@ai-matrx/vault 0.1.30 → 0.1.32

package/dist/identity.d.ts

@@ -0,0 +1,152 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+
+/**
+ * CONFIRM IT'S YOU. The server shows or exports a secret only after a sign-in from the last few
+ * minutes (`recent_auth_required`). Every host signs people in with Supabase, so the one way to
+ * produce a fresh sign-in lives here, over the host's own auth client — whichever way the person
+ * signs in: Google (or any connected provider), a password, or a code sent to their email.
+ */
+/** How a person can prove it is them again. Ordered by what the account actually uses. */
+type IdentityMethod = "provider" | "password" | "email_code" | "dev";
+interface IdentityAccount {
+    email: string | null;
+    /** Connected sign-in providers on the account (`google`, `github`, …), never `email`. */
+    providers: readonly string[];
+    hasPassword: boolean;
+}
+interface VaultIdentity {
+    account(): Promise<IdentityAccount>;
+    /**
+     * Confirms with that provider. On the web it leaves the page and comes back to the same address
+     * (resolves with nothing: the page is going away). A host that confirms IN PLACE (the desktop's
+     * Touch ID, a browser sign-in it waits for) resolves `"confirmed"`, and the gate closes and runs
+     * the refused call again — one confirmation, never a second click.
+     */
+    withProvider(provider: string): Promise<void | "confirmed">;
+    withPassword(password: string): Promise<void>;
+    sendEmailCode(): Promise<void>;
+    withEmailCode(code: string): Promise<void>;
+    /** A host-only path with no human step (the playground's dev server). */
+    dev?: () => Promise<void>;
+    /**
+     * Run once when the page loads. After a provider confirmation left the page and came back, it
+     * checks the SAME person is signed in. A different account is signed out of this device and the
+     * sentence to show is returned; otherwise null.
+     */
+    checkReturn?: () => Promise<string | null>;
+}
+/** The slice of supabase-js `auth` this needs, so the package never depends on supabase-js itself. */
+interface SupabaseAuthLike {
+    getUser(): Promise<{
+        data: {
+            user: {
+                id: string;
+                email?: string | null;
+                identities?: {
+                    provider: string;
+                }[] | null;
+                app_metadata?: {
+                    providers?: string[];
+                };
+            } | null;
+        };
+        error: unknown;
+    }>;
+    signInWithPassword(c: {
+        email: string;
+        password: string;
+    }): Promise<{
+        data: {
+            user: {
+                id: string;
+            } | null;
+        };
+        error: {
+            message: string;
+        } | null;
+    }>;
+    signInWithOtp(c: {
+        email: string;
+        options?: {
+            shouldCreateUser?: boolean;
+        };
+    }): Promise<{
+        error: {
+            message: string;
+        } | null;
+    }>;
+    verifyOtp(c: {
+        email: string;
+        token: string;
+        type: "email";
+    }): Promise<{
+        data: {
+            user: {
+                id: string;
+            } | null;
+        };
+        error: {
+            message: string;
+        } | null;
+    }>;
+    signInWithOAuth(c: {
+        provider: never;
+        options?: {
+            redirectTo?: string;
+        };
+    }): Promise<{
+        error: {
+            message: string;
+        } | null;
+    }>;
+    /** Used only when the host gives no `onDifferentPerson`: ends THIS device's session, never others. */
+    signOut?(o: {
+        scope: "local";
+    }): Promise<{
+        error: unknown;
+    }>;
+}
+/** Where the person confirming is remembered while the page is away at the provider. */
+interface ReturnStore {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+interface SupabaseIdentityOptions {
+    /** The host's accepted OAuth return address carrying this page. */
+    redirectTo?: () => string;
+    dev?: () => Promise<void>;
+    /**
+     * A provider confirmation came back signed in as someone else. The host ends that session on THIS
+     * device only (its own device-scoped sign-out) and tells the person; `message` says what happened.
+     * Without it the package signs out locally through `auth.signOut({ scope: "local" })`.
+     */
+    onDifferentPerson?: (message: string) => Promise<void> | void;
+    /** Default: the tab's `sessionStorage`. */
+    store?: ReturnStore;
+    /** Default `Date.now`. */
+    now?: () => number;
+}
+/** The key the expected person is kept under across the provider's redirect. */
+declare const CONFIRM_RETURN_KEY = "matrx-vault:confirming-as";
+/** THE identity confirmation for every host: give it the host's `supabase.auth`. */
+declare function createSupabaseIdentity(auth: SupabaseAuthLike, options?: SupabaseIdentityOptions): VaultIdentity;
+/** True when the server refused because the sign-in is not recent enough. */
+declare function needsRecentSignIn(e: unknown): boolean;
+
+/**
+ * Wrap any call that shows, copies or exports a secret. When the server answers "sign in again",
+ * the person confirms it is them (Google, password, or an emailed code) and the call runs again —
+ * they never see a dead "Authentication required" in the row.
+ */
+type Confirmed = <T>(run: () => Promise<T>) => Promise<T>;
+declare function useConfirmed(): Confirmed;
+declare function IdentityGate({ identity, children }: {
+    identity: VaultIdentity | undefined;
+    children: ReactNode;
+}): react.JSX.Element;
+/** True for the rejection a canceled confirmation produces (callers stay quiet about it). */
+declare const wasCancelled: (e: unknown) => boolean;
+
+export { CONFIRM_RETURN_KEY, type Confirmed, type IdentityAccount, IdentityGate, type IdentityMethod, type ReturnStore, type SupabaseAuthLike, type SupabaseIdentityOptions, type VaultIdentity, createSupabaseIdentity, needsRecentSignIn, useConfirmed, wasCancelled };

package/dist/identity.js

@@ -0,0 +1,18 @@
+"use client";
+import {
+  CONFIRM_RETURN_KEY,
+  IdentityGate,
+  createSupabaseIdentity,
+  needsRecentSignIn,
+  useConfirmed,
+  wasCancelled
+} from "./chunk-IJVSAR5M.js";
+export {
+  CONFIRM_RETURN_KEY,
+  IdentityGate,
+  createSupabaseIdentity,
+  needsRecentSignIn,
+  useConfirmed,
+  wasCancelled
+};
+//# sourceMappingURL=identity.js.map

package/dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.d.cts

@@ -1,6 +1,7 @@
 import * as react from 'react';
-import { ReactNode } from 'react';
 import { Look } from '@ai-matrx/design-system';
+import { VaultIdentity } from './identity.cjs';
+export { CONFIRM_RETURN_KEY, Confirmed, IdentityAccount, IdentityGate, IdentityMethod, ReturnStore, SupabaseAuthLike, SupabaseIdentityOptions, createSupabaseIdentity, needsRecentSignIn, useConfirmed, wasCancelled } from './identity.cjs';
 import { KnobClient } from '@ai-matrx/data/knobs';
 import * as account from '@ai-matrx/api/account';
 import { Api } from '@ai-matrx/api';
@@ -277,140 +278,6 @@ interface ActivityPort {
     downloadFile(item: VaultItem, attachment: VaultAttachment): Promise<Uint8Array>;
 }
 
-/**
- * CONFIRM IT'S YOU. The server shows or exports a secret only after a sign-in from the last few
- * minutes (`recent_auth_required`). Every host signs people in with Supabase, so the one way to
- * produce a fresh sign-in lives here, over the host's own auth client — whichever way the person
- * signs in: Google (or any connected provider), a password, or a code sent to their email.
- */
-/** How a person can prove it is them again. Ordered by what the account actually uses. */
-type IdentityMethod = "provider" | "password" | "email_code" | "dev";
-interface IdentityAccount {
-    email: string | null;
-    /** Connected sign-in providers on the account (`google`, `github`, …), never `email`. */
-    providers: readonly string[];
-    hasPassword: boolean;
-}
-interface VaultIdentity {
-    account(): Promise<IdentityAccount>;
-    /**
-     * Confirms with that provider. On the web it leaves the page and comes back to the same address
-     * (resolves with nothing: the page is going away). A host that confirms IN PLACE (the desktop's
-     * Touch ID, a browser sign-in it waits for) resolves `"confirmed"`, and the gate closes and runs
-     * the refused call again — one confirmation, never a second click.
-     */
-    withProvider(provider: string): Promise<void | "confirmed">;
-    withPassword(password: string): Promise<void>;
-    sendEmailCode(): Promise<void>;
-    withEmailCode(code: string): Promise<void>;
-    /** A host-only path with no human step (the playground's dev server). */
-    dev?: () => Promise<void>;
-    /**
-     * Run once when the page loads. After a provider confirmation left the page and came back, it
-     * checks the SAME person is signed in. A different account is signed out of this device and the
-     * sentence to show is returned; otherwise null.
-     */
-    checkReturn?: () => Promise<string | null>;
-}
-/** The slice of supabase-js `auth` this needs, so the package never depends on supabase-js itself. */
-interface SupabaseAuthLike {
-    getUser(): Promise<{
-        data: {
-            user: {
-                id: string;
-                email?: string | null;
-                identities?: {
-                    provider: string;
-                }[] | null;
-                app_metadata?: {
-                    providers?: string[];
-                };
-            } | null;
-        };
-        error: unknown;
-    }>;
-    signInWithPassword(c: {
-        email: string;
-        password: string;
-    }): Promise<{
-        data: {
-            user: {
-                id: string;
-            } | null;
-        };
-        error: {
-            message: string;
-        } | null;
-    }>;
-    signInWithOtp(c: {
-        email: string;
-        options?: {
-            shouldCreateUser?: boolean;
-        };
-    }): Promise<{
-        error: {
-            message: string;
-        } | null;
-    }>;
-    verifyOtp(c: {
-        email: string;
-        token: string;
-        type: "email";
-    }): Promise<{
-        data: {
-            user: {
-                id: string;
-            } | null;
-        };
-        error: {
-            message: string;
-        } | null;
-    }>;
-    signInWithOAuth(c: {
-        provider: never;
-        options?: {
-            redirectTo?: string;
-        };
-    }): Promise<{
-        error: {
-            message: string;
-        } | null;
-    }>;
-    /** Used only when the host gives no `onDifferentPerson`: ends THIS device's session, never others. */
-    signOut?(o: {
-        scope: "local";
-    }): Promise<{
-        error: unknown;
-    }>;
-}
-/** Where the person confirming is remembered while the page is away at the provider. */
-interface ReturnStore {
-    getItem(key: string): string | null;
-    setItem(key: string, value: string): void;
-    removeItem(key: string): void;
-}
-interface SupabaseIdentityOptions {
-    /** The host's accepted OAuth return address carrying this page. */
-    redirectTo?: () => string;
-    dev?: () => Promise<void>;
-    /**
-     * A provider confirmation came back signed in as someone else. The host ends that session on THIS
-     * device only (its own device-scoped sign-out) and tells the person; `message` says what happened.
-     * Without it the package signs out locally through `auth.signOut({ scope: "local" })`.
-     */
-    onDifferentPerson?: (message: string) => Promise<void> | void;
-    /** Default: the tab's `sessionStorage`. */
-    store?: ReturnStore;
-    /** Default `Date.now`. */
-    now?: () => number;
-}
-/** The key the expected person is kept under across the provider's redirect. */
-declare const CONFIRM_RETURN_KEY = "matrx-vault:confirming-as";
-/** THE identity confirmation for every host: give it the host's `supabase.auth`. */
-declare function createSupabaseIdentity(auth: SupabaseAuthLike, options?: SupabaseIdentityOptions): VaultIdentity;
-/** True when the server refused because the sign-in is not recent enough. */
-declare function needsRecentSignIn(e: unknown): boolean;
-
 /** One account's one-time password as the server reports it. Metadata only: never a seed. */
 interface AuthenticatorEntry {
     itemId: string;
@@ -1450,20 +1317,6 @@ interface ApiVaultPortOptions {
 }
 declare function createApiVaultPort(hostApi: Api, options?: ApiVaultPortOptions): VaultPort;
 
-/**
- * Wrap any call that shows, copies or exports a secret. When the server answers "sign in again",
- * the person confirms it is them (Google, password, or an emailed code) and the call runs again —
- * they never see a dead "Authentication required" in the row.
- */
-type Confirmed = <T>(run: () => Promise<T>) => Promise<T>;
-declare function useConfirmed(): Confirmed;
-declare function IdentityGate({ identity, children }: {
-    identity: VaultIdentity | undefined;
-    children: ReactNode;
-}): react.JSX.Element;
-/** True for the rejection a canceled confirmation produces (callers stay quiet about it). */
-declare const wasCancelled: (e: unknown) => boolean;
-
 /** Reads the organization's ceilings. Raw knob values are fine: they are validated here. */
 type GeneratorLimitsSource = () => Promise<{
     maxPasswordLength?: unknown;
@@ -1556,4 +1409,4 @@ declare function holdingsDoorIsAbsent(code: string | undefined | null): boolean;
  */
 declare function emptyReadAlarm(total: number, emptyIds: readonly string[], holdings: Holdings): string | null;
 
-export { type ApiVaultPortOptions, BACKUP_PASSPHRASE_MIN_KNOB, CATEGORIES, CONFIRM_RETURN_KEY, type CategoryId, type Confirmed, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, HIDDEN_ITEM_TAG, HOLDINGS_DOOR_MIGRATION, type HoldingRow, type Holdings, type IdentityAccount, IdentityGate, type IdentityMethod, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, REVEAL_SECONDS_KNOB, type ReturnStore, type RowItemAction, type RowMenuEntry, type RowMenuEntryKind, type SaveResult, type SupabaseAuthLike, type SupabaseIdentityOptions, type TotpReading, type UriMatchMode, type UrlGuess, type VaultAgentScope, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCopied, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultInventory, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copiedLine, copyValue, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, emptyReadAlarm, guardPort, holdingsDoorIsAbsent, inferFromUrl, isHiddenItem, itemIdAt, locationFromParams, locationToParams, loginSiteOf, matchesQuery, needsRecentSignIn, parseDefinitions, positiveKnob, providerOf, rowMenuEntriesAt, siteDomainOf, sortItems, useConfirmed, useDisposable, vaultInventoryScope, vaultItemFacts, wasCancelled };
+export { type ApiVaultPortOptions, BACKUP_PASSPHRASE_MIN_KNOB, CATEGORIES, type CategoryId, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, HIDDEN_ITEM_TAG, HOLDINGS_DOOR_MIGRATION, type HoldingRow, type Holdings, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, REVEAL_SECONDS_KNOB, type RowItemAction, type RowMenuEntry, type RowMenuEntryKind, type SaveResult, type TotpReading, type UriMatchMode, type UrlGuess, type VaultAgentScope, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCopied, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, VaultIdentity, type VaultInventory, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copiedLine, copyValue, createApiVaultPort, createVaultKnobs, emptyReadAlarm, guardPort, holdingsDoorIsAbsent, inferFromUrl, isHiddenItem, itemIdAt, locationFromParams, locationToParams, loginSiteOf, matchesQuery, parseDefinitions, positiveKnob, providerOf, rowMenuEntriesAt, siteDomainOf, sortItems, useDisposable, vaultInventoryScope, vaultItemFacts };

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 import * as react from 'react';
-import { ReactNode } from 'react';
 import { Look } from '@ai-matrx/design-system';
+import { VaultIdentity } from './identity.js';
+export { CONFIRM_RETURN_KEY, Confirmed, IdentityAccount, IdentityGate, IdentityMethod, ReturnStore, SupabaseAuthLike, SupabaseIdentityOptions, createSupabaseIdentity, needsRecentSignIn, useConfirmed, wasCancelled } from './identity.js';
 import { KnobClient } from '@ai-matrx/data/knobs';
 import * as account from '@ai-matrx/api/account';
 import { Api } from '@ai-matrx/api';
@@ -277,140 +278,6 @@ interface ActivityPort {
     downloadFile(item: VaultItem, attachment: VaultAttachment): Promise<Uint8Array>;
 }
 
-/**
- * CONFIRM IT'S YOU. The server shows or exports a secret only after a sign-in from the last few
- * minutes (`recent_auth_required`). Every host signs people in with Supabase, so the one way to
- * produce a fresh sign-in lives here, over the host's own auth client — whichever way the person
- * signs in: Google (or any connected provider), a password, or a code sent to their email.
- */
-/** How a person can prove it is them again. Ordered by what the account actually uses. */
-type IdentityMethod = "provider" | "password" | "email_code" | "dev";
-interface IdentityAccount {
-    email: string | null;
-    /** Connected sign-in providers on the account (`google`, `github`, …), never `email`. */
-    providers: readonly string[];
-    hasPassword: boolean;
-}
-interface VaultIdentity {
-    account(): Promise<IdentityAccount>;
-    /**
-     * Confirms with that provider. On the web it leaves the page and comes back to the same address
-     * (resolves with nothing: the page is going away). A host that confirms IN PLACE (the desktop's
-     * Touch ID, a browser sign-in it waits for) resolves `"confirmed"`, and the gate closes and runs
-     * the refused call again — one confirmation, never a second click.
-     */
-    withProvider(provider: string): Promise<void | "confirmed">;
-    withPassword(password: string): Promise<void>;
-    sendEmailCode(): Promise<void>;
-    withEmailCode(code: string): Promise<void>;
-    /** A host-only path with no human step (the playground's dev server). */
-    dev?: () => Promise<void>;
-    /**
-     * Run once when the page loads. After a provider confirmation left the page and came back, it
-     * checks the SAME person is signed in. A different account is signed out of this device and the
-     * sentence to show is returned; otherwise null.
-     */
-    checkReturn?: () => Promise<string | null>;
-}
-/** The slice of supabase-js `auth` this needs, so the package never depends on supabase-js itself. */
-interface SupabaseAuthLike {
-    getUser(): Promise<{
-        data: {
-            user: {
-                id: string;
-                email?: string | null;
-                identities?: {
-                    provider: string;
-                }[] | null;
-                app_metadata?: {
-                    providers?: string[];
-                };
-            } | null;
-        };
-        error: unknown;
-    }>;
-    signInWithPassword(c: {
-        email: string;
-        password: string;
-    }): Promise<{
-        data: {
-            user: {
-                id: string;
-            } | null;
-        };
-        error: {
-            message: string;
-        } | null;
-    }>;
-    signInWithOtp(c: {
-        email: string;
-        options?: {
-            shouldCreateUser?: boolean;
-        };
-    }): Promise<{
-        error: {
-            message: string;
-        } | null;
-    }>;
-    verifyOtp(c: {
-        email: string;
-        token: string;
-        type: "email";
-    }): Promise<{
-        data: {
-            user: {
-                id: string;
-            } | null;
-        };
-        error: {
-            message: string;
-        } | null;
-    }>;
-    signInWithOAuth(c: {
-        provider: never;
-        options?: {
-            redirectTo?: string;
-        };
-    }): Promise<{
-        error: {
-            message: string;
-        } | null;
-    }>;
-    /** Used only when the host gives no `onDifferentPerson`: ends THIS device's session, never others. */
-    signOut?(o: {
-        scope: "local";
-    }): Promise<{
-        error: unknown;
-    }>;
-}
-/** Where the person confirming is remembered while the page is away at the provider. */
-interface ReturnStore {
-    getItem(key: string): string | null;
-    setItem(key: string, value: string): void;
-    removeItem(key: string): void;
-}
-interface SupabaseIdentityOptions {
-    /** The host's accepted OAuth return address carrying this page. */
-    redirectTo?: () => string;
-    dev?: () => Promise<void>;
-    /**
-     * A provider confirmation came back signed in as someone else. The host ends that session on THIS
-     * device only (its own device-scoped sign-out) and tells the person; `message` says what happened.
-     * Without it the package signs out locally through `auth.signOut({ scope: "local" })`.
-     */
-    onDifferentPerson?: (message: string) => Promise<void> | void;
-    /** Default: the tab's `sessionStorage`. */
-    store?: ReturnStore;
-    /** Default `Date.now`. */
-    now?: () => number;
-}
-/** The key the expected person is kept under across the provider's redirect. */
-declare const CONFIRM_RETURN_KEY = "matrx-vault:confirming-as";
-/** THE identity confirmation for every host: give it the host's `supabase.auth`. */
-declare function createSupabaseIdentity(auth: SupabaseAuthLike, options?: SupabaseIdentityOptions): VaultIdentity;
-/** True when the server refused because the sign-in is not recent enough. */
-declare function needsRecentSignIn(e: unknown): boolean;
-
 /** One account's one-time password as the server reports it. Metadata only: never a seed. */
 interface AuthenticatorEntry {
     itemId: string;
@@ -1450,20 +1317,6 @@ interface ApiVaultPortOptions {
 }
 declare function createApiVaultPort(hostApi: Api, options?: ApiVaultPortOptions): VaultPort;
 
-/**
- * Wrap any call that shows, copies or exports a secret. When the server answers "sign in again",
- * the person confirms it is them (Google, password, or an emailed code) and the call runs again —
- * they never see a dead "Authentication required" in the row.
- */
-type Confirmed = <T>(run: () => Promise<T>) => Promise<T>;
-declare function useConfirmed(): Confirmed;
-declare function IdentityGate({ identity, children }: {
-    identity: VaultIdentity | undefined;
-    children: ReactNode;
-}): react.JSX.Element;
-/** True for the rejection a canceled confirmation produces (callers stay quiet about it). */
-declare const wasCancelled: (e: unknown) => boolean;
-
 /** Reads the organization's ceilings. Raw knob values are fine: they are validated here. */
 type GeneratorLimitsSource = () => Promise<{
     maxPasswordLength?: unknown;
@@ -1556,4 +1409,4 @@ declare function holdingsDoorIsAbsent(code: string | undefined | null): boolean;
  */
 declare function emptyReadAlarm(total: number, emptyIds: readonly string[], holdings: Holdings): string | null;
 
-export { type ApiVaultPortOptions, BACKUP_PASSPHRASE_MIN_KNOB, CATEGORIES, CONFIRM_RETURN_KEY, type CategoryId, type Confirmed, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, HIDDEN_ITEM_TAG, HOLDINGS_DOOR_MIGRATION, type HoldingRow, type Holdings, type IdentityAccount, IdentityGate, type IdentityMethod, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, REVEAL_SECONDS_KNOB, type ReturnStore, type RowItemAction, type RowMenuEntry, type RowMenuEntryKind, type SaveResult, type SupabaseAuthLike, type SupabaseIdentityOptions, type TotpReading, type UriMatchMode, type UrlGuess, type VaultAgentScope, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCopied, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultInventory, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copiedLine, copyValue, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, emptyReadAlarm, guardPort, holdingsDoorIsAbsent, inferFromUrl, isHiddenItem, itemIdAt, locationFromParams, locationToParams, loginSiteOf, matchesQuery, needsRecentSignIn, parseDefinitions, positiveKnob, providerOf, rowMenuEntriesAt, siteDomainOf, sortItems, useConfirmed, useDisposable, vaultInventoryScope, vaultItemFacts, wasCancelled };
+export { type ApiVaultPortOptions, BACKUP_PASSPHRASE_MIN_KNOB, CATEGORIES, type CategoryId, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, HIDDEN_ITEM_TAG, HOLDINGS_DOOR_MIGRATION, type HoldingRow, type Holdings, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, REVEAL_SECONDS_KNOB, type RowItemAction, type RowMenuEntry, type RowMenuEntryKind, type SaveResult, type TotpReading, type UriMatchMode, type UrlGuess, type VaultAgentScope, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCopied, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, VaultIdentity, type VaultInventory, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copiedLine, copyValue, createApiVaultPort, createVaultKnobs, emptyReadAlarm, guardPort, holdingsDoorIsAbsent, inferFromUrl, isHiddenItem, itemIdAt, locationFromParams, locationToParams, loginSiteOf, matchesQuery, parseDefinitions, positiveKnob, providerOf, rowMenuEntriesAt, siteDomainOf, sortItems, useDisposable, vaultInventoryScope, vaultItemFacts };