@ai-matrx/vault 0.1.14 → 0.1.16

package/dist/index.js

@@ -101,10 +101,10 @@ var init_keepass_xml_worker_client = __esm({
 });
 
 // src/VaultApp.tsx
-import { useCallback as useCallback5, useEffect as useEffect23, useMemo as useMemo6, useRef as useRef19, useState as useState40 } from "react";
-import { DropdownMenu as DropdownMenu6, DropdownMenuContent as DropdownMenuContent6, DropdownMenuItem as DropdownMenuItem5, DropdownMenuTrigger as DropdownMenuTrigger6, LookScope } from "@ai-matrx/design-system";
-import { Button as Button33, SearchField as SearchField4, Select as Select11 } from "@ai-matrx/design-system/controls";
-import { confirm as confirm13 } from "@ai-matrx/kit/confirm-opener";
+import { useCallback as useCallback5, useEffect as useEffect23, useMemo as useMemo6, useRef as useRef19, useState as useState41 } from "react";
+import { DropdownMenu as DropdownMenu6, DropdownMenuContent as DropdownMenuContent6, DropdownMenuItem as DropdownMenuItem6, DropdownMenuTrigger as DropdownMenuTrigger6, LookScope } from "@ai-matrx/design-system";
+import { Button as Button34, SearchField as SearchField4, Select as Select12 } from "@ai-matrx/design-system/controls";
+import { confirm as confirm14 } from "@ai-matrx/kit/confirm-opener";
 
 // src/notice.tsx
 import { createContext, useCallback, useContext, useEffect, useRef, useState } from "react";
@@ -638,12 +638,12 @@ var ROW_GRID = {
   roomy: "grid-cols-[9rem_minmax(0,1fr)_auto] gap-x-3 px-4",
   viewport: "grid-cols-[5.75rem_minmax(0,1fr)_auto] gap-x-2 px-3 sm:grid-cols-[9rem_minmax(0,1fr)_auto] sm:gap-x-3 sm:px-4"
 };
-function VaultRow({ label, hint, children, actions, top = false, className }) {
+function VaultRow({ label, hint: hint2, children, actions, top = false, className }) {
   const room = useContext4(Room);
   return /* @__PURE__ */ jsxs4("div", { className: cn2("grid min-h-11 py-1", ROW_GRID[room ?? "viewport"], top ? "items-start" : "items-center", className), children: [
     /* @__PURE__ */ jsxs4("div", { className: cn2("flex min-w-0 flex-col text-xs leading-tight text-muted-foreground", top && "pt-2.5"), children: [
       /* @__PURE__ */ jsx4("span", { className: room === "roomy" ? "truncate" : room === "compact" ? "line-clamp-2 break-words" : "line-clamp-2 break-words sm:truncate", children: label }),
-      hint ? /* @__PURE__ */ jsx4("span", { className: "line-clamp-2 break-words text-xs text-disabled-foreground", children: hint }) : null
+      hint2 ? /* @__PURE__ */ jsx4("span", { className: "line-clamp-2 break-words text-xs text-disabled-foreground", children: hint2 }) : null
     ] }),
     /* @__PURE__ */ jsx4("div", { className: cn2("min-w-0 text-sm", top && "py-1.5"), children }),
     /* @__PURE__ */ jsx4("div", { className: cn2("flex items-center gap-0.5", top && "pt-1"), children: actions })
@@ -753,14 +753,14 @@ function TurnOnButton({ label, onTurnOn }) {
     }
   );
 }
-function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
+function PlainRow({ label, value, hint: hint2, openUrl, extra, multiline = false }) {
   const copyValue2 = useCopy();
   const isUrl = /^https?:\/\//i.test(value);
   return /* @__PURE__ */ jsx5(
     VaultRow,
     {
       label,
-      hint,
+      hint: hint2,
       top: multiline,
       actions: /* @__PURE__ */ jsxs5(Fragment2, { children: [
         extra,
@@ -790,13 +790,13 @@ function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
 function AddRow({ label, onAdd, children = "Add" }) {
   return /* @__PURE__ */ jsx5(VaultRow, { label, children: onAdd ? /* @__PURE__ */ jsx5("button", { type: "button", className: "text-sm text-muted-foreground hover:text-primary", onClick: onAdd, children }) : /* @__PURE__ */ jsx5("span", { className: "text-disabled-foreground", children: "\u2014" }) });
 }
-function EditRow({ label, hint, value, onChange, placeholder, secret = false, multiline = false, onRemove, removeLabel, actions, autoFocus, onBlur, inputMode }) {
+function EditRow({ label, hint: hint2, value, onChange, placeholder, secret = false, multiline = false, onRemove, removeLabel, actions, autoFocus, onBlur, inputMode }) {
   const [shown, setShown] = useState5(false);
   return /* @__PURE__ */ jsx5(
     VaultRow,
     {
       label,
-      hint,
+      hint: hint2,
       top: multiline,
       actions: /* @__PURE__ */ jsxs5(Fragment2, { children: [
         secret && value ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: shown ? /* @__PURE__ */ jsx5(EyeOffGlyph, {}) : /* @__PURE__ */ jsx5(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((s) => !s) }) : null,
@@ -807,7 +807,7 @@ function EditRow({ label, hint, value, onChange, placeholder, secret = false, mu
     }
   );
 }
-function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove }) {
+function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue }) {
   const [shown, setShown] = useState5(false);
   return /* @__PURE__ */ jsx5(
     VaultRow,
@@ -815,9 +815,25 @@ function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove }) {
       label: /* @__PURE__ */ jsx5(Field2, { className: "w-full", value: label, onChange: (e) => onLabel(e.target.value), placeholder: "Name", "aria-label": "Field name" }),
       actions: /* @__PURE__ */ jsxs5(Fragment2, { children: [
         secret && value ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: shown ? /* @__PURE__ */ jsx5(EyeOffGlyph, {}) : /* @__PURE__ */ jsx5(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
+        extra,
         /* @__PURE__ */ jsx5(Button2, { variant: "quiet", removes: true, icon: /* @__PURE__ */ jsx5(XGlyph, {}), "aria-label": "Remove field", onClick: onRemove })
       ] }),
-      children: /* @__PURE__ */ jsx5(Field2, { className: "w-full", value, onChange: (e) => onValue(e.target.value), type: secret && !shown ? "password" : "text", placeholder: secret ? "Secret value" : "Value", autoComplete: "off", spellCheck: false, "aria-label": "Field value" })
+      children: /* @__PURE__ */ jsx5(
+        Field2,
+        {
+          className: "w-full",
+          value,
+          onChange: (e) => onValue(e.target.value),
+          onPaste: onPasteValue ? (e) => {
+            if (onPasteValue(e.clipboardData.getData("text"))) e.preventDefault();
+          } : void 0,
+          type: secret && !shown ? "password" : "text",
+          placeholder: secret ? "Secret value" : "Value",
+          autoComplete: "off",
+          spellCheck: false,
+          "aria-label": label ? `${label} value` : "Field value"
+        }
+      )
     }
   );
 }
@@ -831,7 +847,7 @@ import { formatRelativeTime } from "@ai-matrx/kit/format";
 
 // src/model.ts
 var DEFAULT_LOCATION = { vault: "all", view: "all", q: "", sort: "name", itemId: null, mode: "view", kind: null, url: "", panel: null };
-var SORTS = ["name", "website", "updated", "created"];
+var SORTS = ["name", "name-desc", "website", "updated", "created", "viewed"];
 function locationFromParams(params, itemId = params.get("item")) {
   const sort = params.get("sort");
   const mode = params.get("mode");
@@ -871,9 +887,11 @@ function inView(item, view) {
   if (view.startsWith("tag:")) return item.tags.includes(view.slice(4));
   return true;
 }
+var AUTHENTICATOR_WORDS = ["authenticator", "2fa", "two-factor", "two factor", "totp", "one-time password", "verification code", "2-step"];
 function matchesQuery(item, query) {
   const q = query.trim().toLowerCase();
   if (!q) return true;
+  if (item.authenticator && AUTHENTICATOR_WORDS.some((w) => w === q || q.length >= 3 && w.startsWith(q))) return true;
   return [item.name, item.definitionLabel, ...item.tags, ...item.loginUrls, ...item.custom.map((c) => `${c.label} ${c.value}`)].some((h) => h.toLowerCase().includes(q));
 }
 var HIDDEN_ITEM_TAG = "matrx:hidden";
@@ -899,10 +917,15 @@ function siteDomainOf(host) {
   const keep = TWO_PART_SUFFIX.has(sld) && tld.length <= 3 ? 3 : 2;
   return labels.slice(-keep).join(".");
 }
-function sortItems(items, sort) {
+function sortItems(items, sort, recents) {
   const out = [...items];
-  const byName = (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" });
+  const byName = (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base", numeric: true });
   if (sort === "name") return out.sort(byName);
+  if (sort === "name-desc") return out.sort((a, b) => byName(b, a));
+  if (sort === "viewed") {
+    const at = new Map((recents ?? []).map((id, i) => [id, i]));
+    return out.sort((a, b) => (at.get(a.id) ?? Infinity) - (at.get(b.id) ?? Infinity) || byName(a, b));
+  }
   if (sort === "website")
     return out.sort((a, b) => {
       const x = loginSiteOf(a), y = loginSiteOf(b);
@@ -1499,9 +1522,23 @@ function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, on
 // src/authenticator/AuthenticatorView.tsx
 import { useEffect as useEffect11, useState as useState13 } from "react";
 import { Button as Button9 } from "@ai-matrx/design-system/controls";
-import { cn as cn6, DropdownMenu as DropdownMenu2, DropdownMenuContent as DropdownMenuContent2, DropdownMenuItem as DropdownMenuItem2, DropdownMenuSeparator as DropdownMenuSeparator2, DropdownMenuTrigger as DropdownMenuTrigger2, TextInputDialog } from "@ai-matrx/design-system";
+import { cn as cn7, DropdownMenu as DropdownMenu2, DropdownMenuContent as DropdownMenuContent2, DropdownMenuItem as DropdownMenuItem2, DropdownMenuSeparator as DropdownMenuSeparator2, DropdownMenuTrigger as DropdownMenuTrigger2, TextInputDialog } from "@ai-matrx/design-system";
 import { CopyIcon as CopyIcon4 } from "@ai-matrx/design-system/icons";
 
+// src/ItemIcon.tsx
+import { cn as cn5 } from "@ai-matrx/design-system";
+import { jsx as jsx8 } from "react/jsx-runtime";
+function ItemIcon({ definitionKey, family, site, size = "md", inverted = false }) {
+  const box = size === "lg" ? "size-10 rounded-xl text-base" : size === "md" ? "size-8 rounded-lg text-sm" : "size-6 rounded-md text-xs";
+  const tone = inverted ? "bg-primary-foreground text-primary" : "bg-muted text-foreground";
+  const initial = siteDomainOf(site).charAt(0).toUpperCase();
+  if (initial && /[A-Z0-9]/.test(initial)) {
+    return /* @__PURE__ */ jsx8("span", { "aria-hidden": true, className: cn5("flex shrink-0 items-center justify-center font-semibold", box, tone), children: initial });
+  }
+  const Glyph = definitionGlyph(definitionKey, family);
+  return /* @__PURE__ */ jsx8("span", { "aria-hidden": true, className: cn5("flex shrink-0 items-center justify-center", box, tone), children: /* @__PURE__ */ jsx8(Glyph, { className: size === "lg" ? "size-5" : "size-4" }) });
+}
+
 // src/authenticator/AddOtpPanel.tsx
 import { useState as useState12 } from "react";
 import { Button as Button8, Field as Field4, Select as Select2 } from "@ai-matrx/design-system/controls";
@@ -1509,7 +1546,7 @@ import { Button as Button8, Field as Field4, Select as Select2 } from "@ai-matrx
 // src/authenticator/CodeParts.tsx
 import { useEffect as useEffect8, useRef as useRef6, useState as useState8 } from "react";
 import { Button as Button5 } from "@ai-matrx/design-system/controls";
-import { cn as cn5 } from "@ai-matrx/design-system";
+import { cn as cn6 } from "@ai-matrx/design-system";
 import { CopyIcon as CopyIcon3 } from "@ai-matrx/design-system/icons";
 import { groupCode as groupCode2 } from "@ai-matrx/kit/format";
 
@@ -1612,16 +1649,16 @@ function matchIssuerToSite(issuer, candidates, siteOf) {
 }
 
 // src/authenticator/CodeParts.tsx
-import { jsx as jsx8, jsxs as jsxs8 } from "react/jsx-runtime";
+import { jsx as jsx9, jsxs as jsxs8 } from "react/jsx-runtime";
 function CountdownRing({ remaining, period, loading = false, className }) {
   const r = 9.5;
   const c = 2 * Math.PI * r;
   const p = loading ? 0 : Math.max(0, Math.min(1, remaining / period));
   const urgent = !loading && remaining <= 5;
-  return /* @__PURE__ */ jsxs8("span", { className: cn5("relative inline-flex size-6 shrink-0 items-center justify-center", className), role: "img", "aria-label": loading ? "Getting code" : `${remaining} seconds left`, children: [
+  return /* @__PURE__ */ jsxs8("span", { className: cn6("relative inline-flex size-6 shrink-0 items-center justify-center", className), role: "img", "aria-label": loading ? "Getting code" : `${remaining} seconds left`, children: [
     /* @__PURE__ */ jsxs8("svg", { viewBox: "0 0 24 24", className: "absolute inset-0 size-full -rotate-90", "aria-hidden": true, children: [
-      /* @__PURE__ */ jsx8("circle", { cx: "12", cy: "12", r, fill: "none", stroke: "currentColor", strokeWidth: 2.5, className: "text-muted" }),
-      /* @__PURE__ */ jsx8(
+      /* @__PURE__ */ jsx9("circle", { cx: "12", cy: "12", r, fill: "none", stroke: "currentColor", strokeWidth: 2.5, className: "text-muted" }),
+      /* @__PURE__ */ jsx9(
         "circle",
         {
           cx: "12",
@@ -1638,7 +1675,7 @@ function CountdownRing({ remaining, period, loading = false, className }) {
         }
       )
     ] }),
-    /* @__PURE__ */ jsx8("span", { className: cn5("text-[10px] font-semibold leading-none tabular-nums", urgent ? "text-destructive" : "text-muted-foreground"), children: loading ? "" : remaining })
+    /* @__PURE__ */ jsx9("span", { className: cn6("text-[10px] font-semibold leading-none tabular-nums", urgent ? "text-destructive" : "text-muted-foreground"), children: loading ? "" : remaining })
   ] });
 }
 function useCopied() {
@@ -1668,17 +1705,17 @@ function CodeButton({ live, digits, size = "md", label }) {
       onClick: () => live.code && void copy(live.code),
       "aria-label": live.code ? `Copy ${label} code` : `Getting ${label} code`,
       title: live.code ? "Copy" : void 0,
-      className: cn5("group -mx-1.5 inline-flex max-w-full items-center gap-2.5 rounded-md px-1.5 py-1 text-left transition-colors hover:bg-accent focus-visible:bg-accent focus-visible:outline-none", size === "lg" && "gap-3"),
+      className: cn6("group -mx-1.5 inline-flex max-w-full items-center gap-2.5 rounded-md px-1.5 py-1 text-left transition-colors hover:bg-accent focus-visible:bg-accent focus-visible:outline-none", size === "lg" && "gap-3"),
       children: [
-        /* @__PURE__ */ jsx8("span", { className: cn5("whitespace-nowrap font-mono font-medium tabular-nums tracking-[0.08em]", size === "lg" ? "text-2xl" : "text-[1.0625rem]", live.code ? "text-foreground" : "text-disabled-foreground"), children: shown }),
-        copied ? /* @__PURE__ */ jsx8("span", { className: "inline-flex size-6 items-center justify-center text-success", role: "status", "aria-label": "Copied", children: /* @__PURE__ */ jsx8(CheckGlyph, { className: "size-4" }) }) : /* @__PURE__ */ jsx8(CountdownRing, { remaining: live.remaining, period: live.period, loading: !live.code })
+        /* @__PURE__ */ jsx9("span", { className: cn6("whitespace-nowrap font-mono font-medium tabular-nums tracking-[0.08em]", size === "lg" ? "text-2xl" : "text-[1.0625rem]", live.code ? "text-foreground" : "text-disabled-foreground"), children: shown }),
+        copied ? /* @__PURE__ */ jsx9("span", { className: "inline-flex size-6 items-center justify-center text-success", role: "status", "aria-label": "Copied", children: /* @__PURE__ */ jsx9(CheckGlyph, { className: "size-4" }) }) : /* @__PURE__ */ jsx9(CountdownRing, { remaining: live.remaining, period: live.period, loading: !live.code })
       ]
     }
   );
 }
 function CopyCodeButton({ live, label }) {
   const { copied, copy } = useCopied();
-  return /* @__PURE__ */ jsx8(Button5, { variant: "quiet", icon: copied ? /* @__PURE__ */ jsx8(CheckGlyph, {}) : /* @__PURE__ */ jsx8(CopyIcon3, {}), ...copied ? { glyphTone: "success" } : {}, "aria-label": `Copy ${label} code`, disabled: !live.code, onClick: () => live.code && void copy(live.code) });
+  return /* @__PURE__ */ jsx9(Button5, { variant: "quiet", icon: copied ? /* @__PURE__ */ jsx9(CheckGlyph, {}) : /* @__PURE__ */ jsx9(CopyIcon3, {}), ...copied ? { glyphTone: "success" } : {}, "aria-label": `Copy ${label} code`, disabled: !live.code, onClick: () => live.code && void copy(live.code) });
 }
 
 // src/authenticator/live-code.ts
@@ -1770,42 +1807,23 @@ import { useEffect as useEffect10, useRef as useRef8, useState as useState10 } f
 import { Button as Button6, Field as Field3 } from "@ai-matrx/design-system/controls";
 
 // src/authenticator/qr.ts
-function detectorCtor() {
-  const c = globalThis.BarcodeDetector;
-  return typeof c === "function" ? c : null;
-}
-var support = null;
+import { decodeQrFromElement, decodeQrFromImageFile } from "@ai-matrx/capture/qr";
 function canDecodeQrLocally() {
-  if (!support) {
-    const C = detectorCtor();
-    support = !C ? Promise.resolve(false) : C.getSupportedFormats ? C.getSupportedFormats().then((f) => f.includes("qr_code"), () => false) : Promise.resolve(true);
+  if (typeof document === "undefined") return Promise.resolve(false);
+  try {
+    return Promise.resolve(Boolean(document.createElement("canvas").getContext("2d")));
+  } catch {
+    return Promise.resolve(false);
   }
-  return support;
 }
 function hasCamera() {
   return typeof navigator !== "undefined" && typeof navigator.mediaDevices?.getUserMedia === "function";
 }
-var detector = null;
-function qrDetector() {
-  const C = detectorCtor();
-  if (!C) return null;
-  detector ??= new C({ formats: ["qr_code"] });
-  return detector;
-}
 async function decodeQr(source) {
-  const d = qrDetector();
-  if (!d) return null;
-  const found = await d.detect(source);
-  return found.find((b) => b.rawValue)?.rawValue ?? null;
+  return decodeQrFromElement(source);
 }
 async function decodeQrFile(file) {
-  if (!await canDecodeQrLocally()) return null;
-  const bitmap = await createImageBitmap(file);
-  try {
-    return await decodeQr(bitmap);
-  } finally {
-    bitmap.close();
-  }
+  return decodeQrFromImageFile(file);
 }
 function imageFrom(data) {
   if (!data) return null;
@@ -1820,7 +1838,7 @@ function imageFrom(data) {
 }
 
 // src/authenticator/Setup.tsx
-import { Fragment as Fragment5, jsx as jsx9, jsxs as jsxs9 } from "react/jsx-runtime";
+import { Fragment as Fragment5, jsx as jsx10, jsxs as jsxs9 } from "react/jsx-runtime";
 function useCanScan() {
   const [ok, setOk] = useState10(false);
   useEffect10(() => {
@@ -1886,15 +1904,15 @@ function QrScanPanel({ open, onResult, onClose }) {
       stop();
     };
   }, [open]);
-  return /* @__PURE__ */ jsxs9(Panel, { title: "Scan QR code", open, onClose, size: "sm", footer: /* @__PURE__ */ jsx9(Button6, { variant: "quiet", onClick: onClose, children: "Cancel" }), children: [
+  return /* @__PURE__ */ jsxs9(Panel, { title: "Scan QR code", open, onClose, size: "sm", footer: /* @__PURE__ */ jsx10(Button6, { variant: "quiet", onClick: onClose, children: "Cancel" }), children: [
     /* @__PURE__ */ jsxs9("div", { className: "relative mx-auto aspect-square w-full max-w-sm overflow-hidden rounded-xl bg-muted", children: [
-      /* @__PURE__ */ jsx9("video", { ref: video, className: "size-full object-cover", playsInline: true, muted: true, "aria-label": "Camera" }),
-      error ? /* @__PURE__ */ jsx9("div", { className: "absolute inset-0 flex items-center justify-center p-6 text-center text-sm text-destructive", children: error }) : /* @__PURE__ */ jsx9("div", { className: "pointer-events-none absolute inset-[18%] rounded-lg border-2 border-primary", "aria-hidden": true })
+      /* @__PURE__ */ jsx10("video", { ref: video, className: "size-full object-cover", playsInline: true, muted: true, "aria-label": "Camera" }),
+      error ? /* @__PURE__ */ jsx10("div", { className: "absolute inset-0 flex items-center justify-center p-6 text-center text-sm text-destructive", children: error }) : /* @__PURE__ */ jsx10("div", { className: "pointer-events-none absolute inset-[18%] rounded-lg border-2 border-primary", "aria-hidden": true })
     ] }),
-    /* @__PURE__ */ jsx9("p", { className: "text-center text-xs text-muted-foreground", children: "Point at the site's QR code" })
+    /* @__PURE__ */ jsx10("p", { className: "text-center text-xs text-muted-foreground", children: "Point at the site's QR code" })
   ] });
 }
-function OtpSetupRow({ value, onChange, label = "One-time password", placeholder = "Setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status }) {
+function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "Paste setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status }) {
   const file = useRef8(null);
   const canScan = useCanScan();
   const [scanning, setScanning] = useState10(false);
@@ -1927,9 +1945,9 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
       setReading(false);
     }
   };
-  const end = status ? /* @__PURE__ */ jsx9("span", { className: "max-w-48 truncate text-xs text-muted-foreground", children: status }) : reading ? /* @__PURE__ */ jsx9("span", { className: "text-xs text-muted-foreground", children: "Reading\u2026" }) : imageError || error ? /* @__PURE__ */ jsx9("span", { className: "max-w-56 truncate text-xs text-destructive", title: imageError ?? error ?? void 0, role: "alert", children: imageError ?? error }) : parsed ? /* @__PURE__ */ jsxs9("span", { className: "flex max-w-56 items-center gap-1 text-xs text-success", children: [
-    /* @__PURE__ */ jsx9(CheckGlyph, { className: "size-3.5 shrink-0" }),
-    /* @__PURE__ */ jsx9("span", { className: "truncate", children: describeEnrollment(parsed) })
+  const end = status ? /* @__PURE__ */ jsx10("span", { className: "max-w-48 truncate text-xs text-muted-foreground", children: status }) : reading ? /* @__PURE__ */ jsx10("span", { className: "text-xs text-muted-foreground", children: "Reading\u2026" }) : imageError || error ? /* @__PURE__ */ jsx10("span", { className: "max-w-56 truncate text-xs text-destructive", title: imageError ?? error ?? void 0, role: "alert", children: imageError ?? error }) : parsed ? /* @__PURE__ */ jsxs9("span", { className: "flex max-w-56 items-center gap-1 text-xs text-success", children: [
+    /* @__PURE__ */ jsx10(CheckGlyph, { className: "size-3.5 shrink-0" }),
+    /* @__PURE__ */ jsx10("span", { className: "truncate", children: describeEnrollment(parsed) })
   ] }) : null;
   return /* @__PURE__ */ jsxs9(
     "div",
@@ -1954,11 +1972,11 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
           {
             label,
             actions: /* @__PURE__ */ jsxs9(Fragment5, { children: [
-              /* @__PURE__ */ jsx9(Button6, { variant: "quiet", icon: /* @__PURE__ */ jsx9(QrGlyph, {}), "aria-label": "Choose QR image", title: "Choose or drop a QR image", disabled: disabled || reading, onClick: () => file.current?.click() }),
-              canScan ? /* @__PURE__ */ jsx9(Button6, { variant: "quiet", icon: /* @__PURE__ */ jsx9(CameraGlyph, {}), "aria-label": "Scan with camera", title: "Scan with camera", disabled, onClick: () => setScanning(true) }) : null
+              /* @__PURE__ */ jsx10(Button6, { variant: "quiet", icon: /* @__PURE__ */ jsx10(QrGlyph, {}), "aria-label": "Choose QR image", title: "Choose or drop a QR image", disabled: disabled || reading, onClick: () => file.current?.click() }),
+              canScan ? /* @__PURE__ */ jsx10(Button6, { variant: "quiet", icon: /* @__PURE__ */ jsx10(CameraGlyph, {}), "aria-label": "Scan QR code with camera", title: "Scan the site's QR code with the camera", disabled, onClick: () => setScanning(true), children: "Scan" }) : null
             ] }),
             children: [
-              /* @__PURE__ */ jsx9(
+              /* @__PURE__ */ jsx10(
                 Field3,
                 {
                   className: "w-full",
@@ -1981,7 +1999,7 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
                   end
                 }
               ),
-              /* @__PURE__ */ jsx9(
+              /* @__PURE__ */ jsx10(
                 "input",
                 {
                   ref: file,
@@ -1998,7 +2016,7 @@ function OtpSetupRow({ value, onChange, label = "One-time password", placeholder
             ]
           }
         ),
-        canScan ? /* @__PURE__ */ jsx9(
+        canScan ? /* @__PURE__ */ jsx10(
           QrScanPanel,
           {
             open: scanning,
@@ -2029,7 +2047,7 @@ function mfaMethodOf(item) {
 }
 
 // src/authenticator/TotpRows.tsx
-import { Fragment as Fragment6, jsx as jsx10, jsxs as jsxs10 } from "react/jsx-runtime";
+import { Fragment as Fragment6, jsx as jsx11, jsxs as jsxs10 } from "react/jsx-runtime";
 function otpActionError(e, what) {
   const status = e?.status;
   if (status === 404) return "There is no one-time password here.";
@@ -2067,7 +2085,7 @@ function useOtpActions(port, item, onChanged) {
     }),
     remove: async () => {
       const ok = await confirm2({
-        title: `Remove the one-time password for ${item.name}?`,
+        title: `Remove the authenticator for ${item.name}?`,
         description: "Codes stop here. Two-factor stays on at the site, and your phone app and backup codes still work.",
         confirmLabel: "Remove",
         variant: "destructive"
@@ -2087,37 +2105,37 @@ function TotpRow({ port, item, onChanged }) {
   const canManage = item.capabilities.canManage || item.capabilities.canEdit;
   if (a.removed || !item.authenticator) return null;
   const menu = canManage ? /* @__PURE__ */ jsxs10(DropdownMenu, { children: [
-    /* @__PURE__ */ jsx10(DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ jsx10(Button7, { variant: "quiet", icon: /* @__PURE__ */ jsx10(MoreGlyph, {}), "aria-label": "One-time password options", disabled: a.busy }) }),
+    /* @__PURE__ */ jsx11(DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ jsx11(Button7, { variant: "quiet", icon: /* @__PURE__ */ jsx11(MoreGlyph, {}), "aria-label": "Authenticator options", disabled: a.busy }) }),
     /* @__PURE__ */ jsxs10(DropdownMenuContent, { align: "end", className: "min-w-44", children: [
       /* @__PURE__ */ jsxs10(DropdownMenuItem, { onSelect: () => void a.setEnabled(!a.enabled), children: [
-        /* @__PURE__ */ jsx10(PowerGlyph, { className: "size-4" }),
+        /* @__PURE__ */ jsx11(PowerGlyph, { className: "size-4" }),
         a.enabled ? "Turn off" : "Turn on"
       ] }),
-      /* @__PURE__ */ jsx10(DropdownMenuSeparator, {}),
+      /* @__PURE__ */ jsx11(DropdownMenuSeparator, {}),
       /* @__PURE__ */ jsxs10(DropdownMenuItem, { className: "text-destructive focus:text-destructive", onSelect: () => void a.remove(), children: [
-        /* @__PURE__ */ jsx10(TrashGlyph, { className: "size-4" }),
+        /* @__PURE__ */ jsx11(TrashGlyph, { className: "size-4" }),
         "Remove"
       ] })
     ] })
   ] }) : null;
-  return /* @__PURE__ */ jsx10(
+  return /* @__PURE__ */ jsx11(
     VaultRow,
     {
-      label: "One-time password",
+      label: "Authenticator",
       actions: /* @__PURE__ */ jsxs10(Fragment6, { children: [
-        a.enabled ? /* @__PURE__ */ jsx10(CopyCodeButton, { live, label: item.name }) : null,
+        a.enabled ? /* @__PURE__ */ jsx11(CopyCodeButton, { live, label: item.name }) : null,
         menu
       ] }),
       children: a.error ? /* @__PURE__ */ jsxs10("span", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ jsx10("span", { className: "truncate text-sm text-destructive", role: "alert", children: a.error }),
-        /* @__PURE__ */ jsx10(Button7, { variant: "quiet", onClick: a.clearError, children: "Dismiss" })
+        /* @__PURE__ */ jsx11("span", { className: "truncate text-sm text-destructive", role: "alert", children: a.error }),
+        /* @__PURE__ */ jsx11(Button7, { variant: "quiet", onClick: a.clearError, children: "Dismiss" })
       ] }) : !a.enabled ? /* @__PURE__ */ jsxs10("span", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ jsx10("span", { className: "text-sm text-disabled-foreground", children: "Off" }),
-        canManage ? /* @__PURE__ */ jsx10(Button7, { variant: "quiet", icon: /* @__PURE__ */ jsx10(PowerGlyph, {}), disabled: a.busy, onClick: () => void a.setEnabled(true), children: "Turn on" }) : null
+        /* @__PURE__ */ jsx11("span", { className: "text-sm text-disabled-foreground", children: "Off" }),
+        canManage ? /* @__PURE__ */ jsx11(Button7, { variant: "quiet", icon: /* @__PURE__ */ jsx11(PowerGlyph, {}), disabled: a.busy, onClick: () => void a.setEnabled(true), children: "Turn on" }) : null
       ] }) : live.error ? /* @__PURE__ */ jsxs10("span", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ jsx10("span", { className: "truncate text-sm text-destructive", title: live.error, children: live.error }),
-        /* @__PURE__ */ jsx10(Button7, { variant: "quiet", onClick: live.retry, children: "Retry" })
-      ] }) : /* @__PURE__ */ jsx10(CodeButton, { live, digits: item.authenticator.digits, label: item.name })
+        /* @__PURE__ */ jsx11("span", { className: "truncate text-sm text-destructive", title: live.error, children: live.error }),
+        /* @__PURE__ */ jsx11(Button7, { variant: "quiet", onClick: live.retry, children: "Retry" })
+      ] }) : /* @__PURE__ */ jsx11(CodeButton, { live, digits: item.authenticator.digits, label: item.name })
     }
   );
 }
@@ -2135,7 +2153,7 @@ function TotpEditRow({ value, onChange, hasExisting, item, port, onEnrolled, onR
       setStatus(wasCancelled(e) ? null : otpActionError(e, "read that image"));
     }
   } : void 0;
-  return /* @__PURE__ */ jsx10(
+  return /* @__PURE__ */ jsx11(
     OtpSetupRow,
     {
       value,
@@ -2160,7 +2178,7 @@ function TwoFactorMethodRow({ port, item, onChanged }) {
   const [busy, setBusy] = useState11(false);
   const [error, setError] = useState11(null);
   const canEdit = item.capabilities.canEdit || item.capabilities.canManage;
-  return /* @__PURE__ */ jsx10(VaultRow, { label: "Two-factor", hint: error ? /* @__PURE__ */ jsx10("span", { className: "text-destructive", children: error }) : void 0, children: /* @__PURE__ */ jsx10(
+  return /* @__PURE__ */ jsx11(VaultRow, { label: "Two-factor", hint: error ? /* @__PURE__ */ jsx11("span", { className: "text-destructive", children: error }) : void 0, children: /* @__PURE__ */ jsx11(
     Select,
     {
       value: value ?? "none",
@@ -2187,7 +2205,7 @@ function TwoFactorMethodRow({ port, item, onChanged }) {
 }
 
 // src/authenticator/AddOtpPanel.tsx
-import { Fragment as Fragment7, jsx as jsx11, jsxs as jsxs11 } from "react/jsx-runtime";
+import { Fragment as Fragment7, jsx as jsx12, jsxs as jsxs11 } from "react/jsx-runtime";
 var NEW = "__new__";
 var LOGIN_KEYS = ["website_login", "username_password"];
 function normalizeWebsite(raw) {
@@ -2263,23 +2281,23 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       setBusy(false);
     }
   };
-  if (saved) return /* @__PURE__ */ jsx11(AddedPanel, { port, item: saved, onClose, onDone: () => onDone(saved.id) });
+  if (saved) return /* @__PURE__ */ jsx12(AddedPanel, { port, item: saved, onClose, onDone: () => onDone(saved.id) });
   return /* @__PURE__ */ jsxs11(
     Panel,
     {
-      title: "Add one-time password",
+      title: "Add authenticator",
       size: "md",
       onClose,
       footer: /* @__PURE__ */ jsxs11(Fragment7, { children: [
-        /* @__PURE__ */ jsx11(Button8, { variant: "quiet", onClick: onClose, disabled: busy, children: "Cancel" }),
-        /* @__PURE__ */ jsx11(Button8, { variant: "primary", disabled: !ready, onClick: () => void save(), children: busy ? "Adding\u2026" : "Add" })
+        /* @__PURE__ */ jsx12(Button8, { variant: "quiet", onClick: onClose, disabled: busy, children: "Cancel" }),
+        /* @__PURE__ */ jsx12(Button8, { variant: "primary", disabled: !ready, onClick: () => void save(), children: busy ? "Adding\u2026" : "Add" })
       ] }),
       children: [
         /* @__PURE__ */ jsxs11(VaultSection, { children: [
-          /* @__PURE__ */ jsx11(
+          /* @__PURE__ */ jsx12(
             OtpSetupRow,
             {
-              label: "Setup code",
+              label: "Setup key",
               value: input,
               autoFocus: true,
               disabled: busy,
@@ -2297,7 +2315,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
               status: image ? `QR image ready \xB7 ${image.name}` : null
             }
           ),
-          /* @__PURE__ */ jsx11(VaultRow, { label: "Add to", children: /* @__PURE__ */ jsx11(
+          itemId ? null : /* @__PURE__ */ jsx12(VaultRow, { label: "Add to", children: /* @__PURE__ */ jsx12(
             Select2,
             {
               value: target,
@@ -2311,7 +2329,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
             }
           ) }),
           isNew ? /* @__PURE__ */ jsxs11(Fragment7, { children: [
-            /* @__PURE__ */ jsx11(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx11(
+            /* @__PURE__ */ jsx12(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx12(
               Field4,
               {
                 className: "w-full",
@@ -2325,24 +2343,27 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
                 "aria-label": "Name"
               }
             ) }),
-            /* @__PURE__ */ jsx11(VaultRow, { label: "Website", hint: websiteBad ? /* @__PURE__ */ jsx11("span", { className: "text-destructive", children: "Not a web address" }) : void 0, children: /* @__PURE__ */ jsx11(Field4, { className: "w-full", type: "url", value: website, disabled: busy || created !== null, onChange: (e) => setWebsite(e.target.value), placeholder: "example.com", "aria-label": "Website", "aria-invalid": websiteBad || void 0 }) })
+            /* @__PURE__ */ jsx12(VaultRow, { label: "Website", hint: websiteBad ? /* @__PURE__ */ jsx12("span", { className: "text-destructive", children: "Not a web address" }) : void 0, children: /* @__PURE__ */ jsx12(Field4, { className: "w-full", type: "url", value: website, disabled: busy || created !== null, onChange: (e) => setWebsite(e.target.value), placeholder: "example.com", "aria-label": "Website", "aria-invalid": websiteBad || void 0 }) })
           ] }) : null
         ] }),
-        error ? /* @__PURE__ */ jsx11("p", { className: "px-1 text-sm text-destructive", role: "alert", children: error }) : null
+        error ? /* @__PURE__ */ jsx12("p", { className: "px-1 text-sm text-destructive", role: "alert", children: error }) : null
       ]
     }
   );
 }
+function FirstCodePanel(props) {
+  return /* @__PURE__ */ jsx12(AddedPanel, { ...props });
+}
 function AddedPanel({ port, item, onClose, onDone }) {
   const live = useLiveCode(port, item, true);
-  return /* @__PURE__ */ jsx11(Panel, { title: item.name, size: "sm", onClose, footer: /* @__PURE__ */ jsx11(Button8, { variant: "primary", onClick: onDone, children: "Done" }), children: /* @__PURE__ */ jsxs11("div", { className: "flex flex-col items-center gap-2 py-4", children: [
-    live.error ? /* @__PURE__ */ jsx11("span", { className: "text-sm text-destructive", children: live.error }) : /* @__PURE__ */ jsx11(CodeButton, { live, digits: item.authenticator?.digits ?? 6, size: "lg", label: item.name }),
-    /* @__PURE__ */ jsx11("p", { className: "text-xs text-muted-foreground", children: "Enter this code on the site to finish." })
+  return /* @__PURE__ */ jsx12(Panel, { title: item.name, size: "sm", onClose, footer: /* @__PURE__ */ jsx12(Button8, { variant: "primary", onClick: onDone, children: "Done" }), children: /* @__PURE__ */ jsxs11("div", { className: "flex flex-col items-center gap-2 py-4", children: [
+    live.error ? /* @__PURE__ */ jsx12("span", { className: "text-sm text-destructive", children: live.error }) : /* @__PURE__ */ jsx12(CodeButton, { live, digits: item.authenticator?.digits ?? 6, size: "lg", label: item.name }),
+    /* @__PURE__ */ jsx12("p", { className: "text-xs text-muted-foreground", children: "Enter this code on the site to finish." })
   ] }) });
 }
 
 // src/authenticator/AuthenticatorView.tsx
-import { Fragment as Fragment8, jsx as jsx12, jsxs as jsxs12 } from "react/jsx-runtime";
+import { Fragment as Fragment8, jsx as jsx13, jsxs as jsxs12 } from "react/jsx-runtime";
 function matchesEntry(entry, q) {
   if (!entry || !q) return false;
   return [entry.issuer, entry.account].some((v) => v?.toLowerCase().includes(q));
@@ -2360,7 +2381,7 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged, header }) {
+function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
   const [entries, setEntries] = useState13(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = useState13(/* @__PURE__ */ new Set());
   const [adding, setAdding] = useState13(false);
@@ -2380,20 +2401,20 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
-  return /* @__PURE__ */ jsxs12("section", { "aria-label": "One-time passwords", className: "flex h-full min-h-0 flex-col bg-background", children: [
-    header ? /* @__PURE__ */ jsx12("div", { className: "mx-auto w-full max-w-3xl px-3 pt-3 sm:px-4", children: header }) : null,
+  return /* @__PURE__ */ jsxs12("section", { "aria-label": "Authenticator", className: "flex h-full min-h-0 flex-col bg-background", children: [
+    header ? /* @__PURE__ */ jsx13("div", { className: "mx-auto w-full max-w-3xl px-3 pt-3 sm:px-4", children: header }) : null,
     /* @__PURE__ */ jsxs12("div", { className: "flex min-h-12 items-center justify-between gap-2 px-4 pb-1 pt-3", children: [
       /* @__PURE__ */ jsxs12("div", { className: "flex min-w-0 items-baseline gap-2", children: [
-        /* @__PURE__ */ jsx12("h2", { className: "truncate text-sm font-semibold text-foreground", children: "One-time passwords" }),
-        total > 0 ? /* @__PURE__ */ jsx12("span", { className: "text-xs tabular-nums text-muted-foreground", children: total }) : null
+        /* @__PURE__ */ jsx13("h2", { className: "truncate text-sm font-semibold text-foreground", children: "Authenticator" }),
+        total > 0 ? /* @__PURE__ */ jsx13("span", { className: "text-xs tabular-nums text-muted-foreground", children: total }) : null
       ] }),
-      total > 0 ? /* @__PURE__ */ jsx12(Button9, { variant: "outline", icon: /* @__PURE__ */ jsx12(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
+      total > 0 ? /* @__PURE__ */ jsx13(Button9, { variant: "outline", icon: /* @__PURE__ */ jsx13(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
     ] }),
     total === 0 ? /* @__PURE__ */ jsxs12("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
-      /* @__PURE__ */ jsx12("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ jsx12(ShieldGlyph, { className: "size-6" }) }),
-      /* @__PURE__ */ jsx12("p", { className: "text-sm font-medium text-foreground", children: "No one-time passwords yet" }),
-      /* @__PURE__ */ jsx12(Button9, { variant: "primary", icon: /* @__PURE__ */ jsx12(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add one-time password" })
-    ] }) : groups.length === 0 ? /* @__PURE__ */ jsx12("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: "Nothing matches." }) : /* @__PURE__ */ jsx12("div", { className: "min-h-0 flex-1 overflow-y-auto px-3 pb-6 pt-1 sm:px-4", children: /* @__PURE__ */ jsx12("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5", children: groups.map((g) => /* @__PURE__ */ jsx12(VaultSection, { title: g.label, className: "[&>div]:px-1", children: g.items.map((item) => /* @__PURE__ */ jsx12(
+      /* @__PURE__ */ jsx13("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ jsx13(ShieldGlyph, { className: "size-6" }) }),
+      /* @__PURE__ */ jsx13("p", { className: "text-sm font-medium text-foreground", children: "No authenticator codes yet" }),
+      /* @__PURE__ */ jsx13(Button9, { variant: "primary", icon: /* @__PURE__ */ jsx13(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add authenticator" })
+    ] }) : groups.length === 0 ? /* @__PURE__ */ jsx13("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: "Nothing matches." }) : /* @__PURE__ */ jsx13("div", { className: "min-h-0 flex-1 overflow-y-auto px-3 pb-6 pt-1 sm:px-4", children: /* @__PURE__ */ jsx13("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5", children: groups.map((g) => /* @__PURE__ */ jsx13(VaultSection, { title: g.label, className: "[&>div]:px-1", children: g.items.map((item) => /* @__PURE__ */ jsx13(
       OtpListRow,
       {
         port,
@@ -2401,6 +2422,7 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
         family: familyOf2(item.definitionKey),
         entry: entries.get(item.id),
         onOpen: () => onOpen(item.id),
+        ...host.openItemInNewTab ? { onOpenInNewTab: () => host.openItemInNewTab?.(item.id) } : {},
         onRename: () => {
           setRenameError(null);
           setRenaming(item);
@@ -2413,7 +2435,7 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
       },
       item.id
     )) }, g.key)) }) }),
-    adding ? /* @__PURE__ */ jsx12(
+    adding ? /* @__PURE__ */ jsx13(
       AddOtpPanel,
       {
         port,
@@ -2427,7 +2449,7 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
         }
       }
     ) : null,
-    /* @__PURE__ */ jsx12(
+    /* @__PURE__ */ jsx13(
       TextInputDialog,
       {
         open: renaming !== null,
@@ -2435,7 +2457,7 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
           if (!o && !renameBusy) setRenaming(null);
         },
         title: "Rename login",
-        ...renameError ? { description: /* @__PURE__ */ jsx12("span", { className: "text-destructive", children: renameError }) } : {},
+        ...renameError ? { description: /* @__PURE__ */ jsx13("span", { className: "text-destructive", children: renameError }) } : {},
         placeholder: "Login name",
         defaultValue: renaming?.name ?? "",
         confirmLabel: "Rename",
@@ -2458,50 +2480,53 @@ function AuthenticatorView({ port, items, definitions, query, onOpen, onChanged,
     )
   ] });
 }
-function OtpListRow({ port, item, family, entry, onOpen, onRename, onChanged, onRemoved }) {
+function OtpListRow({ port, item, family, entry, onOpen, onOpenInNewTab, onRename, onChanged, onRemoved }) {
   const a = useOtpActions(port, item, (next) => next && next.authenticator === null ? onRemoved() : onChanged());
   const live = useLiveCode(port, item, a.enabled && !a.removed);
   const { copy } = useCopied();
-  const Icon = definitionGlyph(item.definitionKey, family);
   const canManage = item.capabilities.canManage || item.capabilities.canEdit;
   if (a.removed) return null;
   const sub = a.error ?? [entry?.account, loginSiteOf(item) || entry?.issuer].filter((v, i, all) => Boolean(v) && all.indexOf(v) === i).join(" \xB7 ");
   return /* @__PURE__ */ jsxs12("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-3 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
-    /* @__PURE__ */ jsx12("button", { type: "button", onClick: onOpen, "aria-label": `Open ${item.name}`, tabIndex: -1, className: cn6("flex size-8 items-center justify-center rounded-lg bg-muted", a.enabled ? "text-foreground" : "text-disabled-foreground"), children: /* @__PURE__ */ jsx12(Icon, { className: "size-4" }) }),
+    /* @__PURE__ */ jsx13("button", { type: "button", onClick: onOpen, "aria-label": `Open ${item.name}`, tabIndex: -1, className: "flex size-8 items-center justify-center rounded-lg", children: /* @__PURE__ */ jsx13(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item) || (entry?.issuer ?? "") }) }),
     /* @__PURE__ */ jsxs12("button", { type: "button", onClick: onOpen, className: "flex min-w-0 flex-col items-start rounded-md text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring", children: [
-      /* @__PURE__ */ jsx12("span", { className: cn6("max-w-full truncate text-sm font-medium", a.enabled ? "text-foreground" : "text-muted-foreground"), children: item.name }),
-      sub ? /* @__PURE__ */ jsx12("span", { className: cn6("max-w-full truncate text-xs", a.error ? "text-destructive" : "text-muted-foreground"), title: sub, children: sub }) : null
+      /* @__PURE__ */ jsx13("span", { className: cn7("max-w-full truncate text-sm font-medium", a.enabled ? "text-foreground" : "text-muted-foreground"), children: item.name }),
+      sub ? /* @__PURE__ */ jsx13("span", { className: cn7("max-w-full truncate text-xs", a.error ? "text-destructive" : "text-muted-foreground"), title: sub, children: sub }) : null
     ] }),
-    /* @__PURE__ */ jsx12("div", { className: "flex min-w-0 justify-end", children: !a.enabled ? /* @__PURE__ */ jsxs12("span", { className: "flex items-center gap-1.5", children: [
-      /* @__PURE__ */ jsx12("span", { className: "text-sm text-disabled-foreground", children: "Off" }),
-      canManage ? /* @__PURE__ */ jsx12(Button9, { variant: "quiet", disabled: a.busy, onClick: () => void a.setEnabled(true), children: "Turn on" }) : null
+    /* @__PURE__ */ jsx13("div", { className: "flex min-w-0 justify-end", children: !a.enabled ? /* @__PURE__ */ jsxs12("span", { className: "flex items-center gap-1.5", children: [
+      /* @__PURE__ */ jsx13("span", { className: "text-sm text-disabled-foreground", children: "Off" }),
+      canManage ? /* @__PURE__ */ jsx13(Button9, { variant: "quiet", disabled: a.busy, onClick: () => void a.setEnabled(true), children: "Turn on" }) : null
     ] }) : live.error ? /* @__PURE__ */ jsxs12("span", { className: "flex items-center gap-1.5", children: [
-      /* @__PURE__ */ jsx12("span", { className: "max-w-40 truncate text-xs text-destructive", title: live.error, children: live.error }),
-      /* @__PURE__ */ jsx12(Button9, { variant: "quiet", onClick: live.retry, children: "Retry" })
-    ] }) : /* @__PURE__ */ jsx12(CodeButton, { live, digits: item.authenticator?.digits ?? 6, label: item.name }) }),
+      /* @__PURE__ */ jsx13("span", { className: "max-w-40 truncate text-xs text-destructive", title: live.error, children: live.error }),
+      /* @__PURE__ */ jsx13(Button9, { variant: "quiet", onClick: live.retry, children: "Retry" })
+    ] }) : /* @__PURE__ */ jsx13(CodeButton, { live, digits: item.authenticator?.digits ?? 6, label: item.name }) }),
     /* @__PURE__ */ jsxs12(DropdownMenu2, { children: [
-      /* @__PURE__ */ jsx12(DropdownMenuTrigger2, { asChild: true, children: /* @__PURE__ */ jsx12(Button9, { variant: "quiet", icon: /* @__PURE__ */ jsx12(MoreGlyph, {}), "aria-label": `${item.name} options`, disabled: a.busy }) }),
+      /* @__PURE__ */ jsx13(DropdownMenuTrigger2, { asChild: true, children: /* @__PURE__ */ jsx13(Button9, { variant: "quiet", icon: /* @__PURE__ */ jsx13(MoreGlyph, {}), "aria-label": `${item.name} options`, disabled: a.busy }) }),
       /* @__PURE__ */ jsxs12(DropdownMenuContent2, { align: "end", className: "min-w-44", children: [
         /* @__PURE__ */ jsxs12(DropdownMenuItem2, { onSelect: onOpen, children: [
-          /* @__PURE__ */ jsx12(ExternalGlyph, { className: "size-4" }),
+          /* @__PURE__ */ jsx13(ExternalGlyph, { className: "size-4" }),
           "Open login"
         ] }),
+        onOpenInNewTab ? /* @__PURE__ */ jsxs12(DropdownMenuItem2, { onSelect: onOpenInNewTab, children: [
+          /* @__PURE__ */ jsx13(ExternalGlyph, { className: "size-4" }),
+          "Open in new tab"
+        ] }) : null,
         live.code ? /* @__PURE__ */ jsxs12(DropdownMenuItem2, { onSelect: () => live.code && void copy(live.code), children: [
-          /* @__PURE__ */ jsx12(CopyIcon4, { className: "size-4" }),
+          /* @__PURE__ */ jsx13(CopyIcon4, { className: "size-4" }),
           "Copy code"
         ] }) : null,
         canManage ? /* @__PURE__ */ jsxs12(Fragment8, { children: [
           /* @__PURE__ */ jsxs12(DropdownMenuItem2, { onSelect: onRename, children: [
-            /* @__PURE__ */ jsx12(PencilGlyph, { className: "size-4" }),
+            /* @__PURE__ */ jsx13(PencilGlyph, { className: "size-4" }),
             "Rename"
           ] }),
           /* @__PURE__ */ jsxs12(DropdownMenuItem2, { onSelect: () => void a.setEnabled(!a.enabled), children: [
-            /* @__PURE__ */ jsx12(PowerGlyph, { className: "size-4" }),
+            /* @__PURE__ */ jsx13(PowerGlyph, { className: "size-4" }),
             a.enabled ? "Turn off" : "Turn on"
           ] }),
-          /* @__PURE__ */ jsx12(DropdownMenuSeparator2, {}),
+          /* @__PURE__ */ jsx13(DropdownMenuSeparator2, {}),
           /* @__PURE__ */ jsxs12(DropdownMenuItem2, { className: "text-destructive focus:text-destructive", onSelect: () => void a.remove(), children: [
-            /* @__PURE__ */ jsx12(TrashGlyph, { className: "size-4" }),
+            /* @__PURE__ */ jsx13(TrashGlyph, { className: "size-4" }),
             "Remove"
           ] })
         ] }) : null
@@ -2592,9 +2617,21 @@ function withoutCode(codes, index) {
   const left = codes.filter((_, i) => i !== index);
   return left.length ? left.join("\n") : null;
 }
+function parseEnvAssignment(text) {
+  const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=(.*)$/s.exec(text.trim());
+  if (!m || /\n/.test(m[2] ?? "")) return null;
+  let value = (m[2] ?? "").trim();
+  const q = value[0];
+  if ((q === '"' || q === "'") && value.length >= 2 && value.endsWith(q)) value = value.slice(1, -1);
+  return value ? { key: m[1] ?? "", value } : null;
+}
+function labelFromEnvKey(key) {
+  const words = key.toLowerCase().split(/[_\s]+/).filter(Boolean).join(" ");
+  return words ? words.charAt(0).toUpperCase() + words.slice(1) : key;
+}
 
 // src/fields/SettingsPanels.tsx
-import { jsx as jsx13, jsxs as jsxs13 } from "react/jsx-runtime";
+import { jsx as jsx14, jsxs as jsxs13 } from "react/jsx-runtime";
 var say = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function useSaver(onChanged) {
   const [busy, setBusy] = useState14(null);
@@ -2616,14 +2653,14 @@ function useSaver(onChanged) {
   return { busy, error, setError, save };
 }
 function Problem({ children }) {
-  return /* @__PURE__ */ jsx13("p", { role: "alert", className: "px-1 text-sm text-destructive", children });
+  return /* @__PURE__ */ jsx14("p", { role: "alert", className: "px-1 text-sm text-destructive", children });
 }
-var quietHint = (text, tone = "muted") => /* @__PURE__ */ jsx13("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
+var quietHint = (text, tone = "muted") => /* @__PURE__ */ jsx14("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
 function FieldSettingsPanel(props) {
   const field = props.item.fields.find((f) => f.id === props.arg);
   if (!field)
-    return /* @__PURE__ */ jsx13(Panel, { title: "Field settings", size: "md", onClose: props.onClose, footer: /* @__PURE__ */ jsx13(Button10, { variant: "primary", onClick: props.onClose, children: "Done" }), children: /* @__PURE__ */ jsx13(Empty, { children: "This field is no longer on the item." }) });
-  return /* @__PURE__ */ jsx13(FieldSettings, { ...props, field }, field.id);
+    return /* @__PURE__ */ jsx14(Panel, { title: "Field settings", size: "md", onClose: props.onClose, footer: /* @__PURE__ */ jsx14(Button10, { variant: "primary", onClick: props.onClose, children: "Done" }), children: /* @__PURE__ */ jsx14(Empty, { children: "This field is no longer on the item." }) });
+  return /* @__PURE__ */ jsx14(FieldSettings, { ...props, field }, field.id);
 }
 function FieldSettings({ item, port, field, onClose, onChanged }) {
   const { busy, error, setError, save } = useSaver((next) => onChanged(next));
@@ -2662,9 +2699,9 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
   };
   const handling = HANDLING_WORDS[field.handling];
   const locked = !canEdit || busy !== null;
-  return /* @__PURE__ */ jsxs13(Panel, { title: `${field.label} settings`, size: "md", onClose, footer: /* @__PURE__ */ jsx13(Button10, { variant: "primary", onClick: onClose, children: "Done" }), children: [
-    !canEdit ? /* @__PURE__ */ jsx13("p", { className: "px-1 text-sm text-muted-foreground", children: "View only: you can\u2019t change these settings." }) : null,
-    /* @__PURE__ */ jsx13(VaultSection, { title: "Who can see it", children: /* @__PURE__ */ jsx13(VaultRow, { label: "Value", hint: quietHint(handling.hint), children: field.handling === "sealed" ? /* @__PURE__ */ jsx13(Badge3, { icon: /* @__PURE__ */ jsx13(LockGlyph, {}), children: "Sealed for good" }) : /* @__PURE__ */ jsx13(
+  return /* @__PURE__ */ jsxs13(Panel, { title: `${field.label} settings`, size: "md", onClose, footer: /* @__PURE__ */ jsx14(Button10, { variant: "primary", onClick: onClose, children: "Done" }), children: [
+    !canEdit ? /* @__PURE__ */ jsx14("p", { className: "px-1 text-sm text-muted-foreground", children: "View only: you can\u2019t change these settings." }) : null,
+    /* @__PURE__ */ jsx14(VaultSection, { title: "Who can see it", children: /* @__PURE__ */ jsx14(VaultRow, { label: "Value", hint: quietHint(handling.hint), children: field.handling === "sealed" ? /* @__PURE__ */ jsx14(Badge3, { icon: /* @__PURE__ */ jsx14(LockGlyph, {}), children: "Sealed for good" }) : /* @__PURE__ */ jsx14(
       SegmentedControl,
       {
         "aria-label": "Who can see it",
@@ -2674,7 +2711,7 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
       }
     ) }) }),
     /* @__PURE__ */ jsxs13(VaultSection, { title: "Automation", children: [
-      /* @__PURE__ */ jsx13(VaultRow, { label: "Env key", hint: envProblem ? quietHint(envProblem, "destructive") : quietHint("The name sandboxes and workflows use"), children: /* @__PURE__ */ jsx13(
+      /* @__PURE__ */ jsx14(VaultRow, { label: "Env key", hint: envProblem ? quietHint(envProblem, "destructive") : quietHint("The name sandboxes and workflows use"), children: /* @__PURE__ */ jsx14(
         Field5,
         {
           ref: envRef,
@@ -2694,10 +2731,10 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
           }
         }
       ) }),
-      /* @__PURE__ */ jsx13(VaultRow, { label: "Use in sandbox", hint: blocker && !field.injectIntoSandbox ? quietHint(blocker) : quietHint("Sandboxes get it as an env variable"), children: /* @__PURE__ */ jsx13(Switch, { "aria-label": "Use in sandbox", checked: field.injectIntoSandbox, disabled: locked, onCheckedChange: (v) => void setSandbox(v) }) })
+      /* @__PURE__ */ jsx14(VaultRow, { label: "Use in sandbox", hint: blocker && !field.injectIntoSandbox ? quietHint(blocker) : quietHint("Sandboxes get it as an env variable"), children: /* @__PURE__ */ jsx14(Switch, { "aria-label": "Use in sandbox", checked: field.injectIntoSandbox, disabled: locked, onCheckedChange: (v) => void setSandbox(v) }) })
     ] }),
     /* @__PURE__ */ jsxs13(VaultSection, { title: "Field", children: [
-      /* @__PURE__ */ jsx13(VaultRow, { label: "Description", children: /* @__PURE__ */ jsx13(
+      /* @__PURE__ */ jsx14(VaultRow, { label: "Description", children: /* @__PURE__ */ jsx14(
         Field5,
         {
           className: "w-full",
@@ -2713,10 +2750,10 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
           }
         }
       ) }),
-      /* @__PURE__ */ jsx13(VaultRow, { label: "Editable", hint: quietHint(field.editable ? "The value can be changed" : "The value is locked"), children: /* @__PURE__ */ jsx13(Switch, { "aria-label": "Editable", checked: field.editable, disabled: locked, onCheckedChange: (v) => void update("editable", { editable: v }) }) }),
-      /* @__PURE__ */ jsx13(VaultRow, { label: "Turned on", hint: quietHint(field.active ? "In use" : "Kept, but nothing uses it"), children: /* @__PURE__ */ jsx13(Switch, { "aria-label": "Turned on", checked: field.active, disabled: locked, onCheckedChange: (v) => void update("active", { active: v }) }) })
+      /* @__PURE__ */ jsx14(VaultRow, { label: "Editable", hint: quietHint(field.editable ? "The value can be changed" : "The value is locked"), children: /* @__PURE__ */ jsx14(Switch, { "aria-label": "Editable", checked: field.editable, disabled: locked, onCheckedChange: (v) => void update("editable", { editable: v }) }) }),
+      /* @__PURE__ */ jsx14(VaultRow, { label: "Turned on", hint: quietHint(field.active ? "In use" : "Kept, but nothing uses it"), children: /* @__PURE__ */ jsx14(Switch, { "aria-label": "Turned on", checked: field.active, disabled: locked, onCheckedChange: (v) => void update("active", { active: v }) }) })
     ] }),
-    error ? /* @__PURE__ */ jsx13(Problem, { children: error }) : null
+    error ? /* @__PURE__ */ jsx14(Problem, { children: error }) : null
   ] });
 }
 function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
@@ -2743,10 +2780,10 @@ function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
     });
   };
   const fillHint = !hasWebsite ? "Add a website first" : item.browserFillEnabled ? "Offered on matching pages" : "Never filled automatically";
-  return /* @__PURE__ */ jsxs13(Panel, { title: "Item settings", size: "md", onClose, footer: /* @__PURE__ */ jsx13(Button10, { variant: "primary", onClick: onClose, children: "Done" }), children: [
-    !canEdit ? /* @__PURE__ */ jsx13("p", { className: "px-1 text-sm text-muted-foreground", children: "View only: you can\u2019t change these settings." }) : null,
+  return /* @__PURE__ */ jsxs13(Panel, { title: "Item settings", size: "md", onClose, footer: /* @__PURE__ */ jsx14(Button10, { variant: "primary", onClick: onClose, children: "Done" }), children: [
+    !canEdit ? /* @__PURE__ */ jsx14("p", { className: "px-1 text-sm text-muted-foreground", children: "View only: you can\u2019t change these settings." }) : null,
     /* @__PURE__ */ jsxs13(VaultSection, { title: "In the browser", children: [
-      /* @__PURE__ */ jsx13(VaultRow, { label: "Website matching", hint: quietHint(MATCH_WORDS[item.uriMatchMode].hint), children: /* @__PURE__ */ jsx13(
+      /* @__PURE__ */ jsx14(VaultRow, { label: "Website matching", hint: quietHint(MATCH_WORDS[item.uriMatchMode].hint), children: /* @__PURE__ */ jsx14(
         Select3,
         {
           "aria-label": "Website matching",
@@ -2756,45 +2793,45 @@ function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
           onValueChange: (m) => void save("match", () => port.fields.updateItem(item, { uriMatchMode: m }))
         }
       ) }),
-      /* @__PURE__ */ jsx13(VaultRow, { label: "Fill in browser", hint: quietHint(fillHint), children: /* @__PURE__ */ jsx13(Switch, { "aria-label": "Fill in browser", checked: hasWebsite && item.browserFillEnabled, disabled: locked || !hasWebsite, onCheckedChange: (v) => void save("fill", () => port.fields.updateItem(item, { browserFillEnabled: v })) }) }),
-      promotable.map((f) => /* @__PURE__ */ jsx13(
+      /* @__PURE__ */ jsx14(VaultRow, { label: "Fill in browser", hint: quietHint(fillHint), children: /* @__PURE__ */ jsx14(Switch, { "aria-label": "Fill in browser", checked: hasWebsite && item.browserFillEnabled, disabled: locked || !hasWebsite, onCheckedChange: (v) => void save("fill", () => port.fields.updateItem(item, { browserFillEnabled: v })) }) }),
+      promotable.map((f) => /* @__PURE__ */ jsx14(
         VaultRow,
         {
           label: f.label,
           hint: quietHint("Encrypted, so the browser can\u2019t match it"),
-          actions: /* @__PURE__ */ jsx13(Button10, { variant: "outline", icon: /* @__PURE__ */ jsx13(GlobeIcon2, {}), disabled: locked, onClick: () => void promote(f), children: "Use as website" }),
-          children: /* @__PURE__ */ jsx13("span", { className: "text-muted-foreground", children: "Not a website yet" })
+          actions: /* @__PURE__ */ jsx14(Button10, { variant: "outline", icon: /* @__PURE__ */ jsx14(GlobeIcon2, {}), disabled: locked, onClick: () => void promote(f), children: "Use as website" }),
+          children: /* @__PURE__ */ jsx14("span", { className: "text-muted-foreground", children: "Not a website yet" })
         },
         f.id
       ))
     ] }),
     /* @__PURE__ */ jsxs13("div", { className: "flex flex-col gap-1.5", children: [
-      /* @__PURE__ */ jsx13(DisclosureHeader, { open: advanced, title: "Advanced", meta: item.fields.length ? `${item.fields.length} fields` : void 0, onClick: () => setAdvanced((a) => !a) }),
-      advanced ? /* @__PURE__ */ jsx13(VaultSection, { children: item.fields.length === 0 ? /* @__PURE__ */ jsx13(Empty, { children: "No encrypted fields." }) : item.fields.map((f) => /* @__PURE__ */ jsx13(
+      /* @__PURE__ */ jsx14(DisclosureHeader, { open: advanced, title: "Advanced", meta: item.fields.length ? `${item.fields.length} fields` : void 0, onClick: () => setAdvanced((a) => !a) }),
+      advanced ? /* @__PURE__ */ jsx14(VaultSection, { children: item.fields.length === 0 ? /* @__PURE__ */ jsx14(Empty, { children: "No encrypted fields." }) : item.fields.map((f) => /* @__PURE__ */ jsx14(
         VaultRow,
         {
           label: f.label,
-          actions: /* @__PURE__ */ jsx13(Button10, { variant: "quiet", icon: /* @__PURE__ */ jsx13(SlidersGlyph, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }),
+          actions: /* @__PURE__ */ jsx14(Button10, { variant: "quiet", icon: /* @__PURE__ */ jsx14(SlidersGlyph, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }),
           children: /* @__PURE__ */ jsxs13("span", { className: "block truncate", children: [
-            /* @__PURE__ */ jsx13("span", { className: f.handling === "sealed" ? "text-foreground" : "text-muted-foreground", children: HANDLING_WORDS[f.handling].label }),
+            /* @__PURE__ */ jsx14("span", { className: f.handling === "sealed" ? "text-foreground" : "text-muted-foreground", children: HANDLING_WORDS[f.handling].label }),
             f.envKey ? /* @__PURE__ */ jsxs13("span", { className: "font-mono text-muted-foreground", children: [
               " \xB7 ",
               f.envKey
             ] }) : null,
-            f.injectIntoSandbox ? /* @__PURE__ */ jsx13("span", { className: "text-muted-foreground", children: " \xB7 Sandbox" }) : null,
-            !f.active ? /* @__PURE__ */ jsx13("span", { className: "text-warning", children: " \xB7 Turned off" }) : null
+            f.injectIntoSandbox ? /* @__PURE__ */ jsx14("span", { className: "text-muted-foreground", children: " \xB7 Sandbox" }) : null,
+            !f.active ? /* @__PURE__ */ jsx14("span", { className: "text-warning", children: " \xB7 Turned off" }) : null
           ] })
         },
         f.id
       )) }) : null
     ] }),
-    error ? /* @__PURE__ */ jsx13(Problem, { children: error }) : null
+    error ? /* @__PURE__ */ jsx14(Problem, { children: error }) : null
   ] });
 }
 
 // src/generator/PasswordGenerator.tsx
 import { createContext as createContext5, useContext as useContext5, useEffect as useEffect12, useRef as useRef10, useState as useState15 } from "react";
-import { Popover, PopoverContent, PopoverTrigger, cn as cn7 } from "@ai-matrx/design-system";
+import { Popover, PopoverContent, PopoverTrigger, cn as cn8 } from "@ai-matrx/design-system";
 import { Button as Button11, NumberStepper, SegmentedControl as SegmentedControl2, Select as Select4, Switch as Switch2 } from "@ai-matrx/design-system/controls";
 import { CopyIcon as CopyIcon5 } from "@ai-matrx/design-system/icons";
 
@@ -2854,10 +2891,10 @@ function strengthOf(bits) {
 }
 
 // src/generator/PasswordGenerator.tsx
-import { jsx as jsx14, jsxs as jsxs14 } from "react/jsx-runtime";
+import { jsx as jsx15, jsxs as jsxs14 } from "react/jsx-runtime";
 var LimitsCtx = createContext5(null);
 function GeneratorLimitsProvider({ resolve: resolve2, children }) {
-  return /* @__PURE__ */ jsx14(LimitsCtx.Provider, { value: resolve2 ?? null, children });
+  return /* @__PURE__ */ jsx15(LimitsCtx.Provider, { value: resolve2 ?? null, children });
 }
 function useGeneratorLimitsSource() {
   return useContext5(LimitsCtx);
@@ -2918,11 +2955,11 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   useEffect12(() => () => {
     if (expiry.current) clearTimeout(expiry.current);
   }, []);
-  if (limits.state === "loading") return /* @__PURE__ */ jsx14("p", { className: "px-1 py-3 text-sm text-muted-foreground", "aria-live": "polite", children: "Reading limits\u2026" });
+  if (limits.state === "loading") return /* @__PURE__ */ jsx15("p", { className: "px-1 py-3 text-sm text-muted-foreground", "aria-live": "polite", children: "Reading limits\u2026" });
   if (limits.state === "unavailable")
     return /* @__PURE__ */ jsxs14("div", { className: "flex flex-col gap-2 px-1 py-2", children: [
-      /* @__PURE__ */ jsx14("p", { role: "alert", className: "text-sm text-destructive", children: limits.message }),
-      /* @__PURE__ */ jsx14(Button11, { variant: "outline", icon: /* @__PURE__ */ jsx14(RefreshGlyph, {}), onClick: () => setRound((n) => n + 1), children: "Try again" })
+      /* @__PURE__ */ jsx15("p", { role: "alert", className: "text-sm text-destructive", children: limits.message }),
+      /* @__PURE__ */ jsx15(Button11, { variant: "outline", icon: /* @__PURE__ */ jsx15(RefreshGlyph, {}), onClick: () => setRound((n) => n + 1), children: "Try again" })
     ] });
   const ceilings = limits.limits;
   const change = (next) => make(next, ceilings);
@@ -2940,7 +2977,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
     onUse(value);
   };
   return /* @__PURE__ */ jsxs14("div", { className: "flex w-full flex-col gap-3", "aria-label": "Password generator", children: [
-    /* @__PURE__ */ jsx14(
+    /* @__PURE__ */ jsx15(
       SegmentedControl2,
       {
         fill: true,
@@ -2952,13 +2989,13 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
     ),
     /* @__PURE__ */ jsxs14("div", { className: "flex flex-col gap-1 rounded-lg bg-muted px-3 py-2", children: [
       /* @__PURE__ */ jsxs14("div", { className: "flex min-h-7 items-start gap-1", children: [
-        /* @__PURE__ */ jsx14("code", { className: cn7("min-w-0 flex-1 break-all py-1 font-mono text-sm", candidate ? "text-foreground" : "text-muted-foreground"), "data-testid": "generated-value", children: candidate ? revealed ? candidate.value : MASK3 : "\u2014" }),
-        /* @__PURE__ */ jsx14(Button11, { variant: "quiet", icon: revealed ? /* @__PURE__ */ jsx14(EyeOffGlyph, {}) : /* @__PURE__ */ jsx14(EyeGlyph, {}), "aria-label": revealed ? "Hide" : "Reveal", disabled: !candidate, onClick: () => setRevealed((r) => !r) }),
-        /* @__PURE__ */ jsx14(Button11, { variant: "quiet", icon: /* @__PURE__ */ jsx14(CopyIcon5, {}), "aria-label": "Copy", disabled: !candidate, onClick: () => void copy() }),
-        /* @__PURE__ */ jsx14(Button11, { variant: "quiet", icon: /* @__PURE__ */ jsx14(RefreshGlyph, {}), "aria-label": "Generate another", onClick: () => change(settings) })
+        /* @__PURE__ */ jsx15("code", { className: cn8("min-w-0 flex-1 break-all py-1 font-mono text-sm", candidate ? "text-foreground" : "text-muted-foreground"), "data-testid": "generated-value", children: candidate ? revealed ? candidate.value : MASK3 : "\u2014" }),
+        /* @__PURE__ */ jsx15(Button11, { variant: "quiet", icon: revealed ? /* @__PURE__ */ jsx15(EyeOffGlyph, {}) : /* @__PURE__ */ jsx15(EyeGlyph, {}), "aria-label": revealed ? "Hide" : "Reveal", disabled: !candidate, onClick: () => setRevealed((r) => !r) }),
+        /* @__PURE__ */ jsx15(Button11, { variant: "quiet", icon: /* @__PURE__ */ jsx15(CopyIcon5, {}), "aria-label": "Copy", disabled: !candidate, onClick: () => void copy() }),
+        /* @__PURE__ */ jsx15(Button11, { variant: "quiet", icon: /* @__PURE__ */ jsx15(RefreshGlyph, {}), "aria-label": "Generate another", onClick: () => change(settings) })
       ] }),
       strength && candidate ? /* @__PURE__ */ jsxs14("p", { className: "text-xs", children: [
-        /* @__PURE__ */ jsx14("span", { className: cn7(strength.tone === "success" && "text-success", strength.tone === "primary" && "text-primary", strength.tone === "warning" && "text-warning"), children: strength.label }),
+        /* @__PURE__ */ jsx15("span", { className: cn8(strength.tone === "success" && "text-success", strength.tone === "primary" && "text-primary", strength.tone === "warning" && "text-warning"), children: strength.label }),
         /* @__PURE__ */ jsxs14("span", { className: "text-muted-foreground", children: [
           " \xB7 ",
           Math.floor(candidate.bits),
@@ -2967,7 +3004,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
       ] }) : null
     ] }),
     settings.kind === "password" ? /* @__PURE__ */ jsxs14("div", { className: "flex flex-col gap-0.5", children: [
-      /* @__PURE__ */ jsx14(OptionLine, { label: "Length", children: /* @__PURE__ */ jsx14(NumberStepper, { value: settings.password.length, min: minPasswordLength(settings.password), max: ceilings.maxPasswordLength, fallback: 24, onChange: (length) => setPassword({ length }) }) }),
+      /* @__PURE__ */ jsx15(OptionLine, { label: "Length", children: /* @__PURE__ */ jsx15(NumberStepper, { value: settings.password.length, min: minPasswordLength(settings.password), max: ceilings.maxPasswordLength, fallback: 24, onChange: (length) => setPassword({ length }) }) }),
       [
         ["lowercase", "Lowercase"],
         ["uppercase", "Uppercase"],
@@ -2976,26 +3013,26 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
       ].map(([key, label]) => {
         const on = settings.password[key];
         const last = on && minPasswordLength(settings.password) === 1;
-        return /* @__PURE__ */ jsx14(OptionLine, { label, children: /* @__PURE__ */ jsx14(Switch2, { "aria-label": label, checked: on, disabled: last, onCheckedChange: (v) => setPassword({ [key]: v }) }) }, key);
+        return /* @__PURE__ */ jsx15(OptionLine, { label, children: /* @__PURE__ */ jsx15(Switch2, { "aria-label": label, checked: on, disabled: last, onCheckedChange: (v) => setPassword({ [key]: v }) }) }, key);
       }),
-      /* @__PURE__ */ jsx14(OptionLine, { label: "Avoid look-alikes", hint: "No 0/O, 1/l/I", children: /* @__PURE__ */ jsx14(Switch2, { "aria-label": "Avoid look-alikes", checked: settings.password.excludeAmbiguous, onCheckedChange: (v) => setPassword({ excludeAmbiguous: v }) }) })
+      /* @__PURE__ */ jsx15(OptionLine, { label: "Avoid look-alikes", hint: "No 0/O, 1/l/I", children: /* @__PURE__ */ jsx15(Switch2, { "aria-label": "Avoid look-alikes", checked: settings.password.excludeAmbiguous, onCheckedChange: (v) => setPassword({ excludeAmbiguous: v }) }) })
     ] }) : /* @__PURE__ */ jsxs14("div", { className: "flex flex-col gap-0.5", children: [
-      /* @__PURE__ */ jsx14(OptionLine, { label: "Words", children: /* @__PURE__ */ jsx14(NumberStepper, { value: settings.passphrase.wordCount, min: MIN_PASSPHRASE_WORDS, max: ceilings.maxPassphraseWords, fallback: MIN_PASSPHRASE_WORDS, onChange: (wordCount) => change({ ...settings, passphrase: { ...settings.passphrase, wordCount } }) }) }),
-      /* @__PURE__ */ jsx14(OptionLine, { label: "Separator", children: /* @__PURE__ */ jsx14(Select4, { "aria-label": "Separator", variant: "inline", align: "end", value: settings.passphrase.separator, options: SEPARATORS, onValueChange: (separator) => change({ ...settings, passphrase: { ...settings.passphrase, separator } }) }) }),
-      /* @__PURE__ */ jsx14(OptionLine, { label: "Capitalize", children: /* @__PURE__ */ jsx14(Switch2, { "aria-label": "Capitalize", checked: settings.passphrase.capitalize, onCheckedChange: (capitalize) => change({ ...settings, passphrase: { ...settings.passphrase, capitalize } }) }) }),
-      /* @__PURE__ */ jsx14(OptionLine, { label: "Add a digit", children: /* @__PURE__ */ jsx14(Switch2, { "aria-label": "Add a digit", checked: settings.passphrase.appendDigit, onCheckedChange: (appendDigit) => change({ ...settings, passphrase: { ...settings.passphrase, appendDigit } }) }) })
+      /* @__PURE__ */ jsx15(OptionLine, { label: "Words", children: /* @__PURE__ */ jsx15(NumberStepper, { value: settings.passphrase.wordCount, min: MIN_PASSPHRASE_WORDS, max: ceilings.maxPassphraseWords, fallback: MIN_PASSPHRASE_WORDS, onChange: (wordCount) => change({ ...settings, passphrase: { ...settings.passphrase, wordCount } }) }) }),
+      /* @__PURE__ */ jsx15(OptionLine, { label: "Separator", children: /* @__PURE__ */ jsx15(Select4, { "aria-label": "Separator", variant: "inline", align: "end", value: settings.passphrase.separator, options: SEPARATORS, onValueChange: (separator) => change({ ...settings, passphrase: { ...settings.passphrase, separator } }) }) }),
+      /* @__PURE__ */ jsx15(OptionLine, { label: "Capitalize", children: /* @__PURE__ */ jsx15(Switch2, { "aria-label": "Capitalize", checked: settings.passphrase.capitalize, onCheckedChange: (capitalize) => change({ ...settings, passphrase: { ...settings.passphrase, capitalize } }) }) }),
+      /* @__PURE__ */ jsx15(OptionLine, { label: "Add a digit", children: /* @__PURE__ */ jsx15(Switch2, { "aria-label": "Add a digit", checked: settings.passphrase.appendDigit, onCheckedChange: (appendDigit) => change({ ...settings, passphrase: { ...settings.passphrase, appendDigit } }) }) })
     ] }),
-    note ? /* @__PURE__ */ jsx14("p", { "aria-live": "polite", className: cn7("text-xs", note.tone === "destructive" ? "text-destructive" : note.tone === "success" ? "text-success" : "text-muted-foreground"), children: note.text }) : null,
-    /* @__PURE__ */ jsx14(Button11, { variant: "primary", disabled: !candidate, onClick: use, children: useLabel })
+    note ? /* @__PURE__ */ jsx15("p", { "aria-live": "polite", className: cn8("text-xs", note.tone === "destructive" ? "text-destructive" : note.tone === "success" ? "text-success" : "text-muted-foreground"), children: note.text }) : null,
+    /* @__PURE__ */ jsx15(Button11, { variant: "primary", disabled: !candidate, onClick: use, children: useLabel })
   ] });
 }
-function OptionLine({ label, hint, children }) {
+function OptionLine({ label, hint: hint2, children }) {
   return /* @__PURE__ */ jsxs14("div", { className: "flex min-h-9 items-center justify-between gap-3", children: [
     /* @__PURE__ */ jsxs14("div", { className: "flex min-w-0 flex-col", children: [
-      /* @__PURE__ */ jsx14("span", { className: "truncate text-sm text-foreground", children: label }),
-      hint ? /* @__PURE__ */ jsx14("span", { className: "truncate text-xs text-muted-foreground", children: hint }) : null
+      /* @__PURE__ */ jsx15("span", { className: "truncate text-sm text-foreground", children: label }),
+      hint2 ? /* @__PURE__ */ jsx15("span", { className: "truncate text-xs text-muted-foreground", children: hint2 }) : null
     ] }),
-    /* @__PURE__ */ jsx14("div", { className: "flex shrink-0 items-center", children })
+    /* @__PURE__ */ jsx15("div", { className: "flex shrink-0 items-center", children })
   ] });
 }
 function GenerateButton({ onUse, label, limits, disabled }) {
@@ -3005,8 +3042,8 @@ function GenerateButton({ onUse, label, limits, disabled }) {
   if (!source) return null;
   const name = label ?? "Generate password";
   return /* @__PURE__ */ jsxs14(Popover, { open, onOpenChange: setOpen, children: [
-    /* @__PURE__ */ jsx14(PopoverTrigger, { asChild: true, children: /* @__PURE__ */ jsx14(Button11, { variant: "quiet", icon: /* @__PURE__ */ jsx14(KeyGlyph, {}), "aria-label": name, title: name, disabled }) }),
-    /* @__PURE__ */ jsx14(PopoverContent, { sizing: "content", align: "end", children: open ? /* @__PURE__ */ jsx14(
+    /* @__PURE__ */ jsx15(PopoverTrigger, { asChild: true, children: /* @__PURE__ */ jsx15(Button11, { variant: "quiet", icon: /* @__PURE__ */ jsx15(KeyGlyph, {}), "aria-label": name, title: name, disabled }) }),
+    /* @__PURE__ */ jsx15(PopoverContent, { sizing: "content", align: "end", children: open ? /* @__PURE__ */ jsx15(
       PasswordGenerator,
       {
         limits: source,
@@ -3178,13 +3215,13 @@ function startNewRestoreRun(preview) {
 import { useState as useState16 } from "react";
 import { Checkbox } from "@ai-matrx/design-system";
 import { Badge as Badge4, Button as Button12, DisclosureHeader as DisclosureHeader2 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment9, jsx as jsx15, jsxs as jsxs15 } from "react/jsx-runtime";
+import { Fragment as Fragment9, jsx as jsx16, jsxs as jsxs15 } from "react/jsx-runtime";
 function PickLine({ checked, onChange, disabled = false, title, detail, badge, tone }) {
   return /* @__PURE__ */ jsxs15("label", { className: "flex min-h-11 items-center gap-3 px-4 py-1", "data-clickable": disabled ? void 0 : "", children: [
-    /* @__PURE__ */ jsx15(Checkbox, { checked, disabled, onCheckedChange: (v) => onChange(v === true), "aria-label": title }),
-    /* @__PURE__ */ jsx15("span", { className: "min-w-0 flex-1 truncate text-sm text-foreground", children: title }),
-    detail ? /* @__PURE__ */ jsx15("span", { className: "hidden min-w-0 max-w-[45%] truncate text-xs text-muted-foreground sm:block", children: detail }) : null,
-    badge ? /* @__PURE__ */ jsx15(Badge4, { tone: tone ?? "neutral", children: badge }) : null
+    /* @__PURE__ */ jsx16(Checkbox, { checked, disabled, onCheckedChange: (v) => onChange(v === true), "aria-label": title }),
+    /* @__PURE__ */ jsx16("span", { className: "min-w-0 flex-1 truncate text-sm text-foreground", children: title }),
+    detail ? /* @__PURE__ */ jsx16("span", { className: "hidden min-w-0 max-w-[45%] truncate text-xs text-muted-foreground sm:block", children: detail }) : null,
+    badge ? /* @__PURE__ */ jsx16(Badge4, { tone: tone ?? "neutral", children: badge }) : null
   ] });
 }
 function Windowed({ items, size = 150, render }) {
@@ -3192,7 +3229,7 @@ function Windowed({ items, size = 150, render }) {
   const shown = all ? items : items.slice(0, size);
   return /* @__PURE__ */ jsxs15(Fragment9, { children: [
     shown.map(render),
-    items.length > shown.length ? /* @__PURE__ */ jsx15("div", { className: "px-4 py-2", children: /* @__PURE__ */ jsxs15(Button12, { variant: "quiet", onClick: () => setAll(true), children: [
+    items.length > shown.length ? /* @__PURE__ */ jsx16("div", { className: "px-4 py-2", children: /* @__PURE__ */ jsxs15(Button12, { variant: "quiet", onClick: () => setAll(true), children: [
       "Show all ",
       items.length
     ] }) }) : null
@@ -3201,17 +3238,17 @@ function Windowed({ items, size = 150, render }) {
 function More({ title = "More", children }) {
   const [open, setOpen] = useState16(false);
   return /* @__PURE__ */ jsxs15("div", { className: "flex flex-col gap-2", children: [
-    /* @__PURE__ */ jsx15(DisclosureHeader2, { open, title, onClick: () => setOpen((o) => !o) }),
+    /* @__PURE__ */ jsx16(DisclosureHeader2, { open, title, onClick: () => setOpen((o) => !o) }),
     open ? children : null
   ] });
 }
 function ErrorLine({ message: message2 }) {
-  return message2 ? /* @__PURE__ */ jsx15("p", { role: "alert", className: "px-1 text-sm text-destructive", children: message2 }) : null;
+  return message2 ? /* @__PURE__ */ jsx16("p", { role: "alert", className: "px-1 text-sm text-destructive", children: message2 }) : null;
 }
 var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
 
 // src/io/BackupPanel.tsx
-import { Fragment as Fragment10, jsx as jsx16, jsxs as jsxs16 } from "react/jsx-runtime";
+import { Fragment as Fragment10, jsx as jsx17, jsxs as jsxs16 } from "react/jsx-runtime";
 var RECORD_STATUS = {
   created: "Restored",
   replayed: "Already restored",
@@ -3224,16 +3261,16 @@ function omissionText(o) {
 }
 function Summary({ value }) {
   return /* @__PURE__ */ jsxs16(VaultSection, { children: [
-    /* @__PURE__ */ jsx16(VaultRow, { label: "Credentials", children: value.record_count }),
-    /* @__PURE__ */ jsx16(VaultRow, { label: "Protected fields", children: value.field_count }),
-    /* @__PURE__ */ jsx16(VaultRow, { label: "Files", children: value.attachment_count > 0 ? `${value.attachment_count} \xB7 ${formatFileSize(value.attachment_bytes)}` : "0" })
+    /* @__PURE__ */ jsx17(VaultRow, { label: "Credentials", children: value.record_count }),
+    /* @__PURE__ */ jsx17(VaultRow, { label: "Protected fields", children: value.field_count }),
+    /* @__PURE__ */ jsx17(VaultRow, { label: "Files", children: value.attachment_count > 0 ? `${value.attachment_count} \xB7 ${formatFileSize(value.attachment_bytes)}` : "0" })
   ] });
 }
 function Omissions({ omissions, accepted, onAccepted, verb }) {
   if (omissions.length === 0) return null;
   return /* @__PURE__ */ jsxs16(VaultSection, { title: "Left out", children: [
-    omissions.map((o, i) => /* @__PURE__ */ jsx16(VaultRow, { label: o.component.replaceAll("_", " "), children: /* @__PURE__ */ jsx16("span", { className: "block truncate text-muted-foreground", title: omissionText(o), children: omissionText(o) }) }, `${o.component}-${o.source_item_id ?? i}`)),
-    /* @__PURE__ */ jsx16(VaultRow, { label: "Accept", hint: `${verb} without these`, children: /* @__PURE__ */ jsx16(Switch3, { checked: accepted, onCheckedChange: onAccepted, "aria-label": `${verb} without these` }) })
+    omissions.map((o, i) => /* @__PURE__ */ jsx17(VaultRow, { label: o.component.replaceAll("_", " "), children: /* @__PURE__ */ jsx17("span", { className: "block truncate text-muted-foreground", title: omissionText(o), children: omissionText(o) }) }, `${o.component}-${o.source_item_id ?? i}`)),
+    /* @__PURE__ */ jsx17(VaultRow, { label: "Accept", hint: `${verb} without these`, children: /* @__PURE__ */ jsx17(Switch3, { checked: accepted, onCheckedChange: onAccepted, "aria-label": `${verb} without these` }) })
   ] });
 }
 function BackupPanel({ port, items, onClose, onChanged }) {
@@ -3340,20 +3377,20 @@ function BackupPanel({ port, items, onClose, onChanged }) {
   const mismatch = repeat !== "" && repeat !== passphrase;
   const names = new Map(restorePreview?.records.map((r) => [r.source_item_id, r.display_name]) ?? []);
   const footer = mode === "backup" ? /* @__PURE__ */ jsxs16(Fragment10, { children: [
-    /* @__PURE__ */ jsx16(Button13, { variant: "quiet", onClick: onClose, children: "Close" }),
-    backup ? /* @__PURE__ */ jsx16(Button13, { variant: "primary", disabled: busy || !passphrase || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
+    /* @__PURE__ */ jsx17(Button13, { variant: "quiet", onClick: onClose, children: "Close" }),
+    backup ? /* @__PURE__ */ jsx17(Button13, { variant: "primary", disabled: busy || !passphrase || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
       "Review ",
       selected.size
     ] })
   ] }) : /* @__PURE__ */ jsxs16(Fragment10, { children: [
-    /* @__PURE__ */ jsx16(Button13, { variant: "quiet", onClick: onClose, children: result && !retryable ? "Done" : "Close" }),
-    result ? retryable ? /* @__PURE__ */ jsx16(Button13, { variant: "primary", disabled: busy, onClick: () => void restore(), children: "Try again" }) : /* @__PURE__ */ jsx16(Button13, { variant: "outline", disabled: busy, onClick: () => void again(), children: "Restore again" }) : restorePreview ? /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || restorePreview.omissions.length > 0 && !accepted, onClick: () => void restore(), children: [
+    /* @__PURE__ */ jsx17(Button13, { variant: "quiet", onClick: onClose, children: result && !retryable ? "Done" : "Close" }),
+    result ? retryable ? /* @__PURE__ */ jsx17(Button13, { variant: "primary", disabled: busy, onClick: () => void restore(), children: "Try again" }) : /* @__PURE__ */ jsx17(Button13, { variant: "outline", disabled: busy, onClick: () => void again(), children: "Restore again" }) : restorePreview ? /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || restorePreview.omissions.length > 0 && !accepted, onClick: () => void restore(), children: [
       "Restore ",
       restorePreview.record_count
-    ] }) : /* @__PURE__ */ jsx16(Button13, { variant: "primary", disabled: busy || !file || !passphrase, onClick: () => void reviewRestore(), children: "Review" })
+    ] }) : /* @__PURE__ */ jsx17(Button13, { variant: "primary", disabled: busy || !file || !passphrase, onClick: () => void reviewRestore(), children: "Review" })
   ] });
   return /* @__PURE__ */ jsxs16(Panel, { title: "Backup", size: "lg", onClose, footer, children: [
-    /* @__PURE__ */ jsx16(
+    /* @__PURE__ */ jsx17(
       SegmentedControl3,
       {
         value: mode,
@@ -3367,35 +3404,35 @@ function BackupPanel({ port, items, onClose, onChanged }) {
       }
     ),
     mode === "backup" ? /* @__PURE__ */ jsxs16(Fragment10, { children: [
-      /* @__PURE__ */ jsx16(
+      /* @__PURE__ */ jsx17(
         VaultSection,
         {
           title: `${selected.size} of ${plural(items.length, "credential")}`,
           actions: /* @__PURE__ */ jsxs16(Fragment10, { children: [
-            /* @__PURE__ */ jsx16(Button13, { variant: "quiet", disabled: busy || items.length === 0, onClick: () => {
+            /* @__PURE__ */ jsx17(Button13, { variant: "quiet", disabled: busy || items.length === 0, onClick: () => {
               setBackup(null);
               setSelected(new Set(items.map((i) => i.id)));
             }, children: "All" }),
-            /* @__PURE__ */ jsx16(Button13, { variant: "quiet", disabled: busy || selected.size === 0, onClick: () => {
+            /* @__PURE__ */ jsx17(Button13, { variant: "quiet", disabled: busy || selected.size === 0, onClick: () => {
               setBackup(null);
               setSelected(/* @__PURE__ */ new Set());
             }, children: "None" })
           ] }),
-          children: items.length === 0 ? /* @__PURE__ */ jsx16(Empty, { children: "Nothing to back up yet." }) : /* @__PURE__ */ jsx16(Windowed, { items, render: (i) => /* @__PURE__ */ jsx16(PickLine, { title: i.name, detail: i.definitionLabel, checked: selected.has(i.id), disabled: busy, onChange: (on) => pick(i.id, on) }, i.id) })
+          children: items.length === 0 ? /* @__PURE__ */ jsx17(Empty, { children: "Nothing to back up yet." }) : /* @__PURE__ */ jsx17(Windowed, { items, render: (i) => /* @__PURE__ */ jsx17(PickLine, { title: i.name, detail: i.definitionLabel, checked: selected.has(i.id), disabled: busy, onChange: (on) => pick(i.id, on) }, i.id) })
         }
       ),
       backup ? /* @__PURE__ */ jsxs16(Fragment10, { children: [
-        /* @__PURE__ */ jsx16(Summary, { value: backup }),
-        /* @__PURE__ */ jsx16(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
+        /* @__PURE__ */ jsx17(Summary, { value: backup }),
+        /* @__PURE__ */ jsx17(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
         /* @__PURE__ */ jsxs16(VaultSection, { children: [
-          /* @__PURE__ */ jsx16(VaultRow, { label: "Passphrase", hint: "Not saved. It can't be recovered.", children: /* @__PURE__ */ jsx16(Field6, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) }),
-          /* @__PURE__ */ jsx16(VaultRow, { label: "Repeat", ...mismatch ? { hint: "Doesn't match" } : {}, children: /* @__PURE__ */ jsx16(Field6, { type: "password", value: repeat, autoComplete: "new-password", "aria-label": "Repeat the passphrase", onChange: (e) => setRepeat(e.target.value) }) })
+          /* @__PURE__ */ jsx17(VaultRow, { label: "Passphrase", hint: "Not saved. It can't be recovered.", children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) }),
+          /* @__PURE__ */ jsx17(VaultRow, { label: "Repeat", ...mismatch ? { hint: "Doesn't match" } : {}, children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: repeat, autoComplete: "new-password", "aria-label": "Repeat the passphrase", onChange: (e) => setRepeat(e.target.value) }) })
         ] })
       ] }) : null
-    ] }) : /* @__PURE__ */ jsx16(Fragment10, { children: !restorePreview ? /* @__PURE__ */ jsxs16(VaultSection, { children: [
+    ] }) : /* @__PURE__ */ jsx17(Fragment10, { children: !restorePreview ? /* @__PURE__ */ jsxs16(VaultSection, { children: [
       /* @__PURE__ */ jsxs16(VaultRow, { label: "File", ...file ? { hint: file.name } : {}, children: [
-        /* @__PURE__ */ jsx16(Button13, { variant: "outline", disabled: busy, onClick: () => fileInput.current?.click(), children: "Choose a backup" }),
-        /* @__PURE__ */ jsx16(
+        /* @__PURE__ */ jsx17(Button13, { variant: "outline", disabled: busy, onClick: () => fileInput.current?.click(), children: "Choose a backup" }),
+        /* @__PURE__ */ jsx17(
           "input",
           {
             ref: fileInput,
@@ -3409,16 +3446,16 @@ function BackupPanel({ port, items, onClose, onChanged }) {
           }
         )
       ] }),
-      /* @__PURE__ */ jsx16(VaultRow, { label: "Passphrase", children: /* @__PURE__ */ jsx16(Field6, { type: "password", value: passphrase, autoComplete: "current-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) })
+      /* @__PURE__ */ jsx17(VaultRow, { label: "Passphrase", children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: passphrase, autoComplete: "current-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) })
     ] }) : /* @__PURE__ */ jsxs16(Fragment10, { children: [
-      /* @__PURE__ */ jsx16(Summary, { value: restorePreview }),
-      !result ? /* @__PURE__ */ jsx16(Omissions, { omissions: restorePreview.omissions, accepted, onAccepted: setAccepted, verb: "Restore" }) : null,
-      !result ? /* @__PURE__ */ jsx16("p", { className: "px-1 text-xs text-muted-foreground", children: "Restored items start disabled and restricted." }) : /* @__PURE__ */ jsx16(VaultSection, { title: `${result.created} restored \xB7 ${result.replayed} already \xB7 ${result.refused} refused \xB7 ${result.retryable_failure} to retry`, children: result.results.map((r) => /* @__PURE__ */ jsx16(VaultRow, { label: names.get(r.source_item_id) ?? "Credential", children: /* @__PURE__ */ jsxs16("span", { className: r.status === "refused" || r.status === "retryable_failure" ? "text-destructive" : "text-foreground", children: [
+      /* @__PURE__ */ jsx17(Summary, { value: restorePreview }),
+      !result ? /* @__PURE__ */ jsx17(Omissions, { omissions: restorePreview.omissions, accepted, onAccepted: setAccepted, verb: "Restore" }) : null,
+      !result ? /* @__PURE__ */ jsx17("p", { className: "px-1 text-xs text-muted-foreground", children: "Restored items start disabled and restricted." }) : /* @__PURE__ */ jsx17(VaultSection, { title: `${result.created} restored \xB7 ${result.replayed} already \xB7 ${result.refused} refused \xB7 ${result.retryable_failure} to retry`, children: result.results.map((r) => /* @__PURE__ */ jsx17(VaultRow, { label: names.get(r.source_item_id) ?? "Credential", children: /* @__PURE__ */ jsxs16("span", { className: r.status === "refused" || r.status === "retryable_failure" ? "text-destructive" : "text-foreground", children: [
         RECORD_STATUS[r.status],
         r.reason === "alias_conflict" ? " \xB7 name in use" : ""
       ] }) }, r.source_item_id)) })
     ] }) }),
-    /* @__PURE__ */ jsx16(ErrorLine, { message: error })
+    /* @__PURE__ */ jsx17(ErrorLine, { message: error })
   ] });
 }
 
@@ -3427,7 +3464,7 @@ import { useMemo, useState as useState18 } from "react";
 import { Button as Button14, Select as Select5 } from "@ai-matrx/design-system/controls";
 import { downloadFile as downloadFile2 } from "@ai-matrx/kit/download";
 import { confirm as confirm5 } from "@ai-matrx/kit/confirm-opener";
-import { Fragment as Fragment11, jsx as jsx17, jsxs as jsxs17 } from "react/jsx-runtime";
+import { Fragment as Fragment11, jsx as jsx18, jsxs as jsxs17 } from "react/jsx-runtime";
 var FORMATS = [
   { value: "matrx_login_csv_v1", label: "Matrx", hint: "Website logins, all common fields" },
   { value: "firefox_csv_v1", label: "Firefox", hint: "Address, username and password" },
@@ -3508,8 +3545,8 @@ function ExportPanel({ port, items, onClose }) {
       size: "lg",
       onClose,
       footer: /* @__PURE__ */ jsxs17(Fragment11, { children: [
-        /* @__PURE__ */ jsx17(Button14, { variant: "quiet", onClick: onClose, children: "Close" }),
-        preview ? /* @__PURE__ */ jsxs17(Button14, { variant: "primary", icon: /* @__PURE__ */ jsx17(ExportGlyph, { className: "size-4" }), disabled: busy || eligible === 0, onClick: () => void download(), children: [
+        /* @__PURE__ */ jsx18(Button14, { variant: "quiet", onClick: onClose, children: "Close" }),
+        preview ? /* @__PURE__ */ jsxs17(Button14, { variant: "primary", icon: /* @__PURE__ */ jsx18(ExportGlyph, { className: "size-4" }), disabled: busy || eligible === 0, onClick: () => void download(), children: [
           "Download ",
           eligible
         ] }) : /* @__PURE__ */ jsxs17(Button14, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void review(), children: [
@@ -3518,7 +3555,7 @@ function ExportPanel({ port, items, onClose }) {
         ] })
       ] }),
       children: [
-        /* @__PURE__ */ jsx17(VaultSection, { children: /* @__PURE__ */ jsx17(VaultRow, { label: "Format", hint: format?.hint, children: /* @__PURE__ */ jsx17(
+        /* @__PURE__ */ jsx18(VaultSection, { children: /* @__PURE__ */ jsx18(VaultRow, { label: "Format", hint: format?.hint, children: /* @__PURE__ */ jsx18(
           Select5,
           {
             value: profile,
@@ -3530,21 +3567,21 @@ function ExportPanel({ port, items, onClose }) {
             }
           }
         ) }) }),
-        /* @__PURE__ */ jsx17(
+        /* @__PURE__ */ jsx18(
           VaultSection,
           {
             title: `${selected.size} of ${plural(logins.length, "login")}`,
             actions: /* @__PURE__ */ jsxs17(Fragment11, { children: [
-              /* @__PURE__ */ jsx17(Button14, { variant: "quiet", disabled: busy || logins.length === 0, onClick: () => {
+              /* @__PURE__ */ jsx18(Button14, { variant: "quiet", disabled: busy || logins.length === 0, onClick: () => {
                 changed();
                 setSelected(new Set(logins.map((l) => l.id)));
               }, children: "All" }),
-              /* @__PURE__ */ jsx17(Button14, { variant: "quiet", disabled: busy || selected.size === 0, onClick: () => {
+              /* @__PURE__ */ jsx18(Button14, { variant: "quiet", disabled: busy || selected.size === 0, onClick: () => {
                 changed();
                 setSelected(/* @__PURE__ */ new Set());
               }, children: "None" })
             ] }),
-            children: logins.length === 0 ? /* @__PURE__ */ jsx17(Empty, { children: "No website logins to export." }) : /* @__PURE__ */ jsx17(
+            children: logins.length === 0 ? /* @__PURE__ */ jsx18(Empty, { children: "No website logins to export." }) : /* @__PURE__ */ jsx18(
               Windowed,
               {
                 items: logins,
@@ -3552,7 +3589,7 @@ function ExportPanel({ port, items, onClose }) {
                   const p = reasons.get(item.id);
                   const left = p && !p.eligible;
                   const omitted = p ? omissionText2(p.omissions) : "";
-                  return /* @__PURE__ */ jsx17(
+                  return /* @__PURE__ */ jsx18(
                     PickLine,
                     {
                       title: item.name,
@@ -3570,7 +3607,7 @@ function ExportPanel({ port, items, onClose }) {
             )
           }
         ),
-        /* @__PURE__ */ jsx17(ErrorLine, { message: error })
+        /* @__PURE__ */ jsx18(ErrorLine, { message: error })
       ]
     }
   );
@@ -4416,7 +4453,7 @@ async function parseImportFile(source, file, limits, signal) {
 }
 
 // src/io/ImportPanel.tsx
-import { Fragment as Fragment12, jsx as jsx18, jsxs as jsxs18 } from "react/jsx-runtime";
+import { Fragment as Fragment12, jsx as jsx19, jsxs as jsxs18 } from "react/jsx-runtime";
 var ROLE_OPTIONS = [
   { value: "keep", label: "Keep encrypted" },
   { value: "title", label: "Name" },
@@ -4592,25 +4629,25 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
   const stage = done ? "done" : draft ? "review" : "choose";
   const busy = running !== null || reading;
   const footer = stage === "choose" ? /* @__PURE__ */ jsxs18(Fragment12, { children: [
-    /* @__PURE__ */ jsx18(Button15, { variant: "quiet", onClick: onClose, children: "Close" }),
-    source === "env" ? /* @__PURE__ */ jsx18(Button15, { variant: "primary", icon: /* @__PURE__ */ jsx18(ImportGlyph, { className: "size-4" }), disabled: !envText.trim(), onClick: () => reviewEnv(envText), children: "Review" }) : null
+    /* @__PURE__ */ jsx19(Button15, { variant: "quiet", onClick: onClose, children: "Close" }),
+    source === "env" ? /* @__PURE__ */ jsx19(Button15, { variant: "primary", icon: /* @__PURE__ */ jsx19(ImportGlyph, { className: "size-4" }), disabled: !envText.trim(), onClick: () => reviewEnv(envText), children: "Review" }) : null
   ] }) : stage === "review" ? /* @__PURE__ */ jsxs18(Fragment12, { children: [
-    running ? /* @__PURE__ */ jsx18(Button15, { variant: "outline", onClick: () => stop.current = true, children: "Stop" }) : /* @__PURE__ */ jsx18(Button15, { variant: "quiet", onClick: reset, children: "Back" }),
-    /* @__PURE__ */ jsx18(Button15, { variant: "primary", icon: /* @__PURE__ */ jsx18(ImportGlyph, { className: "size-4" }), disabled: busy || chosen === 0 || ambiguous === true || needsApproval, onClick: start, children: running ? `Importing ${running.done} of ${running.total}` : `Import ${chosen}` })
+    running ? /* @__PURE__ */ jsx19(Button15, { variant: "outline", onClick: () => stop.current = true, children: "Stop" }) : /* @__PURE__ */ jsx19(Button15, { variant: "quiet", onClick: reset, children: "Back" }),
+    /* @__PURE__ */ jsx19(Button15, { variant: "primary", icon: /* @__PURE__ */ jsx19(ImportGlyph, { className: "size-4" }), disabled: busy || chosen === 0 || ambiguous === true || needsApproval, onClick: start, children: running ? `Importing ${running.done} of ${running.total}` : `Import ${chosen}` })
   ] }) : /* @__PURE__ */ jsxs18(Fragment12, { children: [
-    done && done.failed.length + done.untried.length > 0 ? /* @__PURE__ */ jsx18(Button15, { variant: "outline", disabled: busy, onClick: retry, children: running ? `Importing ${running.done} of ${running.total}` : `Try ${done.failed.length + done.untried.length} again` }) : null,
-    /* @__PURE__ */ jsx18(Button15, { variant: "primary", onClick: onClose, children: "Done" })
+    done && done.failed.length + done.untried.length > 0 ? /* @__PURE__ */ jsx19(Button15, { variant: "outline", disabled: busy, onClick: retry, children: running ? `Importing ${running.done} of ${running.total}` : `Try ${done.failed.length + done.untried.length} again` }) : null,
+    /* @__PURE__ */ jsx19(Button15, { variant: "primary", onClick: onClose, children: "Done" })
   ] });
   return /* @__PURE__ */ jsxs18(Panel, { title: "Import", size: "xl", onClose, footer, children: [
     stage === "choose" ? /* @__PURE__ */ jsxs18(VaultSection, { children: [
-      /* @__PURE__ */ jsx18(VaultRow, { label: "Source", actions: help && host.openUrl ? /* @__PURE__ */ jsx18(Button15, { variant: "quiet", onClick: () => host.openUrl?.(help), children: "How to export" }) : void 0, children: /* @__PURE__ */ jsx18(Select6, { value: source, options: SOURCE_OPTIONS, "aria-label": "Source", onValueChange: (s) => {
+      /* @__PURE__ */ jsx19(VaultRow, { label: "Source", actions: help && host.openUrl ? /* @__PURE__ */ jsx19(Button15, { variant: "quiet", onClick: () => host.openUrl?.(help), children: "How to export" }) : void 0, children: /* @__PURE__ */ jsx19(Select6, { value: source, options: SOURCE_OPTIONS, "aria-label": "Source", onValueChange: (s) => {
         setSource(s);
         setError(null);
       } }) }),
-      source === "env" ? /* @__PURE__ */ jsx18(VaultRow, { label: ".env text", hint: "Same key updates in place", top: true, children: /* @__PURE__ */ jsx18(Textarea2, { mono: true, rows: 7, value: envText, autoComplete: "off", spellCheck: false, "aria-label": ".env text", placeholder: "OPENAI_API_KEY=sk-...\nDATABASE_URL=postgres://...", onChange: (e) => setEnvText(e.target.value) }) }) : null,
+      source === "env" ? /* @__PURE__ */ jsx19(VaultRow, { label: ".env text", hint: "Same key updates in place", top: true, children: /* @__PURE__ */ jsx19(Textarea2, { mono: true, rows: 7, value: envText, autoComplete: "off", spellCheck: false, "aria-label": ".env text", placeholder: "OPENAI_API_KEY=sk-...\nDATABASE_URL=postgres://...", onChange: (e) => setEnvText(e.target.value) }) }) : null,
       /* @__PURE__ */ jsxs18(VaultRow, { label: "File", hint: fileName ?? void 0, children: [
-        /* @__PURE__ */ jsx18(Button15, { variant: "outline", disabled: reading, onClick: () => fileInput.current?.click(), children: reading ? "Reading\u2026" : source === "env" ? "Load a file" : "Choose a file" }),
-        /* @__PURE__ */ jsx18(
+        /* @__PURE__ */ jsx19(Button15, { variant: "outline", disabled: reading, onClick: () => fileInput.current?.click(), children: reading ? "Reading\u2026" : source === "env" ? "Load a file" : "Choose a file" }),
+        /* @__PURE__ */ jsx19(
           "input",
           {
             ref: fileInput,
@@ -4625,44 +4662,44 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
           }
         )
       ] }),
-      source === "env" ? /* @__PURE__ */ jsx18(VaultRow, { label: "Sandboxes", hint: "Pass these values to agent sandboxes", children: /* @__PURE__ */ jsx18(Switch4, { checked: injectSandbox, onCheckedChange: setInjectSandbox, "aria-label": "Use in sandboxes" }) }) : null
+      source === "env" ? /* @__PURE__ */ jsx19(VaultRow, { label: "Sandboxes", hint: "Pass these values to agent sandboxes", children: /* @__PURE__ */ jsx19(Switch4, { checked: injectSandbox, onCheckedChange: setInjectSandbox, "aria-label": "Use in sandboxes" }) }) : null
     ] }) : null,
     stage === "review" && draft ? /* @__PURE__ */ jsxs18(Fragment12, { children: [
-      organizations.length > 0 ? /* @__PURE__ */ jsx18(VaultSection, { children: /* @__PURE__ */ jsx18(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx18(Select6, { value: destination, options: destinationOptions, "aria-label": "Save to", onValueChange: (v) => draft.kind === "file" ? restart({ destination: v }) : setDestination(v) }) }) }) : null,
-      /* @__PURE__ */ jsx18(
+      organizations.length > 0 ? /* @__PURE__ */ jsx19(VaultSection, { children: /* @__PURE__ */ jsx19(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx19(Select6, { value: destination, options: destinationOptions, "aria-label": "Save to", onValueChange: (v) => draft.kind === "file" ? restart({ destination: v }) : setDestination(v) }) }) }) : null,
+      /* @__PURE__ */ jsx19(
         VaultSection,
         {
           title: draft.kind === "env" ? plural(envKeys.length, "value") : summary(counts, lines.length),
           actions: /* @__PURE__ */ jsxs18(Fragment12, { children: [
-            /* @__PURE__ */ jsx18(Button15, { variant: "quiet", disabled: busy, onClick: () => setSelected(draft.kind === "env" ? new Set(envKeys.map((e) => e.key + e.text)) : defaultSelection(lines)), children: "Reset" }),
-            /* @__PURE__ */ jsx18(Button15, { variant: "quiet", disabled: busy, onClick: () => setSelected(/* @__PURE__ */ new Set()), children: "None" })
+            /* @__PURE__ */ jsx19(Button15, { variant: "quiet", disabled: busy, onClick: () => setSelected(draft.kind === "env" ? new Set(envKeys.map((e) => e.key + e.text)) : defaultSelection(lines)), children: "Reset" }),
+            /* @__PURE__ */ jsx19(Button15, { variant: "quiet", disabled: busy, onClick: () => setSelected(/* @__PURE__ */ new Set()), children: "None" })
           ] }),
-          children: draft.kind === "env" ? /* @__PURE__ */ jsx18(
+          children: draft.kind === "env" ? /* @__PURE__ */ jsx19(
             Windowed,
             {
               items: envKeys,
               render: (e) => {
                 const id = e.key + e.text;
-                return /* @__PURE__ */ jsx18(PickLine, { title: e.key, detail: "Value hidden", checked: selected.has(id), disabled: busy, onChange: (on) => toggle(setSelected, id, on) }, id);
+                return /* @__PURE__ */ jsx19(PickLine, { title: e.key, detail: "Value hidden", checked: selected.has(id), disabled: busy, onChange: (on) => toggle(setSelected, id, on) }, id);
               }
             }
-          ) : lines.length === 0 ? /* @__PURE__ */ jsx18(Empty, { children: "Nothing to import in this file." }) : /* @__PURE__ */ jsx18(
+          ) : lines.length === 0 ? /* @__PURE__ */ jsx19(Empty, { children: "Nothing to import in this file." }) : /* @__PURE__ */ jsx19(
             Windowed,
             {
               items: lines,
               render: (l) => {
                 const badge = STATE_BADGE[l.state];
-                return /* @__PURE__ */ jsx18(PickLine, { title: l.title, detail: l.reason ?? l.detail, checked: selected.has(l.key), disabled: busy || !selectable(l), badge: badge?.text, tone: badge?.tone, onChange: (on) => toggle(setSelected, l.key, on) }, l.key);
+                return /* @__PURE__ */ jsx19(PickLine, { title: l.title, detail: l.reason ?? l.detail, checked: selected.has(l.key), disabled: busy || !selectable(l), badge: badge?.text, tone: badge?.tone, onChange: (on) => toggle(setSelected, l.key, on) }, l.key);
               }
             }
           )
         }
       ),
-      draft.kind === "file" && draft.parsed.kind === "structured" ? /* @__PURE__ */ jsx18(VaultSection, { children: /* @__PURE__ */ jsx18(VaultRow, { label: "Visible details", hint: "Approve saving websites and public keys in the clear", children: /* @__PURE__ */ jsx18(Switch4, { checked: approvedVisible, disabled: busy, onCheckedChange: setApprovedVisible, "aria-label": "Approve visible details" }) }) }) : null,
-      draft.kind === "file" ? /* @__PURE__ */ jsx18(Notices, { draft }) : null,
-      draft.kind === "file" ? /* @__PURE__ */ jsx18(More, { children: /* @__PURE__ */ jsxs18(VaultSection, { children: [
-        /* @__PURE__ */ jsx18(VaultRow, { label: "Browser fill", hint: "Needs username, password and an https address", children: /* @__PURE__ */ jsx18(Switch4, { checked: browserFill, disabled: busy, onCheckedChange: (on) => restart({ browserFill: on }), "aria-label": "Browser fill" }) }),
-        draft.parsed.kind === "csv" ? draft.parsed.preview.headers.map((header, index) => /* @__PURE__ */ jsx18(VaultRow, { label: header || `Column ${index + 1}`, children: /* @__PURE__ */ jsx18(
+      draft.kind === "file" && draft.parsed.kind === "structured" ? /* @__PURE__ */ jsx19(VaultSection, { children: /* @__PURE__ */ jsx19(VaultRow, { label: "Visible details", hint: "Approve saving websites and public keys in the clear", children: /* @__PURE__ */ jsx19(Switch4, { checked: approvedVisible, disabled: busy, onCheckedChange: setApprovedVisible, "aria-label": "Approve visible details" }) }) }) : null,
+      draft.kind === "file" ? /* @__PURE__ */ jsx19(Notices, { draft }) : null,
+      draft.kind === "file" ? /* @__PURE__ */ jsx19(More, { children: /* @__PURE__ */ jsxs18(VaultSection, { children: [
+        /* @__PURE__ */ jsx19(VaultRow, { label: "Browser fill", hint: "Needs username, password and an https address", children: /* @__PURE__ */ jsx19(Switch4, { checked: browserFill, disabled: busy, onCheckedChange: (on) => restart({ browserFill: on }), "aria-label": "Browser fill" }) }),
+        draft.parsed.kind === "csv" ? draft.parsed.preview.headers.map((header, index) => /* @__PURE__ */ jsx19(VaultRow, { label: header || `Column ${index + 1}`, children: /* @__PURE__ */ jsx19(
           Select6,
           {
             value: draft.mapping[index] ?? "keep",
@@ -4672,20 +4709,20 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
           }
         ) }, `${header}-${index}`)) : null
       ] }) }) : null,
-      ambiguous ? /* @__PURE__ */ jsx18(ErrorLine, { message: "Each of name, username, password, notes and one-time password can be used by one column." }) : null
+      ambiguous ? /* @__PURE__ */ jsx19(ErrorLine, { message: "Each of name, username, password, notes and one-time password can be used by one column." }) : null
     ] }) : null,
     stage === "done" && done ? /* @__PURE__ */ jsxs18(VaultSection, { title: "Result", children: [
-      /* @__PURE__ */ jsx18(VaultRow, { label: "Created", children: /* @__PURE__ */ jsx18("span", { className: "text-foreground", children: done.created.length }) }),
-      /* @__PURE__ */ jsx18(VaultRow, { label: "Skipped", children: /* @__PURE__ */ jsx18("span", { className: "text-foreground", children: done.skipped }) }),
-      /* @__PURE__ */ jsx18(VaultRow, { label: "Failed", children: /* @__PURE__ */ jsx18("span", { className: done.failed.length > 0 ? "text-destructive" : "text-foreground", children: done.failed.length }) }),
-      done.untried.length > 0 ? /* @__PURE__ */ jsx18(VaultRow, { label: "Not tried", children: /* @__PURE__ */ jsx18("span", { className: "text-foreground", children: done.untried.length }) }) : null,
-      done.withOtp > 0 ? /* @__PURE__ */ jsx18(VaultRow, { label: "Codes", children: /* @__PURE__ */ jsxs18("span", { className: "text-muted-foreground", children: [
+      /* @__PURE__ */ jsx19(VaultRow, { label: "Created", children: /* @__PURE__ */ jsx19("span", { className: "text-foreground", children: done.created.length }) }),
+      /* @__PURE__ */ jsx19(VaultRow, { label: "Skipped", children: /* @__PURE__ */ jsx19("span", { className: "text-foreground", children: done.skipped }) }),
+      /* @__PURE__ */ jsx19(VaultRow, { label: "Failed", children: /* @__PURE__ */ jsx19("span", { className: done.failed.length > 0 ? "text-destructive" : "text-foreground", children: done.failed.length }) }),
+      done.untried.length > 0 ? /* @__PURE__ */ jsx19(VaultRow, { label: "Not tried", children: /* @__PURE__ */ jsx19("span", { className: "text-foreground", children: done.untried.length }) }) : null,
+      done.withOtp > 0 ? /* @__PURE__ */ jsx19(VaultRow, { label: "Codes", children: /* @__PURE__ */ jsxs18("span", { className: "text-muted-foreground", children: [
         plural(done.withOtp, "login"),
         " still need the one-time password added."
       ] }) }) : null,
-      done.failed.map((f) => /* @__PURE__ */ jsx18(VaultRow, { label: f.title, children: /* @__PURE__ */ jsx18("span", { className: "block truncate text-destructive", title: f.reason, children: f.reason }) }, f.key))
+      done.failed.map((f) => /* @__PURE__ */ jsx19(VaultRow, { label: f.title, children: /* @__PURE__ */ jsx19("span", { className: "block truncate text-destructive", title: f.reason, children: f.reason }) }, f.key))
     ] }) : null,
-    /* @__PURE__ */ jsx18(ErrorLine, { message: error })
+    /* @__PURE__ */ jsx19(ErrorLine, { message: error })
   ] });
 }
 function toggle(set, key, on) {
@@ -4712,35 +4749,22 @@ function Notices({ draft }) {
     }
   }
   if (notes.length === 0) return null;
-  return /* @__PURE__ */ jsx18("div", { className: "flex flex-col gap-0.5 px-1 text-xs text-muted-foreground", children: notes.map((n) => /* @__PURE__ */ jsx18("span", { children: n }, n)) });
+  return /* @__PURE__ */ jsx19("div", { className: "flex flex-col gap-0.5 px-1 text-xs text-muted-foreground", children: notes.map((n) => /* @__PURE__ */ jsx19("span", { children: n }, n)) });
 }
 
 // src/ItemList.tsx
-import { useEffect as useEffect17, useRef as useRef15, useState as useState27 } from "react";
-import { DropdownMenu as DropdownMenu4, DropdownMenuContent as DropdownMenuContent4, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuTrigger as DropdownMenuTrigger4 } from "@ai-matrx/design-system";
+import { useEffect as useEffect17, useRef as useRef15, useState as useState28 } from "react";
+import { DropdownMenu as DropdownMenu4, DropdownMenuContent as DropdownMenuContent4, DropdownMenuItem as DropdownMenuItem4, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator as DropdownMenuSeparator4, DropdownMenuTrigger as DropdownMenuTrigger4 } from "@ai-matrx/design-system";
 import { cn as cn13 } from "@ai-matrx/design-system";
-import { Button as Button22, SearchField } from "@ai-matrx/design-system/controls";
-
-// src/ItemIcon.tsx
-import { cn as cn8 } from "@ai-matrx/design-system";
-import { jsx as jsx19 } from "react/jsx-runtime";
-function ItemIcon({ definitionKey, family, site, size = "md", inverted = false }) {
-  const box = size === "lg" ? "size-10 rounded-xl text-base" : size === "md" ? "size-8 rounded-lg text-sm" : "size-6 rounded-md text-xs";
-  const tone = inverted ? "bg-primary-foreground text-primary" : "bg-muted text-foreground";
-  const initial = siteDomainOf(site).charAt(0).toUpperCase();
-  if (initial && /[A-Z0-9]/.test(initial)) {
-    return /* @__PURE__ */ jsx19("span", { "aria-hidden": true, className: cn8("flex shrink-0 items-center justify-center font-semibold", box, tone), children: initial });
-  }
-  const Glyph = definitionGlyph(definitionKey, family);
-  return /* @__PURE__ */ jsx19("span", { "aria-hidden": true, className: cn8("flex shrink-0 items-center justify-center", box, tone), children: /* @__PURE__ */ jsx19(Glyph, { className: size === "lg" ? "size-5" : "size-4" }) });
-}
+import { Button as Button23, SearchField } from "@ai-matrx/design-system/controls";
+import { CopyIcon as CopyIcon7 } from "@ai-matrx/design-system/icons";
 
 // src/ItemPane.tsx
-import { useEffect as useEffect16, useMemo as useMemo3, useRef as useRef14, useState as useState26 } from "react";
+import { useEffect as useEffect16, useMemo as useMemo3, useRef as useRef14, useState as useState27 } from "react";
 import { DropdownMenu as DropdownMenu3, DropdownMenuContent as DropdownMenuContent3, DropdownMenuItem as DropdownMenuItem3, DropdownMenuSeparator as DropdownMenuSeparator3, DropdownMenuTrigger as DropdownMenuTrigger3 } from "@ai-matrx/design-system";
 import { cn as cn12 } from "@ai-matrx/design-system";
-import { Badge as Badge7, Button as Button21, CONTROLS_CONTAINER_CLASS, OptionCombobox, Switch as Switch5 } from "@ai-matrx/design-system/controls";
-import { confirm as confirm9 } from "@ai-matrx/kit/confirm-opener";
+import { Badge as Badge7, Button as Button22, CONTROLS_CONTAINER_CLASS, OptionCombobox, Switch as Switch6 } from "@ai-matrx/design-system/controls";
+import { confirm as confirm10 } from "@ai-matrx/kit/confirm-opener";
 
 // src/activity/FilesSection.tsx
 import { formatFileSize as formatFileSize2 } from "@ai-matrx/kit/format";
@@ -4761,12 +4785,13 @@ var PROTECTION = [
 function FilesSection({ item, port, editing, onChanged }) {
   const confirmed = useConfirmed();
   const canEdit = editing && item.capabilities.canEdit;
+  const canAdd = item.capabilities.canEdit;
   const [busy, setBusy] = useState20(null);
   const [error, setError] = useState20(null);
   const [pending, setPending] = useState20(null);
   const [dragging, setDragging] = useState20(false);
   const picker = useRef13(null);
-  if (!canEdit && item.attachments.length === 0) return null;
+  if (!canAdd && item.attachments.length === 0) return null;
   async function run(key, work, fallback) {
     setBusy(key);
     setError(null);
@@ -4788,7 +4813,7 @@ function FilesSection({ item, port, editing, onChanged }) {
     setPending(file);
   }
   function drop(e) {
-    if (!canEdit) return;
+    if (!canAdd) return;
     e.preventDefault();
     setDragging(false);
     choose(e.dataTransfer.files[0]);
@@ -4801,22 +4826,23 @@ function FilesSection({ item, port, editing, onChanged }) {
     "div",
     {
       className: cn9("rounded-xl", dragging && "outline outline-2 outline-primary"),
-      onDragOver: canEdit ? (e) => {
+      onDragOver: canAdd ? (e) => {
         e.preventDefault();
         setDragging(true);
       } : void 0,
-      onDragLeave: canEdit ? () => setDragging(false) : void 0,
-      onDrop: canEdit ? drop : void 0,
+      onDragLeave: canAdd ? () => setDragging(false) : void 0,
+      onDrop: canAdd ? drop : void 0,
       children: /* @__PURE__ */ jsxs19(
         VaultSection,
         {
-          title: "Files",
-          actions: canEdit ? /* @__PURE__ */ jsx20(Button16, { variant: "quiet", icon: /* @__PURE__ */ jsx20(PlusGlyph, {}), disabled: busy !== null, onClick: () => picker.current?.click(), children: "Add file" }) : void 0,
+          title: editing || item.attachments.length > 0 || pending ? "Files" : void 0,
+          actions: canAdd && (editing || item.attachments.length > 0) ? /* @__PURE__ */ jsx20(Button16, { variant: "quiet", icon: /* @__PURE__ */ jsx20(PlusGlyph, {}), disabled: busy !== null, onClick: () => picker.current?.click(), children: "Add file" }) : void 0,
           children: [
-            canEdit ? /* @__PURE__ */ jsx20("input", { ref: picker, type: "file", hidden: true, onChange: (e) => {
+            canAdd ? /* @__PURE__ */ jsx20("input", { ref: picker, type: "file", hidden: true, "aria-label": "Choose a file", onChange: (e) => {
               choose(e.target.files?.[0]);
               e.target.value = "";
             } }) : null,
+            !editing && canAdd && item.attachments.length === 0 && !pending ? /* @__PURE__ */ jsx20(AddRow, { label: "Files", onAdd: () => picker.current?.click(), children: "Add file" }) : null,
             item.attachments.map(
               (a) => canEdit ? /* @__PURE__ */ jsx20(EditableFile, { port, item, file: a, busy, run, onDownload: () => void download(a), onTooBig: () => setError(TOO_BIG) }, a.id) : /* @__PURE__ */ jsx20(
                 VaultRow,
@@ -4829,7 +4855,7 @@ function FilesSection({ item, port, editing, onChanged }) {
                 a.id
               )
             ),
-            canEdit && pending ? /* @__PURE__ */ jsx20(NewFile, { file: pending, busy: busy === "add", onCancel: () => setPending(null), onAdd: async (details) => {
+            canAdd && pending ? /* @__PURE__ */ jsx20(NewFile, { file: pending, busy: busy === "add", onCancel: () => setPending(null), onAdd: async (details) => {
               if (await run("add", () => port.activity.addFile(item, pending, details), "The file could not be added.")) setPending(null);
             } }) : null,
             canEdit && item.attachments.length === 0 && !pending ? /* @__PURE__ */ jsx20("div", { className: "px-4 py-3 text-sm text-muted-foreground", children: "Drop a file here or choose Add file" }) : null,
@@ -4950,6 +4976,57 @@ function confirmSeal(label) {
     variant: "destructive"
   });
 }
+function DraftFilesSection({ files, onFiles }) {
+  const [pending, setPending] = useState20(null);
+  const [error, setError] = useState20(null);
+  const [dragging, setDragging] = useState20(false);
+  const picker = useRef13(null);
+  const choose = (file) => {
+    if (!file) return;
+    if (fileTooBig(file.size)) return setError(TOO_BIG);
+    setError(null);
+    setPending(file);
+  };
+  return /* @__PURE__ */ jsx20(
+    "div",
+    {
+      className: cn9("rounded-xl", dragging && "outline outline-2 outline-primary"),
+      onDragOver: (e) => {
+        e.preventDefault();
+        setDragging(true);
+      },
+      onDragLeave: () => setDragging(false),
+      onDrop: (e) => {
+        e.preventDefault();
+        setDragging(false);
+        choose(e.dataTransfer.files[0]);
+      },
+      children: /* @__PURE__ */ jsxs19(VaultSection, { title: files.length > 0 || pending ? "Files" : void 0, actions: files.length > 0 ? /* @__PURE__ */ jsx20(Button16, { variant: "quiet", icon: /* @__PURE__ */ jsx20(PlusGlyph, {}), onClick: () => picker.current?.click(), children: "Add file" }) : void 0, children: [
+        /* @__PURE__ */ jsx20("input", { ref: picker, type: "file", hidden: true, "aria-label": "Choose a file", onChange: (e) => {
+          choose(e.target.files?.[0]);
+          e.target.value = "";
+        } }),
+        files.map((f, i) => /* @__PURE__ */ jsx20(VaultRow, { label: f.label, hint: f.description ?? void 0, actions: /* @__PURE__ */ jsx20(Button16, { variant: "quiet", removes: true, icon: /* @__PURE__ */ jsx20(XGlyph, {}), "aria-label": `Remove ${f.label}`, onClick: () => onFiles(files.filter((_, j) => j !== i)) }), children: /* @__PURE__ */ jsxs19("span", { className: "flex min-w-0 items-center gap-2", children: [
+          /* @__PURE__ */ jsx20("span", { className: "truncate", children: f.file.name }),
+          /* @__PURE__ */ jsx20("span", { className: "shrink-0 text-xs text-muted-foreground", children: formatFileSize2(f.file.size) })
+        ] }) }, `${f.file.name}-${i}`)),
+        pending ? /* @__PURE__ */ jsx20(
+          NewFile,
+          {
+            file: pending,
+            busy: false,
+            onCancel: () => setPending(null),
+            onAdd: async (d) => {
+              onFiles([...files, { file: pending, ...d }]);
+              setPending(null);
+            }
+          }
+        ) : files.length === 0 ? /* @__PURE__ */ jsx20(AddRow, { label: "Files", onAdd: () => picker.current?.click(), children: "Add file" }) : null,
+        error ? /* @__PURE__ */ jsx20("p", { role: "alert", className: "px-4 py-2 text-sm text-destructive", children: error }) : null
+      ] })
+    }
+  );
+}
 
 // src/fields/RecoveryCodesRow.tsx
 import { useState as useState21 } from "react";
@@ -5057,6 +5134,134 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
   );
 }
 
+// src/fields/DraftRows.tsx
+import { useState as useState22 } from "react";
+import { Button as Button18, Field as Field8, SegmentedControl as SegmentedControl5, Select as Select7, Switch as Switch5 } from "@ai-matrx/design-system/controls";
+import { RecordId } from "@ai-matrx/design-system";
+import { confirm as confirm7 } from "@ai-matrx/kit/confirm-opener";
+import { Fragment as Fragment15, jsx as jsx22, jsxs as jsxs21 } from "react/jsx-runtime";
+var HANDLINGS = ["visible", "revealable", "sealed"];
+var hint = (text, tone = "muted") => /* @__PURE__ */ jsx22("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
+var hasSecretSettings = (s) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== "revealable");
+function SecretBuilderRow({ field, onChange, onRemove }) {
+  const [open, setOpen] = useState22(hasSecretSettings(field));
+  const env = field.envKey ?? "";
+  const envProblem = envKeyProblem(env);
+  const envOk = env.trim() !== "" && !envProblem;
+  const handling = field.handling ?? "revealable";
+  const name = field.label.trim() || "Secret";
+  const chooseHandling = async (next) => {
+    if (next === handling) return;
+    if (next === "sealed") {
+      const ok = await confirm7({
+        title: `Seal ${name} permanently?`,
+        description: "Once saved, no person can see or copy it again; only automation can use it.",
+        confirmLabel: "Seal",
+        variant: "destructive"
+      });
+      if (!ok) return;
+    }
+    onChange({ handling: next });
+  };
+  return /* @__PURE__ */ jsxs21(Fragment15, { children: [
+    /* @__PURE__ */ jsx22(
+      CustomEditRow,
+      {
+        label: field.label,
+        value: field.value,
+        secret: true,
+        onLabel: (v) => onChange({ label: v }),
+        onValue: (v) => onChange({ value: v }),
+        onRemove,
+        onPasteValue: (text) => {
+          const a = parseEnvAssignment(text);
+          if (!a) return false;
+          onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
+          setOpen(true);
+          return true;
+        },
+        extra: /* @__PURE__ */ jsxs21(Fragment15, { children: [
+          handling !== "sealed" ? /* @__PURE__ */ jsx22(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
+          /* @__PURE__ */ jsx22(Button18, { variant: "quiet", icon: /* @__PURE__ */ jsx22(SlidersGlyph, {}), "aria-label": `${name} settings`, pressed: open, onClick: () => setOpen((o) => !o) })
+        ] })
+      }
+    ),
+    open ? /* @__PURE__ */ jsxs21(Fragment15, { children: [
+      /* @__PURE__ */ jsx22(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ jsx22(
+        Field8,
+        {
+          className: "w-full font-mono",
+          "aria-label": `${name} env key`,
+          "aria-invalid": Boolean(envProblem),
+          placeholder: "e.g. GITHUB_TOKEN",
+          autoComplete: "off",
+          spellCheck: false,
+          value: env,
+          onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
+        }
+      ) }),
+      /* @__PURE__ */ jsx22(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ jsx22(
+        SegmentedControl5,
+        {
+          "aria-label": `Who can see ${name}`,
+          value: handling,
+          onValueChange: (v) => void chooseHandling(v),
+          data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
+        }
+      ) }),
+      /* @__PURE__ */ jsx22(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ jsx22(Switch5, { "aria-label": `Use ${name} in sandbox`, checked: envOk && field.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
+    ] }) : null
+  ] });
+}
+function withMfaMethod(custom, v) {
+  const rest = custom.filter((c) => c.key !== MFA_METHOD_KEY);
+  return v === "sms" || v === "push_or_other" ? [...rest, { key: MFA_METHOD_KEY, label: "Two-factor method", value: v }] : rest;
+}
+function DraftTwoFactorRow({ custom, onCustom }) {
+  const value = custom.find((c) => c.key === MFA_METHOD_KEY)?.value || "none";
+  return /* @__PURE__ */ jsx22(VaultRow, { label: "Two-factor", children: /* @__PURE__ */ jsx22(
+    Select7,
+    {
+      value: value === "sms" || value === "push_or_other" ? value : "none",
+      "aria-label": "Two-factor method",
+      options: MFA_OPTIONS.map((o) => ({ value: o.value, label: o.label })),
+      onValueChange: (v) => onCustom(withMfaMethod(custom, v))
+    }
+  ) });
+}
+var defaultBrowserSettings = (hasWebsite) => ({ uriMatchMode: "host", browserFillEnabled: hasWebsite });
+function DraftBrowserRows({ value, hasWebsite, onChange }) {
+  return /* @__PURE__ */ jsxs21(Fragment15, { children: [
+    /* @__PURE__ */ jsx22(VaultRow, { label: "Website matching", hint: hint(MATCH_WORDS[value.uriMatchMode].hint), children: /* @__PURE__ */ jsx22(
+      Select7,
+      {
+        "aria-label": "Website matching",
+        value: value.uriMatchMode,
+        options: MATCH_MODES.map((m) => ({ value: m, label: MATCH_WORDS[m].label })),
+        onValueChange: (m) => onChange({ ...value, uriMatchMode: m })
+      }
+    ) }),
+    /* @__PURE__ */ jsx22(VaultRow, { label: "Fill in browser", hint: hint(hasWebsite ? value.browserFillEnabled ? "Offered on matching pages" : "Never filled automatically" : "Add a website first"), children: /* @__PURE__ */ jsx22(Switch5, { "aria-label": "Fill in browser", checked: hasWebsite && value.browserFillEnabled, disabled: !hasWebsite, onCheckedChange: (v) => onChange({ ...value, browserFillEnabled: v }) }) })
+  ] });
+}
+function AssignResult({ sent, onAnother, onDone }) {
+  return /* @__PURE__ */ jsxs21("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", role: "status", children: [
+    /* @__PURE__ */ jsxs21(VaultSection, { title: /* @__PURE__ */ jsxs21("span", { className: "flex items-center gap-1.5", children: [
+      /* @__PURE__ */ jsx22(CheckGlyph, { className: "size-4 text-success" }),
+      "Sent to ",
+      sent.recipientEmail
+    ] }), children: [
+      /* @__PURE__ */ jsx22(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx22("span", { className: "block truncate", children: sent.name }) }),
+      /* @__PURE__ */ jsx22(VaultRow, { label: "Item ID", children: /* @__PURE__ */ jsx22(RecordId, { value: sent.id, label: "Item" }) }),
+      /* @__PURE__ */ jsx22(VaultRow, { label: "Password", children: /* @__PURE__ */ jsx22("span", { className: "block truncate text-muted-foreground", children: sent.generated ? "Generated privately, never shown to you" : "Theirs now; you keep no access" }) })
+    ] }),
+    /* @__PURE__ */ jsxs21("div", { className: "flex justify-end gap-2", children: [
+      /* @__PURE__ */ jsx22(Button18, { variant: "outline", icon: /* @__PURE__ */ jsx22(PlusGlyph, {}), onClick: onAnother, children: "Create another" }),
+      /* @__PURE__ */ jsx22(Button18, { variant: "primary", onClick: onDone, children: "Done" })
+    ] })
+  ] });
+}
+
 // src/ItemPane.tsx
 import { HistoryIcon, SettingsIcon, UsersIcon as UsersIcon2 } from "@ai-matrx/design-system/icons";
 import { dropKeptDraft, keepDraft, readKeptDraft } from "@ai-matrx/kit/drafts";
@@ -5183,15 +5388,15 @@ function targetLabel(t) {
 }
 
 // src/extension/UseOnSiteButton.tsx
-import { useState as useState22 } from "react";
-import { Button as Button18 } from "@ai-matrx/design-system/controls";
-import { jsx as jsx22 } from "react/jsx-runtime";
+import { useState as useState23 } from "react";
+import { Button as Button19 } from "@ai-matrx/design-system/controls";
+import { jsx as jsx23 } from "react/jsx-runtime";
 function canUseOnSite(item, pageUrl) {
   return item.capabilities.canEdit && isFillablePage(pageUrl) && !coversPage(item.loginUrls, item.uriMatchMode, pageUrl);
 }
 function UseOnSiteButton({ port, item, pageUrl, onChanged }) {
   const notify = useNotify();
-  const [busy, setBusy] = useState22(false);
+  const [busy, setBusy] = useState23(false);
   if (!canUseOnSite(item, pageUrl)) return null;
   const site = pageSite(pageUrl);
   const run = async () => {
@@ -5206,13 +5411,13 @@ function UseOnSiteButton({ port, item, pageUrl, onChanged }) {
       setBusy(false);
     }
   };
-  return /* @__PURE__ */ jsx22(Button18, { variant: "outline", icon: /* @__PURE__ */ jsx22(PlusGlyph, {}), disabled: busy, onClick: () => void run(), title: `Fill this login on ${site}`, children: "Use here" });
+  return /* @__PURE__ */ jsx23(Button19, { variant: "outline", icon: /* @__PURE__ */ jsx23(PlusGlyph, {}), disabled: busy, onClick: () => void run(), title: `Fill this login on ${site}`, children: "Use here" });
 }
 
 // src/sharing/SharePanel.tsx
-import { useEffect as useEffect15, useState as useState25 } from "react";
-import { confirm as confirm8 } from "@ai-matrx/kit/confirm-opener";
-import { Button as Button20, DisclosureHeader as DisclosureHeader3, Field as Field9, RegionSkeleton, Select as Select8 } from "@ai-matrx/design-system/controls";
+import { useEffect as useEffect15, useState as useState26 } from "react";
+import { confirm as confirm9 } from "@ai-matrx/kit/confirm-opener";
+import { Button as Button21, DisclosureHeader as DisclosureHeader3, Field as Field10, RegionSkeleton, Select as Select9 } from "@ai-matrx/design-system/controls";
 import { cn as cn11 } from "@ai-matrx/design-system";
 import { UsersIcon } from "@ai-matrx/design-system/icons";
 
@@ -5268,18 +5473,18 @@ function shareSummary(grants) {
 var MEMBER_CHOICE_DEFAULT = "default";
 
 // src/sharing/parts.tsx
-import { useState as useState23 } from "react";
+import { useState as useState24 } from "react";
 import { cn as cn10 } from "@ai-matrx/design-system";
-import { jsx as jsx23, jsxs as jsxs21 } from "react/jsx-runtime";
+import { jsx as jsx24, jsxs as jsxs22 } from "react/jsx-runtime";
 var message = (e, fallback) => {
   const m = e instanceof Error && e.message ? e.message : fallback;
   return copyRefusal(m) ?? m;
 };
 function useConfirmedChange() {
   const confirmed = useConfirmed();
-  const [busy, setBusy] = useState23(null);
-  const [error, setError] = useState23(null);
-  const [notice, setNotice] = useState23(null);
+  const [busy, setBusy] = useState24(null);
+  const [error, setError] = useState24(null);
+  const [notice, setNotice] = useState24(null);
   async function run(key, fn, done) {
     setBusy(key);
     setError(null);
@@ -5298,33 +5503,33 @@ function useConfirmedChange() {
   return { busy, error, notice, run, setNotice };
 }
 function AccessLine({ glyph: G, who, meta, children }) {
-  return /* @__PURE__ */ jsxs21("div", { className: "flex min-h-11 items-center gap-2 px-3 sm:px-4", children: [
-    /* @__PURE__ */ jsx23(G, { className: "size-4 shrink-0 text-muted-foreground" }),
-    /* @__PURE__ */ jsxs21("div", { className: "flex min-w-0 flex-1 items-baseline gap-2", children: [
-      /* @__PURE__ */ jsx23("span", { className: "truncate text-sm text-foreground", children: who }),
-      meta ? /* @__PURE__ */ jsx23("span", { className: "shrink-0 text-xs text-muted-foreground", children: meta }) : null
+  return /* @__PURE__ */ jsxs22("div", { className: "flex min-h-11 items-center gap-2 px-3 sm:px-4", children: [
+    /* @__PURE__ */ jsx24(G, { className: "size-4 shrink-0 text-muted-foreground" }),
+    /* @__PURE__ */ jsxs22("div", { className: "flex min-w-0 flex-1 items-baseline gap-2", children: [
+      /* @__PURE__ */ jsx24("span", { className: "truncate text-sm text-foreground", children: who }),
+      meta ? /* @__PURE__ */ jsx24("span", { className: "shrink-0 text-xs text-muted-foreground", children: meta }) : null
     ] }),
-    /* @__PURE__ */ jsx23("div", { className: "flex shrink-0 items-center gap-0.5", children })
+    /* @__PURE__ */ jsx24("div", { className: "flex shrink-0 items-center gap-0.5", children })
   ] });
 }
 function StatusLine({ error, notice }) {
   if (!error && !notice) return null;
-  return /* @__PURE__ */ jsx23("p", { className: cn10("min-w-0 flex-1 line-clamp-2 text-sm", error ? "text-destructive" : "text-success"), title: error ?? notice ?? void 0, children: error ?? notice });
+  return /* @__PURE__ */ jsx24("p", { className: cn10("min-w-0 flex-1 line-clamp-2 text-sm", error ? "text-destructive" : "text-success"), title: error ?? notice ?? void 0, children: error ?? notice });
 }
 
 // src/sharing/MovePanel.tsx
-import { useState as useState24 } from "react";
-import { confirm as confirm7 } from "@ai-matrx/kit/confirm-opener";
-import { Button as Button19, Field as Field8, Select as Select7 } from "@ai-matrx/design-system/controls";
-import { jsx as jsx24, jsxs as jsxs22 } from "react/jsx-runtime";
+import { useState as useState25 } from "react";
+import { confirm as confirm8 } from "@ai-matrx/kit/confirm-opener";
+import { Button as Button20, Field as Field9, Select as Select8 } from "@ai-matrx/design-system/controls";
+import { jsx as jsx25, jsxs as jsxs23 } from "react/jsx-runtime";
 var NONE = "__none__";
 function MovePanel({ item, port, organizations, onClose, onChanged }) {
   const { busy, error, notice, run, setNotice } = useConfirmedChange();
   const moves = moveDestinations(item, organizations);
   const copies = copyDestinations(organizations, item);
-  const [moveTo, setMoveTo] = useState24("");
-  const [copyTo, setCopyTo] = useState24("");
-  const [email, setEmail] = useState24("");
+  const [moveTo, setMoveTo] = useState25("");
+  const [copyTo, setCopyTo] = useState25("");
+  const [email, setEmail] = useState25("");
   const passkey = isPasskey(item);
   const canMove = item.capabilities.canManage && !passkey && moves.length > 0;
   const canGive = item.capabilities.canManage && item.owner.kind === "me" && !passkey;
@@ -5334,7 +5539,7 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
   const move = async () => {
     if (!moveChoice) return;
     const to = destinationOf(moveChoice.value);
-    const ok = await confirm7({
+    const ok = await confirm8({
       title: `Move to ${moveChoice.label}?`,
       description: `"${item.name}" stays the same item, so everything using it keeps working. ${itemMoveConsequence(item, to)}.`,
       confirmLabel: "Move"
@@ -5349,7 +5554,7 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
   const give = async () => {
     const to = email.trim();
     if (!isEmail(to)) return;
-    const ok = await confirm7({ title: "Give ownership away?", description: giveDescription(item, to), confirmLabel: "Give ownership", variant: "destructive" });
+    const ok = await confirm8({ title: "Give ownership away?", description: giveDescription(item, to), confirmLabel: "Give ownership", variant: "destructive" });
     if (!ok) return;
     const out = await run("give", () => port.sharing.giveOwnership(item, to));
     if (!out) return;
@@ -5362,25 +5567,25 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
     if (made) onChanged();
   };
   const nothing = !canMove && !canGive && !canCopy;
-  return /* @__PURE__ */ jsx24(
+  return /* @__PURE__ */ jsx25(
     Panel,
     {
       title: "Move or copy",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsx24(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx24(StatusLine, { error, notice }) : null, children: /* @__PURE__ */ jsx24(Button19, { variant: "primary", onClick: onClose, children: "Done" }) }),
-      children: nothing ? /* @__PURE__ */ jsx24(VaultSection, { children: /* @__PURE__ */ jsx24(Empty, { children: passkey ? "A passkey stays where it was created." : "Only the owner can move or give this item." }) }) : /* @__PURE__ */ jsxs22(VaultSection, { children: [
-        canMove && moves.length > 0 ? /* @__PURE__ */ jsx24(
+      footer: /* @__PURE__ */ jsx25(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx25(StatusLine, { error, notice }) : null, children: /* @__PURE__ */ jsx25(Button20, { variant: "primary", onClick: onClose, children: "Done" }) }),
+      children: nothing ? /* @__PURE__ */ jsx25(VaultSection, { children: /* @__PURE__ */ jsx25(Empty, { children: passkey ? "A passkey stays where it was created." : "Only the owner can move or give this item." }) }) : /* @__PURE__ */ jsxs23(VaultSection, { children: [
+        canMove && moves.length > 0 ? /* @__PURE__ */ jsx25(
           VaultRow,
           {
             label: "Move to",
             hint: moveChoice ? itemMoveConsequence(item, destinationOf(moveChoice.value)) : void 0,
-            actions: /* @__PURE__ */ jsx24(Button19, { variant: "outline", disabled: busy !== null || !moveChoice, onClick: () => void move(), children: "Move" }),
-            children: /* @__PURE__ */ jsx24(Select7, { className: "w-full", "aria-label": "Move to", value: moveTo || NONE, onValueChange: (v) => setMoveTo(v === NONE ? "" : v), options: [{ value: NONE, label: "Choose where" }, ...moves] })
+            actions: /* @__PURE__ */ jsx25(Button20, { variant: "outline", disabled: busy !== null || !moveChoice, onClick: () => void move(), children: "Move" }),
+            children: /* @__PURE__ */ jsx25(Select8, { className: "w-full", "aria-label": "Move to", value: moveTo || NONE, onValueChange: (v) => setMoveTo(v === NONE ? "" : v), options: [{ value: NONE, label: "Choose where" }, ...moves] })
           }
         ) : null,
-        canGive ? /* @__PURE__ */ jsx24(VaultRow, { label: "Give to", hint: "You lose all access; your shares end", actions: /* @__PURE__ */ jsx24(Button19, { variant: "danger", disabled: busy !== null || !isEmail(email), onClick: () => void give(), children: "Give" }), children: /* @__PURE__ */ jsx24(
-          Field8,
+        canGive ? /* @__PURE__ */ jsx25(VaultRow, { label: "Give to", hint: "You lose all access; your shares end", actions: /* @__PURE__ */ jsx25(Button20, { variant: "danger", disabled: busy !== null || !isEmail(email), onClick: () => void give(), children: "Give" }), children: /* @__PURE__ */ jsx25(
+          Field9,
           {
             className: "w-full",
             type: "email",
@@ -5393,18 +5598,18 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
             onChange: (e) => setEmail(e.target.value)
           }
         ) }) : null,
-        canCopy && copies.length > 0 ? /* @__PURE__ */ jsx24(VaultRow, { label: "Copy to", hint: "A separate item; edits no longer sync", actions: /* @__PURE__ */ jsx24(Button19, { variant: "outline", disabled: busy !== null || !copyChoice, onClick: () => void copy(), children: "Copy" }), children: /* @__PURE__ */ jsx24(Select7, { className: "w-full", "aria-label": "Copy to", value: copyTo || NONE, onValueChange: (v) => setCopyTo(v === NONE ? "" : v), options: [{ value: NONE, label: "Choose where" }, ...copies] }) }) : null
+        canCopy && copies.length > 0 ? /* @__PURE__ */ jsx25(VaultRow, { label: "Copy to", hint: "A separate item; edits no longer sync", actions: /* @__PURE__ */ jsx25(Button20, { variant: "outline", disabled: busy !== null || !copyChoice, onClick: () => void copy(), children: "Copy" }), children: /* @__PURE__ */ jsx25(Select8, { className: "w-full", "aria-label": "Copy to", value: copyTo || NONE, onValueChange: (v) => setCopyTo(v === NONE ? "" : v), options: [{ value: NONE, label: "Choose where" }, ...copies] }) }) : null
       ] })
     }
   );
 }
 
 // src/sharing/SharePanel.tsx
-import { Fragment as Fragment15, jsx as jsx25, jsxs as jsxs23 } from "react/jsx-runtime";
+import { Fragment as Fragment16, jsx as jsx26, jsxs as jsxs24 } from "react/jsx-runtime";
 function useGrants(port, item) {
-  const [grants, setGrants] = useState25(null);
-  const [loadError, setLoadError] = useState25(null);
-  const [nonce, setNonce] = useState25(0);
+  const [grants, setGrants] = useState26(null);
+  const [loadError, setLoadError] = useState26(null);
+  const [nonce, setNonce] = useState26(0);
   const allowed = item.capabilities.canManage;
   useEffect15(() => {
     if (!allowed) return;
@@ -5423,9 +5628,9 @@ function useGrants(port, item) {
 function SharePanel({ item, port, organizations, onClose, onChanged }) {
   const { grants, setGrants, loadError, reload } = useGrants(port, item);
   const { busy, error, notice, run } = useConfirmedChange();
-  const [email, setEmail] = useState25("");
-  const [level, setLevel] = useState25("use");
-  const [more, setMore] = useState25(false);
+  const [email, setEmail] = useState26("");
+  const [level, setLevel] = useState26("use");
+  const [more, setMore] = useState26(false);
   const isOrg = item.owner.kind === "organization" && item.owner.organizationId !== null;
   const orgName = item.owner.label;
   const people = (grants ?? []).filter((g) => g.kind === "person");
@@ -5444,7 +5649,7 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
     if (updated) setGrants((all) => (all ?? []).map((x) => x.id === g.id ? { ...updated, label: updated.label || g.label } : x));
   };
   const revoke = async (g) => {
-    const ok = await confirm8({
+    const ok = await confirm9({
       title: g.kind === "organization" ? `Remove from ${g.label}?` : "Remove access?",
       description: g.kind === "organization" ? `${g.label} members can no longer use "${item.name}". It stays in your vault.` : `${g.label} can no longer use "${item.name}". This takes effect at once.`,
       confirmLabel: "Remove",
@@ -5460,7 +5665,7 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
   const setMode = async (mode) => {
     if (mode === (item.accessMode === "restricted" ? "restricted" : "all_members")) return;
     if (mode === "all_members" && people.length > 0) {
-      const ok = await confirm8({
+      const ok = await confirm9({
         title: "Open to every member?",
         description: `Every member of ${orgName} gets it at their own vault access. The ${people.length === 1 ? "person" : `${people.length} people`} listed here lose their own access.`,
         confirmLabel: "Open to members",
@@ -5475,20 +5680,20 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
     }
   };
   if (!item.capabilities.canManage) {
-    return /* @__PURE__ */ jsx25(Panel, { title: "Share", size: "md", onClose, footer: /* @__PURE__ */ jsx25(Button20, { variant: "primary", onClick: onClose, children: "Done" }), children: /* @__PURE__ */ jsx25(VaultSection, { children: /* @__PURE__ */ jsx25(Empty, { children: "Only the owner can change who has access." }) }) });
+    return /* @__PURE__ */ jsx26(Panel, { title: "Share", size: "md", onClose, footer: /* @__PURE__ */ jsx26(Button21, { variant: "primary", onClick: onClose, children: "Done" }), children: /* @__PURE__ */ jsx26(VaultSection, { children: /* @__PURE__ */ jsx26(Empty, { children: "Only the owner can change who has access." }) }) });
   }
-  return /* @__PURE__ */ jsxs23(
+  return /* @__PURE__ */ jsxs24(
     Panel,
     {
       title: "Share",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsx25(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx25(StatusLine, { error, notice }) : null, children: /* @__PURE__ */ jsx25(Button20, { variant: "primary", onClick: onClose, children: "Done" }) }),
+      footer: /* @__PURE__ */ jsx26(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx26(StatusLine, { error, notice }) : null, children: /* @__PURE__ */ jsx26(Button21, { variant: "primary", onClick: onClose, children: "Done" }) }),
       children: [
-        /* @__PURE__ */ jsxs23(VaultSection, { title: "Who has access", children: [
-          isOrg ? /* @__PURE__ */ jsx25(AccessLine, { glyph: BuildingGlyph, who: `${orgName} admins`, children: /* @__PURE__ */ jsx25("span", { className: "px-2 text-sm text-muted-foreground", children: "Full access" }) }) : /* @__PURE__ */ jsx25(AccessLine, { glyph: PersonGlyph, who: "You", meta: "Owner", children: /* @__PURE__ */ jsx25("span", { className: "px-2 text-sm text-muted-foreground", children: "Full access" }) }),
-          isOrg ? /* @__PURE__ */ jsx25(AccessLine, { glyph: UsersIcon, who: `${orgName} members`, children: /* @__PURE__ */ jsx25(
-            Select8,
+        /* @__PURE__ */ jsxs24(VaultSection, { title: "Who has access", children: [
+          isOrg ? /* @__PURE__ */ jsx26(AccessLine, { glyph: BuildingGlyph, who: `${orgName} admins`, children: /* @__PURE__ */ jsx26("span", { className: "px-2 text-sm text-muted-foreground", children: "Full access" }) }) : /* @__PURE__ */ jsx26(AccessLine, { glyph: PersonGlyph, who: "You", meta: "Owner", children: /* @__PURE__ */ jsx26("span", { className: "px-2 text-sm text-muted-foreground", children: "Full access" }) }),
+          isOrg ? /* @__PURE__ */ jsx26(AccessLine, { glyph: UsersIcon, who: `${orgName} members`, children: /* @__PURE__ */ jsx26(
+            Select9,
             {
               variant: "inline",
               align: "end",
@@ -5502,14 +5707,14 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
               ]
             }
           ) }) : null,
-          loadError ? /* @__PURE__ */ jsx25(AccessLine, { glyph: XGlyph, who: /* @__PURE__ */ jsx25("span", { className: "text-destructive", children: loadError }), children: /* @__PURE__ */ jsx25(Button20, { variant: "quiet", onClick: reload, children: "Retry" }) }) : grants === null ? /* @__PURE__ */ jsx25(RegionSkeleton, { shape: "rows", count: 2, "aria-label": "Loading who has access", className: "px-3 sm:px-4" }) : grants.map((g) => /* @__PURE__ */ jsxs23(AccessLine, { glyph: g.kind === "organization" ? BuildingGlyph : PersonGlyph, who: g.label, ...g.kind === "organization" ? { meta: "Organization vault" } : {}, children: [
-            /* @__PURE__ */ jsx25(Select8, { variant: "inline", align: "end", "aria-label": `What ${g.label} can do`, disabled: busy !== null, value: g.level, onValueChange: (v) => void change(g, v), options: LEVEL_OPTIONS }),
-            /* @__PURE__ */ jsx25(Button20, { variant: "quiet", removes: true, icon: /* @__PURE__ */ jsx25(XGlyph, {}), "aria-label": `Remove ${g.label}`, disabled: busy !== null, onClick: () => void revoke(g) })
+          loadError ? /* @__PURE__ */ jsx26(AccessLine, { glyph: XGlyph, who: /* @__PURE__ */ jsx26("span", { className: "text-destructive", children: loadError }), children: /* @__PURE__ */ jsx26(Button21, { variant: "quiet", onClick: reload, children: "Retry" }) }) : grants === null ? /* @__PURE__ */ jsx26(RegionSkeleton, { shape: "rows", count: 2, "aria-label": "Loading who has access", className: "px-3 sm:px-4" }) : grants.map((g) => /* @__PURE__ */ jsxs24(AccessLine, { glyph: g.kind === "organization" ? BuildingGlyph : PersonGlyph, who: g.label, ...g.kind === "organization" ? { meta: "Organization vault" } : {}, children: [
+            /* @__PURE__ */ jsx26(Select9, { variant: "inline", align: "end", "aria-label": `What ${g.label} can do`, disabled: busy !== null, value: g.level, onValueChange: (v) => void change(g, v), options: LEVEL_OPTIONS }),
+            /* @__PURE__ */ jsx26(Button21, { variant: "quiet", removes: true, icon: /* @__PURE__ */ jsx26(XGlyph, {}), "aria-label": `Remove ${g.label}`, disabled: busy !== null, onClick: () => void revoke(g) })
           ] }, g.id)),
-          /* @__PURE__ */ jsxs23("div", { className: "flex min-h-11 items-center gap-2 px-3 sm:px-4", children: [
-            /* @__PURE__ */ jsx25(PersonGlyph, { className: "size-4 shrink-0 text-muted-foreground" }),
-            /* @__PURE__ */ jsx25(
-              Field9,
+          /* @__PURE__ */ jsxs24("div", { className: "flex min-h-11 items-center gap-2 px-3 sm:px-4", children: [
+            /* @__PURE__ */ jsx26(PersonGlyph, { className: "size-4 shrink-0 text-muted-foreground" }),
+            /* @__PURE__ */ jsx26(
+              Field10,
               {
                 className: "min-w-0 flex-1",
                 type: "email",
@@ -5529,13 +5734,13 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
                 }
               }
             ),
-            /* @__PURE__ */ jsx25(Select8, { variant: "inline", align: "end", "aria-label": "What they can do", value: level, onValueChange: setLevel, options: LEVEL_OPTIONS }),
-            /* @__PURE__ */ jsx25(Button20, { variant: "primary", disabled: busy !== null || !isEmail(email), onClick: () => void add(), children: "Share" })
+            /* @__PURE__ */ jsx26(Select9, { variant: "inline", align: "end", "aria-label": "What they can do", value: level, onValueChange: setLevel, options: LEVEL_OPTIONS }),
+            /* @__PURE__ */ jsx26(Button21, { variant: "primary", disabled: busy !== null || !isEmail(email), onClick: () => void add(), children: "Share" })
           ] })
         ] }),
-        /* @__PURE__ */ jsxs23("div", { className: "flex flex-col gap-3", children: [
-          /* @__PURE__ */ jsx25(DisclosureHeader3, { open: more, title: "More options", onClick: () => setMore((o) => !o) }),
-          more ? isOrg && item.owner.organizationId ? /* @__PURE__ */ jsx25(MemberAccess, { port, organizationId: item.owner.organizationId, organizationName: orgName }) : /* @__PURE__ */ jsx25(IntoOrganization, { item, port, organizations, grants: grants ?? [], onShared: (g) => setGrants((all) => [...(all ?? []).filter((x) => x.id !== g.id), g]) }) : null
+        /* @__PURE__ */ jsxs24("div", { className: "flex flex-col gap-3", children: [
+          /* @__PURE__ */ jsx26(DisclosureHeader3, { open: more, title: "More options", onClick: () => setMore((o) => !o) }),
+          more ? isOrg && item.owner.organizationId ? /* @__PURE__ */ jsx26(MemberAccess, { port, organizationId: item.owner.organizationId, organizationName: orgName }) : /* @__PURE__ */ jsx26(IntoOrganization, { item, port, organizations, grants: grants ?? [], onShared: (g) => setGrants((all) => [...(all ?? []).filter((x) => x.id !== g.id), g]) }) : null
         ] })
       ]
     }
@@ -5544,17 +5749,17 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
 function IntoOrganization({ item, port, organizations, grants, onShared }) {
   const { busy, error, notice, run } = useConfirmedChange();
   const open = organizations.filter((o) => !grants.some((g) => g.organizationId === o.id));
-  const [target, setTarget] = useState25("");
-  const [level, setLevel] = useState25("use");
+  const [target, setTarget] = useState26("");
+  const [level, setLevel] = useState26("use");
   const chosen = open.find((o) => o.id === target);
   if (item.owner.kind !== "me") return null;
-  return /* @__PURE__ */ jsx25(VaultSection, { title: "Share into organization", children: open.length > 0 ? /* @__PURE__ */ jsxs23(Fragment15, { children: [
-    /* @__PURE__ */ jsxs23("div", { className: "flex min-h-11 items-center gap-2 px-3 sm:px-4", children: [
-      /* @__PURE__ */ jsx25(BuildingGlyph, { className: "size-4 shrink-0 text-muted-foreground" }),
-      /* @__PURE__ */ jsx25(Select8, { className: "min-w-0 flex-1", "aria-label": "Organization", value: target || "__none__", onValueChange: (v) => setTarget(v === "__none__" ? "" : v), options: [{ value: "__none__", label: "Choose an organization" }, ...open.map((o) => ({ value: o.id, label: o.name }))] }),
-      /* @__PURE__ */ jsx25(Select8, { variant: "inline", align: "end", "aria-label": "What its members can do", value: level, onValueChange: setLevel, options: LEVEL_OPTIONS }),
-      /* @__PURE__ */ jsx25(
-        Button20,
+  return /* @__PURE__ */ jsx26(VaultSection, { title: "Share into organization", children: open.length > 0 ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
+    /* @__PURE__ */ jsxs24("div", { className: "flex min-h-11 items-center gap-2 px-3 sm:px-4", children: [
+      /* @__PURE__ */ jsx26(BuildingGlyph, { className: "size-4 shrink-0 text-muted-foreground" }),
+      /* @__PURE__ */ jsx26(Select9, { className: "min-w-0 flex-1", "aria-label": "Organization", value: target || "__none__", onValueChange: (v) => setTarget(v === "__none__" ? "" : v), options: [{ value: "__none__", label: "Choose an organization" }, ...open.map((o) => ({ value: o.id, label: o.name }))] }),
+      /* @__PURE__ */ jsx26(Select9, { variant: "inline", align: "end", "aria-label": "What its members can do", value: level, onValueChange: setLevel, options: LEVEL_OPTIONS }),
+      /* @__PURE__ */ jsx26(
+        Button21,
         {
           variant: "outline",
           disabled: busy !== null || !chosen,
@@ -5570,8 +5775,8 @@ function IntoOrganization({ item, port, organizations, grants, onShared }) {
         }
       )
     ] }),
-    /* @__PURE__ */ jsx25("p", { className: "truncate px-3 pb-1 text-xs text-muted-foreground sm:px-4", children: error ? /* @__PURE__ */ jsx25("span", { className: "text-destructive", children: error }) : notice ? /* @__PURE__ */ jsx25("span", { className: "text-success", children: notice }) : "It stays yours; its members can use it too" })
-  ] }) : /* @__PURE__ */ jsx25(Empty, { children: organizations.length ? "Already in every organization you belong to." : "You are not in any organization." }) });
+    /* @__PURE__ */ jsx26("p", { className: "truncate px-3 pb-1 text-xs text-muted-foreground sm:px-4", children: error ? /* @__PURE__ */ jsx26("span", { className: "text-destructive", children: error }) : notice ? /* @__PURE__ */ jsx26("span", { className: "text-success", children: notice }) : "It stays yours; its members can use it too" })
+  ] }) : /* @__PURE__ */ jsx26(Empty, { children: organizations.length ? "Already in every organization you belong to." : "You are not in any organization." }) });
 }
 var CHOICES = [
   { value: MEMBER_CHOICE_DEFAULT, label: "Default" },
@@ -5580,8 +5785,8 @@ var CHOICES = [
   { value: "editor", label: "Can edit", meta: "See and change" }
 ];
 function MemberAccess({ port, organizationId, organizationName }) {
-  const [list, setList] = useState25(null);
-  const [loadError, setLoadError] = useState25(null);
+  const [list, setList] = useState26(null);
+  const [loadError, setLoadError] = useState26(null);
   const { busy, error, run } = useConfirmedChange();
   useEffect15(() => {
     let live = true;
@@ -5598,9 +5803,9 @@ function MemberAccess({ port, organizationId, organizationName }) {
     const effective = await run(userId, () => port.sharing.setMemberAccess(organizationId, userId, access));
     if (effective) setList((l) => l ? { ...l, members: l.members.map((m) => m.userId === userId ? { ...m, access, effective } : m) } : l);
   };
-  return /* @__PURE__ */ jsxs23(VaultSection, { title: `${organizationName} vault access`, children: [
-    loadError ? /* @__PURE__ */ jsx25(Empty, { children: loadError }) : list === null ? /* @__PURE__ */ jsx25(RegionSkeleton, { shape: "rows", count: 3, "aria-label": "Loading member access", className: "px-3 sm:px-4" }) : list.members.length === 0 ? /* @__PURE__ */ jsx25(Empty, { children: "No members yet." }) : list.members.map((m) => /* @__PURE__ */ jsx25(AccessLine, { glyph: PersonGlyph, who: m.email || m.userId, meta: m.role, children: m.effective === "admin" ? /* @__PURE__ */ jsx25("span", { className: "px-2 text-sm text-muted-foreground", children: MEMBER_ACCESS_LABEL.admin }) : /* @__PURE__ */ jsx25(
-      Select8,
+  return /* @__PURE__ */ jsxs24(VaultSection, { title: `${organizationName} vault access`, children: [
+    loadError ? /* @__PURE__ */ jsx26(Empty, { children: loadError }) : list === null ? /* @__PURE__ */ jsx26(RegionSkeleton, { shape: "rows", count: 3, "aria-label": "Loading member access", className: "px-3 sm:px-4" }) : list.members.length === 0 ? /* @__PURE__ */ jsx26(Empty, { children: "No members yet." }) : list.members.map((m) => /* @__PURE__ */ jsx26(AccessLine, { glyph: PersonGlyph, who: m.email || m.userId, meta: m.role, children: m.effective === "admin" ? /* @__PURE__ */ jsx26("span", { className: "px-2 text-sm text-muted-foreground", children: MEMBER_ACCESS_LABEL.admin }) : /* @__PURE__ */ jsx26(
+      Select9,
       {
         variant: "inline",
         align: "end",
@@ -5611,11 +5816,11 @@ function MemberAccess({ port, organizationId, organizationName }) {
         options: CHOICES.map((c) => c.value === MEMBER_CHOICE_DEFAULT ? { value: c.value, label: `Default (${MEMBER_ACCESS_LABEL[list.defaultAccess]})` } : c.meta ? { value: c.value, label: c.label, meta: c.meta } : { value: c.value, label: c.label })
       }
     ) }, m.userId)),
-    /* @__PURE__ */ jsx25("p", { className: "truncate px-3 pb-1 text-xs text-muted-foreground sm:px-4", children: error ? /* @__PURE__ */ jsx25("span", { className: "text-destructive", children: error }) : "Applies to every item in this organization" })
+    /* @__PURE__ */ jsx26("p", { className: "truncate px-3 pb-1 text-xs text-muted-foreground sm:px-4", children: error ? /* @__PURE__ */ jsx26("span", { className: "text-destructive", children: error }) : "Applies to every item in this organization" })
   ] });
 }
 function SharingSummary({ item, port, className }) {
-  const [text, setText] = useState25("");
+  const [text, setText] = useState26("");
   const allowed = item.capabilities.canManage;
   useEffect15(() => {
     if (!allowed) return;
@@ -5629,12 +5834,12 @@ function SharingSummary({ item, port, className }) {
     };
   }, [port, item, allowed]);
   if (!allowed || !text) return null;
-  return /* @__PURE__ */ jsx25("span", { className: cn11("truncate text-xs text-muted-foreground", className), children: text });
+  return /* @__PURE__ */ jsx26("span", { className: cn11("truncate text-xs text-muted-foreground", className), children: text });
 }
 
 // src/ItemPane.tsx
 import { formatAbsoluteDate as formatAbsoluteDate3 } from "@ai-matrx/kit/format";
-import { Fragment as Fragment16, jsx as jsx26, jsxs as jsxs24 } from "react/jsx-runtime";
+import { Fragment as Fragment17, jsx as jsx27, jsxs as jsxs25 } from "react/jsx-runtime";
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
@@ -5643,7 +5848,7 @@ function ItemPane(props) {
   const editing = mode !== "view";
   const seedName = seed?.name ?? "";
   const seedUrl = seed?.url ?? "";
-  const [loaded, setLoaded] = useState26({});
+  const [loaded, setLoaded] = useState27({});
   const base = useMemo3(() => {
     const b = draftOf(item);
     if (!item) {
@@ -5653,16 +5858,21 @@ function ItemPane(props) {
     b.values = { ...loaded };
     return b;
   }, [item, seedName, seedUrl, loaded]);
-  const [draft, setDraft] = useState26(base);
-  const [tagsText, setTagsText] = useState26(base.tags.join(", "));
-  const [showTags, setShowTags] = useState26(false);
-  const [showDescription, setShowDescription] = useState26(false);
-  const [owner, setOwner] = useState26(defaultOwner ?? "me");
-  const [recipient, setRecipient] = useState26("");
-  const [generatePrivately, setGeneratePrivately] = useState26(false);
-  const [busy, setBusy] = useState26(false);
-  const [error, setError] = useState26(null);
-  const [destinations, setDestinations] = useState26({});
+  const [draft, setDraft] = useState27(base);
+  const [tagsText, setTagsText] = useState27(base.tags.join(", "));
+  const [showTags, setShowTags] = useState27(false);
+  const [showDescription, setShowDescription] = useState27(false);
+  const [showRecovery, setShowRecovery] = useState27(false);
+  const [settingUpOtp, setSettingUpOtp] = useState27(false);
+  const [owner, setOwner] = useState27(defaultOwner ?? "me");
+  const [recipient, setRecipient] = useState27("");
+  const [generatePrivately, setGeneratePrivately] = useState27(false);
+  const [busy, setBusy] = useState27(false);
+  const [sent, setSent] = useState27(null);
+  const [queuedFiles, setQueuedFiles] = useState27([]);
+  const [showBrowser, setShowBrowser] = useState27(false);
+  const [error, setError] = useState27(null);
+  const [destinations, setDestinations] = useState27({});
   const dirty = editing && isDirty(base, draft);
   const declared = definition?.fields ?? [];
   const prev = useRef14(null);
@@ -5685,6 +5895,7 @@ function ItemPane(props) {
     setLoaded({});
     setShowTags(false);
     setShowDescription(false);
+    setShowRecovery(false);
   }, [item?.id, mode]);
   useEffect16(() => onDirty(dirty), [dirty, onDirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
@@ -5712,33 +5923,37 @@ function ItemPane(props) {
     setBusy(true);
     setError(null);
     const out = { ...draft, values: Object.fromEntries(changedValues(base, draft)) };
+    if (out.values[RECOVERY_CODES_KEY] !== void 0) out.values[RECOVERY_CODES_KEY] = parseRecoveryCodes(out.values[RECOVERY_CODES_KEY]).join("\n");
     const withOtp = async (saved, notice2) => {
       const setup = out.authenticator.trim();
-      if (!setup) return [saved, notice2];
+      if (!setup) return [saved, notice2, false];
       try {
         await confirmed(() => port.authenticator.enrol(saved, setup));
-        return [await port.get(saved), notice2];
+        return [await port.get(saved), notice2, true];
       } catch (e) {
         const why = wasCancelled(e) ? "it was not confirmed" : e instanceof Error ? e.message : "it was refused";
-        return [saved, `Saved, but the one-time password was not set up: ${why}. Add it with Edit.`];
+        return [saved, `Saved, but the authenticator was not set up: ${why}. Add it with Edit.`, false];
       }
     };
     try {
       if (item) {
         const r = await port.save(item, definition, out);
-        const [next, n] = await withOtp(r.item, r.notice);
+        const [next, n, enrolled] = await withOtp(r.item, r.notice);
         dropKeptDraft(keepKey);
-        onSaved(next, false, n);
+        onSaved(next, false, n, enrolled);
       } else if (definition && owner === "person") {
         const secretKey = declared.find((f) => f.storage === "encrypted" && f.kind === "secret")?.key ?? null;
         const r = await port.sharing.assign({ recipientEmail: recipient.trim(), definition, draft: out, generateFieldKey: generatePrivately ? secretKey : null });
         notify(`Sent to ${r.recipientEmail}`);
-        onCancelNew();
+        dropKeptDraft(keepKey);
+        onDirty(false);
+        setSent(r);
       } else if (definition) {
         const r = await port.create(definition, owner === "me" ? null : owner, out);
-        const [next, n] = await withOtp(r.item, r.notice);
+        const [withCode, n0, enrolled] = await withOtp(r.item, r.notice);
+        const [next, n] = await storeQueuedFiles(withCode, n0);
         dropKeptDraft(keepKey);
-        onSaved(next, true, n);
+        onSaved(next, true, n, enrolled);
       }
     } catch (e) {
       setError(e instanceof Error ? e.message : "Saving failed. Nothing was changed.");
@@ -5746,9 +5961,32 @@ function ItemPane(props) {
       setBusy(false);
     }
   }
+  async function storeQueuedFiles(saved, notice2) {
+    let next = saved;
+    const failed = [];
+    for (const q of queuedFiles) {
+      try {
+        next = await confirmed(() => port.activity.addFile(next, q.file, { label: q.label, description: q.description, handling: q.handling }));
+      } catch {
+        failed.push(q.label);
+      }
+    }
+    setQueuedFiles([]);
+    if (failed.length === 0) return [next, notice2];
+    const said = `Saved, but ${failed.length === 1 ? `the file ${failed[0]} was` : `${failed.length} files were`} not stored. Add ${failed.length === 1 ? "it" : "them"} with Add file.`;
+    return [next, notice2 ? `${notice2} ${said}` : said];
+  }
+  function createAnother() {
+    setSent(null);
+    setDraft(base);
+    setTagsText(base.tags.join(", "));
+    setQueuedFiles([]);
+    setShowBrowser(false);
+    setError(null);
+  }
   async function remove() {
     if (!item) return;
-    const ok = await confirm9({ title: `Delete \u201C${item.name}\u201D?`, description: "It moves to Trash. You can restore it from there.", confirmLabel: "Delete", variant: "destructive" });
+    const ok = await confirm10({ title: `Delete \u201C${item.name}\u201D?`, description: "It moves to Trash. You can restore it from there.", confirmLabel: "Delete", variant: "destructive" });
     if (!ok) return;
     setBusy(true);
     try {
@@ -5789,6 +6027,7 @@ function ItemPane(props) {
       onChanged();
     }
   }
+  const fieldSettings = (f) => canEdit ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SlidersGlyph, {}), "aria-label": `${f.label} settings`, title: `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }) : null;
   const turnOnOne = canTurnOn ? (f) => () => turnOn([f]) : () => void 0;
   const declaredKeys = new Set(declared.map((f) => f.key));
   const extraFields = (item?.fields ?? []).filter((f) => !declaredKeys.has(f.key) && !draft.removed.includes(f.id) && !isAuthenticatorStorage(f.key));
@@ -5797,35 +6036,39 @@ function ItemPane(props) {
   const viewCustom = (item?.custom ?? []).filter((c) => !declaredKeys.has(c.key) && c.key !== MFA_METHOD_KEY && !isAuthenticatorStorage(c.key));
   const isLogin = (item?.definitionKey ?? definition?.key) === "website_login" || (item?.definitionKey ?? definition?.key) === "username_password";
   const typeLabel = definition?.label ?? item?.definitionLabel ?? "";
-  const shownOwner = mode === "new" ? owner === "me" ? { label: "Personal", glyph: /* @__PURE__ */ jsx26(PersonGlyph, {}) } : owner === "person" ? { label: "Someone else", glyph: /* @__PURE__ */ jsx26(SendGlyph, {}) } : { label: organizations.find((o) => o.id === owner)?.name ?? "Organization", glyph: /* @__PURE__ */ jsx26(BuildingGlyph, {}) } : item ? { label: item.owner.label, glyph: item.owner.kind === "me" ? /* @__PURE__ */ jsx26(PersonGlyph, {}) : item.owner.kind === "organization" ? /* @__PURE__ */ jsx26(BuildingGlyph, {}) : /* @__PURE__ */ jsx26(UsersIcon2, {}) } : null;
+  const recoveryDeclared = declaredKeys.has(RECOVERY_CODES_KEY);
+  const recoveryExtra = extraFields.some(isRecoveryCodesField);
+  const offerRecovery = isLogin || Boolean(item?.authenticator) || draft.authenticator.trim() !== "";
+  const recoveryEditing = !recoveryDeclared && !recoveryExtra && (showRecovery || (draft.values[RECOVERY_CODES_KEY] ?? "") !== "");
+  const shownOwner = mode === "new" ? owner === "me" ? { label: "Personal", glyph: /* @__PURE__ */ jsx27(PersonGlyph, {}) } : owner === "person" ? { label: "Someone else", glyph: /* @__PURE__ */ jsx27(SendGlyph, {}) } : { label: organizations.find((o) => o.id === owner)?.name ?? "Organization", glyph: /* @__PURE__ */ jsx27(BuildingGlyph, {}) } : item ? { label: item.owner.label, glyph: item.owner.kind === "me" ? /* @__PURE__ */ jsx27(PersonGlyph, {}) : item.owner.kind === "organization" ? /* @__PURE__ */ jsx27(BuildingGlyph, {}) : /* @__PURE__ */ jsx27(UsersIcon2, {}) } : null;
   const sameNamed = (id) => {
     const name = organizations.find((o) => o.id === id)?.name.trim().toLowerCase();
     return Boolean(name) && organizations.filter((o) => o.name.trim().toLowerCase() === name).length > 1;
   };
   const tagsVisible = showTags || draft.tags.length > 0 || tagsText !== "";
   const descriptionVisible = showDescription || draft.description !== "";
-  const header = /* @__PURE__ */ jsxs24("header", { className: "flex min-h-14 items-center gap-2 border-b border-border px-3 py-2 sm:gap-3 sm:px-5", children: [
-    onBack ? /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(ChevronLeftGlyph, {}), "aria-label": "Back", onClick: mode === "new" ? onCancelNew : onBack }) : null,
-    /* @__PURE__ */ jsx26(ItemIcon, { definitionKey: definition?.key ?? item?.definitionKey ?? "custom", family: definition?.family ?? "generic", site: item ? loginSiteOf(item) : loginSiteOf({ loginUrls: draft.loginUrls }), size: "lg" }),
-    /* @__PURE__ */ jsxs24("div", { className: "flex min-w-0 flex-1 flex-col", children: [
-      /* @__PURE__ */ jsx26("h2", { className: "truncate text-base font-semibold leading-tight", children: editing ? draft.name || (mode === "new" ? `New ${typeLabel.toLowerCase()}` : item?.name) : item?.name }),
-      /* @__PURE__ */ jsxs24("span", { className: "flex min-w-0 items-center gap-1 text-xs text-muted-foreground", children: [
-        typeLabel ? /* @__PURE__ */ jsx26("span", { className: "truncate", children: typeLabel }) : null,
-        shownOwner ? /* @__PURE__ */ jsx26(Badge7, { className: "shrink-0", icon: shownOwner.glyph, "aria-label": `Saved in ${shownOwner.label}`, children: shownOwner.label }) : null,
-        item && !editing ? /* @__PURE__ */ jsx26(SharingSummary, { item, port, className: "hidden truncate before:mr-1 before:content-['\xB7'] sm:inline" }, `${item.updatedAt}-${refreshKey ?? ""}`) : null
+  const header = /* @__PURE__ */ jsxs25("header", { className: "flex min-h-14 items-center gap-2 border-b border-border px-3 py-2 sm:gap-3 sm:px-5", children: [
+    onBack ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(ChevronLeftGlyph, {}), "aria-label": "Back", onClick: mode === "new" ? onCancelNew : onBack }) : null,
+    /* @__PURE__ */ jsx27(ItemIcon, { definitionKey: definition?.key ?? item?.definitionKey ?? "custom", family: definition?.family ?? "generic", site: item ? loginSiteOf(item) : loginSiteOf({ loginUrls: draft.loginUrls }), size: "lg" }),
+    /* @__PURE__ */ jsxs25("div", { className: "flex min-w-0 flex-1 flex-col", children: [
+      /* @__PURE__ */ jsx27("h2", { className: "truncate text-base font-semibold leading-tight", children: editing ? draft.name || (mode === "new" ? `New ${typeLabel.toLowerCase()}` : item?.name) : item?.name }),
+      /* @__PURE__ */ jsxs25("span", { className: "flex min-w-0 items-center gap-1 text-xs text-muted-foreground", children: [
+        typeLabel ? /* @__PURE__ */ jsx27("span", { className: "truncate", children: typeLabel }) : null,
+        shownOwner ? /* @__PURE__ */ jsx27(Badge7, { className: "shrink-0", icon: shownOwner.glyph, "aria-label": `Saved in ${shownOwner.label}`, children: shownOwner.label }) : null,
+        item && !editing ? /* @__PURE__ */ jsx27(SharingSummary, { item, port, className: "hidden truncate before:mr-1 before:content-['\xB7'] sm:inline" }, `${item.updatedAt}-${refreshKey ?? ""}`) : null
       ] })
     ] }),
-    editing ? /* @__PURE__ */ jsxs24("div", { className: "flex shrink-0 items-center gap-2", children: [
-      dirty ? /* @__PURE__ */ jsxs24("span", { className: "hidden items-center gap-1.5 text-xs text-muted-foreground sm:flex", role: "status", children: [
-        /* @__PURE__ */ jsx26("span", { className: "size-1.5 rounded-full bg-warning", "aria-hidden": true }),
+    editing ? /* @__PURE__ */ jsxs25("div", { className: "flex shrink-0 items-center gap-2", children: [
+      dirty ? /* @__PURE__ */ jsxs25("span", { className: "hidden items-center gap-1.5 text-xs text-muted-foreground sm:flex", role: "status", children: [
+        /* @__PURE__ */ jsx27("span", { className: "size-1.5 rounded-full bg-warning", "aria-hidden": true }),
         "Unsaved"
       ] }) : null,
-      /* @__PURE__ */ jsx26(Button21, { variant: "quiet", disabled: busy, onClick: () => mode === "new" ? onCancelNew() : onMode("view"), children: dirty ? "Discard" : "Cancel" }),
-      /* @__PURE__ */ jsx26(Button21, { variant: "primary", disabled: busy || draft.name.trim() === "" || mode === "edit" && !dirty || mode === "new" && owner === "person" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(recipient.trim()), onClick: () => void save(), children: mode === "new" && owner === "person" ? "Send" : "Save" })
-    ] }) : item ? /* @__PURE__ */ jsxs24("div", { className: "flex shrink-0 items-center gap-1", children: [
-      host.page && canUseOnSite(item, host.page.url) ? /* @__PURE__ */ jsx26(UseOnSiteButton, { port, item, pageUrl: host.page.url, onChanged: (next) => onChanged(next) }) : null,
-      host.fill && item.capabilities.canUse ? /* @__PURE__ */ jsx26(
-        Button21,
+      /* @__PURE__ */ jsx27(Button22, { variant: "quiet", disabled: busy, onClick: () => mode === "new" ? onCancelNew() : onMode("view"), children: dirty ? "Discard" : "Cancel" }),
+      /* @__PURE__ */ jsx27(Button22, { variant: "primary", disabled: busy || sent !== null || draft.name.trim() === "" || mode === "edit" && !dirty || mode === "new" && owner === "person" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(recipient.trim()), onClick: () => void save(), children: mode === "new" && owner === "person" ? "Send" : "Save" })
+    ] }) : item ? /* @__PURE__ */ jsxs25("div", { className: "flex shrink-0 items-center gap-1", children: [
+      host.page && canUseOnSite(item, host.page.url) ? /* @__PURE__ */ jsx27(UseOnSiteButton, { port, item, pageUrl: host.page.url, onChanged: (next) => onChanged(next) }) : null,
+      host.fill && item.capabilities.canUse ? /* @__PURE__ */ jsx27(
+        Button22,
         {
           variant: "primary",
           onClick: () => void host.fill?.(item.id).then((outcome) => {
@@ -5835,44 +6078,44 @@ function ItemPane(props) {
           children: "Fill"
         }
       ) : null,
-      favorite ? /* @__PURE__ */ jsx26("span", { className: "hidden sm:contents", children: /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(StarGlyph, { className: favorite.on ? "fill-current text-warning" : "size-4" }), "aria-label": favorite.on ? "Remove from favorites" : "Add to favorites", pressed: favorite.on, onClick: favorite.toggle }) }) : null,
-      canManage ? /* @__PURE__ */ jsx26("span", { className: "hidden sm:contents", children: /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(ShareGlyph, {}), "aria-label": "Share", onClick: () => onPanel("share") }) }) : null,
-      canEdit ? /* @__PURE__ */ jsx26(Button21, { variant: "outline", icon: /* @__PURE__ */ jsx26(PencilGlyph, {}), collapse: "container", "aria-label": "Edit", onClick: () => onMode("edit"), children: "Edit" }) : null,
-      /* @__PURE__ */ jsxs24(DropdownMenu3, { children: [
-        /* @__PURE__ */ jsx26(DropdownMenuTrigger3, { asChild: true, children: /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(MoreGlyph, {}), "aria-label": "More actions" }) }),
-        /* @__PURE__ */ jsxs24(DropdownMenuContent3, { align: "end", children: [
-          favorite ? /* @__PURE__ */ jsxs24(DropdownMenuItem3, { onSelect: favorite.toggle, children: [
-            /* @__PURE__ */ jsx26(StarGlyph, { className: "size-4" }),
+      favorite ? /* @__PURE__ */ jsx27("span", { className: "hidden sm:contents", children: /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(StarGlyph, { className: favorite.on ? "fill-current text-warning" : "size-4" }), "aria-label": favorite.on ? "Remove from favorites" : "Add to favorites", pressed: favorite.on, onClick: favorite.toggle }) }) : null,
+      canManage ? /* @__PURE__ */ jsx27("span", { className: "hidden sm:contents", children: /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(ShareGlyph, {}), "aria-label": "Share", onClick: () => onPanel("share") }) }) : null,
+      canEdit ? /* @__PURE__ */ jsx27(Button22, { variant: "outline", icon: /* @__PURE__ */ jsx27(PencilGlyph, {}), collapse: "container", "aria-label": "Edit", onClick: () => onMode("edit"), children: "Edit" }) : null,
+      /* @__PURE__ */ jsxs25(DropdownMenu3, { children: [
+        /* @__PURE__ */ jsx27(DropdownMenuTrigger3, { asChild: true, children: /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(MoreGlyph, {}), "aria-label": "More actions" }) }),
+        /* @__PURE__ */ jsxs25(DropdownMenuContent3, { align: "end", children: [
+          favorite ? /* @__PURE__ */ jsxs25(DropdownMenuItem3, { onSelect: favorite.toggle, children: [
+            /* @__PURE__ */ jsx27(StarGlyph, { className: "size-4" }),
             favorite.on ? "Remove from favorites" : "Add to favorites"
           ] }) : null,
-          canManage ? /* @__PURE__ */ jsxs24(DropdownMenuItem3, { onSelect: () => onPanel("share"), children: [
-            /* @__PURE__ */ jsx26(ShareGlyph, { className: "size-4" }),
+          canManage ? /* @__PURE__ */ jsxs25(DropdownMenuItem3, { onSelect: () => onPanel("share"), children: [
+            /* @__PURE__ */ jsx27(ShareGlyph, { className: "size-4" }),
             "Share"
           ] }) : null,
-          canManage ? /* @__PURE__ */ jsxs24(DropdownMenuItem3, { onSelect: () => onPanel("move"), children: [
-            /* @__PURE__ */ jsx26(MoveGlyph, { className: "size-4" }),
+          canManage ? /* @__PURE__ */ jsxs25(DropdownMenuItem3, { onSelect: () => onPanel("move"), children: [
+            /* @__PURE__ */ jsx27(MoveGlyph, { className: "size-4" }),
             "Move or copy"
           ] }) : null,
-          item.capabilities.canReveal ? /* @__PURE__ */ jsxs24(DropdownMenuItem3, { onSelect: () => onPanel("send"), children: [
-            /* @__PURE__ */ jsx26(SendGlyph, { className: "size-4" }),
+          item.capabilities.canReveal ? /* @__PURE__ */ jsxs25(DropdownMenuItem3, { onSelect: () => onPanel("send"), children: [
+            /* @__PURE__ */ jsx27(SendGlyph, { className: "size-4" }),
             "Send securely"
           ] }) : null,
-          /* @__PURE__ */ jsxs24(DropdownMenuItem3, { onSelect: () => onPanel("history"), children: [
-            /* @__PURE__ */ jsx26(HistoryIcon, { className: "size-4" }),
+          /* @__PURE__ */ jsxs25(DropdownMenuItem3, { onSelect: () => onPanel("history"), children: [
+            /* @__PURE__ */ jsx27(HistoryIcon, { className: "size-4" }),
             "Password history"
           ] }),
-          /* @__PURE__ */ jsxs24(DropdownMenuItem3, { onSelect: () => onPanel("activity"), children: [
-            /* @__PURE__ */ jsx26(ListGlyph, { className: "size-4" }),
+          /* @__PURE__ */ jsxs25(DropdownMenuItem3, { onSelect: () => onPanel("activity"), children: [
+            /* @__PURE__ */ jsx27(ListGlyph, { className: "size-4" }),
             "Activity"
           ] }),
-          canEdit ? /* @__PURE__ */ jsxs24(DropdownMenuItem3, { onSelect: () => onPanel("settings"), children: [
-            /* @__PURE__ */ jsx26(SettingsIcon, { className: "size-4" }),
+          canEdit ? /* @__PURE__ */ jsxs25(DropdownMenuItem3, { onSelect: () => onPanel("settings"), children: [
+            /* @__PURE__ */ jsx27(SettingsIcon, { className: "size-4" }),
             "Settings"
           ] }) : null,
-          canManage ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
-            /* @__PURE__ */ jsx26(DropdownMenuSeparator3, {}),
-            /* @__PURE__ */ jsxs24(DropdownMenuItem3, { className: "text-destructive", disabled: busy, onSelect: () => void remove(), children: [
-              /* @__PURE__ */ jsx26(TrashGlyph, { className: "size-4" }),
+          canManage ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+            /* @__PURE__ */ jsx27(DropdownMenuSeparator3, {}),
+            /* @__PURE__ */ jsxs25(DropdownMenuItem3, { className: "text-destructive", disabled: busy, onSelect: () => void remove(), children: [
+              /* @__PURE__ */ jsx27(TrashGlyph, { className: "size-4" }),
               "Delete"
             ] })
           ] }) : null
@@ -5881,17 +6124,17 @@ function ItemPane(props) {
     ] }) : null
   ] });
   const filesProps = item ? { item, port, host, definition, organizations, arg: null, onClose: () => void 0, onChanged, onPanel } : null;
-  return /* @__PURE__ */ jsx26(RoomProvider, { value: room, children: /* @__PURE__ */ jsxs24("article", { ref: paneRef, "aria-label": item?.name ?? "New item", className: cn12(CONTROLS_CONTAINER_CLASS, "flex h-full min-h-0 flex-col bg-background"), children: [
+  return /* @__PURE__ */ jsx27(RoomProvider, { value: room, children: /* @__PURE__ */ jsxs25("article", { ref: paneRef, "aria-label": item?.name ?? "New item", className: cn12(CONTROLS_CONTAINER_CLASS, "flex h-full min-h-0 flex-col bg-background"), children: [
     header,
-    error ? /* @__PURE__ */ jsx26("div", { role: "alert", className: "border-b border-border bg-muted px-5 py-2 text-sm text-destructive", children: error }) : null,
-    notice && !editing ? /* @__PURE__ */ jsx26("div", { role: "status", className: "border-b border-border bg-muted px-5 py-2 text-sm text-warning", children: notice }) : null,
-    item && !editing && (itemOff || offFields.length > 0) ? /* @__PURE__ */ jsxs24("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-5 py-2 text-sm", children: [
-      /* @__PURE__ */ jsx26("span", { className: "min-w-0 flex-1 truncate text-warning", children: offFields.length === 0 ? "This item is turned off" : offFields.length === 1 ? "1 field is turned off" : `${offFields.length} fields are turned off` }),
-      canTurnOn ? /* @__PURE__ */ jsx26(TurnOnButton, { label: "all fields", onTurnOn: () => turnOn(offFields) }) : null
+    error ? /* @__PURE__ */ jsx27("div", { role: "alert", className: "border-b border-border bg-muted px-5 py-2 text-sm text-destructive", children: error }) : null,
+    notice && !editing ? /* @__PURE__ */ jsx27("div", { role: "status", className: "border-b border-border bg-muted px-5 py-2 text-sm text-warning", children: notice }) : null,
+    item && !editing && (itemOff || offFields.length > 0) ? /* @__PURE__ */ jsxs25("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-5 py-2 text-sm", children: [
+      /* @__PURE__ */ jsx27("span", { className: "min-w-0 flex-1 truncate text-warning", children: offFields.length === 0 ? "This item is turned off" : offFields.length === 1 ? "1 field is turned off" : `${offFields.length} fields are turned off` }),
+      canTurnOn ? /* @__PURE__ */ jsx27(TurnOnButton, { label: "all fields", onTurnOn: () => turnOn(offFields) }) : null
     ] }) : null,
-    /* @__PURE__ */ jsx26("div", { className: "min-h-0 flex-1 overflow-y-auto", children: /* @__PURE__ */ jsx26("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", children: editing ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
-      /* @__PURE__ */ jsxs24(VaultSection, { children: [
-        mode === "new" ? /* @__PURE__ */ jsx26(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx26(
+    /* @__PURE__ */ jsx27("div", { className: "min-h-0 flex-1 overflow-y-auto", children: sent ? /* @__PURE__ */ jsx27(AssignResult, { sent, onAnother: createAnother, onDone: onCancelNew }) : /* @__PURE__ */ jsx27("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", children: editing ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+      /* @__PURE__ */ jsxs25(VaultSection, { children: [
+        mode === "new" ? /* @__PURE__ */ jsx27(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx27(
           OptionCombobox,
           {
             value: owner,
@@ -5906,20 +6149,20 @@ function ItemPane(props) {
             ],
             getLabel: (v) => v === "me" ? "Personal" : v === "person" ? "Someone else" : organizations.find((o) => o.id === v)?.name ?? v,
             getHint: (v) => v === "me" ? "Only you" : v === "person" ? "Sent by email" : sameNamed(v) ? `ID ${v.slice(0, 8)}` : null,
-            renderIcon: (v) => v === "me" ? /* @__PURE__ */ jsx26(PersonGlyph, { className: "size-4" }) : v === "person" ? /* @__PURE__ */ jsx26(SendGlyph, { className: "size-4" }) : /* @__PURE__ */ jsx26(BuildingGlyph, { className: "size-4" })
+            renderIcon: (v) => v === "me" ? /* @__PURE__ */ jsx27(PersonGlyph, { className: "size-4" }) : v === "person" ? /* @__PURE__ */ jsx27(SendGlyph, { className: "size-4" }) : /* @__PURE__ */ jsx27(BuildingGlyph, { className: "size-4" })
           }
         ) }) : null,
-        /* @__PURE__ */ jsx26(EditRow, { label: "Name", value: draft.name, onChange: (v) => patch({ name: v }), placeholder: "Name", autoFocus: mode === "new" }),
-        mode === "new" && owner === "person" ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
-          /* @__PURE__ */ jsx26(EditRow, { label: "Their email", value: recipient, placeholder: "name@company.com", inputMode: "email", onChange: setRecipient }),
-          declared.some((f) => f.storage === "encrypted" && f.kind === "secret") ? /* @__PURE__ */ jsx26(VaultRow, { label: "Password", hint: "You never see it", children: /* @__PURE__ */ jsx26(Switch5, { checked: generatePrivately, onCheckedChange: setGeneratePrivately, "aria-label": "Generate the password privately" }) }) : null
+        /* @__PURE__ */ jsx27(EditRow, { label: "Name", value: draft.name, onChange: (v) => patch({ name: v }), placeholder: "Name", autoFocus: mode === "new" }),
+        mode === "new" && owner === "person" ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+          /* @__PURE__ */ jsx27(EditRow, { label: "Their email", value: recipient, placeholder: "name@company.com", inputMode: "email", onChange: setRecipient }),
+          declared.some((f) => f.storage === "encrypted" && f.kind === "secret") ? /* @__PURE__ */ jsx27(VaultRow, { label: "Password", hint: "You never see it", children: /* @__PURE__ */ jsx27(Switch6, { checked: generatePrivately, onCheckedChange: setGeneratePrivately, "aria-label": "Generate the password privately" }) }) : null
         ] }) : null,
         declared.map((f) => {
           const existing = item?.fields.find((x) => x.key === f.key);
           const secretKind = f.storage === "encrypted" && f.kind === "secret";
           const value = f.storage === "metadata" ? metaValue(f.key) : draft.values[f.key] ?? "";
           const hidden = existing && existing.handling !== "visible" && !(f.key in loaded);
-          return /* @__PURE__ */ jsx26(
+          return /* @__PURE__ */ jsx27(
             EditRow,
             {
               label: f.label,
@@ -5929,37 +6172,38 @@ function ItemPane(props) {
               multiline: f.kind === "multiline",
               inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
               onChange: (v) => setValue(f.key, v),
-              actions: /* @__PURE__ */ jsxs24(Fragment16, { children: [
-                hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
-                secretKind ? /* @__PURE__ */ jsx26(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
-                existing ? /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null
+              actions: /* @__PURE__ */ jsxs25(Fragment17, { children: [
+                hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
+                secretKind ? /* @__PURE__ */ jsx27(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
+                existing ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null
               ] })
             },
             f.key
           );
         }),
-        extraFields.map((f) => /* @__PURE__ */ jsx26(
+        extraFields.map((f) => /* @__PURE__ */ jsx27(
           EditRow,
           {
             label: f.label,
             value: draft.values[f.key] ?? "",
             placeholder: f.handling === "visible" || f.key in loaded ? "" : "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
-            secret: f.handling !== "visible",
+            secret: f.handling !== "visible" && !isRecoveryCodesField(f),
+            multiline: isRecoveryCodesField(f),
             onChange: (v) => setValue(f.key, v),
             onRemove: () => patch({ removed: [...draft.removed, f.id] }),
             removeLabel: `Delete ${f.label}`,
-            actions: /* @__PURE__ */ jsxs24(Fragment16, { children: [
-              f.handling === "revealable" && !(f.key in loaded) && item?.capabilities.canReveal ? /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
-              /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) })
+            actions: /* @__PURE__ */ jsxs25(Fragment17, { children: [
+              f.handling === "revealable" && !(f.key in loaded) && item?.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
+              /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) })
             ] })
           },
           f.id
         )),
-        draft.loginUrls.map((u, i) => /* @__PURE__ */ jsx26(
+        draft.loginUrls.map((u, i) => /* @__PURE__ */ jsx27(
           EditRow,
           {
             label: i === 0 ? "Website" : `Website ${i + 1}`,
-            hint: destinations[i] && destinations[i].tone !== "success" ? /* @__PURE__ */ jsx26("span", { className: destinations[i].tone === "destructive" ? "text-destructive" : "text-warning", children: destinations[i].message }) : void 0,
+            hint: destinations[i] && destinations[i].tone !== "success" ? /* @__PURE__ */ jsx27("span", { className: destinations[i].tone === "destructive" ? "text-destructive" : "text-warning", children: destinations[i].message }) : void 0,
             value: u,
             autoFocus: i > 0 && u === "" && i === draft.loginUrls.length - 1,
             placeholder: "https://",
@@ -5979,27 +6223,53 @@ function ItemPane(props) {
           },
           i
         )),
-        /* @__PURE__ */ jsx26(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
-        /* @__PURE__ */ jsx26(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
-        item && isLogin && !item.authenticator ? /* @__PURE__ */ jsx26(TwoFactorMethodRow, { port, item, onChanged }) : null
+        /* @__PURE__ */ jsx27(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
+        /* @__PURE__ */ jsx27(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
+        item && isLogin && !item.authenticator ? /* @__PURE__ */ jsx27(TwoFactorMethodRow, { port, item, onChanged }) : null,
+        !item && isLogin && draft.authenticator.trim() === "" ? /* @__PURE__ */ jsx27(DraftTwoFactorRow, { custom: draft.custom, onCustom: (custom) => patch({ custom }) }) : null,
+        recoveryEditing ? /* @__PURE__ */ jsx27(
+          EditRow,
+          {
+            label: "Recovery codes",
+            value: draft.values[RECOVERY_CODES_KEY] ?? "",
+            multiline: true,
+            autoFocus: showRecovery && (draft.values[RECOVERY_CODES_KEY] ?? "") === "",
+            placeholder: "Backup codes, one per line",
+            onChange: (v) => setValue(RECOVERY_CODES_KEY, v),
+            onRemove: () => {
+              setShowRecovery(false);
+              setDraft((d) => {
+                const values = { ...d.values };
+                delete values[RECOVERY_CODES_KEY];
+                return { ...d, values };
+              });
+            },
+            removeLabel: "Remove recovery codes"
+          }
+        ) : !recoveryDeclared && !recoveryExtra && offerRecovery ? /* @__PURE__ */ jsx27(AddRow, { label: "Recovery codes", onAdd: () => setShowRecovery(true), children: "Add backup codes" }) : null
       ] }),
-      /* @__PURE__ */ jsx26(VaultSection, { children: /* @__PURE__ */ jsx26(EditRow, { label: "Notes", value: draft.notes, multiline: true, placeholder: "Anything worth remembering", onChange: (v) => patch({ notes: v }) }) }),
-      /* @__PURE__ */ jsxs24(
+      /* @__PURE__ */ jsx27(VaultSection, { children: /* @__PURE__ */ jsx27(EditRow, { label: "Notes", value: draft.notes, multiline: true, placeholder: "Anything worth remembering", onChange: (v) => patch({ notes: v }) }) }),
+      /* @__PURE__ */ jsxs25(
         VaultSection,
         {
           title: "More",
-          actions: /* @__PURE__ */ jsxs24(DropdownMenu3, { children: [
-            /* @__PURE__ */ jsx26(DropdownMenuTrigger3, { asChild: true, children: /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(PlusGlyph, {}), children: "Add" }) }),
-            /* @__PURE__ */ jsxs24(DropdownMenuContent3, { align: "end", children: [
-              /* @__PURE__ */ jsx26(DropdownMenuItem3, { onSelect: () => patch({ secrets: [...draft.secrets, { key: "", label: "", value: "" }] }), children: "Secret field" }),
-              /* @__PURE__ */ jsx26(DropdownMenuItem3, { onSelect: () => patch({ custom: [...draft.custom, { key: `custom_${draft.custom.length + 1}_${Date.now() % 1e5}`, label: "", value: "" }] }), children: "Text field" }),
-              !tagsVisible ? /* @__PURE__ */ jsx26(DropdownMenuItem3, { onSelect: () => setShowTags(true), children: "Tags" }) : null,
-              !descriptionVisible ? /* @__PURE__ */ jsx26(DropdownMenuItem3, { onSelect: () => setShowDescription(true), children: "Description" }) : null
+          actions: /* @__PURE__ */ jsxs25(DropdownMenu3, { children: [
+            /* @__PURE__ */ jsx27(DropdownMenuTrigger3, { asChild: true, children: /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(PlusGlyph, {}), children: "Add" }) }),
+            /* @__PURE__ */ jsxs25(DropdownMenuContent3, { align: "end", children: [
+              /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => patch({ secrets: [...draft.secrets, { key: "", label: "", value: "" }] }), children: "Secret field" }),
+              /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => patch({ custom: [...draft.custom, { key: `custom_${draft.custom.length + 1}_${Date.now() % 1e5}`, label: "", value: "" }] }), children: "Text field" }),
+              !tagsVisible ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => setShowTags(true), children: "Tags" }) : null,
+              !descriptionVisible ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => setShowDescription(true), children: "Description" }) : null,
+              mode === "new" && !showBrowser ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => {
+                setShowBrowser(true);
+                if (!draft.browser) patch({ browser: defaultBrowserSettings(draft.loginUrls.some((u) => u.trim() !== "")) });
+              }, children: "Browser settings" }) : null,
+              !recoveryDeclared && !recoveryExtra && !recoveryEditing ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => setShowRecovery(true), children: "Recovery codes" }) : null
             ] })
           ] }),
           children: [
-            descriptionVisible ? /* @__PURE__ */ jsx26(EditRow, { label: "Description", value: draft.description, placeholder: "What this is for", onChange: (v) => patch({ description: v }) }) : null,
-            tagsVisible ? /* @__PURE__ */ jsx26(
+            descriptionVisible ? /* @__PURE__ */ jsx27(EditRow, { label: "Description", value: draft.description, placeholder: "What this is for", onChange: (v) => patch({ description: v }) }) : null,
+            tagsVisible ? /* @__PURE__ */ jsx27(
               EditRow,
               {
                 label: "Tags",
@@ -6011,63 +6281,83 @@ function ItemPane(props) {
                 }
               }
             ) : null,
-            draft.secrets.map((s, i) => /* @__PURE__ */ jsx26(CustomEditRow, { label: s.label, value: s.value, secret: true, onLabel: (v) => patch({ secrets: draft.secrets.map((x, j) => j === i ? { ...x, label: v } : x) }), onValue: (v) => patch({ secrets: draft.secrets.map((x, j) => j === i ? { ...x, value: v } : x) }), onRemove: () => patch({ secrets: draft.secrets.filter((_, j) => j !== i) }) }, `s${i}`)),
-            extraCustom.map((c) => /* @__PURE__ */ jsx26(CustomEditRow, { label: c.label, value: c.value, secret: false, onLabel: (v) => patch({ custom: draft.custom.map((x) => x.key === c.key ? { ...x, label: v } : x) }), onValue: (v) => patch({ custom: draft.custom.map((x) => x.key === c.key ? { ...x, value: v } : x) }), onRemove: () => patch({ custom: draft.custom.filter((x) => x.key !== c.key) }) }, c.key)),
-            !descriptionVisible && !tagsVisible && draft.secrets.length === 0 && extraCustom.length === 0 ? /* @__PURE__ */ jsx26(AddRow, { label: "Tags", onAdd: () => setShowTags(true), children: "Add tags" }) : null
+            mode === "new" && showBrowser && draft.browser ? /* @__PURE__ */ jsx27(DraftBrowserRows, { value: draft.browser, hasWebsite: draft.loginUrls.some((u) => u.trim() !== ""), onChange: (browser) => patch({ browser }) }) : null,
+            draft.secrets.map((s, i) => /* @__PURE__ */ jsx27(SecretBuilderRow, { field: s, onChange: (p) => setDraft((d) => ({ ...d, secrets: d.secrets.map((x, j) => j === i ? { ...x, ...p } : x) })), onRemove: () => patch({ secrets: draft.secrets.filter((_, j) => j !== i) }) }, `s${i}`)),
+            extraCustom.map((c) => /* @__PURE__ */ jsx27(CustomEditRow, { label: c.label, value: c.value, secret: false, onLabel: (v) => patch({ custom: draft.custom.map((x) => x.key === c.key ? { ...x, label: v } : x) }), onValue: (v) => patch({ custom: draft.custom.map((x) => x.key === c.key ? { ...x, value: v } : x) }), onRemove: () => patch({ custom: draft.custom.filter((x) => x.key !== c.key) }) }, c.key)),
+            !descriptionVisible && !tagsVisible && draft.secrets.length === 0 && extraCustom.length === 0 ? /* @__PURE__ */ jsx27(AddRow, { label: "Tags", onAdd: () => setShowTags(true), children: "Add tags" }) : null
           ]
         }
       ),
-      filesProps ? /* @__PURE__ */ jsx26(FilesSection, { ...filesProps, editing: true }) : null
-    ] }) : item ? /* @__PURE__ */ jsxs24(Fragment16, { children: [
-      /* @__PURE__ */ jsxs24(VaultSection, { children: [
+      filesProps ? /* @__PURE__ */ jsx27(FilesSection, { ...filesProps, editing: true }) : mode === "new" && owner !== "person" ? /* @__PURE__ */ jsx27(DraftFilesSection, { files: queuedFiles, onFiles: setQueuedFiles }) : null
+    ] }) : item ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+      /* @__PURE__ */ jsxs25(VaultSection, { children: [
         declared.map((f) => {
           if (f.storage === "metadata") {
             const v = metaValue(f.key);
-            return v ? /* @__PURE__ */ jsx26(PlainRow, { label: f.label, value: v, openUrl: host.openUrl }, f.key) : null;
+            return v ? /* @__PURE__ */ jsx27(PlainRow, { label: f.label, value: v, openUrl: host.openUrl }, f.key) : null;
           }
           const field = item.fields.find((x) => x.key === f.key);
-          if (isRecoveryCodesField(f)) return /* @__PURE__ */ jsx26(RecoveryCodesRow, { item, field, port, onChanged }, f.key);
-          return field ? /* @__PURE__ */ jsx26(SecretRow, { port, item, field, onTurnOn: turnOnOne(field) }, field.id) : null;
+          if (isRecoveryCodesField(f)) return /* @__PURE__ */ jsx27(RecoveryCodesRow, { item, field, port, onChanged }, f.key);
+          return field ? /* @__PURE__ */ jsx27(SecretRow, { port, item, field, onTurnOn: turnOnOne(field), extra: fieldSettings(field) }, field.id) : null;
         }),
-        extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ jsx26(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ jsx26(SecretRow, { port, item, field: f, onTurnOn: turnOnOne(f) }, f.id)),
-        item.loginUrls.length > 0 ? item.loginUrls.map((u, i) => /* @__PURE__ */ jsx26(PlainRow, { label: i === 0 ? "Website" : `Website ${i + 1}`, value: u, openUrl: host.openUrl }, `${u}-${i}`)) : /* @__PURE__ */ jsx26(AddRow, { label: "Website", onAdd: canEdit ? () => onMode("edit") : null, children: "Add website" }),
-        item.authenticator ? /* @__PURE__ */ jsx26(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
+        extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ jsx27(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ jsx27(SecretRow, { port, item, field: f, onTurnOn: turnOnOne(f), extra: fieldSettings(f) }, f.id)),
+        item.loginUrls.length > 0 ? item.loginUrls.map((u, i) => /* @__PURE__ */ jsx27(PlainRow, { label: i === 0 ? "Website" : `Website ${i + 1}`, value: u, openUrl: host.openUrl }, `${u}-${i}`)) : /* @__PURE__ */ jsx27(AddRow, { label: "Website", onAdd: canEdit ? () => onMode("edit") : null, children: "Add website" }),
+        item.authenticator ? /* @__PURE__ */ jsx27(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
           // The secret is still there, only off: turning it on brings the codes back. Never "Set up",
           // which would invite replacing a working two-factor secret.
-          /* @__PURE__ */ jsx26(VaultRow, { label: "One-time password", actions: canTurnOn ? /* @__PURE__ */ jsx26(TurnOnButton, { label: "One-time password", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ jsx26("span", { className: "text-muted-foreground", children: "Turned off" }) })
-        ) : /* @__PURE__ */ jsx26(AddRow, { label: "One-time password", onAdd: canEdit ? () => onMode("edit") : null, children: "Set up" }),
-        !item.authenticator && item.custom.some((c) => c.key === MFA_METHOD_KEY && c.value) ? /* @__PURE__ */ jsx26(TwoFactorMethodRow, { port, item, onChanged }) : null
+          /* @__PURE__ */ jsx27(VaultRow, { label: "Authenticator", actions: canTurnOn ? /* @__PURE__ */ jsx27(TurnOnButton, { label: "Authenticator", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ jsx27("span", { className: "text-muted-foreground", children: "Turned off" }) })
+        ) : /* @__PURE__ */ jsx27(AddRow, { label: "Authenticator", onAdd: canEdit ? () => setSettingUpOtp(true) : null, children: "Set up" }),
+        !recoveryDeclared && !recoveryExtra && offerRecovery ? /* @__PURE__ */ jsx27(RecoveryCodesRow, { item, field: null, port, onChanged }) : null,
+        !item.authenticator && item.custom.some((c) => c.key === MFA_METHOD_KEY && c.value) ? /* @__PURE__ */ jsx27(TwoFactorMethodRow, { port, item, onChanged }) : null
       ] }),
-      /* @__PURE__ */ jsx26(VaultSection, { children: item.notes ? /* @__PURE__ */ jsx26(PlainRow, { label: "Notes", value: item.notes, multiline: true }) : /* @__PURE__ */ jsx26(AddRow, { label: "Notes", onAdd: canEdit ? () => onMode("edit") : null, children: "Add notes" }) }),
-      item.description || item.tags.length > 0 || viewCustom.length > 0 ? /* @__PURE__ */ jsxs24(VaultSection, { title: "More", children: [
-        item.description ? /* @__PURE__ */ jsx26(PlainRow, { label: "Description", value: item.description }) : null,
-        item.tags.length > 0 ? /* @__PURE__ */ jsx26(VaultRow, { label: "Tags", children: /* @__PURE__ */ jsx26("div", { className: "flex flex-wrap gap-1", children: item.tags.map((t) => /* @__PURE__ */ jsx26("span", { className: "rounded-md bg-muted px-1.5 py-0.5 text-xs", children: t }, t)) }) }) : null,
-        viewCustom.map((c) => /* @__PURE__ */ jsx26(PlainRow, { label: c.label, value: c.value, openUrl: host.openUrl }, c.key))
+      /* @__PURE__ */ jsx27(VaultSection, { children: item.notes ? /* @__PURE__ */ jsx27(PlainRow, { label: "Notes", value: item.notes, multiline: true }) : /* @__PURE__ */ jsx27(AddRow, { label: "Notes", onAdd: canEdit ? () => onMode("edit") : null, children: "Add notes" }) }),
+      item.description || item.tags.length > 0 || viewCustom.length > 0 ? /* @__PURE__ */ jsxs25(VaultSection, { title: "More", children: [
+        item.description ? /* @__PURE__ */ jsx27(PlainRow, { label: "Description", value: item.description }) : null,
+        item.tags.length > 0 ? /* @__PURE__ */ jsx27(VaultRow, { label: "Tags", children: /* @__PURE__ */ jsx27("div", { className: "flex flex-wrap gap-1", children: item.tags.map((t) => /* @__PURE__ */ jsx27("span", { className: "rounded-md bg-muted px-1.5 py-0.5 text-xs", children: t }, t)) }) }) : null,
+        viewCustom.map((c) => /* @__PURE__ */ jsx27(PlainRow, { label: c.label, value: c.value, openUrl: host.openUrl }, c.key))
       ] }) : null,
-      filesProps ? /* @__PURE__ */ jsx26(FilesSection, { ...filesProps, editing: false }) : null,
-      /* @__PURE__ */ jsxs24("p", { className: cn12("px-1 text-xs text-muted-foreground"), children: [
+      filesProps ? /* @__PURE__ */ jsx27(FilesSection, { ...filesProps, editing: false }) : null,
+      /* @__PURE__ */ jsxs25("p", { className: cn12("px-1 text-xs text-muted-foreground"), children: [
         "Modified ",
         formatAbsoluteDate3(item.updatedAt, DAY_FORMAT, ""),
         " \xB7 Created ",
         formatAbsoluteDate3(item.createdAt, DAY_FORMAT, "")
       ] })
-    ] }) : null }) })
+    ] }) : null }) }),
+    settingUpOtp && item ? /* @__PURE__ */ jsx27(
+      AddOtpPanel,
+      {
+        port,
+        items: [item],
+        definitions: definition ? [definition] : [],
+        itemId: item.id,
+        onClose: () => setSettingUpOtp(false),
+        onChanged: () => onChanged(),
+        onDone: () => {
+          setSettingUpOtp(false);
+          onChanged();
+        }
+      }
+    ) : null
   ] }) });
 }
 
 // src/ItemList.tsx
-import { jsx as jsx27, jsxs as jsxs25 } from "react/jsx-runtime";
+import { jsx as jsx28, jsxs as jsxs26 } from "react/jsx-runtime";
 var SORTS2 = [
-  { value: "name", label: "Name" },
+  { value: "name", label: "Name A\u2013Z" },
+  { value: "name-desc", label: "Name Z\u2013A" },
   { value: "website", label: "Website" },
   { value: "updated", label: "Recently changed" },
-  { value: "created", label: "Recently added" }
+  { value: "created", label: "Recently added" },
+  { value: "viewed", label: "Recently viewed" }
 ];
 function subtitleOf(item, withOwner) {
   const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
-function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, showOwner }) {
+function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, showOwner, canSortViewed = false }) {
+  const sorts = SORTS2.filter((s) => canSortViewed || s.value !== "viewed");
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
   const ordered = [...pinned, ...rest];
@@ -6087,34 +6377,34 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     }
   };
   const mixedOwners = showOwner ?? new Set(items.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
-  const row = (i) => /* @__PURE__ */ jsx27(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners }, i.id);
-  const sortLabel = SORTS2.find((s) => s.value === sort)?.label ?? "Name";
-  return /* @__PURE__ */ jsxs25("section", { "aria-label": title, className: "flex h-full min-h-0 flex-col border-r border-border bg-background", children: [
-    /* @__PURE__ */ jsxs25("div", { className: "flex flex-col gap-2 px-3 pb-2 pt-3", children: [
+  const row = (i) => /* @__PURE__ */ jsx28(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners }, i.id);
+  const sortLabel = sorts.find((s) => s.value === sort)?.label ?? "Name A\u2013Z";
+  return /* @__PURE__ */ jsxs26("section", { "aria-label": title, className: "flex h-full min-h-0 flex-col border-r border-border bg-background", children: [
+    /* @__PURE__ */ jsxs26("div", { className: "flex flex-col gap-2 px-3 pb-2 pt-3", children: [
       header,
-      /* @__PURE__ */ jsxs25("div", { className: "flex items-center gap-2", children: [
-        /* @__PURE__ */ jsx27(SearchField, { value: query, onChange: (e) => onQuery(e.target.value), onKeyDown, placeholder: `Search ${title}`, className: "min-w-0 flex-1", "aria-label": "Search the vault" }),
-        /* @__PURE__ */ jsx27(Button22, { variant: "primary", icon: /* @__PURE__ */ jsx27(PlusGlyph, {}), "aria-label": "New item", onClick: onNew })
+      /* @__PURE__ */ jsxs26("div", { className: "flex items-center gap-2", children: [
+        /* @__PURE__ */ jsx28(SearchField, { value: query, onChange: (e) => onQuery(e.target.value), onKeyDown, placeholder: `Search ${title}`, className: "min-w-0 flex-1", "aria-label": "Search the vault" }),
+        /* @__PURE__ */ jsx28(Button23, { variant: "primary", icon: /* @__PURE__ */ jsx28(PlusGlyph, {}), "aria-label": "New item", onClick: onNew })
       ] }),
-      /* @__PURE__ */ jsxs25("div", { className: "flex items-center justify-between gap-2 px-1", children: [
-        /* @__PURE__ */ jsxs25("span", { className: "truncate text-xs text-muted-foreground", children: [
+      /* @__PURE__ */ jsxs26("div", { className: "flex items-center justify-between gap-2 px-1", children: [
+        /* @__PURE__ */ jsxs26("span", { className: "truncate text-xs text-muted-foreground", children: [
           items.length,
           " ",
           items.length === 1 ? "item" : "items"
         ] }),
-        /* @__PURE__ */ jsxs25(DropdownMenu4, { children: [
-          /* @__PURE__ */ jsx27(DropdownMenuTrigger4, { asChild: true, children: /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SortGlyph, {}), "aria-label": `Sort: ${sortLabel}`, children: sortLabel }) }),
-          /* @__PURE__ */ jsx27(DropdownMenuContent4, { align: "end", children: /* @__PURE__ */ jsx27(DropdownMenuRadioGroup, { value: sort, onValueChange: (v) => onSort(SORTS2.find((s) => s.value === v)?.value ?? "name"), children: SORTS2.map((s) => /* @__PURE__ */ jsx27(DropdownMenuRadioItem, { value: s.value, children: s.label }, s.value)) }) })
+        /* @__PURE__ */ jsxs26(DropdownMenu4, { children: [
+          /* @__PURE__ */ jsx28(DropdownMenuTrigger4, { asChild: true, children: /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(SortGlyph, {}), "aria-label": `Sort: ${sortLabel}`, children: sortLabel }) }),
+          /* @__PURE__ */ jsx28(DropdownMenuContent4, { align: "end", children: /* @__PURE__ */ jsx28(DropdownMenuRadioGroup, { value: sort, onValueChange: (v) => onSort(sorts.find((s) => s.value === v)?.value ?? "name"), children: sorts.map((s) => /* @__PURE__ */ jsx28(DropdownMenuRadioItem, { value: s.value, children: s.label }, s.value)) }) })
         ] })
       ] })
     ] }),
-    /* @__PURE__ */ jsx27("div", { className: "min-h-0 flex-1 overflow-y-auto px-2 pb-3", onKeyDown, children: items.length === 0 ? /* @__PURE__ */ jsxs25("div", { className: "flex flex-col items-center gap-3 px-4 py-12 text-center", children: [
-      /* @__PURE__ */ jsx27("span", { className: "text-sm text-muted-foreground", children: query ? `Nothing matches \u201C${query}\u201D.` : "Nothing here yet." }),
-      query ? /* @__PURE__ */ jsx27(Button22, { variant: "outline", onClick: () => onQuery(""), children: "Clear search" }) : /* @__PURE__ */ jsx27(Button22, { variant: "outline", icon: /* @__PURE__ */ jsx27(PlusGlyph, {}), onClick: onNew, children: "New item" })
-    ] }) : /* @__PURE__ */ jsxs25("ul", { ref: listRef, className: "flex flex-col gap-px", children: [
-      pinned.length > 0 ? /* @__PURE__ */ jsx27("li", { className: "px-2 pb-1 pt-1 text-xs font-medium text-muted-foreground", children: "This page" }) : null,
+    /* @__PURE__ */ jsx28("div", { className: "min-h-0 flex-1 overflow-y-auto px-2 pb-3", onKeyDown, children: items.length === 0 ? /* @__PURE__ */ jsxs26("div", { className: "flex flex-col items-center gap-3 px-4 py-12 text-center", children: [
+      /* @__PURE__ */ jsx28("span", { className: "text-sm text-muted-foreground", children: query ? `Nothing matches \u201C${query}\u201D.` : "Nothing here yet." }),
+      query ? /* @__PURE__ */ jsx28(Button23, { variant: "outline", onClick: () => onQuery(""), children: "Clear search" }) : /* @__PURE__ */ jsx28(Button23, { variant: "outline", icon: /* @__PURE__ */ jsx28(PlusGlyph, {}), onClick: onNew, children: "New item" })
+    ] }) : /* @__PURE__ */ jsxs26("ul", { ref: listRef, className: "flex flex-col gap-px", children: [
+      pinned.length > 0 ? /* @__PURE__ */ jsx28("li", { className: "px-2 pb-1 pt-1 text-xs font-medium text-muted-foreground", children: "This page" }) : null,
       pinned.map(row),
-      pinned.length > 0 && rest.length > 0 ? /* @__PURE__ */ jsx27("li", { className: "px-2 pb-1 pt-3 text-xs font-medium text-muted-foreground", children: "Everything else" }) : null,
+      pinned.length > 0 && rest.length > 0 ? /* @__PURE__ */ jsx28("li", { className: "px-2 pb-1 pt-3 text-xs font-medium text-muted-foreground", children: "Everything else" }) : null,
       rest.map(row)
     ] }) })
   ] });
@@ -6123,48 +6413,93 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
-  const [busy, setBusy] = useState27(false);
-  const user = item.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed");
-  const secret = item.fields.find((f) => f.key === "password" && f.handling === "revealable");
-  const quick = async (key, label) => {
+  const [busy, setBusy] = useState28(false);
+  const [menuOpen, setMenuOpen] = useState28(false);
+  const canUse = item.capabilities.canUse;
+  const user = canUse ? item.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed" && f.active !== false) : void 0;
+  const secret = canUse && item.capabilities.canReveal ? item.fields.find((f) => f.key === "password" && f.handling === "revealable" && f.active !== false) : void 0;
+  const code = canUse && item.authenticator?.enabled ? item.authenticator : null;
+  const run = async (label, read, isSecret) => {
     setBusy(true);
     try {
-      const v = await confirmed(() => port.reveal(item, key));
-      await copy(v, label, { secret: key !== user?.key || user.handling !== "visible" });
+      const v = await confirmed(read);
+      await copy(v, label, { secret: isSecret });
     } catch (e) {
       if (!wasCancelled(e)) notify(e instanceof Error ? e.message : `${label} could not be read`, "error");
     } finally {
       setBusy(false);
     }
   };
-  return /* @__PURE__ */ jsxs25("li", { className: "group relative", "data-item": item.id, children: [
-    /* @__PURE__ */ jsxs25(
+  const copyUser = () => user && void run(user.label, () => port.reveal(item, user.key), user.handling !== "visible");
+  const copyPassword = () => secret && void run("Password", () => port.reveal(item, secret.key), true);
+  const copyCode = () => code && void run("One-time code", async () => (await port.authenticator.code(item)).code, true);
+  const copyName = () => void copy(item.name, "Name", { secret: false });
+  return /* @__PURE__ */ jsxs26("li", { className: "group relative", "data-item": item.id, children: [
+    /* @__PURE__ */ jsxs26(
       "button",
       {
         type: "button",
         "aria-current": on ? "true" : void 0,
         "data-surface": on ? "primary" : void 0,
         onClick: () => onSelect(item.id),
-        className: cn13("flex h-12 w-full items-center gap-3 rounded-lg px-2 text-left", on ? "bg-primary text-primary-foreground" : "hover:bg-accent"),
+        className: cn13("flex h-12 w-full items-center gap-3 rounded-lg px-2 pr-10 text-left", on ? "bg-primary text-primary-foreground" : "hover:bg-accent"),
         children: [
-          /* @__PURE__ */ jsx27(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
-          /* @__PURE__ */ jsxs25("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
-            /* @__PURE__ */ jsx27("span", { className: "truncate text-sm font-medium", children: item.name }),
-            /* @__PURE__ */ jsx27("span", { className: "truncate text-xs text-muted-foreground", children: subtitleOf(item, withOwner) })
+          /* @__PURE__ */ jsx28(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
+          /* @__PURE__ */ jsxs26("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
+            /* @__PURE__ */ jsx28("span", { className: "truncate text-sm font-medium", children: item.name }),
+            /* @__PURE__ */ jsx28("span", { className: "truncate text-xs text-muted-foreground", children: subtitleOf(item, withOwner) })
           ] })
         ]
       }
     ),
-    item.capabilities.canUse && (user || secret && item.capabilities.canReveal) ? /* @__PURE__ */ jsxs25("div", { className: cn13("absolute right-1.5 top-1/2 hidden -translate-y-1/2 items-center gap-0.5 rounded-md pl-2 group-hover:flex", on ? "bg-primary" : "bg-accent"), "data-surface": on ? "primary" : void 0, children: [
-      user ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(UserGlyph, {}), "aria-label": `Copy ${user.label}`, disabled: busy, onClick: () => void quick(user.key, user.label) }) : null,
-      secret && item.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(KeyGlyph, {}), "aria-label": "Copy password", disabled: busy, onClick: () => void quick(secret.key, "Password") }) : null
-    ] }) : null
+    /* @__PURE__ */ jsxs26("div", { className: "absolute right-1.5 top-1/2 flex -translate-y-1/2 items-center gap-0.5", "data-surface": on ? "primary" : void 0, children: [
+      user || secret ? /* @__PURE__ */ jsxs26("div", { className: cn13("hidden items-center gap-0.5 rounded-md pl-2 [@media(hover:hover)]:group-hover:flex [@media(hover:hover)]:group-focus-within:flex", on ? "bg-primary" : "bg-accent"), "data-row-quick": "", children: [
+        user ? /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(UserGlyph, {}), "aria-label": `Copy ${user.label}`, disabled: busy, onClick: copyUser }) : null,
+        secret ? /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(KeyGlyph, {}), "aria-label": "Copy password", disabled: busy, onClick: copyPassword }) : null
+      ] }) : null,
+      /* @__PURE__ */ jsxs26(DropdownMenu4, { open: menuOpen, onOpenChange: setMenuOpen, children: [
+        /* @__PURE__ */ jsx28(DropdownMenuTrigger4, { asChild: true, children: /* @__PURE__ */ jsx28(
+          Button23,
+          {
+            variant: "quiet",
+            icon: /* @__PURE__ */ jsx28(MoreGlyph, {}),
+            "aria-label": `Actions for ${item.name}`,
+            disabled: busy,
+            className: cn13("[@media(hover:hover)]:invisible [@media(hover:hover)]:group-hover:visible [@media(hover:hover)]:group-focus-within:visible", menuOpen && "[@media(hover:hover)]:visible")
+          }
+        ) }),
+        /* @__PURE__ */ jsxs26(DropdownMenuContent4, { align: "end", children: [
+          user ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyUser, children: [
+            /* @__PURE__ */ jsx28(UserGlyph, { className: "size-4" }),
+            "Copy ",
+            user.label.toLowerCase()
+          ] }) : null,
+          secret ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyPassword, children: [
+            /* @__PURE__ */ jsx28(KeyGlyph, { className: "size-4" }),
+            "Copy password"
+          ] }) : null,
+          code ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyCode, children: [
+            /* @__PURE__ */ jsx28(ClockGlyph, { className: "size-4" }),
+            "Copy one-time code"
+          ] }) : null,
+          user || secret || code ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
+          /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: () => onSelect(item.id), children: [
+            /* @__PURE__ */ jsx28(ChevronRightGlyph, { className: "size-4" }),
+            "Open"
+          ] }),
+          /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyName, children: [
+            /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" }),
+            "Copy name"
+          ] })
+        ] })
+      ] })
+    ] })
   ] });
 }
 
 // src/lists/TrashView.tsx
-import { useState as useState29 } from "react";
-import { Button as Button24 } from "@ai-matrx/design-system/controls";
+import { useState as useState30 } from "react";
+import { Button as Button25 } from "@ai-matrx/design-system/controls";
 import { formatAbsoluteDate as formatAbsoluteDate4 } from "@ai-matrx/kit/format";
 
 // src/lists/logic.ts
@@ -6237,15 +6572,15 @@ function refusalText(reason) {
 }
 
 // src/lists/RestorePanel.tsx
-import { useEffect as useEffect18, useState as useState28 } from "react";
-import { Button as Button23 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment17, jsx as jsx28, jsxs as jsxs26 } from "react/jsx-runtime";
+import { useEffect as useEffect18, useState as useState29 } from "react";
+import { Button as Button24 } from "@ai-matrx/design-system/controls";
+import { Fragment as Fragment18, jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 function RestorePanel({ lists, item, restore, onClose }) {
-  const [preview, setPreview] = useState28(null);
-  const [error, setError] = useState28(null);
-  const [busy, setBusy] = useState28(false);
-  const [loading, setLoading] = useState28(Boolean(lists.preview));
+  const [preview, setPreview] = useState29(null);
+  const [error, setError] = useState29(null);
+  const [busy, setBusy] = useState29(false);
+  const [loading, setLoading] = useState29(Boolean(lists.preview));
   useEffect18(() => {
     if (!lists.preview) return;
     let live = true;
@@ -6278,41 +6613,41 @@ function RestorePanel({ lists, item, restore, onClose }) {
       setBusy(false);
     }
   };
-  return /* @__PURE__ */ jsxs26(
+  return /* @__PURE__ */ jsxs27(
     Panel,
     {
       title: `Restore "${item.name}"`,
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs26(Fragment17, { children: [
-        /* @__PURE__ */ jsx28(Button23, { variant: "quiet", onClick: onClose, children: refused ? "Close" : "Cancel" }),
-        refused ? null : /* @__PURE__ */ jsx28(Button23, { variant: "primary", icon: /* @__PURE__ */ jsx28(RestoreGlyph, {}), disabled: busy || loading || lists.preview !== void 0 && preview === null, onClick: () => void run(), children: busy ? "Restoring\u2026" : "Restore" })
+      footer: /* @__PURE__ */ jsxs27(Fragment18, { children: [
+        /* @__PURE__ */ jsx29(Button24, { variant: "quiet", onClick: onClose, children: refused ? "Close" : "Cancel" }),
+        refused ? null : /* @__PURE__ */ jsx29(Button24, { variant: "primary", icon: /* @__PURE__ */ jsx29(RestoreGlyph, {}), disabled: busy || loading || lists.preview !== void 0 && preview === null, onClick: () => void run(), children: busy ? "Restoring\u2026" : "Restore" })
       ] }),
       children: [
-        loading ? /* @__PURE__ */ jsx28(VaultSection, { children: /* @__PURE__ */ jsx28(Empty, { children: "Checking what comes back\u2026" }) }) : preview?.supported ? /* @__PURE__ */ jsxs26(VaultSection, { title: "Comes back", children: [
-          /* @__PURE__ */ jsx28(VaultRow, { label: "Fields", children: /* @__PURE__ */ jsx28("span", { className: "text-foreground", children: count(preview.fields, "field") }) }),
-          /* @__PURE__ */ jsx28(VaultRow, { label: "Files", children: /* @__PURE__ */ jsx28("span", { className: "text-foreground", children: count(preview.attachments, "file") }) }),
-          preview.passkeys === 1 ? /* @__PURE__ */ jsx28(VaultRow, { label: "Passkey", hint: "Not turned on; the site may not accept it", children: /* @__PURE__ */ jsx28("span", { className: "text-foreground", children: "1 passkey" }) }) : null,
-          /* @__PURE__ */ jsx28(VaultRow, { label: "Stays off", hint: "Turn each back on yourself", children: /* @__PURE__ */ jsx28("span", { className: "text-muted-foreground", children: "Sharing, browser fill, codes, sandboxes, agents" }) }),
-          preview.priorWasDisabled ? /* @__PURE__ */ jsx28(VaultRow, { label: "Before", children: /* @__PURE__ */ jsx28("span", { className: "text-muted-foreground", children: "It was already off before it was deleted." }) }) : null
-        ] }) : preview ? /* @__PURE__ */ jsx28(VaultSection, { children: /* @__PURE__ */ jsx28(Empty, { children: refusalText(preview.reason) }) }) : /* @__PURE__ */ jsx28(VaultSection, { children: /* @__PURE__ */ jsx28(Empty, { children: "It comes back turned off: sharing, browser fill, codes and sandbox use stay off." }) }),
-        error ? /* @__PURE__ */ jsx28("p", { role: "alert", className: "px-1 text-sm text-destructive", children: error }) : null
+        loading ? /* @__PURE__ */ jsx29(VaultSection, { children: /* @__PURE__ */ jsx29(Empty, { children: "Checking what comes back\u2026" }) }) : preview?.supported ? /* @__PURE__ */ jsxs27(VaultSection, { title: "Comes back", children: [
+          /* @__PURE__ */ jsx29(VaultRow, { label: "Fields", children: /* @__PURE__ */ jsx29("span", { className: "text-foreground", children: count(preview.fields, "field") }) }),
+          /* @__PURE__ */ jsx29(VaultRow, { label: "Files", children: /* @__PURE__ */ jsx29("span", { className: "text-foreground", children: count(preview.attachments, "file") }) }),
+          preview.passkeys === 1 ? /* @__PURE__ */ jsx29(VaultRow, { label: "Passkey", hint: "Not turned on; the site may not accept it", children: /* @__PURE__ */ jsx29("span", { className: "text-foreground", children: "1 passkey" }) }) : null,
+          /* @__PURE__ */ jsx29(VaultRow, { label: "Stays off", hint: "Turn each back on yourself", children: /* @__PURE__ */ jsx29("span", { className: "text-muted-foreground", children: "Sharing, browser fill, codes, sandboxes, agents" }) }),
+          preview.priorWasDisabled ? /* @__PURE__ */ jsx29(VaultRow, { label: "Before", children: /* @__PURE__ */ jsx29("span", { className: "text-muted-foreground", children: "It was already off before it was deleted." }) }) : null
+        ] }) : preview ? /* @__PURE__ */ jsx29(VaultSection, { children: /* @__PURE__ */ jsx29(Empty, { children: refusalText(preview.reason) }) }) : /* @__PURE__ */ jsx29(VaultSection, { children: /* @__PURE__ */ jsx29(Empty, { children: "It comes back turned off: sharing, browser fill, codes and sandbox use stay off." }) }),
+        error ? /* @__PURE__ */ jsx29("p", { role: "alert", className: "px-1 text-sm text-destructive", children: error }) : null
       ]
     }
   );
 }
 
 // src/lists/TrashView.tsx
-import { jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
+import { jsx as jsx30, jsxs as jsxs28 } from "react/jsx-runtime";
 function trashLineOf(item) {
   return [item.definitionLabel || null, item.owner.label, item.deletion?.deletedAt ? `Deleted ${formatAbsoluteDate4(item.deletion.deletedAt, DAY_FORMAT, "")}` : null].filter(Boolean).join(" \xB7 ");
 }
 function TrashView({ port, deleted, query, header, onChanged }) {
   const confirmed = useConfirmed();
-  const [busyId, setBusyId] = useState29(null);
-  const [message2, setMessage] = useState29(null);
+  const [busyId, setBusyId] = useState30(null);
+  const [message2, setMessage] = useState30(null);
   const shown = deleted.filter((i) => trashItemMatchesQuery(i, query));
-  const [restoring, setRestoring] = useState29(null);
+  const [restoring, setRestoring] = useState30(null);
   const restore = async (item, deletionId) => {
     setBusyId(item.id);
     setMessage(null);
@@ -6328,32 +6663,32 @@ function TrashView({ port, deleted, query, header, onChanged }) {
       setBusyId(null);
     }
   };
-  return /* @__PURE__ */ jsxs27("div", { className: "flex min-h-0 flex-1 flex-col gap-3 overflow-y-auto p-3", children: [
+  return /* @__PURE__ */ jsxs28("div", { className: "flex min-h-0 flex-1 flex-col gap-3 overflow-y-auto p-3", children: [
     header,
-    /* @__PURE__ */ jsx29(VaultSection, { title: "Trash", children: shown.length === 0 ? /* @__PURE__ */ jsx29(Empty, { children: deleted.length === 0 ? "The trash is empty." : "Nothing matches." }) : shown.map((item) => (
+    /* @__PURE__ */ jsx30(VaultSection, { title: "Trash", children: shown.length === 0 ? /* @__PURE__ */ jsx30(Empty, { children: deleted.length === 0 ? "The trash is empty." : "Nothing matches." }) : shown.map((item) => (
       // A list row, not a field row: the name gets the whole width (on a phone a label column
       // left "Vau…" for every row), the deletion date sits under it.
-      /* @__PURE__ */ jsxs27("div", { className: "flex min-h-12 items-center gap-3 px-3 py-1.5 sm:px-4", children: [
-        /* @__PURE__ */ jsxs27("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
-          /* @__PURE__ */ jsx29("span", { className: "truncate text-sm text-foreground", children: item.name }),
-          /* @__PURE__ */ jsx29("span", { className: "truncate text-xs text-muted-foreground", children: trashLineOf(item) })
+      /* @__PURE__ */ jsxs28("div", { className: "flex min-h-12 items-center gap-3 px-3 py-1.5 sm:px-4", children: [
+        /* @__PURE__ */ jsxs28("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
+          /* @__PURE__ */ jsx30("span", { className: "truncate text-sm text-foreground", children: item.name }),
+          /* @__PURE__ */ jsx30("span", { className: "truncate text-xs text-muted-foreground", children: trashLineOf(item) })
         ] }),
-        /* @__PURE__ */ jsx29(Button24, { variant: "outline", icon: /* @__PURE__ */ jsx29(RestoreGlyph, {}), disabled: busyId !== null || !item.deletion, onClick: () => setRestoring(item), children: "Restore" })
+        /* @__PURE__ */ jsx30(Button25, { variant: "outline", icon: /* @__PURE__ */ jsx30(RestoreGlyph, {}), disabled: busyId !== null || !item.deletion, onClick: () => setRestoring(item), children: "Restore" })
       ] }, item.id)
     )) }),
-    restoring ? /* @__PURE__ */ jsx29(RestorePanel, { lists: port.lists, item: restoring, restore: (deletionId) => restore(restoring, deletionId), onClose: () => setRestoring(null) }) : null,
-    message2 ? /* @__PURE__ */ jsx29("p", { role: "status", className: message2.tone === "error" ? "px-1 text-sm text-destructive" : "px-1 text-sm text-muted-foreground", children: message2.text }) : null
+    restoring ? /* @__PURE__ */ jsx30(RestorePanel, { lists: port.lists, item: restoring, restore: (deletionId) => restore(restoring, deletionId), onClose: () => setRestoring(null) }) : null,
+    message2 ? /* @__PURE__ */ jsx30("p", { role: "status", className: message2.tone === "error" ? "px-1 text-sm text-destructive" : "px-1 text-sm text-muted-foreground", children: message2.text }) : null
   ] });
 }
 
 // src/NewItemFlow.tsx
-import { useMemo as useMemo4, useState as useState30 } from "react";
+import { useMemo as useMemo4, useState as useState31 } from "react";
 import { cn as cn14 } from "@ai-matrx/design-system";
-import { Button as Button25, Field as Field10, SearchField as SearchField2 } from "@ai-matrx/design-system/controls";
+import { Button as Button26, Field as Field11, SearchField as SearchField2 } from "@ai-matrx/design-system/controls";
 import { GlobeIcon as GlobeIcon3 } from "@ai-matrx/design-system/icons";
-import { jsx as jsx30, jsxs as jsxs28 } from "react/jsx-runtime";
+import { jsx as jsx31, jsxs as jsxs29 } from "react/jsx-runtime";
 function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
-  const [search, setSearch] = useState30("");
+  const [search, setSearch] = useState31("");
   const guess = useMemo4(() => inferFromUrl(url, definitions), [url, definitions]);
   const common = COMMON_DEFINITION_KEYS.map((k) => definitions.find((d) => d.key === k)).filter((d) => d !== void 0);
   const matches = useMemo4(() => {
@@ -6365,15 +6700,15 @@ function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
   const alternatives = (guess?.alternatives ?? []).map((k) => definitions.find((d) => d.key === k)).filter((d) => d !== void 0).slice(0, 4);
   const use = (d) => onChoose(d.key, guess?.name ?? "", guess?.url ?? url.trim());
   const shown = search.trim() ? matches : common;
-  return /* @__PURE__ */ jsxs28("div", { className: "flex h-full min-h-0 flex-col bg-background", children: [
-    /* @__PURE__ */ jsxs28("header", { className: "flex min-h-14 items-center gap-2 border-b border-border px-3 sm:px-5", children: [
-      /* @__PURE__ */ jsx30(Button25, { variant: "quiet", icon: /* @__PURE__ */ jsx30(ChevronLeftGlyph, {}), "aria-label": "Cancel", onClick: onCancel }),
-      /* @__PURE__ */ jsx30("h2", { className: "text-base font-semibold", children: "New item" })
+  return /* @__PURE__ */ jsxs29("div", { className: "flex h-full min-h-0 flex-col bg-background", children: [
+    /* @__PURE__ */ jsxs29("header", { className: "flex min-h-14 items-center gap-2 border-b border-border px-3 sm:px-5", children: [
+      /* @__PURE__ */ jsx31(Button26, { variant: "quiet", icon: /* @__PURE__ */ jsx31(ChevronLeftGlyph, {}), "aria-label": "Cancel", onClick: onCancel }),
+      /* @__PURE__ */ jsx31("h2", { className: "text-base font-semibold", children: "New item" })
     ] }),
-    /* @__PURE__ */ jsx30("div", { className: "min-h-0 flex-1 overflow-y-auto", children: /* @__PURE__ */ jsxs28("div", { className: "mx-auto flex w-full max-w-2xl flex-col gap-8 px-4 py-8 sm:px-6 sm:py-12", children: [
-      /* @__PURE__ */ jsxs28("div", { className: "flex flex-col gap-3", children: [
-        /* @__PURE__ */ jsx30(
-          Field10,
+    /* @__PURE__ */ jsx31("div", { className: "min-h-0 flex-1 overflow-y-auto", children: /* @__PURE__ */ jsxs29("div", { className: "mx-auto flex w-full max-w-2xl flex-col gap-8 px-4 py-8 sm:px-6 sm:py-12", children: [
+      /* @__PURE__ */ jsxs29("div", { className: "flex flex-col gap-3", children: [
+        /* @__PURE__ */ jsx31(
+          Field11,
           {
             hero: true,
             value: url,
@@ -6385,45 +6720,45 @@ function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
             "aria-label": "Website address",
             inputMode: "url",
             autoFocus: true,
-            icon: /* @__PURE__ */ jsx30(GlobeIcon3, {})
+            icon: /* @__PURE__ */ jsx31(GlobeIcon3, {})
           }
         ),
-        guess && login ? /* @__PURE__ */ jsxs28("div", { className: "flex flex-col gap-2 rounded-xl border border-border bg-card p-3", children: [
-          /* @__PURE__ */ jsxs28("div", { className: "flex items-center gap-3", children: [
-            /* @__PURE__ */ jsx30("span", { "aria-hidden": true, className: "flex size-9 shrink-0 items-center justify-center rounded-lg bg-muted text-sm font-semibold", children: guess.name.charAt(0).toUpperCase() }),
-            /* @__PURE__ */ jsxs28("div", { className: "flex min-w-0 flex-1 flex-col", children: [
-              /* @__PURE__ */ jsx30("span", { className: "truncate text-sm font-medium", children: guess.name }),
-              /* @__PURE__ */ jsx30("span", { className: "truncate text-xs text-muted-foreground", children: guess.url.replace(/^https?:\/\//, "") })
+        guess && login ? /* @__PURE__ */ jsxs29("div", { className: "flex flex-col gap-2 rounded-xl border border-border bg-card p-3", children: [
+          /* @__PURE__ */ jsxs29("div", { className: "flex items-center gap-3", children: [
+            /* @__PURE__ */ jsx31("span", { "aria-hidden": true, className: "flex size-9 shrink-0 items-center justify-center rounded-lg bg-muted text-sm font-semibold", children: guess.name.charAt(0).toUpperCase() }),
+            /* @__PURE__ */ jsxs29("div", { className: "flex min-w-0 flex-1 flex-col", children: [
+              /* @__PURE__ */ jsx31("span", { className: "truncate text-sm font-medium", children: guess.name }),
+              /* @__PURE__ */ jsx31("span", { className: "truncate text-xs text-muted-foreground", children: guess.url.replace(/^https?:\/\//, "") })
             ] }),
-            /* @__PURE__ */ jsx30(Button25, { variant: "primary", onClick: () => use(login), children: "Save login" })
+            /* @__PURE__ */ jsx31(Button26, { variant: "primary", onClick: () => use(login), children: "Save login" })
           ] }),
-          alternatives.length > 0 ? /* @__PURE__ */ jsxs28("div", { className: "flex flex-wrap items-center gap-1.5 pl-12", children: [
-            /* @__PURE__ */ jsx30("span", { className: "text-xs text-muted-foreground", children: "Or" }),
-            alternatives.map((d) => /* @__PURE__ */ jsx30(Button25, { variant: "outline", onClick: () => use(d), children: d.label }, d.key))
+          alternatives.length > 0 ? /* @__PURE__ */ jsxs29("div", { className: "flex flex-wrap items-center gap-1.5 pl-12", children: [
+            /* @__PURE__ */ jsx31("span", { className: "text-xs text-muted-foreground", children: "Or" }),
+            alternatives.map((d) => /* @__PURE__ */ jsx31(Button26, { variant: "outline", onClick: () => use(d), children: d.label }, d.key))
           ] }) : null
-        ] }) : url.trim() ? /* @__PURE__ */ jsx30("p", { className: "px-1 text-sm text-muted-foreground", children: "Not a website address. Pick a type below; it is kept." }) : null
+        ] }) : url.trim() ? /* @__PURE__ */ jsx31("p", { className: "px-1 text-sm text-muted-foreground", children: "Not a website address. Pick a type below; it is kept." }) : null
       ] }),
-      /* @__PURE__ */ jsxs28("div", { className: "flex flex-col gap-3", children: [
-        /* @__PURE__ */ jsx30("div", { className: "flex items-center justify-between gap-3", children: /* @__PURE__ */ jsx30("h3", { className: "text-xs font-medium text-muted-foreground", children: search.trim() ? "Matching types" : "Or choose a type" }) }),
-        /* @__PURE__ */ jsx30("ul", { className: "grid grid-cols-1 gap-2 sm:grid-cols-2", children: shown.map((d) => {
+      /* @__PURE__ */ jsxs29("div", { className: "flex flex-col gap-3", children: [
+        /* @__PURE__ */ jsx31("div", { className: "flex items-center justify-between gap-3", children: /* @__PURE__ */ jsx31("h3", { className: "text-xs font-medium text-muted-foreground", children: search.trim() ? "Matching types" : "Or choose a type" }) }),
+        /* @__PURE__ */ jsx31("ul", { className: "grid grid-cols-1 gap-2 sm:grid-cols-2", children: shown.map((d) => {
           const Icon = definitionGlyph(d.key, d.family);
-          return /* @__PURE__ */ jsx30("li", { children: /* @__PURE__ */ jsxs28("button", { type: "button", onClick: () => use(d), className: cn14("flex h-12 w-full items-center gap-3 rounded-xl border border-border bg-card px-3 text-left hover:bg-accent"), children: [
-            /* @__PURE__ */ jsx30("span", { className: "flex size-8 shrink-0 items-center justify-center rounded-lg bg-muted", children: /* @__PURE__ */ jsx30(Icon, { className: "size-4" }) }),
-            /* @__PURE__ */ jsx30("span", { className: "min-w-0 flex-1 truncate text-sm font-medium", children: d.label })
+          return /* @__PURE__ */ jsx31("li", { children: /* @__PURE__ */ jsxs29("button", { type: "button", onClick: () => use(d), className: cn14("flex h-12 w-full items-center gap-3 rounded-xl border border-border bg-card px-3 text-left hover:bg-accent"), children: [
+            /* @__PURE__ */ jsx31("span", { className: "flex size-8 shrink-0 items-center justify-center rounded-lg bg-muted", children: /* @__PURE__ */ jsx31(Icon, { className: "size-4" }) }),
+            /* @__PURE__ */ jsx31("span", { className: "min-w-0 flex-1 truncate text-sm font-medium", children: d.label })
           ] }) }, d.key);
         }) }),
-        search.trim() && matches.length === 0 ? /* @__PURE__ */ jsx30("p", { className: "px-1 text-sm text-muted-foreground", children: "No type matches." }) : null,
-        /* @__PURE__ */ jsx30(SearchField2, { value: search, onChange: (e) => setSearch(e.target.value), placeholder: `Search all ${definitions.length} types`, "aria-label": "Search types" })
+        search.trim() && matches.length === 0 ? /* @__PURE__ */ jsx31("p", { className: "px-1 text-sm text-muted-foreground", children: "No type matches." }) : null,
+        /* @__PURE__ */ jsx31(SearchField2, { value: search, onChange: (e) => setSearch(e.target.value), placeholder: `Search all ${definitions.length} types`, "aria-label": "Search types" })
       ] })
     ] }) })
   ] });
 }
 
 // src/sharing/SecureLinkPanel.tsx
-import { useEffect as useEffect19, useRef as useRef16, useState as useState31 } from "react";
-import { confirm as confirm10 } from "@ai-matrx/kit/confirm-opener";
+import { useEffect as useEffect19, useRef as useRef16, useState as useState32 } from "react";
+import { confirm as confirm11 } from "@ai-matrx/kit/confirm-opener";
 import { Checkbox as Checkbox2 } from "@ai-matrx/design-system";
-import { Badge as Badge8, Button as Button26, Field as Field11, RegionSkeleton as RegionSkeleton2, SegmentedControl as SegmentedControl5, Textarea as Textarea4 } from "@ai-matrx/design-system/controls";
+import { Badge as Badge8, Button as Button27, Field as Field12, RegionSkeleton as RegionSkeleton2, SegmentedControl as SegmentedControl6, Textarea as Textarea4 } from "@ai-matrx/design-system/controls";
 import { formatAbsoluteDate as formatAbsoluteDate5 } from "@ai-matrx/kit/format";
 
 // src/sharing/secure-link-logic.ts
@@ -6499,23 +6834,23 @@ function sortSent(rows) {
 }
 
 // src/sharing/SecureLinkPanel.tsx
-import { jsx as jsx31, jsxs as jsxs29 } from "react/jsx-runtime";
+import { jsx as jsx32, jsxs as jsxs30 } from "react/jsx-runtime";
 function SecureLinkPanel({ item, port, onClose }) {
   const sharing = port.sharing;
   const { busy, error, notice, run, setNotice } = useConfirmedChange();
-  const [remedy, setRemedy] = useState31(null);
-  const [options, setOptions] = useState31(null);
-  const [optionsError, setOptionsError] = useState31(null);
-  const [sent, setSent] = useState31(null);
-  const [sentError, setSentError] = useState31(null);
-  const [nonce, setNonce] = useState31(0);
-  const [email, setEmail] = useState31("");
-  const [phone, setPhone] = useState31("");
-  const [name, setName] = useState31("");
-  const [linkBy, setLinkBy] = useState31("email");
-  const [fields, setFields] = useState31([]);
-  const [note, setNote] = useState31("");
-  const [sameChannelSent, setSameChannelSent] = useState31(false);
+  const [remedy, setRemedy] = useState32(null);
+  const [options, setOptions] = useState32(null);
+  const [optionsError, setOptionsError] = useState32(null);
+  const [sent, setSent] = useState32(null);
+  const [sentError, setSentError] = useState32(null);
+  const [nonce, setNonce] = useState32(0);
+  const [email, setEmail] = useState32("");
+  const [phone, setPhone] = useState32("");
+  const [name, setName] = useState32("");
+  const [linkBy, setLinkBy] = useState32("email");
+  const [fields, setFields] = useState32([]);
+  const [note, setNote] = useState32("");
+  const [sameChannelSent, setSameChannelSent] = useState32(false);
   useEffect19(() => {
     let live = true;
     setOptionsError(null);
@@ -6544,7 +6879,7 @@ function SecureLinkPanel({ item, port, onClose }) {
       live = false;
     };
   }, [sharing, item, nonce]);
-  const [phoneTyped, setPhoneTyped] = useState31(false);
+  const [phoneTyped, setPhoneTyped] = useState32(false);
   const prefilled = useRef16(false);
   useEffect19(() => {
     const lookup = sharing.phoneOnFile;
@@ -6608,7 +6943,7 @@ function SecureLinkPanel({ item, port, onClose }) {
     setNonce((n) => n + 1);
   };
   const turnOff = async (row) => {
-    const ok = await confirm10({
+    const ok = await confirm11({
       title: "Turn off this link?",
       description: `The link to ${recipientOf(row)} stops working at once and what it carries is deleted. They will need a new one.`,
       confirmLabel: "Turn off",
@@ -6621,23 +6956,23 @@ function SecureLinkPanel({ item, port, onClose }) {
     setNonce((n) => n + 1);
   };
   const toggle2 = (key, on) => setFields((cur) => on ? [...cur.filter((k) => k !== key), key] : cur.filter((k) => k !== key));
-  return /* @__PURE__ */ jsxs29(
+  return /* @__PURE__ */ jsxs30(
     Panel,
     {
       title: "Send securely",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs29(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx31(StatusLine, { error, notice }) : null, children: [
-        sameChannelSent && !error ? /* @__PURE__ */ jsx31(Badge8, { tone: "warning", children: "Both by email" }) : null,
-        /* @__PURE__ */ jsx31(Button26, { variant: "quiet", onClick: onClose, children: "Close" }),
-        /* @__PURE__ */ jsx31(Button26, { variant: "primary", disabled: !canSend, onClick: () => void send(), children: busy === "send" ? "Sending\u2026" : "Send link" })
+      footer: /* @__PURE__ */ jsxs30(PanelFooter, { status: error || notice ? /* @__PURE__ */ jsx32(StatusLine, { error, notice }) : null, children: [
+        sameChannelSent && !error ? /* @__PURE__ */ jsx32(Badge8, { tone: "warning", children: "Both by email" }) : null,
+        /* @__PURE__ */ jsx32(Button27, { variant: "quiet", onClick: onClose, children: "Close" }),
+        /* @__PURE__ */ jsx32(Button27, { variant: "primary", disabled: !canSend, onClick: () => void send(), children: busy === "send" ? "Sending\u2026" : "Send link" })
       ] }),
       children: [
-        remedy ? /* @__PURE__ */ jsx31("p", { className: "px-1 text-xs text-muted-foreground", children: remedy }) : null,
-        /* @__PURE__ */ jsxs29(VaultSection, { title: "Recipient", children: [
-          /* @__PURE__ */ jsx31(VaultRow, { label: "Email", children: /* @__PURE__ */ jsx31(Field11, { type: "email", autoComplete: "off", placeholder: "name@example.com", "aria-label": "Their email", value: email, onChange: (e) => setEmail(e.target.value), className: "w-full" }) }),
-          /* @__PURE__ */ jsx31(VaultRow, { label: "Mobile", hint: "For the code", children: /* @__PURE__ */ jsx31(
-            Field11,
+        remedy ? /* @__PURE__ */ jsx32("p", { className: "px-1 text-xs text-muted-foreground", children: remedy }) : null,
+        /* @__PURE__ */ jsxs30(VaultSection, { title: "Recipient", children: [
+          /* @__PURE__ */ jsx32(VaultRow, { label: "Email", children: /* @__PURE__ */ jsx32(Field12, { type: "email", autoComplete: "off", placeholder: "name@example.com", "aria-label": "Their email", value: email, onChange: (e) => setEmail(e.target.value), className: "w-full" }) }),
+          /* @__PURE__ */ jsx32(VaultRow, { label: "Mobile", hint: "For the code", children: /* @__PURE__ */ jsx32(
+            Field12,
             {
               type: "tel",
               autoComplete: "off",
@@ -6652,9 +6987,9 @@ function SecureLinkPanel({ item, port, onClose }) {
               className: "w-full"
             }
           ) }),
-          /* @__PURE__ */ jsx31(VaultRow, { label: "Name", hint: "Optional", children: /* @__PURE__ */ jsx31(Field11, { autoComplete: "off", placeholder: "Their name", "aria-label": "Their name", value: name, onChange: (e) => setName(e.target.value), className: "w-full" }) }),
-          plan && !plan.same ? /* @__PURE__ */ jsx31(VaultRow, { label: "Link by", children: /* @__PURE__ */ jsx31(
-            SegmentedControl5,
+          /* @__PURE__ */ jsx32(VaultRow, { label: "Name", hint: "Optional", children: /* @__PURE__ */ jsx32(Field12, { autoComplete: "off", placeholder: "Their name", "aria-label": "Their name", value: name, onChange: (e) => setName(e.target.value), className: "w-full" }) }),
+          plan && !plan.same ? /* @__PURE__ */ jsx32(VaultRow, { label: "Link by", children: /* @__PURE__ */ jsx32(
+            SegmentedControl6,
             {
               "aria-label": "Send the link by",
               value: linkBy,
@@ -6665,28 +7000,28 @@ function SecureLinkPanel({ item, port, onClose }) {
               ]
             }
           ) }) : null,
-          email.trim() ? /* @__PURE__ */ jsx31(VaultRow, { label: "Delivery", children: /* @__PURE__ */ jsx31("span", { className: plan?.same ? "text-warning" : "text-foreground", children: planWords(plan) }) }) : null
+          email.trim() ? /* @__PURE__ */ jsx32(VaultRow, { label: "Delivery", children: /* @__PURE__ */ jsx32("span", { className: plan?.same ? "text-warning" : "text-foreground", children: planWords(plan) }) }) : null
         ] }),
-        /* @__PURE__ */ jsx31(VaultSection, { title: "Include", children: optionsError ? /* @__PURE__ */ jsx31(Empty, { children: /* @__PURE__ */ jsx31("span", { className: "text-destructive", children: optionsError }) }) : !options ? /* @__PURE__ */ jsx31(RegionSkeleton2, { shape: "rows", count: 2, "aria-label": "Loading what can be sent", className: "px-3 sm:px-4" }) : options.fields.length === 0 ? /* @__PURE__ */ jsx31(Empty, { children: "Name and details only" }) : options.fields.map((f) => /* @__PURE__ */ jsxs29("label", { className: "flex min-h-11 items-center gap-3 px-3 py-1 sm:px-4", "data-clickable": f.available ? "" : void 0, children: [
-          /* @__PURE__ */ jsx31(Checkbox2, { checked: fields.includes(f.key), disabled: !f.available, onCheckedChange: (v) => toggle2(f.key, v === true), "aria-label": f.label }),
-          /* @__PURE__ */ jsx31("span", { className: "min-w-0 flex-1 truncate text-sm text-foreground", children: f.label }),
-          !f.available && f.reason ? /* @__PURE__ */ jsx31("span", { className: "min-w-0 max-w-[55%] truncate text-xs text-muted-foreground", title: f.reason, children: f.reason }) : null
+        /* @__PURE__ */ jsx32(VaultSection, { title: "Include", children: optionsError ? /* @__PURE__ */ jsx32(Empty, { children: /* @__PURE__ */ jsx32("span", { className: "text-destructive", children: optionsError }) }) : !options ? /* @__PURE__ */ jsx32(RegionSkeleton2, { shape: "rows", count: 2, "aria-label": "Loading what can be sent", className: "px-3 sm:px-4" }) : options.fields.length === 0 ? /* @__PURE__ */ jsx32(Empty, { children: "Name and details only" }) : options.fields.map((f) => /* @__PURE__ */ jsxs30("label", { className: "flex min-h-11 items-center gap-3 px-3 py-1 sm:px-4", "data-clickable": f.available ? "" : void 0, children: [
+          /* @__PURE__ */ jsx32(Checkbox2, { checked: fields.includes(f.key), disabled: !f.available, onCheckedChange: (v) => toggle2(f.key, v === true), "aria-label": f.label }),
+          /* @__PURE__ */ jsx32("span", { className: "min-w-0 flex-1 truncate text-sm text-foreground", children: f.label }),
+          !f.available && f.reason ? /* @__PURE__ */ jsx32("span", { className: "min-w-0 max-w-[55%] truncate text-xs text-muted-foreground", title: f.reason, children: f.reason }) : null
         ] }, f.key)) }),
-        /* @__PURE__ */ jsx31(VaultSection, { title: "Message", children: /* @__PURE__ */ jsx31("div", { className: "px-3 py-1 sm:px-4", children: /* @__PURE__ */ jsx31(Textarea4, { className: "w-full", rows: 2, maxLength: NOTE_MAX, placeholder: "Shown once, with it", "aria-label": "Message", value: note, onChange: (e) => setNote(e.target.value) }) }) }),
-        options ? /* @__PURE__ */ jsxs29(VaultSection, { title: "Link", children: [
-          /* @__PURE__ */ jsx31(VaultRow, { label: "Opens", children: /* @__PURE__ */ jsx31("span", { className: "text-foreground", children: "Once" }) }),
-          /* @__PURE__ */ jsx31(VaultRow, { label: "Link expires", children: /* @__PURE__ */ jsxs29("span", { className: "text-foreground", children: [
+        /* @__PURE__ */ jsx32(VaultSection, { title: "Message", children: /* @__PURE__ */ jsx32("div", { className: "px-3 py-1 sm:px-4", children: /* @__PURE__ */ jsx32(Textarea4, { className: "w-full", rows: 2, maxLength: NOTE_MAX, placeholder: "Shown once, with it", "aria-label": "Message", value: note, onChange: (e) => setNote(e.target.value) }) }) }),
+        options ? /* @__PURE__ */ jsxs30(VaultSection, { title: "Link", children: [
+          /* @__PURE__ */ jsx32(VaultRow, { label: "Opens", children: /* @__PURE__ */ jsx32("span", { className: "text-foreground", children: "Once" }) }),
+          /* @__PURE__ */ jsx32(VaultRow, { label: "Link expires", children: /* @__PURE__ */ jsxs30("span", { className: "text-foreground", children: [
             "After ",
             lifetimeWords(options.linkMinutes)
           ] }) }),
-          /* @__PURE__ */ jsx31(VaultRow, { label: "Code expires", children: /* @__PURE__ */ jsxs29("span", { className: "text-foreground", children: [
+          /* @__PURE__ */ jsx32(VaultRow, { label: "Code expires", children: /* @__PURE__ */ jsxs30("span", { className: "text-foreground", children: [
             "After ",
             lifetimeWords(options.codeMinutes)
           ] }) })
         ] }) : null,
-        sharing.sentSecureLinks ? /* @__PURE__ */ jsx31(VaultSection, { title: "Sent links", children: sentError ? /* @__PURE__ */ jsx31(Empty, { children: /* @__PURE__ */ jsx31("span", { className: "text-destructive", children: sentError }) }) : !sent ? /* @__PURE__ */ jsx31(RegionSkeleton2, { shape: "rows", count: 2, "aria-label": "Loading sent links", className: "px-3 sm:px-4" }) : sent.length === 0 ? /* @__PURE__ */ jsx31(Empty, { children: "None yet" }) : sent.map((row) => /* @__PURE__ */ jsxs29(AccessLine, { glyph: row.status === "pending" ? ClockGlyph : row.fieldKeys.length ? LockGlyph : ShareGlyph, who: recipientOf(row), meta: sentMeta(row, options), children: [
-          /* @__PURE__ */ jsx31(Badge8, { tone: STATUS_TONE[row.status] ?? "neutral", children: statusWord(row.status) }),
-          row.status === "pending" ? /* @__PURE__ */ jsx31(Button26, { variant: "quiet", disabled: busy !== null, onClick: () => void turnOff(row), children: "Turn off" }) : null
+        sharing.sentSecureLinks ? /* @__PURE__ */ jsx32(VaultSection, { title: "Sent links", children: sentError ? /* @__PURE__ */ jsx32(Empty, { children: /* @__PURE__ */ jsx32("span", { className: "text-destructive", children: sentError }) }) : !sent ? /* @__PURE__ */ jsx32(RegionSkeleton2, { shape: "rows", count: 2, "aria-label": "Loading sent links", className: "px-3 sm:px-4" }) : sent.length === 0 ? /* @__PURE__ */ jsx32(Empty, { children: "None yet" }) : sent.map((row) => /* @__PURE__ */ jsxs30(AccessLine, { glyph: row.status === "pending" ? ClockGlyph : row.fieldKeys.length ? LockGlyph : ShareGlyph, who: recipientOf(row), meta: sentMeta(row, options), children: [
+          /* @__PURE__ */ jsx32(Badge8, { tone: STATUS_TONE[row.status] ?? "neutral", children: statusWord(row.status) }),
+          row.status === "pending" ? /* @__PURE__ */ jsx32(Button27, { variant: "quiet", disabled: busy !== null, onClick: () => void turnOff(row), children: "Turn off" }) : null
         ] }, row.id)) }) : null
       ]
     }
@@ -6699,9 +7034,9 @@ function sentMeta(row, options) {
 }
 
 // src/devices/DevicesPanel.tsx
-import { useCallback as useCallback4, useEffect as useEffect20, useState as useState32 } from "react";
-import { confirm as confirm11 } from "@ai-matrx/kit/confirm-opener";
-import { Button as Button27, RegionSkeleton as RegionSkeleton3 } from "@ai-matrx/design-system/controls";
+import { useCallback as useCallback4, useEffect as useEffect20, useState as useState33 } from "react";
+import { confirm as confirm12 } from "@ai-matrx/kit/confirm-opener";
+import { Button as Button28, RegionSkeleton as RegionSkeleton3 } from "@ai-matrx/design-system/controls";
 import { formatAbsoluteDate as formatAbsoluteDate6 } from "@ai-matrx/kit/format";
 
 // src/devices/logic.ts
@@ -6782,17 +7117,17 @@ function addPasskeyFailure(message2) {
 var isRevoked = (d) => d.revokedAt !== null;
 
 // src/devices/DevicesPanel.tsx
-import { Fragment as Fragment18, jsx as jsx32, jsxs as jsxs30 } from "react/jsx-runtime";
+import { Fragment as Fragment19, jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
 var messageOf3 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function ErrorLine2({ text }) {
-  return text ? /* @__PURE__ */ jsx32("p", { role: "alert", className: "px-1 text-sm text-destructive", children: text }) : null;
+  return text ? /* @__PURE__ */ jsx33("p", { role: "alert", className: "px-1 text-sm text-destructive", children: text }) : null;
 }
 function DevicesPanel({ port, onClose }) {
   const confirmed = useConfirmed();
   const notify = useNotify();
-  const [devices, setDevices] = useState32(null);
-  const [error, setError] = useState32(null);
-  const [busyId, setBusyId] = useState32(null);
+  const [devices, setDevices] = useState33(null);
+  const [error, setError] = useState33(null);
+  const [busyId, setBusyId] = useState33(null);
   const load = useCallback4(async () => {
     setError(null);
     try {
@@ -6805,7 +7140,7 @@ function DevicesPanel({ port, onClose }) {
     void load();
   }, [load]);
   const revoke = async (device) => {
-    const yes = await confirm11({
+    const yes = await confirm12({
       title: `Revoke ${device.label}?`,
       description: "It stops filling now and the extension there signs out. It fills again only after you sign in there and confirm.",
       confirmLabel: "Revoke",
@@ -6824,19 +7159,19 @@ function DevicesPanel({ port, onClose }) {
       setBusyId(null);
     }
   };
-  return /* @__PURE__ */ jsxs30(Panel, { title: "Browsers that can fill", onClose, size: "md", children: [
-    /* @__PURE__ */ jsx32(ErrorLine2, { text: error }),
-    /* @__PURE__ */ jsx32(VaultSection, { children: devices === null ? error ? /* @__PURE__ */ jsx32(Empty, { children: /* @__PURE__ */ jsx32(Button27, { variant: "outline", onClick: () => void load(), children: "Try again" }) }) : /* @__PURE__ */ jsx32(RegionSkeleton3, { shape: "rows", count: 2, "aria-label": "Loading your browsers", className: "px-3 sm:px-4" }) : devices.length === 0 ? /* @__PURE__ */ jsx32(Empty, { children: "No browser can fill yet. Turn it on in the extension." }) : devices.map((device) => {
+  return /* @__PURE__ */ jsxs31(Panel, { title: "Browsers that can fill", onClose, size: "md", children: [
+    /* @__PURE__ */ jsx33(ErrorLine2, { text: error }),
+    /* @__PURE__ */ jsx33(VaultSection, { children: devices === null ? error ? /* @__PURE__ */ jsx33(Empty, { children: /* @__PURE__ */ jsx33(Button28, { variant: "outline", onClick: () => void load(), children: "Try again" }) }) : /* @__PURE__ */ jsx33(RegionSkeleton3, { shape: "rows", count: 2, "aria-label": "Loading your browsers", className: "px-3 sm:px-4" }) : devices.length === 0 ? /* @__PURE__ */ jsx33(Empty, { children: "No browser can fill yet. Turn it on in the extension." }) : devices.map((device) => {
       const off = isRevoked(device);
-      return /* @__PURE__ */ jsx32(
+      return /* @__PURE__ */ jsx33(
         VaultRow,
         {
           label: off ? "Turned off" : "Can fill",
           hint: off ? formatAbsoluteDate6(device.revokedAt, DAY_FORMAT, "") : void 0,
-          actions: off ? null : /* @__PURE__ */ jsx32(Button27, { variant: "outline", icon: /* @__PURE__ */ jsx32(PowerGlyph, {}), disabled: busyId !== null, onClick: () => void revoke(device), children: "Revoke" }),
-          children: /* @__PURE__ */ jsxs30("span", { className: "flex min-w-0 flex-col", children: [
-            /* @__PURE__ */ jsx32("span", { className: off ? "truncate text-muted-foreground" : "truncate text-foreground", children: device.label }),
-            /* @__PURE__ */ jsxs30("span", { className: "truncate text-xs text-muted-foreground", children: [
+          actions: off ? null : /* @__PURE__ */ jsx33(Button28, { variant: "outline", icon: /* @__PURE__ */ jsx33(PowerGlyph, {}), disabled: busyId !== null, onClick: () => void revoke(device), children: "Revoke" }),
+          children: /* @__PURE__ */ jsxs31("span", { className: "flex min-w-0 flex-col", children: [
+            /* @__PURE__ */ jsx33("span", { className: off ? "truncate text-muted-foreground" : "truncate text-foreground", children: device.label }),
+            /* @__PURE__ */ jsxs31("span", { className: "truncate text-xs text-muted-foreground", children: [
               device.lastUsedAt ? `Last used ${formatAbsoluteDate6(device.lastUsedAt, void 0, "")}` : "Never used",
               device.addedAt ? ` \xB7 added ${formatAbsoluteDate6(device.addedAt, DAY_FORMAT, "")}` : ""
             ] })
@@ -6859,10 +7194,10 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
   const where = isMac ? "the Mac app" : "the extension";
   const passkeys = port.devices.passkeys;
   const here = passkeys?.available() ?? false;
-  const [methods, setMethods] = useState32(null);
-  const [busy, setBusy] = useState32(null);
-  const [error, setError] = useState32(null);
-  const [approvedUntil, setApprovedUntil] = useState32(null);
+  const [methods, setMethods] = useState33(null);
+  const [busy, setBusy] = useState33(null);
+  const [error, setError] = useState33(null);
+  const [approvedUntil, setApprovedUntil] = useState33(null);
   const load = useCallback4(async () => {
     setError(null);
     try {
@@ -6913,55 +7248,55 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
   };
   const canApprove = Boolean(key && passkeys && here && methods?.passkey && !approvedUntil);
   const title = isMac ? "Approve this Mac" : name ? `Approve ${name}` : "Approve this browser";
-  const footer = approvedUntil ? /* @__PURE__ */ jsx32(Button27, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs30(Fragment18, { children: [
-    /* @__PURE__ */ jsx32(Button27, { variant: "quiet", disabled: busy !== null, onClick: refuse, children: key ? "Refuse" : "Close" }),
-    canApprove ? /* @__PURE__ */ jsx32(Button27, { variant: "primary", icon: /* @__PURE__ */ jsx32(FingerprintGlyph, {}), disabled: busy !== null, onClick: () => void approve(), children: busy === "approve" ? "Approving\u2026" : "Approve with passkey" }) : null
+  const footer = approvedUntil ? /* @__PURE__ */ jsx33(Button28, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs31(Fragment19, { children: [
+    /* @__PURE__ */ jsx33(Button28, { variant: "quiet", disabled: busy !== null, onClick: refuse, children: key ? "Refuse" : "Close" }),
+    canApprove ? /* @__PURE__ */ jsx33(Button28, { variant: "primary", icon: /* @__PURE__ */ jsx33(FingerprintGlyph, {}), disabled: busy !== null, onClick: () => void approve(), children: busy === "approve" ? "Approving\u2026" : "Approve with passkey" }) : null
   ] });
-  return /* @__PURE__ */ jsx32(Panel, { title, onClose: refuse, size: "sm", footer, children: !key ? /* @__PURE__ */ jsx32(VaultSection, { children: /* @__PURE__ */ jsxs30(Empty, { children: [
+  return /* @__PURE__ */ jsx33(Panel, { title, onClose: refuse, size: "sm", footer, children: !key ? /* @__PURE__ */ jsx33(VaultSection, { children: /* @__PURE__ */ jsxs31(Empty, { children: [
     "This link names no key. Start again from ",
     where,
     "."
-  ] }) }) : /* @__PURE__ */ jsxs30(Fragment18, { children: [
-    /* @__PURE__ */ jsxs30(VaultSection, { title: "What is asking", children: [
-      /* @__PURE__ */ jsx32(VaultRow, { label: "Asking", hint: "Approve only if you just asked", children: asker }),
-      name ? /* @__PURE__ */ jsx32(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx32("span", { className: "block truncate", children: name }) }) : null,
-      /* @__PURE__ */ jsx32(VaultRow, { label: "Code", hint: `Must match ${where}`, children: /* @__PURE__ */ jsx32("span", { className: "font-mono tracking-wider text-foreground", children: shortFingerprint(key) }) })
+  ] }) }) : /* @__PURE__ */ jsxs31(Fragment19, { children: [
+    /* @__PURE__ */ jsxs31(VaultSection, { title: "What is asking", children: [
+      /* @__PURE__ */ jsx33(VaultRow, { label: "Asking", hint: "Approve only if you just asked", children: asker }),
+      name ? /* @__PURE__ */ jsx33(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx33("span", { className: "block truncate", children: name }) }) : null,
+      /* @__PURE__ */ jsx33(VaultRow, { label: "Code", hint: `Must match ${where}`, children: /* @__PURE__ */ jsx33("span", { className: "font-mono tracking-wider text-foreground", children: shortFingerprint(key) }) })
     ] }),
-    /* @__PURE__ */ jsx32(ErrorLine2, { text: error }),
-    /* @__PURE__ */ jsx32(VaultSection, { title: "Confirm it\u2019s you", children: approvedUntil ? /* @__PURE__ */ jsx32(VaultRow, { label: "Approved", actions: /* @__PURE__ */ jsx32(CheckGlyph, { className: "size-4 text-primary" }), children: /* @__PURE__ */ jsxs30("span", { className: "text-foreground", children: [
+    /* @__PURE__ */ jsx33(ErrorLine2, { text: error }),
+    /* @__PURE__ */ jsx33(VaultSection, { title: "Confirm it\u2019s you", children: approvedUntil ? /* @__PURE__ */ jsx33(VaultRow, { label: "Approved", actions: /* @__PURE__ */ jsx33(CheckGlyph, { className: "size-4 text-primary" }), children: /* @__PURE__ */ jsxs31("span", { className: "text-foreground", children: [
       "Return to ",
       where,
       " by ",
       formatAbsoluteDate6(approvedUntil, void 0, ""),
       "."
-    ] }) }) : !passkeys ? /* @__PURE__ */ jsxs30(Empty, { children: [
+    ] }) }) : !passkeys ? /* @__PURE__ */ jsxs31(Empty, { children: [
       "Approve with your password in ",
       where,
       "."
-    ] }) : !here ? /* @__PURE__ */ jsx32(
+    ] }) : !here ? /* @__PURE__ */ jsx33(
       VaultRow,
       {
         label: "Passkey",
         hint: `Passkeys work only on ${passkeys.rpId}`,
-        actions: /* @__PURE__ */ jsx32(Button27, { variant: "outline", icon: /* @__PURE__ */ jsx32(ExternalGlyph, {}), onClick: openOnDomain, children: "Open there" }),
-        children: /* @__PURE__ */ jsx32("span", { className: "text-muted-foreground", children: "Not on this page" })
+        actions: /* @__PURE__ */ jsx33(Button28, { variant: "outline", icon: /* @__PURE__ */ jsx33(ExternalGlyph, {}), onClick: openOnDomain, children: "Open there" }),
+        children: /* @__PURE__ */ jsx33("span", { className: "text-muted-foreground", children: "Not on this page" })
       }
-    ) : methods === null ? error ? /* @__PURE__ */ jsx32(Empty, { children: /* @__PURE__ */ jsx32(Button27, { variant: "outline", onClick: () => void load(), children: "Try again" }) }) : /* @__PURE__ */ jsx32(RegionSkeleton3, { shape: "rows", count: 1, "aria-label": "Checking your account", className: "px-3 sm:px-4" }) : !methods.passkey ? /* @__PURE__ */ jsx32(
+    ) : methods === null ? error ? /* @__PURE__ */ jsx33(Empty, { children: /* @__PURE__ */ jsx33(Button28, { variant: "outline", onClick: () => void load(), children: "Try again" }) }) : /* @__PURE__ */ jsx33(RegionSkeleton3, { shape: "rows", count: 1, "aria-label": "Checking your account", className: "px-3 sm:px-4" }) : !methods.passkey ? /* @__PURE__ */ jsx33(
       VaultRow,
       {
         label: "Passkey",
         hint: methods.password ? `Or type your password in ${where}` : "Add one to approve",
-        actions: /* @__PURE__ */ jsx32(Button27, { variant: "primary", icon: /* @__PURE__ */ jsx32(FingerprintGlyph, {}), disabled: busy !== null, onClick: () => void addPasskey(), children: busy === "add" ? "Adding\u2026" : "Add passkey" }),
-        children: /* @__PURE__ */ jsx32("span", { className: "text-muted-foreground", children: methods.password ? "None yet" : "No password or passkey" })
+        actions: /* @__PURE__ */ jsx33(Button28, { variant: "primary", icon: /* @__PURE__ */ jsx33(FingerprintGlyph, {}), disabled: busy !== null, onClick: () => void addPasskey(), children: busy === "add" ? "Adding\u2026" : "Add passkey" }),
+        children: /* @__PURE__ */ jsx33("span", { className: "text-muted-foreground", children: methods.password ? "None yet" : "No password or passkey" })
       }
-    ) : /* @__PURE__ */ jsx32(VaultRow, { label: "Passkey", hint: "Your device asks for it next", children: /* @__PURE__ */ jsx32("span", { className: "text-foreground", children: "Ready" }) }) })
+    ) : /* @__PURE__ */ jsx33(VaultRow, { label: "Passkey", hint: "Your device asks for it next", children: /* @__PURE__ */ jsx33("span", { className: "text-foreground", children: "Ready" }) }) })
   ] }) });
 }
 
 // src/native/NativeImportPanel.tsx
-import { useEffect as useEffect22, useMemo as useMemo5, useState as useState34 } from "react";
-import { confirm as confirm12 } from "@ai-matrx/kit/confirm-opener";
-import { Badge as Badge9, Button as Button28, Select as Select9 } from "@ai-matrx/design-system/controls";
+import { useEffect as useEffect22, useMemo as useMemo5, useState as useState35 } from "react";
+import { confirm as confirm13 } from "@ai-matrx/kit/confirm-opener";
+import { Badge as Badge9, Button as Button29, Select as Select10 } from "@ai-matrx/design-system/controls";
 
 // src/native/logic.ts
 var ACTIVE_PHASES = /* @__PURE__ */ new Set(["authorizing", "importing"]);
@@ -7022,12 +7357,12 @@ async function loadFullPreview(bridge, operationId, current) {
 }
 
 // src/native/use-native-import.ts
-import { useEffect as useEffect21, useRef as useRef17, useState as useState33 } from "react";
+import { useEffect as useEffect21, useRef as useRef17, useState as useState34 } from "react";
 var fail = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 var RESTART = "Your account changed. The import was stopped; start it again.";
 function useNativeImport(bridge, stillAllowed, onImported) {
-  const [screen, setScreen] = useState33({ kind: "idle", message: null });
-  const [busy, setBusy] = useState33(false);
+  const [screen, setScreen] = useState34({ kind: "idle", message: null });
+  const [busy, setBusy] = useState34(false);
   const generation = useRef17(0);
   const mounted = useRef17(false);
   const op = useRef17(null);
@@ -7135,7 +7470,7 @@ function useNativeImport(bridge, stillAllowed, onImported) {
     }
   };
   refreshRef.current = refresh;
-  const confirm14 = async () => {
+  const confirm15 = async () => {
     if (screen.kind !== "preview") return;
     const active = op.current;
     if (!active?.organizationId || active.id !== screen.preview.operation_id) return;
@@ -7217,11 +7552,11 @@ function useNativeImport(bridge, stillAllowed, onImported) {
       off?.();
     };
   }, [bridge]);
-  return { screen, busy, begin, refresh: () => refresh(false), confirm: confirm14, cancel, recover, reset };
+  return { screen, busy, begin, refresh: () => refresh(false), confirm: confirm15, cancel, recover, reset };
 }
 
 // src/native/NativeImportPanel.tsx
-import { Fragment as Fragment19, jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
+import { Fragment as Fragment20, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
 var TONE = {
   eligible: "success",
   committed: "success",
@@ -7232,15 +7567,15 @@ var TONE = {
 };
 function NativeImportPanel({ bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged }) {
   if (!bridge) {
-    return /* @__PURE__ */ jsx33(Panel, { title: "Import passkeys", size: "md", onClose, footer: /* @__PURE__ */ jsx33(Button28, { variant: "primary", onClick: onClose, children: "Close" }), children: /* @__PURE__ */ jsx33(VaultSection, { children: /* @__PURE__ */ jsx33(Empty, { children: "Passkey import needs the desktop app." }) }) });
+    return /* @__PURE__ */ jsx34(Panel, { title: "Import passkeys", size: "md", onClose, footer: /* @__PURE__ */ jsx34(Button29, { variant: "primary", onClick: onClose, children: "Close" }), children: /* @__PURE__ */ jsx34(VaultSection, { children: /* @__PURE__ */ jsx34(Empty, { children: "Passkey import needs the desktop app." }) }) });
   }
-  return /* @__PURE__ */ jsx33(Importer, { bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged });
+  return /* @__PURE__ */ jsx34(Importer, { bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged });
 }
 function Importer({ bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged }) {
   const options = useMemo5(() => organizations.map((o) => ({ value: o.id, label: o.name })), [organizations]);
-  const [organizationId, setOrganizationId] = useState34(() => organizations.some((o) => o.id === activeOrganizationId) ? activeOrganizationId : organizations[0]?.id ?? "");
-  const [limits, setLimits] = useState34(null);
-  const [limitError, setLimitError] = useState34(null);
+  const [organizationId, setOrganizationId] = useState35(() => organizations.some((o) => o.id === activeOrganizationId) ? activeOrganizationId : organizations[0]?.id ?? "");
+  const [limits, setLimits] = useState35(null);
+  const [limitError, setLimitError] = useState35(null);
   const flow = useNativeImport(bridge, (id) => organizations.some((o) => o.id === id), onChanged);
   const { screen, busy } = flow;
   const orgName = organizations.find((o) => o.id === organizationId)?.name ?? "this organization";
@@ -7262,64 +7597,64 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
   const active = status !== null && !TERMINAL_PHASES.has(status.phase);
   const ready = preview?.slots.filter((s) => s.disposition === "eligible").length ?? 0;
   const importNow = async () => {
-    const yes = await confirm12({ title: `Add ${plural2(ready, "passkey")} to ${orgName}?`, description: "Passkeys already there are skipped.", confirmLabel: "Import" });
+    const yes = await confirm13({ title: `Add ${plural2(ready, "passkey")} to ${orgName}?`, description: "Passkeys already there are skipped.", confirmLabel: "Import" });
     if (yes) await flow.confirm();
   };
-  const footer = preview ? /* @__PURE__ */ jsxs31(Fragment19, { children: [
-    /* @__PURE__ */ jsx33(Button28, { variant: "quiet", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel" }),
-    /* @__PURE__ */ jsxs31(Button28, { variant: "primary", icon: /* @__PURE__ */ jsx33(ImportGlyph, { className: "size-4" }), disabled: busy || ready === 0, onClick: () => void importNow(), children: [
+  const footer = preview ? /* @__PURE__ */ jsxs32(Fragment20, { children: [
+    /* @__PURE__ */ jsx34(Button29, { variant: "quiet", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel" }),
+    /* @__PURE__ */ jsxs32(Button29, { variant: "primary", icon: /* @__PURE__ */ jsx34(ImportGlyph, { className: "size-4" }), disabled: busy || ready === 0, onClick: () => void importNow(), children: [
       "Import ",
       ready
     ] })
-  ] }) : status ? active ? /* @__PURE__ */ jsxs31(Fragment19, { children: [
-    /* @__PURE__ */ jsx33(Button28, { variant: "outline", disabled: busy, onClick: () => void flow.refresh(), children: "Refresh" }),
-    /* @__PURE__ */ jsx33(Button28, { variant: "outline", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel import" })
-  ] }) : /* @__PURE__ */ jsxs31(Fragment19, { children: [
-    /* @__PURE__ */ jsx33(Button28, { variant: "quiet", onClick: flow.reset, children: "New file" }),
-    /* @__PURE__ */ jsx33(Button28, { variant: "primary", onClick: onClose, children: "Done" })
-  ] }) : /* @__PURE__ */ jsx33(Button28, { variant: "quiet", onClick: onClose, children: "Close" });
-  return /* @__PURE__ */ jsxs31(Panel, { title: "Import passkeys", size: "lg", onClose, footer, children: [
-    screen.kind === "idle" ? /* @__PURE__ */ jsxs31(VaultSection, { children: [
-      /* @__PURE__ */ jsx33(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx33(Select9, { value: organizationId, options, "aria-label": "Save to", disabled: busy, onValueChange: setOrganizationId }) }),
-      /* @__PURE__ */ jsx33(VaultRow, { label: "File", hint: limits ? `Up to ${plural2(limits.maxItems, "passkey")}` : "A passkey exchange file", children: /* @__PURE__ */ jsx33(Button28, { variant: "outline", icon: /* @__PURE__ */ jsx33(ImportGlyph, { className: "size-4" }), disabled: busy || !organizationId || limitError !== null, onClick: () => void flow.begin(organizationId), children: busy ? "Opening\u2026" : "Choose file" }) }),
-      /* @__PURE__ */ jsx33(VaultRow, { label: "Interrupted", hint: "Finish or clear an earlier import", children: /* @__PURE__ */ jsx33(Button28, { variant: "quiet", disabled: busy, onClick: () => void flow.recover(), children: "Recover" }) })
+  ] }) : status ? active ? /* @__PURE__ */ jsxs32(Fragment20, { children: [
+    /* @__PURE__ */ jsx34(Button29, { variant: "outline", disabled: busy, onClick: () => void flow.refresh(), children: "Refresh" }),
+    /* @__PURE__ */ jsx34(Button29, { variant: "outline", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel import" })
+  ] }) : /* @__PURE__ */ jsxs32(Fragment20, { children: [
+    /* @__PURE__ */ jsx34(Button29, { variant: "quiet", onClick: flow.reset, children: "New file" }),
+    /* @__PURE__ */ jsx34(Button29, { variant: "primary", onClick: onClose, children: "Done" })
+  ] }) : /* @__PURE__ */ jsx34(Button29, { variant: "quiet", onClick: onClose, children: "Close" });
+  return /* @__PURE__ */ jsxs32(Panel, { title: "Import passkeys", size: "lg", onClose, footer, children: [
+    screen.kind === "idle" ? /* @__PURE__ */ jsxs32(VaultSection, { children: [
+      /* @__PURE__ */ jsx34(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx34(Select10, { value: organizationId, options, "aria-label": "Save to", disabled: busy, onValueChange: setOrganizationId }) }),
+      /* @__PURE__ */ jsx34(VaultRow, { label: "File", hint: limits ? `Up to ${plural2(limits.maxItems, "passkey")}` : "A passkey exchange file", children: /* @__PURE__ */ jsx34(Button29, { variant: "outline", icon: /* @__PURE__ */ jsx34(ImportGlyph, { className: "size-4" }), disabled: busy || !organizationId || limitError !== null, onClick: () => void flow.begin(organizationId), children: busy ? "Opening\u2026" : "Choose file" }) }),
+      /* @__PURE__ */ jsx34(VaultRow, { label: "Interrupted", hint: "Finish or clear an earlier import", children: /* @__PURE__ */ jsx34(Button29, { variant: "quiet", disabled: busy, onClick: () => void flow.recover(), children: "Recover" }) })
     ] }) : null,
-    preview ? /* @__PURE__ */ jsx33(VaultSection, { title: `${ready} of ${preview.total} ready`, children: /* @__PURE__ */ jsx33(
+    preview ? /* @__PURE__ */ jsx34(VaultSection, { title: `${ready} of ${preview.total} ready`, children: /* @__PURE__ */ jsx34(
       Windowed,
       {
         items: preview.slots,
-        render: (slot) => /* @__PURE__ */ jsx33(VaultRow, { label: /* @__PURE__ */ jsx33(Badge9, { tone: TONE[slot.disposition], children: dispositionLabel(slot.disposition) }), hint: void 0, children: /* @__PURE__ */ jsx33("span", { className: "block truncate text-foreground", title: slot.reason ?? void 0, children: slot.title ?? "Unnamed passkey" }) }, slot.slot_id)
+        render: (slot) => /* @__PURE__ */ jsx34(VaultRow, { label: /* @__PURE__ */ jsx34(Badge9, { tone: TONE[slot.disposition], children: dispositionLabel(slot.disposition) }), hint: void 0, children: /* @__PURE__ */ jsx34("span", { className: "block truncate text-foreground", title: slot.reason ?? void 0, children: slot.title ?? "Unnamed passkey" }) }, slot.slot_id)
       }
     ) }) : null,
-    status && !preview ? /* @__PURE__ */ jsxs31(VaultSection, { title: `${accounted(status)} of ${status.total} done`, children: [
-      /* @__PURE__ */ jsx33(VaultRow, { label: "Imported", children: /* @__PURE__ */ jsx33("span", { className: "text-foreground", children: status.committed }) }),
-      /* @__PURE__ */ jsx33(VaultRow, { label: "Already there", children: /* @__PURE__ */ jsx33("span", { className: "text-foreground", children: status.already_present }) }),
-      /* @__PURE__ */ jsx33(VaultRow, { label: "Can't import", children: /* @__PURE__ */ jsx33("span", { className: "text-foreground", children: status.unsupported }) }),
-      /* @__PURE__ */ jsx33(VaultRow, { label: "Failed", children: /* @__PURE__ */ jsx33("span", { className: status.failed > 0 ? "text-destructive" : "text-foreground", children: status.failed }) }),
-      status.uncertain > 0 ? /* @__PURE__ */ jsx33(VaultRow, { label: "Needs recovery", children: /* @__PURE__ */ jsx33("span", { className: "text-foreground", children: status.uncertain }) }) : null,
-      status.not_attempted > 0 ? /* @__PURE__ */ jsx33(VaultRow, { label: "Not tried", children: /* @__PURE__ */ jsx33("span", { className: "text-foreground", children: status.not_attempted }) }) : null
+    status && !preview ? /* @__PURE__ */ jsxs32(VaultSection, { title: `${accounted(status)} of ${status.total} done`, children: [
+      /* @__PURE__ */ jsx34(VaultRow, { label: "Imported", children: /* @__PURE__ */ jsx34("span", { className: "text-foreground", children: status.committed }) }),
+      /* @__PURE__ */ jsx34(VaultRow, { label: "Already there", children: /* @__PURE__ */ jsx34("span", { className: "text-foreground", children: status.already_present }) }),
+      /* @__PURE__ */ jsx34(VaultRow, { label: "Can't import", children: /* @__PURE__ */ jsx34("span", { className: "text-foreground", children: status.unsupported }) }),
+      /* @__PURE__ */ jsx34(VaultRow, { label: "Failed", children: /* @__PURE__ */ jsx34("span", { className: status.failed > 0 ? "text-destructive" : "text-foreground", children: status.failed }) }),
+      status.uncertain > 0 ? /* @__PURE__ */ jsx34(VaultRow, { label: "Needs recovery", children: /* @__PURE__ */ jsx34("span", { className: "text-foreground", children: status.uncertain }) }) : null,
+      status.not_attempted > 0 ? /* @__PURE__ */ jsx34(VaultRow, { label: "Not tried", children: /* @__PURE__ */ jsx34("span", { className: "text-foreground", children: status.not_attempted }) }) : null
     ] }) : null,
-    screen.message ? /* @__PURE__ */ jsx33("p", { role: "status", className: "px-1 text-sm text-muted-foreground", children: screen.message }) : null,
-    /* @__PURE__ */ jsx33(ErrorLine, { message: limitError })
+    screen.message ? /* @__PURE__ */ jsx34("p", { role: "status", className: "px-1 text-sm text-muted-foreground", children: screen.message }) : null,
+    /* @__PURE__ */ jsx34(ErrorLine, { message: limitError })
   ] });
 }
 
 // src/extension/PageView.tsx
-import { useState as useState38 } from "react";
-import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuContent5, DropdownMenuItem as DropdownMenuItem4, DropdownMenuTrigger as DropdownMenuTrigger5, SiteIcon } from "@ai-matrx/design-system";
-import { Button as Button32 } from "@ai-matrx/design-system/controls";
+import { useState as useState39 } from "react";
+import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuContent5, DropdownMenuItem as DropdownMenuItem5, DropdownMenuTrigger as DropdownMenuTrigger5, SiteIcon } from "@ai-matrx/design-system";
+import { Button as Button33 } from "@ai-matrx/design-system/controls";
 import { GlobeIcon as GlobeIcon4 } from "@ai-matrx/design-system/icons";
 
 // src/extension/CaptureCard.tsx
-import { useState as useState35, useSyncExternalStore as useSyncExternalStore3 } from "react";
-import { Button as Button29, SearchField as SearchField3 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment20, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
+import { useState as useState36, useSyncExternalStore as useSyncExternalStore3 } from "react";
+import { Button as Button30, SearchField as SearchField3 } from "@ai-matrx/design-system/controls";
+import { Fragment as Fragment21, jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
   const prompt = useSyncExternalStore3(capture.subscribe, capture.get, capture.get);
   const notify = useNotify();
-  const [busy, setBusy] = useState35(false);
-  const [q, setQ] = useState35("");
+  const [busy, setBusy] = useState36(false);
+  const [q, setQ] = useState36("");
   if (!prompt) return null;
   const decide = async (d) => {
     setBusy(true);
@@ -7337,53 +7672,53 @@ function CaptureCard({ capture, onChanged }) {
   const existing = prompt.existing;
   const needle = q.trim().toLocaleLowerCase();
   const shown = needle ? existing.filter((x) => x.name.toLocaleLowerCase().includes(needle)) : existing;
-  return /* @__PURE__ */ jsxs32("section", { "aria-label": "Save this login", className: "flex flex-col gap-2 rounded-xl border border-border bg-card px-3 py-2.5", children: [
-    /* @__PURE__ */ jsxs32("div", { className: "flex items-center gap-2.5", children: [
-      /* @__PURE__ */ jsx34(ShieldGlyph, { className: "size-5 shrink-0 text-primary" }),
-      /* @__PURE__ */ jsxs32("div", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
-        /* @__PURE__ */ jsx34("span", { className: "truncate text-sm font-medium", children: prompt.unavailable ? "Couldn\u2019t hold this login" : "Save this login?" }),
-        /* @__PURE__ */ jsx34("span", { className: "truncate text-xs text-muted-foreground", children: prompt.username ? `${prompt.host} \xB7 ${prompt.username}` : prompt.host })
+  return /* @__PURE__ */ jsxs33("section", { "aria-label": "Save this login", className: "flex flex-col gap-2 rounded-xl border border-border bg-card px-3 py-2.5", children: [
+    /* @__PURE__ */ jsxs33("div", { className: "flex items-center gap-2.5", children: [
+      /* @__PURE__ */ jsx35(ShieldGlyph, { className: "size-5 shrink-0 text-primary" }),
+      /* @__PURE__ */ jsxs33("div", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
+        /* @__PURE__ */ jsx35("span", { className: "truncate text-sm font-medium", children: prompt.unavailable ? "Couldn\u2019t hold this login" : "Save this login?" }),
+        /* @__PURE__ */ jsx35("span", { className: "truncate text-xs text-muted-foreground", children: prompt.username ? `${prompt.host} \xB7 ${prompt.username}` : prompt.host })
       ] }),
-      /* @__PURE__ */ jsx34(Button29, { variant: "quiet", icon: /* @__PURE__ */ jsx34(XGlyph, {}), "aria-label": "Not now", disabled: busy, onClick: () => void decide({ action: "dismiss" }) })
+      /* @__PURE__ */ jsx35(Button30, { variant: "quiet", icon: /* @__PURE__ */ jsx35(XGlyph, {}), "aria-label": "Not now", disabled: busy, onClick: () => void decide({ action: "dismiss" }) })
     ] }),
-    prompt.unavailable ? /* @__PURE__ */ jsx34("p", { className: "text-xs text-muted-foreground", children: "Save it by hand with Save a login." }) : /* @__PURE__ */ jsxs32(Fragment20, { children: [
-      existing.length > 0 ? /* @__PURE__ */ jsxs32("div", { className: "flex flex-col gap-1", children: [
-        existing.length >= SEARCH_FROM ? /* @__PURE__ */ jsx34(SearchField3, { value: q, onChange: (e) => setQ(e.target.value), placeholder: "Search logins", "aria-label": "Search logins to update" }) : null,
-        /* @__PURE__ */ jsxs32("ul", { className: "flex max-h-36 flex-col gap-px overflow-y-auto", children: [
+    prompt.unavailable ? /* @__PURE__ */ jsx35("p", { className: "text-xs text-muted-foreground", children: "Save it by hand with Save a login." }) : /* @__PURE__ */ jsxs33(Fragment21, { children: [
+      existing.length > 0 ? /* @__PURE__ */ jsxs33("div", { className: "flex flex-col gap-1", children: [
+        existing.length >= SEARCH_FROM ? /* @__PURE__ */ jsx35(SearchField3, { value: q, onChange: (e) => setQ(e.target.value), placeholder: "Search logins", "aria-label": "Search logins to update" }) : null,
+        /* @__PURE__ */ jsxs33("ul", { className: "flex max-h-36 flex-col gap-px overflow-y-auto", children: [
           shown.map((x) => {
             const tag = distinguish(x, existing);
-            return /* @__PURE__ */ jsxs32("li", { className: "flex h-9 items-center gap-2 px-1", children: [
-              /* @__PURE__ */ jsxs32("span", { className: "min-w-0 flex-1 truncate text-sm", children: [
+            return /* @__PURE__ */ jsxs33("li", { className: "flex h-9 items-center gap-2 px-1", children: [
+              /* @__PURE__ */ jsxs33("span", { className: "min-w-0 flex-1 truncate text-sm", children: [
                 x.name,
-                tag ? /* @__PURE__ */ jsxs32("span", { className: "text-muted-foreground", children: [
+                tag ? /* @__PURE__ */ jsxs33("span", { className: "text-muted-foreground", children: [
                   " \xB7 ",
                   tag
                 ] }) : null
               ] }),
-              /* @__PURE__ */ jsx34(Button29, { variant: "primary", disabled: busy, onClick: () => void decide({ action: "update", itemId: x.itemId }), "aria-label": `Update ${x.name}`, children: "Update" })
+              /* @__PURE__ */ jsx35(Button30, { variant: "primary", disabled: busy, onClick: () => void decide({ action: "update", itemId: x.itemId }), "aria-label": `Update ${x.name}`, children: "Update" })
             ] }, x.itemId);
           }),
-          shown.length === 0 ? /* @__PURE__ */ jsx34("li", { className: "px-1 py-2 text-xs text-muted-foreground", children: "No saved login matches." }) : null
+          shown.length === 0 ? /* @__PURE__ */ jsx35("li", { className: "px-1 py-2 text-xs text-muted-foreground", children: "No saved login matches." }) : null
         ] })
       ] }) : null,
-      /* @__PURE__ */ jsxs32("div", { className: "flex flex-wrap items-center gap-2", children: [
-        /* @__PURE__ */ jsx34(Button29, { variant: existing.length > 0 ? "outline" : "primary", disabled: busy, onClick: () => void decide({ action: "save" }), children: existing.length > 0 ? "Save as new" : "Save" }),
-        /* @__PURE__ */ jsx34(Button29, { variant: "quiet", disabled: busy, onClick: () => void decide({ action: "never" }), children: "Never here" })
+      /* @__PURE__ */ jsxs33("div", { className: "flex flex-wrap items-center gap-2", children: [
+        /* @__PURE__ */ jsx35(Button30, { variant: existing.length > 0 ? "outline" : "primary", disabled: busy, onClick: () => void decide({ action: "save" }), children: existing.length > 0 ? "Save as new" : "Save" }),
+        /* @__PURE__ */ jsx35(Button30, { variant: "quiet", disabled: busy, onClick: () => void decide({ action: "never" }), children: "Never here" })
       ] })
     ] })
   ] });
 }
 
 // src/extension/FillSetupCard.tsx
-import { useRef as useRef18, useState as useState36, useSyncExternalStore as useSyncExternalStore4 } from "react";
-import { Button as Button30, Field as Field12 } from "@ai-matrx/design-system/controls";
-import { jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
+import { useRef as useRef18, useState as useState37, useSyncExternalStore as useSyncExternalStore4 } from "react";
+import { Button as Button31, Field as Field13 } from "@ai-matrx/design-system/controls";
+import { jsx as jsx36, jsxs as jsxs34 } from "react/jsx-runtime";
 function FillSetupCard({ fillSetup }) {
   const notify = useNotify();
   const state = useSyncExternalStore4(fillSetup.subscribe, fillSetup.get, fillSetup.get);
   const box = useRef18(null);
-  const [busy, setBusy] = useState36(false);
-  const [error, setError] = useState36(null);
+  const [busy, setBusy] = useState37(false);
+  const [error, setError] = useState37(null);
   if (state.status !== "off") return null;
   const finish = async (run) => {
     setBusy(true);
@@ -7409,15 +7744,15 @@ function FillSetupCard({ fillSetup }) {
   const neither = m !== null && !m.password && !m.passkey;
   const showPassword = !neither && (m === null || m.password);
   const showPasskey = state.passkey !== null && (neither || m === null || m.passkey);
-  return /* @__PURE__ */ jsxs33("section", { "aria-label": "Turn on filling", "data-testid": "fill-setup", className: "flex flex-col gap-2 rounded-xl border border-border bg-card px-3 py-2.5", children: [
-    /* @__PURE__ */ jsxs33("div", { className: "flex items-center gap-2.5", children: [
-      /* @__PURE__ */ jsx35(KeyGlyph, { className: "size-5 shrink-0 text-primary" }),
-      /* @__PURE__ */ jsxs33("div", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
-        /* @__PURE__ */ jsx35("span", { className: "truncate text-sm font-medium", children: "Turn on filling" }),
-        /* @__PURE__ */ jsx35("span", { className: "truncate text-xs text-muted-foreground", children: neither ? "Add a passkey on the web first." : "Confirm it\u2019s you once in this browser." })
+  return /* @__PURE__ */ jsxs34("section", { "aria-label": "Turn on filling", "data-testid": "fill-setup", className: "flex flex-col gap-2 rounded-xl border border-border bg-card px-3 py-2.5", children: [
+    /* @__PURE__ */ jsxs34("div", { className: "flex items-center gap-2.5", children: [
+      /* @__PURE__ */ jsx36(KeyGlyph, { className: "size-5 shrink-0 text-primary" }),
+      /* @__PURE__ */ jsxs34("div", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
+        /* @__PURE__ */ jsx36("span", { className: "truncate text-sm font-medium", children: "Turn on filling" }),
+        /* @__PURE__ */ jsx36("span", { className: "truncate text-xs text-muted-foreground", children: neither ? "Add a passkey on the web first." : "Confirm it\u2019s you once in this browser." })
       ] })
     ] }),
-    showPassword ? /* @__PURE__ */ jsxs33(
+    showPassword ? /* @__PURE__ */ jsxs34(
       "form",
       {
         className: "flex items-center gap-2",
@@ -7426,42 +7761,42 @@ function FillSetupCard({ fillSetup }) {
           withPassword();
         },
         children: [
-          /* @__PURE__ */ jsx35(Field12, { ref: box, className: "min-w-0 flex-1", type: "password", autoComplete: "current-password", placeholder: "AI Matrx password", "aria-label": "Your AI Matrx password", disabled: busy }),
-          /* @__PURE__ */ jsx35(Button30, { variant: "primary", type: "submit", disabled: busy, children: "Turn on" })
+          /* @__PURE__ */ jsx36(Field13, { ref: box, className: "min-w-0 flex-1", type: "password", autoComplete: "current-password", placeholder: "AI Matrx password", "aria-label": "Your AI Matrx password", disabled: busy }),
+          /* @__PURE__ */ jsx36(Button31, { variant: "primary", type: "submit", disabled: busy, children: "Turn on" })
         ]
       }
     ) : null,
-    showPasskey ? /* @__PURE__ */ jsx35(Button30, { variant: "outline", iconEnd: /* @__PURE__ */ jsx35(ExternalGlyph, {}), disabled: busy, onClick: () => {
+    showPasskey ? /* @__PURE__ */ jsx36(Button31, { variant: "outline", iconEnd: /* @__PURE__ */ jsx36(ExternalGlyph, {}), disabled: busy, onClick: () => {
       setError(null);
       fillSetup.openPasskey();
     }, children: neither ? "Add a passkey" : "Use a passkey" }) : null,
-    showPasskey && state.awaitingPasskey && state.passkey ? /* @__PURE__ */ jsxs33("div", { className: "flex items-center gap-2", "data-testid": "fill-setup-waiting", children: [
-      /* @__PURE__ */ jsxs33("span", { className: "min-w-0 flex-1 text-xs text-muted-foreground", children: [
+    showPasskey && state.awaitingPasskey && state.passkey ? /* @__PURE__ */ jsxs34("div", { className: "flex items-center gap-2", "data-testid": "fill-setup-waiting", children: [
+      /* @__PURE__ */ jsxs34("span", { className: "min-w-0 flex-1 text-xs text-muted-foreground", children: [
         "Approve code ",
-        /* @__PURE__ */ jsx35("span", { className: "font-mono text-foreground", children: state.passkey.code }),
+        /* @__PURE__ */ jsx36("span", { className: "font-mono text-foreground", children: state.passkey.code }),
         " on that page."
       ] }),
-      /* @__PURE__ */ jsx35(Button30, { variant: "primary", disabled: busy, onClick: () => void finish(() => fillSetup.finishPasskey()), children: "I approved" })
+      /* @__PURE__ */ jsx36(Button31, { variant: "primary", disabled: busy, onClick: () => void finish(() => fillSetup.finishPasskey()), children: "I approved" })
     ] }) : null,
-    error ? /* @__PURE__ */ jsx35("p", { role: "alert", className: "text-xs text-destructive", children: error }) : null
+    error ? /* @__PURE__ */ jsx36("p", { role: "alert", className: "text-xs text-destructive", children: error }) : null
   ] });
 }
 
 // src/extension/PageGenerator.tsx
-import { useState as useState37 } from "react";
+import { useState as useState38 } from "react";
 import { Popover as Popover2, PopoverContent as PopoverContent2, PopoverTrigger as PopoverTrigger2 } from "@ai-matrx/design-system";
-import { Button as Button31 } from "@ai-matrx/design-system/controls";
-import { CopyIcon as CopyIcon7 } from "@ai-matrx/design-system/icons";
-import { Fragment as Fragment21, jsx as jsx36, jsxs as jsxs34 } from "react/jsx-runtime";
+import { Button as Button32 } from "@ai-matrx/design-system/controls";
+import { CopyIcon as CopyIcon8 } from "@ai-matrx/design-system/icons";
+import { Fragment as Fragment22, jsx as jsx37, jsxs as jsxs35 } from "react/jsx-runtime";
 var HOLD_MS = 6e4;
 function PageGenerator({ fields }) {
   const limits = useGeneratorLimitsSource();
   const copy = useCopy();
   const held = useTransientSecret(HOLD_MS);
-  const [open, setOpen] = useState37(false);
-  const [busy, setBusy] = useState37(false);
-  const [targets, setTargets] = useState37([]);
-  const [said, setSaid] = useState37(null);
+  const [open, setOpen] = useState38(false);
+  const [busy, setBusy] = useState38(false);
+  const [targets, setTargets] = useState38([]);
+  const [said, setSaid] = useState38(null);
   if (!limits) return null;
   const say3 = setSaid;
   const put = async (targetId, value2) => {
@@ -7503,30 +7838,30 @@ function PageGenerator({ fields }) {
     }
   };
   const value = held.value;
-  return /* @__PURE__ */ jsxs34(Fragment21, { children: [
-    /* @__PURE__ */ jsx36(
+  return /* @__PURE__ */ jsxs35(Fragment22, { children: [
+    /* @__PURE__ */ jsx37(
       VaultRow,
       {
         label: "New password",
-        actions: /* @__PURE__ */ jsxs34(Fragment21, { children: [
-          value ? /* @__PURE__ */ jsx36(Button31, { variant: "quiet", icon: /* @__PURE__ */ jsx36(CopyIcon7, {}), "aria-label": "Copy password", onClick: () => void copy(value, "Password") }) : null,
-          /* @__PURE__ */ jsxs34(Popover2, { open, onOpenChange: setOpen, children: [
-            /* @__PURE__ */ jsx36(PopoverTrigger2, { asChild: true, children: /* @__PURE__ */ jsx36(Button31, { variant: "outline", icon: /* @__PURE__ */ jsx36(KeyGlyph, {}), disabled: busy, children: "Generate" }) }),
-            /* @__PURE__ */ jsx36(PopoverContent2, { sizing: "content", align: "end", children: open ? /* @__PURE__ */ jsx36(PasswordGenerator, { limits, useLabel: "Fill page", onUse: (v) => void onUse(v) }) : null })
+        actions: /* @__PURE__ */ jsxs35(Fragment22, { children: [
+          value ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(CopyIcon8, {}), "aria-label": "Copy password", onClick: () => void copy(value, "Password") }) : null,
+          /* @__PURE__ */ jsxs35(Popover2, { open, onOpenChange: setOpen, children: [
+            /* @__PURE__ */ jsx37(PopoverTrigger2, { asChild: true, children: /* @__PURE__ */ jsx37(Button32, { variant: "outline", icon: /* @__PURE__ */ jsx37(KeyGlyph, {}), disabled: busy, children: "Generate" }) }),
+            /* @__PURE__ */ jsx37(PopoverContent2, { sizing: "content", align: "end", children: open ? /* @__PURE__ */ jsx37(PasswordGenerator, { limits, useLabel: "Fill page", onUse: (v) => void onUse(v) }) : null })
           ] })
         ] }),
-        children: said ? /* @__PURE__ */ jsx36("span", { role: "status", className: said.tone === "success" ? "line-clamp-2 text-xs text-foreground" : "line-clamp-2 text-xs text-muted-foreground", children: said.text }) : targets.length > 0 ? /* @__PURE__ */ jsx36("span", { className: "text-xs text-muted-foreground", children: "Choose the boxes to fill." }) : /* @__PURE__ */ jsx36("span", { className: "text-xs text-disabled-foreground", children: "Fills the page\u2019s new-password box" })
+        children: said ? /* @__PURE__ */ jsx37("span", { role: "status", className: said.tone === "success" ? "line-clamp-2 text-xs text-foreground" : "line-clamp-2 text-xs text-muted-foreground", children: said.text }) : targets.length > 0 ? /* @__PURE__ */ jsx37("span", { className: "text-xs text-muted-foreground", children: "Choose the boxes to fill." }) : /* @__PURE__ */ jsx37("span", { className: "text-xs text-disabled-foreground", children: "Fills the page\u2019s new-password box" })
       }
     ),
-    value && targets.length > 0 ? targets.map((t) => /* @__PURE__ */ jsx36(VaultRow, { label: t.topFrame ? "This page" : "In a frame", actions: /* @__PURE__ */ jsx36(Button31, { variant: "primary", icon: /* @__PURE__ */ jsx36(CheckGlyph, {}), disabled: busy, onClick: () => void put(t.id, value), children: "Fill" }), children: /* @__PURE__ */ jsx36("span", { className: "block truncate text-sm", children: targetLabel(t) }) }, t.id)) : null
+    value && targets.length > 0 ? targets.map((t) => /* @__PURE__ */ jsx37(VaultRow, { label: t.topFrame ? "This page" : "In a frame", actions: /* @__PURE__ */ jsx37(Button32, { variant: "primary", icon: /* @__PURE__ */ jsx37(CheckGlyph, {}), disabled: busy, onClick: () => void put(t.id, value), children: "Fill" }), children: /* @__PURE__ */ jsx37("span", { className: "block truncate text-sm", children: targetLabel(t) }) }, t.id)) : null
   ] });
 }
 
 // src/extension/PageView.tsx
-import { jsx as jsx37, jsxs as jsxs35 } from "react/jsx-runtime";
+import { jsx as jsx38, jsxs as jsxs36 } from "react/jsx-runtime";
 function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, items, definitions, onOpen, onNewForPage, onBrowse, onChanged, header }) {
-  const [running, setRunning] = useState38(null);
-  const [said, setSaid] = useState38(null);
+  const [running, setRunning] = useState39(null);
+  const [said, setSaid] = useState39(null);
   const site = pageSite(page.url);
   const state = page.matchState ?? { status: "ready" };
   const fillable = new Set(page.fillableItemIds ?? page.matchingItemIds);
@@ -7547,20 +7882,20 @@ function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, ite
     }
   };
   let body;
-  if (!page.url) body = /* @__PURE__ */ jsx37(Empty, { children: "No page is open in this tab." });
+  if (!page.url) body = /* @__PURE__ */ jsx38(Empty, { children: "No page is open in this tab." });
   else if (state.status === "error") {
-    body = /* @__PURE__ */ jsxs35("div", { className: "flex items-center gap-2 px-3 py-2 sm:px-4", children: [
-      /* @__PURE__ */ jsx37("span", { role: "alert", className: "min-w-0 flex-1 text-sm text-muted-foreground", children: MATCH_ERROR_WORDS[state.reason] }),
-      /* @__PURE__ */ jsx37(Button32, { variant: "outline", icon: /* @__PURE__ */ jsx37(RefreshGlyph, {}), onClick: state.retry, children: "Retry" })
+    body = /* @__PURE__ */ jsxs36("div", { className: "flex items-center gap-2 px-3 py-2 sm:px-4", children: [
+      /* @__PURE__ */ jsx38("span", { role: "alert", className: "min-w-0 flex-1 text-sm text-muted-foreground", children: MATCH_ERROR_WORDS[state.reason] }),
+      /* @__PURE__ */ jsx38(Button33, { variant: "outline", icon: /* @__PURE__ */ jsx38(RefreshGlyph, {}), onClick: state.retry, children: "Retry" })
     ] });
   } else if (state.status === "loading") {
-    body = /* @__PURE__ */ jsx37("div", { "aria-busy": "true", "aria-label": "Checking saved logins", className: "flex flex-col", children: [0, 1].map((n) => /* @__PURE__ */ jsxs35("div", { className: "flex h-12 items-center gap-3 px-3", children: [
-      /* @__PURE__ */ jsx37("div", { className: "size-8 animate-pulse rounded-lg bg-muted" }),
-      /* @__PURE__ */ jsx37("div", { className: "h-3 w-1/2 animate-pulse rounded bg-muted" })
+    body = /* @__PURE__ */ jsx38("div", { "aria-busy": "true", "aria-label": "Checking saved logins", className: "flex flex-col", children: [0, 1].map((n) => /* @__PURE__ */ jsxs36("div", { className: "flex h-12 items-center gap-3 px-3", children: [
+      /* @__PURE__ */ jsx38("div", { className: "size-8 animate-pulse rounded-lg bg-muted" }),
+      /* @__PURE__ */ jsx38("div", { className: "h-3 w-1/2 animate-pulse rounded bg-muted" })
     ] }, n)) });
-  } else if (matches.length === 0) body = /* @__PURE__ */ jsx37(Empty, { children: "No saved login for this site." });
+  } else if (matches.length === 0) body = /* @__PURE__ */ jsx38(Empty, { children: "No saved login for this site." });
   else {
-    body = /* @__PURE__ */ jsx37("ul", { className: "flex flex-col", children: matches.map(({ itemId, item }) => /* @__PURE__ */ jsx37(
+    body = /* @__PURE__ */ jsx38("ul", { className: "flex flex-col", children: matches.map(({ itemId, item }) => /* @__PURE__ */ jsx38(
       MatchRow,
       {
         itemId,
@@ -7577,40 +7912,40 @@ function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, ite
       itemId
     )) });
   }
-  return /* @__PURE__ */ jsx37("div", { className: "flex h-full min-h-0 flex-col overflow-y-auto bg-background text-foreground", children: /* @__PURE__ */ jsxs35("div", { className: "flex flex-col gap-3 px-3 pb-4 pt-3", children: [
+  return /* @__PURE__ */ jsx38("div", { className: "flex h-full min-h-0 flex-col overflow-y-auto bg-background text-foreground", children: /* @__PURE__ */ jsxs36("div", { className: "flex flex-col gap-3 px-3 pb-4 pt-3", children: [
     header,
-    /* @__PURE__ */ jsxs35("div", { className: "flex min-h-7 items-center gap-2 px-1", children: [
-      /* @__PURE__ */ jsx37(SiteIcon, { site: page.url, fallback: GlobeIcon4, className: "size-4" }),
-      /* @__PURE__ */ jsx37("span", { className: "min-w-0 flex-1 truncate text-sm font-medium", title: page.url, children: site || "No page open" }),
-      page.refresh ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(RefreshGlyph, {}), "aria-label": "Check again", onClick: page.refresh }) : null,
-      onBrowse ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(ListGlyph, {}), onClick: onBrowse, children: "All items" }) : null
+    /* @__PURE__ */ jsxs36("div", { className: "flex min-h-7 items-center gap-2 px-1", children: [
+      /* @__PURE__ */ jsx38(SiteIcon, { site: page.url, fallback: GlobeIcon4, className: "size-4" }),
+      /* @__PURE__ */ jsx38("span", { className: "min-w-0 flex-1 truncate text-sm font-medium", title: page.url, children: site || "No page open" }),
+      page.refresh ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(RefreshGlyph, {}), "aria-label": "Check again", onClick: page.refresh }) : null,
+      onBrowse ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(ListGlyph, {}), onClick: onBrowse, children: "All items" }) : null
     ] }),
-    fillSetup ? /* @__PURE__ */ jsx37(FillSetupCard, { fillSetup }) : null,
-    capture ? /* @__PURE__ */ jsx37(CaptureCard, { capture, onChanged }) : null,
-    /* @__PURE__ */ jsx37(
+    fillSetup ? /* @__PURE__ */ jsx38(FillSetupCard, { fillSetup }) : null,
+    capture ? /* @__PURE__ */ jsx38(CaptureCard, { capture, onChanged }) : null,
+    /* @__PURE__ */ jsx38(
       VaultSection,
       {
         title: "This site",
-        actions: canSave ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(PlusGlyph, {}), onClick: () => onNewForPage(normalizeLoginUrl2(page.url) ?? page.url), children: "Save a login" }) : null,
+        actions: canSave ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(PlusGlyph, {}), onClick: () => onNewForPage(normalizeLoginUrl2(page.url) ?? page.url), children: "Save a login" }) : null,
         children: body
       }
     ),
-    said ? /* @__PURE__ */ jsx37(Outcome, { said, onDismiss: () => setSaid(null) }) : page.blocked && page.url && state.status === "ready" ? /* @__PURE__ */ jsx37("p", { className: "px-1 text-xs text-muted-foreground", children: BLOCK_WORDS[page.blocked] }) : null,
-    newPasswordFields && canSave ? /* @__PURE__ */ jsx37(VaultSection, { children: /* @__PURE__ */ jsx37(PageGenerator, { fields: newPasswordFields }) }) : null
+    said ? /* @__PURE__ */ jsx38(Outcome, { said, onDismiss: () => setSaid(null) }) : page.blocked && page.url && state.status === "ready" ? /* @__PURE__ */ jsx38("p", { className: "px-1 text-xs text-muted-foreground", children: BLOCK_WORDS[page.blocked] }) : null,
+    newPasswordFields && canSave ? /* @__PURE__ */ jsx38(VaultSection, { children: /* @__PURE__ */ jsx38(PageGenerator, { fields: newPasswordFields }) }) : null
   ] }) });
 }
 function Outcome({ said, onDismiss }) {
-  return /* @__PURE__ */ jsxs35("div", { role: "status", className: "flex items-center gap-2 px-1", children: [
-    said.tone === "success" ? /* @__PURE__ */ jsx37(CheckGlyph, { className: "size-4 shrink-0 text-primary" }) : /* @__PURE__ */ jsx37(ShieldGlyph, { className: "size-4 shrink-0 text-destructive" }),
-    /* @__PURE__ */ jsx37("span", { className: "min-w-0 flex-1 text-xs text-foreground", children: said.text }),
-    /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(XGlyph, {}), "aria-label": "Dismiss", onClick: onDismiss })
+  return /* @__PURE__ */ jsxs36("div", { role: "status", className: "flex items-center gap-2 px-1", children: [
+    said.tone === "success" ? /* @__PURE__ */ jsx38(CheckGlyph, { className: "size-4 shrink-0 text-primary" }) : /* @__PURE__ */ jsx38(ShieldGlyph, { className: "size-4 shrink-0 text-destructive" }),
+    /* @__PURE__ */ jsx38("span", { className: "min-w-0 flex-1 text-xs text-foreground", children: said.text }),
+    /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(XGlyph, {}), "aria-label": "Dismiss", onClick: onDismiss })
   ] });
 }
 function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFill, onSignIn }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
-  const [reading, setReading] = useState38(false);
+  const [reading, setReading] = useState39(false);
   const usable = item?.capabilities.canUse ?? false;
   const user = usable ? item?.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed" && f.active) : void 0;
   const secret = usable && item?.capabilities.canReveal ? item?.fields.find((f) => f.key === "password" && f.handling === "revealable" && f.active) : void 0;
@@ -7626,27 +7961,27 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
     }
   };
   const subtitle = [item ? loginSiteOf(item) || item.definitionLabel : "", tag].filter(Boolean).join(" \xB7 ");
-  return /* @__PURE__ */ jsxs35("li", { className: "flex h-12 items-center gap-1 pl-1 pr-2", "data-item": itemId, children: [
-    /* @__PURE__ */ jsxs35("button", { type: "button", onClick: () => onOpen(itemId), className: "flex h-11 min-w-0 flex-1 items-center gap-3 rounded-lg px-2 text-left hover:bg-accent", children: [
-      /* @__PURE__ */ jsx37(ItemIcon, { definitionKey: item?.definitionKey ?? "website_login", family, site: item ? loginSiteOf(item) : "" }),
-      /* @__PURE__ */ jsxs35("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
-        /* @__PURE__ */ jsx37("span", { className: "truncate text-sm font-medium", children: item?.name ?? "Saved login" }),
-        subtitle ? /* @__PURE__ */ jsx37("span", { className: "truncate text-xs text-muted-foreground", children: subtitle }) : null
+  return /* @__PURE__ */ jsxs36("li", { className: "flex h-12 items-center gap-1 pl-1 pr-2", "data-item": itemId, children: [
+    /* @__PURE__ */ jsxs36("button", { type: "button", onClick: () => onOpen(itemId), className: "flex h-11 min-w-0 flex-1 items-center gap-3 rounded-lg px-2 text-left hover:bg-accent", children: [
+      /* @__PURE__ */ jsx38(ItemIcon, { definitionKey: item?.definitionKey ?? "website_login", family, site: item ? loginSiteOf(item) : "" }),
+      /* @__PURE__ */ jsxs36("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
+        /* @__PURE__ */ jsx38("span", { className: "truncate text-sm font-medium", children: item?.name ?? "Saved login" }),
+        subtitle ? /* @__PURE__ */ jsx38("span", { className: "truncate text-xs text-muted-foreground", children: subtitle }) : null
       ] })
     ] }),
-    onFill ? /* @__PURE__ */ jsx37(Button32, { variant: "primary", disabled: busy, "aria-busy": running || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running ? "Filling\u2026" : "Fill" }) : null,
-    user && item ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(UserGlyph, {}), "aria-label": `Copy ${user.label}`, title: `Copy ${user.label}`, disabled: reading, onClick: () => void read(user.label, () => port.reveal(item, user.key)) }) : null,
-    secret && item ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(KeyGlyph, {}), "aria-label": "Copy password", title: "Copy password", disabled: reading, onClick: () => void read("Password", () => port.reveal(item, secret.key)) }) : null,
-    otp ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null,
-    onSignIn ? /* @__PURE__ */ jsxs35(DropdownMenu5, { children: [
-      /* @__PURE__ */ jsx37(DropdownMenuTrigger5, { asChild: true, children: /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(MoreGlyph, {}), "aria-label": "More", disabled: busy }) }),
-      /* @__PURE__ */ jsxs35(DropdownMenuContent5, { align: "end", children: [
-        /* @__PURE__ */ jsxs35(DropdownMenuItem4, { onSelect: onSignIn, children: [
-          /* @__PURE__ */ jsx37(ShieldGlyph, { className: "size-4" }),
+    onFill ? /* @__PURE__ */ jsx38(Button33, { variant: "primary", disabled: busy, "aria-busy": running || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running ? "Filling\u2026" : "Fill" }) : null,
+    user && item ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(UserGlyph, {}), "aria-label": `Copy ${user.label}`, title: `Copy ${user.label}`, disabled: reading, onClick: () => void read(user.label, () => port.reveal(item, user.key)) }) : null,
+    secret && item ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(KeyGlyph, {}), "aria-label": "Copy password", title: "Copy password", disabled: reading, onClick: () => void read("Password", () => port.reveal(item, secret.key)) }) : null,
+    otp ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null,
+    onSignIn ? /* @__PURE__ */ jsxs36(DropdownMenu5, { children: [
+      /* @__PURE__ */ jsx38(DropdownMenuTrigger5, { asChild: true, children: /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(MoreGlyph, {}), "aria-label": "More", disabled: busy }) }),
+      /* @__PURE__ */ jsxs36(DropdownMenuContent5, { align: "end", children: [
+        /* @__PURE__ */ jsxs36(DropdownMenuItem5, { onSelect: onSignIn, children: [
+          /* @__PURE__ */ jsx38(ShieldGlyph, { className: "size-4" }),
           "Sign me in"
         ] }),
-        /* @__PURE__ */ jsxs35(DropdownMenuItem4, { onSelect: () => onOpen(itemId), children: [
-          /* @__PURE__ */ jsx37(ListGlyph, { className: "size-4" }),
+        /* @__PURE__ */ jsxs36(DropdownMenuItem5, { onSelect: () => onOpen(itemId), children: [
+          /* @__PURE__ */ jsx38(ListGlyph, { className: "size-4" }),
           "Open item"
         ] })
       ] })
@@ -7655,11 +7990,12 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
 }
 
 // src/Sidebar.tsx
-import { useState as useState39 } from "react";
+import { useState as useState40 } from "react";
 import { cn as cn15, useLook as useLook2 } from "@ai-matrx/design-system";
-import { Select as Select10 } from "@ai-matrx/design-system/controls";
+import { Select as Select11 } from "@ai-matrx/design-system/controls";
 import { GlobeIcon as GlobeIcon5 } from "@ai-matrx/design-system/icons";
-import { jsx as jsx38, jsxs as jsxs36 } from "react/jsx-runtime";
+import { jsx as jsx39, jsxs as jsxs37 } from "react/jsx-runtime";
+var AUTHENTICATOR_LABEL = "Authenticator";
 function vaultChoices(items, organizations, current) {
   const n = (f) => items.filter(f).length;
   const shared = n((i) => i.owner.kind === "shared");
@@ -7672,7 +8008,7 @@ function vaultChoices(items, organizations, current) {
   ];
 }
 function VaultSelect({ value, choices, onChange }) {
-  return /* @__PURE__ */ jsx38(Select10, { value, onValueChange: onChange, "aria-label": "Vault", options: choices.map((c) => ({ value: c.value, label: c.label, meta: String(c.count) })) });
+  return /* @__PURE__ */ jsx39(Select11, { value, onValueChange: onChange, "aria-label": "Vault", options: choices.map((c) => ({ value: c.value, label: c.label, meta: String(c.count) })) });
 }
 var CATEGORY_GLYPHS = { logins: GlobeIcon5, passkeys: ShieldGlyph, api: KeyGlyph, oauth: PlugGlyph, infra: DatabaseGlyph, env: TerminalGlyph, files: FileGlyph, other: NoteGlyph };
 var familyOf = (key, definitions) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -7699,7 +8035,7 @@ function buildViews(items, definitions, favoriteIds2, recentIds2) {
 function viewLabel(view, views) {
   if (view === "favorites") return "Favorites";
   if (view === "recent") return "Recently opened";
-  if (view === "authenticator") return "One-time passwords";
+  if (view === "authenticator") return AUTHENTICATOR_LABEL;
   if (view === "trash") return "Trash";
   if (view === "page") return "This page";
   return [...views.categories, ...views.tags].find((v) => v.view === view)?.label ?? "All items";
@@ -7710,7 +8046,7 @@ function viewOptions(views, allCount, deletedCount, hasFavorites, hasRecents, ha
     { value: "all", label: "Every category", meta: String(allCount) },
     ...hasFavorites ? [{ value: "favorites", label: "Favorites", meta: views.favorites === void 0 ? "" : String(views.favorites) }] : [],
     ...hasRecents ? [{ value: "recent", label: "Recently opened", meta: views.recent === void 0 ? "" : String(views.recent) }] : [],
-    { value: "authenticator", label: "One-time passwords", meta: String(views.authenticator) },
+    { value: "authenticator", label: AUTHENTICATOR_LABEL, meta: String(views.authenticator) },
     ...views.categories.map((v) => ({ value: v.view, label: v.label, meta: String(v.count) })),
     ...views.tags.map((v) => ({ value: v.view, label: `#${v.label}`, meta: String(v.count) })),
     { value: "trash", label: "Trash", meta: String(deletedCount) }
@@ -7718,7 +8054,7 @@ function viewOptions(views, allCount, deletedCount, hasFavorites, hasRecents, ha
 }
 function Entry({ on, glyph: Icon, label, count: count2, onClick }) {
   const desktop = useLook2() === "desktop";
-  return /* @__PURE__ */ jsxs36(
+  return /* @__PURE__ */ jsxs37(
     "button",
     {
       type: "button",
@@ -7726,62 +8062,62 @@ function Entry({ on, glyph: Icon, label, count: count2, onClick }) {
       onClick,
       className: cn15("flex h-8 w-full items-center gap-2.5 rounded-lg px-2.5 text-left text-sm", on ? desktop ? "bg-sidebar-accent text-primary" : "bg-sidebar-accent font-medium text-sidebar-accent-foreground" : "text-sidebar-foreground hover:bg-sidebar-accent"),
       children: [
-        /* @__PURE__ */ jsx38(Icon, { className: "size-4 shrink-0" }),
-        /* @__PURE__ */ jsx38("span", { className: "min-w-0 flex-1 truncate", children: label }),
-        count2 !== void 0 ? /* @__PURE__ */ jsx38("span", { className: "text-xs tabular-nums text-muted-foreground", children: count2 }) : null
+        /* @__PURE__ */ jsx39(Icon, { className: "size-4 shrink-0" }),
+        /* @__PURE__ */ jsx39("span", { className: "min-w-0 flex-1 truncate", children: label }),
+        count2 !== void 0 ? /* @__PURE__ */ jsx39("span", { className: "text-xs tabular-nums text-muted-foreground", children: count2 }) : null
       ]
     }
   );
 }
 function Group({ title, children }) {
-  return /* @__PURE__ */ jsxs36("div", { className: "flex flex-col gap-0.5", children: [
-    /* @__PURE__ */ jsx38("div", { className: "px-2.5 pb-1 text-xs font-medium text-muted-foreground", children: title }),
+  return /* @__PURE__ */ jsxs37("div", { className: "flex flex-col gap-0.5", children: [
+    /* @__PURE__ */ jsx39("div", { className: "px-2.5 pb-1 text-xs font-medium text-muted-foreground", children: title }),
     children
   ] });
 }
 function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false }) {
-  const [tagsOpen, setTagsOpen] = useState39(view.startsWith("tag:"));
-  return /* @__PURE__ */ jsxs36("nav", { "aria-label": "Vault", className: "flex h-full min-h-0 flex-col border-r border-sidebar-border bg-sidebar-background text-sidebar-foreground", children: [
-    /* @__PURE__ */ jsxs36("div", { className: "flex items-center gap-2 px-3 pb-2 pt-3", children: [
-      /* @__PURE__ */ jsx38(SafeGlyph, { className: "size-5 shrink-0 text-primary" }),
-      /* @__PURE__ */ jsx38("div", { className: "min-w-0 flex-1", children: /* @__PURE__ */ jsx38(VaultSelect, { value: vault, choices, onChange: onVault }) })
+  const [tagsOpen, setTagsOpen] = useState40(view.startsWith("tag:"));
+  return /* @__PURE__ */ jsxs37("nav", { "aria-label": "Vault", className: "flex h-full min-h-0 flex-col border-r border-sidebar-border bg-sidebar-background text-sidebar-foreground", children: [
+    /* @__PURE__ */ jsxs37("div", { className: "flex items-center gap-2 px-3 pb-2 pt-3", children: [
+      /* @__PURE__ */ jsx39(SafeGlyph, { className: "size-5 shrink-0 text-primary" }),
+      /* @__PURE__ */ jsx39("div", { className: "min-w-0 flex-1", children: /* @__PURE__ */ jsx39(VaultSelect, { value: vault, choices, onChange: onVault }) })
     ] }),
-    /* @__PURE__ */ jsxs36("div", { className: "flex min-h-0 flex-1 flex-col gap-5 overflow-y-auto px-2 pb-3 pt-1", children: [
-      /* @__PURE__ */ jsxs36("div", { className: "flex flex-col gap-0.5", children: [
-        hasPage ? /* @__PURE__ */ jsx38(Entry, { on: view === "page", glyph: GlobeIcon5, label: "This page", onClick: () => onView("page") }) : null,
-        /* @__PURE__ */ jsx38(Entry, { on: view === "all", glyph: GridGlyph, label: "All items", count: allCount, onClick: () => onView("all") }),
-        hasFavorites ? /* @__PURE__ */ jsx38(Entry, { on: view === "favorites", glyph: StarGlyph, label: "Favorites", count: views.favorites, onClick: () => onView("favorites") }) : null,
-        hasRecents ? /* @__PURE__ */ jsx38(Entry, { on: view === "recent", glyph: ClockGlyph, label: "Recently opened", count: views.recent, onClick: () => onView("recent") }) : null,
-        /* @__PURE__ */ jsx38(Entry, { on: view === "authenticator", glyph: LockGlyph, label: "One-time passwords", count: views.authenticator, onClick: () => onView("authenticator") })
+    /* @__PURE__ */ jsxs37("div", { className: "flex min-h-0 flex-1 flex-col gap-5 overflow-y-auto px-2 pb-3 pt-1", children: [
+      /* @__PURE__ */ jsxs37("div", { className: "flex flex-col gap-0.5", children: [
+        hasPage ? /* @__PURE__ */ jsx39(Entry, { on: view === "page", glyph: GlobeIcon5, label: "This page", onClick: () => onView("page") }) : null,
+        /* @__PURE__ */ jsx39(Entry, { on: view === "all", glyph: GridGlyph, label: "All items", count: allCount, onClick: () => onView("all") }),
+        hasFavorites ? /* @__PURE__ */ jsx39(Entry, { on: view === "favorites", glyph: StarGlyph, label: "Favorites", count: views.favorites, onClick: () => onView("favorites") }) : null,
+        hasRecents ? /* @__PURE__ */ jsx39(Entry, { on: view === "recent", glyph: ClockGlyph, label: "Recently opened", count: views.recent, onClick: () => onView("recent") }) : null,
+        /* @__PURE__ */ jsx39(Entry, { on: view === "authenticator", glyph: LockGlyph, label: AUTHENTICATOR_LABEL, count: views.authenticator, onClick: () => onView("authenticator") })
       ] }),
-      views.categories.length > 0 ? /* @__PURE__ */ jsx38(Group, { title: "Categories", children: views.categories.map((e) => /* @__PURE__ */ jsx38(Entry, { on: view === e.view, glyph: e.glyph, label: e.label, count: e.count, onClick: () => onView(e.view) }, e.view)) }) : null,
-      views.tags.length > 0 ? /* @__PURE__ */ jsxs36("div", { className: "flex flex-col gap-0.5", children: [
-        /* @__PURE__ */ jsxs36("button", { type: "button", "aria-expanded": tagsOpen, onClick: () => setTagsOpen((o) => !o), className: "flex h-7 items-center gap-1 rounded-md px-2.5 text-left text-xs font-medium text-muted-foreground hover:text-foreground", children: [
-          tagsOpen ? /* @__PURE__ */ jsx38(ChevronDownGlyph, { className: "size-3.5" }) : /* @__PURE__ */ jsx38(ChevronRightGlyph, { className: "size-3.5" }),
+      views.categories.length > 0 ? /* @__PURE__ */ jsx39(Group, { title: "Categories", children: views.categories.map((e) => /* @__PURE__ */ jsx39(Entry, { on: view === e.view, glyph: e.glyph, label: e.label, count: e.count, onClick: () => onView(e.view) }, e.view)) }) : null,
+      views.tags.length > 0 ? /* @__PURE__ */ jsxs37("div", { className: "flex flex-col gap-0.5", children: [
+        /* @__PURE__ */ jsxs37("button", { type: "button", "aria-expanded": tagsOpen, onClick: () => setTagsOpen((o) => !o), className: "flex h-7 items-center gap-1 rounded-md px-2.5 text-left text-xs font-medium text-muted-foreground hover:text-foreground", children: [
+          tagsOpen ? /* @__PURE__ */ jsx39(ChevronDownGlyph, { className: "size-3.5" }) : /* @__PURE__ */ jsx39(ChevronRightGlyph, { className: "size-3.5" }),
           "Tags",
-          /* @__PURE__ */ jsx38("span", { className: "ml-auto tabular-nums", children: views.tags.length })
+          /* @__PURE__ */ jsx39("span", { className: "ml-auto tabular-nums", children: views.tags.length })
         ] }),
-        tagsOpen ? views.tags.map((e) => /* @__PURE__ */ jsx38(Entry, { on: view === e.view, glyph: e.glyph, label: e.label, count: e.count, onClick: () => onView(e.view) }, e.view)) : null
+        tagsOpen ? views.tags.map((e) => /* @__PURE__ */ jsx39(Entry, { on: view === e.view, glyph: e.glyph, label: e.label, count: e.count, onClick: () => onView(e.view) }, e.view)) : null
       ] }) : null
     ] }),
-    /* @__PURE__ */ jsxs36("div", { className: "flex flex-col gap-0.5 border-t border-sidebar-border p-2", children: [
-      /* @__PURE__ */ jsx38(Entry, { on: view === "trash", glyph: TrashGlyph, label: "Trash", count: deletedCount, onClick: () => onView("trash") }),
-      /* @__PURE__ */ jsx38(Entry, { on: false, glyph: ImportGlyph, label: "Import", onClick: () => onPanel("import") }),
-      /* @__PURE__ */ jsx38(Entry, { on: false, glyph: ExportGlyph, label: "Export", onClick: () => onPanel("export") }),
-      /* @__PURE__ */ jsx38(Entry, { on: false, glyph: SafeGlyph, label: "Backup", onClick: () => onPanel("backup") }),
-      /* @__PURE__ */ jsx38(Entry, { on: false, glyph: ShieldGlyph, label: "Browsers that fill", onClick: () => onPanel("devices") }),
-      hasNativeImport ? /* @__PURE__ */ jsx38(Entry, { on: false, glyph: ImportGlyph, label: "Import passkeys", onClick: () => onPanel("import-passkeys") }) : null,
-      nativeProvider && nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs36("button", { type: "button", onClick: nativeProvider.openSetup, className: "flex h-8 w-full items-center gap-2.5 rounded-lg px-2.5 text-left text-sm hover:bg-sidebar-accent", children: [
-        /* @__PURE__ */ jsx38(ShieldGlyph, { className: "size-4 shrink-0" }),
-        /* @__PURE__ */ jsx38("span", { className: "min-w-0 flex-1 truncate", children: "System AutoFill" }),
-        /* @__PURE__ */ jsx38("span", { className: cn15("text-xs", nativeProvider.status === "ready" ? "text-success" : "text-warning"), children: nativeProvider.status === "ready" ? "On" : "Set up" })
+    /* @__PURE__ */ jsxs37("div", { className: "flex flex-col gap-0.5 border-t border-sidebar-border p-2", children: [
+      /* @__PURE__ */ jsx39(Entry, { on: view === "trash", glyph: TrashGlyph, label: "Trash", count: deletedCount, onClick: () => onView("trash") }),
+      /* @__PURE__ */ jsx39(Entry, { on: false, glyph: ImportGlyph, label: "Import", onClick: () => onPanel("import") }),
+      /* @__PURE__ */ jsx39(Entry, { on: false, glyph: ExportGlyph, label: "Export", onClick: () => onPanel("export") }),
+      /* @__PURE__ */ jsx39(Entry, { on: false, glyph: SafeGlyph, label: "Backup", onClick: () => onPanel("backup") }),
+      /* @__PURE__ */ jsx39(Entry, { on: false, glyph: ShieldGlyph, label: "Browsers that fill", onClick: () => onPanel("devices") }),
+      hasNativeImport ? /* @__PURE__ */ jsx39(Entry, { on: false, glyph: ImportGlyph, label: "Import passkeys", onClick: () => onPanel("import-passkeys") }) : null,
+      nativeProvider && nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs37("button", { type: "button", onClick: nativeProvider.openSetup, className: "flex h-8 w-full items-center gap-2.5 rounded-lg px-2.5 text-left text-sm hover:bg-sidebar-accent", children: [
+        /* @__PURE__ */ jsx39(ShieldGlyph, { className: "size-4 shrink-0" }),
+        /* @__PURE__ */ jsx39("span", { className: "min-w-0 flex-1 truncate", children: "System AutoFill" }),
+        /* @__PURE__ */ jsx39("span", { className: cn15("text-xs", nativeProvider.status === "ready" ? "text-success" : "text-warning"), children: nativeProvider.status === "ready" ? "On" : "Set up" })
       ] }) : null
     ] })
   ] });
 }
 
 // src/VaultApp.tsx
-import { jsx as jsx39, jsxs as jsxs37 } from "react/jsx-runtime";
+import { jsx as jsx40, jsxs as jsxs38 } from "react/jsx-runtime";
 var FULL_AT = 1120;
 var SPLIT_AT = 640;
 var NO_HOST = {};
@@ -7800,7 +8136,7 @@ var generatorLimitsFrom = (knobs) => knobs ? async () => {
 } : void 0;
 function ImportWithLimits(props) {
   const { knobs, ...rest } = props;
-  const [state, setState] = useState40(null);
+  const [state, setState] = useState41(null);
   useEffect23(() => {
     if (!knobs) return setState({ error: "Import is not set up for this organization yet." });
     knobs().then(
@@ -7814,18 +8150,18 @@ function ImportWithLimits(props) {
       (e) => setState({ error: e instanceof Error ? e.message : "The import settings could not be read." })
     );
   }, [knobs]);
-  if (state && "limits" in state) return /* @__PURE__ */ jsx39(ImportPanel, { ...rest, limits: state.limits });
-  return /* @__PURE__ */ jsx39(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ jsx39(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
+  if (state && "limits" in state) return /* @__PURE__ */ jsx40(ImportPanel, { ...rest, limits: state.limits });
+  return /* @__PURE__ */ jsx40(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ jsx40(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
 }
 function VaultApp(props) {
   const lock = props.host?.lock;
   const locked = useLocked(lock);
   const port = useMemo6(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
-  return /* @__PURE__ */ jsx39(LookScope, { look: props.look ?? "web", className: "h-full min-h-0 w-full", children: /* @__PURE__ */ jsx39("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ jsx39(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ jsx39(LockedScreen, { lock }) : /* @__PURE__ */ jsx39(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ jsx39(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ jsx39(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ jsx39(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ jsx39(Workspace, { ...props, port }) }) }) }) }) }) }) });
+  return /* @__PURE__ */ jsx40(LookScope, { look: props.look ?? "web", className: "h-full min-h-0 w-full", children: /* @__PURE__ */ jsx40("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ jsx40(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ jsx40(LockedScreen, { lock }) : /* @__PURE__ */ jsx40(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ jsx40(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ jsx40(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ jsx40(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ jsx40(Workspace, { ...props, port }) }) }) }) }) }) }) });
 }
 function LockedScreen({ lock }) {
-  const [busy, setBusy] = useState40(false);
-  const [error, setError] = useState40(null);
+  const [busy, setBusy] = useState41(false);
+  const [error, setError] = useState41(null);
   const unlock = async () => {
     setBusy(true);
     setError(null);
@@ -7837,28 +8173,29 @@ function LockedScreen({ lock }) {
       setBusy(false);
     }
   };
-  return /* @__PURE__ */ jsxs37("div", { role: "region", "aria-label": "Vault locked", className: "flex h-full min-h-0 flex-col items-center justify-center gap-3 p-6 text-center", children: [
-    /* @__PURE__ */ jsx39(LockGlyph, { className: "size-8 text-muted-foreground" }),
-    /* @__PURE__ */ jsx39("div", { className: "text-base font-medium text-foreground", children: "Vault locked" }),
-    /* @__PURE__ */ jsx39(Button33, { variant: "primary", disabled: busy, onClick: () => void unlock(), children: lock.unlockLabel ?? "Unlock" }),
-    error ? /* @__PURE__ */ jsx39("div", { role: "alert", className: "max-w-sm text-sm text-destructive", children: error }) : null
+  return /* @__PURE__ */ jsxs38("div", { role: "region", "aria-label": "Vault locked", className: "flex h-full min-h-0 flex-col items-center justify-center gap-3 p-6 text-center", children: [
+    /* @__PURE__ */ jsx40(LockGlyph, { className: "size-8 text-muted-foreground" }),
+    /* @__PURE__ */ jsx40("div", { className: "text-base font-medium text-foreground", children: "Vault locked" }),
+    /* @__PURE__ */ jsx40(Button34, { variant: "primary", disabled: busy, onClick: () => void unlock(), children: lock.unlockLabel ?? "Unlock" }),
+    error ? /* @__PURE__ */ jsx40("div", { role: "alert", className: "max-w-sm text-sm text-destructive", children: error }) : null
   ] });
 }
-function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocationChange }) {
+function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocationChange, onInventory }) {
   const rootRef = useRef19(null);
   const width = useElementWidth(rootRef);
   const mode = layout !== "auto" ? layout : width >= FULL_AT ? "full" : width >= SPLIT_AT ? "split" : "stack";
   const notify = useNotify();
-  const [snap, setSnap] = useState40(null);
-  const [items, setItems] = useState40([]);
-  const [deleted, setDeleted] = useState40([]);
-  const [favorites, setFavorites] = useState40(null);
-  const [recents, setRecents] = useState40(null);
-  const [error, setError] = useState40(null);
-  const [inner, setInner] = useState40(DEFAULT_LOCATION);
+  const [snap, setSnap] = useState41(null);
+  const [items, setItems] = useState41([]);
+  const [deleted, setDeleted] = useState41([]);
+  const [favorites, setFavorites] = useState41(null);
+  const [recents, setRecents] = useState41(null);
+  const [error, setError] = useState41(null);
+  const [inner, setInner] = useState41(DEFAULT_LOCATION);
   const loc = location ?? inner;
   const dirty = useRef19(false);
-  const [notice, setNotice] = useState40(null);
+  const [notice, setNotice] = useState41(null);
+  const [firstCode, setFirstCode] = useState41(null);
   const move = useCallback5(
     (next, how) => {
       if (!location) setInner(next);
@@ -7878,7 +8215,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         move(next, how);
       };
       if (leaving && dirty.current) {
-        void confirm13({ title: "Discard your changes?", description: "What you changed in this item is not saved.", confirmLabel: "Discard", cancelLabel: "Keep editing", variant: "destructive" }).then((ok) => ok && proceed());
+        void confirm14({ title: "Discard your changes?", description: "What you changed in this item is not saved.", confirmLabel: "Discard", cancelLabel: "Keep editing", variant: "destructive" }).then((ok) => ok && proceed());
         return;
       }
       proceed();
@@ -7911,7 +8248,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   }, []);
   const knobsRef = useRef19(host.knobs);
   knobsRef.current = host.knobs;
-  const [signedOut, setSignedOut] = useState40(false);
+  const [signedOut, setSignedOut] = useState41(false);
   const load = useCallback5(() => {
     setError(null);
     port.load().then((s) => {
@@ -7931,6 +8268,11 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     port.lists.recents?.list().then(setRecents, () => void 0);
   }, [port]);
   useEffect23(load, [load]);
+  const inventoryRef = useRef19(onInventory);
+  inventoryRef.current = onInventory;
+  useEffect23(() => {
+    if (snap) inventoryRef.current?.({ items, definitions: snap.definitions });
+  }, [snap, items]);
   useEffect23(() => {
     if (!loc.itemId || !port.lists.recents) return;
     const id = loc.itemId;
@@ -7950,7 +8292,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       return inView(i, loc.view);
     });
     if (loc.view === "recent" && recents) return [...filtered].sort((a, b) => recents.indexOf(a.id) - recents.indexOf(b.id));
-    return sortItems(filtered, loc.sort);
+    return sortItems(filtered, loc.sort, recents);
   }, [inThisVault, loc.view, loc.q, loc.sort, favorites, recents, definitions]);
   const choices = useMemo6(() => vaultChoices(items, orgs, loc.vault), [items, orgs, loc.vault]);
   const matchingIds = useMemo6(() => host.page ? new Set(host.page.matchingItemIds) : void 0, [host.page]);
@@ -7977,70 +8319,86 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     });
   };
   if (error) {
-    return /* @__PURE__ */ jsxs37("div", { ref: rootRef, role: "alert", className: "flex h-full flex-col items-center justify-center gap-3 bg-background p-6 text-center text-sm", children: [
-      /* @__PURE__ */ jsx39(SafeGlyph, { className: "size-8 text-muted-foreground" }),
-      /* @__PURE__ */ jsx39("div", { className: "font-medium", children: "The vault couldn\u2019t open" }),
-      /* @__PURE__ */ jsx39("div", { className: "max-w-xs text-muted-foreground", children: signedOut ? "You\u2019ve been signed out." : plainLoadError(error) }),
-      /* @__PURE__ */ jsxs37("div", { className: "flex gap-2", children: [
-        signedOut && host.signIn ? /* @__PURE__ */ jsx39(Button33, { variant: "primary", onClick: host.signIn, children: "Sign in" }) : null,
-        /* @__PURE__ */ jsx39(Button33, { variant: signedOut && host.signIn ? "outline" : "primary", onClick: load, children: "Try again" })
+    return /* @__PURE__ */ jsxs38("div", { ref: rootRef, role: "alert", className: "flex h-full flex-col items-center justify-center gap-3 bg-background p-6 text-center text-sm", children: [
+      /* @__PURE__ */ jsx40(SafeGlyph, { className: "size-8 text-muted-foreground" }),
+      /* @__PURE__ */ jsx40("div", { className: "font-medium", children: "The vault couldn\u2019t open" }),
+      /* @__PURE__ */ jsx40("div", { className: "max-w-xs text-muted-foreground", children: signedOut ? "You\u2019ve been signed out." : plainLoadError(error) }),
+      /* @__PURE__ */ jsxs38("div", { className: "flex gap-2", children: [
+        signedOut && host.signIn ? /* @__PURE__ */ jsx40(Button34, { variant: "primary", onClick: host.signIn, children: "Sign in" }) : null,
+        /* @__PURE__ */ jsx40(Button34, { variant: signedOut && host.signIn ? "outline" : "primary", onClick: load, children: "Try again" })
       ] })
     ] });
   }
   if (!snap) {
-    return /* @__PURE__ */ jsx39("div", { ref: rootRef, className: "flex h-full bg-background", "aria-busy": "true", "aria-label": "Opening the vault", children: /* @__PURE__ */ jsx39("div", { className: "flex w-full max-w-sm flex-col gap-1 p-3", children: [0, 1, 2, 3, 4, 5, 6].map((n) => /* @__PURE__ */ jsxs37("div", { className: "flex h-12 items-center gap-3 px-2", children: [
-      /* @__PURE__ */ jsx39("div", { className: "size-8 animate-pulse rounded-lg bg-muted" }),
-      /* @__PURE__ */ jsxs37("div", { className: "flex flex-1 flex-col gap-1.5", children: [
-        /* @__PURE__ */ jsx39("div", { className: "h-3 w-2/3 animate-pulse rounded bg-muted" }),
-        /* @__PURE__ */ jsx39("div", { className: "h-2.5 w-1/3 animate-pulse rounded bg-muted" })
+    return /* @__PURE__ */ jsx40("div", { ref: rootRef, className: "flex h-full bg-background", "aria-busy": "true", "aria-label": "Opening the vault", children: /* @__PURE__ */ jsx40("div", { className: "flex w-full max-w-sm flex-col gap-1 p-3", children: [0, 1, 2, 3, 4, 5, 6].map((n) => /* @__PURE__ */ jsxs38("div", { className: "flex h-12 items-center gap-3 px-2", children: [
+      /* @__PURE__ */ jsx40("div", { className: "size-8 animate-pulse rounded-lg bg-muted" }),
+      /* @__PURE__ */ jsxs38("div", { className: "flex flex-1 flex-col gap-1.5", children: [
+        /* @__PURE__ */ jsx40("div", { className: "h-3 w-2/3 animate-pulse rounded bg-muted" }),
+        /* @__PURE__ */ jsx40("div", { className: "h-2.5 w-1/3 animate-pulse rounded bg-muted" })
       ] })
     ] }, n)) }) });
   }
   const hasFavorites = port.lists.favorites !== void 0;
   const title = loc.vault === "all" && loc.view === "all" ? "All items" : viewLabel(loc.view, views);
-  const compactHeader = mode === "full" ? void 0 : /* @__PURE__ */ jsxs37("div", { className: "grid grid-cols-[minmax(0,1fr)_minmax(0,1fr)_auto] gap-2", children: [
-    /* @__PURE__ */ jsx39(VaultSelect, { value: loc.vault, choices, onChange: (vault) => go({ vault, itemId: null, panel: null }) }),
-    /* @__PURE__ */ jsx39(Select11, { value: loc.view, onValueChange: (view) => go({ view, itemId: null, panel: null }), options: viewOptions(views, inThisVault.length, deleted.length, hasFavorites, port.lists.recents !== void 0, host.page !== void 0), "aria-label": "Show" }),
-    /* @__PURE__ */ jsxs37(DropdownMenu6, { children: [
-      /* @__PURE__ */ jsx39(DropdownMenuTrigger6, { asChild: true, children: /* @__PURE__ */ jsx39(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx39(MoreGlyph, {}), "aria-label": "Vault actions" }) }),
-      /* @__PURE__ */ jsxs37(DropdownMenuContent6, { align: "end", children: [
-        /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: () => go({ panel: "import" }), children: [
-          /* @__PURE__ */ jsx39(ImportGlyph, { className: "size-4" }),
+  const compactHeader = mode === "full" ? void 0 : /* @__PURE__ */ jsxs38("div", { className: "grid grid-cols-[minmax(0,1fr)_minmax(0,1fr)_auto_auto] gap-2", children: [
+    /* @__PURE__ */ jsx40(VaultSelect, { value: loc.vault, choices, onChange: (vault) => go({ vault, itemId: null, panel: null }) }),
+    /* @__PURE__ */ jsx40(Select12, { value: loc.view, onValueChange: (view) => go({ view, itemId: null, panel: null }), options: viewOptions(views, inThisVault.length, deleted.length, hasFavorites, port.lists.recents !== void 0, host.page !== void 0), "aria-label": "Show" }),
+    /* @__PURE__ */ jsx40(
+      Button34,
+      {
+        variant: loc.view === "authenticator" ? "outline" : "quiet",
+        icon: /* @__PURE__ */ jsx40(LockGlyph, {}),
+        "aria-label": AUTHENTICATOR_LABEL,
+        "aria-pressed": loc.view === "authenticator",
+        title: AUTHENTICATOR_LABEL,
+        onClick: () => go({ view: loc.view === "authenticator" ? "all" : "authenticator", itemId: null, mode: "view", panel: null }),
+        children: mode === "split" ? AUTHENTICATOR_LABEL : null
+      }
+    ),
+    /* @__PURE__ */ jsxs38(DropdownMenu6, { children: [
+      /* @__PURE__ */ jsx40(DropdownMenuTrigger6, { asChild: true, children: /* @__PURE__ */ jsx40(Button34, { variant: "quiet", icon: /* @__PURE__ */ jsx40(MoreGlyph, {}), "aria-label": "Vault actions" }) }),
+      /* @__PURE__ */ jsxs38(DropdownMenuContent6, { align: "end", children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "import" }), children: [
+          /* @__PURE__ */ jsx40(ImportGlyph, { className: "size-4" }),
           "Import"
         ] }),
-        /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: () => go({ panel: "export" }), children: [
-          /* @__PURE__ */ jsx39(ExportGlyph, { className: "size-4" }),
+        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "export" }), children: [
+          /* @__PURE__ */ jsx40(ExportGlyph, { className: "size-4" }),
           "Export"
         ] }),
-        /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: () => go({ panel: "backup" }), children: [
-          /* @__PURE__ */ jsx39(SafeGlyph, { className: "size-4" }),
+        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "backup" }), children: [
+          /* @__PURE__ */ jsx40(SafeGlyph, { className: "size-4" }),
           "Backup"
         ] }),
-        /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: () => go({ panel: "devices" }), children: [
-          /* @__PURE__ */ jsx39(ShieldGlyph, { className: "size-4" }),
+        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "devices" }), children: [
+          /* @__PURE__ */ jsx40(ShieldGlyph, { className: "size-4" }),
           "Browsers that fill"
         ] }),
-        host.nativeImport ? /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: () => go({ panel: "import-passkeys" }), children: [
-          /* @__PURE__ */ jsx39(ImportGlyph, { className: "size-4" }),
+        host.nativeImport ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "import-passkeys" }), children: [
+          /* @__PURE__ */ jsx40(ImportGlyph, { className: "size-4" }),
           "Import passkeys"
         ] }) : null,
-        host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: host.nativeProvider.openSetup, children: [
-          /* @__PURE__ */ jsx39(ShieldGlyph, { className: "size-4" }),
+        host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: host.nativeProvider.openSetup, children: [
+          /* @__PURE__ */ jsx40(ShieldGlyph, { className: "size-4" }),
           "System AutoFill"
         ] }) : null,
-        host.lock?.lock ? /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: () => void host.lock?.lock?.(), children: [
-          /* @__PURE__ */ jsx39(LockGlyph, { className: "size-4" }),
+        host.lock?.lock ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => void host.lock?.lock?.(), children: [
+          /* @__PURE__ */ jsx40(LockGlyph, { className: "size-4" }),
           "Lock"
+        ] }) : null,
+        host.openWebVault ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: host.openWebVault, children: [
+          /* @__PURE__ */ jsx40(ExternalGlyph, { className: "size-4" }),
+          "Open on the web"
         ] }) : null
       ] })
     ] })
   ] });
-  const viewHeader = /* @__PURE__ */ jsxs37("div", { className: "flex flex-col gap-2", children: [
+  const viewHeader = /* @__PURE__ */ jsxs38("div", { className: "flex flex-col gap-2", children: [
     compactHeader,
-    /* @__PURE__ */ jsx39(SearchField4, { value: loc.q, onChange: (e) => go({ q: e.target.value }, "replace"), placeholder: `Search ${viewLabel(loc.view, views)}`, "aria-label": `Search ${viewLabel(loc.view, views)}` })
+    /* @__PURE__ */ jsx40(SearchField4, { value: loc.q, onChange: (e) => go({ q: e.target.value }, "replace"), placeholder: `Search ${viewLabel(loc.view, views)}`, "aria-label": `Search ${viewLabel(loc.view, views)}` })
   ] });
   const viewProps = { port, host, items: inThisVault, deleted, definitions, query: loc.q, onOpen: (id) => go({ view: "all", itemId: id, mode: "view", panel: null }), onChanged: load, header: viewHeader };
-  const pageView = loc.view === "page" && host.page && !loc.q ? /* @__PURE__ */ jsx39(
+  const pageView = loc.view === "page" && host.page && !loc.q ? /* @__PURE__ */ jsx40(
     PageView,
     {
       port,
@@ -8058,8 +8416,8 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       ...compactHeader ? { header: compactHeader } : {}
     }
   ) : null;
-  const specialView = pageView ?? (loc.view === "authenticator" ? /* @__PURE__ */ jsx39(AuthenticatorView, { ...viewProps }) : loc.view === "trash" ? /* @__PURE__ */ jsx39(TrashView, { ...viewProps }) : null);
-  const list = specialView ?? /* @__PURE__ */ jsx39(
+  const specialView = pageView ?? (loc.view === "authenticator" ? /* @__PURE__ */ jsx40(AuthenticatorView, { ...viewProps }) : loc.view === "trash" ? /* @__PURE__ */ jsx40(TrashView, { ...viewProps }) : null);
+  const list = specialView ?? /* @__PURE__ */ jsx40(
     ItemList,
     {
       title,
@@ -8073,6 +8431,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       onQuery: (q) => go({ q }, "replace"),
       sort: loc.sort,
       onSort: (sort) => go({ sort }, "replace"),
+      canSortViewed: port.lists.recents !== void 0,
       onNew: () => go({ itemId: null, mode: "new", kind: null, panel: null }),
       ...matchingIds ? { matchingIds } : {},
       ...compactHeader ? { header: compactHeader } : {}
@@ -8086,9 +8445,9 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const onPanel = (panel2) => go({ panel: panel2 }, "push");
   let detail;
   if (loc.mode === "new" && !kindDefinition) {
-    detail = /* @__PURE__ */ jsx39(NewItemFlow, { definitions, url: loc.url, onUrl: (url) => go({ url }, "replace"), onChoose: (kind, _name, url) => go({ kind, url }, "push"), onCancel: () => go({ mode: "view", kind: null, url: "", itemId: null }) });
+    detail = /* @__PURE__ */ jsx40(NewItemFlow, { definitions, url: loc.url, onUrl: (url) => go({ url }, "replace"), onChoose: (kind, _name, url) => go({ kind, url }, "push"), onCancel: () => go({ mode: "view", kind: null, url: "", itemId: null }) });
   } else if (loc.mode === "new" && kindDefinition) {
-    detail = /* @__PURE__ */ jsx39(
+    detail = /* @__PURE__ */ jsx40(
       ItemPane,
       {
         port,
@@ -8101,9 +8460,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         seed: { name: guess?.name ?? "", url: guess?.url ?? loc.url.trim() },
         onBack: () => go({ kind: null }),
         onMode: () => void 0,
-        onSaved: (item, _wasNew, n) => {
+        onSaved: (item, _wasNew, n, enrolled) => {
           replaceItem(item);
           dirty.current = false;
+          if (enrolled) setFirstCode(item);
           move({ ...loc, itemId: item.id, mode: "view", kind: null, url: "", panel: null }, "replace");
           setNotice(n);
           notify("Saved");
@@ -8119,7 +8479,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       `new-${kindDefinition.key}`
     );
   } else if (selected) {
-    detail = /* @__PURE__ */ jsx39(
+    detail = /* @__PURE__ */ jsx40(
       ItemPane,
       {
         port,
@@ -8132,9 +8492,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         onBack: back,
         onMode: (m) => go({ mode: m, panel: null }),
         notice,
-        onSaved: (item, _wasNew, n) => {
+        onSaved: (item, _wasNew, n, enrolled) => {
           replaceItem(item);
           dirty.current = false;
+          if (enrolled) setFirstCode(item);
           move({ ...loc, mode: "view" }, "replace");
           setNotice(n);
           notify("Saved");
@@ -8162,23 +8523,23 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       selected.id
     );
   } else if (loc.itemId) {
-    detail = /* @__PURE__ */ jsx39(Blank, { children: "This item is not in your vault, or you cannot see it." });
+    detail = /* @__PURE__ */ jsx40(Blank, { children: "This item is not in your vault, or you cannot see it." });
   } else {
-    detail = /* @__PURE__ */ jsx39(Blank, { children: visible.length === 0 ? "" : "Select an item" });
+    detail = /* @__PURE__ */ jsx40(Blank, { children: visible.length === 0 ? "" : "Select an item" });
   }
   const [panelName, panelArg] = (loc.panel ?? "").split(/:(.*)/s);
   const closePanel = () => go({ panel: null }, "push");
   const vaultPanelProps = { port, host, items, definitions, organizations: orgs, onClose: closePanel, onChanged: load };
   let panel = null;
-  if (panelName === "import") panel = /* @__PURE__ */ jsx39(ImportWithLimits, { ...vaultPanelProps, knobs: host.knobs });
-  else if (panelName === "devices") panel = /* @__PURE__ */ jsx39(DevicesPanel, { ...vaultPanelProps });
-  else if (panelName === "approve" && panelArg) panel = /* @__PURE__ */ jsx39(ApprovePanel, { ...vaultPanelProps, ...approvalFromParams(panelArg, new URLSearchParams(globalThis.location?.search ?? "")) });
-  else if (panelName === "import-passkeys" && host.nativeImport) panel = /* @__PURE__ */ jsx39(NativeImportPanel, { ...vaultPanelProps, bridge: host.nativeImport, readLimits: port.native.limits, activeOrganizationId: orgs[0]?.id ?? null });
-  else if (panelName === "export") panel = /* @__PURE__ */ jsx39(ExportPanel, { ...vaultPanelProps });
-  else if (panelName === "backup") panel = /* @__PURE__ */ jsx39(BackupPanel, { ...vaultPanelProps });
+  if (panelName === "import") panel = /* @__PURE__ */ jsx40(ImportWithLimits, { ...vaultPanelProps, knobs: host.knobs });
+  else if (panelName === "devices") panel = /* @__PURE__ */ jsx40(DevicesPanel, { ...vaultPanelProps });
+  else if (panelName === "approve" && panelArg) panel = /* @__PURE__ */ jsx40(ApprovePanel, { ...vaultPanelProps, ...approvalFromParams(panelArg, new URLSearchParams(globalThis.location?.search ?? "")) });
+  else if (panelName === "import-passkeys" && host.nativeImport) panel = /* @__PURE__ */ jsx40(NativeImportPanel, { ...vaultPanelProps, bridge: host.nativeImport, readLimits: port.native.limits, activeOrganizationId: orgs[0]?.id ?? null });
+  else if (panelName === "export") panel = /* @__PURE__ */ jsx40(ExportPanel, { ...vaultPanelProps });
+  else if (panelName === "backup") panel = /* @__PURE__ */ jsx40(BackupPanel, { ...vaultPanelProps });
   else if (panelName && selected && ITEM_PANELS[panelName]) {
     const P = ITEM_PANELS[panelName];
-    panel = /* @__PURE__ */ jsx39(
+    panel = /* @__PURE__ */ jsx40(
       P,
       {
         item: selected,
@@ -8201,17 +8562,17 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   }
   const grid = mode === "full" ? "grid-cols-[15rem_21rem_minmax(0,1fr)]" : mode === "split" ? "grid-cols-[19rem_minmax(0,1fr)]" : "grid-cols-1";
   const shown = panesShown(mode, specialView !== null, showingDetail);
-  return /* @__PURE__ */ jsxs37("div", { ref: rootRef, className: "flex h-full min-h-0 w-full flex-col bg-background text-foreground", children: [
-    snap.unavailable.length > 0 ? /* @__PURE__ */ jsxs37("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
-      /* @__PURE__ */ jsxs37("span", { className: "min-w-0 flex-1 truncate text-warning", children: [
+  return /* @__PURE__ */ jsxs38("div", { ref: rootRef, className: "flex h-full min-h-0 w-full flex-col bg-background text-foreground", children: [
+    snap.unavailable.length > 0 ? /* @__PURE__ */ jsxs38("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
+      /* @__PURE__ */ jsxs38("span", { className: "min-w-0 flex-1 truncate text-warning", children: [
         "Couldn\u2019t load ",
         snap.unavailable.join(", "),
         ". Showing the rest."
       ] }),
-      /* @__PURE__ */ jsx39("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: load, children: "Try again" })
+      /* @__PURE__ */ jsx40("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: load, children: "Try again" })
     ] }) : null,
-    /* @__PURE__ */ jsxs37("div", { className: `grid min-h-0 w-full flex-1 ${grid} overflow-hidden`, children: [
-      mode === "full" ? /* @__PURE__ */ jsx39(
+    /* @__PURE__ */ jsxs38("div", { className: `grid min-h-0 w-full flex-1 ${grid} overflow-hidden`, children: [
+      mode === "full" ? /* @__PURE__ */ jsx40(
         VaultSidebar,
         {
           vault: loc.vault,
@@ -8230,9 +8591,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
           hasPage: host.page !== void 0
         }
       ) : null,
-      shown.list ? /* @__PURE__ */ jsx39("div", { className: specialView && mode !== "stack" ? "col-span-2 min-h-0" : "min-h-0", children: list }) : null,
+      shown.list ? /* @__PURE__ */ jsx40("div", { className: specialView && mode !== "stack" ? "col-span-2 min-h-0" : "min-h-0", children: list }) : null,
       shown.detail ? detail : null,
-      panel
+      panel,
+      firstCode ? /* @__PURE__ */ jsx40(FirstCodePanel, { port, item: firstCode, onClose: () => setFirstCode(null), onDone: () => setFirstCode(null) }) : null
     ] })
   ] });
 }
@@ -8240,8 +8602,8 @@ function plainLoadError(message2) {
   return /load failed|failed to fetch|network|timed? ?out/i.test(message2) ? "The connection dropped. Check you\u2019re online, then try again." : message2;
 }
 function Blank({ children }) {
-  return /* @__PURE__ */ jsxs37("div", { className: "flex h-full flex-col items-center justify-center gap-3 bg-background text-sm text-muted-foreground", children: [
-    /* @__PURE__ */ jsx39(SafeGlyph, { className: "size-10 text-disabled-foreground" }),
+  return /* @__PURE__ */ jsxs38("div", { className: "flex h-full flex-col items-center justify-center gap-3 bg-background text-sm text-muted-foreground", children: [
+    /* @__PURE__ */ jsx40(SafeGlyph, { className: "size-10 text-disabled-foreground" }),
     children
   ] });
 }
@@ -8611,6 +8973,20 @@ function createListsPort(ctx, door) {
 
 // src/sharing/api.ts
 import * as account6 from "@ai-matrx/api/account";
+
+// src/secret-field-in.ts
+function secretFieldIn(s) {
+  const envKey = s.envKey?.trim() || null;
+  return {
+    field_key: fieldKeyOf(s.label),
+    value: s.value,
+    handling: s.handling ?? "revealable",
+    ...envKey ? { env_key: envKey } : {},
+    ...envKey && s.injectIntoSandbox ? { inject_into_sandbox: true } : {}
+  };
+}
+
+// src/sharing/api.ts
 function grantOf(w) {
   const org = Boolean(w.organization_id);
   return {
@@ -8710,7 +9086,7 @@ function createSharingPort(ctx, options = {}) {
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
             ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
-            ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map((s) => ({ field_key: fieldKeyOf(s.label), value: s.value, handling: "revealable" }))
+            ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn)
           ]
         }
       });
@@ -8996,14 +9372,16 @@ function createApiVaultPort(api, options = {}) {
           login_urls: draft.loginUrls,
           // A login a person saves with its website is offered on that website (the server's own
           // default is off, which made "Save a login" on a page answer "No saved login" there).
-          ...draft.loginUrls.length > 0 ? { browser_fill_enabled: true } : {},
+          ...draft.browser ? { uri_match_mode: draft.browser.uriMatchMode, browser_fill_enabled: draft.browser.browserFillEnabled } : draft.loginUrls.length > 0 ? { browser_fill_enabled: true } : {},
           notes: draft.notes || null,
           principal: organizationId ? { type: "organization", organization_id: organizationId } : { type: "user" },
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
             ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
-            ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map((s) => ({ field_key: fieldKeyOf(s.label), value: s.value, handling: "revealable" }))
+            ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn),
+            // Backup codes on a type that does not declare them (a website login): their own encrypted field.
+            ...!declared.some((f) => f.key === RECOVERY_CODES_KEY) && (draft.values[RECOVERY_CODES_KEY] ?? "").trim() !== "" ? [{ field_key: RECOVERY_CODES_KEY, value: parseRecoveryCodes(draft.values[RECOVERY_CODES_KEY] ?? "").join("\n"), handling: "revealable", description: "One-time account recovery codes" }] : []
           ]
         }
       }, organizationId ? { organizationId } : void 0);
@@ -9041,7 +9419,7 @@ function createApiVaultPort(api, options = {}) {
       }
       for (const s of draft.secrets) {
         if (s.label.trim() === "" || s.value === "") continue;
-        await account9.addField(api, { path: { item_id: item.id }, body: { field_key: fieldKeyOf(s.label), value: s.value, handling: "revealable" } }, opts);
+        await account9.addField(api, { path: { item_id: item.id }, body: secretFieldIn(s) }, opts);
       }
       for (const id of draft.removed) await account9.deleteField(api, { path: { item_id: item.id, field_id: id } }, opts);
       return { item: await refetch(item.id, item.owner), notice: null };
@@ -9066,6 +9444,44 @@ function createVaultKnobs(client, address) {
     return snap.resolved;
   };
 }
+
+// src/agent-context.ts
+var hostOf = (url) => {
+  try {
+    return new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(url) ? url : `https://${url}`).host || null;
+  } catch {
+    return null;
+  }
+};
+function providerOf(item, definitions) {
+  return definitions.find((d) => d.key === item.definitionKey)?.providerKey ?? null;
+}
+function vaultItemFacts(item, definitions) {
+  const provider = providerOf(item, definitions);
+  const hosts = item.loginUrls.map(hostOf).filter((h) => Boolean(h));
+  const keys = item.fields.map((f) => f.key).filter((k) => !isAuthenticatorStorage(k));
+  return [
+    `Name: ${item.name}`,
+    ...item.definitionLabel ? [`Type: ${item.definitionLabel}`] : [],
+    ...provider ? [`Provider: ${provider}`] : [],
+    ...hosts.length ? [`Sites: ${hosts.join(", ")}`] : [],
+    `Owner: ${item.owner.label}`,
+    `Status: ${item.turnedOff ? "turned off" : "active"}`,
+    ...item.accessMode ? [`Access: ${item.accessMode}`] : [],
+    ...item.tags.length ? [`Tags: ${item.tags.join(", ")}`] : [],
+    ...keys.length ? [`Fields: ${keys.join(", ")}`] : [],
+    ...item.authenticator ? ["Has a one-time password"] : []
+  ];
+}
+function vaultInventoryScope(inventory, clicked = null) {
+  const { items, definitions } = inventory;
+  const providers = [...new Set(items.map((i) => providerOf(i, definitions)).filter((p) => Boolean(p)))];
+  const content = clicked ? vaultItemFacts(clicked, definitions) : [`Vault \u2014 ${items.length} ${items.length === 1 ? "item" : "items"}`, ...items.map((i) => `\u2022 ${i.name}${i.definitionLabel ? ` \u2014 ${i.definitionLabel}` : ""}`)];
+  return { content: content.join("\n"), credential_count: items.length, credential_labels: items.map((i) => i.name), credential_providers: providers };
+}
+function itemIdAt(target) {
+  return target?.closest("[data-item]")?.getAttribute("data-item") ?? null;
+}
 export {
   CATEGORIES,
   CONFIRM_RETURN_KEY,
@@ -9084,15 +9500,19 @@ export {
   guardPort,
   inferFromUrl,
   isHiddenItem,
+  itemIdAt,
   locationFromParams,
   locationToParams,
   loginSiteOf,
   matchesQuery,
   needsRecentSignIn,
   parseDefinitions,
+  providerOf,
   siteDomainOf,
   sortItems,
   useConfirmed,
+  vaultInventoryScope,
+  vaultItemFacts,
   wasCancelled
 };
 //# sourceMappingURL=index.js.map