@ai-matrx/vault 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.1.3
+
+UNVERIFIED: this release has no Unreleased entry and the source comparison could not be made (the caller supplied no source comparison). Whether source changed is unknown; consumer action is unknown.
+Check the package's gitHead on npm against this version's gitHead: `git diff <previous gitHead> <this gitHead> -- apps/shared/vault/src`.
+
 ## 0.1.2 — 2026-10-16
 
 - Whose an item is is always shown: a badge in the item header reads Personal, the organization's
@@ -31,3 +36,4 @@ extension's vault side panel and the desktop's vault import.
 - Add `@source "../node_modules/@ai-matrx/vault/dist"` (path relative to the stylesheet) so Tailwind emits the package's classes.
 - Vite hosts: `optimizeDeps.exclude: ["@ai-matrx/vault"]` (keeps the import workers' URLs).
 - Delete the host's own vault screens and client once adopted (no twins).
+

package/README.md

@@ -17,6 +17,10 @@ const host = {
 <VaultApp port={port} host={host} location={location} onLocationChange={(next, how) => writeToUrl(next, how)} notify={toast} />;
 ```
 
+- **Confirm it's you returns through the host's sign-in callback**: pass `redirectTo` to
+  `createSupabaseIdentity` as the host's accepted OAuth return address carrying the current page
+  (the web app: `/auth/callback?redirectTo=<this address>`). A bare page URL is usually not on the
+  auth server's allow-list, and the person lands on the home page unconfirmed.
 - **Hosts own identity only**: their `Api` (`@ai-matrx/api`), their Supabase client, the address.
 - **The address carries everything** (`locationToParams` / `locationFromParams`): vault, view, search,
   sort, item, edit/new, the open panel.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/vault",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "The AI Matrx Vault: one password-manager workspace (logins, API keys, secrets, one-time passwords, sharing, import/export) for the web app, the browser extension and the desktop app. Hosts supply an Api, an identity and optional abilities; the package owns every screen and the one client.",
   "type": "module",
   "license": "MIT",
@@ -82,5 +82,5 @@
     "verify:tarball": "node ./scripts/verify-tarball.mjs",
     "test": "vitest run"
   },
-  "gitHead": "a58de4849b913ee7dc6ed2e6a0513b2b15b37016"
+  "gitHead": "74c16f7e035ef6a87ddc88dc5862a26836ce99b8"
 }