@ai-matrx/vault 0.1.18 → 0.1.20

package/dist/index.js

@@ -671,7 +671,7 @@ var DAY_FORMAT = { year: "numeric", month: "short", day: "numeric" };
 import { Fragment as Fragment2, jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
 var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function SecretText({ value, multiline }) {
-  if (multiline || value.length > 200) return /* @__PURE__ */ jsx5("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
+  if (multiline || value.length > 200 || value.includes("\n")) return /* @__PURE__ */ jsx5("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
   return /* @__PURE__ */ jsx5("span", { className: "break-all font-mono text-sm tracking-wide", children: [...value].map((ch, i) => /* @__PURE__ */ jsx5("span", { className: /[0-9]/.test(ch) ? "text-primary" : /[^A-Za-z0-9]/.test(ch) ? "text-warning" : void 0, children: ch }, i)) });
 }
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
@@ -807,18 +807,19 @@ function EditRow({ label, hint: hint2, value, onChange, placeholder, secret = fa
     }
   );
 }
-function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue }) {
+function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue, multiline = false }) {
   const [shown, setShown] = useState5(false);
   return /* @__PURE__ */ jsx5(
     VaultRow,
     {
       label: /* @__PURE__ */ jsx5(Field2, { className: "w-full", value: label, onChange: (e) => onLabel(e.target.value), placeholder: "Name", "aria-label": "Field name" }),
+      top: multiline,
       actions: /* @__PURE__ */ jsxs5(Fragment2, { children: [
-        secret && value ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: shown ? /* @__PURE__ */ jsx5(EyeOffGlyph, {}) : /* @__PURE__ */ jsx5(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
+        secret && value && !multiline ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: shown ? /* @__PURE__ */ jsx5(EyeOffGlyph, {}) : /* @__PURE__ */ jsx5(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
         extra,
         /* @__PURE__ */ jsx5(Button2, { variant: "quiet", removes: true, icon: /* @__PURE__ */ jsx5(XGlyph, {}), "aria-label": "Remove field", onClick: onRemove })
       ] }),
-      children: /* @__PURE__ */ jsx5(
+      children: multiline ? /* @__PURE__ */ jsx5(Textarea, { className: "w-full", value, onChange: (e) => onValue(e.target.value), rows: 4, placeholder: secret ? "Encrypted, hidden until shown" : "Value", autoComplete: "off", spellCheck: !secret, "aria-label": label ? `${label} value` : "Field value" }) : /* @__PURE__ */ jsx5(
         Field2,
         {
           className: "w-full",
@@ -860,6 +861,7 @@ function locationFromParams(params, itemId = params.get("item")) {
     mode: mode === "edit" || mode === "new" ? mode : "view",
     kind: params.get("kind"),
     url: params.get("url") ?? "",
+    ...params.get("name") ? { name: params.get("name") ?? "" } : {},
     panel: params.get("panel")
   };
 }
@@ -872,6 +874,7 @@ function locationToParams(loc) {
   if (loc.mode !== "view") q.set("mode", loc.mode);
   if (loc.kind) q.set("kind", loc.kind);
   if (loc.url) q.set("url", loc.url);
+  if (loc.name) q.set("name", loc.name);
   if (loc.panel) q.set("panel", loc.panel);
   return q;
 }
@@ -935,6 +938,7 @@ function sortItems(items, sort, recents) {
   if (sort === "updated") return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return out.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+var SECURE_NOTE_KEY = "secure_notes";
 function draftOf(item) {
   return {
     name: item?.name ?? "",
@@ -985,7 +989,9 @@ function rebaseDraft(oldBase, newBase, draft) {
     secrets: draft.secrets,
     custom,
     removed: draft.removed,
-    authenticator: draft.authenticator
+    authenticator: draft.authenticator,
+    ...draft.browser ? { browser: draft.browser } : {},
+    ...draft.fieldSettings ? { fieldSettings: draft.fieldSettings } : {}
   };
 }
 function panesShown(mode, specialView, showingDetail) {
@@ -1013,7 +1019,8 @@ var FAMILY_LABELS = {
   signing_files: "Signing & files"
 };
 var COMMON_DEFINITION_KEYS = ["website_login", "username_password", "api_key", "env_value", "database_login", "custom"];
-var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes)/;
+var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes|(^|_)notes?($|_))/;
+var isMultilineKey = (key) => MULTILINE.test(key);
 var SECRET = /(password|secret|token|api_key|private|passphrase|credential|seed|key$|_key)/;
 var URLISH = /(url|uri|endpoint|webhook|hook)/;
 function humanize(key) {
@@ -1912,10 +1919,16 @@ function QrScanPanel({ open, onResult, onClose }) {
     /* @__PURE__ */ jsx10("p", { className: "text-center text-xs text-muted-foreground", children: "Point at the site's QR code" })
   ] });
 }
-function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "Paste setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status }) {
+function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "Paste setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status, autoStartCamera = false }) {
   const file = useRef8(null);
   const canScan = useCanScan();
   const [scanning, setScanning] = useState10(false);
+  const autoStarted = useRef8(false);
+  useEffect10(() => {
+    if (!autoStartCamera || !canScan || disabled || autoStarted.current || value) return;
+    autoStarted.current = true;
+    setScanning(true);
+  }, [autoStartCamera, canScan, disabled, value]);
   const [reading, setReading] = useState10(false);
   const [imageError, setImageError] = useState10(null);
   const [dragging, setDragging] = useState10(false);
@@ -2221,7 +2234,7 @@ function normalizeWebsite(raw) {
     return null;
   }
 }
-function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onDone }) {
+function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
   const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = useState12("");
@@ -2274,6 +2287,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       setInput("");
       setImage(null);
       setSaved(next);
+      onAdded?.(next);
       onChanged();
     } catch (e) {
       setError(wasCancelled(e) ? "Not confirmed, so nothing was added." : otpActionError(e, "add it"));
@@ -2300,6 +2314,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
               label: "Setup key",
               value: input,
               autoFocus: true,
+              autoStartCamera: true,
               disabled: busy,
               onChange: (v) => {
                 setImage(null);
@@ -2381,7 +2396,23 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
+function withAdded(items, added) {
+  if (added.size === 0) return items;
+  const seen = /* @__PURE__ */ new Set();
+  const out = items.map((i) => {
+    seen.add(i.id);
+    const mine = added.get(i.id);
+    return mine && !i.authenticator ? { ...i, authenticator: mine.authenticator, name: mine.name } : i;
+  });
+  for (const [id, a] of added) if (!seen.has(id)) out.push(a);
+  return out;
+}
+function AuthenticatorView({ port, host, items: listed, definitions, query, onOpen, onChanged, header }) {
+  const [added, setAdded] = useState13(/* @__PURE__ */ new Map());
+  const items = withAdded(listed, added);
+  useEffect11(() => {
+    if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
+  }, [listed, added]);
   const [entries, setEntries] = useState13(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = useState13(/* @__PURE__ */ new Set());
   const [adding, setAdding] = useState13(false);
@@ -2397,7 +2428,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
     return () => {
       live = false;
     };
-  }, [port, items]);
+  }, [port, listed, added]);
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -2443,6 +2474,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
         definitions,
         onClose: () => setAdding(false),
         onChanged,
+        onAdded: (item) => setAdded((cur) => new Map(cur).set(item.id, item)),
         onDone: (id) => {
           setAdding(false);
           onOpen(id);
@@ -3852,7 +3884,7 @@ var MAX_FAILURES_IN_A_ROW = 5;
 var failureText = (cause) => cause instanceof Error && cause.message ? cause.message : "The server refused this one.";
 async function runImport(input) {
   const { io, organizationId, lines, keys, confirmed } = input;
-  const result = { created: [], failed: [], withOtp: 0, stoppedEarly: false, untried: [] };
+  const result = { created: [], failed: [], withOtp: 0, needOtp: [], stoppedEarly: false, untried: [] };
   let streak = 0;
   for (let i = 0; i < lines.length; i += 1) {
     const line = lines[i];
@@ -3871,7 +3903,10 @@ async function runImport(input) {
     try {
       const made = await confirmed(() => io.createImported(command.body, organizationId, key));
       result.created.push(made);
-      if (command.hasOtp) result.withOtp += 1;
+      if (command.hasOtp) {
+        result.withOtp += 1;
+        result.needOtp.push(made);
+      }
       streak = 0;
     } catch (cause) {
       const reason = failureText(cause);
@@ -4471,8 +4506,9 @@ var STATE_BADGE = {
   unsupported: { text: "Not supported", tone: "neutral" }
 };
 var ME = "me";
-function ImportPanel({ port, host, items, organizations, onClose, onChanged, limits }) {
+function ImportPanel({ port, host, items, definitions, organizations, onClose, onChanged, limits }) {
   const confirmed = useConfirmed();
+  const [otpFor, setOtpFor] = useState19(null);
   const fileInput = useRef12(null);
   const abort = useRef12(null);
   const stop = useRef12(false);
@@ -4580,6 +4616,7 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
       failed: result.failed,
       skipped,
       withOtp: (previous?.withOtp ?? 0) + result.withOtp,
+      needOtp: [...previous?.needOtp ?? [], ...result.needOtp],
       untried: result.untried
     };
     setDone(merged);
@@ -4605,7 +4642,7 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
     setRunning({ done: 0, total: chosen });
     try {
       const made = await confirmed(() => port.io.importEnv(text, organizationId, injectSandbox));
-      setDone({ created: made, failed: [], skipped: draft.entries.length - chosen, withOtp: 0, untried: [] });
+      setDone({ created: made, failed: [], skipped: draft.entries.length - chosen, withOtp: 0, needOtp: [], untried: [] });
       if (made.length > 0) onChanged();
     } catch (cause) {
       setError(cause instanceof Error ? cause.message : "The import could not finish.");
@@ -4720,9 +4757,32 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
         plural(done.withOtp, "login"),
         " still need the one-time password added."
       ] }) }) : null,
+      done.needOtp.map((made) => {
+        const now = items.find((i) => i.id === made.id);
+        if (now?.authenticator) return null;
+        return /* @__PURE__ */ jsx19(VaultRow, { label: "Authenticator", children: /* @__PURE__ */ jsxs18("button", { type: "button", className: "truncate text-left text-primary hover:underline", onClick: () => setOtpFor(made.id), children: [
+          "Set up authenticator for ",
+          made.name
+        ] }) }, `otp:${made.id}`);
+      }),
       done.failed.map((f) => /* @__PURE__ */ jsx19(VaultRow, { label: f.title, children: /* @__PURE__ */ jsx19("span", { className: "block truncate text-destructive", title: f.reason, children: f.reason }) }, f.key))
     ] }) : null,
-    /* @__PURE__ */ jsx19(ErrorLine, { message: error })
+    /* @__PURE__ */ jsx19(ErrorLine, { message: error }),
+    otpFor ? /* @__PURE__ */ jsx19(
+      AddOtpPanel,
+      {
+        port,
+        items,
+        definitions,
+        itemId: otpFor,
+        onClose: () => setOtpFor(null),
+        onChanged,
+        onDone: () => {
+          setOtpFor(null);
+          onChanged();
+        }
+      }
+    ) : null
   ] });
 }
 function toggle(set, key, on) {
@@ -4760,7 +4820,7 @@ import { Button as Button23, SearchField } from "@ai-matrx/design-system/control
 import { CopyIcon as CopyIcon7 } from "@ai-matrx/design-system/icons";
 
 // src/ItemPane.tsx
-import { useEffect as useEffect16, useMemo as useMemo3, useRef as useRef14, useState as useState27 } from "react";
+import { Fragment as Fragment17, useEffect as useEffect16, useMemo as useMemo3, useRef as useRef14, useState as useState27 } from "react";
 import { DropdownMenu as DropdownMenu3, DropdownMenuContent as DropdownMenuContent3, DropdownMenuItem as DropdownMenuItem3, DropdownMenuSeparator as DropdownMenuSeparator3, DropdownMenuTrigger as DropdownMenuTrigger3 } from "@ai-matrx/design-system";
 import { cn as cn12 } from "@ai-matrx/design-system";
 import { Badge as Badge7, Button as Button22, CONTROLS_CONTAINER_CLASS, OptionCombobox, Switch as Switch6 } from "@ai-matrx/design-system/controls";
@@ -5142,14 +5202,12 @@ import { confirm as confirm7 } from "@ai-matrx/kit/confirm-opener";
 import { Fragment as Fragment15, jsx as jsx22, jsxs as jsxs21 } from "react/jsx-runtime";
 var HANDLINGS = ["visible", "revealable", "sealed"];
 var hint = (text, tone = "muted") => /* @__PURE__ */ jsx22("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
-var hasSecretSettings = (s) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== "revealable");
-function SecretBuilderRow({ field, onChange, onRemove }) {
-  const [open, setOpen] = useState22(hasSecretSettings(field));
-  const env = field.envKey ?? "";
+var saysMore = (s, defaultHandling) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== defaultHandling);
+function FieldSettingsRows({ name, value, defaultHandling = "revealable", onChange }) {
+  const env = value.envKey ?? "";
   const envProblem = envKeyProblem(env);
   const envOk = env.trim() !== "" && !envProblem;
-  const handling = field.handling ?? "revealable";
-  const name = field.label.trim() || "Secret";
+  const handling = value.handling ?? defaultHandling;
   const chooseHandling = async (next) => {
     if (next === handling) return;
     if (next === "sealed") {
@@ -5163,6 +5221,38 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
     }
     onChange({ handling: next });
   };
+  return /* @__PURE__ */ jsxs21(Fragment15, { children: [
+    /* @__PURE__ */ jsx22(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ jsx22(
+      Field8,
+      {
+        className: "w-full font-mono",
+        "aria-label": `${name} env key`,
+        "aria-invalid": Boolean(envProblem),
+        placeholder: "e.g. GITHUB_TOKEN",
+        autoComplete: "off",
+        spellCheck: false,
+        value: env,
+        onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
+      }
+    ) }),
+    /* @__PURE__ */ jsx22(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ jsx22(
+      SegmentedControl5,
+      {
+        "aria-label": `Who can see ${name}`,
+        value: handling,
+        onValueChange: (v) => void chooseHandling(v),
+        data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
+      }
+    ) }),
+    /* @__PURE__ */ jsx22(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ jsx22(Switch5, { "aria-label": `Use ${name} in sandbox`, checked: envOk && value.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
+  ] });
+}
+var hasSecretSettings = (s) => saysMore(s, "revealable");
+var hasDeclaredSettings = (s, defaultHandling) => Boolean(s && saysMore(s, defaultHandling));
+function SecretBuilderRow({ field, onChange, onRemove }) {
+  const [open, setOpen] = useState22(hasSecretSettings(field));
+  const handling = field.handling ?? "revealable";
+  const name = field.label.trim() || "Secret";
   return /* @__PURE__ */ jsxs21(Fragment15, { children: [
     /* @__PURE__ */ jsx22(
       CustomEditRow,
@@ -5170,47 +5260,26 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
         label: field.label,
         value: field.value,
         secret: true,
+        multiline: field.multiline === true,
         onLabel: (v) => onChange({ label: v }),
         onValue: (v) => onChange({ value: v }),
         onRemove,
-        onPasteValue: (text) => {
-          const a = parseEnvAssignment(text);
-          if (!a) return false;
-          onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
-          setOpen(true);
-          return true;
+        ...field.multiline ? {} : {
+          onPasteValue: (text) => {
+            const a = parseEnvAssignment(text);
+            if (!a) return false;
+            onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
+            setOpen(true);
+            return true;
+          }
         },
         extra: /* @__PURE__ */ jsxs21(Fragment15, { children: [
-          handling !== "sealed" ? /* @__PURE__ */ jsx22(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
+          handling !== "sealed" && !field.multiline ? /* @__PURE__ */ jsx22(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
           /* @__PURE__ */ jsx22(Button18, { variant: "quiet", icon: /* @__PURE__ */ jsx22(SlidersGlyph, {}), "aria-label": `${name} settings`, pressed: open, onClick: () => setOpen((o) => !o) })
         ] })
       }
     ),
-    open ? /* @__PURE__ */ jsxs21(Fragment15, { children: [
-      /* @__PURE__ */ jsx22(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ jsx22(
-        Field8,
-        {
-          className: "w-full font-mono",
-          "aria-label": `${name} env key`,
-          "aria-invalid": Boolean(envProblem),
-          placeholder: "e.g. GITHUB_TOKEN",
-          autoComplete: "off",
-          spellCheck: false,
-          value: env,
-          onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
-        }
-      ) }),
-      /* @__PURE__ */ jsx22(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ jsx22(
-        SegmentedControl5,
-        {
-          "aria-label": `Who can see ${name}`,
-          value: handling,
-          onValueChange: (v) => void chooseHandling(v),
-          data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
-        }
-      ) }),
-      /* @__PURE__ */ jsx22(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ jsx22(Switch5, { "aria-label": `Use ${name} in sandbox`, checked: envOk && field.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
-    ] }) : null
+    open ? /* @__PURE__ */ jsx22(FieldSettingsRows, { name, value: field, onChange }) : null
   ] });
 }
 function withMfaMethod(custom, v) {
@@ -5839,7 +5908,9 @@ function SharingSummary({ item, port, className }) {
 
 // src/ItemPane.tsx
 import { formatAbsoluteDate as formatAbsoluteDate3 } from "@ai-matrx/kit/format";
-import { Fragment as Fragment17, jsx as jsx27, jsxs as jsxs25 } from "react/jsx-runtime";
+import { Fragment as Fragment18, jsx as jsx27, jsxs as jsxs25 } from "react/jsx-runtime";
+var ENV_VALUE_KEY = "env_value";
+var secureNoteDraft = () => ({ key: SECURE_NOTE_KEY, label: "Secure note", value: "", multiline: true, description: "Encrypted notes" });
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
@@ -6030,6 +6101,16 @@ function ItemPane(props) {
   const fieldSettings = (f) => canEdit ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SlidersGlyph, {}), "aria-label": `${f.label} settings`, title: `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }) : null;
   const turnOnOne = canTurnOn ? (f) => () => turnOn([f]) : () => void 0;
   const declaredKeys = new Set(declared.map((f) => f.key));
+  const hasSecureNote = declaredKeys.has(SECURE_NOTE_KEY) || Boolean(item?.fields.some((f) => f.key === SECURE_NOTE_KEY)) || draft.secrets.some((x) => x.key === SECURE_NOTE_KEY);
+  const [settingsToggled, setSettingsToggled] = useState27(/* @__PURE__ */ new Set());
+  const settingsOpen = (f) => settingsToggled.has(f.key) !== (definition?.key === ENV_VALUE_KEY || hasDeclaredSettings(draft.fieldSettings?.[f.key], f.handling));
+  const toggleSettings = (key) => setSettingsToggled((cur) => {
+    const next = new Set(cur);
+    if (next.has(key)) next.delete(key);
+    else next.add(key);
+    return next;
+  });
+  const patchFieldSettings = (key, p) => setDraft((d) => ({ ...d, fieldSettings: { ...d.fieldSettings, [key]: { ...d.fieldSettings?.[key], ...p } } }));
   const extraFields = (item?.fields ?? []).filter((f) => !declaredKeys.has(f.key) && !draft.removed.includes(f.id) && !isAuthenticatorStorage(f.key));
   const metaValue = (key) => draft.values[key] ?? item?.custom.find((c) => c.key === key)?.value ?? "";
   const extraCustom = draft.custom.filter((c) => !declaredKeys.has(c.key) && c.key !== MFA_METHOD_KEY && !isAuthenticatorStorage(c.key));
@@ -6112,7 +6193,7 @@ function ItemPane(props) {
             /* @__PURE__ */ jsx27(SettingsIcon, { className: "size-4" }),
             "Settings"
           ] }) : null,
-          canManage ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+          canManage ? /* @__PURE__ */ jsxs25(Fragment18, { children: [
             /* @__PURE__ */ jsx27(DropdownMenuSeparator3, {}),
             /* @__PURE__ */ jsxs25(DropdownMenuItem3, { className: "text-destructive", disabled: busy, onSelect: () => void remove(), children: [
               /* @__PURE__ */ jsx27(TrashGlyph, { className: "size-4" }),
@@ -6132,7 +6213,7 @@ function ItemPane(props) {
       /* @__PURE__ */ jsx27("span", { className: "min-w-0 flex-1 truncate text-warning", children: offFields.length === 0 ? "This item is turned off" : offFields.length === 1 ? "1 field is turned off" : `${offFields.length} fields are turned off` }),
       canTurnOn ? /* @__PURE__ */ jsx27(TurnOnButton, { label: "all fields", onTurnOn: () => turnOn(offFields) }) : null
     ] }) : null,
-    /* @__PURE__ */ jsx27("div", { className: "min-h-0 flex-1 overflow-y-auto", children: sent ? /* @__PURE__ */ jsx27(AssignResult, { sent, onAnother: createAnother, onDone: onCancelNew }) : /* @__PURE__ */ jsx27("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", children: editing ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+    /* @__PURE__ */ jsx27("div", { className: "min-h-0 flex-1 overflow-y-auto", children: sent ? /* @__PURE__ */ jsx27(AssignResult, { sent, onAnother: createAnother, onDone: onCancelNew }) : /* @__PURE__ */ jsx27("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", children: editing ? /* @__PURE__ */ jsxs25(Fragment18, { children: [
       /* @__PURE__ */ jsxs25(VaultSection, { children: [
         mode === "new" ? /* @__PURE__ */ jsx27(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx27(
           OptionCombobox,
@@ -6153,7 +6234,7 @@ function ItemPane(props) {
           }
         ) }) : null,
         /* @__PURE__ */ jsx27(EditRow, { label: "Name", value: draft.name, onChange: (v) => patch({ name: v }), placeholder: "Name", autoFocus: mode === "new" }),
-        mode === "new" && owner === "person" ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+        mode === "new" && owner === "person" ? /* @__PURE__ */ jsxs25(Fragment18, { children: [
           /* @__PURE__ */ jsx27(EditRow, { label: "Their email", value: recipient, placeholder: "name@company.com", inputMode: "email", onChange: setRecipient }),
           declared.some((f) => f.storage === "encrypted" && f.kind === "secret") ? /* @__PURE__ */ jsx27(VaultRow, { label: "Password", hint: "You never see it", children: /* @__PURE__ */ jsx27(Switch6, { checked: generatePrivately, onCheckedChange: setGeneratePrivately, "aria-label": "Generate the password privately" }) }) : null
         ] }) : null,
@@ -6162,24 +6243,29 @@ function ItemPane(props) {
           const secretKind = f.storage === "encrypted" && f.kind === "secret";
           const value = f.storage === "metadata" ? metaValue(f.key) : draft.values[f.key] ?? "";
           const hidden = existing && existing.handling !== "visible" && !(f.key in loaded);
-          return /* @__PURE__ */ jsx27(
-            EditRow,
-            {
-              label: f.label,
-              value,
-              placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
-              secret: secretKind,
-              multiline: f.kind === "multiline",
-              inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
-              onChange: (v) => setValue(f.key, v),
-              actions: /* @__PURE__ */ jsxs25(Fragment17, { children: [
-                hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
-                secretKind ? /* @__PURE__ */ jsx27(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
-                existing ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null
-              ] })
-            },
-            f.key
-          );
+          const newSecret = mode === "new" && f.storage === "encrypted" && owner !== "person";
+          const open = newSecret && settingsOpen(f);
+          return /* @__PURE__ */ jsxs25(Fragment17, { children: [
+            /* @__PURE__ */ jsx27(
+              EditRow,
+              {
+                label: f.label,
+                value,
+                placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
+                secret: secretKind,
+                multiline: f.kind === "multiline" || value.includes("\n"),
+                inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
+                onChange: (v) => setValue(f.key, v),
+                actions: /* @__PURE__ */ jsxs25(Fragment18, { children: [
+                  hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
+                  secretKind ? /* @__PURE__ */ jsx27(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
+                  existing ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null,
+                  newSecret ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SlidersGlyph, {}), "aria-label": `${f.label} settings`, pressed: open, onClick: () => toggleSettings(f.key) }) : null
+                ] })
+              }
+            ),
+            open ? /* @__PURE__ */ jsx27(FieldSettingsRows, { name: f.label, value: draft.fieldSettings?.[f.key] ?? {}, defaultHandling: f.handling, onChange: (p) => patchFieldSettings(f.key, p) }) : null
+          ] }, f.key);
         }),
         extraFields.map((f) => /* @__PURE__ */ jsx27(
           EditRow,
@@ -6188,11 +6274,11 @@ function ItemPane(props) {
             value: draft.values[f.key] ?? "",
             placeholder: f.handling === "visible" || f.key in loaded ? "" : "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
             secret: f.handling !== "visible" && !isRecoveryCodesField(f),
-            multiline: isRecoveryCodesField(f),
+            multiline: f.kind === "multiline" || isRecoveryCodesField(f) || (draft.values[f.key] ?? "").includes("\n"),
             onChange: (v) => setValue(f.key, v),
             onRemove: () => patch({ removed: [...draft.removed, f.id] }),
             removeLabel: `Delete ${f.label}`,
-            actions: /* @__PURE__ */ jsxs25(Fragment17, { children: [
+            actions: /* @__PURE__ */ jsxs25(Fragment18, { children: [
               f.handling === "revealable" && !(f.key in loaded) && item?.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
               /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) })
             ] })
@@ -6257,6 +6343,7 @@ function ItemPane(props) {
             /* @__PURE__ */ jsx27(DropdownMenuTrigger3, { asChild: true, children: /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(PlusGlyph, {}), children: "Add" }) }),
             /* @__PURE__ */ jsxs25(DropdownMenuContent3, { align: "end", children: [
               /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => patch({ secrets: [...draft.secrets, { key: "", label: "", value: "" }] }), children: "Secret field" }),
+              !hasSecureNote ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => patch({ secrets: [...draft.secrets, secureNoteDraft()] }), children: "Secure note" }) : null,
               /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => patch({ custom: [...draft.custom, { key: `custom_${draft.custom.length + 1}_${Date.now() % 1e5}`, label: "", value: "" }] }), children: "Text field" }),
               !tagsVisible ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => setShowTags(true), children: "Tags" }) : null,
               !descriptionVisible ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => setShowDescription(true), children: "Description" }) : null,
@@ -6289,7 +6376,7 @@ function ItemPane(props) {
         }
       ),
       filesProps ? /* @__PURE__ */ jsx27(FilesSection, { ...filesProps, editing: true }) : mode === "new" && owner !== "person" ? /* @__PURE__ */ jsx27(DraftFilesSection, { files: queuedFiles, onFiles: setQueuedFiles }) : null
-    ] }) : item ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+    ] }) : item ? /* @__PURE__ */ jsxs25(Fragment18, { children: [
       /* @__PURE__ */ jsxs25(VaultSection, { children: [
         declared.map((f) => {
           if (f.storage === "metadata") {
@@ -6344,6 +6431,13 @@ function ItemPane(props) {
 
 // src/ItemList.tsx
 import { jsx as jsx28, jsxs as jsxs26 } from "react/jsx-runtime";
+var RECOVERY_KEYS = /^recovery_codes?$/;
+function otherCopyFields(item, user, secret) {
+  if (!item.capabilities.canUse) return [];
+  return item.fields.filter(
+    (f) => f !== user && f !== secret && f.active !== false && f.handling !== "sealed" && (f.handling === "visible" || item.capabilities.canReveal) && !isAuthenticatorStorage(f.key) && !RECOVERY_KEYS.test(f.key)
+  );
+}
 var SORTS2 = [
   { value: "name", label: "Name A\u2013Z" },
   { value: "name-desc", label: "Name Z\u2013A" },
@@ -6356,7 +6450,7 @@ function subtitleOf(item, withOwner) {
   const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
-function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, showOwner, canSortViewed = false }) {
+function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, showOwner, canSortViewed = false, onRefresh, refreshing = false, rowContextMenu = "package", rowMenuItems }) {
   const sorts = SORTS2.filter((s) => canSortViewed || s.value !== "viewed");
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
@@ -6377,7 +6471,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     }
   };
   const mixedOwners = showOwner ?? new Set(items.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
-  const row = (i) => /* @__PURE__ */ jsx28(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners }, i.id);
+  const row = (i) => /* @__PURE__ */ jsx28(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners, ownContextMenu: rowContextMenu === "package", extra: rowMenuItems }, i.id);
   const sortLabel = sorts.find((s) => s.value === sort)?.label ?? "Name A\u2013Z";
   return /* @__PURE__ */ jsxs26("section", { "aria-label": title, className: "flex h-full min-h-0 flex-col border-r border-border bg-background", children: [
     /* @__PURE__ */ jsxs26("div", { className: "flex flex-col gap-2 px-3 pb-2 pt-3", children: [
@@ -6392,9 +6486,12 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
           " ",
           items.length === 1 ? "item" : "items"
         ] }),
-        /* @__PURE__ */ jsxs26(DropdownMenu4, { children: [
-          /* @__PURE__ */ jsx28(DropdownMenuTrigger4, { asChild: true, children: /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(SortGlyph, {}), "aria-label": `Sort: ${sortLabel}`, children: sortLabel }) }),
-          /* @__PURE__ */ jsx28(DropdownMenuContent4, { align: "end", children: /* @__PURE__ */ jsx28(DropdownMenuRadioGroup, { value: sort, onValueChange: (v) => onSort(sorts.find((s) => s.value === v)?.value ?? "name"), children: sorts.map((s) => /* @__PURE__ */ jsx28(DropdownMenuRadioItem, { value: s.value, children: s.label }, s.value)) }) })
+        /* @__PURE__ */ jsxs26("span", { className: "flex shrink-0 items-center gap-0.5", children: [
+          onRefresh ? /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(RefreshGlyph, { className: refreshing ? "animate-spin" : "" }), "aria-label": "Refresh", title: "Refresh the list", disabled: refreshing, onClick: onRefresh }) : null,
+          /* @__PURE__ */ jsxs26(DropdownMenu4, { children: [
+            /* @__PURE__ */ jsx28(DropdownMenuTrigger4, { asChild: true, children: /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(SortGlyph, {}), "aria-label": `Sort: ${sortLabel}`, children: sortLabel }) }),
+            /* @__PURE__ */ jsx28(DropdownMenuContent4, { align: "end", children: /* @__PURE__ */ jsx28(DropdownMenuRadioGroup, { value: sort, onValueChange: (v) => onSort(sorts.find((s) => s.value === v)?.value ?? "name"), children: sorts.map((s) => /* @__PURE__ */ jsx28(DropdownMenuRadioItem, { value: s.value, children: s.label }, s.value)) }) })
+          ] })
         ] })
       ] })
     ] }),
@@ -6409,7 +6506,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     ] }) })
   ] });
 }
-function ListRow({ item, family, port, on, onSelect, withOwner }) {
+function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu, extra }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
@@ -6434,67 +6531,93 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
   const copyPassword = () => secret && void run("Password", () => port.reveal(item, secret.key), true);
   const copyCode = () => code && void run("One-time code", async () => (await port.authenticator.code(item)).code, true);
   const copyName = () => void copy(item.name, "Name", { secret: false });
-  return /* @__PURE__ */ jsxs26("li", { className: "group relative", "data-item": item.id, children: [
-    /* @__PURE__ */ jsxs26(
-      "button",
-      {
-        type: "button",
-        "aria-current": on ? "true" : void 0,
-        "data-surface": on ? "primary" : void 0,
-        onClick: () => onSelect(item.id),
-        className: cn13("flex h-12 w-full items-center gap-3 rounded-lg px-2 pr-10 text-left", on ? "bg-primary text-primary-foreground" : "hover:bg-accent"),
-        children: [
-          /* @__PURE__ */ jsx28(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
-          /* @__PURE__ */ jsxs26("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
-            /* @__PURE__ */ jsx28("span", { className: "truncate text-sm font-medium", children: item.name }),
-            /* @__PURE__ */ jsx28("span", { className: "truncate text-xs text-muted-foreground", children: subtitleOf(item, withOwner) })
-          ] })
-        ]
-      }
-    ),
-    /* @__PURE__ */ jsxs26("div", { className: "absolute right-1.5 top-1/2 flex -translate-y-1/2 items-center gap-0.5", "data-surface": on ? "primary" : void 0, children: [
-      user || secret ? /* @__PURE__ */ jsxs26("div", { className: cn13("hidden items-center gap-0.5 rounded-md pl-2 [@media(hover:hover)]:group-hover:flex [@media(hover:hover)]:group-focus-within:flex", on ? "bg-primary" : "bg-accent"), "data-row-quick": "", children: [
-        user ? /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(UserGlyph, {}), "aria-label": `Copy ${user.label}`, disabled: busy, onClick: copyUser }) : null,
-        secret ? /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(KeyGlyph, {}), "aria-label": "Copy password", disabled: busy, onClick: copyPassword }) : null
-      ] }) : null,
-      /* @__PURE__ */ jsxs26(DropdownMenu4, { open: menuOpen, onOpenChange: setMenuOpen, children: [
-        /* @__PURE__ */ jsx28(DropdownMenuTrigger4, { asChild: true, children: /* @__PURE__ */ jsx28(
-          Button23,
+  const others = otherCopyFields(item, user, secret);
+  const custom = canUse ? item.custom.filter((c) => c.value) : [];
+  const hostEntries = extra?.(item) ?? [];
+  return /* @__PURE__ */ jsxs26(
+    "li",
+    {
+      className: "group relative",
+      "data-item": item.id,
+      onContextMenu: ownContextMenu ? (e) => {
+        e.preventDefault();
+        setMenuOpen(true);
+      } : void 0,
+      children: [
+        /* @__PURE__ */ jsxs26(
+          "button",
           {
-            variant: "quiet",
-            icon: /* @__PURE__ */ jsx28(MoreGlyph, {}),
-            "aria-label": `Actions for ${item.name}`,
-            disabled: busy,
-            className: cn13("[@media(hover:hover)]:invisible [@media(hover:hover)]:group-hover:visible [@media(hover:hover)]:group-focus-within:visible", menuOpen && "[@media(hover:hover)]:visible")
+            type: "button",
+            "aria-current": on ? "true" : void 0,
+            "data-surface": on ? "primary" : void 0,
+            onClick: () => onSelect(item.id),
+            className: cn13("flex h-12 w-full items-center gap-3 rounded-lg px-2 pr-10 text-left", on ? "bg-primary text-primary-foreground" : "hover:bg-accent"),
+            children: [
+              /* @__PURE__ */ jsx28(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
+              /* @__PURE__ */ jsxs26("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
+                /* @__PURE__ */ jsx28("span", { className: "truncate text-sm font-medium", children: item.name }),
+                /* @__PURE__ */ jsx28("span", { className: "truncate text-xs text-muted-foreground", children: subtitleOf(item, withOwner) })
+              ] })
+            ]
           }
-        ) }),
-        /* @__PURE__ */ jsxs26(DropdownMenuContent4, { align: "end", children: [
-          user ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyUser, children: [
-            /* @__PURE__ */ jsx28(UserGlyph, { className: "size-4" }),
-            "Copy ",
-            user.label.toLowerCase()
-          ] }) : null,
-          secret ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyPassword, children: [
-            /* @__PURE__ */ jsx28(KeyGlyph, { className: "size-4" }),
-            "Copy password"
-          ] }) : null,
-          code ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyCode, children: [
-            /* @__PURE__ */ jsx28(ClockGlyph, { className: "size-4" }),
-            "Copy one-time code"
+        ),
+        /* @__PURE__ */ jsxs26("div", { className: "absolute right-1.5 top-1/2 flex -translate-y-1/2 items-center gap-0.5", "data-surface": on ? "primary" : void 0, children: [
+          user || secret ? /* @__PURE__ */ jsxs26("div", { className: cn13("hidden items-center gap-0.5 rounded-md pl-2 [@media(hover:hover)]:group-hover:flex [@media(hover:hover)]:group-focus-within:flex", on ? "bg-primary" : "bg-accent"), "data-row-quick": "", children: [
+            user ? /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(UserGlyph, {}), "aria-label": `Copy ${user.label}`, disabled: busy, onClick: copyUser }) : null,
+            secret ? /* @__PURE__ */ jsx28(Button23, { variant: "quiet", icon: /* @__PURE__ */ jsx28(KeyGlyph, {}), "aria-label": "Copy password", disabled: busy, onClick: copyPassword }) : null
           ] }) : null,
-          user || secret || code ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
-          /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: () => onSelect(item.id), children: [
-            /* @__PURE__ */ jsx28(ChevronRightGlyph, { className: "size-4" }),
-            "Open"
-          ] }),
-          /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyName, children: [
-            /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" }),
-            "Copy name"
+          /* @__PURE__ */ jsxs26(DropdownMenu4, { open: menuOpen, onOpenChange: setMenuOpen, children: [
+            /* @__PURE__ */ jsx28(DropdownMenuTrigger4, { asChild: true, children: /* @__PURE__ */ jsx28(
+              Button23,
+              {
+                variant: "quiet",
+                icon: /* @__PURE__ */ jsx28(MoreGlyph, {}),
+                "aria-label": `Actions for ${item.name}`,
+                disabled: busy,
+                className: cn13("[@media(hover:hover)]:invisible [@media(hover:hover)]:group-hover:visible [@media(hover:hover)]:group-focus-within:visible", menuOpen && "[@media(hover:hover)]:visible")
+              }
+            ) }),
+            /* @__PURE__ */ jsxs26(DropdownMenuContent4, { align: "end", children: [
+              user ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyUser, children: [
+                /* @__PURE__ */ jsx28(UserGlyph, { className: "size-4" }),
+                "Copy ",
+                user.label.toLowerCase()
+              ] }) : null,
+              secret ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyPassword, children: [
+                /* @__PURE__ */ jsx28(KeyGlyph, { className: "size-4" }),
+                "Copy password"
+              ] }) : null,
+              code ? /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyCode, children: [
+                /* @__PURE__ */ jsx28(ClockGlyph, { className: "size-4" }),
+                "Copy one-time code"
+              ] }) : null,
+              others.map((f) => /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: () => void run(f.label, () => port.reveal(item, f.key), f.handling !== "visible"), children: [
+                /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" }),
+                "Copy ",
+                f.label.toLowerCase()
+              ] }, f.key)),
+              custom.map((c) => /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: () => void copy(c.value, c.label, { secret: false }), children: [
+                /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" }),
+                "Copy ",
+                c.label.toLowerCase()
+              ] }, `custom:${c.key}`)),
+              user || secret || code || others.length > 0 || custom.length > 0 ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
+              /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: () => onSelect(item.id), children: [
+                /* @__PURE__ */ jsx28(ChevronRightGlyph, { className: "size-4" }),
+                "Open"
+              ] }),
+              /* @__PURE__ */ jsxs26(DropdownMenuItem4, { onSelect: copyName, children: [
+                /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" }),
+                "Copy name"
+              ] }),
+              hostEntries.length > 0 ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
+              hostEntries.map((h) => /* @__PURE__ */ jsx28(DropdownMenuItem4, { onSelect: h.onSelect, children: h.label }, h.label))
+            ] })
           ] })
         ] })
-      ] })
-    ] })
-  ] });
+      ]
+    }
+  );
 }
 
 // src/lists/TrashView.tsx
@@ -6574,7 +6697,7 @@ function refusalText(reason) {
 // src/lists/RestorePanel.tsx
 import { useEffect as useEffect18, useState as useState29 } from "react";
 import { Button as Button24 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment18, jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
+import { Fragment as Fragment19, jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 function RestorePanel({ lists, item, restore, onClose }) {
   const [preview, setPreview] = useState29(null);
@@ -6619,7 +6742,7 @@ function RestorePanel({ lists, item, restore, onClose }) {
       title: `Restore "${item.name}"`,
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs27(Fragment18, { children: [
+      footer: /* @__PURE__ */ jsxs27(Fragment19, { children: [
         /* @__PURE__ */ jsx29(Button24, { variant: "quiet", onClick: onClose, children: refused ? "Close" : "Cancel" }),
         refused ? null : /* @__PURE__ */ jsx29(Button24, { variant: "primary", icon: /* @__PURE__ */ jsx29(RestoreGlyph, {}), disabled: busy || loading || lists.preview !== void 0 && preview === null, onClick: () => void run(), children: busy ? "Restoring\u2026" : "Restore" })
       ] }),
@@ -7117,7 +7240,7 @@ function addPasskeyFailure(message2) {
 var isRevoked = (d) => d.revokedAt !== null;
 
 // src/devices/DevicesPanel.tsx
-import { Fragment as Fragment19, jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
+import { Fragment as Fragment20, jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
 var messageOf3 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function ErrorLine2({ text }) {
   return text ? /* @__PURE__ */ jsx33("p", { role: "alert", className: "px-1 text-sm text-destructive", children: text }) : null;
@@ -7248,7 +7371,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
   };
   const canApprove = Boolean(key && passkeys && here && methods?.passkey && !approvedUntil);
   const title = isMac ? "Approve this Mac" : name ? `Approve ${name}` : "Approve this browser";
-  const footer = approvedUntil ? /* @__PURE__ */ jsx33(Button28, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs31(Fragment19, { children: [
+  const footer = approvedUntil ? /* @__PURE__ */ jsx33(Button28, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs31(Fragment20, { children: [
     /* @__PURE__ */ jsx33(Button28, { variant: "quiet", disabled: busy !== null, onClick: refuse, children: key ? "Refuse" : "Close" }),
     canApprove ? /* @__PURE__ */ jsx33(Button28, { variant: "primary", icon: /* @__PURE__ */ jsx33(FingerprintGlyph, {}), disabled: busy !== null, onClick: () => void approve(), children: busy === "approve" ? "Approving\u2026" : "Approve with passkey" }) : null
   ] });
@@ -7256,7 +7379,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
     "This link names no key. Start again from ",
     where,
     "."
-  ] }) }) : /* @__PURE__ */ jsxs31(Fragment19, { children: [
+  ] }) }) : /* @__PURE__ */ jsxs31(Fragment20, { children: [
     /* @__PURE__ */ jsxs31(VaultSection, { title: "What is asking", children: [
       /* @__PURE__ */ jsx33(VaultRow, { label: "Asking", hint: "Approve only if you just asked", children: asker }),
       name ? /* @__PURE__ */ jsx33(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx33("span", { className: "block truncate", children: name }) }) : null,
@@ -7556,7 +7679,7 @@ function useNativeImport(bridge, stillAllowed, onImported) {
 }
 
 // src/native/NativeImportPanel.tsx
-import { Fragment as Fragment20, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
+import { Fragment as Fragment21, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
 var TONE = {
   eligible: "success",
   committed: "success",
@@ -7600,16 +7723,16 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
     const yes = await confirm13({ title: `Add ${plural2(ready, "passkey")} to ${orgName}?`, description: "Passkeys already there are skipped.", confirmLabel: "Import" });
     if (yes) await flow.confirm();
   };
-  const footer = preview ? /* @__PURE__ */ jsxs32(Fragment20, { children: [
+  const footer = preview ? /* @__PURE__ */ jsxs32(Fragment21, { children: [
     /* @__PURE__ */ jsx34(Button29, { variant: "quiet", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel" }),
     /* @__PURE__ */ jsxs32(Button29, { variant: "primary", icon: /* @__PURE__ */ jsx34(ImportGlyph, { className: "size-4" }), disabled: busy || ready === 0, onClick: () => void importNow(), children: [
       "Import ",
       ready
     ] })
-  ] }) : status ? active ? /* @__PURE__ */ jsxs32(Fragment20, { children: [
+  ] }) : status ? active ? /* @__PURE__ */ jsxs32(Fragment21, { children: [
     /* @__PURE__ */ jsx34(Button29, { variant: "outline", disabled: busy, onClick: () => void flow.refresh(), children: "Refresh" }),
     /* @__PURE__ */ jsx34(Button29, { variant: "outline", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel import" })
-  ] }) : /* @__PURE__ */ jsxs32(Fragment20, { children: [
+  ] }) : /* @__PURE__ */ jsxs32(Fragment21, { children: [
     /* @__PURE__ */ jsx34(Button29, { variant: "quiet", onClick: flow.reset, children: "New file" }),
     /* @__PURE__ */ jsx34(Button29, { variant: "primary", onClick: onClose, children: "Done" })
   ] }) : /* @__PURE__ */ jsx34(Button29, { variant: "quiet", onClick: onClose, children: "Close" });
@@ -7648,7 +7771,7 @@ import { GlobeIcon as GlobeIcon4 } from "@ai-matrx/design-system/icons";
 // src/extension/CaptureCard.tsx
 import { useState as useState36, useSyncExternalStore as useSyncExternalStore3 } from "react";
 import { Button as Button30, SearchField as SearchField3 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment21, jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
+import { Fragment as Fragment22, jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
   const prompt = useSyncExternalStore3(capture.subscribe, capture.get, capture.get);
@@ -7681,7 +7804,7 @@ function CaptureCard({ capture, onChanged }) {
       ] }),
       /* @__PURE__ */ jsx35(Button30, { variant: "quiet", icon: /* @__PURE__ */ jsx35(XGlyph, {}), "aria-label": "Not now", disabled: busy, onClick: () => void decide({ action: "dismiss" }) })
     ] }),
-    prompt.unavailable ? /* @__PURE__ */ jsx35("p", { className: "text-xs text-muted-foreground", children: "Save it by hand with Save a login." }) : /* @__PURE__ */ jsxs33(Fragment21, { children: [
+    prompt.unavailable ? /* @__PURE__ */ jsx35("p", { className: "text-xs text-muted-foreground", children: "Save it by hand with Save a login." }) : /* @__PURE__ */ jsxs33(Fragment22, { children: [
       existing.length > 0 ? /* @__PURE__ */ jsxs33("div", { className: "flex flex-col gap-1", children: [
         existing.length >= SEARCH_FROM ? /* @__PURE__ */ jsx35(SearchField3, { value: q, onChange: (e) => setQ(e.target.value), placeholder: "Search logins", "aria-label": "Search logins to update" }) : null,
         /* @__PURE__ */ jsxs33("ul", { className: "flex max-h-36 flex-col gap-px overflow-y-auto", children: [
@@ -7787,7 +7910,7 @@ import { useState as useState38 } from "react";
 import { Popover as Popover2, PopoverContent as PopoverContent2, PopoverTrigger as PopoverTrigger2 } from "@ai-matrx/design-system";
 import { Button as Button32 } from "@ai-matrx/design-system/controls";
 import { CopyIcon as CopyIcon8 } from "@ai-matrx/design-system/icons";
-import { Fragment as Fragment22, jsx as jsx37, jsxs as jsxs35 } from "react/jsx-runtime";
+import { Fragment as Fragment23, jsx as jsx37, jsxs as jsxs35 } from "react/jsx-runtime";
 var HOLD_MS = 6e4;
 function PageGenerator({ fields }) {
   const limits = useGeneratorLimitsSource();
@@ -7838,12 +7961,12 @@ function PageGenerator({ fields }) {
     }
   };
   const value = held.value;
-  return /* @__PURE__ */ jsxs35(Fragment22, { children: [
+  return /* @__PURE__ */ jsxs35(Fragment23, { children: [
     /* @__PURE__ */ jsx37(
       VaultRow,
       {
         label: "New password",
-        actions: /* @__PURE__ */ jsxs35(Fragment22, { children: [
+        actions: /* @__PURE__ */ jsxs35(Fragment23, { children: [
           value ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(CopyIcon8, {}), "aria-label": "Copy password", onClick: () => void copy(value, "Password") }) : null,
           /* @__PURE__ */ jsxs35(Popover2, { open, onOpenChange: setOpen, children: [
             /* @__PURE__ */ jsx37(PopoverTrigger2, { asChild: true, children: /* @__PURE__ */ jsx37(Button32, { variant: "outline", icon: /* @__PURE__ */ jsx37(KeyGlyph, {}), disabled: busy, children: "Generate" }) }),
@@ -8121,6 +8244,7 @@ import { jsx as jsx40, jsxs as jsxs38 } from "react/jsx-runtime";
 var FULL_AT = 1120;
 var SPLIT_AT = 640;
 var NO_HOST = {};
+var FOCUS_GAP_MS = 2e3;
 var ITEM_PANELS = {
   share: SharePanel,
   move: MovePanel,
@@ -8249,9 +8373,13 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const knobsRef = useRef19(host.knobs);
   knobsRef.current = host.knobs;
   const [signedOut, setSignedOut] = useState41(false);
-  const load = useCallback5(() => {
-    setError(null);
-    port.load().then((s) => {
+  const [refreshError, setRefreshError] = useState41(null);
+  const [refreshing, setRefreshing] = useState41(false);
+  const loadedAt = useRef19(0);
+  const inFlight = useRef19(false);
+  const apply = useCallback5(
+    (s) => {
+      loadedAt.current = Date.now();
       setSnap(s);
       setItems(s.items);
       setDeleted(s.deleted);
@@ -8259,15 +8387,71 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         (rows) => setDeleted([...s.deleted, ...rows.filter((r) => !s.deleted.some((d) => d.id === r.id))]),
         () => void 0
       );
-    }).catch((e) => {
+    },
+    [port]
+  );
+  const refresh = useCallback5(() => {
+    if (inFlight.current) return;
+    inFlight.current = true;
+    setRefreshing(true);
+    port.load().then((s) => {
+      setRefreshError(null);
+      apply(s);
+    }).catch((e) => setRefreshError(plainLoadError(e instanceof Error && e.message ? e.message : "The vault could not be read."))).finally(() => {
+      inFlight.current = false;
+      setRefreshing(false);
+    });
+    port.lists.favorites?.list().then((ids) => setFavorites(new Set(ids)), () => void 0);
+    port.lists.recents?.list().then(setRecents, () => void 0);
+  }, [port, apply]);
+  const load = useCallback5(() => {
+    setError(null);
+    setRefreshError(null);
+    port.load().then(apply).catch((e) => {
       setSignedOut(e?.status === 401);
       setError(e instanceof Error ? e.message : "The vault could not be loaded.");
     });
     port.lists.favorites?.list().then((ids) => setFavorites(new Set(ids)), () => void 0);
     knobsRef.current?.().catch(() => void 0);
     port.lists.recents?.list().then(setRecents, () => void 0);
-  }, [port]);
+  }, [port, apply]);
   useEffect23(load, [load]);
+  const quietRef = useRef19({ loc, ready: false });
+  quietRef.current = { loc, ready: snap !== null && !error };
+  const [knobSeconds, setKnobSeconds] = useState41(null);
+  useEffect23(() => {
+    if (host.refreshSeconds !== void 0 || !knobsRef.current) return;
+    let live = true;
+    knobsRef.current().then(
+      (r) => {
+        const v = r["vault.list.refresh_seconds"];
+        if (live && typeof v === "number" && v > 0) setKnobSeconds(v);
+      },
+      () => void 0
+    );
+    return () => {
+      live = false;
+    };
+  }, [host.refreshSeconds]);
+  const everySeconds = host.refreshSeconds ?? knobSeconds;
+  useEffect23(() => {
+    const quietly = (minGapMs) => {
+      const { loc: here, ready } = quietRef.current;
+      if (!ready || document.visibilityState === "hidden" || dirty.current || here.mode !== "view") return;
+      if (Date.now() - loadedAt.current < minGapMs) return;
+      refresh();
+    };
+    const onBack = () => quietly(FOCUS_GAP_MS);
+    const onVisible = () => document.visibilityState === "visible" && onBack();
+    window.addEventListener("focus", onBack);
+    document.addEventListener("visibilitychange", onVisible);
+    const timer2 = everySeconds && everySeconds > 0 ? setInterval(() => quietly(0), everySeconds * 1e3) : null;
+    return () => {
+      window.removeEventListener("focus", onBack);
+      document.removeEventListener("visibilitychange", onVisible);
+      if (timer2) clearInterval(timer2);
+    };
+  }, [refresh, everySeconds]);
   const inventoryRef = useRef19(onInventory);
   inventoryRef.current = onInventory;
   useEffect23(() => {
@@ -8433,6 +8617,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       onSort: (sort) => go({ sort }, "replace"),
       canSortViewed: port.lists.recents !== void 0,
       onNew: () => go({ itemId: null, mode: "new", kind: null, panel: null }),
+      onRefresh: refresh,
+      refreshing,
+      rowContextMenu: host.rowContextMenu ?? "package",
+      ...host.rowMenuItems ? { rowMenuItems: host.rowMenuItems } : {},
       ...matchingIds ? { matchingIds } : {},
       ...compactHeader ? { header: compactHeader } : {}
     }
@@ -8457,14 +8645,14 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         host,
         organizations: orgs,
         defaultOwner: ownerDefault,
-        seed: { name: guess?.name ?? "", url: guess?.url ?? loc.url.trim() },
+        seed: { name: loc.name?.trim() || guess?.name || "", url: guess?.url ?? loc.url.trim() },
         onBack: () => go({ kind: null }),
         onMode: () => void 0,
         onSaved: (item, _wasNew, n, enrolled) => {
           replaceItem(item);
           dirty.current = false;
           if (enrolled) setFirstCode(item);
-          move({ ...loc, itemId: item.id, mode: "view", kind: null, url: "", panel: null }, "replace");
+          move({ ...loc, itemId: item.id, mode: "view", kind: null, url: "", name: "", panel: null }, "replace");
           setNotice(n);
           notify("Saved");
         },
@@ -8472,7 +8660,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         onDirty: (d) => {
           dirty.current = d;
         },
-        onCancelNew: () => go({ mode: "view", kind: null, url: "", itemId: null }),
+        onCancelNew: () => go({ mode: "view", kind: null, url: "", name: "", itemId: null }),
         onPanel: () => void 0,
         onChanged: () => void 0
       },
@@ -8563,13 +8751,17 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const grid = mode === "full" ? "grid-cols-[15rem_21rem_minmax(0,1fr)]" : mode === "split" ? "grid-cols-[19rem_minmax(0,1fr)]" : "grid-cols-1";
   const shown = panesShown(mode, specialView !== null, showingDetail);
   return /* @__PURE__ */ jsxs38("div", { ref: rootRef, className: "flex h-full min-h-0 w-full flex-col bg-background text-foreground", children: [
+    refreshError ? /* @__PURE__ */ jsxs38("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
+      /* @__PURE__ */ jsx40("span", { className: "min-w-0 flex-1 truncate text-warning", title: refreshError, children: "Couldn\u2019t refresh. Showing what was loaded." }),
+      /* @__PURE__ */ jsx40("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: refresh, children: "Try again" })
+    ] }) : null,
     snap.unavailable.length > 0 ? /* @__PURE__ */ jsxs38("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
       /* @__PURE__ */ jsxs38("span", { className: "min-w-0 flex-1 truncate text-warning", children: [
         "Couldn\u2019t load ",
         snap.unavailable.join(", "),
         ". Showing the rest."
       ] }),
-      /* @__PURE__ */ jsx40("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: load, children: "Try again" })
+      /* @__PURE__ */ jsx40("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: refresh, children: "Try again" })
     ] }) : null,
     /* @__PURE__ */ jsxs38("div", { className: `grid min-h-0 w-full flex-1 ${grid} overflow-hidden`, children: [
       mode === "full" ? /* @__PURE__ */ jsx40(
@@ -8920,6 +9112,28 @@ function trashItem(r, ctx) {
     createdAt: ""
   };
 }
+async function withTypes(items, door, ctx) {
+  if (!door.schema || items.length === 0) return items;
+  const keys = /* @__PURE__ */ new Map();
+  const CHUNK = 100;
+  try {
+    for (let i = 0; i < items.length; i += CHUNK) {
+      const ids = items.slice(i, i + CHUNK).map((x) => x.id);
+      const { data, error } = await door.schema("users").from("credential_items").select("id,definition_key").in("id", ids);
+      if (error) throw new Error(error.message || "credential_items read failed");
+      for (const r of Array.isArray(data) ? data : []) {
+        if (typeof r.id === "string" && typeof r.definition_key === "string" && r.definition_key) keys.set(r.id, r.definition_key);
+      }
+    }
+  } catch (e) {
+    console.warn("[vault] Trash item types could not be read; rows say Credential", e);
+    return items;
+  }
+  return items.map((it) => {
+    const key = keys.get(it.id);
+    return key ? { ...it, definitionKey: key, definitionLabel: ctx.definition(key)?.label ?? humanize(key) } : it;
+  });
+}
 var previewOf = async (door, id) => parseRecoveryPreview(await call(door, "vault_recovery_preview", { p_id: id }));
 function createListsPort(ctx, door) {
   return {
@@ -8952,7 +9166,8 @@ function createListsPort(ctx, door) {
             if (rows.length < PAGE2) break;
           }
           const items = all.map((r) => trashItem(r, ctx)).filter((i) => i !== null);
-          return [...new Map(items.map((i) => [i.id, i])).values()];
+          const unique = [...new Map(items.map((i) => [i.id, i])).values()];
+          return withTypes(unique, door, ctx);
         }
       },
       favorites: {
@@ -8975,16 +9190,25 @@ function createListsPort(ctx, door) {
 import * as account6 from "@ai-matrx/api/account";
 
 // src/secret-field-in.ts
-function secretFieldIn(s) {
+function settingsIn(s) {
   const envKey = s.envKey?.trim() || null;
   return {
-    field_key: fieldKeyOf(s.label),
-    value: s.value,
-    handling: s.handling ?? "revealable",
     ...envKey ? { env_key: envKey } : {},
     ...envKey && s.injectIntoSandbox ? { inject_into_sandbox: true } : {}
   };
 }
+function secretFieldIn(s) {
+  return {
+    field_key: s.key.trim() || fieldKeyOf(s.label),
+    value: s.value,
+    handling: s.handling ?? "revealable",
+    ...s.description ? { description: s.description } : {},
+    ...settingsIn(s)
+  };
+}
+function declaredFieldIn(f, value, settings) {
+  return { field_key: f.key, value, handling: settings?.handling ?? f.handling, ...settingsIn(settings ?? {}) };
+}
 
 // src/sharing/api.ts
 function grantOf(w) {
@@ -9085,7 +9309,7 @@ function createSharingPort(ctx, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn)
           ]
         }
@@ -9214,7 +9438,7 @@ async function readNativeImportLimits(api, organizationId) {
 var recoveryOf = (w) => w.lifecycle?.vault_recovery;
 var isDeleted = (w) => recoveryOf(w)?.state === "deleted";
 var MATCH_MODES2 = ["host", "domain", "exact", "never"];
-var FIELD_WORDS = { totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
+var FIELD_WORDS = { secure_notes: "Secure note", totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
 var handlingOf = (v) => v === "visible" || v === "sealed" ? v : "revealable";
 function fieldOf(w, def) {
   const declared = def?.fields.find((f) => f.key === w.field_key);
@@ -9223,7 +9447,8 @@ function fieldOf(w, def) {
     id: w.id,
     key: w.field_key,
     label: declared?.label ?? FIELD_WORDS[w.field_key] ?? humanize(w.field_key),
-    kind: declared?.kind ?? (handling === "visible" ? "text" : "secret"),
+    // A field no type declares still edits as several lines when its key says so (an old "Secure note").
+    kind: declared?.kind ?? (isMultilineKey(w.field_key) ? "multiline" : handling === "visible" ? "text" : "secret"),
     handling,
     editable: w.editable ?? true,
     envKey: w.env_key ?? null,
@@ -9378,7 +9603,7 @@ function createApiVaultPort(api, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn),
             // Backup codes on a type that does not declare them (a website login): their own encrypted field.
             ...!declared.some((f) => f.key === RECOVERY_CODES_KEY) && (draft.values[RECOVERY_CODES_KEY] ?? "").trim() !== "" ? [{ field_key: RECOVERY_CODES_KEY, value: parseRecoveryCodes(draft.values[RECOVERY_CODES_KEY] ?? "").join("\n"), handling: "revealable", description: "One-time account recovery codes" }] : []