@ai-matrx/vault 0.1.19 → 0.1.21

package/CHANGELOG.md

@@ -1,10 +1,39 @@
 # Changelog
 
-## 0.1.19
+## 0.1.21
 
 UNVERIFIED: this release has no Unreleased entry and the source comparison could not be made (the caller supplied no source comparison). Whether source changed is unknown; consumer action is unknown.
 Check the package's gitHead on npm against this version's gitHead: `git diff <previous gitHead> <this gitHead> -- apps/shared/vault/src`.
 
+## 0.1.20
+
+- **A multi-line secret edits as several lines.** A field whose type says multi-line, any field under a notes key (an old **Secure note**, `secure_notes`) and any value that already holds a line break now edit in a multi-line box — a one-line box dropped the line breaks on save. Shown values keep their lines too. Guard: `src/vault-gaps-2026-10-19.test.tsx`. Consumer action: none.
+- **Secure note is back** in the item form's Add menu: an encrypted multi-line field stored as `secure_notes`, hidden until shown (`secureNoteDraft`, `NewSecretField.multiline`/`key`/`description`). Consumer action: none.
+- **A new item's declared secrets carry env key, who can see it and sandbox use to the create call** (`ItemDraft.fieldSettings`, `declaredFieldIn`, `FieldSettingsRows`): behind each secret's sliders, open from the start on an Environment value. Consumer action: none.
+- **Trash rows say each item's type** ("Website login"), read from the item through the state door's `schema("users")` (`VaultUserStateDoor.schema`, `withTypes`), instead of "Credential". Consumer action: none — every host already passes its supabase client as `userState`.
+- **A code added in the Authenticator shows in its list at once**, before the vault's re-read answers (or when an older re-read answers last) (`AddOtpPanel onAdded`, `withAdded`). Consumer action: none.
+- **The list stays current.** A **Refresh** button beside the sort re-reads the list; the list also re-reads itself when the window or panel comes back into focus, and every `host.refreshSeconds` (else the organization's `vault.list.refresh_seconds` knob) while shown — never while hidden, never over an edit or a new item, never two reads at once. A refresh that fails keeps the loaded list and says "Couldn’t refresh. Showing what was loaded." with Try again; the partial-read line's Try again no longer drops to the "couldn't open" screen. Guard: `src/parity-gaps.test.tsx`. **Consumer action:** desktop: pass `refreshSeconds` from its refresh knob. Web app and extension: none (focus refresh is on by itself).
+- **The row menu copies any field** — API key, token, account number, any plain custom field — besides username, password and code (never a sealed field, the authenticator's key or recovery codes). **Right-click on a row opens that menu** in every host, with a host's extra entries (`host.rowMenuItems`). **Consumer action:** web app: pass `rowContextMenu: "host"` so its own v3 right-click menu (agents, Copy, Export) keeps answering on rows. Extension and desktop: none.
+- **After an import**, one **Set up authenticator for <name>** link per imported login that came with a one-time password; it opens the setup for that login over the result (`ImportRunResult.needOtp`). Consumer action: none.
+- **The authenticator setup screen starts the camera by itself** where this browser can scan (`OtpSetupRow autoStartCamera`, used by `AddOtpPanel`; a setup row inside an edit never does). Consumer action: none.
+- **An opener can name the new item**: `VaultLocation.name` (`?name=`) prefills the new item's name over the one guessed from the address. Consumer action: none.
+
+## 0.1.19
+
+SOURCE CHANGED WITH NO RELEASE NOTE. This release shipped source changes that nobody described in an Unreleased entry,
+so they may include breaking API changes. Consumer action is UNKNOWN: read the diff before upgrading.
+Diff: `git diff ff560b1be4 05488c8d62 -- apps/shared/vault/src`
+
+Changed shipped source files (8):
+- `apps/shared/vault/src/ItemList.tsx`
+- `apps/shared/vault/src/VaultApp.tsx`
+- `apps/shared/vault/src/authenticator/AddOtpPanel.tsx`
+- `apps/shared/vault/src/authenticator/Setup.tsx`
+- `apps/shared/vault/src/io/ImportPanel.tsx`
+- `apps/shared/vault/src/io/import-run.ts`
+- `apps/shared/vault/src/model.ts`
+- `apps/shared/vault/src/port.ts`
+
 ## 0.1.18
 
 - The Authenticator list keeps the code and its countdown ring apart at every width (the code column never squeezes), the list header lines up with the list on wide screens, and the Add authenticator panel's camera button is icon-only so the setup-key box has room on a phone. Consumer action: none.

package/dist/index.cjs

@@ -622,6 +622,8 @@ function ConfirmIdentityDialog({ open, identity, onDone, onCancel }) {
 var import_react5 = require("react");
 var import_controls2 = require("@ai-matrx/design-system/controls");
 var import_design_system5 = require("@ai-matrx/design-system");
+var import_outbound = require("@ai-matrx/kit/outbound");
+var import_outbound_react = require("@ai-matrx/kit/outbound-react");
 var import_icons2 = require("@ai-matrx/design-system/icons");
 
 // src/hooks.ts
@@ -740,7 +742,7 @@ var DAY_FORMAT = { year: "numeric", month: "short", day: "numeric" };
 var import_jsx_runtime5 = require("react/jsx-runtime");
 var MASK = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function SecretText({ value, multiline }) {
-  if (multiline || value.length > 200) return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
+  if (multiline || value.length > 200 || value.includes("\n")) return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "whitespace-pre-wrap break-all font-mono text-sm", children: value });
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: "break-all font-mono text-sm tracking-wide", children: [...value].map((ch, i) => /* @__PURE__ */ (0, import_jsx_runtime5.jsx)("span", { className: /[0-9]/.test(ch) ? "text-primary" : /[^A-Za-z0-9]/.test(ch) ? "text-warning" : void 0, children: ch }, i)) });
 }
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
@@ -833,13 +835,13 @@ function PlainRow({ label, value, hint: hint2, openUrl, extra, multiline = false
       top: multiline,
       actions: /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
         extra,
-        isUrl && openUrl ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(ExternalGlyph, {}), "aria-label": `Open ${value}`, onClick: () => openUrl(value) }) : null,
+        isUrl && openUrl ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(ExternalGlyph, {}), "aria-label": `Open ${value}`, onClick: () => openUrl((0, import_outbound.withReferral)(value)) }) : null,
         /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_icons2.CopyIcon, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue2(value, typeof label === "string" && label ? label : "Value", { secret: false }) })
       ] }),
       children: isUrl && openUrl ? (
         // A real link (right-click, copy link address, open in a new tab); a click goes through the host's opener.
         /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
-          "a",
+          import_outbound_react.OutboundLink,
           {
             href: value,
             target: "_blank",
@@ -847,7 +849,7 @@ function PlainRow({ label, value, hint: hint2, openUrl, extra, multiline = false
             className: "block max-w-full truncate text-primary hover:underline",
             onClick: (e) => {
               e.preventDefault();
-              openUrl(value);
+              openUrl((0, import_outbound.withReferral)(value));
             },
             children: value.replace(/^https?:\/\//i, "").replace(/\/$/, "")
           }
@@ -876,18 +878,19 @@ function EditRow({ label, hint: hint2, value, onChange, placeholder, secret = fa
     }
   );
 }
-function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue }) {
+function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove, extra, onPasteValue, multiline = false }) {
   const [shown, setShown] = (0, import_react5.useState)(false);
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
     VaultRow,
     {
       label: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Field, { className: "w-full", value: label, onChange: (e) => onLabel(e.target.value), placeholder: "Name", "aria-label": "Field name" }),
+      top: multiline,
       actions: /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
-        secret && value ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: shown ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeOffGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
+        secret && value && !multiline ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: shown ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeOffGlyph, {}) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(EyeGlyph, {}), "aria-label": shown ? "Hide" : "Show", onClick: () => setShown((x) => !x) }) : null,
         extra,
         /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", removes: true, icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(XGlyph, {}), "aria-label": "Remove field", onClick: onRemove })
       ] }),
-      children: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
+      children: multiline ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Textarea, { className: "w-full", value, onChange: (e) => onValue(e.target.value), rows: 4, placeholder: secret ? "Encrypted, hidden until shown" : "Value", autoComplete: "off", spellCheck: !secret, "aria-label": label ? `${label} value` : "Field value" }) : /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
         import_controls2.Field,
         {
           className: "w-full",
@@ -1006,6 +1009,7 @@ function sortItems(items, sort, recents) {
   if (sort === "updated") return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
   return out.sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+var SECURE_NOTE_KEY = "secure_notes";
 function draftOf(item) {
   return {
     name: item?.name ?? "",
@@ -1056,7 +1060,9 @@ function rebaseDraft(oldBase, newBase, draft) {
     secrets: draft.secrets,
     custom,
     removed: draft.removed,
-    authenticator: draft.authenticator
+    authenticator: draft.authenticator,
+    ...draft.browser ? { browser: draft.browser } : {},
+    ...draft.fieldSettings ? { fieldSettings: draft.fieldSettings } : {}
   };
 }
 function panesShown(mode, specialView, showingDetail) {
@@ -1084,7 +1090,8 @@ var FAMILY_LABELS = {
   signing_files: "Signing & files"
 };
 var COMMON_DEFINITION_KEYS = ["website_login", "username_password", "api_key", "env_value", "database_login", "custom"];
-var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes)/;
+var MULTILINE = /(json|pem|private_key|certificate|cert|bundle|document|recovery_codes|(^|_)notes?($|_))/;
+var isMultilineKey = (key) => MULTILINE.test(key);
 var SECRET = /(password|secret|token|api_key|private|passphrase|credential|seed|key$|_key)/;
 var URLISH = /(url|uri|endpoint|webhook|hook)/;
 function humanize(key) {
@@ -2298,7 +2305,7 @@ function normalizeWebsite(raw) {
     return null;
   }
 }
-function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onDone }) {
+function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
   const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = (0, import_react12.useState)("");
@@ -2351,6 +2358,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       setInput("");
       setImage(null);
       setSaved(next);
+      onAdded?.(next);
       onChanged();
     } catch (e) {
       setError(wasCancelled(e) ? "Not confirmed, so nothing was added." : otpActionError(e, "add it"));
@@ -2459,7 +2467,23 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
+function withAdded(items, added) {
+  if (added.size === 0) return items;
+  const seen = /* @__PURE__ */ new Set();
+  const out = items.map((i) => {
+    seen.add(i.id);
+    const mine = added.get(i.id);
+    return mine && !i.authenticator ? { ...i, authenticator: mine.authenticator, name: mine.name } : i;
+  });
+  for (const [id, a] of added) if (!seen.has(id)) out.push(a);
+  return out;
+}
+function AuthenticatorView({ port, host, items: listed, definitions, query, onOpen, onChanged, header }) {
+  const [added, setAdded] = (0, import_react13.useState)(/* @__PURE__ */ new Map());
+  const items = withAdded(listed, added);
+  (0, import_react13.useEffect)(() => {
+    if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
+  }, [listed, added]);
   const [entries, setEntries] = (0, import_react13.useState)(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = (0, import_react13.useState)(/* @__PURE__ */ new Set());
   const [adding, setAdding] = (0, import_react13.useState)(false);
@@ -2475,7 +2499,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
     return () => {
       live = false;
     };
-  }, [port, items]);
+  }, [port, listed, added]);
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -2521,6 +2545,7 @@ function AuthenticatorView({ port, host, items, definitions, query, onOpen, onCh
         definitions,
         onClose: () => setAdding(false),
         onChanged,
+        onAdded: (item) => setAdded((cur) => new Map(cur).set(item.id, item)),
         onDone: (id) => {
           setAdding(false);
           onOpen(id);
@@ -5245,14 +5270,12 @@ var import_confirm_opener7 = require("@ai-matrx/kit/confirm-opener");
 var import_jsx_runtime22 = require("react/jsx-runtime");
 var HANDLINGS = ["visible", "revealable", "sealed"];
 var hint = (text, tone = "muted") => /* @__PURE__ */ (0, import_jsx_runtime22.jsx)("span", { className: tone === "destructive" ? "text-destructive" : void 0, title: text, children: text });
-var hasSecretSettings = (s) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== "revealable");
-function SecretBuilderRow({ field, onChange, onRemove }) {
-  const [open, setOpen] = (0, import_react23.useState)(hasSecretSettings(field));
-  const env = field.envKey ?? "";
+var saysMore = (s, defaultHandling) => Boolean(s.envKey?.trim() || s.injectIntoSandbox || s.handling && s.handling !== defaultHandling);
+function FieldSettingsRows({ name, value, defaultHandling = "revealable", onChange }) {
+  const env = value.envKey ?? "";
   const envProblem = envKeyProblem(env);
   const envOk = env.trim() !== "" && !envProblem;
-  const handling = field.handling ?? "revealable";
-  const name = field.label.trim() || "Secret";
+  const handling = value.handling ?? defaultHandling;
   const chooseHandling = async (next) => {
     if (next === handling) return;
     if (next === "sealed") {
@@ -5266,6 +5289,38 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
     }
     onChange({ handling: next });
   };
+  return /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
+      import_controls18.Field,
+      {
+        className: "w-full font-mono",
+        "aria-label": `${name} env key`,
+        "aria-invalid": Boolean(envProblem),
+        placeholder: "e.g. GITHUB_TOKEN",
+        autoComplete: "off",
+        spellCheck: false,
+        value: env,
+        onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
+      }
+    ) }),
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
+      import_controls18.SegmentedControl,
+      {
+        "aria-label": `Who can see ${name}`,
+        value: handling,
+        onValueChange: (v) => void chooseHandling(v),
+        data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
+      }
+    ) }),
+    /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Switch, { "aria-label": `Use ${name} in sandbox`, checked: envOk && value.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
+  ] });
+}
+var hasSecretSettings = (s) => saysMore(s, "revealable");
+var hasDeclaredSettings = (s, defaultHandling) => Boolean(s && saysMore(s, defaultHandling));
+function SecretBuilderRow({ field, onChange, onRemove }) {
+  const [open, setOpen] = (0, import_react23.useState)(hasSecretSettings(field));
+  const handling = field.handling ?? "revealable";
+  const name = field.label.trim() || "Secret";
   return /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
     /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
       CustomEditRow,
@@ -5273,47 +5328,26 @@ function SecretBuilderRow({ field, onChange, onRemove }) {
         label: field.label,
         value: field.value,
         secret: true,
+        multiline: field.multiline === true,
         onLabel: (v) => onChange({ label: v }),
         onValue: (v) => onChange({ value: v }),
         onRemove,
-        onPasteValue: (text) => {
-          const a = parseEnvAssignment(text);
-          if (!a) return false;
-          onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
-          setOpen(true);
-          return true;
+        ...field.multiline ? {} : {
+          onPasteValue: (text) => {
+            const a = parseEnvAssignment(text);
+            if (!a) return false;
+            onChange({ envKey: a.key, value: a.value, ...field.label.trim() ? {} : { label: labelFromEnvKey(a.key) } });
+            setOpen(true);
+            return true;
+          }
         },
         extra: /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
-          handling !== "sealed" ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
+          handling !== "sealed" && !field.multiline ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(GenerateButton, { onUse: (v) => onChange({ value: v }) }) : null,
           /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(SlidersGlyph, {}), "aria-label": `${name} settings`, pressed: open, onClick: () => setOpen((o) => !o) })
         ] })
       }
     ),
-    open ? /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Env key", hint: envProblem ? hint(envProblem, "destructive") : hint("The name sandboxes and workflows use"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
-        import_controls18.Field,
-        {
-          className: "w-full font-mono",
-          "aria-label": `${name} env key`,
-          "aria-invalid": Boolean(envProblem),
-          placeholder: "e.g. GITHUB_TOKEN",
-          autoComplete: "off",
-          spellCheck: false,
-          value: env,
-          onChange: (e) => onChange({ envKey: e.target.value, ...e.target.value.trim() ? {} : { injectIntoSandbox: false } })
-        }
-      ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Who can see it", hint: hint(HANDLING_WORDS[handling].hint), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(
-        import_controls18.SegmentedControl,
-        {
-          "aria-label": `Who can see ${name}`,
-          value: handling,
-          onValueChange: (v) => void chooseHandling(v),
-          data: HANDLINGS.map((h) => ({ value: h, label: HANDLING_WORDS[h].label, title: HANDLING_WORDS[h].hint }))
-        }
-      ) }),
-      /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(VaultRow, { label: "Use in sandbox", hint: envOk ? hint("Sandboxes get it as an env variable") : hint("Needs an env key"), children: /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(import_controls18.Switch, { "aria-label": `Use ${name} in sandbox`, checked: envOk && field.injectIntoSandbox === true, disabled: !envOk, onCheckedChange: (v) => onChange({ injectIntoSandbox: v }) }) })
-    ] }) : null
+    open ? /* @__PURE__ */ (0, import_jsx_runtime22.jsx)(FieldSettingsRows, { name, value: field, onChange }) : null
   ] });
 }
 function withMfaMethod(custom, v) {
@@ -5943,6 +5977,8 @@ function SharingSummary({ item, port, className }) {
 // src/ItemPane.tsx
 var import_format8 = require("@ai-matrx/kit/format");
 var import_jsx_runtime27 = require("react/jsx-runtime");
+var ENV_VALUE_KEY = "env_value";
+var secureNoteDraft = () => ({ key: SECURE_NOTE_KEY, label: "Secure note", value: "", multiline: true, description: "Encrypted notes" });
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
@@ -6133,6 +6169,16 @@ function ItemPane(props) {
   const fieldSettings = (f) => canEdit ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(SlidersGlyph, {}), "aria-label": `${f.label} settings`, title: `${f.label} settings`, onClick: () => onPanel(`field:${f.id}`) }) : null;
   const turnOnOne = canTurnOn ? (f) => () => turnOn([f]) : () => void 0;
   const declaredKeys = new Set(declared.map((f) => f.key));
+  const hasSecureNote = declaredKeys.has(SECURE_NOTE_KEY) || Boolean(item?.fields.some((f) => f.key === SECURE_NOTE_KEY)) || draft.secrets.some((x) => x.key === SECURE_NOTE_KEY);
+  const [settingsToggled, setSettingsToggled] = (0, import_react28.useState)(/* @__PURE__ */ new Set());
+  const settingsOpen = (f) => settingsToggled.has(f.key) !== (definition?.key === ENV_VALUE_KEY || hasDeclaredSettings(draft.fieldSettings?.[f.key], f.handling));
+  const toggleSettings = (key) => setSettingsToggled((cur) => {
+    const next = new Set(cur);
+    if (next.has(key)) next.delete(key);
+    else next.add(key);
+    return next;
+  });
+  const patchFieldSettings = (key, p) => setDraft((d) => ({ ...d, fieldSettings: { ...d.fieldSettings, [key]: { ...d.fieldSettings?.[key], ...p } } }));
   const extraFields = (item?.fields ?? []).filter((f) => !declaredKeys.has(f.key) && !draft.removed.includes(f.id) && !isAuthenticatorStorage(f.key));
   const metaValue = (key) => draft.values[key] ?? item?.custom.find((c) => c.key === key)?.value ?? "";
   const extraCustom = draft.custom.filter((c) => !declaredKeys.has(c.key) && c.key !== MFA_METHOD_KEY && !isAuthenticatorStorage(c.key));
@@ -6265,24 +6311,29 @@ function ItemPane(props) {
           const secretKind = f.storage === "encrypted" && f.kind === "secret";
           const value = f.storage === "metadata" ? metaValue(f.key) : draft.values[f.key] ?? "";
           const hidden = existing && existing.handling !== "visible" && !(f.key in loaded);
-          return /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
-            EditRow,
-            {
-              label: f.label,
-              value,
-              placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
-              secret: secretKind,
-              multiline: f.kind === "multiline",
-              inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
-              onChange: (v) => setValue(f.key, v),
-              actions: /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_jsx_runtime27.Fragment, { children: [
-                hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
-                secretKind ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
-                existing ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_icons11.SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null
-              ] })
-            },
-            f.key
-          );
+          const newSecret = mode === "new" && f.storage === "encrypted" && owner !== "person";
+          const open = newSecret && settingsOpen(f);
+          return /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_react28.Fragment, { children: [
+            /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
+              EditRow,
+              {
+                label: f.label,
+                value,
+                placeholder: hidden ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : f.required ? "Required" : isRecoveryCodesField(f) ? "Backup codes, one per line" : "",
+                secret: secretKind,
+                multiline: f.kind === "multiline" || value.includes("\n"),
+                inputMode: f.kind === "url" ? "url" : USERNAME_KEYS.test(f.key) ? "email" : "text",
+                onChange: (v) => setValue(f.key, v),
+                actions: /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_jsx_runtime27.Fragment, { children: [
+                  hidden && existing?.handling === "revealable" && item?.capabilities.canReveal ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(EyeGlyph, {}), "aria-label": `Show current ${f.label}`, onClick: () => void loadForEdit(f.key) }) : null,
+                  secretKind ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(GenerateButton, { onUse: (v) => setValue(f.key, v) }) : null,
+                  existing ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_icons11.SettingsIcon, {}), "aria-label": `${f.label} settings`, onClick: () => onPanel(`field:${existing.id}`) }) : null,
+                  newSecret ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(SlidersGlyph, {}), "aria-label": `${f.label} settings`, pressed: open, onClick: () => toggleSettings(f.key) }) : null
+                ] })
+              }
+            ),
+            open ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(FieldSettingsRows, { name: f.label, value: draft.fieldSettings?.[f.key] ?? {}, defaultHandling: f.handling, onChange: (p) => patchFieldSettings(f.key, p) }) : null
+          ] }, f.key);
         }),
         extraFields.map((f) => /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
           EditRow,
@@ -6291,7 +6342,7 @@ function ItemPane(props) {
             value: draft.values[f.key] ?? "",
             placeholder: f.handling === "visible" || f.key in loaded ? "" : "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022",
             secret: f.handling !== "visible" && !isRecoveryCodesField(f),
-            multiline: isRecoveryCodesField(f),
+            multiline: f.kind === "multiline" || isRecoveryCodesField(f) || (draft.values[f.key] ?? "").includes("\n"),
             onChange: (v) => setValue(f.key, v),
             onRemove: () => patch({ removed: [...draft.removed, f.id] }),
             removeLabel: `Delete ${f.label}`,
@@ -6360,6 +6411,7 @@ function ItemPane(props) {
             /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(PlusGlyph, {}), children: "Add" }) }),
             /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_design_system17.DropdownMenuContent, { align: "end", children: [
               /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ secrets: [...draft.secrets, { key: "", label: "", value: "" }] }), children: "Secret field" }),
+              !hasSecureNote ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ secrets: [...draft.secrets, secureNoteDraft()] }), children: "Secure note" }) : null,
               /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => patch({ custom: [...draft.custom, { key: `custom_${draft.custom.length + 1}_${Date.now() % 1e5}`, label: "", value: "" }] }), children: "Text field" }),
               !tagsVisible ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => setShowTags(true), children: "Tags" }) : null,
               !descriptionVisible ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_design_system17.DropdownMenuItem, { onSelect: () => setShowDescription(true), children: "Description" }) : null,
@@ -9128,6 +9180,28 @@ function trashItem(r, ctx) {
     createdAt: ""
   };
 }
+async function withTypes(items, door, ctx) {
+  if (!door.schema || items.length === 0) return items;
+  const keys = /* @__PURE__ */ new Map();
+  const CHUNK = 100;
+  try {
+    for (let i = 0; i < items.length; i += CHUNK) {
+      const ids = items.slice(i, i + CHUNK).map((x) => x.id);
+      const { data, error } = await door.schema("users").from("credential_items").select("id,definition_key").in("id", ids);
+      if (error) throw new Error(error.message || "credential_items read failed");
+      for (const r of Array.isArray(data) ? data : []) {
+        if (typeof r.id === "string" && typeof r.definition_key === "string" && r.definition_key) keys.set(r.id, r.definition_key);
+      }
+    }
+  } catch (e) {
+    console.warn("[vault] Trash item types could not be read; rows say Credential", e);
+    return items;
+  }
+  return items.map((it) => {
+    const key = keys.get(it.id);
+    return key ? { ...it, definitionKey: key, definitionLabel: ctx.definition(key)?.label ?? humanize(key) } : it;
+  });
+}
 var previewOf = async (door, id) => parseRecoveryPreview(await call(door, "vault_recovery_preview", { p_id: id }));
 function createListsPort(ctx, door) {
   return {
@@ -9160,7 +9234,8 @@ function createListsPort(ctx, door) {
             if (rows.length < PAGE2) break;
           }
           const items = all.map((r) => trashItem(r, ctx)).filter((i) => i !== null);
-          return [...new Map(items.map((i) => [i.id, i])).values()];
+          const unique = [...new Map(items.map((i) => [i.id, i])).values()];
+          return withTypes(unique, door, ctx);
         }
       },
       favorites: {
@@ -9183,16 +9258,25 @@ function createListsPort(ctx, door) {
 var account6 = __toESM(require("@ai-matrx/api/account"), 1);
 
 // src/secret-field-in.ts
-function secretFieldIn(s) {
+function settingsIn(s) {
   const envKey = s.envKey?.trim() || null;
   return {
-    field_key: fieldKeyOf(s.label),
-    value: s.value,
-    handling: s.handling ?? "revealable",
     ...envKey ? { env_key: envKey } : {},
     ...envKey && s.injectIntoSandbox ? { inject_into_sandbox: true } : {}
   };
 }
+function secretFieldIn(s) {
+  return {
+    field_key: s.key.trim() || fieldKeyOf(s.label),
+    value: s.value,
+    handling: s.handling ?? "revealable",
+    ...s.description ? { description: s.description } : {},
+    ...settingsIn(s)
+  };
+}
+function declaredFieldIn(f, value, settings) {
+  return { field_key: f.key, value, handling: settings?.handling ?? f.handling, ...settingsIn(settings ?? {}) };
+}
 
 // src/sharing/api.ts
 function grantOf(w) {
@@ -9293,7 +9377,7 @@ function createSharingPort(ctx, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn)
           ]
         }
@@ -9422,7 +9506,7 @@ async function readNativeImportLimits(api, organizationId) {
 var recoveryOf = (w) => w.lifecycle?.vault_recovery;
 var isDeleted = (w) => recoveryOf(w)?.state === "deleted";
 var MATCH_MODES2 = ["host", "domain", "exact", "never"];
-var FIELD_WORDS = { totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
+var FIELD_WORDS = { secure_notes: "Secure note", totp_seed: "One-time password key", authenticator_last_time_step: "Last code used" };
 var handlingOf = (v) => v === "visible" || v === "sealed" ? v : "revealable";
 function fieldOf(w, def) {
   const declared = def?.fields.find((f) => f.key === w.field_key);
@@ -9431,7 +9515,8 @@ function fieldOf(w, def) {
     id: w.id,
     key: w.field_key,
     label: declared?.label ?? FIELD_WORDS[w.field_key] ?? humanize(w.field_key),
-    kind: declared?.kind ?? (handling === "visible" ? "text" : "secret"),
+    // A field no type declares still edits as several lines when its key says so (an old "Secure note").
+    kind: declared?.kind ?? (isMultilineKey(w.field_key) ? "multiline" : handling === "visible" ? "text" : "secret"),
     handling,
     editable: w.editable ?? true,
     envKey: w.env_key ?? null,
@@ -9586,7 +9671,7 @@ function createApiVaultPort(api, options = {}) {
           initiation: "user",
           non_secret_fields: [...meta.map((f) => ({ key: f.key, label: f.label, value: draft.values[f.key] ?? "" })), ...draft.custom.filter((c) => c.label.trim() !== "").map((c) => ({ key: c.key || fieldKeyOf(c.label), label: c.label, value: c.value }))],
           fields: [
-            ...encrypted.map((f) => ({ field_key: f.key, value: draft.values[f.key] ?? "", handling: f.handling })),
+            ...encrypted.map((f) => declaredFieldIn(f, draft.values[f.key] ?? "", draft.fieldSettings?.[f.key])),
             ...draft.secrets.filter((s) => s.label.trim() !== "" && s.value !== "").map(secretFieldIn),
             // Backup codes on a type that does not declare them (a website login): their own encrypted field.
             ...!declared.some((f) => f.key === RECOVERY_CODES_KEY) && (draft.values[RECOVERY_CODES_KEY] ?? "").trim() !== "" ? [{ field_key: RECOVERY_CODES_KEY, value: parseRecoveryCodes(draft.values[RECOVERY_CODES_KEY] ?? "").join("\n"), handling: "revealable", description: "One-time account recovery codes" }] : []