@ai-matrx/vault 0.1.28 → 0.1.30

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.30
+
+- **The 46 aliased glyphs keep their hand-measured optical-trim air again.** They became plain design-system aliases when the glyphs moved, which dropped the per-glyph `--matrx-glyph-air-l/-r` the vault had measured; they are now `withGlyphDefaults(Icon, {}, { air: [l, r] })` (the shared option, no local copy). **Consumer action:** none.
+
+- **Lock and Open on the web at every width.** The three-pane sidebar's foot offers **Lock** whenever the host gives `lock.lock`, and **Open on the web** whenever it gives `openWebVault` (before, both lived only in the narrow layout's More menu, so a desktop window 1120px or wider had no manual lock). Guard: `src/no-feature-lost.test.tsx` § D1. Consumer action: none.
+- **"This page" has the list's search row and New.** A "Search the vault" box (so "/" finds), the compact actions and a **New item** button sit above the site on every page, https or not; typing shows the matching list with the cursor kept in the search, clearing it brings the page back. Guard: § E1. Consumer action: none.
+- **Sign me in is a visible button beside Fill** (primary when there is no Fill), never inside a More menu. Guard: § E2. Consumer action: none.
+- **"Save this login?" and "Turn on filling" show above the list in every view**, not only on "This page" (`host.capture`, `host.fillSetup`; `PageView` no longer receives them from `VaultApp`). Guard: § E3. Consumer action: none.
+- **The copied line says when the clipboard clears.** `VaultClipboard.copy` may answer `{ clearsAtMs }` (`VaultCopied`); the vault then says "Password copied. Clears at 3:42 PM" (`copiedLine`). Answering nothing keeps "Password copied". Guard: § D3. **Consumer action:** a host whose clipboard clears a secret later (the desktop) returns main's `clearsAtMs` from `copy`.
+- **Activity, Share and Delete on every row's menu** (`RowMenuEntryKind` `manage`, `ItemList` `onItemAction`, `manageEntries`): Activity and Share open the item's own panels, Delete asks the item's own question (`confirmDelete`) and moves it to Trash; Share and Delete show off when the item says why it cannot be managed. A host's right-click menu reading `rowMenuEntriesAt` may take the `manage` entries too. Guard: § D4. Consumer action: none.
+- **The organization's backup passphrase minimum is enforced.** `host.backupPassphraseMinLength` (else the organization's `desktop.vault/backup_passphrase_min_length`, `BACKUP_PASSPHRASE_MIN_KNOB`, read through `host.knobs`): the Passphrase row says "At least N characters", a shorter one is refused by name and Encrypt and download stays off. Guard: § D5. **Consumer action:** a host that reads the setting itself (the desktop) passes `backupPassphraseMinLength`.
+- **Every host obeys the organization's reveal time.** Without `host.revealSeconds` the vault reads `desktop.vault/reveal_hide_seconds` (`REVEAL_SECONDS_KNOB`) through `host.knobs` (the extension and the website: 30s by default, was the package's 20s). `positiveKnob` reads either. Guard: § E5. Consumer action: none (a host with `knobs` inherits it).
+- **`useDisposable(create, deps)`**: a host object the screen owns, made and disposed in the same effect, so StrictMode's mount → cleanup → mount leaves a live one (a `useMemo` + cleanup-only effect left the first, disposed copy). Guard: § E4/D2. **Consumer action:** extension: make the new-password-fields host with it; desktop: make the vault lock with it.
+
 ## 0.1.28
 
 - **A website typed as a bare domain always saves.** Every bare domain is sent as `https://…` on create, edit, assign and the item settings call, whether or not the server could reach it (an intranet, a site not live yet) (`normalizeLoginUrls`); the Website box shows the `https://` form after leaving it, and "Not a public website. You can still save it." is a warning, never a block. Guard: `src/review-0-1-28.test.tsx` § 1. Consumer action: none.