@ai-matrx/vault 0.1.27 → 0.1.29

package/dist/index.js

@@ -101,8 +101,8 @@ var init_keepass_xml_worker_client = __esm({
 });
 
 // src/VaultApp.tsx
-import { useCallback as useCallback5, useEffect as useEffect23, useMemo as useMemo6, useRef as useRef19, useState as useState41 } from "react";
-import { DropdownMenu as DropdownMenu6, DropdownMenuContent as DropdownMenuContent6, DropdownMenuItem as DropdownMenuItem6, DropdownMenuTrigger as DropdownMenuTrigger6, LookScope } from "@ai-matrx/design-system";
+import { useCallback as useCallback5, useEffect as useEffect23, useMemo as useMemo6, useRef as useRef19, useState as useState41, useSyncExternalStore as useSyncExternalStore5 } from "react";
+import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuContent5, DropdownMenuItem as DropdownMenuItem5, DropdownMenuTrigger as DropdownMenuTrigger5, LookScope } from "@ai-matrx/design-system";
 import { Button as Button34, SearchField as SearchField4, Select as Select12 } from "@ai-matrx/design-system/controls";
 import { confirm as confirm14 } from "@ai-matrx/kit/confirm-opener";
 
@@ -119,8 +119,8 @@ async function copyValue(text, label, options, deps) {
   const secret = options.secret ?? true;
   if (deps.clipboard) {
     try {
-      await deps.clipboard.copy(text, { secret });
-      deps.notify(`${label} copied`, "success");
+      const copied = await deps.clipboard.copy(text, { secret });
+      deps.notify(copiedLine(label, copied?.clearsAtMs ?? null), "success");
       return true;
     } catch (e) {
       deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, "error");
@@ -129,6 +129,11 @@ async function copyValue(text, label, options, deps) {
   }
   return copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === "error" ? "error" : "success") });
 }
+function copiedLine(label, clearsAtMs) {
+  if (clearsAtMs === null || !Number.isFinite(clearsAtMs)) return `${label} copied`;
+  const at = new Date(clearsAtMs).toLocaleTimeString(void 0, { hour: "numeric", minute: "2-digit" });
+  return `${label} copied. Clears at ${at}`;
+}
 var ClipboardCtx = createContext(void 0);
 function ClipboardProvider({ clipboard, children }) {
   return /* @__PURE__ */ jsx(ClipboardCtx.Provider, { value: clipboard, children });
@@ -576,6 +581,17 @@ function useElementWidth(ref) {
   }, [ref]);
   return width;
 }
+function useDisposable(create, deps) {
+  const [held, setHeld] = useState3(null);
+  const make = useRef3(create);
+  make.current = create;
+  useEffect3(() => {
+    const made = make.current();
+    setHeld(made);
+    return () => made.dispose();
+  }, deps);
+  return held;
+}
 
 // src/ui.tsx
 import { createContext as createContext4, useContext as useContext4, useEffect as useEffect4, useState as useState4 } from "react";
@@ -2637,9 +2653,12 @@ function normalizeLoginUrl(input) {
     return null;
   }
 }
+function normalizeLoginUrls(inputs) {
+  return inputs.map((u) => u.trim()).filter(Boolean).map((u) => normalizeLoginUrl(u) ?? u);
+}
 function describeDestination(r) {
   if (r.state === "reachable") return { url: r.normalizedUrl, state: r.state, tone: "success", message: "Website confirmed" };
-  if (r.state === "invalid") return { url: r.normalizedUrl, state: r.state, tone: "destructive", message: "Not a public website" };
+  if (r.state === "invalid") return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Not a public website. You can still save it." };
   if (r.state === "not_found") return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Site answered, but this page was not found" };
   return { url: r.normalizedUrl, state: r.state, tone: "warning", message: "Couldn\u2019t confirm it. You can still save it." };
 }
@@ -3123,6 +3142,27 @@ function importLimitsFrom(resolved) {
   return out;
 }
 
+// src/knobs.ts
+import { createKnobReader } from "@ai-matrx/data/knobs";
+var FRESH_MS = 6e4;
+function createVaultKnobs(client, address) {
+  const reader = createKnobReader(client);
+  let kept = null;
+  return async () => {
+    if (kept && Date.now() - kept.at < FRESH_MS) return kept.resolved;
+    const snap = await reader.snapshot(address);
+    kept = { at: Date.now(), resolved: snap.resolved };
+    return snap.resolved;
+  };
+}
+var REVEAL_SECONDS_KNOB = "desktop.vault.reveal_hide_seconds";
+var BACKUP_PASSPHRASE_MIN_KNOB = "desktop.vault.backup_passphrase_min_length";
+function positiveKnob(resolved, key) {
+  const v = resolved[key];
+  const n = typeof v === "string" && v.trim() !== "" ? Number(v) : v;
+  return typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : null;
+}
+
 // src/lock.ts
 import { useSyncExternalStore as useSyncExternalStore2 } from "react";
 var LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
@@ -3318,7 +3358,8 @@ function Omissions({ omissions, accepted, onAccepted, verb }) {
     /* @__PURE__ */ jsx17(VaultRow, { label: "Accept", hint: `${verb} without these`, children: /* @__PURE__ */ jsx17(Switch3, { checked: accepted, onCheckedChange: onAccepted, "aria-label": `${verb} without these` }) })
   ] });
 }
-function BackupPanel({ port, items, onClose, onChanged }) {
+function BackupPanel({ port, host, items, onClose, onChanged }) {
+  const minLength = passphraseMinimum(host.backupPassphraseMinLength);
   const confirmed = useConfirmed();
   const fileInput = useRef11(null);
   const abort = useRef11(null);
@@ -3373,7 +3414,7 @@ function BackupPanel({ port, items, onClose, onChanged }) {
     setAccepted(false);
   });
   const downloadBackup = () => guarded(async () => {
-    if (!backup) return;
+    if (!backup || tooShort(passphrase, minLength)) return;
     const bytes2 = await confirmed(() => port.io.downloadBackup({ itemIds: [...selected], revision: backup.revision, passphrase, acceptOmissions: accepted }));
     downloadFile(BACKUP_FILENAME, bytes2, "application/octet-stream");
     setPassphrase("");
@@ -3420,10 +3461,11 @@ function BackupPanel({ port, items, onClose, onChanged }) {
   };
   const retryable = (result?.retryable_failure ?? 0) > 0;
   const mismatch = repeat !== "" && repeat !== passphrase;
+  const short = passphrase !== "" && tooShort(passphrase, minLength);
   const names = new Map(restorePreview?.records.map((r) => [r.source_item_id, r.display_name]) ?? []);
   const footer = mode === "backup" ? /* @__PURE__ */ jsxs16(Fragment10, { children: [
     /* @__PURE__ */ jsx17(Button13, { variant: "quiet", onClick: onClose, children: "Close" }),
-    backup ? /* @__PURE__ */ jsx17(Button13, { variant: "primary", disabled: busy || !passphrase || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
+    backup ? /* @__PURE__ */ jsx17(Button13, { variant: "primary", disabled: busy || !passphrase || short || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
       "Review ",
       selected.size
     ] })
@@ -3470,7 +3512,14 @@ function BackupPanel({ port, items, onClose, onChanged }) {
         /* @__PURE__ */ jsx17(Summary, { value: backup }),
         /* @__PURE__ */ jsx17(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
         /* @__PURE__ */ jsxs16(VaultSection, { children: [
-          /* @__PURE__ */ jsx17(VaultRow, { label: "Passphrase", hint: "Not saved. It can't be recovered.", children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) }),
+          /* @__PURE__ */ jsx17(VaultRow, { label: "Passphrase", hint: minLength ? `At least ${minLength} characters. Not saved.` : "Not saved. It can't be recovered.", children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", "aria-invalid": short || void 0, onChange: (e) => setPassphrase(e.target.value) }) }),
+          short ? /* @__PURE__ */ jsxs16("p", { role: "alert", className: "px-1 text-xs text-destructive", "data-passphrase-too-short": "", children: [
+            "Use at least ",
+            minLength,
+            " characters. This one has ",
+            passphrase.length,
+            "."
+          ] }) : null,
           /* @__PURE__ */ jsx17(VaultRow, { label: "Repeat", ...mismatch ? { hint: "Doesn't match" } : {}, children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: repeat, autoComplete: "new-password", "aria-label": "Repeat the passphrase", onChange: (e) => setRepeat(e.target.value) }) })
         ] })
       ] }) : null
@@ -3503,6 +3552,12 @@ function BackupPanel({ port, items, onClose, onChanged }) {
     /* @__PURE__ */ jsx17(ErrorLine, { message: error })
   ] });
 }
+function passphraseMinimum(given) {
+  return given !== void 0 && Number.isFinite(given) && given > 1 ? Math.floor(given) : null;
+}
+function tooShort(passphrase, minLength) {
+  return minLength !== null && [...passphrase].length < minLength;
+}
 
 // src/io/ExportPanel.tsx
 import { useMemo, useState as useState18 } from "react";
@@ -5345,6 +5400,40 @@ function AssignResult({ sent, onAnother, onDone }) {
   ] });
 }
 
+// src/lists/turn-back-on.ts
+async function turnBackOn(port, item, fields, options = {}) {
+  const run = options.run ?? ((op) => op());
+  const done = [];
+  if (item.turnedOff) {
+    await run(() => port.fields.updateItem(item, { active: true }));
+    done.push("the item");
+  }
+  let n = 0;
+  for (const f of fields) {
+    if (f.active) continue;
+    await run(() => port.fields.updateField(item, f.id, { active: true }));
+    n += 1;
+  }
+  if (n) done.push(n === 1 ? "1 field" : `${n} fields`);
+  if (fields.some((f) => f.key === OTP_SEED_KEY)) {
+    const codes = await port.authenticator.get(item);
+    if (codes && !codes.enabled) {
+      await run(() => port.authenticator.setEnabled(item, true));
+      done.push("one-time codes");
+    }
+  }
+  if (options.browserFill && !item.browserFillEnabled && item.loginUrls.length > 0) {
+    await run(() => port.fields.updateItem(item, { browserFillEnabled: true }));
+    done.push("browser fill");
+  }
+  return done;
+}
+function turnedOnSentence(done) {
+  if (done.length === 0) return "Nothing here was off.";
+  const list = done.length === 1 ? done[0] : `${done.slice(0, -1).join(", ")} and ${done[done.length - 1]}`;
+  return `Turned on ${list}.`;
+}
+
 // src/ItemPane.tsx
 import { HistoryIcon, SettingsIcon, UsersIcon as UsersIcon2 } from "@ai-matrx/design-system/icons";
 import { dropKeptDraft, keepDraft, readKeptDraft } from "@ai-matrx/kit/drafts";
@@ -5926,6 +6015,9 @@ import { Fragment as Fragment18, jsx as jsx27, jsxs as jsxs25 } from "react/jsx-
 var ENV_VALUE_KEY = "env_value";
 var secureNoteDraft = () => ({ key: SECURE_NOTE_KEY, label: "Secure note", value: "", multiline: true, description: "Encrypted notes" });
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
+function confirmDelete(item) {
+  return confirm10({ title: `Delete \u201C${item.name}\u201D?`, description: "It moves to Trash. You can restore it from there.", confirmLabel: "Delete", variant: "destructive" });
+}
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
   const confirmed = useConfirmed();
@@ -5958,7 +6050,8 @@ function ItemPane(props) {
   const [showBrowser, setShowBrowser] = useState27(false);
   const [error, setError] = useState27(null);
   const [destinations, setDestinations] = useState27({});
-  const dirty = editing && isDirty(base, draft);
+  const [savedNew, setSavedNew] = useState27(false);
+  const dirty = editing && !savedNew && isDirty(base, draft);
   const declared = definition?.fields ?? [];
   const prev = useRef14(null);
   const paneRef = useRef14(null);
@@ -5981,8 +6074,11 @@ function ItemPane(props) {
     setShowTags(false);
     setShowDescription(false);
     setShowRecovery(false);
+    setSavedNew(false);
   }, [item?.id, mode]);
-  useEffect16(() => onDirty(dirty), [dirty, onDirty]);
+  const onDirtyRef = useRef14(onDirty);
+  onDirtyRef.current = onDirty;
+  useEffect16(() => onDirtyRef.current(dirty), [dirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
   useEffect16(() => {
     if (editing && dirty) keepDraft(keepKey, keptFieldsOf(draft), { basedOn: item?.updatedAt ?? "new" });
@@ -6039,6 +6135,8 @@ function ItemPane(props) {
         const [withCode, n0, enrolled] = await withOtp(r.item, r.notice);
         const [next, n] = await storeQueuedFiles(withCode, n0);
         dropKeptDraft(keepKey);
+        setSavedNew(true);
+        onDirty(false);
         onSaved(next, true, n, enrolled);
       }
     } catch (e) {
@@ -6072,8 +6170,7 @@ function ItemPane(props) {
   }
   async function remove() {
     if (!item) return;
-    const ok = await confirm10({ title: `Delete \u201C${item.name}\u201D?`, description: "It moves to Trash. You can restore it from there.", confirmLabel: "Delete", variant: "destructive" });
-    if (!ok) return;
+    if (!await confirmDelete(item)) return;
     setBusy(true);
     try {
       await port.remove(item);
@@ -6101,12 +6198,7 @@ function ItemPane(props) {
     if (!item) return;
     setError(null);
     try {
-      if (item.turnedOff) await confirmed(() => port.fields.updateItem(item, { active: true }));
-      for (const f of fields) await confirmed(() => port.fields.updateField(item, f.id, { active: true }));
-      if (fields.some((f) => f.key === OTP_SEED_KEY)) {
-        const codes = await port.authenticator.get(item);
-        if (codes && !codes.enabled) await confirmed(() => port.authenticator.setEnabled(item, true));
-      }
+      await turnBackOn(port, item, fields, { run: confirmed });
       onChanged();
     } catch (e) {
       if (!wasCancelled(e)) setError(e instanceof Error ? e.message : "It could not be turned on.");
@@ -6161,7 +6253,7 @@ function ItemPane(props) {
         "Unsaved"
       ] }) : null,
       /* @__PURE__ */ jsx27(Button22, { variant: "quiet", disabled: busy, onClick: () => mode === "new" ? onCancelNew() : onMode("view"), children: dirty ? "Discard" : "Cancel" }),
-      /* @__PURE__ */ jsx27(Button22, { variant: "primary", disabled: busy || sent !== null || draft.name.trim() === "" || mode === "edit" && !dirty || mode === "new" && owner === "person" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(recipient.trim()), onClick: () => void save(), children: mode === "new" && owner === "person" ? "Send" : "Save" })
+      /* @__PURE__ */ jsx27(Button22, { variant: "primary", disabled: busy || savedNew || sent !== null || draft.name.trim() === "" || mode === "edit" && !dirty || mode === "new" && owner === "person" && !/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(recipient.trim()), onClick: () => void save(), children: mode === "new" && owner === "person" ? "Send" : "Save" })
     ] }) : item ? /* @__PURE__ */ jsxs25("div", { className: "flex shrink-0 items-center gap-1", children: [
       host.page && canUseOnSite(item, host.page.url) ? /* @__PURE__ */ jsx27(UseOnSiteButton, { port, item, pageUrl: host.page.url, onChanged: (next) => onChanged(next) }) : null,
       host.fill && item.capabilities.canUse ? /* @__PURE__ */ jsx27(
@@ -6329,7 +6421,8 @@ function ItemPane(props) {
                 else delete next[i];
                 return next;
               });
-              if (r?.url && r.url !== u) setDraft((d) => ({ ...d, loginUrls: d.loginUrls.map((x, j) => j === i && x === u ? r.url : x) }));
+              const stored = r?.url || normalizeLoginUrl(u);
+              if (stored && stored !== u) setDraft((d) => ({ ...d, loginUrls: d.loginUrls.map((x, j) => j === i && x === u ? stored : x) }));
             }),
             onRemove: () => patch({ loginUrls: draft.loginUrls.filter((_, j) => j !== i) }),
             removeLabel: "Remove website"
@@ -6488,7 +6581,7 @@ function subtitleOf(item, withOwner) {
   const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
-function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, actions, showOwner, canSortViewed = false, onRefresh, refreshing = false, rowContextMenu = "package", rowMenuItems, stillLoading, favorites, onToggleFavorite }) {
+function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, actions, showOwner, canSortViewed = false, onRefresh, refreshing = false, rowContextMenu = "package", rowMenuItems, stillLoading, favorites, onToggleFavorite, onItemAction }) {
   const sorts = SORTS2.filter((s) => canSortViewed || s.value !== "viewed");
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
@@ -6509,7 +6602,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     }
   };
   const mixedOwners = showOwner ?? new Set(items.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
-  const row = (i) => /* @__PURE__ */ jsx28(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners, ownContextMenu: rowContextMenu === "package", extra: rowMenuItems, favorite: onToggleFavorite ? { on: favorites?.has(i.id) ?? false, toggle: () => onToggleFavorite(i.id) } : void 0 }, i.id);
+  const row = (i) => /* @__PURE__ */ jsx28(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners, ownContextMenu: rowContextMenu === "package", extra: rowMenuItems, onAction: onItemAction, favorite: onToggleFavorite ? { on: favorites?.has(i.id) ?? false, toggle: () => onToggleFavorite(i.id) } : void 0 }, i.id);
   const sortLabel = sorts.find((s) => s.value === sort)?.label ?? "Name A\u2013Z";
   return /* @__PURE__ */ jsxs26("section", { "aria-label": title, className: "flex h-full min-h-0 flex-col border-r border-border bg-background", children: [
     /* @__PURE__ */ jsxs26("div", { className: "flex flex-col gap-2 px-3 pb-2 pt-3", children: [
@@ -6553,7 +6646,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     ] }) })
   ] });
 }
-function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu, extra, favorite }) {
+function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu, extra, onAction, favorite }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
@@ -6594,11 +6687,12 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
     ...favoriteEntry ? [favoriteEntry] : [],
     { id: "open", kind: "open", label: "Open", onSelect: () => onSelect(item.id) },
     { id: "copy-name", kind: "copy-name", label: "Copy name", onSelect: copyName },
+    ...manageEntries(item, onAction),
     ...hostEntries.map((h) => ({ ...h, kind: h.kind ?? "host" }))
   ];
   const entriesRef = useRef15(entries);
   entriesRef.current = entries;
-  const glyphOf = (e) => e.id === "copy:username" ? /* @__PURE__ */ jsx28(UserGlyph, { className: "size-4" }) : e.id === "copy:password" ? /* @__PURE__ */ jsx28(KeyGlyph, { className: "size-4" }) : e.id === "copy:code" ? /* @__PURE__ */ jsx28(ClockGlyph, { className: "size-4" }) : e.kind === "favorite" ? /* @__PURE__ */ jsx28(StarGlyph, { className: cn13("size-4", favorite?.on && "fill-current text-warning") }) : e.kind === "open" ? /* @__PURE__ */ jsx28(ChevronRightGlyph, { className: "size-4" }) : e.kind === "host" ? null : /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" });
+  const glyphOf = (e) => e.id === "copy:username" ? /* @__PURE__ */ jsx28(UserGlyph, { className: "size-4" }) : e.id === "copy:password" ? /* @__PURE__ */ jsx28(KeyGlyph, { className: "size-4" }) : e.id === "copy:code" ? /* @__PURE__ */ jsx28(ClockGlyph, { className: "size-4" }) : e.kind === "favorite" ? /* @__PURE__ */ jsx28(StarGlyph, { className: cn13("size-4", favorite?.on && "fill-current text-warning") }) : e.kind === "open" ? /* @__PURE__ */ jsx28(ChevronRightGlyph, { className: "size-4" }) : e.kind === "host" || e.kind === "manage" ? null : /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" });
   const menuItem = (e) => /* @__PURE__ */ jsxs26(DropdownMenuItem4, { disabled: e.disabled ?? false, onSelect: e.onSelect, children: [
     glyphOf(e),
     e.label
@@ -6652,6 +6746,8 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
               copyEntries.map(menuItem),
               copyEntries.length > 0 ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
               entries.filter((e) => e.kind === "favorite" || e.kind === "open" || e.kind === "copy-name").map(menuItem),
+              entries.some((e) => e.kind === "manage") ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
+              entries.filter((e) => e.kind === "manage").map(menuItem),
               hostEntries.length > 0 ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
               entries.filter((e) => e.kind === "host").map(menuItem)
             ] })
@@ -6661,6 +6757,17 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
     }
   );
 }
+function manageEntries(item, onAction) {
+  if (!onAction) return [];
+  const canManage = item.capabilities.canManage;
+  const offManage = !canManage && manageUnavailableReason(item) !== null;
+  const run = (action) => () => onAction(item, action);
+  return [
+    { id: "activity", kind: "manage", label: "Activity", onSelect: run("activity") },
+    ...canManage || offManage ? [{ id: "share", kind: "manage", label: "Share", onSelect: run("share"), disabled: !canManage }] : [],
+    ...canManage || offManage ? [{ id: "delete", kind: "manage", label: "Delete", onSelect: run("delete"), disabled: !canManage }] : []
+  ];
+}
 
 // src/lists/TrashView.tsx
 import { useState as useState30 } from "react";
@@ -6741,8 +6848,16 @@ import { useEffect as useEffect18, useState as useState29 } from "react";
 import { Button as Button24 } from "@ai-matrx/design-system/controls";
 import { Fragment as Fragment19, jsx as jsx29, jsxs as jsxs27 } from "react/jsx-runtime";
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
-function RestorePanel({ lists, item, restore, onClose }) {
+function RestorePanel({
+  lists,
+  item,
+  restore,
+  turnOn,
+  onClose
+}) {
   const [preview, setPreview] = useState29(null);
+  const [restored, setRestored] = useState29(null);
+  const [turnedOn, setTurnedOn] = useState29(null);
   const [error, setError] = useState29(null);
   const [busy, setBusy] = useState29(false);
   const [loading, setLoading] = useState29(Boolean(lists.preview));
@@ -6771,13 +6886,54 @@ function RestorePanel({ lists, item, restore, onClose }) {
     setError(null);
     try {
       const result = await restore(preview?.supported ? preview.deletionId : void 0);
-      if (result) onClose();
+      if (!result) return;
+      if (turnOn && !result.alreadyRestored && preview?.supported && !preview.priorWasDisabled) setRestored(result);
+      else onClose();
     } catch (e) {
       setError(e instanceof Error && e.message ? e.message : "Restore did not complete. Try again.");
     } finally {
       setBusy(false);
     }
   };
+  const runTurnOn = async () => {
+    if (!restored || !turnOn) return;
+    setBusy(true);
+    setError(null);
+    try {
+      const said = await turnOn(restored.item);
+      if (said !== null) setTurnedOn(said);
+    } catch (e) {
+      setError(e instanceof Error && e.message ? e.message : "It could not be turned on. Turn it on from the item.");
+    } finally {
+      setBusy(false);
+    }
+  };
+  if (restored) {
+    return /* @__PURE__ */ jsxs27(
+      Panel,
+      {
+        title: `Restored "${item.name}"`,
+        size: "md",
+        onClose,
+        footer: turnedOn ? /* @__PURE__ */ jsx29(Button24, { variant: "primary", onClick: onClose, children: "Done" }) : /* @__PURE__ */ jsxs27(Fragment19, { children: [
+          /* @__PURE__ */ jsx29(Button24, { variant: "quiet", onClick: onClose, children: "Leave off" }),
+          /* @__PURE__ */ jsx29(Button24, { variant: "primary", icon: /* @__PURE__ */ jsx29(RestoreGlyph, {}), disabled: busy, onClick: () => void runTurnOn(), children: busy ? "Turning on\u2026" : "Turn these back on" })
+        ] }),
+        children: [
+          /* @__PURE__ */ jsxs27(VaultSection, { title: turnedOn ? "Turned on" : "Back, turned off", children: [
+            /* @__PURE__ */ jsx29(VaultRow, { label: "Came back", children: /* @__PURE__ */ jsxs27("span", { className: "text-foreground", children: [
+              count(restored.restoredFields, "field"),
+              ", ",
+              count(restored.restoredAttachments, "file")
+            ] }) }),
+            turnedOn ? /* @__PURE__ */ jsx29(VaultRow, { label: "Now on", children: /* @__PURE__ */ jsx29("span", { role: "status", className: "text-foreground", children: turnedOn }) }) : /* @__PURE__ */ jsx29(VaultRow, { label: "Turns on", hint: "One press, nothing else changes", children: /* @__PURE__ */ jsx29("span", { className: "text-muted-foreground", children: "The item, its fields, codes and browser fill" }) }),
+            /* @__PURE__ */ jsx29(VaultRow, { label: "Stays off", hint: "Choose these again yourself", children: /* @__PURE__ */ jsx29("span", { className: "text-muted-foreground", children: "Sharing, sandbox use" }) })
+          ] }),
+          error ? /* @__PURE__ */ jsx29("p", { role: "alert", className: "px-1 text-sm text-destructive", children: error }) : null
+        ]
+      }
+    );
+  }
   return /* @__PURE__ */ jsxs27(
     Panel,
     {
@@ -6818,7 +6974,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
     setMessage(null);
     try {
       const r = await confirmed(() => port.lists.restore(item, deletionId));
-      setMessage({ tone: "ok", text: r.alreadyRestored ? `"${item.name}" was already restored.` : `Restored "${item.name}" with ${r.restoredFields} fields and ${r.restoredAttachments} files. Turn its fields on from the item.` });
+      setMessage({ tone: "ok", text: r.alreadyRestored ? `"${item.name}" was already restored.` : `Restored "${item.name}" with ${r.restoredFields} fields and ${r.restoredAttachments} files, turned off.` });
       onChanged();
       return r;
     } catch (e) {
@@ -6828,6 +6984,19 @@ function TrashView({ port, deleted, query, header, onChanged }) {
       setBusyId(null);
     }
   };
+  const turnOn = async (item) => {
+    try {
+      const done = await turnBackOn(port, item, item.fields, { browserFill: true, run: confirmed });
+      const said = turnedOnSentence(done);
+      setMessage({ tone: "ok", text: `"${item.name}": ${said}` });
+      onChanged();
+      return said;
+    } catch (e) {
+      onChanged();
+      if (wasCancelled(e)) return null;
+      throw e;
+    }
+  };
   return /* @__PURE__ */ jsxs28("div", { className: "flex min-h-0 flex-1 flex-col gap-3 overflow-y-auto p-3", children: [
     header,
     /* @__PURE__ */ jsx30(VaultSection, { title: "Trash", children: shown.length === 0 ? /* @__PURE__ */ jsx30(Empty, { children: deleted.length === 0 ? "The trash is empty." : "Nothing matches." }) : shown.map((item) => (
@@ -6841,7 +7010,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
         /* @__PURE__ */ jsx30(Button25, { variant: "outline", icon: /* @__PURE__ */ jsx30(RestoreGlyph, {}), disabled: busyId !== null || !item.deletion, onClick: () => setRestoring(item), children: "Restore" })
       ] }, item.id)
     )) }),
-    restoring ? /* @__PURE__ */ jsx30(RestorePanel, { lists: port.lists, item: restoring, restore: (deletionId) => restore(restoring, deletionId), onClose: () => setRestoring(null) }) : null,
+    restoring ? /* @__PURE__ */ jsx30(RestorePanel, { lists: port.lists, item: restoring, restore: (deletionId) => restore(restoring, deletionId), turnOn, onClose: () => setRestoring(null) }) : null,
     message2 ? /* @__PURE__ */ jsx30("p", { role: "status", className: message2.tone === "error" ? "px-1 text-sm text-destructive" : "px-1 text-sm text-muted-foreground", children: message2.text }) : null
   ] });
 }
@@ -7806,7 +7975,7 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
 
 // src/extension/PageView.tsx
 import { useState as useState39 } from "react";
-import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuContent5, DropdownMenuItem as DropdownMenuItem5, DropdownMenuTrigger as DropdownMenuTrigger5, SiteIcon } from "@ai-matrx/design-system";
+import { SiteIcon } from "@ai-matrx/design-system";
 import { Button as Button33 } from "@ai-matrx/design-system/controls";
 import { GlobeIcon as GlobeIcon4 } from "@ai-matrx/design-system/icons";
 
@@ -8135,22 +8304,10 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
       ] })
     ] }),
     onFill ? /* @__PURE__ */ jsx38(Button33, { variant: "primary", disabled: busy, "aria-busy": running || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running ? "Filling\u2026" : "Fill" }) : null,
+    onSignIn ? /* @__PURE__ */ jsx38(Button33, { variant: onFill ? "outline" : "primary", icon: /* @__PURE__ */ jsx38(ShieldGlyph, {}), disabled: busy, onClick: onSignIn, "aria-label": `Sign me in with ${item?.name ?? "this login"}`, title: "Sign me in", children: "Sign me in" }) : null,
     user && item ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(UserGlyph, {}), "aria-label": `Copy ${user.label}`, title: `Copy ${user.label}`, disabled: reading, onClick: () => void read(user.label, () => port.reveal(item, user.key)) }) : null,
     secret && item ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(KeyGlyph, {}), "aria-label": "Copy password", title: "Copy password", disabled: reading, onClick: () => void read("Password", () => port.reveal(item, secret.key)) }) : null,
-    otp ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null,
-    onSignIn ? /* @__PURE__ */ jsxs36(DropdownMenu5, { children: [
-      /* @__PURE__ */ jsx38(DropdownMenuTrigger5, { asChild: true, children: /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(MoreGlyph, {}), "aria-label": "More", disabled: busy }) }),
-      /* @__PURE__ */ jsxs36(DropdownMenuContent5, { align: "end", children: [
-        /* @__PURE__ */ jsxs36(DropdownMenuItem5, { onSelect: onSignIn, children: [
-          /* @__PURE__ */ jsx38(ShieldGlyph, { className: "size-4" }),
-          "Sign me in"
-        ] }),
-        /* @__PURE__ */ jsxs36(DropdownMenuItem5, { onSelect: () => onOpen(itemId), children: [
-          /* @__PURE__ */ jsx38(ListGlyph, { className: "size-4" }),
-          "Open item"
-        ] })
-      ] })
-    ] }) : null
+    otp ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null
   ] });
 }
 
@@ -8262,7 +8419,7 @@ function Group({ title, children }) {
     children
   ] });
 }
-function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false }) {
+function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false, onLock, onOpenWeb }) {
   const [tagsOpen, setTagsOpen] = useState40(view.startsWith("tag:"));
   return /* @__PURE__ */ jsxs37("nav", { "aria-label": "Vault", className: "flex h-full min-h-0 flex-col border-r border-sidebar-border bg-sidebar-background text-sidebar-foreground", children: [
     /* @__PURE__ */ jsxs37("div", { className: "flex items-center gap-2 px-3 pb-2 pt-3", children: [
@@ -8301,7 +8458,9 @@ function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, v
         /* @__PURE__ */ jsx39(ShieldGlyph, { className: "size-4 shrink-0" }),
         /* @__PURE__ */ jsx39("span", { className: "min-w-0 flex-1 truncate", children: "System AutoFill" }),
         /* @__PURE__ */ jsx39("span", { className: cn15("text-xs", nativeProvider.status === "ready" ? "text-success" : "text-warning"), children: nativeProvider.status === "ready" ? "On" : "Set up" })
-      ] }) : null
+      ] }) : null,
+      onOpenWeb ? /* @__PURE__ */ jsx39(Entry, { on: false, glyph: ExternalGlyph, label: "Open on the web", onClick: onOpenWeb }) : null,
+      onLock ? /* @__PURE__ */ jsx39(Entry, { on: false, glyph: LockGlyph, label: "Lock", onClick: onLock }) : null
     ] })
   ] });
 }
@@ -8344,12 +8503,42 @@ function ImportWithLimits(props) {
   if (state && "limits" in state) return /* @__PURE__ */ jsx40(ImportPanel, { ...rest, limits: state.limits });
   return /* @__PURE__ */ jsx40(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ jsx40(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
 }
-function VaultApp(props) {
+function VaultApp(given) {
+  const props = { ...given, host: useOrganizationSettings(given.host ?? NO_HOST) };
   const lock = props.host?.lock;
   const locked = useLocked(lock);
   const port = useMemo6(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
   return /* @__PURE__ */ jsx40(LookScope, { look: props.look ?? "web", className: "h-full min-h-0 w-full", children: /* @__PURE__ */ jsx40("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ jsx40(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ jsx40(LockedScreen, { lock }) : /* @__PURE__ */ jsx40(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ jsx40(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ jsx40(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ jsx40(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ jsx40(Workspace, { ...props, port }) }) }) }) }) }) }) });
 }
+function useOrganizationSettings(host) {
+  const knobs = host.knobs;
+  const needs = knobs !== void 0 && (host.revealSeconds === void 0 || host.backupPassphraseMinLength === void 0);
+  const [read, setRead] = useState41(null);
+  useEffect23(() => {
+    if (!needs || !knobs) return;
+    let live = true;
+    knobs().then(
+      (r) => live && setRead({ reveal: positiveKnob(r, REVEAL_SECONDS_KNOB), backupMin: positiveKnob(r, BACKUP_PASSPHRASE_MIN_KNOB) }),
+      () => void 0
+    );
+    return () => {
+      live = false;
+    };
+  }, [needs, knobs]);
+  if (!read) return host;
+  return {
+    ...host,
+    ...host.revealSeconds === void 0 && read.reveal !== null ? { revealSeconds: read.reveal } : {},
+    ...host.backupPassphraseMinLength === void 0 && read.backupMin !== null ? { backupPassphraseMinLength: read.backupMin } : {}
+  };
+}
+var NO_STORE = () => () => void 0;
+var NOTHING = () => null;
+function useHostPrompts(capture, fillSetup) {
+  const prompt = useSyncExternalStore5(capture ? capture.subscribe : NO_STORE, capture ? capture.get : NOTHING, capture ? capture.get : NOTHING);
+  const setup = useSyncExternalStore5(fillSetup ? fillSetup.subscribe : NO_STORE, fillSetup ? fillSetup.get : NOTHING, fillSetup ? fillSetup.get : NOTHING);
+  return prompt !== null || setup?.status === "off";
+}
 function LockedScreen({ lock }) {
   const [busy, setBusy] = useState41(false);
   const [error, setError] = useState41(null);
@@ -8437,6 +8626,16 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     document.addEventListener("keydown", onKey);
     return () => document.removeEventListener("keydown", onKey);
   }, []);
+  const keepSearchFocus = useRef19(false);
+  useEffect23(() => {
+    if (!keepSearchFocus.current) return;
+    keepSearchFocus.current = false;
+    const search = rootRef.current?.querySelector('input[aria-label^="Search"]');
+    if (!search || document.activeElement === search) return;
+    search.focus();
+    search.setSelectionRange(search.value.length, search.value.length);
+  }, [loc.q]);
+  const hasPrompts = useHostPrompts(host.capture, host.fillSetup);
   const knobsRef = useRef19(host.knobs);
   knobsRef.current = host.knobs;
   const [signedOut, setSignedOut] = useState41(false);
@@ -8579,6 +8778,25 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       notify(e instanceof Error ? e.message : "Favorites could not be saved.", "error");
     });
   };
+  const deletedItem = (id) => {
+    setItems((cur) => cur.filter((i) => i.id !== id));
+    dirty.current = false;
+    if (loc.itemId === id) move({ ...loc, itemId: null, mode: "view", panel: null }, "push");
+    notify("Moved to Trash");
+    load();
+  };
+  const rowAction = (item, action) => {
+    if (action !== "delete") return go({ view: loc.view === "page" ? "all" : loc.view, itemId: item.id, mode: "view", panel: action });
+    void confirmDelete(item).then(async (ok) => {
+      if (!ok) return;
+      try {
+        await port.remove(item);
+        deletedItem(item.id);
+      } catch (e) {
+        notify(e instanceof Error && e.message ? e.message : "Deleting failed.", "error");
+      }
+    });
+  };
   if (error) {
     return /* @__PURE__ */ jsxs38("div", { ref: rootRef, role: "alert", className: "flex h-full flex-col items-center justify-center gap-3 bg-background p-6 text-center text-sm", children: [
       /* @__PURE__ */ jsx40(SafeGlyph, { className: "size-8 text-muted-foreground" }),
@@ -8617,38 +8835,38 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         onClick: () => go({ view: loc.view === "authenticator" ? "all" : "authenticator", itemId: null, mode: "view", panel: null })
       }
     ),
-    /* @__PURE__ */ jsxs38(DropdownMenu6, { children: [
-      /* @__PURE__ */ jsx40(DropdownMenuTrigger6, { asChild: true, children: /* @__PURE__ */ jsx40(Button34, { variant: "quiet", icon: /* @__PURE__ */ jsx40(MoreGlyph, {}), "aria-label": "Vault actions" }) }),
-      /* @__PURE__ */ jsxs38(DropdownMenuContent6, { align: "end", children: [
-        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "import" }), children: [
+    /* @__PURE__ */ jsxs38(DropdownMenu5, { children: [
+      /* @__PURE__ */ jsx40(DropdownMenuTrigger5, { asChild: true, children: /* @__PURE__ */ jsx40(Button34, { variant: "quiet", icon: /* @__PURE__ */ jsx40(MoreGlyph, {}), "aria-label": "Vault actions" }) }),
+      /* @__PURE__ */ jsxs38(DropdownMenuContent5, { align: "end", children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "import" }), children: [
           /* @__PURE__ */ jsx40(ImportGlyph, { className: "size-4" }),
           "Import"
         ] }),
-        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "export" }), children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "export" }), children: [
           /* @__PURE__ */ jsx40(ExportGlyph, { className: "size-4" }),
           "Export"
         ] }),
-        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "backup" }), children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "backup" }), children: [
           /* @__PURE__ */ jsx40(SafeGlyph, { className: "size-4" }),
           "Backup"
         ] }),
-        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "devices" }), children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "devices" }), children: [
           /* @__PURE__ */ jsx40(ShieldGlyph, { className: "size-4" }),
           "Browsers that fill"
         ] }),
-        host.nativeImport ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "import-passkeys" }), children: [
+        host.nativeImport ? /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "import-passkeys" }), children: [
           /* @__PURE__ */ jsx40(ImportGlyph, { className: "size-4" }),
           "Import passkeys"
         ] }) : null,
-        host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: host.nativeProvider.openSetup, children: [
+        host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: host.nativeProvider.openSetup, children: [
           /* @__PURE__ */ jsx40(ShieldGlyph, { className: "size-4" }),
           "System AutoFill"
         ] }) : null,
-        host.lock?.lock ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => void host.lock?.lock?.(), children: [
+        host.lock?.lock ? /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => void host.lock?.lock?.(), children: [
           /* @__PURE__ */ jsx40(LockGlyph, { className: "size-4" }),
           "Lock"
         ] }) : null,
-        host.openWebVault ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: host.openWebVault, children: [
+        host.openWebVault ? /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: host.openWebVault, children: [
           /* @__PURE__ */ jsx40(ExternalGlyph, { className: "size-4" }),
           "Open on the web"
         ] }) : null
@@ -8662,6 +8880,27 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       compactActions
     ] })
   ] });
+  const newItem = () => go({ itemId: null, mode: "new", kind: null, panel: null });
+  const pageHeader = /* @__PURE__ */ jsxs38("div", { className: "flex flex-col gap-2", "data-vault-page-header": "", children: [
+    compactHeader,
+    /* @__PURE__ */ jsxs38("div", { className: "flex items-center gap-2", children: [
+      /* @__PURE__ */ jsx40(
+        SearchField4,
+        {
+          value: loc.q,
+          onChange: (e) => {
+            keepSearchFocus.current = true;
+            go({ q: e.target.value }, "replace");
+          },
+          placeholder: "Search the vault",
+          "aria-label": "Search the vault",
+          className: "min-w-0 flex-1"
+        }
+      ),
+      compactActions,
+      /* @__PURE__ */ jsx40(Button34, { variant: "primary", icon: /* @__PURE__ */ jsx40(PlusGlyph, {}), "aria-label": "New item", onClick: newItem })
+    ] })
+  ] });
   const viewProps = { port, host, items: inThisVault, deleted, definitions, query: loc.q, onOpen: (id) => go({ view: "all", itemId: id, mode: "view", panel: null }), onChanged: load, header: viewHeader };
   const pageView = loc.view === "page" && host.page && !loc.q ? /* @__PURE__ */ jsx40(
     PageView,
@@ -8669,8 +8908,6 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       port,
       page: host.page,
       fill: host.fill,
-      capture: host.capture,
-      fillSetup: host.fillSetup,
       newPasswordFields: host.newPasswordFields,
       items: inThisVault,
       definitions,
@@ -8678,10 +8915,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       onNewForPage: (url) => go({ mode: "new", kind: null, url, itemId: null, panel: null }),
       onBrowse: () => go({ view: "all", itemId: null }),
       onChanged: load,
-      ...compactHeader ? { header: /* @__PURE__ */ jsxs38("div", { className: "flex flex-col gap-2", children: [
-        compactHeader,
-        /* @__PURE__ */ jsx40("div", { className: "flex justify-end", children: compactActions })
-      ] }) } : {}
+      header: pageHeader
     }
   ) : null;
   const specialView = pageView ?? (loc.view === "authenticator" ? /* @__PURE__ */ jsx40(AuthenticatorView, { ...viewProps }) : loc.view === "trash" ? /* @__PURE__ */ jsx40(TrashView, { ...viewProps }) : null);
@@ -8696,11 +8930,15 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       selectedId: loc.itemId,
       onSelect: (id) => go({ itemId: id, mode: "view", kind: null, panel: null }),
       query: loc.q,
-      onQuery: (q) => go({ q }, "replace"),
+      onQuery: (q) => {
+        if (loc.view === "page" && host.page && !q) keepSearchFocus.current = true;
+        go({ q }, "replace");
+      },
       sort: loc.sort,
       onSort: (sort) => go({ sort }, "replace"),
       canSortViewed: port.lists.recents !== void 0,
-      onNew: () => go({ itemId: null, mode: "new", kind: null, panel: null }),
+      onNew: newItem,
+      onItemAction: rowAction,
       onRefresh: refresh,
       refreshing,
       ...snap.pending && snap.pending.length > 0 ? { stillLoading: snap.pending } : {},
@@ -8775,13 +9013,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
           setNotice(n);
           notify("Saved");
         },
-        onDeleted: (id) => {
-          setItems((cur) => cur.filter((i) => i.id !== id));
-          dirty.current = false;
-          move({ ...loc, itemId: null, mode: "view", panel: null }, "push");
-          notify("Moved to Trash");
-          load();
-        },
+        onDeleted: deletedItem,
         onDirty: (d) => {
           dirty.current = d;
         },
@@ -8842,6 +9074,13 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       /* @__PURE__ */ jsx40("span", { className: "min-w-0 flex-1 truncate text-warning", title: refreshError, children: "Couldn\u2019t refresh. Showing what was loaded." }),
       /* @__PURE__ */ jsx40("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: refresh, children: "Try again" })
     ] }) : null,
+    hasPrompts ? (
+      // "Save this login?" and "Turn on filling" show above the list in every view, not only "This page".
+      /* @__PURE__ */ jsxs38("div", { className: "flex flex-col gap-3 border-b border-border px-3 py-3", "data-vault-host-prompts": "", children: [
+        host.fillSetup ? /* @__PURE__ */ jsx40(FillSetupCard, { fillSetup: host.fillSetup }) : null,
+        host.capture ? /* @__PURE__ */ jsx40(CaptureCard, { capture: host.capture, onChanged: load }) : null
+      ] })
+    ) : null,
     snap.unavailable.length > 0 ? /* @__PURE__ */ jsxs38("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
       /* @__PURE__ */ jsxs38("span", { className: "min-w-0 flex-1 truncate text-warning", children: [
         "Couldn\u2019t load ",
@@ -8867,7 +9106,9 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
           onPanel: (p) => go({ panel: p }),
           nativeProvider: host.nativeProvider,
           hasNativeImport: host.nativeImport !== void 0,
-          hasPage: host.page !== void 0
+          hasPage: host.page !== void 0,
+          onLock: host.lock?.lock ? () => void host.lock?.lock?.() : void 0,
+          onOpenWeb: host.openWebVault
         }
       ) : null,
       shown.list ? /* @__PURE__ */ jsx40("div", { className: specialView && mode !== "stack" ? "col-span-2 min-h-0" : "min-h-0", children: list }) : null,
@@ -9106,7 +9347,7 @@ function createFieldsPort(ctx) {
       const body = { initiation: "user" };
       if (patch.uriMatchMode !== void 0) body.uri_match_mode = patch.uriMatchMode;
       if (patch.browserFillEnabled !== void 0) body.browser_fill_enabled = patch.browserFillEnabled;
-      if (patch.loginUrls !== void 0) body.login_urls = patch.loginUrls;
+      if (patch.loginUrls !== void 0) body.login_urls = normalizeLoginUrls(patch.loginUrls);
       if (patch.active !== void 0) body.status = patch.active ? "active" : "disabled";
       await account3.updateItem(api, { path: { item_id: item.id }, body }, ctx.optsFor(item));
       return reread(item);
@@ -9118,6 +9359,33 @@ function createFieldsPort(ctx) {
   };
 }
 
+// src/server-reasons.ts
+var GENERIC = [/please check your input/i, /^\s*request failed\s*\(\d+\)\s*$/i, /^\s*bad request\.?\s*$/i, /^\s*HTTP \d+\s*$/i];
+var isGeneric = (s) => GENERIC.some((re) => re.test(s));
+function cleanReason(detail) {
+  const s = detail.replace(/^\s*validation error:\s*/i, "").replace(/^\s*value error,\s*/i, "").trim();
+  return s ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+}
+function serverReason(e) {
+  if (!e || typeof e !== "object") return null;
+  const { status, detail, message: message2 } = e;
+  if (typeof status !== "number" || status < 400 || status >= 500) return null;
+  if (typeof detail !== "string" || !detail.trim() || isGeneric(detail)) return null;
+  const shown = typeof message2 === "string" ? message2 : "";
+  if (shown && !isGeneric(shown)) return null;
+  return cleanReason(detail);
+}
+function withReason(e) {
+  const reason = serverReason(e);
+  if (reason) Object.assign(e, { message: reason, userMessage: reason });
+  return e;
+}
+function withServerReasons(api) {
+  const wrapped = Object.create(api);
+  wrapped.call = (...args) => api.call(...args).catch((e) => Promise.reject(withReason(e)));
+  return wrapped;
+}
+
 // src/io/api.ts
 import * as account4 from "@ai-matrx/api/account";
 var orgOpts = (organizationId) => organizationId ? { organizationId } : void 0;
@@ -9390,7 +9658,7 @@ function createSharingPort(ctx, options = {}) {
           definition_key: definition.key,
           provider_key: definition.providerKey,
           tags: draft.tags,
-          login_urls: draft.loginUrls,
+          login_urls: normalizeLoginUrls(draft.loginUrls),
           notes: draft.notes || null,
           generate_field_key: generateFieldKey,
           initiation: "user",
@@ -9587,7 +9855,8 @@ async function retrying(run, tries = 3) {
     }
   }
 }
-function createApiVaultPort(api, options = {}) {
+function createApiVaultPort(hostApi, options = {}) {
+  const api = withServerReasons(hostApi);
   let defs = /* @__PURE__ */ new Map();
   let auth = /* @__PURE__ */ new Map();
   let orgs = [];
@@ -9742,6 +10011,7 @@ function createApiVaultPort(api, options = {}) {
       const declared = definition.fields;
       const encrypted = declared.filter((f) => f.storage === "encrypted" && (draft.values[f.key] ?? "") !== "");
       const meta = declared.filter((f) => f.storage === "metadata" && (draft.values[f.key] ?? "") !== "");
+      const loginUrls = normalizeLoginUrls(draft.loginUrls);
       const w = await account9.createItem(api, {
         body: {
           display_name: draft.name.trim(),
@@ -9749,10 +10019,10 @@ function createApiVaultPort(api, options = {}) {
           definition_key: definition.key,
           provider_key: definition.providerKey,
           tags: draft.tags,
-          login_urls: draft.loginUrls,
+          login_urls: loginUrls,
           // A login a person saves with its website is offered on that website (the server's own
           // default is off, which made "Save a login" on a page answer "No saved login" there).
-          ...draft.browser ? { uri_match_mode: draft.browser.uriMatchMode, browser_fill_enabled: draft.browser.browserFillEnabled } : draft.loginUrls.length > 0 ? { browser_fill_enabled: true } : {},
+          ...draft.browser ? { uri_match_mode: draft.browser.uriMatchMode, browser_fill_enabled: draft.browser.browserFillEnabled } : loginUrls.length > 0 ? { browser_fill_enabled: true } : {},
           notes: draft.notes || null,
           principal: organizationId ? { type: "organization", organization_id: organizationId } : { type: "user" },
           initiation: "user",
@@ -9779,7 +10049,7 @@ function createApiVaultPort(api, options = {}) {
         else body.description = draft.description.trim();
       }
       if (JSON.stringify(draft.tags) !== JSON.stringify(item.tags)) body.tags = draft.tags;
-      if (JSON.stringify(draft.loginUrls) !== JSON.stringify(item.loginUrls)) body.login_urls = draft.loginUrls;
+      if (JSON.stringify(draft.loginUrls) !== JSON.stringify(item.loginUrls)) body.login_urls = normalizeLoginUrls(draft.loginUrls);
       if (draft.notes !== item.notes) {
         if (draft.notes === "") body.clear_notes = true;
         else body.notes = draft.notes;
@@ -9811,20 +10081,6 @@ function createApiVaultPort(api, options = {}) {
   };
 }
 
-// src/knobs.ts
-import { createKnobReader } from "@ai-matrx/data/knobs";
-var FRESH_MS = 6e4;
-function createVaultKnobs(client, address) {
-  const reader = createKnobReader(client);
-  let kept = null;
-  return async () => {
-    if (kept && Date.now() - kept.at < FRESH_MS) return kept.resolved;
-    const snap = await reader.snapshot(address);
-    kept = { at: Date.now(), resolved: snap.resolved };
-    return snap.resolved;
-  };
-}
-
 // src/agent-context.ts
 var hostOf = (url) => {
   try {
@@ -9892,6 +10148,7 @@ function emptyReadAlarm(total, emptyIds, holdings) {
   return `${staleAlarm(total)} (The check that tells an empty credential from an unreadable one did not answer either: ${holdings.why})`;
 }
 export {
+  BACKUP_PASSPHRASE_MIN_KNOB,
   CATEGORIES,
   CONFIRM_RETURN_KEY,
   DEFAULT_LOCATION,
@@ -9900,9 +10157,11 @@ export {
   HOLDINGS_DOOR_MIGRATION,
   IdentityGate,
   LOCKED_MESSAGE,
+  REVEAL_SECONDS_KNOB,
   VaultApp,
   VaultLockedError,
   categoryOf,
+  copiedLine,
   copyValue,
   createApiVaultPort,
   createSupabaseIdentity,
@@ -9919,11 +10178,13 @@ export {
   matchesQuery,
   needsRecentSignIn,
   parseDefinitions,
+  positiveKnob,
   providerOf,
   rowMenuEntriesAt,
   siteDomainOf,
   sortItems,
   useConfirmed,
+  useDisposable,
   vaultInventoryScope,
   vaultItemFacts,
   wasCancelled