@ai-matrx/vault 0.1.18 → 0.1.20

package/dist/index.d.cts

@@ -116,6 +116,8 @@ interface VaultLocation {
     /** New-item flow: the chosen definition, and the URL pasted at the start (kept across steps). */
     kind: string | null;
     url: string;
+    /** New-item flow: a name the opener chose ("Instagram login"); beats the one guessed from the address. */
+    name?: string;
     /** A panel open over the workspace: `share`, `history`, `activity`, `files`, `move`, `import`, … */
     panel: string | null;
 }
@@ -150,17 +152,25 @@ declare function siteDomainOf(host: string): string;
  * order, then everything never opened by name. Without it `viewed` sorts by name.
  */
 declare function sortItems(items: readonly VaultItem[], sort: VaultSort, recents?: readonly string[] | null): VaultItem[];
-interface NewSecretField {
-    key: string;
-    label: string;
-    value: string;
+/** A secret's automation settings, chosen before it is saved. */
+interface FieldSettingsDraft {
     /** The name sandboxes and workflows find it by (`GITHUB_TOKEN`); absent = none. */
     envKey?: string;
-    /** Who may see it; absent = `revealable` (shown after "Confirm it's you"). */
+    /** Who may see it; absent = `revealable` (or what its type declares). */
     handling?: FieldHandling;
     /** Sandboxes get it as an env variable (needs `envKey`). */
     injectIntoSandbox?: boolean;
 }
+interface NewSecretField extends FieldSettingsDraft {
+    /** The stored field key; empty = made from the label. */
+    key: string;
+    label: string;
+    value: string;
+    /** Several lines (a secure note): edited in a multi-line box. */
+    multiline?: boolean;
+    /** Plain words stored with the field. */
+    description?: string;
+}
 /** How the browser treats a NEW item, chosen before its first save (afterwards: item settings). */
 interface DraftBrowserSettings {
     uriMatchMode: UriMatchMode;
@@ -184,6 +194,8 @@ interface ItemDraft {
     authenticator: string;
     /** New item only: website matching and browser fill chosen before the first save; absent = the defaults. */
     browser?: DraftBrowserSettings;
+    /** New item only: env key, who can see it and sandbox use of each declared secret, by field key. */
+    fieldSettings?: Record<string, FieldSettingsDraft>;
 }
 
 /** One recorded earlier value of a secret field. Value-free: the value comes only from `revealHistory`. */
@@ -950,6 +962,15 @@ interface RecentsPort {
  * anything with a supabase-js style `rpc`. The server API has no endpoint for it (see FEATURE.md),
  * so the HOST supplies it; without it `favorites` and `recents` are absent and their controls hide.
  */
+/** The one read Trash needs beyond the platform's trash list: each deleted item's type (row security decides what comes back). */
+interface DeletedTypeRead {
+    in(column: "id", values: readonly string[]): PromiseLike<{
+        data?: unknown;
+        error?: {
+            message?: string;
+        } | null;
+    }>;
+}
 interface VaultUserStateDoor {
     rpc(fn: string, args?: Record<string, unknown>): PromiseLike<{
         data?: unknown;
@@ -957,6 +978,12 @@ interface VaultUserStateDoor {
             message?: string;
         } | null;
     }>;
+    /** The host's supabase client gives this; without it Trash rows say "Credential" instead of the item's type. */
+    schema?(name: "users"): {
+        from(table: "credential_items"): {
+            select(columns: "id,definition_key"): DeletedTypeRead;
+        };
+    };
 }
 /** List-level state: trash and restore, favorites, recently opened. */
 interface ListsPort {
@@ -1202,6 +1229,23 @@ interface VaultHostCapabilities {
     clipboard?: VaultClipboard;
     /** How long a shown value stays shown, in seconds (an organization knob the host reads); default 20. */
     revealSeconds?: number;
+    /**
+     * How often the list re-reads itself while the vault is on screen, in seconds (the desktop's
+     * refresh knob). Without it the organization's `vault.list.refresh_seconds` knob decides; with
+     * neither, the list still re-reads whenever the window or panel comes back into focus.
+     */
+    refreshSeconds?: number;
+    /**
+     * Who answers a right-click on a list row. `package` (default): the row's own menu (copy any
+     * field, open, copy name, plus `rowMenuItems`). `host`: the host wraps the vault in its own
+     * right-click menu (the website's agents menu) and the row leaves the event alone.
+     */
+    rowContextMenu?: "package" | "host";
+    /** Extra entries a host adds to every row's menu (the More button and the right-click menu). */
+    rowMenuItems?: (item: VaultItem) => readonly {
+        label: string;
+        onSelect: () => void;
+    }[];
     nativeProvider?: {
         status: "ready" | "needs_setup" | "unavailable";
         openSetup: () => void;

package/dist/index.d.ts

@@ -116,6 +116,8 @@ interface VaultLocation {
     /** New-item flow: the chosen definition, and the URL pasted at the start (kept across steps). */
     kind: string | null;
     url: string;
+    /** New-item flow: a name the opener chose ("Instagram login"); beats the one guessed from the address. */
+    name?: string;
     /** A panel open over the workspace: `share`, `history`, `activity`, `files`, `move`, `import`, … */
     panel: string | null;
 }
@@ -150,17 +152,25 @@ declare function siteDomainOf(host: string): string;
  * order, then everything never opened by name. Without it `viewed` sorts by name.
  */
 declare function sortItems(items: readonly VaultItem[], sort: VaultSort, recents?: readonly string[] | null): VaultItem[];
-interface NewSecretField {
-    key: string;
-    label: string;
-    value: string;
+/** A secret's automation settings, chosen before it is saved. */
+interface FieldSettingsDraft {
     /** The name sandboxes and workflows find it by (`GITHUB_TOKEN`); absent = none. */
     envKey?: string;
-    /** Who may see it; absent = `revealable` (shown after "Confirm it's you"). */
+    /** Who may see it; absent = `revealable` (or what its type declares). */
     handling?: FieldHandling;
     /** Sandboxes get it as an env variable (needs `envKey`). */
     injectIntoSandbox?: boolean;
 }
+interface NewSecretField extends FieldSettingsDraft {
+    /** The stored field key; empty = made from the label. */
+    key: string;
+    label: string;
+    value: string;
+    /** Several lines (a secure note): edited in a multi-line box. */
+    multiline?: boolean;
+    /** Plain words stored with the field. */
+    description?: string;
+}
 /** How the browser treats a NEW item, chosen before its first save (afterwards: item settings). */
 interface DraftBrowserSettings {
     uriMatchMode: UriMatchMode;
@@ -184,6 +194,8 @@ interface ItemDraft {
     authenticator: string;
     /** New item only: website matching and browser fill chosen before the first save; absent = the defaults. */
     browser?: DraftBrowserSettings;
+    /** New item only: env key, who can see it and sandbox use of each declared secret, by field key. */
+    fieldSettings?: Record<string, FieldSettingsDraft>;
 }
 
 /** One recorded earlier value of a secret field. Value-free: the value comes only from `revealHistory`. */
@@ -950,6 +962,15 @@ interface RecentsPort {
  * anything with a supabase-js style `rpc`. The server API has no endpoint for it (see FEATURE.md),
  * so the HOST supplies it; without it `favorites` and `recents` are absent and their controls hide.
  */
+/** The one read Trash needs beyond the platform's trash list: each deleted item's type (row security decides what comes back). */
+interface DeletedTypeRead {
+    in(column: "id", values: readonly string[]): PromiseLike<{
+        data?: unknown;
+        error?: {
+            message?: string;
+        } | null;
+    }>;
+}
 interface VaultUserStateDoor {
     rpc(fn: string, args?: Record<string, unknown>): PromiseLike<{
         data?: unknown;
@@ -957,6 +978,12 @@ interface VaultUserStateDoor {
             message?: string;
         } | null;
     }>;
+    /** The host's supabase client gives this; without it Trash rows say "Credential" instead of the item's type. */
+    schema?(name: "users"): {
+        from(table: "credential_items"): {
+            select(columns: "id,definition_key"): DeletedTypeRead;
+        };
+    };
 }
 /** List-level state: trash and restore, favorites, recently opened. */
 interface ListsPort {
@@ -1202,6 +1229,23 @@ interface VaultHostCapabilities {
     clipboard?: VaultClipboard;
     /** How long a shown value stays shown, in seconds (an organization knob the host reads); default 20. */
     revealSeconds?: number;
+    /**
+     * How often the list re-reads itself while the vault is on screen, in seconds (the desktop's
+     * refresh knob). Without it the organization's `vault.list.refresh_seconds` knob decides; with
+     * neither, the list still re-reads whenever the window or panel comes back into focus.
+     */
+    refreshSeconds?: number;
+    /**
+     * Who answers a right-click on a list row. `package` (default): the row's own menu (copy any
+     * field, open, copy name, plus `rowMenuItems`). `host`: the host wraps the vault in its own
+     * right-click menu (the website's agents menu) and the row leaves the event alone.
+     */
+    rowContextMenu?: "package" | "host";
+    /** Extra entries a host adds to every row's menu (the More button and the right-click menu). */
+    rowMenuItems?: (item: VaultItem) => readonly {
+        label: string;
+        onSelect: () => void;
+    }[];
     nativeProvider?: {
         status: "ready" | "needs_setup" | "unavailable";
         openSetup: () => void;