@ai-matrx/vault 0.1.13 → 0.1.15

package/dist/index.cjs

@@ -936,9 +936,11 @@ function inView(item, view) {
   if (view.startsWith("tag:")) return item.tags.includes(view.slice(4));
   return true;
 }
+var AUTHENTICATOR_WORDS = ["authenticator", "2fa", "two-factor", "two factor", "totp", "one-time password", "verification code", "2-step"];
 function matchesQuery(item, query) {
   const q = query.trim().toLowerCase();
   if (!q) return true;
+  if (item.authenticator && AUTHENTICATOR_WORDS.some((w) => w === q || q.length >= 3 && w.startsWith(q))) return true;
   return [item.name, item.definitionLabel, ...item.tags, ...item.loginUrls, ...item.custom.map((c) => `${c.label} ${c.value}`)].some((h) => h.toLowerCase().includes(q));
 }
 var HIDDEN_ITEM_TAG = "matrx:hidden";
@@ -1564,9 +1566,23 @@ function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, on
 // src/authenticator/AuthenticatorView.tsx
 var import_react13 = require("react");
 var import_controls9 = require("@ai-matrx/design-system/controls");
-var import_design_system9 = require("@ai-matrx/design-system");
+var import_design_system10 = require("@ai-matrx/design-system");
 var import_icons5 = require("@ai-matrx/design-system/icons");
 
+// src/ItemIcon.tsx
+var import_design_system7 = require("@ai-matrx/design-system");
+var import_jsx_runtime8 = require("react/jsx-runtime");
+function ItemIcon({ definitionKey, family, site, size = "md", inverted = false }) {
+  const box = size === "lg" ? "size-10 rounded-xl text-base" : size === "md" ? "size-8 rounded-lg text-sm" : "size-6 rounded-md text-xs";
+  const tone = inverted ? "bg-primary-foreground text-primary" : "bg-muted text-foreground";
+  const initial = siteDomainOf(site).charAt(0).toUpperCase();
+  if (initial && /[A-Z0-9]/.test(initial)) {
+    return /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("span", { "aria-hidden": true, className: (0, import_design_system7.cn)("flex shrink-0 items-center justify-center font-semibold", box, tone), children: initial });
+  }
+  const Glyph = definitionGlyph(definitionKey, family);
+  return /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("span", { "aria-hidden": true, className: (0, import_design_system7.cn)("flex shrink-0 items-center justify-center", box, tone), children: /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(Glyph, { className: size === "lg" ? "size-5" : "size-4" }) });
+}
+
 // src/authenticator/AddOtpPanel.tsx
 var import_react12 = require("react");
 var import_controls8 = require("@ai-matrx/design-system/controls");
@@ -1574,7 +1590,7 @@ var import_controls8 = require("@ai-matrx/design-system/controls");
 // src/authenticator/CodeParts.tsx
 var import_react8 = require("react");
 var import_controls5 = require("@ai-matrx/design-system/controls");
-var import_design_system7 = require("@ai-matrx/design-system");
+var import_design_system8 = require("@ai-matrx/design-system");
 var import_icons4 = require("@ai-matrx/design-system/icons");
 var import_format5 = require("@ai-matrx/kit/format");
 
@@ -1677,16 +1693,16 @@ function matchIssuerToSite(issuer, candidates, siteOf) {
 }
 
 // src/authenticator/CodeParts.tsx
-var import_jsx_runtime8 = require("react/jsx-runtime");
+var import_jsx_runtime9 = require("react/jsx-runtime");
 function CountdownRing({ remaining, period, loading = false, className }) {
   const r = 9.5;
   const c = 2 * Math.PI * r;
   const p = loading ? 0 : Math.max(0, Math.min(1, remaining / period));
   const urgent = !loading && remaining <= 5;
-  return /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)("span", { className: (0, import_design_system7.cn)("relative inline-flex size-6 shrink-0 items-center justify-center", className), role: "img", "aria-label": loading ? "Getting code" : `${remaining} seconds left`, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)("svg", { viewBox: "0 0 24 24", className: "absolute inset-0 size-full -rotate-90", "aria-hidden": true, children: [
-      /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("circle", { cx: "12", cy: "12", r, fill: "none", stroke: "currentColor", strokeWidth: 2.5, className: "text-muted" }),
-      /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("span", { className: (0, import_design_system8.cn)("relative inline-flex size-6 shrink-0 items-center justify-center", className), role: "img", "aria-label": loading ? "Getting code" : `${remaining} seconds left`, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("svg", { viewBox: "0 0 24 24", className: "absolute inset-0 size-full -rotate-90", "aria-hidden": true, children: [
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("circle", { cx: "12", cy: "12", r, fill: "none", stroke: "currentColor", strokeWidth: 2.5, className: "text-muted" }),
+      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
         "circle",
         {
           cx: "12",
@@ -1703,7 +1719,7 @@ function CountdownRing({ remaining, period, loading = false, className }) {
         }
       )
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("span", { className: (0, import_design_system7.cn)("text-[10px] font-semibold leading-none tabular-nums", urgent ? "text-destructive" : "text-muted-foreground"), children: loading ? "" : remaining })
+    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: (0, import_design_system8.cn)("text-[10px] font-semibold leading-none tabular-nums", urgent ? "text-destructive" : "text-muted-foreground"), children: loading ? "" : remaining })
   ] });
 }
 function useCopied() {
@@ -1725,7 +1741,7 @@ function useCopied() {
 function CodeButton({ live, digits, size = "md", label }) {
   const { copied, copy } = useCopied();
   const shown = live.code ? (0, import_format5.groupCode)(live.code) : maskedCode(digits);
-  return /* @__PURE__ */ (0, import_jsx_runtime8.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
     "button",
     {
       type: "button",
@@ -1733,17 +1749,17 @@ function CodeButton({ live, digits, size = "md", label }) {
       onClick: () => live.code && void copy(live.code),
       "aria-label": live.code ? `Copy ${label} code` : `Getting ${label} code`,
       title: live.code ? "Copy" : void 0,
-      className: (0, import_design_system7.cn)("group -mx-1.5 inline-flex max-w-full items-center gap-2.5 rounded-md px-1.5 py-1 text-left transition-colors hover:bg-accent focus-visible:bg-accent focus-visible:outline-none", size === "lg" && "gap-3"),
+      className: (0, import_design_system8.cn)("group -mx-1.5 inline-flex max-w-full items-center gap-2.5 rounded-md px-1.5 py-1 text-left transition-colors hover:bg-accent focus-visible:bg-accent focus-visible:outline-none", size === "lg" && "gap-3"),
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("span", { className: (0, import_design_system7.cn)("whitespace-nowrap font-mono font-medium tabular-nums tracking-[0.08em]", size === "lg" ? "text-2xl" : "text-[1.0625rem]", live.code ? "text-foreground" : "text-disabled-foreground"), children: shown }),
-        copied ? /* @__PURE__ */ (0, import_jsx_runtime8.jsx)("span", { className: "inline-flex size-6 items-center justify-center text-success", role: "status", "aria-label": "Copied", children: /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(CheckGlyph, { className: "size-4" }) }) : /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(CountdownRing, { remaining: live.remaining, period: live.period, loading: !live.code })
+        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: (0, import_design_system8.cn)("whitespace-nowrap font-mono font-medium tabular-nums tracking-[0.08em]", size === "lg" ? "text-2xl" : "text-[1.0625rem]", live.code ? "text-foreground" : "text-disabled-foreground"), children: shown }),
+        copied ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "inline-flex size-6 items-center justify-center text-success", role: "status", "aria-label": "Copied", children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CheckGlyph, { className: "size-4" }) }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CountdownRing, { remaining: live.remaining, period: live.period, loading: !live.code })
       ]
     }
   );
 }
 function CopyCodeButton({ live, label }) {
   const { copied, copy } = useCopied();
-  return /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_controls5.Button, { variant: "quiet", icon: copied ? /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(CheckGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime8.jsx)(import_icons4.CopyIcon, {}), ...copied ? { glyphTone: "success" } : {}, "aria-label": `Copy ${label} code`, disabled: !live.code, onClick: () => live.code && void copy(live.code) });
+  return /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_controls5.Button, { variant: "quiet", icon: copied ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CheckGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_icons4.CopyIcon, {}), ...copied ? { glyphTone: "success" } : {}, "aria-label": `Copy ${label} code`, disabled: !live.code, onClick: () => live.code && void copy(live.code) });
 }
 
 // src/authenticator/live-code.ts
@@ -1835,42 +1851,23 @@ var import_react10 = require("react");
 var import_controls6 = require("@ai-matrx/design-system/controls");
 
 // src/authenticator/qr.ts
-function detectorCtor() {
-  const c = globalThis.BarcodeDetector;
-  return typeof c === "function" ? c : null;
-}
-var support = null;
+var import_qr = require("@ai-matrx/capture/qr");
 function canDecodeQrLocally() {
-  if (!support) {
-    const C = detectorCtor();
-    support = !C ? Promise.resolve(false) : C.getSupportedFormats ? C.getSupportedFormats().then((f) => f.includes("qr_code"), () => false) : Promise.resolve(true);
+  if (typeof document === "undefined") return Promise.resolve(false);
+  try {
+    return Promise.resolve(Boolean(document.createElement("canvas").getContext("2d")));
+  } catch {
+    return Promise.resolve(false);
   }
-  return support;
 }
 function hasCamera() {
   return typeof navigator !== "undefined" && typeof navigator.mediaDevices?.getUserMedia === "function";
 }
-var detector = null;
-function qrDetector() {
-  const C = detectorCtor();
-  if (!C) return null;
-  detector ??= new C({ formats: ["qr_code"] });
-  return detector;
-}
 async function decodeQr(source) {
-  const d = qrDetector();
-  if (!d) return null;
-  const found = await d.detect(source);
-  return found.find((b) => b.rawValue)?.rawValue ?? null;
+  return (0, import_qr.decodeQrFromElement)(source);
 }
 async function decodeQrFile(file) {
-  if (!await canDecodeQrLocally()) return null;
-  const bitmap = await createImageBitmap(file);
-  try {
-    return await decodeQr(bitmap);
-  } finally {
-    bitmap.close();
-  }
+  return (0, import_qr.decodeQrFromImageFile)(file);
 }
 function imageFrom(data) {
   if (!data) return null;
@@ -1885,7 +1882,7 @@ function imageFrom(data) {
 }
 
 // src/authenticator/Setup.tsx
-var import_jsx_runtime9 = require("react/jsx-runtime");
+var import_jsx_runtime10 = require("react/jsx-runtime");
 function useCanScan() {
   const [ok, setOk] = (0, import_react10.useState)(false);
   (0, import_react10.useEffect)(() => {
@@ -1951,15 +1948,15 @@ function QrScanPanel({ open, onResult, onClose }) {
       stop();
     };
   }, [open]);
-  return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(Panel, { title: "Scan QR code", open, onClose, size: "sm", footer: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_controls6.Button, { variant: "quiet", onClick: onClose, children: "Cancel" }), children: [
-    /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("div", { className: "relative mx-auto aspect-square w-full max-w-sm overflow-hidden rounded-xl bg-muted", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("video", { ref: video, className: "size-full object-cover", playsInline: true, muted: true, "aria-label": "Camera" }),
-      error ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("div", { className: "absolute inset-0 flex items-center justify-center p-6 text-center text-sm text-destructive", children: error }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("div", { className: "pointer-events-none absolute inset-[18%] rounded-lg border-2 border-primary", "aria-hidden": true })
+  return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Panel, { title: "Scan QR code", open, onClose, size: "sm", footer: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls6.Button, { variant: "quiet", onClick: onClose, children: "Cancel" }), children: [
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "relative mx-auto aspect-square w-full max-w-sm overflow-hidden rounded-xl bg-muted", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("video", { ref: video, className: "size-full object-cover", playsInline: true, muted: true, "aria-label": "Camera" }),
+      error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "absolute inset-0 flex items-center justify-center p-6 text-center text-sm text-destructive", children: error }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "pointer-events-none absolute inset-[18%] rounded-lg border-2 border-primary", "aria-hidden": true })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("p", { className: "text-center text-xs text-muted-foreground", children: "Point at the site's QR code" })
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { className: "text-center text-xs text-muted-foreground", children: "Point at the site's QR code" })
   ] });
 }
-function OtpSetupRow({ value, onChange, label = "One-time password", placeholder = "Setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status }) {
+function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "Paste setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status }) {
   const file = (0, import_react10.useRef)(null);
   const canScan = useCanScan();
   const [scanning, setScanning] = (0, import_react10.useState)(false);
@@ -1992,11 +1989,11 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
       setReading(false);
     }
   };
-  const end = status ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "max-w-48 truncate text-xs text-muted-foreground", children: status }) : reading ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "text-xs text-muted-foreground", children: "Reading\u2026" }) : imageError || error ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "max-w-56 truncate text-xs text-destructive", title: imageError ?? error ?? void 0, role: "alert", children: imageError ?? error }) : parsed ? /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("span", { className: "flex max-w-56 items-center gap-1 text-xs text-success", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CheckGlyph, { className: "size-3.5 shrink-0" }),
-    /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "truncate", children: describeEnrollment(parsed) })
+  const end = status ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "max-w-48 truncate text-xs text-muted-foreground", children: status }) : reading ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "text-xs text-muted-foreground", children: "Reading\u2026" }) : imageError || error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "max-w-56 truncate text-xs text-destructive", title: imageError ?? error ?? void 0, role: "alert", children: imageError ?? error }) : parsed ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("span", { className: "flex max-w-56 items-center gap-1 text-xs text-success", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(CheckGlyph, { className: "size-3.5 shrink-0" }),
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "truncate", children: describeEnrollment(parsed) })
   ] }) : null;
-  return /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
     "div",
     {
       onDragOver: (e) => {
@@ -2014,16 +2011,16 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
       },
       className: dragging ? "rounded-lg bg-accent" : void 0,
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(
+        /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(
           VaultRow,
           {
             label,
-            actions: /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)(import_jsx_runtime9.Fragment, { children: [
-              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_controls6.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(QrGlyph, {}), "aria-label": "Choose QR image", title: "Choose or drop a QR image", disabled: disabled || reading, onClick: () => file.current?.click() }),
-              canScan ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(import_controls6.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CameraGlyph, {}), "aria-label": "Scan with camera", title: "Scan with camera", disabled, onClick: () => setScanning(true) }) : null
+            actions: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls6.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(QrGlyph, {}), "aria-label": "Choose QR image", title: "Choose or drop a QR image", disabled: disabled || reading, onClick: () => file.current?.click() }),
+              canScan ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls6.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(CameraGlyph, {}), "aria-label": "Scan QR code with camera", title: "Scan the site's QR code with the camera", disabled, onClick: () => setScanning(true), children: "Scan" }) : null
             ] }),
             children: [
-              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
                 import_controls6.Field,
                 {
                   className: "w-full",
@@ -2046,7 +2043,7 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
                   end
                 }
               ),
-              /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
                 "input",
                 {
                   ref: file,
@@ -2063,7 +2060,7 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
             ]
           }
         ),
-        canScan ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(
+        canScan ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
           QrScanPanel,
           {
             open: scanning,
@@ -2082,7 +2079,7 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
 // src/authenticator/TotpRows.tsx
 var import_react11 = require("react");
 var import_controls7 = require("@ai-matrx/design-system/controls");
-var import_design_system8 = require("@ai-matrx/design-system");
+var import_design_system9 = require("@ai-matrx/design-system");
 var import_confirm_opener2 = require("@ai-matrx/kit/confirm-opener");
 
 // src/authenticator/port.ts
@@ -2094,7 +2091,7 @@ function mfaMethodOf(item) {
 }
 
 // src/authenticator/TotpRows.tsx
-var import_jsx_runtime10 = require("react/jsx-runtime");
+var import_jsx_runtime11 = require("react/jsx-runtime");
 function otpActionError(e, what) {
   const status = e?.status;
   if (status === 404) return "There is no one-time password here.";
@@ -2132,7 +2129,7 @@ function useOtpActions(port, item, onChanged) {
     }),
     remove: async () => {
       const ok = await (0, import_confirm_opener2.confirm)({
-        title: `Remove the one-time password for ${item.name}?`,
+        title: `Remove the authenticator for ${item.name}?`,
         description: "Codes stop here. Two-factor stays on at the site, and your phone app and backup codes still work.",
         confirmLabel: "Remove",
         variant: "destructive"
@@ -2151,38 +2148,38 @@ function TotpRow({ port, item, onChanged }) {
   const live = useLiveCode(port, item, a.enabled && !a.removed);
   const canManage = item.capabilities.canManage || item.capabilities.canEdit;
   if (a.removed || !item.authenticator) return null;
-  const menu = canManage ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_design_system8.DropdownMenu, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_design_system8.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls7.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(MoreGlyph, {}), "aria-label": "One-time password options", disabled: a.busy }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_design_system8.DropdownMenuContent, { align: "end", className: "min-w-44", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_design_system8.DropdownMenuItem, { onSelect: () => void a.setEnabled(!a.enabled), children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(PowerGlyph, { className: "size-4" }),
+  const menu = canManage ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_design_system9.DropdownMenu, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_design_system9.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_controls7.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(MoreGlyph, {}), "aria-label": "Authenticator options", disabled: a.busy }) }),
+    /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_design_system9.DropdownMenuContent, { align: "end", className: "min-w-44", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_design_system9.DropdownMenuItem, { onSelect: () => void a.setEnabled(!a.enabled), children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(PowerGlyph, { className: "size-4" }),
         a.enabled ? "Turn off" : "Turn on"
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_design_system8.DropdownMenuSeparator, {}),
-      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_design_system8.DropdownMenuItem, { className: "text-destructive focus:text-destructive", onSelect: () => void a.remove(), children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(TrashGlyph, { className: "size-4" }),
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_design_system9.DropdownMenuSeparator, {}),
+      /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_design_system9.DropdownMenuItem, { className: "text-destructive focus:text-destructive", onSelect: () => void a.remove(), children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(TrashGlyph, { className: "size-4" }),
         "Remove"
       ] })
     ] })
   ] }) : null;
-  return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
     VaultRow,
     {
-      label: "One-time password",
-      actions: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
-        a.enabled ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(CopyCodeButton, { live, label: item.name }) : null,
+      label: "Authenticator",
+      actions: /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
+        a.enabled ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(CopyCodeButton, { live, label: item.name }) : null,
         menu
       ] }),
-      children: a.error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("span", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "truncate text-sm text-destructive", role: "alert", children: a.error }),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls7.Button, { variant: "quiet", onClick: a.clearError, children: "Dismiss" })
-      ] }) : !a.enabled ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("span", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "text-sm text-disabled-foreground", children: "Off" }),
-        canManage ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls7.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(PowerGlyph, {}), disabled: a.busy, onClick: () => void a.setEnabled(true), children: "Turn on" }) : null
-      ] }) : live.error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("span", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "truncate text-sm text-destructive", title: live.error, children: live.error }),
-        /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls7.Button, { variant: "quiet", onClick: live.retry, children: "Retry" })
-      ] }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(CodeButton, { live, digits: item.authenticator.digits, label: item.name })
+      children: a.error ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("span", { className: "flex items-center gap-2", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { className: "truncate text-sm text-destructive", role: "alert", children: a.error }),
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_controls7.Button, { variant: "quiet", onClick: a.clearError, children: "Dismiss" })
+      ] }) : !a.enabled ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("span", { className: "flex items-center gap-2", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { className: "text-sm text-disabled-foreground", children: "Off" }),
+        canManage ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_controls7.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(PowerGlyph, {}), disabled: a.busy, onClick: () => void a.setEnabled(true), children: "Turn on" }) : null
+      ] }) : live.error ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("span", { className: "flex items-center gap-2", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { className: "truncate text-sm text-destructive", title: live.error, children: live.error }),
+        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_controls7.Button, { variant: "quiet", onClick: live.retry, children: "Retry" })
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(CodeButton, { live, digits: item.authenticator.digits, label: item.name })
     }
   );
 }
@@ -2200,7 +2197,7 @@ function TotpEditRow({ value, onChange, hasExisting, item, port, onEnrolled, onR
       setStatus(wasCancelled(e) ? null : otpActionError(e, "read that image"));
     }
   } : void 0;
-  return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
     OtpSetupRow,
     {
       value,
@@ -2225,7 +2222,7 @@ function TwoFactorMethodRow({ port, item, onChanged }) {
   const [busy, setBusy] = (0, import_react11.useState)(false);
   const [error, setError] = (0, import_react11.useState)(null);
   const canEdit = item.capabilities.canEdit || item.capabilities.canManage;
-  return /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(VaultRow, { label: "Two-factor", hint: error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "text-destructive", children: error }) : void 0, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(VaultRow, { label: "Two-factor", hint: error ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { className: "text-destructive", children: error }) : void 0, children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
     import_controls7.Select,
     {
       value: value ?? "none",
@@ -2252,7 +2249,7 @@ function TwoFactorMethodRow({ port, item, onChanged }) {
 }
 
 // src/authenticator/AddOtpPanel.tsx
-var import_jsx_runtime11 = require("react/jsx-runtime");
+var import_jsx_runtime12 = require("react/jsx-runtime");
 var NEW = "__new__";
 var LOGIN_KEYS = ["website_login", "username_password"];
 function normalizeWebsite(raw) {
@@ -2328,23 +2325,23 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       setBusy(false);
     }
   };
-  if (saved) return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(AddedPanel, { port, item: saved, onClose, onDone: () => onDone(saved.id) });
-  return /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(
+  if (saved) return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(AddedPanel, { port, item: saved, onClose, onDone: () => onDone(saved.id) });
+  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(
     Panel,
     {
-      title: "Add one-time password",
+      title: "Add authenticator",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_controls8.Button, { variant: "quiet", onClick: onClose, disabled: busy, children: "Cancel" }),
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_controls8.Button, { variant: "primary", disabled: !ready, onClick: () => void save(), children: busy ? "Adding\u2026" : "Add" })
+      footer: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls8.Button, { variant: "quiet", onClick: onClose, disabled: busy, children: "Cancel" }),
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls8.Button, { variant: "primary", disabled: !ready, onClick: () => void save(), children: busy ? "Adding\u2026" : "Add" })
       ] }),
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(VaultSection, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(VaultSection, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
             OtpSetupRow,
             {
-              label: "Setup code",
+              label: "Setup key",
               value: input,
               autoFocus: true,
               disabled: busy,
@@ -2362,7 +2359,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
               status: image ? `QR image ready \xB7 ${image.name}` : null
             }
           ),
-          /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(VaultRow, { label: "Add to", children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+          itemId ? null : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(VaultRow, { label: "Add to", children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
             import_controls8.Select,
             {
               value: target,
@@ -2375,8 +2372,8 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
               }
             }
           ) }),
-          isNew ? /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)(import_jsx_runtime11.Fragment, { children: [
-            /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(VaultRow, { label: "Name", children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(
+          isNew ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(VaultRow, { label: "Name", children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
               import_controls8.Field,
               {
                 className: "w-full",
@@ -2390,24 +2387,27 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
                 "aria-label": "Name"
               }
             ) }),
-            /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(VaultRow, { label: "Website", hint: websiteBad ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { className: "text-destructive", children: "Not a web address" }) : void 0, children: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_controls8.Field, { className: "w-full", type: "url", value: website, disabled: busy || created !== null, onChange: (e) => setWebsite(e.target.value), placeholder: "example.com", "aria-label": "Website", "aria-invalid": websiteBad || void 0 }) })
+            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(VaultRow, { label: "Website", hint: websiteBad ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "text-destructive", children: "Not a web address" }) : void 0, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls8.Field, { className: "w-full", type: "url", value: website, disabled: busy || created !== null, onChange: (e) => setWebsite(e.target.value), placeholder: "example.com", "aria-label": "Website", "aria-invalid": websiteBad || void 0 }) })
           ] }) : null
         ] }),
-        error ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { className: "px-1 text-sm text-destructive", role: "alert", children: error }) : null
+        error ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { className: "px-1 text-sm text-destructive", role: "alert", children: error }) : null
       ]
     }
   );
 }
+function FirstCodePanel(props) {
+  return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(AddedPanel, { ...props });
+}
 function AddedPanel({ port, item, onClose, onDone }) {
   const live = useLiveCode(port, item, true);
-  return /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(Panel, { title: item.name, size: "sm", onClose, footer: /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(import_controls8.Button, { variant: "primary", onClick: onDone, children: "Done" }), children: /* @__PURE__ */ (0, import_jsx_runtime11.jsxs)("div", { className: "flex flex-col items-center gap-2 py-4", children: [
-    live.error ? /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("span", { className: "text-sm text-destructive", children: live.error }) : /* @__PURE__ */ (0, import_jsx_runtime11.jsx)(CodeButton, { live, digits: item.authenticator?.digits ?? 6, size: "lg", label: item.name }),
-    /* @__PURE__ */ (0, import_jsx_runtime11.jsx)("p", { className: "text-xs text-muted-foreground", children: "Enter this code on the site to finish." })
+  return /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Panel, { title: item.name, size: "sm", onClose, footer: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls8.Button, { variant: "primary", onClick: onDone, children: "Done" }), children: /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "flex flex-col items-center gap-2 py-4", children: [
+    live.error ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "text-sm text-destructive", children: live.error }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(CodeButton, { live, digits: item.authenticator?.digits ?? 6, size: "lg", label: item.name }),
+    /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { className: "text-xs text-muted-foreground", children: "Enter this code on the site to finish." })
   ] }) });
 }
 
 // src/authenticator/AuthenticatorView.tsx
-var import_jsx_runtime12 = require("react/jsx-runtime");
+var import_jsx_runtime13 = require("react/jsx-runtime");
 function matchesEntry(entry, q) {
   if (!entry || !q) return false;
   return [entry.issuer, entry.account].some((v) => v?.toLowerCase().includes(q));
@@ -2425,7 +2425,7 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged, header }) {
+function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
   const [entries, setEntries] = (0, import_react13.useState)(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = (0, import_react13.useState)(/* @__PURE__ */ new Set());
   const [adding, setAdding] = (0, import_react13.useState)(false);
@@ -2445,20 +2445,20 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
-  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("section", { "aria-label": "One-time passwords", className: "flex h-full min-h-0 flex-col bg-background", children: [
-    header ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("div", { className: "mx-auto w-full max-w-3xl px-3 pt-3 sm:px-4", children: header }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "flex min-h-12 items-center justify-between gap-2 px-4 pb-1 pt-3", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "flex min-w-0 items-baseline gap-2", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("h2", { className: "truncate text-sm font-semibold text-foreground", children: "One-time passwords" }),
-        total > 0 ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "text-xs tabular-nums text-muted-foreground", children: total }) : null
+  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("section", { "aria-label": "Authenticator", className: "flex h-full min-h-0 flex-col bg-background", children: [
+    header ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("div", { className: "mx-auto w-full max-w-3xl px-3 pt-3 sm:px-4", children: header }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "flex min-h-12 items-center justify-between gap-2 px-4 pb-1 pt-3", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "flex min-w-0 items-baseline gap-2", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("h2", { className: "truncate text-sm font-semibold text-foreground", children: "Authenticator" }),
+        total > 0 ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "text-xs tabular-nums text-muted-foreground", children: total }) : null
       ] }),
-      total > 0 ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls9.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
+      total > 0 ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls9.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
     ] }),
-    total === 0 ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(ShieldGlyph, { className: "size-6" }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("p", { className: "text-sm font-medium text-foreground", children: "No one-time passwords yet" }),
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls9.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add one-time password" })
-    ] }) : groups.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: "Nothing matches." }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("div", { className: "min-h-0 flex-1 overflow-y-auto px-3 pb-6 pt-1 sm:px-4", children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5", children: groups.map((g) => /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(VaultSection, { title: g.label, className: "[&>div]:px-1", children: g.items.map((item) => /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+    total === 0 ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(ShieldGlyph, { className: "size-6" }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { className: "text-sm font-medium text-foreground", children: "No authenticator codes yet" }),
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls9.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add authenticator" })
+    ] }) : groups.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: "Nothing matches." }) : /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("div", { className: "min-h-0 flex-1 overflow-y-auto px-3 pb-6 pt-1 sm:px-4", children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5", children: groups.map((g) => /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultSection, { title: g.label, className: "[&>div]:px-1", children: g.items.map((item) => /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
       OtpListRow,
       {
         port,
@@ -2466,6 +2466,7 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
         family: familyOf2(item.definitionKey),
         entry: entries.get(item.id),
         onOpen: () => onOpen(item.id),
+        ...host.openItemInNewTab ? { onOpenInNewTab: () => host.openItemInNewTab?.(item.id) } : {},
         onRename: () => {
           setRenameError(null);
           setRenaming(item);
@@ -2478,7 +2479,7 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
       },
       item.id
     )) }, g.key)) }) }),
-    adding ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
+    adding ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
       AddOtpPanel,
       {
         port,
@@ -2492,15 +2493,15 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
         }
       }
     ) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(
-      import_design_system9.TextInputDialog,
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+      import_design_system10.TextInputDialog,
       {
         open: renaming !== null,
         onOpenChange: (o) => {
           if (!o && !renameBusy) setRenaming(null);
         },
         title: "Rename login",
-        ...renameError ? { description: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "text-destructive", children: renameError }) } : {},
+        ...renameError ? { description: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "text-destructive", children: renameError }) } : {},
         placeholder: "Login name",
         defaultValue: renaming?.name ?? "",
         confirmLabel: "Rename",
@@ -2523,50 +2524,53 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
     )
   ] });
 }
-function OtpListRow({ port, item, family, entry, onOpen, onRename, onChanged, onRemoved }) {
+function OtpListRow({ port, item, family, entry, onOpen, onOpenInNewTab, onRename, onChanged, onRemoved }) {
   const a = useOtpActions(port, item, (next) => next && next.authenticator === null ? onRemoved() : onChanged());
   const live = useLiveCode(port, item, a.enabled && !a.removed);
   const { copy } = useCopied();
-  const Icon = definitionGlyph(item.definitionKey, family);
   const canManage = item.capabilities.canManage || item.capabilities.canEdit;
   if (a.removed) return null;
   const sub = a.error ?? [entry?.account, loginSiteOf(item) || entry?.issuer].filter((v, i, all) => Boolean(v) && all.indexOf(v) === i).join(" \xB7 ");
-  return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-3 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { type: "button", onClick: onOpen, "aria-label": `Open ${item.name}`, tabIndex: -1, className: (0, import_design_system9.cn)("flex size-8 items-center justify-center rounded-lg bg-muted", a.enabled ? "text-foreground" : "text-disabled-foreground"), children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Icon, { className: "size-4" }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("button", { type: "button", onClick: onOpen, className: "flex min-w-0 flex-col items-start rounded-md text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: (0, import_design_system9.cn)("max-w-full truncate text-sm font-medium", a.enabled ? "text-foreground" : "text-muted-foreground"), children: item.name }),
-      sub ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: (0, import_design_system9.cn)("max-w-full truncate text-xs", a.error ? "text-destructive" : "text-muted-foreground"), title: sub, children: sub }) : null
+  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-3 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("button", { type: "button", onClick: onOpen, "aria-label": `Open ${item.name}`, tabIndex: -1, className: "flex size-8 items-center justify-center rounded-lg", children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item) || (entry?.issuer ?? "") }) }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("button", { type: "button", onClick: onOpen, className: "flex min-w-0 flex-col items-start rounded-md text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: (0, import_design_system10.cn)("max-w-full truncate text-sm font-medium", a.enabled ? "text-foreground" : "text-muted-foreground"), children: item.name }),
+      sub ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: (0, import_design_system10.cn)("max-w-full truncate text-xs", a.error ? "text-destructive" : "text-muted-foreground"), title: sub, children: sub }) : null
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("div", { className: "flex min-w-0 justify-end", children: !a.enabled ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("span", { className: "flex items-center gap-1.5", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "text-sm text-disabled-foreground", children: "Off" }),
-      canManage ? /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls9.Button, { variant: "quiet", disabled: a.busy, onClick: () => void a.setEnabled(true), children: "Turn on" }) : null
-    ] }) : live.error ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("span", { className: "flex items-center gap-1.5", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("span", { className: "max-w-40 truncate text-xs text-destructive", title: live.error, children: live.error }),
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls9.Button, { variant: "quiet", onClick: live.retry, children: "Retry" })
-    ] }) : /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(CodeButton, { live, digits: item.authenticator?.digits ?? 6, label: item.name }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system9.DropdownMenu, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_design_system9.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls9.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(MoreGlyph, {}), "aria-label": `${item.name} options`, disabled: a.busy }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system9.DropdownMenuContent, { align: "end", className: "min-w-44", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system9.DropdownMenuItem, { onSelect: onOpen, children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(ExternalGlyph, { className: "size-4" }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("div", { className: "flex min-w-0 justify-end", children: !a.enabled ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("span", { className: "flex items-center gap-1.5", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "text-sm text-disabled-foreground", children: "Off" }),
+      canManage ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls9.Button, { variant: "quiet", disabled: a.busy, onClick: () => void a.setEnabled(true), children: "Turn on" }) : null
+    ] }) : live.error ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("span", { className: "flex items-center gap-1.5", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "max-w-40 truncate text-xs text-destructive", title: live.error, children: live.error }),
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls9.Button, { variant: "quiet", onClick: live.retry, children: "Retry" })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(CodeButton, { live, digits: item.authenticator?.digits ?? 6, label: item.name }) }),
+    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system10.DropdownMenu, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_design_system10.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls9.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(MoreGlyph, {}), "aria-label": `${item.name} options`, disabled: a.busy }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system10.DropdownMenuContent, { align: "end", className: "min-w-44", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system10.DropdownMenuItem, { onSelect: onOpen, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(ExternalGlyph, { className: "size-4" }),
           "Open login"
         ] }),
-        live.code ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system9.DropdownMenuItem, { onSelect: () => live.code && void copy(live.code), children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_icons5.CopyIcon, { className: "size-4" }),
+        onOpenInNewTab ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system10.DropdownMenuItem, { onSelect: onOpenInNewTab, children: [
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(ExternalGlyph, { className: "size-4" }),
+          "Open in new tab"
+        ] }) : null,
+        live.code ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system10.DropdownMenuItem, { onSelect: () => live.code && void copy(live.code), children: [
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_icons5.CopyIcon, { className: "size-4" }),
           "Copy code"
         ] }) : null,
-        canManage ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system9.DropdownMenuItem, { onSelect: onRename, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(PencilGlyph, { className: "size-4" }),
+        canManage ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_jsx_runtime13.Fragment, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system10.DropdownMenuItem, { onSelect: onRename, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(PencilGlyph, { className: "size-4" }),
             "Rename"
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system9.DropdownMenuItem, { onSelect: () => void a.setEnabled(!a.enabled), children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(PowerGlyph, { className: "size-4" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system10.DropdownMenuItem, { onSelect: () => void a.setEnabled(!a.enabled), children: [
+            /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(PowerGlyph, { className: "size-4" }),
             a.enabled ? "Turn off" : "Turn on"
           ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_design_system9.DropdownMenuSeparator, {}),
-          /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_design_system9.DropdownMenuItem, { className: "text-destructive focus:text-destructive", onSelect: () => void a.remove(), children: [
-            /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(TrashGlyph, { className: "size-4" }),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_design_system10.DropdownMenuSeparator, {}),
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(import_design_system10.DropdownMenuItem, { className: "text-destructive focus:text-destructive", onSelect: () => void a.remove(), children: [
+            /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(TrashGlyph, { className: "size-4" }),
             "Remove"
           ] })
         ] }) : null
@@ -2659,7 +2663,7 @@ function withoutCode(codes, index) {
 }
 
 // src/fields/SettingsPanels.tsx
-var import_jsx_runtime13 = require("react/jsx-runtime");
+var import_jsx_runtime14 = require("react/jsx-runtime");
 var say = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function useSaver(onChanged) {
   const [busy, setBusy] = (0, import_react14.useState)(null);
@@ -2681,14 +2685,14 @@ function useSaver(onChanged) {
   return { busy, error, setError, save };
 }
 function Problem({ children }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { role: "alert", className: "px-1 text-sm text-destructive", children });
+  return /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { role: "alert", className: "px-1 text-sm text-destructive", children });
 }
-var quietHint = (text, tone = "muted") => /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
+var quietHint = (text, tone = "muted") => /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
 function FieldSettingsPanel(props) {
   const field = props.item.fields.find((f) => f.id === props.arg);
   if (!field)
-    return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Panel, { title: "Field settings", size: "md", onClose: props.onClose, footer: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Button, { variant: "primary", onClick: props.onClose, children: "Done" }), children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Empty, { children: "This field is no longer on the item." }) });
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(FieldSettings, { ...props, field }, field.id);
+    return /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Panel, { title: "Field settings", size: "md", onClose: props.onClose, footer: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "primary", onClick: props.onClose, children: "Done" }), children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Empty, { children: "This field is no longer on the item." }) });
+  return /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(FieldSettings, { ...props, field }, field.id);
 }
 function FieldSettings({ item, port, field, onClose, onChanged }) {
   const { busy, error, setError, save } = useSaver((next) => onChanged(next));
@@ -2727,9 +2731,9 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
   };
   const handling = HANDLING_WORDS[field.handling];
   const locked = !canEdit || busy !== null;
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Panel, { title: `${field.label} settings`, size: "md", onClose, footer: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Button, { variant: "primary", onClick: onClose, children: "Done" }), children: [
-    !canEdit ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { className: "px-1 text-sm text-muted-foreground", children: "View only: you can\u2019t change these settings." }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultSection, { title: "Who can see it", children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Value", hint: quietHint(handling.hint), children: field.handling === "sealed" ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Badge, { icon: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(LockGlyph, {}), children: "Sealed for good" }) : /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(Panel, { title: `${field.label} settings`, size: "md", onClose, footer: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "primary", onClick: onClose, children: "Done" }), children: [
+    !canEdit ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { className: "px-1 text-sm text-muted-foreground", children: "View only: you can\u2019t change these settings." }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultSection, { title: "Who can see it", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultRow, { label: "Value", hint: quietHint(handling.hint), children: field.handling === "sealed" ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Badge, { icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(LockGlyph, {}), children: "Sealed for good" }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
       import_controls10.SegmentedControl,
       {
         "aria-label": "Who can see it",
@@ -2738,8 +2742,8 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
         data: handlingChoices(field.handling).map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint, disabled: locked }))
       }
     ) }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(VaultSection, { title: "Automation", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Env key", hint: envProblem ? quietHint(envProblem, "destructive") : quietHint("The name sandboxes and workflows use"), children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(VaultSection, { title: "Automation", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultRow, { label: "Env key", hint: envProblem ? quietHint(envProblem, "destructive") : quietHint("The name sandboxes and workflows use"), children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
         import_controls10.Field,
         {
           ref: envRef,
@@ -2759,10 +2763,10 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
           }
         }
       ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Use in sandbox", hint: blocker && !field.injectIntoSandbox ? quietHint(blocker) : quietHint("Sandboxes get it as an env variable"), children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Switch, { "aria-label": "Use in sandbox", checked: field.injectIntoSandbox, disabled: locked, onCheckedChange: (v) => void setSandbox(v) }) })
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultRow, { label: "Use in sandbox", hint: blocker && !field.injectIntoSandbox ? quietHint(blocker) : quietHint("Sandboxes get it as an env variable"), children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Switch, { "aria-label": "Use in sandbox", checked: field.injectIntoSandbox, disabled: locked, onCheckedChange: (v) => void setSandbox(v) }) })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(VaultSection, { title: "Field", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Description", children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(VaultSection, { title: "Field", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultRow, { label: "Description", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
         import_controls10.Field,
         {
           className: "w-full",
@@ -2778,10 +2782,10 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
           }
         }
       ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Editable", hint: quietHint(field.editable ? "The value can be changed" : "The value is locked"), children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Switch, { "aria-label": "Editable", checked: field.editable, disabled: locked, onCheckedChange: (v) => void update("editable", { editable: v }) }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Turned on", hint: quietHint(field.active ? "In use" : "Kept, but nothing uses it"), children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Switch, { "aria-label": "Turned on", checked: field.active, disabled: locked, onCheckedChange: (v) => void update("active", { active: v }) }) })
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultRow, { label: "Editable", hint: quietHint(field.editable ? "The value can be changed" : "The value is locked"), children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Switch, { "aria-label": "Editable", checked: field.editable, disabled: locked, onCheckedChange: (v) => void update("editable", { editable: v }) }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultRow, { label: "Turned on", hint: quietHint(field.active ? "In use" : "Kept, but nothing uses it"), children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Switch, { "aria-label": "Turned on", checked: field.active, disabled: locked, onCheckedChange: (v) => void update("active", { active: v }) }) })
     ] }),
-    error ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Problem, { children: error }) : null
+    error ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Problem, { children: error }) : null
   ] });
 }
 function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
@@ -2808,10 +2812,10 @@ function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
     });
   };
   const fillHint = !hasWebsite ? "Add a website first" : item.browserFillEnabled ? "Offered on matching pages" : "Never filled automatically";
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(Panel, { title: "Item settings", size: "md", onClose, footer: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Button, { variant: "primary", onClick: onClose, children: "Done" }), children: [
-    !canEdit ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { className: "px-1 text-sm text-muted-foreground", children: "View only: you can\u2019t change these settings." }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)(VaultSection, { title: "In the browser", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Website matching", hint: quietHint(MATCH_WORDS[item.uriMatchMode].hint), children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(Panel, { title: "Item settings", size: "md", onClose, footer: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "primary", onClick: onClose, children: "Done" }), children: [
+    !canEdit ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { className: "px-1 text-sm text-muted-foreground", children: "View only: you can\u2019t change these settings." }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(VaultSection, { title: "In the browser", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultRow, { label: "Website matching", hint: quietHint(MATCH_WORDS[item.uriMatchMode].hint), children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
         import_controls10.Select,
         {
           "aria-label": "Website matching",
@@ -2821,45 +2825,45 @@ function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
           onValueChange: (m) => void save("match", () => port.fields.updateItem(item, { uriMatchMode: m }))
         }
       ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Fill in browser", hint: quietHint(fillHint), children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Switch, { "aria-label": "Fill in browser", checked: hasWebsite && item.browserFillEnabled, disabled: locked || !hasWebsite, onCheckedChange: (v) => void save("fill", () => port.fields.updateItem(item, { browserFillEnabled: v })) }) }),
-      promotable.map((f) => /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultRow, { label: "Fill in browser", hint: quietHint(fillHint), children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Switch, { "aria-label": "Fill in browser", checked: hasWebsite && item.browserFillEnabled, disabled: locked || !hasWebsite, onCheckedChange: (v) => void save("fill", () => port.fields.updateItem(item, { browserFillEnabled: v })) }) }),
+      promotable.map((f) => /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
         VaultRow,
         {
           label: f.label,
           hint: quietHint("Encrypted, so the browser can\u2019t match it"),
-          actions: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_icons6.GlobeIcon, {}), disabled: locked, onClick: () => void promote(f), children: "Use as website" }),
-          children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "text-muted-foreground", children: "Not a website yet" })
+          actions: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_icons6.GlobeIcon, {}), disabled: locked, onClick: () => void promote(f), children: "Use as website" }),
+          children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "text-muted-foreground", children: "Not a website yet" })
         },
         f.id
       ))
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "flex flex-col gap-1.5", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.DisclosureHeader, { open: advanced, title: "Advanced", meta: item.fields.length ? `${item.fields.length} fields` : void 0, onClick: () => setAdvanced((a) => !a) }),
-      advanced ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultSection, { children: item.fields.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Empty, { children: "No encrypted fields." }) : item.fields.map((f) => /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
+    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-col gap-1.5", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.DisclosureHeader, { open: advanced, title: "Advanced", meta: item.fields.length ? `${item.fields.length} fields` : void 0, onClick: () => setAdvanced((a) => !a) }),
+      advanced ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(VaultSection, { children: item.fields.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Empty, { children: "No encrypted fields." }) : item.fields.map((f) => /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
         VaultRow,
         {
           label: f.label,
-          actions: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls10.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(SlidersGlyph, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }),
-          children: /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("span", { className: "block truncate", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: f.handling === "sealed" ? "text-foreground" : "text-muted-foreground", children: HANDLING_WORDS[f.handling].label }),
-            f.envKey ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("span", { className: "font-mono text-muted-foreground", children: [
+          actions: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(SlidersGlyph, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }),
+          children: /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("span", { className: "block truncate", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: f.handling === "sealed" ? "text-foreground" : "text-muted-foreground", children: HANDLING_WORDS[f.handling].label }),
+            f.envKey ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("span", { className: "font-mono text-muted-foreground", children: [
               " \xB7 ",
               f.envKey
             ] }) : null,
-            f.injectIntoSandbox ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "text-muted-foreground", children: " \xB7 Sandbox" }) : null,
-            !f.active ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "text-warning", children: " \xB7 Turned off" }) : null
+            f.injectIntoSandbox ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "text-muted-foreground", children: " \xB7 Sandbox" }) : null,
+            !f.active ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "text-warning", children: " \xB7 Turned off" }) : null
           ] })
         },
         f.id
       )) }) : null
     ] }),
-    error ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(Problem, { children: error }) : null
+    error ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(Problem, { children: error }) : null
   ] });
 }
 
 // src/generator/PasswordGenerator.tsx
 var import_react15 = require("react");
-var import_design_system10 = require("@ai-matrx/design-system");
+var import_design_system11 = require("@ai-matrx/design-system");
 var import_controls11 = require("@ai-matrx/design-system/controls");
 var import_icons7 = require("@ai-matrx/design-system/icons");
 
@@ -2916,10 +2920,10 @@ function strengthOf(bits) {
 }
 
 // src/generator/PasswordGenerator.tsx
-var import_jsx_runtime14 = require("react/jsx-runtime");
+var import_jsx_runtime15 = require("react/jsx-runtime");
 var LimitsCtx = (0, import_react15.createContext)(null);
 function GeneratorLimitsProvider({ resolve: resolve2, children }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(LimitsCtx.Provider, { value: resolve2 ?? null, children });
+  return /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(LimitsCtx.Provider, { value: resolve2 ?? null, children });
 }
 function useGeneratorLimitsSource() {
   return (0, import_react15.useContext)(LimitsCtx);
@@ -2980,11 +2984,11 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   (0, import_react15.useEffect)(() => () => {
     if (expiry.current) clearTimeout(expiry.current);
   }, []);
-  if (limits.state === "loading") return /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { className: "px-1 py-3 text-sm text-muted-foreground", "aria-live": "polite", children: "Reading limits\u2026" });
+  if (limits.state === "loading") return /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { className: "px-1 py-3 text-sm text-muted-foreground", "aria-live": "polite", children: "Reading limits\u2026" });
   if (limits.state === "unavailable")
-    return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-col gap-2 px-1 py-2", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { role: "alert", className: "text-sm text-destructive", children: limits.message }),
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(RefreshGlyph, {}), onClick: () => setRound((n) => n + 1), children: "Try again" })
+    return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex flex-col gap-2 px-1 py-2", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { role: "alert", className: "text-sm text-destructive", children: limits.message }),
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(RefreshGlyph, {}), onClick: () => setRound((n) => n + 1), children: "Try again" })
     ] });
   const ceilings = limits.limits;
   const change = (next) => make(next, ceilings);
@@ -3001,8 +3005,8 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
     drop();
     onUse(value);
   };
-  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex w-full flex-col gap-3", "aria-label": "Password generator", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex w-full flex-col gap-3", "aria-label": "Password generator", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
       import_controls11.SegmentedControl,
       {
         fill: true,
@@ -3012,24 +3016,24 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
         data: [{ value: "password", label: "Password" }, { value: "passphrase", label: "Passphrase" }]
       }
     ),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-col gap-1 rounded-lg bg-muted px-3 py-2", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex min-h-7 items-start gap-1", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("code", { className: (0, import_design_system10.cn)("min-w-0 flex-1 break-all py-1 font-mono text-sm", candidate ? "text-foreground" : "text-muted-foreground"), "data-testid": "generated-value", children: candidate ? revealed ? candidate.value : MASK3 : "\u2014" }),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Button, { variant: "quiet", icon: revealed ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(EyeOffGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(EyeGlyph, {}), "aria-label": revealed ? "Hide" : "Reveal", disabled: !candidate, onClick: () => setRevealed((r) => !r) }),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_icons7.CopyIcon, {}), "aria-label": "Copy", disabled: !candidate, onClick: () => void copy() }),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(RefreshGlyph, {}), "aria-label": "Generate another", onClick: () => change(settings) })
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex flex-col gap-1 rounded-lg bg-muted px-3 py-2", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex min-h-7 items-start gap-1", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("code", { className: (0, import_design_system11.cn)("min-w-0 flex-1 break-all py-1 font-mono text-sm", candidate ? "text-foreground" : "text-muted-foreground"), "data-testid": "generated-value", children: candidate ? revealed ? candidate.value : MASK3 : "\u2014" }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Button, { variant: "quiet", icon: revealed ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(EyeOffGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(EyeGlyph, {}), "aria-label": revealed ? "Hide" : "Reveal", disabled: !candidate, onClick: () => setRevealed((r) => !r) }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_icons7.CopyIcon, {}), "aria-label": "Copy", disabled: !candidate, onClick: () => void copy() }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(RefreshGlyph, {}), "aria-label": "Generate another", onClick: () => change(settings) })
       ] }),
-      strength && candidate ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("p", { className: "text-xs", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: (0, import_design_system10.cn)(strength.tone === "success" && "text-success", strength.tone === "primary" && "text-primary", strength.tone === "warning" && "text-warning"), children: strength.label }),
-        /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("span", { className: "text-muted-foreground", children: [
+      strength && candidate ? /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("p", { className: "text-xs", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("span", { className: (0, import_design_system11.cn)(strength.tone === "success" && "text-success", strength.tone === "primary" && "text-primary", strength.tone === "warning" && "text-warning"), children: strength.label }),
+        /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("span", { className: "text-muted-foreground", children: [
           " \xB7 ",
           Math.floor(candidate.bits),
           "-bit"
         ] })
       ] }) : null
     ] }),
-    settings.kind === "password" ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-col gap-0.5", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(OptionLine, { label: "Length", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.NumberStepper, { value: settings.password.length, min: minPasswordLength(settings.password), max: ceilings.maxPasswordLength, fallback: 24, onChange: (length) => setPassword({ length }) }) }),
+    settings.kind === "password" ? /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex flex-col gap-0.5", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(OptionLine, { label: "Length", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.NumberStepper, { value: settings.password.length, min: minPasswordLength(settings.password), max: ceilings.maxPasswordLength, fallback: 24, onChange: (length) => setPassword({ length }) }) }),
       [
         ["lowercase", "Lowercase"],
         ["uppercase", "Uppercase"],
@@ -3038,26 +3042,26 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
       ].map(([key, label]) => {
         const on = settings.password[key];
         const last = on && minPasswordLength(settings.password) === 1;
-        return /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(OptionLine, { label, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Switch, { "aria-label": label, checked: on, disabled: last, onCheckedChange: (v) => setPassword({ [key]: v }) }) }, key);
+        return /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(OptionLine, { label, children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Switch, { "aria-label": label, checked: on, disabled: last, onCheckedChange: (v) => setPassword({ [key]: v }) }) }, key);
       }),
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(OptionLine, { label: "Avoid look-alikes", hint: "No 0/O, 1/l/I", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Switch, { "aria-label": "Avoid look-alikes", checked: settings.password.excludeAmbiguous, onCheckedChange: (v) => setPassword({ excludeAmbiguous: v }) }) })
-    ] }) : /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-col gap-0.5", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(OptionLine, { label: "Words", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.NumberStepper, { value: settings.passphrase.wordCount, min: MIN_PASSPHRASE_WORDS, max: ceilings.maxPassphraseWords, fallback: MIN_PASSPHRASE_WORDS, onChange: (wordCount) => change({ ...settings, passphrase: { ...settings.passphrase, wordCount } }) }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(OptionLine, { label: "Separator", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Select, { "aria-label": "Separator", variant: "inline", align: "end", value: settings.passphrase.separator, options: SEPARATORS, onValueChange: (separator) => change({ ...settings, passphrase: { ...settings.passphrase, separator } }) }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(OptionLine, { label: "Capitalize", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Switch, { "aria-label": "Capitalize", checked: settings.passphrase.capitalize, onCheckedChange: (capitalize) => change({ ...settings, passphrase: { ...settings.passphrase, capitalize } }) }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(OptionLine, { label: "Add a digit", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Switch, { "aria-label": "Add a digit", checked: settings.passphrase.appendDigit, onCheckedChange: (appendDigit) => change({ ...settings, passphrase: { ...settings.passphrase, appendDigit } }) }) })
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(OptionLine, { label: "Avoid look-alikes", hint: "No 0/O, 1/l/I", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Switch, { "aria-label": "Avoid look-alikes", checked: settings.password.excludeAmbiguous, onCheckedChange: (v) => setPassword({ excludeAmbiguous: v }) }) })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex flex-col gap-0.5", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(OptionLine, { label: "Words", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.NumberStepper, { value: settings.passphrase.wordCount, min: MIN_PASSPHRASE_WORDS, max: ceilings.maxPassphraseWords, fallback: MIN_PASSPHRASE_WORDS, onChange: (wordCount) => change({ ...settings, passphrase: { ...settings.passphrase, wordCount } }) }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(OptionLine, { label: "Separator", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Select, { "aria-label": "Separator", variant: "inline", align: "end", value: settings.passphrase.separator, options: SEPARATORS, onValueChange: (separator) => change({ ...settings, passphrase: { ...settings.passphrase, separator } }) }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(OptionLine, { label: "Capitalize", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Switch, { "aria-label": "Capitalize", checked: settings.passphrase.capitalize, onCheckedChange: (capitalize) => change({ ...settings, passphrase: { ...settings.passphrase, capitalize } }) }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(OptionLine, { label: "Add a digit", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Switch, { "aria-label": "Add a digit", checked: settings.passphrase.appendDigit, onCheckedChange: (appendDigit) => change({ ...settings, passphrase: { ...settings.passphrase, appendDigit } }) }) })
     ] }),
-    note ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { "aria-live": "polite", className: (0, import_design_system10.cn)("text-xs", note.tone === "destructive" ? "text-destructive" : note.tone === "success" ? "text-success" : "text-muted-foreground"), children: note.text }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Button, { variant: "primary", disabled: !candidate, onClick: use, children: useLabel })
+    note ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { "aria-live": "polite", className: (0, import_design_system11.cn)("text-xs", note.tone === "destructive" ? "text-destructive" : note.tone === "success" ? "text-success" : "text-muted-foreground"), children: note.text }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Button, { variant: "primary", disabled: !candidate, onClick: use, children: useLabel })
   ] });
 }
 function OptionLine({ label, hint, children }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex min-h-9 items-center justify-between gap-3", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex min-w-0 flex-col", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "truncate text-sm text-foreground", children: label }),
-      hint ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "truncate text-xs text-muted-foreground", children: hint }) : null
+  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex min-h-9 items-center justify-between gap-3", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex min-w-0 flex-col", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("span", { className: "truncate text-sm text-foreground", children: label }),
+      hint ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("span", { className: "truncate text-xs text-muted-foreground", children: hint }) : null
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("div", { className: "flex shrink-0 items-center", children })
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("div", { className: "flex shrink-0 items-center", children })
   ] });
 }
 function GenerateButton({ onUse, label, limits, disabled }) {
@@ -3066,9 +3070,9 @@ function GenerateButton({ onUse, label, limits, disabled }) {
   const [open, setOpen] = (0, import_react15.useState)(false);
   if (!source) return null;
   const name = label ?? "Generate password";
-  return /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)(import_design_system10.Popover, { open, onOpenChange: setOpen, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_design_system10.PopoverTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls11.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(KeyGlyph, {}), "aria-label": name, title: name, disabled }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_design_system10.PopoverContent, { sizing: "content", align: "end", children: open ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(import_design_system11.Popover, { open, onOpenChange: setOpen, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_design_system11.PopoverTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls11.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(KeyGlyph, {}), "aria-label": name, title: name, disabled }) }),
+    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_design_system11.PopoverContent, { sizing: "content", align: "end", children: open ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(
       PasswordGenerator,
       {
         limits: source,
@@ -3238,23 +3242,23 @@ function startNewRestoreRun(preview) {
 
 // src/io/lines.tsx
 var import_react17 = require("react");
-var import_design_system11 = require("@ai-matrx/design-system");
+var import_design_system12 = require("@ai-matrx/design-system");
 var import_controls12 = require("@ai-matrx/design-system/controls");
-var import_jsx_runtime15 = require("react/jsx-runtime");
+var import_jsx_runtime16 = require("react/jsx-runtime");
 function PickLine({ checked, onChange, disabled = false, title, detail, badge, tone }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("label", { className: "flex min-h-11 items-center gap-3 px-4 py-1", "data-clickable": disabled ? void 0 : "", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_design_system11.Checkbox, { checked, disabled, onCheckedChange: (v) => onChange(v === true), "aria-label": title }),
-    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("span", { className: "min-w-0 flex-1 truncate text-sm text-foreground", children: title }),
-    detail ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("span", { className: "hidden min-w-0 max-w-[45%] truncate text-xs text-muted-foreground sm:block", children: detail }) : null,
-    badge ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls12.Badge, { tone: tone ?? "neutral", children: badge }) : null
+  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("label", { className: "flex min-h-11 items-center gap-3 px-4 py-1", "data-clickable": disabled ? void 0 : "", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_design_system12.Checkbox, { checked, disabled, onCheckedChange: (v) => onChange(v === true), "aria-label": title }),
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("span", { className: "min-w-0 flex-1 truncate text-sm text-foreground", children: title }),
+    detail ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("span", { className: "hidden min-w-0 max-w-[45%] truncate text-xs text-muted-foreground sm:block", children: detail }) : null,
+    badge ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls12.Badge, { tone: tone ?? "neutral", children: badge }) : null
   ] });
 }
 function Windowed({ items, size = 150, render }) {
   const [all, setAll] = (0, import_react17.useState)(false);
   const shown = all ? items : items.slice(0, size);
-  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(import_jsx_runtime15.Fragment, { children: [
+  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
     shown.map(render),
-    items.length > shown.length ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("div", { className: "px-4 py-2", children: /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(import_controls12.Button, { variant: "quiet", onClick: () => setAll(true), children: [
+    items.length > shown.length ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("div", { className: "px-4 py-2", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_controls12.Button, { variant: "quiet", onClick: () => setAll(true), children: [
       "Show all ",
       items.length
     ] }) }) : null
@@ -3262,18 +3266,18 @@ function Windowed({ items, size = 150, render }) {
 }
 function More({ title = "More", children }) {
   const [open, setOpen] = (0, import_react17.useState)(false);
-  return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex flex-col gap-2", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls12.DisclosureHeader, { open, title, onClick: () => setOpen((o) => !o) }),
+  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "flex flex-col gap-2", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls12.DisclosureHeader, { open, title, onClick: () => setOpen((o) => !o) }),
     open ? children : null
   ] });
 }
 function ErrorLine({ message: message2 }) {
-  return message2 ? /* @__PURE__ */ (0, import_jsx_runtime15.jsx)("p", { role: "alert", className: "px-1 text-sm text-destructive", children: message2 }) : null;
+  return message2 ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { role: "alert", className: "px-1 text-sm text-destructive", children: message2 }) : null;
 }
 var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 
 // src/io/BackupPanel.tsx
-var import_jsx_runtime16 = require("react/jsx-runtime");
+var import_jsx_runtime17 = require("react/jsx-runtime");
 var RECORD_STATUS = {
   created: "Restored",
   replayed: "Already restored",
@@ -3285,17 +3289,17 @@ function omissionText(o) {
   return `${o.count ?? "Some"} ${what}: ${o.reason.replaceAll("_", " ")}`;
 }
 function Summary({ value }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(VaultSection, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: "Credentials", children: value.record_count }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: "Protected fields", children: value.field_count }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: "Files", children: value.attachment_count > 0 ? `${value.attachment_count} \xB7 ${(0, import_format6.formatFileSize)(value.attachment_bytes)}` : "0" })
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(VaultSection, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Credentials", children: value.record_count }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Protected fields", children: value.field_count }),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Files", children: value.attachment_count > 0 ? `${value.attachment_count} \xB7 ${(0, import_format6.formatFileSize)(value.attachment_bytes)}` : "0" })
   ] });
 }
 function Omissions({ omissions, accepted, onAccepted, verb }) {
   if (omissions.length === 0) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(VaultSection, { title: "Left out", children: [
-    omissions.map((o, i) => /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: o.component.replaceAll("_", " "), children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("span", { className: "block truncate text-muted-foreground", title: omissionText(o), children: omissionText(o) }) }, `${o.component}-${o.source_item_id ?? i}`)),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: "Accept", hint: `${verb} without these`, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Switch, { checked: accepted, onCheckedChange: onAccepted, "aria-label": `${verb} without these` }) })
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(VaultSection, { title: "Left out", children: [
+    omissions.map((o, i) => /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: o.component.replaceAll("_", " "), children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("span", { className: "block truncate text-muted-foreground", title: omissionText(o), children: omissionText(o) }) }, `${o.component}-${o.source_item_id ?? i}`)),
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Accept", hint: `${verb} without these`, children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Switch, { checked: accepted, onCheckedChange: onAccepted, "aria-label": `${verb} without these` }) })
   ] });
 }
 function BackupPanel({ port, items, onClose, onChanged }) {
@@ -3401,21 +3405,21 @@ function BackupPanel({ port, items, onClose, onChanged }) {
   const retryable = (result?.retryable_failure ?? 0) > 0;
   const mismatch = repeat !== "" && repeat !== passphrase;
   const names = new Map(restorePreview?.records.map((r) => [r.source_item_id, r.display_name]) ?? []);
-  const footer = mode === "backup" ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "quiet", onClick: onClose, children: "Close" }),
-    backup ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "primary", disabled: busy || !passphrase || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_controls13.Button, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
+  const footer = mode === "backup" ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "quiet", onClick: onClose, children: "Close" }),
+    backup ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "primary", disabled: busy || !passphrase || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_controls13.Button, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
       "Review ",
       selected.size
     ] })
-  ] }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "quiet", onClick: onClose, children: result && !retryable ? "Done" : "Close" }),
-    result ? retryable ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "primary", disabled: busy, onClick: () => void restore(), children: "Try again" }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "outline", disabled: busy, onClick: () => void again(), children: "Restore again" }) : restorePreview ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_controls13.Button, { variant: "primary", disabled: busy || restorePreview.omissions.length > 0 && !accepted, onClick: () => void restore(), children: [
+  ] }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "quiet", onClick: onClose, children: result && !retryable ? "Done" : "Close" }),
+    result ? retryable ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "primary", disabled: busy, onClick: () => void restore(), children: "Try again" }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "outline", disabled: busy, onClick: () => void again(), children: "Restore again" }) : restorePreview ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_controls13.Button, { variant: "primary", disabled: busy || restorePreview.omissions.length > 0 && !accepted, onClick: () => void restore(), children: [
       "Restore ",
       restorePreview.record_count
-    ] }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "primary", disabled: busy || !file || !passphrase, onClick: () => void reviewRestore(), children: "Review" })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "primary", disabled: busy || !file || !passphrase, onClick: () => void reviewRestore(), children: "Review" })
   ] });
-  return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(Panel, { title: "Backup", size: "lg", onClose, footer, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(Panel, { title: "Backup", size: "lg", onClose, footer, children: [
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
       import_controls13.SegmentedControl,
       {
         value: mode,
@@ -3428,36 +3432,36 @@ function BackupPanel({ port, items, onClose, onChanged }) {
         ]
       }
     ),
-    mode === "backup" ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+    mode === "backup" ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
         VaultSection,
         {
           title: `${selected.size} of ${plural(items.length, "credential")}`,
-          actions: /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
-            /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "quiet", disabled: busy || items.length === 0, onClick: () => {
+          actions: /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "quiet", disabled: busy || items.length === 0, onClick: () => {
               setBackup(null);
               setSelected(new Set(items.map((i) => i.id)));
             }, children: "All" }),
-            /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "quiet", disabled: busy || selected.size === 0, onClick: () => {
+            /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "quiet", disabled: busy || selected.size === 0, onClick: () => {
               setBackup(null);
               setSelected(/* @__PURE__ */ new Set());
             }, children: "None" })
           ] }),
-          children: items.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Empty, { children: "Nothing to back up yet." }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Windowed, { items, render: (i) => /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(PickLine, { title: i.name, detail: i.definitionLabel, checked: selected.has(i.id), disabled: busy, onChange: (on) => pick(i.id, on) }, i.id) })
+          children: items.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Empty, { children: "Nothing to back up yet." }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Windowed, { items, render: (i) => /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(PickLine, { title: i.name, detail: i.definitionLabel, checked: selected.has(i.id), disabled: busy, onChange: (on) => pick(i.id, on) }, i.id) })
         }
       ),
-      backup ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Summary, { value: backup }),
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(VaultSection, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: "Passphrase", hint: "Not saved. It can't be recovered.", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) }),
-          /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: "Repeat", ...mismatch ? { hint: "Doesn't match" } : {}, children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Field, { type: "password", value: repeat, autoComplete: "new-password", "aria-label": "Repeat the passphrase", onChange: (e) => setRepeat(e.target.value) }) })
+      backup ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Summary, { value: backup }),
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(VaultSection, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Passphrase", hint: "Not saved. It can't be recovered.", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) }),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Repeat", ...mismatch ? { hint: "Doesn't match" } : {}, children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: repeat, autoComplete: "new-password", "aria-label": "Repeat the passphrase", onChange: (e) => setRepeat(e.target.value) }) })
         ] })
       ] }) : null
-    ] }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_jsx_runtime16.Fragment, { children: !restorePreview ? /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(VaultSection, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(VaultRow, { label: "File", ...file ? { hint: file.name } : {}, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Button, { variant: "outline", disabled: busy, onClick: () => fileInput.current?.click(), children: "Choose a backup" }),
-        /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_jsx_runtime17.Fragment, { children: !restorePreview ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(VaultSection, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(VaultRow, { label: "File", ...file ? { hint: file.name } : {}, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "outline", disabled: busy, onClick: () => fileInput.current?.click(), children: "Choose a backup" }),
+        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
           "input",
           {
             ref: fileInput,
@@ -3471,16 +3475,16 @@ function BackupPanel({ port, items, onClose, onChanged }) {
           }
         )
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: "Passphrase", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "current-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) })
-    ] }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Summary, { value: restorePreview }),
-      !result ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(Omissions, { omissions: restorePreview.omissions, accepted, onAccepted: setAccepted, verb: "Restore" }) : null,
-      !result ? /* @__PURE__ */ (0, import_jsx_runtime16.jsx)("p", { className: "px-1 text-xs text-muted-foreground", children: "Restored items start disabled and restricted." }) : /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultSection, { title: `${result.created} restored \xB7 ${result.replayed} already \xB7 ${result.refused} refused \xB7 ${result.retryable_failure} to retry`, children: result.results.map((r) => /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(VaultRow, { label: names.get(r.source_item_id) ?? "Credential", children: /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("span", { className: r.status === "refused" || r.status === "retryable_failure" ? "text-destructive" : "text-foreground", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Passphrase", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "current-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) })
+    ] }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Summary, { value: restorePreview }),
+      !result ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Omissions, { omissions: restorePreview.omissions, accepted, onAccepted: setAccepted, verb: "Restore" }) : null,
+      !result ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)("p", { className: "px-1 text-xs text-muted-foreground", children: "Restored items start disabled and restricted." }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultSection, { title: `${result.created} restored \xB7 ${result.replayed} already \xB7 ${result.refused} refused \xB7 ${result.retryable_failure} to retry`, children: result.results.map((r) => /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: names.get(r.source_item_id) ?? "Credential", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("span", { className: r.status === "refused" || r.status === "retryable_failure" ? "text-destructive" : "text-foreground", children: [
         RECORD_STATUS[r.status],
         r.reason === "alias_conflict" ? " \xB7 name in use" : ""
       ] }) }, r.source_item_id)) })
     ] }) }),
-    /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(ErrorLine, { message: error })
+    /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(ErrorLine, { message: error })
   ] });
 }
 
@@ -3489,7 +3493,7 @@ var import_react19 = require("react");
 var import_controls14 = require("@ai-matrx/design-system/controls");
 var import_download2 = require("@ai-matrx/kit/download");
 var import_confirm_opener5 = require("@ai-matrx/kit/confirm-opener");
-var import_jsx_runtime17 = require("react/jsx-runtime");
+var import_jsx_runtime18 = require("react/jsx-runtime");
 var FORMATS = [
   { value: "matrx_login_csv_v1", label: "Matrx", hint: "Website logins, all common fields" },
   { value: "firefox_csv_v1", label: "Firefox", hint: "Address, username and password" },
@@ -3563,24 +3567,24 @@ function ExportPanel({ port, items, onClose }) {
       setBusy(false);
     }
   };
-  return /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(
+  return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(
     Panel,
     {
       title: "Export logins",
       size: "lg",
       onClose,
-      footer: /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls14.Button, { variant: "quiet", onClick: onClose, children: "Close" }),
-        preview ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_controls14.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(ExportGlyph, { className: "size-4" }), disabled: busy || eligible === 0, onClick: () => void download(), children: [
+      footer: /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls14.Button, { variant: "quiet", onClick: onClose, children: "Close" }),
+        preview ? /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_controls14.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ExportGlyph, { className: "size-4" }), disabled: busy || eligible === 0, onClick: () => void download(), children: [
           "Download ",
           eligible
-        ] }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_controls14.Button, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void review(), children: [
+        ] }) : /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_controls14.Button, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void review(), children: [
           "Review ",
           selected.size
         ] })
       ] }),
       children: [
-        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultSection, { children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Format", hint: format?.hint, children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultSection, { children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Format", hint: format?.hint, children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
           import_controls14.Select,
           {
             value: profile,
@@ -3592,21 +3596,21 @@ function ExportPanel({ port, items, onClose }) {
             }
           }
         ) }) }),
-        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
           VaultSection,
           {
             title: `${selected.size} of ${plural(logins.length, "login")}`,
-            actions: /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
-              /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls14.Button, { variant: "quiet", disabled: busy || logins.length === 0, onClick: () => {
+            actions: /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
+              /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls14.Button, { variant: "quiet", disabled: busy || logins.length === 0, onClick: () => {
                 changed();
                 setSelected(new Set(logins.map((l) => l.id)));
               }, children: "All" }),
-              /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls14.Button, { variant: "quiet", disabled: busy || selected.size === 0, onClick: () => {
+              /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls14.Button, { variant: "quiet", disabled: busy || selected.size === 0, onClick: () => {
                 changed();
                 setSelected(/* @__PURE__ */ new Set());
               }, children: "None" })
             ] }),
-            children: logins.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Empty, { children: "No website logins to export." }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+            children: logins.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Empty, { children: "No website logins to export." }) : /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
               Windowed,
               {
                 items: logins,
@@ -3614,7 +3618,7 @@ function ExportPanel({ port, items, onClose }) {
                   const p = reasons.get(item.id);
                   const left = p && !p.eligible;
                   const omitted = p ? omissionText2(p.omissions) : "";
-                  return /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(
+                  return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
                     PickLine,
                     {
                       title: item.name,
@@ -3632,7 +3636,7 @@ function ExportPanel({ port, items, onClose }) {
             )
           }
         ),
-        /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(ErrorLine, { message: error })
+        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ErrorLine, { message: error })
       ]
     }
   );
@@ -4150,7 +4154,7 @@ var import_zip2 = require("@zip.js/zip.js");
 var safe = (value) => Number.isSafeInteger(value) && value >= 0;
 var unsafeName = (name) => /[\\\0-\x1F\x7F-\x9F]/.test(name);
 function stopIfCancelled(signal) {
-  if (signal?.aborted) throw new Error("The archive import was cancelled.");
+  if (signal?.aborted) throw new Error("The archive import was canceled.");
 }
 function hasWarnings(reader, entry) {
   return Boolean(reader.warnings?.length || entry.warnings?.length);
@@ -4251,7 +4255,7 @@ async function openBoundedZip(file, limits, signal) {
     };
   } catch (error) {
     await reader.close();
-    if (signal?.aborted) throw new Error("The archive import was cancelled.");
+    if (signal?.aborted) throw new Error("The archive import was canceled.");
     throw error;
   }
 }
@@ -4290,7 +4294,7 @@ async function readDashlaneCsvArchive(file, limits, signal) {
     return { credentialsText, omittedCsvCount };
   } catch (error) {
     credentialsText = void 0;
-    if (signal?.aborted) throw new Error("The Dashlane import was cancelled.");
+    if (signal?.aborted) throw new Error("The Dashlane import was canceled.");
     throw error;
   } finally {
     credentialsText = void 0;
@@ -4425,7 +4429,7 @@ function hasValidStructuredImportFileNotices(value, maxCount) {
 }
 
 // src/io/parse-source.ts
-var cancelled = () => new Error("The import was cancelled.");
+var cancelled = () => new Error("The import was canceled.");
 function parseStructured(source, file, limits, signal) {
   const descriptor = structuredImportSource(source);
   if (!descriptor) return Promise.reject(new Error("This kind of file cannot be imported."));
@@ -4478,7 +4482,7 @@ async function parseImportFile(source, file, limits, signal) {
 }
 
 // src/io/ImportPanel.tsx
-var import_jsx_runtime18 = require("react/jsx-runtime");
+var import_jsx_runtime19 = require("react/jsx-runtime");
 var ROLE_OPTIONS = [
   { value: "keep", label: "Keep encrypted" },
   { value: "title", label: "Name" },
@@ -4653,26 +4657,26 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
   const help = EXPORT_HELP[source];
   const stage = done ? "done" : draft ? "review" : "choose";
   const busy = running !== null || reading;
-  const footer = stage === "choose" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "quiet", onClick: onClose, children: "Close" }),
-    source === "env" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ImportGlyph, { className: "size-4" }), disabled: !envText.trim(), onClick: () => reviewEnv(envText), children: "Review" }) : null
-  ] }) : stage === "review" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
-    running ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "outline", onClick: () => stop.current = true, children: "Stop" }) : /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "quiet", onClick: reset, children: "Back" }),
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ImportGlyph, { className: "size-4" }), disabled: busy || chosen === 0 || ambiguous === true || needsApproval, onClick: start, children: running ? `Importing ${running.done} of ${running.total}` : `Import ${chosen}` })
-  ] }) : /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
-    done && done.failed.length + done.untried.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "outline", disabled: busy, onClick: retry, children: running ? `Importing ${running.done} of ${running.total}` : `Try ${done.failed.length + done.untried.length} again` }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "primary", onClick: onClose, children: "Done" })
+  const footer = stage === "choose" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(import_jsx_runtime19.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "quiet", onClick: onClose, children: "Close" }),
+    source === "env" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(ImportGlyph, { className: "size-4" }), disabled: !envText.trim(), onClick: () => reviewEnv(envText), children: "Review" }) : null
+  ] }) : stage === "review" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(import_jsx_runtime19.Fragment, { children: [
+    running ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "outline", onClick: () => stop.current = true, children: "Stop" }) : /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "quiet", onClick: reset, children: "Back" }),
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(ImportGlyph, { className: "size-4" }), disabled: busy || chosen === 0 || ambiguous === true || needsApproval, onClick: start, children: running ? `Importing ${running.done} of ${running.total}` : `Import ${chosen}` })
+  ] }) : /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(import_jsx_runtime19.Fragment, { children: [
+    done && done.failed.length + done.untried.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "outline", disabled: busy, onClick: retry, children: running ? `Importing ${running.done} of ${running.total}` : `Try ${done.failed.length + done.untried.length} again` }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "primary", onClick: onClose, children: "Done" })
   ] });
-  return /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(Panel, { title: "Import", size: "xl", onClose, footer, children: [
-    stage === "choose" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(VaultSection, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Source", actions: help && host.openUrl ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "quiet", onClick: () => host.openUrl?.(help), children: "How to export" }) : void 0, children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Select, { value: source, options: SOURCE_OPTIONS, "aria-label": "Source", onValueChange: (s) => {
+  return /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(Panel, { title: "Import", size: "xl", onClose, footer, children: [
+    stage === "choose" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(VaultSection, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Source", actions: help && host.openUrl ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "quiet", onClick: () => host.openUrl?.(help), children: "How to export" }) : void 0, children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Select, { value: source, options: SOURCE_OPTIONS, "aria-label": "Source", onValueChange: (s) => {
         setSource(s);
         setError(null);
       } }) }),
-      source === "env" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: ".env text", hint: "Same key updates in place", top: true, children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Textarea, { mono: true, rows: 7, value: envText, autoComplete: "off", spellCheck: false, "aria-label": ".env text", placeholder: "OPENAI_API_KEY=sk-...\nDATABASE_URL=postgres://...", onChange: (e) => setEnvText(e.target.value) }) }) : null,
-      /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(VaultRow, { label: "File", hint: fileName ?? void 0, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "outline", disabled: reading, onClick: () => fileInput.current?.click(), children: reading ? "Reading\u2026" : source === "env" ? "Load a file" : "Choose a file" }),
-        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
+      source === "env" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: ".env text", hint: "Same key updates in place", top: true, children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Textarea, { mono: true, rows: 7, value: envText, autoComplete: "off", spellCheck: false, "aria-label": ".env text", placeholder: "OPENAI_API_KEY=sk-...\nDATABASE_URL=postgres://...", onChange: (e) => setEnvText(e.target.value) }) }) : null,
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(VaultRow, { label: "File", hint: fileName ?? void 0, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "outline", disabled: reading, onClick: () => fileInput.current?.click(), children: reading ? "Reading\u2026" : source === "env" ? "Load a file" : "Choose a file" }),
+        /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(
           "input",
           {
             ref: fileInput,
@@ -4687,44 +4691,44 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
           }
         )
       ] }),
-      source === "env" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Sandboxes", hint: "Pass these values to agent sandboxes", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Switch, { checked: injectSandbox, onCheckedChange: setInjectSandbox, "aria-label": "Use in sandboxes" }) }) : null
+      source === "env" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Sandboxes", hint: "Pass these values to agent sandboxes", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Switch, { checked: injectSandbox, onCheckedChange: setInjectSandbox, "aria-label": "Use in sandboxes" }) }) : null
     ] }) : null,
-    stage === "review" && draft ? /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
-      organizations.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultSection, { children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Save to", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Select, { value: destination, options: destinationOptions, "aria-label": "Save to", onValueChange: (v) => draft.kind === "file" ? restart({ destination: v }) : setDestination(v) }) }) }) : null,
-      /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
+    stage === "review" && draft ? /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(import_jsx_runtime19.Fragment, { children: [
+      organizations.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultSection, { children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Save to", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Select, { value: destination, options: destinationOptions, "aria-label": "Save to", onValueChange: (v) => draft.kind === "file" ? restart({ destination: v }) : setDestination(v) }) }) }) : null,
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(
         VaultSection,
         {
           title: draft.kind === "env" ? plural(envKeys.length, "value") : summary(counts, lines.length),
-          actions: /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(import_jsx_runtime18.Fragment, { children: [
-            /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "quiet", disabled: busy, onClick: () => setSelected(draft.kind === "env" ? new Set(envKeys.map((e) => e.key + e.text)) : defaultSelection(lines)), children: "Reset" }),
-            /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Button, { variant: "quiet", disabled: busy, onClick: () => setSelected(/* @__PURE__ */ new Set()), children: "None" })
+          actions: /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(import_jsx_runtime19.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "quiet", disabled: busy, onClick: () => setSelected(draft.kind === "env" ? new Set(envKeys.map((e) => e.key + e.text)) : defaultSelection(lines)), children: "Reset" }),
+            /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Button, { variant: "quiet", disabled: busy, onClick: () => setSelected(/* @__PURE__ */ new Set()), children: "None" })
           ] }),
-          children: draft.kind === "env" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
+          children: draft.kind === "env" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(
             Windowed,
             {
               items: envKeys,
               render: (e) => {
                 const id = e.key + e.text;
-                return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(PickLine, { title: e.key, detail: "Value hidden", checked: selected.has(id), disabled: busy, onChange: (on) => toggle(setSelected, id, on) }, id);
+                return /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(PickLine, { title: e.key, detail: "Value hidden", checked: selected.has(id), disabled: busy, onChange: (on) => toggle(setSelected, id, on) }, id);
               }
             }
-          ) : lines.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Empty, { children: "Nothing to import in this file." }) : /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
+          ) : lines.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(Empty, { children: "Nothing to import in this file." }) : /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(
             Windowed,
             {
               items: lines,
               render: (l) => {
                 const badge = STATE_BADGE[l.state];
-                return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(PickLine, { title: l.title, detail: l.reason ?? l.detail, checked: selected.has(l.key), disabled: busy || !selectable(l), badge: badge?.text, tone: badge?.tone, onChange: (on) => toggle(setSelected, l.key, on) }, l.key);
+                return /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(PickLine, { title: l.title, detail: l.reason ?? l.detail, checked: selected.has(l.key), disabled: busy || !selectable(l), badge: badge?.text, tone: badge?.tone, onChange: (on) => toggle(setSelected, l.key, on) }, l.key);
               }
             }
           )
         }
       ),
-      draft.kind === "file" && draft.parsed.kind === "structured" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultSection, { children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Visible details", hint: "Approve saving websites and public keys in the clear", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Switch, { checked: approvedVisible, disabled: busy, onCheckedChange: setApprovedVisible, "aria-label": "Approve visible details" }) }) }) : null,
-      draft.kind === "file" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(Notices, { draft }) : null,
-      draft.kind === "file" ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(More, { children: /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(VaultSection, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Browser fill", hint: "Needs username, password and an https address", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(import_controls15.Switch, { checked: browserFill, disabled: busy, onCheckedChange: (on) => restart({ browserFill: on }), "aria-label": "Browser fill" }) }),
-        draft.parsed.kind === "csv" ? draft.parsed.preview.headers.map((header, index) => /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: header || `Column ${index + 1}`, children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(
+      draft.kind === "file" && draft.parsed.kind === "structured" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultSection, { children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Visible details", hint: "Approve saving websites and public keys in the clear", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Switch, { checked: approvedVisible, disabled: busy, onCheckedChange: setApprovedVisible, "aria-label": "Approve visible details" }) }) }) : null,
+      draft.kind === "file" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(Notices, { draft }) : null,
+      draft.kind === "file" ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(More, { children: /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(VaultSection, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Browser fill", hint: "Needs username, password and an https address", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(import_controls15.Switch, { checked: browserFill, disabled: busy, onCheckedChange: (on) => restart({ browserFill: on }), "aria-label": "Browser fill" }) }),
+        draft.parsed.kind === "csv" ? draft.parsed.preview.headers.map((header, index) => /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: header || `Column ${index + 1}`, children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(
           import_controls15.Select,
           {
             value: draft.mapping[index] ?? "keep",
@@ -4734,20 +4738,20 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
           }
         ) }, `${header}-${index}`)) : null
       ] }) }) : null,
-      ambiguous ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ErrorLine, { message: "Each of name, username, password, notes and one-time password can be used by one column." }) : null
+      ambiguous ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(ErrorLine, { message: "Each of name, username, password, notes and one-time password can be used by one column." }) : null
     ] }) : null,
-    stage === "done" && done ? /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)(VaultSection, { title: "Result", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Created", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { className: "text-foreground", children: done.created.length }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Skipped", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { className: "text-foreground", children: done.skipped }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Failed", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { className: done.failed.length > 0 ? "text-destructive" : "text-foreground", children: done.failed.length }) }),
-      done.untried.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Not tried", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { className: "text-foreground", children: done.untried.length }) }) : null,
-      done.withOtp > 0 ? /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: "Codes", children: /* @__PURE__ */ (0, import_jsx_runtime18.jsxs)("span", { className: "text-muted-foreground", children: [
+    stage === "done" && done ? /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)(VaultSection, { title: "Result", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Created", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "text-foreground", children: done.created.length }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Skipped", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "text-foreground", children: done.skipped }) }),
+      /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Failed", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: done.failed.length > 0 ? "text-destructive" : "text-foreground", children: done.failed.length }) }),
+      done.untried.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Not tried", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "text-foreground", children: done.untried.length }) }) : null,
+      done.withOtp > 0 ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Codes", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)("span", { className: "text-muted-foreground", children: [
         plural(done.withOtp, "login"),
         " still need the one-time password added."
       ] }) }) : null,
-      done.failed.map((f) => /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(VaultRow, { label: f.title, children: /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { className: "block truncate text-destructive", title: f.reason, children: f.reason }) }, f.key))
+      done.failed.map((f) => /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: f.title, children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "block truncate text-destructive", title: f.reason, children: f.reason }) }, f.key))
     ] }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime18.jsx)(ErrorLine, { message: error })
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(ErrorLine, { message: error })
   ] });
 }
 function toggle(set, key, on) {
@@ -4774,7 +4778,7 @@ function Notices({ draft }) {
     }
   }
   if (notes.length === 0) return null;
-  return /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("div", { className: "flex flex-col gap-0.5 px-1 text-xs text-muted-foreground", children: notes.map((n) => /* @__PURE__ */ (0, import_jsx_runtime18.jsx)("span", { children: n }, n)) });
+  return /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("div", { className: "flex flex-col gap-0.5 px-1 text-xs text-muted-foreground", children: notes.map((n) => /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { children: n }, n)) });
 }
 
 // src/ItemList.tsx
@@ -4783,20 +4787,6 @@ var import_design_system18 = require("@ai-matrx/design-system");
 var import_design_system19 = require("@ai-matrx/design-system");
 var import_controls22 = require("@ai-matrx/design-system/controls");
 
-// src/ItemIcon.tsx
-var import_design_system12 = require("@ai-matrx/design-system");
-var import_jsx_runtime19 = require("react/jsx-runtime");
-function ItemIcon({ definitionKey, family, site, size = "md", inverted = false }) {
-  const box = size === "lg" ? "size-10 rounded-xl text-base" : size === "md" ? "size-8 rounded-lg text-sm" : "size-6 rounded-md text-xs";
-  const tone = inverted ? "bg-primary-foreground text-primary" : "bg-muted text-foreground";
-  const initial = siteDomainOf(site).charAt(0).toUpperCase();
-  if (initial && /[A-Z0-9]/.test(initial)) {
-    return /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { "aria-hidden": true, className: (0, import_design_system12.cn)("flex shrink-0 items-center justify-center font-semibold", box, tone), children: initial });
-  }
-  const Glyph = definitionGlyph(definitionKey, family);
-  return /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { "aria-hidden": true, className: (0, import_design_system12.cn)("flex shrink-0 items-center justify-center", box, tone), children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(Glyph, { className: size === "lg" ? "size-5" : "size-4" }) });
-}
-
 // src/ItemPane.tsx
 var import_react27 = require("react");
 var import_design_system16 = require("@ai-matrx/design-system");
@@ -5719,6 +5709,8 @@ function ItemPane(props) {
   const [tagsText, setTagsText] = (0, import_react27.useState)(base.tags.join(", "));
   const [showTags, setShowTags] = (0, import_react27.useState)(false);
   const [showDescription, setShowDescription] = (0, import_react27.useState)(false);
+  const [showRecovery, setShowRecovery] = (0, import_react27.useState)(false);
+  const [settingUpOtp, setSettingUpOtp] = (0, import_react27.useState)(false);
   const [owner, setOwner] = (0, import_react27.useState)(defaultOwner ?? "me");
   const [recipient, setRecipient] = (0, import_react27.useState)("");
   const [generatePrivately, setGeneratePrivately] = (0, import_react27.useState)(false);
@@ -5747,6 +5739,7 @@ function ItemPane(props) {
     setLoaded({});
     setShowTags(false);
     setShowDescription(false);
+    setShowRecovery(false);
   }, [item?.id, mode]);
   (0, import_react27.useEffect)(() => onDirty(dirty), [dirty, onDirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
@@ -5774,23 +5767,24 @@ function ItemPane(props) {
     setBusy(true);
     setError(null);
     const out = { ...draft, values: Object.fromEntries(changedValues(base, draft)) };
+    if (out.values[RECOVERY_CODES_KEY] !== void 0) out.values[RECOVERY_CODES_KEY] = parseRecoveryCodes(out.values[RECOVERY_CODES_KEY]).join("\n");
     const withOtp = async (saved, notice2) => {
       const setup = out.authenticator.trim();
-      if (!setup) return [saved, notice2];
+      if (!setup) return [saved, notice2, false];
       try {
         await confirmed(() => port.authenticator.enrol(saved, setup));
-        return [await port.get(saved), notice2];
+        return [await port.get(saved), notice2, true];
       } catch (e) {
         const why = wasCancelled(e) ? "it was not confirmed" : e instanceof Error ? e.message : "it was refused";
-        return [saved, `Saved, but the one-time password was not set up: ${why}. Add it with Edit.`];
+        return [saved, `Saved, but the authenticator was not set up: ${why}. Add it with Edit.`, false];
       }
     };
     try {
       if (item) {
         const r = await port.save(item, definition, out);
-        const [next, n] = await withOtp(r.item, r.notice);
+        const [next, n, enrolled] = await withOtp(r.item, r.notice);
         (0, import_drafts.dropKeptDraft)(keepKey);
-        onSaved(next, false, n);
+        onSaved(next, false, n, enrolled);
       } else if (definition && owner === "person") {
         const secretKey = declared.find((f) => f.storage === "encrypted" && f.kind === "secret")?.key ?? null;
         const r = await port.sharing.assign({ recipientEmail: recipient.trim(), definition, draft: out, generateFieldKey: generatePrivately ? secretKey : null });
@@ -5798,9 +5792,9 @@ function ItemPane(props) {
         onCancelNew();
       } else if (definition) {
         const r = await port.create(definition, owner === "me" ? null : owner, out);
-        const [next, n] = await withOtp(r.item, r.notice);
+        const [next, n, enrolled] = await withOtp(r.item, r.notice);
         (0, import_drafts.dropKeptDraft)(keepKey);
-        onSaved(next, true, n);
+        onSaved(next, true, n, enrolled);
       }
     } catch (e) {
       setError(e instanceof Error ? e.message : "Saving failed. Nothing was changed.");
@@ -5859,6 +5853,10 @@ function ItemPane(props) {
   const viewCustom = (item?.custom ?? []).filter((c) => !declaredKeys.has(c.key) && c.key !== MFA_METHOD_KEY && !isAuthenticatorStorage(c.key));
   const isLogin = (item?.definitionKey ?? definition?.key) === "website_login" || (item?.definitionKey ?? definition?.key) === "username_password";
   const typeLabel = definition?.label ?? item?.definitionLabel ?? "";
+  const recoveryDeclared = declaredKeys.has(RECOVERY_CODES_KEY);
+  const recoveryExtra = extraFields.some(isRecoveryCodesField);
+  const offerRecovery = isLogin || Boolean(item?.authenticator) || draft.authenticator.trim() !== "";
+  const recoveryEditing = !recoveryDeclared && !recoveryExtra && (showRecovery || (draft.values[RECOVERY_CODES_KEY] ?? "") !== "");
   const shownOwner = mode === "new" ? owner === "me" ? { label: "Personal", glyph: /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(PersonGlyph, {}) } : owner === "person" ? { label: "Someone else", glyph: /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(SendGlyph, {}) } : { label: organizations.find((o) => o.id === owner)?.name ?? "Organization", glyph: /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(BuildingGlyph, {}) } : item ? { label: item.owner.label, glyph: item.owner.kind === "me" ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(PersonGlyph, {}) : item.owner.kind === "organization" ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(BuildingGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(import_icons11.UsersIcon, {}) } : null;
   const sameNamed = (id) => {
     const name = organizations.find((o) => o.id === id)?.name.trim().toLowerCase();
@@ -6006,7 +6004,8 @@ function ItemPane(props) {
             label: f.label,
             value: draft.values[f.key] ?? "",
             placeholder: f.handling === "visible" || f.key in loaded ? "" : "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
-            secret: f.handling !== "visible",
+            secret: f.handling !== "visible" && !isRecoveryCodesField(f),
+            multiline: isRecoveryCodesField(f),
             onChange: (v) => setValue(f.key, v),
             onRemove: () => patch({ removed: [...draft.removed, f.id] }),
             removeLabel: `Delete ${f.label}`,
@@ -6043,7 +6042,27 @@ function ItemPane(props) {
         )),
         /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
         /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
-        item && isLogin && !item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(TwoFactorMethodRow, { port, item, onChanged }) : null
+        item && isLogin && !item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(TwoFactorMethodRow, { port, item, onChanged }) : null,
+        recoveryEditing ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(
+          EditRow,
+          {
+            label: "Recovery codes",
+            value: draft.values[RECOVERY_CODES_KEY] ?? "",
+            multiline: true,
+            autoFocus: showRecovery && (draft.values[RECOVERY_CODES_KEY] ?? "") === "",
+            placeholder: "Backup codes, one per line",
+            onChange: (v) => setValue(RECOVERY_CODES_KEY, v),
+            onRemove: () => {
+              setShowRecovery(false);
+              setDraft((d) => {
+                const values = { ...d.values };
+                delete values[RECOVERY_CODES_KEY];
+                return { ...d, values };
+              });
+            },
+            removeLabel: "Remove recovery codes"
+          }
+        ) : !recoveryDeclared && !recoveryExtra && offerRecovery ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(AddRow, { label: "Recovery codes", onAdd: () => setShowRecovery(true), children: "Add backup codes" }) : null
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(VaultSection, { children: /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(EditRow, { label: "Notes", value: draft.notes, multiline: true, placeholder: "Anything worth remembering", onChange: (v) => patch({ notes: v }) }) }),
       /* @__PURE__ */ (0, import_jsx_runtime26.jsxs)(
@@ -6056,7 +6075,8 @@ function ItemPane(props) {
               /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(import_design_system16.DropdownMenuItem, { onSelect: () => patch({ secrets: [...draft.secrets, { key: "", label: "", value: "" }] }), children: "Secret field" }),
               /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(import_design_system16.DropdownMenuItem, { onSelect: () => patch({ custom: [...draft.custom, { key: `custom_${draft.custom.length + 1}_${Date.now() % 1e5}`, label: "", value: "" }] }), children: "Text field" }),
               !tagsVisible ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(import_design_system16.DropdownMenuItem, { onSelect: () => setShowTags(true), children: "Tags" }) : null,
-              !descriptionVisible ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(import_design_system16.DropdownMenuItem, { onSelect: () => setShowDescription(true), children: "Description" }) : null
+              !descriptionVisible ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(import_design_system16.DropdownMenuItem, { onSelect: () => setShowDescription(true), children: "Description" }) : null,
+              !recoveryDeclared && !recoveryExtra && !recoveryEditing ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(import_design_system16.DropdownMenuItem, { onSelect: () => setShowRecovery(true), children: "Recovery codes" }) : null
             ] })
           ] }),
           children: [
@@ -6096,8 +6116,9 @@ function ItemPane(props) {
         item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
           // The secret is still there, only off: turning it on brings the codes back. Never "Set up",
           // which would invite replacing a working two-factor secret.
-          /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(VaultRow, { label: "One-time password", actions: canTurnOn ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(TurnOnButton, { label: "One-time password", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ (0, import_jsx_runtime26.jsx)("span", { className: "text-muted-foreground", children: "Turned off" }) })
-        ) : /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(AddRow, { label: "One-time password", onAdd: canEdit ? () => onMode("edit") : null, children: "Set up" }),
+          /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(VaultRow, { label: "Authenticator", actions: canTurnOn ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(TurnOnButton, { label: "Authenticator", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ (0, import_jsx_runtime26.jsx)("span", { className: "text-muted-foreground", children: "Turned off" }) })
+        ) : /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(AddRow, { label: "Authenticator", onAdd: canEdit ? () => setSettingUpOtp(true) : null, children: "Set up" }),
+        !recoveryDeclared && !recoveryExtra && offerRecovery ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(RecoveryCodesRow, { item, field: null, port, onChanged }) : null,
         !item.authenticator && item.custom.some((c) => c.key === MFA_METHOD_KEY && c.value) ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(TwoFactorMethodRow, { port, item, onChanged }) : null
       ] }),
       /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(VaultSection, { children: item.notes ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(PlainRow, { label: "Notes", value: item.notes, multiline: true }) : /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(AddRow, { label: "Notes", onAdd: canEdit ? () => onMode("edit") : null, children: "Add notes" }) }),
@@ -6113,7 +6134,22 @@ function ItemPane(props) {
         " \xB7 Created ",
         (0, import_format8.formatAbsoluteDate)(item.createdAt, DAY_FORMAT, "")
       ] })
-    ] }) : null }) })
+    ] }) : null }) }),
+    settingUpOtp && item ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(
+      AddOtpPanel,
+      {
+        port,
+        items: [item],
+        definitions: definition ? [definition] : [],
+        itemId: item.id,
+        onClose: () => setSettingUpOtp(false),
+        onChanged: () => onChanged(),
+        onDone: () => {
+          setSettingUpOtp(false);
+          onChanged();
+        }
+      }
+    ) : null
   ] }) });
 }
 
@@ -7051,7 +7087,7 @@ var plural2 = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 function terminalMessage(s) {
   if (s.phase === "completed") return `Imported ${plural2(s.committed, "passkey")}.`;
   if (s.phase === "partial") return `${s.committed} imported; ${s.unsupported + s.failed + s.uncertain + s.not_attempted} need attention.`;
-  if (s.phase === "cancelled") return "Import cancelled. Nothing else will be imported.";
+  if (s.phase === "cancelled") return "Import canceled. Nothing else will be imported.";
   if (s.phase === "unavailable") return "Passkey import is unavailable here.";
   if (s.phase === "failed") return "The import did not finish. Recover it before using a new file.";
   return s.message;
@@ -7236,7 +7272,7 @@ function useNativeImport(bridge, stillAllowed, onImported) {
       present(g, { kind: "status", status: result, message: terminalMessage(result) });
       if (!done && ACTIVE_PHASES.has(result.phase)) schedulePoll(active.id);
     } catch (e) {
-      keepOperation(g, fail(e, "The import could not be cancelled."));
+      keepOperation(g, fail(e, "The import could not be canceled."));
     } finally {
       if (current(g)) setBusy(false);
     }
@@ -7722,6 +7758,7 @@ var import_design_system24 = require("@ai-matrx/design-system");
 var import_controls33 = require("@ai-matrx/design-system/controls");
 var import_icons15 = require("@ai-matrx/design-system/icons");
 var import_jsx_runtime38 = require("react/jsx-runtime");
+var AUTHENTICATOR_LABEL = "Authenticator";
 function vaultChoices(items, organizations, current) {
   const n = (f) => items.filter(f).length;
   const shared = n((i) => i.owner.kind === "shared");
@@ -7761,7 +7798,7 @@ function buildViews(items, definitions, favoriteIds2, recentIds2) {
 function viewLabel(view, views) {
   if (view === "favorites") return "Favorites";
   if (view === "recent") return "Recently opened";
-  if (view === "authenticator") return "One-time passwords";
+  if (view === "authenticator") return AUTHENTICATOR_LABEL;
   if (view === "trash") return "Trash";
   if (view === "page") return "This page";
   return [...views.categories, ...views.tags].find((v) => v.view === view)?.label ?? "All items";
@@ -7772,7 +7809,7 @@ function viewOptions(views, allCount, deletedCount, hasFavorites, hasRecents, ha
     { value: "all", label: "Every category", meta: String(allCount) },
     ...hasFavorites ? [{ value: "favorites", label: "Favorites", meta: views.favorites === void 0 ? "" : String(views.favorites) }] : [],
     ...hasRecents ? [{ value: "recent", label: "Recently opened", meta: views.recent === void 0 ? "" : String(views.recent) }] : [],
-    { value: "authenticator", label: "One-time passwords", meta: String(views.authenticator) },
+    { value: "authenticator", label: AUTHENTICATOR_LABEL, meta: String(views.authenticator) },
     ...views.categories.map((v) => ({ value: v.view, label: v.label, meta: String(v.count) })),
     ...views.tags.map((v) => ({ value: v.view, label: `#${v.label}`, meta: String(v.count) })),
     { value: "trash", label: "Trash", meta: String(deletedCount) }
@@ -7814,7 +7851,7 @@ function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, v
         /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(Entry, { on: view === "all", glyph: GridGlyph, label: "All items", count: allCount, onClick: () => onView("all") }),
         hasFavorites ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(Entry, { on: view === "favorites", glyph: StarGlyph, label: "Favorites", count: views.favorites, onClick: () => onView("favorites") }) : null,
         hasRecents ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(Entry, { on: view === "recent", glyph: ClockGlyph, label: "Recently opened", count: views.recent, onClick: () => onView("recent") }) : null,
-        /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(Entry, { on: view === "authenticator", glyph: LockGlyph, label: "One-time passwords", count: views.authenticator, onClick: () => onView("authenticator") })
+        /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(Entry, { on: view === "authenticator", glyph: LockGlyph, label: AUTHENTICATOR_LABEL, count: views.authenticator, onClick: () => onView("authenticator") })
       ] }),
       views.categories.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(Group, { title: "Categories", children: views.categories.map((e) => /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(Entry, { on: view === e.view, glyph: e.glyph, label: e.label, count: e.count, onClick: () => onView(e.view) }, e.view)) }) : null,
       views.tags.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)("div", { className: "flex flex-col gap-0.5", children: [
@@ -7921,6 +7958,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const loc = location ?? inner;
   const dirty = (0, import_react41.useRef)(false);
   const [notice, setNotice] = (0, import_react41.useState)(null);
+  const [firstCode, setFirstCode] = (0, import_react41.useState)(null);
   const move = (0, import_react41.useCallback)(
     (next, how) => {
       if (!location) setInner(next);
@@ -8060,9 +8098,21 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   }
   const hasFavorites = port.lists.favorites !== void 0;
   const title = loc.vault === "all" && loc.view === "all" ? "All items" : viewLabel(loc.view, views);
-  const compactHeader = mode === "full" ? void 0 : /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("div", { className: "grid grid-cols-[minmax(0,1fr)_minmax(0,1fr)_auto] gap-2", children: [
+  const compactHeader = mode === "full" ? void 0 : /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("div", { className: "grid grid-cols-[minmax(0,1fr)_minmax(0,1fr)_auto_auto] gap-2", children: [
     /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(VaultSelect, { value: loc.vault, choices, onChange: (vault) => go({ vault, itemId: null, panel: null }) }),
     /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_controls34.Select, { value: loc.view, onValueChange: (view) => go({ view, itemId: null, panel: null }), options: viewOptions(views, inThisVault.length, deleted.length, hasFavorites, port.lists.recents !== void 0, host.page !== void 0), "aria-label": "Show" }),
+    /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(
+      import_controls34.Button,
+      {
+        variant: loc.view === "authenticator" ? "outline" : "quiet",
+        icon: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(LockGlyph, {}),
+        "aria-label": AUTHENTICATOR_LABEL,
+        "aria-pressed": loc.view === "authenticator",
+        title: AUTHENTICATOR_LABEL,
+        onClick: () => go({ view: loc.view === "authenticator" ? "all" : "authenticator", itemId: null, mode: "view", panel: null }),
+        children: mode === "split" ? AUTHENTICATOR_LABEL : null
+      }
+    ),
     /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)(import_design_system25.DropdownMenu, { children: [
       /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_design_system25.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_controls34.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(MoreGlyph, {}), "aria-label": "Vault actions" }) }),
       /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)(import_design_system25.DropdownMenuContent, { align: "end", children: [
@@ -8163,9 +8213,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         seed: { name: guess?.name ?? "", url: guess?.url ?? loc.url.trim() },
         onBack: () => go({ kind: null }),
         onMode: () => void 0,
-        onSaved: (item, _wasNew, n) => {
+        onSaved: (item, _wasNew, n, enrolled) => {
           replaceItem(item);
           dirty.current = false;
+          if (enrolled) setFirstCode(item);
           move({ ...loc, itemId: item.id, mode: "view", kind: null, url: "", panel: null }, "replace");
           setNotice(n);
           notify("Saved");
@@ -8194,9 +8245,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         onBack: back,
         onMode: (m) => go({ mode: m, panel: null }),
         notice,
-        onSaved: (item, _wasNew, n) => {
+        onSaved: (item, _wasNew, n, enrolled) => {
           replaceItem(item);
           dirty.current = false;
+          if (enrolled) setFirstCode(item);
           move({ ...loc, mode: "view" }, "replace");
           setNotice(n);
           notify("Saved");
@@ -8294,7 +8346,8 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       ) : null,
       shown.list ? /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: specialView && mode !== "stack" ? "col-span-2 min-h-0" : "min-h-0", children: list }) : null,
       shown.detail ? detail : null,
-      panel
+      panel,
+      firstCode ? /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(FirstCodePanel, { port, item: firstCode, onClose: () => setFirstCode(null), onDone: () => setFirstCode(null) }) : null
     ] })
   ] });
 }
@@ -9065,7 +9118,9 @@ function createApiVaultPort(api, options = {}) {
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
             ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
-            ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map((s) => ({ field_key: fieldKeyOf(s.label), value: s.value, handling: "revealable" }))
+            ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map((s) => ({ field_key: fieldKeyOf(s.label), value: s.value, handling: "revealable" })),
+            // Backup codes on a type that does not declare them (a website login): their own encrypted field.
+            ...!declared.some((f) => f.key === RECOVERY_CODES_KEY) && (draft.values[RECOVERY_CODES_KEY] ?? "").trim() !== "" ? [{ field_key: RECOVERY_CODES_KEY, value: parseRecoveryCodes(draft.values[RECOVERY_CODES_KEY] ?? "").join("\n"), handling: "revealable", description: "One-time account recovery codes" }] : []
           ]
         }
       }, organizationId ? { organizationId } : void 0);