
   return jsonResponse(sendToResponse(send));
 }
@@ -641,6 +648,7 @@ export async function handleDeleteSend(request: Request, env: Env, userId: strin
   await storage.deleteSend(sendId, userId);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifySendDeleteForRequest(request, env, sendId, userId, revisionDate);
   await writeSendAudit(storage, request, userId, 'send.delete', {
     id: sendId,
     type: send.type,
@@ -676,6 +684,9 @@ export async function handleBulkDeleteSends(request: Request, env: Env, userId:
   const revisionDate = await storage.bulkDeleteSends(body.ids, userId);
   if (revisionDate) {
     notifyVaultSyncForRequest(request, env, userId, revisionDate);
+    for (const send of sends) {
+      notifySendDeleteForRequest(request, env, send.id, userId, revisionDate);
+    }
     await writeSendAudit(storage, request, userId, 'send.delete.bulk', {
       count: sends.length,
       requestedCount: body.ids.length,
@@ -697,6 +708,7 @@ export async function handleRemoveSendPassword(request: Request, env: Env, userI
   await storage.saveSend(send);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifySendUpdateForRequest(request, env, send.id, userId, revisionDate);
   await writeSendAudit(storage, request, userId, 'send.password.remove', {
     id: send.id,
     type: send.type,
@@ -718,6 +730,7 @@ export async function handleRemoveSendAuth(request: Request, env: Env, userId: s
   await storage.saveSend(send);
   const revisionDate = await storage.updateRevisionDate(userId);
   notifyVaultSyncForRequest(request, env, userId, revisionDate);
+  notifySendUpdateForRequest(request, env, send.id, userId, revisionDate);
   await writeSendAudit(storage, request, userId, 'send.auth.remove', {
     id: send.id,
     type: send.type,

src/handlers/sends-public.ts

@@ -2,6 +2,7 @@ import { Env, SendType } from '../types';
 import { StorageService } from '../services/storage';
 import { RateLimitService, getClientIdentifier } from '../services/ratelimit';
 import { jsonResponse, errorResponse } from '../utils/response';
+import { sanitizeDownloadContentType } from '../utils/content-type';
 import { LIMITS } from '../config/limits';
 import {
   createSendAccessToken,
@@ -21,6 +22,7 @@ import {
   getSafeJwtSecret,
   hasEmailAuth,
   isSendAvailable,
+  notifySendUpdateForRequest,
   notifyVaultSyncForRequest,
   parseStoredSendData,
   resolveSendFromIdOrAccessId,
@@ -33,6 +35,14 @@ import {
   verifySendPasswordHashB64,
 } from './sends-shared';
 
+function contentDispositionAttachment(fileName: string | null | undefined): string {
+  const fallback = 'send-file';
+  const value = String(fileName || fallback)
+    .replace(/[\r\n"]/g, '_')
+    .trim() || fallback;
+  return `attachment; filename="${value}"`;
+}
+
 export async function handleAccessSend(request: Request, env: Env, accessId: string): Promise<Response> {
   const storage = new StorageService(env.DB);
   const sendId = fromAccessId(accessId);
@@ -90,6 +100,7 @@ export async function handleAccessSend(request: Request, env: Env, accessId: str
     send.accessCount += 1;
     const revisionDate = await storage.updateRevisionDate(send.userId);
     notifyVaultSyncForRequest(request, env, send.userId, revisionDate);
+    notifySendUpdateForRequest(request, env, send.id, send.userId, revisionDate);
   }
 
   const creatorIdentifier = await getCreatorIdentifier(storage, send);
@@ -163,6 +174,7 @@ export async function handleAccessSendFile(
   send.accessCount += 1;
   const revisionDate = await storage.updateRevisionDate(send.userId);
   notifyVaultSyncForRequest(request, env, send.userId, revisionDate);
+  notifySendUpdateForRequest(request, env, send.id, send.userId, revisionDate);
 
   const token = await createSendFileDownloadToken(send.id, fileId, secret);
   const url = new URL(request.url);
@@ -203,6 +215,7 @@ export async function handleAccessSendV2(request: Request, env: Env): Promise<Re
     send.accessCount += 1;
     const revisionDate = await storage.updateRevisionDate(send.userId);
     notifyVaultSyncForRequest(request, env, send.userId, revisionDate);
+    notifySendUpdateForRequest(request, env, send.id, send.userId, revisionDate);
   }
 
   const creatorIdentifier = await getCreatorIdentifier(storage, send);
@@ -242,6 +255,7 @@ export async function handleAccessSendFileV2(request: Request, env: Env, fileId:
   send.accessCount += 1;
   const revisionDate = await storage.updateRevisionDate(send.userId);
   notifyVaultSyncForRequest(request, env, send.userId, revisionDate);
+  notifySendUpdateForRequest(request, env, send.id, send.userId, revisionDate);
 
   const downloadToken = await createSendFileDownloadToken(send.id, fileId, jwt.secret);
   const url = new URL(request.url);
@@ -282,6 +296,9 @@ export async function handleDownloadSendFile(
   if (!object) {
     return errorResponse('Send file not found', 404);
   }
+  const send = await storage.getSend(sendId);
+  const data = send ? parseStoredSendData(send) : {};
+  const fileName = typeof data.fileName === 'string' ? data.fileName : fileId;
 
   const firstUse = await storage.consumeAttachmentDownloadToken(`send:${claims.jti}`, claims.exp);
   if (!firstUse) {
@@ -290,9 +307,11 @@ export async function handleDownloadSendFile(
 
   return new Response(object.body, {
     headers: {
-      'Content-Type': object.contentType || 'application/octet-stream',
+      'Content-Type': sanitizeDownloadContentType(object.contentType),
       'Content-Length': String(object.size),
+      'Content-Disposition': contentDispositionAttachment(fileName),
       'Cache-Control': 'private, no-cache',
+      'X-Content-Type-Options': 'nosniff',
     },
   });
 }

src/handlers/sends-shared.ts

@@ -1,5 +1,10 @@
 import { Env, Send, SendAuthType, SendResponse, SendType, DEFAULT_DEV_SECRET } from '../types';
-import { notifyUserVaultSync } from '../durable/notifications-hub';
+import {
+  notifyUserSendCreate,
+  notifyUserSendDelete,
+  notifyUserSendUpdate,
+  notifyUserVaultSync,
+} from '../durable/notifications-hub';
 import { StorageService } from '../services/storage';
 import { jsonResponse, errorResponse } from '../utils/response';
 import { readActingDeviceIdentifier } from '../utils/device';
@@ -18,6 +23,51 @@ export function notifyVaultSyncForRequest(
   notifyUserVaultSync(env, userId, revisionDate, readActingDeviceIdentifier(request));
 }
 
+export function notifySendCreateForRequest(
+  request: Request,
+  env: Env,
+  sendId: string,
+  userId: string,
+  revisionDate: string
+): void {
+  notifyUserSendCreate(env, {
+    userId,
+    sendId,
+    revisionDate,
+    contextId: readActingDeviceIdentifier(request),
+  });
+}
+
+export function notifySendUpdateForRequest(
+  request: Request,
+  env: Env,
+  sendId: string,
+  userId: string,
+  revisionDate: string
+): void {
+  notifyUserSendUpdate(env, {
+    userId,
+    sendId,
+    revisionDate,
+    contextId: readActingDeviceIdentifier(request),
+  });
+}
+
+export function notifySendDeleteForRequest(
+  request: Request,
+  env: Env,
+  sendId: string,
+  userId: string,
+  revisionDate: string
+): void {
+  notifyUserSendDelete(env, {
+    userId,
+    sendId,
+    revisionDate,
+    contextId: readActingDeviceIdentifier(request),
+  });
+}
+
 export function getAliasedProp(source: unknown, aliases: string[]): { present: boolean; value: unknown } {
   if (!source || typeof source !== 'object') return { present: false, value: undefined };
   for (const key of aliases) {

src/handlers/sync.ts

@@ -5,12 +5,12 @@ import { cipherToResponse, isCipherResponseSyncCompatible, shouldPreserveRepaira
 import { sendToResponse } from './sends';
 import { LIMITS } from '../config/limits';
 import {
-  buildAccountKeys,
   buildUserDecryptionCompat,
   buildUserDecryptionOptions,
 } from '../utils/user-decryption';
 import { buildDomainsResponse } from '../services/domain-rules';
 import { buildWebAuthnPrfOption } from '../utils/account-passkeys';
+import { buildProfileResponse } from '../utils/profile-response';
 
 // CONTRACT:
 // /api/sync reuses cipherToResponse() as the single cipher response shaper.
@@ -84,36 +84,12 @@ export async function handleSync(request: Request, env: Env, userId: string): Pr
     storage.getAttachmentsByUserId(userId),
     excludeDomains ? Promise.resolve(null) : storage.getUserDomainSettings(userId),
   ]);
-  const accountKeys = buildAccountKeys(user);
   const webAuthnPrfOptions = accountPasskeys
     .map(buildWebAuthnPrfOption)
     .filter((option): option is NonNullable<typeof option> => !!option);
   const userDecryptionOptions = buildUserDecryptionOptions(user, webAuthnPrfOptions[0] || null);
 
-  const profile: ProfileResponse = {
-    id: user.id,
-    name: user.name,
-    email: user.email,
-    emailVerified: true,
-    premium: true,
-    premiumFromOrganization: false,
-    usesKeyConnector: false,
-    masterPasswordHint: user.masterPasswordHint,
-    culture: 'en-US',
-    twoFactorEnabled: !!user.totpSecret,
-    key: user.key,
-    privateKey: user.privateKey,
-    accountKeys,
-    securityStamp: user.securityStamp || user.id,
-    organizations: [],
-    providers: [],
-    providerOrganizations: [],
-    forcePasswordReset: false,
-    avatarColor: null,
-    creationDate: user.createdAt,
-    verifyDevices: user.verifyDevices,
-    object: 'profile',
-  };
+  const profile: ProfileResponse = buildProfileResponse(user, env);
 
   const cipherResponses: CipherResponse[] = [];
   for (const cipher of ciphers) {
@@ -149,6 +125,7 @@ export async function handleSync(request: Request, env: Env, userId: string): Pr
           { omitExcludedGlobals: true }
         ),
     policies: [],
+    policiesNew: [],
     sends: sendResponses,
     UserDecryption: {
       MasterPasswordUnlock: userDecryptionOptions.MasterPasswordUnlock,
@@ -156,6 +133,7 @@ export async function handleSync(request: Request, env: Env, userId: string): Pr
       KeyConnectorOption: null,
       WebAuthnPrfOption: webAuthnPrfOptions[0] || null,
       WebAuthnPrfOptions: webAuthnPrfOptions,
+      V2UpgradeToken: null,
       Object: 'userDecryption',
     },
     UserDecryptionOptions: userDecryptionOptions,

src/router-admin-backup.ts

@@ -50,7 +50,7 @@ export async function handleAdminBackupRoute(
     return handleListAdminRemoteBackups(request, env, actorUser);
   }
 
-  if (path === '/api/admin/backup/remote/download' && method === 'GET') {
+  if (path === '/api/admin/backup/remote/download' && method === 'POST') {
     return handleDownloadAdminRemoteBackup(request, env, actorUser);
   }
 

src/router-authenticated.ts

@@ -3,6 +3,7 @@ import { errorResponse, jsonResponse } from './utils/response';
 import {
   handleGetProfile,
   handleUpdateProfile,
+  handleGetKeys,
   handleSetKeys,
   handleGetRevisionDate,
   handleVerifyPassword,
@@ -11,6 +12,10 @@ import {
   handleGetTotpStatus,
   handleSetTotpStatus,
   handleGetTotpRecoveryCode,
+  handleGetTwoFactorProviders,
+  handleGetTwoFactorAuthenticator,
+  handlePutTwoFactorAuthenticator,
+  handleDisableTwoFactorProvider,
   handleGetApiKey,
   handleRotateApiKey,
 } from './handlers/accounts';
@@ -74,6 +79,12 @@ import {
   handleGetAccountPasskeyUpdateAssertionOptions,
   handleUpdateAccountPasskeyEncryption,
 } from './handlers/account-passkeys';
+import {
+  handleGetAuthRequest,
+  handleListAuthRequests,
+  handleListPendingAuthRequests,
+  handleUpdateAuthRequest,
+} from './handlers/auth-requests';
 
 export async function handleAuthenticatedRoute(
   request: Request,
@@ -105,8 +116,10 @@ export async function handleAuthenticatedRoute(
     return handleChangePassword(request, env, userId);
   }
 
-  if (path === '/api/accounts/keys' && method === 'POST') {
-    return handleSetKeys(request, env, userId);
+  if (path === '/api/accounts/keys') {
+    if (method === 'GET') return handleGetKeys(request, env, userId);
+    if (method === 'POST') return handleSetKeys(request, env, userId);
+    return errorResponse('Method not allowed', 405);
   }
 
   if (path === '/api/accounts/totp') {
@@ -119,6 +132,25 @@ export async function handleAuthenticatedRoute(
     return handleGetTotpRecoveryCode(request, env, userId);
   }
 
+  if (path === '/api/two-factor') {
+    if (method === 'GET') return handleGetTwoFactorProviders(request, env, userId);
+    return errorResponse('Method not allowed', 405);
+  }
+
+  if (path === '/api/two-factor/get-authenticator' && method === 'POST') {
+    return handleGetTwoFactorAuthenticator(request, env, userId);
+  }
+
+  if (path === '/api/two-factor/authenticator') {
+    if (method === 'PUT' || method === 'POST') return handlePutTwoFactorAuthenticator(request, env, userId);
+    if (method === 'DELETE') return handleDisableTwoFactorProvider(request, env, userId);
+    return errorResponse('Method not allowed', 405);
+  }
+
+  if (path === '/api/two-factor/disable' && (method === 'PUT' || method === 'POST')) {
+    return handleDisableTwoFactorProvider(request, env, userId);
+  }
+
   if (path === '/api/accounts/revision-date' && method === 'GET') {
     return handleGetRevisionDate(request, env, userId);
   }
@@ -262,8 +294,21 @@ export async function handleAuthenticatedRoute(
     if (method === 'DELETE') return handleDeleteFolder(request, env, userId, folderId);
   }
 
-  if (path.startsWith('/api/auth-requests')) {
-    return jsonResponse({ data: [], object: 'list', continuationToken: null });
+  if (path === '/api/auth-requests' || path === '/api/auth-requests/') {
+    if (method === 'GET') return handleListAuthRequests(request, env, userId);
+    return errorResponse('Method not allowed', 405);
+  }
+
+  if (path === '/api/auth-requests/pending') {
+    if (method === 'GET') return handleListPendingAuthRequests(request, env, userId);
+    return errorResponse('Method not allowed', 405);
+  }
+
+  const authRequestMatch = path.match(/^\/api\/auth-requests\/([a-f0-9-]+)$/i);
+  if (authRequestMatch) {
+    if (method === 'GET') return handleGetAuthRequest(request, env, userId, authRequestMatch[1]);
+    if (method === 'PUT') return handleUpdateAuthRequest(request, env, userId, authRequestMatch[1]);
+    return errorResponse('Method not allowed', 405);
   }
 
   if (path === '/api/collections' || path.startsWith('/api/collections/')) {

src/router-devices.ts

@@ -20,6 +20,10 @@ import {
   handleClearDeviceToken,
 } from './handlers/devices';
 
+function devicesPath(pattern: string): RegExp {
+  return new RegExp(`^/(?:api/)?devices${pattern}$`, 'i');
+}
+
 export async function handleAuthenticatedDeviceRoute(
   request: Request,
   env: Env,
@@ -27,31 +31,31 @@ export async function handleAuthenticatedDeviceRoute(
   path: string,
   method: string
 ): Promise<Response | null> {
-  if (path === '/api/devices') {
+  if (path === '/api/devices' || path === '/devices') {
     if (method === 'GET') return handleGetDevices(request, env, userId);
     if (method === 'DELETE') return handleDeleteAllDevices(request, env, userId);
     return null;
   }
 
-  if (path === '/api/devices/authorized') {
+  if (path === '/api/devices/authorized' || path === '/devices/authorized') {
     if (method === 'GET') return handleGetAuthorizedDevices(request, env, userId);
     if (method === 'DELETE') return handleRevokeAllTrustedDevices(request, env, userId);
     return null;
   }
 
-  const authorizedDeviceMatch = path.match(/^\/api\/devices\/authorized\/([^/]+)$/i);
+  const authorizedDeviceMatch = path.match(devicesPath('/authorized/([^/]+)'));
   if (authorizedDeviceMatch && method === 'DELETE') {
     const deviceIdentifier = decodeURIComponent(authorizedDeviceMatch[1]);
     return handleRevokeTrustedDevice(request, env, userId, deviceIdentifier);
   }
 
-  const permanentAuthorizedDeviceMatch = path.match(/^\/api\/devices\/authorized\/([^/]+)\/permanent$/i);
+  const permanentAuthorizedDeviceMatch = path.match(devicesPath('/authorized/([^/]+)/permanent'));
   if (permanentAuthorizedDeviceMatch && method === 'POST') {
     const deviceIdentifier = decodeURIComponent(permanentAuthorizedDeviceMatch[1]);
     return handleTrustDevicePermanently(request, env, userId, deviceIdentifier);
   }
 
-  const deleteDeviceMatch = path.match(/^\/api\/devices\/([^/]+)$/i);
+  const deleteDeviceMatch = path.match(devicesPath('/([^/]+)'));
   if (deleteDeviceMatch && method === 'GET') {
     const deviceIdentifier = decodeURIComponent(deleteDeviceMatch[1]);
     return handleGetDevice(request, env, userId, deviceIdentifier);
@@ -61,59 +65,59 @@ export async function handleAuthenticatedDeviceRoute(
     return handleDeleteDevice(request, env, userId, deviceIdentifier);
   }
 
-  const updateDeviceNameMatch = path.match(/^\/api\/devices\/([^/]+)\/name$/i);
+  const updateDeviceNameMatch = path.match(devicesPath('/([^/]+)/name'));
   if (updateDeviceNameMatch && method === 'PUT') {
     const deviceIdentifier = decodeURIComponent(updateDeviceNameMatch[1]);
     return handleUpdateDeviceName(request, env, userId, deviceIdentifier);
   }
 
-  const identifierMatch = path.match(/^\/api\/devices\/identifier\/([^/]+)$/i);
+  const identifierMatch = path.match(devicesPath('/identifier/([^/]+)'));
   if (identifierMatch && method === 'GET') {
     const deviceIdentifier = decodeURIComponent(identifierMatch[1]);
     return handleGetDeviceByIdentifier(request, env, userId, deviceIdentifier);
   }
 
-  const deviceKeysMatch = path.match(/^\/api\/devices\/([^/]+)\/keys$/i) || path.match(/^\/api\/devices\/identifier\/([^/]+)\/keys$/i);
+  const deviceKeysMatch = path.match(devicesPath('/([^/]+)/keys')) || path.match(devicesPath('/identifier/([^/]+)/keys'));
   if (deviceKeysMatch && (method === 'PUT' || method === 'POST')) {
     const deviceIdentifier = decodeURIComponent(deviceKeysMatch[1]);
     return handleUpdateDeviceKeys(request, env, userId, deviceIdentifier);
   }
 
-  const identifierTokenMatch = path.match(/^\/api\/devices\/identifier\/([^/]+)\/token$/i);
+  const identifierTokenMatch = path.match(devicesPath('/identifier/([^/]+)/token'));
   if (identifierTokenMatch && (method === 'PUT' || method === 'POST')) {
     const deviceIdentifier = decodeURIComponent(identifierTokenMatch[1]);
     return handleUpdateDeviceToken(request, env, userId, deviceIdentifier);
   }
 
-  const identifierWebPushMatch = path.match(/^\/api\/devices\/identifier\/([^/]+)\/web-push-auth$/i);
+  const identifierWebPushMatch = path.match(devicesPath('/identifier/([^/]+)/web-push-auth'));
   if (identifierWebPushMatch && (method === 'PUT' || method === 'POST')) {
     const deviceIdentifier = decodeURIComponent(identifierWebPushMatch[1]);
     return handleUpdateDeviceWebPushAuth(request, env, userId, deviceIdentifier);
   }
 
-  const identifierClearTokenMatch = path.match(/^\/api\/devices\/identifier\/([^/]+)\/clear-token$/i);
+  const identifierClearTokenMatch = path.match(devicesPath('/identifier/([^/]+)/clear-token'));
   if (identifierClearTokenMatch && (method === 'PUT' || method === 'POST')) {
     const deviceIdentifier = decodeURIComponent(identifierClearTokenMatch[1]);
     return handleClearDeviceToken(request, env, userId, deviceIdentifier);
   }
 
-  const identifierRetrieveKeysMatch = path.match(/^\/api\/devices\/([^/]+)\/retrieve-keys$/i);
+  const identifierRetrieveKeysMatch = path.match(devicesPath('/([^/]+)/retrieve-keys'));
   if (identifierRetrieveKeysMatch && method === 'POST') {
     const deviceIdentifier = decodeURIComponent(identifierRetrieveKeysMatch[1]);
     return handleRetrieveDeviceKeys(request, env, userId, deviceIdentifier);
   }
 
-  const identifierDeactivateMatch = path.match(/^\/api\/devices\/([^/]+)\/deactivate$/i);
+  const identifierDeactivateMatch = path.match(devicesPath('/([^/]+)/deactivate'));
   if (identifierDeactivateMatch && (method === 'POST' || method === 'DELETE')) {
     const deviceIdentifier = decodeURIComponent(identifierDeactivateMatch[1]);
     return handleDeactivateDevice(request, env, userId, deviceIdentifier);
   }
 
-  if (path === '/api/devices/update-trust' && method === 'POST') {
+  if ((path === '/api/devices/update-trust' || path === '/devices/update-trust') && method === 'POST') {
     return handleUpdateDeviceTrust(request, env, userId);
   }
 
-  if (path === '/api/devices/untrust' && method === 'POST') {
+  if ((path === '/api/devices/untrust' || path === '/devices/untrust') && method === 'POST') {
     return handleUntrustDevices(request, env, userId);
   }
 

src/router-public.ts

@@ -15,13 +15,19 @@ import {
   handleGetPasswordHint,
   handleRecoverTwoFactor,
 } from './handlers/accounts';
+import {
+  handleCreateAuthRequest,
+  handleGetAuthRequestResponse,
+} from './handlers/auth-requests';
 import { handlePublicDownloadAttachment } from './handlers/attachments';
 import { handlePublicUploadAttachment } from './handlers/attachments';
 import {
+  handleAnonymousNotificationsHub,
   handleNotificationsHub,
   handleNotificationsNegotiate,
 } from './handlers/notifications';
 import { handlePublicUploadSendFile } from './handlers/sends';
+import { isSafeWebsiteIconContentType } from './utils/content-type';
 import { jsonResponse } from './utils/response';
 import { StorageService } from './services/storage';
 import type { Env } from './types';
@@ -121,6 +127,7 @@ function buildConfigResponse(origin: string) {
       'email-verification': true,
       'pm-19051-send-email-verification': false,
       'pm-19148-innovation-archive': true,
+      'pm-30529-webauthn-related-origins': true,
       'unauth-ui-refresh': true,
       'web-push': false,
     },
@@ -236,6 +243,7 @@ function iconResponse(body: BodyInit | null, contentType: string | null): Respon
     headers: {
       'Content-Type': contentType || 'image/png',
       'Cache-Control': `public, max-age=${LIMITS.cache.iconTtlSeconds}, immutable`,
+      'Content-Security-Policy': "default-src 'none'; img-src 'self' data:; sandbox",
     },
   });
 }
@@ -267,7 +275,7 @@ async function handleWebsiteIcon(host: string, fallbackMode: 'default' | 'not-fo
 
       if (!resp.ok) continue;
       const contentType = String(resp.headers.get('Content-Type') || '').toLowerCase();
-      if (!contentType.startsWith('image/')) continue;
+      if (!isSafeWebsiteIconContentType(contentType)) continue;
 
       const contentLength = getPositiveContentLength(resp.headers);
       if (contentLength !== null && contentLength > ICON_MAX_BUFFER_BYTES) continue;
@@ -390,6 +398,19 @@ export async function handlePublicRoute(
     return handleDownloadSendFile(request, env, sendDownloadMatch[1], sendDownloadMatch[2]);
   }
 
+  if ((path === '/api/auth-requests' || path === '/api/auth-requests/') && method === 'POST') {
+    const blocked = await enforcePublicRateLimit('public-sensitive', LIMITS.rateLimit.sensitivePublicRequestsPerMinute);
+    if (blocked) return blocked;
+    return handleCreateAuthRequest(request, env);
+  }
+
+  const authRequestResponseMatch = path.match(/^\/api\/auth-requests\/([a-f0-9-]+)\/response$/i);
+  if (authRequestResponseMatch && method === 'GET') {
+    const blocked = await enforcePublicRateLimit('public-sensitive', LIMITS.rateLimit.sensitivePublicRequestsPerMinute);
+    if (blocked) return blocked;
+    return handleGetAuthRequestResponse(request, env, authRequestResponseMatch[1]);
+  }
+
   if (path === '/identity/connect/token' && method === 'POST') {
     return handleToken(request, env);
   }
@@ -449,7 +470,7 @@ export async function handlePublicRoute(
     const blocked = await enforcePublicRateLimit('public-read', LIMITS.rateLimit.publicReadRequestsPerMinute);
     if (blocked) return blocked;
     const origin = new URL(request.url).origin;
-    return jsonResponse(buildConfigResponse(origin));
+    return jsonResponse(buildConfigResponse(origin), 200, { 'Cache-Control': 'no-store' });
   }
 
   if (path === '/api/version' && method === 'GET') {
@@ -477,5 +498,9 @@ export async function handlePublicRoute(
   if (path === '/notifications/hub' && method === 'GET') {
     return handleNotificationsHub(request, env);
   }
+
+  if (path === '/notifications/anonymous-hub' && method === 'GET') {
+    return handleAnonymousNotificationsHub(request, env);
+  }
   return null;
 }

src/services/backup-archive.ts

@@ -68,6 +68,7 @@ export interface BackupPayload {
     ciphers: SqlRow[];
     attachments: SqlRow[];
     webauthn_credentials?: SqlRow[];
+    trusted_two_factor_device_tokens?: SqlRow[];
   };
 }
 
@@ -302,6 +303,7 @@ export function validateBackupPayloadContents(
   const cipherRows = ensureRowArray(payload.db.ciphers, 'ciphers');
   const attachmentRows = ensureRowArray(payload.db.attachments, 'attachments');
   const accountPasskeyRows = ensureRowArray(payload.db.webauthn_credentials || [], 'webauthn_credentials');
+  const trustedTwoFactorTokenRows = ensureRowArray(payload.db.trusted_two_factor_device_tokens || [], 'trusted_two_factor_device_tokens');
   const externalAttachmentKeys = new Set<string>(
     options.allowExternalAttachmentBlobs
       ? (payload.manifest.attachmentBlobs || []).map((item) => `attachments/${String(item.cipherId || '').trim()}/${String(item.attachmentId || '').trim()}.bin`)
@@ -390,6 +392,21 @@ export function validateBackupPayloadContents(
     accountPasskeyIds.add(id);
     accountPasskeyCredentialIds.add(credentialId);
   }
+
+  const trustedTwoFactorTokens = new Set<string>();
+  for (const row of trustedTwoFactorTokenRows) {
+    const token = String(row.token || '').trim();
+    const userId = String(row.user_id || '').trim();
+    const deviceIdentifier = String(row.device_identifier || '').trim();
+    const expiresAt = Number(row.expires_at || 0);
+    if (!token || !userIds.has(userId) || !deviceIdentifier || !Number.isFinite(expiresAt) || expiresAt <= 0) {
+      throw new Error('Backup archive contains an invalid trusted two-factor device token row');
+    }
+    if (trustedTwoFactorTokens.has(token)) {
+      throw new Error(`Backup archive contains duplicate trusted two-factor device token: ${token}`);
+    }
+    trustedTwoFactorTokens.add(token);
+  }
 }
 
 export async function buildBackupArchive(
@@ -408,7 +425,7 @@ export async function buildBackupArchive(
     includeAttachments,
   });
   const encoder = new TextEncoder();
-  const [configRows, userRows, domainSettingsRows, revisionRows, folderRows, cipherRows, attachmentRows, accountPasskeyRows] = await Promise.all([
+  const [configRows, userRows, domainSettingsRows, revisionRows, folderRows, cipherRows, attachmentRows, accountPasskeyRows, trustedTwoFactorTokenRows] = await Promise.all([
     queryRows(env.DB, 'SELECT key, value FROM config ORDER BY key ASC'),
     queryRows(env.DB, 'SELECT id, email, name, master_password_hint, master_password_hash, key, private_key, public_key, kdf_type, kdf_iterations, kdf_memory, kdf_parallelism, security_stamp, role, status, verify_devices, totp_secret, totp_recovery_code, created_at, updated_at FROM users ORDER BY created_at ASC'),
     queryRows(env.DB, 'SELECT user_id, equivalent_domains, custom_equivalent_domains, excluded_global_equivalent_domains, updated_at FROM domain_settings ORDER BY user_id ASC'),
@@ -417,6 +434,7 @@ export async function buildBackupArchive(
     queryRows(env.DB, 'SELECT id, user_id, type, folder_id, name, notes, favorite, data, reprompt, key, created_at, updated_at, archived_at, deleted_at FROM ciphers ORDER BY created_at ASC'),
     queryRows(env.DB, 'SELECT id, cipher_id, file_name, size, size_name, key FROM attachments ORDER BY cipher_id ASC, id ASC'),
     queryRows(env.DB, 'SELECT id, user_id, name, public_key, credential_id, counter, type, aa_guid, transports, encrypted_user_key, encrypted_public_key, encrypted_private_key, supports_prf, created_at, updated_at FROM webauthn_credentials ORDER BY created_at ASC'),
+    queryRows(env.DB, 'SELECT token, user_id, device_identifier, expires_at FROM trusted_two_factor_device_tokens WHERE expires_at >= ? ORDER BY user_id ASC, device_identifier ASC, expires_at DESC', date.getTime()),
   ]);
   const exportedConfigRows = sanitizeConfigRowsForExport(configRows);
   const exportedAttachmentRows = includeAttachments ? attachmentRows : [];
@@ -445,6 +463,7 @@ export async function buildBackupArchive(
       ciphers: cipherRows.length,
       attachments: exportedAttachmentRows.length,
       webauthn_credentials: accountPasskeyRows.length,
+      trusted_two_factor_device_tokens: trustedTwoFactorTokenRows.length,
     },
     includes: {
       attachments: includeAttachments,
@@ -468,6 +487,7 @@ export async function buildBackupArchive(
       ciphers: cipherRows,
       attachments: exportedAttachmentRows,
       webauthn_credentials: accountPasskeyRows,
+      trusted_two_factor_device_tokens: trustedTwoFactorTokenRows,
     }, null, BACKUP_JSON_INDENT)),
   };
 

src/services/backup-config.ts

@@ -16,6 +16,7 @@ import {
   type BackupRuntimeState,
   type BackupScheduleConfig,
   type BackupSettings,
+  type S3BackupAddressingStyle,
   type S3BackupDestination,
   type WebDavBackupDestination,
   createBackupRandomId,
@@ -25,6 +26,7 @@ import {
 } from '../../shared/backup-schema';
 
 export const BACKUP_SETTINGS_CONFIG_KEY = 'backup.settings.v1';
+const BACKUP_RUNTIME_CONFIG_KEY = 'backup.runtime.v1';
 export const BACKUP_SCHEDULER_WINDOW_MINUTES = 5;
 const MAX_BACKUP_DESTINATIONS = 24;
 
@@ -35,6 +37,7 @@ export type {
   BackupRuntimeState,
   BackupScheduleConfig,
   BackupSettings,
+  S3BackupAddressingStyle,
   S3BackupDestination,
   WebDavBackupDestination,
 } from '../../shared/backup-schema';
@@ -109,6 +112,9 @@ function normalizeS3Destination(value: unknown, allowIncomplete = false): S3Back
   const source = isPlainObject(value) ? value : {};
   const endpoint = asTrimmedString(source.endpoint);
   const bucket = asTrimmedString(source.bucket);
+  const addressingStyleRaw = asTrimmedString(source.addressingStyle);
+  const addressingStyle: S3BackupAddressingStyle =
+    addressingStyleRaw === 'virtual-hosted-style' ? 'virtual-hosted-style' : 'path-style';
   const accessKeyId = asTrimmedString(source.accessKeyId);
   const secretAccessKey = asTrimmedString(source.secretAccessKey);
   const region = asTrimmedString(source.region) || 'auto';
@@ -131,6 +137,7 @@ function normalizeS3Destination(value: unknown, allowIncomplete = false): S3Back
   return {
     endpoint: endpoint ? endpoint.replace(/\/+$/, '') : '',
     bucket,
+    addressingStyle,
     region,
     accessKeyId,
     secretAccessKey,
@@ -318,6 +325,47 @@ function mapDestinationsById(destinations: BackupDestinationRecord[]): Map<strin
   return new Map(destinations.map((destination) => [destination.id, destination]));
 }
 
+function stripRuntimeFromSettings(settings: BackupSettings): BackupSettings {
+  return {
+    destinations: settings.destinations.map((destination) => ({
+      ...destination,
+      runtime: normalizeRuntime(null),
+    })),
+  };
+}
+
+function serializeRuntimeState(settings: BackupSettings): string {
+  return JSON.stringify({
+    version: 1,
+    destinations: Object.fromEntries(
+      settings.destinations.map((destination) => [destination.id, normalizeRuntime(destination.runtime)])
+    ),
+  });
+}
+
+async function loadBackupRuntimeStates(storage: StorageService): Promise<Map<string, BackupRuntimeState>> {
+  const raw = await storage.getConfigValue(BACKUP_RUNTIME_CONFIG_KEY);
+  if (!raw) return new Map();
+  try {
+    const parsed = JSON.parse(raw) as { destinations?: Record<string, unknown> };
+    const entries = Object.entries(parsed.destinations || {})
+      .filter(([id]) => !!asTrimmedString(id))
+      .map(([id, runtime]) => [id, normalizeRuntime(runtime)] as const);
+    return new Map(entries);
+  } catch {
+    return new Map();
+  }
+}
+
+function mergeRuntimeStates(settings: BackupSettings, runtimes: Map<string, BackupRuntimeState>): BackupSettings {
+  return {
+    destinations: settings.destinations.map((destination) => ({
+      ...destination,
+      runtime: runtimes.get(destination.id) || normalizeRuntime(destination.runtime),
+    })),
+  };
+}
+
 export function getDefaultBackupSettings(timezone: string = 'UTC'): BackupSettings {
   return createSharedDefaultBackupSettings(assertValidTimeZone(timezone));
 }
@@ -381,27 +429,30 @@ export function normalizeBackupSettingsInput(
 }
 
 export function serializeBackupSettings(settings: BackupSettings): string {
-  return JSON.stringify(settings);
+  return JSON.stringify(stripRuntimeFromSettings(settings));
 }
 
 export async function loadBackupSettings(storage: StorageService, env: Env, fallbackTimezone: string = 'UTC'): Promise<BackupSettings> {
   const raw = await storage.getConfigValue(BACKUP_SETTINGS_CONFIG_KEY);
+  const mergeRuntime = async (settings: BackupSettings): Promise<BackupSettings> => (
+    mergeRuntimeStates(settings, await loadBackupRuntimeStates(storage))
+  );
   if (!raw) {
     const settings = getDefaultBackupSettings(fallbackTimezone);
     await saveBackupSettings(storage, env, settings);
-    return settings;
+    return mergeRuntime(settings);
   }
 
   const envelope = parseBackupSettingsEnvelope(raw);
   if (!envelope) {
     const settings = parseBackupSettings(raw, fallbackTimezone);
     await saveBackupSettings(storage, env, settings);
-    return settings;
+    return mergeRuntime(settings);
   }
 
   try {
     const decrypted = await decryptBackupSettingsRuntime(raw, env);
-    return parseBackupSettings(decrypted, fallbackTimezone);
+    return mergeRuntime(parseBackupSettings(decrypted, fallbackTimezone));
   } catch {
     throw new Error('Backup settings need administrator reactivation after restore');
   }
@@ -411,6 +462,27 @@ export async function saveBackupSettings(storage: StorageService, env: Env, sett
   const users = await storage.getAllUsers();
   const encrypted = await encryptBackupSettingsEnvelope(serializeBackupSettings(settings), env, users);
   await storage.setConfigValue(BACKUP_SETTINGS_CONFIG_KEY, encrypted);
+  await saveBackupRuntimeStates(storage, settings);
+}
+
+export async function saveBackupRuntimeStates(storage: StorageService, settings: BackupSettings): Promise<void> {
+  await storage.setConfigValue(BACKUP_RUNTIME_CONFIG_KEY, serializeRuntimeState(settings));
+}
+
+export async function updateBackupDestinationRuntime(
+  storage: StorageService,
+  destinationId: string,
+  mutator: (runtime: BackupRuntimeState) => BackupRuntimeState
+): Promise<BackupRuntimeState> {
+  const runtimes = await loadBackupRuntimeStates(storage);
+  const current = runtimes.get(destinationId) || normalizeRuntime(null);
+  const next = normalizeRuntime(mutator(current));
+  runtimes.set(destinationId, next);
+  await storage.setConfigValue(BACKUP_RUNTIME_CONFIG_KEY, JSON.stringify({
+    version: 1,
+    destinations: Object.fromEntries(runtimes.entries()),
+  }));
+  return next;
 }
 
 export async function normalizeImportedBackupSettings(storage: StorageService, env: Env, fallbackTimezone: string = 'UTC'): Promise<void> {
@@ -590,9 +662,9 @@ export function hasBackupSlotBetween(
   const endMs = endExclusive.getTime();
   if (!Number.isFinite(startMs) || !Number.isFinite(endMs) || endMs <= startMs) return false;
 
-  const lastAttemptAt = destination.runtime.lastAttemptAt ? new Date(destination.runtime.lastAttemptAt) : null;
-  const lastAttemptMs = lastAttemptAt && Number.isFinite(lastAttemptAt.getTime())
-    ? lastAttemptAt.getTime()
+  const lastSuccessAt = destination.runtime.lastSuccessAt ? new Date(destination.runtime.lastSuccessAt) : null;
+  const lastSuccessMs = lastSuccessAt && Number.isFinite(lastSuccessAt.getTime())
+    ? lastSuccessAt.getTime()
     : Number.NEGATIVE_INFINITY;
 
   const dayCursor = new Date(startMs);
@@ -614,7 +686,7 @@ export function hasBackupSlotBetween(
       for (const slotStart of slotStarts) {
         const slotStartMs = slotStart.getTime();
         if (slotStartMs < startMs || slotStartMs >= endMs) continue;
-        if (lastAttemptMs >= slotStartMs) continue;
+        if (lastSuccessMs >= slotStartMs) continue;
         return true;
       }
     }
@@ -631,9 +703,9 @@ export function isBackupDueNow(
 ): boolean {
   if (!destination.schedule.enabled) return false;
   const toleranceMs = Math.max(1, windowMinutes) * 60 * 1000;
-  const lastAttemptAt = destination.runtime.lastAttemptAt ? new Date(destination.runtime.lastAttemptAt) : null;
-  const lastAttemptMs = lastAttemptAt && Number.isFinite(lastAttemptAt.getTime())
-    ? lastAttemptAt.getTime()
+  const lastSuccessAt = destination.runtime.lastSuccessAt ? new Date(destination.runtime.lastSuccessAt) : null;
+  const lastSuccessMs = lastSuccessAt && Number.isFinite(lastSuccessAt.getTime())
+    ? lastSuccessAt.getTime()
     : Number.NEGATIVE_INFINITY;
   const localDateKey = getBackupLocalDateKey(now, destination.schedule.timezone);
   const slotStarts = getBackupSlotStartsForLocalDay(
@@ -646,7 +718,7 @@ export function isBackupDueNow(
   for (const slotStart of slotStarts) {
     const slotStartMs = slotStart.getTime();
     if (now.getTime() < slotStartMs || now.getTime() >= slotStartMs + toleranceMs) continue;
-    if (lastAttemptMs >= slotStartMs) return false;
+    if (lastSuccessMs >= slotStartMs) return false;
     return true;
   }
   return false;

src/services/backup-import.ts

@@ -24,6 +24,7 @@ type BackupTableName =
   | 'users'
   | 'domain_settings'
   | 'user_revisions'
+  | 'trusted_two_factor_device_tokens'
   | 'webauthn_credentials'
   | 'folders'
   | 'ciphers'
@@ -34,6 +35,7 @@ const BACKUP_TABLES: BackupTableName[] = [
   'users',
   'domain_settings',
   'user_revisions',
+  'trusted_two_factor_device_tokens',
   'webauthn_credentials',
   'folders',
   'ciphers',
@@ -51,6 +53,7 @@ export interface BackupImportResultBody {
     users: number;
     domainSettings: number;
     userRevisions: number;
+    trustedTwoFactorDeviceTokens: number;
     webauthnCredentials: number;
     folders: number;
     ciphers: number;
@@ -172,6 +175,7 @@ function buildResetImportTargetStatements(db: D1Database): D1PreparedStatement[]
     'DELETE FROM ciphers',
     'DELETE FROM folders',
     'DELETE FROM webauthn_credentials',
+    'DELETE FROM trusted_two_factor_device_tokens',
     'DELETE FROM domain_settings',
     'DELETE FROM user_revisions',
     'DELETE FROM users',
@@ -296,6 +300,7 @@ async function importPreparedBackupRows(db: D1Database, payload: BackupPayload['
     })),
     domain_settings: cloneRows(payload.domain_settings || []),
     user_revisions: cloneRows(payload.user_revisions || []),
+    trusted_two_factor_device_tokens: cloneRows(payload.trusted_two_factor_device_tokens || []),
     webauthn_credentials: cloneRows(payload.webauthn_credentials || []),
     folders: cloneRows(payload.folders || []),
     ciphers: cloneRows(payload.ciphers || []).map((row) => ({
@@ -634,6 +639,16 @@ async function importBackupRows(db: D1Database, payload: BackupPayload['db'], us
       true
     )
   );
+  await runInsertBatch(
+    db,
+    tableName('trusted_two_factor_device_tokens'),
+    buildInsertStatements(
+      db,
+      tableName('trusted_two_factor_device_tokens'),
+      ['token', 'user_id', 'device_identifier', 'expires_at'],
+      payload.trusted_two_factor_device_tokens || []
+    )
+  );
   await runInsertBatch(
     db,
     tableName('webauthn_credentials'),
@@ -712,6 +727,7 @@ export async function importBackupArchiveBytes(
       users: (db.users || []).length,
       domain_settings: (db.domain_settings || []).length,
       user_revisions: (db.user_revisions || []).length,
+      trusted_two_factor_device_tokens: (db.trusted_two_factor_device_tokens || []).length,
       webauthn_credentials: (db.webauthn_credentials || []).length,
       folders: (db.folders || []).length,
       ciphers: (db.ciphers || []).length,
@@ -735,6 +751,7 @@ export async function importBackupArchiveBytes(
       users: (db.users || []).length,
       domain_settings: (db.domain_settings || []).length,
       user_revisions: (db.user_revisions || []).length,
+      trusted_two_factor_device_tokens: (db.trusted_two_factor_device_tokens || []).length,
       webauthn_credentials: (db.webauthn_credentials || []).length,
       folders: (db.folders || []).length,
       ciphers: (db.ciphers || []).length,
@@ -776,6 +793,7 @@ export async function importBackupArchiveBytes(
           users: (db.users || []).length,
           domainSettings: (db.domain_settings || []).length,
           userRevisions: (db.user_revisions || []).length,
+          trustedTwoFactorDeviceTokens: (db.trusted_two_factor_device_tokens || []).length,
           webauthnCredentials: (db.webauthn_credentials || []).length,
           folders: (db.folders || []).length,
           ciphers: (db.ciphers || []).length,
@@ -853,6 +871,7 @@ export async function importRemoteBackupArchiveBytes(
       users: (db.users || []).length,
       domain_settings: (db.domain_settings || []).length,
       user_revisions: (db.user_revisions || []).length,
+      trusted_two_factor_device_tokens: (db.trusted_two_factor_device_tokens || []).length,
       webauthn_credentials: (db.webauthn_credentials || []).length,
       folders: (db.folders || []).length,
       ciphers: (db.ciphers || []).length,
@@ -876,6 +895,7 @@ export async function importRemoteBackupArchiveBytes(
       users: (db.users || []).length,
       domain_settings: (db.domain_settings || []).length,
       user_revisions: (db.user_revisions || []).length,
+      trusted_two_factor_device_tokens: (db.trusted_two_factor_device_tokens || []).length,
       webauthn_credentials: (db.webauthn_credentials || []).length,
       folders: (db.folders || []).length,
       ciphers: (db.ciphers || []).length,
@@ -923,6 +943,7 @@ export async function importRemoteBackupArchiveBytes(
           users: (db.users || []).length,
           domainSettings: (db.domain_settings || []).length,
           userRevisions: (db.user_revisions || []).length,
+          trustedTwoFactorDeviceTokens: (db.trusted_two_factor_device_tokens || []).length,
           webauthnCredentials: (db.webauthn_credentials || []).length,
           folders: (db.folders || []).length,
           ciphers: (db.ciphers || []).length,

src/services/backup-uploader.ts

@@ -33,6 +33,13 @@ export interface RemoteBackupFile {
   bytes: Uint8Array;
 }
 
+export interface RemoteBackupFileStat {
+  provider: BackupDestinationType;
+  remotePath: string;
+  size: number | null;
+  modifiedAt: string | null;
+}
+
 export interface RemoteBackupFilePutOptions {
   contentType?: string;
 }
@@ -433,6 +440,10 @@ async function deleteFromWebDav(config: WebDavBackupDestination, relativePath: s
 }
 
 async function existsInWebDav(config: WebDavBackupDestination, relativePath: string): Promise<boolean> {
+  return (await statWebDavFile(config, relativePath)) !== null;
+}
+
+async function statWebDavFile(config: WebDavBackupDestination, relativePath: string): Promise<RemoteBackupFileStat | null> {
   const authHeader = toBasicAuthHeader(config.username, config.password);
   const remotePath = webDavFullPath(config, relativePath);
   const response = await fetch(buildWebDavUrl(config.baseUrl, remotePath), {
@@ -441,15 +452,40 @@ async function existsInWebDav(config: WebDavBackupDestination, relativePath: str
       Authorization: authHeader,
     },
   });
-  if (response.status === 404) return false;
+  if (response.status === 404) return null;
   if (!response.ok) {
     throw new Error(`WebDAV existence check failed: ${response.status}`);
   }
-  return true;
+  const size = Number(response.headers.get('Content-Length') || '');
+  return {
+    provider: 'webdav',
+    remotePath: normalizeRelativePath(relativePath),
+    size: Number.isFinite(size) ? size : null,
+    modifiedAt: parseHttpDate(response.headers.get('Last-Modified') || ''),
+  };
+}
+
+function isBucketHostedS3Endpoint(endpoint: URL, bucket: string): boolean {
+  const hostname = endpoint.hostname.toLowerCase();
+  const bucketName = bucket.trim().toLowerCase();
+  return !!bucketName && (hostname === bucketName || hostname.startsWith(`${bucketName}.`));
 }
 
 function s3BucketBaseUrl(config: S3BackupDestination): URL {
-  return new URL(`${config.endpoint.replace(/\/+$/, '')}/${encodeURIComponent(config.bucket)}`);
+  const endpoint = new URL(config.endpoint.replace(/\/+$/, ''));
+  const bucket = config.bucket.trim();
+
+  if (config.addressingStyle === 'virtual-hosted-style') {
+    if (isBucketHostedS3Endpoint(endpoint, bucket)) return endpoint;
+    endpoint.hostname = `${bucket}.${endpoint.hostname}`;
+    return endpoint;
+  }
+
+  return new URL(`${endpoint.toString().replace(/\/+$/, '')}/${encodeURIComponent(bucket)}`);
+}
+
+function s3ObjectUrl(config: S3BackupDestination, objectKey: string): URL {
+  return new URL(`${s3BucketBaseUrl(config).toString().replace(/\/+$/, '')}/${encodePathSegments(objectKey)}`);
 }
 
 function normalizeS3ObjectKey(config: S3BackupDestination, relativePath: string): string {
@@ -501,7 +537,7 @@ async function putToS3(
   options: RemoteBackupFilePutOptions = {}
 ): Promise<void> {
   const objectKey = normalizeS3ObjectKey(config, relativePath);
-  const url = new URL(`${s3BucketBaseUrl(config).toString()}/${encodePathSegments(objectKey)}`);
+  const url = s3ObjectUrl(config, objectKey);
   const response = await signedS3Request(config, 'PUT', url, bytes, options.contentType);
 
   if (!response.ok) {
@@ -521,61 +557,68 @@ async function listS3Entries(config: S3BackupDestination, relativePath: string):
   const currentPath = normalizeRelativePath(relativePath);
   const targetPrefixBase = normalizeS3ObjectKey(config, currentPath);
   const targetPrefix = trimSlashes(targetPrefixBase) ? `${trimSlashes(targetPrefixBase)}/` : '';
-  const url = s3BucketBaseUrl(config);
-  url.searchParams.set('list-type', '2');
-  url.searchParams.set('delimiter', '/');
-  if (targetPrefix) url.searchParams.set('prefix', targetPrefix);
-
-  const response = await signedS3Request(config, 'GET', url);
-  if (!response.ok) {
-    throw new Error(`S3 listing failed: ${response.status}`);
-  }
-
-  const xml = await response.text();
   const rootPrefix = trimSlashes(config.rootPath);
   const items: RemoteBackupItem[] = [];
+  let continuationToken = '';
 
-  for (const prefix of extractXmlBlocks(xml, 'CommonPrefixes')) {
-    const fullPrefix = trimSlashes(extractXmlFirst(prefix, 'Prefix') || '');
-    if (!fullPrefix) continue;
-    const relative = rootPrefix
-      ? fullPrefix === rootPrefix
-        ? ''
-        : fullPrefix.startsWith(`${rootPrefix}/`)
-          ? fullPrefix.slice(rootPrefix.length + 1)
+  do {
+    const url = s3BucketBaseUrl(config);
+    url.searchParams.set('list-type', '2');
+    url.searchParams.set('delimiter', '/');
+    if (targetPrefix) url.searchParams.set('prefix', targetPrefix);
+    if (continuationToken) url.searchParams.set('continuation-token', continuationToken);
+
+    const response = await signedS3Request(config, 'GET', url);
+    if (!response.ok) {
+      throw new Error(`S3 listing failed: ${response.status}`);
+    }
+
+    const xml = await response.text();
+
+    for (const prefix of extractXmlBlocks(xml, 'CommonPrefixes')) {
+      const fullPrefix = trimSlashes(extractXmlFirst(prefix, 'Prefix') || '');
+      if (!fullPrefix) continue;
+      const relative = rootPrefix
+        ? fullPrefix === rootPrefix
+          ? ''
+          : fullPrefix.startsWith(`${rootPrefix}/`)
+            ? fullPrefix.slice(rootPrefix.length + 1)
+            : ''
+        : fullPrefix;
+      const normalizedRelative = trimSlashes(relative);
+      if (!normalizedRelative) continue;
+      const itemPath = normalizedRelative.replace(/\/+$/, '');
+      if ((parentPath(itemPath) || '') !== currentPath) continue;
+      items.push({
+        path: itemPath,
+        name: basename(itemPath) || itemPath,
+        isDirectory: true,
+        size: null,
+        modifiedAt: null,
+      });
+    }
+
+    for (const content of extractXmlBlocks(xml, 'Contents')) {
+      const fullKey = trimSlashes(extractXmlFirst(content, 'Key') || '');
+      if (!fullKey || (targetPrefix && fullKey === trimSlashes(targetPrefix))) continue;
+      const relative = rootPrefix
+        ? fullKey.startsWith(`${rootPrefix}/`)
+          ? fullKey.slice(rootPrefix.length + 1)
           : ''
-      : fullPrefix;
-    const normalizedRelative = trimSlashes(relative);
-    if (!normalizedRelative) continue;
-    const itemPath = normalizedRelative.replace(/\/+$/, '');
-    if ((parentPath(itemPath) || '') !== currentPath) continue;
-    items.push({
-      path: itemPath,
-      name: basename(itemPath) || itemPath,
-      isDirectory: true,
-      size: null,
-      modifiedAt: null,
-    });
-  }
+        : fullKey;
+      const normalizedRelative = trimSlashes(relative);
+      if (!normalizedRelative || (parentPath(normalizedRelative) || '') !== currentPath) continue;
+      items.push({
+        path: normalizedRelative,
+        name: basename(normalizedRelative) || normalizedRelative,
+        isDirectory: false,
+        size: Number(extractXmlFirst(content, 'Size') || 0) || null,
+        modifiedAt: parseHttpDate(extractXmlFirst(content, 'LastModified') || '') || null,
+      });
+    }
 
-  for (const content of extractXmlBlocks(xml, 'Contents')) {
-    const fullKey = trimSlashes(extractXmlFirst(content, 'Key') || '');
-    if (!fullKey || (targetPrefix && fullKey === trimSlashes(targetPrefix))) continue;
-    const relative = rootPrefix
-      ? fullKey.startsWith(`${rootPrefix}/`)
-        ? fullKey.slice(rootPrefix.length + 1)
-        : ''
-      : fullKey;
-    const normalizedRelative = trimSlashes(relative);
-    if (!normalizedRelative || (parentPath(normalizedRelative) || '') !== currentPath) continue;
-    items.push({
-      path: normalizedRelative,
-      name: basename(normalizedRelative) || normalizedRelative,
-      isDirectory: false,
-      size: Number(extractXmlFirst(content, 'Size') || 0) || null,
-      modifiedAt: parseHttpDate(extractXmlFirst(content, 'LastModified') || '') || null,
-    });
-  }
+    continuationToken = extractXmlFirst(xml, 'NextContinuationToken') || '';
+  } while (continuationToken);
 
   const deduped = new Map<string, RemoteBackupItem>();
   for (const item of items) deduped.set(`${item.isDirectory ? 'd' : 'f'}:${item.path}`, item);
@@ -594,7 +637,7 @@ async function downloadFromS3(config: S3BackupDestination, relativePath: string)
     throw new Error('Please select a backup file');
   }
   const objectKey = normalizeS3ObjectKey(config, normalized);
-  const url = new URL(`${s3BucketBaseUrl(config).toString()}/${encodePathSegments(objectKey)}`);
+  const url = s3ObjectUrl(config, objectKey);
   const response = await signedS3Request(config, 'GET', url);
   if (!response.ok) {
     throw new Error(`S3 download failed: ${response.status}`);
@@ -610,7 +653,7 @@ async function downloadFromS3(config: S3BackupDestination, relativePath: string)
 
 async function deleteFromS3(config: S3BackupDestination, relativePath: string): Promise<void> {
   const objectKey = normalizeS3ObjectKey(config, relativePath);
-  const url = new URL(`${s3BucketBaseUrl(config).toString()}/${encodePathSegments(objectKey)}`);
+  const url = s3ObjectUrl(config, objectKey);
   const response = await signedS3Request(config, 'DELETE', url);
   if (!response.ok && response.status !== 404) {
     throw new Error(`S3 delete failed: ${response.status}`);
@@ -618,14 +661,24 @@ async function deleteFromS3(config: S3BackupDestination, relativePath: string):
 }
 
 async function existsInS3(config: S3BackupDestination, relativePath: string): Promise<boolean> {
+  return (await statS3File(config, relativePath)) !== null;
+}
+
+async function statS3File(config: S3BackupDestination, relativePath: string): Promise<RemoteBackupFileStat | null> {
   const objectKey = normalizeS3ObjectKey(config, relativePath);
-  const url = new URL(`${s3BucketBaseUrl(config).toString()}/${encodePathSegments(objectKey)}`);
+  const url = s3ObjectUrl(config, objectKey);
   const response = await signedS3Request(config, 'HEAD', url);
-  if (response.status === 404) return false;
+  if (response.status === 404) return null;
   if (!response.ok) {
     throw new Error(`S3 existence check failed: ${response.status}`);
   }
-  return true;
+  const size = Number(response.headers.get('Content-Length') || '');
+  return {
+    provider: 's3',
+    remotePath: normalizeRelativePath(relativePath),
+    size: Number.isFinite(size) ? size : null,
+    modifiedAt: parseHttpDate(response.headers.get('Last-Modified') || ''),
+  };
 }
 
 interface ConfiguredDestinationAdapter {
@@ -637,6 +690,7 @@ interface ConfiguredDestinationAdapter {
   download: (config: WebDavBackupDestination | S3BackupDestination, relativePath: string) => Promise<RemoteBackupFile>;
   deleteFile: (config: WebDavBackupDestination | S3BackupDestination, relativePath: string) => Promise<void>;
   exists: (config: WebDavBackupDestination | S3BackupDestination, relativePath: string) => Promise<boolean>;
+  stat: (config: WebDavBackupDestination | S3BackupDestination, relativePath: string) => Promise<RemoteBackupFileStat | null>;
 }
 
 export interface RemoteBackupTransferSession {
@@ -647,6 +701,7 @@ export interface RemoteBackupTransferSession {
   download(relativePath: string): Promise<RemoteBackupFile>;
   deleteFile(relativePath: string): Promise<void>;
   exists(relativePath: string): Promise<boolean>;
+  stat(relativePath: string): Promise<RemoteBackupFileStat | null>;
 }
 
 function resolveConfiguredDestinationAdapter(
@@ -664,6 +719,7 @@ function resolveConfiguredDestinationAdapter(
       download: (config, relativePath) => downloadFromWebDav(config as WebDavBackupDestination, relativePath),
       deleteFile: (config, relativePath) => deleteFromWebDav(config as WebDavBackupDestination, relativePath),
       exists: (config, relativePath) => existsInWebDav(config as WebDavBackupDestination, relativePath),
+      stat: (config, relativePath) => statWebDavFile(config as WebDavBackupDestination, relativePath),
     };
   }
   if (destination.type === 's3') {
@@ -676,6 +732,7 @@ function resolveConfiguredDestinationAdapter(
       download: (config, relativePath) => downloadFromS3(config as S3BackupDestination, relativePath),
       deleteFile: (config, relativePath) => deleteFromS3(config as S3BackupDestination, relativePath),
       exists: (config, relativePath) => existsInS3(config as S3BackupDestination, relativePath),
+      stat: (config, relativePath) => statS3File(config as S3BackupDestination, relativePath),
     };
   }
 
@@ -711,6 +768,7 @@ export function createRemoteBackupTransferSession(destination: BackupDestination
     download: async (relativePath: string) => adapter.download(adapter.config, relativePath),
     deleteFile: async (relativePath: string) => adapter.deleteFile(adapter.config, normalizeRelativePath(relativePath)),
     exists: async (relativePath: string) => adapter.exists(adapter.config, normalizeRelativePath(relativePath)),
+    stat: async (relativePath: string) => adapter.stat(adapter.config, normalizeRelativePath(relativePath)),
   };
 }
 

src/services/push-relay.ts

@@ -0,0 +1,275 @@
+import type { Env } from '../types';
+import {
+  setConfigValue as saveConfigValue,
+} from './storage-config-repo';
+
+const PUSH_RELAY_URI = 'https://push.bitwarden.com';
+const PUSH_IDENTITY_URI = 'https://identity.bitwarden.com';
+const INSTALLATIONS_URI = 'https://api.bitwarden.com/installations';
+const PUSH_INSTALLATION_ID_KEY = 'push.installation.id';
+const PUSH_INSTALLATION_KEY_KEY = 'push.installation.key';
+const PUSH_REQUEST_TIMEOUT_MS = 5000;
+
+interface CachedPushAccessToken {
+  token: string;
+  expiresAt: number;
+}
+
+let cachedPushAccessToken: CachedPushAccessToken | null = null;
+
+async function fetchPushEndpoint(url: string, init: RequestInit, errorMessage: string): Promise<Response | null> {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), PUSH_REQUEST_TIMEOUT_MS);
+  try {
+    return await fetch(url, { ...init, signal: controller.signal });
+  } catch (error) {
+    console.error(errorMessage, error);
+    return null;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+function randomInstallationEmail(): string {
+  const bytes = new Uint8Array(10);
+  crypto.getRandomValues(bytes);
+  const localPart = Array.from(bytes, (byte) => (byte % 36).toString(36)).join('');
+  return `${localPart}@nodewarden.app`;
+}
+
+async function getConfigKeyPresence(db: D1Database, key: string): Promise<string | null> {
+  const row = await db.prepare('SELECT value FROM config WHERE key = ? LIMIT 1').bind(key).first<{ value: string }>();
+  return typeof row?.value === 'string' ? row.value : null;
+}
+
+async function getPushInstallationCredentials(db: D1Database): Promise<{ id: string; key: string } | null> {
+  const [id, key] = await Promise.all([
+    getConfigKeyPresence(db, PUSH_INSTALLATION_ID_KEY),
+    getConfigKeyPresence(db, PUSH_INSTALLATION_KEY_KEY),
+  ]);
+  const normalizedId = String(id || '').trim();
+  const normalizedKey = String(key || '').trim();
+  return normalizedId && normalizedKey ? { id: normalizedId, key: normalizedKey } : null;
+}
+
+export async function ensurePushInstallationCredentials(db: D1Database): Promise<{ id: string; key: string } | null> {
+  const existing = await getPushInstallationCredentials(db);
+  if (existing) return existing;
+
+  const response = await fetchPushEndpoint(
+    INSTALLATIONS_URI,
+    {
+      method: 'POST',
+      headers: {
+        accept: 'application/json',
+        'accept-language': 'zh-CN,zh;q=0.9,en;q=0.8',
+        'cache-control': 'no-cache',
+        'content-type': 'application/json',
+        origin: 'https://bitwarden.com',
+        pragma: 'no-cache',
+        priority: 'u=1, i',
+        referer: 'https://bitwarden.com/host/',
+        'sec-ch-ua': '"Google Chrome";v="137", "Chromium";v="137", "Not/A)Brand";v="24"',
+        'sec-ch-ua-mobile': '?0',
+        'sec-ch-ua-platform': '"Windows"',
+        'sec-fetch-dest': 'empty',
+        'sec-fetch-mode': 'cors',
+        'sec-fetch-site': 'same-site',
+        'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36',
+      },
+      body: JSON.stringify({
+        formName: 'request_host',
+        url: '/host/',
+        locale: 'zh-CN',
+        email: randomInstallationEmail(),
+        region: 'us',
+      }),
+    },
+    'Failed to request Bitwarden push installation:'
+  );
+  if (!response) return null;
+
+  if (!response.ok) {
+    console.error('Failed to request Bitwarden push installation:', response.status, await response.text().catch(() => ''));
+    return null;
+  }
+
+  const body = (await response.json().catch(() => null)) as { id?: string; key?: string; enabled?: boolean } | null;
+  const id = String(body?.id || '').trim();
+  const key = String(body?.key || '').trim();
+  if (!id || !key) {
+    console.error('Bitwarden push installation response did not include id/key');
+    return null;
+  }
+
+  await Promise.all([
+    saveConfigValue(db, PUSH_INSTALLATION_ID_KEY, id),
+    saveConfigValue(db, PUSH_INSTALLATION_KEY_KEY, key),
+  ]);
+  return { id, key };
+}
+
+async function getPushAccessToken(env: Env): Promise<string | null> {
+  const credentials = await ensurePushInstallationCredentials(env.DB);
+  if (!credentials) return null;
+
+  const now = Date.now();
+  if (cachedPushAccessToken && cachedPushAccessToken.expiresAt > now + 30_000) {
+    return cachedPushAccessToken.token;
+  }
+
+  const params = new URLSearchParams({
+    grant_type: 'client_credentials',
+    scope: 'api.push',
+    client_id: `installation.${credentials.id}`,
+    client_secret: credentials.key,
+  });
+
+  const response = await fetchPushEndpoint(
+    `${PUSH_IDENTITY_URI}/connect/token`,
+    {
+      method: 'POST',
+      headers: {
+        accept: 'application/json',
+        'content-type': 'application/x-www-form-urlencoded',
+      },
+      body: params.toString(),
+    },
+    'Failed to get Bitwarden push relay token:'
+  );
+  if (!response) return null;
+
+  if (!response.ok) {
+    console.error('Failed to get Bitwarden push relay token:', response.status, await response.text().catch(() => ''));
+    return null;
+  }
+
+  const body = (await response.json().catch(() => null)) as { access_token?: string; expires_in?: number } | null;
+  const token = String(body?.access_token || '').trim();
+  if (!token) {
+    console.error('Bitwarden push relay token response did not include an access_token');
+    return null;
+  }
+
+  const expiresInSeconds = Math.max(60, Number(body?.expires_in || 3600));
+  cachedPushAccessToken = {
+    token,
+    expiresAt: now + Math.floor(expiresInSeconds * 500),
+  };
+  return token;
+}
+
+async function postToPushRelay(env: Env, path: string, body?: unknown): Promise<boolean> {
+  const token = await getPushAccessToken(env);
+  if (!token) return false;
+
+  const response = await fetchPushEndpoint(
+    `${PUSH_RELAY_URI}${path}`,
+    {
+      method: 'POST',
+      headers: {
+        accept: 'application/json',
+        authorization: `Bearer ${token}`,
+        ...(body === undefined ? {} : { 'content-type': 'application/json' }),
+      },
+      body: body === undefined ? undefined : JSON.stringify(body),
+    },
+    `Bitwarden push relay request failed: ${path}`
+  );
+  if (!response) return false;
+
+  if (!response.ok) {
+    console.error('Bitwarden push relay request failed:', path, response.status, await response.text().catch(() => ''));
+    return false;
+  }
+
+  return true;
+}
+
+function mobilePayloadFromSignalR(updateType: number, userId: string, revisionDate: string, payload: Record<string, unknown> | null | undefined): Record<string, unknown> {
+  const source = payload || {};
+  const id = source.Id ?? source.id;
+  const organizationId = source.OrganizationId ?? source.organizationId ?? null;
+  const collectionIds = source.CollectionIds ?? source.collectionIds ?? null;
+
+  if (id != null) {
+    return {
+      id,
+      userId: source.UserId ?? source.userId ?? userId,
+      organizationId,
+      collectionIds,
+      revisionDate: source.RevisionDate ?? source.revisionDate ?? revisionDate,
+    };
+  }
+
+  return {
+    userId: source.UserId ?? source.userId ?? userId,
+    date: source.Date ?? source.date ?? revisionDate,
+  };
+}
+
+export async function registerMobilePushDevice(
+  env: Env,
+  input: {
+    userId: string;
+    deviceIdentifier: string;
+    type: number;
+    pushUuid: string;
+    pushToken: string;
+  }
+): Promise<boolean> {
+  const credentials = await ensurePushInstallationCredentials(env.DB);
+  if (!credentials) return false;
+
+  return postToPushRelay(env, '/push/register', {
+    deviceId: input.pushUuid,
+    pushToken: input.pushToken,
+    userId: input.userId,
+    type: input.type,
+    identifier: input.deviceIdentifier,
+    installationId: credentials.id,
+  });
+}
+
+export async function unregisterMobilePushDevice(env: Env, pushUuid: string | null | undefined): Promise<boolean> {
+  const normalized = String(pushUuid || '').trim();
+  if (!normalized) return false;
+  return postToPushRelay(env, `/push/delete/${encodeURIComponent(normalized)}`);
+}
+
+export async function notifyMobilePush(
+  env: Env,
+  input: {
+    userId: string;
+    updateType: number;
+    revisionDate: string;
+    contextId: string | null;
+    payload: Record<string, unknown> | null | undefined;
+  }
+): Promise<void> {
+  const hasPushDevice = await env.DB
+    .prepare('SELECT 1 FROM devices WHERE user_id = ? AND push_token IS NOT NULL AND push_token <> ? LIMIT 1')
+    .bind(input.userId, '')
+    .first<{ '1': number }>();
+  if (!hasPushDevice) return;
+
+  let actingPushUuid: string | null = null;
+  if (input.contextId) {
+    const row = await env.DB
+      .prepare('SELECT push_uuid FROM devices WHERE user_id = ? AND device_identifier = ? LIMIT 1')
+      .bind(input.userId, input.contextId)
+      .first<{ push_uuid: string | null }>();
+    actingPushUuid = row?.push_uuid ?? null;
+  }
+
+  await postToPushRelay(env, '/push/send', {
+    userId: input.userId,
+    organizationId: null,
+    deviceId: actingPushUuid,
+    identifier: input.contextId,
+    type: input.updateType,
+    payload: mobilePayloadFromSignalR(input.updateType, input.userId, input.revisionDate, input.payload),
+    clientType: null,
+    installationId: null,
+  });
+}

src/services/storage-admin-repo.ts

@@ -117,12 +117,36 @@ export async function listInvites(db: D1Database, includeInactive: boolean = fal
 }
 
 export async function markInviteUsed(db: D1Database, code: string, userId: string): Promise<boolean> {
+  void userId;
   const now = new Date().toISOString();
   const result = await db
     .prepare(
-      "UPDATE invites SET status = 'used', used_by = ?, updated_at = ? WHERE code = ? AND status = 'active' AND expires_at > ?"
+      "UPDATE invites SET status = 'used', used_by = NULL, updated_at = ? WHERE code = ? AND status = 'active' AND expires_at > ?"
     )
-    .bind(userId, now, code, now)
+    .bind(now, code, now)
+    .run();
+  return (result.meta.changes ?? 0) > 0;
+}
+
+export async function assignInviteUsedBy(db: D1Database, code: string, userId: string): Promise<boolean> {
+  const now = new Date().toISOString();
+  const result = await db
+    .prepare(
+      "UPDATE invites SET used_by = ?, updated_at = ? WHERE code = ? AND status = 'used' AND used_by IS NULL"
+    )
+    .bind(userId, now, code)
+    .run();
+  return (result.meta.changes ?? 0) > 0;
+}
+
+export async function revertInviteUsed(db: D1Database, code: string, userId: string): Promise<boolean> {
+  void userId;
+  const now = new Date().toISOString();
+  const result = await db
+    .prepare(
+      "UPDATE invites SET status = 'active', used_by = NULL, updated_at = ? WHERE code = ? AND status = 'used' AND used_by IS NULL"
+    )
+    .bind(now, code)
     .run();
   return (result.meta.changes ?? 0) > 0;
 }

src/services/storage-auth-request-repo.ts

@@ -0,0 +1,139 @@
+import type { AuthRequestRecord, AuthRequestType } from '../types';
+
+const AUTH_REQUEST_EXPIRATION_MS = 15 * 60 * 1000;
+
+function mapAuthRequestRow(row: any): AuthRequestRecord {
+  return {
+    id: row.id,
+    userId: row.user_id,
+    organizationId: row.organization_id ?? null,
+    type: Number(row.type) as AuthRequestType,
+    requestDeviceIdentifier: row.request_device_identifier,
+    requestDeviceType: Number(row.request_device_type ?? 14),
+    requestIpAddress: row.request_ip_address ?? null,
+    requestCountryName: row.request_country_name ?? null,
+    responseDeviceIdentifier: row.response_device_identifier ?? null,
+    accessCode: row.access_code,
+    publicKey: row.public_key,
+    key: row.key ?? null,
+    masterPasswordHash: row.master_password_hash ?? null,
+    approved: row.approved == null ? null : Number(row.approved) === 1,
+    creationDate: row.creation_date,
+    responseDate: row.response_date ?? null,
+    authenticationDate: row.authentication_date ?? null,
+  };
+}
+
+export function isAuthRequestExpired(request: AuthRequestRecord, nowMs: number = Date.now()): boolean {
+  return new Date(request.creationDate).getTime() + AUTH_REQUEST_EXPIRATION_MS <= nowMs;
+}
+
+const AUTH_REQUEST_SELECT =
+  'SELECT id, user_id, organization_id, type, request_device_identifier, request_device_type, request_ip_address, request_country_name, ' +
+  'response_device_identifier, access_code, public_key, key, master_password_hash, approved, creation_date, response_date, authentication_date ' +
+  'FROM auth_requests';
+
+export async function createAuthRequest(db: D1Database, request: AuthRequestRecord): Promise<void> {
+  await db
+    .prepare(
+      'INSERT INTO auth_requests(' +
+        'id, user_id, organization_id, type, request_device_identifier, request_device_type, request_ip_address, request_country_name, ' +
+        'response_device_identifier, access_code, public_key, key, master_password_hash, approved, creation_date, response_date, authentication_date' +
+        ') VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'
+    )
+    .bind(
+      request.id,
+      request.userId,
+      request.organizationId,
+      request.type,
+      request.requestDeviceIdentifier,
+      request.requestDeviceType,
+      request.requestIpAddress,
+      request.requestCountryName,
+      request.responseDeviceIdentifier,
+      request.accessCode,
+      request.publicKey,
+      request.key,
+      request.masterPasswordHash,
+      request.approved == null ? null : (request.approved ? 1 : 0),
+      request.creationDate,
+      request.responseDate,
+      request.authenticationDate
+    )
+    .run();
+}
+
+export async function getAuthRequestById(db: D1Database, id: string): Promise<AuthRequestRecord | null> {
+  const row = await db.prepare(`${AUTH_REQUEST_SELECT} WHERE id = ? LIMIT 1`).bind(id).first<any>();
+  return row ? mapAuthRequestRow(row) : null;
+}
+
+export async function listAuthRequestsByUserId(db: D1Database, userId: string): Promise<AuthRequestRecord[]> {
+  const res = await db.prepare(`${AUTH_REQUEST_SELECT} WHERE user_id = ? ORDER BY creation_date DESC`).bind(userId).all<any>();
+  return (res.results || []).map(mapAuthRequestRow);
+}
+
+export async function listPendingAuthRequestsByUserId(db: D1Database, userId: string, nowMs: number = Date.now()): Promise<AuthRequestRecord[]> {
+  const cutoff = new Date(nowMs - AUTH_REQUEST_EXPIRATION_MS).toISOString();
+  const res = await db
+    .prepare(
+      'SELECT ar.id, ar.user_id, ar.organization_id, ar.type, ar.request_device_identifier, ar.request_device_type, ar.request_ip_address, ar.request_country_name, ' +
+        'ar.response_device_identifier, ar.access_code, ar.public_key, ar.key, ar.master_password_hash, ar.approved, ar.creation_date, ar.response_date, ar.authentication_date ' +
+        'FROM auth_requests ar ' +
+        'JOIN (' +
+        '  SELECT request_device_identifier, MAX(creation_date) AS latest_creation_date ' +
+        '  FROM auth_requests ' +
+        '  WHERE user_id = ? AND type IN (0, 1) AND approved IS NULL AND response_date IS NULL AND authentication_date IS NULL AND creation_date >= ? ' +
+        '  GROUP BY request_device_identifier' +
+        ') latest ON latest.request_device_identifier = ar.request_device_identifier AND latest.latest_creation_date = ar.creation_date ' +
+        'WHERE ar.user_id = ? AND ar.type IN (0, 1) AND ar.approved IS NULL AND ar.response_date IS NULL AND ar.authentication_date IS NULL ' +
+        'ORDER BY ar.creation_date DESC'
+    )
+    .bind(userId, cutoff, userId)
+    .all<any>();
+  return (res.results || []).map(mapAuthRequestRow).filter((request) => !isAuthRequestExpired(request, nowMs));
+}
+
+export async function updateAuthRequestResponse(
+  db: D1Database,
+  id: string,
+  userId: string,
+  update: {
+    approved: boolean;
+    responseDeviceIdentifier: string;
+    key?: string | null;
+    masterPasswordHash?: string | null;
+    responseDate?: string;
+  }
+): Promise<boolean> {
+  const result = await db
+    .prepare(
+      'UPDATE auth_requests SET approved = ?, response_device_identifier = ?, key = ?, master_password_hash = ?, response_date = ? ' +
+        'WHERE id = ? AND user_id = ? AND approved IS NULL AND response_date IS NULL AND authentication_date IS NULL'
+    )
+    .bind(
+      update.approved ? 1 : 0,
+      update.responseDeviceIdentifier,
+      update.approved ? (update.key ?? null) : null,
+      update.approved ? (update.masterPasswordHash ?? null) : null,
+      update.responseDate || new Date().toISOString(),
+      id,
+      userId
+    )
+    .run();
+  return Number(result.meta.changes ?? 0) > 0;
+}
+
+export async function markAuthRequestAuthenticated(db: D1Database, id: string, authenticationDate: string = new Date().toISOString()): Promise<boolean> {
+  const result = await db
+    .prepare('UPDATE auth_requests SET authentication_date = ? WHERE id = ? AND authentication_date IS NULL')
+    .bind(authenticationDate, id)
+    .run();
+  return Number(result.meta.changes ?? 0) > 0;
+}
+
+export async function pruneExpiredAuthRequests(db: D1Database, nowMs: number = Date.now()): Promise<number> {
+  const cutoff = new Date(nowMs - AUTH_REQUEST_EXPIRATION_MS).toISOString();
+  const result = await db.prepare('DELETE FROM auth_requests WHERE creation_date < ?').bind(cutoff).run();
+  return Number(result.meta.changes ?? 0);
+}

src/services/storage-cipher-repo.ts

@@ -87,7 +87,7 @@ function parseCipherRow(row: CipherRow | null | undefined): Cipher | null {
       createdAt: row.created_at,
       updatedAt: row.updated_at,
       archivedAt: row.archived_at ?? parsed.archivedAt ?? parsed.archivedDate ?? null,
-      deletedAt: row.deleted_at ?? null,
+      deletedAt: row.deleted_at ?? parsed.deletedAt ?? parsed.deletedDate ?? null,
     };
   } catch {
     console.error('Corrupted cipher data, id:', row.id);
@@ -244,7 +244,9 @@ export async function getCiphersPage(
   limit: number,
   offset: number
 ): Promise<Cipher[]> {
-  const whereDeleted = includeDeleted ? '' : 'AND deleted_at IS NULL';
+  const whereDeleted = includeDeleted
+    ? ''
+    : "AND deleted_at IS NULL AND json_extract(data, '$.deletedAt') IS NULL AND json_extract(data, '$.deletedDate') IS NULL";
   const res = await db
     .prepare(
       `SELECT ${selectCipherColumns()} FROM ciphers
@@ -341,7 +343,10 @@ export async function bulkArchiveCiphers(
         `UPDATE ciphers
          SET archived_at = ?, updated_at = ?,
              data = json_remove(data, '$.archivedAt', '$.archivedDate', '$.updatedAt', '$.revisionDate')
-         WHERE user_id = ? AND id IN (${placeholders}) AND deleted_at IS NULL`
+         WHERE user_id = ? AND id IN (${placeholders})
+           AND deleted_at IS NULL
+           AND json_extract(data, '$.deletedAt') IS NULL
+           AND json_extract(data, '$.deletedDate') IS NULL`
       )
       .bind(now, now, userId, ...chunk)
       .run();

src/services/storage-device-repo.ts

@@ -1,4 +1,5 @@
 import type { Device, TrustedDeviceTokenSummary, User } from '../types';
+import { generateUUID } from '../utils/uuid';
 
 type GetUserByEmail = (email: string) => Promise<User | null>;
 type TrustedTokenKeyFn = (token: string) => Promise<string>;
@@ -14,6 +15,8 @@ function mapDeviceRow(row: any): Device {
     encryptedUserKey: row.encrypted_user_key ?? null,
     encryptedPublicKey: row.encrypted_public_key ?? null,
     encryptedPrivateKey: row.encrypted_private_key ?? null,
+    pushUuid: row.push_uuid ?? null,
+    pushToken: row.push_token ?? null,
     lastSeenAt: row.last_seen_at ?? null,
     createdAt: row.created_at,
     updatedAt: row.updated_at,
@@ -38,13 +41,15 @@ export async function upsertDevice(
   const existingDevice = await getDeviceById(userId, deviceIdentifier);
   const effectiveSessionStamp = String(sessionStamp || '').trim() || existingDevice?.sessionStamp || '';
   const effectiveName = String(name || '').trim() || String(existingDevice?.name || '').trim();
+  const effectivePushUuid = String(existingDevice?.pushUuid || '').trim() || generateUUID();
   await db
     .prepare(
-      'INSERT INTO devices(user_id, device_identifier, name, type, session_stamp, encrypted_user_key, encrypted_public_key, encrypted_private_key, banned, banned_at, device_note, last_seen_at, created_at, updated_at) VALUES(?, ?, ?, ?, ?, ?, ?, ?, 0, NULL, ?, ?, ?, ?) ' +
+      'INSERT INTO devices(user_id, device_identifier, name, type, session_stamp, encrypted_user_key, encrypted_public_key, encrypted_private_key, push_uuid, banned, banned_at, device_note, last_seen_at, created_at, updated_at) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, 0, NULL, ?, ?, ?, ?) ' +
         'ON CONFLICT(user_id, device_identifier) DO UPDATE SET name=excluded.name, type=excluded.type, session_stamp=excluded.session_stamp, ' +
         'encrypted_user_key=COALESCE(excluded.encrypted_user_key, encrypted_user_key), ' +
         'encrypted_public_key=COALESCE(excluded.encrypted_public_key, encrypted_public_key), ' +
         'encrypted_private_key=COALESCE(excluded.encrypted_private_key, encrypted_private_key), ' +
+        'push_uuid=COALESCE(push_uuid, excluded.push_uuid), ' +
         'last_seen_at=excluded.last_seen_at, ' +
         'updated_at=excluded.updated_at'
     )
@@ -57,6 +62,7 @@ export async function upsertDevice(
       keys?.encryptedUserKey ?? null,
       keys?.encryptedPublicKey ?? null,
       keys?.encryptedPrivateKey ?? null,
+      effectivePushUuid,
       existingDevice?.deviceNote ?? null,
       now,
       now,
@@ -166,7 +172,7 @@ export async function isKnownDeviceByEmail(
 export async function getDevicesByUserId(db: D1Database, userId: string): Promise<Device[]> {
   const res = await db
     .prepare(
-      'SELECT user_id, device_identifier, name, type, session_stamp, encrypted_user_key, encrypted_public_key, encrypted_private_key, banned, banned_at, device_note, last_seen_at, created_at, updated_at ' +
+      'SELECT user_id, device_identifier, name, type, session_stamp, encrypted_user_key, encrypted_public_key, encrypted_private_key, push_uuid, push_token, banned, banned_at, device_note, last_seen_at, created_at, updated_at ' +
         'FROM devices WHERE user_id = ? ORDER BY COALESCE(last_seen_at, created_at) DESC, updated_at DESC'
     )
     .bind(userId)
@@ -177,7 +183,7 @@ export async function getDevicesByUserId(db: D1Database, userId: string): Promis
 export async function getDevice(db: D1Database, userId: string, deviceIdentifier: string): Promise<Device | null> {
   const row = await db
     .prepare(
-      'SELECT user_id, device_identifier, name, type, session_stamp, encrypted_user_key, encrypted_public_key, encrypted_private_key, banned, banned_at, device_note, last_seen_at, created_at, updated_at ' +
+      'SELECT user_id, device_identifier, name, type, session_stamp, encrypted_user_key, encrypted_public_key, encrypted_private_key, push_uuid, push_token, banned, banned_at, device_note, last_seen_at, created_at, updated_at ' +
         'FROM devices WHERE user_id = ? AND device_identifier = ? LIMIT 1'
     )
     .bind(userId, deviceIdentifier)
@@ -185,6 +191,63 @@ export async function getDevice(db: D1Database, userId: string, deviceIdentifier
   return row ? mapDeviceRow(row) : null;
 }
 
+export async function updateDevicePushToken(
+  db: D1Database,
+  userId: string,
+  deviceIdentifier: string,
+  pushUuid: string,
+  pushToken: string
+): Promise<boolean> {
+  const now = new Date().toISOString();
+  const result = await db
+    .prepare(
+      'UPDATE devices SET push_uuid = ?, push_token = ?, updated_at = ? ' +
+        'WHERE user_id = ? AND device_identifier = ?'
+    )
+    .bind(pushUuid, pushToken, now, userId, deviceIdentifier)
+    .run();
+  return Number(result.meta.changes ?? 0) > 0;
+}
+
+export async function clearDevicePushToken(
+  db: D1Database,
+  userId: string,
+  deviceIdentifier: string
+): Promise<{ pushUuid: string | null } | null> {
+  const existing = await db
+    .prepare('SELECT push_uuid FROM devices WHERE user_id = ? AND device_identifier = ? LIMIT 1')
+    .bind(userId, deviceIdentifier)
+    .first<{ push_uuid: string | null }>();
+  if (!existing) return null;
+
+  await db
+    .prepare('UPDATE devices SET push_token = NULL, updated_at = ? WHERE user_id = ? AND device_identifier = ?')
+    .bind(new Date().toISOString(), userId, deviceIdentifier)
+    .run();
+
+  return { pushUuid: existing.push_uuid ?? null };
+}
+
+export async function getDevicePushUuid(
+  db: D1Database,
+  userId: string,
+  deviceIdentifier: string
+): Promise<string | null> {
+  const row = await db
+    .prepare('SELECT push_uuid FROM devices WHERE user_id = ? AND device_identifier = ? LIMIT 1')
+    .bind(userId, deviceIdentifier)
+    .first<{ push_uuid: string | null }>();
+  return row?.push_uuid ?? null;
+}
+
+export async function userHasPushDevice(db: D1Database, userId: string): Promise<boolean> {
+  const row = await db
+    .prepare('SELECT 1 FROM devices WHERE user_id = ? AND push_token IS NOT NULL AND push_token <> ? LIMIT 1')
+    .bind(userId, '')
+    .first<{ '1': number }>();
+  return !!row;
+}
+
 export async function deleteDevice(db: D1Database, userId: string, deviceIdentifier: string): Promise<boolean> {
   const result = await db
     .prepare('DELETE FROM devices WHERE user_id = ? AND device_identifier = ?')

src/services/storage-schema.ts

@@ -78,6 +78,7 @@ const SCHEMA_STATEMENTS: readonly string[] = [
   'code TEXT PRIMARY KEY, created_by TEXT NOT NULL, used_by TEXT, expires_at TEXT NOT NULL, status TEXT NOT NULL, created_at TEXT NOT NULL, updated_at TEXT NOT NULL, ' +
   'FOREIGN KEY (created_by) REFERENCES users(id) ON DELETE CASCADE, ' +
   'FOREIGN KEY (used_by) REFERENCES users(id) ON DELETE SET NULL)',
+  'ALTER TABLE invites ADD COLUMN used_by TEXT',
   'CREATE INDEX IF NOT EXISTS idx_invites_status_expires ON invites(status, expires_at)',
   'CREATE INDEX IF NOT EXISTS idx_invites_created_by ON invites(created_by, created_at)',
 
@@ -94,7 +95,7 @@ const SCHEMA_STATEMENTS: readonly string[] = [
   'CREATE INDEX IF NOT EXISTS idx_audit_logs_level_created ON audit_logs(level, created_at)',
 
   'CREATE TABLE IF NOT EXISTS devices (' +
-  'user_id TEXT NOT NULL, device_identifier TEXT NOT NULL, name TEXT NOT NULL, type INTEGER NOT NULL, session_stamp TEXT, encrypted_user_key TEXT, encrypted_public_key TEXT, encrypted_private_key TEXT, banned INTEGER NOT NULL DEFAULT 0, banned_at TEXT, device_note TEXT, last_seen_at TEXT, ' +
+  'user_id TEXT NOT NULL, device_identifier TEXT NOT NULL, name TEXT NOT NULL, type INTEGER NOT NULL, session_stamp TEXT, encrypted_user_key TEXT, encrypted_public_key TEXT, encrypted_private_key TEXT, push_uuid TEXT, push_token TEXT, banned INTEGER NOT NULL DEFAULT 0, banned_at TEXT, device_note TEXT, last_seen_at TEXT, ' +
   'created_at TEXT NOT NULL, updated_at TEXT NOT NULL, ' +
   'PRIMARY KEY (user_id, device_identifier), ' +
   'FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE)',
@@ -103,17 +104,35 @@ const SCHEMA_STATEMENTS: readonly string[] = [
   'ALTER TABLE devices ADD COLUMN encrypted_user_key TEXT',
   'ALTER TABLE devices ADD COLUMN encrypted_public_key TEXT',
   'ALTER TABLE devices ADD COLUMN encrypted_private_key TEXT',
+  'ALTER TABLE devices ADD COLUMN push_uuid TEXT',
+  'ALTER TABLE devices ADD COLUMN push_token TEXT',
   'ALTER TABLE devices ADD COLUMN banned INTEGER NOT NULL DEFAULT 0',
   'ALTER TABLE devices ADD COLUMN banned_at TEXT',
   'ALTER TABLE devices ADD COLUMN device_note TEXT',
   'ALTER TABLE devices ADD COLUMN last_seen_at TEXT',
   'CREATE INDEX IF NOT EXISTS idx_devices_user_last_seen ON devices(user_id, last_seen_at)',
+  'CREATE INDEX IF NOT EXISTS idx_devices_user_push ON devices(user_id, push_token)',
+
+  'CREATE TABLE IF NOT EXISTS auth_requests (' +
+  'id TEXT PRIMARY KEY, user_id TEXT NOT NULL, organization_id TEXT, type INTEGER NOT NULL, request_device_identifier TEXT NOT NULL, request_device_type INTEGER NOT NULL, ' +
+  'request_ip_address TEXT, request_country_name TEXT, response_device_identifier TEXT, access_code TEXT NOT NULL, public_key TEXT NOT NULL, key TEXT, master_password_hash TEXT, ' +
+  'approved INTEGER, creation_date TEXT NOT NULL, response_date TEXT, authentication_date TEXT, ' +
+  'FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE)',
+  'CREATE INDEX IF NOT EXISTS idx_auth_requests_user_created ON auth_requests(user_id, creation_date)',
+  'CREATE INDEX IF NOT EXISTS idx_auth_requests_user_pending ON auth_requests(user_id, approved, response_date, authentication_date, creation_date)',
+  'CREATE INDEX IF NOT EXISTS idx_auth_requests_device_pending ON auth_requests(user_id, request_device_identifier, creation_date)',
 
   'CREATE TABLE IF NOT EXISTS trusted_two_factor_device_tokens (' +
   'token TEXT PRIMARY KEY, user_id TEXT NOT NULL, device_identifier TEXT NOT NULL, expires_at INTEGER NOT NULL, ' +
   'FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE)',
   'CREATE INDEX IF NOT EXISTS idx_trusted_two_factor_device_tokens_user_device ON trusted_two_factor_device_tokens(user_id, device_identifier)',
 
+  'CREATE TABLE IF NOT EXISTS totp_login_replays (' +
+  'user_id TEXT NOT NULL, time_counter INTEGER NOT NULL, consumed_at INTEGER NOT NULL, ' +
+  'PRIMARY KEY (user_id, time_counter), ' +
+  'FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE)',
+  'CREATE INDEX IF NOT EXISTS idx_totp_login_replays_consumed_at ON totp_login_replays(consumed_at)',
+
   'CREATE TABLE IF NOT EXISTS webauthn_credentials (' +
   'id TEXT PRIMARY KEY, user_id TEXT NOT NULL, name TEXT NOT NULL, public_key TEXT NOT NULL, credential_id TEXT NOT NULL, counter INTEGER NOT NULL DEFAULT 0, ' +
   'type TEXT, aa_guid TEXT, transports TEXT, encrypted_user_key TEXT, encrypted_public_key TEXT, encrypted_private_key TEXT, supports_prf INTEGER NOT NULL DEFAULT 0, ' +

src/services/storage-totp-replay-repo.ts

@@ -0,0 +1,35 @@
+type ShouldRunPeriodicCleanup = (lastRunAt: number, intervalMs: number) => boolean;
+
+export async function consumeTotpLoginCounter(
+  db: D1Database,
+  shouldRunPeriodicCleanup: ShouldRunPeriodicCleanup,
+  lastCleanupAt: number,
+  cleanupIntervalMs: number,
+  userId: string,
+  timeCounter: number,
+  consumedAtMs: number,
+  markerTtlMs: number
+): Promise<{ consumed: boolean; cleanedUpAt: number | null }> {
+  let cleanedUpAt: number | null = null;
+
+  if (shouldRunPeriodicCleanup(lastCleanupAt, cleanupIntervalMs)) {
+    await db
+      .prepare('DELETE FROM totp_login_replays WHERE consumed_at < ?')
+      .bind(consumedAtMs - markerTtlMs)
+      .run();
+    cleanedUpAt = consumedAtMs;
+  }
+
+  const result = await db
+    .prepare(
+      'INSERT INTO totp_login_replays(user_id, time_counter, consumed_at) VALUES(?, ?, ?) ' +
+        'ON CONFLICT(user_id, time_counter) DO NOTHING'
+    )
+    .bind(userId, timeCounter, consumedAtMs)
+    .run();
+
+  return {
+    consumed: (result.meta.changes ?? 0) > 0,
+    cleanedUpAt,
+  };
+}

src/services/storage.ts

@@ -1,5 +1,6 @@
-import { User, Cipher, Folder, Attachment, Device, Invite, AuditLog, Send, TrustedDeviceTokenSummary, RefreshTokenRecord, CustomEquivalentDomain, AccountPasskeyChallenge, AccountPasskeyChallengeScope, AccountPasskeyCredential } from '../types';
+import { User, Cipher, Folder, Attachment, Device, Invite, AuditLog, Send, TrustedDeviceTokenSummary, RefreshTokenRecord, CustomEquivalentDomain, AccountPasskeyChallenge, AccountPasskeyChallengeScope, AccountPasskeyCredential, AuthRequestRecord } from '../types';
 import { LIMITS } from '../config/limits';
+import { ensurePushInstallationCredentials } from './push-relay';
 import { ensureStorageSchema } from './storage-schema';
 import {
   getConfigValue as getStoredConfigValue,
@@ -21,6 +22,7 @@ import {
   type AuditLogListOptions,
   createAuditLog as createStoredAuditLog,
   clearAuditLogs as clearStoredAuditLogs,
+  assignInviteUsedBy as assignStoredInviteUsedBy,
   createInvite as createStoredInvite,
   deleteAllInvites as deleteStoredInvites,
   getInvite as findStoredInvite,
@@ -29,6 +31,7 @@ import {
   markInviteUsed as markStoredInviteUsed,
   pruneAuditLogs as pruneStoredAuditLogs,
   pruneAuditLogsToMax as pruneStoredAuditLogsToMax,
+  revertInviteUsed as revertStoredInviteUsed,
   revokeInvite as revokeStoredInvite,
 } from './storage-admin-repo';
 import {
@@ -87,10 +90,12 @@ import {
 import {
   deleteDevice as deleteStoredDevice,
   deleteDevicesByUserId as deleteStoredDevicesByUserId,
+  clearDevicePushToken as clearStoredDevicePushToken,
   clearDeviceKeys as clearStoredDeviceKeys,
   deleteTrustedTwoFactorTokensByDevice as deleteStoredTrustedTokensByDevice,
   deleteTrustedTwoFactorTokensByUserId as deleteStoredTrustedTokensByUserId,
   getDevice as findStoredDevice,
+  getDevicePushUuid as findStoredDevicePushUuid,
   getDevicesByUserId as listStoredDevicesByUserId,
   getTrustedDeviceTokenSummariesByUserId as listStoredTrustedTokenSummaries,
   getTrustedTwoFactorDeviceTokenUserId as findStoredTrustedTokenUserId,
@@ -101,12 +106,26 @@ import {
   upsertDevice as saveStoredDevice,
   updateDeviceName as updateStoredDeviceName,
   updateDeviceKeys as updateStoredDeviceKeys,
+  updateDevicePushToken as updateStoredDevicePushToken,
   updateTrustedTwoFactorTokensExpiryByDevice as updateStoredTrustedTokensExpiryByDevice,
+  userHasPushDevice as getUserHasPushDevice,
 } from './storage-device-repo';
+import {
+  createAuthRequest as createStoredAuthRequest,
+  getAuthRequestById as findStoredAuthRequestById,
+  listAuthRequestsByUserId as listStoredAuthRequestsByUserId,
+  listPendingAuthRequestsByUserId as listStoredPendingAuthRequestsByUserId,
+  markAuthRequestAuthenticated as markStoredAuthRequestAuthenticated,
+  pruneExpiredAuthRequests as pruneStoredExpiredAuthRequests,
+  updateAuthRequestResponse as updateStoredAuthRequestResponse,
+} from './storage-auth-request-repo';
 import {
   ensureUsedAttachmentDownloadTokenTable as ensureStoredAttachmentTokenTable,
   consumeAttachmentDownloadToken as consumeStoredAttachmentDownloadToken,
 } from './storage-attachment-token-repo';
+import {
+  consumeTotpLoginCounter as consumeStoredTotpLoginCounter,
+} from './storage-totp-replay-repo';
 import {
   getRevisionDate as getStoredRevisionDate,
   updateRevisionDate as updateStoredRevisionDate,
@@ -134,8 +153,8 @@ const STORAGE_SCHEMA_VERSION_KEY = 'schema.version';
 // Bump this whenever src/services/storage-schema.ts or migrations/0001_init.sql
 // changes. Existing D1 installs only rerun ensureStorageSchema() when this value
 // differs from config.schema.version.
-const STORAGE_SCHEMA_VERSION = '2026-06-09-account-passkeys';
-const REQUIRED_ACCOUNT_PASSKEY_TABLES = ['webauthn_credentials', 'webauthn_challenges'] as const;
+const STORAGE_SCHEMA_VERSION = '2026-06-23-totp-login-replay';
+const REQUIRED_SCHEMA_TABLES = ['webauthn_credentials', 'webauthn_challenges', 'auth_requests', 'totp_login_replays'] as const;
 
 // D1-backed storage.
 // Contract:
@@ -148,10 +167,13 @@ export class StorageService {
   private static schemaVerified = false;
   private static lastRefreshTokenCleanupAt = 0;
   private static lastAttachmentTokenCleanupAt = 0;
+  private static lastTotpReplayCleanupAt = 0;
   private static readonly MAX_D1_SQL_VARIABLES = 100;
 
   private static readonly REFRESH_TOKEN_CLEANUP_INTERVAL_MS = LIMITS.cleanup.refreshTokenCleanupIntervalMs;
   private static readonly ATTACHMENT_TOKEN_CLEANUP_INTERVAL_MS = LIMITS.cleanup.attachmentTokenCleanupIntervalMs;
+  private static readonly TOTP_REPLAY_CLEANUP_INTERVAL_MS = 10 * 60 * 1000;
+  private static readonly TOTP_REPLAY_MARKER_TTL_MS = 5 * 60 * 1000;
   private static readonly PERIODIC_CLEANUP_PROBABILITY = LIMITS.cleanup.cleanupProbability;
 
   constructor(private db: D1Database) {}
@@ -166,14 +188,14 @@ export class StorageService {
     return stmt.bind(...values.map(v => v === undefined ? null : v));
   }
 
-  private async hasAccountPasskeyTables(): Promise<boolean> {
-    const placeholders = REQUIRED_ACCOUNT_PASSKEY_TABLES.map(() => '?').join(', ');
+  private async hasRequiredSchemaTables(): Promise<boolean> {
+    const placeholders = REQUIRED_SCHEMA_TABLES.map(() => '?').join(', ');
     const result = await this.db
       .prepare(`SELECT name FROM sqlite_master WHERE type = 'table' AND name IN (${placeholders})`)
-      .bind(...REQUIRED_ACCOUNT_PASSKEY_TABLES)
+      .bind(...REQUIRED_SCHEMA_TABLES)
       .all<{ name: string }>();
     const found = new Set((result.results || []).map((row) => row.name));
-    return REQUIRED_ACCOUNT_PASSKEY_TABLES.every((table) => found.has(table));
+    return REQUIRED_SCHEMA_TABLES.every((table) => found.has(table));
   }
 
   private sqlChunkSize(fixedBindCount: number): number {
@@ -220,12 +242,13 @@ export class StorageService {
     await this.db.prepare('CREATE TABLE IF NOT EXISTS config (key TEXT PRIMARY KEY, value TEXT NOT NULL)').run();
     const schemaVersion = await getStoredConfigValue(this.db, STORAGE_SCHEMA_VERSION_KEY);
     const schemaMissingRequiredTables = schemaVersion === STORAGE_SCHEMA_VERSION
-      ? !(await this.hasAccountPasskeyTables())
+      ? !(await this.hasRequiredSchemaTables())
       : true;
     if (schemaVersion !== STORAGE_SCHEMA_VERSION || schemaMissingRequiredTables) {
       await ensureStorageSchema(this.db);
       await saveConfigValue(this.db, STORAGE_SCHEMA_VERSION_KEY, STORAGE_SCHEMA_VERSION);
     }
+    await ensurePushInstallationCredentials(this.db);
 
     StorageService.schemaVerified = true;
   }
@@ -298,6 +321,14 @@ export class StorageService {
     return markStoredInviteUsed(this.db, code, userId);
   }
 
+  async assignInviteUsedBy(code: string, userId: string): Promise<boolean> {
+    return assignStoredInviteUsedBy(this.db, code, userId);
+  }
+
+  async revertInviteUsed(code: string, userId: string): Promise<boolean> {
+    return revertStoredInviteUsed(this.db, code, userId);
+  }
+
   async revokeInvite(code: string): Promise<boolean> {
     return revokeStoredInvite(this.db, code);
   }
@@ -704,6 +735,27 @@ export class StorageService {
     return touchStoredDeviceLastSeen(this.db, userId, deviceIdentifier);
   }
 
+  async updateDevicePushToken(
+    userId: string,
+    deviceIdentifier: string,
+    pushUuid: string,
+    pushToken: string
+  ): Promise<boolean> {
+    return updateStoredDevicePushToken(this.db, userId, deviceIdentifier, pushUuid, pushToken);
+  }
+
+  async clearDevicePushToken(userId: string, deviceIdentifier: string): Promise<{ pushUuid: string | null } | null> {
+    return clearStoredDevicePushToken(this.db, userId, deviceIdentifier);
+  }
+
+  async getDevicePushUuid(userId: string, deviceIdentifier: string): Promise<string | null> {
+    return findStoredDevicePushUuid(this.db, userId, deviceIdentifier);
+  }
+
+  async userHasPushDevice(userId: string): Promise<boolean> {
+    return getUserHasPushDevice(this.db, userId);
+  }
+
   async clearDeviceKeys(userId: string, deviceIdentifiers: string[]): Promise<number> {
     return clearStoredDeviceKeys(this.db, userId, deviceIdentifiers);
   }
@@ -716,6 +768,45 @@ export class StorageService {
     return deleteStoredDevicesByUserId(this.db, userId);
   }
 
+  // --- Auth requests / Login with device ---
+
+  async createAuthRequest(request: AuthRequestRecord): Promise<void> {
+    await createStoredAuthRequest(this.db, request);
+  }
+
+  async getAuthRequestById(id: string): Promise<AuthRequestRecord | null> {
+    return findStoredAuthRequestById(this.db, id);
+  }
+
+  async listAuthRequestsByUserId(userId: string): Promise<AuthRequestRecord[]> {
+    return listStoredAuthRequestsByUserId(this.db, userId);
+  }
+
+  async listPendingAuthRequestsByUserId(userId: string): Promise<AuthRequestRecord[]> {
+    return listStoredPendingAuthRequestsByUserId(this.db, userId);
+  }
+
+  async updateAuthRequestResponse(
+    id: string,
+    userId: string,
+    update: {
+      approved: boolean;
+      responseDeviceIdentifier: string;
+      key?: string | null;
+      masterPasswordHash?: string | null;
+    }
+  ): Promise<boolean> {
+    return updateStoredAuthRequestResponse(this.db, id, userId, update);
+  }
+
+  async markAuthRequestAuthenticated(id: string): Promise<boolean> {
+    return markStoredAuthRequestAuthenticated(this.db, id);
+  }
+
+  async pruneExpiredAuthRequests(): Promise<number> {
+    return pruneStoredExpiredAuthRequests(this.db);
+  }
+
   async getTrustedDeviceTokenSummariesByUserId(userId: string): Promise<TrustedDeviceTokenSummary[]> {
     return listStoredTrustedTokenSummaries(this.db, userId);
   }
@@ -748,6 +839,24 @@ export class StorageService {
     return findStoredTrustedTokenUserId(this.db, this.trustedTwoFactorTokenKey.bind(this), token, deviceIdentifier);
   }
 
+  async consumeTotpLoginCounter(userId: string, timeCounter: number, consumedAtMs: number = Date.now()): Promise<boolean> {
+    if (!Number.isSafeInteger(timeCounter) || timeCounter < 0) return false;
+    const result = await consumeStoredTotpLoginCounter(
+      this.db,
+      this.shouldRunPeriodicCleanup.bind(this),
+      StorageService.lastTotpReplayCleanupAt,
+      StorageService.TOTP_REPLAY_CLEANUP_INTERVAL_MS,
+      userId,
+      timeCounter,
+      consumedAtMs,
+      StorageService.TOTP_REPLAY_MARKER_TTL_MS
+    );
+    if (result.cleanedUpAt !== null) {
+      StorageService.lastTotpReplayCleanupAt = result.cleanedUpAt;
+    }
+    return result.consumed;
+  }
+
   // --- Revision dates ---
 
   async getRevisionDate(userId: string): Promise<string> {

src/types/index.ts

@@ -231,6 +231,8 @@ export interface Device {
   encryptedUserKey: string | null;
   encryptedPublicKey: string | null;
   encryptedPrivateKey: string | null;
+  pushUuid: string | null;
+  pushToken: string | null;
   devicePendingAuthRequest?: DevicePendingAuthRequest | null;
   lastSeenAt: string | null;
   createdAt: string;
@@ -273,6 +275,28 @@ export interface DevicePendingAuthRequest {
   creationDate: string;
 }
 
+export type AuthRequestType = 0 | 1 | 2;
+
+export interface AuthRequestRecord {
+  id: string;
+  userId: string;
+  organizationId: string | null;
+  type: AuthRequestType;
+  requestDeviceIdentifier: string;
+  requestDeviceType: number;
+  requestIpAddress: string | null;
+  requestCountryName: string | null;
+  responseDeviceIdentifier: string | null;
+  accessCode: string;
+  publicKey: string;
+  key: string | null;
+  masterPasswordHash: string | null;
+  approved: boolean | null;
+  creationDate: string;
+  responseDate: string | null;
+  authenticationDate: string | null;
+}
+
 export interface DeviceResponse {
   id: string;
   userId?: string | null;
@@ -442,8 +466,18 @@ export interface TokenResponse {
   ResetMasterPassword: boolean;
   scope: string;
   unofficialServer: boolean;
+  UserVerificationToken?: string;
+  userVerificationToken?: string;
   MasterPasswordPolicy?: {
+    minComplexity: number;
+    minLength: number;
+    requireUpper: boolean;
+    requireLower: boolean;
+    requireNumbers: boolean;
+    requireSpecial: boolean;
+    enforceOnLogin: boolean;
     Object: string;
+    object?: string;
   } | null;
   ApiUseKeyConnector?: boolean;
   AccountKeys?: any | null;
@@ -472,12 +506,13 @@ export interface ProfileResponse {
   accountKeys: any | null;
   securityStamp: string;
   organizations: any[];
+  organizationsNew?: any[];
   providers: any[];
   providerOrganizations: any[];
   forcePasswordReset: boolean;
   avatarColor: string | null;
   creationDate: string;
-  verifyDevices?: boolean;
+  verifyDevices: boolean;
   role?: UserRole;
   status?: UserStatus;
   object: string;
@@ -536,6 +571,7 @@ export interface SyncResponse {
   ciphers: CipherResponse[];
   domains: any;
   policies: any[];
+  policiesNew?: any[];
   sends: SendResponse[];
   UserDecryption?: {
     MasterPasswordUnlock: MasterPasswordUnlock | null;
@@ -543,6 +579,10 @@ export interface SyncResponse {
     KeyConnectorOption?: null;
     WebAuthnPrfOption?: WebAuthnPrfDecryptionOption | null;
     WebAuthnPrfOptions?: WebAuthnPrfDecryptionOption[];
+    V2UpgradeToken?: {
+      WrappedUserKey1: string;
+      WrappedUserKey2: string;
+    } | null;
     Object?: string;
   } | null;
   // PascalCase for desktop/browser clients

src/utils/content-type.ts

@@ -0,0 +1,38 @@
+const ACTIVE_DOWNLOAD_MEDIA_TYPES = new Set([
+  'application/xhtml+xml',
+  'application/xml',
+  'image/svg+xml',
+  'text/html',
+  'text/xml',
+]);
+
+const SAFE_ICON_MEDIA_TYPES = new Set([
+  'image/avif',
+  'image/bmp',
+  'image/gif',
+  'image/jpeg',
+  'image/png',
+  'image/vnd.microsoft.icon',
+  'image/webp',
+  'image/x-icon',
+]);
+
+function normalizeMediaType(contentType: string | null | undefined): string {
+  return String(contentType || '')
+    .split(';', 1)[0]
+    .trim()
+    .toLowerCase();
+}
+
+export function isSafeWebsiteIconContentType(contentType: string | null | undefined): boolean {
+  return SAFE_ICON_MEDIA_TYPES.has(normalizeMediaType(contentType));
+}
+
+export function sanitizeDownloadContentType(contentType: string | null | undefined): string {
+  const mediaType = normalizeMediaType(contentType);
+  if (!mediaType) return 'application/octet-stream';
+  if (ACTIVE_DOWNLOAD_MEDIA_TYPES.has(mediaType)) {
+    return 'application/octet-stream';
+  }
+  return contentType || mediaType;
+}

src/utils/profile-response.ts

@@ -0,0 +1,36 @@
+import type { Env, ProfileResponse, User } from '../types';
+import { buildAccountKeys } from './user-decryption';
+
+export function buildProfileResponse(user: User, env?: Env): ProfileResponse {
+  void env;
+  const organizations: any[] = [];
+  const accountKeys = buildAccountKeys(user);
+
+  return {
+    id: user.id,
+    name: user.name,
+    email: user.email,
+    emailVerified: true,
+    premium: true,
+    premiumFromOrganization: false,
+    usesKeyConnector: false,
+    masterPasswordHint: user.masterPasswordHint,
+    culture: 'en-US',
+    twoFactorEnabled: !!user.totpSecret,
+    key: user.key,
+    privateKey: user.privateKey,
+    accountKeys,
+    securityStamp: user.securityStamp || user.id,
+    organizations,
+    organizationsNew: organizations,
+    providers: [],
+    providerOrganizations: [],
+    forcePasswordReset: false,
+    avatarColor: null,
+    creationDate: user.createdAt,
+    verifyDevices: user.verifyDevices !== false,
+    role: user.role,
+    status: user.status,
+    object: 'profile',
+  };
+}

src/utils/response.ts

@@ -100,7 +100,9 @@ export function applyCors(
   headers.set('X-Frame-Options', 'DENY');
   headers.set('X-Content-Type-Options', 'nosniff');
   headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-  headers.set('Content-Security-Policy', "frame-ancestors 'none'; img-src 'self' data:");
+  if (!headers.has('Content-Security-Policy')) {
+    headers.set('Content-Security-Policy', "frame-ancestors 'none'; img-src 'self' data:");
+  }
   return new Response(response.body, {
     status: response.status,
     statusText: response.statusText,

src/utils/totp.ts

@@ -70,17 +70,22 @@ function normalizeToken(token: string): string {
   return token.replace(/\s+/g, '');
 }
 
-export async function verifyTotpToken(secretRaw: string, tokenRaw: string, nowMs: number = Date.now()): Promise<boolean> {
+export async function findMatchingTotpCounter(
+  secretRaw: string,
+  tokenRaw: string,
+  nowMs: number = Date.now()
+): Promise<number | null> {
   const token = normalizeToken(tokenRaw);
-  if (!/^\d{6}$/.test(token)) return false;
+  if (!/^\d{6}$/.test(token)) return null;
 
   const secret = base32Decode(secretRaw);
-  if (!secret) return false;
+  if (!secret) return null;
 
   const currentCounter = Math.floor(nowMs / 1000 / TOTP_STEP_SECONDS);
-  let matched = false;
+  let matchedCounter: number | null = null;
   for (let delta = -TOTP_WINDOW; delta <= TOTP_WINDOW; delta++) {
-    const expected = await hotp(secret, currentCounter + delta);
+    const candidateCounter = currentCounter + delta;
+    const expected = await hotp(secret, candidateCounter);
     // Constant-time comparison: always check all windows, never short-circuit.
     const a = new TextEncoder().encode(expected);
     const b = new TextEncoder().encode(token);
@@ -88,9 +93,13 @@ export async function verifyTotpToken(secretRaw: string, tokenRaw: string, nowMs
     for (let i = 0; i < a.length && i < b.length; i++) {
       diff |= a[i] ^ b[i];
     }
-    if (diff === 0) matched = true;
+    if (diff === 0 && matchedCounter == null) matchedCounter = candidateCounter;
   }
-  return matched;
+  return matchedCounter;
+}
+
+export async function verifyTotpToken(secretRaw: string, tokenRaw: string, nowMs: number = Date.now()): Promise<boolean> {
+  return (await findMatchingTotpCounter(secretRaw, tokenRaw, nowMs)) != null;
 }
 
 export function isTotpEnabled(secretRaw: string | undefined | null): boolean {

src/utils/user-decryption.ts

@@ -16,6 +16,7 @@ export function buildAccountKeys(user: Pick<User, 'privateKey' | 'publicKey'>):
     publicKeyEncryptionKeyPair: {
       wrappedPrivateKey: user.privateKey,
       publicKey,
+      signedPublicKey: null,
       Object: 'publicKeyEncryptionKeyPair',
     },
     Object: 'privateKeys',

src/utils/user-verification-token.ts

@@ -0,0 +1,89 @@
+import type { Env } from '../types';
+import { base64UrlToBytes, bytesToBase64Url } from './passkey';
+
+const USER_VERIFICATION_TOKEN_TYPE = 'nodewarden.user-verification.v1';
+const USER_VERIFICATION_TOKEN_TTL_MS = 5 * 60 * 1000;
+
+export type UserVerificationPurpose = 'backup.settings.repair';
+
+interface UserVerificationTokenPayload {
+  typ: typeof USER_VERIFICATION_TOKEN_TYPE;
+  userId: string;
+  method: 'passkey';
+  purpose: UserVerificationPurpose;
+  iat: number;
+  exp: number;
+}
+
+function textBytes(value: string): Uint8Array {
+  return new TextEncoder().encode(value);
+}
+
+async function importHmacKey(secret: string): Promise<CryptoKey> {
+  return crypto.subtle.importKey('raw', textBytes(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign', 'verify']);
+}
+
+async function hmacSha256(secret: string, data: string): Promise<Uint8Array> {
+  const key = await importHmacKey(secret);
+  return new Uint8Array(await crypto.subtle.sign('HMAC', key, textBytes(data)));
+}
+
+function encodeJson(value: unknown): string {
+  return bytesToBase64Url(textBytes(JSON.stringify(value)));
+}
+
+function decodeJson<T>(value: string): T | null {
+  try {
+    return JSON.parse(new TextDecoder().decode(base64UrlToBytes(value))) as T;
+  } catch {
+    return null;
+  }
+}
+
+export async function createPasskeyUserVerificationToken(
+  env: Env,
+  userId: string,
+  purpose: UserVerificationPurpose
+): Promise<string> {
+  const now = Date.now();
+  const payload: UserVerificationTokenPayload = {
+    typ: USER_VERIFICATION_TOKEN_TYPE,
+    userId,
+    method: 'passkey',
+    purpose,
+    iat: now,
+    exp: now + USER_VERIFICATION_TOKEN_TTL_MS,
+  };
+  const header = { alg: 'HS256', typ: 'JWT' };
+  const data = `${encodeJson(header)}.${encodeJson(payload)}`;
+  const signature = bytesToBase64Url(await hmacSha256(env.JWT_SECRET, data));
+  return `${data}.${signature}`;
+}
+
+export async function verifyPasskeyUserVerificationToken(
+  env: Env,
+  token: string,
+  userId: string,
+  purpose: UserVerificationPurpose
+): Promise<boolean> {
+  try {
+    const parts = String(token || '').split('.');
+    if (parts.length !== 3) return false;
+    const data = `${parts[0]}.${parts[1]}`;
+    const expected = await hmacSha256(env.JWT_SECRET, data);
+    const actual = base64UrlToBytes(parts[2]);
+    if (actual.length !== expected.length) return false;
+
+    let diff = 0;
+    for (let i = 0; i < actual.length; i += 1) diff |= actual[i] ^ expected[i];
+    if (diff !== 0) return false;
+
+    const payload = decodeJson<UserVerificationTokenPayload>(parts[1]);
+    if (!payload || payload.typ !== USER_VERIFICATION_TOKEN_TYPE) return false;
+    if (payload.userId !== userId || payload.purpose !== purpose || payload.method !== 'passkey') return false;
+    if (!Number.isFinite(payload.exp) || payload.exp < Date.now()) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}

webapp/public/icon-source.svg

@@ -0,0 +1,10 @@
+<svg width="512" height="512" viewBox="0 0 512 512" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <!-- Full-bleed background for any/maskable -->
+  <rect width="512" height="512" fill="#116FF9"/>
+  <!-- Logo scaled to ~50% centered in safe zone (inner 66% = Android adaptive icon guideline) -->
+  <g transform="translate(256,256) scale(0.5) translate(-380,-380)">
+    <path d="M386.5 183C497.785 183 588 271.2 588 380C588 419.877 575.879 456.986 555.046 488H17.6816C16.5766 481.834 16 475.484 16 469C16 413.617 58.0774 368.061 112.008 362.558C108.771 353.989 107 344.701 107 335C107 291.922 141.922 257 185 257C198.365 257 210.945 260.362 221.94 266.286C258.437 215.895 318.539 183 386.5 183Z" fill="#F6821F"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M92.6568 91.0069C88.7796 262.923 101.55 381.119 143.869 469.459C186.188 557.799 258.092 616.353 372.665 668.892C485.877 616.354 556.929 557.802 598.746 469.461C640.564 381.12 653.181 262.923 649.35 91.0069H92.6568ZM539.796 432.933C570.479 365.533 581.347 278.379 582.419 153.939L582.422 153.432H377.661V593.786L378.405 593.364C458.602 547.962 509.101 500.36 539.796 432.933Z" fill="white"/>
+    <path d="M604.465 305C680.976 305 743 367.233 743 444C743 459.378 740.509 474.172 735.913 488H379V423.553C391.721 397.751 418.287 380 449 380C459.483 380 469.482 382.068 478.613 385.818C500.559 338.11 548.658 305 604.465 305Z" fill="#FD9C33"/>
+  </g>
+</svg>

webapp/src/App.tsx

@@ -3,6 +3,7 @@ import { useLocation } from 'wouter';
 import { useQuery, useQueryClient } from '@tanstack/react-query';
 import AppAuthenticatedShell from '@/components/AppAuthenticatedShell';
 import AppGlobalOverlays, { type AppConfirmState } from '@/components/AppGlobalOverlays';
+import AuthRequestApprovalDialog from '@/components/AuthRequestApprovalDialog';
 import AuthViews from '@/components/AuthViews';
 import NotFoundPage from '@/components/NotFoundPage';
 import PublicSendPage from '@/components/PublicSendPage';
@@ -10,6 +11,7 @@ import RecoverTwoFactorPage from '@/components/RecoverTwoFactorPage';
 import JwtWarningPage from '@/components/JwtWarningPage';
 import {
   createAuthedFetch,
+  deriveLoginHash,
   getAuthorizedDevices,
   clearProfileSnapshot,
   getCurrentDeviceIdentifier,
@@ -19,14 +21,21 @@ import {
   saveProfileSnapshot,
   revokeCurrentSession,
   getTotpStatus,
+  getVaultRevisionDate,
   saveSession,
   stripProfileSecrets,
 } from '@/lib/api/auth';
+import {
+  encryptSessionUserKeyForAuthRequest,
+  isPendingAuthRequest,
+  listPendingAuthRequests,
+  respondToAuthRequest,
+} from '@/lib/api/auth-requests';
 import { clearAuditLogs, getAuditLogSettings, listAdminInvites, listAdminUsers, listAuditLogs, saveAuditLogSettings, type AuditLogFilters } from '@/lib/api/admin';
 import { getDomainRules, saveDomainRules } from '@/lib/api/domains';
-import { getSends } from '@/lib/api/send';
-import { repairCipherKeyMismatches, repairCipherUriChecksums } from '@/lib/api/vault';
-import { getCachedVaultCoreSnapshot, invalidateVaultCoreSyncSnapshot, loadVaultCoreSyncSnapshot } from '@/lib/api/vault-sync';
+import { getSendById, getSends } from '@/lib/api/send';
+import { getCipherById, getFolderById, repairCipherKeyMismatches, repairCipherUriChecksums } from '@/lib/api/vault';
+import { getCachedVaultCoreSnapshot, invalidateVaultCoreSyncSnapshot, loadVaultCoreSyncSnapshot, saveVaultCoreSyncSnapshot } from '@/lib/api/vault-sync';
 import { silentlyRepairBackupSettingsIfNeeded } from '@/lib/backup-settings-repair';
 import {
   parseSignalRTextFrames,
@@ -74,7 +83,7 @@ import {
   createDemoMainRoutesProps,
 } from '@/lib/demo';
 import type { AdminBackupSettings } from '@/lib/api/backup';
-import type { AdminInvite, AdminUser, AppPhase, AuditLogSettings, AuthorizedDevice, Cipher, CustomEquivalentDomain, DomainRules, Folder as VaultFolder, Profile, Send, SessionState } from '@/lib/types';
+import type { AdminInvite, AdminUser, AppPhase, AuditLogSettings, AuthRequest, AuthorizedDevice, Cipher, CustomEquivalentDomain, DomainRules, Folder as VaultFolder, Profile, Send, SessionState } from '@/lib/types';
 import type { VaultCoreSnapshot } from '@/lib/vault-cache';
 
 function isBackupProgressDetail(value: unknown): value is BackupProgressDetail {
@@ -94,6 +103,8 @@ const IMPORT_ROUTE_ALIASES: ReadonlySet<string> = new Set(IMPORT_ROUTE_PATHS.fil
 const SETTINGS_HOME_ROUTE = '/settings';
 const SETTINGS_ACCOUNT_ROUTE = '/settings/account';
 const SETTINGS_DOMAIN_RULES_ROUTE = '/settings/domain-rules';
+const DEVICE_MANAGEMENT_ROUTE = '/settings/security/device-management';
+const LEGACY_DEVICE_MANAGEMENT_ROUTE = '/security/devices';
 const AUTH_ROUTE_PATHS = ['/', '/login', '/register', '/lock', '/recover-2fa'] as const;
 const APP_ROUTE_PATHS = [
   '/',
@@ -102,7 +113,8 @@ const APP_ROUTE_PATHS = [
   '/sends',
   '/admin',
   '/logs',
-  '/security/devices',
+  LEGACY_DEVICE_MANAGEMENT_ROUTE,
+  DEVICE_MANAGEMENT_ROUTE,
   '/backup',
   '/settings',
   SETTINGS_ACCOUNT_ROUTE,
@@ -124,10 +136,22 @@ function normalizeRoutePath(path: string): string {
 }
 const THEME_STORAGE_KEY = 'nodewarden.theme.preference.v1';
 const SIGNALR_RECORD_SEPARATOR = String.fromCharCode(0x1e);
+const SIGNALR_UPDATE_TYPE_SYNC_CIPHER_UPDATE = 0;
+const SIGNALR_UPDATE_TYPE_SYNC_CIPHER_CREATE = 1;
+const SIGNALR_UPDATE_TYPE_SYNC_FOLDER_DELETE = 3;
+const SIGNALR_UPDATE_TYPE_SYNC_CIPHERS = 4;
 const SIGNALR_UPDATE_TYPE_SYNC_VAULT = 5;
+const SIGNALR_UPDATE_TYPE_SYNC_FOLDER_CREATE = 7;
+const SIGNALR_UPDATE_TYPE_SYNC_FOLDER_UPDATE = 8;
+const SIGNALR_UPDATE_TYPE_SYNC_CIPHER_DELETE = 9;
 const SIGNALR_UPDATE_TYPE_LOG_OUT = 11;
-const SIGNALR_UPDATE_TYPE_DEVICE_STATUS = 12;
-const SIGNALR_UPDATE_TYPE_BACKUP_RESTORE_PROGRESS = 13;
+const SIGNALR_UPDATE_TYPE_SYNC_SEND_CREATE = 12;
+const SIGNALR_UPDATE_TYPE_SYNC_SEND_UPDATE = 13;
+const SIGNALR_UPDATE_TYPE_SYNC_SEND_DELETE = 14;
+const SIGNALR_UPDATE_TYPE_AUTH_REQUEST = 15;
+const SIGNALR_UPDATE_TYPE_AUTH_REQUEST_RESPONSE = 16;
+const SIGNALR_UPDATE_TYPE_DEVICE_STATUS = 101;
+const SIGNALR_UPDATE_TYPE_BACKUP_RESTORE_PROGRESS = 102;
 
 type ThemePreference = 'system' | 'light' | 'dark';
 type LockTimeoutMinutes = 0 | 1 | 5 | 15 | 30;
@@ -213,6 +237,9 @@ export default function App() {
   const [disableTotpOpen, setDisableTotpOpen] = useState(false);
   const [disableTotpPassword, setDisableTotpPassword] = useState('');
   const [disableTotpSubmitting, setDisableTotpSubmitting] = useState(false);
+  const [authRequestDialogDismissedId, setAuthRequestDialogDismissedId] = useState<string | null>(null);
+  const [authRequestDialogSelectedId, setAuthRequestDialogSelectedId] = useState<string | null>(null);
+  const [authRequestSubmittingId, setAuthRequestSubmittingId] = useState<string | null>(null);
   const [recoverValues, setRecoverValues] = useState({ email: '', password: '', recoveryCode: '' });
   const [themePreference, setThemePreference] = useState<ThemePreference>(() => readThemePreference());
   const [systemTheme, setSystemTheme] = useState<'light' | 'dark'>(() => resolveSystemTheme());
@@ -237,7 +264,13 @@ export default function App() {
   const sessionRef = useRef<SessionState | null>(initialBootstrap.session);
   const silentRefreshVaultRef = useRef<() => Promise<void>>(async () => {});
   const refreshAuthorizedDevicesRef = useRef<() => Promise<void>>(async () => {});
+  const refreshPendingAuthRequestsRef = useRef<() => Promise<void>>(async () => {});
   const repairAttemptRef = useRef<string>('');
+  const loginScopedBackupRepairAuthRef = useRef<{
+    accessToken: string;
+    masterPasswordHash?: string | null;
+    userVerificationToken?: string | null;
+  } | null>(null);
   const uriChecksumRepairAttemptRef = useRef<string>('');
   const pendingVaultCoreQueryRefreshRef = useRef<Promise<{ data?: VaultCoreSnapshot } | unknown> | null>(null);
   const pendingVaultCoreRefreshRef = useRef<Promise<unknown> | null>(null);
@@ -479,7 +512,15 @@ export default function App() {
     };
   }, [phase, session?.email, location, navigate]);
 
-  async function finalizeLogin(login: CompletedLogin, successMessage = t('txt_login_success')) {
+  async function finalizeLogin(login: CompletedLogin) {
+    loginScopedBackupRepairAuthRef.current =
+      login.session.accessToken && (login.freshMasterPasswordHash || login.freshUserVerificationToken)
+        ? {
+            accessToken: login.session.accessToken,
+            masterPasswordHash: login.freshMasterPasswordHash || null,
+            userVerificationToken: login.freshUserVerificationToken || null,
+          }
+        : null;
     setSession(login.session);
     setProfile(login.profile);
     setUnlockPreparing(false);
@@ -493,7 +534,6 @@ export default function App() {
     if (location === '/' || location === '/login' || location === '/register' || location === '/lock') {
       navigate('/vault');
     }
-    pushToast('success', successMessage);
     void (async () => {
       try {
         const hydratedProfile = await login.profilePromise;
@@ -510,7 +550,7 @@ export default function App() {
     if (IS_DEMO_MODE) {
       setPendingAuthAction('login');
       try {
-        await finalizeLogin(createDemoCompletedLogin(loginValues.email), t('txt_login_success'));
+        await finalizeLogin(createDemoCompletedLogin(loginValues.email));
       } finally {
         setPendingAuthAction(null);
       }
@@ -582,7 +622,7 @@ export default function App() {
     try {
       const result = await performPasskeyLogin(defaultKdfIterations, expectedEmail);
       if (result.kind === 'success') {
-        await finalizeLogin(result.login, t('txt_unlocked'));
+        await finalizeLogin(result.login);
         return;
       }
       if (result.kind === 'password') {
@@ -624,7 +664,7 @@ export default function App() {
     setTotpSubmitting(true);
     try {
       const login = await performTotpLogin(pendingTotp, totpCode, rememberDevice);
-      await finalizeLogin(login, pendingTotpMode === 'unlock' ? t('txt_unlocked') : t('txt_login_success'));
+      await finalizeLogin(login);
     } catch (error) {
       pushToast('error', error instanceof Error ? error.message : t('txt_totp_verify_failed'));
     } finally {
@@ -764,7 +804,7 @@ export default function App() {
     if (IS_DEMO_MODE) {
       setPendingAuthAction('unlock');
       try {
-        await finalizeLogin(createDemoCompletedLogin(session.email), t('txt_unlocked'));
+        await finalizeLogin(createDemoCompletedLogin(session.email));
       } finally {
         setPendingAuthAction(null);
       }
@@ -778,7 +818,7 @@ export default function App() {
     try {
       const result = await performUnlock(session, profile, unlockPassword, defaultKdfIterations);
       if (result.kind === 'success') {
-        await finalizeLogin(result.login, t('txt_unlocked'));
+        await finalizeLogin(result.login);
         return;
       }
       if (result.kind === 'totp') {
@@ -1060,6 +1100,77 @@ export default function App() {
     enabled: !IS_DEMO_MODE && phase === 'app' && !!session?.accessToken && vaultInitialDecryptDone,
     staleTime: 30_000,
   });
+
+  async function deriveCurrentMasterPasswordHash(masterPassword: string): Promise<string> {
+    const email = String(profile?.email || session?.email || '').trim().toLowerCase();
+    if (!email) throw new Error(t('txt_profile_unavailable'));
+    const normalizedPassword = String(masterPassword || '');
+    if (!normalizedPassword) throw new Error(t('txt_master_password_is_required'));
+    const derived = await deriveLoginHash(email, normalizedPassword, defaultKdfIterations);
+    return derived.hash;
+  }
+  const pendingAuthRequestsQueryKey = useMemo(() => ['auth-requests-pending', vaultCacheKey || session?.email] as const, [vaultCacheKey, session?.email]);
+  const pendingAuthRequestsQuery = useQuery({
+    queryKey: pendingAuthRequestsQueryKey,
+    queryFn: () => listPendingAuthRequests(authedFetch, profile?.email || session?.email || ''),
+    enabled: !IS_DEMO_MODE && phase === 'app' && !!session?.accessToken && !!session?.symEncKey && !!session?.symMacKey && !!(profile?.email || session?.email),
+    staleTime: 5_000,
+    refetchInterval: 15_000,
+    refetchIntervalInBackground: true,
+  });
+  const pendingAuthRequests = (pendingAuthRequestsQuery.data || []).filter(isPendingAuthRequest);
+  const latestPendingAuthRequest = pendingAuthRequests[0] || null;
+  const selectedPendingAuthRequest = authRequestDialogSelectedId
+    ? pendingAuthRequests.find((request) => request.id === authRequestDialogSelectedId) || null
+    : null;
+  const authRequestDialogRequest = selectedPendingAuthRequest || (
+    latestPendingAuthRequest && latestPendingAuthRequest.id !== authRequestDialogDismissedId
+      ? latestPendingAuthRequest
+      : null
+  );
+  const authRequestDialogOpen = !!authRequestDialogRequest;
+
+  async function beginApproveAuthRequest(authRequest: AuthRequest): Promise<void> {
+    setAuthRequestDialogSelectedId(authRequest.id);
+    setAuthRequestDialogDismissedId(null);
+  }
+
+  async function approveAuthRequest(authRequest: AuthRequest): Promise<void> {
+    if (!session) throw new Error(t('txt_vault_key_unavailable'));
+    setAuthRequestSubmittingId(authRequest.id);
+    try {
+      const key = await encryptSessionUserKeyForAuthRequest(session, authRequest);
+      await respondToAuthRequest(authedFetch, authRequest.id, {
+        key,
+        masterPasswordHash: null,
+        deviceIdentifier: getCurrentDeviceIdentifier(),
+        requestApproved: true,
+      });
+      setAuthRequestDialogDismissedId(null);
+      setAuthRequestDialogSelectedId(null);
+      pushToast('success', t('txt_auth_request_approved'));
+      await pendingAuthRequestsQuery.refetch();
+    } finally {
+      setAuthRequestSubmittingId(null);
+    }
+  }
+
+  async function denyAuthRequest(authRequest: AuthRequest): Promise<void> {
+    setAuthRequestSubmittingId(authRequest.id);
+    try {
+      await respondToAuthRequest(authedFetch, authRequest.id, {
+        deviceIdentifier: getCurrentDeviceIdentifier(),
+        requestApproved: false,
+      });
+      setAuthRequestDialogDismissedId(null);
+      setAuthRequestDialogSelectedId(null);
+      pushToast('success', t('txt_auth_request_denied'));
+      await pendingAuthRequestsQuery.refetch();
+    } finally {
+      setAuthRequestSubmittingId(null);
+    }
+  }
+
   function handleSaveDomainRules(customEquivalentDomains: CustomEquivalentDomain[], excludedGlobalEquivalentDomains: number[]): Promise<void> {
     const equivalentDomains = customEquivalentDomains.filter((rule) => !rule.excluded).map((rule) => rule.domains);
     const excludedGlobalTypes = new Set(excludedGlobalEquivalentDomains);
@@ -1117,13 +1228,25 @@ export default function App() {
     if (!isAdminProfile(profile)) return;
     if (repairAttemptRef.current === session.accessToken) return;
 
+    const loginScopedRepairAuth = loginScopedBackupRepairAuthRef.current?.accessToken === session.accessToken
+      ? loginScopedBackupRepairAuthRef.current
+      : null;
     repairAttemptRef.current = session.accessToken;
-    void silentlyRepairBackupSettingsIfNeeded(session, profile);
+    void (async () => {
+      try {
+        await silentlyRepairBackupSettingsIfNeeded(session, profile, loginScopedRepairAuth);
+      } finally {
+        if (loginScopedBackupRepairAuthRef.current?.accessToken === session.accessToken) {
+          loginScopedBackupRepairAuthRef.current = null;
+        }
+      }
+    })();
   }, [phase, session?.accessToken, session?.symEncKey, session?.symMacKey, profile, vaultInitialDecryptDone]);
 
   useEffect(() => {
     if (session?.accessToken) return;
     repairAttemptRef.current = '';
+    loginScopedBackupRepairAuthRef.current = null;
     uriChecksumRepairAttemptRef.current = '';
   }, [session?.accessToken]);
 
@@ -1269,6 +1392,193 @@ export default function App() {
 
   silentRefreshVaultRef.current = refreshVaultSilently;
 
+  function normalizeVaultCoreSnapshot(snapshot?: Partial<VaultCoreSnapshot> | null): VaultCoreSnapshot {
+    return {
+      ciphers: Array.isArray(snapshot?.ciphers) ? snapshot.ciphers : [],
+      folders: Array.isArray(snapshot?.folders) ? snapshot.folders : [],
+      sends: Array.isArray(snapshot?.sends) ? snapshot.sends : [],
+    };
+  }
+
+  function upsertById<T extends { id: string }>(items: T[], nextItem: T): T[] {
+    const nextId = String(nextItem.id || '').trim();
+    if (!nextId) return items;
+    const index = items.findIndex((item) => String(item.id || '').trim() === nextId);
+    if (index < 0) return [...items, nextItem];
+    const next = items.slice();
+    next[index] = nextItem;
+    return next;
+  }
+
+  function removeById<T extends { id: string }>(items: T[], id: string): T[] {
+    const normalizedId = String(id || '').trim();
+    if (!normalizedId) return items;
+    return items.filter((item) => String(item.id || '').trim() !== normalizedId);
+  }
+
+  function revisionStampFromIso(value: unknown): number | null {
+    const stamp = new Date(String(value || '').trim()).getTime();
+    return Number.isFinite(stamp) && stamp > 0 ? stamp : null;
+  }
+
+  function patchVaultCoreSnapshot(
+    updater: (snapshot: VaultCoreSnapshot) => VaultCoreSnapshot,
+    options?: { revisionStamp?: number | null }
+  ): void {
+    if (!vaultCacheKey) return;
+    let nextSnapshot: VaultCoreSnapshot | null = null;
+    queryClient.setQueryData(['vault-core', vaultCacheKey], (previous?: VaultCoreSnapshot) => {
+      const base = normalizeVaultCoreSnapshot(previous || cachedVaultCore);
+      nextSnapshot = updater(base);
+      return nextSnapshot;
+    });
+    if (nextSnapshot) {
+      setCachedVaultCore(nextSnapshot);
+      void saveVaultCoreSyncSnapshot(vaultCacheKey, nextSnapshot, options?.revisionStamp ?? null);
+    }
+  }
+
+  async function refreshVaultCoreRevisionStamp(): Promise<void> {
+    if (!vaultCacheKey || !session?.accessToken) return;
+    try {
+      const revisionStamp = await getVaultRevisionDate(authedFetch);
+      const currentSnapshot = normalizeVaultCoreSnapshot(
+        queryClient.getQueryData<VaultCoreSnapshot>(['vault-core', vaultCacheKey]) || cachedVaultCore
+      );
+      await saveVaultCoreSyncSnapshot(vaultCacheKey, currentSnapshot, revisionStamp);
+    } catch {
+      // A stale revision stamp only affects the next cache validation; the local resource patch remains valid.
+    }
+  }
+
+  function upsertEncryptedCipher(cipher: Cipher, revisionStamp?: number | null): void {
+    patchVaultCoreSnapshot((snapshot) => ({
+      ...snapshot,
+      ciphers: upsertById(snapshot.ciphers, cipher),
+    }), { revisionStamp: revisionStamp ?? revisionStampFromIso(cipher.revisionDate) });
+  }
+
+  function deleteCipherLocally(cipherId: string, revisionStamp?: number | null): void {
+    const id = String(cipherId || '').trim();
+    if (!id) return;
+    patchVaultCoreSnapshot((snapshot) => ({
+      ...snapshot,
+      ciphers: removeById(snapshot.ciphers, id),
+    }), { revisionStamp });
+    setDecryptedCiphers((current) => removeById(current, id));
+  }
+
+  function upsertEncryptedFolder(folder: VaultFolder, revisionStamp?: number | null): void {
+    patchVaultCoreSnapshot((snapshot) => ({
+      ...snapshot,
+      folders: upsertById(snapshot.folders, folder),
+    }), { revisionStamp: revisionStamp ?? revisionStampFromIso(folder.revisionDate) });
+  }
+
+  function deleteFolderLocally(folderId: string, revisionStamp?: number | null): void {
+    const id = String(folderId || '').trim();
+    if (!id) return;
+    patchVaultCoreSnapshot((snapshot) => ({
+      ...snapshot,
+      folders: removeById(snapshot.folders, id),
+      ciphers: snapshot.ciphers.map((cipher) => (
+        String(cipher.folderId || '').trim() === id ? { ...cipher, folderId: null } : cipher
+      )),
+    }), { revisionStamp });
+    setDecryptedFolders((current) => removeById(current, id));
+    setDecryptedCiphers((current) => current.map((cipher) => (
+      String(cipher.folderId || '').trim() === id ? { ...cipher, folderId: null } : cipher
+    )));
+  }
+
+  function upsertEncryptedSend(send: Send, revisionStamp?: number | null): void {
+    patchVaultCoreSnapshot((snapshot) => ({
+      ...snapshot,
+      sends: upsertById(snapshot.sends, send),
+    }), { revisionStamp: revisionStamp ?? revisionStampFromIso(send.revisionDate) });
+    queryClient.setQueryData(sendsQueryKey, (previous?: Send[]) => upsertById(Array.isArray(previous) ? previous : [], send));
+  }
+
+  function deleteSendLocally(sendId: string, revisionStamp?: number | null): void {
+    const id = String(sendId || '').trim();
+    if (!id) return;
+    patchVaultCoreSnapshot((snapshot) => ({
+      ...snapshot,
+      sends: removeById(snapshot.sends, id),
+    }), { revisionStamp });
+    queryClient.setQueryData(sendsQueryKey, (previous?: Send[]) => removeById(Array.isArray(previous) ? previous : [], id));
+    setDecryptedSends((current) => removeById(current, id));
+  }
+
+  async function upsertCipherFromNotification(cipherId: string, revisionStamp?: number | null): Promise<void> {
+    const id = String(cipherId || '').trim();
+    if (!id || !session?.symEncKey || !session?.symMacKey) return;
+    try {
+      const encrypted = await getCipherById(authedFetch, id);
+      upsertEncryptedCipher(encrypted, revisionStamp);
+      const result = await decryptVaultCore({
+        folders: [],
+        ciphers: [encrypted],
+        symEncKeyB64: session.symEncKey,
+        symMacKeyB64: session.symMacKey,
+      });
+      const decrypted = result.ciphers[0];
+      if (decrypted) setDecryptedCiphers((current) => upsertById(current, decrypted));
+    } catch (error) {
+      if ((error as { status?: number }).status === 404) {
+        deleteCipherLocally(id);
+        return;
+      }
+      console.warn('Failed to upsert cipher from notification:', error);
+    }
+  }
+
+  async function upsertFolderFromNotification(folderId: string, revisionStamp?: number | null): Promise<void> {
+    const id = String(folderId || '').trim();
+    if (!id || !session?.symEncKey || !session?.symMacKey) return;
+    try {
+      const encrypted = await getFolderById(authedFetch, id);
+      upsertEncryptedFolder(encrypted, revisionStamp);
+      const result = await decryptVaultCore({
+        folders: [encrypted],
+        ciphers: [],
+        symEncKeyB64: session.symEncKey,
+        symMacKeyB64: session.symMacKey,
+      });
+      const decrypted = result.folders[0];
+      if (decrypted) setDecryptedFolders((current) => upsertById(current, decrypted));
+    } catch (error) {
+      if ((error as { status?: number }).status === 404) {
+        deleteFolderLocally(id);
+        return;
+      }
+      console.warn('Failed to upsert folder from notification:', error);
+    }
+  }
+
+  async function upsertSendFromNotification(sendId: string, revisionStamp?: number | null): Promise<void> {
+    const id = String(sendId || '').trim();
+    if (!id || !session?.symEncKey || !session?.symMacKey) return;
+    try {
+      const encrypted = await getSendById(authedFetch, id);
+      upsertEncryptedSend(encrypted, revisionStamp);
+      const sends = await decryptSends({
+        sends: [encrypted],
+        symEncKeyB64: session.symEncKey,
+        symMacKeyB64: session.symMacKey,
+        origin: window.location.origin,
+      });
+      const decrypted = sends[0];
+      if (decrypted) setDecryptedSends((current) => upsertById(current, decrypted));
+    } catch (error) {
+      if ((error as { status?: number }).status === 404) {
+        deleteSendLocally(id);
+        return;
+      }
+      console.warn('Failed to upsert send from notification:', error);
+    }
+  }
+
   useEffect(() => {
     if (IS_DEMO_MODE) return;
     if (phase !== 'app' || !session?.accessToken || !session?.symEncKey || !session?.symMacKey || !vaultInitialDecryptDone) return;
@@ -1345,7 +1655,18 @@ export default function App() {
         const frames = parseSignalRTextFrames(event.data);
         for (const frame of frames) {
           if (frame.type !== 1 || frame.target !== 'ReceiveMessage') continue;
-          const updateType = Number(frame.arguments?.[0]?.Type || 0);
+          const message = frame.arguments?.[0] as Record<string, unknown> | undefined;
+          const updateType = Number(message?.Type || 0);
+          const contextId = String(message?.ContextId || '').trim();
+          const payload = message?.Payload;
+          const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : null;
+          const resourceId = String(payloadRecord?.Id || payloadRecord?.id || '').trim();
+          const revisionStamp = revisionStampFromIso(
+            payloadRecord?.RevisionDate
+            || payloadRecord?.revisionDate
+            || message?.Date
+            || message?.date
+          );
           if (updateType === SIGNALR_UPDATE_TYPE_LOG_OUT) {
             logoutNow();
             return;
@@ -1354,21 +1675,49 @@ export default function App() {
             void refreshAuthorizedDevicesRef.current();
             continue;
           }
+          if (updateType === SIGNALR_UPDATE_TYPE_AUTH_REQUEST || updateType === SIGNALR_UPDATE_TYPE_AUTH_REQUEST_RESPONSE) {
+            void refreshPendingAuthRequestsRef.current();
+            continue;
+          }
           if (updateType === SIGNALR_UPDATE_TYPE_BACKUP_RESTORE_PROGRESS) {
-            const payload = frame.arguments?.[0]?.Payload;
             if (isBackupProgressDetail(payload)) dispatchBackupProgress(payload);
             continue;
           }
-          if (updateType !== SIGNALR_UPDATE_TYPE_SYNC_VAULT) continue;
-          const contextId = String(frame.arguments?.[0]?.ContextId || '').trim();
           if (contextId && contextId === getCurrentDeviceIdentifier()) continue;
-          if (notificationRefreshTimerRef.current !== null) {
-            window.clearTimeout(notificationRefreshTimerRef.current);
+          if (updateType === SIGNALR_UPDATE_TYPE_SYNC_CIPHERS || updateType === SIGNALR_UPDATE_TYPE_SYNC_VAULT) {
+            if (notificationRefreshTimerRef.current !== null) {
+              window.clearTimeout(notificationRefreshTimerRef.current);
+            }
+            notificationRefreshTimerRef.current = window.setTimeout(() => {
+              notificationRefreshTimerRef.current = null;
+              void silentRefreshVaultRef.current();
+            }, 250);
+            continue;
+          }
+          if ((updateType === SIGNALR_UPDATE_TYPE_SYNC_CIPHER_CREATE || updateType === SIGNALR_UPDATE_TYPE_SYNC_CIPHER_UPDATE) && resourceId) {
+            void upsertCipherFromNotification(resourceId, revisionStamp);
+            continue;
+          }
+          if (updateType === SIGNALR_UPDATE_TYPE_SYNC_CIPHER_DELETE && resourceId) {
+            deleteCipherLocally(resourceId, revisionStamp);
+            continue;
+          }
+          if ((updateType === SIGNALR_UPDATE_TYPE_SYNC_FOLDER_CREATE || updateType === SIGNALR_UPDATE_TYPE_SYNC_FOLDER_UPDATE) && resourceId) {
+            void upsertFolderFromNotification(resourceId, revisionStamp);
+            continue;
+          }
+          if (updateType === SIGNALR_UPDATE_TYPE_SYNC_FOLDER_DELETE && resourceId) {
+            deleteFolderLocally(resourceId, revisionStamp);
+            continue;
+          }
+          if ((updateType === SIGNALR_UPDATE_TYPE_SYNC_SEND_CREATE || updateType === SIGNALR_UPDATE_TYPE_SYNC_SEND_UPDATE) && resourceId) {
+            void upsertSendFromNotification(resourceId, revisionStamp);
+            continue;
+          }
+          if (updateType === SIGNALR_UPDATE_TYPE_SYNC_SEND_DELETE && resourceId) {
+            deleteSendLocally(resourceId, revisionStamp);
+            continue;
           }
-          notificationRefreshTimerRef.current = window.setTimeout(() => {
-            notificationRefreshTimerRef.current = null;
-            void silentRefreshVaultRef.current();
-          }, 250);
         }
       });
 
@@ -1427,8 +1776,33 @@ export default function App() {
     },
     refetchSends: refetchSendsFromVaultCore,
     onNotify: pushToast,
+    patchEncryptedCiphers: (updater) => {
+      patchVaultCoreSnapshot((snapshot) => ({
+        ...snapshot,
+        ciphers: updater(snapshot.ciphers),
+      }));
+    },
+    patchEncryptedFolders: (updater) => {
+      patchVaultCoreSnapshot((snapshot) => ({
+        ...snapshot,
+        folders: updater(snapshot.folders),
+      }));
+    },
+    patchEncryptedSends: (updater) => {
+      let nextSends: Send[] = [];
+      patchVaultCoreSnapshot((snapshot) => {
+        nextSends = updater(snapshot.sends);
+        return {
+          ...snapshot,
+          sends: nextSends,
+        };
+      });
+      queryClient.setQueryData(sendsQueryKey, nextSends);
+    },
     patchDecryptedCiphers: setDecryptedCiphers,
     patchDecryptedFolders: setDecryptedFolders,
+    patchDecryptedSends: setDecryptedSends,
+    refreshVaultRevisionStamp: refreshVaultCoreRevisionStamp,
   });
   const accountSecurityActions = useAccountSecurityActions({
     authedFetch,
@@ -1459,6 +1833,11 @@ export default function App() {
     if (!vaultInitialDecryptDone) return;
     await authorizedDevicesQuery.refetch();
   };
+  refreshPendingAuthRequestsRef.current = async () => {
+    if (!vaultInitialDecryptDone || !(profile?.email || session?.email)) return;
+    setAuthRequestDialogDismissedId(null);
+    await pendingAuthRequestsQuery.refetch();
+  };
 
   const hashPathRaw = typeof window !== 'undefined' ? window.location.hash || '' : '';
   const hashPath = hashPathRaw.startsWith('#') ? hashPathRaw.slice(1) : hashPathRaw;
@@ -1477,7 +1856,7 @@ export default function App() {
   const isKnownAppRoute = APP_ROUTES.has(routeLocation) || isPublicSendRoute || isImportHashRoute;
   const isUnknownRoute = isMalformedSendRoute || (phase === 'app' ? !isKnownAppRoute : !isKnownAuthRoute && !APP_ROUTES.has(routeLocation));
   const isImportRoute = routeLocation === IMPORT_ROUTE || IMPORT_ROUTE_ALIASES.has(routeLocation);
-  const showSidebarToggle = mobileLayout && (location === '/vault' || location === '/sends');
+  const showSidebarToggle = mobileLayout && location === '/sends';
   const sidebarToggleTitle = location === '/vault' ? t('txt_folders') : t('txt_type');
   const demoDomainRules = useMemo<DomainRules>(() => ({
     equivalentDomains: [
@@ -1509,7 +1888,7 @@ export default function App() {
     if (location === '/sends') return t('nav_sends');
     if (location === '/admin') return t('nav_admin_panel');
     if (location === '/logs') return t('nav_log_center');
-    if (location === '/security/devices') return t('nav_device_management');
+    if (location === LEGACY_DEVICE_MANAGEMENT_ROUTE || location === DEVICE_MANAGEMENT_ROUTE) return t('nav_device_management');
     if (location === SETTINGS_DOMAIN_RULES_ROUTE) return t('nav_domain_rules');
     if (location === '/backup') return t('nav_backup_strategy');
     if (isImportRoute) return t('nav_import_export');
@@ -1518,6 +1897,16 @@ export default function App() {
     return t('nav_my_vault');
   })();
 
+  useEffect(() => {
+    if (phase !== 'app') return;
+    if (!hashPath.startsWith('/')) return;
+    if (normalizedHashPath !== DEVICE_MANAGEMENT_ROUTE && normalizedHashPath !== LEGACY_DEVICE_MANAGEMENT_ROUTE) return;
+    if (typeof window !== 'undefined' && typeof window.history?.replaceState === 'function') {
+      window.history.replaceState(null, '', DEVICE_MANAGEMENT_ROUTE);
+    }
+    if (location !== DEVICE_MANAGEMENT_ROUTE) navigate(DEVICE_MANAGEMENT_ROUTE);
+  }, [phase, hashPath, normalizedHashPath, location, navigate]);
+
   useEffect(() => {
     if (phase === 'app' && location === '/' && !isPublicSendRoute) navigate('/vault');
   }, [phase, location, isPublicSendRoute, navigate]);
@@ -1612,8 +2001,8 @@ export default function App() {
     sendUploadPercent: vaultSendActions.sendUploadPercent,
     onChangePassword: accountSecurityActions.changePassword,
     onSavePasswordHint: accountSecurityActions.savePasswordHint,
-    onEnableTotp: async (secret: string, token: string) => {
-      await accountSecurityActions.enableTotp(secret, token);
+    onEnableTotp: async (secret: string, token: string, masterPassword: string) => {
+      await accountSecurityActions.enableTotp(secret, token, masterPassword);
       await totpStatusQuery.refetch();
     },
     onOpenDisableTotp: () => setDisableTotpOpen(true),
@@ -1624,6 +2013,13 @@ export default function App() {
     onCreateAccountPasskey: accountSecurityActions.createAccountPasskey,
     onEnableAccountPasskeyDirectUnlock: accountSecurityActions.enableAccountPasskeyDirectUnlock,
     onDeleteAccountPasskey: accountSecurityActions.deleteAccountPasskey,
+    pendingAuthRequests,
+    pendingAuthRequestsLoading: pendingAuthRequestsQuery.isFetching,
+    onRefreshPendingAuthRequests: async () => {
+      await pendingAuthRequestsQuery.refetch();
+    },
+    onApproveAuthRequest: beginApproveAuthRequest,
+    onDenyAuthRequest: denyAuthRequest,
     onLockTimeoutChange: setLockTimeoutMinutes,
     onSessionTimeoutActionChange: setSessionTimeoutAction,
     onRefreshAuthorizedDevices: accountSecurityActions.refreshAuthorizedDevices,
@@ -1647,22 +2043,50 @@ export default function App() {
     onLoadAuditLogSettings: () => getAuditLogSettings(authedFetch),
     onSaveAuditLogSettings: (settings: AuditLogSettings) => saveAuditLogSettings(authedFetch, settings),
     onClearAuditLogs: () => clearAuditLogs(authedFetch),
-    onExportBackup: backupActions.exportBackup,
-    onImportBackup: backupActions.importBackup,
-    onImportBackupAllowingChecksumMismatch: backupActions.importBackupAllowingChecksumMismatch,
+    onExportBackup: async (masterPassword: string, includeAttachments?: boolean) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      return backupActions.exportBackup(hash, includeAttachments);
+    },
+    onImportBackup: async (masterPassword: string, file: File, replaceExisting?: boolean) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      return backupActions.importBackup(hash, file, replaceExisting);
+    },
+    onImportBackupAllowingChecksumMismatch: async (masterPassword: string, file: File, replaceExisting?: boolean) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      return backupActions.importBackupAllowingChecksumMismatch(hash, file, replaceExisting);
+    },
     onLoadBackupSettings: () => queryClient.ensureQueryData({
       queryKey: ['admin-backup-settings', vaultCacheKey],
       queryFn: () => backupActions.loadSettings(),
       staleTime: 30_000,
     }),
-    onSaveBackupSettings: backupActions.saveSettings,
-    onRunRemoteBackup: backupActions.runRemoteBackup,
+    onSaveBackupSettings: async (masterPassword: string, settings: AdminBackupSettings) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      const saved = await backupActions.saveSettings(hash, settings);
+      queryClient.setQueryData(['admin-backup-settings', vaultCacheKey], saved);
+      return saved;
+    },
+    onRunRemoteBackup: async (masterPassword: string, destinationId?: string | null) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      const result = await backupActions.runRemoteBackup(hash, destinationId);
+      queryClient.setQueryData(['admin-backup-settings', vaultCacheKey], result.settings);
+      return result;
+    },
     onListRemoteBackups: backupActions.listRemoteBackups,
-    onDownloadRemoteBackup: backupActions.downloadRemoteBackup,
+    onDownloadRemoteBackup: async (masterPassword: string, destinationId: string, path: string, onProgress?: (percent: number | null) => void) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      return backupActions.downloadRemoteBackup(hash, destinationId, path, onProgress);
+    },
     onInspectRemoteBackup: backupActions.inspectRemoteBackup,
     onDeleteRemoteBackup: backupActions.deleteRemoteBackup,
-    onRestoreRemoteBackup: backupActions.restoreRemoteBackup,
-    onRestoreRemoteBackupAllowingChecksumMismatch: backupActions.restoreRemoteBackupAllowingChecksumMismatch,
+    onRestoreRemoteBackup: async (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      return backupActions.restoreRemoteBackup(hash, destinationId, path, replaceExisting);
+    },
+    onRestoreRemoteBackupAllowingChecksumMismatch: async (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => {
+      const hash = await deriveCurrentMasterPasswordHash(masterPassword);
+      return backupActions.restoreRemoteBackupAllowingChecksumMismatch(hash, destinationId, path, replaceExisting);
+    },
   };
   const effectiveMainRoutesProps = IS_DEMO_MODE
     ? createDemoMainRoutesProps(mainRoutesProps, pushToast, {
@@ -1868,6 +2292,27 @@ export default function App() {
         }}
         disableTotpSubmitting={disableTotpSubmitting}
       />
+      <AuthRequestApprovalDialog
+        open={authRequestDialogOpen}
+        authRequest={authRequestDialogRequest}
+        submitting={!!authRequestSubmittingId}
+        onApprove={() => {
+          if (!authRequestDialogRequest) return;
+          void approveAuthRequest(authRequestDialogRequest).catch((error) => {
+            pushToast('error', error instanceof Error ? error.message : t('txt_auth_request_update_failed'));
+          });
+        }}
+        onDeny={() => {
+          if (!authRequestDialogRequest) return;
+          void denyAuthRequest(authRequestDialogRequest).catch((error) => {
+            pushToast('error', error instanceof Error ? error.message : t('txt_auth_request_update_failed'));
+          });
+        }}
+        onClose={() => {
+          setAuthRequestDialogSelectedId(null);
+          setAuthRequestDialogDismissedId(authRequestDialogRequest?.id || null);
+        }}
+      />
     </>
   );
 }

webapp/src/components/AppAuthenticatedShell.tsx

@@ -47,6 +47,9 @@ function isAdminProfile(profile: Profile | null): boolean {
   return String(profile?.role || '').toLowerCase() === 'admin';
 }
 
+const DEVICE_MANAGEMENT_ROUTE = '/settings/security/device-management';
+const LEGACY_DEVICE_MANAGEMENT_ROUTE = '/security/devices';
+
 export default function AppAuthenticatedShell(props: AppAuthenticatedShellProps) {
   const routeAnimationKey = props.isImportRoute ? props.importRoute : props.location;
   const isDomainRulesRoute = props.location === '/settings/domain-rules';
@@ -55,7 +58,8 @@ export default function AppAuthenticatedShell(props: AppAuthenticatedShellProps)
   const vaultActive = props.location === '/vault' || props.location === '/vault/totp';
   const settingsActive = props.location === props.settingsAccountRoute || props.location === '/settings/domain-rules';
   const dataActive = props.location === '/backup' || props.isImportRoute;
-  const managementActive = props.location === '/admin' || props.location === '/security/devices' || props.location === '/logs';
+  const deviceManagementActive = props.location === DEVICE_MANAGEMENT_ROUTE || props.location === LEGACY_DEVICE_MANAGEMENT_ROUTE;
+  const managementActive = props.location === '/admin' || deviceManagementActive || props.location === '/logs';
   const [navLayoutMode, setNavLayoutMode] = useState<NavLayoutMode>(readNavLayoutMode);
   const [navLayoutPickerOpen, setNavLayoutPickerOpen] = useState(false);
   const navLayoutPickerRef = useRef<HTMLDivElement | null>(null);
@@ -177,7 +181,7 @@ export default function AppAuthenticatedShell(props: AppAuthenticatedShellProps)
       {renderSideLink(props.importRoute, props.isImportRoute, <ArrowUpDown size={16} />, t('nav_import_export'))}
       {isAdmin && renderSideLink('/admin', props.location === '/admin', <Users size={16} />, t('nav_admin_panel'))}
       {isAdmin && renderSideLink('/logs', props.location === '/logs', <FileClock size={16} />, t('nav_log_center'))}
-      {renderSideLink('/security/devices', props.location === '/security/devices', <MonitorSmartphone size={16} />, t('nav_device_management'))}
+      {renderSideLink(DEVICE_MANAGEMENT_ROUTE, deviceManagementActive, <MonitorSmartphone size={16} />, t('nav_device_management'))}
     </>
   );
 
@@ -222,7 +226,7 @@ export default function AppAuthenticatedShell(props: AppAuthenticatedShellProps)
         <>
           {isAdmin && renderSubLink('/admin', props.location === '/admin', t('nav_admin_panel'))}
           {isAdmin && renderSubLink('/logs', props.location === '/logs', t('nav_log_center'))}
-          {renderSubLink('/security/devices', props.location === '/security/devices', t('nav_device_management'))}
+          {renderSubLink(DEVICE_MANAGEMENT_ROUTE, deviceManagementActive, t('nav_device_management'))}
         </>
       )}
     </>

webapp/src/components/AppMainRoutes.tsx

@@ -8,7 +8,7 @@ import type { AdminBackupImportResponse, AdminBackupRunResponse, AdminBackupSett
 import type { AuditLogFilters } from '@/lib/api/admin';
 import type { CiphersImportPayload } from '@/lib/api/vault';
 import { t } from '@/lib/i18n';
-import type { AccountPasskeyCredential, AdminInvite, AdminUser, AuditLogListResult, AuditLogSettings, AuthorizedDevice, Cipher, CustomEquivalentDomain, DomainRules, Folder as VaultFolder, Profile, Send, SendDraft, SessionState, VaultDraft } from '@/lib/types';
+import type { AccountPasskeyCredential, AdminInvite, AdminUser, AuditLogListResult, AuditLogSettings, AuthRequest, AuthorizedDevice, Cipher, CustomEquivalentDomain, DomainRules, Folder as VaultFolder, Profile, Send, SendDraft, SessionState, VaultDraft } from '@/lib/types';
 import type { ExportRequest } from '@/lib/export-formats';
 
 const VaultPage = lazy(() => import('@/components/VaultPage'));
@@ -107,7 +107,7 @@ export interface AppMainRoutesProps {
   sendUploadPercent: number | null;
   onChangePassword: (currentPassword: string, nextPassword: string, nextPassword2: string) => Promise<void>;
   onSavePasswordHint: (masterPasswordHint: string) => Promise<void>;
-  onEnableTotp: (secret: string, token: string) => Promise<void>;
+  onEnableTotp: (secret: string, token: string, masterPassword: string) => Promise<void>;
   onOpenDisableTotp: () => void;
   onGetRecoveryCode: (masterPassword: string) => Promise<string>;
   onGetApiKey: (masterPassword: string) => Promise<string>;
@@ -116,6 +116,11 @@ export interface AppMainRoutesProps {
   onCreateAccountPasskey: (name: string, masterPassword: string, directUnlock: boolean) => Promise<AccountPasskeyCredential | null>;
   onEnableAccountPasskeyDirectUnlock: (id: string, masterPassword: string) => Promise<void>;
   onDeleteAccountPasskey: (id: string, masterPassword: string) => Promise<void>;
+  pendingAuthRequests: AuthRequest[];
+  pendingAuthRequestsLoading: boolean;
+  onRefreshPendingAuthRequests: () => Promise<void>;
+  onApproveAuthRequest: (request: AuthRequest) => Promise<void>;
+  onDenyAuthRequest: (request: AuthRequest) => Promise<void>;
   onLockTimeoutChange: (minutes: 0 | 1 | 5 | 15 | 30) => void;
   onSessionTimeoutActionChange: (action: 'lock' | 'logout') => void;
   onRefreshAuthorizedDevices: () => Promise<void>;
@@ -137,22 +142,23 @@ export interface AppMainRoutesProps {
   onLoadAuditLogSettings: () => Promise<AuditLogSettings>;
   onSaveAuditLogSettings: (settings: AuditLogSettings) => Promise<AuditLogSettings>;
   onClearAuditLogs: () => Promise<number>;
-  onExportBackup: (includeAttachments?: boolean) => Promise<void>;
-  onImportBackup: (file: File, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
-  onImportBackupAllowingChecksumMismatch: (file: File, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
+  onExportBackup: (masterPassword: string, includeAttachments?: boolean) => Promise<void>;
+  onImportBackup: (masterPassword: string, file: File, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
+  onImportBackupAllowingChecksumMismatch: (masterPassword: string, file: File, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
   onLoadBackupSettings: () => Promise<AdminBackupSettings>;
-  onSaveBackupSettings: (settings: AdminBackupSettings) => Promise<AdminBackupSettings>;
-  onRunRemoteBackup: (destinationId?: string | null) => Promise<AdminBackupRunResponse>;
+  onSaveBackupSettings: (masterPassword: string, settings: AdminBackupSettings) => Promise<AdminBackupSettings>;
+  onRunRemoteBackup: (masterPassword: string, destinationId?: string | null) => Promise<AdminBackupRunResponse>;
   onListRemoteBackups: (destinationId: string, path: string) => Promise<RemoteBackupBrowserResponse>;
-  onDownloadRemoteBackup: (destinationId: string, path: string, onProgress?: (percent: number | null) => void) => Promise<void>;
+  onDownloadRemoteBackup: (masterPassword: string, destinationId: string, path: string, onProgress?: (percent: number | null) => void) => Promise<void>;
   onInspectRemoteBackup: (destinationId: string, path: string) => Promise<{ object: 'backup-remote-integrity'; destinationId: string; path: string; fileName: string; integrity: { hasChecksumPrefix: boolean; expectedPrefix: string | null; actualPrefix: string; matches: boolean } }>;
   onDeleteRemoteBackup: (destinationId: string, path: string) => Promise<void>;
-  onRestoreRemoteBackup: (destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
-  onRestoreRemoteBackupAllowingChecksumMismatch: (destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
+  onRestoreRemoteBackup: (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
+  onRestoreRemoteBackupAllowingChecksumMismatch: (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
 }
 
 export default function AppMainRoutes(props: AppMainRoutesProps) {
   const importRoutePaths = [props.importRoute, '/tools/import', '/tools/import-export', '/tools/import-data', '/import', '/import-export'] as const;
+  const deviceManagementRoutePaths = ['/security/devices', '/settings/security/device-management'] as const;
   const isAdmin = String(props.profile?.role || '').toLowerCase() === 'admin';
   const importPageContent = (
     <Suspense fallback={<RouteContentFallback />}>
@@ -287,7 +293,7 @@ export default function AppMainRoutes(props: AppMainRoutesProps) {
                 <SettingsIcon size={18} />
                 <span>{t('nav_account_settings')}</span>
               </Link>
-              <Link href="/security/devices" className="mobile-settings-link">
+              <Link href="/settings/security/device-management" className="mobile-settings-link">
                 <Shield size={18} />
                 <span>{t('nav_device_management')}</span>
               </Link>
@@ -327,32 +333,39 @@ export default function AppMainRoutes(props: AppMainRoutesProps) {
           <LoadingState card lines={4} />
         ) : null}
       </Route>
-      <Route path="/security/devices">
-        <div className="stack">
-          {props.mobileLayout && (
-            <div className="mobile-settings-subhead">
-              <button type="button" className="btn btn-secondary small mobile-settings-back" onClick={() => props.onNavigate(props.settingsHomeRoute)}>
-                <span className="btn-icon" aria-hidden="true">{"<"}</span>
-                {t('txt_back')}
-              </button>
-            </div>
-          )}
-          <Suspense fallback={<RouteContentFallback />}>
-            <SecurityDevicesPage
-              devices={props.authorizedDevices}
-              loading={props.authorizedDevicesLoading}
-              error={props.authorizedDevicesError}
-              onRefresh={() => void props.onRefreshAuthorizedDevices()}
-              onRenameDevice={props.onRenameAuthorizedDevice}
-              onRevokeTrust={props.onRevokeDeviceTrust}
-              onTrustPermanently={props.onTrustDevicePermanently}
-              onRemoveDevice={props.onRemoveDevice}
-              onRevokeAll={props.onRevokeAllDeviceTrust}
-              onRemoveAll={props.onRemoveAllDevices}
-            />
-          </Suspense>
-        </div>
-      </Route>
+      {deviceManagementRoutePaths.map((path) => (
+        <Route key={path} path={path}>
+          <div className="stack">
+            {props.mobileLayout && (
+              <div className="mobile-settings-subhead">
+                <button type="button" className="btn btn-secondary small mobile-settings-back" onClick={() => props.onNavigate(props.settingsHomeRoute)}>
+                  <span className="btn-icon" aria-hidden="true">{"<"}</span>
+                  {t('txt_back')}
+                </button>
+              </div>
+            )}
+            <Suspense fallback={<RouteContentFallback />}>
+              <SecurityDevicesPage
+                devices={props.authorizedDevices}
+                loading={props.authorizedDevicesLoading}
+                error={props.authorizedDevicesError}
+                pendingAuthRequests={props.pendingAuthRequests}
+                pendingAuthRequestsLoading={props.pendingAuthRequestsLoading}
+                onRefresh={() => void props.onRefreshAuthorizedDevices()}
+                onRefreshPendingAuthRequests={props.onRefreshPendingAuthRequests}
+                onApproveAuthRequest={props.onApproveAuthRequest}
+                onDenyAuthRequest={props.onDenyAuthRequest}
+                onRenameDevice={props.onRenameAuthorizedDevice}
+                onRevokeTrust={props.onRevokeDeviceTrust}
+                onTrustPermanently={props.onTrustDevicePermanently}
+                onRemoveDevice={props.onRemoveDevice}
+                onRevokeAll={props.onRevokeAllDeviceTrust}
+                onRemoveAll={props.onRemoveAllDevices}
+              />
+            </Suspense>
+          </div>
+        </Route>
+      ))}
       <Route path="/settings/domain-rules">
         <div className="stack domain-rules-route">
           {props.mobileLayout && (

webapp/src/components/AuthRequestApprovalDialog.tsx

@@ -0,0 +1,74 @@
+import { ShieldCheck, ShieldX } from 'lucide-preact';
+import ConfirmDialog from '@/components/ConfirmDialog';
+import { t } from '@/lib/i18n';
+import type { AuthRequest } from '@/lib/types';
+
+interface AuthRequestApprovalDialogProps {
+  open: boolean;
+  authRequest: AuthRequest | null;
+  submitting: boolean;
+  onApprove: () => void;
+  onDeny: () => void;
+  onClose: () => void;
+}
+
+function formatDateTime(value: string | null | undefined): string {
+  if (!value) return t('txt_dash');
+  const parsed = new Date(value);
+  if (Number.isNaN(parsed.getTime())) return value;
+  return parsed.toLocaleString();
+}
+
+export default function AuthRequestApprovalDialog(props: AuthRequestApprovalDialogProps) {
+  const authRequest = props.authRequest;
+  return (
+    <ConfirmDialog
+      open={props.open && !!authRequest}
+      title={t('txt_approve_device_login')}
+      message={t('txt_auth_request_approve_message')}
+      confirmText={props.submitting ? t('txt_approving') : t('txt_approve')}
+      cancelText={t('txt_later')}
+      confirmDisabled={props.submitting || !authRequest}
+      cancelDisabled={props.submitting}
+      onConfirm={props.onApprove}
+      onCancel={props.onClose}
+      afterActions={(
+        <button
+          type="button"
+          className="btn btn-danger dialog-btn"
+          disabled={props.submitting || !authRequest}
+          onClick={props.onDeny}
+        >
+          <ShieldX size={14} className="btn-icon" />
+          {t('txt_deny')}
+        </button>
+      )}
+    >
+      {authRequest && (
+        <div className="auth-request-details">
+          <div className="auth-request-device">
+            <ShieldCheck size={18} />
+            <div>
+              <strong>{authRequest.requestDeviceType || t('txt_unknown_device')}</strong>
+              <small>{authRequest.requestDeviceIdentifier}</small>
+            </div>
+          </div>
+          <div className="auth-request-kv">
+            <span>{t('txt_created')}</span>
+            <strong>{formatDateTime(authRequest.creationDate)}</strong>
+          </div>
+          {authRequest.requestIpAddress && (
+            <div className="auth-request-kv">
+              <span>{t('txt_ip_address')}</span>
+              <strong>{authRequest.requestIpAddress}</strong>
+            </div>
+          )}
+          <div className="auth-request-fingerprint">
+            <span>{t('txt_fingerprint_phrase')}</span>
+            <strong>{authRequest.fingerprintPhrase || t('txt_dash')}</strong>
+          </div>
+        </div>
+      )}
+    </ConfirmDialog>
+  );
+}

webapp/src/components/BackupCenterPage.tsx

@@ -34,18 +34,18 @@ import { BackupOperationsSidebar } from './backup-center/BackupOperationsSidebar
 
 interface BackupCenterPageProps {
   currentUserId: string | null;
-  onExport: (includeAttachments?: boolean) => Promise<void>;
-  onImport: (file: File, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
-  onImportAllowingChecksumMismatch: (file: File, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
+  onExport: (masterPassword: string, includeAttachments?: boolean) => Promise<void>;
+  onImport: (masterPassword: string, file: File, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
+  onImportAllowingChecksumMismatch: (masterPassword: string, file: File, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
   onLoadSettings: () => Promise<AdminBackupSettings>;
-  onSaveSettings: (settings: AdminBackupSettings) => Promise<AdminBackupSettings>;
-  onRunRemoteBackup: (destinationId?: string | null) => Promise<AdminBackupRunResponse>;
+  onSaveSettings: (masterPassword: string, settings: AdminBackupSettings) => Promise<AdminBackupSettings>;
+  onRunRemoteBackup: (masterPassword: string, destinationId?: string | null) => Promise<AdminBackupRunResponse>;
   onListRemoteBackups: (destinationId: string, path: string) => Promise<RemoteBackupBrowserResponse>;
-  onDownloadRemoteBackup: (destinationId: string, path: string, onProgress?: (percent: number | null) => void) => Promise<void>;
+  onDownloadRemoteBackup: (masterPassword: string, destinationId: string, path: string, onProgress?: (percent: number | null) => void) => Promise<void>;
   onInspectRemoteBackup: (destinationId: string, path: string) => Promise<{ object: 'backup-remote-integrity'; destinationId: string; path: string; fileName: string; integrity: BackupFileIntegrityCheckResult }>;
   onDeleteRemoteBackup: (destinationId: string, path: string) => Promise<void>;
-  onRestoreRemoteBackup: (destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
-  onRestoreRemoteBackupAllowingChecksumMismatch: (destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
+  onRestoreRemoteBackup: (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
+  onRestoreRemoteBackupAllowingChecksumMismatch: (masterPassword: string, destinationId: string, path: string, replaceExisting?: boolean) => Promise<AdminBackupImportResponse>;
   onNotify: (type: 'success' | 'error' | 'warning', text: string) => void;
 }
 
@@ -53,6 +53,15 @@ type PendingRestoreIntegrity =
   | { source: 'local'; fileName: string; result: BackupFileIntegrityCheckResult }
   | { source: 'remote'; fileName: string; path: string; result: BackupFileIntegrityCheckResult };
 
+type PendingBackupVerification =
+  | { action: 'export' }
+  | { action: 'saveSettings' }
+  | { action: 'deleteDestination'; destinationId: string; settings: AdminBackupSettings }
+  | { action: 'import'; replaceExisting: boolean; allowChecksumMismatch: boolean; knownIntegrity?: BackupFileIntegrityCheckResult }
+  | { action: 'runRemoteBackup' }
+  | { action: 'downloadRemote'; path: string }
+  | { action: 'restoreRemote'; path: string; replaceExisting: boolean; allowChecksumMismatch: boolean; knownIntegrity?: BackupFileIntegrityCheckResult };
+
 interface BackupProgressPhase {
   titleKey: string;
   detailKey: string;
@@ -184,7 +193,7 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
   const [downloadingRemotePercent, setDownloadingRemotePercent] = useState<number | null>(null);
   const [restoringRemotePath, setRestoringRemotePath] = useState('');
   const [deletingRemotePath, setDeletingRemotePath] = useState('');
-  const [localError, setLocalError] = useState('');
+  const [, setLocalError] = useState('');
   const [restoreProgress, setRestoreProgress] = useState<BackupProgressState | null>(null);
   const [restoreElapsedSeconds, setRestoreElapsedSeconds] = useState(0);
   const [confirmLocalRestoreOpen, setConfirmLocalRestoreOpen] = useState(false);
@@ -193,6 +202,9 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
   const [confirmIntegrityWarningOpen, setConfirmIntegrityWarningOpen] = useState(false);
   const [confirmDeleteDestinationOpen, setConfirmDeleteDestinationOpen] = useState(false);
   const [confirmRemoteDeleteOpen, setConfirmRemoteDeleteOpen] = useState(false);
+  const [pendingBackupVerification, setPendingBackupVerification] = useState<PendingBackupVerification | null>(null);
+  const [backupPasswordValue, setBackupPasswordValue] = useState('');
+  const [backupPasswordSubmitting, setBackupPasswordSubmitting] = useState(false);
   const [pendingRestoreIntegrity, setPendingRestoreIntegrity] = useState<PendingRestoreIntegrity | null>(null);
   const [pendingRemoteRestorePath, setPendingRemoteRestorePath] = useState('');
   const [pendingRemoteDeletePath, setPendingRemoteDeletePath] = useState('');
@@ -209,7 +221,7 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
   const selectedDestination = getDestinationById(settings, selectedDestinationId);
   const savedSelectedDestination = getDestinationById(savedSettings, selectedDestinationId);
   const selectedDestinationIsSaved = !!savedSelectedDestination;
-  const disableWhileBusy = exporting || importing || savingSettings || runningRemoteBackup;
+  const disableWhileBusy = exporting || importing || savingSettings || runningRemoteBackup || backupPasswordSubmitting;
   const currentRemoteBrowserPath = savedSelectedDestination ? (remoteBrowserPathByDestination[savedSelectedDestination.id] || '') : '';
   const currentRemoteBrowserKey = savedSelectedDestination ? getRemoteBrowserCacheKey(savedSelectedDestination.id, currentRemoteBrowserPath) : '';
   const remoteBrowser = currentRemoteBrowserKey ? remoteBrowserCache[currentRemoteBrowserKey] || null : null;
@@ -226,6 +238,18 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
   const recommendedS3Providers = RECOMMENDED_PROVIDERS.filter((provider) => provider.protocol === 's3');
   const canRunSelectedDestination = !!selectedDestination && selectedDestinationIsSaved;
   const canBrowseSelectedDestination = !!savedSelectedDestination;
+  const backupPasswordPromptTitle =
+    pendingBackupVerification?.action === 'export'
+      ? t('txt_backup_export')
+      : pendingBackupVerification?.action === 'saveSettings' || pendingBackupVerification?.action === 'deleteDestination'
+        ? t('txt_backup_save_settings')
+        : pendingBackupVerification?.action === 'runRemoteBackup'
+          ? t('txt_backup_run_manual')
+      : pendingBackupVerification?.action === 'downloadRemote'
+        ? t('txt_backup_remote_download')
+        : pendingBackupVerification?.action === 'restoreRemote'
+          ? t('txt_backup_import')
+          : t('txt_backup_import');
 
   useEffect(() => {
     let cancelled = false;
@@ -478,10 +502,16 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
       destinations: (savedSettings?.destinations || []).filter((destination) => destination.id !== destinationIdToDelete),
     };
 
+    setPendingBackupVerification({ action: 'deleteDestination', destinationId: destinationIdToDelete, settings: nextSettings });
+    setBackupPasswordValue('');
+    setConfirmDeleteDestinationOpen(false);
+  }
+
+  async function executeDeleteDestination(masterPassword: string, destinationIdToDelete: string, payload: AdminBackupSettings) {
     setSavingSettings(true);
     setLocalError('');
     try {
-      const saved = await props.onSaveSettings(nextSettings);
+      const saved = await props.onSaveSettings(masterPassword, payload);
       const nextDraftDestinations = settings.destinations.filter((destination) => destination.id !== destinationIdToDelete);
       const nextSelected = getFirstVisibleDestinationId({ destinations: nextDraftDestinations }) || getFirstVisibleDestinationId(saved);
       setSavedSettings(saved);
@@ -507,11 +537,17 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
   }
 
   async function handleExport() {
+    if (exporting) return;
+    setPendingBackupVerification({ action: 'export' });
+    setBackupPasswordValue('');
+  }
+
+  async function executeExport(masterPassword: string) {
     setLocalError('');
     setExporting(true);
     try {
       startRestoreProgress('backup-export', t('txt_backup_export'), { source: 'local', includeAttachments: exportIncludeAttachments });
-      await props.onExport(exportIncludeAttachments);
+      await props.onExport(masterPassword, exportIncludeAttachments);
       props.onNotify('success', t('txt_backup_export_success'));
     } catch (error) {
       const message = error instanceof Error ? error.message : t('txt_backup_export_failed');
@@ -527,6 +563,28 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
     replaceExisting: boolean,
     allowChecksumMismatch: boolean = false,
     knownIntegrity?: BackupFileIntegrityCheckResult
+  ) {
+    if (importing) return;
+    if (!selectedFile) {
+      const message = t('txt_backup_file_required');
+      setLocalError(message);
+      props.onNotify('error', message);
+      return;
+    }
+    setPendingBackupVerification({
+      action: 'import',
+      replaceExisting,
+      allowChecksumMismatch,
+      knownIntegrity,
+    });
+    setBackupPasswordValue('');
+  }
+
+  async function executeLocalRestore(
+    masterPassword: string,
+    replaceExisting: boolean,
+    allowChecksumMismatch: boolean = false,
+    knownIntegrity?: BackupFileIntegrityCheckResult
   ) {
     if (importing) return;
     if (!selectedFile) {
@@ -547,8 +605,8 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
         delayMs: replaceExisting ? 480 : 1400,
       });
       const result = allowChecksumMismatch
-        ? await props.onImportAllowingChecksumMismatch(selectedFile, replaceExisting)
-        : await props.onImport(selectedFile, replaceExisting);
+        ? await props.onImportAllowingChecksumMismatch(masterPassword, selectedFile, replaceExisting)
+        : await props.onImport(masterPassword, selectedFile, replaceExisting);
       props.onNotify('success', `${buildIntegrityStatusMessage(integrity)} ${t('txt_backup_restore_success_relogin')}`);
       const skippedMessage = buildSkippedImportMessage(result);
       if (skippedMessage) props.onNotify('warning', skippedMessage);
@@ -573,12 +631,18 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
   }
 
   async function handleSaveSettings() {
+    if (savingSettings) return;
+    setPendingBackupVerification({ action: 'saveSettings' });
+    setBackupPasswordValue('');
+  }
+
+  async function executeSaveSettings(masterPassword: string) {
     const payload = buildSettingsPayloadForSelectedDestination();
     const destinationIdToInvalidate = selectedDestinationId;
     setSavingSettings(true);
     setLocalError('');
     try {
-      const saved = await props.onSaveSettings(payload);
+      const saved = await props.onSaveSettings(masterPassword, payload);
       const nextSelected =
         (selectedDestinationId && saved.destinations.some((destination) => destination.id === selectedDestinationId) && selectedDestinationId)
         || getFirstVisibleDestinationId(saved)
@@ -613,6 +677,12 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
   }
 
   async function handleRunRemoteBackup() {
+    if (!selectedDestination || runningRemoteBackup) return;
+    setPendingBackupVerification({ action: 'runRemoteBackup' });
+    setBackupPasswordValue('');
+  }
+
+  async function executeRunRemoteBackup(masterPassword: string) {
     if (!selectedDestination) return;
     setRunningRemoteBackup(true);
     setLocalError('');
@@ -621,7 +691,7 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
         source: 'remote',
         includeAttachments: !!selectedDestination.includeAttachments,
       });
-      const result = await props.onRunRemoteBackup(selectedDestination.id);
+      const result = await props.onRunRemoteBackup(masterPassword, selectedDestination.id);
       setSavedSettings(result.settings);
       setSettings(result.settings);
       setSelectedDestinationId(selectedDestination.id);
@@ -638,12 +708,17 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
   }
 
   async function handleDownloadRemote(path: string) {
+    setPendingBackupVerification({ action: 'downloadRemote', path });
+    setBackupPasswordValue('');
+  }
+
+  async function executeDownloadRemote(masterPassword: string, path: string) {
     if (!savedSelectedDestination) return;
     setDownloadingRemotePath(path);
     setDownloadingRemotePercent(null);
     setLocalError('');
     try {
-      await props.onDownloadRemoteBackup(savedSelectedDestination.id, path, setDownloadingRemotePercent);
+      await props.onDownloadRemoteBackup(masterPassword, savedSelectedDestination.id, path, setDownloadingRemotePercent);
     } catch (error) {
       const message = error instanceof Error ? error.message : t('txt_backup_remote_download_failed');
       setLocalError(message);
@@ -724,6 +799,25 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
     replaceExisting: boolean,
     allowChecksumMismatch: boolean = false,
     knownIntegrity?: BackupFileIntegrityCheckResult
+  ) {
+    if (restoringRemotePath) return;
+    if (!savedSelectedDestination) return;
+    setPendingBackupVerification({
+      action: 'restoreRemote',
+      path,
+      replaceExisting,
+      allowChecksumMismatch,
+      knownIntegrity,
+    });
+    setBackupPasswordValue('');
+  }
+
+  async function executeRemoteRestore(
+    masterPassword: string,
+    path: string,
+    replaceExisting: boolean,
+    allowChecksumMismatch: boolean = false,
+    knownIntegrity?: BackupFileIntegrityCheckResult
   ) {
     if (restoringRemotePath) return;
     if (!savedSelectedDestination) return;
@@ -738,8 +832,8 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
         delayMs: replaceExisting ? 480 : 1400,
       });
       const result = allowChecksumMismatch
-        ? await props.onRestoreRemoteBackupAllowingChecksumMismatch(savedSelectedDestination.id, path, replaceExisting)
-        : await props.onRestoreRemoteBackup(savedSelectedDestination.id, path, replaceExisting);
+        ? await props.onRestoreRemoteBackupAllowingChecksumMismatch(masterPassword, savedSelectedDestination.id, path, replaceExisting)
+        : await props.onRestoreRemoteBackup(masterPassword, savedSelectedDestination.id, path, replaceExisting);
       setConfirmRemoteReplaceOpen(false);
       setPendingRemoteRestorePath('');
       props.onNotify('success', `${buildIntegrityStatusMessage(integrity.result, { remote: true })} ${t('txt_backup_restore_success_relogin')}`);
@@ -762,6 +856,38 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
     }
   }
 
+  async function submitBackupPasswordPrompt(): Promise<void> {
+    const request = pendingBackupVerification;
+    const masterPassword = backupPasswordValue;
+    if (!request || backupPasswordSubmitting) return;
+    if (!masterPassword.trim()) {
+      props.onNotify('error', t('txt_master_password_is_required'));
+      return;
+    }
+    setBackupPasswordSubmitting(true);
+    setPendingBackupVerification(null);
+    setBackupPasswordValue('');
+    try {
+      if (request.action === 'export') {
+        await executeExport(masterPassword);
+      } else if (request.action === 'saveSettings') {
+        await executeSaveSettings(masterPassword);
+      } else if (request.action === 'deleteDestination') {
+        await executeDeleteDestination(masterPassword, request.destinationId, request.settings);
+      } else if (request.action === 'import') {
+        await executeLocalRestore(masterPassword, request.replaceExisting, request.allowChecksumMismatch, request.knownIntegrity);
+      } else if (request.action === 'runRemoteBackup') {
+        await executeRunRemoteBackup(masterPassword);
+      } else if (request.action === 'downloadRemote') {
+        await executeDownloadRemote(masterPassword, request.path);
+      } else if (request.action === 'restoreRemote') {
+        await executeRemoteRestore(masterPassword, request.path, request.replaceExisting, request.allowChecksumMismatch, request.knownIntegrity);
+      }
+    } finally {
+      setBackupPasswordSubmitting(false);
+    }
+  }
+
   return (
     <div className="backup-grid">
       <input
@@ -848,7 +974,6 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
         }}
       />
 
-      {localError ? <div className="local-error">{localError}</div> : null}
       {restoreProgress && typeof document !== 'undefined' ? createPortal((
         <div className="restore-progress-overlay" aria-live="polite">
           <section className="restore-progress-card restore-progress-modal">
@@ -893,6 +1018,33 @@ export default function BackupCenterPage(props: BackupCenterPageProps) {
         </div>
       ), document.body) : null}
 
+      <ConfirmDialog
+        open={pendingBackupVerification !== null}
+        title={backupPasswordPromptTitle}
+        message={t('txt_enter_master_password_to_continue')}
+        confirmText={t('txt_continue')}
+        cancelText={t('txt_cancel')}
+        confirmDisabled={backupPasswordSubmitting || !backupPasswordValue.trim()}
+        cancelDisabled={backupPasswordSubmitting}
+        onConfirm={() => void submitBackupPasswordPrompt()}
+        onCancel={() => {
+          if (backupPasswordSubmitting) return;
+          setPendingBackupVerification(null);
+          setBackupPasswordValue('');
+        }}
+      >
+        <label className="field">
+          <span>{t('txt_master_password')}</span>
+          <input
+            className="input"
+            type="password"
+            autoComplete="current-password"
+            value={backupPasswordValue}
+            onInput={(event) => setBackupPasswordValue((event.currentTarget as HTMLInputElement).value)}
+          />
+        </label>
+      </ConfirmDialog>
+
       <ConfirmDialog
         open={confirmLocalRestoreOpen}
         title={t('txt_backup_import')}

webapp/src/components/ConfirmDialog.tsx

@@ -83,6 +83,7 @@ export default function ConfirmDialog(props: ConfirmDialogProps) {
   const [present, setPresent] = useState(props.open);
   const [closing, setClosing] = useState(false);
   const cardRef = useRef<HTMLFormElement | null>(null);
+  const maskPointerStartedRef = useRef(false);
   const restoreFocusRef = useRef<HTMLElement | null>(null);
   const dialogId = useMemo(() => `confirm-dialog-${++dialogIdCounter}`, []);
   const titleId = `${dialogId}-title`;
@@ -176,8 +177,11 @@ export default function ConfirmDialog(props: ConfirmDialogProps) {
   return createPortal((
     <div
       className={`dialog-mask ${props.variant === 'warning' ? 'warning' : ''} ${props.open && !closing ? 'open' : ''} ${closing ? 'closing' : ''}`}
+      onPointerDown={(event) => {
+        maskPointerStartedRef.current = event.target === event.currentTarget;
+      }}
       onClick={(event) => {
-        if (event.target !== event.currentTarget || !canDismiss) return;
+        if (event.target !== event.currentTarget || !maskPointerStartedRef.current || !canDismiss) return;
         props.onCancel();
       }}
     >

webapp/src/components/LoadingSkeleton.tsx

@@ -0,0 +1,40 @@
+export function CardSkeleton() {
+  return (
+    <div className="skeleton-card">
+      <div className="skeleton-avatar" />
+      <div className="skeleton-content">
+        <div className="skeleton-line skeleton-line-lg" />
+        <div className="skeleton-line" />
+      </div>
+    </div>
+  );
+}
+
+export function ListSkeleton({ count = 5 }: { count?: number }) {
+  return (
+    <>
+      {Array.from({ length: count }).map((_, i) => (
+        <div key={i} className="skeleton-list-item">
+          <div className="skeleton-icon" />
+          <div className="skeleton-content">
+            <div className="skeleton-line skeleton-line-md" />
+            <div className="skeleton-line skeleton-line-sm" />
+          </div>
+        </div>
+      ))}
+    </>
+  );
+}
+
+export function PageSkeleton() {
+  return (
+    <div className="skeleton-page">
+      <div className="skeleton-header">
+        <div className="skeleton-line skeleton-line-xl" />
+      </div>
+      <div className="skeleton-body">
+        <ListSkeleton />
+      </div>
+    </div>
+  );
+}

webapp/src/components/NetworkStatusBadge.tsx

@@ -23,7 +23,6 @@ export default function NetworkStatusBadge() {
   const Icon = status === 'online' ? Wifi : WifiOff;
 
   useEffect(() => {
-    let cancelled = false;
     let timer = 0;
 
     const checkService = async () => {
@@ -31,10 +30,7 @@ export default function NetworkStatusBadge() {
         setCurrentNetworkStatus('offline');
         return;
       }
-      const reachable = await probeNodeWardenService();
-      if (!cancelled) {
-        setCurrentNetworkStatus(reachable ? 'online' : 'offline');
-      }
+      await probeNodeWardenService();
     };
 
     const scheduleNextCheck = () => {
@@ -62,7 +58,6 @@ export default function NetworkStatusBadge() {
     document.addEventListener('visibilitychange', handleVisibilityChange);
 
     return () => {
-      cancelled = true;
       unsubscribe();
       window.clearTimeout(timer);
       window.removeEventListener('online', handleOnline);

webapp/src/components/PendingAuthRequestsPanel.tsx

@@ -0,0 +1,112 @@
+import { useState } from 'preact/hooks';
+import { RefreshCw, ShieldCheck, ShieldX } from 'lucide-preact';
+import LoadingState from '@/components/LoadingState';
+import type { AuthRequest } from '@/lib/types';
+import { t } from '@/lib/i18n';
+
+interface PendingAuthRequestsPanelProps {
+  pendingAuthRequests: AuthRequest[];
+  pendingAuthRequestsLoading: boolean;
+  onRefreshPendingAuthRequests: () => Promise<void>;
+  onApproveAuthRequest: (request: AuthRequest) => Promise<void>;
+  onDenyAuthRequest: (request: AuthRequest) => Promise<void>;
+  className?: string;
+  loadingVariant?: 'placeholder' | 'compact';
+}
+
+function formatDateTime(value: string | null | undefined): string {
+  if (!value) return t('txt_dash');
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? t('txt_dash') : date.toLocaleString();
+}
+
+export default function PendingAuthRequestsPanel(props: PendingAuthRequestsPanelProps) {
+  const [authRequestSubmittingId, setAuthRequestSubmittingId] = useState<string | null>(null);
+
+  async function approveAuthRequest(authRequest: AuthRequest): Promise<void> {
+    if (authRequestSubmittingId) return;
+    setAuthRequestSubmittingId(authRequest.id);
+    try {
+      await props.onApproveAuthRequest(authRequest);
+    } finally {
+      setAuthRequestSubmittingId(null);
+    }
+  }
+
+  async function denyAuthRequest(authRequest: AuthRequest): Promise<void> {
+    if (authRequestSubmittingId) return;
+    setAuthRequestSubmittingId(authRequest.id);
+    try {
+      await props.onDenyAuthRequest(authRequest);
+    } finally {
+      setAuthRequestSubmittingId(null);
+    }
+  }
+
+  return (
+    <section className={props.className || 'card settings-module'}>
+      <div className="settings-module-head">
+        <h3>{t('txt_pending_device_logins')}</h3>
+        <button
+          type="button"
+          className="btn btn-secondary small"
+          disabled={props.pendingAuthRequestsLoading}
+          onClick={() => void props.onRefreshPendingAuthRequests()}
+        >
+          <RefreshCw size={14} className="btn-icon" />
+          {t('txt_refresh')}
+        </button>
+      </div>
+      <div className="account-passkeys-list">
+        {props.pendingAuthRequestsLoading && props.pendingAuthRequests.length === 0 ? (
+          props.loadingVariant === 'compact' ? (
+            <LoadingState lines={2} compact />
+          ) : (
+            <div className="settings-module-placeholder">
+              <RefreshCw size={20} />
+              <span>{t('txt_loading')}</span>
+            </div>
+          )
+        ) : props.pendingAuthRequests.length === 0 ? (
+          <div className="settings-module-placeholder">
+            <ShieldCheck size={20} />
+            <span>{t('txt_no_pending_device_logins')}</span>
+          </div>
+        ) : (
+          props.pendingAuthRequests.map((authRequest) => (
+            <div key={authRequest.id} className="account-passkey-row auth-request-row">
+              <div className="account-passkey-main">
+                <strong>{authRequest.requestDeviceType || t('txt_unknown_device')}</strong>
+                <small>{authRequest.requestDeviceIdentifier}</small>
+                <small>{t('txt_created_value', { value: formatDateTime(authRequest.creationDate) })}</small>
+              </div>
+              <span className="auth-request-fingerprint-inline">
+                {authRequest.fingerprintPhrase || t('txt_dash')}
+              </span>
+              <div className="actions account-passkey-actions">
+                <button
+                  type="button"
+                  className="btn btn-primary small"
+                  disabled={!!authRequestSubmittingId}
+                  onClick={() => void approveAuthRequest(authRequest)}
+                >
+                  <ShieldCheck size={14} className="btn-icon" />
+                  {authRequestSubmittingId === authRequest.id ? t('txt_approving') : t('txt_approve')}
+                </button>
+                <button
+                  type="button"
+                  className="btn btn-danger small"
+                  disabled={!!authRequestSubmittingId}
+                  onClick={() => void denyAuthRequest(authRequest)}
+                >
+                  <ShieldX size={14} className="btn-icon" />
+                  {t('txt_deny')}
+                </button>
+              </div>
+            </div>
+          ))
+        )}
+      </div>
+    </section>
+  );
+}

webapp/src/components/SecurityDevicesPage.tsx

@@ -2,14 +2,20 @@ import { useState } from 'preact/hooks';
 import { Clock3, Pencil, RefreshCw, ShieldCheck, ShieldOff, Trash2 } from 'lucide-preact';
 import ConfirmDialog from '@/components/ConfirmDialog';
 import LoadingState from '@/components/LoadingState';
-import type { AuthorizedDevice } from '@/lib/types';
+import PendingAuthRequestsPanel from '@/components/PendingAuthRequestsPanel';
+import type { AuthRequest, AuthorizedDevice } from '@/lib/types';
 import { t } from '@/lib/i18n';
 
 interface SecurityDevicesPageProps {
   devices: AuthorizedDevice[];
   loading: boolean;
   error: string;
+  pendingAuthRequests: AuthRequest[];
+  pendingAuthRequestsLoading: boolean;
   onRefresh: () => void;
+  onRefreshPendingAuthRequests: () => Promise<void>;
+  onApproveAuthRequest: (request: AuthRequest) => Promise<void>;
+  onDenyAuthRequest: (request: AuthRequest) => Promise<void>;
   onRenameDevice: (device: AuthorizedDevice, name: string) => Promise<void>;
   onRevokeTrust: (device: AuthorizedDevice) => void;
   onTrustPermanently: (device: AuthorizedDevice) => void;
@@ -72,43 +78,49 @@ export default function SecurityDevicesPage(props: SecurityDevicesPageProps) {
   return (
     <>
       <div className="stack">
-        <section className="card">
-        <div className="section-head">
-          <div>
-            <h3 className="flush-title">{t('txt_device_management')}</h3>
-            <div className="muted-inline section-note">
-              {t('txt_manage_device_sessions_and_30_day_totp_trusted_sessions')}
-            </div>
-          </div>
-          <div className="actions">
-            <button type="button" className="btn btn-secondary small" disabled={props.loading} onClick={props.onRefresh}>
-              <RefreshCw size={14} className="btn-icon" />
-              {t('txt_refresh')}
-            </button>
-            <button type="button" className="btn btn-danger small" onClick={props.onRevokeAll}>
-              <ShieldOff size={14} className="btn-icon" />
-              {t('txt_revoke_all_trusted')}
-            </button>
-            <button type="button" className="btn btn-danger small" onClick={props.onRemoveAll}>
-              <Trash2 size={14} className="btn-icon" />
-              {t('txt_remove_all_devices')}
-            </button>
-          </div>
-        </div>
-        </section>
+        <PendingAuthRequestsPanel
+          className="card"
+          loadingVariant="compact"
+          pendingAuthRequests={props.pendingAuthRequests}
+          pendingAuthRequestsLoading={props.pendingAuthRequestsLoading}
+          onRefreshPendingAuthRequests={props.onRefreshPendingAuthRequests}
+          onApproveAuthRequest={props.onApproveAuthRequest}
+          onDenyAuthRequest={props.onDenyAuthRequest}
+        />
 
         <section className="card">
-        <h3 className="section-title-flush">{t('txt_authorized_devices')}</h3>
-        {!!props.error && (
-          <div className="local-error">
-            <span>{props.error}</span>
-            <button type="button" className="btn btn-secondary small" disabled={props.loading} onClick={props.onRefresh}>
-              <RefreshCw size={14} className="btn-icon" />
-              {t('txt_refresh')}
-            </button>
+          <div className="section-head">
+            <div>
+              <h3 className="flush-title">{t('txt_authorized_devices')}</h3>
+              <div className="muted-inline section-note">
+                {t('txt_manage_device_sessions_and_30_day_totp_trusted_sessions')}
+              </div>
+            </div>
+            <div className="actions">
+              <button type="button" className="btn btn-secondary small" disabled={props.loading} onClick={props.onRefresh}>
+                <RefreshCw size={14} className="btn-icon" />
+                {t('txt_refresh')}
+              </button>
+              <button type="button" className="btn btn-danger small" onClick={props.onRevokeAll}>
+                <ShieldOff size={14} className="btn-icon" />
+                {t('txt_revoke_all_trusted')}
+              </button>
+              <button type="button" className="btn btn-danger small" onClick={props.onRemoveAll}>
+                <Trash2 size={14} className="btn-icon" />
+                {t('txt_remove_all_devices')}
+              </button>
+            </div>
           </div>
-        )}
-        <table className="table authorized-devices-table">
+          {!!props.error && (
+            <div className="local-error">
+              <span>{props.error}</span>
+              <button type="button" className="btn btn-secondary small" disabled={props.loading} onClick={props.onRefresh}>
+                <RefreshCw size={14} className="btn-icon" />
+                {t('txt_refresh')}
+              </button>
+            </div>
+          )}
+          <table className="table authorized-devices-table">
           <colgroup>
             <col className="authorized-devices-col-device" />
             <col className="authorized-devices-col-type" />
@@ -217,7 +229,7 @@ export default function SecurityDevicesPage(props: SecurityDevicesPageProps) {
               </tr>
             )}
           </tbody>
-        </table>
+          </table>
         </section>
       </div>
 

webapp/src/components/SettingsPage.tsx

@@ -13,7 +13,7 @@ interface SettingsPageProps {
   sessionTimeoutAction: 'lock' | 'logout';
   onChangePassword: (currentPassword: string, nextPassword: string, nextPassword2: string) => Promise<void>;
   onSavePasswordHint: (masterPasswordHint: string) => Promise<void>;
-  onEnableTotp: (secret: string, token: string) => Promise<void>;
+  onEnableTotp: (secret: string, token: string, masterPassword: string) => Promise<void>;
   onOpenDisableTotp: () => void;
   onGetRecoveryCode: (masterPassword: string) => Promise<string>;
   onGetApiKey: (masterPassword: string) => Promise<string>;
@@ -28,6 +28,7 @@ interface SettingsPageProps {
 }
 
 type MasterPasswordPromptAction =
+  | 'enableTotp'
   | 'recovery'
   | 'apiKey'
   | 'rotateApiKey'
@@ -76,6 +77,13 @@ function clearLegacyTotpSetupSecrets(): void {
   }
 }
 
+function formatDateTime(value: string | null | undefined): string {
+  if (!value) return t('txt_dash');
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return t('txt_dash');
+  return date.toLocaleString();
+}
+
 export default function SettingsPage(props: SettingsPageProps) {
   const [currentPassword, setCurrentPassword] = useState('');
   const [newPassword, setNewPassword] = useState('');
@@ -128,12 +136,12 @@ export default function SettingsPage(props: SettingsPageProps) {
   }, [props.profile.email, secret]);
 
   async function enableTotp(): Promise<void> {
-    try {
-      await props.onEnableTotp(secret, token);
-      setTotpLocked(true);
-    } catch {
-      // Keep inputs editable after a failed attempt.
+    if (totpLocked) return;
+    if (!secret.trim() || !token.trim()) {
+      props.onNotify?.('error', t('txt_secret_and_code_are_required'));
+      return;
     }
+    openMasterPasswordPrompt('enableTotp');
   }
 
   async function refreshAccountPasskeys(): Promise<void> {
@@ -165,7 +173,10 @@ export default function SettingsPage(props: SettingsPageProps) {
     const masterPassword = masterPasswordPromptValue;
     setMasterPasswordPromptSubmitting(true);
     try {
-      if (masterPasswordPrompt === 'recovery') {
+      if (masterPasswordPrompt === 'enableTotp') {
+        await props.onEnableTotp(secret, token, masterPassword);
+        setTotpLocked(true);
+      } else if (masterPasswordPrompt === 'recovery') {
         const code = await props.onGetRecoveryCode(masterPassword);
         setRecoveryCode(code);
         props.onNotify?.('success', t('txt_recovery_code_loaded'));
@@ -201,7 +212,9 @@ export default function SettingsPage(props: SettingsPageProps) {
   }
 
   const masterPasswordPromptTitle =
-    masterPasswordPrompt === 'recovery'
+    masterPasswordPrompt === 'enableTotp'
+      ? t('txt_enable_totp')
+      : masterPasswordPrompt === 'recovery'
       ? t('txt_view_recovery_code')
       : masterPasswordPrompt === 'rotateApiKey'
         ? t('txt_rotate_api_key')
@@ -219,13 +232,6 @@ export default function SettingsPage(props: SettingsPageProps) {
     return t('txt_prf_not_supported');
   }
 
-  function formatDateTime(value: string | null | undefined): string {
-    if (!value) return t('txt_dash');
-    const parsed = new Date(value);
-    if (Number.isNaN(parsed.getTime())) return value;
-    return parsed.toLocaleString();
-  }
-
   async function changeLocale(next: Locale): Promise<void> {
     if (next === getLocale()) return;
     setSelectedLocale(next);
@@ -503,7 +509,6 @@ export default function SettingsPage(props: SettingsPageProps) {
           )}
         </div>
       </section>
-
       <section className="settings-module sensitive-actions-module">
         <div className="sensitive-actions-grid">
           <div className="sensitive-action">

webapp/src/components/ThemeSwitch.tsx

@@ -7,7 +7,7 @@ interface ThemeSwitchProps {
 export default function ThemeSwitch(props: ThemeSwitchProps) {
   return (
     <div className="theme-switch-wrap" title={props.title}>
-      <label className="theme-switch" aria-label={props.title}>
+      <label className={`theme-switch ${props.checked ? 'checked' : 'unchecked'}`} aria-label={props.title}>
         <span className="sun" aria-hidden="true">
           <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24">
             <g fill="#ffd43b">

webapp/src/components/ToastHost.tsx

@@ -12,8 +12,10 @@ export default function ToastHost({ toasts, onClose }: ToastHostProps) {
       {toasts.map((toast) => (
         <li key={toast.id} className={`toast-item ${toast.type}`}>
           <div className="toast-text">{toast.text}</div>
-          <button type="button" className="toast-close" onClick={() => onClose(toast.id)}>
-            x
+          <button type="button" className="toast-close" onClick={() => onClose(toast.id)} aria-label="关闭通知">
+            <svg width="14" height="14" viewBox="0 0 14 14" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" aria-hidden="true">
+              <path d="M3 3l8 8M11 3l-8 8" />
+            </svg>
           </button>
           <div className="toast-progress" />
         </li>

webapp/src/components/TotpCodesPage.tsx

@@ -6,7 +6,7 @@ import { t } from '@/lib/i18n';
 import type { Cipher } from '@/lib/types';
 import LoadingState from '@/components/LoadingState';
 import WebsiteIcon from '@/components/vault/WebsiteIcon';
-import { isCipherVisibleInNormalVault } from '@/components/vault/vault-page-helpers';
+import { formatTotp, isCipherVisibleInNormalVault } from '@/components/vault/vault-page-helpers';
 
 interface TotpCodesPageProps {
   ciphers: Cipher[];
@@ -26,13 +26,6 @@ function getTotpTimeState(): { windowId: number; remain: number } {
   };
 }
 
-function formatTotp(code: string): string {
-  if (!code) return code;
-  if (code.length === 5) return `${code.slice(0, 2)} ${code.slice(2)}`;
-  if (code.length < 6) return code;
-  return `${code.slice(0, 3)} ${code.slice(3, 6)}`;
-}
-
 function TotpListIcon({ cipher }: { cipher: Cipher }) {
   return <WebsiteIcon cipher={cipher} fallback={<Globe size={18} />} />;
 }

webapp/src/components/VaultPage.tsx

@@ -17,13 +17,14 @@ import {
   createEmptyDraft,
   creationTimeValue,
   draftFromCipher,
-  buildCipherDuplicateSignature,
+  buildCipherDuplicateSignatures,
   firstCipherUri,
   firstPasskeyCreationTime,
   isCipherVisibleInArchive,
   isCipherVisibleInNormalVault,
   isCipherVisibleInTrash,
   sortTimeValue,
+  type DuplicateDetectionMode,
   type SidebarFilter,
   type VaultSortMode,
 } from '@/components/vault/vault-page-helpers';
@@ -79,6 +80,7 @@ export default function VaultPage(props: VaultPageProps) {
   const [sortMenuOpen, setSortMenuOpen] = useState(false);
   const [folderSortMode, setFolderSortMode] = useState<VaultSortMode>('name');
   const [folderSortMenuOpen, setFolderSortMenuOpen] = useState(false);
+  const [duplicateMode, setDuplicateMode] = useState<DuplicateDetectionMode>('exact');
   const [sidebarFilter, setSidebarFilter] = useState<SidebarFilter>({ kind: 'all' });
   const [selectedCipherId, setSelectedCipherId] = useState('');
   const [selectedMap, setSelectedMap] = useState<Record<string, boolean>>({});
@@ -338,16 +340,41 @@ export default function VaultPage(props: VaultPageProps) {
 
   const duplicateSignatureInfo = useMemo(() => {
     if (sidebarFilter.kind !== 'duplicates') return null;
-    const byId = new Map<string, string>();
+    const byId = new Map<string, string[]>();
     const counts = new Map<string, number>();
     for (const cipher of props.ciphers) {
       if (!isCipherVisibleInNormalVault(cipher)) continue;
-      const signature = buildCipherDuplicateSignature(cipher);
-      byId.set(cipher.id, signature);
-      counts.set(signature, (counts.get(signature) || 0) + 1);
+      const signatures = Array.from(new Set(buildCipherDuplicateSignatures(cipher, duplicateMode)));
+      byId.set(cipher.id, signatures);
+      for (const signature of signatures) {
+        counts.set(signature, (counts.get(signature) || 0) + 1);
+      }
     }
     return { byId, counts };
-  }, [props.ciphers, sidebarFilter.kind]);
+  }, [props.ciphers, sidebarFilter.kind, duplicateMode]);
+
+  const duplicateGroupIndexById = useMemo(() => {
+    if (!duplicateSignatureInfo) return new Map<string, number>();
+    const groupKeyById = new Map<string, string>();
+    const groupKeys = new Set<string>();
+    for (const cipher of props.ciphers) {
+      const groupKey = (duplicateSignatureInfo.byId.get(cipher.id) || [])
+        .filter((signature) => (duplicateSignatureInfo.counts.get(signature) || 0) >= 2)
+        .sort()[0];
+      if (!groupKey) continue;
+      groupKeyById.set(cipher.id, groupKey);
+      groupKeys.add(groupKey);
+    }
+    const groupIndexByKey = new Map<string, number>();
+    Array.from(groupKeys).sort().forEach((groupKey, index) => {
+      groupIndexByKey.set(groupKey, index % 64);
+    });
+    const byId = new Map<string, number>();
+    for (const [cipherId, groupKey] of groupKeyById.entries()) {
+      byId.set(cipherId, groupIndexByKey.get(groupKey) || 0);
+    }
+    return byId;
+  }, [props.ciphers, duplicateSignatureInfo]);
 
   const filteredCiphers = useMemo(() => {
     const next = props.ciphers.filter((cipher) => {
@@ -358,8 +385,11 @@ export default function VaultPage(props: VaultPageProps) {
         if (!isCipherVisibleInArchive(cipher)) return false;
       } else {
         if (!isCipherVisibleInNormalVault(cipher)) return false;
-        if (sidebarFilter.kind === 'duplicates' && ((duplicateSignatureInfo?.counts.get(duplicateSignatureInfo.byId.get(cipher.id) || '') || 0) < 2)) {
-          return false;
+        if (sidebarFilter.kind === 'duplicates') {
+          const signatures = duplicateSignatureInfo?.byId.get(cipher.id) || [];
+          if (!signatures.some((signature) => (duplicateSignatureInfo?.counts.get(signature) || 0) >= 2)) {
+            return false;
+          }
         }
         if (sidebarFilter.kind === 'favorite' && !cipher.favorite) return false;
         if (sidebarFilter.kind === 'type' && meta?.typeKey !== sidebarFilter.value) return false;
@@ -404,8 +434,9 @@ export default function VaultPage(props: VaultPageProps) {
   const sidebarFilterKey = useMemo(() => {
     if (sidebarFilter.kind === 'folder') return `folder:${sidebarFilter.folderId ?? 'none'}`;
     if (sidebarFilter.kind === 'type') return `type:${sidebarFilter.value}`;
+    if (sidebarFilter.kind === 'duplicates') return `duplicates:${duplicateMode}`;
     return sidebarFilter.kind;
-  }, [sidebarFilter]);
+  }, [sidebarFilter, duplicateMode]);
 
   useEffect(() => {
     setListScrollTop(0);
@@ -419,6 +450,10 @@ export default function VaultPage(props: VaultPageProps) {
     }
   }, [sidebarFilter.kind, sortMode]);
 
+  useEffect(() => {
+    if (sidebarFilter.kind === 'duplicates') setSelectedMap({});
+  }, [sidebarFilter.kind, duplicateMode]);
+
   useEffect(() => {
     if (isCreating) return;
     if (!filteredCiphers.length) {
@@ -984,10 +1019,11 @@ const folderName = useCallback((id: string | null | undefined): string => {
   const handleSyncVault = useCallback(() => { void syncVault(); }, [props.onRefresh]);
   const handleOpenBulkDelete = useCallback(() => setBulkDeleteOpen(true), []);
   const handleSelectDuplicates = useCallback(() => {
+    if (duplicateMode !== 'exact') return;
     const map: Record<string, boolean> = {};
     const seen = new Set<string>();
     for (const cipher of filteredCiphers) {
-      const signature = duplicateSignatureInfo?.byId.get(cipher.id) || buildCipherDuplicateSignature(cipher);
+      const signature = duplicateSignatureInfo?.byId.get(cipher.id)?.[0] || buildCipherDuplicateSignatures(cipher, 'exact')[0];
       if (seen.has(signature)) {
         map[cipher.id] = true;
         continue;
@@ -995,7 +1031,7 @@ const folderName = useCallback((id: string | null | undefined): string => {
       seen.add(signature);
     }
     setSelectedMap(map);
-  }, [filteredCiphers, duplicateSignatureInfo]);
+  }, [filteredCiphers, duplicateSignatureInfo, duplicateMode]);
   const handleSelectAll = useCallback(() => {
     const map: Record<string, boolean> = {};
     for (const cipher of filteredCiphers) map[cipher.id] = true;
@@ -1079,13 +1115,16 @@ const folderName = useCallback((id: string | null | undefined): string => {
           busy={busy}
           loading={props.loading}
           error={props.error}
+          folders={props.folders}
           searchInput={searchInput}
           sortMode={sortMode}
           sortMenuOpen={sortMenuOpen}
+          duplicateMode={duplicateMode}
           selectedCount={selectedCount}
           totalCipherCount={totalCipherCount}
           filteredCiphers={filteredCiphers}
           visibleCiphers={visibleCiphers}
+          duplicateGroupIndexById={duplicateGroupIndexById}
           virtualRange={virtualRange}
           selectedCipherId={selectedCipherId}
           selectedMap={selectedMap}
@@ -1102,6 +1141,8 @@ const folderName = useCallback((id: string | null | undefined): string => {
           onSearchCompositionEnd={handleSearchCompositionEnd}
           onToggleSortMenu={handleToggleSortMenu}
           onSelectSortMode={handleSelectSortMode}
+          onDuplicateModeChange={setDuplicateMode}
+          onChangeFilter={setSidebarFilter}
           onSyncVault={handleSyncVault}
           onOpenBulkDelete={handleOpenBulkDelete}
           onSelectDuplicates={handleSelectDuplicates}

webapp/src/components/backup-center/BackupDestinationDetail.tsx

@@ -2,6 +2,7 @@ import { CloudUpload, Save, Trash2 } from 'lucide-preact';
 import type {
   BackupDestinationRecord,
   RemoteBackupBrowserResponse,
+  S3BackupAddressingStyle,
   S3BackupDestination,
   WebDavBackupDestination,
 } from '@/lib/api/backup';
@@ -53,21 +54,18 @@ function renderRecommendedProviderDetails(provider: RecommendedProvider) {
         <>
           <div className="backup-recommendation-steps">
             <div className="backup-recommendation-step">
-              <strong>1.</strong> {t('txt_backup_recommend_koofr_step_1')}
-            </div>
-            <div className="backup-recommendation-step">
-              <strong>2.</strong> {t('txt_backup_recommend_koofr_step_2_prefix')}{' '}
+              <strong>1.</strong> {t('txt_backup_recommend_koofr_step_2_prefix')}{' '}
               <a href={provider.passwordUrl} target="_blank" rel="noreferrer">{t('txt_backup_recommend_koofr_password_link')}</a>
               {t('txt_backup_recommend_koofr_step_2_suffix')}
             </div>
             <div className="backup-recommendation-step">
-              <strong>3.</strong> {t('txt_backup_recommend_koofr_step_3')}
+              <strong>2.</strong> {t('txt_backup_recommend_koofr_step_3')}
             </div>
             <div className="backup-recommendation-step">
-              <strong>4.</strong> {t('txt_backup_recommend_koofr_step_4')}
+              <strong>3.</strong> {t('txt_backup_recommend_koofr_step_4')}
             </div>
             <div className="backup-recommendation-step">
-              <strong>5.</strong> {t('txt_backup_recommend_koofr_step_5_prefix')}{' '}
+              <strong>4.</strong> {t('txt_backup_recommend_koofr_step_5_prefix')}{' '}
               <a href={provider.storageUrl} target="_blank" rel="noreferrer">{t('txt_backup_recommend_koofr_storage_link')}</a>
               {t('txt_backup_recommend_koofr_step_5_suffix')}
             </div>
@@ -97,13 +95,10 @@ function renderRecommendedProviderDetails(provider: RecommendedProvider) {
       return (
         <div className="backup-recommendation-steps">
           <div className="backup-recommendation-step">
-            <strong>1.</strong> {t('txt_backup_recommend_pcloud_step_1')}
+            <strong>1.</strong> {t('txt_backup_recommend_pcloud_step_2')}
           </div>
           <div className="backup-recommendation-step">
-            <strong>2.</strong> {t('txt_backup_recommend_pcloud_step_2')}
-          </div>
-          <div className="backup-recommendation-step">
-            <strong>3.</strong> {t('txt_backup_recommend_pcloud_step_3')}
+            <strong>2.</strong> {t('txt_backup_recommend_pcloud_step_3')}
           </div>
         </div>
       );
@@ -111,18 +106,87 @@ function renderRecommendedProviderDetails(provider: RecommendedProvider) {
       return (
         <div className="backup-recommendation-steps">
           <div className="backup-recommendation-step">
-            <strong>1.</strong> {t('txt_backup_recommend_infinicloud_step_1')}
-          </div>
-          <div className="backup-recommendation-step">
-            <strong>2.</strong> {t('txt_backup_recommend_infinicloud_step_2_prefix')}{' '}
+            <strong>1.</strong> {t('txt_backup_recommend_infinicloud_step_2_prefix')}{' '}
             <a href="https://infini-cloud.net/en/modules/mypage/usage/" target="_blank" rel="noreferrer">My Page</a>
             {t('txt_backup_recommend_infinicloud_step_2_suffix')}
           </div>
           <div className="backup-recommendation-step">
-            <strong>3.</strong> {t('txt_backup_recommend_infinicloud_step_3')}
+            <strong>2.</strong> {t('txt_backup_recommend_infinicloud_step_3')}
           </div>
           <div className="backup-recommendation-step">
-            <strong>4.</strong> {t('txt_backup_recommend_infinicloud_step_4')}
+            <strong>3.</strong> {t('txt_backup_recommend_infinicloud_step_4')}
+          </div>
+        </div>
+      );
+    case 'backblaze-b2':
+      return (
+        <div className="backup-recommendation-steps">
+          <div className="backup-recommendation-step">
+            <strong>1.</strong> {t('txt_backup_recommend_backblaze_step_2_prefix')}{' '}
+            <a href={provider.bucketsUrl} target="_blank" rel="noreferrer">Buckets</a>
+            {t('txt_backup_recommend_backblaze_step_2_suffix')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>2.</strong> {t('txt_backup_recommend_backblaze_step_3')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>3.</strong> {t('txt_backup_recommend_backblaze_step_4_prefix')}{' '}
+            <a href={provider.applicationKeysUrl} target="_blank" rel="noreferrer">Application Keys</a>
+            {t('txt_backup_recommend_backblaze_step_4_suffix')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>4.</strong> {t('txt_backup_recommend_backblaze_step_5')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>5.</strong> {t('txt_backup_recommend_s3_path_prefix_step')}
+          </div>
+        </div>
+      );
+    case 'cloudflare-r2':
+      return (
+        <div className="backup-recommendation-steps">
+          <div className="backup-recommendation-step">
+            <strong>1.</strong> {t('txt_backup_recommend_cloudflare_r2_step_1_prefix')}{' '}
+            <a href={provider.bucketUrl} target="_blank" rel="noreferrer">{t('txt_backup_recommend_cloudflare_r2_bucket_link')}</a>
+            {t('txt_backup_recommend_cloudflare_r2_step_1_suffix')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>2.</strong> {t('txt_backup_recommend_cloudflare_r2_step_2_prefix')}{' '}
+            <a href={provider.apiTokenUrl} target="_blank" rel="noreferrer">{t('txt_backup_recommend_cloudflare_r2_api_link')}</a>
+            {t('txt_backup_recommend_cloudflare_r2_step_2_suffix')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>3.</strong> {t('txt_backup_recommend_cloudflare_r2_step_3')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>4.</strong> {t('txt_backup_recommend_cloudflare_r2_step_4')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>5.</strong> {t('txt_backup_recommend_cloudflare_r2_step_5')}
+          </div>
+        </div>
+      );
+    case 'tigris':
+      return (
+        <div className="backup-recommendation-steps">
+          <div className="backup-recommendation-step">
+            <strong>1.</strong> {t('txt_backup_recommend_tigris_step_2_prefix')}{' '}
+            <a href={provider.bucketUrl} target="_blank" rel="noreferrer">Create Bucket</a>
+            {t('txt_backup_recommend_tigris_step_2_suffix')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>2.</strong> {t('txt_backup_recommend_tigris_step_3_prefix')}{' '}
+            <a href={provider.accessKeyUrl} target="_blank" rel="noreferrer">{t('txt_backup_recommend_tigris_access_key_link')}</a>
+            {t('txt_backup_recommend_tigris_step_3_suffix')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>3.</strong> {t('txt_backup_recommend_tigris_step_4')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>4.</strong> {t('txt_backup_recommend_tigris_step_5')}
+          </div>
+          <div className="backup-recommendation-step">
+            <strong>5.</strong> {t('txt_backup_recommend_s3_path_prefix_step')}
           </div>
         </div>
       );
@@ -146,6 +210,9 @@ export function BackupDestinationDetail(props: BackupDestinationDetailProps) {
               <div className="backup-inline-note">
                 {props.selectedRecommendedProvider.id === 'infinicloud' ? t('txt_backup_recommend_infinicloud_summary')
                   : props.selectedRecommendedProvider.id === 'koofr' ? t('txt_backup_recommend_koofr_summary')
+                    : props.selectedRecommendedProvider.id === 'backblaze-b2' ? t('txt_backup_recommend_backblaze_summary')
+                      : props.selectedRecommendedProvider.id === 'cloudflare-r2' ? t('txt_backup_recommend_cloudflare_r2_summary')
+                        : props.selectedRecommendedProvider.id === 'tigris' ? t('txt_backup_recommend_tigris_summary')
                     : t('txt_backup_recommend_pcloud_summary')}
               </div>
             </div>
@@ -386,7 +453,7 @@ export function BackupDestinationDetail(props: BackupDestinationDetailProps) {
                   className="input"
                   value={(props.selectedDestination.destination as WebDavBackupDestination).remotePath}
                   disabled={props.loadingSettings || props.disableWhileBusy}
-                  placeholder="nodewarden/backups"
+                  placeholder="nodewarden"
                   onInput={(event) => props.onUpdateDestination((destination) => ({
                     ...destination,
                     destination: {
@@ -401,7 +468,7 @@ export function BackupDestinationDetail(props: BackupDestinationDetailProps) {
 
           {props.selectedDestination.type === 's3' ? (
             <div className="field-grid">
-              <label className="field field-span-2">
+              <label className="field">
                 <span>{t('txt_backup_s3_endpoint')}</span>
                 <input
                   className="input"
@@ -417,6 +484,24 @@ export function BackupDestinationDetail(props: BackupDestinationDetailProps) {
                   }))}
                 />
               </label>
+              <label className="field">
+                <span>{t('txt_backup_s3_addressing_style')}</span>
+                <select
+                  className="input"
+                  value={(props.selectedDestination.destination as S3BackupDestination).addressingStyle || 'path-style'}
+                  disabled={props.loadingSettings || props.disableWhileBusy}
+                  onChange={(event) => props.onUpdateDestination((destination) => ({
+                    ...destination,
+                    destination: {
+                      ...(destination.destination as S3BackupDestination),
+                      addressingStyle: (event.currentTarget as HTMLSelectElement).value as S3BackupAddressingStyle,
+                    },
+                  }))}
+                >
+                  <option value="path-style">{t('txt_backup_s3_addressing_path_style')}</option>
+                  <option value="virtual-hosted-style">{t('txt_backup_s3_addressing_virtual_hosted_style')}</option>
+                </select>
+              </label>
               <label className="field">
                 <span>{t('txt_backup_s3_bucket')}</span>
                 <input
@@ -485,7 +570,7 @@ export function BackupDestinationDetail(props: BackupDestinationDetailProps) {
                   className="input"
                   value={(props.selectedDestination.destination as S3BackupDestination).rootPath}
                   disabled={props.loadingSettings || props.disableWhileBusy}
-                  placeholder="nodewarden/backups"
+                  placeholder=""
                   onInput={(event) => props.onUpdateDestination((destination) => ({
                     ...destination,
                     destination: {

webapp/src/components/backup-center/BackupOperationsSidebar.tsx

@@ -1,9 +1,12 @@
 import { Download, FileUp } from 'lucide-preact';
+import { useEffect, useState } from 'preact/hooks';
 import type { RecommendedProvider } from '@/lib/backup-recommendations';
 import { hasLinkedStorages } from '@/lib/backup-recommendations';
 import { t } from '@/lib/i18n';
 import { BackupIncludeAttachmentsField } from './BackupIncludeAttachmentsField';
 
+const MOBILE_RECOMMENDATIONS_QUERY = '(max-width: 760px)';
+
 interface BackupOperationsSidebarProps {
   disableWhileBusy: boolean;
   exporting: boolean;
@@ -18,7 +21,30 @@ interface BackupOperationsSidebarProps {
   onSelectProvider: (providerId: string) => void;
 }
 
+function getDefaultRecommendationsOpen() {
+  if (typeof window === 'undefined' || typeof window.matchMedia !== 'function') {
+    return true;
+  }
+  return !window.matchMedia(MOBILE_RECOMMENDATIONS_QUERY).matches;
+}
+
 export function BackupOperationsSidebar(props: BackupOperationsSidebarProps) {
+  const [recommendationsOpen, setRecommendationsOpen] = useState(getDefaultRecommendationsOpen);
+  const [recommendationsTouched, setRecommendationsTouched] = useState(false);
+
+  useEffect(() => {
+    if (typeof window === 'undefined' || typeof window.matchMedia !== 'function' || recommendationsTouched) {
+      return;
+    }
+
+    const media = window.matchMedia(MOBILE_RECOMMENDATIONS_QUERY);
+    const syncOpenState = () => setRecommendationsOpen(!media.matches);
+
+    syncOpenState();
+    media.addEventListener('change', syncOpenState);
+    return () => media.removeEventListener('change', syncOpenState);
+  }, [recommendationsTouched]);
+
   return (
     <aside className="backup-operations-sidebar">
       <div className="section-head">
@@ -41,7 +67,14 @@ export function BackupOperationsSidebar(props: BackupOperationsSidebarProps) {
         </button>
       </div>
 
-      <details className="backup-recommendations-disclosure">
+      <details
+        className="backup-recommendations-disclosure"
+        open={recommendationsOpen}
+        onToggle={(event) => {
+          setRecommendationsTouched(true);
+          setRecommendationsOpen((event.currentTarget as HTMLDetailsElement).open);
+        }}
+      >
         <summary className="backup-recommendations-summary">
           <span>
             <strong>{t('txt_backup_recommend_title')}</strong>

webapp/src/components/backup-center/RemoteBackupBrowser.tsx

@@ -1,4 +1,4 @@
-import { Download, FileArchive, FolderOpen, RefreshCw, RotateCcw, Trash2 } from 'lucide-preact';
+import { Download, FileArchive, FolderOpen, FolderUp, RefreshCw, RotateCcw, Trash2 } from 'lucide-preact';
 import type { RemoteBackupBrowserResponse } from '@/lib/api/backup';
 import { formatBytes, formatDateTime, isZipCandidate } from '@/lib/backup-center';
 import { t } from '@/lib/i18n';
@@ -32,26 +32,32 @@ export function RemoteBackupBrowser(props: RemoteBackupBrowserProps) {
       : t('txt_downloading_percent', { percent: props.downloadingRemotePercent });
   };
 
+  const renderRefreshPrompt = () => (
+    <div className="backup-browser-empty">
+      <span className="backup-browser-refresh-prompt">
+        <span>{t('txt_backup_remote_cached_empty_prefix')}</span>
+        <button type="button" className="btn btn-secondary small" disabled={!props.canBrowse || props.loadingRemoteBrowser || props.disableWhileBusy} onClick={props.onRefresh}>
+          {t('txt_backup_remote_refresh')}
+        </button>
+        <span>{t('txt_backup_remote_cached_empty_suffix')}</span>
+      </span>
+    </div>
+  );
+
   return (
     <>
       <div className="backup-divider" />
 
       <div className="section-head">
         <h3>{t('txt_backup_remote_title')}</h3>
-        {props.canBrowse ? (
-          <div className="actions">
-            <button type="button" className="btn btn-secondary small" disabled={props.loadingRemoteBrowser || props.disableWhileBusy} onClick={props.onRefresh}>
-              <RefreshCw size={14} className="btn-icon" />
-              {t('txt_backup_remote_refresh')}
-            </button>
-          </div>
-        ) : null}
       </div>
 
       {!props.destinationIsSaved ? (
         <div className="backup-browser-empty">{t('txt_backup_remote_save_first')}</div>
+      ) : props.loadingRemoteBrowser && !props.remoteBrowser ? (
+        <div className="backup-browser-empty">{t('txt_backup_remote_loading')}</div>
       ) : !props.remoteBrowser ? (
-        <div className="backup-browser-empty">{t('txt_backup_remote_cached_empty')}</div>
+        renderRefreshPrompt()
       ) : (
         <>
           <div className="backup-browser-path">
@@ -59,20 +65,28 @@ export function RemoteBackupBrowser(props: RemoteBackupBrowserProps) {
             <span>{props.remoteBrowser.currentPath ? `/${props.remoteBrowser.currentPath}` : '/'}</span>
           </div>
 
-          <div className="actions backup-browser-nav">
-            <button type="button" className="btn btn-secondary small" disabled={props.loadingRemoteBrowser || props.disableWhileBusy} onClick={() => props.onShowPath('')}>
-              <FolderOpen size={14} className="btn-icon" />
-              {t('txt_backup_remote_root')}
-            </button>
-            <button
-              type="button"
-              className="btn btn-secondary small"
-              disabled={props.loadingRemoteBrowser || props.disableWhileBusy || props.remoteBrowser.parentPath === null}
-              onClick={() => props.onShowPath(props.remoteBrowser?.parentPath || '')}
-            >
-              <RotateCcw size={14} className="btn-icon" />
-              {t('txt_backup_remote_up')}
-            </button>
+          <div className="backup-browser-nav">
+            <div className="actions backup-browser-nav-left">
+              <button type="button" className="btn btn-secondary small" disabled={props.loadingRemoteBrowser || props.disableWhileBusy} onClick={() => props.onShowPath('')}>
+                <FolderOpen size={14} className="btn-icon" />
+                {t('txt_backup_remote_root')}
+              </button>
+              <button
+                type="button"
+                className="btn btn-secondary small"
+                disabled={props.loadingRemoteBrowser || props.disableWhileBusy || props.remoteBrowser.parentPath === null}
+                onClick={() => props.onShowPath(props.remoteBrowser?.parentPath || '')}
+              >
+                <FolderUp size={14} className="btn-icon" />
+                {t('txt_backup_remote_up')}
+              </button>
+            </div>
+            {props.canBrowse ? (
+              <button type="button" className="btn btn-secondary small" disabled={props.loadingRemoteBrowser || props.disableWhileBusy} onClick={props.onRefresh}>
+                <RefreshCw size={14} className="btn-icon" />
+                {t('txt_backup_remote_refresh')}
+              </button>
+            ) : null}
           </div>
 
           {props.loadingRemoteBrowser ? (
@@ -80,6 +94,12 @@ export function RemoteBackupBrowser(props: RemoteBackupBrowserProps) {
           ) : props.remoteBrowser.items.length ? (
             <>
               <div className="backup-browser-list">
+                <div className="backup-browser-head" aria-hidden="true">
+                  <span>{t('txt_name')}</span>
+                  <span>{t('txt_backup_remote_modified')}</span>
+                  <span>{t('txt_backup_remote_size')}</span>
+                  <span>{t('txt_actions')}</span>
+                </div>
                 {props.visibleItems.map((item) => (
                   <div key={`${item.isDirectory ? 'd' : 'f'}:${item.path}`} className="backup-browser-row">
                     <button
@@ -92,10 +112,12 @@ export function RemoteBackupBrowser(props: RemoteBackupBrowserProps) {
                       {item.isDirectory ? <FolderOpen size={16} className="btn-icon" /> : <FileArchive size={16} className="btn-icon" />}
                       <span className="backup-browser-name">{item.name}</span>
                     </button>
-                    <div className="backup-browser-meta">
-                      <span>{item.modifiedAt ? formatDateTime(item.modifiedAt) : t('txt_backup_remote_unknown_time')}</span>
-                      <span>{item.isDirectory ? t('txt_backup_remote_folder') : formatBytes(item.size)}</span>
-                    </div>
+                    <span className="backup-browser-meta backup-browser-modified">
+                      {item.modifiedAt ? formatDateTime(item.modifiedAt) : t('txt_backup_remote_unknown_time')}
+                    </span>
+                    <span className="backup-browser-meta backup-browser-size">
+                      {item.isDirectory ? t('txt_backup_remote_folder') : formatBytes(item.size)}
+                    </span>
                     <div className="actions backup-browser-actions">
                       {item.isDirectory ? (
                         <button type="button" className="btn btn-secondary small" onClick={() => props.onShowPath(item.path)}>

webapp/src/components/vault/VaultListPanel.tsx

@@ -1,15 +1,40 @@
-import type { RefObject } from 'preact';
+import type { ComponentChildren, RefObject } from 'preact';
+import { useEffect, useRef, useState } from 'preact/hooks';
 import { memo } from 'preact/compat';
 import { createPortal } from 'preact/compat';
-import { Archive, ArrowUpDown, Check, CheckCheck, FolderInput, Plus, RefreshCw, RotateCcw, Trash2, X } from 'lucide-preact';
+import {
+  Archive,
+  ArrowUpDown,
+  Check,
+  CheckCheck,
+  ChevronDown,
+  Copy,
+  CreditCard,
+  Folder as FolderIcon,
+  FolderInput,
+  FolderX,
+  Globe,
+  KeyRound,
+  LayoutGrid,
+  Plus,
+  RefreshCw,
+  RotateCcw,
+  ShieldUser,
+  Star,
+  StickyNote,
+  Trash2,
+  X,
+} from 'lucide-preact';
 import LoadingState from '@/components/LoadingState';
-import type { Cipher } from '@/lib/types';
+import type { Cipher, Folder } from '@/lib/types';
 import { t } from '@/lib/i18n';
 import {
   CreateTypeIcon,
   getCreateTypeOptions,
+  getDuplicateDetectionOptions,
   getVaultSortOptions,
   VaultListIcon,
+  type DuplicateDetectionMode,
   type SidebarFilter,
   type VaultSortMode,
 } from '@/components/vault/vault-page-helpers';
@@ -25,13 +50,16 @@ interface VaultListPanelProps {
   busy: boolean;
   loading: boolean;
   error: string;
+  folders: Folder[];
   searchInput: string;
   sortMode: VaultSortMode;
   sortMenuOpen: boolean;
+  duplicateMode: DuplicateDetectionMode;
   selectedCount: number;
   totalCipherCount: number;
   filteredCiphers: Cipher[];
   visibleCiphers: Cipher[];
+  duplicateGroupIndexById: Map<string, number>;
   virtualRange: VirtualRange;
   selectedCipherId: string;
   selectedMap: Record<string, boolean>;
@@ -48,6 +76,8 @@ interface VaultListPanelProps {
   onSearchCompositionEnd: (value: string) => void;
   onToggleSortMenu: () => void;
   onSelectSortMode: (value: VaultSortMode) => void;
+  onDuplicateModeChange: (value: DuplicateDetectionMode) => void;
+  onChangeFilter: (filter: SidebarFilter) => void;
   onSyncVault: () => void;
   onOpenBulkDelete: () => void;
   onSelectDuplicates: () => void;
@@ -69,15 +99,28 @@ interface CipherListItemProps {
   cipher: Cipher;
   selected: boolean;
   checked: boolean;
+  duplicateGroupIndex: number | null;
   subtitle: string;
   onToggleSelected: (cipherId: string, checked: boolean) => void;
   onSelectCipher: (cipherId: string) => void;
 }
 
+type MobileFilterMenuKey = 'duplicate' | 'menu' | 'type' | 'folder';
+
+interface MobileFilterOption {
+  value: string;
+  label: string;
+  icon: ComponentChildren;
+  active: boolean;
+  onSelect: () => void;
+}
+
 const CipherListItem = memo(function CipherListItem(props: CipherListItemProps) {
+  const duplicateGroupHue = props.duplicateGroupIndex === null ? null : (props.duplicateGroupIndex * 137.508) % 360;
   return (
     <div
-      className={`list-item ${props.selected ? 'active' : ''}`}
+      className={`list-item ${props.selected ? 'active' : ''} ${duplicateGroupHue === null ? '' : 'duplicate-group-item'}`}
+      style={duplicateGroupHue === null ? undefined : { '--duplicate-group-hue': `${duplicateGroupHue}deg` }}
       onClick={(event) => {
         const target = event.target as HTMLElement;
         if (target.closest('.row-check')) return;
@@ -107,13 +150,116 @@ const CipherListItem = memo(function CipherListItem(props: CipherListItemProps)
 });
 
 export default function VaultListPanel(props: VaultListPanelProps) {
+  const [mobileFilterOpen, setMobileFilterOpen] = useState<MobileFilterMenuKey | null>(null);
+  const mobileFilterRef = useRef<HTMLDivElement | null>(null);
   const createTypeOptions = getCreateTypeOptions();
+  const duplicateDetectionOptions = getDuplicateDetectionOptions();
   const vaultSortOptions = getVaultSortOptions();
-  const createMenu = (
-    <div className="create-menu-wrap mobile-fab-wrap" ref={props.createMenuRef}>
+  const duplicateModeOptions: MobileFilterOption[] = duplicateDetectionOptions.map((option) => ({
+    value: option.value,
+    label: option.label,
+    icon: option.value === 'login-site' ? <Globe size={14} /> : option.value === 'exact' ? <Copy size={14} /> : <KeyRound size={14} />,
+    active: props.duplicateMode === option.value,
+    onSelect: () => props.onDuplicateModeChange(option.value),
+  }));
+  const menuFilterOptions: MobileFilterOption[] = [
+    { value: 'all', label: t('txt_all_items'), icon: <LayoutGrid size={14} />, active: props.sidebarFilter.kind === 'all', onSelect: () => props.onChangeFilter({ kind: 'all' }) },
+    { value: 'favorite', label: t('txt_favorites'), icon: <Star size={14} />, active: props.sidebarFilter.kind === 'favorite', onSelect: () => props.onChangeFilter({ kind: 'favorite' }) },
+    { value: 'archive', label: t('txt_archive'), icon: <Archive size={14} />, active: props.sidebarFilter.kind === 'archive', onSelect: () => props.onChangeFilter({ kind: 'archive' }) },
+    { value: 'trash', label: t('txt_trash'), icon: <Trash2 size={14} />, active: props.sidebarFilter.kind === 'trash', onSelect: () => props.onChangeFilter({ kind: 'trash' }) },
+    { value: 'duplicates', label: t('txt_duplicates'), icon: <Copy size={14} />, active: props.sidebarFilter.kind === 'duplicates', onSelect: () => props.onChangeFilter({ kind: 'duplicates' }) },
+  ];
+  const typeMobileFilterOptions: MobileFilterOption[] = [
+    { value: 'login', label: t('txt_login'), icon: <Globe size={14} />, active: props.sidebarFilter.kind === 'type' && props.sidebarFilter.value === 'login', onSelect: () => props.onChangeFilter({ kind: 'type', value: 'login' }) },
+    { value: 'card', label: t('txt_card'), icon: <CreditCard size={14} />, active: props.sidebarFilter.kind === 'type' && props.sidebarFilter.value === 'card', onSelect: () => props.onChangeFilter({ kind: 'type', value: 'card' }) },
+    { value: 'identity', label: t('txt_identity'), icon: <ShieldUser size={14} />, active: props.sidebarFilter.kind === 'type' && props.sidebarFilter.value === 'identity', onSelect: () => props.onChangeFilter({ kind: 'type', value: 'identity' }) },
+    { value: 'note', label: t('txt_note'), icon: <StickyNote size={14} />, active: props.sidebarFilter.kind === 'type' && props.sidebarFilter.value === 'note', onSelect: () => props.onChangeFilter({ kind: 'type', value: 'note' }) },
+    { value: 'ssh', label: t('txt_ssh_key'), icon: <KeyRound size={14} />, active: props.sidebarFilter.kind === 'type' && props.sidebarFilter.value === 'ssh', onSelect: () => props.onChangeFilter({ kind: 'type', value: 'ssh' }) },
+  ];
+  const folderMobileFilterOptions: MobileFilterOption[] = [
+    { value: '__none__', label: t('txt_no_folder'), icon: <FolderX size={14} />, active: props.sidebarFilter.kind === 'folder' && props.sidebarFilter.folderId === null, onSelect: () => props.onChangeFilter({ kind: 'folder', folderId: null }) },
+    ...props.folders.map((folder) => ({
+      value: folder.id,
+      label: folder.decName || folder.name || folder.id,
+      icon: <FolderIcon size={14} />,
+      active: props.sidebarFilter.kind === 'folder' && props.sidebarFilter.folderId === folder.id,
+      onSelect: () => props.onChangeFilter({ kind: 'folder', folderId: folder.id }),
+    })),
+  ];
+  const menuFilterSelected = menuFilterOptions.find((option) => option.active);
+  const typeFilterSelected = typeMobileFilterOptions.find((option) => option.active);
+  const folderFilterSelected = folderMobileFilterOptions.find((option) => option.active);
+  const duplicateModeSelected = duplicateModeOptions.find((option) => option.active);
+
+  useEffect(() => {
+    const onPointerDown = (event: Event) => {
+      if (!mobileFilterOpen) return;
+      const target = event.target as Node | null;
+      if (mobileFilterRef.current && target && !mobileFilterRef.current.contains(target)) {
+        setMobileFilterOpen(null);
+      }
+    };
+    const onKeyDown = (event: KeyboardEvent) => {
+      if (event.key === 'Escape') setMobileFilterOpen(null);
+    };
+    document.addEventListener('pointerdown', onPointerDown);
+    document.addEventListener('keydown', onKeyDown);
+    return () => {
+      document.removeEventListener('pointerdown', onPointerDown);
+      document.removeEventListener('keydown', onKeyDown);
+    };
+  }, [mobileFilterOpen]);
+
+  const renderMobileFilterMenu = (
+    key: MobileFilterMenuKey,
+    label: string,
+    selected: MobileFilterOption | undefined,
+    fallbackIcon: ComponentChildren,
+    options: MobileFilterOption[]
+  ) => (
+    <div className="mobile-vault-filter-control">
       <button
         type="button"
-        className="btn btn-primary small mobile-fab-trigger"
+        className={`mobile-vault-filter-trigger ${mobileFilterOpen === key ? 'active' : ''}`}
+        aria-haspopup="menu"
+        aria-expanded={mobileFilterOpen === key}
+        onClick={() => setMobileFilterOpen((open) => open === key ? null : key)}
+      >
+        <span className="mobile-vault-filter-trigger-icon">{selected?.icon || fallbackIcon}</span>
+        <span className="mobile-vault-filter-trigger-label">{selected?.label || label}</span>
+        <ChevronDown size={13} className="mobile-vault-filter-chevron" />
+      </button>
+      {mobileFilterOpen === key && (
+        <div className="sort-menu mobile-vault-filter-menu" role="menu">
+          {options.map((option) => (
+            <button
+              key={option.value}
+              type="button"
+              className={`sort-menu-item mobile-vault-filter-item ${option.active ? 'active' : ''}`}
+              onClick={() => {
+                option.onSelect();
+                setMobileFilterOpen(null);
+              }}
+              role="menuitemradio"
+              aria-checked={option.active}
+            >
+              <span className="mobile-vault-filter-item-main">
+                <span className="mobile-vault-filter-item-icon">{option.icon}</span>
+                <span>{option.label}</span>
+              </span>
+              {option.active ? <Check size={14} /> : <span className="sort-menu-check-placeholder" />}
+            </button>
+          ))}
+        </div>
+      )}
+    </div>
+  );
+
+  const createMenu = (
+    <div className={`create-menu-wrap ${props.isMobileLayout ? 'mobile-fab-wrap' : 'desktop-create-menu-wrap'}`} ref={props.createMenuRef}>
+      <button
+        type="button"
+        className={`btn btn-primary small ${props.isMobileLayout ? 'mobile-fab-trigger' : 'desktop-create-trigger'}`}
         aria-label={t('txt_add')}
         title={t('txt_add')}
         onClick={props.onToggleCreateMenu}
@@ -135,108 +281,127 @@ export default function VaultListPanel(props: VaultListPanelProps) {
 
   return (
     <section className="list-col">
-      <div className="list-head">
-        <div className="search-input-wrap">
-          <input
-            className="search-input"
-            placeholder={t('txt_search_your_secure_vault')}
-            value={props.searchInput}
-            onInput={(e) => props.onSearchInput((e.currentTarget as HTMLInputElement).value)}
-            onCompositionStart={props.onSearchCompositionStart}
-            onCompositionEnd={(e) => props.onSearchCompositionEnd((e.currentTarget as HTMLInputElement).value)}
-            onKeyDown={(e) => {
-              if (e.key !== 'Escape' || !props.searchInput) return;
-              e.preventDefault();
-              props.onClearSearch();
-            }}
-          />
-          {!!props.searchInput && (
-            <button
-              type="button"
-              className="search-clear-btn"
-              aria-label={t('txt_clear_search')}
-              title={t('txt_clear_search_esc')}
-              onClick={props.onClearSearch}
-            >
-              <X size={14} />
-            </button>
-          )}
-        </div>
-        <div className="sort-menu-wrap" ref={props.sortMenuRef}>
-          <button
-            type="button"
-            className={`btn btn-secondary small sort-trigger ${props.sortMenuOpen ? 'active' : ''}`}
-            aria-label={t('txt_sort')}
-            title={t('txt_sort')}
-            onClick={props.onToggleSortMenu}
-          >
-            <ArrowUpDown size={14} className="btn-icon" />
-          </button>
-          {props.sortMenuOpen && (
-            <div className="sort-menu">
-              {vaultSortOptions.map((option) => (
-                <button
-                  key={option.value}
-                  type="button"
-                  className={`sort-menu-item ${props.sortMode === option.value ? 'active' : ''}`}
-                  onClick={() => props.onSelectSortMode(option.value)}
-                >
-                  <span>{option.label}</span>
-                  {props.sortMode === option.value ? <Check size={14} /> : <span className="sort-menu-check-placeholder" />}
+      <div className="list-toolbar-stack" ref={mobileFilterRef}>
+        <div className={`list-head ${props.selectedCount > 0 ? 'selection-mode' : ''}`}>
+          {props.selectedCount > 0 ? (
+            <>
+              {props.sidebarFilter.kind !== 'duplicates' && (
+                <button type="button" className="btn btn-secondary small" disabled={!props.filteredCiphers.length} onClick={props.onSelectAll}>
+                  <CheckCheck size={14} className="btn-icon" /> {t('txt_select_all')}
                 </button>
-              ))}
-            </div>
+              )}
+              <button type="button" className="btn btn-secondary small" onClick={props.onClearSelection}>
+                <X size={14} className="btn-icon" /> {t('txt_cancel')}
+              </button>
+              {props.sidebarFilter.kind === 'trash' && (
+                <button type="button" className="btn btn-secondary small" disabled={props.busy} onClick={props.onBulkRestore}>
+                  <RefreshCw size={14} className="btn-icon" /> {t('txt_restore')}
+                </button>
+              )}
+              {props.sidebarFilter.kind === 'archive' && (
+                <button type="button" className="btn btn-secondary small" disabled={props.busy} onClick={props.onBulkUnarchive}>
+                  <RotateCcw size={14} className="btn-icon" /> {t('txt_unarchive')}
+                </button>
+              )}
+              {props.sidebarFilter.kind !== 'trash' && props.sidebarFilter.kind !== 'archive' && props.sidebarFilter.kind !== 'duplicates' && (
+                <button type="button" className="btn btn-secondary small" disabled={props.busy} onClick={props.onBulkArchive}>
+                  <Archive size={14} className="btn-icon" /> {t('txt_archive_selected')}
+                </button>
+              )}
+              {props.sidebarFilter.kind !== 'trash' && props.sidebarFilter.kind !== 'archive' && props.sidebarFilter.kind !== 'duplicates' && (
+                <button type="button" className="btn btn-secondary small" disabled={props.busy} onClick={props.onOpenMove}>
+                  <FolderInput size={14} className="btn-icon" /> {t('txt_move')}
+                </button>
+              )}
+              <button type="button" className="btn btn-danger small" disabled={props.busy} onClick={props.onOpenBulkDelete}>
+                <Trash2 size={14} className="btn-icon" /> {props.sidebarFilter.kind === 'trash' ? t('txt_delete_permanently') : t('txt_delete_selected')}
+              </button>
+            </>
+          ) : (
+            <>
+              <div className="search-input-wrap">
+                {props.sidebarFilter.kind === 'duplicates' && props.isMobileLayout ? (
+                  <div className="duplicate-mode-head-menu">
+                    {renderMobileFilterMenu('duplicate', t('txt_duplicate_detection_mode'), duplicateModeSelected, <Copy size={14} />, duplicateModeOptions)}
+                  </div>
+                ) : (
+                  <>
+                    <input
+                      className="search-input"
+                      placeholder={t('txt_search_items_count', { count: props.totalCipherCount })}
+                      value={props.searchInput}
+                      onInput={(e) => props.onSearchInput((e.currentTarget as HTMLInputElement).value)}
+                      onCompositionStart={props.onSearchCompositionStart}
+                      onCompositionEnd={(e) => props.onSearchCompositionEnd((e.currentTarget as HTMLInputElement).value)}
+                      onKeyDown={(e) => {
+                        if (e.key !== 'Escape' || !props.searchInput) return;
+                        e.preventDefault();
+                        props.onClearSearch();
+                      }}
+                    />
+                    {!!props.searchInput && (
+                      <button
+                        type="button"
+                        className="search-clear-btn"
+                        aria-label={t('txt_clear_search')}
+                        title={t('txt_clear_search_esc')}
+                        onClick={props.onClearSearch}
+                      >
+                        <X size={14} />
+                      </button>
+                    )}
+                  </>
+                )}
+              </div>
+              {props.sidebarFilter.kind === 'duplicates' && !props.isMobileLayout && (
+                <div className="duplicate-mode-head-menu">
+                  {renderMobileFilterMenu('duplicate', t('txt_duplicate_detection_mode'), duplicateModeSelected, <Copy size={14} />, duplicateModeOptions)}
+                </div>
+              )}
+              <div className="sort-menu-wrap" ref={props.sortMenuRef}>
+                <button
+                  type="button"
+                  className={`btn btn-secondary small sort-trigger sort-trigger-labeled ${props.sortMenuOpen ? 'active' : ''}`}
+                  aria-label={t('txt_sort')}
+                  title={t('txt_sort')}
+                  onClick={props.onToggleSortMenu}
+                >
+                  <ArrowUpDown size={14} className="btn-icon" /> <span>{t('txt_sort')}</span>
+                </button>
+                {props.sortMenuOpen && (
+                  <div className="sort-menu">
+                    {vaultSortOptions.map((option) => (
+                      <button
+                        key={option.value}
+                        type="button"
+                        className={`sort-menu-item ${props.sortMode === option.value ? 'active' : ''}`}
+                        onClick={() => props.onSelectSortMode(option.value)}
+                      >
+                        <span>{option.label}</span>
+                        {props.sortMode === option.value ? <Check size={14} /> : <span className="sort-menu-check-placeholder" />}
+                      </button>
+                    ))}
+                  </div>
+                )}
+              </div>
+              <button type="button" className="btn btn-secondary small list-icon-btn" disabled={props.busy || props.loading} onClick={props.onSyncVault}>
+                <RefreshCw size={14} className="btn-icon" /> {t('txt_sync_vault')}
+              </button>
+              {!props.isMobileLayout && props.sidebarFilter !== undefined && createMenu}
+            </>
           )}
         </div>
-        <div className="list-count" title={t('txt_total_items_count', { count: props.totalCipherCount })}>
-          {t('txt_total_items_count', { count: props.totalCipherCount })}
-        </div>
-        <button type="button" className="btn btn-secondary small list-icon-btn" disabled={props.busy || props.loading} onClick={props.onSyncVault}>
-          <RefreshCw size={14} className="btn-icon" /> {t('txt_sync_vault')}
-        </button>
+        {props.isMobileLayout && (
+          <div className="mobile-vault-filter-row" aria-label={t('txt_filter')}>
+            {renderMobileFilterMenu('menu', t('txt_menu'), menuFilterSelected, <LayoutGrid size={14} />, menuFilterOptions)}
+            {renderMobileFilterMenu('type', t('txt_type'), typeFilterSelected, <Globe size={14} />, typeMobileFilterOptions)}
+            {renderMobileFilterMenu('folder', t('txt_folder'), folderFilterSelected, <FolderIcon size={14} />, folderMobileFilterOptions)}
+          </div>
+        )}
       </div>
-      <div className="toolbar actions">
-        {props.sidebarFilter.kind === 'duplicates' && (
-          <button type="button" className="btn btn-secondary small" disabled={!props.filteredCiphers.length || props.busy} onClick={props.onSelectDuplicates}>
-            <Check size={14} className="btn-icon" /> {t('txt_select_duplicate_items')}
-          </button>
-        )}
-        {props.selectedCount > 0 && props.sidebarFilter.kind === 'trash' && (
-          <button type="button" className="btn btn-secondary small" disabled={props.busy} onClick={props.onBulkRestore}>
-            <RefreshCw size={14} className="btn-icon" /> {t('txt_restore')}
-          </button>
-        )}
-        {props.selectedCount > 0 && props.sidebarFilter.kind === 'archive' && (
-          <button type="button" className="btn btn-secondary small" disabled={props.busy} onClick={props.onBulkUnarchive}>
-            <RotateCcw size={14} className="btn-icon" /> {t('txt_unarchive')}
-          </button>
-        )}
-        {props.selectedCount > 0 && props.sidebarFilter.kind !== 'trash' && props.sidebarFilter.kind !== 'archive' && props.sidebarFilter.kind !== 'duplicates' && (
-          <button type="button" className="btn btn-secondary small" disabled={props.busy} onClick={props.onBulkArchive}>
-            <Archive size={14} className="btn-icon" /> {t('txt_archive_selected')}
-          </button>
-        )}
-        {props.selectedCount > 0 && props.sidebarFilter.kind !== 'trash' && props.sidebarFilter.kind !== 'archive' && props.sidebarFilter.kind !== 'duplicates' && (
-          <button type="button" className="btn btn-secondary small" disabled={props.busy} onClick={props.onOpenMove}>
-            <FolderInput size={14} className="btn-icon" /> {t('txt_move')}
-          </button>
-        )}
-        {props.selectedCount > 0 && (
-          <button type="button" className="btn btn-secondary small" onClick={props.onClearSelection}>
-            <X size={14} className="btn-icon" /> {t('txt_cancel')}
-          </button>
-        )}
-        <button type="button" className="btn btn-danger small" disabled={!props.selectedCount || props.busy} onClick={props.onOpenBulkDelete}>
-          <Trash2 size={14} className="btn-icon" /> {props.sidebarFilter.kind === 'trash' ? t('txt_delete_permanently') : t('txt_delete_selected')}
-        </button>
-        <button type="button" className="btn btn-secondary small" disabled={!props.filteredCiphers.length} onClick={props.onSelectAll}>
-          <CheckCheck size={14} className="btn-icon" /> {t('txt_select_all')}
-        </button>
-        {props.isMobileLayout && typeof document !== 'undefined'
-          ? props.mobileFabVisible ? createPortal(createMenu, document.body) : null
-          : createMenu}
-      </div>
-
+      {!props.selectedCount && props.isMobileLayout && props.sidebarFilter.kind !== 'duplicates' && typeof document !== 'undefined' && props.mobileFabVisible
+        ? createPortal(createMenu, document.body)
+        : null}
       <div className="list-panel" ref={props.listPanelRef} onScroll={(event) => props.onScroll((event.currentTarget as HTMLDivElement).scrollTop)}>
         {props.loading && !props.filteredCiphers.length && <LoadingState lines={7} compact />}
         {!props.loading && !!props.error && !props.filteredCiphers.length && (
@@ -255,6 +420,7 @@ export default function VaultListPanel(props: VaultListPanelProps) {
                 cipher={cipher}
                 selected={props.selectedCipherId === cipher.id}
                 checked={!!props.selectedMap[cipher.id]}
+                duplicateGroupIndex={props.sidebarFilter.kind === 'duplicates' ? props.duplicateGroupIndexById.get(cipher.id) ?? null : null}
                 subtitle={props.listSubtitle(cipher)}
                 onToggleSelected={props.onToggleSelected}
                 onSelectCipher={props.onSelectCipher}

webapp/src/components/vault/vault-page-helpers.tsx

@@ -10,10 +10,13 @@ import {
 import { copyTextToClipboard } from '@/lib/clipboard';
 import { t } from '@/lib/i18n';
 import type { Cipher, CipherAttachment, CustomFieldType, VaultDraft, VaultDraftField, VaultDraftLoginUri } from '@/lib/types';
+import { firstCipherUri, hostFromUri, websiteIconUrl } from '@/lib/website-utils';
+import { normalizeEquivalentDomain } from '@shared/domain-normalize';
 import WebsiteIcon from './WebsiteIcon';
 
 export type TypeFilter = 'login' | 'card' | 'identity' | 'note' | 'ssh';
 export type VaultSortMode = 'edited' | 'created' | 'name';
+export type DuplicateDetectionMode = 'exact' | 'login-site' | 'login-credentials' | 'password';
 export type SidebarFilter =
   | { kind: 'all' }
   | { kind: 'favorite' }
@@ -126,6 +129,16 @@ export const FOLDER_SORT_STORAGE_KEY = 'nodewarden.folder-sort.v1';
 export const MOBILE_LAYOUT_QUERY = '(max-width: 1180px)';
 export const VAULT_LIST_ROW_HEIGHT = 74;
 export const VAULT_LIST_OVERSCAN = 10;
+
+export function getDuplicateDetectionOptions(): Array<{ value: DuplicateDetectionMode; label: string }> {
+  return [
+    { value: 'exact', label: t('txt_duplicate_mode_exact') },
+    { value: 'login-site', label: t('txt_duplicate_mode_login_site') },
+    { value: 'login-credentials', label: t('txt_duplicate_mode_login_credentials') },
+    { value: 'password', label: t('txt_duplicate_mode_password') },
+  ];
+}
+
 export function getVaultSortOptions(): Array<{ value: VaultSortMode; label: string }> {
   return [
     { value: 'edited', label: t('txt_sort_last_edited') },
@@ -242,7 +255,7 @@ export function toBooleanFieldValue(raw: string): boolean {
   return v === '1' || v === 'true' || v === 'yes' || v === 'on';
 }
 
-export { firstCipherUri, hostFromUri, websiteIconUrl } from '@/lib/website-utils';
+export { firstCipherUri, hostFromUri, websiteIconUrl };
 
 export function createEmptyLoginUri(): VaultDraftLoginUri {
   return { uri: '', match: null, originalUri: '', extra: {} };
@@ -257,6 +270,30 @@ function valueOrFallback(value: string | null | undefined): string {
   return String(value || '');
 }
 
+function duplicateLoginUsername(cipher: Cipher): string {
+  return valueOrFallback(cipher.login?.decUsername ?? cipher.login?.username).trim().toLowerCase();
+}
+
+function duplicateLoginPassword(cipher: Cipher): string {
+  return valueOrFallback(cipher.login?.decPassword ?? cipher.login?.password);
+}
+
+function duplicateLoginSites(cipher: Cipher): string[] {
+  const sites = new Set<string>();
+  for (const uri of cipher.login?.uris || []) {
+    const raw = valueOrFallback(uri.decUri ?? uri.uri).trim();
+    if (!raw) continue;
+    const host = hostFromUri(raw).trim().toLowerCase().replace(/^www\./, '');
+    const site = normalizeEquivalentDomain(raw) || host;
+    if (site) sites.add(site);
+  }
+  return Array.from(sites).sort();
+}
+
+function duplicateSignature(parts: string[]): string {
+  return JSON.stringify(parts);
+}
+
 export function buildCipherDuplicateSignature(cipher: Cipher): string {
   const normalized = {
     type: Number(cipher.type || 1),
@@ -326,13 +363,30 @@ export function buildCipherDuplicateSignature(cipher: Cipher): string {
       linkedId: field.linkedId ?? null,
     })),
     passwordHistory: (cipher.passwordHistory || []).map((entry) => ({
-      password: valueOrFallback(entry.password),
+      password: valueOrFallback(entry.decPassword ?? entry.password),
       lastUsedDate: valueOrFallback(entry.lastUsedDate),
     })),
   };
   return JSON.stringify(normalized);
 }
 
+export function buildCipherDuplicateSignatures(cipher: Cipher, mode: DuplicateDetectionMode): string[] {
+  if (mode === 'exact') return [buildCipherDuplicateSignature(cipher)];
+  if (Number(cipher.type || 1) !== 1 || !cipher.login) return [];
+
+  const username = duplicateLoginUsername(cipher);
+  const password = duplicateLoginPassword(cipher);
+  if (mode === 'password') {
+    return password ? [duplicateSignature(['password', password])] : [];
+  }
+  if (!username || !password) return [];
+  if (mode === 'login-credentials') {
+    return [duplicateSignature(['login-credentials', username, password])];
+  }
+
+  return duplicateLoginSites(cipher).map((site) => duplicateSignature(['login-site', site, username, password]));
+}
+
 export function createEmptyDraft(type: number): VaultDraft {
   return {
     type,
@@ -453,8 +507,9 @@ export function maskSecret(value: string): string {
 export function formatTotp(code: string): string {
   if (!code) return code;
   if (code.length === 5) return `${code.slice(0, 2)} ${code.slice(2)}`;
-  if (code.length < 6) return code;
-  return `${code.slice(0, 3)} ${code.slice(3, 6)}`;
+  if (code.length <= 4) return code;
+  if (code.length === 8) return `${code.slice(0, 4)} ${code.slice(4)}`;
+  return code.replace(/(.{3})(?=.)/g, '$1 ');
 }
 
 export function formatHistoryTime(value: string | null | undefined): string {

webapp/src/hooks/useAccountSecurityActions.ts

@@ -145,14 +145,30 @@ export default function useAccountSecurityActions(options: UseAccountSecurityAct
         }
       },
 
-      async enableTotp(secret: string, token: string) {
+      async enableTotp(secret: string, token: string, masterPassword: string) {
+        if (!profile) {
+          const error = new Error(t('txt_profile_unavailable'));
+          onNotify('error', error.message);
+          throw error;
+        }
         if (!secret.trim() || !token.trim()) {
           const error = new Error(t('txt_secret_and_code_are_required'));
           onNotify('error', error.message);
           throw error;
         }
+        if (!masterPassword) {
+          const error = new Error(t('txt_master_password_is_required'));
+          onNotify('error', error.message);
+          throw error;
+        }
         try {
-          await setTotp(authedFetch, { enabled: true, secret: secret.trim(), token: token.trim() });
+          const derived = await deriveLoginHash(profile.email, masterPassword, defaultKdfIterations);
+          await setTotp(authedFetch, {
+            enabled: true,
+            secret: secret.trim(),
+            token: token.trim(),
+            masterPasswordHash: derived.hash,
+          });
           onNotify('success', t('txt_totp_enabled'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_enable_totp_failed'));
@@ -218,24 +234,33 @@ export default function useAccountSecurityActions(options: UseAccountSecurityAct
         const normalizedName = String(name || '').trim() || t('txt_account_passkey');
         const derived = await deriveLoginHash(profile.email, normalizedPassword, defaultKdfIterations);
         const options = await getAccountPasskeyAttestationOptions(authedFetch, derived.hash);
-        const pending = await createAccountPasskeyCredential(options);
+        const pending = await createAccountPasskeyCredential(options, directUnlock);
         let keySet = null;
         let savedWithoutDirectUnlock = false;
         if (directUnlock) {
           if (!session?.symEncKey || !session?.symMacKey) throw new Error(t('txt_vault_key_unavailable'));
-          try {
-            keySet = await buildAccountPasskeyPrfKeySet(pending, {
-              symEncKey: session.symEncKey,
-              symMacKey: session.symMacKey,
-            });
-          } catch (error) {
-            if (!(error instanceof AccountPasskeyPrfUnavailableError)) throw error;
+          if (!pending.supportsPrf) {
             const shouldSaveLoginOnly = await confirmSaveLoginOnlyAccountPasskey();
             if (!shouldSaveLoginOnly) {
               onNotify('warning', t('txt_account_passkey_not_saved'));
               return null;
             }
             savedWithoutDirectUnlock = true;
+          } else {
+            try {
+              keySet = await buildAccountPasskeyPrfKeySet(pending, {
+                symEncKey: session.symEncKey,
+                symMacKey: session.symMacKey,
+              });
+            } catch (error) {
+              if (!(error instanceof AccountPasskeyPrfUnavailableError)) throw error;
+              const shouldSaveLoginOnly = await confirmSaveLoginOnlyAccountPasskey();
+              if (!shouldSaveLoginOnly) {
+                onNotify('warning', t('txt_account_passkey_not_saved'));
+                return null;
+              }
+              savedWithoutDirectUnlock = true;
+            }
           }
         }
         const credential = await saveAccountPasskey(authedFetch, {

webapp/src/hooks/useBackupActions.ts

@@ -27,9 +27,10 @@ export default function useBackupActions(options: UseBackupActionsOptions) {
 
   return useMemo(
     () => ({
-      async exportBackup(includeAttachments: boolean = false) {
+      async exportBackup(masterPasswordHash: string, includeAttachments: boolean = false) {
         const payload = await buildCompleteAdminBackupExport(
           authedFetch,
+          masterPasswordHash,
           includeAttachments,
           async (event: BackupExportClientProgressEvent) => {
             dispatchBackupProgress(event);
@@ -48,14 +49,14 @@ export default function useBackupActions(options: UseBackupActionsOptions) {
         });
       },
 
-      async importBackup(file: File, replaceExisting: boolean = false) {
-        const result = await importAdminBackup(authedFetch, file, replaceExisting);
+      async importBackup(masterPasswordHash: string, file: File, replaceExisting: boolean = false) {
+        const result = await importAdminBackup(authedFetch, masterPasswordHash, file, replaceExisting);
         onImported?.();
         return result;
       },
 
-      async importBackupAllowingChecksumMismatch(file: File, replaceExisting: boolean = false) {
-        const result = await importAdminBackup(authedFetch, file, replaceExisting, true);
+      async importBackupAllowingChecksumMismatch(masterPasswordHash: string, file: File, replaceExisting: boolean = false) {
+        const result = await importAdminBackup(authedFetch, masterPasswordHash, file, replaceExisting, true);
         onImported?.();
         return result;
       },
@@ -64,20 +65,20 @@ export default function useBackupActions(options: UseBackupActionsOptions) {
         return getAdminBackupSettings(authedFetch);
       },
 
-      async saveSettings(settings: Parameters<typeof saveAdminBackupSettings>[1]) {
-        return saveAdminBackupSettings(authedFetch, settings);
+      async saveSettings(masterPasswordHash: string, settings: Parameters<typeof saveAdminBackupSettings>[2]) {
+        return saveAdminBackupSettings(authedFetch, masterPasswordHash, settings);
       },
 
-      async runRemoteBackup(destinationId?: string | null) {
-        return runAdminBackupNow(authedFetch, destinationId);
+      async runRemoteBackup(masterPasswordHash: string, destinationId?: string | null) {
+        return runAdminBackupNow(authedFetch, masterPasswordHash, destinationId);
       },
 
       async listRemoteBackups(destinationId: string, path: string) {
         return listRemoteBackups(authedFetch, destinationId, path);
       },
 
-      async downloadRemoteBackup(destinationId: string, path: string, onProgress?: (percent: number | null) => void) {
-        const payload = await fetchRemoteBackupPayload(authedFetch, destinationId, path, onProgress);
+      async downloadRemoteBackup(masterPasswordHash: string, destinationId: string, path: string, onProgress?: (percent: number | null) => void) {
+        const payload = await fetchRemoteBackupPayload(authedFetch, masterPasswordHash, destinationId, path, onProgress);
         downloadBytesAsFile(payload.bytes, payload.fileName, payload.mimeType);
       },
 
@@ -89,14 +90,14 @@ export default function useBackupActions(options: UseBackupActionsOptions) {
         await deleteRemoteBackup(authedFetch, destinationId, path);
       },
 
-      async restoreRemoteBackup(destinationId: string, path: string, replaceExisting: boolean = false) {
-        const result = await restoreRemoteBackupRequest(authedFetch, destinationId, path, replaceExisting);
+      async restoreRemoteBackup(masterPasswordHash: string, destinationId: string, path: string, replaceExisting: boolean = false) {
+        const result = await restoreRemoteBackupRequest(authedFetch, masterPasswordHash, destinationId, path, replaceExisting);
         onRestored?.();
         return result;
       },
 
-      async restoreRemoteBackupAllowingChecksumMismatch(destinationId: string, path: string, replaceExisting: boolean = false) {
-        const result = await restoreRemoteBackupRequest(authedFetch, destinationId, path, replaceExisting, true);
+      async restoreRemoteBackupAllowingChecksumMismatch(masterPasswordHash: string, destinationId: string, path: string, replaceExisting: boolean = false) {
+        const result = await restoreRemoteBackupRequest(authedFetch, masterPasswordHash, destinationId, path, replaceExisting, true);
         onRestored?.();
         return result;
       },

webapp/src/hooks/useVaultSendActions.ts

@@ -4,6 +4,7 @@ import type { ExportRequest, ZipAttachmentEntry } from '@/lib/export-formats';
 import {
   attachNodeWardenEncryptedAttachmentPayload,
   buildAccountEncryptedBitwardenJsonString,
+  buildBitwardenCsvString,
   buildBitwardenZipBytes,
   buildExportFileName,
   buildNodeWardenAttachmentRecords,
@@ -40,6 +41,7 @@ import {
   downloadCipherAttachmentDecrypted,
   encryptFolderImportName,
   getAttachmentDownloadInfo,
+  getCipherById,
   importCiphers,
   permanentDeleteCipher,
   type CiphersImportPayload,
@@ -68,8 +70,13 @@ interface UseVaultSendActionsOptions {
   refetchFolders: () => Promise<{ data?: VaultFolder[] | undefined } | unknown>;
   refetchSends: () => Promise<unknown>;
   onNotify: Notify;
+  patchEncryptedCiphers: (updater: (prev: Cipher[]) => Cipher[]) => void;
+  patchEncryptedFolders: (updater: (prev: VaultFolder[]) => VaultFolder[]) => void;
+  patchEncryptedSends: (updater: (prev: Send[]) => Send[]) => void;
   patchDecryptedCiphers: (updater: (prev: Cipher[]) => Cipher[]) => void;
   patchDecryptedFolders: (updater: (prev: VaultFolder[]) => VaultFolder[]) => void;
+  patchDecryptedSends: (updater: (prev: Send[]) => Send[]) => void;
+  refreshVaultRevisionStamp: () => Promise<void>;
 }
 
 function extractImportIdMaps(cipherMap: ImportedCipherMapEntry[] | null) {
@@ -287,8 +294,13 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
     refetchFolders,
     refetchSends,
     onNotify,
+    patchEncryptedCiphers,
+    patchEncryptedFolders,
+    patchEncryptedSends,
     patchDecryptedCiphers,
     patchDecryptedFolders,
+    patchDecryptedSends,
+    refreshVaultRevisionStamp,
   } = options;
   const [downloadingAttachmentKey, setDownloadingAttachmentKey] = useState('');
   const [attachmentDownloadPercent, setAttachmentDownloadPercent] = useState<number | null>(null);
@@ -307,21 +319,20 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
       throw new Error(t('txt_offline_vault_readonly'));
     };
 
-    const syncVaultCoreInBackground = (options?: { includeFolders?: boolean }) => {
-      const tasks: Promise<unknown>[] = [Promise.resolve(refetchCiphers())];
-      if (options?.includeFolders) {
-        tasks.push(Promise.resolve(refetchFolders()));
-      }
-      void Promise.all(tasks).catch((err) => {
-        console.warn('Background vault sync failed:', err);
-      });
-    };
-
     async function decryptAndPatch(encrypted: Cipher) {
       if (!session?.symEncKey || !session?.symMacKey) {
         await refetchCiphers();
         return;
       }
+      patchEncryptedCiphers((prev) => {
+        const idx = prev.findIndex((c) => c.id === encrypted.id);
+        if (idx >= 0) {
+          const next = [...prev];
+          next[idx] = encrypted;
+          return next;
+        }
+        return [encrypted, ...prev];
+      });
       const encKey = base64ToBytes(session.symEncKey);
       const macKey = base64ToBytes(session.symMacKey);
       const decrypted = await decryptSingleCipher(encrypted, encKey, macKey);
@@ -341,6 +352,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         await refetchCiphers();
         return;
       }
+      patchEncryptedCiphers((prev) => [encrypted, ...prev.filter((cipher) => cipher.id !== optimisticId && cipher.id !== encrypted.id)]);
       const encKey = base64ToBytes(session.symEncKey);
       const macKey = base64ToBytes(session.symMacKey);
       const decrypted = await decryptSingleCipher(encrypted, encKey, macKey);
@@ -351,31 +363,70 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
     }
 
     function removeCipherFromState(id: string) {
+      patchEncryptedCiphers((prev) => prev.filter((c) => c.id !== id));
       patchDecryptedCiphers((prev) => prev.filter((c) => c.id !== id));
     }
 
-    function patchCipherBatch(ids: string[], updater: (cipher: Cipher) => Cipher | null) {
+    function patchCipherBatch(
+      ids: string[],
+      updater: (cipher: Cipher) => Cipher | null,
+      options?: { patchEncrypted?: boolean; patchDecrypted?: boolean }
+    ) {
       const idSet = new Set(ids.map((id) => String(id || '').trim()).filter(Boolean));
       if (!idSet.size) return;
-      patchDecryptedCiphers((prev) => {
-        let changed = false;
-        const next: Cipher[] = [];
-        for (const cipher of prev) {
-          if (!idSet.has(cipher.id)) {
-            next.push(cipher);
-            continue;
+      const shouldPatchEncrypted = options?.patchEncrypted !== false;
+      const shouldPatchDecrypted = options?.patchDecrypted !== false;
+      if (shouldPatchEncrypted) {
+        patchEncryptedCiphers((prev) => {
+          let changed = false;
+          const next: Cipher[] = [];
+          for (const cipher of prev) {
+            if (!idSet.has(cipher.id)) {
+              next.push(cipher);
+              continue;
+            }
+            const updated = updater(cipher);
+            changed = true;
+            if (updated) next.push(updated);
           }
-          const updated = updater(cipher);
-          changed = true;
-          if (updated) next.push(updated);
-        }
-        return changed ? next : prev;
-      });
+          return changed ? next : prev;
+        });
+      }
+      if (shouldPatchDecrypted) {
+        patchDecryptedCiphers((prev) => {
+          let changed = false;
+          const next: Cipher[] = [];
+          for (const cipher of prev) {
+            if (!idSet.has(cipher.id)) {
+              next.push(cipher);
+              continue;
+            }
+            const updated = updater(cipher);
+            changed = true;
+            if (updated) next.push(updated);
+          }
+          return changed ? next : prev;
+        });
+      }
     }
 
     function patchFolderBatch(ids: string[], updater: (folder: VaultFolder) => VaultFolder | null) {
       const idSet = new Set(ids.map((id) => String(id || '').trim()).filter(Boolean));
       if (!idSet.size) return;
+      patchEncryptedFolders((prev) => {
+        let changed = false;
+        const next: VaultFolder[] = [];
+        for (const folder of prev) {
+          if (!idSet.has(folder.id)) {
+            next.push(folder);
+            continue;
+          }
+          const updated = updater(folder);
+          changed = true;
+          if (updated) next.push(updated);
+        }
+        return changed ? next : prev;
+      });
       patchDecryptedFolders((prev) => {
         let changed = false;
         const next: VaultFolder[] = [];
@@ -392,6 +443,31 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
       });
     }
 
+    function upsertEncryptedFolder(folder: VaultFolder) {
+      patchEncryptedFolders((prev) => {
+        const index = prev.findIndex((item) => item.id === folder.id);
+        if (index < 0) return [folder, ...prev];
+        const next = [...prev];
+        next[index] = folder;
+        return next;
+      });
+    }
+
+    function upsertSend(send: Send) {
+      patchEncryptedSends((prev) => {
+        const index = prev.findIndex((item) => item.id === send.id);
+        if (index < 0) return [send, ...prev];
+        const next = [...prev];
+        next[index] = send;
+        return next;
+      });
+    }
+
+    function removeSend(id: string) {
+      patchEncryptedSends((prev) => prev.filter((send) => send.id !== id));
+      patchDecryptedSends((prev) => prev.filter((send) => send.id !== id));
+    }
+
     const uploadImportedAttachments = async (
       attachments: ImportAttachmentFile[],
       idMaps: { byIndex: Map<number, string>; bySourceId: Map<string, string> }
@@ -467,8 +543,9 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
             setAttachmentUploadPercent(0);
             await uploadCipherAttachment(authedFetch, session, created.id, file, undefined, setAttachmentUploadPercent);
           }
-          await decryptAndReplaceOptimistic(optimistic.id, created);
-          syncVaultCoreInBackground({ includeFolders: !!draft.folderId || attachments.length > 0 });
+          const finalCipher = attachments.length ? await getCipherById(authedFetch, created.id) : created;
+          await decryptAndReplaceOptimistic(optimistic.id, finalCipher);
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_item_created'));
         } catch (error) {
           patchDecryptedCiphers((prev) => prev.filter((cipher) => cipher.id !== optimistic.id));
@@ -510,7 +587,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
             .filter((attachment) => !removedSet.has(String(attachment?.id || '').trim()))
             .map((attachment) => ({ ...attachment }));
         }
-        patchCipherBatch([cipher.id], () => optimistic);
+        patchCipherBatch([cipher.id], () => optimistic, { patchEncrypted: false });
         try {
           const updated = await updateCipher(authedFetch, session, cipher, draft);
           for (const attachmentId of removeAttachmentIds) {
@@ -523,16 +600,14 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
             setAttachmentUploadPercent(0);
             await uploadCipherAttachment(authedFetch, session, cipher.id, file, cipher, setAttachmentUploadPercent);
           }
-          await decryptAndPatch(updated);
-          syncVaultCoreInBackground({
-            includeFolders:
-              draft.folderId !== (cipher.folderId || '')
-              || addFiles.length > 0
-              || removeAttachmentIds.length > 0,
-          });
+          const finalCipher = addFiles.length || removeAttachmentIds.length
+            ? await getCipherById(authedFetch, cipher.id)
+            : updated;
+          await decryptAndPatch(finalCipher);
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_item_updated'));
         } catch (error) {
-          patchCipherBatch([cipher.id], () => previousCipher);
+          patchCipherBatch([cipher.id], () => previousCipher, { patchEncrypted: false });
           onNotify('error', error instanceof Error ? error.message : t('txt_update_item_failed'));
           throw error;
         } finally {
@@ -571,7 +646,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
           try {
             await permanentDeleteCipher(authedFetch, cipher.id);
             patchCipherBatch([cipher.id], () => null);
-            syncVaultCoreInBackground({ includeFolders: true });
+            void refreshVaultRevisionStamp();
             onNotify('success', t('txt_item_deleted_permanently'));
           } catch (error) {
             onNotify('error', error instanceof Error ? error.message : t('txt_permanent_delete_item_failed'));
@@ -584,10 +659,10 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           const deleted = await deleteCipher(authedFetch, cipher.id);
           await decryptAndPatch(deleted);
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_item_deleted'));
         } catch (error) {
-          patchCipherBatch([cipher.id], () => previousCipher);
+          patchCipherBatch([cipher.id], () => previousCipher, { patchEncrypted: false });
           onNotify('error', error instanceof Error ? error.message : t('txt_delete_item_failed'));
           throw error;
         }
@@ -606,10 +681,10 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           const archived = await archiveCipher(authedFetch, cipher.id);
           await decryptAndPatch(archived);
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_item_archived'));
         } catch (error) {
-          patchCipherBatch([cipher.id], () => previousCipher);
+          patchCipherBatch([cipher.id], () => previousCipher, { patchEncrypted: false });
           onNotify('error', error instanceof Error ? error.message : t('txt_archive_item_failed'));
           throw error;
         }
@@ -628,10 +703,10 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           const unarchived = await unarchiveCipher(authedFetch, cipher.id);
           await decryptAndPatch(unarchived);
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_item_unarchived'));
         } catch (error) {
-          patchCipherBatch([cipher.id], () => previousCipher);
+          patchCipherBatch([cipher.id], () => previousCipher, { patchEncrypted: false });
           onNotify('error', error instanceof Error ? error.message : t('txt_unarchive_item_failed'));
           throw error;
         }
@@ -648,7 +723,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
           await bulkDeleteCiphers(authedFetch, ids);
           const deletedDate = new Date().toISOString();
           patchCipherBatch(ids, (cipher) => ({ ...cipher, deletedDate, archivedDate: null }));
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_deleted_selected_items'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_bulk_delete_failed'));
@@ -667,7 +742,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
           await bulkArchiveCiphers(authedFetch, ids);
           const archivedDate = new Date().toISOString();
           patchCipherBatch(ids, (cipher) => ({ ...cipher, archivedDate, deletedDate: null }));
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_archived_selected_items'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_bulk_archive_failed'));
@@ -685,7 +760,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           await bulkUnarchiveCiphers(authedFetch, ids);
           patchCipherBatch(ids, (cipher) => ({ ...cipher, archivedDate: null }));
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_unarchived_selected_items'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_bulk_unarchive_failed'));
@@ -703,7 +778,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           await bulkMoveCiphers(authedFetch, ids, folderId);
           patchCipherBatch(ids, (cipher) => ({ ...cipher, folderId }));
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_moved_selected_items'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_bulk_move_failed'));
@@ -726,15 +801,18 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           if (!session) throw new Error(t('txt_vault_key_unavailable'));
           const created = await createFolder(authedFetch, session, folderName);
+          upsertEncryptedFolder(created);
           patchDecryptedFolders((prev) => [
             {
               id: created.id,
               name: created.name || folderName,
               decName: folderName,
+              revisionDate: created.revisionDate,
+              creationDate: created.creationDate,
             },
             ...prev,
           ]);
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_folder_created'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_create_folder_failed'));
@@ -757,8 +835,9 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           await deleteFolder(authedFetch, id);
           patchFolderBatch([id], () => null);
+          patchEncryptedCiphers((prev) => prev.map((cipher) => (cipher.folderId === id ? { ...cipher, folderId: null } : cipher)));
           patchDecryptedCiphers((prev) => prev.map((cipher) => (cipher.folderId === id ? { ...cipher, folderId: null } : cipher)));
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_folder_deleted'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_delete_folder_failed'));
@@ -785,9 +864,14 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         }
         try {
           if (!session) throw new Error(t('txt_vault_key_unavailable'));
-          await updateFolder(authedFetch, session, id, nextName);
-          patchFolderBatch([id], (folder) => ({ ...folder, decName: nextName }));
-          syncVaultCoreInBackground({ includeFolders: true });
+          const updated = await updateFolder(authedFetch, session, id, nextName);
+          upsertEncryptedFolder(updated);
+          patchDecryptedFolders((prev) => prev.map((folder) => (
+            folder.id === id
+              ? { ...folder, name: updated.name || folder.name, decName: nextName, revisionDate: updated.revisionDate }
+              : folder
+          )));
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_folder_updated'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_update_folder_failed'));
@@ -805,7 +889,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           await bulkRestoreCiphers(authedFetch, ids);
           patchCipherBatch(ids, (cipher) => ({ ...cipher, deletedDate: null }));
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_restored_selected_items'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_bulk_restore_failed'));
@@ -823,7 +907,7 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           await bulkPermanentDeleteCiphers(authedFetch, ids);
           patchCipherBatch(ids, () => null);
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_deleted_selected_items_permanently'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_bulk_permanent_delete_failed'));
@@ -843,9 +927,11 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         try {
           await bulkDeleteFolders(authedFetch, ids);
           const removedIds = new Set(ids);
+          patchEncryptedFolders((prev) => prev.filter((folder) => !removedIds.has(folder.id)));
+          patchEncryptedCiphers((prev) => prev.map((cipher) => (cipher.folderId && removedIds.has(cipher.folderId) ? { ...cipher, folderId: null } : cipher)));
           patchDecryptedFolders((prev) => prev.filter((folder) => !removedIds.has(folder.id)));
           patchDecryptedCiphers((prev) => prev.map((cipher) => (cipher.folderId && removedIds.has(cipher.folderId) ? { ...cipher, folderId: null } : cipher)));
-          syncVaultCoreInBackground({ includeFolders: true });
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_folders_deleted'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_delete_all_folders_failed'));
@@ -873,7 +959,8 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
             setSendUploadPercent(0);
           }
           const created = await createSend(authedFetch, session, draft, fileName ? setSendUploadPercent : undefined);
-          await refetchSends();
+          upsertSend(created);
+          void refreshVaultRevisionStamp();
           if (autoCopyLink && created.key && session.symEncKey && session.symMacKey) {
             const keyPart = await buildSendShareKey(created.key, session.symEncKey, session.symMacKey);
             const shareUrl = buildPublicSendUrl(window.location.origin, created.accessId, keyPart);
@@ -899,7 +986,8 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         }
         try {
           const updated = await updateSend(authedFetch, session, send, draft);
-          await refetchSends();
+          upsertSend(updated);
+          void refreshVaultRevisionStamp();
           if (autoCopyLink && updated.key && session.symEncKey && session.symMacKey) {
             const keyPart = await buildSendShareKey(updated.key, session.symEncKey, session.symMacKey);
             const shareUrl = buildPublicSendUrl(window.location.origin, updated.accessId, keyPart);
@@ -921,7 +1009,8 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         }
         try {
           await deleteSend(authedFetch, send.id);
-          await refetchSends();
+          removeSend(send.id);
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_send_deleted'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_delete_send_failed'));
@@ -938,7 +1027,10 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
         }
         try {
           await bulkDeleteSends(authedFetch, ids);
-          await refetchSends();
+          const idSet = new Set(ids.map((id) => String(id || '').trim()).filter(Boolean));
+          patchEncryptedSends((prev) => prev.filter((send) => !idSet.has(send.id)));
+          patchDecryptedSends((prev) => prev.filter((send) => !idSet.has(send.id)));
+          void refreshVaultRevisionStamp();
           onNotify('success', t('txt_deleted_selected_sends'));
         } catch (error) {
           onNotify('error', error instanceof Error ? error.message : t('txt_bulk_delete_sends_failed'));
@@ -1190,6 +1282,12 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
             mimeType: 'application/json',
             bytes: new TextEncoder().encode(await getPlainJson()),
           };
+        } else if (format === 'bitwarden_csv') {
+          result = {
+            fileName: buildExportFileName(format),
+            mimeType: 'text/csv;charset=utf-8',
+            bytes: new TextEncoder().encode(buildBitwardenCsvString(await getPlainJsonDoc())),
+          };
         } else if (format === 'bitwarden_encrypted_json') {
           if (request.encryptedJsonMode === 'password') {
             const plainJson = await getPlainJson();
@@ -1292,10 +1390,17 @@ export default function useVaultSendActions(options: UseVaultSendActionsOptions)
     encryptedFolders,
     importAuthedFetch,
     onNotify,
+    patchDecryptedCiphers,
+    patchDecryptedFolders,
+    patchDecryptedSends,
+    patchEncryptedCiphers,
+    patchEncryptedFolders,
+    patchEncryptedSends,
     profile,
     refetchCiphers,
     refetchFolders,
     refetchSends,
+    refreshVaultRevisionStamp,
     session,
     sendUploadPercent,
     uploadingAttachmentName,

webapp/src/lib/account-passkeys.ts

@@ -150,6 +150,22 @@ function shouldRetryWithLegacyPrf(error: unknown): boolean {
   return name === 'NotSupportedError' || name === 'SyntaxError' || name === 'TypeError';
 }
 
+function shouldRetryCreateWithoutPrf(error: unknown): boolean {
+  const name = error instanceof DOMException || error instanceof Error ? error.name : '';
+  const message = error instanceof DOMException || error instanceof Error ? error.message : '';
+  return (
+    name === 'NotSupportedError' ||
+    name === 'SyntaxError' ||
+    name === 'TypeError' ||
+    (name === 'UnknownError' && /transient/i.test(message))
+  );
+}
+
+async function canRequestPrfExtension(): Promise<boolean> {
+  if (/\bFirefox\//i.test(navigator.userAgent)) return false;
+  return true;
+}
+
 async function getPublicKeyCredentialWithPrf(
   options: PublicKeyCredentialRequestOptions,
   salt: Uint8Array,
@@ -265,17 +281,38 @@ export async function assertAccountPasskey(
 }
 
 export async function createAccountPasskeyCredential(
-  response: { options: unknown; token: string }
+  response: { options: unknown; token: string },
+  requestPrf: boolean = false
 ): Promise<PendingAccountPasskeyCredential> {
   if (!window.PublicKeyCredential || !navigator.credentials) {
     throw new Error(t('txt_passkey_browser_not_supported'));
   }
   const nativeOptions = cloneCreationOptions(response.options);
-  (nativeOptions as any).extensions = {
-    ...((nativeOptions as any).extensions || {}),
-    prf: {},
+  const createWithOptions = async (options: PublicKeyCredentialCreationOptions): Promise<PublicKeyCredential> => {
+    const credential = await navigator.credentials.create({ publicKey: options });
+    if (!(credential instanceof PublicKeyCredential)) {
+      throw new Error(t('txt_no_passkey_created'));
+    }
+    return credential;
   };
-  const credential = await navigator.credentials.create({ publicKey: nativeOptions });
+  let credential: PublicKeyCredential;
+  if (requestPrf && await canRequestPrfExtension()) {
+    const prfOptions: PublicKeyCredentialCreationOptions = {
+      ...nativeOptions,
+      extensions: {
+        ...((nativeOptions as any).extensions || {}),
+        prf: {},
+      } as any,
+    };
+    try {
+      credential = await createWithOptions(prfOptions);
+    } catch (error) {
+      if (!shouldRetryCreateWithoutPrf(error)) throw error;
+      credential = await createWithOptions(nativeOptions);
+    }
+  } else {
+    credential = await createWithOptions(nativeOptions);
+  }
   if (!(credential instanceof PublicKeyCredential)) {
     throw new Error(t('txt_no_passkey_created'));
   }

webapp/src/lib/api/auth-requests.ts

@@ -0,0 +1,128 @@
+import { base64ToBytes, bytesToBase64, hkdfExpand, toBufferSource } from '@/lib/crypto';
+import { EFFLongWordList } from '@/lib/fingerprint-wordlist';
+import { t } from '@/lib/i18n';
+import type { AuthRequest, ListResponse, SessionState } from '@/lib/types';
+import type { AuthedFetch } from './shared';
+import { parseErrorMessage, parseJson } from './shared';
+
+function readResponseProperty<T>(source: Record<string, any>, camel: string, pascal: string, fallback: T): T {
+  return (source[camel] ?? source[pascal] ?? fallback) as T;
+}
+
+function normalizeAuthRequest(raw: Record<string, any>): AuthRequest {
+  return {
+    id: String(readResponseProperty(raw, 'id', 'Id', '')),
+    publicKey: String(readResponseProperty(raw, 'publicKey', 'PublicKey', '')),
+    requestDeviceType: readResponseProperty(raw, 'requestDeviceType', 'RequestDeviceType', null),
+    requestDeviceTypeValue: readResponseProperty(raw, 'requestDeviceTypeValue', 'RequestDeviceTypeValue', null),
+    requestDeviceIdentifier: String(readResponseProperty(raw, 'requestDeviceIdentifier', 'RequestDeviceIdentifier', '')),
+    requestIpAddress: readResponseProperty(raw, 'requestIpAddress', 'RequestIpAddress', null),
+    requestCountryName: readResponseProperty(raw, 'requestCountryName', 'RequestCountryName', null),
+    key: readResponseProperty(raw, 'key', 'Key', null),
+    creationDate: String(readResponseProperty(raw, 'creationDate', 'CreationDate', '')),
+    requestApproved: readResponseProperty(raw, 'requestApproved', 'RequestApproved', null),
+    responseDate: readResponseProperty(raw, 'responseDate', 'ResponseDate', null),
+    deviceId: readResponseProperty(raw, 'deviceId', 'DeviceId', null),
+    requestDeviceId: readResponseProperty(raw, 'requestDeviceId', 'RequestDeviceId', null),
+  };
+}
+
+async function withFingerprintPhrase(email: string, request: AuthRequest): Promise<AuthRequest> {
+  if (!request.publicKey) return request;
+  try {
+    return {
+      ...request,
+      fingerprintPhrase: await getFingerprintPhrase(email, base64ToBytes(request.publicKey)),
+    };
+  } catch {
+    return request;
+  }
+}
+
+export async function listPendingAuthRequests(authedFetch: AuthedFetch, email: string): Promise<AuthRequest[]> {
+  const resp = await authedFetch('/api/auth-requests/pending');
+  if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_auth_requests_load_failed')));
+  const body = await parseJson<ListResponse<Record<string, any>> & { Data?: Record<string, any>[] }>(resp);
+  const rows = (body?.data || body?.Data || []).map(normalizeAuthRequest);
+  return Promise.all(rows.map((row) => withFingerprintPhrase(email, row)));
+}
+
+export async function respondToAuthRequest(
+  authedFetch: AuthedFetch,
+  requestId: string,
+  payload: {
+    key?: string | null;
+    masterPasswordHash?: string | null;
+    deviceIdentifier: string;
+    requestApproved: boolean;
+  }
+): Promise<AuthRequest> {
+  const resp = await authedFetch(`/api/auth-requests/${encodeURIComponent(requestId)}`, {
+    method: 'PUT',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify(payload),
+  });
+  if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_auth_request_update_failed')));
+  const body = await parseJson<Record<string, any>>(resp);
+  if (!body) throw new Error(t('txt_auth_request_update_failed'));
+  return normalizeAuthRequest(body);
+}
+
+export function isPendingAuthRequest(request: AuthRequest): boolean {
+  if (!request.id || !request.creationDate) return false;
+  if (request.responseDate) return false;
+  const createdAt = new Date(request.creationDate).getTime();
+  if (!Number.isFinite(createdAt)) return true;
+  return Date.now() - createdAt < 15 * 60 * 1000;
+}
+
+export async function encryptSessionUserKeyForAuthRequest(session: SessionState, authRequest: AuthRequest): Promise<string> {
+  if (!session.symEncKey || !session.symMacKey) throw new Error(t('txt_vault_key_unavailable'));
+  if (!authRequest.publicKey) throw new Error(t('txt_auth_request_missing_public_key'));
+
+  const userKeyBytes = new Uint8Array(64);
+  userKeyBytes.set(base64ToBytes(session.symEncKey), 0);
+  userKeyBytes.set(base64ToBytes(session.symMacKey), 32);
+  const publicKey = await crypto.subtle.importKey(
+    'spki',
+    toBufferSource(base64ToBytes(authRequest.publicKey)),
+    { name: 'RSA-OAEP', hash: 'SHA-1' },
+    false,
+    ['encrypt']
+  );
+  const encryptedBytes = new Uint8Array(await crypto.subtle.encrypt(
+    { name: 'RSA-OAEP' },
+    publicKey,
+    toBufferSource(userKeyBytes)
+  ));
+  return `4.${bytesToBase64(encryptedBytes)}`;
+}
+
+export async function getFingerprintPhrase(email: string, publicKey: Uint8Array): Promise<string> {
+  const keyFingerprint = new Uint8Array(await crypto.subtle.digest('SHA-256', toBufferSource(publicKey)));
+  const userFingerprint = await hkdfExpand(keyFingerprint, email.toLowerCase(), 32);
+  return hashPhrase(userFingerprint).join('-');
+}
+
+function hashPhrase(hash: Uint8Array, minimumEntropy = 64): string[] {
+  const entropyPerWord = Math.log(EFFLongWordList.length) / Math.log(2);
+  let numWords = Math.ceil(minimumEntropy / entropyPerWord);
+  if (numWords * entropyPerWord > hash.length * 4) {
+    throw new Error('Output entropy of hash function is too small');
+  }
+
+  let hashNumber = 0n;
+  for (const byte of hash) {
+    hashNumber = (hashNumber * 256n) + BigInt(byte);
+  }
+
+  const phrase: string[] = [];
+  const wordCount = BigInt(EFFLongWordList.length);
+  while (numWords > 0) {
+    const remainder = Number(hashNumber % wordCount);
+    hashNumber /= wordCount;
+    phrase.push(EFFLongWordList[remainder]);
+    numWords -= 1;
+  }
+  return phrase;
+}

webapp/src/lib/api/auth.ts

@@ -9,6 +9,7 @@ import type {
   TokenSuccess,
 } from '../types';
 import type { AccountPasskeyAssertion, AccountPasskeyPrfKeySet } from '../account-passkeys';
+import { recordNodeWardenReachable, recordNodeWardenUnreachable } from '../network-status';
 import { parseJson, type AuthedFetch, type SessionSetter } from './shared';
 
 const SESSION_KEY = 'nodewarden.web.session.v4';
@@ -474,6 +475,7 @@ export function createAuthedFetch(getSession: () => SessionState | null, setSess
       for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
         try {
           const response = await fetch(input, { ...init, headers });
+          recordNodeWardenReachable();
           if (response.status !== 429 && (response.status < 500 || response.status >= 600)) {
             return response;
           }
@@ -484,6 +486,7 @@ export function createAuthedFetch(getSession: () => SessionState | null, setSess
         } catch (error) {
           lastError = error;
           if (attempt === maxAttempts - 1) {
+            recordNodeWardenUnreachable();
             throw error;
           }
         }
@@ -497,7 +500,6 @@ export function createAuthedFetch(getSession: () => SessionState | null, setSess
     if (!session?.accessToken) throw new Error(t('txt_offline_vault_readonly'));
     const headers = new Headers(init.headers || {});
     headers.set('Authorization', `Bearer ${session.accessToken}`);
-    headers.set('X-NodeWarden-Web', '1');
 
     let resp = await retryableRequest(headers);
     if (resp.status !== 401 || (!session.refreshToken && session.authMode !== 'web-cookie')) return resp;
@@ -506,7 +508,6 @@ export function createAuthedFetch(getSession: () => SessionState | null, setSess
     if (latest?.accessToken && latest.accessToken !== session.accessToken) {
       const latestHeaders = new Headers(init.headers || {});
       latestHeaders.set('Authorization', `Bearer ${latest.accessToken}`);
-      latestHeaders.set('X-NodeWarden-Web', '1');
       resp = await retryableRequest(latestHeaders);
       if (resp.status !== 401) return resp;
     }
@@ -532,7 +533,6 @@ export function createAuthedFetch(getSession: () => SessionState | null, setSess
 
     const retryHeaders = new Headers(init.headers || {});
     retryHeaders.set('Authorization', `Bearer ${nextSession.accessToken}`);
-    retryHeaders.set('X-NodeWarden-Web', '1');
     resp = await retryableRequest(retryHeaders);
     return resp;
   };
@@ -596,14 +596,35 @@ export async function changeMasterPassword(
   const nextEnc = await hkdfExpand(nextMasterKey, 'enc', 32);
   const nextMac = await hkdfExpand(nextMasterKey, 'mac', 32);
   const newKey = await encryptBw(userSym.slice(0, 64), nextEnc, nextMac);
+  const newMasterPasswordHash = bytesToBase64(nextHash);
 
   const resp = await authedFetch('/api/accounts/password', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
-      currentPasswordHash: current.hash,
-      newMasterPasswordHash: bytesToBase64(nextHash),
-      newKey,
+      masterPasswordHash: current.hash,
+      newMasterPasswordHash,
+      key: newKey,
+      authenticationData: {
+        kdf: {
+          kdfType: 0,
+          iterations: current.kdfIterations,
+          memory: null,
+          parallelism: null,
+        },
+        masterPasswordAuthenticationHash: newMasterPasswordHash,
+        salt: args.email.trim().toLowerCase(),
+      },
+      unlockData: {
+        kdf: {
+          kdfType: 0,
+          iterations: current.kdfIterations,
+          memory: null,
+          parallelism: null,
+        },
+        masterKeyWrappedUserKey: newKey,
+        salt: args.email.trim().toLowerCase(),
+      },
       kdf: 0,
       kdfIterations: current.kdfIterations,
     }),

webapp/src/lib/api/backup.ts

@@ -6,6 +6,7 @@ import type {
   BackupRuntimeState,
   BackupScheduleConfig,
   BackupSettings as AdminBackupSettings,
+  S3BackupAddressingStyle,
   S3BackupDestination,
   WebDavBackupDestination,
 } from '@shared/backup-schema';
@@ -26,6 +27,7 @@ export type {
   BackupRuntimeState,
   BackupScheduleConfig,
   AdminBackupSettings,
+  S3BackupAddressingStyle,
   S3BackupDestination,
   WebDavBackupDestination,
 };
@@ -47,6 +49,11 @@ export interface BackupSettingsRepairStateResponse {
   portable: BackupSettingsPortablePayload | null;
 }
 
+export interface BackupUserVerificationPayload {
+  masterPasswordHash?: string | null;
+  userVerificationToken?: string | null;
+}
+
 export interface AdminBackupRunResponse {
   object: 'backup-run';
   result: {
@@ -96,6 +103,7 @@ export interface AdminBackupImportCounts {
   users: number;
   domainSettings?: number;
   userRevisions: number;
+  trustedTwoFactorDeviceTokens?: number;
   webauthnCredentials?: number;
   folders: number;
   ciphers: number;
@@ -170,12 +178,13 @@ async function applyBackupFileIntegrityName(fileName: string, bytes: Uint8Array)
 
 export async function exportAdminBackup(
   authedFetch: AuthedFetch,
+  masterPasswordHash: string,
   includeAttachments: boolean = false
 ): Promise<AdminBackupExportPayload> {
   const resp = await authedFetch('/api/admin/backup/export', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ includeAttachments }),
+    body: JSON.stringify({ includeAttachments, masterPasswordHash }),
   });
   if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_backup_export_failed')));
 
@@ -198,10 +207,11 @@ export async function downloadAdminBackupAttachmentBlob(
 
 export async function buildCompleteAdminBackupExport(
   authedFetch: AuthedFetch,
+  masterPasswordHash: string,
   includeAttachments: boolean = false,
   onProgress?: (event: BackupExportClientProgressEvent) => void | Promise<void>
 ): Promise<AdminBackupExportPayload> {
-  const payload = await exportAdminBackup(authedFetch, includeAttachments);
+  const payload = await exportAdminBackup(authedFetch, masterPasswordHash, includeAttachments);
   if (!includeAttachments) {
     await onProgress?.({
       operation: 'backup-export',
@@ -275,12 +285,13 @@ export async function getAdminBackupSettings(authedFetch: AuthedFetch): Promise<
 
 export async function saveAdminBackupSettings(
   authedFetch: AuthedFetch,
+  masterPasswordHash: string,
   settings: AdminBackupSettings
 ): Promise<AdminBackupSettings> {
   const resp = await authedFetch('/api/admin/backup/settings', {
     method: 'PUT',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(settings),
+    body: JSON.stringify({ ...settings, masterPasswordHash }),
   });
   if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_backup_settings_save_failed')));
   const body = await parseJson<AdminBackupSettings>(resp);
@@ -302,12 +313,13 @@ export async function getAdminBackupSettingsRepairState(
 
 export async function repairAdminBackupSettings(
   authedFetch: AuthedFetch,
+  verification: BackupUserVerificationPayload,
   settings: AdminBackupSettings
 ): Promise<AdminBackupSettings> {
   const resp = await authedFetch('/api/admin/backup/settings/repair', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(settings),
+    body: JSON.stringify({ ...settings, ...verification }),
   });
   if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_backup_settings_save_failed')));
   const body = await parseJson<AdminBackupSettings>(resp);
@@ -317,12 +329,13 @@ export async function repairAdminBackupSettings(
 
 export async function runAdminBackupNow(
   authedFetch: AuthedFetch,
+  masterPasswordHash: string,
   destinationId?: string | null
 ): Promise<AdminBackupRunResponse> {
   const resp = await authedFetch('/api/admin/backup/run', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(destinationId ? { destinationId } : {}),
+    body: JSON.stringify(destinationId ? { destinationId, masterPasswordHash } : { masterPasswordHash }),
   });
   if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_backup_remote_run_failed')));
   const body = await parseJson<AdminBackupRunResponse>(resp);
@@ -348,14 +361,16 @@ export async function listRemoteBackups(
 
 export async function downloadRemoteBackup(
   authedFetch: AuthedFetch,
+  masterPasswordHash: string,
   destinationId: string,
   path: string,
   onProgress?: (percent: number | null) => void
 ): Promise<AdminBackupExportPayload> {
-  const params = new URLSearchParams();
-  params.set('destinationId', destinationId);
-  params.set('path', path);
-  const resp = await authedFetch(`/api/admin/backup/remote/download?${params.toString()}`, { method: 'GET' });
+  const resp = await authedFetch('/api/admin/backup/remote/download', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ destinationId, path, masterPasswordHash }),
+  });
   if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_backup_remote_download_failed')));
   const mimeType = String(resp.headers.get('Content-Type') || 'application/zip').trim() || 'application/zip';
   const fileName = parseContentDispositionFileName(resp, 'nodewarden_remote_backup.zip');
@@ -415,6 +430,7 @@ export async function inspectRemoteBackupIntegrity(
 
 export async function restoreRemoteBackup(
   authedFetch: AuthedFetch,
+  masterPasswordHash: string,
   destinationId: string,
   path: string,
   replaceExisting: boolean = false,
@@ -423,7 +439,7 @@ export async function restoreRemoteBackup(
   const resp = await authedFetch('/api/admin/backup/remote/restore', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ destinationId, path, replaceExisting, allowChecksumMismatch }),
+    body: JSON.stringify({ destinationId, path, replaceExisting, allowChecksumMismatch, masterPasswordHash }),
   });
   if (!resp.ok) throw new Error(await parseErrorMessage(resp, t('txt_backup_remote_restore_failed')));
   const body = await parseJson<AdminBackupImportResponse>(resp);
@@ -433,12 +449,14 @@ export async function restoreRemoteBackup(
 
 export async function importAdminBackup(
   authedFetch: AuthedFetch,
+  masterPasswordHash: string,
   file: File,
   replaceExisting: boolean = false,
   allowChecksumMismatch: boolean = false
 ): Promise<AdminBackupImportResponse> {
   const formData = new FormData();
   formData.set('file', file, file.name || 'nodewarden_backup.zip');
+  formData.set('masterPasswordHash', masterPasswordHash);
   if (replaceExisting) {
     formData.set('replaceExisting', '1');
   }

webapp/src/lib/api/send.ts

@@ -67,6 +67,17 @@ export async function getSends(authedFetch: AuthedFetch): Promise<Send[]> {
   return body?.data || [];
 }
 
+export async function getSendById(authedFetch: AuthedFetch, sendId: string): Promise<Send> {
+  const id = String(sendId || '').trim();
+  if (!id) throw new Error('Send id is required');
+  const resp = await authedFetch(`/api/sends/${encodeURIComponent(id)}`);
+  if (resp.status === 404) throw createApiError('Send not found', 404);
+  if (!resp.ok) throw new Error(await parseErrorMessage(resp, 'Load send failed'));
+  const body = await parseJson<Send>(resp);
+  if (!body?.id) throw new Error('Load send failed');
+  return body;
+}
+
 export async function createSend(
   authedFetch: AuthedFetch,
   session: SessionState,

webapp/src/lib/api/vault-sync.ts

@@ -51,6 +51,29 @@ export async function invalidateVaultCoreSyncSnapshot(cacheKey: string): Promise
   await clearCachedVaultCoreSnapshot(normalizedKey);
 }
 
+export async function saveVaultCoreSyncSnapshot(
+  cacheKey: string,
+  snapshot: VaultCoreSnapshot,
+  revisionStamp?: number | null
+): Promise<void> {
+  const normalizedKey = String(cacheKey || '').trim();
+  if (!normalizedKey) return;
+
+  const normalizedSnapshot = normalizeCachedSnapshot(snapshot);
+  const currentMemory = memoryVaultCoreCache.get(normalizedKey);
+  let nextRevisionStamp = Number(revisionStamp);
+  if (!Number.isFinite(nextRevisionStamp) || nextRevisionStamp <= 0) {
+    const cached = await loadCachedVaultCoreSnapshot(normalizedKey);
+    nextRevisionStamp = currentMemory?.revisionStamp || cached?.revisionStamp || Date.now();
+  }
+
+  memoryVaultCoreCache.set(normalizedKey, {
+    revisionStamp: nextRevisionStamp,
+    snapshot: normalizedSnapshot,
+  });
+  await saveCachedVaultCoreSnapshot(normalizedKey, nextRevisionStamp, normalizedSnapshot);
+}
+
 export async function loadVaultCoreSyncSnapshot(authedFetch: AuthedFetch, cacheKey: string): Promise<VaultCoreSnapshot> {
   const normalizedKey = String(cacheKey || '').trim();
   if (!normalizedKey) return { ciphers: [], folders: [], sends: [] };

webapp/src/lib/api/vault.ts

@@ -10,6 +10,7 @@ import type {
 import {
   BULK_API_CHUNK_SIZE,
   chunkArray,
+  createApiError,
   parseErrorMessage,
   parseJson,
   uploadDirectEncryptedPayload,
@@ -20,17 +21,29 @@ import { readResponseBytesWithProgress } from '../download';
 import { loadVaultCoreSyncSnapshot } from './vault-sync';
 
 type CipherLoginData = NonNullable<Cipher['login']>;
+const NODEWARDEN_WEB_REPAIR_HEADER = 'X-NodeWarden-Web';
 
 export async function getFolders(authedFetch: AuthedFetch, cacheKey: string): Promise<Folder[]> {
   const body = await loadVaultCoreSyncSnapshot(authedFetch, cacheKey);
   return body.folders || [];
 }
 
+export async function getFolderById(authedFetch: AuthedFetch, folderId: string): Promise<Folder> {
+  const id = String(folderId || '').trim();
+  if (!id) throw new Error('Folder id is required');
+  const resp = await authedFetch(`/api/folders/${encodeURIComponent(id)}`);
+  if (resp.status === 404) throw createApiError('Folder not found', 404);
+  if (!resp.ok) throw new Error(await parseErrorMessage(resp, 'Load folder failed'));
+  const body = await parseJson<Folder>(resp);
+  if (!body?.id) throw new Error('Load folder failed');
+  return body;
+}
+
 export async function createFolder(
   authedFetch: AuthedFetch,
   session: SessionState,
   name: string
-): Promise<{ id: string; name?: string | null }> {
+): Promise<Folder> {
   if (!session.symEncKey || !session.symMacKey) throw new Error('Vault key unavailable');
   const enc = base64ToBytes(session.symEncKey);
   const mac = base64ToBytes(session.symMacKey);
@@ -41,9 +54,9 @@ export async function createFolder(
     body: JSON.stringify({ name: encryptedName }),
   });
   if (!resp.ok) throw new Error('Create folder failed');
-  const body = await parseJson<{ id?: string; name?: string | null }>(resp);
+  const body = await parseJson<Folder>(resp);
   if (!body?.id) throw new Error('Create folder failed');
-  return { id: body.id, name: body.name ?? null };
+  return body;
 }
 
 export async function encryptFolderImportName(session: SessionState, name: string): Promise<string> {
@@ -79,7 +92,7 @@ export async function updateFolder(
   session: SessionState,
   folderId: string,
   name: string
-): Promise<void> {
+): Promise<Folder> {
   const id = String(folderId || '').trim();
   if (!id) throw new Error('Folder id is required');
   if (!session.symEncKey || !session.symMacKey) throw new Error('Vault key unavailable');
@@ -92,6 +105,9 @@ export async function updateFolder(
     body: JSON.stringify({ name: encryptedName }),
   });
   if (!resp.ok) throw new Error('Update folder failed');
+  const body = await parseJson<Folder>(resp);
+  if (!body?.id) throw new Error('Update folder failed');
+  return body;
 }
 
 export async function getCiphers(authedFetch: AuthedFetch, cacheKey: string): Promise<Cipher[]> {
@@ -99,6 +115,17 @@ export async function getCiphers(authedFetch: AuthedFetch, cacheKey: string): Pr
   return body.ciphers || [];
 }
 
+export async function getCipherById(authedFetch: AuthedFetch, cipherId: string): Promise<Cipher> {
+  const id = String(cipherId || '').trim();
+  if (!id) throw new Error('Cipher id is required');
+  const resp = await authedFetch(`/api/ciphers/${encodeURIComponent(id)}`);
+  if (resp.status === 404) throw createApiError('Cipher not found', 404);
+  if (!resp.ok) throw new Error(await parseErrorMessage(resp, 'Load cipher failed'));
+  const body = await parseJson<Cipher>(resp);
+  if (!body?.id) throw new Error('Load cipher failed');
+  return body;
+}
+
 export interface CiphersImportPayload {
   ciphers: Array<Record<string, unknown>>;
   folders: Array<{ name: string }>;
@@ -933,7 +960,7 @@ export async function repairCipherUriChecksums(
 
     const resp = await authedFetch(`/api/ciphers/${encodeURIComponent(cipher.id)}`, {
       method: 'PUT',
-      headers: { 'Content-Type': 'application/json' },
+      headers: { 'Content-Type': 'application/json', [NODEWARDEN_WEB_REPAIR_HEADER]: '1' },
       body: JSON.stringify(payload),
     });
     if (!resp.ok) throw new Error(await parseErrorMessage(resp, 'Repair URI checksum failed'));
@@ -1092,9 +1119,14 @@ export async function repairCipherKeyMismatches(
     if (!cipher?.id || !looksLikeCipherString(cipher.key)) continue;
     if (!(await hasItemKeyFieldMismatch(cipher, userEnc, userMac))) continue;
     if (hasUnresolvedEncryptedFields(cipher)) continue;
-    await updateCipher(authedFetch, session, cipher, draftFromDecryptedCipher(cipher), {
-      preserveRevisionDate: true,
-    });
+    await updateCipher(
+      authedFetch,
+      session,
+      cipher,
+      draftFromDecryptedCipher(cipher),
+      { preserveRevisionDate: true },
+      { webRepair: true }
+    );
     repaired += 1;
   }
 
@@ -1229,7 +1261,8 @@ export async function updateCipher(
   session: SessionState,
   cipher: Cipher,
   draft: VaultDraft,
-  extraPayload?: Record<string, unknown>
+  extraPayload?: Record<string, unknown>,
+  options?: { webRepair?: boolean }
 ): Promise<Cipher> {
   const payload = await buildCipherPayload(session, draft, cipher);
   if (extraPayload) {
@@ -1238,7 +1271,10 @@ export async function updateCipher(
 
   const resp = await authedFetch(`/api/ciphers/${encodeURIComponent(cipher.id)}`, {
     method: 'PUT',
-    headers: { 'Content-Type': 'application/json' },
+    headers: {
+      'Content-Type': 'application/json',
+      ...(options?.webRepair ? { [NODEWARDEN_WEB_REPAIR_HEADER]: '1' } : {}),
+    },
     body: JSON.stringify(payload),
   });
   if (!resp.ok) throw new Error('Update item failed');

webapp/src/lib/app-auth.ts

@@ -66,6 +66,12 @@ export interface CompletedLogin {
   session: SessionState;
   profile: Profile;
   profilePromise: Promise<Profile>;
+  freshMasterPasswordHash?: string | null;
+  freshUserVerificationToken?: string | null;
+}
+
+function readTokenUserVerificationToken(token: TokenSuccess): string | null {
+  return String(token.UserVerificationToken || token.userVerificationToken || '').trim() || null;
 }
 
 export type PasswordLoginResult =
@@ -279,20 +285,16 @@ export async function hydrateLockedSession(
   fallbackProfile: Profile | null = null
 ): Promise<{ session: SessionState | null; profile: Profile | null }> {
   const hasOfflineUnlock = hasOfflineUnlockRecord(session.email);
-  let serviceReachable = true;
-  if (hasOfflineUnlock) {
-    serviceReachable = await probeNodeWardenService();
-    if (!serviceReachable) {
-      return {
-        session,
-        profile: fallbackProfile || loadOfflineProfileSnapshot(session.email),
-      };
-    }
+  if (hasOfflineUnlock && browserReportsOffline()) {
+    return {
+      session,
+      profile: fallbackProfile || loadOfflineProfileSnapshot(session.email),
+    };
   }
 
   const refreshedSession = await maybeRefreshSession(session);
   if (!refreshedSession?.accessToken) {
-    if (hasOfflineUnlock && !serviceReachable) {
+    if (hasOfflineUnlock && (browserReportsOffline() || !(await probeNodeWardenService()))) {
       return {
         session,
         profile: fallbackProfile || loadOfflineProfileSnapshot(session.email),
@@ -323,7 +325,8 @@ export async function completeLogin(
   token: TokenSuccess,
   email: string,
   masterKey: Uint8Array,
-  fallbackKdfIterations: number
+  fallbackKdfIterations: number,
+  freshMasterPasswordHash?: string | null
 ): Promise<CompletedLogin> {
   const normalizedEmail = email.trim().toLowerCase();
   const fallbackProfile = loadProfileSnapshot(normalizedEmail);
@@ -352,6 +355,8 @@ export async function completeLogin(
     session: { ...baseSession, ...keys },
     profile,
     profilePromise: getProfile(tempFetch),
+    freshMasterPasswordHash: freshMasterPasswordHash || null,
+    freshUserVerificationToken: readTokenUserVerificationToken(token),
   };
 }
 
@@ -364,7 +369,8 @@ async function completeLoginWithVaultKeys(
   token: TokenSuccess,
   email: string,
   keys: { symEncKey: string; symMacKey: string },
-  fallbackKdfIterations: number
+  fallbackKdfIterations: number,
+  freshMasterPasswordHash?: string | null
 ): Promise<CompletedLogin> {
   const normalizedEmail = email.trim().toLowerCase();
   const fallbackProfile = loadProfileSnapshot(normalizedEmail);
@@ -389,6 +395,8 @@ async function completeLoginWithVaultKeys(
     session: { ...baseSession, ...keys },
     profile,
     profilePromise: getProfile(tempFetch),
+    freshMasterPasswordHash: freshMasterPasswordHash || null,
+    freshUserVerificationToken: readTokenUserVerificationToken(token),
   };
 }
 
@@ -404,7 +412,7 @@ export async function performPasswordLogin(
   if ('access_token' in token && token.access_token) {
     return {
       kind: 'success',
-      login: await completeLogin(token, normalizedEmail, derived.masterKey, derived.kdfIterations),
+      login: await completeLogin(token, normalizedEmail, derived.masterKey, derived.kdfIterations, derived.hash),
     };
   }
 
@@ -480,7 +488,7 @@ export async function completePasskeyPasswordLogin(
   password: string
 ): Promise<CompletedLogin> {
   const derived = await deriveLoginHashLocally(pending.email, password, pending.kdfIterations);
-  return completeLogin(pending.token, pending.email, derived.masterKey, pending.kdfIterations);
+  return completeLogin(pending.token, pending.email, derived.masterKey, pending.kdfIterations, derived.hash);
 }
 
 export async function performTotpLogin(
@@ -493,7 +501,7 @@ export async function performTotpLogin(
     rememberDevice,
   });
   if ('access_token' in token && token.access_token) {
-    return completeLogin(token, pendingTotp.email, pendingTotp.masterKey, pendingTotp.kdfIterations);
+    return completeLogin(token, pendingTotp.email, pendingTotp.masterKey, pendingTotp.kdfIterations, pendingTotp.passwordHash);
   }
   const tokenError = token as { error_description?: string; error?: string };
   throw new Error(translateServerError(tokenError.error_description || tokenError.error, t('txt_totp_verify_failed')));
@@ -512,7 +520,7 @@ export async function performRecoverTwoFactorLogin(
 
   if ('access_token' in token && token.access_token) {
     return {
-      login: await completeLogin(token, normalizedEmail, derived.masterKey, derived.kdfIterations),
+      login: await completeLogin(token, normalizedEmail, derived.masterKey, derived.kdfIterations, derived.hash),
       newRecoveryCode: recovered.newRecoveryCode || null,
     };
   }
@@ -561,6 +569,7 @@ export async function performUnlock(
           session: offline.session,
           profile: offline.profile,
           profilePromise: Promise.resolve(offline.profile),
+          freshMasterPasswordHash: null,
         },
       };
     } catch {
@@ -571,14 +580,8 @@ export async function performUnlock(
     }
   };
 
-  if (hasOfflineUnlock) {
-    if (browserReportsOffline()) {
-      return unlockOffline();
-    }
-    const serviceReachable = await probeNodeWardenService();
-    if (!serviceReachable) {
-      return unlockOffline();
-    }
+  if (hasOfflineUnlock && browserReportsOffline()) {
+    return unlockOffline();
   }
 
   let token: TokenSuccess | { TwoFactorProviders?: unknown; error_description?: string; error?: string };
@@ -599,7 +602,7 @@ export async function performUnlock(
   if ('access_token' in token && token.access_token) {
     return {
       kind: 'success',
-      login: await completeLogin(token, normalizedEmail, derived.masterKey, derived.kdfIterations),
+      login: await completeLogin(token, normalizedEmail, derived.masterKey, derived.kdfIterations, derived.hash),
     };
   }
 

webapp/src/lib/backup-recommendations.ts

@@ -4,7 +4,7 @@ export interface RecommendedStorageLink {
 }
 
 export interface RecommendedProviderBase {
-  id: 'infinicloud' | 'koofr' | 'pcloud';
+  id: 'infinicloud' | 'koofr' | 'pcloud' | 'backblaze-b2' | 'cloudflare-r2' | 'tigris';
   name: string;
   capacity: string;
   protocol: 'webdav' | 's3';
@@ -28,7 +28,25 @@ export interface PcloudProvider extends RecommendedProviderBase {
   id: 'pcloud';
 }
 
-export type RecommendedProvider = InfinicloudProvider | KoofrProvider | PcloudProvider;
+export interface BackblazeB2Provider extends RecommendedProviderBase {
+  id: 'backblaze-b2';
+  bucketsUrl: string;
+  applicationKeysUrl: string;
+}
+
+export interface CloudflareR2Provider extends RecommendedProviderBase {
+  id: 'cloudflare-r2';
+  bucketUrl: string;
+  apiTokenUrl: string;
+}
+
+export interface TigrisProvider extends RecommendedProviderBase {
+  id: 'tigris';
+  bucketUrl: string;
+  accessKeyUrl: string;
+}
+
+export type RecommendedProvider = InfinicloudProvider | KoofrProvider | PcloudProvider | BackblazeB2Provider | CloudflareR2Provider | TigrisProvider;
 
 export const RECOMMENDED_PROVIDERS: RecommendedProvider[] = [
   {
@@ -61,6 +79,33 @@ export const RECOMMENDED_PROVIDERS: RecommendedProvider[] = [
     signupUrl: 'https://u.pcloud.com/#/register?invite=GITx7ZvEU1N7',
     hasAffiliateLink: true,
   },
+  {
+    id: 'backblaze-b2',
+    name: 'Backblaze B2',
+    capacity: '10G',
+    protocol: 's3',
+    signupUrl: 'https://secure.backblaze.com/user_signin.htm',
+    bucketsUrl: 'https://secure.backblaze.com/b2_buckets.htm',
+    applicationKeysUrl: 'https://secure.backblaze.com/app_keys.htm',
+  },
+  {
+    id: 'cloudflare-r2',
+    name: 'Cloudflare R2',
+    capacity: '10G',
+    protocol: 's3',
+    signupUrl: 'https://dash.cloudflare.com/?to=/:account/r2/new',
+    bucketUrl: 'https://dash.cloudflare.com/?to=/:account/r2/new',
+    apiTokenUrl: 'https://dash.cloudflare.com/?to=/:account/r2/api-tokens/create?type=user',
+  },
+  {
+    id: 'tigris',
+    name: 'Tigris',
+    capacity: '5G',
+    protocol: 's3',
+    signupUrl: 'https://console.storage.dev/signup',
+    bucketUrl: 'https://console.storage.dev/createbucket',
+    accessKeyUrl: 'https://console.storage.dev/createaccesskey',
+  },
 ];
 
 export function hasLinkedStorages(provider: RecommendedProvider): provider is KoofrProvider {

webapp/src/lib/backup-settings-repair.ts

@@ -5,7 +5,8 @@ import type { Profile, SessionState } from './types';
 
 export async function silentlyRepairBackupSettingsIfNeeded(
   activeSession: SessionState,
-  activeProfile: Profile
+  activeProfile: Profile,
+  verification?: { masterPasswordHash?: string | null; userVerificationToken?: string | null } | null
 ): Promise<void> {
   if (activeProfile.role !== 'admin') return;
   if (!activeSession.accessToken || !activeSession.symEncKey || !activeSession.symMacKey) return;
@@ -14,8 +15,9 @@ export async function silentlyRepairBackupSettingsIfNeeded(
   try {
     const state = await getAdminBackupSettingsRepairState(tempFetch);
     if (!state.needsRepair || !state.portable) return;
+    if (!verification?.masterPasswordHash && !verification?.userVerificationToken) return;
     const repairedSettings = await decryptPortableBackupSettings(state.portable, activeProfile, activeSession);
-    await repairAdminBackupSettings(tempFetch, repairedSettings);
+    await repairAdminBackupSettings(tempFetch, verification, repairedSettings);
   } catch (error) {
     console.error('Backup settings auto-repair failed:', error);
   }

webapp/src/lib/crypto.ts

@@ -220,6 +220,25 @@ function normalizeTotpSecret(secret: string): string {
   return secret.toUpperCase().replace(/[\s-]/g, '').replace(/=+$/g, '');
 }
 
+function readOtpAuthParam(raw: string, name: string): string {
+  const queryStart = raw.indexOf('?');
+  if (queryStart < 0) return '';
+  const fragmentStart = raw.indexOf('#', queryStart + 1);
+  const query = raw.slice(queryStart + 1, fragmentStart > queryStart ? fragmentStart : undefined);
+  for (const part of query.split('&')) {
+    const eq = part.indexOf('=');
+    const key = eq >= 0 ? part.slice(0, eq) : part;
+    if (key.trim().toLowerCase() !== name.toLowerCase()) continue;
+    const value = eq >= 0 ? part.slice(eq + 1) : '';
+    try {
+      return decodeURIComponent(value.replace(/\+/g, ' '));
+    } catch {
+      return value;
+    }
+  }
+  return '';
+}
+
 function parseSteamSecret(raw: string): string {
   const match = raw.trim().match(/^steam:\/\/([^/?#]+)(?:[/?#].*)?$/i);
   if (!match?.[1]) return '';
@@ -276,7 +295,8 @@ function parseTotpConfig(raw: string): TotpConfig {
   if (/^otpauth:\/\//i.test(s)) {
     try {
       const u = new URL(s);
-      if (u.hostname.toLowerCase() !== 'totp') {
+      const otpType = u.hostname.toLowerCase();
+      if (otpType !== 'totp') {
         return { secret: '', steam: false, ...DEFAULT_TOTP_CONFIG };
       }
       const label = decodeURIComponent((u.pathname || '').replace(/^\/+/, '')).toLowerCase();
@@ -291,7 +311,16 @@ function parseTotpConfig(raw: string): TotpConfig {
         period: parseTotpPositiveInt(u.searchParams.get('period'), DEFAULT_TOTP_CONFIG.period, 1, 3600),
       };
     } catch {
-      return { secret: '', steam: false, ...DEFAULT_TOTP_CONFIG };
+      const issuer = readOtpAuthParam(s, 'issuer').trim().toLowerCase();
+      const algorithm = readOtpAuthParam(s, 'algorithm').trim().toLowerCase();
+      const steam = issuer === 'steam' || algorithm === 'steam';
+      return {
+        secret: normalizeTotpSecret(readOtpAuthParam(s, 'secret')),
+        steam,
+        algorithm: steam ? 'SHA-1' : parseTotpHashAlgorithm(algorithm),
+        digits: steam ? 5 : parseTotpPositiveInt(readOtpAuthParam(s, 'digits'), DEFAULT_TOTP_CONFIG.digits, 1, 10),
+        period: parseTotpPositiveInt(readOtpAuthParam(s, 'period'), DEFAULT_TOTP_CONFIG.period, 1, 3600),
+      };
     }
   }
   return { secret: normalizeTotpSecret(s), steam: false, ...DEFAULT_TOTP_CONFIG };

webapp/src/lib/demo.ts

@@ -1156,32 +1156,32 @@ export function createDemoMainRoutesProps(base: AppMainRoutesProps, notify: Noti
       notify('success', t('txt_logs_cleared'));
       return 0;
     },
-    onExportBackup: async () => {
+    onExportBackup: async (_masterPassword: string) => {
       notify('success', t('txt_backup_export_success'));
     },
-    onImportBackup: async () => {
+    onImportBackup: async (_masterPassword: string, _file: File, _replaceExisting?: boolean) => {
       resetDemoVaultState(state);
       notify('success', t('txt_backup_import_success_relogin'));
       return createDemoImportBackupResult();
     },
-    onImportBackupAllowingChecksumMismatch: async () => {
+    onImportBackupAllowingChecksumMismatch: async (_masterPassword: string, _file: File, _replaceExisting?: boolean) => {
       resetDemoVaultState(state);
       notify('success', t('txt_backup_import_success_relogin'));
       return createDemoImportBackupResult();
     },
     onLoadBackupSettings: async () => state.backupSettings,
-    onSaveBackupSettings: async (settings) => {
+    onSaveBackupSettings: async (_masterPassword: string, settings) => {
       const next = cloneJson(settings);
       state.setBackupSettings(next);
       notify('success', t('txt_backup_settings_saved'));
       return next;
     },
-    onRunRemoteBackup: async (destinationId?: string | null) => {
+    onRunRemoteBackup: async (_masterPassword: string, destinationId?: string | null) => {
       notify('success', t('txt_backup_remote_run_success'));
       return createDemoBackupRun(state.backupSettings, destinationId);
     },
     onListRemoteBackups: async (destinationId: string, path: string) => createDemoRemoteBrowser(destinationId, path),
-    onDownloadRemoteBackup: async () => {
+    onDownloadRemoteBackup: async (_masterPassword: string, _destinationId: string, _path: string, _onProgress?: (percent: number | null) => void) => {
       notify('success', t('txt_demo_download_prepared'));
     },
     onInspectRemoteBackup: async (_destinationId: string, path: string) => ({
@@ -1199,13 +1199,13 @@ export function createDemoMainRoutesProps(base: AppMainRoutesProps, notify: Noti
     onDeleteRemoteBackup: async () => {
       notify('success', t('txt_backup_remote_delete_success'));
     },
-    onRestoreRemoteBackup: async (_destinationId, path) => {
+    onRestoreRemoteBackup: async (_masterPassword: string, _destinationId, path) => {
       await runDemoRemoteRestoreProgress(path.split('/').pop() || path || 'nodewarden_backup_demo.zip');
       resetDemoVaultState(state);
       notify('success', t('txt_backup_remote_restore_completed_verified'));
       return createDemoImportBackupResult();
     },
-    onRestoreRemoteBackupAllowingChecksumMismatch: async (_destinationId, path) => {
+    onRestoreRemoteBackupAllowingChecksumMismatch: async (_masterPassword: string, _destinationId, path) => {
       await runDemoRemoteRestoreProgress(path.split('/').pop() || path || 'nodewarden_backup_demo.zip');
       resetDemoVaultState(state);
       notify('success', t('txt_backup_remote_restore_completed_verified'));

webapp/src/lib/export-formats.ts

@@ -9,6 +9,7 @@ configureZipJs({ useWebWorkers: false });
 
 export const EXPORT_FORMATS = [
   { id: 'bitwarden_json', label: 'Bitwarden (vault as json)' },
+  { id: 'bitwarden_csv', label: 'Bitwarden (vault as csv)' },
   { id: 'bitwarden_encrypted_json', label: 'Bitwarden (encrypted vault as json)' },
   { id: 'bitwarden_json_zip', label: 'Bitwarden (vault + attachments as zip)' },
   { id: 'bitwarden_encrypted_json_zip', label: 'Bitwarden (encrypted vault + attachments as zip)' },
@@ -70,6 +71,31 @@ function isRecord(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === 'object';
 }
 
+function csvText(value: unknown): string {
+  if (value === null || value === undefined) return '';
+  if (typeof value === 'string') return value;
+  if (typeof value === 'number' || typeof value === 'boolean') return String(value);
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+
+function escapeCsvCell(value: unknown): string {
+  const text = csvText(value);
+  if (!/[",\r\n]/.test(text)) return text;
+  return `"${text.replace(/"/g, '""')}"`;
+}
+
+function buildCsvString(rows: string[][]): string {
+  return `${rows.map((row) => row.map(escapeCsvCell).join(',')).join('\r\n')}\r\n`;
+}
+
+function buildSingleRowCsvString(values: string[]): string {
+  return values.map(escapeCsvCell).join(',');
+}
+
 function isCipherString(value: string): boolean {
   return /^\d+\.[A-Za-z0-9+/=]+\|[A-Za-z0-9+/=]+(?:\|[A-Za-z0-9+/=]+)?$/.test(String(value || '').trim());
 }
@@ -383,6 +409,106 @@ export async function buildPlainBitwardenJsonString(args: BuildPlainJsonArgs): P
   return JSON.stringify(doc, null, 2);
 }
 
+const BITWARDEN_CSV_HEADERS = [
+  'folder',
+  'favorite',
+  'type',
+  'name',
+  'notes',
+  'fields',
+  'reprompt',
+  'login_uri',
+  'login_username',
+  'login_password',
+  'login_totp',
+] as const;
+
+function bitwardenCsvType(type: number): 'login' | 'note' {
+  return type === 1 ? 'login' : 'note';
+}
+
+function sourceTypeLabel(type: number): string {
+  if (type === 3) return 'card';
+  if (type === 4) return 'identity';
+  if (type === 5) return 'sshKey';
+  if (type === 2) return 'note';
+  return `type ${type}`;
+}
+
+function appendFieldLine(lines: string[], name: unknown, value: unknown): void {
+  const key = csvText(name).trim();
+  const text = csvText(value);
+  if (!key || !text) return;
+  lines.push(`${key}: ${text}`);
+}
+
+function appendRecordFieldLines(lines: string[], prefix: string, value: unknown): void {
+  if (!isRecord(value)) return;
+  for (const [key, fieldValue] of Object.entries(value)) {
+    appendFieldLine(lines, `${prefix}.${key}`, fieldValue);
+  }
+}
+
+function buildBitwardenCsvFields(item: Record<string, unknown>, type: number): string {
+  const lines: string[] = [];
+  const fields = Array.isArray(item.fields) ? item.fields : [];
+  for (const field of fields) {
+    if (!isRecord(field)) continue;
+    appendFieldLine(lines, field.name, field.value);
+  }
+  if (type !== 1 && type !== 2) {
+    appendFieldLine(lines, 'nodewardenType', sourceTypeLabel(type));
+    appendRecordFieldLines(lines, sourceTypeLabel(type), item[sourceTypeLabel(type)]);
+  }
+  return lines.join('\n');
+}
+
+function buildFolderNameById(foldersRaw: unknown): Map<string, string> {
+  const out = new Map<string, string>();
+  const folders = Array.isArray(foldersRaw) ? foldersRaw : [];
+  for (const folder of folders) {
+    if (!isRecord(folder)) continue;
+    const id = csvText(folder.id).trim();
+    if (!id) continue;
+    out.set(id, csvText(folder.name));
+  }
+  return out;
+}
+
+function buildBitwardenCsvLoginUri(login: Record<string, unknown> | null): string {
+  const uris = Array.isArray(login?.uris) ? login.uris : [];
+  return buildSingleRowCsvString(uris
+    .map((uri) => (isRecord(uri) ? csvText(uri.uri).trim() : ''))
+    .filter(Boolean));
+}
+
+export function buildBitwardenCsvString(bitwardenJsonDoc: Record<string, unknown>): string {
+  const folderNameById = buildFolderNameById(bitwardenJsonDoc.folders);
+  const rows: string[][] = [[...BITWARDEN_CSV_HEADERS]];
+  const items = Array.isArray(bitwardenJsonDoc.items) ? bitwardenJsonDoc.items : [];
+  for (const itemRaw of items) {
+    if (!isRecord(itemRaw)) continue;
+    const type = normalizeNumber(itemRaw.type, 1);
+    const isLogin = type === 1;
+    const login = isRecord(itemRaw.login) ? itemRaw.login : null;
+    const folderId = csvText(itemRaw.folderId).trim();
+    rows.push([
+      folderNameById.get(folderId) || '',
+      itemRaw.favorite ? '1' : '0',
+      bitwardenCsvType(type),
+      csvText(itemRaw.name) || '--',
+      csvText(itemRaw.notes),
+      buildBitwardenCsvFields(itemRaw, type),
+      String(normalizeNumber(itemRaw.reprompt, 0)),
+      isLogin ? buildBitwardenCsvLoginUri(login) : '',
+      isLogin ? csvText(login?.username) : '',
+      isLogin ? csvText(login?.password) : '',
+      isLogin ? csvText(login?.totp) : '',
+    ]);
+  }
+  return `\uFEFF${buildCsvString(rows)}`;
+}
+
 export async function buildAccountEncryptedBitwardenJsonString(args: BuildEncryptedJsonArgs): Promise<string> {
   const userEnc = base64ToBytes(args.userEncB64);
   const userMac = base64ToBytes(args.userMacB64);
@@ -566,11 +692,13 @@ function nowStamp(now = new Date()): string {
 export function buildExportFileName(format: ExportFormatId, zipEncrypted = false): string {
   const stamp = nowStamp();
   if (
+    format === 'bitwarden_csv' ||
     format === 'bitwarden_json' ||
     format === 'bitwarden_encrypted_json' ||
     format === 'nodewarden_json' ||
     format === 'nodewarden_encrypted_json'
   ) {
+    if (format === 'bitwarden_csv') return `bitwarden_export_${stamp}.csv`;
     if (format.startsWith('nodewarden_')) return `nodewarden_export_${stamp}.json`;
     return `bitwarden_export_${stamp}.json`;
   }

webapp/src/lib/i18n.ts

@@ -113,27 +113,115 @@ export function translateServerError(message: string | null | undefined, fallbac
     return t('txt_rate_limit_try_again_seconds', { seconds: rateLimitMatch[1] });
   }
 
+  const backupDestinationLimitMatch = normalized.match(/^You can save up to (\d+) backup destinations$/i);
+  if (backupDestinationLimitMatch) {
+    return t('txt_backup_error_destination_limit', { count: backupDestinationLimitMatch[1] });
+  }
+
+  const backupArchiveVerificationMatch = normalized.match(/^Backup archive upload verification failed after (\d+) attempts: (.+)$/i);
+  if (backupArchiveVerificationMatch) {
+    return t('txt_backup_error_archive_upload_verification_failed_attempts', {
+      count: backupArchiveVerificationMatch[1],
+      reason: translateServerError(backupArchiveVerificationMatch[2], backupArchiveVerificationMatch[2]),
+    });
+  }
+
+  const remoteAttachmentStatusMatch = normalized.match(/^Remote attachment (download|batch download) failed: (\d+)$/i);
+  if (remoteAttachmentStatusMatch) {
+    return t(
+      remoteAttachmentStatusMatch[1].toLowerCase() === 'batch download'
+        ? 'txt_backup_error_remote_attachment_batch_download_failed_status'
+        : 'txt_backup_error_remote_attachment_download_failed_status',
+      { status: remoteAttachmentStatusMatch[2] }
+    );
+  }
+
+  const providerStatusMatch = normalized.match(/^(WebDAV|S3) (directory creation|upload|listing|download|delete|existence check) failed: (\d+)$/i);
+  if (providerStatusMatch) {
+    const provider = providerStatusMatch[1].toLowerCase() === 'webdav' ? 'webdav' : 's3';
+    const actionKey = providerStatusMatch[2].toLowerCase().replace(/\s+/g, '_');
+    return t(`txt_backup_error_${provider}_${actionKey}_failed_status`, { status: providerStatusMatch[3] });
+  }
+
   const key = {
     'Account is disabled': 'txt_server_error_account_disabled',
+    'Another backup or restore run is already in progress': 'txt_backup_error_another_backup_or_restore_running',
+    'Another backup run is already in progress': 'txt_backup_error_another_backup_running',
+    'Backup archive upload failed': 'txt_backup_error_archive_upload_failed',
+    'Backup attachment blob is invalid': 'txt_backup_error_attachment_blob_invalid',
+    'Backup attachment blob is required': 'txt_backup_error_attachment_blob_required',
+    'Backup attachment blob not found': 'txt_backup_error_attachment_blob_not_found',
+    'Backup attachment download failed': 'txt_backup_error_attachment_download_failed',
+    'Backup destination is invalid': 'txt_backup_error_destination_invalid',
+    'Backup destination not found': 'txt_backup_error_destination_not_found',
+    'Backup destination ids must be unique': 'txt_backup_error_destination_ids_unique',
+    'Backup destination type is invalid': 'txt_backup_error_destination_type_invalid',
+    'Backup destinations are invalid': 'txt_backup_error_destinations_invalid',
+    'Backup export payload is invalid': 'txt_backup_error_export_payload_invalid',
+    'Backup file checksum does not match its filename': 'txt_backup_error_file_checksum_mismatch',
+    'Backup file is required': 'txt_backup_error_file_required',
+    'Backup interval hours must be between 1 and 99': 'txt_backup_error_interval_hours_range',
+    'Backup retention count must be between 1 and 1000': 'txt_backup_error_retention_count_range',
+    'Backup run failed': 'txt_backup_error_run_failed',
+    'Backup run payload is invalid': 'txt_backup_error_run_payload_invalid',
+    'Backup run response is invalid': 'txt_backup_error_run_response_invalid',
+    'Backup settings are invalid': 'txt_backup_error_settings_invalid',
+    'Backup settings could not be loaded': 'txt_backup_error_settings_load_failed',
+    'Backup settings envelope is invalid': 'txt_backup_error_settings_envelope_invalid',
+    'Backup settings need administrator reactivation after restore': 'txt_backup_error_settings_need_reactivation',
+    'Backup settings payload is invalid': 'txt_backup_error_settings_payload_invalid',
+    'Backup settings repair payload is invalid': 'txt_backup_error_settings_repair_payload_invalid',
+    'Backup settings repair state could not be loaded': 'txt_backup_error_settings_repair_state_load_failed',
+    'Backup start time must be in HH:mm format': 'txt_backup_error_start_time_format',
     'Client IP is required': 'txt_server_error_client_ip_required',
     'ClientId or clientSecret is incorrect. Try again': 'txt_server_error_client_credentials_incorrect',
+    'Content-Type must be multipart/form-data': 'txt_backup_error_multipart_required',
     'Email already registered': 'txt_server_error_email_already_registered',
     'Email and password are required': 'txt_server_error_email_password_required',
     'Email is required': 'txt_server_error_email_required',
+    'Forbidden': 'txt_server_error_forbidden',
     'Invite code is invalid or expired': 'txt_server_error_invite_invalid_or_expired',
     'Invite code is required': 'txt_server_error_invite_required',
+    'Invalid backup timezone': 'txt_backup_error_timezone_invalid',
+    'Invalid password': 'txt_server_error_invalid_password',
     'Invalid refresh token': 'txt_server_error_invalid_refresh_token',
+    'Invalid remote backup path': 'txt_backup_error_remote_path_invalid',
     'Invalid request payload': 'txt_server_error_invalid_request_payload',
+    'Invalid user verification token': 'txt_server_error_invalid_user_verification_token',
     'JWT_SECRET is not set': 'txt_server_error_jwt_secret_missing',
     'JWT_SECRET is using the default/sample value. Please change it.': 'txt_server_error_jwt_secret_default',
     'JWT_SECRET must be at least 32 characters': 'txt_server_error_jwt_secret_too_short',
     'Parameter error': 'txt_server_error_parameter_error',
+    'Please select a backup file': 'txt_backup_error_select_backup_file',
+    'Please select a backup ZIP file': 'txt_backup_error_select_backup_zip_file',
     'Refresh token is required': 'txt_server_error_refresh_token_required',
+    'Remote backup ZIP checksum verification failed': 'txt_backup_error_remote_zip_checksum_failed',
+    'Remote backup ZIP size verification failed': 'txt_backup_error_remote_zip_size_failed',
+    'Remote backup delete failed': 'txt_backup_error_remote_delete_failed',
+    'Remote backup download failed': 'txt_backup_error_remote_download_failed',
+    'Remote backup download payload is invalid': 'txt_backup_error_remote_download_payload_invalid',
+    'Remote backup integrity inspection failed': 'txt_backup_error_remote_integrity_failed',
+    'Remote backup listing failed': 'txt_backup_error_remote_listing_failed',
+    'Remote restore payload is invalid': 'txt_backup_error_remote_restore_payload_invalid',
     'Registration is temporarily unavailable, retry once': 'txt_server_error_registration_retry',
+    'S3 access key is required': 'txt_backup_error_s3_access_key_required',
+    'S3 bucket is required': 'txt_backup_error_s3_bucket_required',
+    'S3 endpoint is required': 'txt_backup_error_s3_endpoint_required',
+    'S3 endpoint must start with http:// or https://': 'txt_backup_error_s3_endpoint_protocol',
+    'S3 secret key is required': 'txt_backup_error_s3_secret_key_required',
     'TOTP token is required': 'txt_server_error_totp_token_required',
     'Two factor required.': 'txt_server_error_two_factor_required',
     'Two-step token is invalid. Try again.': 'txt_server_error_two_factor_invalid',
+    'Unable to read backup file': 'txt_backup_error_read_backup_file_failed',
+    'Unsupported backup destination type': 'txt_backup_error_destination_type_unsupported',
     'Username or password is incorrect. Try again': 'txt_server_error_username_password_incorrect',
+    'WebDAV password is required': 'txt_backup_error_webdav_password_required',
+    'WebDAV remote backup path is too deep for safe attachment batching': 'txt_backup_error_webdav_path_too_deep',
+    'WebDAV server URL is required': 'txt_backup_error_webdav_url_required',
+    'WebDAV server URL must start with http:// or https://': 'txt_backup_error_webdav_url_protocol',
+    'WebDAV username is required': 'txt_backup_error_webdav_username_required',
+    'masterPasswordHash is required': 'txt_server_error_master_password_hash_required',
+    'masterPasswordHash or userVerificationToken is required': 'txt_server_error_master_password_or_verification_required',
   }[normalized];
 
   return key ? t(key) : normalized;

webapp/src/lib/i18n/locales/en.ts

@@ -85,6 +85,37 @@ const en: Record<string, string> = {
   "txt_backup_recommend_pcloud_step_1": "Register a pCloud account with just your email address.",
   "txt_backup_recommend_pcloud_step_2": "Use https://webdav.pcloud.com/ as the WebDAV server URL.",
   "txt_backup_recommend_pcloud_step_3": "Use your registration email as the WebDAV username and your account password as the WebDAV password.",
+  "txt_backup_recommend_backblaze_summary": "S3-compatible object storage with 10 GB free and no credit card required.",
+  "txt_backup_recommend_backblaze_step_1": "Register or sign in to a Backblaze account.",
+  "txt_backup_recommend_backblaze_step_2_prefix": "Open",
+  "txt_backup_recommend_backblaze_step_2_suffix": ", click Create a Bucket, enter only the bucket name, leave the other settings unchanged, and create it.",
+  "txt_backup_recommend_backblaze_step_3": "After creation, put the displayed Endpoint into S3 Endpoint URL, use the bucket name for Bucket Name, and use the middle segment of the endpoint, such as us-west-004, for Region.",
+  "txt_backup_recommend_backblaze_step_4_prefix": "Open",
+  "txt_backup_recommend_backblaze_step_4_suffix": ", click Add a New Application Key, enter any Name of Key, leave the other settings unchanged, and create it.",
+  "txt_backup_recommend_backblaze_step_5": "Use keyID as the access key and applicationKey as the secret key.",
+  "txt_backup_recommend_cloudflare_r2_summary": "S3-compatible object storage with 10 GB free, but it requires credit card verification.",
+  "txt_backup_recommend_cloudflare_r2_bucket_link": "Create bucket page",
+  "txt_backup_recommend_cloudflare_r2_api_link": "API token page",
+  "txt_backup_recommend_cloudflare_r2_step_1_prefix": "Open the",
+  "txt_backup_recommend_cloudflare_r2_step_1_suffix": ", enter only the bucket name, and create it directly.",
+  "txt_backup_recommend_cloudflare_r2_step_2_prefix": "Open the",
+  "txt_backup_recommend_cloudflare_r2_step_2_suffix": ", select Object Read & Write for permissions, and create it directly.",
+  "txt_backup_recommend_cloudflare_r2_step_3": "Ignore the token value after creation. Fill Access Key ID into Access ID, and Secret Access Key into Access Password.",
+  "txt_backup_recommend_cloudflare_r2_step_4": "Copy the address shown below into S3 Endpoint URL, fill Bucket Name exactly as shown, and leave Region as auto.",
+  "txt_backup_recommend_cloudflare_r2_step_5": "Set Path Prefix as needed, for example nodewarden, or leave it empty if you do not want a folder prefix.",
+  "txt_backup_recommend_s3_path_prefix_step": "Set Path Prefix as needed, for example nodewarden, or leave it empty if you do not want a folder prefix.",
+  "txt_backup_recommend_tigris_summary": "S3-compatible object storage with 5 GB free and no credit card required.",
+  "txt_backup_recommend_tigris_signup_link": "signup page",
+  "txt_backup_recommend_tigris_bucket_link": "Create Bucket page",
+  "txt_backup_recommend_tigris_access_key_link": "Create Access Key page",
+  "txt_backup_recommend_tigris_step_1_prefix": "Open the",
+  "txt_backup_recommend_tigris_step_1_suffix": ", sign up, and log in to Tigris.",
+  "txt_backup_recommend_tigris_step_2_prefix": "Open",
+  "txt_backup_recommend_tigris_step_2_suffix": ", enter only the bucket name, leave everything else unchanged, and create it.",
+  "txt_backup_recommend_tigris_step_3_prefix": "Then open the",
+  "txt_backup_recommend_tigris_step_3_suffix": ", use any name you like, and create it.",
+  "txt_backup_recommend_tigris_step_4": "Ignore Endpoint URL IAM after creation. Fill the other displayed values into the backup page using the matching field names.",
+  "txt_backup_recommend_tigris_step_5": "Finally, click Manage Key Permissions and turn on Admin Access, otherwise writing backups will fail.",
   "txt_backup_add_destination": "Add Destination",
   "txt_backup_schedule_panel_title": "Automatic Schedule",
   "txt_backup_schedule_panel_note": "Each destination can keep its own daily backup schedule.",
@@ -193,10 +224,14 @@ const en: Record<string, string> = {
   "txt_backup_restore_progress_remote_finalize_detail": "The server is performing final validation and then switching the verified restore data into the live tables.",
   "txt_backup_remote_loading": "Loading remote backups...",
   "txt_backup_remote_cached_empty": "Click Refresh to load this destination.",
+  "txt_backup_remote_cached_empty_prefix": "Click",
+  "txt_backup_remote_cached_empty_suffix": "to load this destination.",
   "txt_backup_remote_empty": "No backup files found in this folder.",
   "txt_backup_remote_folder": "Folder",
   "txt_backup_remote_unknown_time": "Unknown time",
   "txt_backup_remote_current_path": "Current Folder",
+  "txt_backup_remote_modified": "Modified",
+  "txt_backup_remote_size": "Size",
   "txt_backup_remote_load_failed": "Loading remote backups failed",
   "txt_backup_remote_invalid_response": "Invalid remote backup response",
   "txt_backup_remote_download_failed": "Downloading remote backup failed",
@@ -214,6 +249,74 @@ const en: Record<string, string> = {
   "txt_backup_remote_run_invalid_response": "Invalid remote backup run response",
   "txt_backup_settings_invalid_response": "Invalid backup settings response",
   "txt_backup_import_invalid_response": "Invalid backup import response",
+  "txt_backup_error_another_backup_or_restore_running": "Another backup or restore task is already running.",
+  "txt_backup_error_another_backup_running": "Another backup task is already running.",
+  "txt_backup_error_archive_upload_failed": "Backup archive upload failed.",
+  "txt_backup_error_archive_upload_verification_failed_attempts": "Backup upload verification failed after {count} attempt(s): {reason}",
+  "txt_backup_error_attachment_blob_invalid": "Backup attachment blob is invalid.",
+  "txt_backup_error_attachment_blob_required": "Backup attachment blob is required.",
+  "txt_backup_error_attachment_blob_not_found": "Backup attachment blob not found.",
+  "txt_backup_error_attachment_download_failed": "Backup attachment download failed.",
+  "txt_backup_error_destination_invalid": "Backup destination is invalid.",
+  "txt_backup_error_destination_limit": "You can save up to {count} backup destinations.",
+  "txt_backup_error_destination_not_found": "Backup destination not found.",
+  "txt_backup_error_destination_ids_unique": "Backup destination IDs must be unique.",
+  "txt_backup_error_destination_type_invalid": "Backup destination type is invalid.",
+  "txt_backup_error_destination_type_unsupported": "Unsupported backup destination type.",
+  "txt_backup_error_destinations_invalid": "Backup destinations are invalid.",
+  "txt_backup_error_export_payload_invalid": "Backup export payload is invalid.",
+  "txt_backup_error_file_checksum_mismatch": "Backup file checksum does not match its filename.",
+  "txt_backup_error_file_required": "Backup file is required.",
+  "txt_backup_error_interval_hours_range": "Backup interval must be between 1 and 99 hours.",
+  "txt_backup_error_multipart_required": "The upload request must use multipart/form-data.",
+  "txt_backup_error_read_backup_file_failed": "Unable to read backup file.",
+  "txt_backup_error_remote_attachment_batch_download_failed_status": "Remote attachment batch download failed: HTTP {status}.",
+  "txt_backup_error_remote_attachment_download_failed_status": "Remote attachment download failed: HTTP {status}.",
+  "txt_backup_error_remote_delete_failed": "Remote backup delete failed.",
+  "txt_backup_error_remote_download_failed": "Remote backup download failed.",
+  "txt_backup_error_remote_download_payload_invalid": "Remote backup download request is invalid.",
+  "txt_backup_error_remote_integrity_failed": "Remote backup integrity inspection failed.",
+  "txt_backup_error_remote_listing_failed": "Remote backup listing failed.",
+  "txt_backup_error_remote_path_invalid": "Remote backup path is invalid.",
+  "txt_backup_error_remote_restore_payload_invalid": "Remote restore request is invalid.",
+  "txt_backup_error_remote_zip_checksum_failed": "Remote backup ZIP checksum verification failed.",
+  "txt_backup_error_remote_zip_size_failed": "Remote backup ZIP size verification failed.",
+  "txt_backup_error_retention_count_range": "Backup retention count must be between 1 and 1000.",
+  "txt_backup_error_run_failed": "Backup run failed.",
+  "txt_backup_error_run_payload_invalid": "Backup run request is invalid.",
+  "txt_backup_error_run_response_invalid": "Backup run response is invalid.",
+  "txt_backup_error_s3_access_key_required": "S3 access key is required.",
+  "txt_backup_error_s3_bucket_required": "S3 bucket is required.",
+  "txt_backup_error_s3_delete_failed_status": "S3 delete failed: HTTP {status}.",
+  "txt_backup_error_s3_download_failed_status": "S3 download failed: HTTP {status}.",
+  "txt_backup_error_s3_endpoint_required": "S3 endpoint is required.",
+  "txt_backup_error_s3_endpoint_protocol": "S3 endpoint must start with http:// or https://.",
+  "txt_backup_error_s3_existence_check_failed_status": "S3 existence check failed: HTTP {status}.",
+  "txt_backup_error_s3_listing_failed_status": "S3 listing failed: HTTP {status}.",
+  "txt_backup_error_s3_secret_key_required": "S3 secret key is required.",
+  "txt_backup_error_s3_upload_failed_status": "S3 upload failed: HTTP {status}.",
+  "txt_backup_error_select_backup_file": "Please select a backup file.",
+  "txt_backup_error_select_backup_zip_file": "Please select a backup ZIP file.",
+  "txt_backup_error_settings_envelope_invalid": "Backup settings envelope is invalid.",
+  "txt_backup_error_settings_invalid": "Backup settings are invalid.",
+  "txt_backup_error_settings_load_failed": "Backup settings could not be loaded.",
+  "txt_backup_error_settings_need_reactivation": "Backup settings need administrator reactivation after restore.",
+  "txt_backup_error_settings_payload_invalid": "Backup settings request is invalid.",
+  "txt_backup_error_settings_repair_payload_invalid": "Backup settings repair request is invalid.",
+  "txt_backup_error_settings_repair_state_load_failed": "Backup settings repair state could not be loaded.",
+  "txt_backup_error_start_time_format": "Backup start time must be in HH:mm format.",
+  "txt_backup_error_timezone_invalid": "Backup timezone is invalid.",
+  "txt_backup_error_webdav_delete_failed_status": "WebDAV delete failed: HTTP {status}.",
+  "txt_backup_error_webdav_directory_creation_failed_status": "WebDAV directory creation failed: HTTP {status}.",
+  "txt_backup_error_webdav_download_failed_status": "WebDAV download failed: HTTP {status}.",
+  "txt_backup_error_webdav_existence_check_failed_status": "WebDAV existence check failed: HTTP {status}.",
+  "txt_backup_error_webdav_listing_failed_status": "WebDAV listing failed: HTTP {status}.",
+  "txt_backup_error_webdav_password_required": "WebDAV password is required.",
+  "txt_backup_error_webdav_path_too_deep": "WebDAV remote backup path is too deep for safe attachment batching.",
+  "txt_backup_error_webdav_upload_failed_status": "WebDAV upload failed: HTTP {status}.",
+  "txt_backup_error_webdav_url_required": "WebDAV server URL is required.",
+  "txt_backup_error_webdav_url_protocol": "WebDAV server URL must start with http:// or https://.",
+  "txt_backup_error_webdav_username_required": "WebDAV username is required.",
   "txt_backup_destination": "Backup Destination",
   "txt_backup_protocol_webdav": "WebDAV",
   "txt_backup_protocol_s3": "S3",
@@ -267,6 +370,9 @@ const en: Record<string, string> = {
   "txt_backup_webdav_password": "WebDAV Password",
   "txt_backup_webdav_path": "Remote Folder",
   "txt_backup_s3_endpoint": "S3 Endpoint",
+  "txt_backup_s3_addressing_style": "S3 Addressing Style",
+  "txt_backup_s3_addressing_path_style": "path-style (default)",
+  "txt_backup_s3_addressing_virtual_hosted_style": "virtual-hosted-style",
   "txt_backup_s3_bucket": "Bucket",
   "txt_backup_s3_region": "Region",
   "txt_backup_s3_access_key": "Access Key",
@@ -447,6 +553,11 @@ const en: Record<string, string> = {
   "txt_favorite": "Favorite",
   "txt_favorites": "Favorites",
   "txt_duplicates": "Duplicates",
+  "txt_duplicate_detection_mode": "Match by",
+  "txt_duplicate_mode_exact": "Exact item",
+  "txt_duplicate_mode_login_site": "Site + username + password",
+  "txt_duplicate_mode_login_credentials": "Username + password",
+  "txt_duplicate_mode_password": "Reused password",
   "txt_field": "Field",
   "txt_field_label": "Field Label",
   "txt_field_label_is_required": "Field label is required.",
@@ -481,16 +592,21 @@ const en: Record<string, string> = {
   "txt_server_error_account_disabled": "Account is disabled",
   "txt_server_error_client_credentials_incorrect": "Client ID or client secret is incorrect. Try again.",
   "txt_server_error_client_ip_required": "Client IP is required",
+  "txt_server_error_forbidden": "You do not have permission to perform this action.",
   "txt_server_error_email_already_registered": "Email already registered",
   "txt_server_error_email_password_required": "Email and password are required",
   "txt_server_error_email_required": "Email is required",
+  "txt_server_error_invalid_password": "Invalid password.",
   "txt_server_error_invalid_refresh_token": "Session expired. Please sign in again.",
+  "txt_server_error_invalid_user_verification_token": "Invalid user verification token.",
   "txt_server_error_invalid_request_payload": "Invalid request payload",
   "txt_server_error_invite_invalid_or_expired": "Invite code is invalid or expired",
   "txt_server_error_invite_required": "Invite code is required",
   "txt_server_error_jwt_secret_default": "JWT_SECRET is using the default/sample value. Please change it.",
   "txt_server_error_jwt_secret_missing": "JWT_SECRET is not set",
   "txt_server_error_jwt_secret_too_short": "JWT_SECRET must be at least 32 characters",
+  "txt_server_error_master_password_hash_required": "Master password verification is required.",
+  "txt_server_error_master_password_or_verification_required": "Master password or user verification token is required.",
   "txt_server_error_parameter_error": "Parameter error",
   "txt_server_error_refresh_token_required": "Session is missing. Please sign in again.",
   "txt_server_error_registration_retry": "Registration is temporarily unavailable. Please retry once.",
@@ -750,6 +866,7 @@ const en: Record<string, string> = {
   "txt_search_sends": "Search sends...",
   "txt_session_refresh_failed": "Session refresh failed. Please sign in again.",
   "txt_search_your_secure_vault": "Search your secure vault...",
+  "txt_search_items_count": "Search within {count} items...",
   "txt_clear_search": "Clear search",
   "txt_clear_search_esc": "Clear search (Esc)",
   "txt_sort": "Sort",
@@ -1172,7 +1289,22 @@ const en: Record<string, string> = {
   "txt_target": "Target",
   "txt_time": "Time",
   "txt_time_range": "Time range",
-  "txt_remove_domain": "Remove domain"
+  "txt_remove_domain": "Remove domain",
+  "txt_approve_device_login": "Approve device login",
+  "txt_auth_request_approve_message": "Unlock Bitwarden on your device or approve from the web app. Before approving, make sure the fingerprint phrase matches the one below.",
+  "txt_approve": "Approve",
+  "txt_approving": "Approving...",
+  "txt_deny": "Deny",
+  "txt_later": "Later",
+  "txt_pending_device_logins": "Pending device logins",
+  "txt_no_pending_device_logins": "No pending device logins",
+  "txt_fingerprint_phrase": "Fingerprint phrase",
+  "txt_auth_requests_load_failed": "Failed to load device login requests",
+  "txt_auth_request_update_failed": "Failed to update device login request",
+  "txt_auth_request_approved": "Device login approved",
+  "txt_auth_request_denied": "Device login denied",
+  "txt_auth_request_missing_public_key": "Device login request is missing a public key",
+  "txt_ip_address": "IP address"
 };
 
 export default en;

webapp/src/lib/i18n/locales/es.ts

@@ -85,6 +85,37 @@ const es: Record<string, string> = {
   "txt_backup_recommend_pcloud_step_1": "Registre una cuenta pCloud solo con su dirección de correo.",
   "txt_backup_recommend_pcloud_step_2": "Use https://webdav.pcloud.com/ como URL del servidor WebDAV.",
   "txt_backup_recommend_pcloud_step_3": "Use su correo de registro como nombre de usuario WebDAV y su contraseña de cuenta como contraseña WebDAV.",
+  "txt_backup_recommend_backblaze_summary": "Almacenamiento de objetos compatible con S3 con 10 GB gratis y sin tarjeta de crédito.",
+  "txt_backup_recommend_backblaze_step_1": "Registre o inicie sesión en una cuenta de Backblaze.",
+  "txt_backup_recommend_backblaze_step_2_prefix": "Abra",
+  "txt_backup_recommend_backblaze_step_2_suffix": ", haga clic en Create a Bucket, introduzca solo el nombre del bucket, deje lo demás sin cambios y créelo.",
+  "txt_backup_recommend_backblaze_step_3": "Después de crearlo, ponga el Endpoint mostrado en S3 Endpoint URL, use el nombre del bucket en Bucket Name y la parte central del endpoint, como us-west-004, en Region.",
+  "txt_backup_recommend_backblaze_step_4_prefix": "Abra",
+  "txt_backup_recommend_backblaze_step_4_suffix": ", haga clic en Add a New Application Key, introduzca cualquier Name of Key, deje lo demás sin cambios y créelo.",
+  "txt_backup_recommend_backblaze_step_5": "Use keyID como clave de acceso y applicationKey como clave secreta.",
+  "txt_backup_recommend_cloudflare_r2_summary": "Almacenamiento de objetos compatible con S3 con 10 GB gratis, pero requiere verificación con tarjeta de crédito.",
+  "txt_backup_recommend_cloudflare_r2_bucket_link": "página para crear bucket",
+  "txt_backup_recommend_cloudflare_r2_api_link": "página de token API",
+  "txt_backup_recommend_cloudflare_r2_step_1_prefix": "Abra la",
+  "txt_backup_recommend_cloudflare_r2_step_1_suffix": ", introduzca solo el nombre del bucket y créelo directamente.",
+  "txt_backup_recommend_cloudflare_r2_step_2_prefix": "Abra la",
+  "txt_backup_recommend_cloudflare_r2_step_2_suffix": ", seleccione Object Read & Write en permisos y créelo directamente.",
+  "txt_backup_recommend_cloudflare_r2_step_3": "Ignore el valor del token después de crearlo. Use Access Key ID como ID de acceso y Secret Access Key como contraseña de acceso.",
+  "txt_backup_recommend_cloudflare_r2_step_4": "Copie la dirección mostrada abajo en S3 Endpoint URL, rellene Bucket Name tal como aparece y deje Region en auto.",
+  "txt_backup_recommend_cloudflare_r2_step_5": "Configure Path Prefix si lo necesita, por ejemplo nodewarden, o déjelo vacío si no quiere un prefijo de carpeta.",
+  "txt_backup_recommend_s3_path_prefix_step": "Configure Path Prefix si lo necesita, por ejemplo nodewarden, o déjelo vacío si no quiere un prefijo de carpeta.",
+  "txt_backup_recommend_tigris_summary": "Almacenamiento de objetos compatible con S3 con 5 GB gratis y sin tarjeta de crédito.",
+  "txt_backup_recommend_tigris_signup_link": "página de registro",
+  "txt_backup_recommend_tigris_bucket_link": "página Create Bucket",
+  "txt_backup_recommend_tigris_access_key_link": "página Create Access Key",
+  "txt_backup_recommend_tigris_step_1_prefix": "Abra la",
+  "txt_backup_recommend_tigris_step_1_suffix": ", regístrese e inicie sesión en Tigris.",
+  "txt_backup_recommend_tigris_step_2_prefix": "Abra",
+  "txt_backup_recommend_tigris_step_2_suffix": ", introduzca solo el nombre del bucket, deje todo lo demás sin cambios y créelo.",
+  "txt_backup_recommend_tigris_step_3_prefix": "Luego abra la",
+  "txt_backup_recommend_tigris_step_3_suffix": ", use cualquier nombre y créela.",
+  "txt_backup_recommend_tigris_step_4": "Ignore Endpoint URL IAM después de crearla. Rellene los demás valores mostrados en la página de copia de seguridad usando los nombres correspondientes.",
+  "txt_backup_recommend_tigris_step_5": "Por último, haga clic en Manage Key Permissions y active Admin Access; de lo contrario, no podrá escribir copias de seguridad.",
   "txt_backup_add_destination": "Añadir destino",
   "txt_backup_schedule_panel_title": "Programación automática",
   "txt_backup_schedule_panel_note": "Cada destino puede mantener su propia programación de copia de seguridad diaria.",
@@ -193,10 +224,14 @@ const es: Record<string, string> = {
   "txt_backup_restore_progress_remote_finalize_detail": "El servidor está realizando la validación final y luego cambiando los datos de restauración verificados a las tablas activas.",
   "txt_backup_remote_loading": "Cargando copias remotas...",
   "txt_backup_remote_cached_empty": "Haga clic en Actualizar para cargar este destino.",
+  "txt_backup_remote_cached_empty_prefix": "Haga clic en",
+  "txt_backup_remote_cached_empty_suffix": "para cargar este destino.",
   "txt_backup_remote_empty": "No se encontraron archivos de copia de seguridad en esta carpeta.",
   "txt_backup_remote_folder": "Carpeta",
   "txt_backup_remote_unknown_time": "Hora desconocida",
   "txt_backup_remote_current_path": "Carpeta actual",
+  "txt_backup_remote_modified": "Modificado",
+  "txt_backup_remote_size": "Tamaño",
   "txt_backup_remote_load_failed": "Error al cargar copias de seguridad remotas",
   "txt_backup_remote_invalid_response": "Respuesta de copia de seguridad remota no válida",
   "txt_backup_remote_download_failed": "Error al descargar copia de seguridad remota",
@@ -214,6 +249,74 @@ const es: Record<string, string> = {
   "txt_backup_remote_run_invalid_response": "Respuesta de ejecución de copia de seguridad remota no válida",
   "txt_backup_settings_invalid_response": "Respuesta de configuración de copia de seguridad no válida",
   "txt_backup_import_invalid_response": "Respuesta de importación de copia de seguridad no válida",
+  "txt_backup_error_another_backup_or_restore_running": "Ya hay una tarea de copia o restauración en curso.",
+  "txt_backup_error_another_backup_running": "Ya hay una tarea de copia en curso.",
+  "txt_backup_error_archive_upload_failed": "No se pudo subir el archivo de copia.",
+  "txt_backup_error_archive_upload_verification_failed_attempts": "La verificación de subida falló tras {count} intento(s): {reason}",
+  "txt_backup_error_attachment_blob_invalid": "El objeto de adjunto de copia no es válido.",
+  "txt_backup_error_attachment_blob_required": "Falta el objeto de adjunto de copia.",
+  "txt_backup_error_attachment_blob_not_found": "No se encontró el objeto de adjunto de copia.",
+  "txt_backup_error_attachment_download_failed": "No se pudo descargar el adjunto de copia.",
+  "txt_backup_error_destination_invalid": "El destino de copia no es válido.",
+  "txt_backup_error_destination_limit": "Puede guardar hasta {count} destinos de copia.",
+  "txt_backup_error_destination_not_found": "No se encontró el destino de copia.",
+  "txt_backup_error_destination_ids_unique": "Los ID de destino de copia no pueden repetirse.",
+  "txt_backup_error_destination_type_invalid": "El tipo de destino de copia no es válido.",
+  "txt_backup_error_destination_type_unsupported": "Tipo de destino de copia no compatible.",
+  "txt_backup_error_destinations_invalid": "La lista de destinos de copia no es válida.",
+  "txt_backup_error_export_payload_invalid": "La solicitud de exportación de copia no es válida.",
+  "txt_backup_error_file_checksum_mismatch": "La suma de verificación de la copia no coincide con el nombre del archivo.",
+  "txt_backup_error_file_required": "Seleccione un archivo de copia.",
+  "txt_backup_error_interval_hours_range": "El intervalo de copia debe estar entre 1 y 99 horas.",
+  "txt_backup_error_multipart_required": "La solicitud de subida debe usar multipart/form-data.",
+  "txt_backup_error_read_backup_file_failed": "No se pudo leer el archivo de copia.",
+  "txt_backup_error_remote_attachment_batch_download_failed_status": "Error al descargar adjuntos remotos por lotes: HTTP {status}.",
+  "txt_backup_error_remote_attachment_download_failed_status": "Error al descargar adjunto remoto: HTTP {status}.",
+  "txt_backup_error_remote_delete_failed": "No se pudo eliminar la copia remota.",
+  "txt_backup_error_remote_download_failed": "No se pudo descargar la copia remota.",
+  "txt_backup_error_remote_download_payload_invalid": "La solicitud de descarga remota no es válida.",
+  "txt_backup_error_remote_integrity_failed": "No se pudo inspeccionar la integridad de la copia remota.",
+  "txt_backup_error_remote_listing_failed": "No se pudo leer la lista de copias remotas.",
+  "txt_backup_error_remote_path_invalid": "La ruta de copia remota no es válida.",
+  "txt_backup_error_remote_restore_payload_invalid": "La solicitud de restauración remota no es válida.",
+  "txt_backup_error_remote_zip_checksum_failed": "Falló la verificación de suma del ZIP remoto.",
+  "txt_backup_error_remote_zip_size_failed": "Falló la verificación de tamaño del ZIP remoto.",
+  "txt_backup_error_retention_count_range": "La retención debe estar entre 1 y 1000.",
+  "txt_backup_error_run_failed": "La ejecución de copia falló.",
+  "txt_backup_error_run_payload_invalid": "La solicitud de ejecución de copia no es válida.",
+  "txt_backup_error_run_response_invalid": "La respuesta de ejecución de copia no es válida.",
+  "txt_backup_error_s3_access_key_required": "La clave de acceso S3 es obligatoria.",
+  "txt_backup_error_s3_bucket_required": "El bucket S3 es obligatorio.",
+  "txt_backup_error_s3_delete_failed_status": "Eliminación S3 fallida: HTTP {status}.",
+  "txt_backup_error_s3_download_failed_status": "Descarga S3 fallida: HTTP {status}.",
+  "txt_backup_error_s3_endpoint_required": "El endpoint S3 es obligatorio.",
+  "txt_backup_error_s3_endpoint_protocol": "El endpoint S3 debe empezar por http:// o https://.",
+  "txt_backup_error_s3_existence_check_failed_status": "Comprobación de existencia S3 fallida: HTTP {status}.",
+  "txt_backup_error_s3_listing_failed_status": "Listado S3 fallido: HTTP {status}.",
+  "txt_backup_error_s3_secret_key_required": "La clave secreta S3 es obligatoria.",
+  "txt_backup_error_s3_upload_failed_status": "Subida S3 fallida: HTTP {status}.",
+  "txt_backup_error_select_backup_file": "Seleccione un archivo de copia.",
+  "txt_backup_error_select_backup_zip_file": "Seleccione un archivo ZIP de copia.",
+  "txt_backup_error_settings_envelope_invalid": "El contenedor cifrado de configuración de copia no es válido.",
+  "txt_backup_error_settings_invalid": "La configuración de copia no es válida.",
+  "txt_backup_error_settings_load_failed": "No se pudo cargar la configuración de copia.",
+  "txt_backup_error_settings_need_reactivation": "La configuración de copia requiere reactivación de administrador tras la restauración.",
+  "txt_backup_error_settings_payload_invalid": "La solicitud de configuración de copia no es válida.",
+  "txt_backup_error_settings_repair_payload_invalid": "La solicitud de reparación de configuración no es válida.",
+  "txt_backup_error_settings_repair_state_load_failed": "No se pudo cargar el estado de reparación de configuración.",
+  "txt_backup_error_start_time_format": "La hora de inicio debe tener formato HH:mm.",
+  "txt_backup_error_timezone_invalid": "La zona horaria de copia no es válida.",
+  "txt_backup_error_webdav_delete_failed_status": "Eliminación WebDAV fallida: HTTP {status}.",
+  "txt_backup_error_webdav_directory_creation_failed_status": "Creación de directorio WebDAV fallida: HTTP {status}.",
+  "txt_backup_error_webdav_download_failed_status": "Descarga WebDAV fallida: HTTP {status}.",
+  "txt_backup_error_webdav_existence_check_failed_status": "Comprobación de existencia WebDAV fallida: HTTP {status}.",
+  "txt_backup_error_webdav_listing_failed_status": "Listado WebDAV fallido: HTTP {status}.",
+  "txt_backup_error_webdav_password_required": "La contraseña WebDAV es obligatoria.",
+  "txt_backup_error_webdav_path_too_deep": "La ruta remota WebDAV es demasiado profunda para procesar adjuntos por lotes de forma segura.",
+  "txt_backup_error_webdav_upload_failed_status": "Subida WebDAV fallida: HTTP {status}.",
+  "txt_backup_error_webdav_url_required": "La URL del servidor WebDAV es obligatoria.",
+  "txt_backup_error_webdav_url_protocol": "La URL WebDAV debe empezar por http:// o https://.",
+  "txt_backup_error_webdav_username_required": "El usuario WebDAV es obligatorio.",
   "txt_backup_destination": "Destino de copia",
   "txt_backup_protocol_webdav": "WebDAV",
   "txt_backup_protocol_s3": "S3",
@@ -267,6 +370,9 @@ const es: Record<string, string> = {
   "txt_backup_webdav_password": "Contraseña WebDAV",
   "txt_backup_webdav_path": "Carpeta remota",
   "txt_backup_s3_endpoint": "Endpoint S3",
+  "txt_backup_s3_addressing_style": "Estilo de direccionamiento S3",
+  "txt_backup_s3_addressing_path_style": "path-style (predeterminado)",
+  "txt_backup_s3_addressing_virtual_hosted_style": "virtual-hosted-style",
   "txt_backup_s3_bucket": "Bucket S3",
   "txt_backup_s3_region": "Región",
   "txt_backup_s3_access_key": "Clave de acceso",
@@ -447,6 +553,11 @@ const es: Record<string, string> = {
   "txt_favorite": "Favorito",
   "txt_favorites": "Favoritos",
   "txt_duplicates": "Duplicados",
+  "txt_duplicate_detection_mode": "Coincidir por",
+  "txt_duplicate_mode_exact": "Elemento exacto",
+  "txt_duplicate_mode_login_site": "Sitio + usuario + contraseña",
+  "txt_duplicate_mode_login_credentials": "Usuario + contraseña",
+  "txt_duplicate_mode_password": "Contraseña reutilizada",
   "txt_field": "Campo",
   "txt_field_label": "Etiqueta del campo",
   "txt_field_label_is_required": "La etiqueta del campo es obligatoria.",
@@ -481,16 +592,21 @@ const es: Record<string, string> = {
   "txt_server_error_account_disabled": "La cuenta está deshabilitada",
   "txt_server_error_client_credentials_incorrect": "El ID de cliente o el secreto de cliente no son correctos. Inténtalo de nuevo.",
   "txt_server_error_client_ip_required": "Se requiere la IP del cliente",
+  "txt_server_error_forbidden": "No tiene permiso para realizar esta acción.",
   "txt_server_error_email_already_registered": "Este correo ya está registrado",
   "txt_server_error_email_password_required": "Correo y contraseña son obligatorios",
   "txt_server_error_email_required": "El correo es obligatorio",
+  "txt_server_error_invalid_password": "Contraseña no válida.",
   "txt_server_error_invalid_refresh_token": "La sesión caducó. Inicia sesión de nuevo.",
+  "txt_server_error_invalid_user_verification_token": "Token de verificación de usuario no válido.",
   "txt_server_error_invalid_request_payload": "Solicitud no válida",
   "txt_server_error_invite_invalid_or_expired": "El código de invitación no es válido o ha caducado",
   "txt_server_error_invite_required": "El código de invitación es obligatorio",
   "txt_server_error_jwt_secret_default": "JWT_SECRET usa el valor predeterminado/de ejemplo. Cámbialo.",
   "txt_server_error_jwt_secret_missing": "JWT_SECRET no está configurado",
   "txt_server_error_jwt_secret_too_short": "JWT_SECRET debe tener al menos 32 caracteres",
+  "txt_server_error_master_password_hash_required": "Se requiere verificación de la contraseña maestra.",
+  "txt_server_error_master_password_or_verification_required": "Se requiere contraseña maestra o token de verificación de usuario.",
   "txt_server_error_parameter_error": "Error de parámetros",
   "txt_server_error_refresh_token_required": "Falta la sesión. Inicia sesión de nuevo.",
   "txt_server_error_registration_retry": "El registro no está disponible temporalmente. Inténtalo una vez más.",
@@ -750,6 +866,7 @@ const es: Record<string, string> = {
   "txt_search_sends": "Buscar envíos...",
   "txt_session_refresh_failed": "Error al actualizar la sesión. Inicia sesión de nuevo.",
   "txt_search_your_secure_vault": "Buscar en su bóveda segura...",
+  "txt_search_items_count": "Buscar entre {count} elementos...",
   "txt_clear_search": "Limpiar búsqueda",
   "txt_clear_search_esc": "Limpiar búsqueda (Esc)",
   "txt_sort": "Ordenar",
@@ -1172,7 +1289,22 @@ const es: Record<string, string> = {
   "txt_target": "Destino",
   "txt_time": "Hora",
   "txt_time_range": "Rango de tiempo",
-  "txt_remove_domain": "Quitar dominio"
+  "txt_remove_domain": "Quitar dominio",
+  "txt_approve_device_login": "Aprobar inicio de sesión con dispositivo",
+  "txt_auth_request_approve_message": "Desbloquee Bitwarden en su dispositivo o apruebe desde la aplicación web. Antes de aprobar, asegúrese de que la frase de huella coincida con la siguiente.",
+  "txt_fingerprint_phrase": "Frase de huella",
+  "txt_ip_address": "Dirección IP",
+  "txt_approve": "Aprobar",
+  "txt_approving": "Aprobando...",
+  "txt_deny": "Denegar",
+  "txt_later": "Más tarde",
+  "txt_pending_device_logins": "Inicios de sesión con dispositivo pendientes",
+  "txt_no_pending_device_logins": "No hay inicios de sesión con dispositivo pendientes",
+  "txt_auth_requests_load_failed": "No se pudieron cargar las solicitudes de inicio de sesión con dispositivo",
+  "txt_auth_request_update_failed": "No se pudo actualizar la solicitud de inicio de sesión con dispositivo",
+  "txt_auth_request_approved": "Inicio de sesión con dispositivo aprobado",
+  "txt_auth_request_denied": "Inicio de sesión con dispositivo denegado",
+  "txt_auth_request_missing_public_key": "La solicitud de inicio de sesión con dispositivo no incluye una clave pública"
 };
 
 export default es;

webapp/src/lib/i18n/locales/ru.ts

@@ -86,6 +86,37 @@ const ru: Record<string, string> = {
   "txt_backup_recommend_pcloud_step_1": "Зарегистрируйте учетную запись pCloud, используя только свой адрес электронной почты.",
   "txt_backup_recommend_pcloud_step_2": "Используйте https://webdav.ploud.com/ в качестве URL-адреса сервера WebDAV.",
   "txt_backup_recommend_pcloud_step_3": "Используйте свой регистрационный адрес электронной почты в качестве имени пользователя WebDAV и пароль своей учетной записи в качестве пароля WebDAV.",
+  "txt_backup_recommend_backblaze_summary": "S3-совместимое объектное хранилище с бесплатными 10 ГБ и без кредитной карты.",
+  "txt_backup_recommend_backblaze_step_1": "Зарегистрируйте учетную запись Backblaze или войдите в нее.",
+  "txt_backup_recommend_backblaze_step_2_prefix": "Откройте",
+  "txt_backup_recommend_backblaze_step_2_suffix": ", нажмите Create a Bucket, введите только имя bucket, оставьте остальные настройки без изменений и создайте его.",
+  "txt_backup_recommend_backblaze_step_3": "После создания вставьте показанный Endpoint в S3 Endpoint URL, имя bucket укажите в Bucket Name, а среднюю часть endpoint, например us-west-004, используйте как Region.",
+  "txt_backup_recommend_backblaze_step_4_prefix": "Откройте",
+  "txt_backup_recommend_backblaze_step_4_suffix": ", нажмите Add a New Application Key, введите любое Name of Key, оставьте остальные настройки без изменений и создайте ключ.",
+  "txt_backup_recommend_backblaze_step_5": "Используйте keyID как ключ доступа, а applicationKey как секретный ключ.",
+  "txt_backup_recommend_cloudflare_r2_summary": "S3-совместимое объектное хранилище с бесплатными 10 ГБ, но с обязательной проверкой кредитной карты.",
+  "txt_backup_recommend_cloudflare_r2_bucket_link": "страницу создания bucket",
+  "txt_backup_recommend_cloudflare_r2_api_link": "страницу API token",
+  "txt_backup_recommend_cloudflare_r2_step_1_prefix": "Откройте",
+  "txt_backup_recommend_cloudflare_r2_step_1_suffix": ", введите только имя bucket и сразу создайте его.",
+  "txt_backup_recommend_cloudflare_r2_step_2_prefix": "Откройте",
+  "txt_backup_recommend_cloudflare_r2_step_2_suffix": ", выберите Object Read & Write в разрешениях и сразу создайте токен.",
+  "txt_backup_recommend_cloudflare_r2_step_3": "После создания игнорируйте token value. Введите Access Key ID как ID доступа, а Secret Access Key как пароль доступа.",
+  "txt_backup_recommend_cloudflare_r2_step_4": "Вставьте показанный ниже адрес в S3 Endpoint URL, заполните Bucket Name как показано и оставьте Region в значении auto.",
+  "txt_backup_recommend_cloudflare_r2_step_5": "Укажите Path Prefix при необходимости, например nodewarden, или оставьте пустым, если префикс папки не нужен.",
+  "txt_backup_recommend_s3_path_prefix_step": "Укажите Path Prefix при необходимости, например nodewarden, или оставьте пустым, если префикс папки не нужен.",
+  "txt_backup_recommend_tigris_summary": "S3-совместимое объектное хранилище с бесплатными 5 ГБ и без кредитной карты.",
+  "txt_backup_recommend_tigris_signup_link": "страницу регистрации",
+  "txt_backup_recommend_tigris_bucket_link": "страницу Create Bucket",
+  "txt_backup_recommend_tigris_access_key_link": "страницу Create Access Key",
+  "txt_backup_recommend_tigris_step_1_prefix": "Откройте",
+  "txt_backup_recommend_tigris_step_1_suffix": ", зарегистрируйтесь и войдите в Tigris.",
+  "txt_backup_recommend_tigris_step_2_prefix": "Откройте",
+  "txt_backup_recommend_tigris_step_2_suffix": ", введите только имя bucket, ничего больше не меняйте и создайте его.",
+  "txt_backup_recommend_tigris_step_3_prefix": "Затем откройте",
+  "txt_backup_recommend_tigris_step_3_suffix": ", введите любое имя и создайте ключ.",
+  "txt_backup_recommend_tigris_step_4": "После создания игнорируйте Endpoint URL IAM. Остальные показанные значения заполните на странице резервного копирования по совпадающим названиям полей.",
+  "txt_backup_recommend_tigris_step_5": "В конце нажмите Manage Key Permissions и включите Admin Access, иначе запись резервных копий не будет работать.",
   "txt_backup_add_destination": "Добавить пункт назначения",
   "txt_backup_schedule_panel_title": "Автоматическое расписание",
   "txt_backup_schedule_panel_note": "Каждый пункт назначения может иметь собственный ежедневный график резервного копирования.",
@@ -193,10 +224,14 @@ const ru: Record<string, string> = {
   "txt_backup_restore_progress_remote_finalize_detail": "Сервер выполняет окончательную проверку, а затем переключает проверенные данные восстановления в живые таблицы.",
   "txt_backup_remote_loading": "Загрузка удаленных резервных копий...",
   "txt_backup_remote_cached_empty": "Нажмите «Обновить», чтобы загрузить это место назначения.",
+  "txt_backup_remote_cached_empty_prefix": "Нажмите",
+  "txt_backup_remote_cached_empty_suffix": "чтобы загрузить это место назначения.",
   "txt_backup_remote_empty": "В этой папке не найдено файлов резервных копий.",
   "txt_backup_remote_folder": "Папка",
   "txt_backup_remote_unknown_time": "Неизвестное время",
   "txt_backup_remote_current_path": "Текущая папка",
+  "txt_backup_remote_modified": "Изменено",
+  "txt_backup_remote_size": "Размер",
   "txt_backup_remote_load_failed": "Не удалось загрузить удаленные резервные копии.",
   "txt_backup_remote_invalid_response": "Неверный ответ удаленного резервного копирования",
   "txt_backup_remote_download_failed": "Не удалось загрузить удаленную резервную копию.",
@@ -214,6 +249,74 @@ const ru: Record<string, string> = {
   "txt_backup_remote_run_invalid_response": "Неверный ответ на удаленное резервное копирование.",
   "txt_backup_settings_invalid_response": "Неверный ответ на настройки резервного копирования",
   "txt_backup_import_invalid_response": "Неверный ответ на импорт резервной копии",
+  "txt_backup_error_another_backup_or_restore_running": "Уже выполняется задача резервного копирования или восстановления.",
+  "txt_backup_error_another_backup_running": "Уже выполняется задача резервного копирования.",
+  "txt_backup_error_archive_upload_failed": "Не удалось загрузить архив резервной копии.",
+  "txt_backup_error_archive_upload_verification_failed_attempts": "Проверка загрузки не прошла после {count} попыток: {reason}",
+  "txt_backup_error_attachment_blob_invalid": "Объект вложения резервной копии недействителен.",
+  "txt_backup_error_attachment_blob_required": "Требуется объект вложения резервной копии.",
+  "txt_backup_error_attachment_blob_not_found": "Объект вложения резервной копии не найден.",
+  "txt_backup_error_attachment_download_failed": "Не удалось скачать вложение резервной копии.",
+  "txt_backup_error_destination_invalid": "Место назначения резервной копии недействительно.",
+  "txt_backup_error_destination_limit": "Можно сохранить не более {count} мест назначения резервной копии.",
+  "txt_backup_error_destination_not_found": "Место назначения резервной копии не найдено.",
+  "txt_backup_error_destination_ids_unique": "ID мест назначения резервной копии должны быть уникальными.",
+  "txt_backup_error_destination_type_invalid": "Тип места назначения резервной копии недействителен.",
+  "txt_backup_error_destination_type_unsupported": "Неподдерживаемый тип места назначения резервной копии.",
+  "txt_backup_error_destinations_invalid": "Список мест назначения резервной копии недействителен.",
+  "txt_backup_error_export_payload_invalid": "Запрос экспорта резервной копии недействителен.",
+  "txt_backup_error_file_checksum_mismatch": "Контрольная сумма файла резервной копии не совпадает с именем файла.",
+  "txt_backup_error_file_required": "Выберите файл резервной копии.",
+  "txt_backup_error_interval_hours_range": "Интервал резервного копирования должен быть от 1 до 99 часов.",
+  "txt_backup_error_multipart_required": "Запрос загрузки должен использовать multipart/form-data.",
+  "txt_backup_error_read_backup_file_failed": "Не удалось прочитать файл резервной копии.",
+  "txt_backup_error_remote_attachment_batch_download_failed_status": "Пакетное скачивание удаленных вложений не удалось: HTTP {status}.",
+  "txt_backup_error_remote_attachment_download_failed_status": "Скачивание удаленного вложения не удалось: HTTP {status}.",
+  "txt_backup_error_remote_delete_failed": "Не удалось удалить удаленную резервную копию.",
+  "txt_backup_error_remote_download_failed": "Не удалось скачать удаленную резервную копию.",
+  "txt_backup_error_remote_download_payload_invalid": "Запрос скачивания удаленной резервной копии недействителен.",
+  "txt_backup_error_remote_integrity_failed": "Не удалось проверить целостность удаленной резервной копии.",
+  "txt_backup_error_remote_listing_failed": "Не удалось получить список удаленных резервных копий.",
+  "txt_backup_error_remote_path_invalid": "Путь удаленной резервной копии недействителен.",
+  "txt_backup_error_remote_restore_payload_invalid": "Запрос удаленного восстановления недействителен.",
+  "txt_backup_error_remote_zip_checksum_failed": "Проверка контрольной суммы удаленного ZIP не прошла.",
+  "txt_backup_error_remote_zip_size_failed": "Проверка размера удаленного ZIP не прошла.",
+  "txt_backup_error_retention_count_range": "Количество сохраняемых копий должно быть от 1 до 1000.",
+  "txt_backup_error_run_failed": "Запуск резервного копирования не удался.",
+  "txt_backup_error_run_payload_invalid": "Запрос запуска резервного копирования недействителен.",
+  "txt_backup_error_run_response_invalid": "Ответ запуска резервного копирования недействителен.",
+  "txt_backup_error_s3_access_key_required": "Требуется ключ доступа S3.",
+  "txt_backup_error_s3_bucket_required": "Требуется bucket S3.",
+  "txt_backup_error_s3_delete_failed_status": "Удаление S3 не удалось: HTTP {status}.",
+  "txt_backup_error_s3_download_failed_status": "Скачивание S3 не удалось: HTTP {status}.",
+  "txt_backup_error_s3_endpoint_required": "Требуется endpoint S3.",
+  "txt_backup_error_s3_endpoint_protocol": "Endpoint S3 должен начинаться с http:// или https://.",
+  "txt_backup_error_s3_existence_check_failed_status": "Проверка существования S3 не удалась: HTTP {status}.",
+  "txt_backup_error_s3_listing_failed_status": "Получение списка S3 не удалось: HTTP {status}.",
+  "txt_backup_error_s3_secret_key_required": "Требуется секретный ключ S3.",
+  "txt_backup_error_s3_upload_failed_status": "Загрузка S3 не удалась: HTTP {status}.",
+  "txt_backup_error_select_backup_file": "Выберите файл резервной копии.",
+  "txt_backup_error_select_backup_zip_file": "Выберите ZIP-файл резервной копии.",
+  "txt_backup_error_settings_envelope_invalid": "Зашифрованный контейнер настроек резервного копирования недействителен.",
+  "txt_backup_error_settings_invalid": "Настройки резервного копирования недействительны.",
+  "txt_backup_error_settings_load_failed": "Не удалось загрузить настройки резервного копирования.",
+  "txt_backup_error_settings_need_reactivation": "После восстановления настройки резервного копирования нужно повторно активировать администратором.",
+  "txt_backup_error_settings_payload_invalid": "Запрос настроек резервного копирования недействителен.",
+  "txt_backup_error_settings_repair_payload_invalid": "Запрос восстановления настроек резервного копирования недействителен.",
+  "txt_backup_error_settings_repair_state_load_failed": "Не удалось загрузить состояние восстановления настроек резервного копирования.",
+  "txt_backup_error_start_time_format": "Время начала резервного копирования должно быть в формате HH:mm.",
+  "txt_backup_error_timezone_invalid": "Часовой пояс резервного копирования недействителен.",
+  "txt_backup_error_webdav_delete_failed_status": "Удаление WebDAV не удалось: HTTP {status}.",
+  "txt_backup_error_webdav_directory_creation_failed_status": "Создание каталога WebDAV не удалось: HTTP {status}.",
+  "txt_backup_error_webdav_download_failed_status": "Скачивание WebDAV не удалось: HTTP {status}.",
+  "txt_backup_error_webdav_existence_check_failed_status": "Проверка существования WebDAV не удалась: HTTP {status}.",
+  "txt_backup_error_webdav_listing_failed_status": "Получение списка WebDAV не удалось: HTTP {status}.",
+  "txt_backup_error_webdav_password_required": "Требуется пароль WebDAV.",
+  "txt_backup_error_webdav_path_too_deep": "Удаленный путь WebDAV слишком глубокий для безопасной пакетной обработки вложений.",
+  "txt_backup_error_webdav_upload_failed_status": "Загрузка WebDAV не удалась: HTTP {status}.",
+  "txt_backup_error_webdav_url_required": "Требуется URL сервера WebDAV.",
+  "txt_backup_error_webdav_url_protocol": "URL WebDAV должен начинаться с http:// или https://.",
+  "txt_backup_error_webdav_username_required": "Требуется имя пользователя WebDAV.",
   "txt_backup_destination": "Место назначения резервного копирования",
   "txt_backup_protocol_webdav": "WebDAV",
   "txt_backup_protocol_s3": "S3",
@@ -267,6 +370,9 @@ const ru: Record<string, string> = {
   "txt_backup_webdav_password": "Пароль WebDAV",
   "txt_backup_webdav_path": "Удаленная папка",
   "txt_backup_s3_endpoint": "S3 endpoint",
+  "txt_backup_s3_addressing_style": "Стиль адресации S3",
+  "txt_backup_s3_addressing_path_style": "path-style (по умолчанию)",
+  "txt_backup_s3_addressing_virtual_hosted_style": "virtual-hosted-style",
   "txt_backup_s3_bucket": "Бакет",
   "txt_backup_s3_region": "Регион",
   "txt_backup_s3_access_key": "Ключ доступа",
@@ -447,6 +553,11 @@ const ru: Record<string, string> = {
   "txt_favorite": "Любимый",
   "txt_favorites": "Избранное",
   "txt_duplicates": "Дубликаты",
+  "txt_duplicate_detection_mode": "Сравнивать по",
+  "txt_duplicate_mode_exact": "Полное совпадение",
+  "txt_duplicate_mode_login_site": "Сайт + логин + пароль",
+  "txt_duplicate_mode_login_credentials": "Логин + пароль",
+  "txt_duplicate_mode_password": "Повтор пароля",
   "txt_field": "Поле",
   "txt_field_label": "Метка поля",
   "txt_field_label_is_required": "Метка поля обязательна.",
@@ -481,16 +592,21 @@ const ru: Record<string, string> = {
   "txt_server_error_account_disabled": "Учетная запись отключена",
   "txt_server_error_client_credentials_incorrect": "ID клиента или секрет клиента неверны. Повторите попытку.",
   "txt_server_error_client_ip_required": "Требуется IP клиента",
+  "txt_server_error_forbidden": "У вас нет прав для выполнения этого действия.",
   "txt_server_error_email_already_registered": "Этот адрес электронной почты уже зарегистрирован",
   "txt_server_error_email_password_required": "Требуются адрес электронной почты и пароль",
   "txt_server_error_email_required": "Требуется адрес электронной почты",
+  "txt_server_error_invalid_password": "Неверный пароль.",
   "txt_server_error_invalid_refresh_token": "Сеанс истек. Войдите снова.",
+  "txt_server_error_invalid_user_verification_token": "Недействительный токен проверки пользователя.",
   "txt_server_error_invalid_request_payload": "Недопустимый запрос",
   "txt_server_error_invite_invalid_or_expired": "Код приглашения недействителен или истек",
   "txt_server_error_invite_required": "Требуется код приглашения",
   "txt_server_error_jwt_secret_default": "JWT_SECRET использует значение по умолчанию/пример. Измените его.",
   "txt_server_error_jwt_secret_missing": "JWT_SECRET не настроен",
   "txt_server_error_jwt_secret_too_short": "JWT_SECRET должен содержать не менее 32 символов",
+  "txt_server_error_master_password_hash_required": "Требуется проверка мастер-пароля.",
+  "txt_server_error_master_password_or_verification_required": "Требуется мастер-пароль или токен проверки пользователя.",
   "txt_server_error_parameter_error": "Ошибка параметров",
   "txt_server_error_refresh_token_required": "Сеанс отсутствует. Войдите снова.",
   "txt_server_error_registration_retry": "Регистрация временно недоступна. Повторите попытку один раз.",
@@ -750,6 +866,7 @@ const ru: Record<string, string> = {
   "txt_search_sends": "Поиск отправляет...",
   "txt_session_refresh_failed": "Не удалось обновить сеанс. Войдите снова.",
   "txt_search_your_secure_vault": "Найдите свое безопасное хранилище...",
+  "txt_search_items_count": "Поиск по {count} элементам...",
   "txt_clear_search": "Очистить поиск",
   "txt_clear_search_esc": "Очистить поиск (Esc)",
   "txt_sort": "Сортировать",
@@ -1172,7 +1289,22 @@ const ru: Record<string, string> = {
   "txt_target": "Цель",
   "txt_time": "Время",
   "txt_time_range": "Период",
-  "txt_remove_domain": "Удалить домен"
+  "txt_remove_domain": "Удалить домен",
+  "txt_approve_device_login": "Подтвердить вход с устройства",
+  "txt_auth_request_approve_message": "Разблокируйте Bitwarden на устройстве или подтвердите вход через веб-приложение. Перед подтверждением убедитесь, что фраза отпечатка совпадает с указанной ниже.",
+  "txt_fingerprint_phrase": "Фраза отпечатка",
+  "txt_ip_address": "IP-адрес",
+  "txt_approve": "Подтвердить",
+  "txt_approving": "Подтверждение...",
+  "txt_deny": "Отклонить",
+  "txt_later": "Позже",
+  "txt_pending_device_logins": "Ожидающие входы с устройств",
+  "txt_no_pending_device_logins": "Нет ожидающих входов с устройств",
+  "txt_auth_requests_load_failed": "Не удалось загрузить запросы входа с устройств",
+  "txt_auth_request_update_failed": "Не удалось обновить запрос входа с устройства",
+  "txt_auth_request_approved": "Вход с устройства подтвержден",
+  "txt_auth_request_denied": "Вход с устройства отклонен",
+  "txt_auth_request_missing_public_key": "В запросе входа с устройства отсутствует открытый ключ"
 };
 
 export default ru;

webapp/src/lib/i18n/locales/zh-CN.ts

@@ -85,6 +85,37 @@ const zhCN: Record<string, string> = {
   "txt_backup_recommend_pcloud_step_1": "先用邮箱注册一个 pCloud 账号。",
   "txt_backup_recommend_pcloud_step_2": "WebDAV 地址填写 https://webdav.pcloud.com/ 。",
   "txt_backup_recommend_pcloud_step_3": "注册邮箱用作 WebDAV 用户名，注册密码用作 WebDAV 密码。",
+  "txt_backup_recommend_backblaze_summary": "兼容 S3 的对象存储，免费容量 10 GB，无需信用卡。",
+  "txt_backup_recommend_backblaze_step_1": "先注册或登录 Backblaze 账号。",
+  "txt_backup_recommend_backblaze_step_2_prefix": "打开",
+  "txt_backup_recommend_backblaze_step_2_suffix": "，点击创建一个桶，只输入桶名字，其他地方不修改，然后创建。",
+  "txt_backup_recommend_backblaze_step_3": "创建后显示的 Endpoint 填到 S3 端点 URL；桶名字填到存储桶名称；区域填 Endpoint 中间那段，例如 us-west-004。",
+  "txt_backup_recommend_backblaze_step_4_prefix": "打开",
+  "txt_backup_recommend_backblaze_step_4_suffix": "，点击 Add a New Application Key，随便输入 Name of Key，其他地方不动，然后创建。",
+  "txt_backup_recommend_backblaze_step_5": "生成结果里的 keyID 填到 访问 ID，applicationKey 填到 访问密码。",
+  "txt_backup_recommend_cloudflare_r2_summary": "兼容 S3 的对象存储，免费容量 10 GB，需要信用卡认证。",
+  "txt_backup_recommend_cloudflare_r2_bucket_link": "创建储存桶页面",
+  "txt_backup_recommend_cloudflare_r2_api_link": "API 创建页面",
+  "txt_backup_recommend_cloudflare_r2_step_1_prefix": "打开",
+  "txt_backup_recommend_cloudflare_r2_step_1_suffix": "，只输入存储桶名称，直接创建。",
+  "txt_backup_recommend_cloudflare_r2_step_2_prefix": "打开",
+  "txt_backup_recommend_cloudflare_r2_step_2_suffix": "，权限全选“对象读和写”，直接创建。",
+  "txt_backup_recommend_cloudflare_r2_step_3": "创建后令牌值不用管；Access Key ID 填到 访问 ID，Secret Access Key 填到 访问密码。",
+  "txt_backup_recommend_cloudflare_r2_step_4": "把下面显示的地址填到 S3 端点 URL；存储桶名称如实填写；区域保持 auto 不改。",
+  "txt_backup_recommend_cloudflare_r2_step_5": "路径前缀按需要填写，例如 nodewarden；不想分目录可以留空。",
+  "txt_backup_recommend_s3_path_prefix_step": "路径前缀按需要填写，例如 nodewarden；不想分目录可以留空。",
+  "txt_backup_recommend_tigris_summary": "兼容 S3 的对象存储。免费容量 5 GB，无需信用卡。",
+  "txt_backup_recommend_tigris_signup_link": "注册页面",
+  "txt_backup_recommend_tigris_bucket_link": "Create Bucket 页面",
+  "txt_backup_recommend_tigris_access_key_link": "Create Access Key 页面",
+  "txt_backup_recommend_tigris_step_1_prefix": "打开",
+  "txt_backup_recommend_tigris_step_1_suffix": "，注册并登录 Tigris。",
+  "txt_backup_recommend_tigris_step_2_prefix": "打开",
+  "txt_backup_recommend_tigris_step_2_suffix": "，只输入桶的名字，其他地方不动，直接创建。",
+  "txt_backup_recommend_tigris_step_3_prefix": "然后打开",
+  "txt_backup_recommend_tigris_step_3_suffix": "，名字随意，直接创建。",
+  "txt_backup_recommend_tigris_step_4": "创建后显示的 Endpoint URL IAM 不用管；其余显示出来的内容按名称填写到备份页面里。",
+  "txt_backup_recommend_tigris_step_5": "最后点击 Manage Key Permissions，把 Admin Access 打开，否则无法写入。",
   "txt_backup_add_destination": "新增地点",
   "txt_backup_schedule_panel_title": "自动备份计划",
   "txt_backup_schedule_panel_note": "每个备份地点都可以单独配置自己的每日自动备份计划。",
@@ -193,10 +224,14 @@ const zhCN: Record<string, string> = {
   "txt_backup_restore_progress_remote_finalize_detail": "服务器正在执行最终校验，校验通过后会把已验证的数据切换为正式数据。",
   "txt_backup_remote_loading": "正在读取远端备份...",
   "txt_backup_remote_cached_empty": "点击“刷新”后读取",
+  "txt_backup_remote_cached_empty_prefix": "点击",
+  "txt_backup_remote_cached_empty_suffix": "后读取",
   "txt_backup_remote_empty": "这个目录下还没有备份文件",
   "txt_backup_remote_folder": "文件夹",
   "txt_backup_remote_unknown_time": "未知时间",
   "txt_backup_remote_current_path": "当前目录",
+  "txt_backup_remote_modified": "修改时间",
+  "txt_backup_remote_size": "大小",
   "txt_backup_remote_load_failed": "读取远端备份失败",
   "txt_backup_remote_invalid_response": "远端备份响应无效",
   "txt_backup_remote_download_failed": "下载远端备份失败",
@@ -214,6 +249,74 @@ const zhCN: Record<string, string> = {
   "txt_backup_remote_run_invalid_response": "远端备份执行响应无效",
   "txt_backup_settings_invalid_response": "备份设置响应无效",
   "txt_backup_import_invalid_response": "备份还原响应无效",
+  "txt_backup_error_another_backup_or_restore_running": "已有备份或还原任务正在执行。",
+  "txt_backup_error_another_backup_running": "已有备份任务正在执行。",
+  "txt_backup_error_archive_upload_failed": "备份压缩包上传失败。",
+  "txt_backup_error_archive_upload_verification_failed_attempts": "备份上传校验在 {count} 次尝试后仍失败：{reason}",
+  "txt_backup_error_attachment_blob_invalid": "备份附件对象无效。",
+  "txt_backup_error_attachment_blob_required": "缺少备份附件对象。",
+  "txt_backup_error_attachment_blob_not_found": "未找到备份附件对象。",
+  "txt_backup_error_attachment_download_failed": "备份附件下载失败。",
+  "txt_backup_error_destination_invalid": "备份地点无效。",
+  "txt_backup_error_destination_limit": "最多只能保存 {count} 个备份地点。",
+  "txt_backup_error_destination_not_found": "未找到备份地点。",
+  "txt_backup_error_destination_ids_unique": "备份地点 ID 不能重复。",
+  "txt_backup_error_destination_type_invalid": "备份地点类型无效。",
+  "txt_backup_error_destination_type_unsupported": "不支持的备份地点类型。",
+  "txt_backup_error_destinations_invalid": "备份地点列表无效。",
+  "txt_backup_error_export_payload_invalid": "备份导出请求无效。",
+  "txt_backup_error_file_checksum_mismatch": "备份文件校验值与文件名不一致。",
+  "txt_backup_error_file_required": "请选择备份文件。",
+  "txt_backup_error_interval_hours_range": "备份间隔必须在 1 到 99 小时之间。",
+  "txt_backup_error_multipart_required": "上传请求必须使用 multipart/form-data。",
+  "txt_backup_error_read_backup_file_failed": "无法读取备份文件。",
+  "txt_backup_error_remote_attachment_batch_download_failed_status": "远端附件批量下载失败：HTTP {status}。",
+  "txt_backup_error_remote_attachment_download_failed_status": "远端附件下载失败：HTTP {status}。",
+  "txt_backup_error_remote_delete_failed": "远端备份删除失败。",
+  "txt_backup_error_remote_download_failed": "远端备份下载失败。",
+  "txt_backup_error_remote_download_payload_invalid": "远端备份下载请求无效。",
+  "txt_backup_error_remote_integrity_failed": "远端备份完整性检查失败。",
+  "txt_backup_error_remote_listing_failed": "远端备份列表读取失败。",
+  "txt_backup_error_remote_path_invalid": "远端备份路径无效。",
+  "txt_backup_error_remote_restore_payload_invalid": "远端还原请求无效。",
+  "txt_backup_error_remote_zip_checksum_failed": "远端备份 ZIP 校验失败。",
+  "txt_backup_error_remote_zip_size_failed": "远端备份 ZIP 大小校验失败。",
+  "txt_backup_error_retention_count_range": "备份保留数量必须在 1 到 1000 之间。",
+  "txt_backup_error_run_failed": "备份执行失败。",
+  "txt_backup_error_run_payload_invalid": "备份执行请求无效。",
+  "txt_backup_error_run_response_invalid": "备份执行响应无效。",
+  "txt_backup_error_s3_access_key_required": "请填写 S3 访问 ID。",
+  "txt_backup_error_s3_bucket_required": "请填写 S3 存储桶名称。",
+  "txt_backup_error_s3_delete_failed_status": "S3 删除失败：HTTP {status}。",
+  "txt_backup_error_s3_download_failed_status": "S3 下载失败：HTTP {status}。",
+  "txt_backup_error_s3_endpoint_required": "请填写 S3 端点 URL。",
+  "txt_backup_error_s3_endpoint_protocol": "S3 端点 URL 必须以 http:// 或 https:// 开头。",
+  "txt_backup_error_s3_existence_check_failed_status": "S3 文件存在性检查失败：HTTP {status}。",
+  "txt_backup_error_s3_listing_failed_status": "S3 列表读取失败：HTTP {status}。",
+  "txt_backup_error_s3_secret_key_required": "请填写 S3 访问密码。",
+  "txt_backup_error_s3_upload_failed_status": "S3 上传失败：HTTP {status}。",
+  "txt_backup_error_select_backup_file": "请选择备份文件。",
+  "txt_backup_error_select_backup_zip_file": "请选择备份 ZIP 文件。",
+  "txt_backup_error_settings_envelope_invalid": "备份设置加密封装无效。",
+  "txt_backup_error_settings_invalid": "备份设置无效。",
+  "txt_backup_error_settings_load_failed": "无法加载备份设置。",
+  "txt_backup_error_settings_need_reactivation": "还原后需要管理员重新激活备份设置。",
+  "txt_backup_error_settings_payload_invalid": "备份设置请求无效。",
+  "txt_backup_error_settings_repair_payload_invalid": "备份设置修复请求无效。",
+  "txt_backup_error_settings_repair_state_load_failed": "无法加载备份设置修复状态。",
+  "txt_backup_error_start_time_format": "备份开始时间必须是 HH:mm 格式。",
+  "txt_backup_error_timezone_invalid": "备份时区无效。",
+  "txt_backup_error_webdav_delete_failed_status": "WebDAV 删除失败：HTTP {status}。",
+  "txt_backup_error_webdav_directory_creation_failed_status": "WebDAV 目录创建失败：HTTP {status}。",
+  "txt_backup_error_webdav_download_failed_status": "WebDAV 下载失败：HTTP {status}。",
+  "txt_backup_error_webdav_existence_check_failed_status": "WebDAV 文件存在性检查失败：HTTP {status}。",
+  "txt_backup_error_webdav_listing_failed_status": "WebDAV 列表读取失败：HTTP {status}。",
+  "txt_backup_error_webdav_password_required": "请填写 WebDAV 密码。",
+  "txt_backup_error_webdav_path_too_deep": "WebDAV 远端备份路径过深，无法安全分批处理附件。",
+  "txt_backup_error_webdav_upload_failed_status": "WebDAV 上传失败：HTTP {status}。",
+  "txt_backup_error_webdav_url_required": "请填写 WebDAV 服务地址。",
+  "txt_backup_error_webdav_url_protocol": "WebDAV 服务地址必须以 http:// 或 https:// 开头。",
+  "txt_backup_error_webdav_username_required": "请填写 WebDAV 用户名。",
   "txt_backup_destination": "备份地点",
   "txt_backup_protocol_webdav": "WebDAV",
   "txt_backup_protocol_s3": "S3",
@@ -266,12 +369,15 @@ const zhCN: Record<string, string> = {
   "txt_backup_webdav_username": "WebDAV 用户名",
   "txt_backup_webdav_password": "WebDAV 密码",
   "txt_backup_webdav_path": "远程目录",
-  "txt_backup_s3_endpoint": "S3 端点",
-  "txt_backup_s3_bucket": "存储桶",
+  "txt_backup_s3_endpoint": "S3 端点 URL",
+  "txt_backup_s3_addressing_style": "寻址方式",
+  "txt_backup_s3_addressing_path_style": "path-style（默认）",
+  "txt_backup_s3_addressing_virtual_hosted_style": "virtual-hosted-style",
+  "txt_backup_s3_bucket": "存储桶名称",
   "txt_backup_s3_region": "区域",
-  "txt_backup_s3_access_key": "访问密钥",
-  "txt_backup_s3_secret_key": "秘密密钥",
-  "txt_backup_s3_path": "远程路径",
+  "txt_backup_s3_access_key": "访问 ID",
+  "txt_backup_s3_secret_key": "访问密码",
+  "txt_backup_s3_path": "路径前缀",
   "txt_backup_reserved_name": "预留类型名称",
   "txt_backup_reserved_notes": "预留备注",
   "txt_backup_reserved_notes_placeholder": "给下一个备份地点先留个说明",
@@ -447,6 +553,11 @@ const zhCN: Record<string, string> = {
   "txt_favorite": "收藏",
   "txt_favorites": "收藏",
   "txt_duplicates": "重复项",
+  "txt_duplicate_detection_mode": "匹配方式",
+  "txt_duplicate_mode_exact": "完全相同",
+  "txt_duplicate_mode_login_site": "网站+账号+密码",
+  "txt_duplicate_mode_login_credentials": "账号+密码",
+  "txt_duplicate_mode_password": "密码复用",
   "txt_field": "字段",
   "txt_field_label": "字段标签",
   "txt_field_label_is_required": "字段标签不能为空",
@@ -481,16 +592,21 @@ const zhCN: Record<string, string> = {
   "txt_server_error_account_disabled": "账号已被禁用",
   "txt_server_error_client_credentials_incorrect": "客户端 ID 或客户端密钥不正确，请重试",
   "txt_server_error_client_ip_required": "无法获取客户端 IP",
+  "txt_server_error_forbidden": "你没有权限执行此操作。",
   "txt_server_error_email_already_registered": "该邮箱已注册",
   "txt_server_error_email_password_required": "邮箱和密码不能为空",
   "txt_server_error_email_required": "邮箱不能为空",
+  "txt_server_error_invalid_password": "密码无效。",
   "txt_server_error_invalid_refresh_token": "登录状态已失效，请重新登录",
+  "txt_server_error_invalid_user_verification_token": "用户验证令牌无效。",
   "txt_server_error_invalid_request_payload": "请求内容无效",
   "txt_server_error_invite_invalid_or_expired": "邀请码无效或已过期",
   "txt_server_error_invite_required": "邀请码不能为空",
   "txt_server_error_jwt_secret_default": "JWT_SECRET 正在使用默认示例值，请修改后再继续",
   "txt_server_error_jwt_secret_missing": "JWT_SECRET 未设置",
   "txt_server_error_jwt_secret_too_short": "JWT_SECRET 至少需要 32 个字符",
+  "txt_server_error_master_password_hash_required": "需要验证主密码。",
+  "txt_server_error_master_password_or_verification_required": "需要主密码或用户验证令牌。",
   "txt_server_error_parameter_error": "请求参数错误",
   "txt_server_error_refresh_token_required": "登录状态缺失，请重新登录",
   "txt_server_error_registration_retry": "注册暂时不可用，请重试一次",
@@ -750,6 +866,7 @@ const zhCN: Record<string, string> = {
   "txt_search_sends": "搜索 Send...",
   "txt_session_refresh_failed": "会话刷新失败，请重新登录",
   "txt_search_your_secure_vault": "搜索你的密码库...",
+  "txt_search_items_count": "共 {count} 项中搜索...",
   "txt_clear_search": "清空搜索",
   "txt_clear_search_esc": "清空搜索（Esc）",
   "txt_sort": "排序",
@@ -1172,7 +1289,22 @@ const zhCN: Record<string, string> = {
   "txt_target": "目标",
   "txt_time": "时间",
   "txt_time_range": "时间范围",
-  "txt_remove_domain": "移除域名"
+  "txt_remove_domain": "移除域名",
+  "txt_approve_device_login": "批准设备登录",
+  "txt_auth_request_approve_message": "解锁您设备上的 Bitwarden，或通过网页 App 批准。批准前，请确保指纹短语与下面的相匹配。",
+  "txt_approve": "批准",
+  "txt_approving": "正在批准...",
+  "txt_deny": "拒绝",
+  "txt_later": "稍后",
+  "txt_pending_device_logins": "待处理设备登录",
+  "txt_no_pending_device_logins": "没有待处理设备登录",
+  "txt_fingerprint_phrase": "指纹短语",
+  "txt_auth_requests_load_failed": "加载设备登录请求失败",
+  "txt_auth_request_update_failed": "更新设备登录请求失败",
+  "txt_auth_request_approved": "已批准设备登录",
+  "txt_auth_request_denied": "已拒绝设备登录",
+  "txt_auth_request_missing_public_key": "设备登录请求缺少公钥",
+  "txt_ip_address": "IP 地址"
 };
 
 export default zhCN;

webapp/src/lib/i18n/locales/zh-TW.ts

@@ -85,6 +85,37 @@ const zhTW: Record<string, string> = {
   "txt_backup_recommend_pcloud_step_1": "先用郵箱註冊一個 pCloud 賬號。",
   "txt_backup_recommend_pcloud_step_2": "WebDAV 地址填寫 https://webdav.pcloud.com/ 。",
   "txt_backup_recommend_pcloud_step_3": "註冊郵箱用作 WebDAV 用戶名，註冊密碼用作 WebDAV 密碼。",
+  "txt_backup_recommend_backblaze_summary": "兼容 S3 的對象儲存，免費容量 10 GB，無需信用卡。",
+  "txt_backup_recommend_backblaze_step_1": "先註冊或登入 Backblaze 賬號。",
+  "txt_backup_recommend_backblaze_step_2_prefix": "打開",
+  "txt_backup_recommend_backblaze_step_2_suffix": "，點擊創建一個桶，只輸入桶名字，其他地方不修改，然後創建。",
+  "txt_backup_recommend_backblaze_step_3": "創建後顯示的 Endpoint 填到 S3 端點 URL；桶名字填到儲存桶名稱；區域填 Endpoint 中間那段，例如 us-west-004。",
+  "txt_backup_recommend_backblaze_step_4_prefix": "打開",
+  "txt_backup_recommend_backblaze_step_4_suffix": "，點擊 Add a New Application Key，隨便輸入 Name of Key，其他地方不動，然後創建。",
+  "txt_backup_recommend_backblaze_step_5": "生成結果裡的 keyID 填存取金鑰，applicationKey 填秘密金鑰。",
+  "txt_backup_recommend_cloudflare_r2_summary": "兼容 S3 的對象儲存，免費容量 10 GB，需要信用卡驗證。",
+  "txt_backup_recommend_cloudflare_r2_bucket_link": "創建儲存桶頁面",
+  "txt_backup_recommend_cloudflare_r2_api_link": "API 創建頁面",
+  "txt_backup_recommend_cloudflare_r2_step_1_prefix": "打開",
+  "txt_backup_recommend_cloudflare_r2_step_1_suffix": "，只輸入儲存桶名稱，直接創建。",
+  "txt_backup_recommend_cloudflare_r2_step_2_prefix": "打開",
+  "txt_backup_recommend_cloudflare_r2_step_2_suffix": "，權限全選「對象讀和寫」，直接創建。",
+  "txt_backup_recommend_cloudflare_r2_step_3": "創建後令牌值不用管；Access Key ID 填到存取 ID，Secret Access Key 填到存取密碼。",
+  "txt_backup_recommend_cloudflare_r2_step_4": "把下面顯示的地址填到 S3 端點 URL；儲存桶名稱如實填寫；區域保持 auto 不改。",
+  "txt_backup_recommend_cloudflare_r2_step_5": "路徑前綴按需要填寫，例如 nodewarden；不想分目錄可以留空。",
+  "txt_backup_recommend_s3_path_prefix_step": "路徑前綴按需要填寫，例如 nodewarden；不想分目錄可以留空。",
+  "txt_backup_recommend_tigris_summary": "兼容 S3 的對象儲存。免費容量 5 GB，無需信用卡。",
+  "txt_backup_recommend_tigris_signup_link": "註冊頁面",
+  "txt_backup_recommend_tigris_bucket_link": "Create Bucket 頁面",
+  "txt_backup_recommend_tigris_access_key_link": "Create Access Key 頁面",
+  "txt_backup_recommend_tigris_step_1_prefix": "打開",
+  "txt_backup_recommend_tigris_step_1_suffix": "，註冊並登入 Tigris。",
+  "txt_backup_recommend_tigris_step_2_prefix": "打開",
+  "txt_backup_recommend_tigris_step_2_suffix": "，只輸入桶的名字，其他地方不動，直接創建。",
+  "txt_backup_recommend_tigris_step_3_prefix": "然後打開",
+  "txt_backup_recommend_tigris_step_3_suffix": "，名字隨意，直接創建。",
+  "txt_backup_recommend_tigris_step_4": "創建後顯示的 Endpoint URL IAM 不用管；其餘顯示出來的內容按名稱填寫到備份頁面裡。",
+  "txt_backup_recommend_tigris_step_5": "最後點擊 Manage Key Permissions，把 Admin Access 打開，否則無法寫入。",
   "txt_backup_add_destination": "新增地點",
   "txt_backup_schedule_panel_title": "自動備份計劃",
   "txt_backup_schedule_panel_note": "每個備份地點都可以單獨配置自己的每日自動備份計劃。",
@@ -193,10 +224,14 @@ const zhTW: Record<string, string> = {
   "txt_backup_restore_progress_remote_finalize_detail": "服務器正在執行最終校驗，校驗通過後會把已驗證的數據切換為正式數據。",
   "txt_backup_remote_loading": "正在讀取遠端備份...",
   "txt_backup_remote_cached_empty": "點擊“刷新”後讀取",
+  "txt_backup_remote_cached_empty_prefix": "點擊",
+  "txt_backup_remote_cached_empty_suffix": "後讀取",
   "txt_backup_remote_empty": "這個目錄下還沒有備份文件",
   "txt_backup_remote_folder": "文件夾",
   "txt_backup_remote_unknown_time": "未知時間",
   "txt_backup_remote_current_path": "當前目錄",
+  "txt_backup_remote_modified": "修改時間",
+  "txt_backup_remote_size": "大小",
   "txt_backup_remote_load_failed": "讀取遠端備份失敗",
   "txt_backup_remote_invalid_response": "遠端備份響應無效",
   "txt_backup_remote_download_failed": "下載遠端備份失敗",
@@ -214,6 +249,74 @@ const zhTW: Record<string, string> = {
   "txt_backup_remote_run_invalid_response": "遠端備份執行響應無效",
   "txt_backup_settings_invalid_response": "備份設置響應無效",
   "txt_backup_import_invalid_response": "備份還原響應無效",
+  "txt_backup_error_another_backup_or_restore_running": "已有備份或還原任務正在執行。",
+  "txt_backup_error_another_backup_running": "已有備份任務正在執行。",
+  "txt_backup_error_archive_upload_failed": "備份壓縮包上傳失敗。",
+  "txt_backup_error_archive_upload_verification_failed_attempts": "備份上傳校驗在 {count} 次嘗試後仍失敗：{reason}",
+  "txt_backup_error_attachment_blob_invalid": "備份附件對象無效。",
+  "txt_backup_error_attachment_blob_required": "缺少備份附件對象。",
+  "txt_backup_error_attachment_blob_not_found": "未找到備份附件對象。",
+  "txt_backup_error_attachment_download_failed": "備份附件下載失敗。",
+  "txt_backup_error_destination_invalid": "備份地點無效。",
+  "txt_backup_error_destination_limit": "最多只能保存 {count} 個備份地點。",
+  "txt_backup_error_destination_not_found": "未找到備份地點。",
+  "txt_backup_error_destination_ids_unique": "備份地點 ID 不能重複。",
+  "txt_backup_error_destination_type_invalid": "備份地點類型無效。",
+  "txt_backup_error_destination_type_unsupported": "不支持的備份地點類型。",
+  "txt_backup_error_destinations_invalid": "備份地點列表無效。",
+  "txt_backup_error_export_payload_invalid": "備份導出請求無效。",
+  "txt_backup_error_file_checksum_mismatch": "備份文件校驗值與文件名不一致。",
+  "txt_backup_error_file_required": "請選擇備份文件。",
+  "txt_backup_error_interval_hours_range": "備份間隔必須在 1 到 99 小時之間。",
+  "txt_backup_error_multipart_required": "上傳請求必須使用 multipart/form-data。",
+  "txt_backup_error_read_backup_file_failed": "無法讀取備份文件。",
+  "txt_backup_error_remote_attachment_batch_download_failed_status": "遠端附件批量下載失敗：HTTP {status}。",
+  "txt_backup_error_remote_attachment_download_failed_status": "遠端附件下載失敗：HTTP {status}。",
+  "txt_backup_error_remote_delete_failed": "遠端備份刪除失敗。",
+  "txt_backup_error_remote_download_failed": "遠端備份下載失敗。",
+  "txt_backup_error_remote_download_payload_invalid": "遠端備份下載請求無效。",
+  "txt_backup_error_remote_integrity_failed": "遠端備份完整性檢查失敗。",
+  "txt_backup_error_remote_listing_failed": "遠端備份列表讀取失敗。",
+  "txt_backup_error_remote_path_invalid": "遠端備份路徑無效。",
+  "txt_backup_error_remote_restore_payload_invalid": "遠端還原請求無效。",
+  "txt_backup_error_remote_zip_checksum_failed": "遠端備份 ZIP 校驗失敗。",
+  "txt_backup_error_remote_zip_size_failed": "遠端備份 ZIP 大小校驗失敗。",
+  "txt_backup_error_retention_count_range": "備份保留數量必須在 1 到 1000 之間。",
+  "txt_backup_error_run_failed": "備份執行失敗。",
+  "txt_backup_error_run_payload_invalid": "備份執行請求無效。",
+  "txt_backup_error_run_response_invalid": "備份執行響應無效。",
+  "txt_backup_error_s3_access_key_required": "請填寫 S3 存取 ID。",
+  "txt_backup_error_s3_bucket_required": "請填寫 S3 儲存桶名稱。",
+  "txt_backup_error_s3_delete_failed_status": "S3 刪除失敗：HTTP {status}。",
+  "txt_backup_error_s3_download_failed_status": "S3 下載失敗：HTTP {status}。",
+  "txt_backup_error_s3_endpoint_required": "請填寫 S3 端點 URL。",
+  "txt_backup_error_s3_endpoint_protocol": "S3 端點 URL 必須以 http:// 或 https:// 開頭。",
+  "txt_backup_error_s3_existence_check_failed_status": "S3 文件存在性檢查失敗：HTTP {status}。",
+  "txt_backup_error_s3_listing_failed_status": "S3 列表讀取失敗：HTTP {status}。",
+  "txt_backup_error_s3_secret_key_required": "請填寫 S3 存取密碼。",
+  "txt_backup_error_s3_upload_failed_status": "S3 上傳失敗：HTTP {status}。",
+  "txt_backup_error_select_backup_file": "請選擇備份文件。",
+  "txt_backup_error_select_backup_zip_file": "請選擇備份 ZIP 文件。",
+  "txt_backup_error_settings_envelope_invalid": "備份設置加密封裝無效。",
+  "txt_backup_error_settings_invalid": "備份設置無效。",
+  "txt_backup_error_settings_load_failed": "無法加載備份設置。",
+  "txt_backup_error_settings_need_reactivation": "還原後需要管理員重新激活備份設置。",
+  "txt_backup_error_settings_payload_invalid": "備份設置請求無效。",
+  "txt_backup_error_settings_repair_payload_invalid": "備份設置修復請求無效。",
+  "txt_backup_error_settings_repair_state_load_failed": "無法加載備份設置修復狀態。",
+  "txt_backup_error_start_time_format": "備份開始時間必須是 HH:mm 格式。",
+  "txt_backup_error_timezone_invalid": "備份時區無效。",
+  "txt_backup_error_webdav_delete_failed_status": "WebDAV 刪除失敗：HTTP {status}。",
+  "txt_backup_error_webdav_directory_creation_failed_status": "WebDAV 目錄創建失敗：HTTP {status}。",
+  "txt_backup_error_webdav_download_failed_status": "WebDAV 下載失敗：HTTP {status}。",
+  "txt_backup_error_webdav_existence_check_failed_status": "WebDAV 文件存在性檢查失敗：HTTP {status}。",
+  "txt_backup_error_webdav_listing_failed_status": "WebDAV 列表讀取失敗：HTTP {status}。",
+  "txt_backup_error_webdav_password_required": "請填寫 WebDAV 密碼。",
+  "txt_backup_error_webdav_path_too_deep": "WebDAV 遠端備份路徑過深，無法安全分批處理附件。",
+  "txt_backup_error_webdav_upload_failed_status": "WebDAV 上傳失敗：HTTP {status}。",
+  "txt_backup_error_webdav_url_required": "請填寫 WebDAV 服務地址。",
+  "txt_backup_error_webdav_url_protocol": "WebDAV 服務地址必須以 http:// 或 https:// 開頭。",
+  "txt_backup_error_webdav_username_required": "請填寫 WebDAV 用戶名。",
   "txt_backup_destination": "備份地點",
   "txt_backup_protocol_webdav": "WebDAV",
   "txt_backup_protocol_s3": "S3",
@@ -267,6 +370,9 @@ const zhTW: Record<string, string> = {
   "txt_backup_webdav_password": "WebDAV 密碼",
   "txt_backup_webdav_path": "遠程目錄",
   "txt_backup_s3_endpoint": "S3 端點",
+  "txt_backup_s3_addressing_style": "S3 定址方式",
+  "txt_backup_s3_addressing_path_style": "path-style（預設）",
+  "txt_backup_s3_addressing_virtual_hosted_style": "virtual-hosted-style",
   "txt_backup_s3_bucket": "儲存桶",
   "txt_backup_s3_region": "區域",
   "txt_backup_s3_access_key": "存取金鑰",
@@ -447,6 +553,11 @@ const zhTW: Record<string, string> = {
   "txt_favorite": "收藏",
   "txt_favorites": "收藏",
   "txt_duplicates": "重複項",
+  "txt_duplicate_detection_mode": "匹配方式",
+  "txt_duplicate_mode_exact": "完全相同",
+  "txt_duplicate_mode_login_site": "網站+帳號+密碼",
+  "txt_duplicate_mode_login_credentials": "帳號+密碼",
+  "txt_duplicate_mode_password": "密碼重複使用",
   "txt_field": "字段",
   "txt_field_label": "字段標籤",
   "txt_field_label_is_required": "字段標籤不能為空",
@@ -481,16 +592,21 @@ const zhTW: Record<string, string> = {
   "txt_server_error_account_disabled": "帳號已被禁用",
   "txt_server_error_client_credentials_incorrect": "客戶端 ID 或客戶端密鑰不正確，請重試",
   "txt_server_error_client_ip_required": "無法獲取客戶端 IP",
+  "txt_server_error_forbidden": "你沒有權限執行此操作。",
   "txt_server_error_email_already_registered": "該郵箱已註冊",
   "txt_server_error_email_password_required": "郵箱和密碼不能為空",
   "txt_server_error_email_required": "郵箱不能為空",
+  "txt_server_error_invalid_password": "密碼無效。",
   "txt_server_error_invalid_refresh_token": "登入狀態已失效，請重新登入",
+  "txt_server_error_invalid_user_verification_token": "用戶驗證令牌無效。",
   "txt_server_error_invalid_request_payload": "請求內容無效",
   "txt_server_error_invite_invalid_or_expired": "邀請碼無效或已過期",
   "txt_server_error_invite_required": "邀請碼不能為空",
   "txt_server_error_jwt_secret_default": "JWT_SECRET 正在使用默認示例值，請修改後再繼續",
   "txt_server_error_jwt_secret_missing": "JWT_SECRET 未設置",
   "txt_server_error_jwt_secret_too_short": "JWT_SECRET 至少需要 32 個字符",
+  "txt_server_error_master_password_hash_required": "需要驗證主密碼。",
+  "txt_server_error_master_password_or_verification_required": "需要主密碼或用戶驗證令牌。",
   "txt_server_error_parameter_error": "請求參數錯誤",
   "txt_server_error_refresh_token_required": "登入狀態缺失，請重新登入",
   "txt_server_error_registration_retry": "註冊暫時不可用，請重試一次",
@@ -750,6 +866,7 @@ const zhTW: Record<string, string> = {
   "txt_search_sends": "搜索 Send...",
   "txt_session_refresh_failed": "會話刷新失敗，請重新登入",
   "txt_search_your_secure_vault": "搜索你的密碼庫...",
+  "txt_search_items_count": "在共 {count} 項中搜索...",
   "txt_clear_search": "清空搜索",
   "txt_clear_search_esc": "清空搜索（Esc）",
   "txt_sort": "排序",
@@ -1172,7 +1289,22 @@ const zhTW: Record<string, string> = {
   "txt_target": "目標",
   "txt_time": "時間",
   "txt_time_range": "時間範圍",
-  "txt_remove_domain": "移除域名"
+  "txt_remove_domain": "移除域名",
+  "txt_approve_device_login": "批准裝置登入",
+  "txt_auth_request_approve_message": "解鎖您裝置上的 Bitwarden，或透過網頁 App 批准。批准前，請確保指紋短語與下面的相符。",
+  "txt_fingerprint_phrase": "指紋短語",
+  "txt_ip_address": "IP 位址",
+  "txt_approve": "批准",
+  "txt_approving": "正在批准...",
+  "txt_deny": "拒絕",
+  "txt_later": "稍後",
+  "txt_pending_device_logins": "待處理裝置登入",
+  "txt_no_pending_device_logins": "沒有待處理裝置登入",
+  "txt_auth_requests_load_failed": "載入裝置登入請求失敗",
+  "txt_auth_request_update_failed": "更新裝置登入請求失敗",
+  "txt_auth_request_approved": "已批准裝置登入",
+  "txt_auth_request_denied": "已拒絕裝置登入",
+  "txt_auth_request_missing_public_key": "裝置登入請求缺少公鑰"
 };
 
 export default zhTW;

webapp/src/lib/network-status.ts

@@ -1,12 +1,14 @@
 export type NetworkStatus = 'online' | 'offline';
 
-const STATUS_PROBE_TIMEOUT_MS = 3500;
+const STATUS_PROBE_TIMEOUT_MS = 8000;
 const STATUS_PROBE_CACHE_MS = 5000;
+const PROBE_FAILURES_BEFORE_OFFLINE = 2;
 const listeners = new Set<(status: NetworkStatus) => void>();
 let currentStatus: NetworkStatus = getInitialNetworkStatus();
 let pendingProbe: Promise<boolean> | null = null;
 let lastProbeAt = 0;
 let lastProbeResult = currentStatus === 'online';
+let consecutiveProbeFailures = 0;
 
 export function browserReportsOffline(): boolean {
   return typeof navigator !== 'undefined' && navigator.onLine === false;
@@ -35,8 +37,23 @@ export function subscribeNetworkStatus(listener: (status: NetworkStatus) => void
   };
 }
 
+export function recordNodeWardenReachable(): void {
+  consecutiveProbeFailures = 0;
+  lastProbeResult = true;
+  setCurrentNetworkStatus('online');
+}
+
+export function recordNodeWardenUnreachable(): void {
+  lastProbeResult = false;
+  consecutiveProbeFailures += 1;
+  if (browserReportsOffline() || consecutiveProbeFailures >= PROBE_FAILURES_BEFORE_OFFLINE) {
+    setCurrentNetworkStatus('offline');
+  }
+}
+
 export async function probeNodeWardenService(): Promise<boolean> {
   if (browserReportsOffline()) {
+    consecutiveProbeFailures = PROBE_FAILURES_BEFORE_OFFLINE;
     setCurrentNetworkStatus('offline');
     return false;
   }
@@ -68,8 +85,11 @@ export async function probeNodeWardenService(): Promise<boolean> {
     .catch(() => false)
     .then((result) => {
       lastProbeAt = Date.now();
-      lastProbeResult = result;
-      setCurrentNetworkStatus(result ? 'online' : 'offline');
+      if (result) {
+        recordNodeWardenReachable();
+      } else {
+        recordNodeWardenUnreachable();
+      }
       return result;
     })
     .finally(() => {