@ai-matrx/vault 0.1.19 → 0.1.20

package/dist/index.js

@@ -671,7 +671,7 @@ var DAY_FORMAT = { year: "numeric", month: "short", day: "numeric" };
 import { Fragment as Fragment2, jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
 var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function SecretText({ value, multiline }) {
-  if (multiline || value.length > 200) return /* @__PURE__ */ jsx5("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
+  if (multiline || value.length > 200 || value.includes("\n")) return /* @__PURE__ */ jsx5("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
   return /* @__PURE__ */ jsx5("span", { className: "break-all font-mono text-sm tracking-wide", children: [...value].map((ch, i) => /* @__PURE__ */ jsx5("span", { className: /[0-9]/.test(ch) ? "text-primary" : /[^A-Za-z0-9]/.test(ch) ? "text-warning" : void 0, children: ch }, i)) });
 }
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
@@ -807,18 +807,19 @@ function EditRow({ label, hint: hint2, value, onChange, placeholder, secret = fa
     }
   );
 }
-function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue }) {
+function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue, multiline = false }) {
   const [shown, setShown] = useState5(false);
   return /* @__PURE__ */ jsx5(
     VaultRow,
     {
       label: /* @__PURE__ */ jsx5(Field2, { className: "w-full", value: label, onChange: (e) => onLabel(e.target.value), placeholder: "Name", "aria-label": "Field name" }),
+      top: multiline,
       actions: /* @__PURE__ */ jsxs5(Fragment2, { children: [
-        secret && value ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: shown ? /* @__PURE__ */ jsx5(EyeOffGlyph, {}) : /* @__PURE__ */ jsx5(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
+        secret && value && !multiline ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: shown ? /* @__PURE__ */ jsx5(EyeOffGlyph, {}) : /* @__PURE__ */ jsx5(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
         extra,
         /* @__PURE__ */ jsx5(Button2, { variant: "quiet", removes: true, icon: /* @__PURE__ */ jsx5(XGlyph, {}), "aria-label": "Remove field", onClick: onRemove })
       ] }),
-      children: /* @__PURE__ */ jsx5(
+      children: multiline ? /* @__PURE__ */ jsx5(Textarea, { className: "w-full", value, onChange: (e) => onValue(e.target.value), rows: 4, placeholder: secret ? "Encrypted, hidden until shown" : "Value", autoComplete: "off", spellCheck: !secret, "aria-label": label ? `${label} value` : "Field value" }) : /* @__PURE__ */ jsx5(
         Field2,
         {
           className: "w-full",
@@ -937,6 +938,7 @@ function sortItems(items, sort, recents) {
   if (sort === "updated") return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return out.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+var SECURE_NOTE_KEY = "secure_notes";
 function draftOf(item) {
   return {
     name: item?.name ?? "",
@@ -987,7 +989,9 @@ function rebaseDraft(oldBase, newBase, draft) {
     secrets: draft.secrets,
     custom,
     removed: draft.removed,
-    authenticator: draft.authenticator
+    authenticator: draft.authenticator,
+    ...draft.browser ? { browser: draft.browser } : {},
+    ...draft.fieldSettings ? { fieldSettings: draft.fieldSettings } : {}
   };
 }
 function panesShown(mode, specialView, showingDetail) {
@@ -1015,7 +1019,8 @@ var FAMILY_LABELS = {
   signing_files: "Signing & files"
 };
 var COMMON_DEFINITION_KEYS = ["website_login", "username_password", "api_key", "env_value", "database_login", "custom"];
-var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes)/;
+var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes|(^|_)notes?($|_))/;
+var isMultilineKey = (key) => MULTILINE.test(key);
 var SECRET = /(password|secret|token|api_key|private|passphrase|credential|seed|key$|_key)/;
 var URLISH = /(url|uri|endpoint|webhook|hook)/;
 function humanize(key) {
@@ -2229,7 +2234,7 @@ function normalizeWebsite(raw) {
     return null;
   }
 }
-function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onDone }) {
+function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
   const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = useState12("");
@@ -2282,6 +2287,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       setInput("");
       setImage(null);
       setSaved(next);
+      onAdded?.(next);
       onChanged();
     } catch (e) {
       setError(wasCancelled(e) ? "Not confirmed, so nothing was added." : otpActionError(e, "add it"));
@@ -2390,7 +2396,23 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
+function withAdded(items, added) {
+  if (added.size === 0) return items;
+  const seen = /* @__PURE__ */ new Set();
+  const out = items.map((i) => {
+    seen.add(i.id);
+    const mine = added.get(i.id);
+    return mine && !i.authenticator ? { ...i, authenticator: mine.authenticator, name: mine.name } : i;
+  });
+  for (const [id, a] of added) if (!seen.has(id)) out.push(a);
+  return out;
+}
+function AuthenticatorView({ port, host, items: listed, definitions, query, onOpen, onChanged, header }) {
+  const [added, setAdded] = useState13(/* @__PURE__ */ new Map());
+  const items = withAdded(listed, added);
+  useEffect11(() => {
+    if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
+  }, [listed, added]);
   const [entries, setEntries] = useState13(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = useState13(/* @__PURE__ */ new Set());
   const [adding, setAdding] = useState13(false);
@@ -2406,7 +2428,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
     return () => {
       live = false;
     };
-  }, [port, items]);
+  }, [port, listed, added]);
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -2452,6 +2474,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
         definitions,
         onClose: () => setAdding(false),
         onChanged,
+        onAdded: (item) => setAdded((cur) => new Map(cur).set(item.id, item)),
         onDone: (id) => {
           setAdding(false);
           onOpen(id);
@@ -4797,7 +4820,7 @@ import { Button as Button23, SearchField } from "@ai-matrx/design-system/control
 import { CopyIcon as CopyIcon7 } from "@ai-matrx/design-system/icons";
 
 // src/ItemPane.tsx
-import { useEffect as useEffect16, useMemo as useMemo3, useRef as useRef14, useState as useState27 } from "react";
+import { Fragment as Fragment17, useEffect as useEffect16, useMemo as useMemo3, useRef as useRef14, useState as useState27 } from "react";
 import { DropdownMenu as DropdownMenu3, DropdownMenuContent as DropdownMenuContent3, DropdownMenuItem as DropdownMenuItem3, DropdownMenuSeparator as DropdownMenuSeparator3, DropdownMenuTrigger as DropdownMenuTrigger3 } from "@ai-matrx/design-system";
 import { cn as cn12 } from "@ai-matrx/design-system";
 import { Badge as Badge7, Button as Button22, CONTROLS_CONTAINER_CLASS, OptionCombobox, Switch as Switch6 } from "@ai-matrx/design-system/controls";
@@ -5179,14 +5202,12 @@ import { confirm as confirm7 } from "@ai-matrx/kit/confirm-opener";
 import { Fragment as Fragment15, jsx as jsx22, jsxs as jsxs21 } from "react/jsx-runtime";
 var HANDLINGS = ["visible", "revealable", "sealed"];
 var hint = (text, tone = "muted") => /* @__PURE__ */ jsx22("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
-var hasSecretSettings = (s) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== "revealable");
-function SecretBuilderRow({ field, onChange, onRemove }) {
-  const [open, setOpen] = useState22(hasSecretSettings(field));
-  const env = field.envKey ?? "";
+var saysMore = (s, defaultHandling) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== defaultHandling);
+function FieldSettingsRows({ name, value, defaultHandling = "revealable", onChange }) {
+  const env = value.envKey ?? "";
   const envProblem = envKeyProblem(env);
   const envOk = env.trim() !== "" && !envProblem;
-  const handling = field.handling ?? "revealable";
-  const name = field.label.trim() || "Secret";
+  const handling = value.handling ?? defaultHandling;
   const chooseHandling = async (next) => {
     if (next === handling) return;
     if (next === "sealed") {
@@ -5200,6 +5221,38 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
     }
     onChange({ handling: next });
   };
+  return /* @__PURE__ */ jsxs21(Fragment15, { children: [
+    /* @__PURE__ */ jsx22(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ jsx22(
+      Field8,
+      {
+        className: "w-full font-mono",
+        "aria-label": `${name} env key`,
+        "aria-invalid": Boolean(envProblem),
+        placeholder: "e.g. GITHUB_TOKEN",
+        autoComplete: "off",
+        spellCheck: false,
+        value: env,
+        onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
+      }
+    ) }),
+    /* @__PURE__ */ jsx22(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ jsx22(
+      SegmentedControl5,
+      {
+        "aria-label": `Who can see ${name}`,
+        value: handling,
+        onValueChange: (v) => void chooseHandling(v),
+        data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
+      }
+    ) }),
+    /* @__PURE__ */ jsx22(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ jsx22(Switch5, { "aria-label": `Use ${name} in sandbox`, checked: envOk && value.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
+  ] });
+}
+var hasSecretSettings = (s) => saysMore(s, "revealable");
+var hasDeclaredSettings = (s, defaultHandling) => Boolean(s && saysMore(s, defaultHandling));
+function SecretBuilderRow({ field, onChange, onRemove }) {
+  const [open, setOpen] = useState22(hasSecretSettings(field));
+  const handling = field.handling ?? "revealable";
+  const name = field.label.trim() || "Secret";
   return /* @__PURE__ */ jsxs21(Fragment15, { children: [
     /* @__PURE__ */ jsx22(
       CustomEditRow,
@@ -5207,47 +5260,26 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
         label: field.label,
         value: field.value,
         secret: true,
+        multiline: field.multiline === true,
         onLabel: (v) => onChange({ label: v }),
         onValue: (v) => onChange({ value: v }),
         onRemove,
-        onPasteValue: (text) => {
-          const a = parseEnvAssignment(text);
-          if (!a) return false;
-          onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
-          setOpen(true);
-          return true;
+        ...field.multiline ? {} : {
+          onPasteValue: (text) => {
+            const a = parseEnvAssignment(text);
+            if (!a) return false;
+            onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
+            setOpen(true);
+            return true;
+          }
         },
         extra: /* @__PURE__ */ jsxs21(Fragment15, { children: [
-          handling !== "sealed" ? /* @__PURE__ */ jsx22(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
+          handling !== "sealed" && !field.multiline ? /* @__PURE__ */ jsx22(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
           /* @__PURE__ */ jsx22(Button18, { variant: "quiet", icon: /* @__PURE__ */ jsx22(SlidersGlyph, {}), "aria-label": `${name} settings`, pressed: open, onClick: () => setOpen((o) => !o) })
         ] })
       }
     ),
-    open ? /* @__PURE__ */ jsxs21(Fragment15, { children: [
-      /* @__PURE__ */ jsx22(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ jsx22(
-        Field8,
-        {
-          className: "w-full font-mono",
-          "aria-label": `${name} env key`,
-          "aria-invalid": Boolean(envProblem),
-          placeholder: "e.g. GITHUB_TOKEN",
-          autoComplete: "off",
-          spellCheck: false,
-          value: env,
-          onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
-        }
-      ) }),
-      /* @__PURE__ */ jsx22(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ jsx22(
-        SegmentedControl5,
-        {
-          "aria-label": `Who can see ${name}`,
-          value: handling,
-          onValueChange: (v) => void chooseHandling(v),
-          data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
-        }
-      ) }),
-      /* @__PURE__ */ jsx22(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ jsx22(Switch5, { "aria-label": `Use ${name} in sandbox`, checked: envOk && field.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
-    ] }) : null
+    open ? /* @__PURE__ */ jsx22(FieldSettingsRows, { name, value: field, onChange }) : null
   ] });
 }
 function withMfaMethod(custom, v) {
@@ -5876,7 +5908,9 @@ function SharingSummary({ item, port, className }) {
 
 // src/ItemPane.tsx
 import { formatAbsoluteDate as formatAbsoluteDate3 } from "@ai-matrx/kit/format";
-import { Fragment as Fragment17, jsx as jsx27, jsxs as jsxs25 } from "react/jsx-runtime";
+import { Fragment as Fragment18, jsx as jsx27, jsxs as jsxs25 } from "react/jsx-runtime";
+var ENV_VALUE_KEY = "env_value";
+var secureNoteDraft = () => ({ key: SECURE_NOTE_KEY, label: "Secure note", value: "", multiline: true, description: "Encrypted notes" });
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
@@ -6067,6 +6101,16 @@ function ItemPane(props) {
   const fieldSettings = (f) => canEdit ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SlidersGlyph, {}), "aria-label": `${f.label} settings`, title: `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }) : null;
   const turnOnOne = canTurnOn ? (f) => () => turnOn([f]) : () => void 0;
   const declaredKeys = new Set(declared.map((f) => f.key));
+  const hasSecureNote = declaredKeys.has(SECURE_NOTE_KEY) || Boolean(item?.fields.some((f) => f.key === SECURE_NOTE_KEY)) || draft.secrets.some((x) => x.key === SECURE_NOTE_KEY);
+  const [settingsToggled, setSettingsToggled] = useState27(/* @__PURE__ */ new Set());
+  const settingsOpen = (f) => settingsToggled.has(f.key) !== (definition?.key === ENV_VALUE_KEY || hasDeclaredSettings(draft.fieldSettings?.[f.key], f.handling));
+  const toggleSettings = (key) => setSettingsToggled((cur) => {
+    const next = new Set(cur);
+    if (next.has(key)) next.delete(key);
+    else next.add(key);
+    return next;
+  });
+  const patchFieldSettings = (key, p) => setDraft((d) => ({ ...d, fieldSettings: { ...d.fieldSettings, [key]: { ...d.fieldSettings?.[key], ...p } } }));
   const extraFields = (item?.fields ?? []).filter((f) => !declaredKeys.has(f.key) && !draft.removed.includes(f.id) && !isAuthenticatorStorage(f.key));
   const metaValue = (key) => draft.values[key] ?? item?.custom.find((c) => c.key === key)?.value ?? "";
   const extraCustom = draft.custom.filter((c) => !declaredKeys.has(c.key) && c.key !== MFA_METHOD_KEY && !isAuthenticatorStorage(c.key));
@@ -6149,7 +6193,7 @@ function ItemPane(props) {
             /* @__PURE__ */ jsx27(SettingsIcon, { className: "size-4" }),
             "Settings"
           ] }) : null,
-          canManage ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+          canManage ? /* @__PURE__ */ jsxs25(Fragment18, { children: [
             /* @__PURE__ */ jsx27(DropdownMenuSeparator3, {}),
             /* @__PURE__ */ jsxs25(DropdownMenuItem3, { className: "text-destructive", disabled: busy, onSelect: () => void remove(), children: [
               /* @__PURE__ */ jsx27(TrashGlyph, { className: "size-4" }),
@@ -6169,7 +6213,7 @@ function ItemPane(props) {
       /* @__PURE__ */ jsx27("span", { className: "min-w-0 flex-1 truncate text-warning", children: offFields.length === 0 ? "This item is turned off" : offFields.length === 1 ? "1 field is turned off" : `${offFields.length} fields are turned off` }),
       canTurnOn ? /* @__PURE__ */ jsx27(TurnOnButton, { label: "all fields", onTurnOn: () => turnOn(offFields) }) : null
     ] }) : null,
-    /* @__PURE__ */ jsx27("div", { className: "min-h-0 flex-1 overflow-y-auto", children: sent ? /* @__PURE__ */ jsx27(AssignResult, { sent, onAnother: createAnother, onDone: onCancelNew }) : /* @__PURE__ */ jsx27("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", children: editing ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+    /* @__PURE__ */ jsx27("div", { className: "min-h-0 flex-1 overflow-y-auto", children: sent ? /* @__PURE__ */ jsx27(AssignResult, { sent, onAnother: createAnother, onDone: onCancelNew }) : /* @__PURE__ */ jsx27("div", { className: "mx-auto flex w-full max-w-3xl flex-col gap-5 px-3 py-4 sm:px-6 sm:py-6", children: editing ? /* @__PURE__ */ jsxs25(Fragment18, { children: [
       /* @__PURE__ */ jsxs25(VaultSection, { children: [
         mode === "new" ? /* @__PURE__ */ jsx27(VaultRow, { label: "Save to", children: /* @__PURE__ */ jsx27(
           OptionCombobox,
@@ -6190,7 +6234,7 @@ function ItemPane(props) {
           }
         ) }) : null,
         /* @__PURE__ */ jsx27(EditRow, { label: "Name", value: draft.name, onChange: (v) => patch({ name: v }), placeholder: "Name", autoFocus: mode === "new" }),
-        mode === "new" && owner === "person" ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+        mode === "new" && owner === "person" ? /* @__PURE__ */ jsxs25(Fragment18, { children: [
           /* @__PURE__ */ jsx27(EditRow, { label: "Their email", value: recipient, placeholder: "name@company.com", inputMode: "email", onChange: setRecipient }),
           declared.some((f) => f.storage === "encrypted" && f.kind === "secret") ? /* @__PURE__ */ jsx27(VaultRow, { label: "Password", hint: "You never see it", children: /* @__PURE__ */ jsx27(Switch6, { checked: generatePrivately, onCheckedChange: setGeneratePrivately, "aria-label": "Generate the password privately" }) }) : null
         ] }) : null,
@@ -6199,24 +6243,29 @@ function ItemPane(props) {
           const secretKind = f.storage === "encrypted" && f.kind === "secret";
           const value = f.storage === "metadata" ? metaValue(f.key) : draft.values[f.key] ?? "";
           const hidden = existing && existing.handling !== "visible" && !(f.key in loaded);
-          return /* @__PURE__ */ jsx27(
-            EditRow,
-            {
-              label: f.label,
-              value,
-              placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
-              secret: secretKind,
-              multiline: f.kind === "multiline",
-              inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
-              onChange: (v) => setValue(f.key, v),
-              actions: /* @__PURE__ */ jsxs25(Fragment17, { children: [
-                hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
-                secretKind ? /* @__PURE__ */ jsx27(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
-                existing ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null
-              ] })
-            },
-            f.key
-          );
+          const newSecret = mode === "new" && f.storage === "encrypted" && owner !== "person";
+          const open = newSecret && settingsOpen(f);
+          return /* @__PURE__ */ jsxs25(Fragment17, { children: [
+            /* @__PURE__ */ jsx27(
+              EditRow,
+              {
+                label: f.label,
+                value,
+                placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
+                secret: secretKind,
+                multiline: f.kind === "multiline" || value.includes("\n"),
+                inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
+                onChange: (v) => setValue(f.key, v),
+                actions: /* @__PURE__ */ jsxs25(Fragment18, { children: [
+                  hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
+                  secretKind ? /* @__PURE__ */ jsx27(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
+                  existing ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null,
+                  newSecret ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SlidersGlyph, {}), "aria-label": `${f.label} settings`, pressed: open, onClick: () => toggleSettings(f.key) }) : null
+                ] })
+              }
+            ),
+            open ? /* @__PURE__ */ jsx27(FieldSettingsRows, { name: f.label, value: draft.fieldSettings?.[f.key] ?? {}, defaultHandling: f.handling, onChange: (p) => patchFieldSettings(f.key, p) }) : null
+          ] }, f.key);
         }),
         extraFields.map((f) => /* @__PURE__ */ jsx27(
           EditRow,
@@ -6225,11 +6274,11 @@ function ItemPane(props) {
             value: draft.values[f.key] ?? "",
             placeholder: f.handling === "visible" || f.key in loaded ? "" : "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
             secret: f.handling !== "visible" && !isRecoveryCodesField(f),
-            multiline: isRecoveryCodesField(f),
+            multiline: f.kind === "multiline" || isRecoveryCodesField(f) || (draft.values[f.key] ?? "").includes("\n"),
             onChange: (v) => setValue(f.key, v),
             onRemove: () => patch({ removed: [...draft.removed, f.id] }),
             removeLabel: `Delete ${f.label}`,
-            actions: /* @__PURE__ */ jsxs25(Fragment17, { children: [
+            actions: /* @__PURE__ */ jsxs25(Fragment18, { children: [
               f.handling === "revealable" && !(f.key in loaded) && item?.capabilities.canReveal ? /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
               /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) })
             ] })
@@ -6294,6 +6343,7 @@ function ItemPane(props) {
             /* @__PURE__ */ jsx27(DropdownMenuTrigger3, { asChild: true, children: /* @__PURE__ */ jsx27(Button22, { variant: "quiet", icon: /* @__PURE__ */ jsx27(PlusGlyph, {}), children: "Add" }) }),
             /* @__PURE__ */ jsxs25(DropdownMenuContent3, { align: "end", children: [
               /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => patch({ secrets: [...draft.secrets, { key: "", label: "", value: "" }] }), children: "Secret field" }),
+              !hasSecureNote ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => patch({ secrets: [...draft.secrets, secureNoteDraft()] }), children: "Secure note" }) : null,
               /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => patch({ custom: [...draft.custom, { key: `custom_${draft.custom.length + 1}_${Date.now() % 1e5}`, label: "", value: "" }] }), children: "Text field" }),
               !tagsVisible ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => setShowTags(true), children: "Tags" }) : null,
               !descriptionVisible ? /* @__PURE__ */ jsx27(DropdownMenuItem3, { onSelect: () => setShowDescription(true), children: "Description" }) : null,
@@ -6326,7 +6376,7 @@ function ItemPane(props) {
         }
       ),
       filesProps ? /* @__PURE__ */ jsx27(FilesSection, { ...filesProps, editing: true }) : mode === "new" && owner !== "person" ? /* @__PURE__ */ jsx27(DraftFilesSection, { files: queuedFiles, onFiles: setQueuedFiles }) : null
-    ] }) : item ? /* @__PURE__ */ jsxs25(Fragment17, { children: [
+    ] }) : item ? /* @__PURE__ */ jsxs25(Fragment18, { children: [
       /* @__PURE__ */ jsxs25(VaultSection, { children: [
         declared.map((f) => {
           if (f.storage === "metadata") {
@@ -6647,7 +6697,7 @@ function refusalText(reason) {
 // src/lists/RestorePanel.tsx
 import { useEffect as useEffect18, useState as useState29 } from "react";
 import { Button as Button24 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment18, jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
+import { Fragment as Fragment19, jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 function RestorePanel({ lists, item, restore, onClose }) {
   const [preview, setPreview] = useState29(null);
@@ -6692,7 +6742,7 @@ function RestorePanel({ lists, item, restore, onClose }) {
       title: `Restore "${item.name}"`,
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ jsxs27(Fragment18, { children: [
+      footer: /* @__PURE__ */ jsxs27(Fragment19, { children: [
         /* @__PURE__ */ jsx29(Button24, { variant: "quiet", onClick: onClose, children: refused ? "Close" : "Cancel" }),
         refused ? null : /* @__PURE__ */ jsx29(Button24, { variant: "primary", icon: /* @__PURE__ */ jsx29(RestoreGlyph, {}), disabled: busy || loading || lists.preview !== void 0 && preview === null, onClick: () => void run(), children: busy ? "Restoring\u2026" : "Restore" })
       ] }),
@@ -7190,7 +7240,7 @@ function addPasskeyFailure(message2) {
 var isRevoked = (d) => d.revokedAt !== null;
 
 // src/devices/DevicesPanel.tsx
-import { Fragment as Fragment19, jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
+import { Fragment as Fragment20, jsx as jsx33, jsxs as jsxs31 } from "react/jsx-runtime";
 var messageOf3 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function ErrorLine2({ text }) {
   return text ? /* @__PURE__ */ jsx33("p", { role: "alert", className: "px-1 text-sm text-destructive", children: text }) : null;
@@ -7321,7 +7371,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
   };
   const canApprove = Boolean(key && passkeys && here && methods?.passkey && !approvedUntil);
   const title = isMac ? "Approve this Mac" : name ? `Approve ${name}` : "Approve this browser";
-  const footer = approvedUntil ? /* @__PURE__ */ jsx33(Button28, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs31(Fragment19, { children: [
+  const footer = approvedUntil ? /* @__PURE__ */ jsx33(Button28, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs31(Fragment20, { children: [
     /* @__PURE__ */ jsx33(Button28, { variant: "quiet", disabled: busy !== null, onClick: refuse, children: key ? "Refuse" : "Close" }),
     canApprove ? /* @__PURE__ */ jsx33(Button28, { variant: "primary", icon: /* @__PURE__ */ jsx33(FingerprintGlyph, {}), disabled: busy !== null, onClick: () => void approve(), children: busy === "approve" ? "Approving\u2026" : "Approve with passkey" }) : null
   ] });
@@ -7329,7 +7379,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
     "This link names no key. Start again from ",
     where,
     "."
-  ] }) }) : /* @__PURE__ */ jsxs31(Fragment19, { children: [
+  ] }) }) : /* @__PURE__ */ jsxs31(Fragment20, { children: [
     /* @__PURE__ */ jsxs31(VaultSection, { title: "What is asking", children: [
       /* @__PURE__ */ jsx33(VaultRow, { label: "Asking", hint: "Approve only if you just asked", children: asker }),
       name ? /* @__PURE__ */ jsx33(VaultRow, { label: "Name", children: /* @__PURE__ */ jsx33("span", { className: "block truncate", children: name }) }) : null,
@@ -7629,7 +7679,7 @@ function useNativeImport(bridge, stillAllowed, onImported) {
 }
 
 // src/native/NativeImportPanel.tsx
-import { Fragment as Fragment20, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
+import { Fragment as Fragment21, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
 var TONE = {
   eligible: "success",
   committed: "success",
@@ -7673,16 +7723,16 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
     const yes = await confirm13({ title: `Add ${plural2(ready, "passkey")} to ${orgName}?`, description: "Passkeys already there are skipped.", confirmLabel: "Import" });
     if (yes) await flow.confirm();
   };
-  const footer = preview ? /* @__PURE__ */ jsxs32(Fragment20, { children: [
+  const footer = preview ? /* @__PURE__ */ jsxs32(Fragment21, { children: [
     /* @__PURE__ */ jsx34(Button29, { variant: "quiet", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel" }),
     /* @__PURE__ */ jsxs32(Button29, { variant: "primary", icon: /* @__PURE__ */ jsx34(ImportGlyph, { className: "size-4" }), disabled: busy || ready === 0, onClick: () => void importNow(), children: [
       "Import ",
       ready
     ] })
-  ] }) : status ? active ? /* @__PURE__ */ jsxs32(Fragment20, { children: [
+  ] }) : status ? active ? /* @__PURE__ */ jsxs32(Fragment21, { children: [
     /* @__PURE__ */ jsx34(Button29, { variant: "outline", disabled: busy, onClick: () => void flow.refresh(), children: "Refresh" }),
     /* @__PURE__ */ jsx34(Button29, { variant: "outline", disabled: busy, onClick: () => void flow.cancel(), children: "Cancel import" })
-  ] }) : /* @__PURE__ */ jsxs32(Fragment20, { children: [
+  ] }) : /* @__PURE__ */ jsxs32(Fragment21, { children: [
     /* @__PURE__ */ jsx34(Button29, { variant: "quiet", onClick: flow.reset, children: "New file" }),
     /* @__PURE__ */ jsx34(Button29, { variant: "primary", onClick: onClose, children: "Done" })
   ] }) : /* @__PURE__ */ jsx34(Button29, { variant: "quiet", onClick: onClose, children: "Close" });
@@ -7721,7 +7771,7 @@ import { GlobeIcon as GlobeIcon4 } from "@ai-matrx/design-system/icons";
 // src/extension/CaptureCard.tsx
 import { useState as useState36, useSyncExternalStore as useSyncExternalStore3 } from "react";
 import { Button as Button30, SearchField as SearchField3 } from "@ai-matrx/design-system/controls";
-import { Fragment as Fragment21, jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
+import { Fragment as Fragment22, jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
   const prompt = useSyncExternalStore3(capture.subscribe, capture.get, capture.get);
@@ -7754,7 +7804,7 @@ function CaptureCard({ capture, onChanged }) {
       ] }),
       /* @__PURE__ */ jsx35(Button30, { variant: "quiet", icon: /* @__PURE__ */ jsx35(XGlyph, {}), "aria-label": "Not now", disabled: busy, onClick: () => void decide({ action: "dismiss" }) })
     ] }),
-    prompt.unavailable ? /* @__PURE__ */ jsx35("p", { className: "text-xs text-muted-foreground", children: "Save it by hand with Save a login." }) : /* @__PURE__ */ jsxs33(Fragment21, { children: [
+    prompt.unavailable ? /* @__PURE__ */ jsx35("p", { className: "text-xs text-muted-foreground", children: "Save it by hand with Save a login." }) : /* @__PURE__ */ jsxs33(Fragment22, { children: [
       existing.length > 0 ? /* @__PURE__ */ jsxs33("div", { className: "flex flex-col gap-1", children: [
         existing.length >= SEARCH_FROM ? /* @__PURE__ */ jsx35(SearchField3, { value: q, onChange: (e) => setQ(e.target.value), placeholder: "Search logins", "aria-label": "Search logins to update" }) : null,
         /* @__PURE__ */ jsxs33("ul", { className: "flex max-h-36 flex-col gap-px overflow-y-auto", children: [
@@ -7860,7 +7910,7 @@ import { useState as useState38 } from "react";
 import { Popover as Popover2, PopoverContent as PopoverContent2, PopoverTrigger as PopoverTrigger2 } from "@ai-matrx/design-system";
 import { Button as Button32 } from "@ai-matrx/design-system/controls";
 import { CopyIcon as CopyIcon8 } from "@ai-matrx/design-system/icons";
-import { Fragment as Fragment22, jsx as jsx37, jsxs as jsxs35 } from "react/jsx-runtime";
+import { Fragment as Fragment23, jsx as jsx37, jsxs as jsxs35 } from "react/jsx-runtime";
 var HOLD_MS = 6e4;
 function PageGenerator({ fields }) {
   const limits = useGeneratorLimitsSource();
@@ -7911,12 +7961,12 @@ function PageGenerator({ fields }) {
     }
   };
   const value = held.value;
-  return /* @__PURE__ */ jsxs35(Fragment22, { children: [
+  return /* @__PURE__ */ jsxs35(Fragment23, { children: [
     /* @__PURE__ */ jsx37(
       VaultRow,
       {
         label: "New password",
-        actions: /* @__PURE__ */ jsxs35(Fragment22, { children: [
+        actions: /* @__PURE__ */ jsxs35(Fragment23, { children: [
           value ? /* @__PURE__ */ jsx37(Button32, { variant: "quiet", icon: /* @__PURE__ */ jsx37(CopyIcon8, {}), "aria-label": "Copy password", onClick: () => void copy(value, "Password") }) : null,
           /* @__PURE__ */ jsxs35(Popover2, { open, onOpenChange: setOpen, children: [
             /* @__PURE__ */ jsx37(PopoverTrigger2, { asChild: true, children: /* @__PURE__ */ jsx37(Button32, { variant: "outline", icon: /* @__PURE__ */ jsx37(KeyGlyph, {}), disabled: busy, children: "Generate" }) }),
@@ -9062,6 +9112,28 @@ function trashItem(r, ctx) {
     createdAt: ""
   };
 }
+async function withTypes(items, door, ctx) {
+  if (!door.schema || items.length === 0) return items;
+  const keys = /* @__PURE__ */ new Map();
+  const CHUNK = 100;
+  try {
+    for (let i = 0; i < items.length; i += CHUNK) {
+      const ids = items.slice(i, i + CHUNK).map((x) => x.id);
+      const { data, error } = await door.schema("users").from("credential_items").select("id,definition_key").in("id", ids);
+      if (error) throw new Error(error.message || "credential_items read failed");
+      for (const r of Array.isArray(data) ? data : []) {
+        if (typeof r.id === "string" && typeof r.definition_key === "string" && r.definition_key) keys.set(r.id, r.definition_key);
+      }
+    }
+  } catch (e) {
+    console.warn("[vault] Trash item types could not be read; rows say Credential", e);
+    return items;
+  }
+  return items.map((it) => {
+    const key = keys.get(it.id);
+    return key ? { ...it, definitionKey: key, definitionLabel: ctx.definition(key)?.label ?? humanize(key) } : it;
+  });
+}
 var previewOf = async (door, id) => parseRecoveryPreview(await call(door, "vault_recovery_preview", { p_id: id }));
 function createListsPort(ctx, door) {
   return {
@@ -9094,7 +9166,8 @@ function createListsPort(ctx, door) {
             if (rows.length < PAGE2) break;
           }
           const items = all.map((r) => trashItem(r, ctx)).filter((i) => i !== null);
-          return [...new Map(items.map((i) => [i.id, i])).values()];
+          const unique = [...new Map(items.map((i) => [i.id, i])).values()];
+          return withTypes(unique, door, ctx);
         }
       },
       favorites: {
@@ -9117,16 +9190,25 @@ function createListsPort(ctx, door) {
 import * as account6 from "@ai-matrx/api/account";
 
 // src/secret-field-in.ts
-function secretFieldIn(s) {
+function settingsIn(s) {
   const envKey = s.envKey?.trim() || null;
   return {
-    field_key: fieldKeyOf(s.label),
-    value: s.value,
-    handling: s.handling ?? "revealable",
     ...envKey ? { env_key: envKey } : {},
     ...envKey && s.injectIntoSandbox ? { inject_into_sandbox: true } : {}
   };
 }
+function secretFieldIn(s) {
+  return {
+    field_key: s.key.trim() || fieldKeyOf(s.label),
+    value: s.value,
+    handling: s.handling ?? "revealable",
+    ...s.description ? { description: s.description } : {},
+    ...settingsIn(s)
+  };
+}
+function declaredFieldIn(f, value, settings) {
+  return { field_key: f.key, value, handling: settings?.handling ?? f.handling, ...settingsIn(settings ?? {}) };
+}
 
 // src/sharing/api.ts
 function grantOf(w) {
@@ -9227,7 +9309,7 @@ function createSharingPort(ctx, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn)
           ]
         }
@@ -9356,7 +9438,7 @@ async function readNativeImportLimits(api, organizationId) {
 var recoveryOf = (w) => w.lifecycle?.vault_recovery;
 var isDeleted = (w) => recoveryOf(w)?.state === "deleted";
 var MATCH_MODES2 = ["host", "domain", "exact", "never"];
-var FIELD_WORDS = { totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
+var FIELD_WORDS = { secure_notes: "Secure note", totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
 var handlingOf = (v) => v === "visible" || v === "sealed" ? v : "revealable";
 function fieldOf(w, def) {
   const declared = def?.fields.find((f) => f.key === w.field_key);
@@ -9365,7 +9447,8 @@ function fieldOf(w, def) {
     id: w.id,
     key: w.field_key,
     label: declared?.label ?? FIELD_WORDS[w.field_key] ?? humanize(w.field_key),
-    kind: declared?.kind ?? (handling === "visible" ? "text" : "secret"),
+    // A field no type declares still edits as several lines when its key says so (an old "Secure note").
+    kind: declared?.kind ?? (isMultilineKey(w.field_key) ? "multiline" : handling === "visible" ? "text" : "secret"),
     handling,
     editable: w.editable ?? true,
     envKey: w.env_key ?? null,
@@ -9520,7 +9603,7 @@ function createApiVaultPort(api, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn),
             // Backup codes on a type that does not declare them (a website login): their own encrypted field.
             ...!declared.some((f) => f.key === RECOVERY_CODES_KEY) && (draft.values[RECOVERY_CODES_KEY] ?? "").trim() !== "" ? [{ field_key: RECOVERY_CODES_KEY, value: parseRecoveryCodes(draft.values[RECOVERY_CODES_KEY] ?? "").join("\n"), handling: "revealable", description: "One-time account recovery codes" }] : []