@ai-matrx/vault 0.1.27 → 0.1.29

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.1.29
+
+- **Lock and Open on the web at every width.** The three-pane sidebar's foot offers **Lock** whenever the host gives `lock.lock`, and **Open on the web** whenever it gives `openWebVault` (before, both lived only in the narrow layout's More menu, so a desktop window 1120px or wider had no manual lock). Guard: `src/no-feature-lost.test.tsx` § D1. Consumer action: none.
+- **"This page" has the list's search row and New.** A "Search the vault" box (so "/" finds), the compact actions and a **New item** button sit above the site on every page, https or not; typing shows the matching list with the cursor kept in the search, clearing it brings the page back. Guard: § E1. Consumer action: none.
+- **Sign me in is a visible button beside Fill** (primary when there is no Fill), never inside a More menu. Guard: § E2. Consumer action: none.
+- **"Save this login?" and "Turn on filling" show above the list in every view**, not only on "This page" (`host.capture`, `host.fillSetup`; `PageView` no longer receives them from `VaultApp`). Guard: § E3. Consumer action: none.
+- **The copied line says when the clipboard clears.** `VaultClipboard.copy` may answer `{ clearsAtMs }` (`VaultCopied`); the vault then says "Password copied. Clears at 3:42 PM" (`copiedLine`). Answering nothing keeps "Password copied". Guard: § D3. **Consumer action:** a host whose clipboard clears a secret later (the desktop) returns main's `clearsAtMs` from `copy`.
+- **Activity, Share and Delete on every row's menu** (`RowMenuEntryKind` `manage`, `ItemList` `onItemAction`, `manageEntries`): Activity and Share open the item's own panels, Delete asks the item's own question (`confirmDelete`) and moves it to Trash; Share and Delete show off when the item says why it cannot be managed. A host's right-click menu reading `rowMenuEntriesAt` may take the `manage` entries too. Guard: § D4. Consumer action: none.
+- **The organization's backup passphrase minimum is enforced.** `host.backupPassphraseMinLength` (else the organization's `desktop.vault/backup_passphrase_min_length`, `BACKUP_PASSPHRASE_MIN_KNOB`, read through `host.knobs`): the Passphrase row says "At least N characters", a shorter one is refused by name and Encrypt and download stays off. Guard: § D5. **Consumer action:** a host that reads the setting itself (the desktop) passes `backupPassphraseMinLength`.
+- **Every host obeys the organization's reveal time.** Without `host.revealSeconds` the vault reads `desktop.vault/reveal_hide_seconds` (`REVEAL_SECONDS_KNOB`) through `host.knobs` (the extension and the website: 30s by default, was the package's 20s). `positiveKnob` reads either. Guard: § E5. Consumer action: none (a host with `knobs` inherits it).
+- **`useDisposable(create, deps)`**: a host object the screen owns, made and disposed in the same effect, so StrictMode's mount → cleanup → mount leaves a live one (a `useMemo` + cleanup-only effect left the first, disposed copy). Guard: § E4/D2. **Consumer action:** extension: make the new-password-fields host with it; desktop: make the vault lock with it.
+
+## 0.1.28
+
+- **A website typed as a bare domain always saves.** Every bare domain is sent as `https://…` on create, edit, assign and the item settings call, whether or not the server could reach it (an intranet, a site not live yet) (`normalizeLoginUrls`); the Website box shows the `https://` form after leaving it, and "Not a public website. You can still save it." is a warning, never a block. Guard: `src/review-0-1-28.test.tsx` § 1. Consumer action: none.
+- **Every vault refusal shows the server's reason.** `createApiVaultPort` wraps the host's `Api` once (`withServerReasons`): a 4xx whose sentence is generic ("Invalid request. Please check your input and try again.") is re-worded, on the same error object, with the server's own reason ("Login URL must start with https:// or http://…"), so every action inherits it. Guard: § 1. Consumer action: none.
+- **A restored item turns back on in one press.** Restore still comes back as the server's quarantine (item, fields, codes, browser fill and sandbox use off; shares never recreated). The restore result now offers **Turn these back on**: it turns on the item, its fields, its one-time codes and browser fill (when it has a website), then says what it turned on; sharing and sandbox use stay the person's choice (`RestorePanel turnOn`, `turnBackOn`, `turnedOnSentence`; the item's own Turn on uses the same `turnBackOn`). Not offered when the item was already off before it was deleted. Guard: § 2. Consumer action: none.
+- **The first save of a new item leaves the form clean.** Once create resolves the pane reports clean and Save is off, even while a host's address has not moved to the saved item yet (it used to keep "Unsaved" up and ask "Discard your changes?"); `onDirty` is said when it changes, never re-said for a new callback. Guard: § 3. Consumer action: none.
+- Guard for every row copy ending in "<label> copied" or a failure line (refused clipboard, unreadable value): § 4. Consumer action: none.
+
 ## 0.1.27
 
 - **`emptyReadAlarm`, `holdingsDoorIsAbsent`, `HOLDINGS_DOOR_MIGRATION` and the `HoldingRow`/`Holdings` types are exported from the root** so the web app can drop its whole-file copy (`features/secrets/empty-read.ts`). Consumer action: none.