@ai-matrx/vault 0.1.19 → 0.1.20

package/CHANGELOG.md

@@ -1,9 +1,33 @@
 # Changelog
 
+## 0.1.20
+
+- **A multi-line secret edits as several lines.** A field whose type says multi-line, any field under a notes key (an old **Secure note**, `secure_notes`) and any value that already holds a line break now edit in a multi-line box — a one-line box dropped the line breaks on save. Shown values keep their lines too. Guard: `src/vault-gaps-2026-10-19.test.tsx`. Consumer action: none.
+- **Secure note is back** in the item form's Add menu: an encrypted multi-line field stored as `secure_notes`, hidden until shown (`secureNoteDraft`, `NewSecretField.multiline`/`key`/`description`). Consumer action: none.
+- **A new item's declared secrets carry env key, who can see it and sandbox use to the create call** (`ItemDraft.fieldSettings`, `declaredFieldIn`, `FieldSettingsRows`): behind each secret's sliders, open from the start on an Environment value. Consumer action: none.
+- **Trash rows say each item's type** ("Website login"), read from the item through the state door's `schema("users")` (`VaultUserStateDoor.schema`, `withTypes`), instead of "Credential". Consumer action: none — every host already passes its supabase client as `userState`.
+- **A code added in the Authenticator shows in its list at once**, before the vault's re-read answers (or when an older re-read answers last) (`AddOtpPanel onAdded`, `withAdded`). Consumer action: none.
+- **The list stays current.** A **Refresh** button beside the sort re-reads the list; the list also re-reads itself when the window or panel comes back into focus, and every `host.refreshSeconds` (else the organization's `vault.list.refresh_seconds` knob) while shown — never while hidden, never over an edit or a new item, never two reads at once. A refresh that fails keeps the loaded list and says "Couldn’t refresh. Showing what was loaded." with Try again; the partial-read line's Try again no longer drops to the "couldn't open" screen. Guard: `src/parity-gaps.test.tsx`. **Consumer action:** desktop: pass `refreshSeconds` from its refresh knob. Web app and extension: none (focus refresh is on by itself).
+- **The row menu copies any field** — API key, token, account number, any plain custom field — besides username, password and code (never a sealed field, the authenticator's key or recovery codes). **Right-click on a row opens that menu** in every host, with a host's extra entries (`host.rowMenuItems`). **Consumer action:** web app: pass `rowContextMenu: "host"` so its own v3 right-click menu (agents, Copy, Export) keeps answering on rows. Extension and desktop: none.
+- **After an import**, one **Set up authenticator for <name>** link per imported login that came with a one-time password; it opens the setup for that login over the result (`ImportRunResult.needOtp`). Consumer action: none.
+- **The authenticator setup screen starts the camera by itself** where this browser can scan (`OtpSetupRow autoStartCamera`, used by `AddOtpPanel`; a setup row inside an edit never does). Consumer action: none.
+- **An opener can name the new item**: `VaultLocation.name` (`?name=`) prefills the new item's name over the one guessed from the address. Consumer action: none.
+
 ## 0.1.19
 
-UNVERIFIED: this release has no Unreleased entry and the source comparison could not be made (the caller supplied no source comparison). Whether source changed is unknown; consumer action is unknown.
-Check the package's gitHead on npm against this version's gitHead: `git diff <previous gitHead> <this gitHead> -- apps/shared/vault/src`.
+SOURCE CHANGED WITH NO RELEASE NOTE. This release shipped source changes that nobody described in an Unreleased entry,
+so they may include breaking API changes. Consumer action is UNKNOWN: read the diff before upgrading.
+Diff: `git diff ff560b1be4 05488c8d62 -- apps/shared/vault/src`
+
+Changed shipped source files (8):
+- `apps/shared/vault/src/ItemList.tsx`
+- `apps/shared/vault/src/VaultApp.tsx`
+- `apps/shared/vault/src/authenticator/AddOtpPanel.tsx`
+- `apps/shared/vault/src/authenticator/Setup.tsx`
+- `apps/shared/vault/src/io/ImportPanel.tsx`
+- `apps/shared/vault/src/io/import-run.ts`
+- `apps/shared/vault/src/model.ts`
+- `apps/shared/vault/src/port.ts`
 
 ## 0.1.18
 

package/dist/index.cjs

@@ -740,7 +740,7 @@ var DAY_FORMAT = { year: "numeric", month: "short", day: "numeric" };
 var import_jsx_runtime5 = require("react/jsx-runtime");
 var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function SecretText({ value, multiline }) {
-  if (multiline || value.length > 200) return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
+  if (multiline || value.length > 200 || value.includes("\n")) return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "break-all font-mono text-sm tracking-wide", children: [...value].map((ch, i) => /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: /[0-9]/.test(ch) ? "text-primary" : /[^A-Za-z0-9]/.test(ch) ? "text-warning" : void 0, children: ch }, i)) });
 }
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
@@ -876,18 +876,19 @@ function EditRow({ label, hint: hint2, value, onChange, placeholder, secret = fa
     }
   );
 }
-function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue }) {
+function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue, multiline = false }) {
   const [shown, setShown] = (0, import_react5.useState)(false);
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
     VaultRow,
     {
       label: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Field, { className: "w-full", value: label, onChange: (e) => onLabel(e.target.value), placeholder: "Name", "aria-label": "Field name" }),
+      top: multiline,
       actions: /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
-        secret && value ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: shown ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeOffGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
+        secret && value && !multiline ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: shown ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeOffGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
         extra,
         /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", removes: true, icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(XGlyph, {}), "aria-label": "Remove field", onClick: onRemove })
       ] }),
-      children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+      children: multiline ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Textarea, { className: "w-full", value, onChange: (e) => onValue(e.target.value), rows: 4, placeholder: secret ? "Encrypted, hidden until shown" : "Value", autoComplete: "off", spellCheck: !secret, "aria-label": label ? `${label} value` : "Field value" }) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
         import_controls2.Field,
         {
           className: "w-full",
@@ -1006,6 +1007,7 @@ function sortItems(items, sort, recents) {
   if (sort === "updated") return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return out.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+var SECURE_NOTE_KEY = "secure_notes";
 function draftOf(item) {
   return {
     name: item?.name ?? "",
@@ -1056,7 +1058,9 @@ function rebaseDraft(oldBase, newBase, draft) {
     secrets: draft.secrets,
     custom,
     removed: draft.removed,
-    authenticator: draft.authenticator
+    authenticator: draft.authenticator,
+    ...draft.browser ? { browser: draft.browser } : {},
+    ...draft.fieldSettings ? { fieldSettings: draft.fieldSettings } : {}
   };
 }
 function panesShown(mode, specialView, showingDetail) {
@@ -1084,7 +1088,8 @@ var FAMILY_LABELS = {
   signing_files: "Signing & files"
 };
 var COMMON_DEFINITION_KEYS = ["website_login", "username_password", "api_key", "env_value", "database_login", "custom"];
-var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes)/;
+var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes|(^|_)notes?($|_))/;
+var isMultilineKey = (key) => MULTILINE.test(key);
 var SECRET = /(password|secret|token|api_key|private|passphrase|credential|seed|key$|_key)/;
 var URLISH = /(url|uri|endpoint|webhook|hook)/;
 function humanize(key) {
@@ -2298,7 +2303,7 @@ function normalizeWebsite(raw) {
     return null;
   }
 }
-function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onDone }) {
+function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
   const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = (0, import_react12.useState)("");
@@ -2351,6 +2356,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       setInput("");
       setImage(null);
       setSaved(next);
+      onAdded?.(next);
       onChanged();
     } catch (e) {
       setError(wasCancelled(e) ? "Not confirmed, so nothing was added." : otpActionError(e, "add it"));
@@ -2459,7 +2465,23 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
+function withAdded(items, added) {
+  if (added.size === 0) return items;
+  const seen = /* @__PURE__ */ new Set();
+  const out = items.map((i) => {
+    seen.add(i.id);
+    const mine = added.get(i.id);
+    return mine && !i.authenticator ? { ...i, authenticator: mine.authenticator, name: mine.name } : i;
+  });
+  for (const [id, a] of added) if (!seen.has(id)) out.push(a);
+  return out;
+}
+function AuthenticatorView({ port, host, items: listed, definitions, query, onOpen, onChanged, header }) {
+  const [added, setAdded] = (0, import_react13.useState)(/* @__PURE__ */ new Map());
+  const items = withAdded(listed, added);
+  (0, import_react13.useEffect)(() => {
+    if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
+  }, [listed, added]);
   const [entries, setEntries] = (0, import_react13.useState)(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = (0, import_react13.useState)(/* @__PURE__ */ new Set());
   const [adding, setAdding] = (0, import_react13.useState)(false);
@@ -2475,7 +2497,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
     return () => {
       live = false;
     };
-  }, [port, items]);
+  }, [port, listed, added]);
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -2521,6 +2543,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
         definitions,
         onClose: () => setAdding(false),
         onChanged,
+        onAdded: (item) => setAdded((cur) => new Map(cur).set(item.id, item)),
         onDone: (id) => {
           setAdding(false);
           onOpen(id);
@@ -5245,14 +5268,12 @@ var import_confirm_opener7 = require("@ai-matrx/kit/confirm-opener");
 var import_jsx_runtime22 = require("react/jsx-runtime");
 var HANDLINGS = ["visible", "revealable", "sealed"];
 var hint = (text, tone = "muted") => /* @__PURE__ */ (0, import_jsx_runtime22.jsx)("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
-var hasSecretSettings = (s) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== "revealable");
-function SecretBuilderRow({ field, onChange, onRemove }) {
-  const [open, setOpen] = (0, import_react23.useState)(hasSecretSettings(field));
-  const env = field.envKey ?? "";
+var saysMore = (s, defaultHandling) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== defaultHandling);
+function FieldSettingsRows({ name, value, defaultHandling = "revealable", onChange }) {
+  const env = value.envKey ?? "";
   const envProblem = envKeyProblem(env);
   const envOk = env.trim() !== "" && !envProblem;
-  const handling = field.handling ?? "revealable";
-  const name = field.label.trim() || "Secret";
+  const handling = value.handling ?? defaultHandling;
   const chooseHandling = async (next) => {
     if (next === handling) return;
     if (next === "sealed") {
@@ -5266,6 +5287,38 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
     }
     onChange({ handling: next });
   };
+  return /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
+      import_controls18.Field,
+      {
+        className: "w-full font-mono",
+        "aria-label": `${name} env key`,
+        "aria-invalid": Boolean(envProblem),
+        placeholder: "e.g. GITHUB_TOKEN",
+        autoComplete: "off",
+        spellCheck: false,
+        value: env,
+        onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
+      }
+    ) }),
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
+      import_controls18.SegmentedControl,
+      {
+        "aria-label": `Who can see ${name}`,
+        value: handling,
+        onValueChange: (v) => void chooseHandling(v),
+        data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
+      }
+    ) }),
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Switch, { "aria-label": `Use ${name} in sandbox`, checked: envOk && value.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
+  ] });
+}
+var hasSecretSettings = (s) => saysMore(s, "revealable");
+var hasDeclaredSettings = (s, defaultHandling) => Boolean(s && saysMore(s, defaultHandling));
+function SecretBuilderRow({ field, onChange, onRemove }) {
+  const [open, setOpen] = (0, import_react23.useState)(hasSecretSettings(field));
+  const handling = field.handling ?? "revealable";
+  const name = field.label.trim() || "Secret";
   return /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
     /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
       CustomEditRow,
@@ -5273,47 +5326,26 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
         label: field.label,
         value: field.value,
         secret: true,
+        multiline: field.multiline === true,
         onLabel: (v) => onChange({ label: v }),
         onValue: (v) => onChange({ value: v }),
         onRemove,
-        onPasteValue: (text) => {
-          const a = parseEnvAssignment(text);
-          if (!a) return false;
-          onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
-          setOpen(true);
-          return true;
+        ...field.multiline ? {} : {
+          onPasteValue: (text) => {
+            const a = parseEnvAssignment(text);
+            if (!a) return false;
+            onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
+            setOpen(true);
+            return true;
+          }
         },
         extra: /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
-          handling !== "sealed" ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
+          handling !== "sealed" && !field.multiline ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
           /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(SlidersGlyph, {}), "aria-label": `${name} settings`, pressed: open, onClick: () => setOpen((o) => !o) })
         ] })
       }
     ),
-    open ? /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
-        import_controls18.Field,
-        {
-          className: "w-full font-mono",
-          "aria-label": `${name} env key`,
-          "aria-invalid": Boolean(envProblem),
-          placeholder: "e.g. GITHUB_TOKEN",
-          autoComplete: "off",
-          spellCheck: false,
-          value: env,
-          onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
-        }
-      ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
-        import_controls18.SegmentedControl,
-        {
-          "aria-label": `Who can see ${name}`,
-          value: handling,
-          onValueChange: (v) => void chooseHandling(v),
-          data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
-        }
-      ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Switch, { "aria-label": `Use ${name} in sandbox`, checked: envOk && field.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
-    ] }) : null
+    open ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(FieldSettingsRows, { name, value: field, onChange }) : null
   ] });
 }
 function withMfaMethod(custom, v) {
@@ -5943,6 +5975,8 @@ function SharingSummary({ item, port, className }) {
 // src/ItemPane.tsx
 var import_format8 = require("@ai-matrx/kit/format");
 var import_jsx_runtime27 = require("react/jsx-runtime");
+var ENV_VALUE_KEY = "env_value";
+var secureNoteDraft = () => ({ key: SECURE_NOTE_KEY, label: "Secure note", value: "", multiline: true, description: "Encrypted notes" });
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
@@ -6133,6 +6167,16 @@ function ItemPane(props) {
   const fieldSettings = (f) => canEdit ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(SlidersGlyph, {}), "aria-label": `${f.label} settings`, title: `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }) : null;
   const turnOnOne = canTurnOn ? (f) => () => turnOn([f]) : () => void 0;
   const declaredKeys = new Set(declared.map((f) => f.key));
+  const hasSecureNote = declaredKeys.has(SECURE_NOTE_KEY) || Boolean(item?.fields.some((f) => f.key === SECURE_NOTE_KEY)) || draft.secrets.some((x) => x.key === SECURE_NOTE_KEY);
+  const [settingsToggled, setSettingsToggled] = (0, import_react28.useState)(/* @__PURE__ */ new Set());
+  const settingsOpen = (f) => settingsToggled.has(f.key) !== (definition?.key === ENV_VALUE_KEY || hasDeclaredSettings(draft.fieldSettings?.[f.key], f.handling));
+  const toggleSettings = (key) => setSettingsToggled((cur) => {
+    const next = new Set(cur);
+    if (next.has(key)) next.delete(key);
+    else next.add(key);
+    return next;
+  });
+  const patchFieldSettings = (key, p) => setDraft((d) => ({ ...d, fieldSettings: { ...d.fieldSettings, [key]: { ...d.fieldSettings?.[key], ...p } } }));
   const extraFields = (item?.fields ?? []).filter((f) => !declaredKeys.has(f.key) && !draft.removed.includes(f.id) && !isAuthenticatorStorage(f.key));
   const metaValue = (key) => draft.values[key] ?? item?.custom.find((c) => c.key === key)?.value ?? "";
   const extraCustom = draft.custom.filter((c) => !declaredKeys.has(c.key) && c.key !== MFA_METHOD_KEY && !isAuthenticatorStorage(c.key));
@@ -6265,24 +6309,29 @@ function ItemPane(props) {
           const secretKind = f.storage === "encrypted" && f.kind === "secret";
           const value = f.storage === "metadata" ? metaValue(f.key) : draft.values[f.key] ?? "";
           const hidden = existing && existing.handling !== "visible" && !(f.key in loaded);
-          return /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
-            EditRow,
-            {
-              label: f.label,
-              value,
-              placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
-              secret: secretKind,
-              multiline: f.kind === "multiline",
-              inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
-              onChange: (v) => setValue(f.key, v),
-              actions: /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_jsx_runtime27.Fragment, { children: [
-                hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
-                secretKind ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
-                existing ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_icons11.SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null
-              ] })
-            },
-            f.key
-          );
+          const newSecret = mode === "new" && f.storage === "encrypted" && owner !== "person";
+          const open = newSecret && settingsOpen(f);
+          return /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_react28.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
+              EditRow,
+              {
+                label: f.label,
+                value,
+                placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
+                secret: secretKind,
+                multiline: f.kind === "multiline" || value.includes("\n"),
+                inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
+                onChange: (v) => setValue(f.key, v),
+                actions: /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_jsx_runtime27.Fragment, { children: [
+                  hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
+                  secretKind ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
+                  existing ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_icons11.SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null,
+                  newSecret ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(SlidersGlyph, {}), "aria-label": `${f.label} settings`, pressed: open, onClick: () => toggleSettings(f.key) }) : null
+                ] })
+              }
+            ),
+            open ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(FieldSettingsRows, { name: f.label, value: draft.fieldSettings?.[f.key] ?? {}, defaultHandling: f.handling, onChange: (p) => patchFieldSettings(f.key, p) }) : null
+          ] }, f.key);
         }),
         extraFields.map((f) => /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
           EditRow,
@@ -6291,7 +6340,7 @@ function ItemPane(props) {
             value: draft.values[f.key] ?? "",
             placeholder: f.handling === "visible" || f.key in loaded ? "" : "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
             secret: f.handling !== "visible" && !isRecoveryCodesField(f),
-            multiline: isRecoveryCodesField(f),
+            multiline: f.kind === "multiline" || isRecoveryCodesField(f) || (draft.values[f.key] ?? "").includes("\n"),
             onChange: (v) => setValue(f.key, v),
             onRemove: () => patch({ removed: [...draft.removed, f.id] }),
             removeLabel: `Delete ${f.label}`,
@@ -6360,6 +6409,7 @@ function ItemPane(props) {
             /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(PlusGlyph, {}), children: "Add" }) }),
             /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_design_system17.DropdownMenuContent, { align: "end", children: [
               /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ secrets: [...draft.secrets, { key: "", label: "", value: "" }] }), children: "Secret field" }),
+              !hasSecureNote ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ secrets: [...draft.secrets, secureNoteDraft()] }), children: "Secure note" }) : null,
               /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ custom: [...draft.custom, { key: `custom_${draft.custom.length + 1}_${Date.now() % 1e5}`, label: "", value: "" }] }), children: "Text field" }),
               !tagsVisible ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => setShowTags(true), children: "Tags" }) : null,
               !descriptionVisible ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => setShowDescription(true), children: "Description" }) : null,
@@ -9128,6 +9178,28 @@ function trashItem(r, ctx) {
     createdAt: ""
   };
 }
+async function withTypes(items, door, ctx) {
+  if (!door.schema || items.length === 0) return items;
+  const keys = /* @__PURE__ */ new Map();
+  const CHUNK = 100;
+  try {
+    for (let i = 0; i < items.length; i += CHUNK) {
+      const ids = items.slice(i, i + CHUNK).map((x) => x.id);
+      const { data, error } = await door.schema("users").from("credential_items").select("id,definition_key").in("id", ids);
+      if (error) throw new Error(error.message || "credential_items read failed");
+      for (const r of Array.isArray(data) ? data : []) {
+        if (typeof r.id === "string" && typeof r.definition_key === "string" && r.definition_key) keys.set(r.id, r.definition_key);
+      }
+    }
+  } catch (e) {
+    console.warn("[vault] Trash item types could not be read; rows say Credential", e);
+    return items;
+  }
+  return items.map((it) => {
+    const key = keys.get(it.id);
+    return key ? { ...it, definitionKey: key, definitionLabel: ctx.definition(key)?.label ?? humanize(key) } : it;
+  });
+}
 var previewOf = async (door, id) => parseRecoveryPreview(await call(door, "vault_recovery_preview", { p_id: id }));
 function createListsPort(ctx, door) {
   return {
@@ -9160,7 +9232,8 @@ function createListsPort(ctx, door) {
             if (rows.length < PAGE2) break;
           }
           const items = all.map((r) => trashItem(r, ctx)).filter((i) => i !== null);
-          return [...new Map(items.map((i) => [i.id, i])).values()];
+          const unique = [...new Map(items.map((i) => [i.id, i])).values()];
+          return withTypes(unique, door, ctx);
         }
       },
       favorites: {
@@ -9183,16 +9256,25 @@ function createListsPort(ctx, door) {
 var account6 = __toESM(require("@ai-matrx/api/account"), 1);
 
 // src/secret-field-in.ts
-function secretFieldIn(s) {
+function settingsIn(s) {
   const envKey = s.envKey?.trim() || null;
   return {
-    field_key: fieldKeyOf(s.label),
-    value: s.value,
-    handling: s.handling ?? "revealable",
     ...envKey ? { env_key: envKey } : {},
     ...envKey && s.injectIntoSandbox ? { inject_into_sandbox: true } : {}
   };
 }
+function secretFieldIn(s) {
+  return {
+    field_key: s.key.trim() || fieldKeyOf(s.label),
+    value: s.value,
+    handling: s.handling ?? "revealable",
+    ...s.description ? { description: s.description } : {},
+    ...settingsIn(s)
+  };
+}
+function declaredFieldIn(f, value, settings) {
+  return { field_key: f.key, value, handling: settings?.handling ?? f.handling, ...settingsIn(settings ?? {}) };
+}
 
 // src/sharing/api.ts
 function grantOf(w) {
@@ -9293,7 +9375,7 @@ function createSharingPort(ctx, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn)
           ]
         }
@@ -9422,7 +9504,7 @@ async function readNativeImportLimits(api, organizationId) {
 var recoveryOf = (w) => w.lifecycle?.vault_recovery;
 var isDeleted = (w) => recoveryOf(w)?.state === "deleted";
 var MATCH_MODES2 = ["host", "domain", "exact", "never"];
-var FIELD_WORDS = { totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
+var FIELD_WORDS = { secure_notes: "Secure note", totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
 var handlingOf = (v) => v === "visible" || v === "sealed" ? v : "revealable";
 function fieldOf(w, def) {
   const declared = def?.fields.find((f) => f.key === w.field_key);
@@ -9431,7 +9513,8 @@ function fieldOf(w, def) {
     id: w.id,
     key: w.field_key,
     label: declared?.label ?? FIELD_WORDS[w.field_key] ?? humanize(w.field_key),
-    kind: declared?.kind ?? (handling === "visible" ? "text" : "secret"),
+    // A field no type declares still edits as several lines when its key says so (an old "Secure note").
+    kind: declared?.kind ?? (isMultilineKey(w.field_key) ? "multiline" : handling === "visible" ? "text" : "secret"),
     handling,
     editable: w.editable ?? true,
     envKey: w.env_key ?? null,
@@ -9586,7 +9669,7 @@ function createApiVaultPort(api, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn),
             // Backup codes on a type that does not declare them (a website login): their own encrypted field.
             ...!declared.some((f) => f.key === RECOVERY_CODES_KEY) && (draft.values[RECOVERY_CODES_KEY] ?? "").trim() !== "" ? [{ field_key: RECOVERY_CODES_KEY, value: parseRecoveryCodes(draft.values[RECOVERY_CODES_KEY] ?? "").join("\n"), handling: "revealable", description: "One-time account recovery codes" }] : []