@ai-matrx/vault 0.1.28 → 0.1.29

package/dist/index.js

@@ -101,8 +101,8 @@ var init_keepass_xml_worker_client = __esm({
 });
 
 // src/VaultApp.tsx
-import { useCallback as useCallback5, useEffect as useEffect23, useMemo as useMemo6, useRef as useRef19, useState as useState41 } from "react";
-import { DropdownMenu as DropdownMenu6, DropdownMenuContent as DropdownMenuContent6, DropdownMenuItem as DropdownMenuItem6, DropdownMenuTrigger as DropdownMenuTrigger6, LookScope } from "@ai-matrx/design-system";
+import { useCallback as useCallback5, useEffect as useEffect23, useMemo as useMemo6, useRef as useRef19, useState as useState41, useSyncExternalStore as useSyncExternalStore5 } from "react";
+import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuContent5, DropdownMenuItem as DropdownMenuItem5, DropdownMenuTrigger as DropdownMenuTrigger5, LookScope } from "@ai-matrx/design-system";
 import { Button as Button34, SearchField as SearchField4, Select as Select12 } from "@ai-matrx/design-system/controls";
 import { confirm as confirm14 } from "@ai-matrx/kit/confirm-opener";
 
@@ -119,8 +119,8 @@ async function copyValue(text, label, options, deps) {
   const secret = options.secret ?? true;
   if (deps.clipboard) {
     try {
-      await deps.clipboard.copy(text, { secret });
-      deps.notify(`${label} copied`, "success");
+      const copied = await deps.clipboard.copy(text, { secret });
+      deps.notify(copiedLine(label, copied?.clearsAtMs ?? null), "success");
       return true;
     } catch (e) {
       deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, "error");
@@ -129,6 +129,11 @@ async function copyValue(text, label, options, deps) {
   }
   return copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === "error" ? "error" : "success") });
 }
+function copiedLine(label, clearsAtMs) {
+  if (clearsAtMs === null || !Number.isFinite(clearsAtMs)) return `${label} copied`;
+  const at = new Date(clearsAtMs).toLocaleTimeString(void 0, { hour: "numeric", minute: "2-digit" });
+  return `${label} copied. Clears at ${at}`;
+}
 var ClipboardCtx = createContext(void 0);
 function ClipboardProvider({ clipboard, children }) {
   return /* @__PURE__ */ jsx(ClipboardCtx.Provider, { value: clipboard, children });
@@ -576,6 +581,17 @@ function useElementWidth(ref) {
   }, [ref]);
   return width;
 }
+function useDisposable(create, deps) {
+  const [held, setHeld] = useState3(null);
+  const make = useRef3(create);
+  make.current = create;
+  useEffect3(() => {
+    const made = make.current();
+    setHeld(made);
+    return () => made.dispose();
+  }, deps);
+  return held;
+}
 
 // src/ui.tsx
 import { createContext as createContext4, useContext as useContext4, useEffect as useEffect4, useState as useState4 } from "react";
@@ -3126,6 +3142,27 @@ function importLimitsFrom(resolved) {
   return out;
 }
 
+// src/knobs.ts
+import { createKnobReader } from "@ai-matrx/data/knobs";
+var FRESH_MS = 6e4;
+function createVaultKnobs(client, address) {
+  const reader = createKnobReader(client);
+  let kept = null;
+  return async () => {
+    if (kept && Date.now() - kept.at < FRESH_MS) return kept.resolved;
+    const snap = await reader.snapshot(address);
+    kept = { at: Date.now(), resolved: snap.resolved };
+    return snap.resolved;
+  };
+}
+var REVEAL_SECONDS_KNOB = "desktop.vault.reveal_hide_seconds";
+var BACKUP_PASSPHRASE_MIN_KNOB = "desktop.vault.backup_passphrase_min_length";
+function positiveKnob(resolved, key) {
+  const v = resolved[key];
+  const n = typeof v === "string" && v.trim() !== "" ? Number(v) : v;
+  return typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : null;
+}
+
 // src/lock.ts
 import { useSyncExternalStore as useSyncExternalStore2 } from "react";
 var LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
@@ -3321,7 +3358,8 @@ function Omissions({ omissions, accepted, onAccepted, verb }) {
     /* @__PURE__ */ jsx17(VaultRow, { label: "Accept", hint: `${verb} without these`, children: /* @__PURE__ */ jsx17(Switch3, { checked: accepted, onCheckedChange: onAccepted, "aria-label": `${verb} without these` }) })
   ] });
 }
-function BackupPanel({ port, items, onClose, onChanged }) {
+function BackupPanel({ port, host, items, onClose, onChanged }) {
+  const minLength = passphraseMinimum(host.backupPassphraseMinLength);
   const confirmed = useConfirmed();
   const fileInput = useRef11(null);
   const abort = useRef11(null);
@@ -3376,7 +3414,7 @@ function BackupPanel({ port, items, onClose, onChanged }) {
     setAccepted(false);
   });
   const downloadBackup = () => guarded(async () => {
-    if (!backup) return;
+    if (!backup || tooShort(passphrase, minLength)) return;
     const bytes2 = await confirmed(() => port.io.downloadBackup({ itemIds: [...selected], revision: backup.revision, passphrase, acceptOmissions: accepted }));
     downloadFile(BACKUP_FILENAME, bytes2, "application/octet-stream");
     setPassphrase("");
@@ -3423,10 +3461,11 @@ function BackupPanel({ port, items, onClose, onChanged }) {
   };
   const retryable = (result?.retryable_failure ?? 0) > 0;
   const mismatch = repeat !== "" && repeat !== passphrase;
+  const short = passphrase !== "" && tooShort(passphrase, minLength);
   const names = new Map(restorePreview?.records.map((r) => [r.source_item_id, r.display_name]) ?? []);
   const footer = mode === "backup" ? /* @__PURE__ */ jsxs16(Fragment10, { children: [
     /* @__PURE__ */ jsx17(Button13, { variant: "quiet", onClick: onClose, children: "Close" }),
-    backup ? /* @__PURE__ */ jsx17(Button13, { variant: "primary", disabled: busy || !passphrase || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
+    backup ? /* @__PURE__ */ jsx17(Button13, { variant: "primary", disabled: busy || !passphrase || short || passphrase !== repeat || backup.omissions.length > 0 && !accepted, onClick: () => void downloadBackup(), children: "Encrypt and download" }) : /* @__PURE__ */ jsxs16(Button13, { variant: "primary", disabled: busy || selected.size === 0, onClick: () => void reviewBackup(), children: [
       "Review ",
       selected.size
     ] })
@@ -3473,7 +3512,14 @@ function BackupPanel({ port, items, onClose, onChanged }) {
         /* @__PURE__ */ jsx17(Summary, { value: backup }),
         /* @__PURE__ */ jsx17(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
         /* @__PURE__ */ jsxs16(VaultSection, { children: [
-          /* @__PURE__ */ jsx17(VaultRow, { label: "Passphrase", hint: "Not saved. It can't be recovered.", children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", onChange: (e) => setPassphrase(e.target.value) }) }),
+          /* @__PURE__ */ jsx17(VaultRow, { label: "Passphrase", hint: minLength ? `At least ${minLength} characters. Not saved.` : "Not saved. It can't be recovered.", children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", "aria-invalid": short || void 0, onChange: (e) => setPassphrase(e.target.value) }) }),
+          short ? /* @__PURE__ */ jsxs16("p", { role: "alert", className: "px-1 text-xs text-destructive", "data-passphrase-too-short": "", children: [
+            "Use at least ",
+            minLength,
+            " characters. This one has ",
+            passphrase.length,
+            "."
+          ] }) : null,
           /* @__PURE__ */ jsx17(VaultRow, { label: "Repeat", ...mismatch ? { hint: "Doesn't match" } : {}, children: /* @__PURE__ */ jsx17(Field6, { type: "password", value: repeat, autoComplete: "new-password", "aria-label": "Repeat the passphrase", onChange: (e) => setRepeat(e.target.value) }) })
         ] })
       ] }) : null
@@ -3506,6 +3552,12 @@ function BackupPanel({ port, items, onClose, onChanged }) {
     /* @__PURE__ */ jsx17(ErrorLine, { message: error })
   ] });
 }
+function passphraseMinimum(given) {
+  return given !== void 0 && Number.isFinite(given) && given > 1 ? Math.floor(given) : null;
+}
+function tooShort(passphrase, minLength) {
+  return minLength !== null && [...passphrase].length < minLength;
+}
 
 // src/io/ExportPanel.tsx
 import { useMemo, useState as useState18 } from "react";
@@ -5963,6 +6015,9 @@ import { Fragment as Fragment18, jsx as jsx27, jsxs as jsxs25 } from "react/jsx-
 var ENV_VALUE_KEY = "env_value";
 var secureNoteDraft = () => ({ key: SECURE_NOTE_KEY, label: "Secure note", value: "", multiline: true, description: "Encrypted notes" });
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
+function confirmDelete(item) {
+  return confirm10({ title: `Delete \u201C${item.name}\u201D?`, description: "It moves to Trash. You can restore it from there.", confirmLabel: "Delete", variant: "destructive" });
+}
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
   const confirmed = useConfirmed();
@@ -6115,8 +6170,7 @@ function ItemPane(props) {
   }
   async function remove() {
     if (!item) return;
-    const ok = await confirm10({ title: `Delete \u201C${item.name}\u201D?`, description: "It moves to Trash. You can restore it from there.", confirmLabel: "Delete", variant: "destructive" });
-    if (!ok) return;
+    if (!await confirmDelete(item)) return;
     setBusy(true);
     try {
       await port.remove(item);
@@ -6527,7 +6581,7 @@ function subtitleOf(item, withOwner) {
   const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
-function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, actions, showOwner, canSortViewed = false, onRefresh, refreshing = false, rowContextMenu = "package", rowMenuItems, stillLoading, favorites, onToggleFavorite }) {
+function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header, actions, showOwner, canSortViewed = false, onRefresh, refreshing = false, rowContextMenu = "package", rowMenuItems, stillLoading, favorites, onToggleFavorite, onItemAction }) {
   const sorts = SORTS2.filter((s) => canSortViewed || s.value !== "viewed");
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
@@ -6548,7 +6602,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     }
   };
   const mixedOwners = showOwner ?? new Set(items.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
-  const row = (i) => /* @__PURE__ */ jsx28(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners, ownContextMenu: rowContextMenu === "package", extra: rowMenuItems, favorite: onToggleFavorite ? { on: favorites?.has(i.id) ?? false, toggle: () => onToggleFavorite(i.id) } : void 0 }, i.id);
+  const row = (i) => /* @__PURE__ */ jsx28(ListRow, { item: i, family: familyOf2(i.definitionKey), port, on: i.id === selectedId, onSelect, withOwner: mixedOwners, ownContextMenu: rowContextMenu === "package", extra: rowMenuItems, onAction: onItemAction, favorite: onToggleFavorite ? { on: favorites?.has(i.id) ?? false, toggle: () => onToggleFavorite(i.id) } : void 0 }, i.id);
   const sortLabel = sorts.find((s) => s.value === sort)?.label ?? "Name A\u2013Z";
   return /* @__PURE__ */ jsxs26("section", { "aria-label": title, className: "flex h-full min-h-0 flex-col border-r border-border bg-background", children: [
     /* @__PURE__ */ jsxs26("div", { className: "flex flex-col gap-2 px-3 pb-2 pt-3", children: [
@@ -6592,7 +6646,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
     ] }) })
   ] });
 }
-function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu, extra, favorite }) {
+function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu, extra, onAction, favorite }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
@@ -6633,11 +6687,12 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
     ...favoriteEntry ? [favoriteEntry] : [],
     { id: "open", kind: "open", label: "Open", onSelect: () => onSelect(item.id) },
     { id: "copy-name", kind: "copy-name", label: "Copy name", onSelect: copyName },
+    ...manageEntries(item, onAction),
     ...hostEntries.map((h) => ({ ...h, kind: h.kind ?? "host" }))
   ];
   const entriesRef = useRef15(entries);
   entriesRef.current = entries;
-  const glyphOf = (e) => e.id === "copy:username" ? /* @__PURE__ */ jsx28(UserGlyph, { className: "size-4" }) : e.id === "copy:password" ? /* @__PURE__ */ jsx28(KeyGlyph, { className: "size-4" }) : e.id === "copy:code" ? /* @__PURE__ */ jsx28(ClockGlyph, { className: "size-4" }) : e.kind === "favorite" ? /* @__PURE__ */ jsx28(StarGlyph, { className: cn13("size-4", favorite?.on && "fill-current text-warning") }) : e.kind === "open" ? /* @__PURE__ */ jsx28(ChevronRightGlyph, { className: "size-4" }) : e.kind === "host" ? null : /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" });
+  const glyphOf = (e) => e.id === "copy:username" ? /* @__PURE__ */ jsx28(UserGlyph, { className: "size-4" }) : e.id === "copy:password" ? /* @__PURE__ */ jsx28(KeyGlyph, { className: "size-4" }) : e.id === "copy:code" ? /* @__PURE__ */ jsx28(ClockGlyph, { className: "size-4" }) : e.kind === "favorite" ? /* @__PURE__ */ jsx28(StarGlyph, { className: cn13("size-4", favorite?.on && "fill-current text-warning") }) : e.kind === "open" ? /* @__PURE__ */ jsx28(ChevronRightGlyph, { className: "size-4" }) : e.kind === "host" || e.kind === "manage" ? null : /* @__PURE__ */ jsx28(CopyIcon7, { className: "size-4" });
   const menuItem = (e) => /* @__PURE__ */ jsxs26(DropdownMenuItem4, { disabled: e.disabled ?? false, onSelect: e.onSelect, children: [
     glyphOf(e),
     e.label
@@ -6691,6 +6746,8 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
               copyEntries.map(menuItem),
               copyEntries.length > 0 ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
               entries.filter((e) => e.kind === "favorite" || e.kind === "open" || e.kind === "copy-name").map(menuItem),
+              entries.some((e) => e.kind === "manage") ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
+              entries.filter((e) => e.kind === "manage").map(menuItem),
               hostEntries.length > 0 ? /* @__PURE__ */ jsx28(DropdownMenuSeparator4, {}) : null,
               entries.filter((e) => e.kind === "host").map(menuItem)
             ] })
@@ -6700,6 +6757,17 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
     }
   );
 }
+function manageEntries(item, onAction) {
+  if (!onAction) return [];
+  const canManage = item.capabilities.canManage;
+  const offManage = !canManage && manageUnavailableReason(item) !== null;
+  const run = (action) => () => onAction(item, action);
+  return [
+    { id: "activity", kind: "manage", label: "Activity", onSelect: run("activity") },
+    ...canManage || offManage ? [{ id: "share", kind: "manage", label: "Share", onSelect: run("share"), disabled: !canManage }] : [],
+    ...canManage || offManage ? [{ id: "delete", kind: "manage", label: "Delete", onSelect: run("delete"), disabled: !canManage }] : []
+  ];
+}
 
 // src/lists/TrashView.tsx
 import { useState as useState30 } from "react";
@@ -7907,7 +7975,7 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
 
 // src/extension/PageView.tsx
 import { useState as useState39 } from "react";
-import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuContent5, DropdownMenuItem as DropdownMenuItem5, DropdownMenuTrigger as DropdownMenuTrigger5, SiteIcon } from "@ai-matrx/design-system";
+import { SiteIcon } from "@ai-matrx/design-system";
 import { Button as Button33 } from "@ai-matrx/design-system/controls";
 import { GlobeIcon as GlobeIcon4 } from "@ai-matrx/design-system/icons";
 
@@ -8236,22 +8304,10 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
       ] })
     ] }),
     onFill ? /* @__PURE__ */ jsx38(Button33, { variant: "primary", disabled: busy, "aria-busy": running || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running ? "Filling\u2026" : "Fill" }) : null,
+    onSignIn ? /* @__PURE__ */ jsx38(Button33, { variant: onFill ? "outline" : "primary", icon: /* @__PURE__ */ jsx38(ShieldGlyph, {}), disabled: busy, onClick: onSignIn, "aria-label": `Sign me in with ${item?.name ?? "this login"}`, title: "Sign me in", children: "Sign me in" }) : null,
     user && item ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(UserGlyph, {}), "aria-label": `Copy ${user.label}`, title: `Copy ${user.label}`, disabled: reading, onClick: () => void read(user.label, () => port.reveal(item, user.key)) }) : null,
     secret && item ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(KeyGlyph, {}), "aria-label": "Copy password", title: "Copy password", disabled: reading, onClick: () => void read("Password", () => port.reveal(item, secret.key)) }) : null,
-    otp ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null,
-    onSignIn ? /* @__PURE__ */ jsxs36(DropdownMenu5, { children: [
-      /* @__PURE__ */ jsx38(DropdownMenuTrigger5, { asChild: true, children: /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(MoreGlyph, {}), "aria-label": "More", disabled: busy }) }),
-      /* @__PURE__ */ jsxs36(DropdownMenuContent5, { align: "end", children: [
-        /* @__PURE__ */ jsxs36(DropdownMenuItem5, { onSelect: onSignIn, children: [
-          /* @__PURE__ */ jsx38(ShieldGlyph, { className: "size-4" }),
-          "Sign me in"
-        ] }),
-        /* @__PURE__ */ jsxs36(DropdownMenuItem5, { onSelect: () => onOpen(itemId), children: [
-          /* @__PURE__ */ jsx38(ListGlyph, { className: "size-4" }),
-          "Open item"
-        ] })
-      ] })
-    ] }) : null
+    otp ? /* @__PURE__ */ jsx38(Button33, { variant: "quiet", icon: /* @__PURE__ */ jsx38(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null
   ] });
 }
 
@@ -8363,7 +8419,7 @@ function Group({ title, children }) {
     children
   ] });
 }
-function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false }) {
+function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false, onLock, onOpenWeb }) {
   const [tagsOpen, setTagsOpen] = useState40(view.startsWith("tag:"));
   return /* @__PURE__ */ jsxs37("nav", { "aria-label": "Vault", className: "flex h-full min-h-0 flex-col border-r border-sidebar-border bg-sidebar-background text-sidebar-foreground", children: [
     /* @__PURE__ */ jsxs37("div", { className: "flex items-center gap-2 px-3 pb-2 pt-3", children: [
@@ -8402,7 +8458,9 @@ function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, v
         /* @__PURE__ */ jsx39(ShieldGlyph, { className: "size-4 shrink-0" }),
         /* @__PURE__ */ jsx39("span", { className: "min-w-0 flex-1 truncate", children: "System AutoFill" }),
         /* @__PURE__ */ jsx39("span", { className: cn15("text-xs", nativeProvider.status === "ready" ? "text-success" : "text-warning"), children: nativeProvider.status === "ready" ? "On" : "Set up" })
-      ] }) : null
+      ] }) : null,
+      onOpenWeb ? /* @__PURE__ */ jsx39(Entry, { on: false, glyph: ExternalGlyph, label: "Open on the web", onClick: onOpenWeb }) : null,
+      onLock ? /* @__PURE__ */ jsx39(Entry, { on: false, glyph: LockGlyph, label: "Lock", onClick: onLock }) : null
     ] })
   ] });
 }
@@ -8445,12 +8503,42 @@ function ImportWithLimits(props) {
   if (state && "limits" in state) return /* @__PURE__ */ jsx40(ImportPanel, { ...rest, limits: state.limits });
   return /* @__PURE__ */ jsx40(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ jsx40(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
 }
-function VaultApp(props) {
+function VaultApp(given) {
+  const props = { ...given, host: useOrganizationSettings(given.host ?? NO_HOST) };
   const lock = props.host?.lock;
   const locked = useLocked(lock);
   const port = useMemo6(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
   return /* @__PURE__ */ jsx40(LookScope, { look: props.look ?? "web", className: "h-full min-h-0 w-full", children: /* @__PURE__ */ jsx40("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ jsx40(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ jsx40(LockedScreen, { lock }) : /* @__PURE__ */ jsx40(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ jsx40(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ jsx40(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ jsx40(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ jsx40(Workspace, { ...props, port }) }) }) }) }) }) }) });
 }
+function useOrganizationSettings(host) {
+  const knobs = host.knobs;
+  const needs = knobs !== void 0 && (host.revealSeconds === void 0 || host.backupPassphraseMinLength === void 0);
+  const [read, setRead] = useState41(null);
+  useEffect23(() => {
+    if (!needs || !knobs) return;
+    let live = true;
+    knobs().then(
+      (r) => live && setRead({ reveal: positiveKnob(r, REVEAL_SECONDS_KNOB), backupMin: positiveKnob(r, BACKUP_PASSPHRASE_MIN_KNOB) }),
+      () => void 0
+    );
+    return () => {
+      live = false;
+    };
+  }, [needs, knobs]);
+  if (!read) return host;
+  return {
+    ...host,
+    ...host.revealSeconds === void 0 && read.reveal !== null ? { revealSeconds: read.reveal } : {},
+    ...host.backupPassphraseMinLength === void 0 && read.backupMin !== null ? { backupPassphraseMinLength: read.backupMin } : {}
+  };
+}
+var NO_STORE = () => () => void 0;
+var NOTHING = () => null;
+function useHostPrompts(capture, fillSetup) {
+  const prompt = useSyncExternalStore5(capture ? capture.subscribe : NO_STORE, capture ? capture.get : NOTHING, capture ? capture.get : NOTHING);
+  const setup = useSyncExternalStore5(fillSetup ? fillSetup.subscribe : NO_STORE, fillSetup ? fillSetup.get : NOTHING, fillSetup ? fillSetup.get : NOTHING);
+  return prompt !== null || setup?.status === "off";
+}
 function LockedScreen({ lock }) {
   const [busy, setBusy] = useState41(false);
   const [error, setError] = useState41(null);
@@ -8538,6 +8626,16 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     document.addEventListener("keydown", onKey);
     return () => document.removeEventListener("keydown", onKey);
   }, []);
+  const keepSearchFocus = useRef19(false);
+  useEffect23(() => {
+    if (!keepSearchFocus.current) return;
+    keepSearchFocus.current = false;
+    const search = rootRef.current?.querySelector('input[aria-label^="Search"]');
+    if (!search || document.activeElement === search) return;
+    search.focus();
+    search.setSelectionRange(search.value.length, search.value.length);
+  }, [loc.q]);
+  const hasPrompts = useHostPrompts(host.capture, host.fillSetup);
   const knobsRef = useRef19(host.knobs);
   knobsRef.current = host.knobs;
   const [signedOut, setSignedOut] = useState41(false);
@@ -8680,6 +8778,25 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       notify(e instanceof Error ? e.message : "Favorites could not be saved.", "error");
     });
   };
+  const deletedItem = (id) => {
+    setItems((cur) => cur.filter((i) => i.id !== id));
+    dirty.current = false;
+    if (loc.itemId === id) move({ ...loc, itemId: null, mode: "view", panel: null }, "push");
+    notify("Moved to Trash");
+    load();
+  };
+  const rowAction = (item, action) => {
+    if (action !== "delete") return go({ view: loc.view === "page" ? "all" : loc.view, itemId: item.id, mode: "view", panel: action });
+    void confirmDelete(item).then(async (ok) => {
+      if (!ok) return;
+      try {
+        await port.remove(item);
+        deletedItem(item.id);
+      } catch (e) {
+        notify(e instanceof Error && e.message ? e.message : "Deleting failed.", "error");
+      }
+    });
+  };
   if (error) {
     return /* @__PURE__ */ jsxs38("div", { ref: rootRef, role: "alert", className: "flex h-full flex-col items-center justify-center gap-3 bg-background p-6 text-center text-sm", children: [
       /* @__PURE__ */ jsx40(SafeGlyph, { className: "size-8 text-muted-foreground" }),
@@ -8718,38 +8835,38 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         onClick: () => go({ view: loc.view === "authenticator" ? "all" : "authenticator", itemId: null, mode: "view", panel: null })
       }
     ),
-    /* @__PURE__ */ jsxs38(DropdownMenu6, { children: [
-      /* @__PURE__ */ jsx40(DropdownMenuTrigger6, { asChild: true, children: /* @__PURE__ */ jsx40(Button34, { variant: "quiet", icon: /* @__PURE__ */ jsx40(MoreGlyph, {}), "aria-label": "Vault actions" }) }),
-      /* @__PURE__ */ jsxs38(DropdownMenuContent6, { align: "end", children: [
-        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "import" }), children: [
+    /* @__PURE__ */ jsxs38(DropdownMenu5, { children: [
+      /* @__PURE__ */ jsx40(DropdownMenuTrigger5, { asChild: true, children: /* @__PURE__ */ jsx40(Button34, { variant: "quiet", icon: /* @__PURE__ */ jsx40(MoreGlyph, {}), "aria-label": "Vault actions" }) }),
+      /* @__PURE__ */ jsxs38(DropdownMenuContent5, { align: "end", children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "import" }), children: [
           /* @__PURE__ */ jsx40(ImportGlyph, { className: "size-4" }),
           "Import"
         ] }),
-        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "export" }), children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "export" }), children: [
           /* @__PURE__ */ jsx40(ExportGlyph, { className: "size-4" }),
           "Export"
         ] }),
-        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "backup" }), children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "backup" }), children: [
           /* @__PURE__ */ jsx40(SafeGlyph, { className: "size-4" }),
           "Backup"
         ] }),
-        /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "devices" }), children: [
+        /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "devices" }), children: [
           /* @__PURE__ */ jsx40(ShieldGlyph, { className: "size-4" }),
           "Browsers that fill"
         ] }),
-        host.nativeImport ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => go({ panel: "import-passkeys" }), children: [
+        host.nativeImport ? /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => go({ panel: "import-passkeys" }), children: [
           /* @__PURE__ */ jsx40(ImportGlyph, { className: "size-4" }),
           "Import passkeys"
         ] }) : null,
-        host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: host.nativeProvider.openSetup, children: [
+        host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: host.nativeProvider.openSetup, children: [
           /* @__PURE__ */ jsx40(ShieldGlyph, { className: "size-4" }),
           "System AutoFill"
         ] }) : null,
-        host.lock?.lock ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: () => void host.lock?.lock?.(), children: [
+        host.lock?.lock ? /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: () => void host.lock?.lock?.(), children: [
           /* @__PURE__ */ jsx40(LockGlyph, { className: "size-4" }),
           "Lock"
         ] }) : null,
-        host.openWebVault ? /* @__PURE__ */ jsxs38(DropdownMenuItem6, { onSelect: host.openWebVault, children: [
+        host.openWebVault ? /* @__PURE__ */ jsxs38(DropdownMenuItem5, { onSelect: host.openWebVault, children: [
           /* @__PURE__ */ jsx40(ExternalGlyph, { className: "size-4" }),
           "Open on the web"
         ] }) : null
@@ -8763,6 +8880,27 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       compactActions
     ] })
   ] });
+  const newItem = () => go({ itemId: null, mode: "new", kind: null, panel: null });
+  const pageHeader = /* @__PURE__ */ jsxs38("div", { className: "flex flex-col gap-2", "data-vault-page-header": "", children: [
+    compactHeader,
+    /* @__PURE__ */ jsxs38("div", { className: "flex items-center gap-2", children: [
+      /* @__PURE__ */ jsx40(
+        SearchField4,
+        {
+          value: loc.q,
+          onChange: (e) => {
+            keepSearchFocus.current = true;
+            go({ q: e.target.value }, "replace");
+          },
+          placeholder: "Search the vault",
+          "aria-label": "Search the vault",
+          className: "min-w-0 flex-1"
+        }
+      ),
+      compactActions,
+      /* @__PURE__ */ jsx40(Button34, { variant: "primary", icon: /* @__PURE__ */ jsx40(PlusGlyph, {}), "aria-label": "New item", onClick: newItem })
+    ] })
+  ] });
   const viewProps = { port, host, items: inThisVault, deleted, definitions, query: loc.q, onOpen: (id) => go({ view: "all", itemId: id, mode: "view", panel: null }), onChanged: load, header: viewHeader };
   const pageView = loc.view === "page" && host.page && !loc.q ? /* @__PURE__ */ jsx40(
     PageView,
@@ -8770,8 +8908,6 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       port,
       page: host.page,
       fill: host.fill,
-      capture: host.capture,
-      fillSetup: host.fillSetup,
       newPasswordFields: host.newPasswordFields,
       items: inThisVault,
       definitions,
@@ -8779,10 +8915,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       onNewForPage: (url) => go({ mode: "new", kind: null, url, itemId: null, panel: null }),
       onBrowse: () => go({ view: "all", itemId: null }),
       onChanged: load,
-      ...compactHeader ? { header: /* @__PURE__ */ jsxs38("div", { className: "flex flex-col gap-2", children: [
-        compactHeader,
-        /* @__PURE__ */ jsx40("div", { className: "flex justify-end", children: compactActions })
-      ] }) } : {}
+      header: pageHeader
     }
   ) : null;
   const specialView = pageView ?? (loc.view === "authenticator" ? /* @__PURE__ */ jsx40(AuthenticatorView, { ...viewProps }) : loc.view === "trash" ? /* @__PURE__ */ jsx40(TrashView, { ...viewProps }) : null);
@@ -8797,11 +8930,15 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       selectedId: loc.itemId,
       onSelect: (id) => go({ itemId: id, mode: "view", kind: null, panel: null }),
       query: loc.q,
-      onQuery: (q) => go({ q }, "replace"),
+      onQuery: (q) => {
+        if (loc.view === "page" && host.page && !q) keepSearchFocus.current = true;
+        go({ q }, "replace");
+      },
       sort: loc.sort,
       onSort: (sort) => go({ sort }, "replace"),
       canSortViewed: port.lists.recents !== void 0,
-      onNew: () => go({ itemId: null, mode: "new", kind: null, panel: null }),
+      onNew: newItem,
+      onItemAction: rowAction,
       onRefresh: refresh,
       refreshing,
       ...snap.pending && snap.pending.length > 0 ? { stillLoading: snap.pending } : {},
@@ -8876,13 +9013,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
           setNotice(n);
           notify("Saved");
         },
-        onDeleted: (id) => {
-          setItems((cur) => cur.filter((i) => i.id !== id));
-          dirty.current = false;
-          move({ ...loc, itemId: null, mode: "view", panel: null }, "push");
-          notify("Moved to Trash");
-          load();
-        },
+        onDeleted: deletedItem,
         onDirty: (d) => {
           dirty.current = d;
         },
@@ -8943,6 +9074,13 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       /* @__PURE__ */ jsx40("span", { className: "min-w-0 flex-1 truncate text-warning", title: refreshError, children: "Couldn\u2019t refresh. Showing what was loaded." }),
       /* @__PURE__ */ jsx40("button", { type: "button", className: "shrink-0 text-primary hover:underline", onClick: refresh, children: "Try again" })
     ] }) : null,
+    hasPrompts ? (
+      // "Save this login?" and "Turn on filling" show above the list in every view, not only "This page".
+      /* @__PURE__ */ jsxs38("div", { className: "flex flex-col gap-3 border-b border-border px-3 py-3", "data-vault-host-prompts": "", children: [
+        host.fillSetup ? /* @__PURE__ */ jsx40(FillSetupCard, { fillSetup: host.fillSetup }) : null,
+        host.capture ? /* @__PURE__ */ jsx40(CaptureCard, { capture: host.capture, onChanged: load }) : null
+      ] })
+    ) : null,
     snap.unavailable.length > 0 ? /* @__PURE__ */ jsxs38("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-4 py-2 text-sm", children: [
       /* @__PURE__ */ jsxs38("span", { className: "min-w-0 flex-1 truncate text-warning", children: [
         "Couldn\u2019t load ",
@@ -8968,7 +9106,9 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
           onPanel: (p) => go({ panel: p }),
           nativeProvider: host.nativeProvider,
           hasNativeImport: host.nativeImport !== void 0,
-          hasPage: host.page !== void 0
+          hasPage: host.page !== void 0,
+          onLock: host.lock?.lock ? () => void host.lock?.lock?.() : void 0,
+          onOpenWeb: host.openWebVault
         }
       ) : null,
       shown.list ? /* @__PURE__ */ jsx40("div", { className: specialView && mode !== "stack" ? "col-span-2 min-h-0" : "min-h-0", children: list }) : null,
@@ -9941,20 +10081,6 @@ function createApiVaultPort(hostApi, options = {}) {
   };
 }
 
-// src/knobs.ts
-import { createKnobReader } from "@ai-matrx/data/knobs";
-var FRESH_MS = 6e4;
-function createVaultKnobs(client, address) {
-  const reader = createKnobReader(client);
-  let kept = null;
-  return async () => {
-    if (kept && Date.now() - kept.at < FRESH_MS) return kept.resolved;
-    const snap = await reader.snapshot(address);
-    kept = { at: Date.now(), resolved: snap.resolved };
-    return snap.resolved;
-  };
-}
-
 // src/agent-context.ts
 var hostOf = (url) => {
   try {
@@ -10022,6 +10148,7 @@ function emptyReadAlarm(total, emptyIds, holdings) {
   return `${staleAlarm(total)} (The check that tells an empty credential from an unreadable one did not answer either: ${holdings.why})`;
 }
 export {
+  BACKUP_PASSPHRASE_MIN_KNOB,
   CATEGORIES,
   CONFIRM_RETURN_KEY,
   DEFAULT_LOCATION,
@@ -10030,9 +10157,11 @@ export {
   HOLDINGS_DOOR_MIGRATION,
   IdentityGate,
   LOCKED_MESSAGE,
+  REVEAL_SECONDS_KNOB,
   VaultApp,
   VaultLockedError,
   categoryOf,
+  copiedLine,
   copyValue,
   createApiVaultPort,
   createSupabaseIdentity,
@@ -10049,11 +10178,13 @@ export {
   matchesQuery,
   needsRecentSignIn,
   parseDefinitions,
+  positiveKnob,
   providerOf,
   rowMenuEntriesAt,
   siteDomainOf,
   sortItems,
   useConfirmed,
+  useDisposable,
   vaultInventoryScope,
   vaultItemFacts,
   wasCancelled