@ai-matrx/vault 0.1.18 → 0.1.20

package/dist/index.cjs

@@ -740,7 +740,7 @@ var DAY_FORMAT = { year: "numeric", month: "short", day: "numeric" };
 var import_jsx_runtime5 = require("react/jsx-runtime");
 var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function SecretText({ value, multiline }) {
-  if (multiline || value.length > 200) return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
+  if (multiline || value.length > 200 || value.includes("\n")) return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "break-all font-mono text-sm tracking-wide", children: [...value].map((ch, i) => /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: /[0-9]/.test(ch) ? "text-primary" : /[^A-Za-z0-9]/.test(ch) ? "text-warning" : void 0, children: ch }, i)) });
 }
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
@@ -876,18 +876,19 @@ function EditRow({ label, hint: hint2, value, onChange, placeholder, secret = fa
     }
   );
 }
-function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue }) {
+function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue, multiline = false }) {
   const [shown, setShown] = (0, import_react5.useState)(false);
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
     VaultRow,
     {
       label: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Field, { className: "w-full", value: label, onChange: (e) => onLabel(e.target.value), placeholder: "Name", "aria-label": "Field name" }),
+      top: multiline,
       actions: /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
-        secret && value ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: shown ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeOffGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
+        secret && value && !multiline ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: shown ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeOffGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
         extra,
         /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", removes: true, icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(XGlyph, {}), "aria-label": "Remove field", onClick: onRemove })
       ] }),
-      children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+      children: multiline ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Textarea, { className: "w-full", value, onChange: (e) => onValue(e.target.value), rows: 4, placeholder: secret ? "Encrypted, hidden until shown" : "Value", autoComplete: "off", spellCheck: !secret, "aria-label": label ? `${label} value` : "Field value" }) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
         import_controls2.Field,
         {
           className: "w-full",
@@ -929,6 +930,7 @@ function locationFromParams(params, itemId = params.get("item")) {
     mode: mode === "edit" || mode === "new" ? mode : "view",
     kind: params.get("kind"),
     url: params.get("url") ?? "",
+    ...params.get("name") ? { name: params.get("name") ?? "" } : {},
     panel: params.get("panel")
   };
 }
@@ -941,6 +943,7 @@ function locationToParams(loc) {
   if (loc.mode !== "view") q.set("mode", loc.mode);
   if (loc.kind) q.set("kind", loc.kind);
   if (loc.url) q.set("url", loc.url);
+  if (loc.name) q.set("name", loc.name);
   if (loc.panel) q.set("panel", loc.panel);
   return q;
 }
@@ -1004,6 +1007,7 @@ function sortItems(items, sort, recents) {
   if (sort === "updated") return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return out.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+var SECURE_NOTE_KEY = "secure_notes";
 function draftOf(item) {
   return {
     name: item?.name ?? "",
@@ -1054,7 +1058,9 @@ function rebaseDraft(oldBase, newBase, draft) {
     secrets: draft.secrets,
     custom,
     removed: draft.removed,
-    authenticator: draft.authenticator
+    authenticator: draft.authenticator,
+    ...draft.browser ? { browser: draft.browser } : {},
+    ...draft.fieldSettings ? { fieldSettings: draft.fieldSettings } : {}
   };
 }
 function panesShown(mode, specialView, showingDetail) {
@@ -1082,7 +1088,8 @@ var FAMILY_LABELS = {
   signing_files: "Signing & files"
 };
 var COMMON_DEFINITION_KEYS = ["website_login", "username_password", "api_key", "env_value", "database_login", "custom"];
-var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes)/;
+var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes|(^|_)notes?($|_))/;
+var isMultilineKey = (key) => MULTILINE.test(key);
 var SECRET = /(password|secret|token|api_key|private|passphrase|credential|seed|key$|_key)/;
 var URLISH = /(url|uri|endpoint|webhook|hook)/;
 function humanize(key) {
@@ -1981,10 +1988,16 @@ function QrScanPanel({ open, onResult, onClose }) {
     /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { className: "text-center text-xs text-muted-foreground", children: "Point at the site's QR code" })
   ] });
 }
-function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "Paste setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status }) {
+function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "Paste setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status, autoStartCamera = false }) {
   const file = (0, import_react10.useRef)(null);
   const canScan = useCanScan();
   const [scanning, setScanning] = (0, import_react10.useState)(false);
+  const autoStarted = (0, import_react10.useRef)(false);
+  (0, import_react10.useEffect)(() => {
+    if (!autoStartCamera || !canScan || disabled || autoStarted.current || value) return;
+    autoStarted.current = true;
+    setScanning(true);
+  }, [autoStartCamera, canScan, disabled, value]);
   const [reading, setReading] = (0, import_react10.useState)(false);
   const [imageError, setImageError] = (0, import_react10.useState)(null);
   const [dragging, setDragging] = (0, import_react10.useState)(false);
@@ -2290,7 +2303,7 @@ function normalizeWebsite(raw) {
     return null;
   }
 }
-function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onDone }) {
+function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
   const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = (0, import_react12.useState)("");
@@ -2343,6 +2356,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       setInput("");
       setImage(null);
       setSaved(next);
+      onAdded?.(next);
       onChanged();
     } catch (e) {
       setError(wasCancelled(e) ? "Not confirmed, so nothing was added." : otpActionError(e, "add it"));
@@ -2369,6 +2383,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
               label: "Setup key",
               value: input,
               autoFocus: true,
+              autoStartCamera: true,
               disabled: busy,
               onChange: (v) => {
                 setImage(null);
@@ -2450,7 +2465,23 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
+function withAdded(items, added) {
+  if (added.size === 0) return items;
+  const seen = /* @__PURE__ */ new Set();
+  const out = items.map((i) => {
+    seen.add(i.id);
+    const mine = added.get(i.id);
+    return mine && !i.authenticator ? { ...i, authenticator: mine.authenticator, name: mine.name } : i;
+  });
+  for (const [id, a] of added) if (!seen.has(id)) out.push(a);
+  return out;
+}
+function AuthenticatorView({ port, host, items: listed, definitions, query, onOpen, onChanged, header }) {
+  const [added, setAdded] = (0, import_react13.useState)(/* @__PURE__ */ new Map());
+  const items = withAdded(listed, added);
+  (0, import_react13.useEffect)(() => {
+    if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
+  }, [listed, added]);
   const [entries, setEntries] = (0, import_react13.useState)(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = (0, import_react13.useState)(/* @__PURE__ */ new Set());
   const [adding, setAdding] = (0, import_react13.useState)(false);
@@ -2466,7 +2497,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
     return () => {
       live = false;
     };
-  }, [port, items]);
+  }, [port, listed, added]);
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -2512,6 +2543,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
         definitions,
         onClose: () => setAdding(false),
         onChanged,
+        onAdded: (item) => setAdded((cur) => new Map(cur).set(item.id, item)),
         onDone: (id) => {
           setAdding(false);
           onOpen(id);
@@ -3918,7 +3950,7 @@ var MAX_FAILURES_IN_A_ROW = 5;
 var failureText = (cause) => cause instanceof Error && cause.message ? cause.message : "The server refused this one.";
 async function runImport(input) {
   const { io, organizationId, lines, keys, confirmed } = input;
-  const result = { created: [], failed: [], withOtp: 0, stoppedEarly: false, untried: [] };
+  const result = { created: [], failed: [], withOtp: 0, needOtp: [], stoppedEarly: false, untried: [] };
   let streak = 0;
   for (let i = 0; i < lines.length; i += 1) {
     const line = lines[i];
@@ -3937,7 +3969,10 @@ async function runImport(input) {
     try {
       const made = await confirmed(() => io.createImported(command.body, organizationId, key));
       result.created.push(made);
-      if (command.hasOtp) result.withOtp += 1;
+      if (command.hasOtp) {
+        result.withOtp += 1;
+        result.needOtp.push(made);
+      }
       streak = 0;
     } catch (cause) {
       const reason = failureText(cause);
@@ -4537,8 +4572,9 @@ var STATE_BADGE = {
   unsupported: { text: "Not supported", tone: "neutral" }
 };
 var ME = "me";
-function ImportPanel({ port, host, items, organizations, onClose, onChanged, limits }) {
+function ImportPanel({ port, host, items, definitions, organizations, onClose, onChanged, limits }) {
   const confirmed = useConfirmed();
+  const [otpFor, setOtpFor] = (0, import_react20.useState)(null);
   const fileInput = (0, import_react20.useRef)(null);
   const abort = (0, import_react20.useRef)(null);
   const stop = (0, import_react20.useRef)(false);
@@ -4646,6 +4682,7 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
       failed: result.failed,
       skipped,
       withOtp: (previous?.withOtp ?? 0) + result.withOtp,
+      needOtp: [...previous?.needOtp ?? [], ...result.needOtp],
       untried: result.untried
     };
     setDone(merged);
@@ -4671,7 +4708,7 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
     setRunning({ done: 0, total: chosen });
     try {
       const made = await confirmed(() => port.io.importEnv(text, organizationId, injectSandbox));
-      setDone({ created: made, failed: [], skipped: draft.entries.length - chosen, withOtp: 0, untried: [] });
+      setDone({ created: made, failed: [], skipped: draft.entries.length - chosen, withOtp: 0, needOtp: [], untried: [] });
       if (made.length > 0) onChanged();
     } catch (cause) {
       setError(cause instanceof Error ? cause.message : "The import could not finish.");
@@ -4786,9 +4823,32 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
         plural(done.withOtp, "login"),
         " still need the one-time password added."
       ] }) }) : null,
+      done.needOtp.map((made) => {
+        const now = items.find((i) => i.id === made.id);
+        if (now?.authenticator) return null;
+        return /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: "Authenticator", children: /* @__PURE__ */ (0, import_jsx_runtime19.jsxs)("button", { type: "button", className: "truncate text-left text-primary hover:underline", onClick: () => setOtpFor(made.id), children: [
+          "Set up authenticator for ",
+          made.name
+        ] }) }, `otp:${made.id}`);
+      }),
       done.failed.map((f) => /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(VaultRow, { label: f.title, children: /* @__PURE__ */ (0, import_jsx_runtime19.jsx)("span", { className: "block truncate text-destructive", title: f.reason, children: f.reason }) }, f.key))
     ] }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(ErrorLine, { message: error })
+    /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(ErrorLine, { message: error }),
+    otpFor ? /* @__PURE__ */ (0, import_jsx_runtime19.jsx)(
+      AddOtpPanel,
+      {
+        port,
+        items,
+        definitions,
+        itemId: otpFor,
+        onClose: () => setOtpFor(null),
+        onChanged,
+        onDone: () => {
+          setOtpFor(null);
+          onChanged();
+        }
+      }
+    ) : null
   ] });
 }
 function toggle(set, key, on) {
@@ -5208,14 +5268,12 @@ var import_confirm_opener7 = require("@ai-matrx/kit/confirm-opener");
 var import_jsx_runtime22 = require("react/jsx-runtime");
 var HANDLINGS = ["visible", "revealable", "sealed"];
 var hint = (text, tone = "muted") => /* @__PURE__ */ (0, import_jsx_runtime22.jsx)("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
-var hasSecretSettings = (s) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== "revealable");
-function SecretBuilderRow({ field, onChange, onRemove }) {
-  const [open, setOpen] = (0, import_react23.useState)(hasSecretSettings(field));
-  const env = field.envKey ?? "";
+var saysMore = (s, defaultHandling) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== defaultHandling);
+function FieldSettingsRows({ name, value, defaultHandling = "revealable", onChange }) {
+  const env = value.envKey ?? "";
   const envProblem = envKeyProblem(env);
   const envOk = env.trim() !== "" && !envProblem;
-  const handling = field.handling ?? "revealable";
-  const name = field.label.trim() || "Secret";
+  const handling = value.handling ?? defaultHandling;
   const chooseHandling = async (next) => {
     if (next === handling) return;
     if (next === "sealed") {
@@ -5229,6 +5287,38 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
     }
     onChange({ handling: next });
   };
+  return /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
+      import_controls18.Field,
+      {
+        className: "w-full font-mono",
+        "aria-label": `${name} env key`,
+        "aria-invalid": Boolean(envProblem),
+        placeholder: "e.g. GITHUB_TOKEN",
+        autoComplete: "off",
+        spellCheck: false,
+        value: env,
+        onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
+      }
+    ) }),
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
+      import_controls18.SegmentedControl,
+      {
+        "aria-label": `Who can see ${name}`,
+        value: handling,
+        onValueChange: (v) => void chooseHandling(v),
+        data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
+      }
+    ) }),
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Switch, { "aria-label": `Use ${name} in sandbox`, checked: envOk && value.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
+  ] });
+}
+var hasSecretSettings = (s) => saysMore(s, "revealable");
+var hasDeclaredSettings = (s, defaultHandling) => Boolean(s && saysMore(s, defaultHandling));
+function SecretBuilderRow({ field, onChange, onRemove }) {
+  const [open, setOpen] = (0, import_react23.useState)(hasSecretSettings(field));
+  const handling = field.handling ?? "revealable";
+  const name = field.label.trim() || "Secret";
   return /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
     /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
       CustomEditRow,
@@ -5236,47 +5326,26 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
         label: field.label,
         value: field.value,
         secret: true,
+        multiline: field.multiline === true,
         onLabel: (v) => onChange({ label: v }),
         onValue: (v) => onChange({ value: v }),
         onRemove,
-        onPasteValue: (text) => {
-          const a = parseEnvAssignment(text);
-          if (!a) return false;
-          onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
-          setOpen(true);
-          return true;
+        ...field.multiline ? {} : {
+          onPasteValue: (text) => {
+            const a = parseEnvAssignment(text);
+            if (!a) return false;
+            onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
+            setOpen(true);
+            return true;
+          }
         },
         extra: /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
-          handling !== "sealed" ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
+          handling !== "sealed" && !field.multiline ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
           /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(SlidersGlyph, {}), "aria-label": `${name} settings`, pressed: open, onClick: () => setOpen((o) => !o) })
         ] })
       }
     ),
-    open ? /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
-        import_controls18.Field,
-        {
-          className: "w-full font-mono",
-          "aria-label": `${name} env key`,
-          "aria-invalid": Boolean(envProblem),
-          placeholder: "e.g. GITHUB_TOKEN",
-          autoComplete: "off",
-          spellCheck: false,
-          value: env,
-          onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
-        }
-      ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
-        import_controls18.SegmentedControl,
-        {
-          "aria-label": `Who can see ${name}`,
-          value: handling,
-          onValueChange: (v) => void chooseHandling(v),
-          data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
-        }
-      ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Switch, { "aria-label": `Use ${name} in sandbox`, checked: envOk && field.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
-    ] }) : null
+    open ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(FieldSettingsRows, { name, value: field, onChange }) : null
   ] });
 }
 function withMfaMethod(custom, v) {
@@ -5906,6 +5975,8 @@ function SharingSummary({ item, port, className }) {
 // src/ItemPane.tsx
 var import_format8 = require("@ai-matrx/kit/format");
 var import_jsx_runtime27 = require("react/jsx-runtime");
+var ENV_VALUE_KEY = "env_value";
+var secureNoteDraft = () => ({ key: SECURE_NOTE_KEY, label: "Secure note", value: "", multiline: true, description: "Encrypted notes" });
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
@@ -6096,6 +6167,16 @@ function ItemPane(props) {
   const fieldSettings = (f) => canEdit ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(SlidersGlyph, {}), "aria-label": `${f.label} settings`, title: `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }) : null;
   const turnOnOne = canTurnOn ? (f) => () => turnOn([f]) : () => void 0;
   const declaredKeys = new Set(declared.map((f) => f.key));
+  const hasSecureNote = declaredKeys.has(SECURE_NOTE_KEY) || Boolean(item?.fields.some((f) => f.key === SECURE_NOTE_KEY)) || draft.secrets.some((x) => x.key === SECURE_NOTE_KEY);
+  const [settingsToggled, setSettingsToggled] = (0, import_react28.useState)(/* @__PURE__ */ new Set());
+  const settingsOpen = (f) => settingsToggled.has(f.key) !== (definition?.key === ENV_VALUE_KEY || hasDeclaredSettings(draft.fieldSettings?.[f.key], f.handling));
+  const toggleSettings = (key) => setSettingsToggled((cur) => {
+    const next = new Set(cur);
+    if (next.has(key)) next.delete(key);
+    else next.add(key);
+    return next;
+  });
+  const patchFieldSettings = (key, p) => setDraft((d) => ({ ...d, fieldSettings: { ...d.fieldSettings, [key]: { ...d.fieldSettings?.[key], ...p } } }));
   const extraFields = (item?.fields ?? []).filter((f) => !declaredKeys.has(f.key) && !draft.removed.includes(f.id) && !isAuthenticatorStorage(f.key));
   const metaValue = (key) => draft.values[key] ?? item?.custom.find((c) => c.key === key)?.value ?? "";
   const extraCustom = draft.custom.filter((c) => !declaredKeys.has(c.key) && c.key !== MFA_METHOD_KEY && !isAuthenticatorStorage(c.key));
@@ -6228,24 +6309,29 @@ function ItemPane(props) {
           const secretKind = f.storage === "encrypted" && f.kind === "secret";
           const value = f.storage === "metadata" ? metaValue(f.key) : draft.values[f.key] ?? "";
           const hidden = existing && existing.handling !== "visible" && !(f.key in loaded);
-          return /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
-            EditRow,
-            {
-              label: f.label,
-              value,
-              placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
-              secret: secretKind,
-              multiline: f.kind === "multiline",
-              inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
-              onChange: (v) => setValue(f.key, v),
-              actions: /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_jsx_runtime27.Fragment, { children: [
-                hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
-                secretKind ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
-                existing ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_icons11.SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null
-              ] })
-            },
-            f.key
-          );
+          const newSecret = mode === "new" && f.storage === "encrypted" && owner !== "person";
+          const open = newSecret && settingsOpen(f);
+          return /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_react28.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
+              EditRow,
+              {
+                label: f.label,
+                value,
+                placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
+                secret: secretKind,
+                multiline: f.kind === "multiline" || value.includes("\n"),
+                inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
+                onChange: (v) => setValue(f.key, v),
+                actions: /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_jsx_runtime27.Fragment, { children: [
+                  hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
+                  secretKind ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
+                  existing ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_icons11.SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null,
+                  newSecret ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(SlidersGlyph, {}), "aria-label": `${f.label} settings`, pressed: open, onClick: () => toggleSettings(f.key) }) : null
+                ] })
+              }
+            ),
+            open ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(FieldSettingsRows, { name: f.label, value: draft.fieldSettings?.[f.key] ?? {}, defaultHandling: f.handling, onChange: (p) => patchFieldSettings(f.key, p) }) : null
+          ] }, f.key);
         }),
         extraFields.map((f) => /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
           EditRow,
@@ -6254,7 +6340,7 @@ function ItemPane(props) {
             value: draft.values[f.key] ?? "",
             placeholder: f.handling === "visible" || f.key in loaded ? "" : "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
             secret: f.handling !== "visible" && !isRecoveryCodesField(f),
-            multiline: isRecoveryCodesField(f),
+            multiline: f.kind === "multiline" || isRecoveryCodesField(f) || (draft.values[f.key] ?? "").includes("\n"),
             onChange: (v) => setValue(f.key, v),
             onRemove: () => patch({ removed: [...draft.removed, f.id] }),
             removeLabel: `Delete ${f.label}`,
@@ -6323,6 +6409,7 @@ function ItemPane(props) {
             /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(PlusGlyph, {}), children: "Add" }) }),
             /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_design_system17.DropdownMenuContent, { align: "end", children: [
               /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ secrets: [...draft.secrets, { key: "", label: "", value: "" }] }), children: "Secret field" }),
+              !hasSecureNote ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ secrets: [...draft.secrets, secureNoteDraft()] }), children: "Secure note" }) : null,
               /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ custom: [...draft.custom, { key: `custom_${draft.custom.length + 1}_${Date.now() % 1e5}`, label: "", value: "" }] }), children: "Text field" }),
               !tagsVisible ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => setShowTags(true), children: "Tags" }) : null,
               !descriptionVisible ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => setShowDescription(true), children: "Description" }) : null,
@@ -6410,6 +6497,13 @@ function ItemPane(props) {
 
 // src/ItemList.tsx
 var import_jsx_runtime28 = require("react/jsx-runtime");
+var RECOVERY_KEYS = /^recovery_codes?$/;
+function otherCopyFields(item, user, secret) {
+  if (!item.capabilities.canUse) return [];
+  return item.fields.filter(
+    (f) => f !== user && f !== secret && f.active !== false && f.handling !== "sealed" && (f.handling === "visible" || item.capabilities.canReveal) && !isAuthenticatorStorage(f.key) && !RECOVERY_KEYS.test(f.key)
+  );
+}
 var SORTS2 = [
   { value: "name", label: "Name A\u2013Z" },
   { value: "name-desc", label: "Name Z\u2013A" },
@@ -6422,7 +6516,7 @@ function subtitleOf(item, withOwner) {
   const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
-function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, showOwner, canSortViewed = false }) {
+function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, showOwner, canSortViewed = false, onRefresh, refreshing = false, rowContextMenu = "package", rowMenuItems }) {
   const sorts = SORTS2.filter((s) => canSortViewed || s.value !== "viewed");
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
@@ -6443,7 +6537,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     }
   };
   const mixedOwners = showOwner ?? new Set(items.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
-  const row = (i) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners }, i.id);
+  const row = (i) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners, ownContextMenu: rowContextMenu === "package", extra: rowMenuItems }, i.id);
   const sortLabel = sorts.find((s) => s.value === sort)?.label ?? "Name A\u2013Z";
   return /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("section", { "aria-label": title, className: "flex h-full min-h-0 flex-col border-r border-border bg-background", children: [
     /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: "flex flex-col gap-2 px-3 pb-2 pt-3", children: [
@@ -6458,9 +6552,12 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
           " ",
           items.length === 1 ? "item" : "items"
         ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenu, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(SortGlyph, {}), "aria-label": `Sort: ${sortLabel}`, children: sortLabel }) }),
-          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuContent, { align: "end", children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuRadioGroup, { value: sort, onValueChange: (v) => onSort(sorts.find((s) => s.value === v)?.value ?? "name"), children: sorts.map((s) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuRadioItem, { value: s.value, children: s.label }, s.value)) }) })
+        /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("span", { className: "flex shrink-0 items-center gap-0.5", children: [
+          onRefresh ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(RefreshGlyph, { className: refreshing ? "animate-spin" : "" }), "aria-label": "Refresh", title: "Refresh the list", disabled: refreshing, onClick: onRefresh }) : null,
+          /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenu, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(SortGlyph, {}), "aria-label": `Sort: ${sortLabel}`, children: sortLabel }) }),
+            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuContent, { align: "end", children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuRadioGroup, { value: sort, onValueChange: (v) => onSort(sorts.find((s) => s.value === v)?.value ?? "name"), children: sorts.map((s) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuRadioItem, { value: s.value, children: s.label }, s.value)) }) })
+          ] })
         ] })
       ] })
     ] }),
@@ -6475,7 +6572,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     ] }) })
   ] });
 }
-function ListRow({ item, family, port, on, onSelect, withOwner }) {
+function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu, extra }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
@@ -6500,67 +6597,93 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
   const copyPassword = () => secret && void run("Password", () => port.reveal(item, secret.key), true);
   const copyCode = () => code && void run("One-time code", async () => (await port.authenticator.code(item)).code, true);
   const copyName = () => void copy(item.name, "Name", { secret: false });
-  return /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("li", { className: "group relative", "data-item": item.id, children: [
-    /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(
-      "button",
-      {
-        type: "button",
-        "aria-current": on ? "true" : void 0,
-        "data-surface": on ? "primary" : void 0,
-        onClick: () => onSelect(item.id),
-        className: (0, import_design_system20.cn)("flex h-12 w-full items-center gap-3 rounded-lg px-2 pr-10 text-left", on ? "bg-primary text-primary-foreground" : "hover:bg-accent"),
-        children: [
-          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
-          /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
-            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "truncate text-sm font-medium", children: item.name }),
-            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "truncate text-xs text-muted-foreground", children: subtitleOf(item, withOwner) })
-          ] })
-        ]
-      }
-    ),
-    /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: "absolute right-1.5 top-1/2 flex -translate-y-1/2 items-center gap-0.5", "data-surface": on ? "primary" : void 0, children: [
-      user || secret ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: (0, import_design_system20.cn)("hidden items-center gap-0.5 rounded-md pl-2 [@media(hover:hover)]:group-hover:flex [@media(hover:hover)]:group-focus-within:flex", on ? "bg-primary" : "bg-accent"), "data-row-quick": "", children: [
-        user ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(UserGlyph, {}), "aria-label": `Copy ${user.label}`, disabled: busy, onClick: copyUser }) : null,
-        secret ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, {}), "aria-label": "Copy password", disabled: busy, onClick: copyPassword }) : null
-      ] }) : null,
-      /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenu, { open: menuOpen, onOpenChange: setMenuOpen, children: [
-        /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(
-          import_controls23.Button,
+  const others = otherCopyFields(item, user, secret);
+  const custom = canUse ? item.custom.filter((c) => c.value) : [];
+  const hostEntries = extra?.(item) ?? [];
+  return /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(
+    "li",
+    {
+      className: "group relative",
+      "data-item": item.id,
+      onContextMenu: ownContextMenu ? (e) => {
+        e.preventDefault();
+        setMenuOpen(true);
+      } : void 0,
+      children: [
+        /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(
+          "button",
           {
-            variant: "quiet",
-            icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(MoreGlyph, {}),
-            "aria-label": `Actions for ${item.name}`,
-            disabled: busy,
-            className: (0, import_design_system20.cn)("[@media(hover:hover)]:invisible [@media(hover:hover)]:group-hover:visible [@media(hover:hover)]:group-focus-within:visible", menuOpen && "[@media(hover:hover)]:visible")
+            type: "button",
+            "aria-current": on ? "true" : void 0,
+            "data-surface": on ? "primary" : void 0,
+            onClick: () => onSelect(item.id),
+            className: (0, import_design_system20.cn)("flex h-12 w-full items-center gap-3 rounded-lg px-2 pr-10 text-left", on ? "bg-primary text-primary-foreground" : "hover:bg-accent"),
+            children: [
+              /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
+              /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "truncate text-sm font-medium", children: item.name }),
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "truncate text-xs text-muted-foreground", children: subtitleOf(item, withOwner) })
+              ] })
+            ]
           }
-        ) }),
-        /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuContent, { align: "end", children: [
-          user ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: copyUser, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(UserGlyph, { className: "size-4" }),
-            "Copy ",
-            user.label.toLowerCase()
-          ] }) : null,
-          secret ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: copyPassword, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, { className: "size-4" }),
-            "Copy password"
-          ] }) : null,
-          code ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: copyCode, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ClockGlyph, { className: "size-4" }),
-            "Copy one-time code"
+        ),
+        /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: "absolute right-1.5 top-1/2 flex -translate-y-1/2 items-center gap-0.5", "data-surface": on ? "primary" : void 0, children: [
+          user || secret ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: (0, import_design_system20.cn)("hidden items-center gap-0.5 rounded-md pl-2 [@media(hover:hover)]:group-hover:flex [@media(hover:hover)]:group-focus-within:flex", on ? "bg-primary" : "bg-accent"), "data-row-quick": "", children: [
+            user ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(UserGlyph, {}), "aria-label": `Copy ${user.label}`, disabled: busy, onClick: copyUser }) : null,
+            secret ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, {}), "aria-label": "Copy password", disabled: busy, onClick: copyPassword }) : null
           ] }) : null,
-          user || secret || code ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuSeparator, {}) : null,
-          /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: () => onSelect(item.id), children: [
-            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ChevronRightGlyph, { className: "size-4" }),
-            "Open"
-          ] }),
-          /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: copyName, children: [
-            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_icons12.CopyIcon, { className: "size-4" }),
-            "Copy name"
+          /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenu, { open: menuOpen, onOpenChange: setMenuOpen, children: [
+            /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(
+              import_controls23.Button,
+              {
+                variant: "quiet",
+                icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(MoreGlyph, {}),
+                "aria-label": `Actions for ${item.name}`,
+                disabled: busy,
+                className: (0, import_design_system20.cn)("[@media(hover:hover)]:invisible [@media(hover:hover)]:group-hover:visible [@media(hover:hover)]:group-focus-within:visible", menuOpen && "[@media(hover:hover)]:visible")
+              }
+            ) }),
+            /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuContent, { align: "end", children: [
+              user ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: copyUser, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(UserGlyph, { className: "size-4" }),
+                "Copy ",
+                user.label.toLowerCase()
+              ] }) : null,
+              secret ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: copyPassword, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, { className: "size-4" }),
+                "Copy password"
+              ] }) : null,
+              code ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: copyCode, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ClockGlyph, { className: "size-4" }),
+                "Copy one-time code"
+              ] }) : null,
+              others.map((f) => /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: () => void run(f.label, () => port.reveal(item, f.key), f.handling !== "visible"), children: [
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_icons12.CopyIcon, { className: "size-4" }),
+                "Copy ",
+                f.label.toLowerCase()
+              ] }, f.key)),
+              custom.map((c) => /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: () => void copy(c.value, c.label, { secret: false }), children: [
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_icons12.CopyIcon, { className: "size-4" }),
+                "Copy ",
+                c.label.toLowerCase()
+              ] }, `custom:${c.key}`)),
+              user || secret || code || others.length > 0 || custom.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuSeparator, {}) : null,
+              /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: () => onSelect(item.id), children: [
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ChevronRightGlyph, { className: "size-4" }),
+                "Open"
+              ] }),
+              /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { onSelect: copyName, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_icons12.CopyIcon, { className: "size-4" }),
+                "Copy name"
+              ] }),
+              hostEntries.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuSeparator, {}) : null,
+              hostEntries.map((h) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuItem, { onSelect: h.onSelect, children: h.label }, h.label))
+            ] })
           ] })
         ] })
-      ] })
-    ] })
-  ] });
+      ]
+    }
+  );
 }
 
 // src/lists/TrashView.tsx
@@ -8187,6 +8310,7 @@ var import_jsx_runtime40 = require("react/jsx-runtime");
 var FULL_AT = 1120;
 var SPLIT_AT = 640;
 var NO_HOST = {};
+var FOCUS_GAP_MS = 2e3;
 var ITEM_PANELS = {
   share: SharePanel,
   move: MovePanel,
@@ -8315,9 +8439,13 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const knobsRef = (0, import_react42.useRef)(host.knobs);
   knobsRef.current = host.knobs;
   const [signedOut, setSignedOut] = (0, import_react42.useState)(false);
-  const load = (0, import_react42.useCallback)(() => {
-    setError(null);
-    port.load().then((s) => {
+  const [refreshError, setRefreshError] = (0, import_react42.useState)(null);
+  const [refreshing, setRefreshing] = (0, import_react42.useState)(false);
+  const loadedAt = (0, import_react42.useRef)(0);
+  const inFlight = (0, import_react42.useRef)(false);
+  const apply = (0, import_react42.useCallback)(
+    (s) => {
+      loadedAt.current = Date.now();
       setSnap(s);
       setItems(s.items);
       setDeleted(s.deleted);
@@ -8325,15 +8453,71 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         (rows) => setDeleted([...s.deleted, ...rows.filter((r) => !s.deleted.some((d) => d.id === r.id))]),
         () => void 0
       );
-    }).catch((e) => {
+    },
+    [port]
+  );
+  const refresh = (0, import_react42.useCallback)(() => {
+    if (inFlight.current) return;
+    inFlight.current = true;
+    setRefreshing(true);
+    port.load().then((s) => {
+      setRefreshError(null);
+      apply(s);
+    }).catch((e) => setRefreshError(plainLoadError(e instanceof Error && e.message ? e.message : "The vault could not be read."))).finally(() => {
+      inFlight.current = false;
+      setRefreshing(false);
+    });
+    port.lists.favorites?.list().then((ids) => setFavorites(new Set(ids)), () => void 0);
+    port.lists.recents?.list().then(setRecents, () => void 0);
+  }, [port, apply]);
+  const load = (0, import_react42.useCallback)(() => {
+    setError(null);
+    setRefreshError(null);
+    port.load().then(apply).catch((e) => {
       setSignedOut(e?.status === 401);
       setError(e instanceof Error ? e.message : "The vault could not be loaded.");
     });
     port.lists.favorites?.list().then((ids) => setFavorites(new Set(ids)), () => void 0);
     knobsRef.current?.().catch(() => void 0);
     port.lists.recents?.list().then(setRecents, () => void 0);
-  }, [port]);
+  }, [port, apply]);
   (0, import_react42.useEffect)(load, [load]);
+  const quietRef = (0, import_react42.useRef)({ loc, ready: false });
+  quietRef.current = { loc, ready: snap !== null && !error };
+  const [knobSeconds, setKnobSeconds] = (0, import_react42.useState)(null);
+  (0, import_react42.useEffect)(() => {
+    if (host.refreshSeconds !== void 0 || !knobsRef.current) return;
+    let live = true;
+    knobsRef.current().then(
+      (r) => {
+        const v = r["vault.list.refresh_seconds"];
+        if (live && typeof v === "number" && v > 0) setKnobSeconds(v);
+      },
+      () => void 0
+    );
+    return () => {
+      live = false;
+    };
+  }, [host.refreshSeconds]);
+  const everySeconds = host.refreshSeconds ?? knobSeconds;
+  (0, import_react42.useEffect)(() => {
+    const quietly = (minGapMs) => {
+      const { loc: here, ready } = quietRef.current;
+      if (!ready || document.visibilityState === "hidden" || dirty.current || here.mode !== "view") return;
+      if (Date.now() - loadedAt.current < minGapMs) return;
+      refresh();
+    };
+    const onBack = () => quietly(FOCUS_GAP_MS);
+    const onVisible = () => document.visibilityState === "visible" && onBack();
+    window.addEventListener("focus", onBack);
+    document.addEventListener("visibilitychange", onVisible);
+    const timer2 = everySeconds && everySeconds > 0 ? setInterval(() => quietly(0), everySeconds * 1e3) : null;
+    return () => {
+      window.removeEventListener("focus", onBack);
+      document.removeEventListener("visibilitychange", onVisible);
+      if (timer2) clearInterval(timer2);
+    };
+  }, [refresh, everySeconds]);
   const inventoryRef = (0, import_react42.useRef)(onInventory);
   inventoryRef.current = onInventory;
   (0, import_react42.useEffect)(() => {
@@ -8499,6 +8683,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       onSort: (sort) => go({ sort }, "replace"),
       canSortViewed: port.lists.recents !== void 0,
       onNew: () => go({ itemId: null, mode: "new", kind: null, panel: null }),
+      onRefresh: refresh,
+      refreshing,
+      rowContextMenu: host.rowContextMenu ?? "package",
+      ...host.rowMenuItems ? { rowMenuItems: host.rowMenuItems } : {},
       ...matchingIds ? { matchingIds } : {},
       ...compactHeader ? { header: compactHeader } : {}
     }
@@ -8523,14 +8711,14 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         host,
         organizations: orgs,
         defaultOwner: ownerDefault,
-        seed: { name: guess?.name ?? "", url: guess?.url ?? loc.url.trim() },
+        seed: { name: loc.name?.trim() || guess?.name || "", url: guess?.url ?? loc.url.trim() },
         onBack: () => go({ kind: null }),
         onMode: () => void 0,
         onSaved: (item, _wasNew, n, enrolled) => {
           replaceItem(item);
           dirty.current = false;
           if (enrolled) setFirstCode(item);
-          move({ ...loc, itemId: item.id, mode: "view", kind: null, url: "", panel: null }, "replace");
+          move({ ...loc, itemId: item.id, mode: "view", kind: null, url: "", name: "", panel: null }, "replace");
           setNotice(n);
           notify("Saved");
         },
@@ -8538,7 +8726,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         onDirty: (d) => {
           dirty.current = d;
         },
-        onCancelNew: () => go({ mode: "view", kind: null, url: "", itemId: null }),
+        onCancelNew: () => go({ mode: "view", kind: null, url: "", name: "", itemId: null }),
         onPanel: () => void 0,
         onChanged: () => void 0
       },
@@ -8629,13 +8817,17 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const grid = mode === "full" ? "grid-cols-[15rem_21rem_minmax(0,1fr)]" : mode === "split" ? "grid-cols-[19rem_minmax(0,1fr)]" : "grid-cols-1";
   const shown = panesShown(mode, specialView !== null, showingDetail);
   return /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { ref: rootRef, className: "flex h-full min-h-0 w-full flex-col bg-background text-foreground", children: [
+    refreshError ? /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("span", { className: "min-w-0 flex-1 truncate text-warning", title: refreshError, children: "Couldn\u2019t refresh. Showing what was loaded." }),
+      /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: refresh, children: "Try again" })
+    ] }) : null,
     snap.unavailable.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
       /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("span", { className: "min-w-0 flex-1 truncate text-warning", children: [
         "Couldn\u2019t load ",
         snap.unavailable.join(", "),
         ". Showing the rest."
       ] }),
-      /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: load, children: "Try again" })
+      /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: refresh, children: "Try again" })
     ] }) : null,
     /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { className: `grid min-h-0 w-full flex-1 ${grid} overflow-hidden`, children: [
       mode === "full" ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(
@@ -8986,6 +9178,28 @@ function trashItem(r, ctx) {
     createdAt: ""
   };
 }
+async function withTypes(items, door, ctx) {
+  if (!door.schema || items.length === 0) return items;
+  const keys = /* @__PURE__ */ new Map();
+  const CHUNK = 100;
+  try {
+    for (let i = 0; i < items.length; i += CHUNK) {
+      const ids = items.slice(i, i + CHUNK).map((x) => x.id);
+      const { data, error } = await door.schema("users").from("credential_items").select("id,definition_key").in("id", ids);
+      if (error) throw new Error(error.message || "credential_items read failed");
+      for (const r of Array.isArray(data) ? data : []) {
+        if (typeof r.id === "string" && typeof r.definition_key === "string" && r.definition_key) keys.set(r.id, r.definition_key);
+      }
+    }
+  } catch (e) {
+    console.warn("[vault] Trash item types could not be read; rows say Credential", e);
+    return items;
+  }
+  return items.map((it) => {
+    const key = keys.get(it.id);
+    return key ? { ...it, definitionKey: key, definitionLabel: ctx.definition(key)?.label ?? humanize(key) } : it;
+  });
+}
 var previewOf = async (door, id) => parseRecoveryPreview(await call(door, "vault_recovery_preview", { p_id: id }));
 function createListsPort(ctx, door) {
   return {
@@ -9018,7 +9232,8 @@ function createListsPort(ctx, door) {
             if (rows.length < PAGE2) break;
           }
           const items = all.map((r) => trashItem(r, ctx)).filter((i) => i !== null);
-          return [...new Map(items.map((i) => [i.id, i])).values()];
+          const unique = [...new Map(items.map((i) => [i.id, i])).values()];
+          return withTypes(unique, door, ctx);
         }
       },
       favorites: {
@@ -9041,16 +9256,25 @@ function createListsPort(ctx, door) {
 var account6 = __toESM(require("@ai-matrx/api/account"), 1);
 
 // src/secret-field-in.ts
-function secretFieldIn(s) {
+function settingsIn(s) {
   const envKey = s.envKey?.trim() || null;
   return {
-    field_key: fieldKeyOf(s.label),
-    value: s.value,
-    handling: s.handling ?? "revealable",
     ...envKey ? { env_key: envKey } : {},
     ...envKey && s.injectIntoSandbox ? { inject_into_sandbox: true } : {}
   };
 }
+function secretFieldIn(s) {
+  return {
+    field_key: s.key.trim() || fieldKeyOf(s.label),
+    value: s.value,
+    handling: s.handling ?? "revealable",
+    ...s.description ? { description: s.description } : {},
+    ...settingsIn(s)
+  };
+}
+function declaredFieldIn(f, value, settings) {
+  return { field_key: f.key, value, handling: settings?.handling ?? f.handling, ...settingsIn(settings ?? {}) };
+}
 
 // src/sharing/api.ts
 function grantOf(w) {
@@ -9151,7 +9375,7 @@ function createSharingPort(ctx, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn)
           ]
         }
@@ -9280,7 +9504,7 @@ async function readNativeImportLimits(api, organizationId) {
 var recoveryOf = (w) => w.lifecycle?.vault_recovery;
 var isDeleted = (w) => recoveryOf(w)?.state === "deleted";
 var MATCH_MODES2 = ["host", "domain", "exact", "never"];
-var FIELD_WORDS = { totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
+var FIELD_WORDS = { secure_notes: "Secure note", totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
 var handlingOf = (v) => v === "visible" || v === "sealed" ? v : "revealable";
 function fieldOf(w, def) {
   const declared = def?.fields.find((f) => f.key === w.field_key);
@@ -9289,7 +9513,8 @@ function fieldOf(w, def) {
     id: w.id,
     key: w.field_key,
     label: declared?.label ?? FIELD_WORDS[w.field_key] ?? humanize(w.field_key),
-    kind: declared?.kind ?? (handling === "visible" ? "text" : "secret"),
+    // A field no type declares still edits as several lines when its key says so (an old "Secure note").
+    kind: declared?.kind ?? (isMultilineKey(w.field_key) ? "multiline" : handling === "visible" ? "text" : "secret"),
     handling,
     editable: w.editable ?? true,
     envKey: w.env_key ?? null,
@@ -9444,7 +9669,7 @@ function createApiVaultPort(api, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn),
             // Backup codes on a type that does not declare them (a website login): their own encrypted field.
             ...!declared.some((f) => f.key === RECOVERY_CODES_KEY) && (draft.values[RECOVERY_CODES_KEY] ?? "").trim() !== "" ? [{ field_key: RECOVERY_CODES_KEY, value: parseRecoveryCodes(draft.values[RECOVERY_CODES_KEY] ?? "").join("\n"), handling: "revealable", description: "One-time account recovery codes" }] : []