@ai-matrx/vault 0.1.26 → 0.1.27

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.1.27
+
+- **`emptyReadAlarm`, `holdingsDoorIsAbsent`, `HOLDINGS_DOOR_MIGRATION` and the `HoldingRow`/`Holdings` types are exported from the root** so the web app can drop its whole-file copy (`features/secrets/empty-read.ts`). Consumer action: none.
+
 ## 0.1.26
 
 - **`glyphs.tsx` draws only `SafeGlyph` itself.** The other 46 vault glyphs (`KeyGlyph`, `CardGlyph`, `EyeGlyph`, `QrGlyph`, ...) are aliases of the matching `@ai-matrx/design-system/icons` glyphs, so they now render the exact lucide 1.48 drawing and carry the `lucide-<name>` optical-trim class instead of a hand-set `--matrx-glyph-air-*` style. Every export name and the `Glyph` type are unchanged. Consumer action: none.

package/dist/index.cjs

@@ -140,6 +140,7 @@ __export(src_exports, {
   DEFAULT_LOCATION: () => DEFAULT_LOCATION,
   GenerateButton: () => GenerateButton,
   HIDDEN_ITEM_TAG: () => HIDDEN_ITEM_TAG,
+  HOLDINGS_DOOR_MIGRATION: () => HOLDINGS_DOOR_MIGRATION,
   IdentityGate: () => IdentityGate,
   LOCKED_MESSAGE: () => LOCKED_MESSAGE,
   VaultApp: () => VaultApp,
@@ -149,7 +150,9 @@ __export(src_exports, {
   createApiVaultPort: () => createApiVaultPort,
   createSupabaseIdentity: () => createSupabaseIdentity,
   createVaultKnobs: () => createVaultKnobs,
+  emptyReadAlarm: () => emptyReadAlarm,
   guardPort: () => guardPort,
+  holdingsDoorIsAbsent: () => holdingsDoorIsAbsent,
   inferFromUrl: () => inferFromUrl,
   isHiddenItem: () => isHiddenItem,
   itemIdAt: () => itemIdAt,
@@ -9882,4 +9885,33 @@ function vaultInventoryScope(inventory, clicked = null) {
 function itemIdAt(target) {
   return target?.closest("[data-item]")?.getAttribute("data-item") ?? null;
 }
+
+// src/io/empty-read.ts
+var HOLDINGS_DOOR_MIGRATION = "migrations/campaign/errorshonest_s8_a_credential_says_how_much_it_holds.sql";
+function holdingsDoorIsAbsent(code) {
+  return code === "PGRST202" || code === "42883";
+}
+function staleAlarm(total) {
+  return `Your vault has ${total} ${total === 1 ? "item" : "items"} but none of their fields or files could be read. Either every one of these items is genuinely still empty, or the database refused the read without reporting an error \u2014 the second is a known failure mode of this screen (DD-160). Nothing has been lost: reload, and if the items are still blank, report it rather than re-entering the credentials.`;
+}
+function emptyReadAlarm(total, emptyIds, holdings) {
+  if (emptyIds.length === 0) return null;
+  if (holdings.state === "answered") {
+    const asked = new Set(emptyIds);
+    const unread = holdings.rows.filter(
+      (r) => asked.has(r.credential_item_id) && (r.field_count > 0 || r.file_count > 0)
+    );
+    if (unread.length === 0) return null;
+    const n = unread.length;
+    return `${n === 1 ? "One credential" : `${n} credentials`} in this vault ${n === 1 ? "holds" : "hold"} fields or files this screen could not read \u2014 the database refused the read without reporting an error, a known failure mode of this screen (DD-160). Nothing has been lost: reload, and if ${n === 1 ? "it is" : "they are"} still blank, report it rather than re-entering the credentials.`;
+  }
+  if (emptyIds.length < total) return null;
+  if (holdings.state === "absent") {
+    console.warn(
+      `[vault] users.credential_item_holdings is not on this database (${holdings.why}); the empty-read alarm falls back to the whole-vault rule until ${HOLDINGS_DOOR_MIGRATION} is applied.`
+    );
+    return staleAlarm(total);
+  }
+  return `${staleAlarm(total)} (The check that tells an empty credential from an unreadable one did not answer either: ${holdings.why})`;
+}
 //# sourceMappingURL=index.cjs.map