@ai-matrx/vault 0.1.28 → 0.1.29

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.29
+
+- **Lock and Open on the web at every width.** The three-pane sidebar's foot offers **Lock** whenever the host gives `lock.lock`, and **Open on the web** whenever it gives `openWebVault` (before, both lived only in the narrow layout's More menu, so a desktop window 1120px or wider had no manual lock). Guard: `src/no-feature-lost.test.tsx` § D1. Consumer action: none.
+- **"This page" has the list's search row and New.** A "Search the vault" box (so "/" finds), the compact actions and a **New item** button sit above the site on every page, https or not; typing shows the matching list with the cursor kept in the search, clearing it brings the page back. Guard: § E1. Consumer action: none.
+- **Sign me in is a visible button beside Fill** (primary when there is no Fill), never inside a More menu. Guard: § E2. Consumer action: none.
+- **"Save this login?" and "Turn on filling" show above the list in every view**, not only on "This page" (`host.capture`, `host.fillSetup`; `PageView` no longer receives them from `VaultApp`). Guard: § E3. Consumer action: none.
+- **The copied line says when the clipboard clears.** `VaultClipboard.copy` may answer `{ clearsAtMs }` (`VaultCopied`); the vault then says "Password copied. Clears at 3:42 PM" (`copiedLine`). Answering nothing keeps "Password copied". Guard: § D3. **Consumer action:** a host whose clipboard clears a secret later (the desktop) returns main's `clearsAtMs` from `copy`.
+- **Activity, Share and Delete on every row's menu** (`RowMenuEntryKind` `manage`, `ItemList` `onItemAction`, `manageEntries`): Activity and Share open the item's own panels, Delete asks the item's own question (`confirmDelete`) and moves it to Trash; Share and Delete show off when the item says why it cannot be managed. A host's right-click menu reading `rowMenuEntriesAt` may take the `manage` entries too. Guard: § D4. Consumer action: none.
+- **The organization's backup passphrase minimum is enforced.** `host.backupPassphraseMinLength` (else the organization's `desktop.vault/backup_passphrase_min_length`, `BACKUP_PASSPHRASE_MIN_KNOB`, read through `host.knobs`): the Passphrase row says "At least N characters", a shorter one is refused by name and Encrypt and download stays off. Guard: § D5. **Consumer action:** a host that reads the setting itself (the desktop) passes `backupPassphraseMinLength`.
+- **Every host obeys the organization's reveal time.** Without `host.revealSeconds` the vault reads `desktop.vault/reveal_hide_seconds` (`REVEAL_SECONDS_KNOB`) through `host.knobs` (the extension and the website: 30s by default, was the package's 20s). `positiveKnob` reads either. Guard: § E5. Consumer action: none (a host with `knobs` inherits it).
+- **`useDisposable(create, deps)`**: a host object the screen owns, made and disposed in the same effect, so StrictMode's mount → cleanup → mount leaves a live one (a `useMemo` + cleanup-only effect left the first, disposed copy). Guard: § E4/D2. **Consumer action:** extension: make the new-password-fields host with it; desktop: make the vault lock with it.
+
 ## 0.1.28
 
 - **A website typed as a bare domain always saves.** Every bare domain is sent as `https://…` on create, edit, assign and the item settings call, whether or not the server could reach it (an intranet, a site not live yet) (`normalizeLoginUrls`); the Website box shows the `https://` form after leaving it, and "Not a public website. You can still save it." is a warning, never a block. Guard: `src/review-0-1-28.test.tsx` § 1. Consumer action: none.

package/dist/index.cjs

@@ -135,6 +135,7 @@ var init_keepass_xml_worker_client = __esm({
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  BACKUP_PASSPHRASE_MIN_KNOB: () => BACKUP_PASSPHRASE_MIN_KNOB,
   CATEGORIES: () => CATEGORIES,
   CONFIRM_RETURN_KEY: () => CONFIRM_RETURN_KEY,
   DEFAULT_LOCATION: () => DEFAULT_LOCATION,
@@ -143,9 +144,11 @@ __export(src_exports, {
   HOLDINGS_DOOR_MIGRATION: () => HOLDINGS_DOOR_MIGRATION,
   IdentityGate: () => IdentityGate,
   LOCKED_MESSAGE: () => LOCKED_MESSAGE,
+  REVEAL_SECONDS_KNOB: () => REVEAL_SECONDS_KNOB,
   VaultApp: () => VaultApp,
   VaultLockedError: () => VaultLockedError,
   categoryOf: () => categoryOf,
+  copiedLine: () => copiedLine,
   copyValue: () => copyValue,
   createApiVaultPort: () => createApiVaultPort,
   createSupabaseIdentity: () => createSupabaseIdentity,
@@ -162,11 +165,13 @@ __export(src_exports, {
   matchesQuery: () => matchesQuery,
   needsRecentSignIn: () => needsRecentSignIn,
   parseDefinitions: () => parseDefinitions,
+  positiveKnob: () => positiveKnob,
   providerOf: () => providerOf,
   rowMenuEntriesAt: () => rowMenuEntriesAt,
   siteDomainOf: () => siteDomainOf,
   sortItems: () => sortItems,
   useConfirmed: () => useConfirmed,
+  useDisposable: () => useDisposable,
   vaultInventoryScope: () => vaultInventoryScope,
   vaultItemFacts: () => vaultItemFacts,
   wasCancelled: () => wasCancelled
@@ -192,8 +197,8 @@ async function copyValue(text, label, options, deps) {
   const secret = options.secret ?? true;
   if (deps.clipboard) {
     try {
-      await deps.clipboard.copy(text, { secret });
-      deps.notify(`${label} copied`, "success");
+      const copied = await deps.clipboard.copy(text, { secret });
+      deps.notify(copiedLine(label, copied?.clearsAtMs ?? null), "success");
       return true;
     } catch (e) {
       deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, "error");
@@ -202,6 +207,11 @@ async function copyValue(text, label, options, deps) {
   }
   return (0, import_clipboard.copyText)(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === "error" ? "error" : "success") });
 }
+function copiedLine(label, clearsAtMs) {
+  if (clearsAtMs === null || !Number.isFinite(clearsAtMs)) return `${label} copied`;
+  const at = new Date(clearsAtMs).toLocaleTimeString(void 0, { hour: "numeric", minute: "2-digit" });
+  return `${label} copied. Clears at ${at}`;
+}
 var ClipboardCtx = (0, import_react.createContext)(void 0);
 function ClipboardProvider({ clipboard, children }) {
   return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ClipboardCtx.Provider, { value: clipboard, children });
@@ -602,6 +612,17 @@ function useElementWidth(ref) {
   }, [ref]);
   return width;
 }
+function useDisposable(create, deps) {
+  const [held, setHeld] = (0, import_react3.useState)(null);
+  const make = (0, import_react3.useRef)(create);
+  make.current = create;
+  (0, import_react3.useEffect)(() => {
+    const made = make.current();
+    setHeld(made);
+    return () => made.dispose();
+  }, deps);
+  return held;
+}
 
 // src/ui.tsx
 var import_react4 = require("react");
@@ -3149,6 +3170,27 @@ function importLimitsFrom(resolved) {
   return out;
 }
 
+// src/knobs.ts
+var import_knobs = require("@ai-matrx/data/knobs");
+var FRESH_MS = 6e4;
+function createVaultKnobs(client, address) {
+  const reader = (0, import_knobs.createKnobReader)(client);
+  let kept = null;
+  return async () => {
+    if (kept && Date.now() - kept.at < FRESH_MS) return kept.resolved;
+    const snap = await reader.snapshot(address);
+    kept = { at: Date.now(), resolved: snap.resolved };
+    return snap.resolved;
+  };
+}
+var REVEAL_SECONDS_KNOB = "desktop.vault.reveal_hide_seconds";
+var BACKUP_PASSPHRASE_MIN_KNOB = "desktop.vault.backup_passphrase_min_length";
+function positiveKnob(resolved, key) {
+  const v = resolved[key];
+  const n = typeof v === "string" && v.trim() !== "" ? Number(v) : v;
+  return typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : null;
+}
+
 // src/lock.ts
 var import_react16 = require("react");
 var LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
@@ -3344,7 +3386,8 @@ function Omissions({ omissions, accepted, onAccepted, verb }) {
     /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Accept", hint: `${verb} without these`, children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Switch, { checked: accepted, onCheckedChange: onAccepted, "aria-label": `${verb} without these` }) })
   ] });
 }
-function BackupPanel({ port, items, onClose, onChanged }) {
+function BackupPanel({ port, host, items, onClose, onChanged }) {
+  const minLength = passphraseMinimum(host.backupPassphraseMinLength);
   const confirmed = useConfirmed();
   const fileInput = (0, import_react18.useRef)(null);
   const abort = (0, import_react18.useRef)(null);
@@ -3399,7 +3442,7 @@ function BackupPanel({ port, items, onClose, onChanged }) {
     setAccepted(false);
   });
   const downloadBackup = () => guarded(async () => {
-    if (!backup) return;
+    if (!backup || tooShort(passphrase, minLength)) return;
     const bytes2 = await confirmed(() => port.io.downloadBackup({ itemIds: [...selected], revision: backup.revision, passphrase, acceptOmissions: accepted }));
     (0, import_download.downloadFile)(BACKUP_FILENAME, bytes2, "application/octet-stream");
     setPassphrase("");
@@ -3446,10 +3489,11 @@ function BackupPanel({ port, items, onClose, onChanged }) {
   };
   const retryable = (result?.retryable_failure ?? 0) > 0;
   const mismatch = repeat !== "" && repeat !== passphrase;
+  const short = passphrase !== "" && tooShort(passphrase, minLength);
   const names = new Map(restorePreview?.records.map((r) => [r.source_item_id, r.display_name]) ?? []);
   const footer = mode === "backup" ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_jsx_runtime17.Fragment, { children: [
     /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "quiet", onClick: onClose, children: "Close" }),
-    backup ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "primary", disabled: busy || !passphrase || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_controls13.Button, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
+    backup ? /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Button, { variant: "primary", disabled: busy || !passphrase || short || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(import_controls13.Button, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
       "Review ",
       selected.size
     ] })
@@ -3496,7 +3540,14 @@ function BackupPanel({ port, items, onClose, onChanged }) {
         /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Summary, { value: backup }),
         /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
         /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(VaultSection, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Passphrase", hint: "Not saved. It can't be recovered.", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) }),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Passphrase", hint: minLength ? `At least ${minLength} characters. Not saved.` : "Not saved. It can't be recovered.", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", "aria-invalid": short || void 0, onChange: (e) => setPassphrase(e.target.value) }) }),
+          short ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("p", { role: "alert", className: "px-1 text-xs text-destructive", "data-passphrase-too-short": "", children: [
+            "Use at least ",
+            minLength,
+            " characters. This one has ",
+            passphrase.length,
+            "."
+          ] }) : null,
           /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Repeat", ...mismatch ? { hint: "Doesn't match" } : {}, children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: repeat, autoComplete: "new-password", "aria-label": "Repeat the passphrase", onChange: (e) => setRepeat(e.target.value) }) })
         ] })
       ] }) : null
@@ -3529,6 +3580,12 @@ function BackupPanel({ port, items, onClose, onChanged }) {
     /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(ErrorLine, { message: error })
   ] });
 }
+function passphraseMinimum(given) {
+  return given !== void 0 && Number.isFinite(given) && given > 1 ? Math.floor(given) : null;
+}
+function tooShort(passphrase, minLength) {
+  return minLength !== null && [...passphrase].length < minLength;
+}
 
 // src/io/ExportPanel.tsx
 var import_react19 = require("react");
@@ -5986,6 +6043,9 @@ var import_jsx_runtime27 = require("react/jsx-runtime");
 var ENV_VALUE_KEY = "env_value";
 var secureNoteDraft = () => ({ key: SECURE_NOTE_KEY, label: "Secure note", value: "", multiline: true, description: "Encrypted notes" });
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
+function confirmDelete(item) {
+  return (0, import_confirm_opener10.confirm)({ title: `Delete \u201C${item.name}\u201D?`, description: "It moves to Trash. You can restore it from there.", confirmLabel: "Delete", variant: "destructive" });
+}
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
   const confirmed = useConfirmed();
@@ -6138,8 +6198,7 @@ function ItemPane(props) {
   }
   async function remove() {
     if (!item) return;
-    const ok = await (0, import_confirm_opener10.confirm)({ title: `Delete \u201C${item.name}\u201D?`, description: "It moves to Trash. You can restore it from there.", confirmLabel: "Delete", variant: "destructive" });
-    if (!ok) return;
+    if (!await confirmDelete(item)) return;
     setBusy(true);
     try {
       await port.remove(item);
@@ -6550,7 +6609,7 @@ function subtitleOf(item, withOwner) {
   const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
-function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, actions, showOwner, canSortViewed = false, onRefresh, refreshing = false, rowContextMenu = "package", rowMenuItems, stillLoading, favorites, onToggleFavorite }) {
+function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, actions, showOwner, canSortViewed = false, onRefresh, refreshing = false, rowContextMenu = "package", rowMenuItems, stillLoading, favorites, onToggleFavorite, onItemAction }) {
   const sorts = SORTS2.filter((s) => canSortViewed || s.value !== "viewed");
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
@@ -6571,7 +6630,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     }
   };
   const mixedOwners = showOwner ?? new Set(items.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
-  const row = (i) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners, ownContextMenu: rowContextMenu === "package", extra: rowMenuItems, favorite: onToggleFavorite ? { on: favorites?.has(i.id) ?? false, toggle: () => onToggleFavorite(i.id) } : void 0 }, i.id);
+  const row = (i) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners, ownContextMenu: rowContextMenu === "package", extra: rowMenuItems, onAction: onItemAction, favorite: onToggleFavorite ? { on: favorites?.has(i.id) ?? false, toggle: () => onToggleFavorite(i.id) } : void 0 }, i.id);
   const sortLabel = sorts.find((s) => s.value === sort)?.label ?? "Name A\u2013Z";
   return /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("section", { "aria-label": title, className: "flex h-full min-h-0 flex-col border-r border-border bg-background", children: [
     /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: "flex flex-col gap-2 px-3 pb-2 pt-3", children: [
@@ -6615,7 +6674,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     ] }) })
   ] });
 }
-function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu, extra, favorite }) {
+function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu, extra, onAction, favorite }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
@@ -6656,11 +6715,12 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
     ...favoriteEntry ? [favoriteEntry] : [],
     { id: "open", kind: "open", label: "Open", onSelect: () => onSelect(item.id) },
     { id: "copy-name", kind: "copy-name", label: "Copy name", onSelect: copyName },
+    ...manageEntries(item, onAction),
     ...hostEntries.map((h) => ({ ...h, kind: h.kind ?? "host" }))
   ];
   const entriesRef = (0, import_react29.useRef)(entries);
   entriesRef.current = entries;
-  const glyphOf = (e) => e.id === "copy:username" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(UserGlyph, { className: "size-4" }) : e.id === "copy:password" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, { className: "size-4" }) : e.id === "copy:code" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ClockGlyph, { className: "size-4" }) : e.kind === "favorite" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(StarGlyph, { className: (0, import_design_system20.cn)("size-4", favorite?.on && "fill-current text-warning") }) : e.kind === "open" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ChevronRightGlyph, { className: "size-4" }) : e.kind === "host" ? null : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_icons12.CopyIcon, { className: "size-4" });
+  const glyphOf = (e) => e.id === "copy:username" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(UserGlyph, { className: "size-4" }) : e.id === "copy:password" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, { className: "size-4" }) : e.id === "copy:code" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ClockGlyph, { className: "size-4" }) : e.kind === "favorite" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(StarGlyph, { className: (0, import_design_system20.cn)("size-4", favorite?.on && "fill-current text-warning") }) : e.kind === "open" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ChevronRightGlyph, { className: "size-4" }) : e.kind === "host" || e.kind === "manage" ? null : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_icons12.CopyIcon, { className: "size-4" });
   const menuItem = (e) => /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { disabled: e.disabled ?? false, onSelect: e.onSelect, children: [
     glyphOf(e),
     e.label
@@ -6714,6 +6774,8 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
               copyEntries.map(menuItem),
               copyEntries.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuSeparator, {}) : null,
               entries.filter((e) => e.kind === "favorite" || e.kind === "open" || e.kind === "copy-name").map(menuItem),
+              entries.some((e) => e.kind === "manage") ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuSeparator, {}) : null,
+              entries.filter((e) => e.kind === "manage").map(menuItem),
               hostEntries.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuSeparator, {}) : null,
               entries.filter((e) => e.kind === "host").map(menuItem)
             ] })
@@ -6723,6 +6785,17 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
     }
   );
 }
+function manageEntries(item, onAction) {
+  if (!onAction) return [];
+  const canManage = item.capabilities.canManage;
+  const offManage = !canManage && manageUnavailableReason(item) !== null;
+  const run = (action) => () => onAction(item, action);
+  return [
+    { id: "activity", kind: "manage", label: "Activity", onSelect: run("activity") },
+    ...canManage || offManage ? [{ id: "share", kind: "manage", label: "Share", onSelect: run("share"), disabled: !canManage }] : [],
+    ...canManage || offManage ? [{ id: "delete", kind: "manage", label: "Delete", onSelect: run("delete"), disabled: !canManage }] : []
+  ];
+}
 
 // src/lists/TrashView.tsx
 var import_react31 = require("react");
@@ -8259,22 +8332,10 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
       ] })
     ] }),
     onFill ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "primary", disabled: busy, "aria-busy": running || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running ? "Filling\u2026" : "Fill" }) : null,
+    onSignIn ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: onFill ? "outline" : "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ShieldGlyph, {}), disabled: busy, onClick: onSignIn, "aria-label": `Sign me in with ${item?.name ?? "this login"}`, title: "Sign me in", children: "Sign me in" }) : null,
     user && item ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(UserGlyph, {}), "aria-label": `Copy ${user.label}`, title: `Copy ${user.label}`, disabled: reading, onClick: () => void read(user.label, () => port.reveal(item, user.key)) }) : null,
     secret && item ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(KeyGlyph, {}), "aria-label": "Copy password", title: "Copy password", disabled: reading, onClick: () => void read("Password", () => port.reveal(item, secret.key)) }) : null,
-    otp ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null,
-    onSignIn ? /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)(import_design_system24.DropdownMenu, { children: [
-      /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_design_system24.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(MoreGlyph, {}), "aria-label": "More", disabled: busy }) }),
-      /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)(import_design_system24.DropdownMenuContent, { align: "end", children: [
-        /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)(import_design_system24.DropdownMenuItem, { onSelect: onSignIn, children: [
-          /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ShieldGlyph, { className: "size-4" }),
-          "Sign me in"
-        ] }),
-        /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)(import_design_system24.DropdownMenuItem, { onSelect: () => onOpen(itemId), children: [
-          /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ListGlyph, { className: "size-4" }),
-          "Open item"
-        ] })
-      ] })
-    ] }) : null
+    otp ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null
   ] });
 }
 
@@ -8386,7 +8447,7 @@ function Group({ title, children }) {
     children
   ] });
 }
-function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false }) {
+function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false, onLock, onOpenWeb }) {
   const [tagsOpen, setTagsOpen] = (0, import_react41.useState)(view.startsWith("tag:"));
   return /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("nav", { "aria-label": "Vault", className: "flex h-full min-h-0 flex-col border-r border-sidebar-border bg-sidebar-background text-sidebar-foreground", children: [
     /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("div", { className: "flex items-center gap-2 px-3 pb-2 pt-3", children: [
@@ -8425,7 +8486,9 @@ function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, v
         /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(ShieldGlyph, { className: "size-4 shrink-0" }),
         /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("span", { className: "min-w-0 flex-1 truncate", children: "System AutoFill" }),
         /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("span", { className: (0, import_design_system25.cn)("text-xs", nativeProvider.status === "ready" ? "text-success" : "text-warning"), children: nativeProvider.status === "ready" ? "On" : "Set up" })
-      ] }) : null
+      ] }) : null,
+      onOpenWeb ? /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Entry, { on: false, glyph: ExternalGlyph, label: "Open on the web", onClick: onOpenWeb }) : null,
+      onLock ? /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Entry, { on: false, glyph: LockGlyph, label: "Lock", onClick: onLock }) : null
     ] })
   ] });
 }
@@ -8468,12 +8531,42 @@ function ImportWithLimits(props) {
   if (state && "limits" in state) return /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(ImportPanel, { ...rest, limits: state.limits });
   return /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
 }
-function VaultApp(props) {
+function VaultApp(given) {
+  const props = { ...given, host: useOrganizationSettings(given.host ?? NO_HOST) };
   const lock = props.host?.lock;
   const locked = useLocked(lock);
   const port = (0, import_react42.useMemo)(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
   return /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(import_design_system26.LookScope, { look: props.look ?? "web", className: "h-full min-h-0 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(LockedScreen, { lock }) : /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(Workspace, { ...props, port }) }) }) }) }) }) }) });
 }
+function useOrganizationSettings(host) {
+  const knobs = host.knobs;
+  const needs = knobs !== void 0 && (host.revealSeconds === void 0 || host.backupPassphraseMinLength === void 0);
+  const [read, setRead] = (0, import_react42.useState)(null);
+  (0, import_react42.useEffect)(() => {
+    if (!needs || !knobs) return;
+    let live = true;
+    knobs().then(
+      (r) => live && setRead({ reveal: positiveKnob(r, REVEAL_SECONDS_KNOB), backupMin: positiveKnob(r, BACKUP_PASSPHRASE_MIN_KNOB) }),
+      () => void 0
+    );
+    return () => {
+      live = false;
+    };
+  }, [needs, knobs]);
+  if (!read) return host;
+  return {
+    ...host,
+    ...host.revealSeconds === void 0 && read.reveal !== null ? { revealSeconds: read.reveal } : {},
+    ...host.backupPassphraseMinLength === void 0 && read.backupMin !== null ? { backupPassphraseMinLength: read.backupMin } : {}
+  };
+}
+var NO_STORE = () => () => void 0;
+var NOTHING = () => null;
+function useHostPrompts(capture, fillSetup) {
+  const prompt = (0, import_react42.useSyncExternalStore)(capture ? capture.subscribe : NO_STORE, capture ? capture.get : NOTHING, capture ? capture.get : NOTHING);
+  const setup = (0, import_react42.useSyncExternalStore)(fillSetup ? fillSetup.subscribe : NO_STORE, fillSetup ? fillSetup.get : NOTHING, fillSetup ? fillSetup.get : NOTHING);
+  return prompt !== null || setup?.status === "off";
+}
 function LockedScreen({ lock }) {
   const [busy, setBusy] = (0, import_react42.useState)(false);
   const [error, setError] = (0, import_react42.useState)(null);
@@ -8561,6 +8654,16 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     document.addEventListener("keydown", onKey);
     return () => document.removeEventListener("keydown", onKey);
   }, []);
+  const keepSearchFocus = (0, import_react42.useRef)(false);
+  (0, import_react42.useEffect)(() => {
+    if (!keepSearchFocus.current) return;
+    keepSearchFocus.current = false;
+    const search = rootRef.current?.querySelector('input[aria-label^="Search"]');
+    if (!search || document.activeElement === search) return;
+    search.focus();
+    search.setSelectionRange(search.value.length, search.value.length);
+  }, [loc.q]);
+  const hasPrompts = useHostPrompts(host.capture, host.fillSetup);
   const knobsRef = (0, import_react42.useRef)(host.knobs);
   knobsRef.current = host.knobs;
   const [signedOut, setSignedOut] = (0, import_react42.useState)(false);
@@ -8703,6 +8806,25 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       notify(e instanceof Error ? e.message : "Favorites could not be saved.", "error");
     });
   };
+  const deletedItem = (id) => {
+    setItems((cur) => cur.filter((i) => i.id !== id));
+    dirty.current = false;
+    if (loc.itemId === id) move({ ...loc, itemId: null, mode: "view", panel: null }, "push");
+    notify("Moved to Trash");
+    load();
+  };
+  const rowAction = (item, action) => {
+    if (action !== "delete") return go({ view: loc.view === "page" ? "all" : loc.view, itemId: item.id, mode: "view", panel: action });
+    void confirmDelete(item).then(async (ok) => {
+      if (!ok) return;
+      try {
+        await port.remove(item);
+        deletedItem(item.id);
+      } catch (e) {
+        notify(e instanceof Error && e.message ? e.message : "Deleting failed.", "error");
+      }
+    });
+  };
   if (error) {
     return /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { ref: rootRef, role: "alert", className: "flex h-full flex-col items-center justify-center gap-3 bg-background p-6 text-center text-sm", children: [
       /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(SafeGlyph, { className: "size-8 text-muted-foreground" }),
@@ -8786,6 +8908,27 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       compactActions
     ] })
   ] });
+  const newItem = () => go({ itemId: null, mode: "new", kind: null, panel: null });
+  const pageHeader = /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { className: "flex flex-col gap-2", "data-vault-page-header": "", children: [
+    compactHeader,
+    /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { className: "flex items-center gap-2", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(
+        import_controls35.SearchField,
+        {
+          value: loc.q,
+          onChange: (e) => {
+            keepSearchFocus.current = true;
+            go({ q: e.target.value }, "replace");
+          },
+          placeholder: "Search the vault",
+          "aria-label": "Search the vault",
+          className: "min-w-0 flex-1"
+        }
+      ),
+      compactActions,
+      /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(import_controls35.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(PlusGlyph, {}), "aria-label": "New item", onClick: newItem })
+    ] })
+  ] });
   const viewProps = { port, host, items: inThisVault, deleted, definitions, query: loc.q, onOpen: (id) => go({ view: "all", itemId: id, mode: "view", panel: null }), onChanged: load, header: viewHeader };
   const pageView = loc.view === "page" && host.page && !loc.q ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(
     PageView,
@@ -8793,8 +8936,6 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       port,
       page: host.page,
       fill: host.fill,
-      capture: host.capture,
-      fillSetup: host.fillSetup,
       newPasswordFields: host.newPasswordFields,
       items: inThisVault,
       definitions,
@@ -8802,10 +8943,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       onNewForPage: (url) => go({ mode: "new", kind: null, url, itemId: null, panel: null }),
       onBrowse: () => go({ view: "all", itemId: null }),
       onChanged: load,
-      ...compactHeader ? { header: /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { className: "flex flex-col gap-2", children: [
-        compactHeader,
-        /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("div", { className: "flex justify-end", children: compactActions })
-      ] }) } : {}
+      header: pageHeader
     }
   ) : null;
   const specialView = pageView ?? (loc.view === "authenticator" ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(AuthenticatorView, { ...viewProps }) : loc.view === "trash" ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(TrashView, { ...viewProps }) : null);
@@ -8820,11 +8958,15 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       selectedId: loc.itemId,
       onSelect: (id) => go({ itemId: id, mode: "view", kind: null, panel: null }),
       query: loc.q,
-      onQuery: (q) => go({ q }, "replace"),
+      onQuery: (q) => {
+        if (loc.view === "page" && host.page && !q) keepSearchFocus.current = true;
+        go({ q }, "replace");
+      },
       sort: loc.sort,
       onSort: (sort) => go({ sort }, "replace"),
       canSortViewed: port.lists.recents !== void 0,
-      onNew: () => go({ itemId: null, mode: "new", kind: null, panel: null }),
+      onNew: newItem,
+      onItemAction: rowAction,
       onRefresh: refresh,
       refreshing,
       ...snap.pending && snap.pending.length > 0 ? { stillLoading: snap.pending } : {},
@@ -8899,13 +9041,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
           setNotice(n);
           notify("Saved");
         },
-        onDeleted: (id) => {
-          setItems((cur) => cur.filter((i) => i.id !== id));
-          dirty.current = false;
-          move({ ...loc, itemId: null, mode: "view", panel: null }, "push");
-          notify("Moved to Trash");
-          load();
-        },
+        onDeleted: deletedItem,
         onDirty: (d) => {
           dirty.current = d;
         },
@@ -8966,6 +9102,13 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("span", { className: "min-w-0 flex-1 truncate text-warning", title: refreshError, children: "Couldn\u2019t refresh. Showing what was loaded." }),
       /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: refresh, children: "Try again" })
     ] }) : null,
+    hasPrompts ? (
+      // "Save this login?" and "Turn on filling" show above the list in every view, not only "This page".
+      /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { className: "flex flex-col gap-3 border-b border-border px-3 py-3", "data-vault-host-prompts": "", children: [
+        host.fillSetup ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(FillSetupCard, { fillSetup: host.fillSetup }) : null,
+        host.capture ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(CaptureCard, { capture: host.capture, onChanged: load }) : null
+      ] })
+    ) : null,
     snap.unavailable.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
       /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("span", { className: "min-w-0 flex-1 truncate text-warning", children: [
         "Couldn\u2019t load ",
@@ -8991,7 +9134,9 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
           onPanel: (p) => go({ panel: p }),
           nativeProvider: host.nativeProvider,
           hasNativeImport: host.nativeImport !== void 0,
-          hasPage: host.page !== void 0
+          hasPage: host.page !== void 0,
+          onLock: host.lock?.lock ? () => void host.lock?.lock?.() : void 0,
+          onOpenWeb: host.openWebVault
         }
       ) : null,
       shown.list ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("div", { className: specialView && mode !== "stack" ? "col-span-2 min-h-0" : "min-h-0", children: list }) : null,
@@ -9964,20 +10109,6 @@ function createApiVaultPort(hostApi, options = {}) {
   };
 }
 
-// src/knobs.ts
-var import_knobs = require("@ai-matrx/data/knobs");
-var FRESH_MS = 6e4;
-function createVaultKnobs(client, address) {
-  const reader = (0, import_knobs.createKnobReader)(client);
-  let kept = null;
-  return async () => {
-    if (kept && Date.now() - kept.at < FRESH_MS) return kept.resolved;
-    const snap = await reader.snapshot(address);
-    kept = { at: Date.now(), resolved: snap.resolved };
-    return snap.resolved;
-  };
-}
-
 // src/agent-context.ts
 var hostOf = (url) => {
   try {