@ai-ecoverse/slicc-spectrum 1.62.2 → 1.64.0

package/dist/slicc-ui.js

@@ -25,6 +25,11 @@ import {
 import {
   define
 } from "./chunk-XI74SELH.js";
+import {
+  isVaultFailure,
+  nameProblem,
+  valueProblem
+} from "./chunk-XQHRTHDQ.js";
 import {
   Emitter
 } from "./chunk-T5NHW4KC.js";
@@ -9589,8 +9594,8 @@ function basename(path) {
 function treePaths(entries) {
   return entries.map((entry) => relative(entry.path) + (entry.kind === "directory" ? "/" : ""));
 }
-function treeStatus(changes) {
-  return changes.map((change) => ({ path: relative(change.path), status: change.status }));
+function treeStatus(changes2) {
+  return changes2.map((change) => ({ path: relative(change.path), status: change.status }));
 }
 function ancestors(paths) {
   const out = /* @__PURE__ */ new Set();
@@ -9868,11 +9873,11 @@ var SliccFiles = class extends ModelElement {
   }
   #sync() {
     const tree = this.#tree();
-    const changes = this.model ? changesOf(this.model).changes() : [];
+    const changes2 = this.model ? changesOf(this.model).changes() : [];
     if (!tree) return;
-    if (tree.paths.length === 0) tree.expanded = ancestors(changes.map((change) => change.path));
+    if (tree.paths.length === 0) tree.expanded = ancestors(changes2.map((change) => change.path));
     tree.paths = treePaths(this.#entries);
-    tree.gitStatus = treeStatus(changes);
+    tree.gitStatus = treeStatus(changes2);
     this.#show();
     if (this.#pending) {
       this.#pending = false;
@@ -11726,8 +11731,8 @@ var QrSegment = class {
   // Creates a new QR Code segment with the given attributes and data.
   // The character count (numChars) must agree with the mode and the bit buffer length,
   // but the constraint isn't checked. The given bit buffer is cloned and stored.
-  constructor(mode, numChars, bitData) {
-    this.mode = mode;
+  constructor(mode2, numChars, bitData) {
+    this.mode = mode2;
     this.numChars = numChars;
     this.bitData = bitData;
     if (numChars < 0)
@@ -11743,8 +11748,8 @@ var QrSegment = class {
 var MODE_NUMERIC = [1, 10, 12, 14];
 var MODE_ALPHANUMERIC = [2, 9, 11, 13];
 var MODE_BYTE = [4, 8, 16, 16];
-function numCharCountBits(mode, ver) {
-  return mode[Math.floor((ver + 7) / 17) + 1];
+function numCharCountBits(mode2, ver) {
+  return mode2[Math.floor((ver + 7) / 17) + 1];
 }
 function makeBytes(data) {
   const bb = [];
@@ -12273,14 +12278,14 @@ function networkStatus(port) {
 }
 function remoteLight(status2) {
   const devices = status2?.links?.devices ?? [];
-  const asking2 = devices.filter((device) => device.asking);
+  const asking3 = devices.filter((device) => device.asking);
   const prompting = devices.filter((device) => device.controlling === "prompt");
   const watching = devices.filter((device) => device.controlling === "watch");
   const shells = devices.filter((device) => device.terminals);
-  if (!asking2.length && !prompting.length && !watching.length && !shells.length) return null;
+  if (!asking3.length && !prompting.length && !watching.length && !shells.length) return null;
   const tooltip = [
     ...say(
-      asking2,
+      asking3,
       (device) => `${device.name} asks to follow this SLICC. Allow it in Linked devices.`,
       "devices ask to follow this SLICC. Allow them in Linked devices."
     ),
@@ -12301,8 +12306,8 @@ function remoteLight(status2) {
     )
   ].join(" ");
   const by = (list5) => list5.length === 1 ? list5[0].name : `${list5.length} linked devices`;
-  if (asking2.length) {
-    const text2 = asking2.length === 1 ? `${asking2[0].name} asks to follow` : `${asking2.length} devices ask to follow`;
+  if (asking3.length) {
+    const text2 = asking3.length === 1 ? `${asking3[0].name} asks to follow` : `${asking3.length} devices ask to follow`;
     return { mode: "ask", variant: "notice", text: text2, tooltip };
   }
   if (prompting.length)
@@ -13845,13 +13850,16 @@ function table(rows) {
 var done = (result, note = "") => result.code === 0 ? { stdout: `${result.message}${note}
 `, stderr: "", code: 0 } : { stdout: "", stderr: `panel: ${result.message}
 `, code: result.code };
+function closedWhen(ago2) {
+  return ago2 < 5e3 ? "just now" : `${Math.round(ago2 / 1e3)} s ago`;
+}
 function act(scope, parsed) {
   const { panels, reachable: reachable2, cone } = scope;
   if (parsed.verb === "reset") {
     const recent = scope.agent ? panels.recentClose() : null;
     if (recent)
       return refusedOutput(
-        `the user closed ${recent.id} ${Math.round(recent.ago / 1e3)} s ago; ask before resetting the layout`
+        `the user closed ${recent.id} ${closedWhen(recent.ago)}; ask before resetting the layout`
       );
     return done(panels.reset());
   }
@@ -13867,9 +13875,7 @@ function act(scope, parsed) {
   if (parsed.verb === "close") return done(panels.close(id));
   const ago2 = scope.agent && !panels.find(id)?.open ? panels.closedAgo(id) : null;
   if (ago2 !== null)
-    return refusedOutput(
-      `the user closed ${id} ${Math.round(ago2 / 1e3)} s ago; ask before opening it again`
-    );
+    return refusedOutput(`the user closed ${id} ${closedWhen(ago2)}; ask before opening it again`);
   if (parsed.verb === "move") return done(panels.move(id, place3));
   const options = { place: place3, section: parsed.section };
   if (parsed.verb === "open") return done(panels.open(id, options));
@@ -20497,6 +20503,16 @@ function body(call, color) {
   }
   return b`<pre class="input">${call.input}</pre>`;
 }
+var severityWords = {
+  error: "Error: ",
+  warn: "Warning: ",
+  info: "Note: "
+};
+function notes(list5) {
+  return b`<ul class="notes">${list5.map(
+    (note) => b`<li data-note data-severity=${note.severity}>${note.severity === "info" ? b`<swc-icon-info-circle size="s" aria-hidden="true"></swc-icon-info-circle>` : b`<swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle>`}<span><span class="sr">${severityWords[note.severity]}</span>${note.text}</span></li>`
+  )}</ul>`;
+}
 function tool(call, color = "light") {
   const kind = toolKind(call.name);
   return b`<details class="tool" data-status=${call.status} data-tool=${call.name} data-kind=${kind.id}>
@@ -20514,6 +20530,7 @@ function tool(call, color = "light") {
     <div class="call">
       ${body(call, color)}
       ${call.output ? b`<pre class="output">${call.output}</pre>` : A}
+      ${call.notes?.length ? notes(call.notes) : A}
       ${call.image ? b`<img class="shot" src=${call.image} alt=${call.title} />` : A}
     </div>
   </details>`;
@@ -21168,6 +21185,33 @@ var messageCss = i`
     max-block-size: calc(var(--swc-spacing-1000) * 2.5);
     overflow: auto;
   }
+  .call > pre {
+    white-space: pre-wrap;
+    overflow-wrap: anywhere;
+  }
+  .notes {
+    display: flex;
+    flex-direction: column;
+    gap: var(--swc-spacing-75);
+    margin: var(--swc-spacing-100) 0 0;
+    padding: 0;
+    list-style: none;
+    color: var(--swc-neutral-subdued-content-color-default);
+  }
+  .notes li {
+    display: flex;
+    align-items: flex-start;
+    gap: var(--swc-spacing-75);
+    overflow-wrap: anywhere;
+  }
+  .notes swc-icon-alert-triangle,
+  .notes swc-icon-info-circle {
+    flex: none;
+    margin-block-start: var(--swc-spacing-50);
+  }
+  .notes [data-severity='error'] {
+    color: var(--swc-negative-content-color-default);
+  }
   .call > pre.input:has(+ pre.output) {
     margin-block-end: calc(-1 * var(--swc-spacing-100));
     border-block-end: 0;
@@ -21455,7 +21499,8 @@ var messageCss = i`
   .lick[data-severity='warn'] {
     --severity: var(--swc-notice-visual-color);
   }
-  .lick .sr {
+  .lick .sr,
+  .notes .sr {
     position: absolute;
     inline-size: 1px;
     block-size: 1px;
@@ -21996,11 +22041,11 @@ var SliccUpdates = class extends ModelElement {
       </p>`;
     }
     const version2 = item2.version === null ? item2.offered : item2.offered && item2.offered !== item2.version ? `${item2.version} \u2192 ${item2.offered}` : item2.version;
-    const download = item2.size !== void 0 && (item2.version === null || item2.offered !== item2.version);
+    const download2 = item2.size !== void 0 && (item2.version === null || item2.offered !== item2.version);
     const requires = requiresText(item2, all2);
     return b`<p class="meta">
       ${version2 ? b`<span class="version">${version2}</span>` : A}
-      ${download ? b`<span>${size3(item2.size)}</span>` : A}
+      ${download2 ? b`<span>${size3(item2.size)}</span>` : A}
       ${requires ? b`<span data-requires>${requires}</span>` : A}
     </p>`;
   }
@@ -22764,13 +22809,13 @@ var SliccApp = class extends ThemedElement {
     this.#detach(id, null, false);
   }
   #railButton(item2, side) {
-    const changes = item2.id === "changes" ? this.#changes() : 0;
+    const changes2 = item2.id === "changes" ? this.#changes() : 0;
     const driven = item2.id === "browser" && !!this.model?.browser.list().some((tab) => tab.controlled);
     const visible2 = shown(this.dock, item2.id);
-    const label = `${visible2 ? `${item2.title}, shown` : `Open ${item2.title}`}${changes ? `, ${changeCount(changes)}` : driven ? ", a tab is in use" : ""}`;
+    const label = `${visible2 ? `${item2.title}, shown` : `Open ${item2.title}`}${changes2 ? `, ${changeCount(changes2)}` : driven ? ", a tab is in use" : ""}`;
     const button = u16`<swc-action-button id=${`rail-${item2.id}`} class=${visible2 ? "selected" : ""} quiet size="m" accessible-label=${label} data-surface=${item2.id} data-cone=${o2(item2.cone)} ?data-visible=${visible2} @click=${() => this.show(item2.id)}>${railIcon(item2.icon)}</swc-action-button>`;
     const tooltip = b`<swc-tooltip for=${`rail-${item2.id}`} placement=${{ left: "end", right: "start", bottom: "top" }[side]}>${item2.title}</swc-tooltip>`;
-    return changes ? b`<span class="badged">${button}<swc-badge size="s" variant="neutral" aria-hidden="true">${changes}</swc-badge></span>${tooltip}` : driven ? b`<span class="badged">${button}<span class="dot" data-driven aria-hidden="true"></span></span>${tooltip}` : b`${button}${tooltip}`;
+    return changes2 ? b`<span class="badged">${button}<swc-badge size="s" variant="neutral" aria-hidden="true">${changes2}</swc-badge></span>${tooltip}` : driven ? b`<span class="badged">${button}<span class="dot" data-driven aria-hidden="true"></span></span>${tooltip}` : b`${button}${tooltip}`;
   }
   #changes() {
     const port = this.model ? changesOf(this.model) : null;
@@ -22778,13 +22823,13 @@ var SliccApp = class extends ThemedElement {
   }
   #more(items) {
     if (!items.length) return A;
-    const changes = items.some((item2) => item2.id === "changes") ? this.#changes() : 0;
-    const label = changes ? `More panels, ${changeCount(changes)}` : "More panels";
+    const changes2 = items.some((item2) => item2.id === "changes") ? this.#changes() : 0;
+    const label = changes2 ? `More panels, ${changeCount(changes2)}` : "More panels";
     const menu = u16`<sp-action-menu quiet size="m" label=${label} placement="top-end" @change=${(event2) => this.show(event2.target.value)}>
       <swc-icon-more slot="icon"></swc-icon-more>
       ${items.map((item2) => u16`<sp-menu-item value=${item2.id}>${railIcon(item2.icon)}${item2.title}</sp-menu-item>`)}
     </sp-action-menu>`;
-    return changes ? b`<span class="badged">${menu}<swc-badge size="s" variant="neutral" aria-hidden="true">${changes}</swc-badge></span>` : menu;
+    return changes2 ? b`<span class="badged">${menu}<swc-badge size="s" variant="neutral" aria-hidden="true">${changes2}</swc-badge></span>` : menu;
   }
   #rail(items, side) {
     const primary = side === "bottom" ? items.filter((item2) => phoneRail.includes(item2.id)) : items;
@@ -23018,6 +23063,7 @@ var SliccApp = class extends ThemedElement {
         ${rails.bottom}
       </div>
       <slicc-approvals .model=${this.model}></slicc-approvals>
+      <slicc-value-request .model=${this.model}></slicc-value-request>
     </sp-theme></div>`;
   }
 };
@@ -24773,9 +24819,9 @@ function where(change) {
   if (at === change.repo) return "";
   return at.startsWith(`${change.repo}/`) ? at.slice(change.repo.length + 1) : at;
 }
-function lost(changes) {
-  const kind = changes.every((change) => change.repo) ? "uncommitted" : "pending";
-  return `${changes.length === 1 ? "Its" : "Their"} ${kind} changes are discarded and can\u2019t be undone.`;
+function lost(changes2) {
+  const kind = changes2.every((change) => change.repo) ? "uncommitted" : "pending";
+  return `${changes2.length === 1 ? "Its" : "Their"} ${kind} changes are discarded and can\u2019t be undone.`;
 }
 var confirmRevert = (change) => confirm({ title: `Revert ${basename(change.path)}?`, body: lost([change]), action: "Revert" });
 async function revertPaths(port, paths) {
@@ -24790,9 +24836,9 @@ async function revertPaths(port, paths) {
   if (errors.length > 1) return `Couldn\u2019t revert ${errors.length} files. ${errors[0]}`;
   return errors[0] ?? "";
 }
-function groups(changes) {
+function groups(changes2) {
   const byRepo = /* @__PURE__ */ new Map();
-  for (const change of changes) {
+  for (const change of changes2) {
     const key2 = change.repo ?? "";
     byRepo.set(key2, [...byRepo.get(key2) ?? [], change]);
   }
@@ -24963,18 +25009,18 @@ var SliccChanges = class extends ModelElement {
   }
   async #all(action) {
     const port = this.#port();
-    const changes = port.changes();
+    const changes2 = port.changes();
     this.error = "";
     if (action === "accept") {
-      for (const change of changes) port.accept(change.path);
+      for (const change of changes2) port.accept(change.path);
       return;
     }
-    const count = changes.length;
+    const count = changes2.length;
     const title = `Revert ${count} ${count === 1 ? "change" : "changes"}?`;
-    if (await confirm({ title, body: lost(changes), action: "Revert all" }))
+    if (await confirm({ title, body: lost(changes2), action: "Revert all" }))
       this.error = await revertPaths(
         port,
-        changes.map((change) => change.path)
+        changes2.map((change) => change.path)
       );
   }
   #keydown(event2) {
@@ -25029,10 +25075,10 @@ var SliccChanges = class extends ModelElement {
       </span>
     </li>`;
   }
-  #list(changes) {
-    const grouped = groups(changes);
+  #list(changes2) {
+    const grouped = groups(changes2);
     if (grouped.length === 1 && !grouped[0][0])
-      return b`<ul aria-label="Pending changes" @keydown=${this.#keydown}>${changes.map((change) => this.#row(change))}</ul>`;
+      return b`<ul aria-label="Pending changes" @keydown=${this.#keydown}>${changes2.map((change) => this.#row(change))}</ul>`;
     return b`<ul aria-label="Pending changes" @keydown=${this.#keydown}>${grouped.map(
       ([repo, items]) => b`<li data-repo=${repo}>
         <div class="repo" title=${repo}>
@@ -25072,15 +25118,15 @@ var SliccChanges = class extends ModelElement {
     const port = this.model ? changesOf(this.model) : null;
     const unavailable = port?.unavailable?.() ?? null;
     if (unavailable) return this.#unavailable(unavailable);
-    const changes = port?.changes() ?? [];
+    const changes2 = port?.changes() ?? [];
     return b`<div class="bar">
-        <span class="summary">${changes.length} pending ${changes.length === 1 ? "change" : "changes"}</span>
+        <span class="summary">${changes2.length} pending ${changes2.length === 1 ? "change" : "changes"}</span>
         <span class="spacer"></span>
-        ${changes.length ? b`<swc-action-button size="s" quiet @click=${() => this.#all("accept")}>Accept all</swc-action-button>
+        ${changes2.length ? b`<swc-action-button size="s" quiet @click=${() => this.#all("accept")}>Accept all</swc-action-button>
               <swc-action-button size="s" quiet @click=${() => this.#all("revert")}>Revert all</swc-action-button>` : A}
       </div>
       ${errorLine(this.error)}
-      ${changes.length ? this.#list(changes) : b`<div class="note">No pending changes. Edits by agents show up here for review.</div>`}`;
+      ${changes2.length ? this.#list(changes2) : b`<div class="note">No pending changes. Edits by agents show up here for review.</div>`}`;
   }
 };
 var SliccDiffPanel = class extends ThemedElement {
@@ -26490,6 +26536,286 @@ var o84 = class extends a10 {
 };
 e25("swc-icon-clock", o84);
 
+// src/app/vault.ts
+var exitNames = {
+  page: "This page",
+  proxy: "Local proxy",
+  "vault-direct": "Straight from the vault",
+  "local-proxy": "Local proxy",
+  "cli-v": "Local SLICC, direct",
+  tailscale: "Tailscale",
+  "local-link": "Linked SLICC, through this page"
+};
+function devicesOf(model) {
+  return model?.network?.status().links?.devices ?? [];
+}
+function deviceName2(id, devices) {
+  return (devices.find((device) => device.id === id)?.name ?? id).replace(/^slicc\b/i, "SLICC");
+}
+function exitLabel(exit, devices) {
+  if (exit.startsWith("device:")) return deviceName2(exit.slice("device:".length), devices);
+  return exitNames[exit];
+}
+function list4(items) {
+  if (items.length < 2) return items.join("");
+  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+}
+function ruleLine(rule) {
+  const methods = rule.methods.length ? rule.methods.join(" or ") : "any method";
+  const paths = rule.paths.length ? rule.paths.join(" or ") : "any path";
+  return `${rule.domain}, in ${rule.header}, ${methods}, ${paths}`;
+}
+function shellWord(word) {
+  return /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, "'\\''")}'`;
+}
+function execLine(exec, argv = []) {
+  if (typeof exec === "object") return execLine("argv", exec.argv);
+  if (exec === "any" || exec === true) return "Revealed to any command";
+  if (exec === "shell") return "Revealed in every bash";
+  if (exec === false) return null;
+  if (!argv.length) return "Revealed only to listed commands";
+  return `Revealed only to ${list4(argv.map((words) => words.map(shellWord).join(" ")))}`;
+}
+function lower(line) {
+  return `${line[0].toLowerCase()}${line.slice(1)}`;
+}
+function mode(exec) {
+  return lower(execLine(exec) ?? "Never revealed to commands");
+}
+function changeLine(change, devices) {
+  switch (change.kind) {
+    case "rule":
+      return `${change.secret} ${change.change === "added" ? "may now" : "may no longer"} be sent to ${ruleLine(change.rule)}`;
+    case "exec":
+      return `${change.secret} was ${mode(change.from)}, now ${mode(change.to)}`;
+    case "exits":
+      if (change.to?.length === 0) return `${change.secret} now has no exit`;
+      return `${change.secret} now leaves through ${change.to ? list4(change.to.map((exit) => exitLabel(exit, devices))) : "any exit"}`;
+    default:
+      return `The limit ${change.field} changed from ${change.from} to ${change.to}`;
+  }
+}
+var codeTexts = {
+  EACCES: "Unlock the vault first",
+  ENOTSUP: "This arrives with a later vault version"
+};
+function widening(change, devices) {
+  switch (change.kind) {
+    case "rule":
+      return `${change.secret} may now be sent to ${ruleLine(change.rule)}`;
+    case "methods":
+      return `${change.secret} may now use ${list4(change.methods)} on ${change.domain}`;
+    case "paths":
+      return `${change.secret} may now reach ${list4(change.paths)} on ${change.domain}`;
+    case "exec":
+      return `${change.secret} is now ${mode(change.grant)}`;
+    case "exit":
+      return `${change.secret} may now leave through ${exitLabel(change.exit, devices)}`;
+    default:
+      return `The limit ${change.field} rose from ${change.from} to ${change.to}`;
+  }
+}
+function failureText(error) {
+  const text2 = isVaultFailure(error) ? codeTexts[error.code] : void 0;
+  return text2 ?? (error instanceof Error ? error.message : "The vault did not answer");
+}
+function fieldOf(error, field) {
+  return isVaultFailure(error) && error.code === "EINVAL" ? field : null;
+}
+function away(vault) {
+  const state3 = vault.availability?.() ?? (vault.status() ? "ready" : "waiting");
+  return state3 === "connecting" || state3 === "waiting";
+}
+function take(input) {
+  const value = input.value;
+  input.value = "";
+  return value;
+}
+function clearValues(root2) {
+  for (const input of root2.querySelectorAll("input[type=password]"))
+    input.value = "";
+}
+var fieldStyles = i`
+  .field {
+    display: grid;
+    gap: var(--swc-spacing-75);
+    min-width: 0;
+  }
+  .field > span {
+    font-size: var(--swc-font-size-75);
+    color: var(--swc-neutral-subdued-content-color-default);
+  }
+  .field input:not([type='checkbox']) {
+    box-sizing: border-box;
+    inline-size: 100%;
+    font: inherit;
+    min-height: var(--swc-component-height-100);
+    padding: 0 var(--swc-spacing-100);
+    border: var(--swc-border-width-100) solid var(--swc-gray-400);
+    border-radius: var(--swc-corner-radius-small-default);
+    background: var(--swc-background-layer-2-color);
+    color: inherit;
+  }
+  .field input[aria-invalid='true'] {
+    border-color: var(--swc-negative-border-color-default);
+  }
+  .field input[type='file'] {
+    padding: var(--swc-spacing-75) var(--swc-spacing-100);
+  }
+  .field input[type='file']::file-selector-button {
+    font: inherit;
+    font-weight: var(--swc-bold-font-weight);
+    margin-inline-end: var(--swc-spacing-200);
+    padding: var(--swc-spacing-50) var(--swc-spacing-300);
+    border: none;
+    border-radius: var(--swc-corner-radius-full);
+    background: var(--swc-gray-200);
+    color: inherit;
+  }
+  .field input:focus-visible,
+  input[type='checkbox']:focus-visible {
+    outline: var(--swc-focus-indicator-thickness) solid var(--swc-focus-indicator-color);
+    outline-offset: var(--swc-focus-ring-gap);
+  }
+`;
+function shown2(element2, style = getComputedStyle(element2)) {
+  return !element2.hidden && !element2.inert && style.display !== "none";
+}
+function disabled(element2) {
+  if (element2.matches(":disabled")) return true;
+  if (!element2.matches("button, input, select, textarea")) return false;
+  let fieldset = element2.closest("fieldset[disabled]");
+  while (fieldset) {
+    if (!fieldset.querySelector(":scope > legend")?.contains(element2)) return true;
+    fieldset = fieldset.parentElement?.closest("fieldset[disabled]") ?? null;
+  }
+  return false;
+}
+function reachable(element2) {
+  const radio = element2;
+  if (radio.localName !== "input" || radio.type !== "radio" || !radio.name) return true;
+  const root2 = radio.getRootNode();
+  const group = Array.from(root2.querySelectorAll("input[type=radio]")).filter(
+    (other) => other.name === radio.name && other.form === radio.form
+  );
+  const checked = group.find((other) => other.checked);
+  return checked ? checked === radio : radio === group[0] || radio === group.at(-1);
+}
+function tabbables(root2, stop, out = []) {
+  for (const child of Array.from(root2.children)) {
+    if (child === stop) {
+      out.push(null);
+      continue;
+    }
+    const style = getComputedStyle(child);
+    if (!shown2(child, style)) continue;
+    if (child.localName === "details" && !child.open) {
+      const summary = child.querySelector(":scope > summary");
+      if (summary && shown2(summary) && getComputedStyle(summary).visibility !== "hidden" && !(summary.hasAttribute("tabindex") && summary.tabIndex < 0))
+        out.push(summary);
+      continue;
+    }
+    if (child.tabIndex >= 0 && !disabled(child) && style.visibility !== "hidden" && reachable(child))
+      out.push(child);
+    if (child.shadowRoot) tabbables(child.shadowRoot, stop, out);
+    tabbables(child, stop, out);
+  }
+  return out;
+}
+function sequential(order) {
+  const rank = (element2) => element2 && element2.tabIndex > 0 ? element2.tabIndex : Number.POSITIVE_INFINITY;
+  return [...order].sort((a22, b13) => rank(a22) - rank(b13) || 0);
+}
+var SliccVaultButton = class extends i2 {
+  static properties = {
+    vault: { attribute: false },
+    config: { attribute: false }
+  };
+  #button = null;
+  #off = null;
+  #ready = false;
+  #sent = "";
+  static styles = i`
+    :host {
+      display: inline-flex;
+      vertical-align: middle;
+    }
+    iframe {
+      border: 0;
+      background: transparent;
+      color-scheme: normal;
+    }
+  `;
+  constructor() {
+    super();
+    this.vault = null;
+    this.config = null;
+  }
+  connectedCallback() {
+    super.connectedCallback();
+    this.requestUpdate();
+  }
+  disconnectedCallback() {
+    super.disconnectedCallback();
+    this.#drop();
+  }
+  focus() {
+    this.#button?.post({ type: "slicc-vault", v: 1, op: "focus" });
+  }
+  updated(changed) {
+    if (changed.has("vault")) this.#drop();
+    if (!this.#button && this.vault) this.#mount(this.vault);
+    this.#send();
+  }
+  #mount(vault) {
+    const button = vault.button();
+    this.#button = button;
+    this.#off = button.listen((event2) => this.#event(event2));
+    this.renderRoot.append(button.element);
+  }
+  #drop() {
+    this.#off?.();
+    this.#button?.element.remove();
+    this.#button = null;
+    this.#off = null;
+    this.#ready = false;
+    this.#sent = "";
+  }
+  #send() {
+    if (!(this.#ready && this.#button && this.config)) return;
+    const sent = JSON.stringify(this.config);
+    if (sent === this.#sent) return;
+    this.#sent = sent;
+    this.#button.post({ type: "slicc-vault", v: 1, op: "button", button: this.config });
+  }
+  #event(event2) {
+    const element2 = this.#button?.element;
+    if (event2.event === "ready") {
+      this.#ready = true;
+      this.#send();
+    } else if (event2.event === "size") {
+      element2.style.width = `${event2.width}px`;
+      element2.style.height = `${event2.height}px`;
+      element2.style.margin = `${-event2.inset}px`;
+    } else if (event2.event === "label") {
+      element2.title = event2.label;
+    } else if (event2.event === "focus") {
+      const order = sequential(tabbables(this.ownerDocument, this));
+      const at = order.indexOf(null);
+      order[event2.direction === "next" ? at + 1 : at - 1]?.focus();
+    } else if (event2.event === "popup") {
+      const { intent, state: state3 } = event2;
+      this.dispatchEvent(
+        new CustomEvent("vault-popup", {
+          detail: { intent, state: state3 },
+          bubbles: true,
+          composed: true
+        })
+      );
+    }
+  }
+};
+
 // src/app/composer.ts
 var limit = 25 * 1024 * 1024;
 function available(model) {
@@ -26579,6 +26905,10 @@ function trigger(text2, caret) {
     return { kind: "mention", start: before.length - mention[2].length - 1, query: mention[2] };
   return null;
 }
+function blocked(vault) {
+  if (away(vault)) return "Waiting for the vault";
+  return vault.status()?.locked ? "Unlock the vault first" : null;
+}
 var SliccComposer = class extends ThemedElement {
   static properties = {
     ...ThemedElement.properties,
@@ -26587,6 +26917,9 @@ var SliccComposer = class extends ThemedElement {
     popup: { state: true },
     dictating: { state: true },
     blocked: { state: true },
+    sharing: { state: true },
+    secretError: { state: true },
+    secretField: { state: true },
     agent: {}
   };
   #drafts = /* @__PURE__ */ new Map();
@@ -26603,6 +26936,9 @@ var SliccComposer = class extends ThemedElement {
     this.popup = null;
     this.dictating = false;
     this.blocked = false;
+    this.sharing = false;
+    this.secretError = null;
+    this.secretField = null;
     this.agent = "";
   }
   static styles = [
@@ -26809,6 +27145,14 @@ var SliccComposer = class extends ThemedElement {
         gap: var(--swc-spacing-100);
         padding: var(--swc-spacing-100);
       }
+      .secret .field {
+        display: grid;
+        gap: var(--swc-spacing-75);
+      }
+      .secret .field > span {
+        font-size: var(--swc-font-size-75);
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
       .secret input {
         font: inherit;
         min-height: var(--swc-component-height-100);
@@ -26818,6 +27162,9 @@ var SliccComposer = class extends ThemedElement {
         background: var(--swc-background-layer-2-color);
         color: inherit;
       }
+      .secret input[aria-invalid='true'] {
+        border-color: var(--swc-negative-border-color-default);
+      }
       .secret input:focus-visible {
         outline: var(--swc-focus-indicator-thickness) solid var(--swc-focus-indicator-color);
         outline-offset: var(--swc-focus-ring-gap);
@@ -26825,6 +27172,14 @@ var SliccComposer = class extends ThemedElement {
       .secret swc-button {
         justify-self: start;
       }
+      .secret-error {
+        display: flex;
+        align-items: flex-start;
+        gap: var(--swc-spacing-75);
+        color: var(--swc-negative-content-color-default);
+        font-size: var(--swc-font-size-75);
+        --swc-icon-color: var(--swc-negative-content-color-default);
+      }
       sp-menu {
         min-width: 240px;
       }
@@ -26835,6 +27190,7 @@ var SliccComposer = class extends ThemedElement {
   ];
   willUpdate(changed) {
     super.willUpdate(changed);
+    if (changed.has("popup") && this.popup?.kind !== "secret") clearValues(this.renderRoot);
     if (changed.has("agent") && this.agent && this.model && this.agent !== this.#agent) {
       this.#switch(this.agent);
     }
@@ -26846,6 +27202,10 @@ var SliccComposer = class extends ThemedElement {
   firstUpdated() {
     this.#wire();
   }
+  disconnectedCallback() {
+    super.disconnectedCallback();
+    clearValues(this.renderRoot);
+  }
   updated(changed) {
     if (changed.has("popup"))
       this.renderRoot.querySelector('.item[aria-selected="true"]')?.scrollIntoView({ block: "nearest" });
@@ -26879,7 +27239,8 @@ var SliccComposer = class extends ThemedElement {
       model.agent.on("messages", update),
       model.agent.on("message", update),
       model.settings.on("settings", update),
-      ...model.follow ? [model.follow.on("follow", update)] : []
+      ...model.follow ? [model.follow.on("follow", update)] : [],
+      ...model.vault ? [model.vault.on("availability", update), model.vault.on("status", update)] : []
     ];
   }
   #held() {
@@ -26914,7 +27275,7 @@ var SliccComposer = class extends ThemedElement {
   #busy() {
     return this.model?.agent.busy(this.#agent) ?? false;
   }
-  send(mode = "send") {
+  send(mode2 = "send") {
     const model = this.model;
     const text2 = this.value.trim();
     const attachments = this.attachments.filter((attachment2) => !attachment2.error);
@@ -26930,7 +27291,7 @@ var SliccComposer = class extends ThemedElement {
       return;
     }
     const busy = this.#busy();
-    const resolved = mode === "queue" ? busy ? "queue" : "send" : busy || mode === "steer" ? "steer" : "send";
+    const resolved = mode2 === "queue" ? busy ? "queue" : "send" : busy || mode2 === "steer" ? "steer" : "send";
     void model.agent.send(this.#agent, { text: text2, attachments, mode: resolved });
   }
   #id() {
@@ -26995,9 +27356,17 @@ var SliccComposer = class extends ThemedElement {
       text2 === null || text2 === void 0 ? { ...base, kind: "file", size: 0, error: "Could not read the file" } : { ...base, kind: "text", size: text2.length, text: text2 }
     ];
   }
-  shareSecret(name) {
+  async shareSecret(name, field = null) {
     const clean = name.trim().toUpperCase().replace(/[^A-Z0-9_]/g, "_");
-    if (!clean) return;
+    if (this.sharing) return;
+    if (!clean) {
+      if (field) this.#refuse("Enter a name", "name", true);
+      return;
+    }
+    const value = field ? take(field) : "";
+    const vault = this.model?.vault;
+    if (field && vault?.put && !await this.#store(vault, clean, value)) return;
+    this.#refuse(null);
     this.attachments = [
       ...this.attachments,
       {
@@ -27010,6 +27379,51 @@ var SliccComposer = class extends ThemedElement {
     ];
     this.popup = null;
   }
+  #refuse(text2, field = null, focus = false) {
+    this.secretError = text2;
+    this.secretField = text2 ? field : null;
+    if (focus && text2 && field)
+      void this.updateComplete.then(
+        () => this.renderRoot.querySelector(`form.secret input[name=${field}]`)?.focus()
+      );
+  }
+  async #store(vault, clean, value) {
+    if (blocked(vault)) {
+      this.#refuse(blocked(vault));
+      return false;
+    }
+    const exists = !!vault.list()?.secrets.some((secret) => secret.name === clean && secret.state !== "removed");
+    if (exists && value === "") return true;
+    const bad = nameProblem(clean);
+    const problem = bad ?? valueProblem(value);
+    this.#refuse(problem, bad ? "name" : "value", true);
+    if (problem) return false;
+    const agent = this.#agent;
+    const mine = () => this.#agent === agent && this.model?.vault === vault;
+    this.sharing = true;
+    try {
+      if (exists) {
+        const sure = await confirm({
+          title: `Replace ${clean}?`,
+          body: "A secret with this name exists. Sharing replaces its value, and its placeholder stays.",
+          action: "Replace",
+          variant: "confirmation"
+        });
+        if (!sure || !mine()) return false;
+        if (blocked(vault)) {
+          this.#refuse(blocked(vault));
+          return false;
+        }
+      }
+      await vault.put?.(clean, value);
+      return mine();
+    } catch (error) {
+      if (mine()) this.#refuse(failureText(error), fieldOf(error, "value"));
+      return false;
+    } finally {
+      this.sharing = false;
+    }
+  }
   #choices(kind, query) {
     const model = this.model;
     if (kind === "command") {
@@ -27053,6 +27467,9 @@ var SliccComposer = class extends ThemedElement {
     this.popup = found && (found.kind !== "argument" || takes) ? { ...found, items: this.#choices(found.kind, found.query), index: 0 } : null;
   }
   openPopup(kind) {
+    clearValues(this.renderRoot);
+    this.secretError = null;
+    this.secretField = null;
     this.popup = {
       kind,
       start: 0,
@@ -27214,17 +27631,32 @@ var SliccComposer = class extends ThemedElement {
     const popup2 = this.popup;
     if (!popup2) return A;
     if (popup2.kind === "secret") {
+      const vault = this.model?.vault;
+      const valued = !!vault?.put && !blocked(vault);
+      const waiting2 = vault?.put ? blocked(vault) : null;
+      if (!valued) clearValues(this.renderRoot);
       const submit = (event2) => {
         event2.preventDefault();
         const form = event2.currentTarget;
-        this.shareSecret(form.elements.namedItem("name").value);
+        void this.shareSecret(
+          form.elements.namedItem("name").value,
+          form.elements.namedItem("value")
+        );
+      };
+      const close = (event2) => {
+        if (event2.key !== "Escape") return;
+        clearValues(this.renderRoot);
+        this.popup = null;
       };
-      return b`<form class="popup secret" @submit=${submit} @keydown=${(event2) => event2.key === "Escape" && (this.popup = null)}>
+      const bad = (name) => this.secretField === name ? "true" : A;
+      const described = (name) => this.secretField === name ? "secret-error" : A;
+      return b`<form class="popup secret" data-vault=${valued ? "on" : "off"} @submit=${submit} @keydown=${close} @input=${() => this.secretField = null}>
         <strong>Share a secret</strong>
-        <span class="lead">The value goes to the secret store; the agent only sees its name.</span>
-        <input name="name" placeholder="Name, e.g. API_TOKEN" aria-label="Secret name" />
-        <input name="value" type="password" placeholder="Value" aria-label="Secret value" autocomplete="off" />
-        <swc-button size="s" variant="accent" @click=${(event2) => event2.currentTarget.closest("form")?.requestSubmit()}>Share</swc-button>
+        <span class="lead">${valued ? "The value goes to the vault; the agent only sees its name. Leave the value empty to share a secret the vault already has." : waiting2 === "Unlock the vault first" ? "The vault is locked. You can share the name now and add the value once it is unlocked." : waiting2 ? "Waiting for the vault. You can share the name now and add the value in Settings \u203A Secrets later." : "Add the value in Settings \u203A Secrets. The agent only sees the name."}</span>
+        <label class="field"><span>Name</span><input name="name" placeholder="API_TOKEN" autocomplete="off" spellcheck="false" aria-invalid=${bad("name")} aria-describedby=${described("name")} /></label>
+        ${valued ? b`<label class="field"><span>Value</span><input name="value" type="password" autocomplete="off" spellcheck="false" aria-invalid=${bad("value")} aria-describedby=${described("value")} /></label>` : A}
+        ${this.secretError ? b`<span class="secret-error" role="alert" id="secret-error" data-error><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>${this.secretError}</span></span>` : A}
+        <swc-button size="s" variant="accent" data-action="share-secret" ?pending=${this.sharing} @click=${(event2) => event2.currentTarget.closest("form")?.requestSubmit()}>Share</swc-button>
       </form>`;
     }
     const title = {
@@ -27746,11 +28178,13 @@ function attention(section) {
 var SliccMonitor = class extends ModelElement {
   static properties = {
     ...ModelElement.properties,
-    expanded: { state: true }
+    expanded: { state: true },
+    copied: { state: true }
   };
   constructor() {
     super();
     this.expanded = {};
+    this.copied = null;
   }
   static styles = [
     shared,
@@ -27850,6 +28284,36 @@ var SliccMonitor = class extends ModelElement {
         display: block;
         color: var(--swc-neutral-subdued-content-color-default);
       }
+      .alert > div {
+        min-width: 0;
+      }
+      .alert .command {
+        display: flex;
+        align-items: center;
+        gap: var(--swc-spacing-100);
+        margin-block-start: var(--swc-spacing-75);
+        padding-inline-start: var(--swc-spacing-100);
+        border-radius: var(--swc-corner-radius-medium-default);
+        background: var(--swc-background-layer-1-color);
+      }
+      .alert code {
+        flex: 1;
+        min-width: 0;
+        overflow-x: auto;
+        white-space: nowrap;
+        font-family: var(--swc-code-font-family-stack);
+        font-size: var(--swc-font-size-75);
+        color: var(--swc-code-color);
+      }
+      .alert .lead {
+        display: block;
+        margin-block-start: var(--swc-spacing-75);
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
+      .alert .uncopied {
+        display: block;
+        color: var(--swc-negative-content-color-default);
+      }
       .sections {
         display: grid;
         margin: 0;
@@ -27974,9 +28438,16 @@ var SliccMonitor = class extends ModelElement {
     const error = alert.severity === "error";
     return b`<li class="alert" data-severity=${alert.severity}>
       ${error ? b`<swc-icon-alert-diamond size="s" aria-hidden="true"></swc-icon-alert-diamond>` : b`<swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle>`}
-      <div><span class="sr">${error ? "Error: " : "Warning: "}</span><strong>${alert.title}</strong><span class="detail">${alert.detail}</span></div>
+      <div><span class="sr">${error ? "Error: " : "Warning: "}</span><strong>${alert.title}</strong><span class="detail">${alert.detail}</span>${alert.command ? this.#command(alert.id, alert.command, alert.commandLabel ?? "Run") : A}</div>
     </li>`;
   }
+  #command(id, text2, label) {
+    const copied = this.copied?.id === id && this.copied.text === text2 ? this.copied : null;
+    return b`<span class="lead">${label}:</span><div class="command" data-command><code>${text2}</code><swc-action-button size="s" quiet data-action="copy-command" accessible-label=${copied?.done ? "Copied" : "Copy command"} @click=${() => this.#copy(id, text2)}><swc-icon-copy slot="icon"></swc-icon-copy>${copied?.done ? "Copied" : "Copy"}</swc-action-button></div>${copied && !copied.done ? b`<span class="uncopied" role="alert" data-error="copy">Couldn’t copy. Select the command and copy it.</span>` : A}`;
+  }
+  async #copy(id, text2) {
+    this.copied = { id, text: text2, done: await copyText(text2) };
+  }
   #open(id) {
     this.dispatchEvent(
       new CustomEvent("show-surface", { detail: { id }, bubbles: true, composed: true })
@@ -28214,197 +28685,6 @@ var SliccNotices = class extends ModelElement {
   }
 };
 
-// src/app/vault.ts
-var exitNames = {
-  "vault-direct": "Straight from the vault",
-  "local-proxy": "Local proxy",
-  "cli-v": "Local SLICC, direct",
-  tailscale: "Tailscale",
-  "local-link": "Linked SLICC, through this page"
-};
-function devicesOf(model) {
-  return model?.network?.status().links?.devices ?? [];
-}
-function deviceName2(id, devices) {
-  return (devices.find((device) => device.id === id)?.name ?? id).replace(/^slicc\b/i, "SLICC");
-}
-function exitLabel(exit, devices) {
-  if (exit.startsWith("device:")) return deviceName2(exit.slice("device:".length), devices);
-  return exitNames[exit];
-}
-function list4(items) {
-  if (items.length < 2) return items.join("");
-  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
-}
-function ruleLine(rule) {
-  const methods = rule.methods.length ? rule.methods.join(" or ") : "any method";
-  const paths = rule.paths.length ? rule.paths.join(" or ") : "any path";
-  return `${rule.domain}, in ${rule.header}, ${methods}, ${paths}`;
-}
-function shellWord(word) {
-  return /^[\w@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, "'\\''")}'`;
-}
-function execLine(grant) {
-  if (grant === false) return "Never revealed to programs";
-  if (grant === true) return "Revealed to any program that asks";
-  return `Revealed only to ${list4(grant.argv.map((argv) => argv.map(shellWord).join(" ")))}`;
-}
-function widening(change, devices) {
-  switch (change.kind) {
-    case "rule":
-      return `${change.secret} may now be sent to ${ruleLine(change.rule)}`;
-    case "methods":
-      return `${change.secret} may now use ${list4(change.methods)} on ${change.domain}`;
-    case "paths":
-      return `${change.secret} may now reach ${list4(change.paths)} on ${change.domain}`;
-    case "exec": {
-      const line = execLine(change.grant);
-      return `${change.secret}: ${line[0].toLowerCase()}${line.slice(1)}`;
-    }
-    case "exit":
-      return `${change.secret} may now leave through ${exitLabel(change.exit, devices)}`;
-    default:
-      return `The limit ${change.field} rose from ${change.from} to ${change.to}`;
-  }
-}
-function shown2(element2, style = getComputedStyle(element2)) {
-  return !element2.hidden && !element2.inert && style.display !== "none";
-}
-function disabled(element2) {
-  if (element2.matches(":disabled")) return true;
-  if (!element2.matches("button, input, select, textarea")) return false;
-  let fieldset = element2.closest("fieldset[disabled]");
-  while (fieldset) {
-    if (!fieldset.querySelector(":scope > legend")?.contains(element2)) return true;
-    fieldset = fieldset.parentElement?.closest("fieldset[disabled]") ?? null;
-  }
-  return false;
-}
-function reachable(element2) {
-  const radio = element2;
-  if (radio.localName !== "input" || radio.type !== "radio" || !radio.name) return true;
-  const root2 = radio.getRootNode();
-  const group = Array.from(root2.querySelectorAll("input[type=radio]")).filter(
-    (other) => other.name === radio.name && other.form === radio.form
-  );
-  const checked = group.find((other) => other.checked);
-  return checked ? checked === radio : radio === group[0] || radio === group.at(-1);
-}
-function tabbables(root2, stop, out = []) {
-  for (const child of Array.from(root2.children)) {
-    if (child === stop) {
-      out.push(null);
-      continue;
-    }
-    const style = getComputedStyle(child);
-    if (!shown2(child, style)) continue;
-    if (child.localName === "details" && !child.open) {
-      const summary = child.querySelector(":scope > summary");
-      if (summary && shown2(summary) && getComputedStyle(summary).visibility !== "hidden" && !(summary.hasAttribute("tabindex") && summary.tabIndex < 0))
-        out.push(summary);
-      continue;
-    }
-    if (child.tabIndex >= 0 && !disabled(child) && style.visibility !== "hidden" && reachable(child))
-      out.push(child);
-    if (child.shadowRoot) tabbables(child.shadowRoot, stop, out);
-    tabbables(child, stop, out);
-  }
-  return out;
-}
-function sequential(order) {
-  const rank = (element2) => element2 && element2.tabIndex > 0 ? element2.tabIndex : Number.POSITIVE_INFINITY;
-  return [...order].sort((a22, b13) => rank(a22) - rank(b13) || 0);
-}
-var SliccVaultButton = class extends i2 {
-  static properties = {
-    vault: { attribute: false },
-    config: { attribute: false }
-  };
-  #button = null;
-  #off = null;
-  #ready = false;
-  #sent = "";
-  static styles = i`
-    :host {
-      display: inline-flex;
-      vertical-align: middle;
-    }
-    iframe {
-      border: 0;
-      background: transparent;
-      color-scheme: normal;
-    }
-  `;
-  constructor() {
-    super();
-    this.vault = null;
-    this.config = null;
-  }
-  connectedCallback() {
-    super.connectedCallback();
-    this.requestUpdate();
-  }
-  disconnectedCallback() {
-    super.disconnectedCallback();
-    this.#drop();
-  }
-  focus() {
-    this.#button?.post({ type: "slicc-vault", v: 1, op: "focus" });
-  }
-  updated(changed) {
-    if (changed.has("vault")) this.#drop();
-    if (!this.#button && this.vault) this.#mount(this.vault);
-    this.#send();
-  }
-  #mount(vault) {
-    const button = vault.button();
-    this.#button = button;
-    this.#off = button.listen((event2) => this.#event(event2));
-    this.renderRoot.append(button.element);
-  }
-  #drop() {
-    this.#off?.();
-    this.#button?.element.remove();
-    this.#button = null;
-    this.#off = null;
-    this.#ready = false;
-    this.#sent = "";
-  }
-  #send() {
-    if (!(this.#ready && this.#button && this.config)) return;
-    const sent = JSON.stringify(this.config);
-    if (sent === this.#sent) return;
-    this.#sent = sent;
-    this.#button.post({ type: "slicc-vault", v: 1, op: "button", button: this.config });
-  }
-  #event(event2) {
-    const element2 = this.#button?.element;
-    if (event2.event === "ready") {
-      this.#ready = true;
-      this.#send();
-    } else if (event2.event === "size") {
-      element2.style.width = `${event2.width}px`;
-      element2.style.height = `${event2.height}px`;
-      element2.style.margin = `${-event2.inset}px`;
-    } else if (event2.event === "label") {
-      element2.title = event2.label;
-    } else if (event2.event === "focus") {
-      const order = sequential(tabbables(this.ownerDocument, this));
-      const at = order.indexOf(null);
-      order[event2.direction === "next" ? at + 1 : at - 1]?.focus();
-    } else if (event2.event === "popup") {
-      const { intent, state: state3, result } = event2;
-      this.dispatchEvent(
-        new CustomEvent("vault-popup", {
-          detail: { intent, state: state3, ...result ? { result } : {} },
-          bubbles: true,
-          composed: true
-        })
-      );
-    }
-  }
-};
-
 // src/app/secrets.ts
 var kinds = { secret: null, grant: "Sign-in", model: "Model key", mcp: "MCP server" };
 var lockModes = {
@@ -28423,12 +28703,27 @@ function until(at, now = Date.now()) {
 }
 function who(entry) {
   if (entry.tag) return entry.tag;
-  if (entry.uid === null) return "the vault";
+  if (entry.uid === null) return "you";
   return entry.uid === 0 ? "root" : `uid ${entry.uid}`;
 }
+function asker(request2) {
+  if (request2.tag) return request2.tag;
+  return request2.uid === 0 ? "A program running as root" : `A program running as uid ${request2.uid}`;
+}
+function asking2(request2) {
+  const by = asker(request2);
+  if (request2.kind === "oauth") return b`${by} asks you to sign in to ${request2.provider}`;
+  if (request2.kind === "jerk-seal")
+    return b`${by} asks for a jerk lease for ${request2.provider}`;
+  return request2.name ? b`${by} asks for <code>${request2.name}</code>` : b`${by} asks for a value`;
+}
+function byName(a22, b13) {
+  return a22.name < b13.name ? -1 : a22.name > b13.name ? 1 : 0;
+}
 function sourceLine(secret, devices) {
   const on = secret.sourceDevice ? ` on ${deviceName2(secret.sourceDevice, devices)}` : "";
   const [kind, detail = ""] = secret.source.split(/:(.*)/s);
+  if (kind === "settings") return `Entered in SLICC${on}`;
   if (kind === "popup") return `Entered in the vault${on}`;
   if (kind === "process") return `Saved by a program${on}`;
   if (kind === "import") return `Imported from ${detail}`;
@@ -28455,11 +28750,16 @@ function revealed(name, entries, now = Date.now(), more = false) {
   const when = today ? `${partial ? "at least " : ""}${today} ${today === 1 ? "time" : "times"} today` : since(last.at, now);
   return b`Revealed to programs ${when}, last by ${who(last)} with <code>${last.argv}</code>`;
 }
+function changes(entry, devices) {
+  if (entry.changes)
+    return entry.changes.map((change) => [change.kind, changeLine(change, devices)]);
+  return (entry.widened ?? []).map((change) => [change.kind, widening(change, devices)]);
+}
 function auditLine(entry, devices) {
   switch (entry.type) {
     case "inject":
     case "forward":
-      return b`${entry.type === "inject" ? "Sent to" : "Forwarded to"} ${entry.domain}: <code>${entry.method} ${entry.path}</code>, through ${exitLabel(entry.exit, devices)}`;
+      return b`Sent to ${entry.domain}: <code>${entry.method} ${entry.path}</code>, through ${exitLabel(entry.exit, devices)}`;
     case "materialize":
       return b`Revealed to <code>${entry.argv}</code> in <code>${entry.cwd}</code>`;
     case "seal":
@@ -28468,11 +28768,10 @@ function auditLine(entry, devices) {
       return b`Removed`;
     case "restore":
       return b`Restored`;
-    default: {
-      const count = entry.widened.length;
-      const widened = count ? `, widening ${count} ${count === 1 ? "rule" : "rules"}` : "";
-      return b`<code>${entry.file}</code> ${entry.accepted ? `changed${widened}` : "changed and was refused"}${entry.warning ? b`. ${entry.warning}` : A}`;
-    }
+    case "refresh":
+      return entry.grant ? b`Refreshed automatically with the sign-in <code>${entry.grant}</code>` : b`Refreshed automatically`;
+    default:
+      return b`<code>${entry.file}</code> ${entry.accepted ? "changed" : "changed and was refused"}${changes(entry, devices).map(([kind, line]) => b`<span class="change" data-change=${kind}>${line}</span>`)}${entry.warning ? b`<span class="warning" data-warning>${entry.warning}</span>` : A}${entry.accepted ? b`<span class="hint" data-hint>If you didn’t mean this, change the file back with sudo.</span>` : A}`;
   }
 }
 function merged(...pages) {
@@ -28480,6 +28779,37 @@ function merged(...pages) {
   for (const page of pages) for (const entry of page) bySeq.set(entry.seq, entry);
   return [...bySeq.values()].sort((a22, b13) => b13.seq - a22.seq);
 }
+function replaceable(secret) {
+  return secret.state !== "removed" && secret.kind !== "grant" && (secret.source === "settings" || secret.source === "process" || secret.source.startsWith("import:"));
+}
+function filename(now = Date.now()) {
+  const date = new Date(now);
+  const day2 = [date.getFullYear(), date.getMonth() + 1, date.getDate()].map((part2) => String(part2).padStart(2, "0")).join("-");
+  return `slicc-secrets-${day2}.slicc-vault`;
+}
+function download(bytes, name, root2) {
+  const url = URL.createObjectURL(
+    new Blob([bytes], { type: "application/octet-stream" })
+  );
+  const link = document.createElement("a");
+  link.href = url;
+  link.download = name;
+  link.hidden = true;
+  root2.append(link);
+  link.click();
+  link.remove();
+  URL.revokeObjectURL(url);
+}
+var importKinds = {
+  bundle: "Bundle",
+  keepass: "KeePass (.kdbx)",
+  six: "six"
+};
+function exported(at) {
+  if (at === void 0) return A;
+  const when = at === null ? "Never exported" : `Last exported ${new Intl.DateTimeFormat(void 0, { dateStyle: "medium" }).format(at)}`;
+  return b`<span class="muted" data-exported>${when}</span>`;
+}
 function prompt2(text2) {
   return text2.length > 200 ? `${text2.slice(0, 199)}\u2026` : text2;
 }
@@ -28491,10 +28821,20 @@ var SliccSecrets = class extends ThemedElement {
     loading: { state: true },
     reveals: { state: true },
     popup: { state: true },
-    acking: { state: true },
-    failure: { state: true }
+    failure: { state: true },
+    form: { state: true },
+    busy: { state: true },
+    problem: { state: true },
+    invalid: { state: true },
+    said: { state: true },
+    acting: { state: true },
+    importKind: { state: true },
+    candidates: { state: true },
+    picked: { state: true },
+    again: { state: true }
   };
   #tick;
+  #offline = false;
   constructor() {
     super();
     this.older = [];
@@ -28502,252 +28842,353 @@ var SliccSecrets = class extends ThemedElement {
     this.loading = false;
     this.reveals = false;
     this.popup = null;
-    this.acking = /* @__PURE__ */ new Set();
     this.failure = null;
+    this.form = null;
+    this.busy = false;
+    this.problem = null;
+    this.invalid = null;
+    this.said = null;
+    this.acting = /* @__PURE__ */ new Set();
+    this.importKind = "bundle";
+    this.candidates = null;
+    this.picked = /* @__PURE__ */ new Set();
+    this.again = false;
   }
-  static styles = i`
-    :host {
-      display: block;
-      container-type: inline-size;
-    }
-    h2 {
-      font-size: var(--swc-heading-size-xs);
-      font-weight: var(--swc-bold-font-weight);
-      line-height: var(--swc-heading-line-height);
-      color: var(--swc-heading-color);
-      margin: 0;
-    }
-    h3 {
-      font-size: var(--swc-font-size-100);
-      font-weight: var(--swc-bold-font-weight);
-      color: var(--swc-heading-color);
-      margin: var(--swc-spacing-400) 0 var(--swc-spacing-100);
-    }
-    p {
-      margin: var(--swc-spacing-100) 0;
-    }
-    ul,
-    ol {
-      list-style: none;
-      margin: 0;
-      padding: 0;
-    }
-    code {
-      font-family: var(--swc-code-font-family, ui-monospace, monospace);
-      font-size: 0.9em;
-      overflow-wrap: anywhere;
-    }
-    .head {
-      display: flex;
-      flex-wrap: wrap;
-      align-items: baseline;
-      gap: var(--swc-spacing-200) var(--swc-spacing-300);
-      margin: var(--swc-spacing-500) 0 var(--swc-spacing-200);
-    }
-    .head slicc-vault-button {
-      align-self: center;
-      margin-inline-start: auto;
-    }
-    .muted {
-      color: var(--swc-neutral-subdued-content-color-default);
-    }
-    .box {
-      display: grid;
-      gap: var(--swc-spacing-100);
-      padding: var(--swc-spacing-200) var(--swc-spacing-300);
-      margin: var(--swc-spacing-200) 0;
-      border-radius: var(--swc-corner-radius-100);
-      border: var(--swc-border-width-100) solid var(--swc-gray-200);
-      background: var(--swc-background-layer-1-color);
-    }
-    .box.notice {
-      border-color: var(--swc-notice-visual-color);
-      --swc-icon-color: var(--swc-notice-visual-color);
-    }
-    .box .title {
-      display: flex;
-      align-items: flex-start;
-      gap: var(--swc-spacing-100);
-      font-weight: var(--swc-bold-font-weight);
-    }
-    .box ul {
-      list-style: disc;
-      padding-inline-start: var(--swc-spacing-400);
-    }
-    .box .actions {
-      display: flex;
-      flex-wrap: wrap;
-      align-items: center;
-      gap: var(--swc-spacing-200);
-    }
-    .prompt {
-      margin: 0;
-      padding-inline-start: var(--swc-spacing-200);
-      border-inline-start: var(--swc-border-width-200) solid var(--swc-gray-300);
-      overflow-wrap: anywhere;
-    }
-    .said {
-      white-space: pre-wrap;
-    }
-    .from {
-      display: block;
-      font-size: var(--swc-font-size-75);
-      color: var(--swc-neutral-subdued-content-color-default);
-    }
-    .secrets {
-      display: grid;
-      gap: var(--swc-spacing-200);
-    }
-    .secret {
-      display: grid;
-      grid-template-columns: minmax(0, 1fr) max-content;
-      gap: var(--swc-spacing-100) var(--swc-spacing-300);
-      padding: var(--swc-spacing-200) 0;
-      border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
-    }
-    .secret:first-child {
-      border-top: 0;
-    }
-    .name {
-      display: flex;
-      flex-wrap: wrap;
-      align-items: baseline;
-      gap: var(--swc-spacing-100) var(--swc-spacing-200);
-      min-width: 0;
-    }
-    .name code {
-      font-size: var(--swc-font-size-100);
-      font-weight: var(--swc-bold-font-weight);
-    }
-    .secret slicc-vault-button {
-      align-self: start;
-    }
-    .removed {
-      margin-top: var(--swc-spacing-200);
-      border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
-      padding-top: var(--swc-spacing-200);
-    }
-    .removed summary {
-      cursor: pointer;
-      font-size: var(--swc-font-size-75);
-      color: var(--swc-neutral-subdued-content-color-default);
-    }
-    .removed .secret dl,
-    .removed .secret .name code {
-      color: var(--swc-neutral-subdued-content-color-default);
-    }
-    dl {
-      grid-column: 1 / -1;
-      display: grid;
-      grid-template-columns: max-content minmax(0, 1fr);
-      gap: var(--swc-spacing-50) var(--swc-spacing-300);
-      margin: 0;
-      font-size: var(--swc-font-size-75);
-      line-height: var(--swc-line-height-200);
-    }
-    dt {
-      color: var(--swc-neutral-subdued-content-color-default);
-    }
-    dd {
-      margin: 0;
-      min-width: 0;
-      overflow-wrap: anywhere;
-    }
-    .audit-head {
-      display: flex;
-      flex-wrap: wrap;
-      align-items: baseline;
-      justify-content: space-between;
-      gap: var(--swc-spacing-200);
-      margin: var(--swc-spacing-400) 0 var(--swc-spacing-100);
-    }
-    .audit-head h3 {
-      margin-block: 0;
-    }
-    .audit li {
-      display: grid;
-      grid-template-columns: 7em minmax(0, 1fr);
-      gap: var(--swc-spacing-50) var(--swc-spacing-300);
-      padding: var(--swc-spacing-100) 0;
-      border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
-      font-size: var(--swc-font-size-75);
-      line-height: var(--swc-line-height-200);
-    }
-    .audit time {
-      color: var(--swc-neutral-subdued-content-color-default);
-    }
-    .audit .what {
-      overflow-wrap: anywhere;
-    }
-    .audit .by {
-      color: var(--swc-neutral-subdued-content-color-default);
-    }
-    .row {
-      display: flex;
-      flex-wrap: wrap;
-      align-items: center;
-      gap: var(--swc-spacing-200);
-      margin-top: var(--swc-spacing-200);
-    }
-    .error {
-      display: flex;
-      align-items: flex-start;
-      gap: var(--swc-spacing-100);
-      color: var(--swc-negative-content-color-default);
-      font-size: var(--swc-font-size-75);
-      --swc-icon-color: var(--swc-negative-content-color-default);
-    }
-    @container (max-width: 480px) {
+  static styles = [
+    fieldStyles,
+    i`
+      :host {
+        display: block;
+        container-type: inline-size;
+      }
+      h2 {
+        font-size: var(--swc-heading-size-xs);
+        font-weight: var(--swc-bold-font-weight);
+        line-height: var(--swc-heading-line-height);
+        color: var(--swc-heading-color);
+        margin: 0;
+      }
+      h3 {
+        font-size: var(--swc-font-size-100);
+        font-weight: var(--swc-bold-font-weight);
+        color: var(--swc-heading-color);
+        margin: var(--swc-spacing-400) 0 var(--swc-spacing-100);
+      }
+      p {
+        margin: var(--swc-spacing-100) 0;
+      }
+      ul,
+      ol {
+        list-style: none;
+        margin: 0;
+        padding: 0;
+      }
+      code {
+        font-family: var(--swc-code-font-family, ui-monospace, monospace);
+        font-size: 0.9em;
+        overflow-wrap: anywhere;
+      }
+      .head {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: baseline;
+        gap: var(--swc-spacing-200) var(--swc-spacing-300);
+        margin: var(--swc-spacing-500) 0 var(--swc-spacing-200);
+      }
+      .head .controls {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: var(--swc-spacing-200);
+        align-self: center;
+        margin-inline-start: auto;
+      }
+      .muted {
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
+      .box {
+        display: grid;
+        gap: var(--swc-spacing-100);
+        padding: var(--swc-spacing-200) var(--swc-spacing-300);
+        margin: var(--swc-spacing-200) 0;
+        border-radius: var(--swc-corner-radius-100);
+        border: var(--swc-border-width-100) solid var(--swc-gray-200);
+        background: var(--swc-background-layer-1-color);
+      }
+      .box.info {
+        border-color: var(--swc-informative-visual-color);
+        --swc-icon-color: var(--swc-informative-visual-color);
+      }
+      .availability {
+        display: flex;
+        align-items: center;
+        gap: var(--swc-spacing-100);
+      }
+      .box .title {
+        display: flex;
+        align-items: flex-start;
+        gap: var(--swc-spacing-100);
+        font-weight: var(--swc-bold-font-weight);
+      }
+      .box .actions,
+      .buttons {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: var(--swc-spacing-200);
+      }
+      .prompt {
+        margin: 0;
+        padding-inline-start: var(--swc-spacing-200);
+        border-inline-start: var(--swc-border-width-200) solid var(--swc-gray-300);
+        overflow-wrap: anywhere;
+      }
+      .said {
+        white-space: pre-wrap;
+      }
+      .from {
+        display: block;
+        font-size: var(--swc-font-size-75);
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
+      .form {
+        display: grid;
+        gap: var(--swc-spacing-200);
+        max-inline-size: 32rem;
+        padding: var(--swc-spacing-300);
+        margin: var(--swc-spacing-200) 0;
+        border-radius: var(--swc-corner-radius-100);
+        border: var(--swc-border-width-100) solid var(--swc-gray-300);
+        background: var(--swc-background-layer-1-color);
+      }
+      .form strong {
+        font-weight: var(--swc-bold-font-weight);
+      }
+      .form sp-picker {
+        inline-size: 100%;
+      }
+      .picks {
+        display: grid;
+        gap: var(--swc-spacing-100);
+        margin: 0;
+        padding: var(--swc-spacing-200) var(--swc-spacing-300);
+        border: var(--swc-border-width-100) solid var(--swc-gray-200);
+        border-radius: var(--swc-corner-radius-100);
+      }
+      .picks legend {
+        padding: 0 var(--swc-spacing-75);
+        font-size: var(--swc-font-size-75);
+      }
+      .picks label {
+        display: grid;
+        grid-template-columns: max-content minmax(0, 1fr);
+        align-items: start;
+        gap: var(--swc-spacing-50) var(--swc-spacing-100);
+      }
+      .picks input {
+        margin: 0.2em 0 0;
+        accent-color: var(--swc-accent-background-color-default);
+      }
+      .picks .about {
+        display: grid;
+        gap: var(--swc-spacing-50);
+        min-width: 0;
+      }
+      .picks .suggested {
+        font-size: var(--swc-font-size-75);
+        overflow-wrap: anywhere;
+      }
+      .secrets {
+        display: grid;
+        gap: var(--swc-spacing-200);
+      }
       .secret {
-        grid-template-columns: minmax(0, 1fr);
+        display: grid;
+        grid-template-columns: minmax(0, 1fr) max-content;
+        gap: var(--swc-spacing-100) var(--swc-spacing-300);
+        padding: var(--swc-spacing-200) 0;
+        border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
       }
-      .secret slicc-vault-button {
-        order: 1;
-        justify-self: start;
+      .secret:first-child {
+        border-top: 0;
+      }
+      .secret .form {
+        grid-column: 1 / -1;
+      }
+      .secret .buttons {
+        align-self: start;
+        justify-content: flex-end;
+      }
+      .name {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: baseline;
+        gap: var(--swc-spacing-100) var(--swc-spacing-200);
+        min-width: 0;
+      }
+      .name code {
+        font-size: var(--swc-font-size-100);
+        font-weight: var(--swc-bold-font-weight);
+      }
+      .removed {
+        margin-top: var(--swc-spacing-200);
+        border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
+        padding-top: var(--swc-spacing-200);
+      }
+      .removed summary {
+        cursor: pointer;
+        font-size: var(--swc-font-size-75);
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
+      .removed .secret dl,
+      .removed .secret .name code {
+        color: var(--swc-neutral-subdued-content-color-default);
       }
       dl {
-        grid-template-columns: minmax(0, 1fr);
+        grid-column: 1 / -1;
+        display: grid;
+        grid-template-columns: max-content minmax(0, 1fr);
+        gap: var(--swc-spacing-50) var(--swc-spacing-300);
+        margin: 0;
+        font-size: var(--swc-font-size-75);
+        line-height: var(--swc-line-height-200);
+      }
+      dt {
+        color: var(--swc-neutral-subdued-content-color-default);
       }
       dd {
-        margin-bottom: var(--swc-spacing-75);
+        margin: 0;
+        min-width: 0;
+        overflow-wrap: anywhere;
+      }
+      .refused li {
+        display: grid;
+        gap: var(--swc-spacing-50);
+        padding: var(--swc-spacing-100) 0;
+        border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
+        font-size: var(--swc-font-size-75);
+        overflow-wrap: anywhere;
+      }
+      .audit-head {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: baseline;
+        justify-content: space-between;
+        gap: var(--swc-spacing-200);
+        margin: var(--swc-spacing-400) 0 var(--swc-spacing-100);
+      }
+      .audit-head h3 {
+        margin-block: 0;
       }
       .audit li {
-        grid-template-columns: minmax(0, 1fr);
+        display: grid;
+        grid-template-columns: 7em minmax(0, 1fr);
+        gap: var(--swc-spacing-50) var(--swc-spacing-300);
+        padding: var(--swc-spacing-100) 0;
+        border-top: var(--swc-border-width-100) solid var(--swc-gray-200);
+        font-size: var(--swc-font-size-75);
+        line-height: var(--swc-line-height-200);
       }
-    }
-  `;
-  #pushed = [];
+      .audit time {
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
+      .audit .what {
+        overflow-wrap: anywhere;
+      }
+      .audit .by,
+      .audit .hint {
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
+      .audit .change::before {
+        content: '• ' / '';
+      }
+      .audit .change,
+      .audit .warning,
+      .audit .hint {
+        display: block;
+      }
+      .row {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: var(--swc-spacing-200);
+        margin-top: var(--swc-spacing-200);
+      }
+      .error {
+        display: flex;
+        align-items: flex-start;
+        gap: var(--swc-spacing-100);
+        margin: 0;
+        color: var(--swc-negative-content-color-default);
+        font-size: var(--swc-font-size-75);
+        --swc-icon-color: var(--swc-negative-content-color-default);
+      }
+      @container (max-width: 480px) {
+        .secret {
+          grid-template-columns: minmax(0, 1fr);
+        }
+        .secret .buttons {
+          order: 1;
+          justify-content: flex-start;
+        }
+        .secret .form {
+          order: 2;
+        }
+        .form {
+          max-inline-size: none;
+        }
+        dl {
+          grid-template-columns: minmax(0, 1fr);
+        }
+        dd {
+          margin-bottom: var(--swc-spacing-75);
+        }
+        .audit li {
+          grid-template-columns: minmax(0, 1fr);
+        }
+      }
+    `
+  ];
   disconnectedCallback() {
     super.disconnectedCallback();
     clearTimeout(this.#tick);
+    clearValues(this.renderRoot);
     this.older = [];
     this.more = null;
-    this.#pushed = [];
   }
   willUpdate(changed) {
     super.willUpdate(changed);
     const before = changed.get("model");
     if (!changed.has("model") || before?.vault === this.model?.vault) return;
+    clearValues(this.renderRoot);
     this.older = [];
     this.more = null;
     this.loading = false;
     this.popup = null;
-    this.acking = /* @__PURE__ */ new Set();
     this.failure = null;
-    this.#pushed = [];
+    this.form = null;
+    this.busy = false;
+    this.problem = null;
+    this.invalid = null;
+    this.said = null;
+    this.acting = /* @__PURE__ */ new Set();
+    this.candidates = null;
   }
   updated() {
     clearTimeout(this.#tick);
     if (!this.isConnected) return;
     const now = Date.now();
+    const vault = this.model?.vault;
     const next = Math.min(
       now + 6e4,
-      ...(this.model?.vault?.list()?.secrets ?? []).map((secret) => secret.expiresAt ?? Number.POSITIVE_INFINITY).filter((at) => at > now)
+      ...[
+        ...(vault?.list()?.secrets ?? []).map((secret) => secret.expiresAt),
+        ...(vault?.status()?.waiting ?? []).map((request2) => request2.expiresAt)
+      ].map((at) => at ?? Number.POSITIVE_INFINITY).filter((at) => at > now)
     );
     this.#tick = setTimeout(() => this.requestUpdate(), next - now);
   }
   #listed(vault) {
-    this.#pushed = [];
     const head2 = vault.list()?.audit ?? [];
     const last = head2[head2.length - 1];
     if (this.older.length && (!last || last.seq > this.older[0].seq + 1)) {
@@ -28756,25 +29197,22 @@ var SliccSecrets = class extends ThemedElement {
     }
     this.requestUpdate();
   }
-  #noticed(notice) {
-    this.#pushed = [...this.#pushed.filter((item2) => item2.id !== notice.id), notice];
-    this.requestUpdate();
-  }
   subscribe(model) {
     const update = () => this.requestUpdate();
     return [
       ...super.subscribe(model),
       ...model.vault ? [
         model.vault.on("status", update),
-        model.vault.on("list", () => this.#listed(model.vault)),
-        model.vault.on("notice", (notice) => this.#noticed(notice))
+        model.vault.on("availability", update),
+        model.vault.on("list", () => this.#listed(model.vault))
       ] : [],
       ...model.network ? [model.network.on("network", update)] : []
     ];
   }
-  #button(config) {
+  #button(config, action) {
     const theme3 = this.color;
     return b`<slicc-vault-button
+      data-action=${action}
       .vault=${this.model?.vault}
       .config=${{ size: "m", variant: "secondary", ...config, theme: theme3 }}
       @vault-popup=${(event2) => this.#popup(event2.detail)}
@@ -28783,6 +29221,238 @@ var SliccSecrets = class extends ThemedElement {
   #popup(detail) {
     this.popup = detail;
   }
+  open(form) {
+    if (form && this.busy) return;
+    clearValues(this.renderRoot);
+    this.form = form;
+    this.problem = null;
+    this.invalid = null;
+    this.said = null;
+    this.candidates = null;
+    this.again = false;
+    if (form?.kind === "import") this.importKind = "bundle";
+    if (form) void this.updateComplete.then(() => this.#focus());
+  }
+  #refuse(text2, field = null, focus = false) {
+    this.problem = text2;
+    this.invalid = text2 ? field : null;
+    if (focus && text2 && field) void this.updateComplete.then(() => this.#field(field)?.focus());
+  }
+  #typed() {
+    this.invalid = null;
+  }
+  #bad(field) {
+    return this.invalid === field ? "true" : A;
+  }
+  #described(field) {
+    return this.invalid === field ? "error-form" : A;
+  }
+  #focus() {
+    this.renderRoot.querySelector("[data-form] input, [data-form] sp-picker")?.focus();
+  }
+  #field(name) {
+    return this.renderRoot.querySelector(
+      `[data-form] input[data-field=${name}]`
+    );
+  }
+  #same(vault, form, kind, file) {
+    return this.#mine(vault, form) && this.importKind === kind && this.#field("file")?.files?.[0] === file;
+  }
+  #shut(vault) {
+    if (!vault.status()?.locked) return false;
+    this.#refuse("Unlock the vault first");
+    return true;
+  }
+  #mine(vault, form) {
+    return this.model?.vault === vault && this.isConnected && !away(vault) && (form === void 0 || this.form === form);
+  }
+  async save(vault) {
+    const form = this.form;
+    if (this.busy) return;
+    const name = form.kind === "replace" ? form.name : this.#field("name").value.trim();
+    const bad = nameProblem(name);
+    if (bad) {
+      this.#refuse(bad, "name", true);
+      return;
+    }
+    const value = take(this.#field("value"));
+    const problem = valueProblem(value);
+    this.#refuse(problem, "value", true);
+    if (problem) return;
+    if (form.kind === "add" && vault.list()?.secrets.some((secret) => secret.name === name)) {
+      this.busy = true;
+      const sure = await confirm({
+        title: `Replace ${name}?`,
+        body: "A secret with this name exists. Saving replaces its value, and its placeholder stays.",
+        action: "Replace",
+        variant: "confirmation"
+      });
+      if (this.model?.vault === vault) this.busy = false;
+      if (!sure || !this.#mine(vault, form) || this.#shut(vault)) return;
+    }
+    this.busy = true;
+    try {
+      await vault.put?.(name, value);
+      if (!this.#mine(vault, form)) return;
+      this.form = null;
+      this.said = { kind: "saved", name };
+    } catch (error) {
+      if (this.#mine(vault, form)) this.#refuse(failureText(error), fieldOf(error, "value"));
+    } finally {
+      if (this.model?.vault === vault) this.busy = false;
+    }
+  }
+  async #act(vault, key2, run2, missing = "") {
+    if (this.acting.has(key2)) return;
+    this.acting = /* @__PURE__ */ new Set([...this.acting, key2]);
+    this.failure = null;
+    try {
+      await run2();
+    } catch (error) {
+      if (this.#mine(vault))
+        this.failure = missing && isVaultFailure(error) && error.code === "ENOENT" ? missing : failureText(error);
+    } finally {
+      if (this.model?.vault === vault)
+        this.acting = new Set([...this.acting].filter((item2) => item2 !== key2));
+    }
+  }
+  async removeSecret(vault, secret, trigger2 = null) {
+    const { name, kind } = secret;
+    const sure = await confirm({
+      title: `Remove ${name}?`,
+      body: "Agents and programs can no longer use it. You can restore it from Removed.",
+      action: "Remove",
+      variant: "confirmation",
+      trigger: trigger2
+    });
+    if (!sure || !this.#mine(vault)) return;
+    if (this.form?.kind === "replace" && this.form.name === name) this.open(null);
+    await this.#act(vault, `remove:${name}`, async () => vault.remove?.(name, kind));
+  }
+  restoreSecret(vault, secret) {
+    const { name, kind } = secret;
+    return this.#act(
+      vault,
+      `restore:${name}`,
+      async () => vault.restore?.(name, kind),
+      "Removed too long ago to restore"
+    );
+  }
+  cancelRequest(vault, id) {
+    return this.#act(vault, `cancel:${id}`, async () => vault.cancel?.(id));
+  }
+  lockVault(vault) {
+    return this.#act(vault, "lock", async () => vault.lock?.());
+  }
+  dismissBackup(vault) {
+    return this.#act(vault, "backup", async () => vault.dismissBackupReminder?.());
+  }
+  answer(id) {
+    const vault = this.model?.vault;
+    this.dispatchEvent(
+      new CustomEvent("value-request", { detail: { id, vault }, bubbles: true, composed: true })
+    );
+  }
+  #kind(event2) {
+    this.importKind = event2.currentTarget.value;
+    this.candidates = null;
+    this.#refuse(null);
+  }
+  #reset() {
+    this.candidates = null;
+    this.#refuse(null);
+  }
+  async read(vault) {
+    const form = this.form;
+    const kind = this.importKind;
+    if (this.busy) return;
+    const password = take(this.#field("password"));
+    const file = this.#field("file").files?.[0];
+    if (!file) {
+      this.#refuse("Choose a file to import", "file", true);
+      return;
+    }
+    const pick = this.candidates?.filter((item2) => this.picked.has(item2.name)).map(
+      (item2) => item2.kind && item2.kind !== "secret" ? { name: item2.name, kind: item2.kind } : item2.name
+    );
+    if (pick && !pick.length) {
+      this.#refuse("Choose at least one secret to import");
+      return;
+    }
+    this.busy = true;
+    this.#refuse(null);
+    try {
+      let bytes = new Uint8Array(await file.arrayBuffer());
+      if (!this.#same(vault, form, kind, file) || this.#shut(vault)) return;
+      const call = vault.import?.(kind, bytes, {
+        ...password ? { password } : {},
+        ...pick ? { pick } : {}
+      });
+      bytes = null;
+      const result = await call;
+      if (!this.#same(vault, form, kind, file)) return;
+      if (result.stage === "pick") {
+        this.candidates = result.candidates;
+        this.picked = new Set(
+          result.candidates.filter((item2) => !item2.refused).map((item2) => item2.name)
+        );
+        this.again = !!password;
+        return;
+      }
+      this.form = null;
+      this.candidates = null;
+      this.said = {
+        kind: "imported",
+        imported: result.imported.length,
+        skipped: result.skipped.map((name) => {
+          const reason = result.reasons?.[name];
+          return reason ? { name, reason } : { name };
+        })
+      };
+    } catch (error) {
+      if (this.#mine(vault, form))
+        this.#refuse(failureText(error), fieldOf(error, password ? "password" : "file"));
+    } finally {
+      if (this.model?.vault === vault) this.busy = false;
+    }
+  }
+  #pick(name, event2) {
+    const on = event2.currentTarget.checked;
+    this.picked = new Set(
+      on ? [...this.picked, name] : [...this.picked].filter((item2) => item2 !== name)
+    );
+  }
+  async exportAll(vault, trigger2 = null) {
+    const form = this.form;
+    if (this.busy) return;
+    const passphrase = take(this.#field("passphrase"));
+    const repeat = take(this.#field("repeat"));
+    const short2 = new TextEncoder().encode(passphrase).length < 8;
+    const problem = short2 ? "Passphrases need at least 8 bytes" : passphrase !== repeat ? "The passphrases don't match" : null;
+    this.#refuse(problem, short2 ? "passphrase" : "repeat", true);
+    if (problem) return;
+    const sure = await confirm({
+      title: "Export your secrets?",
+      body: "The file holds every value, encrypted with your passphrase. Keep it somewhere safe.",
+      action: "Export",
+      variant: "confirmation",
+      trigger: trigger2
+    });
+    if (!sure || !this.#mine(vault, form) || this.#shut(vault)) return;
+    this.busy = true;
+    try {
+      const bytes = await vault.export?.(passphrase);
+      if (!this.#mine(vault, form)) return;
+      const file = filename();
+      download(bytes, file, this.renderRoot);
+      this.form = null;
+      this.said = { kind: "exported", file };
+    } catch (error) {
+      if (this.#mine(vault, form)) this.#refuse(failureText(error), fieldOf(error, "passphrase"));
+    } finally {
+      if (this.model?.vault === vault) this.busy = false;
+    }
+  }
   async showOlder(vault, entries) {
     this.loading = true;
     this.failure = null;
@@ -28795,112 +29465,181 @@ var SliccSecrets = class extends ThemedElement {
       this.older = merged(this.older, page.audit);
       this.more = page.more;
     } catch (error) {
-      if (this.model?.vault === vault && this.isConnected) this.failure = error.message;
+      if (this.#mine(vault)) this.failure = error.message;
     } finally {
       if (this.model?.vault === vault) this.loading = false;
     }
   }
-  async acknowledge(vault, notice) {
-    if (this.acking.has(notice.id)) return;
-    this.acking = /* @__PURE__ */ new Set([...this.acking, notice.id]);
-    this.failure = null;
-    try {
-      await vault.acknowledge(notice.id);
-      if (this.model?.vault === vault)
-        this.#pushed = this.#pushed.filter((item2) => item2.id !== notice.id);
-    } catch (error) {
-      if (this.model?.vault === vault && this.isConnected) this.failure = error.message;
-    } finally {
-      if (this.model?.vault === vault)
-        this.acking = new Set([...this.acking].filter((id) => id !== notice.id));
+  #error(text2, id) {
+    return b`<p class="error" role="alert" id=${`error-${id}`} data-error=${id}><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>${text2}</span></p>`;
+  }
+  #enter(event2, run2, locked) {
+    if (event2.key === "Escape") {
+      event2.preventDefault();
+      this.open(null);
+      return;
     }
+    if (event2.key !== "Enter" || event2.target.localName !== "input") return;
+    event2.preventDefault();
+    if (!locked && !this.busy) void run2();
+  }
+  #value(label, field = "value") {
+    return b`<label class="field"><span>${label}</span><input type="password" autocomplete="off" spellcheck="false" data-field=${field} aria-invalid=${this.#bad(field)} aria-describedby=${this.#described(field)} /></label>`;
+  }
+  #actions(locked, label, action, run2) {
+    return b`<div class="buttons">
+      <swc-button size="m" variant="accent" data-action=${action} ?pending=${this.busy} ?disabled=${locked} @click=${run2}>${label}</swc-button>
+      <swc-button size="m" variant="secondary" fill-style="outline" data-action="cancel" @click=${() => this.open(null)}>Cancel</swc-button>
+    </div>`;
+  }
+  #locked(locked) {
+    return locked ? b`<p class="muted" data-locked>Unlock the vault first</p>` : A;
+  }
+  #valueForm(vault, form, locked) {
+    const save = () => this.save(vault);
+    const add = form.kind === "add";
+    return b`<div class="form" data-form=${form.kind} @input=${() => this.#typed()} @keydown=${(event2) => this.#enter(event2, save, locked)}>
+      <strong>${add ? "Add a secret" : b`Replace the value of <code>${form.name}</code>`}</strong>
+      ${add ? b`<label class="field"><span>Name</span><input type="text" autocomplete="off" spellcheck="false" autocapitalize="characters" data-field="name" placeholder="API_TOKEN" aria-invalid=${this.#bad("name")} aria-describedby=${this.#described("name")} @input=${(event2) => this.#upper(event2)} /></label>` : A}
+      ${this.#value(add ? "Value" : "New value")}
+      ${this.#locked(locked)}
+      ${this.problem ? this.#error(this.problem, "form") : A}
+      ${this.#actions(locked, "Save", "save", save)}
+    </div>`;
+  }
+  #upper(event2) {
+    const input = event2.currentTarget;
+    input.value = input.value.toUpperCase();
+  }
+  #importForm(vault, locked) {
+    const read = () => this.read(vault);
+    const candidates2 = this.candidates;
+    return b`<div class="form" data-form="import" @input=${() => this.#typed()} @keydown=${(event2) => this.#enter(event2, read, locked)}>
+      <strong>Import secrets</strong>
+      <label class="field"><span id="import-kind">Kind</span>
+        <sp-picker size="m" label="Kind" aria-labelledby="import-kind" data-field="kind" value=${this.importKind} @change=${(event2) => this.#kind(event2)}>
+          ${Object.entries(importKinds).map(([value, label]) => b`<sp-menu-item value=${value}>${label}</sp-menu-item>`)}
+        </sp-picker>
+      </label>
+      <label class="field"><span>File</span><input type="file" data-field="file" aria-invalid=${this.#bad("file")} aria-describedby=${this.#described("file")} @change=${() => this.#reset()} /></label>
+      <label class="field"><span>${this.again ? "Password, once more to import" : "Password, if the file has one"}</span><input type="password" autocomplete="off" spellcheck="false" data-field="password" aria-invalid=${this.#bad("password")} aria-describedby=${this.#described("password")} /></label>
+      ${candidates2 ? b`<fieldset class="picks" data-picks>
+              <legend class="muted">Choose what to import</legend>
+              <p class="muted" data-rules-note>Rules from the file aren't applied. Add them with sudo.</p>
+              ${candidates2.map(
+      (item2) => b`<label data-candidate=${item2.name}>
+                  <input type="checkbox" data-pick=${item2.name} .checked=${this.picked.has(item2.name)} ?disabled=${!!item2.refused} @change=${(event2) => this.#pick(item2.name, event2)} />
+                  <span class="about">
+                    <span><code>${item2.name}</code>${item2.exists ? b` <swc-badge size="s" variant="notice" subtle>Replaces a secret</swc-badge>` : A}</span>
+                    ${item2.refused ? b`<span class="muted" data-refused-reason>Can't be imported: ${item2.refused}</span>` : A}
+                    ${item2.suggestedRules ? b`<span class="suggested" data-suggested><span class="from">From the file, not checked by SLICC:</span> <span class="said">${prompt2(item2.suggestedRules)}</span></span>` : A}
+                  </span>
+                </label>`
+    )}
+            </fieldset>` : A}
+      ${this.#locked(locked)}
+      ${this.problem ? this.#error(this.problem, "form") : A}
+      ${candidates2 ? this.#actions(
+      locked || !this.picked.size,
+      `Import ${this.picked.size}`,
+      "import-picked",
+      read
+    ) : this.#actions(locked, "Continue", "read", read)}
+    </div>`;
   }
-  #request(request2) {
-    const asker = who(request2);
-    const what = request2.kind === "value" ? b`${asker} asks for <code>${request2.name}</code>` : request2.kind === "oauth" ? b`${asker} asks you to sign in to ${request2.provider}` : b`${asker} asks for a jerk lease for ${request2.provider}`;
+  #exportForm(vault, locked) {
+    const run2 = () => this.exportAll(vault);
+    return b`<div class="form" data-form="export" @input=${() => this.#typed()} @keydown=${(event2) => this.#enter(event2, run2, locked)}>
+      <strong>Export secrets</strong>
+      <span class="muted">The file is sealed with this passphrase. You need it to import the file again.</span>
+      ${this.#value("Passphrase", "passphrase")}
+      ${this.#value("Passphrase again", "repeat")}
+      ${exported(this.model?.vault?.status()?.exportedAt)}
+      ${this.#locked(locked)}
+      ${this.problem ? this.#error(this.problem, "form") : A}
+      ${this.#actions(locked, "Export", "download", run2)}
+    </div>`;
+  }
+  #request(vault, request2) {
+    const what = asking2(request2);
     return b`<div class="box" data-request=${request2.id}>
       <span class="title">${what}</span>
       ${request2.prompt ? b`<p class="prompt" data-prompt><span class="from">From the agent, not checked by SLICC:</span> <span class="said">${prompt2(request2.prompt)}</span></p>` : A}
       <div class="actions">
-        ${this.#button({ intent: { kind: "request", request: request2.id }, label: "Answer in the vault", variant: "accent" })}
+        ${request2.kind === "value" && vault.put && !this.#offline ? b`<swc-button size="m" variant="accent" data-action="answer" @click=${() => this.answer(request2.id)}>Enter value</swc-button>` : A}
+        ${vault.cancel && !this.#offline ? b`<swc-button size="m" variant="secondary" fill-style="outline" data-action="cancel-request" ?pending=${this.acting.has(`cancel:${request2.id}`)} @click=${() => this.cancelRequest(vault, request2.id)}>Cancel request</swc-button>` : A}
         <span class="muted">Expires ${until(request2.expiresAt)}</span>
       </div>
     </div>`;
   }
-  #notice(vault, notice, devices) {
-    return b`<div class="box notice" role="alert" data-notice=${notice.id}>
-      <span class="title"><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>Rules widened in <code>${notice.file}</code> ${since(notice.at)}</span></span>
-      <ul>${notice.widened.map((change) => b`<li>${widening(change, devices)}</li>`)}</ul>
-      <span>If you didn’t mean this, change the file back with sudo.</span>
-      <div class="actions"><swc-button size="s" variant="secondary" data-action="acknowledge" ?pending=${this.acking.has(notice.id)} @click=${() => this.acknowledge(vault, notice)}>Acknowledge</swc-button></div>
-    </div>`;
-  }
   #state(secret) {
     const [variant, label] = secret.state === "removed" ? ["neutral", "Removed"] : secret.expiresAt !== void 0 && secret.expiresAt <= Date.now() ? ["notice", "Expired"] : secret.state === "inert" ? ["neutral", "No rule yet"] : ["positive", "Active"];
     return b`<swc-status-light size="s" variant=${variant}>${label}</swc-status-light>`;
   }
-  #action(secret) {
+  #controls(vault, secret) {
+    if (this.#offline) return A;
+    const { name } = secret;
     if (secret.state === "removed")
-      return this.#button({
-        intent: { kind: "manage", name: secret.name },
-        label: "Manage",
-        size: "s"
-      });
-    if (secret.source.startsWith("oauth:"))
-      return this.#button({
-        intent: { kind: "signin", provider: secret.source.slice("oauth:".length) },
-        label: "Sign in again",
-        size: "s"
-      });
-    return this.#button({
-      intent: { kind: "enter", name: secret.name },
-      label: "Replace value",
-      size: "s"
-    });
+      return vault.restore ? b`<div class="buttons"><swc-button size="s" variant="secondary" data-action="restore" ?pending=${this.acting.has(`restore:${name}`)} @click=${() => this.restoreSecret(vault, secret)}>Restore</swc-button></div>` : A;
+    const replace = vault.put && replaceable(secret);
+    if (!replace && !vault.remove) return A;
+    return b`<div class="buttons">
+      ${replace ? b`<swc-button size="s" variant="secondary" data-action="replace" @click=${() => this.open({ kind: "replace", name })}>Replace value</swc-button>` : A}
+      ${vault.remove ? b`<swc-button size="s" variant="secondary" fill-style="outline" data-action="remove" ?pending=${this.acting.has(`remove:${name}`)} @click=${(event2) => this.removeSecret(vault, secret, event2.currentTarget)}>Remove</swc-button>` : A}
+    </div>`;
   }
-  #secret(secret, entries, devices, more) {
+  #secret(vault, secret, entries, devices, more, locked) {
     const kind = kinds[secret.kind];
     const reveal = revealed(secret.name, entries, Date.now(), more);
+    const exec = execLine(secret.exec, secret.execArgv);
     const gone2 = secret.state === "removed";
+    const form = this.#offline ? null : this.form;
     return b`<li class="secret" data-secret=${secret.name} data-state=${secret.state}>
       <div class="name">
         <code>${secret.name}</code>
         ${kind ? b`<swc-badge size="s" variant="neutral" subtle>${kind}</swc-badge>` : A}
         ${this.#state(secret)}
       </div>
-      ${this.#action(secret)}
+      ${this.#controls(vault, secret)}
       <dl>
         <dt>${gone2 ? "Was sent to" : "Sent to"}</dt>
         <dd data-rules>${secret.rules.length ? secret.rules.map((rule, index) => b`${index ? b`<br />` : A}${ruleLine(rule)}`) : "Nowhere yet: no rule names it"}</dd>
-        <dt>${gone2 ? "Left through" : "Leaves through"}</dt>
-        <dd data-exits>${list4(secret.exits.map((exit) => exitLabel(exit, devices)))}</dd>
-        <dt>Programs</dt>
-        <dd data-exec>${execLine(secret.exec)}${reveal ? b`<br />${reveal}` : A}</dd>
+        ${secret.exits ? b`<dt>${gone2 ? "Left through" : "Leaves through"}</dt><dd data-exits>${secret.exits.length ? list4(secret.exits.map((exit) => exitLabel(exit, devices))) : "No exit"}</dd>` : A}
+        ${exec || reveal ? b`<dt>Programs</dt><dd data-exec>${exec}${exec && reveal ? b`<br />` : A}${reveal}</dd>` : A}
         <dt>From</dt>
         <dd data-source>${sourceLine(secret, devices)}</dd>
         ${secret.usedAt ? b`<dt>Last used</dt><dd data-used>${since(secret.usedAt)}</dd>` : A}
         ${secret.expiresAt ? b`<dt>Expires</dt><dd data-expires>${until(secret.expiresAt)}</dd>` : A}
         ${secret.removedAt ? b`<dt>Removed</dt><dd>${since(secret.removedAt)}</dd>` : A}
       </dl>
+      ${form?.kind === "replace" && form.name === secret.name ? this.#valueForm(vault, form, locked) : A}
     </li>`;
   }
-  #secrets(list5, entries, devices) {
+  #secrets(vault, list5, entries, devices, locked) {
     const more = this.more ?? list5.auditMore;
-    const row = (secret) => this.#secret(secret, entries, devices, more);
-    const live = list5.secrets.filter((secret) => secret.state !== "removed");
-    const removed = list5.secrets.filter((secret) => secret.state === "removed");
+    const row = (secret) => this.#secret(vault, secret, entries, devices, more, locked);
+    const sorted = [...list5.secrets].sort(byName);
+    const live = sorted.filter((secret) => secret.state !== "removed");
+    const removed = sorted.filter((secret) => secret.state === "removed");
     return b`${live.length ? b`<ul class="secrets" aria-labelledby="secrets">${live.map(row)}</ul>` : A}
       ${removed.length ? b`<details class="removed" data-removed>
               <summary>Removed (${removed.length})</summary>
               <ul class="secrets">${removed.map(row)}</ul>
             </details>` : A}`;
   }
+  #refused(refused2) {
+    if (!refused2.length) return A;
+    return b`<h3 id="secrets-refused">Rules SLICC refused</h3>
+      <ul class="refused" aria-labelledby="secrets-refused" data-refused>
+        ${refused2.map((item2) => b`<li data-refused-secret=${item2.secret}><span><code>${item2.secret}</code> to ${ruleLine(item2.rule)}</span><span class="muted">${item2.reason}</span></li>`)}
+      </ul>`;
+  }
   #entry(entry, devices) {
     const date = new Date(entry.at);
     const name = entry.type === "policy" ? null : entry.name;
     return b`<li data-seq=${entry.seq} data-type=${entry.type}>
       <time datetime=${date.toISOString()} title=${date.toLocaleString("en-GB", { dateStyle: "medium", timeStyle: "short" })}>${since(entry.at)}</time>
-      <span class="what">${name ? b`<code>${name}</code> · ` : A}${auditLine(entry, devices)}${entry.type === "policy" ? A : b` <span class="by">by ${who(entry)}</span>`}</span>
+      <span class="what">${name ? b`<code>${name}</code> · ` : A}${auditLine(entry, devices)}${entry.type === "policy" || entry.type === "refresh" ? A : b` <span class="by">by ${who(entry)}</span>`}</span>
     </li>`;
   }
   #audit(vault, list5, entries, devices) {
@@ -28916,12 +29655,52 @@ var SliccSecrets = class extends ThemedElement {
       ${more ? b`<div class="row"><swc-button size="s" variant="secondary" fill-style="outline" data-action="older" ?pending=${this.loading} @click=${() => this.showOlder(vault, entries)}>Show older</swc-button></div>` : A}`;
   }
   #feedback() {
+    const said = this.said;
     if (this.popup?.state === "blocked")
       return b`<div class="error" role="alert" data-popup="blocked"><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>The browser blocked the vault window. Allow pop-ups for this site, then try again.</span></div>`;
-    if (this.popup?.state === "done" && this.popup.result)
-      return b`<p role="status" data-popup="done">Saved <code>${this.popup.result.name}</code> in the vault.</p>`;
+    if (!said) return A;
+    if (said.kind === "saved")
+      return b`<p role="status" data-said="saved">Saved <code>${said.name}</code> in the vault</p>`;
+    if (said.kind === "imported")
+      return b`<div role="status" data-said="imported"><p>Imported ${said.imported}</p>${said.skipped.map((item2) => b`<p class="skipped" data-skipped=${item2.name}>Skipped <code>${item2.name}</code>${item2.reason ? b`: <span class="said">${item2.reason}</span>` : A}</p>`)}</div>`;
+    return b`<p role="status" data-said="exported">Exported to <code>${said.file}</code></p>`;
+  }
+  #availability() {
+    if (this.#offline)
+      return b`<p class="availability" role="status" data-availability="waiting"><swc-progress-circle size="s" indeterminate label="Waiting for the vault" aria-hidden="true"></swc-progress-circle><span>Waiting for the vault</span></p>`;
     return A;
   }
+  #backup(vault, status2) {
+    if (status2?.backupReminder !== "due" || this.#offline) return A;
+    return b`<div class="box info" role="region" aria-labelledby="secrets-backup" data-backup>
+      <span class="title" id="secrets-backup"><swc-icon-info-circle size="s" aria-hidden="true"></swc-icon-info-circle><span>Export a backup of your secrets. Clearing this site's data loses every value.</span></span>
+      <div class="actions">
+        ${vault.export ? b`<swc-button size="m" variant="accent" data-action="export" @click=${() => this.open({ kind: "export" })}>Export backup</swc-button>` : A}
+        ${vault.dismissBackupReminder ? b`<swc-button size="m" variant="secondary" fill-style="outline" data-action="dismiss-backup" ?pending=${this.acting.has("backup")} @click=${() => this.dismissBackup(vault)}>Not now</swc-button>` : A}
+      </div>
+    </div>`;
+  }
+  #header(vault, status2) {
+    if (!status2) return A;
+    if (this.#offline)
+      return b`<swc-status-light size="m" variant="neutral">Waiting</swc-status-light>`;
+    return b`<swc-status-light size="m" variant=${status2.locked ? "notice" : "positive"}>${status2.locked ? "Locked" : "Unlocked"}</swc-status-light><span class="muted">${lockModes[status2.lock]}</span>
+      <span class="controls">${status2.locked ? b`${status2.scrub?.needed && !status2.scrub.ready ? b`<span class="availability" role="status" data-availability="unlock"><swc-icon-info-circle size="s" aria-hidden="true"></swc-icon-info-circle><span>Unlock the vault to continue</span></span>` : A}${this.#button({ intent: { kind: "unlock" }, label: "Unlock", variant: "accent" }, "unlock")}` : b`${vault.lock ? b`<swc-button size="m" variant="secondary" fill-style="outline" data-action="lock" ?pending=${this.acting.has("lock")} @click=${() => this.lockVault(vault)}>Lock</swc-button>` : A}
+            ${this.#button({ intent: { kind: "protect" }, label: status2.lock === "auto" ? "Protect with a passkey" : "Change protection" }, "protect")}`}</span>`;
+  }
+  #tools(vault, locked) {
+    if (this.#offline) return A;
+    const form = this.form;
+    const tool2 = (kind, label, variant = "secondary") => b`<swc-button size="m" variant=${variant} data-action=${kind === "add" ? "add-secret" : kind} aria-expanded=${form?.kind === kind ? "true" : "false"} @click=${() => this.open(form?.kind === kind ? null : { kind })}>${label}</swc-button>`;
+    return b`${vault.put || vault.import || vault.export ? b`<div class="row" data-tools>
+            ${vault.put ? tool2("add", "Add secret", "accent") : A}
+            ${vault.import ? tool2("import", "Import\u2026") : A}
+            ${vault.export ? tool2("export", "Export\u2026") : A}
+          </div>` : A}
+      ${form?.kind === "add" ? this.#valueForm(vault, form, locked) : A}
+      ${form?.kind === "import" ? this.#importForm(vault, locked) : A}
+      ${form?.kind === "export" ? this.#exportForm(vault, locked) : A}`;
+  }
   render() {
     const vault = this.model?.vault;
     if (!vault) return A;
@@ -28929,28 +29708,26 @@ var SliccSecrets = class extends ThemedElement {
     const current = vault.list();
     const devices = devicesOf(this.model);
     const entries = merged(current?.audit ?? [], this.older);
-    const listed = current?.notices ?? [];
-    const notices = [
-      ...listed,
-      ...this.#pushed.filter((notice) => !listed.some((item2) => item2.id === notice.id))
-    ].filter((notice) => !notice.acknowledged);
+    const locked = !!status2?.locked;
+    this.#offline = away(vault);
+    if (this.#offline && this.form) clearValues(this.renderRoot);
+    const now = Date.now();
+    const waiting2 = (status2?.waiting ?? []).filter((request2) => request2.expiresAt > now);
     return b`<section aria-labelledby="secrets" data-vault=${status2 ? status2.locked ? "locked" : "unlocked" : "loading"}>
       <div class="head">
         <h2 id="secrets">Secrets</h2>
-        ${status2 ? b`<swc-status-light size="m" variant=${status2.locked ? "notice" : "positive"}>${status2.locked ? "Locked" : "Unlocked"}</swc-status-light><span class="muted">${lockModes[status2.lock]}</span>` : A}
-        ${status2?.locked ? this.#button({ intent: { kind: "unlock" }, label: "Unlock", variant: "accent" }) : this.#button({ intent: { kind: "manage" }, label: "Open the vault" })}
+        ${this.#header(vault, status2)}
       </div>
-      <p class="muted">Agents and programs use secrets by name. The values stay in the vault, so SLICC never sees or shows them.</p>
+      <p class="muted">Agents and programs use secrets by name. SLICC sends each value only where its rules allow, so agents never see it.</p>
+      ${this.#availability()}
       ${this.#feedback()}
-      ${this.failure ? b`<div class="error" role="alert" data-error="vault"><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>${this.failure}</span></div>` : A}
-      ${status2?.waiting.length ? b`<h3>Waiting for you</h3>${status2.waiting.map((request2) => this.#request(request2))}` : A}
-      ${notices.map((notice) => this.#notice(vault, notice, devices))}
-      ${!current ? b`<p class="muted" data-loading>Loading secrets…</p>` : current.secrets.length ? this.#secrets(current, entries, devices) : b`<p data-empty>No secrets yet. When an agent or program needs one, it asks here, and you enter the value in the vault.</p>`}
+      ${this.failure ? this.#error(this.failure, "vault") : A}
+      ${waiting2.length ? b`<h3>Waiting for you</h3>${waiting2.map((request2) => this.#request(vault, request2))}` : A}
+      ${this.#backup(vault, status2)}
+      ${this.#tools(vault, locked)}
+      ${!current ? this.#offline ? A : b`<p class="muted" data-loading>Loading secrets…</p>` : current.secrets.length ? this.#secrets(vault, current, entries, devices, locked) : b`<p data-empty>No secrets yet. Add one here, or enter the value when an agent or program asks for one.</p>`}
+      ${this.#refused(current?.refused ?? [])}
       <p class="muted" data-policy>Rules live in <code>/etc/fnox/config.toml</code> and <code>/etc/slicc/secrets-policy.toml</code>. Change them with sudo; SLICC asks you before every change.</p>
-      <div class="row">
-        ${this.#button({ intent: { kind: "import" }, label: "Import\u2026", size: "s" })}
-        ${this.#button({ intent: { kind: "export" }, label: "Export\u2026", size: "s" })}
-      </div>
       ${current ? this.#audit(vault, current, entries, devices) : A}
     </section>`;
   }
@@ -29745,6 +30522,292 @@ ${data.html}`;
   }
 };
 
+// src/app/value-request.ts
+function valueRequests(vault, now) {
+  return [...vault?.status()?.waiting ?? []].filter((request2) => request2.kind === "value" && request2.expiresAt > now).sort((a22, b13) => a22.createdAt - b13.createdAt);
+}
+var SliccValueRequest = class extends ThemedElement {
+  static properties = {
+    ...ThemedElement.properties,
+    now: { state: true },
+    busy: { state: true },
+    problem: { state: true },
+    blocked: { state: true }
+  };
+  #later = /* @__PURE__ */ new Set();
+  #done = /* @__PURE__ */ new Set();
+  #front = "";
+  #shown = "";
+  #trigger = null;
+  #timer = null;
+  #port;
+  #open = (event2) => {
+    const { id, vault } = event2.detail;
+    if (vault === void 0 || vault === this.model?.vault) this.reopen(id);
+  };
+  constructor() {
+    super();
+    this.now = Date.now();
+    this.busy = false;
+    this.problem = null;
+    this.blocked = false;
+  }
+  static styles = [
+    dialogStyles,
+    fieldStyles,
+    i`
+      :host {
+        display: contents;
+      }
+      .asked {
+        margin-block-start: var(--swc-spacing-100);
+      }
+      .timer,
+      .more,
+      .locked {
+        margin-block-start: var(--swc-spacing-100);
+        color: var(--swc-neutral-subdued-content-color-default);
+        font-size: var(--swc-font-size-75);
+      }
+      .prompt {
+        margin-block-start: var(--swc-spacing-200);
+        padding-inline-start: var(--swc-spacing-200);
+        border-inline-start: var(--swc-border-width-200) solid var(--swc-gray-300);
+        overflow-wrap: anywhere;
+      }
+      .said {
+        white-space: pre-wrap;
+      }
+      .from {
+        display: block;
+        font-size: var(--swc-font-size-75);
+        color: var(--swc-neutral-subdued-content-color-default);
+      }
+      .fields {
+        display: grid;
+        gap: var(--swc-spacing-200);
+        margin-block-start: var(--swc-spacing-300);
+        padding: var(--swc-spacing-75);
+      }
+      .unlock {
+        display: flex;
+        flex-wrap: wrap;
+        align-items: center;
+        gap: var(--swc-spacing-200);
+        margin-block-start: var(--swc-spacing-200);
+      }
+      .problem {
+        display: flex;
+        align-items: flex-start;
+        gap: var(--swc-spacing-75);
+        margin-block-start: var(--swc-spacing-200);
+        color: var(--swc-negative-content-color-default);
+        --swc-icon-color: var(--swc-negative-content-color-default);
+      }
+      code {
+        font-family: var(--swc-code-font-family-stack);
+        overflow-wrap: anywhere;
+      }
+    `
+  ];
+  connectedCallback() {
+    super.connectedCallback();
+    this.ownerDocument.addEventListener("value-request", this.#open);
+  }
+  disconnectedCallback() {
+    super.disconnectedCallback();
+    this.ownerDocument.removeEventListener("value-request", this.#open);
+    clearValues(this.renderRoot);
+    this.#tick(false);
+    this.#shown = "";
+  }
+  subscribe(model) {
+    if (model.vault !== this.#port) {
+      clearValues(this.renderRoot);
+      this.#port = model.vault;
+      this.#later.clear();
+      this.#done.clear();
+      this.#front = "";
+      this.busy = false;
+      this.problem = null;
+      this.blocked = false;
+    }
+    const update = () => {
+      this.now = Date.now();
+      this.requestUpdate();
+    };
+    return [
+      ...super.subscribe(model),
+      ...model.vault ? [model.vault.on("status", update), model.vault.on("availability", update)] : []
+    ];
+  }
+  reopen(id) {
+    this.#later.delete(id);
+    this.#front = id;
+    this.now = Date.now();
+  }
+  later(id) {
+    if (this.busy) return;
+    clearValues(this.renderRoot);
+    this.#later.add(id);
+    if (this.#front === id) this.#front = "";
+    this.problem = null;
+    this.requestUpdate();
+  }
+  #queue() {
+    const vault = this.model?.vault;
+    if (!vault || away(vault)) return [];
+    return valueRequests(vault, this.now).filter(({ id }) => !this.#done.has(id));
+  }
+  #current(queue) {
+    return queue.find(({ id }) => id === this.#front) ?? queue.find(({ id }) => !this.#later.has(id)) ?? null;
+  }
+  #tick(on) {
+    if (on && !this.#timer) this.#timer = setInterval(() => this.now = Date.now(), 1e3);
+    if (!on && this.#timer) {
+      clearInterval(this.#timer);
+      this.#timer = null;
+    }
+  }
+  #mine(vault) {
+    return this.model?.vault === vault && this.isConnected;
+  }
+  #field(name) {
+    return this.renderRoot.querySelector(`input[data-field=${name}]`);
+  }
+  async save(request2) {
+    const vault = this.model?.vault;
+    if (this.busy) return;
+    const name = request2.name ?? this.#field("name").value.trim();
+    const bad = nameProblem(name);
+    const value = bad ? "" : take(this.#field("value"));
+    const text2 = bad ?? valueProblem(value);
+    const field = bad ? "name" : "value";
+    this.problem = text2 ? { id: request2.id, text: text2, field } : null;
+    if (text2) {
+      void this.updateComplete.then(() => this.#field(field)?.focus());
+      return;
+    }
+    this.busy = true;
+    try {
+      await vault.put?.(name, value, request2.id);
+      if (!this.#mine(vault)) return;
+      this.#done.add(request2.id);
+    } catch (error) {
+      if (this.#mine(vault)) {
+        const field2 = fieldOf(error, "value");
+        this.problem = { id: request2.id, text: failureText(error), ...field2 ? { field: field2 } : {} };
+      }
+    } finally {
+      if (this.model?.vault === vault) this.busy = false;
+    }
+  }
+  #typed() {
+    if (this.problem?.field) this.problem = { id: this.problem.id, text: this.problem.text };
+  }
+  #aria(field, problem) {
+    const bad = problem?.field === field;
+    return { invalid: bad ? "true" : A, described: bad ? "error-request" : A };
+  }
+  async cancelRequest(request2) {
+    const vault = this.model?.vault;
+    if (this.busy) return;
+    clearValues(this.renderRoot);
+    this.busy = true;
+    this.problem = null;
+    try {
+      await vault.cancel?.(request2.id);
+      if (this.#mine(vault)) this.#done.add(request2.id);
+    } catch (error) {
+      if (this.#mine(vault)) this.problem = { id: request2.id, text: failureText(error) };
+    } finally {
+      if (this.model?.vault === vault) this.busy = false;
+    }
+  }
+  willUpdate(changed) {
+    super.willUpdate(changed);
+    const current = this.#current(this.#queue());
+    if ((current?.id ?? "") !== this.#shown) clearValues(this.renderRoot);
+  }
+  updated(changed) {
+    super.updated(changed);
+    const dialog = this.renderRoot.querySelector("dialog");
+    this.#tick(this.isConnected && !!dialog);
+    const key2 = dialog?.dataset.request ?? "";
+    if (key2 === this.#shown) return;
+    if (dialog && !this.#shown) this.#trigger = focused();
+    this.#shown = key2;
+    if (!dialog) {
+      if (this.#trigger?.isConnected) this.#trigger.focus();
+      this.#trigger = null;
+      return;
+    }
+    if (!dialog.open) dialog.showModal();
+    const target = dialog.querySelector("input") ?? dialog.querySelector("[data-action=later]");
+    void dialog.querySelector("sp-alert-dialog").updateComplete.then(
+      () => target.focus()
+    );
+  }
+  #onKey(event2, request2) {
+    if (event2.key !== "Enter" || event2.target.localName !== "input") return;
+    event2.preventDefault();
+    if (!this.model?.vault?.status()?.locked) void this.save(request2);
+  }
+  #unlock(vault) {
+    return b`<div class="unlock" data-locked>
+      <span class="locked">Unlock the vault first</span>
+      <slicc-vault-button
+        data-action="unlock"
+        .vault=${vault}
+        .config=${{ intent: { kind: "unlock" }, label: "Unlock", size: "m", variant: "accent", theme: this.color }}
+        @vault-popup=${(event2) => {
+      this.blocked = event2.detail.state === "blocked";
+    }}
+      ></slicc-vault-button>
+      ${this.blocked ? b`<span class="problem" role="alert" data-popup="blocked"><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>The browser blocked the vault window. Allow pop-ups for this site, then try again.</span></span>` : A}
+    </div>`;
+  }
+  render() {
+    const vault = this.model?.vault;
+    const queue = this.#queue();
+    const request2 = this.#current(queue);
+    if (!vault || !request2) return A;
+    const locked = !!vault.status()?.locked;
+    const rest = queue.length - 1;
+    const shown3 = this.problem?.id === request2.id ? this.problem : null;
+    const problem = shown3?.text ?? "";
+    const name = this.#aria("name", shown3);
+    const field = this.#aria("value", shown3);
+    return i17(
+      request2.id,
+      b`<dialog role="alertdialog" aria-labelledby="title" aria-describedby="asked" data-request=${request2.id} @cancel=${(event2) => {
+        event2.preventDefault();
+        this.later(request2.id);
+      }}>
+        <sp-alert-dialog variant="confirmation">
+          <h2 id="title" slot="heading">${request2.name ? b`Enter a value for <code>${request2.name}</code>` : "Enter a value"}</h2>
+          <p class="asked" id="asked" data-asked>${asking2(request2)}</p>
+          ${request2.prompt ? b`<p class="prompt" data-prompt><span class="from">From the agent, not checked by SLICC:</span> <span class="said">${prompt2(request2.prompt)}</span></p>` : A}
+          ${vault.put ? b`<div class="fields" @input=${() => this.#typed()} @keydown=${(event2) => this.#onKey(event2, request2)}>
+                  ${request2.name ? A : b`<label class="field"><span>Name</span><input type="text" autocomplete="off" spellcheck="false" autocapitalize="characters" data-field="name" aria-invalid=${name.invalid} aria-describedby=${name.described} @input=${(event2) => {
+        const input = event2.currentTarget;
+        input.value = input.value.toUpperCase();
+      }} /></label>`}
+                  <label class="field"><span>Value</span><input type="password" autocomplete="off" spellcheck="false" data-field="value" aria-invalid=${field.invalid} aria-describedby=${field.described} /></label>
+                </div>` : A}
+          ${locked ? this.#unlock(vault) : A}
+          ${problem ? b`<p class="problem" role="alert" id="error-request" data-error><swc-icon-alert-triangle size="s" aria-hidden="true"></swc-icon-alert-triangle><span>${problem}</span></p>` : A}
+          <p class="timer" data-timer>Expires ${until(request2.expiresAt, this.now)}</p>
+          ${rest > 0 ? b`<p class="more" data-more>${rest} more waiting</p>` : A}
+          <swc-button slot="button" variant="secondary" fill-style="outline" data-action="later" ?disabled=${this.busy} @click=${() => this.later(request2.id)}>Later</swc-button>
+          ${vault.cancel ? b`<swc-button slot="button" variant="secondary" fill-style="outline" data-action="cancel-request" ?disabled=${this.busy} @click=${() => this.cancelRequest(request2)}>Cancel request</swc-button>` : A}
+          ${vault.put ? b`<swc-button slot="button" variant="accent" data-action="save" ?pending=${this.busy} ?disabled=${locked} @click=${() => this.save(request2)}>Save</swc-button>` : A}
+        </sp-alert-dialog>
+      </dialog>`
+    );
+  }
+};
+
 // node_modules/@pierre/diffs/dist/constants.js
 var DIFFS_TAG_NAME = "diffs-container";
 var DIFFS_DEVELOPMENT_BUILD = (() => {
@@ -40389,7 +41452,7 @@ var captureDelim = r35`${namedCaptureDelim}|(?<unnamed>\()(?!\?)`;
 var token = new RegExp(r35`${namedCaptureDelim}|${recursiveToken}|\(\?|\\?.`, "gsu");
 var overlappingRecursionMsg = "Cannot use multiple overlapping recursions";
 function recursion(pattern2, data) {
-  const { hiddenCaptures, mode } = {
+  const { hiddenCaptures, mode: mode2 } = {
     hiddenCaptures: [],
     mode: "plugin",
     ...data
@@ -40402,7 +41465,7 @@ function recursion(pattern2, data) {
       hiddenCaptures
     };
   }
-  if (mode === "plugin" && hasUnescaped(pattern2, r35`\(\?\(DEFINE\)`, Context.DEFAULT)) {
+  if (mode2 === "plugin" && hasUnescaped(pattern2, r35`\(\?\(DEFINE\)`, Context.DEFAULT)) {
     throw new Error("DEFINE groups cannot be used with recursion");
   }
   const addedHiddenCaptures = [];
@@ -40428,7 +41491,7 @@ function recursion(pattern2, data) {
           throw new Error(
             // When used in `external` mode by transpilers other than Regex+, backrefs might have
             // gone through conversion from named to numbered, so avoid a misleading error
-            `${mode === "external" ? "Backrefs" : "Numbered backrefs"} cannot be used with global recursion`
+            `${mode2 === "external" ? "Backrefs" : "Numbered backrefs"} cannot be used with global recursion`
           );
         }
         const left = pattern2.slice(0, match.index);
@@ -40468,7 +41531,7 @@ function recursion(pattern2, data) {
           }
         }
         if (!isWithinReffedGroup) {
-          throw new Error(r35`Recursive \g cannot be used outside the referenced group "${mode === "external" ? gRNameOrNum : r35`\g<${gRNameOrNum}&R=${gRDepth}>`}"`);
+          throw new Error(r35`Recursive \g cannot be used outside the referenced group "${mode2 === "external" ? gRNameOrNum : r35`\g<${gRNameOrNum}&R=${gRDepth}>`}"`);
         }
         const startPos = groupContentsStartPos.get(gRNameOrNum);
         const groupContents = getGroupContents(pattern2, startPos);
@@ -40476,7 +41539,7 @@ function recursion(pattern2, data) {
           throw new Error(
             // When used in `external` mode by transpilers other than Regex+, backrefs might have
             // gone through conversion from named to numbered, so avoid a misleading error
-            `${mode === "external" ? "Backrefs" : "Numbered backrefs"} cannot be used with recursion of capturing groups`
+            `${mode2 === "external" ? "Backrefs" : "Numbered backrefs"} cannot be used with recursion of capturing groups`
           );
         }
         const groupContentsLeft = pattern2.slice(startPos, match.index);
@@ -40758,17 +41821,17 @@ function getIgnoreCaseMatchChars(char) {
     return [char];
   }
   const set = /* @__PURE__ */ new Set();
-  const lower = char.toLowerCase();
-  const upper = lower.toUpperCase();
-  const title = LowerToTitleCaseMap.get(lower);
-  const altLower = LowerToAlternativeLowerCaseMap.get(lower);
-  const altUpper = LowerToAlternativeUpperCaseMap.get(lower);
+  const lower2 = char.toLowerCase();
+  const upper = lower2.toUpperCase();
+  const title = LowerToTitleCaseMap.get(lower2);
+  const altLower = LowerToAlternativeLowerCaseMap.get(lower2);
+  const altUpper = LowerToAlternativeUpperCaseMap.get(lower2);
   if ([...upper].length === 1) {
     set.add(upper);
   }
   altUpper && set.add(altUpper);
   title && set.add(title);
-  set.add(lower);
+  set.add(lower2);
   altLower && set.add(altLower);
   return [...set];
 }
@@ -43252,8 +44315,8 @@ var InteractionManager = class {
   renderedEditorActiveLineState;
   selectionAnchor;
   pointerSession = { mode: "idle" };
-  constructor(mode, options) {
-    this.mode = mode;
+  constructor(mode2, options) {
+    this.mode = mode2;
     this.options = options;
   }
   setOptions(options) {
@@ -44766,23 +45829,23 @@ function getIconForType(type) {
 }
 
 // node_modules/@pierre/diffs/dist/utils/createFileHeaderElement.js
-function createFileHeaderElement({ fileOrDiff, mode, stickyHeader }) {
+function createFileHeaderElement({ fileOrDiff, mode: mode2, stickyHeader }) {
   const fileDiff = "type" in fileOrDiff ? fileOrDiff : void 0;
   const properties = {
-    "data-diffs-header": mode,
+    "data-diffs-header": mode2,
     "data-change-type": fileDiff?.type,
     "data-sticky": stickyHeader ? "" : void 0
   };
   return createHastElement({
     tagName: "div",
-    children: [mode === "custom" ? createHastElement({
+    children: [mode2 === "custom" ? createHastElement({
       tagName: "slot",
       properties: { name: CUSTOM_HEADER_SLOT_ID }
     }) : createHeaderElement({
       name: fileOrDiff.name,
       prevName: "prevName" in fileOrDiff ? fileOrDiff.prevName : void 0,
       iconType: fileDiff?.type ?? "file"
-    }), ...mode === "custom" ? [] : [createMetadataElement(fileDiff)]],
+    }), ...mode2 === "custom" ? [] : [createMetadataElement(fileDiff)]],
     properties
   });
 }
@@ -47295,8 +48358,8 @@ var File = class {
   * mode always restores the external values. An accepted file cannot reuse
   * the replaced file's `cacheKey`.
   */
-  __completeEditSession(editor, mode) {
-    this.settleEditSession(mode === "install", editor);
+  __completeEditSession(editor, mode2) {
+    this.settleEditSession(mode2 === "install", editor);
   }
   settleEditSession(installResult, editor) {
     const { editSession, file: externalFile, lineAnnotations: externalAnnotations } = this;
@@ -48451,10 +49514,10 @@ function _processFile(fileDiffString, { cacheKey, isGitDiff = GIT_DIFF_FILE_BREA
             else currentFile.type = "rename-changed";
           }
           if (line.startsWith("index ")) {
-            const [, prevObjectId, newObjectId, mode] = line.trim().match(INDEX_LINE_METADATA) ?? [];
+            const [, prevObjectId, newObjectId, mode2] = line.trim().match(INDEX_LINE_METADATA) ?? [];
             if (prevObjectId != null) currentFile.prevObjectId = detachString(prevObjectId);
             if (newObjectId != null) currentFile.newObjectId = detachString(newObjectId);
-            if (mode != null) currentFile.mode = detachString(mode);
+            if (mode2 != null) currentFile.mode = detachString(mode2);
           }
           if (line.startsWith("rename from ") || line.startsWith("copy from ")) currentFile.prevName = detachString(decodeDiffFileName(line.slice(line.startsWith("rename") ? 12 : 10)));
           if (line.startsWith("rename to ") || line.startsWith("copy to ")) currentFile.name = detachString(decodeDiffFileName(line.slice(line.startsWith("rename") ? 10 : 8)));
@@ -49153,14 +50216,14 @@ var WordDiff = class extends Diff {
       }
     }).join("");
   }
-  postProcess(changes, options) {
-    if (!changes || options.oneChangePerToken) {
-      return changes;
+  postProcess(changes2, options) {
+    if (!changes2 || options.oneChangePerToken) {
+      return changes2;
     }
     let lastKeep = null;
     let insertion = null;
     let deletion = null;
-    changes.forEach((change) => {
+    changes2.forEach((change) => {
       if (change.added) {
         insertion = change;
       } else if (change.removed) {
@@ -49177,7 +50240,7 @@ var WordDiff = class extends Diff {
     if (insertion || deletion) {
       dedupeWhitespaceInChangeObjects(lastKeep, deletion, insertion, null, options.intlSegmenter);
     }
-    return changes;
+    return changes2;
   }
 };
 var wordDiff = new WordDiff();
@@ -53595,8 +54658,8 @@ var FileDiff = class {
   * values. `discard` mode always restores the external values. An accepted
   * diff cannot reuse the replaced diff's `cacheKey`.
   */
-  __completeEditSession(editor, mode) {
-    this.settleEditSession(mode === "install", editor);
+  __completeEditSession(editor, mode2) {
+    this.settleEditSession(mode2 === "install", editor);
   }
   settleEditSession(installResult, editor) {
     const { editSession, fileDiff: externalDiff, lineAnnotations: externalAnnotations } = this;
@@ -74484,7 +75547,7 @@ function createCleanupMetricSnapshot(state3) {
     totalNodeSlotCount: Math.max(0, state3.snapshot.nodes.length - 1)
   };
 }
-function createCleanupResult(mode, idsPreserved, before, after) {
+function createCleanupResult(mode2, idsPreserved, before, after) {
   return {
     activeNodeCountAfter: after.activeNodeCount,
     activeNodeCountBefore: before.activeNodeCount,
@@ -74493,7 +75556,7 @@ function createCleanupResult(mode, idsPreserved, before, after) {
     idsPreserved,
     loadInfoEntryCountAfter: after.loadInfoEntryCount,
     loadInfoEntryCountBefore: before.loadInfoEntryCount,
-    mode,
+    mode: mode2,
     reclaimedCachedPathEntryCount: before.cachedPathEntryCount - after.cachedPathEntryCount,
     reclaimedLoadInfoEntryCount: before.loadInfoEntryCount - after.loadInfoEntryCount,
     reclaimedNodeSlotCount: before.totalNodeSlotCount - after.totalNodeSlotCount,
@@ -74642,12 +75705,12 @@ function hasActiveCleanupBlockingLoads(state3) {
   for (const loadInfo of state3.directoryLoadInfoById.values()) if (loadInfo.state === "loading" && loadInfo.activeAttemptId != null) return true;
   return false;
 }
-function cleanupPathStoreState(state3, mode) {
+function cleanupPathStoreState(state3, mode2) {
   const before = createCleanupMetricSnapshot(state3);
-  if (mode === "stable") withBenchmarkPhase(state3.instrumentation, "store.cleanup.stable", () => runStableCleanup(state3));
+  if (mode2 === "stable") withBenchmarkPhase(state3.instrumentation, "store.cleanup.stable", () => runStableCleanup(state3));
   else withBenchmarkPhase(state3.instrumentation, "store.cleanup.aggressive", () => runAggressiveCleanup(state3));
   const after = createCleanupMetricSnapshot(state3);
-  return createCleanupResult(mode, mode === "stable", before, after);
+  return createCleanupResult(mode2, mode2 === "stable", before, after);
 }
 
 // node_modules/@pierre/trees/dist/path-store/src/projection.js
@@ -77883,35 +78946,35 @@ function OverflowMarker({ children, marker, variant = "default" }) {
 }
 function OverflowContent(options) {
   "use no memo";
-  const { mode, children } = options;
+  const { mode: mode2, children } = options;
   return /* @__PURE__ */ u25("div", { children: [/* @__PURE__ */ u25("div", {
     "data-truncate-content": "visible",
-    children: mode === "fruncate" ? /* @__PURE__ */ u25("span", { children }) : children
+    children: mode2 === "fruncate" ? /* @__PURE__ */ u25("span", { children }) : children
   }), /* @__PURE__ */ u25("div", {
     "data-truncate-content": "overflow",
     "aria-hidden": true,
-    children: mode === "fruncate" ? /* @__PURE__ */ u25("span", { children }) : children
+    children: mode2 === "fruncate" ? /* @__PURE__ */ u25("span", { children }) : children
   })] });
 }
-function OverflowText({ children, mode = "truncate", marker = "\u2026", variant = "default", ...props }) {
+function OverflowText({ children, mode: mode2 = "truncate", marker = "\u2026", variant = "default", ...props }) {
   "use no memo";
   const contentNode = /* @__PURE__ */ u25(OverflowContent, {
-    mode,
+    mode: mode2,
     children
   }, "content");
   const markerNode = /* @__PURE__ */ u25(OverflowMarker, {
     marker,
-    mode,
+    mode: mode2,
     variant
   }, "marker");
   const fillNode = /* @__PURE__ */ u25("div", { "data-truncate-fill": true }, "fill");
   return /* @__PURE__ */ u25("div", {
-    "data-truncate-container": mode,
+    "data-truncate-container": mode2,
     "data-truncate-variant": variant,
     ...props,
     children: /* @__PURE__ */ u25("div", {
       "data-truncate-grid": true,
-      children: mode === "truncate" ? [contentNode, markerNode] : [
+      children: mode2 === "truncate" ? [contentNode, markerNode] : [
         markerNode,
         contentNode,
         fillNode
@@ -78387,8 +79450,8 @@ function RenameInput({ ariaLabel, isFlattened = false, ref, value, onBlur, onInp
 
 // node_modules/@pierre/trees/dist/render/rowAttributes.js
 function computeFileTreeRowElementAttributes(input) {
-  const { row, mode, targetPath, ariaLabel, domId, isParked, itemHeight, features, state: state3, extraStyle } = input;
-  const isSticky = mode === "sticky";
+  const { row, mode: mode2, targetPath, ariaLabel, domId, isParked, itemHeight, features, state: state3, extraStyle } = input;
+  const isSticky = mode2 === "sticky";
   const parentPath = row.ancestorPaths.at(-1) ?? "";
   const stateAttributes = {};
   if (state3.isFocusRinged) stateAttributes["data-item-focused"] = true;
@@ -78430,7 +79493,7 @@ function computeFileTreeRowElementAttributes(input) {
 
 // node_modules/@pierre/trees/dist/render/rowClickPlan.js
 function computeFileTreeRowClickPlan(input) {
-  const { event: event2, mode, isSearchOpen, isDirectory } = input;
+  const { event: event2, mode: mode2, isSearchOpen, isDirectory } = input;
   const additive = event2.ctrlKey || event2.metaKey;
   const hasModifier = event2.shiftKey || additive;
   const selection = event2.shiftKey ? {
@@ -78439,7 +79502,7 @@ function computeFileTreeRowClickPlan(input) {
   } : additive ? { kind: "toggle" } : { kind: "single" };
   return {
     closeSearch: isSearchOpen,
-    revealCanonical: mode === "sticky",
+    revealCanonical: mode2 === "sticky",
     selection,
     toggleDirectory: !hasModifier && isDirectory
   };
@@ -78981,8 +80044,8 @@ function renderFileTreeRowContent(row, resolveIcon, { actionLaneEnabled = false,
 function renderStyledRow(frame, row, key2, options = {}) {
   const { controller, renameView, visualFocusPath, contextHoverPath, draggedPathSet, dragTarget, dragAndDropEnabled, shouldSuppressContextMenu, handleRowDragStart, handleRowDragEnd, handleRowTouchStart, instanceId: instanceId5, itemHeight, gitStatusByPath, ignoredGitDirectories, ignoredInheritanceCache, directoriesWithGitChanges, gitLaneActive, contextMenuEnabled, contextMenuTriggerMode, contextMenuButtonTriggerEnabled, contextMenuButtonVisibility, contextMenuRightClickEnabled, registerRenameInput, registerButton, resolveIcon, renderDecorationForRow, openContextMenuForRow, onRowClick, onKeyDown } = frame;
   const targetPath = getFileTreeRowPath(row);
-  const { isParked = false, mode = "flow", style } = options;
-  const isSticky = mode === "sticky";
+  const { isParked = false, mode: mode2 = "flow", style } = options;
+  const isSticky = mode2 === "sticky";
   const effectiveGitStatus = gitStatusByPath?.get(targetPath) ?? null ?? getInheritedIgnoredGitStatus(row.ancestorPaths, ignoredGitDirectories, ignoredInheritanceCache);
   const containsGitChange = row.kind === "directory" && (directoriesWithGitChanges?.has(targetPath) ?? false);
   const customDecoration = renderDecorationForRow(row, targetPath);
@@ -79028,7 +80091,7 @@ function renderStyledRow(frame, row, key2, options = {}) {
       },
       isParked,
       itemHeight,
-      mode,
+      mode: mode2,
       row,
       state: {
         containsGitChange,
@@ -79086,7 +80149,7 @@ function renderStyledRow(frame, row, key2, options = {}) {
       handleRowTouchStart(event2, row, targetPath);
     } : void 0,
     onClick: (event2) => {
-      onRowClick(event2, row, targetPath, mode);
+      onRowClick(event2, row, targetPath, mode2);
     },
     children: rowContent
   });
@@ -80250,7 +81313,7 @@ function FileTreeView({ composition, controller, gitStatusByPath, ignoredGitDire
     top: `${pointerAnchorRect.top}px`
   } : rowAnchorTop != null ? { top: `${rowAnchorTop}px` } : void 0;
   const contextMenuTriggerStyle = isPointerContextMenuOpen ? { opacity: "0" } : void 0;
-  const handleRowClick = b12((event2, row, targetPath, mode) => {
+  const handleRowClick = b12((event2, row, targetPath, mode2) => {
     const plan = computeFileTreeRowClickPlan({
       event: {
         ctrlKey: event2.ctrlKey,
@@ -80259,7 +81322,7 @@ function FileTreeView({ composition, controller, gitStatusByPath, ignoredGitDire
       },
       isDirectory: row.kind === "directory",
       isSearchOpen,
-      mode
+      mode: mode2
     });
     const shouldToggleDirectory = plan.toggleDirectory && row.kind === "directory";
     const mountedDirectoryPath = shouldToggleDirectory ? controller.resolveMountedDirectoryPathFromInput(targetPath) : null;
@@ -80278,7 +81341,7 @@ function FileTreeView({ composition, controller, gitStatusByPath, ignoredGitDire
     }
     const clickedElement = event2.currentTarget instanceof HTMLElement ? event2.currentTarget : null;
     const clickedRowIsVisible = row.index >= layoutSnapshot.visible.startIndex && row.index <= layoutSnapshot.visible.endIndex;
-    const shouldExposeFocusedTrigger = mode === "flow" && clickedRowIsVisible && clickedElement != null && clickedElement.dataset.itemParked !== "true";
+    const shouldExposeFocusedTrigger = mode2 === "flow" && clickedRowIsVisible && clickedElement != null && clickedElement.dataset.itemParked !== "true";
     controller.focusMountedPathFromInput(actionTargetPath);
     if (shouldExposeFocusedTrigger) {
       domFocusOwnerRef.current = true;
@@ -81189,6 +82252,7 @@ var elements = {
   "slicc-approvals": SliccApprovals,
   "slicc-secrets": SliccSecrets,
   "slicc-vault-button": SliccVaultButton,
+  "slicc-value-request": SliccValueRequest,
   "slicc-confirm": SliccConfirm,
   "slicc-prompt": SliccPrompt,
   "slicc-app": SliccApp
@@ -81227,10 +82291,12 @@ export {
   SliccPrompt,
   SliccSecrets,
   SliccUpdates,
+  SliccValueRequest,
   SliccVaultButton,
   confirm,
   define2 as define,
   grammarBase,
+  isVaultFailure,
   panelCommand,
   prompt,
   resolveColor,