@ai-matrx/vault 0.1.26 → 0.1.28

package/dist/index.d.cts

@@ -1420,7 +1420,7 @@ interface ApiVaultPortOptions {
     /** The host's `supabase.auth`: turns on approving a browser with a passkey. */
     passkeys?: PasskeyAuthLike;
 }
-declare function createApiVaultPort(api: Api, options?: ApiVaultPortOptions): VaultPort;
+declare function createApiVaultPort(hostApi: Api, options?: ApiVaultPortOptions): VaultPort;
 
 /**
  * Wrap any call that shows, copies or exports a secret. When the server answers "sign in again",
@@ -1471,4 +1471,48 @@ interface RowMenuEntry {
 /** The entries of the row a right-click landed on (`[data-item]`), else none. */
 declare function rowMenuEntriesAt(target: Element | null | undefined): readonly RowMenuEntry[];
 
-export { type ApiVaultPortOptions, CATEGORIES, CONFIRM_RETURN_KEY, type CategoryId, type Confirmed, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, HIDDEN_ITEM_TAG, type IdentityAccount, IdentityGate, type IdentityMethod, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, type ReturnStore, type RowMenuEntry, type RowMenuEntryKind, type SaveResult, type SupabaseAuthLike, type SupabaseIdentityOptions, type TotpReading, type UriMatchMode, type UrlGuess, type VaultAgentScope, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultInventory, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copyValue, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, guardPort, inferFromUrl, isHiddenItem, itemIdAt, locationFromParams, locationToParams, loginSiteOf, matchesQuery, needsRecentSignIn, parseDefinitions, providerOf, rowMenuEntriesAt, siteDomainOf, sortItems, useConfirmed, vaultInventoryScope, vaultItemFacts, wasCancelled };
+/**
+ * AN EMPTY CREDENTIAL IS A FACT; AN EMPTY READ OF A FULL ONE IS A FAILURE (DD-160, lane
+ * ERRORS-HONEST 2026-09-24).
+ *
+ * RLS refuses a row by returning nothing, so a list that reads a credential's fields and gets `[]`
+ * cannot tell "there is nothing in it" from "the database filtered the read" — from 2026-07 to
+ * 2026-09-12 a restrictive policy hid every field from its own owner and the screen reported
+ * success. The list used to guess from the whole scope ("no field and no file anywhere" = alarm),
+ * which blanked an organization whose only credential was simply empty (Pinecrest Records'
+ * Bandcamp label login).
+ *
+ * The guess is replaced by the database's own answer: `users.credential_item_holdings(ids)` counts
+ * the live field and file rows of each credential the caller may read (counts only, never a value).
+ * The alarm fires only for a credential that HOLDS something the read did not return.
+ */
+type HoldingRow = {
+    credential_item_id: string;
+    field_count: number;
+    file_count: number;
+};
+type Holdings = {
+    state: "answered";
+    rows: HoldingRow[];
+}
+/** The door is not on this database yet — the migration below has not been applied. */
+ | {
+    state: "absent";
+    why: string;
+} | {
+    state: "unavailable";
+    why: string;
+};
+declare const HOLDINGS_DOOR_MIGRATION = "migrations/campaign/errorshonest_s8_a_credential_says_how_much_it_holds.sql";
+/** The error codes that mean "no such function on this database", not "the read failed". */
+declare function holdingsDoorIsAbsent(code: string | undefined | null): boolean;
+/**
+ * The alarm sentence, or null when every credential that read empty is genuinely empty.
+ *
+ * @param total      how many credentials the list read
+ * @param emptyIds   the ones whose field AND file reads came back empty
+ * @param holdings   the database's answer for `emptyIds`
+ */
+declare function emptyReadAlarm(total: number, emptyIds: readonly string[], holdings: Holdings): string | null;
+
+export { type ApiVaultPortOptions, CATEGORIES, CONFIRM_RETURN_KEY, type CategoryId, type Confirmed, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, HIDDEN_ITEM_TAG, HOLDINGS_DOOR_MIGRATION, type HoldingRow, type Holdings, type IdentityAccount, IdentityGate, type IdentityMethod, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, type ReturnStore, type RowMenuEntry, type RowMenuEntryKind, type SaveResult, type SupabaseAuthLike, type SupabaseIdentityOptions, type TotpReading, type UriMatchMode, type UrlGuess, type VaultAgentScope, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultInventory, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copyValue, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, emptyReadAlarm, guardPort, holdingsDoorIsAbsent, inferFromUrl, isHiddenItem, itemIdAt, locationFromParams, locationToParams, loginSiteOf, matchesQuery, needsRecentSignIn, parseDefinitions, providerOf, rowMenuEntriesAt, siteDomainOf, sortItems, useConfirmed, vaultInventoryScope, vaultItemFacts, wasCancelled };

package/dist/index.d.ts

@@ -1420,7 +1420,7 @@ interface ApiVaultPortOptions {
     /** The host's `supabase.auth`: turns on approving a browser with a passkey. */
     passkeys?: PasskeyAuthLike;
 }
-declare function createApiVaultPort(api: Api, options?: ApiVaultPortOptions): VaultPort;
+declare function createApiVaultPort(hostApi: Api, options?: ApiVaultPortOptions): VaultPort;
 
 /**
  * Wrap any call that shows, copies or exports a secret. When the server answers "sign in again",
@@ -1471,4 +1471,48 @@ interface RowMenuEntry {
 /** The entries of the row a right-click landed on (`[data-item]`), else none. */
 declare function rowMenuEntriesAt(target: Element | null | undefined): readonly RowMenuEntry[];
 
-export { type ApiVaultPortOptions, CATEGORIES, CONFIRM_RETURN_KEY, type CategoryId, type Confirmed, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, HIDDEN_ITEM_TAG, type IdentityAccount, IdentityGate, type IdentityMethod, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, type ReturnStore, type RowMenuEntry, type RowMenuEntryKind, type SaveResult, type SupabaseAuthLike, type SupabaseIdentityOptions, type TotpReading, type UriMatchMode, type UrlGuess, type VaultAgentScope, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultInventory, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copyValue, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, guardPort, inferFromUrl, isHiddenItem, itemIdAt, locationFromParams, locationToParams, loginSiteOf, matchesQuery, needsRecentSignIn, parseDefinitions, providerOf, rowMenuEntriesAt, siteDomainOf, sortItems, useConfirmed, vaultInventoryScope, vaultItemFacts, wasCancelled };
+/**
+ * AN EMPTY CREDENTIAL IS A FACT; AN EMPTY READ OF A FULL ONE IS A FAILURE (DD-160, lane
+ * ERRORS-HONEST 2026-09-24).
+ *
+ * RLS refuses a row by returning nothing, so a list that reads a credential's fields and gets `[]`
+ * cannot tell "there is nothing in it" from "the database filtered the read" — from 2026-07 to
+ * 2026-09-12 a restrictive policy hid every field from its own owner and the screen reported
+ * success. The list used to guess from the whole scope ("no field and no file anywhere" = alarm),
+ * which blanked an organization whose only credential was simply empty (Pinecrest Records'
+ * Bandcamp label login).
+ *
+ * The guess is replaced by the database's own answer: `users.credential_item_holdings(ids)` counts
+ * the live field and file rows of each credential the caller may read (counts only, never a value).
+ * The alarm fires only for a credential that HOLDS something the read did not return.
+ */
+type HoldingRow = {
+    credential_item_id: string;
+    field_count: number;
+    file_count: number;
+};
+type Holdings = {
+    state: "answered";
+    rows: HoldingRow[];
+}
+/** The door is not on this database yet — the migration below has not been applied. */
+ | {
+    state: "absent";
+    why: string;
+} | {
+    state: "unavailable";
+    why: string;
+};
+declare const HOLDINGS_DOOR_MIGRATION = "migrations/campaign/errorshonest_s8_a_credential_says_how_much_it_holds.sql";
+/** The error codes that mean "no such function on this database", not "the read failed". */
+declare function holdingsDoorIsAbsent(code: string | undefined | null): boolean;
+/**
+ * The alarm sentence, or null when every credential that read empty is genuinely empty.
+ *
+ * @param total      how many credentials the list read
+ * @param emptyIds   the ones whose field AND file reads came back empty
+ * @param holdings   the database's answer for `emptyIds`
+ */
+declare function emptyReadAlarm(total: number, emptyIds: readonly string[], holdings: Holdings): string | null;
+
+export { type ApiVaultPortOptions, CATEGORIES, CONFIRM_RETURN_KEY, type CategoryId, type Confirmed, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, HIDDEN_ITEM_TAG, HOLDINGS_DOOR_MIGRATION, type HoldingRow, type Holdings, type IdentityAccount, IdentityGate, type IdentityMethod, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, type ReturnStore, type RowMenuEntry, type RowMenuEntryKind, type SaveResult, type SupabaseAuthLike, type SupabaseIdentityOptions, type TotpReading, type UriMatchMode, type UrlGuess, type VaultAgentScope, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultInventory, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copyValue, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, emptyReadAlarm, guardPort, holdingsDoorIsAbsent, inferFromUrl, isHiddenItem, itemIdAt, locationFromParams, locationToParams, loginSiteOf, matchesQuery, needsRecentSignIn, parseDefinitions, providerOf, rowMenuEntriesAt, siteDomainOf, sortItems, useConfirmed, vaultInventoryScope, vaultItemFacts, wasCancelled };

package/dist/index.js

@@ -2637,9 +2637,12 @@ function normalizeLoginUrl(input) {
     return null;
   }
 }
+function normalizeLoginUrls(inputs) {
+  return inputs.map((u) => u.trim()).filter(Boolean).map((u) => normalizeLoginUrl(u) ?? u);
+}
 function describeDestination(r) {
   if (r.state === "reachable") return { url: r.normalizedUrl, state: r.state, tone: "success", message: "Website confirmed" };
-  if (r.state === "invalid") return { url: r.normalizedUrl, state: r.state, tone: "destructive", message: "Not a public website" };
+  if (r.state === "invalid") return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Not a public website. You can still save it." };
   if (r.state === "not_found") return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Site answered, but this page was not found" };
   return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Couldn\u2019t confirm it. You can still save it." };
 }
@@ -5345,6 +5348,40 @@ function AssignResult({ sent, onAnother, onDone }) {
   ] });
 }
 
+// src/lists/turn-back-on.ts
+async function turnBackOn(port, item, fields, options = {}) {
+  const run = options.run ?? ((op) => op());
+  const done = [];
+  if (item.turnedOff) {
+    await run(() => port.fields.updateItem(item, { active: true }));
+    done.push("the item");
+  }
+  let n = 0;
+  for (const f of fields) {
+    if (f.active) continue;
+    await run(() => port.fields.updateField(item, f.id, { active: true }));
+    n += 1;
+  }
+  if (n) done.push(n === 1 ? "1 field" : `${n} fields`);
+  if (fields.some((f) => f.key === OTP_SEED_KEY)) {
+    const codes = await port.authenticator.get(item);
+    if (codes && !codes.enabled) {
+      await run(() => port.authenticator.setEnabled(item, true));
+      done.push("one-time codes");
+    }
+  }
+  if (options.browserFill && !item.browserFillEnabled && item.loginUrls.length > 0) {
+    await run(() => port.fields.updateItem(item, { browserFillEnabled: true }));
+    done.push("browser fill");
+  }
+  return done;
+}
+function turnedOnSentence(done) {
+  if (done.length === 0) return "Nothing here was off.";
+  const list = done.length === 1 ? done[0] : `${done.slice(0, -1).join(", ")} and ${done[done.length - 1]}`;
+  return `Turned on ${list}.`;
+}
+
 // src/ItemPane.tsx
 import { HistoryIcon, SettingsIcon, UsersIcon as UsersIcon2 } from "@ai-matrx/design-system/icons";
 import { dropKeptDraft, keepDraft, readKeptDraft } from "@ai-matrx/kit/drafts";
@@ -5958,7 +5995,8 @@ function ItemPane(props) {
   const [showBrowser, setShowBrowser] = useState27(false);
   const [error, setError] = useState27(null);
   const [destinations, setDestinations] = useState27({});
-  const dirty = editing && isDirty(base, draft);
+  const [savedNew, setSavedNew] = useState27(false);
+  const dirty = editing && !savedNew && isDirty(base, draft);
   const declared = definition?.fields ?? [];
   const prev = useRef14(null);
   const paneRef = useRef14(null);
@@ -5981,8 +6019,11 @@ function ItemPane(props) {
     setShowTags(false);
     setShowDescription(false);
     setShowRecovery(false);
+    setSavedNew(false);
   }, [item?.id, mode]);
-  useEffect16(() => onDirty(dirty), [dirty, onDirty]);
+  const onDirtyRef = useRef14(onDirty);
+  onDirtyRef.current = onDirty;
+  useEffect16(() => onDirtyRef.current(dirty), [dirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
   useEffect16(() => {
     if (editing && dirty) keepDraft(keepKey, keptFieldsOf(draft), { basedOn: item?.updatedAt ?? "new" });
@@ -6039,6 +6080,8 @@ function ItemPane(props) {
         const [withCode, n0, enrolled] = await withOtp(r.item, r.notice);
         const [next, n] = await storeQueuedFiles(withCode, n0);
         dropKeptDraft(keepKey);
+        setSavedNew(true);
+        onDirty(false);
         onSaved(next, true, n, enrolled);
       }
     } catch (e) {
@@ -6101,12 +6144,7 @@ function ItemPane(props) {
     if (!item) return;
     setError(null);
     try {
-      if (item.turnedOff) await confirmed(() => port.fields.updateItem(item, { active: true }));
-      for (const f of fields) await confirmed(() => port.fields.updateField(item, f.id, { active: true }));
-      if (fields.some((f) => f.key === OTP_SEED_KEY)) {
-        const codes = await port.authenticator.get(item);
-        if (codes && !codes.enabled) await confirmed(() => port.authenticator.setEnabled(item, true));
-      }
+      await turnBackOn(port, item, fields, { run: confirmed });
       onChanged();
     } catch (e) {
       if (!wasCancelled(e)) setError(e instanceof Error ? e.message : "It could not be turned on.");
@@ -6161,7 +6199,7 @@ function ItemPane(props) {
         "Unsaved"
       ] }) : null,
       /* @__PURE__ */ jsx27(Button22, { variant: "quiet", disabled: busy, onClick: () => mode === "new" ? onCancelNew() : onMode("view"), children: dirty ? "Discard" : "Cancel" }),
-      /* @__PURE__ */ jsx27(Button22, { variant: "primary", disabled: busy || sent !== null || draft.name.trim() === "" || mode === "edit" && !dirty || mode === "new" && owner === "person" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(recipient.trim()), onClick: () => void save(), children: mode === "new" && owner === "person" ? "Send" : "Save" })
+      /* @__PURE__ */ jsx27(Button22, { variant: "primary", disabled: busy || savedNew || sent !== null || draft.name.trim() === "" || mode === "edit" && !dirty || mode === "new" && owner === "person" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(recipient.trim()), onClick: () => void save(), children: mode === "new" && owner === "person" ? "Send" : "Save" })
     ] }) : item ? /* @__PURE__ */ jsxs25("div", { className: "flex shrink-0 items-center gap-1", children: [
       host.page && canUseOnSite(item, host.page.url) ? /* @__PURE__ */ jsx27(UseOnSiteButton, { port, item, pageUrl: host.page.url, onChanged: (next) => onChanged(next) }) : null,
       host.fill && item.capabilities.canUse ? /* @__PURE__ */ jsx27(
@@ -6329,7 +6367,8 @@ function ItemPane(props) {
                 else delete next[i];
                 return next;
               });
-              if (r?.url && r.url !== u) setDraft((d) => ({ ...d, loginUrls: d.loginUrls.map((x, j) => j === i && x === u ? r.url : x) }));
+              const stored = r?.url || normalizeLoginUrl(u);
+              if (stored && stored !== u) setDraft((d) => ({ ...d, loginUrls: d.loginUrls.map((x, j) => j === i && x === u ? stored : x) }));
             }),
             onRemove: () => patch({ loginUrls: draft.loginUrls.filter((_, j) => j !== i) }),
             removeLabel: "Remove website"
@@ -6741,8 +6780,16 @@ import { useEffect as useEffect18, useState as useState29 } from "react";
 import { Button as Button24 } from "@ai-matrx/design-system/controls";
 import { Fragment as Fragment19, jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
-function RestorePanel({ lists, item, restore, onClose }) {
+function RestorePanel({
+  lists,
+  item,
+  restore,
+  turnOn,
+  onClose
+}) {
   const [preview, setPreview] = useState29(null);
+  const [restored, setRestored] = useState29(null);
+  const [turnedOn, setTurnedOn] = useState29(null);
   const [error, setError] = useState29(null);
   const [busy, setBusy] = useState29(false);
   const [loading, setLoading] = useState29(Boolean(lists.preview));
@@ -6771,13 +6818,54 @@ function RestorePanel({ lists, item, restore, onClose }) {
     setError(null);
     try {
       const result = await restore(preview?.supported ? preview.deletionId : void 0);
-      if (result) onClose();
+      if (!result) return;
+      if (turnOn && !result.alreadyRestored && preview?.supported && !preview.priorWasDisabled) setRestored(result);
+      else onClose();
     } catch (e) {
       setError(e instanceof Error && e.message ? e.message : "Restore did not complete. Try again.");
     } finally {
       setBusy(false);
     }
   };
+  const runTurnOn = async () => {
+    if (!restored || !turnOn) return;
+    setBusy(true);
+    setError(null);
+    try {
+      const said = await turnOn(restored.item);
+      if (said !== null) setTurnedOn(said);
+    } catch (e) {
+      setError(e instanceof Error && e.message ? e.message : "It could not be turned on. Turn it on from the item.");
+    } finally {
+      setBusy(false);
+    }
+  };
+  if (restored) {
+    return /* @__PURE__ */ jsxs27(
+      Panel,
+      {
+        title: `Restored "${item.name}"`,
+        size: "md",
+        onClose,
+        footer: turnedOn ? /* @__PURE__ */ jsx29(Button24, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs27(Fragment19, { children: [
+          /* @__PURE__ */ jsx29(Button24, { variant: "quiet", onClick: onClose, children: "Leave off" }),
+          /* @__PURE__ */ jsx29(Button24, { variant: "primary", icon: /* @__PURE__ */ jsx29(RestoreGlyph, {}), disabled: busy, onClick: () => void runTurnOn(), children: busy ? "Turning on\u2026" : "Turn these back on" })
+        ] }),
+        children: [
+          /* @__PURE__ */ jsxs27(VaultSection, { title: turnedOn ? "Turned on" : "Back, turned off", children: [
+            /* @__PURE__ */ jsx29(VaultRow, { label: "Came back", children: /* @__PURE__ */ jsxs27("span", { className: "text-foreground", children: [
+              count(restored.restoredFields, "field"),
+              ", ",
+              count(restored.restoredAttachments, "file")
+            ] }) }),
+            turnedOn ? /* @__PURE__ */ jsx29(VaultRow, { label: "Now on", children: /* @__PURE__ */ jsx29("span", { role: "status", className: "text-foreground", children: turnedOn }) }) : /* @__PURE__ */ jsx29(VaultRow, { label: "Turns on", hint: "One press, nothing else changes", children: /* @__PURE__ */ jsx29("span", { className: "text-muted-foreground", children: "The item, its fields, codes and browser fill" }) }),
+            /* @__PURE__ */ jsx29(VaultRow, { label: "Stays off", hint: "Choose these again yourself", children: /* @__PURE__ */ jsx29("span", { className: "text-muted-foreground", children: "Sharing, sandbox use" }) })
+          ] }),
+          error ? /* @__PURE__ */ jsx29("p", { role: "alert", className: "px-1 text-sm text-destructive", children: error }) : null
+        ]
+      }
+    );
+  }
   return /* @__PURE__ */ jsxs27(
     Panel,
     {
@@ -6818,7 +6906,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
     setMessage(null);
     try {
       const r = await confirmed(() => port.lists.restore(item, deletionId));
-      setMessage({ tone: "ok", text: r.alreadyRestored ? `"${item.name}" was already restored.` : `Restored "${item.name}" with ${r.restoredFields} fields and ${r.restoredAttachments} files. Turn its fields on from the item.` });
+      setMessage({ tone: "ok", text: r.alreadyRestored ? `"${item.name}" was already restored.` : `Restored "${item.name}" with ${r.restoredFields} fields and ${r.restoredAttachments} files, turned off.` });
       onChanged();
       return r;
     } catch (e) {
@@ -6828,6 +6916,19 @@ function TrashView({ port, deleted, query, header, onChanged }) {
       setBusyId(null);
     }
   };
+  const turnOn = async (item) => {
+    try {
+      const done = await turnBackOn(port, item, item.fields, { browserFill: true, run: confirmed });
+      const said = turnedOnSentence(done);
+      setMessage({ tone: "ok", text: `"${item.name}": ${said}` });
+      onChanged();
+      return said;
+    } catch (e) {
+      onChanged();
+      if (wasCancelled(e)) return null;
+      throw e;
+    }
+  };
   return /* @__PURE__ */ jsxs28("div", { className: "flex min-h-0 flex-1 flex-col gap-3 overflow-y-auto p-3", children: [
     header,
     /* @__PURE__ */ jsx30(VaultSection, { title: "Trash", children: shown.length === 0 ? /* @__PURE__ */ jsx30(Empty, { children: deleted.length === 0 ? "The trash is empty." : "Nothing matches." }) : shown.map((item) => (
@@ -6841,7 +6942,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
         /* @__PURE__ */ jsx30(Button25, { variant: "outline", icon: /* @__PURE__ */ jsx30(RestoreGlyph, {}), disabled: busyId !== null || !item.deletion, onClick: () => setRestoring(item), children: "Restore" })
       ] }, item.id)
     )) }),
-    restoring ? /* @__PURE__ */ jsx30(RestorePanel, { lists: port.lists, item: restoring, restore: (deletionId) => restore(restoring, deletionId), onClose: () => setRestoring(null) }) : null,
+    restoring ? /* @__PURE__ */ jsx30(RestorePanel, { lists: port.lists, item: restoring, restore: (deletionId) => restore(restoring, deletionId), turnOn, onClose: () => setRestoring(null) }) : null,
     message2 ? /* @__PURE__ */ jsx30("p", { role: "status", className: message2.tone === "error" ? "px-1 text-sm text-destructive" : "px-1 text-sm text-muted-foreground", children: message2.text }) : null
   ] });
 }
@@ -9106,7 +9207,7 @@ function createFieldsPort(ctx) {
       const body = { initiation: "user" };
       if (patch.uriMatchMode !== void 0) body.uri_match_mode = patch.uriMatchMode;
       if (patch.browserFillEnabled !== void 0) body.browser_fill_enabled = patch.browserFillEnabled;
-      if (patch.loginUrls !== void 0) body.login_urls = patch.loginUrls;
+      if (patch.loginUrls !== void 0) body.login_urls = normalizeLoginUrls(patch.loginUrls);
       if (patch.active !== void 0) body.status = patch.active ? "active" : "disabled";
       await account3.updateItem(api, { path: { item_id: item.id }, body }, ctx.optsFor(item));
       return reread(item);
@@ -9118,6 +9219,33 @@ function createFieldsPort(ctx) {
   };
 }
 
+// src/server-reasons.ts
+var GENERIC = [/please check your input/i, /^\s*request failed\s*\(\d+\)\s*$/i, /^\s*bad request\.?\s*$/i, /^\s*HTTP \d+\s*$/i];
+var isGeneric = (s) => GENERIC.some((re) => re.test(s));
+function cleanReason(detail) {
+  const s = detail.replace(/^\s*validation error:\s*/i, "").replace(/^\s*value error,\s*/i, "").trim();
+  return s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+}
+function serverReason(e) {
+  if (!e || typeof e !== "object") return null;
+  const { status, detail, message: message2 } = e;
+  if (typeof status !== "number" || status < 400 || status >= 500) return null;
+  if (typeof detail !== "string" || !detail.trim() || isGeneric(detail)) return null;
+  const shown = typeof message2 === "string" ? message2 : "";
+  if (shown && !isGeneric(shown)) return null;
+  return cleanReason(detail);
+}
+function withReason(e) {
+  const reason = serverReason(e);
+  if (reason) Object.assign(e, { message: reason, userMessage: reason });
+  return e;
+}
+function withServerReasons(api) {
+  const wrapped = Object.create(api);
+  wrapped.call = (...args) => api.call(...args).catch((e) => Promise.reject(withReason(e)));
+  return wrapped;
+}
+
 // src/io/api.ts
 import * as account4 from "@ai-matrx/api/account";
 var orgOpts = (organizationId) => organizationId ? { organizationId } : void 0;
@@ -9390,7 +9518,7 @@ function createSharingPort(ctx, options = {}) {
           definition_key: definition.key,
           provider_key: definition.providerKey,
           tags: draft.tags,
-          login_urls: draft.loginUrls,
+          login_urls: normalizeLoginUrls(draft.loginUrls),
           notes: draft.notes || null,
           generate_field_key: generateFieldKey,
           initiation: "user",
@@ -9587,7 +9715,8 @@ async function retrying(run, tries = 3) {
     }
   }
 }
-function createApiVaultPort(api, options = {}) {
+function createApiVaultPort(hostApi, options = {}) {
+  const api = withServerReasons(hostApi);
   let defs = /* @__PURE__ */ new Map();
   let auth = /* @__PURE__ */ new Map();
   let orgs = [];
@@ -9742,6 +9871,7 @@ function createApiVaultPort(api, options = {}) {
       const declared = definition.fields;
       const encrypted = declared.filter((f) => f.storage === "encrypted" && (draft.values[f.key] ?? "") !== "");
       const meta = declared.filter((f) => f.storage === "metadata" && (draft.values[f.key] ?? "") !== "");
+      const loginUrls = normalizeLoginUrls(draft.loginUrls);
       const w = await account9.createItem(api, {
         body: {
           display_name: draft.name.trim(),
@@ -9749,10 +9879,10 @@ function createApiVaultPort(api, options = {}) {
           definition_key: definition.key,
           provider_key: definition.providerKey,
           tags: draft.tags,
-          login_urls: draft.loginUrls,
+          login_urls: loginUrls,
           // A login a person saves with its website is offered on that website (the server's own
           // default is off, which made "Save a login" on a page answer "No saved login" there).
-          ...draft.browser ? { uri_match_mode: draft.browser.uriMatchMode, browser_fill_enabled: draft.browser.browserFillEnabled } : draft.loginUrls.length > 0 ? { browser_fill_enabled: true } : {},
+          ...draft.browser ? { uri_match_mode: draft.browser.uriMatchMode, browser_fill_enabled: draft.browser.browserFillEnabled } : loginUrls.length > 0 ? { browser_fill_enabled: true } : {},
           notes: draft.notes || null,
           principal: organizationId ? { type: "organization", organization_id: organizationId } : { type: "user" },
           initiation: "user",
@@ -9779,7 +9909,7 @@ function createApiVaultPort(api, options = {}) {
         else body.description = draft.description.trim();
       }
       if (JSON.stringify(draft.tags) !== JSON.stringify(item.tags)) body.tags = draft.tags;
-      if (JSON.stringify(draft.loginUrls) !== JSON.stringify(item.loginUrls)) body.login_urls = draft.loginUrls;
+      if (JSON.stringify(draft.loginUrls) !== JSON.stringify(item.loginUrls)) body.login_urls = normalizeLoginUrls(draft.loginUrls);
       if (draft.notes !== item.notes) {
         if (draft.notes === "") body.clear_notes = true;
         else body.notes = draft.notes;
@@ -9862,12 +9992,42 @@ function vaultInventoryScope(inventory, clicked = null) {
 function itemIdAt(target) {
   return target?.closest("[data-item]")?.getAttribute("data-item") ?? null;
 }
+
+// src/io/empty-read.ts
+var HOLDINGS_DOOR_MIGRATION = "migrations/campaign/errorshonest_s8_a_credential_says_how_much_it_holds.sql";
+function holdingsDoorIsAbsent(code) {
+  return code === "PGRST202" || code === "42883";
+}
+function staleAlarm(total) {
+  return `Your vault has ${total} ${total === 1 ? "item" : "items"} but none of their fields or files could be read. Either every one of these items is genuinely still empty, or the database refused the read without reporting an error \u2014 the second is a known failure mode of this screen (DD-160). Nothing has been lost: reload, and if the items are still blank, report it rather than re-entering the credentials.`;
+}
+function emptyReadAlarm(total, emptyIds, holdings) {
+  if (emptyIds.length === 0) return null;
+  if (holdings.state === "answered") {
+    const asked = new Set(emptyIds);
+    const unread = holdings.rows.filter(
+      (r) => asked.has(r.credential_item_id) && (r.field_count > 0 || r.file_count > 0)
+    );
+    if (unread.length === 0) return null;
+    const n = unread.length;
+    return `${n === 1 ? "One credential" : `${n} credentials`} in this vault ${n === 1 ? "holds" : "hold"} fields or files this screen could not read \u2014 the database refused the read without reporting an error, a known failure mode of this screen (DD-160). Nothing has been lost: reload, and if ${n === 1 ? "it is" : "they are"} still blank, report it rather than re-entering the credentials.`;
+  }
+  if (emptyIds.length < total) return null;
+  if (holdings.state === "absent") {
+    console.warn(
+      `[vault] users.credential_item_holdings is not on this database (${holdings.why}); the empty-read alarm falls back to the whole-vault rule until ${HOLDINGS_DOOR_MIGRATION} is applied.`
+    );
+    return staleAlarm(total);
+  }
+  return `${staleAlarm(total)} (The check that tells an empty credential from an unreadable one did not answer either: ${holdings.why})`;
+}
 export {
   CATEGORIES,
   CONFIRM_RETURN_KEY,
   DEFAULT_LOCATION,
   GenerateButton,
   HIDDEN_ITEM_TAG,
+  HOLDINGS_DOOR_MIGRATION,
   IdentityGate,
   LOCKED_MESSAGE,
   VaultApp,
@@ -9877,7 +10037,9 @@ export {
   createApiVaultPort,
   createSupabaseIdentity,
   createVaultKnobs,
+  emptyReadAlarm,
   guardPort,
+  holdingsDoorIsAbsent,
   inferFromUrl,
   isHiddenItem,
   itemIdAt,