@ai-matrx/vault 0.1.11 → 0.1.12

package/dist/index.js

@@ -324,9 +324,20 @@ var FingerprintGlyph = glyph(/* @__PURE__ */ jsxs2(Fragment, { children: [
 var SendGlyph = glyph(/* @__PURE__ */ jsx2("path", { d: "M14.5 21.7a.5.5 0 0 0 .9 0L22 3a.5.5 0 0 0-.6-.6L2.3 9.1a.5.5 0 0 0 0 .9l7.9 3.2a2 2 0 0 1 1.1 1.1zM21.9 2.1 10.9 13.1" }), [1, 1]);
 
 // src/auth/identity.ts
+var CONFIRM_RETURN_KEY = "matrx-vault:confirming-as";
+var RETURN_WINDOW_MS = 15 * 6e4;
 var SAME_PERSON = "That signed in a different account. Use the account this vault belongs to.";
 function createSupabaseIdentity(auth, options = {}) {
   let me = null;
+  const now = options.now ?? Date.now;
+  const store = () => {
+    if (options.store) return options.store;
+    try {
+      return globalThis.sessionStorage ?? null;
+    } catch {
+      return null;
+    }
+  };
   const who = async () => {
     const { data } = await auth.getUser();
     if (!data.user) throw new Error("You are signed out. Sign in again.");
@@ -343,10 +354,35 @@ function createSupabaseIdentity(auth, options = {}) {
       return { email: u.email ?? null, providers: [...names].filter((p) => p !== "email" && p !== "phone"), hasPassword: names.has("email") };
     },
     async withProvider(provider) {
-      await who();
+      const u = await who();
+      store()?.setItem(CONFIRM_RETURN_KEY, JSON.stringify({ id: u.id, email: u.email ?? null, at: now() }));
       const redirectTo = options.redirectTo?.() ?? globalThis.location?.href;
       const { error } = await auth.signInWithOAuth({ provider, ...redirectTo ? { options: { redirectTo } } : {} });
-      if (error) throw new Error(error.message);
+      if (error) {
+        store()?.removeItem(CONFIRM_RETURN_KEY);
+        throw new Error(error.message);
+      }
+    },
+    async checkReturn() {
+      const s = store();
+      const raw = s?.getItem(CONFIRM_RETURN_KEY) ?? null;
+      if (!s || raw === null) return null;
+      s.removeItem(CONFIRM_RETURN_KEY);
+      let expected;
+      try {
+        expected = JSON.parse(raw);
+      } catch {
+        return null;
+      }
+      if (typeof expected.id !== "string" || typeof expected.at !== "number" || now() - expected.at > RETURN_WINDOW_MS) return null;
+      const { data } = await auth.getUser();
+      if (!data.user || data.user.id === expected.id) return null;
+      const email = typeof expected.email === "string" && expected.email ? expected.email : null;
+      const message2 = `That signed in a different account, so it was signed out here.${email ? ` Sign in again as ${email}.` : " Sign in again."}`;
+      me = null;
+      if (options.onDifferentPerson) await options.onDifferentPerson(message2);
+      else await auth.signOut?.({ scope: "local" });
+      return message2;
     },
     async withPassword(password) {
       const u = await who();
@@ -392,6 +428,18 @@ var providerLabel = (p) => PROVIDER_LABEL[p] ?? p.charAt(0).toUpperCase() + p.sl
 function IdentityGate({ identity, children }) {
   const [asking, setAsking] = useState2(false);
   const waiters = useRef2([]);
+  const [returnProblem, setReturnProblem] = useState2(null);
+  useEffect2(() => {
+    if (!identity?.checkReturn) return;
+    let live = true;
+    identity.checkReturn().then(
+      (problem) => live && problem && setReturnProblem(problem),
+      (e) => live && setReturnProblem(e instanceof Error ? e.message : "The account that came back could not be checked.")
+    );
+    return () => {
+      live = false;
+    };
+  }, [identity]);
   const confirmed = async (run) => {
     try {
       return await run();
@@ -412,7 +460,14 @@ function IdentityGate({ identity, children }) {
   };
   return /* @__PURE__ */ jsxs3(Ctx2.Provider, { value: confirmed, children: [
     children,
-    identity ? /* @__PURE__ */ jsx3(ConfirmIdentityDialog, { open: asking, identity, onDone: () => settle(true), onCancel: () => settle(false) }) : null
+    identity ? /* @__PURE__ */ jsx3(ConfirmIdentityDialog, { open: asking, identity, onDone: () => settle(true), onCancel: () => settle(false) }) : null,
+    /* @__PURE__ */ jsx3(Dialog, { open: returnProblem !== null, onOpenChange: (o) => o ? void 0 : setReturnProblem(null), children: /* @__PURE__ */ jsxs3(DialogContent, { size: "sm", children: [
+      /* @__PURE__ */ jsxs3(DialogHeader, { children: [
+        /* @__PURE__ */ jsx3(DialogTitle, { children: "Different account" }),
+        /* @__PURE__ */ jsx3(DialogDescription, { children: returnProblem })
+      ] }),
+      /* @__PURE__ */ jsx3("div", { className: "flex justify-end", children: /* @__PURE__ */ jsx3(Button, { variant: "primary", onClick: () => setReturnProblem(null), children: "OK" }) })
+    ] }) })
   ] });
 }
 var wasCancelled = (e) => e instanceof Error && e.message === CANCELLED;
@@ -476,7 +531,7 @@ function ConfirmIdentityDialog({ open, identity, onDone, onCancel }) {
         e.preventDefault();
         if (password) void attempt(() => identity.withPassword(password));
       }, children: [
-        /* @__PURE__ */ jsx3(Field, { className: "min-w-0 flex-1", type: "password", autoComplete: "current-password", placeholder: "Your password", "aria-label": "Your password", value: password, onChange: (e) => setPassword(e.target.value) }),
+        /* @__PURE__ */ jsx3(Field, { className: "min-w-0 flex-1", type: "password", autoComplete: "current-password", placeholder: "Your password", "aria-label": "Your password", value: password, onChange: (e) => setPassword(e.target.value), autoFocus: true }),
         /* @__PURE__ */ jsx3(Button, { variant: "outline", type: "submit", disabled: busy || !password, children: "Confirm" })
       ] }) : null,
       account10?.email ? codeSent ? /* @__PURE__ */ jsxs3("form", { className: "flex gap-2", onSubmit: (e) => {
@@ -604,6 +659,12 @@ function Panel({ title, open = true, onClose, children, footer, size = "lg" }) {
     footer ? /* @__PURE__ */ jsx4(DialogFooter, { children: footer }) : null
   ] }) });
 }
+function PanelFooter({ status, children }) {
+  return /* @__PURE__ */ jsxs4("div", { className: "flex w-full flex-wrap items-center justify-end gap-2", children: [
+    status ? /* @__PURE__ */ jsx4("div", { className: "min-w-0 flex-1 basis-full sm:basis-0", children: status }) : null,
+    children
+  ] });
+}
 var DAY_FORMAT = { year: "numeric", month: "short", day: "numeric" };
 
 // src/FieldRows.tsx
@@ -614,7 +675,7 @@ function SecretText({ value, multiline }) {
   return /* @__PURE__ */ jsx5("span", { className: "break-all font-mono text-sm tracking-wide", children: [...value].map((ch, i) => /* @__PURE__ */ jsx5("span", { className: /[0-9]/.test(ch) ? "text-primary" : /[^A-Za-z0-9]/.test(ch) ? "text-warning" : void 0, children: ch }, i)) });
 }
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
-function SecretRow({ port, item, field, extra }) {
+function SecretRow({ port, item, field, extra, onTurnOn }) {
   const confirmed = useConfirmed();
   const copyValue2 = useCopy();
   const secret = useTransientSecret();
@@ -668,10 +729,27 @@ function SecretRow({ port, item, field, extra }) {
       top: multiline && shown !== null,
       actions: /* @__PURE__ */ jsxs5(Fragment2, { children: [
         extra,
+        off && onTurnOn ? /* @__PURE__ */ jsx5(TurnOnButton, { label: field.label, onTurnOn }) : null,
         canSee && !visible ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: secret.value !== null ? /* @__PURE__ */ jsx5(EyeOffGlyph, {}) : /* @__PURE__ */ jsx5(EyeGlyph, {}), "aria-label": secret.value !== null ? `Hide ${field.label}` : `Show ${field.label}`, disabled: busy, onClick: () => void toggle2() }) : null,
         canSee ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: /* @__PURE__ */ jsx5(CopyIcon, {}), "aria-label": `Copy ${field.label}`, disabled: busy, onClick: () => void copy() }) : null
       ] }),
-      children: sealed ? /* @__PURE__ */ jsx5(Badge, { icon: /* @__PURE__ */ jsx5(LockGlyph, {}), children: "Sealed" }) : off ? /* @__PURE__ */ jsx5("span", { className: "text-muted-foreground", children: "Turned off" }) : error ? /* @__PURE__ */ jsx5("span", { className: "truncate text-destructive", title: error, children: error }) : shown !== null ? visible ? /* @__PURE__ */ jsx5("span", { className: cn3("block", multiline ? "whitespace-pre-wrap break-words" : "truncate"), children: shown || "\u2014" }) : /* @__PURE__ */ jsx5(SecretText, { value: shown, multiline }) : /* @__PURE__ */ jsx5("span", { className: cn3("block truncate text-muted-foreground", !visible && "tracking-widest"), children: visible ? "\u2026" : MASK })
+      children: sealed ? /* @__PURE__ */ jsx5(Badge, { icon: /* @__PURE__ */ jsx5(LockGlyph, {}), children: "Never shown" }) : off ? /* @__PURE__ */ jsx5("span", { className: "text-muted-foreground", children: "Turned off" }) : error ? /* @__PURE__ */ jsx5("span", { className: "truncate text-destructive", title: error, children: error }) : shown !== null ? visible ? /* @__PURE__ */ jsx5("span", { className: cn3("block", multiline ? "whitespace-pre-wrap break-words" : "truncate"), children: shown || "\u2014" }) : /* @__PURE__ */ jsx5(SecretText, { value: shown, multiline }) : /* @__PURE__ */ jsx5("span", { className: cn3("block truncate text-muted-foreground", !visible && "tracking-widest"), children: visible ? "\u2026" : MASK })
+    }
+  );
+}
+function TurnOnButton({ label, onTurnOn }) {
+  const [busy, setBusy] = useState5(false);
+  return /* @__PURE__ */ jsx5(
+    Button2,
+    {
+      variant: "outline",
+      "aria-label": `Turn on ${label}`,
+      disabled: busy,
+      onClick: () => {
+        setBusy(true);
+        void onTurnOn().finally(() => setBusy(false));
+      },
+      children: "Turn on"
     }
   );
 }
@@ -810,14 +888,27 @@ function loginSiteOf(item) {
     return raw.replace(/^https?:\/\//, "").replace(/^www\./, "").split("/")[0] ?? "";
   }
 }
+var TWO_PART_SUFFIX = /* @__PURE__ */ new Set(["co", "com", "org", "net", "gov", "edu", "ac", "ne", "or"]);
+function siteDomainOf(host) {
+  const h = host.toLowerCase().replace(/\.$/, "");
+  if (!h || /^[\d.]+$/.test(h) || h.includes(":")) return h;
+  const labels = h.split(".").filter(Boolean);
+  if (labels.length <= 2) return labels.join(".");
+  const sld = labels[labels.length - 2] ?? "";
+  const tld = labels[labels.length - 1] ?? "";
+  const keep = TWO_PART_SUFFIX.has(sld) && tld.length <= 3 ? 3 : 2;
+  return labels.slice(-keep).join(".");
+}
 function sortItems(items, sort) {
   const out = [...items];
   const byName = (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" });
   if (sort === "name") return out.sort(byName);
-  if (sort === "website") return out.sort((a, b) => {
-    const x = loginSiteOf(a), y = loginSiteOf(b);
-    return x && y ? x.localeCompare(y) || byName(a, b) : x ? -1 : y ? 1 : byName(a, b);
-  });
+  if (sort === "website")
+    return out.sort((a, b) => {
+      const x = loginSiteOf(a), y = loginSiteOf(b);
+      if (!x || !y) return x ? -1 : y ? 1 : byName(a, b);
+      return siteDomainOf(x).localeCompare(siteDomainOf(y)) || x.localeCompare(y) || byName(a, b);
+    });
   if (sort === "updated") return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return out.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
@@ -1208,7 +1299,7 @@ import { useEffect as useEffect6, useRef as useRef4, useState as useState6 } fro
 import { Button as Button3 } from "@ai-matrx/design-system/controls";
 import { cn as cn4 } from "@ai-matrx/design-system";
 import { formatAbsoluteDate } from "@ai-matrx/kit/format";
-import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
+import { Fragment as Fragment3, jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 var PAGE = 50;
 var MAX = 500;
 function ActivityPanel({ item, port, onClose }) {
@@ -1237,7 +1328,10 @@ function ActivityPanel({ item, port, onClose }) {
     {
       title: "Activity",
       onClose,
-      footer: hasMore ? /* @__PURE__ */ jsx6(Button3, { variant: "outline", disabled: loading, onClick: () => setLimit((n) => Math.min(MAX, n * 2)), children: loading ? "Loading\u2026" : "Show more" }) : void 0,
+      footer: /* @__PURE__ */ jsxs6(Fragment3, { children: [
+        hasMore ? /* @__PURE__ */ jsx6(Button3, { variant: "outline", disabled: loading, onClick: () => setLimit((n) => Math.min(MAX, n * 2)), children: loading ? "Loading\u2026" : "Show more" }) : null,
+        /* @__PURE__ */ jsx6(Button3, { variant: "primary", onClick: onClose, children: "Done" })
+      ] }),
       children: [
         error ? /* @__PURE__ */ jsx6("p", { role: "alert", className: "px-1 text-sm text-destructive", children: error }) : null,
         entries === null ? loading ? /* @__PURE__ */ jsx6(Empty, { children: "Reading activity\u2026" }) : null : entries.length === 0 ? /* @__PURE__ */ jsx6(Empty, { children: "Nothing has happened yet." }) : groupByDay(entries, now).map((day) => /* @__PURE__ */ jsx6(VaultSection, { title: day.label, children: collapseRuns(
@@ -1260,7 +1354,7 @@ function ActivityPanel({ item, port, onClose }) {
 }
 
 // src/activity/HistoryPanel.tsx
-import { Fragment as Fragment3, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
+import { Fragment as Fragment4, jsx as jsx7, jsxs as jsxs7 } from "react/jsx-runtime";
 var MASK2 = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 var messageOf = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
 function ItemHistoryPanel({ item, port, arg, onClose, onChanged }) {
@@ -1320,8 +1414,11 @@ function ItemHistoryPanel({ item, port, arg, onClose, onChanged }) {
     {
       title: "Password history",
       onClose,
-      footer: page?.nextBefore ? /* @__PURE__ */ jsx7(Button4, { variant: "outline", disabled: more, onClick: () => void loadMore(), children: more ? "Loading\u2026" : "Show earlier" }) : void 0,
-      children: !eligible ? /* @__PURE__ */ jsx7(Empty, { children: "History is kept only for your own items." }) : loading && !page ? /* @__PURE__ */ jsx7(Empty, { children: "Reading history\u2026" }) : /* @__PURE__ */ jsxs7(Fragment3, { children: [
+      footer: /* @__PURE__ */ jsxs7(Fragment4, { children: [
+        page?.nextBefore ? /* @__PURE__ */ jsx7(Button4, { variant: "outline", disabled: more, onClick: () => void loadMore(), children: more ? "Loading\u2026" : "Show earlier" }) : null,
+        /* @__PURE__ */ jsx7(Button4, { variant: "primary", onClick: onClose, children: "Done" })
+      ] }),
+      children: !eligible ? /* @__PURE__ */ jsx7(Empty, { children: "History is kept only for your own items." }) : loading && !page ? /* @__PURE__ */ jsx7(Empty, { children: "Reading history\u2026" }) : /* @__PURE__ */ jsxs7(Fragment4, { children: [
         error ? /* @__PURE__ */ jsx7("p", { role: "alert", className: "px-1 text-sm text-destructive", children: error }) : null,
         notice ? /* @__PURE__ */ jsx7("p", { role: "status", className: "px-1 text-sm text-success", children: notice }) : null,
         page && groups.length === 0 ? /* @__PURE__ */ jsx7(Empty, { children: "No earlier values yet." }) : null,
@@ -1389,7 +1486,7 @@ function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, on
     VaultRow,
     {
       label: when,
-      actions: entry.available ? /* @__PURE__ */ jsxs7(Fragment3, { children: [
+      actions: entry.available ? /* @__PURE__ */ jsxs7(Fragment4, { children: [
         /* @__PURE__ */ jsx7(Button4, { variant: "quiet", icon: secret.value !== null ? /* @__PURE__ */ jsx7(EyeOffGlyph, {}) : /* @__PURE__ */ jsx7(EyeGlyph, {}), "aria-label": secret.value !== null ? "Hide" : "Show", disabled: busy, onClick: () => void toggle2() }),
         /* @__PURE__ */ jsx7(Button4, { variant: "quiet", icon: /* @__PURE__ */ jsx7(CopyIcon2, {}), "aria-label": "Copy", disabled: busy, onClick: () => void copy() }),
         canRestore(page, entry) ? /* @__PURE__ */ jsx7(Button4, { variant: "quiet", icon: /* @__PURE__ */ jsx7(RestoreGlyph, {}), "aria-label": "Restore", disabled: busy, onClick: () => void restore() }) : null
@@ -1723,7 +1820,7 @@ function imageFrom(data) {
 }
 
 // src/authenticator/Setup.tsx
-import { Fragment as Fragment4, jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+import { Fragment as Fragment5, jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
 function useCanScan() {
   const [ok, setOk] = useState10(false);
   useEffect10(() => {
@@ -1856,7 +1953,7 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
           VaultRow,
           {
             label,
-            actions: /* @__PURE__ */ jsxs9(Fragment4, { children: [
+            actions: /* @__PURE__ */ jsxs9(Fragment5, { children: [
               /* @__PURE__ */ jsx9(Button6, { variant: "quiet", icon: /* @__PURE__ */ jsx9(QrGlyph, {}), "aria-label": "Choose QR image", title: "Choose or drop a QR image", disabled: disabled || reading, onClick: () => file.current?.click() }),
               canScan ? /* @__PURE__ */ jsx9(Button6, { variant: "quiet", icon: /* @__PURE__ */ jsx9(CameraGlyph, {}), "aria-label": "Scan with camera", title: "Scan with camera", disabled, onClick: () => setScanning(true) }) : null
             ] }),
@@ -1925,13 +2022,14 @@ import { confirm as confirm2 } from "@ai-matrx/kit/confirm-opener";
 
 // src/authenticator/port.ts
 var MFA_METHOD_KEY = "mfa_method";
+var OTP_SEED_KEY = "totp_seed";
 function mfaMethodOf(item) {
   const v = item.custom.find((c) => c.key === MFA_METHOD_KEY)?.value;
   return v === "sms" ? "sms" : v ? "push_or_other" : null;
 }
 
 // src/authenticator/TotpRows.tsx
-import { Fragment as Fragment5, jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+import { Fragment as Fragment6, jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
 function otpActionError(e, what) {
   const status = e?.status;
   if (status === 404) return "There is no one-time password here.";
@@ -2006,7 +2104,7 @@ function TotpRow({ port, item, onChanged }) {
     VaultRow,
     {
       label: "One-time password",
-      actions: /* @__PURE__ */ jsxs10(Fragment5, { children: [
+      actions: /* @__PURE__ */ jsxs10(Fragment6, { children: [
         a.enabled ? /* @__PURE__ */ jsx10(CopyCodeButton, { live, label: item.name }) : null,
         menu
       ] }),
@@ -2089,7 +2187,7 @@ function TwoFactorMethodRow({ port, item, onChanged }) {
 }
 
 // src/authenticator/AddOtpPanel.tsx
-import { Fragment as Fragment6, jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
+import { Fragment as Fragment7, jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
 var NEW = "__new__";
 var LOGIN_KEYS = ["website_login", "username_password"];
 function normalizeWebsite(raw) {
@@ -2172,7 +2270,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       title: "Add one-time password",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs11(Fragment6, { children: [
+      footer: /* @__PURE__ */ jsxs11(Fragment7, { children: [
         /* @__PURE__ */ jsx11(Button8, { variant: "quiet", onClick: onClose, disabled: busy, children: "Cancel" }),
         /* @__PURE__ */ jsx11(Button8, { variant: "primary", disabled: !ready, onClick: () => void save(), children: busy ? "Adding\u2026" : "Add" })
       ] }),
@@ -2212,7 +2310,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
               }
             }
           ) }),
-          isNew ? /* @__PURE__ */ jsxs11(Fragment6, { children: [
+          isNew ? /* @__PURE__ */ jsxs11(Fragment7, { children: [
             /* @__PURE__ */ jsx11(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx11(
               Field4,
               {
@@ -2244,7 +2342,7 @@ function AddedPanel({ port, item, onClose, onDone }) {
 }
 
 // src/authenticator/AuthenticatorView.tsx
-import { Fragment as Fragment7, jsx as jsx12, jsxs as jsxs12 } from "react/jsx-runtime";
+import { Fragment as Fragment8, jsx as jsx12, jsxs as jsxs12 } from "react/jsx-runtime";
 function matchesEntry(entry, q) {
   if (!entry || !q) return false;
   return [entry.issuer, entry.account].some((v) => v?.toLowerCase().includes(q));
@@ -2283,7 +2381,7 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
   return /* @__PURE__ */ jsxs12("section", { "aria-label": "One-time passwords", className: "flex h-full min-h-0 flex-col bg-background", children: [
-    header,
+    header ? /* @__PURE__ */ jsx12("div", { className: "mx-auto w-full max-w-3xl px-3 pt-3 sm:px-4", children: header }) : null,
     /* @__PURE__ */ jsxs12("div", { className: "flex min-h-12 items-center justify-between gap-2 px-4 pb-1 pt-3", children: [
       /* @__PURE__ */ jsxs12("div", { className: "flex min-w-0 items-baseline gap-2", children: [
         /* @__PURE__ */ jsx12("h2", { className: "truncate text-sm font-semibold text-foreground", children: "One-time passwords" }),
@@ -2295,7 +2393,7 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
       /* @__PURE__ */ jsx12("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ jsx12(ShieldGlyph, { className: "size-6" }) }),
       /* @__PURE__ */ jsx12("p", { className: "text-sm font-medium text-foreground", children: "No one-time passwords yet" }),
       /* @__PURE__ */ jsx12(Button9, { variant: "primary", icon: /* @__PURE__ */ jsx12(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add one-time password" })
-    ] }) : groups.length === 0 ? /* @__PURE__ */ jsx12("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: "Nothing matches." }) : /* @__PURE__ */ jsx12("div", { className: "min-h-0 flex-1 overflow-y-auto px-3 pb-6 pt-1 sm:px-4", children: /* @__PURE__ */ jsx12("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5", children: groups.map((g) => /* @__PURE__ */ jsx12(VaultSection, { ...groups.length > 1 ? { title: g.label } : {}, className: "[&>div]:px-1", children: g.items.map((item) => /* @__PURE__ */ jsx12(
+    ] }) : groups.length === 0 ? /* @__PURE__ */ jsx12("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: "Nothing matches." }) : /* @__PURE__ */ jsx12("div", { className: "min-h-0 flex-1 overflow-y-auto px-3 pb-6 pt-1 sm:px-4", children: /* @__PURE__ */ jsx12("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5", children: groups.map((g) => /* @__PURE__ */ jsx12(VaultSection, { title: g.label, className: "[&>div]:px-1", children: g.items.map((item) => /* @__PURE__ */ jsx12(
       OtpListRow,
       {
         port,
@@ -2392,7 +2490,7 @@ function OtpListRow({ port, item, family, entry, onOpen, onRename, onChanged, on
           /* @__PURE__ */ jsx12(CopyIcon4, { className: "size-4" }),
           "Copy code"
         ] }) : null,
-        canManage ? /* @__PURE__ */ jsxs12(Fragment7, { children: [
+        canManage ? /* @__PURE__ */ jsxs12(Fragment8, { children: [
           /* @__PURE__ */ jsxs12(DropdownMenuItem2, { onSelect: onRename, children: [
             /* @__PURE__ */ jsx12(PencilGlyph, { className: "size-4" }),
             "Rename"
@@ -2432,9 +2530,9 @@ function sandboxBlocker(envKeyDraft, savedEnvKey) {
   return null;
 }
 var HANDLING_WORDS = {
-  visible: { label: "Anyone", hint: "Anyone who can use it can show or copy it" },
-  revealable: { label: "On request", hint: "Showing or copying it needs reveal access" },
-  sealed: { label: "Sealed", hint: "No one can see it. Automation can still use it." }
+  visible: { label: "Always shown", hint: "Anyone who can use it can show or copy it" },
+  revealable: { label: "Hidden", hint: "Showing or copying it needs reveal access" },
+  sealed: { label: "Never shown", hint: "No one can see it. Automation can still use it." }
 };
 function handlingChoices(current) {
   return current === "sealed" ? ["sealed"] : ["visible", "revealable", "sealed"];
@@ -2616,7 +2714,7 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
         }
       ) }),
       /* @__PURE__ */ jsx13(VaultRow, { label: "Editable", hint: quietHint(field.editable ? "The value can be changed" : "The value is locked"), children: /* @__PURE__ */ jsx13(Switch, { "aria-label": "Editable", checked: field.editable, disabled: locked, onCheckedChange: (v) => void update("editable", { editable: v }) }) }),
-      /* @__PURE__ */ jsx13(VaultRow, { label: "Active", hint: quietHint(field.active ? "In use" : "Kept, but nothing uses it"), children: /* @__PURE__ */ jsx13(Switch, { "aria-label": "Active", checked: field.active, disabled: locked, onCheckedChange: (v) => void update("active", { active: v }) }) })
+      /* @__PURE__ */ jsx13(VaultRow, { label: "Turned on", hint: quietHint(field.active ? "In use" : "Kept, but nothing uses it"), children: /* @__PURE__ */ jsx13(Switch, { "aria-label": "Turned on", checked: field.active, disabled: locked, onCheckedChange: (v) => void update("active", { active: v }) }) })
     ] }),
     error ? /* @__PURE__ */ jsx13(Problem, { children: error }) : null
   ] });
@@ -2684,7 +2782,7 @@ function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
               f.envKey
             ] }) : null,
             f.injectIntoSandbox ? /* @__PURE__ */ jsx13("span", { className: "text-muted-foreground", children: " \xB7 Sandbox" }) : null,
-            !f.active ? /* @__PURE__ */ jsx13("span", { className: "text-disabled-foreground", children: " \xB7 Off" }) : null
+            !f.active ? /* @__PURE__ */ jsx13("span", { className: "text-warning", children: " \xB7 Turned off" }) : null
           ] })
         },
         f.id
@@ -3080,7 +3178,7 @@ function startNewRestoreRun(preview) {
 import { useState as useState16 } from "react";
 import { Checkbox } from "@ai-matrx/design-system";
 import { Badge as Badge4, Button as Button12, DisclosureHeader as DisclosureHeader2 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment8, jsx as jsx15, jsxs as jsxs15 } from "react/jsx-runtime";
+import { Fragment as Fragment9, jsx as jsx15, jsxs as jsxs15 } from "react/jsx-runtime";
 function PickLine({ checked, onChange, disabled = false, title, detail, badge, tone }) {
   return /* @__PURE__ */ jsxs15("label", { className: "flex min-h-11 items-center gap-3 px-4 py-1", "data-clickable": disabled ? void 0 : "", children: [
     /* @__PURE__ */ jsx15(Checkbox, { checked, disabled, onCheckedChange: (v) => onChange(v === true), "aria-label": title }),
@@ -3092,7 +3190,7 @@ function PickLine({ checked, onChange, disabled = false, title, detail, badge, t
 function Windowed({ items, size = 150, render }) {
   const [all, setAll] = useState16(false);
   const shown = all ? items : items.slice(0, size);
-  return /* @__PURE__ */ jsxs15(Fragment8, { children: [
+  return /* @__PURE__ */ jsxs15(Fragment9, { children: [
     shown.map(render),
     items.length > shown.length ? /* @__PURE__ */ jsx15("div", { className: "px-4 py-2", children: /* @__PURE__ */ jsxs15(Button12, { variant: "quiet", onClick: () => setAll(true), children: [
       "Show all ",
@@ -3113,7 +3211,7 @@ function ErrorLine({ message: message2 }) {
 var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 
 // src/io/BackupPanel.tsx
-import { Fragment as Fragment9, jsx as jsx16, jsxs as jsxs16 } from "react/jsx-runtime";
+import { Fragment as Fragment10, jsx as jsx16, jsxs as jsxs16 } from "react/jsx-runtime";
 var RECORD_STATUS = {
   created: "Restored",
   replayed: "Already restored",
@@ -3241,13 +3339,13 @@ function BackupPanel({ port, items, onClose, onChanged }) {
   const retryable = (result?.retryable_failure ?? 0) > 0;
   const mismatch = repeat !== "" && repeat !== passphrase;
   const names = new Map(restorePreview?.records.map((r) => [r.source_item_id, r.display_name]) ?? []);
-  const footer = mode === "backup" ? /* @__PURE__ */ jsxs16(Fragment9, { children: [
+  const footer = mode === "backup" ? /* @__PURE__ */ jsxs16(Fragment10, { children: [
     /* @__PURE__ */ jsx16(Button13, { variant: "quiet", onClick: onClose, children: "Close" }),
     backup ? /* @__PURE__ */ jsx16(Button13, { variant: "primary", disabled: busy || !passphrase || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
       "Review ",
       selected.size
     ] })
-  ] }) : /* @__PURE__ */ jsxs16(Fragment9, { children: [
+  ] }) : /* @__PURE__ */ jsxs16(Fragment10, { children: [
     /* @__PURE__ */ jsx16(Button13, { variant: "quiet", onClick: onClose, children: result && !retryable ? "Done" : "Close" }),
     result ? retryable ? /* @__PURE__ */ jsx16(Button13, { variant: "primary", disabled: busy, onClick: () => void restore(), children: "Try again" }) : /* @__PURE__ */ jsx16(Button13, { variant: "outline", disabled: busy, onClick: () => void again(), children: "Restore again" }) : restorePreview ? /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || restorePreview.omissions.length > 0 && !accepted, onClick: () => void restore(), children: [
       "Restore ",
@@ -3268,12 +3366,12 @@ function BackupPanel({ port, items, onClose, onChanged }) {
         ]
       }
     ),
-    mode === "backup" ? /* @__PURE__ */ jsxs16(Fragment9, { children: [
+    mode === "backup" ? /* @__PURE__ */ jsxs16(Fragment10, { children: [
       /* @__PURE__ */ jsx16(
         VaultSection,
         {
           title: `${selected.size} of ${plural(items.length, "credential")}`,
-          actions: /* @__PURE__ */ jsxs16(Fragment9, { children: [
+          actions: /* @__PURE__ */ jsxs16(Fragment10, { children: [
             /* @__PURE__ */ jsx16(Button13, { variant: "quiet", disabled: busy || items.length === 0, onClick: () => {
               setBackup(null);
               setSelected(new Set(items.map((i) => i.id)));
@@ -3286,7 +3384,7 @@ function BackupPanel({ port, items, onClose, onChanged }) {
           children: items.length === 0 ? /* @__PURE__ */ jsx16(Empty, { children: "Nothing to back up yet." }) : /* @__PURE__ */ jsx16(Windowed, { items, render: (i) => /* @__PURE__ */ jsx16(PickLine, { title: i.name, detail: i.definitionLabel, checked: selected.has(i.id), disabled: busy, onChange: (on) => pick(i.id, on) }, i.id) })
         }
       ),
-      backup ? /* @__PURE__ */ jsxs16(Fragment9, { children: [
+      backup ? /* @__PURE__ */ jsxs16(Fragment10, { children: [
         /* @__PURE__ */ jsx16(Summary, { value: backup }),
         /* @__PURE__ */ jsx16(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
         /* @__PURE__ */ jsxs16(VaultSection, { children: [
@@ -3294,7 +3392,7 @@ function BackupPanel({ port, items, onClose, onChanged }) {
           /* @__PURE__ */ jsx16(VaultRow, { label: "Repeat", ...mismatch ? { hint: "Doesn't match" } : {}, children: /* @__PURE__ */ jsx16(Field6, { type: "password", value: repeat, autoComplete: "new-password", "aria-label": "Repeat the passphrase", onChange: (e) => setRepeat(e.target.value) }) })
         ] })
       ] }) : null
-    ] }) : /* @__PURE__ */ jsx16(Fragment9, { children: !restorePreview ? /* @__PURE__ */ jsxs16(VaultSection, { children: [
+    ] }) : /* @__PURE__ */ jsx16(Fragment10, { children: !restorePreview ? /* @__PURE__ */ jsxs16(VaultSection, { children: [
       /* @__PURE__ */ jsxs16(VaultRow, { label: "File", ...file ? { hint: file.name } : {}, children: [
         /* @__PURE__ */ jsx16(Button13, { variant: "outline", disabled: busy, onClick: () => fileInput.current?.click(), children: "Choose a backup" }),
         /* @__PURE__ */ jsx16(
@@ -3312,7 +3410,7 @@ function BackupPanel({ port, items, onClose, onChanged }) {
         )
       ] }),
       /* @__PURE__ */ jsx16(VaultRow, { label: "Passphrase", children: /* @__PURE__ */ jsx16(Field6, { type: "password", value: passphrase, autoComplete: "current-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) })
-    ] }) : /* @__PURE__ */ jsxs16(Fragment9, { children: [
+    ] }) : /* @__PURE__ */ jsxs16(Fragment10, { children: [
       /* @__PURE__ */ jsx16(Summary, { value: restorePreview }),
       !result ? /* @__PURE__ */ jsx16(Omissions, { omissions: restorePreview.omissions, accepted, onAccepted: setAccepted, verb: "Restore" }) : null,
       !result ? /* @__PURE__ */ jsx16("p", { className: "px-1 text-xs text-muted-foreground", children: "Restored items start disabled and restricted." }) : /* @__PURE__ */ jsx16(VaultSection, { title: `${result.created} restored \xB7 ${result.replayed} already \xB7 ${result.refused} refused \xB7 ${result.retryable_failure} to retry`, children: result.results.map((r) => /* @__PURE__ */ jsx16(VaultRow, { label: names.get(r.source_item_id) ?? "Credential", children: /* @__PURE__ */ jsxs16("span", { className: r.status === "refused" || r.status === "retryable_failure" ? "text-destructive" : "text-foreground", children: [
@@ -3329,7 +3427,7 @@ import { useMemo, useState as useState18 } from "react";
 import { Button as Button14, Select as Select5 } from "@ai-matrx/design-system/controls";
 import { downloadFile as downloadFile2 } from "@ai-matrx/kit/download";
 import { confirm as confirm5 } from "@ai-matrx/kit/confirm-opener";
-import { Fragment as Fragment10, jsx as jsx17, jsxs as jsxs17 } from "react/jsx-runtime";
+import { Fragment as Fragment11, jsx as jsx17, jsxs as jsxs17 } from "react/jsx-runtime";
 var FORMATS = [
   { value: "matrx_login_csv_v1", label: "Matrx", hint: "Website logins, all common fields" },
   { value: "firefox_csv_v1", label: "Firefox", hint: "Address, username and password" },
@@ -3409,7 +3507,7 @@ function ExportPanel({ port, items, onClose }) {
       title: "Export logins",
       size: "lg",
       onClose,
-      footer: /* @__PURE__ */ jsxs17(Fragment10, { children: [
+      footer: /* @__PURE__ */ jsxs17(Fragment11, { children: [
         /* @__PURE__ */ jsx17(Button14, { variant: "quiet", onClick: onClose, children: "Close" }),
         preview ? /* @__PURE__ */ jsxs17(Button14, { variant: "primary", icon: /* @__PURE__ */ jsx17(ExportGlyph, { className: "size-4" }), disabled: busy || eligible === 0, onClick: () => void download(), children: [
           "Download ",
@@ -3436,7 +3534,7 @@ function ExportPanel({ port, items, onClose }) {
           VaultSection,
           {
             title: `${selected.size} of ${plural(logins.length, "login")}`,
-            actions: /* @__PURE__ */ jsxs17(Fragment10, { children: [
+            actions: /* @__PURE__ */ jsxs17(Fragment11, { children: [
               /* @__PURE__ */ jsx17(Button14, { variant: "quiet", disabled: busy || logins.length === 0, onClick: () => {
                 changed();
                 setSelected(new Set(logins.map((l) => l.id)));
@@ -4318,7 +4416,7 @@ async function parseImportFile(source, file, limits, signal) {
 }
 
 // src/io/ImportPanel.tsx
-import { Fragment as Fragment11, jsx as jsx18, jsxs as jsxs18 } from "react/jsx-runtime";
+import { Fragment as Fragment12, jsx as jsx18, jsxs as jsxs18 } from "react/jsx-runtime";
 var ROLE_OPTIONS = [
   { value: "keep", label: "Keep encrypted" },
   { value: "title", label: "Name" },
@@ -4493,13 +4591,13 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
   const help = EXPORT_HELP[source];
   const stage = done ? "done" : draft ? "review" : "choose";
   const busy = running !== null || reading;
-  const footer = stage === "choose" ? /* @__PURE__ */ jsxs18(Fragment11, { children: [
+  const footer = stage === "choose" ? /* @__PURE__ */ jsxs18(Fragment12, { children: [
     /* @__PURE__ */ jsx18(Button15, { variant: "quiet", onClick: onClose, children: "Close" }),
     source === "env" ? /* @__PURE__ */ jsx18(Button15, { variant: "primary", icon: /* @__PURE__ */ jsx18(ImportGlyph, { className: "size-4" }), disabled: !envText.trim(), onClick: () => reviewEnv(envText), children: "Review" }) : null
-  ] }) : stage === "review" ? /* @__PURE__ */ jsxs18(Fragment11, { children: [
+  ] }) : stage === "review" ? /* @__PURE__ */ jsxs18(Fragment12, { children: [
     running ? /* @__PURE__ */ jsx18(Button15, { variant: "outline", onClick: () => stop.current = true, children: "Stop" }) : /* @__PURE__ */ jsx18(Button15, { variant: "quiet", onClick: reset, children: "Back" }),
     /* @__PURE__ */ jsx18(Button15, { variant: "primary", icon: /* @__PURE__ */ jsx18(ImportGlyph, { className: "size-4" }), disabled: busy || chosen === 0 || ambiguous === true || needsApproval, onClick: start, children: running ? `Importing ${running.done} of ${running.total}` : `Import ${chosen}` })
-  ] }) : /* @__PURE__ */ jsxs18(Fragment11, { children: [
+  ] }) : /* @__PURE__ */ jsxs18(Fragment12, { children: [
     done && done.failed.length + done.untried.length > 0 ? /* @__PURE__ */ jsx18(Button15, { variant: "outline", disabled: busy, onClick: retry, children: running ? `Importing ${running.done} of ${running.total}` : `Try ${done.failed.length + done.untried.length} again` }) : null,
     /* @__PURE__ */ jsx18(Button15, { variant: "primary", onClick: onClose, children: "Done" })
   ] });
@@ -4529,13 +4627,13 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
       ] }),
       source === "env" ? /* @__PURE__ */ jsx18(VaultRow, { label: "Sandboxes", hint: "Pass these values to agent sandboxes", children: /* @__PURE__ */ jsx18(Switch4, { checked: injectSandbox, onCheckedChange: setInjectSandbox, "aria-label": "Use in sandboxes" }) }) : null
     ] }) : null,
-    stage === "review" && draft ? /* @__PURE__ */ jsxs18(Fragment11, { children: [
+    stage === "review" && draft ? /* @__PURE__ */ jsxs18(Fragment12, { children: [
       organizations.length > 0 ? /* @__PURE__ */ jsx18(VaultSection, { children: /* @__PURE__ */ jsx18(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx18(Select6, { value: destination, options: destinationOptions, "aria-label": "Save to", onValueChange: (v) => draft.kind === "file" ? restart({ destination: v }) : setDestination(v) }) }) }) : null,
       /* @__PURE__ */ jsx18(
         VaultSection,
         {
           title: draft.kind === "env" ? plural(envKeys.length, "value") : summary(counts, lines.length),
-          actions: /* @__PURE__ */ jsxs18(Fragment11, { children: [
+          actions: /* @__PURE__ */ jsxs18(Fragment12, { children: [
             /* @__PURE__ */ jsx18(Button15, { variant: "quiet", disabled: busy, onClick: () => setSelected(draft.kind === "env" ? new Set(envKeys.map((e) => e.key + e.text)) : defaultSelection(lines)), children: "Reset" }),
             /* @__PURE__ */ jsx18(Button15, { variant: "quiet", disabled: busy, onClick: () => setSelected(/* @__PURE__ */ new Set()), children: "None" })
           ] }),
@@ -4629,7 +4727,7 @@ import { jsx as jsx19 } from "react/jsx-runtime";
 function ItemIcon({ definitionKey, family, site, size = "md", inverted = false }) {
   const box = size === "lg" ? "size-10 rounded-xl text-base" : size === "md" ? "size-8 rounded-lg text-sm" : "size-6 rounded-md text-xs";
   const tone = inverted ? "bg-primary-foreground text-primary" : "bg-muted text-foreground";
-  const initial = site.replace(/^(app|my|login|accounts|signin|auth|console|portal|admin|www)\./, "").charAt(0).toUpperCase();
+  const initial = siteDomainOf(site).charAt(0).toUpperCase();
   if (initial && /[A-Z0-9]/.test(initial)) {
     return /* @__PURE__ */ jsx19("span", { "aria-hidden": true, className: cn8("flex shrink-0 items-center justify-center font-semibold", box, tone), children: initial });
   }
@@ -4652,13 +4750,13 @@ import { cn as cn9 } from "@ai-matrx/design-system";
 import { confirm as confirm6 } from "@ai-matrx/kit/confirm-opener";
 import { downloadFile as downloadFile3 } from "@ai-matrx/kit/download";
 import { DownloadIcon } from "@ai-matrx/design-system/icons";
-import { Fragment as Fragment12, jsx as jsx20, jsxs as jsxs19 } from "react/jsx-runtime";
+import { Fragment as Fragment13, jsx as jsx20, jsxs as jsxs19 } from "react/jsx-runtime";
 var messageOf2 = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
 var TOO_BIG = "Files over 25 MB can't be stored.";
 var PROTECTION = [
   { value: "visible", label: "Open", title: "Anyone who can use the item can download it" },
   { value: "revealable", label: "Protected", title: "Downloading needs a recent sign-in" },
-  { value: "sealed", label: "Sealed", title: "Only automation can use it, never a person" }
+  { value: "sealed", label: "Never shown", title: "Only automation can use it, never a person" }
 ];
 function FilesSection({ item, port, editing, onChanged }) {
   const confirmed = useConfirmed();
@@ -4725,7 +4823,7 @@ function FilesSection({ item, port, editing, onChanged }) {
                 {
                   label: a.label,
                   hint: a.description || void 0,
-                  actions: a.handling === "sealed" ? /* @__PURE__ */ jsx20(Badge5, { icon: /* @__PURE__ */ jsx20(LockGlyph, {}), children: "Sealed" }) : canDownload(item, a) ? /* @__PURE__ */ jsx20(Button16, { variant: "quiet", icon: /* @__PURE__ */ jsx20(DownloadIcon, {}), "aria-label": `Download ${a.fileName}`, disabled: busy !== null, onClick: () => void download(a) }) : null,
+                  actions: a.handling === "sealed" ? /* @__PURE__ */ jsx20(Badge5, { icon: /* @__PURE__ */ jsx20(LockGlyph, {}), children: "Never shown" }) : canDownload(item, a) ? /* @__PURE__ */ jsx20(Button16, { variant: "quiet", icon: /* @__PURE__ */ jsx20(DownloadIcon, {}), "aria-label": `Download ${a.fileName}`, disabled: busy !== null, onClick: () => void download(a) }) : null,
                   children: /* @__PURE__ */ jsx20(FileName, { file: a })
                 },
                 a.id
@@ -4749,13 +4847,13 @@ function EditableFile({ port, item: it, file: a, busy: b, run: go, onDownload, o
     const yes = await confirm6({ title: `Delete ${a.label}?`, description: "The encrypted file is removed from this item.", confirmLabel: "Delete", variant: "destructive" });
     if (yes) await go(`delete:${a.id}`, () => port.activity.deleteFile(it, a.id), "The file could not be deleted.");
   }
-  return /* @__PURE__ */ jsxs19(Fragment12, { children: [
+  return /* @__PURE__ */ jsxs19(Fragment13, { children: [
     /* @__PURE__ */ jsx20(
       VaultRow,
       {
         label: a.label,
         hint: a.description || void 0,
-        actions: /* @__PURE__ */ jsxs19(Fragment12, { children: [
+        actions: /* @__PURE__ */ jsxs19(Fragment13, { children: [
           canDownload(it, a) ? /* @__PURE__ */ jsx20(Button16, { variant: "quiet", icon: /* @__PURE__ */ jsx20(DownloadIcon, {}), "aria-label": `Download ${a.fileName}`, disabled: b !== null, onClick: onDownload }) : null,
           /* @__PURE__ */ jsx20(Button16, { variant: "quiet", icon: /* @__PURE__ */ jsx20(PencilGlyph, {}), "aria-label": `Edit ${a.label}`, pressed: open, disabled: b !== null, onClick: () => setOpen((o) => !o) }),
           /* @__PURE__ */ jsx20(Button16, { variant: "quiet", icon: /* @__PURE__ */ jsx20(UploadGlyph, {}), "aria-label": `Replace ${a.fileName}`, disabled: b !== null, onClick: () => replacer.current?.click() }),
@@ -4809,7 +4907,7 @@ function NewFile({ file, busy, onAdd, onCancel }) {
     if (handling === "sealed" && !await confirmSeal(label)) return;
     await onAdd({ label: label.trim(), description: description.trim() || null, handling });
   }
-  return /* @__PURE__ */ jsxs19(Fragment12, { children: [
+  return /* @__PURE__ */ jsxs19(Fragment13, { children: [
     /* @__PURE__ */ jsx20(VaultRow, { label: "New file", children: /* @__PURE__ */ jsxs19("span", { className: "flex min-w-0 items-center gap-2", children: [
       /* @__PURE__ */ jsx20("span", { className: "truncate", children: file.name }),
       /* @__PURE__ */ jsx20("span", { className: "shrink-0 text-xs text-muted-foreground", children: formatFileSize2(file.size) })
@@ -4833,7 +4931,7 @@ function FileDetailsRows({ file, busy, onSave, onCancel }) {
     if (handling === "sealed" && file.handling !== "sealed" && !await confirmSeal(label)) return;
     await onSave({ label: label.trim(), description: description.trim() || null, fileName: fileName.trim(), handling });
   }
-  return /* @__PURE__ */ jsxs19(Fragment12, { children: [
+  return /* @__PURE__ */ jsxs19(Fragment13, { children: [
     /* @__PURE__ */ jsx20(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx20(Field7, { "aria-label": "Name", value: label, onChange: (e) => setLabel(e.target.value) }) }),
     /* @__PURE__ */ jsx20(VaultRow, { label: "Purpose", children: /* @__PURE__ */ jsx20(Field7, { "aria-label": "Purpose", placeholder: "What it is for", value: description, onChange: (e) => setDescription(e.target.value) }) }),
     /* @__PURE__ */ jsx20(VaultRow, { label: "File name", children: /* @__PURE__ */ jsx20(Field7, { "aria-label": "File name", value: fileName, onChange: (e) => setFileName(e.target.value) }) }),
@@ -4857,7 +4955,7 @@ function confirmSeal(label) {
 import { useState as useState21 } from "react";
 import { Badge as Badge6, Button as Button17, Textarea as Textarea3 } from "@ai-matrx/design-system/controls";
 import { CopyIcon as CopyIcon6 } from "@ai-matrx/design-system/icons";
-import { Fragment as Fragment13, jsx as jsx21, jsxs as jsxs20 } from "react/jsx-runtime";
+import { Fragment as Fragment14, jsx as jsx21, jsxs as jsxs20 } from "react/jsx-runtime";
 var MASK4 = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 var say2 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function RecoveryCodesRow({ item, field, port, onChanged }) {
@@ -4901,7 +4999,7 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
       {
         label: "Recovery codes",
         top: true,
-        actions: /* @__PURE__ */ jsxs20(Fragment13, { children: [
+        actions: /* @__PURE__ */ jsxs20(Fragment14, { children: [
           /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(CheckGlyph, {}), "aria-label": "Save codes", disabled: busy || !draft.trim(), onClick: () => void saveDraft() }),
           /* @__PURE__ */ jsx21(Button17, { variant: "quiet", removes: true, icon: /* @__PURE__ */ jsx21(XGlyph, {}), "aria-label": "Cancel", disabled: busy, onClick: () => {
             setDraft(null);
@@ -4943,11 +5041,11 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
     {
       label: "Recovery codes",
       top: codes !== null,
-      actions: /* @__PURE__ */ jsxs20(Fragment13, { children: [
+      actions: /* @__PURE__ */ jsxs20(Fragment14, { children: [
         canSee ? /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: codes ? /* @__PURE__ */ jsx21(EyeOffGlyph, {}) : /* @__PURE__ */ jsx21(EyeGlyph, {}), "aria-label": codes ? "Hide codes" : "Show codes", disabled: busy, onClick: () => void toggle2() }) : null,
         canEdit && !sealed ? /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(PencilGlyph, {}), "aria-label": "Replace all codes", disabled: busy, onClick: () => setDraft("") }) : null
       ] }),
-      children: sealed ? /* @__PURE__ */ jsx21(Badge6, { icon: /* @__PURE__ */ jsx21(LockGlyph, {}), children: "Sealed" }) : codes ? /* @__PURE__ */ jsxs20("ul", { className: "flex flex-col gap-0.5", "aria-label": "Recovery codes", children: [
+      children: sealed ? /* @__PURE__ */ jsx21(Badge6, { icon: /* @__PURE__ */ jsx21(LockGlyph, {}), children: "Never shown" }) : codes ? /* @__PURE__ */ jsxs20("ul", { className: "flex flex-col gap-0.5", "aria-label": "Recovery codes", children: [
         codes.map((code, i) => /* @__PURE__ */ jsxs20("li", { className: "flex min-h-7 items-center gap-1", children: [
           /* @__PURE__ */ jsx21("code", { className: "min-w-0 flex-1 break-all font-mono text-sm text-foreground", children: code }),
           /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(CopyIcon6, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue2(code, "Recovery code") }),
@@ -5270,10 +5368,7 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
       title: "Move or copy",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs22("div", { className: "flex w-full items-center gap-2", children: [
-        /* @__PURE__ */ jsx24(StatusLine, { error, notice }),
-        /* @__PURE__ */ jsx24(Button19, { variant: "outline", className: "ml-auto", onClick: onClose, children: "Close" })
-      ] }),
+      footer: /* @__PURE__ */ jsx24(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx24(StatusLine, { error, notice }) : null, children: /* @__PURE__ */ jsx24(Button19, { variant: "primary", onClick: onClose, children: "Done" }) }),
       children: nothing ? /* @__PURE__ */ jsx24(VaultSection, { children: /* @__PURE__ */ jsx24(Empty, { children: passkey ? "A passkey stays where it was created." : "Only the owner can move or give this item." }) }) : /* @__PURE__ */ jsxs22(VaultSection, { children: [
         canMove && moves.length > 0 ? /* @__PURE__ */ jsx24(
           VaultRow,
@@ -5305,7 +5400,7 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
 }
 
 // src/sharing/SharePanel.tsx
-import { Fragment as Fragment14, jsx as jsx25, jsxs as jsxs23 } from "react/jsx-runtime";
+import { Fragment as Fragment15, jsx as jsx25, jsxs as jsxs23 } from "react/jsx-runtime";
 function useGrants(port, item) {
   const [grants, setGrants] = useState25(null);
   const [loadError, setLoadError] = useState25(null);
@@ -5388,10 +5483,7 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
       title: "Share",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs23("div", { className: "flex w-full items-center gap-2", children: [
-        /* @__PURE__ */ jsx25(StatusLine, { error, notice }),
-        /* @__PURE__ */ jsx25(Button20, { variant: "primary", className: "ml-auto", onClick: onClose, children: "Done" })
-      ] }),
+      footer: /* @__PURE__ */ jsx25(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx25(StatusLine, { error, notice }) : null, children: /* @__PURE__ */ jsx25(Button20, { variant: "primary", onClick: onClose, children: "Done" }) }),
       children: [
         /* @__PURE__ */ jsxs23(VaultSection, { title: "Who has access", children: [
           isOrg ? /* @__PURE__ */ jsx25(AccessLine, { glyph: BuildingGlyph, who: `${orgName} admins`, children: /* @__PURE__ */ jsx25("span", { className: "px-2 text-sm text-muted-foreground", children: "Full access" }) }) : /* @__PURE__ */ jsx25(AccessLine, { glyph: PersonGlyph, who: "You", meta: "Owner", children: /* @__PURE__ */ jsx25("span", { className: "px-2 text-sm text-muted-foreground", children: "Full access" }) }),
@@ -5456,7 +5548,7 @@ function IntoOrganization({ item, port, organizations, grants, onShared }) {
   const [level, setLevel] = useState25("use");
   const chosen = open.find((o) => o.id === target);
   if (item.owner.kind !== "me") return null;
-  return /* @__PURE__ */ jsx25(VaultSection, { title: "Share into organization", children: open.length > 0 ? /* @__PURE__ */ jsxs23(Fragment14, { children: [
+  return /* @__PURE__ */ jsx25(VaultSection, { title: "Share into organization", children: open.length > 0 ? /* @__PURE__ */ jsxs23(Fragment15, { children: [
     /* @__PURE__ */ jsxs23("div", { className: "flex min-h-11 items-center gap-2 px-3 sm:px-4", children: [
       /* @__PURE__ */ jsx25(BuildingGlyph, { className: "size-4 shrink-0 text-muted-foreground" }),
       /* @__PURE__ */ jsx25(Select8, { className: "min-w-0 flex-1", "aria-label": "Organization", value: target || "__none__", onValueChange: (v) => setTarget(v === "__none__" ? "" : v), options: [{ value: "__none__", label: "Choose an organization" }, ...open.map((o) => ({ value: o.id, label: o.name }))] }),
@@ -5542,7 +5634,7 @@ function SharingSummary({ item, port, className }) {
 
 // src/ItemPane.tsx
 import { formatAbsoluteDate as formatAbsoluteDate3 } from "@ai-matrx/kit/format";
-import { Fragment as Fragment15, jsx as jsx26, jsxs as jsxs24 } from "react/jsx-runtime";
+import { Fragment as Fragment16, jsx as jsx26, jsxs as jsxs24 } from "react/jsx-runtime";
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
@@ -5677,6 +5769,21 @@ function ItemPane(props) {
       if (!wasCancelled(e)) setError(e instanceof Error ? e.message : "The value could not be read.");
     }
   }
+  const offFields = item ? item.fields.filter((f) => !f.active) : [];
+  const seedField = item?.fields.find((f) => f.key === OTP_SEED_KEY) ?? null;
+  const canTurnOn = Boolean(item && canEdit);
+  async function turnOn(fields) {
+    if (!item || fields.length === 0) return;
+    setError(null);
+    try {
+      for (const f of fields) await confirmed(() => port.fields.updateField(item, f.id, { active: true }));
+      onChanged();
+    } catch (e) {
+      if (!wasCancelled(e)) setError(e instanceof Error ? e.message : "It could not be turned on.");
+      onChanged();
+    }
+  }
+  const turnOnOne = canTurnOn ? (f) => () => turnOn([f]) : () => void 0;
   const declaredKeys = new Set(declared.map((f) => f.key));
   const extraFields = (item?.fields ?? []).filter((f) => !declaredKeys.has(f.key) && !draft.removed.includes(f.id) && !isAuthenticatorStorage(f.key));
   const metaValue = (key) => draft.values[key] ?? item?.custom.find((c) => c.key === key)?.value ?? "";
@@ -5685,6 +5792,10 @@ function ItemPane(props) {
   const isLogin = (item?.definitionKey ?? definition?.key) === "website_login" || (item?.definitionKey ?? definition?.key) === "username_password";
   const typeLabel = definition?.label ?? item?.definitionLabel ?? "";
   const shownOwner = mode === "new" ? owner === "me" ? { label: "Personal", glyph: /* @__PURE__ */ jsx26(PersonGlyph, {}) } : owner === "person" ? { label: "Someone else", glyph: /* @__PURE__ */ jsx26(SendGlyph, {}) } : { label: organizations.find((o) => o.id === owner)?.name ?? "Organization", glyph: /* @__PURE__ */ jsx26(BuildingGlyph, {}) } : item ? { label: item.owner.label, glyph: item.owner.kind === "me" ? /* @__PURE__ */ jsx26(PersonGlyph, {}) : item.owner.kind === "organization" ? /* @__PURE__ */ jsx26(BuildingGlyph, {}) : /* @__PURE__ */ jsx26(UsersIcon2, {}) } : null;
+  const sameNamed = (id) => {
+    const name = organizations.find((o) => o.id === id)?.name.trim().toLowerCase();
+    return Boolean(name) && organizations.filter((o) => o.name.trim().toLowerCase() === name).length > 1;
+  };
   const tagsVisible = showTags || draft.tags.length > 0 || tagsText !== "";
   const descriptionVisible = showDescription || draft.description !== "";
   const header = /* @__PURE__ */ jsxs24("header", { className: "flex min-h-14 items-center gap-2 border-b border-border px-3 py-2 sm:gap-3 sm:px-5", children: [
@@ -5752,7 +5863,7 @@ function ItemPane(props) {
             /* @__PURE__ */ jsx26(SettingsIcon, { className: "size-4" }),
             "Settings"
           ] }) : null,
-          canManage ? /* @__PURE__ */ jsxs24(Fragment15, { children: [
+          canManage ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
             /* @__PURE__ */ jsx26(DropdownMenuSeparator3, {}),
             /* @__PURE__ */ jsxs24(DropdownMenuItem3, { className: "text-destructive", disabled: busy, onSelect: () => void remove(), children: [
               /* @__PURE__ */ jsx26(TrashGlyph, { className: "size-4" }),
@@ -5768,7 +5879,11 @@ function ItemPane(props) {
     header,
     error ? /* @__PURE__ */ jsx26("div", { role: "alert", className: "border-b border-border bg-muted px-5 py-2 text-sm text-destructive", children: error }) : null,
     notice && !editing ? /* @__PURE__ */ jsx26("div", { role: "status", className: "border-b border-border bg-muted px-5 py-2 text-sm text-warning", children: notice }) : null,
-    /* @__PURE__ */ jsx26("div", { className: "min-h-0 flex-1 overflow-y-auto", children: /* @__PURE__ */ jsx26("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", children: editing ? /* @__PURE__ */ jsxs24(Fragment15, { children: [
+    item && !editing && offFields.length > 0 ? /* @__PURE__ */ jsxs24("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-5 py-2 text-sm", children: [
+      /* @__PURE__ */ jsx26("span", { className: "min-w-0 flex-1 truncate text-warning", children: offFields.length === 1 ? "1 field is turned off" : `${offFields.length} fields are turned off` }),
+      canTurnOn ? /* @__PURE__ */ jsx26(TurnOnButton, { label: "all fields", onTurnOn: () => turnOn(offFields) }) : null
+    ] }) : null,
+    /* @__PURE__ */ jsx26("div", { className: "min-h-0 flex-1 overflow-y-auto", children: /* @__PURE__ */ jsx26("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", children: editing ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
       /* @__PURE__ */ jsxs24(VaultSection, { children: [
         mode === "new" ? /* @__PURE__ */ jsx26(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx26(
           OptionCombobox,
@@ -5780,16 +5895,16 @@ function ItemPane(props) {
             searchPlaceholder: "Find an organization",
             groups: [
               { heading: "Just you", options: ["me"] },
-              ...organizations.length > 0 ? [{ heading: "Organizations", options: organizations.map((o) => o.id) }] : [],
+              ...organizations.length > 0 ? [{ heading: "Organizations", options: [...organizations].sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }) || a.id.localeCompare(b.id)).map((o) => o.id) }] : [],
               { heading: "Send", options: ["person"] }
             ],
             getLabel: (v) => v === "me" ? "Personal" : v === "person" ? "Someone else" : organizations.find((o) => o.id === v)?.name ?? v,
-            getHint: (v) => v === "me" ? "Only you" : v === "person" ? "Sent by email" : null,
+            getHint: (v) => v === "me" ? "Only you" : v === "person" ? "Sent by email" : sameNamed(v) ? `ID ${v.slice(0, 8)}` : null,
             renderIcon: (v) => v === "me" ? /* @__PURE__ */ jsx26(PersonGlyph, { className: "size-4" }) : v === "person" ? /* @__PURE__ */ jsx26(SendGlyph, { className: "size-4" }) : /* @__PURE__ */ jsx26(BuildingGlyph, { className: "size-4" })
           }
         ) }) : null,
         /* @__PURE__ */ jsx26(EditRow, { label: "Name", value: draft.name, onChange: (v) => patch({ name: v }), placeholder: "Name", autoFocus: mode === "new" }),
-        mode === "new" && owner === "person" ? /* @__PURE__ */ jsxs24(Fragment15, { children: [
+        mode === "new" && owner === "person" ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
           /* @__PURE__ */ jsx26(EditRow, { label: "Their email", value: recipient, placeholder: "name@company.com", inputMode: "email", onChange: setRecipient }),
           declared.some((f) => f.storage === "encrypted" && f.kind === "secret") ? /* @__PURE__ */ jsx26(VaultRow, { label: "Password", hint: "You never see it", children: /* @__PURE__ */ jsx26(Switch5, { checked: generatePrivately, onCheckedChange: setGeneratePrivately, "aria-label": "Generate the password privately" }) }) : null
         ] }) : null,
@@ -5808,7 +5923,7 @@ function ItemPane(props) {
               multiline: f.kind === "multiline",
               inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
               onChange: (v) => setValue(f.key, v),
-              actions: /* @__PURE__ */ jsxs24(Fragment15, { children: [
+              actions: /* @__PURE__ */ jsxs24(Fragment16, { children: [
                 hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
                 secretKind ? /* @__PURE__ */ jsx26(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
                 existing ? /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null
@@ -5827,7 +5942,7 @@ function ItemPane(props) {
             onChange: (v) => setValue(f.key, v),
             onRemove: () => patch({ removed: [...draft.removed, f.id] }),
             removeLabel: `Delete ${f.label}`,
-            actions: /* @__PURE__ */ jsxs24(Fragment15, { children: [
+            actions: /* @__PURE__ */ jsxs24(Fragment16, { children: [
               f.handling === "revealable" && !(f.key in loaded) && item?.capabilities.canReveal ? /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
               /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) })
             ] })
@@ -5859,7 +5974,7 @@ function ItemPane(props) {
           i
         )),
         /* @__PURE__ */ jsx26(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
-        /* @__PURE__ */ jsx26(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator), item, port, onEnrolled: onChanged }),
+        /* @__PURE__ */ jsx26(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
         item && isLogin && !item.authenticator ? /* @__PURE__ */ jsx26(TwoFactorMethodRow, { port, item, onChanged }) : null
       ] }),
       /* @__PURE__ */ jsx26(VaultSection, { children: /* @__PURE__ */ jsx26(EditRow, { label: "Notes", value: draft.notes, multiline: true, placeholder: "Anything worth remembering", onChange: (v) => patch({ notes: v }) }) }),
@@ -5892,12 +6007,12 @@ function ItemPane(props) {
             ) : null,
             draft.secrets.map((s, i) => /* @__PURE__ */ jsx26(CustomEditRow, { label: s.label, value: s.value, secret: true, onLabel: (v) => patch({ secrets: draft.secrets.map((x, j) => j === i ? { ...x, label: v } : x) }), onValue: (v) => patch({ secrets: draft.secrets.map((x, j) => j === i ? { ...x, value: v } : x) }), onRemove: () => patch({ secrets: draft.secrets.filter((_, j) => j !== i) }) }, `s${i}`)),
             extraCustom.map((c) => /* @__PURE__ */ jsx26(CustomEditRow, { label: c.label, value: c.value, secret: false, onLabel: (v) => patch({ custom: draft.custom.map((x) => x.key === c.key ? { ...x, label: v } : x) }), onValue: (v) => patch({ custom: draft.custom.map((x) => x.key === c.key ? { ...x, value: v } : x) }), onRemove: () => patch({ custom: draft.custom.filter((x) => x.key !== c.key) }) }, c.key)),
-            !descriptionVisible && !tagsVisible && draft.secrets.length === 0 && extraCustom.length === 0 ? /* @__PURE__ */ jsx26(AddRow, { label: "Fields, tags", onAdd: null, children: "None" }) : null
+            !descriptionVisible && !tagsVisible && draft.secrets.length === 0 && extraCustom.length === 0 ? /* @__PURE__ */ jsx26(AddRow, { label: "Tags", onAdd: () => setShowTags(true), children: "Add tags" }) : null
           ]
         }
       ),
       filesProps ? /* @__PURE__ */ jsx26(FilesSection, { ...filesProps, editing: true }) : null
-    ] }) : item ? /* @__PURE__ */ jsxs24(Fragment15, { children: [
+    ] }) : item ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
       /* @__PURE__ */ jsxs24(VaultSection, { children: [
         declared.map((f) => {
           if (f.storage === "metadata") {
@@ -5906,11 +6021,15 @@ function ItemPane(props) {
           }
           const field = item.fields.find((x) => x.key === f.key);
           if (isRecoveryCodesField(f)) return /* @__PURE__ */ jsx26(RecoveryCodesRow, { item, field, port, onChanged }, f.key);
-          return field ? /* @__PURE__ */ jsx26(SecretRow, { port, item, field }, field.id) : null;
+          return field ? /* @__PURE__ */ jsx26(SecretRow, { port, item, field, onTurnOn: turnOnOne(field) }, field.id) : null;
         }),
-        extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ jsx26(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ jsx26(SecretRow, { port, item, field: f }, f.id)),
+        extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ jsx26(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ jsx26(SecretRow, { port, item, field: f, onTurnOn: turnOnOne(f) }, f.id)),
         item.loginUrls.length > 0 ? item.loginUrls.map((u, i) => /* @__PURE__ */ jsx26(PlainRow, { label: i === 0 ? "Website" : `Website ${i + 1}`, value: u, openUrl: host.openUrl }, `${u}-${i}`)) : /* @__PURE__ */ jsx26(AddRow, { label: "Website", onAdd: canEdit ? () => onMode("edit") : null, children: "Add website" }),
-        item.authenticator ? /* @__PURE__ */ jsx26(TotpRow, { port, item, onChanged }) : /* @__PURE__ */ jsx26(AddRow, { label: "One-time password", onAdd: canEdit ? () => onMode("edit") : null, children: "Set up" }),
+        item.authenticator ? /* @__PURE__ */ jsx26(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
+          // The secret is still there, only off: turning it on brings the codes back. Never "Set up",
+          // which would invite replacing a working two-factor secret.
+          /* @__PURE__ */ jsx26(VaultRow, { label: "One-time password", actions: canTurnOn ? /* @__PURE__ */ jsx26(TurnOnButton, { label: "One-time password", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ jsx26("span", { className: "text-muted-foreground", children: "Turned off" }) })
+        ) : /* @__PURE__ */ jsx26(AddRow, { label: "One-time password", onAdd: canEdit ? () => onMode("edit") : null, children: "Set up" }),
         !item.authenticator && item.custom.some((c) => c.key === MFA_METHOD_KEY && c.value) ? /* @__PURE__ */ jsx26(TwoFactorMethodRow, { port, item, onChanged }) : null
       ] }),
       /* @__PURE__ */ jsx26(VaultSection, { children: item.notes ? /* @__PURE__ */ jsx26(PlainRow, { label: "Notes", value: item.notes, multiline: true }) : /* @__PURE__ */ jsx26(AddRow, { label: "Notes", onAdd: canEdit ? () => onMode("edit") : null, children: "Add notes" }) }),
@@ -5942,7 +6061,7 @@ function subtitleOf(item, withOwner) {
   const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
-function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header }) {
+function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, showOwner }) {
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
   const ordered = [...pinned, ...rest];
@@ -5961,7 +6080,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
       listRef.current?.querySelector(`[data-item="${next.id}"]`)?.scrollIntoView({ block: "nearest" });
     }
   };
-  const mixedOwners = new Set(items.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
+  const mixedOwners = showOwner ?? new Set(items.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
   const row = (i) => /* @__PURE__ */ jsx27(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners }, i.id);
   const sortLabel = SORTS2.find((s) => s.value === sort)?.label ?? "Name";
   return /* @__PURE__ */ jsxs25("section", { "aria-label": title, className: "flex h-full min-h-0 flex-col border-r border-border bg-background", children: [
@@ -6114,7 +6233,7 @@ function refusalText(reason) {
 // src/lists/RestorePanel.tsx
 import { useEffect as useEffect18, useState as useState28 } from "react";
 import { Button as Button23 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment16, jsx as jsx28, jsxs as jsxs26 } from "react/jsx-runtime";
+import { Fragment as Fragment17, jsx as jsx28, jsxs as jsxs26 } from "react/jsx-runtime";
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 function RestorePanel({ lists, item, restore, onClose }) {
   const [preview, setPreview] = useState28(null);
@@ -6159,7 +6278,7 @@ function RestorePanel({ lists, item, restore, onClose }) {
       title: `Restore "${item.name}"`,
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs26(Fragment16, { children: [
+      footer: /* @__PURE__ */ jsxs26(Fragment17, { children: [
         /* @__PURE__ */ jsx28(Button23, { variant: "quiet", onClick: onClose, children: refused ? "Close" : "Cancel" }),
         refused ? null : /* @__PURE__ */ jsx28(Button23, { variant: "primary", icon: /* @__PURE__ */ jsx28(RestoreGlyph, {}), disabled: busy || loading || lists.preview !== void 0 && preview === null, onClick: () => void run(), children: busy ? "Restoring\u2026" : "Restore" })
       ] }),
@@ -6179,6 +6298,9 @@ function RestorePanel({ lists, item, restore, onClose }) {
 
 // src/lists/TrashView.tsx
 import { jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
+function trashLineOf(item) {
+  return [item.definitionLabel || null, item.owner.label, item.deletion?.deletedAt ? `Deleted ${formatAbsoluteDate4(item.deletion.deletedAt, DAY_FORMAT, "")}` : null].filter(Boolean).join(" \xB7 ");
+}
 function TrashView({ port, deleted, query, header, onChanged }) {
   const confirmed = useConfirmed();
   const [busyId, setBusyId] = useState29(null);
@@ -6190,7 +6312,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
     setMessage(null);
     try {
       const r = await confirmed(() => port.lists.restore(item, deletionId));
-      setMessage({ tone: "ok", text: r.alreadyRestored ? `"${item.name}" was already restored.` : `Restored "${item.name}" with ${r.restoredFields} fields and ${r.restoredAttachments} files. It is turned off.` });
+      setMessage({ tone: "ok", text: r.alreadyRestored ? `"${item.name}" was already restored.` : `Restored "${item.name}" with ${r.restoredFields} fields and ${r.restoredAttachments} files. Turn its fields on from the item.` });
       onChanged();
       return r;
     } catch (e) {
@@ -6208,7 +6330,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
       /* @__PURE__ */ jsxs27("div", { className: "flex min-h-12 items-center gap-3 px-3 py-1.5 sm:px-4", children: [
         /* @__PURE__ */ jsxs27("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
           /* @__PURE__ */ jsx29("span", { className: "truncate text-sm text-foreground", children: item.name }),
-          /* @__PURE__ */ jsx29("span", { className: "truncate text-xs text-muted-foreground", children: [item.deletion?.deletedAt ? `Deleted ${formatAbsoluteDate4(item.deletion.deletedAt, DAY_FORMAT, "")}` : null, item.owner.kind !== "me" ? item.owner.label : null].filter(Boolean).join(" \xB7 ") })
+          /* @__PURE__ */ jsx29("span", { className: "truncate text-xs text-muted-foreground", children: trashLineOf(item) })
         ] }),
         /* @__PURE__ */ jsx29(Button24, { variant: "outline", icon: /* @__PURE__ */ jsx29(RestoreGlyph, {}), disabled: busyId !== null || !item.deletion, onClick: () => setRestoring(item), children: "Restore" })
       ] }, item.id)
@@ -6499,10 +6621,9 @@ function SecureLinkPanel({ item, port, onClose }) {
       title: "Send securely",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs29("div", { className: "flex w-full flex-wrap items-center gap-2", children: [
-        /* @__PURE__ */ jsx31("div", { className: "w-full sm:w-auto sm:min-w-0 sm:flex-1", children: /* @__PURE__ */ jsx31(StatusLine, { error, notice }) }),
+      footer: /* @__PURE__ */ jsxs29(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx31(StatusLine, { error, notice }) : null, children: [
         sameChannelSent && !error ? /* @__PURE__ */ jsx31(Badge8, { tone: "warning", children: "Both by email" }) : null,
-        /* @__PURE__ */ jsx31(Button26, { variant: "quiet", className: "ml-auto", onClick: onClose, children: "Close" }),
+        /* @__PURE__ */ jsx31(Button26, { variant: "quiet", onClick: onClose, children: "Close" }),
         /* @__PURE__ */ jsx31(Button26, { variant: "primary", disabled: !canSend, onClick: () => void send(), children: busy === "send" ? "Sending\u2026" : "Send link" })
       ] }),
       children: [
@@ -6655,7 +6776,7 @@ function addPasskeyFailure(message2) {
 var isRevoked = (d) => d.revokedAt !== null;
 
 // src/devices/DevicesPanel.tsx
-import { Fragment as Fragment17, jsx as jsx32, jsxs as jsxs30 } from "react/jsx-runtime";
+import { Fragment as Fragment18, jsx as jsx32, jsxs as jsxs30 } from "react/jsx-runtime";
 var messageOf3 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function ErrorLine2({ text }) {
   return text ? /* @__PURE__ */ jsx32("p", { role: "alert", className: "px-1 text-sm text-destructive", children: text }) : null;
@@ -6786,7 +6907,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
   };
   const canApprove = Boolean(key && passkeys && here && methods?.passkey && !approvedUntil);
   const title = isMac ? "Approve this Mac" : name ? `Approve ${name}` : "Approve this browser";
-  const footer = approvedUntil ? /* @__PURE__ */ jsx32(Button27, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs30(Fragment17, { children: [
+  const footer = approvedUntil ? /* @__PURE__ */ jsx32(Button27, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs30(Fragment18, { children: [
     /* @__PURE__ */ jsx32(Button27, { variant: "quiet", disabled: busy !== null, onClick: refuse, children: key ? "Refuse" : "Close" }),
     canApprove ? /* @__PURE__ */ jsx32(Button27, { variant: "primary", icon: /* @__PURE__ */ jsx32(FingerprintGlyph, {}), disabled: busy !== null, onClick: () => void approve(), children: busy === "approve" ? "Approving\u2026" : "Approve with passkey" }) : null
   ] });
@@ -6794,7 +6915,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
     "This link names no key. Start again from ",
     where,
     "."
-  ] }) }) : /* @__PURE__ */ jsxs30(Fragment17, { children: [
+  ] }) }) : /* @__PURE__ */ jsxs30(Fragment18, { children: [
     /* @__PURE__ */ jsxs30(VaultSection, { title: "What is asking", children: [
       /* @__PURE__ */ jsx32(VaultRow, { label: "Asking", hint: "Approve only if you just asked", children: asker }),
       name ? /* @__PURE__ */ jsx32(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx32("span", { className: "block truncate", children: name }) }) : null,
@@ -7094,7 +7215,7 @@ function useNativeImport(bridge, stillAllowed, onImported) {
 }
 
 // src/native/NativeImportPanel.tsx
-import { Fragment as Fragment18, jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
+import { Fragment as Fragment19, jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
 var TONE = {
   eligible: "success",
   committed: "success",
@@ -7138,16 +7259,16 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
     const yes = await confirm12({ title: `Add ${plural2(ready, "passkey")} to ${orgName}?`, description: "Passkeys already there are skipped.", confirmLabel: "Import" });
     if (yes) await flow.confirm();
   };
-  const footer = preview ? /* @__PURE__ */ jsxs31(Fragment18, { children: [
+  const footer = preview ? /* @__PURE__ */ jsxs31(Fragment19, { children: [
     /* @__PURE__ */ jsx33(Button28, { variant: "quiet", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel" }),
     /* @__PURE__ */ jsxs31(Button28, { variant: "primary", icon: /* @__PURE__ */ jsx33(ImportGlyph, { className: "size-4" }), disabled: busy || ready === 0, onClick: () => void importNow(), children: [
       "Import ",
       ready
     ] })
-  ] }) : status ? active ? /* @__PURE__ */ jsxs31(Fragment18, { children: [
+  ] }) : status ? active ? /* @__PURE__ */ jsxs31(Fragment19, { children: [
     /* @__PURE__ */ jsx33(Button28, { variant: "outline", disabled: busy, onClick: () => void flow.refresh(), children: "Refresh" }),
     /* @__PURE__ */ jsx33(Button28, { variant: "outline", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel import" })
-  ] }) : /* @__PURE__ */ jsxs31(Fragment18, { children: [
+  ] }) : /* @__PURE__ */ jsxs31(Fragment19, { children: [
     /* @__PURE__ */ jsx33(Button28, { variant: "quiet", onClick: flow.reset, children: "New file" }),
     /* @__PURE__ */ jsx33(Button28, { variant: "primary", onClick: onClose, children: "Done" })
   ] }) : /* @__PURE__ */ jsx33(Button28, { variant: "quiet", onClick: onClose, children: "Close" });
@@ -7186,7 +7307,7 @@ import { GlobeIcon as GlobeIcon4 } from "@ai-matrx/design-system/icons";
 // src/extension/CaptureCard.tsx
 import { useState as useState35, useSyncExternalStore as useSyncExternalStore3 } from "react";
 import { Button as Button29, SearchField as SearchField3 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment19, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
+import { Fragment as Fragment20, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
   const prompt = useSyncExternalStore3(capture.subscribe, capture.get, capture.get);
@@ -7219,7 +7340,7 @@ function CaptureCard({ capture, onChanged }) {
       ] }),
       /* @__PURE__ */ jsx34(Button29, { variant: "quiet", icon: /* @__PURE__ */ jsx34(XGlyph, {}), "aria-label": "Not now", disabled: busy, onClick: () => void decide({ action: "dismiss" }) })
     ] }),
-    prompt.unavailable ? /* @__PURE__ */ jsx34("p", { className: "text-xs text-muted-foreground", children: "Save it by hand with Save a login." }) : /* @__PURE__ */ jsxs32(Fragment19, { children: [
+    prompt.unavailable ? /* @__PURE__ */ jsx34("p", { className: "text-xs text-muted-foreground", children: "Save it by hand with Save a login." }) : /* @__PURE__ */ jsxs32(Fragment20, { children: [
       existing.length > 0 ? /* @__PURE__ */ jsxs32("div", { className: "flex flex-col gap-1", children: [
         existing.length >= SEARCH_FROM ? /* @__PURE__ */ jsx34(SearchField3, { value: q, onChange: (e) => setQ(e.target.value), placeholder: "Search logins", "aria-label": "Search logins to update" }) : null,
         /* @__PURE__ */ jsxs32("ul", { className: "flex max-h-36 flex-col gap-px overflow-y-auto", children: [
@@ -7325,7 +7446,7 @@ import { useState as useState37 } from "react";
 import { Popover as Popover2, PopoverContent as PopoverContent2, PopoverTrigger as PopoverTrigger2 } from "@ai-matrx/design-system";
 import { Button as Button31 } from "@ai-matrx/design-system/controls";
 import { CopyIcon as CopyIcon7 } from "@ai-matrx/design-system/icons";
-import { Fragment as Fragment20, jsx as jsx36, jsxs as jsxs34 } from "react/jsx-runtime";
+import { Fragment as Fragment21, jsx as jsx36, jsxs as jsxs34 } from "react/jsx-runtime";
 var HOLD_MS = 6e4;
 function PageGenerator({ fields }) {
   const limits = useGeneratorLimitsSource();
@@ -7376,12 +7497,12 @@ function PageGenerator({ fields }) {
     }
   };
   const value = held.value;
-  return /* @__PURE__ */ jsxs34(Fragment20, { children: [
+  return /* @__PURE__ */ jsxs34(Fragment21, { children: [
     /* @__PURE__ */ jsx36(
       VaultRow,
       {
         label: "New password",
-        actions: /* @__PURE__ */ jsxs34(Fragment20, { children: [
+        actions: /* @__PURE__ */ jsxs34(Fragment21, { children: [
           value ? /* @__PURE__ */ jsx36(Button31, { variant: "quiet", icon: /* @__PURE__ */ jsx36(CopyIcon7, {}), "aria-label": "Copy password", onClick: () => void copy(value, "Password") }) : null,
           /* @__PURE__ */ jsxs34(Popover2, { open, onOpenChange: setOpen, children: [
             /* @__PURE__ */ jsx36(PopoverTrigger2, { asChild: true, children: /* @__PURE__ */ jsx36(Button31, { variant: "outline", icon: /* @__PURE__ */ jsx36(KeyGlyph, {}), disabled: busy, children: "Generate" }) }),
@@ -7758,8 +7879,33 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     },
     [loc, move]
   );
+  const keyState = useRef19({ loc, go });
+  keyState.current = { loc, go };
+  useEffect23(() => {
+    const onKey = (e) => {
+      if (e.defaultPrevented || e.metaKey || e.ctrlKey || e.altKey) return;
+      const root = rootRef.current;
+      const at = document.activeElement;
+      if (!root || at && at !== document.body && !root.contains(at)) return;
+      if (at instanceof HTMLElement && (at.isContentEditable || /^(INPUT|TEXTAREA|SELECT)$/.test(at.tagName))) return;
+      if (document.querySelector('[role="dialog"], [role="alertdialog"]')) return;
+      const { loc: here, go: to } = keyState.current;
+      if (e.key === "/") {
+        const search = root.querySelector('input[aria-label^="Search"]');
+        if (!search) return;
+        e.preventDefault();
+        search.focus();
+      } else if (e.key === "Escape" && here.itemId && here.mode === "view" && !here.panel) {
+        e.preventDefault();
+        to({ itemId: null, mode: "view", panel: null });
+      }
+    };
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, []);
   const knobsRef = useRef19(host.knobs);
   knobsRef.current = host.knobs;
+  const [signedOut, setSignedOut] = useState40(false);
   const load = useCallback5(() => {
     setError(null);
     port.load().then((s) => {
@@ -7770,7 +7916,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         (rows) => setDeleted([...s.deleted, ...rows.filter((r) => !s.deleted.some((d) => d.id === r.id))]),
         () => void 0
       );
-    }).catch((e) => setError(e instanceof Error ? e.message : "The vault could not be loaded."));
+    }).catch((e) => {
+      setSignedOut(e?.status === 401);
+      setError(e instanceof Error ? e.message : "The vault could not be loaded.");
+    });
     port.lists.favorites?.list().then((ids) => setFavorites(new Set(ids)), () => void 0);
     knobsRef.current?.().catch(() => void 0);
     port.lists.recents?.list().then(setRecents, () => void 0);
@@ -7784,6 +7933,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const orgs = snap?.organizations ?? [];
   const definitions = snap?.definitions ?? [];
   const inThisVault = useMemo6(() => items.filter((i) => inVault(i, loc.vault)), [items, loc.vault]);
+  const vaultMixesOwners = new Set(inThisVault.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
   const views = useMemo6(() => buildViews(inThisVault, definitions, favorites, recents), [inThisVault, definitions, favorites, recents]);
   const visible = useMemo6(() => {
     const filtered = inThisVault.filter((i) => {
@@ -7824,8 +7974,11 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     return /* @__PURE__ */ jsxs37("div", { ref: rootRef, role: "alert", className: "flex h-full flex-col items-center justify-center gap-3 bg-background p-6 text-center text-sm", children: [
       /* @__PURE__ */ jsx39(SafeGlyph, { className: "size-8 text-muted-foreground" }),
       /* @__PURE__ */ jsx39("div", { className: "font-medium", children: "The vault couldn\u2019t open" }),
-      /* @__PURE__ */ jsx39("div", { className: "max-w-xs text-muted-foreground", children: plainLoadError(error) }),
-      /* @__PURE__ */ jsx39("button", { type: "button", className: "text-primary hover:underline", onClick: load, children: "Try again" })
+      /* @__PURE__ */ jsx39("div", { className: "max-w-xs text-muted-foreground", children: signedOut ? "You\u2019ve been signed out." : plainLoadError(error) }),
+      /* @__PURE__ */ jsxs37("div", { className: "flex gap-2", children: [
+        signedOut && host.signIn ? /* @__PURE__ */ jsx39(Button33, { variant: "primary", onClick: host.signIn, children: "Sign in" }) : null,
+        /* @__PURE__ */ jsx39(Button33, { variant: signedOut && host.signIn ? "outline" : "primary", onClick: load, children: "Try again" })
+      ] })
     ] });
   }
   if (!snap) {
@@ -7905,6 +8058,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     {
       title,
       items: visible,
+      showOwner: vaultMixesOwners,
       definitions,
       port,
       selectedId: loc.itemId,
@@ -8677,6 +8831,7 @@ async function readNativeImportLimits(api, organizationId) {
 var recoveryOf = (w) => w.lifecycle?.vault_recovery;
 var isDeleted = (w) => recoveryOf(w)?.state === "deleted";
 var MATCH_MODES2 = ["host", "domain", "exact", "never"];
+var FIELD_WORDS = { totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
 var handlingOf = (v) => v === "visible" || v === "sealed" ? v : "revealable";
 function fieldOf(w, def) {
   const declared = def?.fields.find((f) => f.key === w.field_key);
@@ -8684,7 +8839,7 @@ function fieldOf(w, def) {
   return {
     id: w.id,
     key: w.field_key,
-    label: declared?.label ?? humanize(w.field_key),
+    label: declared?.label ?? FIELD_WORDS[w.field_key] ?? humanize(w.field_key),
     kind: declared?.kind ?? (handling === "visible" ? "text" : "secret"),
     handling,
     editable: w.editable ?? true,
@@ -8902,9 +9057,11 @@ function createVaultKnobs(client, address) {
 }
 export {
   CATEGORIES,
+  CONFIRM_RETURN_KEY,
   DEFAULT_LOCATION,
   GenerateButton,
   HIDDEN_ITEM_TAG,
+  IdentityGate,
   LOCKED_MESSAGE,
   VaultApp,
   VaultLockedError,
@@ -8922,6 +9079,9 @@ export {
   matchesQuery,
   needsRecentSignIn,
   parseDefinitions,
-  sortItems
+  siteDomainOf,
+  sortItems,
+  useConfirmed,
+  wasCancelled
 };
 //# sourceMappingURL=index.js.map