@ai-matrx/vault 0.1.26 → 0.1.28

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.28
+
+- **A website typed as a bare domain always saves.** Every bare domain is sent as `https://…` on create, edit, assign and the item settings call, whether or not the server could reach it (an intranet, a site not live yet) (`normalizeLoginUrls`); the Website box shows the `https://` form after leaving it, and "Not a public website. You can still save it." is a warning, never a block. Guard: `src/review-0-1-28.test.tsx` § 1. Consumer action: none.
+- **Every vault refusal shows the server's reason.** `createApiVaultPort` wraps the host's `Api` once (`withServerReasons`): a 4xx whose sentence is generic ("Invalid request. Please check your input and try again.") is re-worded, on the same error object, with the server's own reason ("Login URL must start with https:// or http://…"), so every action inherits it. Guard: § 1. Consumer action: none.
+- **A restored item turns back on in one press.** Restore still comes back as the server's quarantine (item, fields, codes, browser fill and sandbox use off; shares never recreated). The restore result now offers **Turn these back on**: it turns on the item, its fields, its one-time codes and browser fill (when it has a website), then says what it turned on; sharing and sandbox use stay the person's choice (`RestorePanel turnOn`, `turnBackOn`, `turnedOnSentence`; the item's own Turn on uses the same `turnBackOn`). Not offered when the item was already off before it was deleted. Guard: § 2. Consumer action: none.
+- **The first save of a new item leaves the form clean.** Once create resolves the pane reports clean and Save is off, even while a host's address has not moved to the saved item yet (it used to keep "Unsaved" up and ask "Discard your changes?"); `onDirty` is said when it changes, never re-said for a new callback. Guard: § 3. Consumer action: none.
+- Guard for every row copy ending in "<label> copied" or a failure line (refused clipboard, unreadable value): § 4. Consumer action: none.
+
+## 0.1.27
+
+- **`emptyReadAlarm`, `holdingsDoorIsAbsent`, `HOLDINGS_DOOR_MIGRATION` and the `HoldingRow`/`Holdings` types are exported from the root** so the web app can drop its whole-file copy (`features/secrets/empty-read.ts`). Consumer action: none.
+
 ## 0.1.26
 
 - **`glyphs.tsx` draws only `SafeGlyph` itself.** The other 46 vault glyphs (`KeyGlyph`, `CardGlyph`, `EyeGlyph`, `QrGlyph`, ...) are aliases of the matching `@ai-matrx/design-system/icons` glyphs, so they now render the exact lucide 1.48 drawing and carry the `lucide-<name>` optical-trim class instead of a hand-set `--matrx-glyph-air-*` style. Every export name and the `Glyph` type are unchanged. Consumer action: none.

package/dist/index.cjs

@@ -140,6 +140,7 @@ __export(src_exports, {
   DEFAULT_LOCATION: () => DEFAULT_LOCATION,
   GenerateButton: () => GenerateButton,
   HIDDEN_ITEM_TAG: () => HIDDEN_ITEM_TAG,
+  HOLDINGS_DOOR_MIGRATION: () => HOLDINGS_DOOR_MIGRATION,
   IdentityGate: () => IdentityGate,
   LOCKED_MESSAGE: () => LOCKED_MESSAGE,
   VaultApp: () => VaultApp,
@@ -149,7 +150,9 @@ __export(src_exports, {
   createApiVaultPort: () => createApiVaultPort,
   createSupabaseIdentity: () => createSupabaseIdentity,
   createVaultKnobs: () => createVaultKnobs,
+  emptyReadAlarm: () => emptyReadAlarm,
   guardPort: () => guardPort,
+  holdingsDoorIsAbsent: () => holdingsDoorIsAbsent,
   inferFromUrl: () => inferFromUrl,
   isHiddenItem: () => isHiddenItem,
   itemIdAt: () => itemIdAt,
@@ -2660,9 +2663,12 @@ function normalizeLoginUrl(input) {
     return null;
   }
 }
+function normalizeLoginUrls(inputs) {
+  return inputs.map((u) => u.trim()).filter(Boolean).map((u) => normalizeLoginUrl(u) ?? u);
+}
 function describeDestination(r) {
   if (r.state === "reachable") return { url: r.normalizedUrl, state: r.state, tone: "success", message: "Website confirmed" };
-  if (r.state === "invalid") return { url: r.normalizedUrl, state: r.state, tone: "destructive", message: "Not a public website" };
+  if (r.state === "invalid") return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Not a public website. You can still save it." };
   if (r.state === "not_found") return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Site answered, but this page was not found" };
   return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Couldn\u2019t confirm it. You can still save it." };
 }
@@ -5365,6 +5371,40 @@ function AssignResult({ sent, onAnother, onDone }) {
   ] });
 }
 
+// src/lists/turn-back-on.ts
+async function turnBackOn(port, item, fields, options = {}) {
+  const run = options.run ?? ((op) => op());
+  const done = [];
+  if (item.turnedOff) {
+    await run(() => port.fields.updateItem(item, { active: true }));
+    done.push("the item");
+  }
+  let n = 0;
+  for (const f of fields) {
+    if (f.active) continue;
+    await run(() => port.fields.updateField(item, f.id, { active: true }));
+    n += 1;
+  }
+  if (n) done.push(n === 1 ? "1 field" : `${n} fields`);
+  if (fields.some((f) => f.key === OTP_SEED_KEY)) {
+    const codes = await port.authenticator.get(item);
+    if (codes && !codes.enabled) {
+      await run(() => port.authenticator.setEnabled(item, true));
+      done.push("one-time codes");
+    }
+  }
+  if (options.browserFill && !item.browserFillEnabled && item.loginUrls.length > 0) {
+    await run(() => port.fields.updateItem(item, { browserFillEnabled: true }));
+    done.push("browser fill");
+  }
+  return done;
+}
+function turnedOnSentence(done) {
+  if (done.length === 0) return "Nothing here was off.";
+  const list = done.length === 1 ? done[0] : `${done.slice(0, -1).join(", ")} and ${done[done.length - 1]}`;
+  return `Turned on ${list}.`;
+}
+
 // src/ItemPane.tsx
 var import_icons11 = require("@ai-matrx/design-system/icons");
 var import_drafts = require("@ai-matrx/kit/drafts");
@@ -5978,7 +6018,8 @@ function ItemPane(props) {
   const [showBrowser, setShowBrowser] = (0, import_react28.useState)(false);
   const [error, setError] = (0, import_react28.useState)(null);
   const [destinations, setDestinations] = (0, import_react28.useState)({});
-  const dirty = editing && isDirty(base, draft);
+  const [savedNew, setSavedNew] = (0, import_react28.useState)(false);
+  const dirty = editing && !savedNew && isDirty(base, draft);
   const declared = definition?.fields ?? [];
   const prev = (0, import_react28.useRef)(null);
   const paneRef = (0, import_react28.useRef)(null);
@@ -6001,8 +6042,11 @@ function ItemPane(props) {
     setShowTags(false);
     setShowDescription(false);
     setShowRecovery(false);
+    setSavedNew(false);
   }, [item?.id, mode]);
-  (0, import_react28.useEffect)(() => onDirty(dirty), [dirty, onDirty]);
+  const onDirtyRef = (0, import_react28.useRef)(onDirty);
+  onDirtyRef.current = onDirty;
+  (0, import_react28.useEffect)(() => onDirtyRef.current(dirty), [dirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
   (0, import_react28.useEffect)(() => {
     if (editing && dirty) (0, import_drafts.keepDraft)(keepKey, keptFieldsOf(draft), { basedOn: item?.updatedAt ?? "new" });
@@ -6059,6 +6103,8 @@ function ItemPane(props) {
         const [withCode, n0, enrolled] = await withOtp(r.item, r.notice);
         const [next, n] = await storeQueuedFiles(withCode, n0);
         (0, import_drafts.dropKeptDraft)(keepKey);
+        setSavedNew(true);
+        onDirty(false);
         onSaved(next, true, n, enrolled);
       }
     } catch (e) {
@@ -6121,12 +6167,7 @@ function ItemPane(props) {
     if (!item) return;
     setError(null);
     try {
-      if (item.turnedOff) await confirmed(() => port.fields.updateItem(item, { active: true }));
-      for (const f of fields) await confirmed(() => port.fields.updateField(item, f.id, { active: true }));
-      if (fields.some((f) => f.key === OTP_SEED_KEY)) {
-        const codes = await port.authenticator.get(item);
-        if (codes && !codes.enabled) await confirmed(() => port.authenticator.setEnabled(item, true));
-      }
+      await turnBackOn(port, item, fields, { run: confirmed });
       onChanged();
     } catch (e) {
       if (!wasCancelled(e)) setError(e instanceof Error ? e.message : "It could not be turned on.");
@@ -6181,7 +6222,7 @@ function ItemPane(props) {
         "Unsaved"
       ] }) : null,
       /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "quiet", disabled: busy, onClick: () => mode === "new" ? onCancelNew() : onMode("view"), children: dirty ? "Discard" : "Cancel" }),
-      /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "primary", disabled: busy || sent !== null || draft.name.trim() === "" || mode === "edit" && !dirty || mode === "new" && owner === "person" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(recipient.trim()), onClick: () => void save(), children: mode === "new" && owner === "person" ? "Send" : "Save" })
+      /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(import_controls22.Button, { variant: "primary", disabled: busy || savedNew || sent !== null || draft.name.trim() === "" || mode === "edit" && !dirty || mode === "new" && owner === "person" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(recipient.trim()), onClick: () => void save(), children: mode === "new" && owner === "person" ? "Send" : "Save" })
     ] }) : item ? /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)("div", { className: "flex shrink-0 items-center gap-1", children: [
       host.page && canUseOnSite(item, host.page.url) ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(UseOnSiteButton, { port, item, pageUrl: host.page.url, onChanged: (next) => onChanged(next) }) : null,
       host.fill && item.capabilities.canUse ? /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
@@ -6349,7 +6390,8 @@ function ItemPane(props) {
                 else delete next[i];
                 return next;
               });
-              if (r?.url && r.url !== u) setDraft((d) => ({ ...d, loginUrls: d.loginUrls.map((x, j) => j === i && x === u ? r.url : x) }));
+              const stored = r?.url || normalizeLoginUrl(u);
+              if (stored && stored !== u) setDraft((d) => ({ ...d, loginUrls: d.loginUrls.map((x, j) => j === i && x === u ? stored : x) }));
             }),
             onRemove: () => patch({ loginUrls: draft.loginUrls.filter((_, j) => j !== i) }),
             removeLabel: "Remove website"
@@ -6761,8 +6803,16 @@ var import_react30 = require("react");
 var import_controls24 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime29 = require("react/jsx-runtime");
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
-function RestorePanel({ lists, item, restore, onClose }) {
+function RestorePanel({
+  lists,
+  item,
+  restore,
+  turnOn,
+  onClose
+}) {
   const [preview, setPreview] = (0, import_react30.useState)(null);
+  const [restored, setRestored] = (0, import_react30.useState)(null);
+  const [turnedOn, setTurnedOn] = (0, import_react30.useState)(null);
   const [error, setError] = (0, import_react30.useState)(null);
   const [busy, setBusy] = (0, import_react30.useState)(false);
   const [loading, setLoading] = (0, import_react30.useState)(Boolean(lists.preview));
@@ -6791,13 +6841,54 @@ function RestorePanel({ lists, item, restore, onClose }) {
     setError(null);
     try {
       const result = await restore(preview?.supported ? preview.deletionId : void 0);
-      if (result) onClose();
+      if (!result) return;
+      if (turnOn && !result.alreadyRestored && preview?.supported && !preview.priorWasDisabled) setRestored(result);
+      else onClose();
     } catch (e) {
       setError(e instanceof Error && e.message ? e.message : "Restore did not complete. Try again.");
     } finally {
       setBusy(false);
     }
   };
+  const runTurnOn = async () => {
+    if (!restored || !turnOn) return;
+    setBusy(true);
+    setError(null);
+    try {
+      const said = await turnOn(restored.item);
+      if (said !== null) setTurnedOn(said);
+    } catch (e) {
+      setError(e instanceof Error && e.message ? e.message : "It could not be turned on. Turn it on from the item.");
+    } finally {
+      setBusy(false);
+    }
+  };
+  if (restored) {
+    return /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)(
+      Panel,
+      {
+        title: `Restored "${item.name}"`,
+        size: "md",
+        onClose,
+        footer: turnedOn ? /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(import_controls24.Button, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)(import_jsx_runtime29.Fragment, { children: [
+          /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(import_controls24.Button, { variant: "quiet", onClick: onClose, children: "Leave off" }),
+          /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(import_controls24.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(RestoreGlyph, {}), disabled: busy, onClick: () => void runTurnOn(), children: busy ? "Turning on\u2026" : "Turn these back on" })
+        ] }),
+        children: [
+          /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)(VaultSection, { title: turnedOn ? "Turned on" : "Back, turned off", children: [
+            /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(VaultRow, { label: "Came back", children: /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)("span", { className: "text-foreground", children: [
+              count(restored.restoredFields, "field"),
+              ", ",
+              count(restored.restoredAttachments, "file")
+            ] }) }),
+            turnedOn ? /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(VaultRow, { label: "Now on", children: /* @__PURE__ */ (0, import_jsx_runtime29.jsx)("span", { role: "status", className: "text-foreground", children: turnedOn }) }) : /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(VaultRow, { label: "Turns on", hint: "One press, nothing else changes", children: /* @__PURE__ */ (0, import_jsx_runtime29.jsx)("span", { className: "text-muted-foreground", children: "The item, its fields, codes and browser fill" }) }),
+            /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(VaultRow, { label: "Stays off", hint: "Choose these again yourself", children: /* @__PURE__ */ (0, import_jsx_runtime29.jsx)("span", { className: "text-muted-foreground", children: "Sharing, sandbox use" }) })
+          ] }),
+          error ? /* @__PURE__ */ (0, import_jsx_runtime29.jsx)("p", { role: "alert", className: "px-1 text-sm text-destructive", children: error }) : null
+        ]
+      }
+    );
+  }
   return /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)(
     Panel,
     {
@@ -6838,7 +6929,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
     setMessage(null);
     try {
       const r = await confirmed(() => port.lists.restore(item, deletionId));
-      setMessage({ tone: "ok", text: r.alreadyRestored ? `"${item.name}" was already restored.` : `Restored "${item.name}" with ${r.restoredFields} fields and ${r.restoredAttachments} files. Turn its fields on from the item.` });
+      setMessage({ tone: "ok", text: r.alreadyRestored ? `"${item.name}" was already restored.` : `Restored "${item.name}" with ${r.restoredFields} fields and ${r.restoredAttachments} files, turned off.` });
       onChanged();
       return r;
     } catch (e) {
@@ -6848,6 +6939,19 @@ function TrashView({ port, deleted, query, header, onChanged }) {
       setBusyId(null);
     }
   };
+  const turnOn = async (item) => {
+    try {
+      const done = await turnBackOn(port, item, item.fields, { browserFill: true, run: confirmed });
+      const said = turnedOnSentence(done);
+      setMessage({ tone: "ok", text: `"${item.name}": ${said}` });
+      onChanged();
+      return said;
+    } catch (e) {
+      onChanged();
+      if (wasCancelled(e)) return null;
+      throw e;
+    }
+  };
   return /* @__PURE__ */ (0, import_jsx_runtime30.jsxs)("div", { className: "flex min-h-0 flex-1 flex-col gap-3 overflow-y-auto p-3", children: [
     header,
     /* @__PURE__ */ (0, import_jsx_runtime30.jsx)(VaultSection, { title: "Trash", children: shown.length === 0 ? /* @__PURE__ */ (0, import_jsx_runtime30.jsx)(Empty, { children: deleted.length === 0 ? "The trash is empty." : "Nothing matches." }) : shown.map((item) => (
@@ -6861,7 +6965,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
         /* @__PURE__ */ (0, import_jsx_runtime30.jsx)(import_controls25.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime30.jsx)(RestoreGlyph, {}), disabled: busyId !== null || !item.deletion, onClick: () => setRestoring(item), children: "Restore" })
       ] }, item.id)
     )) }),
-    restoring ? /* @__PURE__ */ (0, import_jsx_runtime30.jsx)(RestorePanel, { lists: port.lists, item: restoring, restore: (deletionId) => restore(restoring, deletionId), onClose: () => setRestoring(null) }) : null,
+    restoring ? /* @__PURE__ */ (0, import_jsx_runtime30.jsx)(RestorePanel, { lists: port.lists, item: restoring, restore: (deletionId) => restore(restoring, deletionId), turnOn, onClose: () => setRestoring(null) }) : null,
     message2 ? /* @__PURE__ */ (0, import_jsx_runtime30.jsx)("p", { role: "status", className: message2.tone === "error" ? "px-1 text-sm text-destructive" : "px-1 text-sm text-muted-foreground", children: message2.text }) : null
   ] });
 }
@@ -9126,7 +9230,7 @@ function createFieldsPort(ctx) {
       const body = { initiation: "user" };
       if (patch.uriMatchMode !== void 0) body.uri_match_mode = patch.uriMatchMode;
       if (patch.browserFillEnabled !== void 0) body.browser_fill_enabled = patch.browserFillEnabled;
-      if (patch.loginUrls !== void 0) body.login_urls = patch.loginUrls;
+      if (patch.loginUrls !== void 0) body.login_urls = normalizeLoginUrls(patch.loginUrls);
       if (patch.active !== void 0) body.status = patch.active ? "active" : "disabled";
       await account3.updateItem(api, { path: { item_id: item.id }, body }, ctx.optsFor(item));
       return reread(item);
@@ -9138,6 +9242,33 @@ function createFieldsPort(ctx) {
   };
 }
 
+// src/server-reasons.ts
+var GENERIC = [/please check your input/i, /^\s*request failed\s*\(\d+\)\s*$/i, /^\s*bad request\.?\s*$/i, /^\s*HTTP \d+\s*$/i];
+var isGeneric = (s) => GENERIC.some((re) => re.test(s));
+function cleanReason(detail) {
+  const s = detail.replace(/^\s*validation error:\s*/i, "").replace(/^\s*value error,\s*/i, "").trim();
+  return s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+}
+function serverReason(e) {
+  if (!e || typeof e !== "object") return null;
+  const { status, detail, message: message2 } = e;
+  if (typeof status !== "number" || status < 400 || status >= 500) return null;
+  if (typeof detail !== "string" || !detail.trim() || isGeneric(detail)) return null;
+  const shown = typeof message2 === "string" ? message2 : "";
+  if (shown && !isGeneric(shown)) return null;
+  return cleanReason(detail);
+}
+function withReason(e) {
+  const reason = serverReason(e);
+  if (reason) Object.assign(e, { message: reason, userMessage: reason });
+  return e;
+}
+function withServerReasons(api) {
+  const wrapped = Object.create(api);
+  wrapped.call = (...args) => api.call(...args).catch((e) => Promise.reject(withReason(e)));
+  return wrapped;
+}
+
 // src/io/api.ts
 var account4 = __toESM(require("@ai-matrx/api/account"), 1);
 var orgOpts = (organizationId) => organizationId ? { organizationId } : void 0;
@@ -9410,7 +9541,7 @@ function createSharingPort(ctx, options = {}) {
           definition_key: definition.key,
           provider_key: definition.providerKey,
           tags: draft.tags,
-          login_urls: draft.loginUrls,
+          login_urls: normalizeLoginUrls(draft.loginUrls),
           notes: draft.notes || null,
           generate_field_key: generateFieldKey,
           initiation: "user",
@@ -9607,7 +9738,8 @@ async function retrying(run, tries = 3) {
     }
   }
 }
-function createApiVaultPort(api, options = {}) {
+function createApiVaultPort(hostApi, options = {}) {
+  const api = withServerReasons(hostApi);
   let defs = /* @__PURE__ */ new Map();
   let auth = /* @__PURE__ */ new Map();
   let orgs = [];
@@ -9762,6 +9894,7 @@ function createApiVaultPort(api, options = {}) {
       const declared = definition.fields;
       const encrypted = declared.filter((f) => f.storage === "encrypted" && (draft.values[f.key] ?? "") !== "");
       const meta = declared.filter((f) => f.storage === "metadata" && (draft.values[f.key] ?? "") !== "");
+      const loginUrls = normalizeLoginUrls(draft.loginUrls);
       const w = await account9.createItem(api, {
         body: {
           display_name: draft.name.trim(),
@@ -9769,10 +9902,10 @@ function createApiVaultPort(api, options = {}) {
           definition_key: definition.key,
           provider_key: definition.providerKey,
           tags: draft.tags,
-          login_urls: draft.loginUrls,
+          login_urls: loginUrls,
           // A login a person saves with its website is offered on that website (the server's own
           // default is off, which made "Save a login" on a page answer "No saved login" there).
-          ...draft.browser ? { uri_match_mode: draft.browser.uriMatchMode, browser_fill_enabled: draft.browser.browserFillEnabled } : draft.loginUrls.length > 0 ? { browser_fill_enabled: true } : {},
+          ...draft.browser ? { uri_match_mode: draft.browser.uriMatchMode, browser_fill_enabled: draft.browser.browserFillEnabled } : loginUrls.length > 0 ? { browser_fill_enabled: true } : {},
           notes: draft.notes || null,
           principal: organizationId ? { type: "organization", organization_id: organizationId } : { type: "user" },
           initiation: "user",
@@ -9799,7 +9932,7 @@ function createApiVaultPort(api, options = {}) {
         else body.description = draft.description.trim();
       }
       if (JSON.stringify(draft.tags) !== JSON.stringify(item.tags)) body.tags = draft.tags;
-      if (JSON.stringify(draft.loginUrls) !== JSON.stringify(item.loginUrls)) body.login_urls = draft.loginUrls;
+      if (JSON.stringify(draft.loginUrls) !== JSON.stringify(item.loginUrls)) body.login_urls = normalizeLoginUrls(draft.loginUrls);
       if (draft.notes !== item.notes) {
         if (draft.notes === "") body.clear_notes = true;
         else body.notes = draft.notes;
@@ -9882,4 +10015,33 @@ function vaultInventoryScope(inventory, clicked = null) {
 function itemIdAt(target) {
   return target?.closest("[data-item]")?.getAttribute("data-item") ?? null;
 }
+
+// src/io/empty-read.ts
+var HOLDINGS_DOOR_MIGRATION = "migrations/campaign/errorshonest_s8_a_credential_says_how_much_it_holds.sql";
+function holdingsDoorIsAbsent(code) {
+  return code === "PGRST202" || code === "42883";
+}
+function staleAlarm(total) {
+  return `Your vault has ${total} ${total === 1 ? "item" : "items"} but none of their fields or files could be read. Either every one of these items is genuinely still empty, or the database refused the read without reporting an error \u2014 the second is a known failure mode of this screen (DD-160). Nothing has been lost: reload, and if the items are still blank, report it rather than re-entering the credentials.`;
+}
+function emptyReadAlarm(total, emptyIds, holdings) {
+  if (emptyIds.length === 0) return null;
+  if (holdings.state === "answered") {
+    const asked = new Set(emptyIds);
+    const unread = holdings.rows.filter(
+      (r) => asked.has(r.credential_item_id) && (r.field_count > 0 || r.file_count > 0)
+    );
+    if (unread.length === 0) return null;
+    const n = unread.length;
+    return `${n === 1 ? "One credential" : `${n} credentials`} in this vault ${n === 1 ? "holds" : "hold"} fields or files this screen could not read \u2014 the database refused the read without reporting an error, a known failure mode of this screen (DD-160). Nothing has been lost: reload, and if ${n === 1 ? "it is" : "they are"} still blank, report it rather than re-entering the credentials.`;
+  }
+  if (emptyIds.length < total) return null;
+  if (holdings.state === "absent") {
+    console.warn(
+      `[vault] users.credential_item_holdings is not on this database (${holdings.why}); the empty-read alarm falls back to the whole-vault rule until ${HOLDINGS_DOOR_MIGRATION} is applied.`
+    );
+    return staleAlarm(total);
+  }
+  return `${staleAlarm(total)} (The check that tells an empty credential from an unreadable one did not answer either: ${holdings.why})`;
+}
 //# sourceMappingURL=index.cjs.map