@ai-matrx/vault 0.1.31 → 0.1.32

package/dist/identity.cjs

@@ -0,0 +1,338 @@
+"use client";
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/identity.ts
+var identity_exports = {};
+__export(identity_exports, {
+  CONFIRM_RETURN_KEY: () => CONFIRM_RETURN_KEY,
+  IdentityGate: () => IdentityGate,
+  createSupabaseIdentity: () => createSupabaseIdentity,
+  needsRecentSignIn: () => needsRecentSignIn,
+  useConfirmed: () => useConfirmed,
+  wasCancelled: () => wasCancelled
+});
+module.exports = __toCommonJS(identity_exports);
+
+// src/auth/identity.ts
+var CONFIRM_RETURN_KEY = "matrx-vault:confirming-as";
+var RETURN_WINDOW_MS = 15 * 6e4;
+var SAME_PERSON = "That signed in a different account. Use the account this vault belongs to.";
+function createSupabaseIdentity(auth, options = {}) {
+  let me = null;
+  const now = options.now ?? Date.now;
+  const store = () => {
+    if (options.store) return options.store;
+    try {
+      return globalThis.sessionStorage ?? null;
+    } catch {
+      return null;
+    }
+  };
+  const who = async () => {
+    const { data } = await auth.getUser();
+    if (!data.user) throw new Error("You are signed out. Sign in again.");
+    me = { id: data.user.id, email: data.user.email ?? null };
+    return data.user;
+  };
+  const sameUser = (id) => {
+    if (!me || id !== me.id) throw new Error(SAME_PERSON);
+  };
+  const identity = {
+    async account() {
+      const u = await who();
+      const names = /* @__PURE__ */ new Set([...(u.identities ?? []).map((i) => i.provider), ...u.app_metadata?.providers ?? []]);
+      return { email: u.email ?? null, providers: [...names].filter((p) => p !== "email" && p !== "phone"), hasPassword: names.has("email") };
+    },
+    async withProvider(provider) {
+      const u = await who();
+      store()?.setItem(CONFIRM_RETURN_KEY, JSON.stringify({ id: u.id, email: u.email ?? null, at: now() }));
+      const redirectTo = options.redirectTo?.() ?? globalThis.location?.href;
+      const { error } = await auth.signInWithOAuth({ provider, ...redirectTo ? { options: { redirectTo } } : {} });
+      if (error) {
+        store()?.removeItem(CONFIRM_RETURN_KEY);
+        throw new Error(error.message);
+      }
+    },
+    async checkReturn() {
+      const s = store();
+      const raw = s?.getItem(CONFIRM_RETURN_KEY) ?? null;
+      if (!s || raw === null) return null;
+      s.removeItem(CONFIRM_RETURN_KEY);
+      let expected;
+      try {
+        expected = JSON.parse(raw);
+      } catch {
+        return null;
+      }
+      if (typeof expected.id !== "string" || typeof expected.at !== "number" || now() - expected.at > RETURN_WINDOW_MS) return null;
+      const { data } = await auth.getUser();
+      if (!data.user || data.user.id === expected.id) return null;
+      const email = typeof expected.email === "string" && expected.email ? expected.email : null;
+      const message = `That signed in a different account, so it was signed out here.${email ? ` Sign in again as ${email}.` : " Sign in again."}`;
+      me = null;
+      if (options.onDifferentPerson) await options.onDifferentPerson(message);
+      else await auth.signOut?.({ scope: "local" });
+      return message;
+    },
+    async withPassword(password) {
+      const u = await who();
+      if (!u.email) throw new Error("This account has no email to confirm with.");
+      const { data, error } = await auth.signInWithPassword({ email: u.email, password });
+      if (error) throw new Error("That password was not accepted.");
+      sameUser(data.user?.id);
+    },
+    async sendEmailCode() {
+      const u = await who();
+      if (!u.email) throw new Error("This account has no email to send a code to.");
+      const { error } = await auth.signInWithOtp({ email: u.email, options: { shouldCreateUser: false } });
+      if (error) throw new Error(error.message);
+    },
+    async withEmailCode(code) {
+      const u = me ?? await who();
+      if (!u.email) throw new Error("This account has no email.");
+      const { data, error } = await auth.verifyOtp({ email: u.email, token: code.trim(), type: "email" });
+      if (error) throw new Error("That code was not accepted. Check it, or send a new one.");
+      sameUser(data.user?.id);
+    }
+  };
+  if (options.dev) identity.dev = options.dev;
+  return identity;
+}
+function needsRecentSignIn(e) {
+  const err = e;
+  if (!err) return false;
+  if (err.code === "recent_auth_required") return true;
+  const said = [err.message, JSON.stringify(err.serverDetail ?? "")].filter((x) => typeof x === "string").join(" ");
+  return /recent auth|recent sign|re-authenticate|authentication within the last/i.test(said);
+}
+
+// src/auth/IdentityGate.tsx
+var import_react2 = require("react");
+var import_design_system2 = require("@ai-matrx/design-system");
+var import_controls = require("@ai-matrx/design-system/controls");
+
+// src/glyphs.tsx
+var import_icons = require("@ai-matrx/design-system/icons");
+var import_jsx_runtime = require("react/jsx-runtime");
+function glyph(paths, air = [1, 1]) {
+  const style = { "--matrx-glyph-air-l": air[0], "--matrx-glyph-air-r": air[1] };
+  return function VaultGlyph({ className }) {
+    return /* @__PURE__ */ (0, import_jsx_runtime.jsx)("svg", { className, style, viewBox: "0 0 24 24", fill: "none", stroke: "currentColor", strokeWidth: 2, strokeLinecap: "round", strokeLinejoin: "round", "aria-hidden": true, children: paths });
+  };
+}
+var KeyGlyph = (0, import_icons.withGlyphDefaults)(import_icons.KeyIcon, {}, { air: [1, 2] });
+var NoteGlyph = (0, import_icons.withGlyphDefaults)(import_icons.FileTextIcon, {}, { air: [3, 3] });
+var CardGlyph = (0, import_icons.withGlyphDefaults)(import_icons.CreditCardIcon, {}, { air: [1, 1] });
+var PersonGlyph = (0, import_icons.withGlyphDefaults)(import_icons.UserRoundIcon, {}, { air: [3, 3] });
+var DatabaseGlyph = (0, import_icons.withGlyphDefaults)(import_icons.DatabaseIcon, {}, { air: [2, 2] });
+var ServerGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ServerIcon, {}, { air: [1, 1] });
+var TerminalGlyph = (0, import_icons.withGlyphDefaults)(import_icons.TerminalIcon, {}, { air: [3, 3] });
+var FileGlyph = (0, import_icons.withGlyphDefaults)(import_icons.FilePageIcon, {}, { air: [3, 3] });
+var CodeGlyph = (0, import_icons.withGlyphDefaults)(import_icons.CodeIcon, {}, { air: [1, 1] });
+var StarGlyph = (0, import_icons.withGlyphDefaults)(import_icons.StarIcon, {}, { air: [1, 1] });
+var PlusGlyph = (0, import_icons.withGlyphDefaults)(import_icons.PlusIcon, {}, { air: [4, 4] });
+var EyeGlyph = (0, import_icons.withGlyphDefaults)(import_icons.EyeIcon, {}, { air: [1, 1] });
+var EyeOffGlyph = (0, import_icons.withGlyphDefaults)(import_icons.EyeOffIcon, {}, { air: [1, 1] });
+var LockGlyph = (0, import_icons.withGlyphDefaults)(import_icons.LockIcon, {}, { air: [2, 2] });
+var ExternalGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ExternalLinkIcon, {}, { air: [2, 2] });
+var TrashGlyph = (0, import_icons.withGlyphDefaults)(import_icons.TrashIcon, {}, { air: [2, 2] });
+var ArchiveGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ArchiveIcon, {}, { air: [1, 1] });
+var TagGlyph = (0, import_icons.withGlyphDefaults)(import_icons.TagIcon, {}, { air: [1, 1] });
+var ShieldGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ShieldIcon, {}, { air: [3, 3] });
+var BuildingGlyph = (0, import_icons.withGlyphDefaults)(import_icons.BuildingIcon, {}, { air: [3, 3] });
+var ChevronLeftGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ChevronLeftIcon, {}, { air: [8, 8] });
+var GridGlyph = (0, import_icons.withGlyphDefaults)(import_icons.LayoutGridIcon, {}, { air: [2, 2] });
+var PlugGlyph = (0, import_icons.withGlyphDefaults)(import_icons.PlugIcon, {}, { air: [5, 5] });
+var XGlyph = (0, import_icons.withGlyphDefaults)(import_icons.XIcon, {}, { air: [5, 5] });
+var PencilGlyph = (0, import_icons.withGlyphDefaults)(import_icons.PencilIcon, {}, { air: [2, 2] });
+var ClockGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ClockIcon, {}, { air: [1, 1] });
+var MoreGlyph = (0, import_icons.withGlyphDefaults)(import_icons.MoreHorizontalIcon, {}, { air: [3, 3] });
+var ShareGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ShareIcon, {}, { air: [3, 3] });
+var ListGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ListIcon, {}, { air: [2, 2] });
+var ImportGlyph = (0, import_icons.withGlyphDefaults)(import_icons.DownloadIcon, {}, { air: [2, 2] });
+var ExportGlyph = (0, import_icons.withGlyphDefaults)(import_icons.UploadIcon, {}, { air: [2, 2] });
+var ChevronDownGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ChevronDownIcon, {}, { air: [5, 5] });
+var ChevronRightGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ChevronRightIcon, {}, { air: [8, 8] });
+var SortGlyph = (0, import_icons.withGlyphDefaults)(import_icons.ArrowUpDownIcon, {}, { air: [2, 2] });
+var UserGlyph = (0, import_icons.withGlyphDefaults)(import_icons.UserIcon, {}, { air: [5, 5] });
+var MoveGlyph = (0, import_icons.withGlyphDefaults)(import_icons.MoveIcon, {}, { air: [1, 1] });
+var SafeGlyph = glyph(/* @__PURE__ */ (0, import_jsx_runtime.jsxs)(import_jsx_runtime.Fragment, { children: [
+  /* @__PURE__ */ (0, import_jsx_runtime.jsx)("rect", { x: "3", y: "3", width: "18", height: "18", rx: "2" }),
+  /* @__PURE__ */ (0, import_jsx_runtime.jsx)("circle", { cx: "12", cy: "12", r: "4" }),
+  /* @__PURE__ */ (0, import_jsx_runtime.jsx)("path", { d: "M12 8v1M12 15v1M8 12h1M15 12h1" })
+] }), [2, 2]);
+var RestoreGlyph = (0, import_icons.withGlyphDefaults)(import_icons.RotateCcwIcon, {}, { air: [2, 2] });
+var QrGlyph = (0, import_icons.withGlyphDefaults)(import_icons.QrCodeIcon, {}, { air: [2, 2] });
+var CameraGlyph = (0, import_icons.withGlyphDefaults)(import_icons.CameraIcon, {}, { air: [1, 1] });
+var CheckGlyph = (0, import_icons.withGlyphDefaults)(import_icons.CheckIcon, {}, { air: [3, 3] });
+var PowerGlyph = (0, import_icons.withGlyphDefaults)(import_icons.PowerIcon, {}, { air: [2, 2] });
+var RefreshGlyph = (0, import_icons.withGlyphDefaults)(import_icons.RefreshCwIcon, {}, { air: [2, 2] });
+var SlidersGlyph = (0, import_icons.withGlyphDefaults)(import_icons.SlidersVerticalIcon, {}, { air: [0, 0] });
+var UploadGlyph = (0, import_icons.withGlyphDefaults)(import_icons.UploadIcon, {}, { air: [2, 2] });
+var FingerprintGlyph = (0, import_icons.withGlyphDefaults)(import_icons.FingerprintPatternIcon, {}, { air: [1, 1] });
+var SendGlyph = (0, import_icons.withGlyphDefaults)(import_icons.SendIcon, {}, { air: [1, 1] });
+
+// src/notice.tsx
+var import_react = require("react");
+var import_design_system = require("@ai-matrx/design-system");
+var import_clipboard = require("@ai-matrx/kit/clipboard");
+var import_jsx_runtime2 = require("react/jsx-runtime");
+var Ctx = (0, import_react.createContext)(() => void 0);
+function useNotify() {
+  return (0, import_react.useContext)(Ctx);
+}
+var ClipboardCtx = (0, import_react.createContext)(void 0);
+
+// src/auth/IdentityGate.tsx
+var import_jsx_runtime3 = require("react/jsx-runtime");
+var CANCELLED = "Not confirmed.";
+var NOT_CONFIRMED_NOTICE = "Not confirmed, so nothing was done";
+var Ctx2 = (0, import_react2.createContext)((run) => run());
+function useConfirmed() {
+  return (0, import_react2.useContext)(Ctx2);
+}
+var PROVIDER_LABEL = { google: "Google", github: "GitHub", azure: "Microsoft", apple: "Apple", linkedin_oidc: "LinkedIn", slack_oidc: "Slack", browser: "Browser", touch_id: "Touch ID" };
+var providerLabel = (p) => PROVIDER_LABEL[p] ?? p.charAt(0).toUpperCase() + p.slice(1);
+function IdentityGate({ identity, children }) {
+  const [asking, setAsking] = (0, import_react2.useState)(false);
+  const notify = useNotify();
+  const waiters = (0, import_react2.useRef)([]);
+  const [returnProblem, setReturnProblem] = (0, import_react2.useState)(null);
+  (0, import_react2.useEffect)(() => {
+    if (!identity?.checkReturn) return;
+    let live = true;
+    identity.checkReturn().then(
+      (problem) => live && problem && setReturnProblem(problem),
+      (e) => live && setReturnProblem(e instanceof Error ? e.message : "The account that came back could not be checked.")
+    );
+    return () => {
+      live = false;
+    };
+  }, [identity]);
+  const confirmed = async (run) => {
+    try {
+      return await run();
+    } catch (e) {
+      if (!identity || !needsRecentSignIn(e)) throw e;
+      await new Promise((resolve, reject) => {
+        waiters.current.push({ resolve, reject });
+        setAsking(true);
+      });
+      return run();
+    }
+  };
+  const settle = (ok) => {
+    const w = waiters.current;
+    waiters.current = [];
+    setAsking(false);
+    for (const x of w) ok ? x.resolve() : x.reject(new Error(CANCELLED));
+    if (!ok && w.length > 0) notify(NOT_CONFIRMED_NOTICE, "info");
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(Ctx2.Provider, { value: confirmed, children: [
+    children,
+    identity ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(ConfirmIdentityDialog, { open: asking, identity, onDone: () => settle(true), onCancel: () => settle(false) }) : null,
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_design_system2.Dialog, { open: returnProblem !== null, onOpenChange: (o) => o ? void 0 : setReturnProblem(null), children: /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_design_system2.DialogContent, { size: "sm", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_design_system2.DialogHeader, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_design_system2.DialogTitle, { children: "Different account" }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_design_system2.DialogDescription, { children: returnProblem })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("div", { className: "flex justify-end", children: /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_controls.Button, { variant: "primary", onClick: () => setReturnProblem(null), children: "OK" }) })
+    ] }) })
+  ] });
+}
+var wasCancelled = (e) => e instanceof Error && e.message === CANCELLED;
+function ConfirmIdentityDialog({ open, identity, onDone, onCancel }) {
+  const [account, setAccount] = (0, import_react2.useState)(null);
+  const [password, setPassword] = (0, import_react2.useState)("");
+  const [code, setCode] = (0, import_react2.useState)("");
+  const [codeSent, setCodeSent] = (0, import_react2.useState)(false);
+  const [busy, setBusy] = (0, import_react2.useState)(false);
+  const [error, setError] = (0, import_react2.useState)(null);
+  (0, import_react2.useEffect)(() => {
+    if (!open) return;
+    setPassword("");
+    setCode("");
+    setCodeSent(false);
+    setError(null);
+    identity.account().then(setAccount, (e) => setError(e instanceof Error ? e.message : "Your account could not be read."));
+  }, [open, identity]);
+  const attempt = async (step, done = true) => {
+    setBusy(true);
+    setError(null);
+    try {
+      await step();
+      if (done) onDone();
+    } catch (e) {
+      setError(e instanceof Error ? e.message : "That did not work. Try again.");
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_design_system2.Dialog, { open, onOpenChange: (o) => o ? void 0 : onCancel(), children: /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_design_system2.DialogContent, { size: "sm", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_design_system2.DialogHeader, { children: [
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "flex items-center gap-2", children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(ShieldGlyph, { className: "size-5 text-primary" }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_design_system2.DialogTitle, { children: "Confirm it\u2019s you" })
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(import_design_system2.DialogDescription, { children: [
+        "This needs a recent sign-in",
+        account?.email ? ` to ${account.email}` : "",
+        "."
+      ] })
+    ] }),
+    /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("div", { className: "flex flex-col gap-3", children: [
+      identity.dev ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_controls.Button, { variant: "primary", disabled: busy, onClick: () => void attempt(() => identity.dev?.() ?? Promise.resolve()), children: "Sign in again (dev)" }) : null,
+      account?.providers.map((p) => /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)(
+        import_controls.Button,
+        {
+          variant: identity.dev ? "outline" : "primary",
+          disabled: busy,
+          onClick: () => void attempt(async () => {
+            if (await identity.withProvider(p) === "confirmed") onDone();
+          }, false),
+          children: [
+            "Continue with ",
+            providerLabel(p)
+          ]
+        },
+        p
+      )),
+      account?.hasPassword ? /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("form", { className: "flex gap-2", onSubmit: (e) => {
+        e.preventDefault();
+        if (password) void attempt(() => identity.withPassword(password));
+      }, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_controls.Field, { className: "min-w-0 flex-1", type: "password", autoComplete: "current-password", placeholder: "Your password", "aria-label": "Your password", value: password, onChange: (e) => setPassword(e.target.value), autoFocus: true }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_controls.Button, { variant: "outline", type: "submit", disabled: busy || !password, children: "Confirm" })
+      ] }) : null,
+      account?.email ? codeSent ? /* @__PURE__ */ (0, import_jsx_runtime3.jsxs)("form", { className: "flex gap-2", onSubmit: (e) => {
+        e.preventDefault();
+        if (code.trim()) void attempt(() => identity.withEmailCode(code));
+      }, children: [
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_controls.Field, { className: "min-w-0 flex-1", inputMode: "numeric", autoComplete: "one-time-code", placeholder: "Code from your email", "aria-label": "Code from your email", value: code, onChange: (e) => setCode(e.target.value), autoFocus: true }),
+        /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_controls.Button, { variant: "outline", type: "submit", disabled: busy || !code.trim(), children: "Confirm" })
+      ] }) : /* @__PURE__ */ (0, import_jsx_runtime3.jsx)(import_controls.Button, { variant: "quiet", disabled: busy, onClick: () => void attempt(async () => {
+        await identity.sendEmailCode();
+        setCodeSent(true);
+      }, false), children: "Email me a code instead" }) : null,
+      error ? /* @__PURE__ */ (0, import_jsx_runtime3.jsx)("p", { role: "alert", className: "text-sm text-destructive", children: error }) : null
+    ] })
+  ] }) });
+}
+//# sourceMappingURL=identity.cjs.map

package/dist/identity.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/identity.ts","../src/auth/identity.ts","../src/auth/IdentityGate.tsx","../src/glyphs.tsx","../src/notice.tsx"],"sourcesContent":["/**\n * `@ai-matrx/vault/identity` — \"Confirm it's you\" without the Vault workspace.\n *\n * The identity seam and its gate dialog, for a host that only needs a recent-sign-in check (the\n * share sheet's secure links). Importing them from the root pulled the whole Vault (every screen,\n * the importers, zip.js) into that host's build graph; this entry reaches only the gate.\n */\nexport { CONFIRM_RETURN_KEY, createSupabaseIdentity, needsRecentSignIn, type IdentityAccount, type IdentityMethod, type ReturnStore, type SupabaseAuthLike, type SupabaseIdentityOptions, type VaultIdentity } from \"./auth/identity\";\nexport { IdentityGate, useConfirmed, wasCancelled, type Confirmed } from \"./auth/IdentityGate\";\n","/**\n * CONFIRM IT'S YOU. The server shows or exports a secret only after a sign-in from the last few\n * minutes (`recent_auth_required`). Every host signs people in with Supabase, so the one way to\n * produce a fresh sign-in lives here, over the host's own auth client — whichever way the person\n * signs in: Google (or any connected provider), a password, or a code sent to their email.\n */\n\n/** How a person can prove it is them again. Ordered by what the account actually uses. */\nexport type IdentityMethod = \"provider\" | \"password\" | \"email_code\" | \"dev\";\n\nexport interface IdentityAccount {\n  email: string | null;\n  /** Connected sign-in providers on the account (`google`, `github`, …), never `email`. */\n  providers: readonly string[];\n  hasPassword: boolean;\n}\n\nexport interface VaultIdentity {\n  account(): Promise<IdentityAccount>;\n  /**\n   * Confirms with that provider. On the web it leaves the page and comes back to the same address\n   * (resolves with nothing: the page is going away). A host that confirms IN PLACE (the desktop's\n   * Touch ID, a browser sign-in it waits for) resolves `\"confirmed\"`, and the gate closes and runs\n   * the refused call again — one confirmation, never a second click.\n   */\n  withProvider(provider: string): Promise<void | \"confirmed\">;\n  withPassword(password: string): Promise<void>;\n  sendEmailCode(): Promise<void>;\n  withEmailCode(code: string): Promise<void>;\n  /** A host-only path with no human step (the playground's dev server). */\n  dev?: () => Promise<void>;\n  /**\n   * Run once when the page loads. After a provider confirmation left the page and came back, it\n   * checks the SAME person is signed in. A different account is signed out of this device and the\n   * sentence to show is returned; otherwise null.\n   */\n  checkReturn?: () => Promise<string | null>;\n}\n\n/** The slice of supabase-js `auth` this needs, so the package never depends on supabase-js itself. */\nexport interface SupabaseAuthLike {\n  getUser(): Promise<{ data: { user: { id: string; email?: string | null; identities?: { provider: string }[] | null; app_metadata?: { providers?: string[] } } | null }; error: unknown }>;\n  signInWithPassword(c: { email: string; password: string }): Promise<{ data: { user: { id: string } | null }; error: { message: string } | null }>;\n  signInWithOtp(c: { email: string; options?: { shouldCreateUser?: boolean } }): Promise<{ error: { message: string } | null }>;\n  verifyOtp(c: { email: string; token: string; type: \"email\" }): Promise<{ data: { user: { id: string } | null }; error: { message: string } | null }>;\n  signInWithOAuth(c: { provider: never; options?: { redirectTo?: string } }): Promise<{ error: { message: string } | null }>;\n  /** Used only when the host gives no `onDifferentPerson`: ends THIS device's session, never others. */\n  signOut?(o: { scope: \"local\" }): Promise<{ error: unknown }>;\n}\n\n/** Where the person confirming is remembered while the page is away at the provider. */\nexport interface ReturnStore {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\nexport interface SupabaseIdentityOptions {\n  /** The host's accepted OAuth return address carrying this page. */\n  redirectTo?: () => string;\n  dev?: () => Promise<void>;\n  /**\n   * A provider confirmation came back signed in as someone else. The host ends that session on THIS\n   * device only (its own device-scoped sign-out) and tells the person; `message` says what happened.\n   * Without it the package signs out locally through `auth.signOut({ scope: \"local\" })`.\n   */\n  onDifferentPerson?: (message: string) => Promise<void> | void;\n  /** Default: the tab's `sessionStorage`. */\n  store?: ReturnStore;\n  /** Default `Date.now`. */\n  now?: () => number;\n}\n\n/** The key the expected person is kept under across the provider's redirect. */\nexport const CONFIRM_RETURN_KEY = \"matrx-vault:confirming-as\";\n/** A remembered confirmation older than this is stale (the person never came back from it). */\nconst RETURN_WINDOW_MS = 15 * 60_000;\n\nconst SAME_PERSON = \"That signed in a different account. Use the account this vault belongs to.\";\n\n/** THE identity confirmation for every host: give it the host's `supabase.auth`. */\nexport function createSupabaseIdentity(auth: SupabaseAuthLike, options: SupabaseIdentityOptions = {}): VaultIdentity {\n  let me: { id: string; email: string | null } | null = null;\n  const now = options.now ?? Date.now;\n  const store = (): ReturnStore | null => {\n    if (options.store) return options.store;\n    try {\n      return (globalThis as { sessionStorage?: ReturnStore }).sessionStorage ?? null;\n    } catch {\n      return null;\n    }\n  };\n  const who = async () => {\n    const { data } = await auth.getUser();\n    if (!data.user) throw new Error(\"You are signed out. Sign in again.\");\n    me = { id: data.user.id, email: data.user.email ?? null };\n    return data.user;\n  };\n  const sameUser = (id: string | undefined) => {\n    if (!me || id !== me.id) throw new Error(SAME_PERSON);\n  };\n  const identity: VaultIdentity = {\n    async account() {\n      const u = await who();\n      const names = new Set([...(u.identities ?? []).map((i) => i.provider), ...(u.app_metadata?.providers ?? [])]);\n      return { email: u.email ?? null, providers: [...names].filter((p) => p !== \"email\" && p !== \"phone\"), hasPassword: names.has(\"email\") };\n    },\n    async withProvider(provider) {\n      const u = await who();\n      // Remembered across the redirect, so the page that loads back can check the same person came back.\n      store()?.setItem(CONFIRM_RETURN_KEY, JSON.stringify({ id: u.id, email: u.email ?? null, at: now() }));\n      const redirectTo = options.redirectTo?.() ?? globalThis.location?.href;\n      // `provider` is a supabase-js Provider string; the structural type keeps supabase-js out of the package.\n      const { error } = await auth.signInWithOAuth({ provider: provider as never, ...(redirectTo ? { options: { redirectTo } } : {}) });\n      if (error) {\n        store()?.removeItem(CONFIRM_RETURN_KEY);\n        throw new Error(error.message);\n      }\n    },\n    async checkReturn() {\n      const s = store();\n      const raw = s?.getItem(CONFIRM_RETURN_KEY) ?? null;\n      if (!s || raw === null) return null;\n      s.removeItem(CONFIRM_RETURN_KEY);\n      let expected: { id?: unknown; email?: unknown; at?: unknown };\n      try {\n        expected = JSON.parse(raw) as typeof expected;\n      } catch {\n        return null;\n      }\n      if (typeof expected.id !== \"string\" || typeof expected.at !== \"number\" || now() - expected.at > RETURN_WINDOW_MS) return null;\n      const { data } = await auth.getUser();\n      if (!data.user || data.user.id === expected.id) return null;\n      const email = typeof expected.email === \"string\" && expected.email ? expected.email : null;\n      const message = `That signed in a different account, so it was signed out here.${email ? ` Sign in again as ${email}.` : \" Sign in again.\"}`;\n      me = null;\n      if (options.onDifferentPerson) await options.onDifferentPerson(message);\n      else await auth.signOut?.({ scope: \"local\" });\n      return message;\n    },\n    async withPassword(password) {\n      const u = await who();\n      if (!u.email) throw new Error(\"This account has no email to confirm with.\");\n      const { data, error } = await auth.signInWithPassword({ email: u.email, password });\n      if (error) throw new Error(\"That password was not accepted.\");\n      sameUser(data.user?.id);\n    },\n    async sendEmailCode() {\n      const u = await who();\n      if (!u.email) throw new Error(\"This account has no email to send a code to.\");\n      const { error } = await auth.signInWithOtp({ email: u.email, options: { shouldCreateUser: false } });\n      if (error) throw new Error(error.message);\n    },\n    async withEmailCode(code) {\n      const u = me ?? (await who());\n      if (!u.email) throw new Error(\"This account has no email.\");\n      const { data, error } = await auth.verifyOtp({ email: u.email, token: code.trim(), type: \"email\" });\n      if (error) throw new Error(\"That code was not accepted. Check it, or send a new one.\");\n      sameUser(data.user?.id);\n    },\n  };\n  if (options.dev) identity.dev = options.dev;\n  return identity;\n}\n\n/** True when the server refused because the sign-in is not recent enough. */\nexport function needsRecentSignIn(e: unknown): boolean {\n  const err = e as { code?: unknown; status?: unknown; message?: unknown; serverDetail?: unknown } | null;\n  if (!err) return false;\n  if (err.code === \"recent_auth_required\") return true;\n  // Some routes answer with only a sentence (the shown message is a generic \"sign in\"; the server's\n  // own words say which): read those too.\n  const said = [err.message, JSON.stringify(err.serverDetail ?? \"\")].filter((x): x is string => typeof x === \"string\").join(\" \");\n  return /recent auth|recent sign|re-authenticate|authentication within the last/i.test(said);\n}\n","import { createContext, useContext, useEffect, useRef, useState, type ReactNode } from \"react\";\nimport { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from \"@ai-matrx/design-system\";\nimport { Button, Field } from \"@ai-matrx/design-system/controls\";\nimport { ShieldGlyph } from \"../glyphs\";\nimport { useNotify } from \"../notice\";\nimport { needsRecentSignIn, type IdentityAccount, type VaultIdentity } from \"./identity\";\n\n/**\n * Wrap any call that shows, copies or exports a secret. When the server answers \"sign in again\",\n * the person confirms it is them (Google, password, or an emailed code) and the call runs again —\n * they never see a dead \"Authentication required\" in the row.\n */\nexport type Confirmed = <T>(run: () => Promise<T>) => Promise<T>;\n\nconst CANCELLED = \"Not confirmed.\";\n/** Said once when the person closes \"Confirm it's you\": whatever asked for it did not happen. */\nexport const NOT_CONFIRMED_NOTICE = \"Not confirmed, so nothing was done\";\nconst Ctx = createContext<Confirmed>((run) => run());\n\nexport function useConfirmed(): Confirmed {\n  return useContext(Ctx);\n}\n\nconst PROVIDER_LABEL: Record<string, string> = { google: \"Google\", github: \"GitHub\", azure: \"Microsoft\", apple: \"Apple\", linkedin_oidc: \"LinkedIn\", slack_oidc: \"Slack\", browser: \"Browser\", touch_id: \"Touch ID\" };\nconst providerLabel = (p: string) => PROVIDER_LABEL[p] ?? p.charAt(0).toUpperCase() + p.slice(1);\n\nexport function IdentityGate({ identity, children }: { identity: VaultIdentity | undefined; children: ReactNode }) {\n  const [asking, setAsking] = useState(false);\n  const notify = useNotify();\n  const waiters = useRef<{ resolve: () => void; reject: (e: Error) => void }[]>([]);\n  // Back from a provider's confirmation: a different account that came back is signed out and said.\n  const [returnProblem, setReturnProblem] = useState<string | null>(null);\n  useEffect(() => {\n    if (!identity?.checkReturn) return;\n    let live = true;\n    identity.checkReturn().then(\n      (problem) => live && problem && setReturnProblem(problem),\n      (e: unknown) => live && setReturnProblem(e instanceof Error ? e.message : \"The account that came back could not be checked.\"),\n    );\n    return () => {\n      live = false;\n    };\n  }, [identity]);\n\n  const confirmed: Confirmed = async (run) => {\n    try {\n      return await run();\n    } catch (e) {\n      if (!identity || !needsRecentSignIn(e)) throw e;\n      await new Promise<void>((resolve, reject) => {\n        waiters.current.push({ resolve, reject });\n        setAsking(true);\n      });\n      return run();\n    }\n  };\n\n  const settle = (ok: boolean) => {\n    const w = waiters.current;\n    waiters.current = [];\n    setAsking(false);\n    for (const x of w) (ok ? x.resolve() : x.reject(new Error(CANCELLED)));\n    // Never silent: every caller stays quiet about a cancel (`wasCancelled`), so the gate says it once.\n    if (!ok && w.length > 0) notify(NOT_CONFIRMED_NOTICE, \"info\");\n  };\n\n  return (\n    <Ctx.Provider value={confirmed}>\n      {children}\n      {identity ? <ConfirmIdentityDialog open={asking} identity={identity} onDone={() => settle(true)} onCancel={() => settle(false)} /> : null}\n      <Dialog open={returnProblem !== null} onOpenChange={(o) => (o ? undefined : setReturnProblem(null))}>\n        <DialogContent size=\"sm\">\n          <DialogHeader>\n            <DialogTitle>Different account</DialogTitle>\n            <DialogDescription>{returnProblem}</DialogDescription>\n          </DialogHeader>\n          <div className=\"flex justify-end\">\n            <Button variant=\"primary\" onClick={() => setReturnProblem(null)}>OK</Button>\n          </div>\n        </DialogContent>\n      </Dialog>\n    </Ctx.Provider>\n  );\n}\n\n/** True for the rejection a canceled confirmation produces (callers stay quiet about it). */\nexport const wasCancelled = (e: unknown) => e instanceof Error && e.message === CANCELLED;\n\nfunction ConfirmIdentityDialog({ open, identity, onDone, onCancel }: { open: boolean; identity: VaultIdentity; onDone: () => void; onCancel: () => void }) {\n  const [account, setAccount] = useState<IdentityAccount | null>(null);\n  const [password, setPassword] = useState(\"\");\n  const [code, setCode] = useState(\"\");\n  const [codeSent, setCodeSent] = useState(false);\n  const [busy, setBusy] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  useEffect(() => {\n    if (!open) return;\n    setPassword(\"\");\n    setCode(\"\");\n    setCodeSent(false);\n    setError(null);\n    identity.account().then(setAccount, (e: unknown) => setError(e instanceof Error ? e.message : \"Your account could not be read.\"));\n  }, [open, identity]);\n\n  const attempt = async (step: () => Promise<void>, done = true) => {\n    setBusy(true);\n    setError(null);\n    try {\n      await step();\n      if (done) onDone();\n    } catch (e) {\n      setError(e instanceof Error ? e.message : \"That did not work. Try again.\");\n    } finally {\n      setBusy(false);\n    }\n  };\n\n  return (\n    <Dialog open={open} onOpenChange={(o) => (o ? undefined : onCancel())}>\n      <DialogContent size=\"sm\">\n        <DialogHeader>\n          <div className=\"flex items-center gap-2\">\n            <ShieldGlyph className=\"size-5 text-primary\" />\n            <DialogTitle>Confirm it’s you</DialogTitle>\n          </div>\n          <DialogDescription>This needs a recent sign-in{account?.email ? ` to ${account.email}` : \"\"}.</DialogDescription>\n        </DialogHeader>\n        <div className=\"flex flex-col gap-3\">\n          {identity.dev ? (\n            <Button variant=\"primary\" disabled={busy} onClick={() => void attempt(() => identity.dev?.() ?? Promise.resolve())}>\n              Sign in again (dev)\n            </Button>\n          ) : null}\n          {account?.providers.map((p) => (\n            <Button\n              key={p}\n              variant={identity.dev ? \"outline\" : \"primary\"}\n              disabled={busy}\n              onClick={() =>\n                void attempt(async () => {\n                  if ((await identity.withProvider(p)) === \"confirmed\") onDone();\n                }, false)\n              }\n            >\n              Continue with {providerLabel(p)}\n            </Button>\n          ))}\n          {account?.hasPassword ? (\n            <form className=\"flex gap-2\" onSubmit={(e) => { e.preventDefault(); if (password) void attempt(() => identity.withPassword(password)); }}>\n              <Field className=\"min-w-0 flex-1\" type=\"password\" autoComplete=\"current-password\" placeholder=\"Your password\" aria-label=\"Your password\" value={password} onChange={(e) => setPassword(e.target.value)} autoFocus />\n              <Button variant=\"outline\" type=\"submit\" disabled={busy || !password}>Confirm</Button>\n            </form>\n          ) : null}\n          {account?.email ? (\n            codeSent ? (\n              <form className=\"flex gap-2\" onSubmit={(e) => { e.preventDefault(); if (code.trim()) void attempt(() => identity.withEmailCode(code)); }}>\n                <Field className=\"min-w-0 flex-1\" inputMode=\"numeric\" autoComplete=\"one-time-code\" placeholder=\"Code from your email\" aria-label=\"Code from your email\" value={code} onChange={(e) => setCode(e.target.value)} autoFocus />\n                <Button variant=\"outline\" type=\"submit\" disabled={busy || !code.trim()}>Confirm</Button>\n              </form>\n            ) : (\n              <Button variant=\"quiet\" disabled={busy} onClick={() => void attempt(async () => { await identity.sendEmailCode(); setCodeSent(true); }, false)}>\n                Email me a code instead\n              </Button>\n            )\n          ) : null}\n          {error ? <p role=\"alert\" className=\"text-sm text-destructive\">{error}</p> : null}\n        </div>\n      </DialogContent>\n    </Dialog>\n  );\n}\n","import type { CSSProperties, ReactNode } from \"react\";\n\nimport {\n  GlobeIcon,\n  ArchiveIcon,\n  ArrowUpDownIcon,\n  BuildingIcon,\n  CameraIcon,\n  CheckIcon,\n  ChevronDownIcon,\n  ChevronLeftIcon,\n  ChevronRightIcon,\n  ClockIcon,\n  CodeIcon,\n  CreditCardIcon,\n  DatabaseIcon,\n  DownloadIcon,\n  ExternalLinkIcon,\n  EyeIcon,\n  EyeOffIcon,\n  FilePageIcon,\n  FileTextIcon,\n  FingerprintPatternIcon,\n  KeyIcon,\n  LayoutGridIcon,\n  ListIcon,\n  LockIcon,\n  MoreHorizontalIcon,\n  MoveIcon,\n  PencilIcon,\n  PlugIcon,\n  PlusIcon,\n  PowerIcon,\n  QrCodeIcon,\n  RefreshCwIcon,\n  RotateCcwIcon,\n  SendIcon,\n  ServerIcon,\n  ShareIcon,\n  ShieldIcon,\n  SlidersVerticalIcon,\n  StarIcon,\n  TagIcon,\n  TerminalIcon,\n  TrashIcon,\n  UploadIcon,\n  UserIcon,\n  UserRoundIcon,\n  XIcon,\n  withGlyphDefaults,\n} from \"@ai-matrx/design-system/icons\";\n\n/**\n * The vault's glyphs. Every lucide drawing lives once, in `@ai-matrx/design-system/icons` (the one lucide-free\n * glyph home, which also carries the optical-trim class); each name here is an alias of it. `SafeGlyph` is the\n * vault's own drawing (a strongbox: no lucide twin) and is the only one drawn in this file.\n */\nexport type Glyph = (props: { className?: string }) => ReactNode;\n\n/**\n * `air` = the empty 24-grid units left and right of the drawn ink (stroke included), measured with\n * getBBox. The design system's optical trim reads it (`--matrx-glyph-air-l/-r`) so an icon + label\n * button sits its INK, not its box, the same distance from both edges — exactly as it does for lucide.\n */\nfunction glyph(paths: ReactNode, air: readonly [number, number] = [1, 1]): Glyph {\n  const style = { \"--matrx-glyph-air-l\": air[0], \"--matrx-glyph-air-r\": air[1] } as CSSProperties;\n  return function VaultGlyph({ className }) {\n    return (\n      <svg className={className} style={style} viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" strokeWidth={2} strokeLinecap=\"round\" strokeLinejoin=\"round\" aria-hidden>\n        {paths}\n      </svg>\n    );\n  };\n}\n\nexport const KeyGlyph: Glyph = withGlyphDefaults(KeyIcon, {}, { air: [1, 2] });\nexport const NoteGlyph: Glyph = withGlyphDefaults(FileTextIcon, {}, { air: [3, 3] });\nexport const CardGlyph: Glyph = withGlyphDefaults(CreditCardIcon, {}, { air: [1, 1] });\nexport const PersonGlyph: Glyph = withGlyphDefaults(UserRoundIcon, {}, { air: [3, 3] });\nexport const DatabaseGlyph: Glyph = withGlyphDefaults(DatabaseIcon, {}, { air: [2, 2] });\nexport const ServerGlyph: Glyph = withGlyphDefaults(ServerIcon, {}, { air: [1, 1] });\nexport const TerminalGlyph: Glyph = withGlyphDefaults(TerminalIcon, {}, { air: [3, 3] });\nexport const FileGlyph: Glyph = withGlyphDefaults(FilePageIcon, {}, { air: [3, 3] });\nexport const CodeGlyph: Glyph = withGlyphDefaults(CodeIcon, {}, { air: [1, 1] });\nexport const StarGlyph: Glyph = withGlyphDefaults(StarIcon, {}, { air: [1, 1] });\nexport const PlusGlyph: Glyph = withGlyphDefaults(PlusIcon, {}, { air: [4, 4] });\nexport const EyeGlyph: Glyph = withGlyphDefaults(EyeIcon, {}, { air: [1, 1] });\nexport const EyeOffGlyph: Glyph = withGlyphDefaults(EyeOffIcon, {}, { air: [1, 1] });\nexport const LockGlyph: Glyph = withGlyphDefaults(LockIcon, {}, { air: [2, 2] });\nexport const ExternalGlyph: Glyph = withGlyphDefaults(ExternalLinkIcon, {}, { air: [2, 2] });\nexport const TrashGlyph: Glyph = withGlyphDefaults(TrashIcon, {}, { air: [2, 2] });\nexport const ArchiveGlyph: Glyph = withGlyphDefaults(ArchiveIcon, {}, { air: [1, 1] });\nexport const TagGlyph: Glyph = withGlyphDefaults(TagIcon, {}, { air: [1, 1] });\nexport const ShieldGlyph: Glyph = withGlyphDefaults(ShieldIcon, {}, { air: [3, 3] });\nexport const BuildingGlyph: Glyph = withGlyphDefaults(BuildingIcon, {}, { air: [3, 3] });\nexport const ChevronLeftGlyph: Glyph = withGlyphDefaults(ChevronLeftIcon, {}, { air: [8, 8] });\nexport const GridGlyph: Glyph = withGlyphDefaults(LayoutGridIcon, {}, { air: [2, 2] });\nexport const PlugGlyph: Glyph = withGlyphDefaults(PlugIcon, {}, { air: [5, 5] });\n\nconst FAMILY_GLYPHS: Record<string, Glyph> = {\n  databases: DatabaseGlyph,\n  server_network: ServerGlyph,\n  hosting_deployment: ServerGlyph,\n  source_control: CodeGlyph,\n  signing_files: FileGlyph,\n  identity_security: ShieldGlyph,\n  cloud_infrastructure: ServerGlyph,\n};\n\n/** A type's glyph: logins are a globe, then by family, else a key. */\nexport function definitionGlyph(key: string, family: string): Glyph {\n  if (key === \"username_password\" || key === \"website_login\") return GlobeIcon;\n  return FAMILY_GLYPHS[family] ?? KeyGlyph;\n}\nexport const XGlyph: Glyph = withGlyphDefaults(XIcon, {}, { air: [5, 5] });\nexport const PencilGlyph: Glyph = withGlyphDefaults(PencilIcon, {}, { air: [2, 2] });\nexport const ClockGlyph: Glyph = withGlyphDefaults(ClockIcon, {}, { air: [1, 1] });\n// ── core workspace glyphs ────────────────────────────────────────────────────\nexport const MoreGlyph: Glyph = withGlyphDefaults(MoreHorizontalIcon, {}, { air: [3, 3] });\nexport const ShareGlyph: Glyph = withGlyphDefaults(ShareIcon, {}, { air: [3, 3] });\nexport const ListGlyph: Glyph = withGlyphDefaults(ListIcon, {}, { air: [2, 2] });\nexport const ImportGlyph: Glyph = withGlyphDefaults(DownloadIcon, {}, { air: [2, 2] });\nexport const ExportGlyph: Glyph = withGlyphDefaults(UploadIcon, {}, { air: [2, 2] });\nexport const ChevronDownGlyph: Glyph = withGlyphDefaults(ChevronDownIcon, {}, { air: [5, 5] });\nexport const ChevronRightGlyph: Glyph = withGlyphDefaults(ChevronRightIcon, {}, { air: [8, 8] });\nexport const SortGlyph: Glyph = withGlyphDefaults(ArrowUpDownIcon, {}, { air: [2, 2] });\nexport const UserGlyph: Glyph = withGlyphDefaults(UserIcon, {}, { air: [5, 5] });\nexport const MoveGlyph: Glyph = withGlyphDefaults(MoveIcon, {}, { air: [1, 1] });\nexport const SafeGlyph = glyph(<><rect x=\"3\" y=\"3\" width=\"18\" height=\"18\" rx=\"2\" /><circle cx=\"12\" cy=\"12\" r=\"4\" /><path d=\"M12 8v1M12 15v1M8 12h1M15 12h1\" /></>, [2, 2]);\nexport const RestoreGlyph: Glyph = withGlyphDefaults(RotateCcwIcon, {}, { air: [2, 2] });\n// ── one-time passwords ───────────────────────────────────────────────────────\nexport const QrGlyph: Glyph = withGlyphDefaults(QrCodeIcon, {}, { air: [2, 2] });\nexport const CameraGlyph: Glyph = withGlyphDefaults(CameraIcon, {}, { air: [1, 1] });\nexport const CheckGlyph: Glyph = withGlyphDefaults(CheckIcon, {}, { air: [3, 3] });\nexport const PowerGlyph: Glyph = withGlyphDefaults(PowerIcon, {}, { air: [2, 2] });\n// ── generator and field settings ─────────────────────────────────────────────\nexport const RefreshGlyph: Glyph = withGlyphDefaults(RefreshCwIcon, {}, { air: [2, 2] });\nexport const SlidersGlyph: Glyph = withGlyphDefaults(SlidersVerticalIcon, {}, { air: [0, 0] });\nexport const UploadGlyph: Glyph = withGlyphDefaults(UploadIcon, {}, { air: [2, 2] });\n// ── browsers that can fill ───────────────────────────────────────────────────\nexport const FingerprintGlyph: Glyph = withGlyphDefaults(FingerprintPatternIcon, {}, { air: [1, 1] });\nexport const SendGlyph: Glyph = withGlyphDefaults(SendIcon, {}, { air: [1, 1] });\n","import { createContext, useCallback, useContext, useEffect, useRef, useState, type ReactNode } from \"react\";\nimport { cn } from \"@ai-matrx/design-system\";\nimport { copyText } from \"@ai-matrx/kit/clipboard\";\nimport type { VaultClipboard } from \"./lock\";\n\nexport type NoticeKind = \"success\" | \"error\" | \"info\";\nexport type Notify = (message: string, kind?: NoticeKind) => void;\n\nconst Ctx = createContext<Notify>(() => undefined);\n\n/** Say something short to the person (\"Password copied\"). Hosts with their own toasts pass `notify`. */\nexport function useNotify(): Notify {\n  return useContext(Ctx);\n}\n\nexport interface CopyOptions {\n  /** A secret (a password, a code, a key): the host's clipboard takes custody. Default true. */\n  secret?: boolean;\n}\n\n/**\n * Writes `text` and says so (or says why not). Through the host's clipboard when it has one (custody:\n * the host clears a secret later), else the browser's. Pure over its inputs, so it is tested alone.\n */\nexport async function copyValue(text: string, label: string, options: CopyOptions, deps: { clipboard?: VaultClipboard | undefined; notify: Notify }): Promise<boolean> {\n  const secret = options.secret ?? true;\n  if (deps.clipboard) {\n    try {\n      const copied = await deps.clipboard.copy(text, { secret });\n      deps.notify(copiedLine(label, copied?.clearsAtMs ?? null), \"success\");\n      return true;\n    } catch (e) {\n      deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, \"error\");\n      return false;\n    }\n  }\n  return copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === \"error\" ? \"error\" : \"success\") });\n}\n\n/** \"Password copied\", or \"Password copied. Clears at 3:42 PM\" when the host says when it clears it. */\nexport function copiedLine(label: string, clearsAtMs: number | null): string {\n  if (clearsAtMs === null || !Number.isFinite(clearsAtMs)) return `${label} copied`;\n  const at = new Date(clearsAtMs).toLocaleTimeString(undefined, { hour: \"numeric\", minute: \"2-digit\" });\n  return `${label} copied. Clears at ${at}`;\n}\n\nconst ClipboardCtx = createContext<VaultClipboard | undefined>(undefined);\n\n/** The host's clipboard (`host.clipboard`), for every copy below it. */\nexport function ClipboardProvider({ clipboard, children }: { clipboard: VaultClipboard | undefined; children: ReactNode }) {\n  return <ClipboardCtx.Provider value={clipboard}>{children}</ClipboardCtx.Provider>;\n}\n\n/** THE copy for every vault screen: writes, then says so (or says why not). */\nexport function useCopy(): (text: string, label: string, options?: CopyOptions) => Promise<boolean> {\n  const notify = useNotify();\n  const clipboard = useContext(ClipboardCtx);\n  return useCallback((text, label, options = {}) => copyValue(text, label, options, { clipboard, notify }), [notify, clipboard]);\n}\n\n/**\n * The vault's own notice line, so feedback exists in every host (an extension side panel has no app\n * toaster). A host that has one passes `notify` and this draws nothing.\n */\nexport function NoticeProvider({ notify, children }: { notify?: Notify | undefined; children: ReactNode }) {\n  const [shown, setShown] = useState<{ message: string; kind: NoticeKind; n: number } | null>(null);\n  const timer = useRef<ReturnType<typeof setTimeout> | null>(null);\n  const local = useCallback<Notify>((message, kind = \"success\") => {\n    if (timer.current) clearTimeout(timer.current);\n    setShown((s) => ({ message, kind, n: (s?.n ?? 0) + 1 }));\n    timer.current = setTimeout(() => setShown(null), kind === \"error\" ? 5000 : 2200);\n  }, []);\n  useEffect(() => () => void (timer.current && clearTimeout(timer.current)), []);\n  return (\n    <Ctx.Provider value={notify ?? local}>\n      {children}\n      {!notify ? (\n        <div aria-live=\"polite\" className=\"pointer-events-none absolute inset-x-0 bottom-4 z-30 flex justify-center px-4\">\n          {shown ? (\n            <div key={shown.n} role=\"status\" className={cn(\"rounded-full border border-border bg-popover px-4 py-2 text-sm shadow-lg\", shown.kind === \"error\" ? \"text-destructive\" : \"text-foreground\")}>\n              {shown.message}\n            </div>\n          ) : null}\n        </div>\n      ) : null}\n    </Ctx.Provider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC0EO,IAAM,qBAAqB;AAElC,IAAM,mBAAmB,KAAK;AAE9B,IAAM,cAAc;AAGb,SAAS,uBAAuB,MAAwB,UAAmC,CAAC,GAAkB;AACnH,MAAI,KAAkD;AACtD,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,QAAQ,MAA0B;AACtC,QAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,QAAI;AACF,aAAQ,WAAgD,kBAAkB;AAAA,IAC5E,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,YAAY;AACtB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,QAAQ;AACpC,QAAI,CAAC,KAAK,KAAM,OAAM,IAAI,MAAM,oCAAoC;AACpE,SAAK,EAAE,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,SAAS,KAAK;AACxD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,WAAW,CAAC,OAA2B;AAC3C,QAAI,CAAC,MAAM,OAAO,GAAG,GAAI,OAAM,IAAI,MAAM,WAAW;AAAA,EACtD;AACA,QAAM,WAA0B;AAAA,IAC9B,MAAM,UAAU;AACd,YAAM,IAAI,MAAM,IAAI;AACpB,YAAM,QAAQ,oBAAI,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,GAAI,EAAE,cAAc,aAAa,CAAC,CAAE,CAAC;AAC5G,aAAO,EAAE,OAAO,EAAE,SAAS,MAAM,WAAW,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,MAAM,MAAM,WAAW,MAAM,OAAO,GAAG,aAAa,MAAM,IAAI,OAAO,EAAE;AAAA,IACxI;AAAA,IACA,MAAM,aAAa,UAAU;AAC3B,YAAM,IAAI,MAAM,IAAI;AAEpB,YAAM,GAAG,QAAQ,oBAAoB,KAAK,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,SAAS,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;AACpG,YAAM,aAAa,QAAQ,aAAa,KAAK,WAAW,UAAU;AAElE,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB,EAAE,UAA6B,GAAI,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,EAAG,CAAC;AAChI,UAAI,OAAO;AACT,cAAM,GAAG,WAAW,kBAAkB;AACtC,cAAM,IAAI,MAAM,MAAM,OAAO;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,MAAM,cAAc;AAClB,YAAM,IAAI,MAAM;AAChB,YAAM,MAAM,GAAG,QAAQ,kBAAkB,KAAK;AAC9C,UAAI,CAAC,KAAK,QAAQ,KAAM,QAAO;AAC/B,QAAE,WAAW,kBAAkB;AAC/B,UAAI;AACJ,UAAI;AACF,mBAAW,KAAK,MAAM,GAAG;AAAA,MAC3B,QAAQ;AACN,eAAO;AAAA,MACT;AACA,UAAI,OAAO,SAAS,OAAO,YAAY,OAAO,SAAS,OAAO,YAAY,IAAI,IAAI,SAAS,KAAK,iBAAkB,QAAO;AACzH,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,QAAQ;AACpC,UAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAS,GAAI,QAAO;AACvD,YAAM,QAAQ,OAAO,SAAS,UAAU,YAAY,SAAS,QAAQ,SAAS,QAAQ;AACtF,YAAM,UAAU,iEAAiE,QAAQ,qBAAqB,KAAK,MAAM,iBAAiB;AAC1I,WAAK;AACL,UAAI,QAAQ,kBAAmB,OAAM,QAAQ,kBAAkB,OAAO;AAAA,UACjE,OAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAC5C,aAAO;AAAA,IACT;AAAA,IACA,MAAM,aAAa,UAAU;AAC3B,YAAM,IAAI,MAAM,IAAI;AACpB,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,4CAA4C;AAC1E,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,mBAAmB,EAAE,OAAO,EAAE,OAAO,SAAS,CAAC;AAClF,UAAI,MAAO,OAAM,IAAI,MAAM,iCAAiC;AAC5D,eAAS,KAAK,MAAM,EAAE;AAAA,IACxB;AAAA,IACA,MAAM,gBAAgB;AACpB,YAAM,IAAI,MAAM,IAAI;AACpB,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,8CAA8C;AAC5E,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,cAAc,EAAE,OAAO,EAAE,OAAO,SAAS,EAAE,kBAAkB,MAAM,EAAE,CAAC;AACnG,UAAI,MAAO,OAAM,IAAI,MAAM,MAAM,OAAO;AAAA,IAC1C;AAAA,IACA,MAAM,cAAc,MAAM;AACxB,YAAM,IAAI,MAAO,MAAM,IAAI;AAC3B,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,4BAA4B;AAC1D,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,UAAU,EAAE,OAAO,EAAE,OAAO,OAAO,KAAK,KAAK,GAAG,MAAM,QAAQ,CAAC;AAClG,UAAI,MAAO,OAAM,IAAI,MAAM,0DAA0D;AACrF,eAAS,KAAK,MAAM,EAAE;AAAA,IACxB;AAAA,EACF;AACA,MAAI,QAAQ,IAAK,UAAS,MAAM,QAAQ;AACxC,SAAO;AACT;AAGO,SAAS,kBAAkB,GAAqB;AACrD,QAAM,MAAM;AACZ,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,SAAS,uBAAwB,QAAO;AAGhD,QAAM,OAAO,CAAC,IAAI,SAAS,KAAK,UAAU,IAAI,gBAAgB,EAAE,CAAC,EAAE,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC7H,SAAO,0EAA0E,KAAK,IAAI;AAC5F;;;AC9KA,IAAAA,gBAAuF;AACvF,IAAAC,wBAAoF;AACpF,sBAA8B;;;ACA9B,mBAgDO;AAkBD;AAJN,SAAS,MAAM,OAAkB,MAAiC,CAAC,GAAG,CAAC,GAAU;AAC/E,QAAM,QAAQ,EAAE,uBAAuB,IAAI,CAAC,GAAG,uBAAuB,IAAI,CAAC,EAAE;AAC7E,SAAO,SAAS,WAAW,EAAE,UAAU,GAAG;AACxC,WACE,4CAAC,SAAI,WAAsB,OAAc,SAAQ,aAAY,MAAK,QAAO,QAAO,gBAAe,aAAa,GAAG,eAAc,SAAQ,gBAAe,SAAQ,eAAW,MACpK,iBACH;AAAA,EAEJ;AACF;AAEO,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,gBAAmB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,6BAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,kBAAqB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,gBAAmB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,oBAAuB,gCAAkB,+BAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACpF,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,mBAAsB,gCAAkB,0BAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,uBAA0B,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,gBAAmB,gCAAkB,6BAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAiBxE,IAAM,aAAgB,gCAAkB,oBAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE1E,IAAM,gBAAmB,gCAAkB,iCAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,kBAAqB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,uBAA0B,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,wBAA2B,gCAAkB,+BAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,IAAM,gBAAmB,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,YAAY,MAAM,4EAAE;AAAA,8CAAC,UAAK,GAAE,KAAI,GAAE,KAAI,OAAM,MAAK,QAAO,MAAK,IAAG,KAAI;AAAA,EAAE,4CAAC,YAAO,IAAG,MAAK,IAAG,MAAK,GAAE,KAAI;AAAA,EAAE,4CAAC,UAAK,GAAE,kCAAiC;AAAA,GAAE,GAAK,CAAC,GAAG,CAAC,CAAC;AAClK,IAAM,mBAAsB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAEhF,IAAM,cAAiB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE1E,IAAM,mBAAsB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,mBAAsB,gCAAkB,kCAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE5E,IAAM,uBAA0B,gCAAkB,qCAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7F,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;;;AC7I/E,mBAAoG;AACpG,2BAAmB;AACnB,uBAAyB;AAgDhB,IAAAC,sBAAA;AA1CT,IAAM,UAAM,4BAAsB,MAAM,MAAS;AAG1C,SAAS,YAAoB;AAClC,aAAO,yBAAW,GAAG;AACvB;AAiCA,IAAM,mBAAe,4BAA0C,MAAS;;;AFuBtD,IAAAC,sBAAA;AAvDlB,IAAM,YAAY;AAEX,IAAM,uBAAuB;AACpC,IAAMC,WAAM,6BAAyB,CAAC,QAAQ,IAAI,CAAC;AAE5C,SAAS,eAA0B;AACxC,aAAO,0BAAWA,IAAG;AACvB;AAEA,IAAM,iBAAyC,EAAE,QAAQ,UAAU,QAAQ,UAAU,OAAO,aAAa,OAAO,SAAS,eAAe,YAAY,YAAY,SAAS,SAAS,WAAW,UAAU,WAAW;AAClN,IAAM,gBAAgB,CAAC,MAAc,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC;AAExF,SAAS,aAAa,EAAE,UAAU,SAAS,GAAiE;AACjH,QAAM,CAAC,QAAQ,SAAS,QAAI,wBAAS,KAAK;AAC1C,QAAM,SAAS,UAAU;AACzB,QAAM,cAAU,sBAA8D,CAAC,CAAC;AAEhF,QAAM,CAAC,eAAe,gBAAgB,QAAI,wBAAwB,IAAI;AACtE,+BAAU,MAAM;AACd,QAAI,CAAC,UAAU,YAAa;AAC5B,QAAI,OAAO;AACX,aAAS,YAAY,EAAE;AAAA,MACrB,CAAC,YAAY,QAAQ,WAAW,iBAAiB,OAAO;AAAA,MACxD,CAAC,MAAe,QAAQ,iBAAiB,aAAa,QAAQ,EAAE,UAAU,kDAAkD;AAAA,IAC9H;AACA,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,YAAuB,OAAO,QAAQ;AAC1C,QAAI;AACF,aAAO,MAAM,IAAI;AAAA,IACnB,SAAS,GAAG;AACV,UAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAG,OAAM;AAC9C,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,gBAAQ,QAAQ,KAAK,EAAE,SAAS,OAAO,CAAC;AACxC,kBAAU,IAAI;AAAA,MAChB,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA,EACF;AAEA,QAAM,SAAS,CAAC,OAAgB;AAC9B,UAAM,IAAI,QAAQ;AAClB,YAAQ,UAAU,CAAC;AACnB,cAAU,KAAK;AACf,eAAW,KAAK,EAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,OAAO,IAAI,MAAM,SAAS,CAAC;AAEpE,QAAI,CAAC,MAAM,EAAE,SAAS,EAAG,QAAO,sBAAsB,MAAM;AAAA,EAC9D;AAEA,SACE,8CAACA,KAAI,UAAJ,EAAa,OAAO,WAClB;AAAA;AAAA,IACA,WAAW,6CAAC,yBAAsB,MAAM,QAAQ,UAAoB,QAAQ,MAAM,OAAO,IAAI,GAAG,UAAU,MAAM,OAAO,KAAK,GAAG,IAAK;AAAA,IACrI,6CAAC,gCAAO,MAAM,kBAAkB,MAAM,cAAc,CAAC,MAAO,IAAI,SAAY,iBAAiB,IAAI,GAC/F,wDAAC,uCAAc,MAAK,MAClB;AAAA,oDAAC,sCACC;AAAA,qDAAC,qCAAY,+BAAiB;AAAA,QAC9B,6CAAC,2CAAmB,yBAAc;AAAA,SACpC;AAAA,MACA,6CAAC,SAAI,WAAU,oBACb,uDAAC,0BAAO,SAAQ,WAAU,SAAS,MAAM,iBAAiB,IAAI,GAAG,gBAAE,GACrE;AAAA,OACF,GACF;AAAA,KACF;AAEJ;AAGO,IAAM,eAAe,CAAC,MAAe,aAAa,SAAS,EAAE,YAAY;AAEhF,SAAS,sBAAsB,EAAE,MAAM,UAAU,QAAQ,SAAS,GAAyF;AACzJ,QAAM,CAAC,SAAS,UAAU,QAAI,wBAAiC,IAAI;AACnE,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAS,EAAE;AACnC,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,KAAK;AAC9C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAS,KAAK;AACtC,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAwB,IAAI;AAEtD,+BAAU,MAAM;AACd,QAAI,CAAC,KAAM;AACX,gBAAY,EAAE;AACd,YAAQ,EAAE;AACV,gBAAY,KAAK;AACjB,aAAS,IAAI;AACb,aAAS,QAAQ,EAAE,KAAK,YAAY,CAAC,MAAe,SAAS,aAAa,QAAQ,EAAE,UAAU,iCAAiC,CAAC;AAAA,EAClI,GAAG,CAAC,MAAM,QAAQ,CAAC;AAEnB,QAAM,UAAU,OAAO,MAA2B,OAAO,SAAS;AAChE,YAAQ,IAAI;AACZ,aAAS,IAAI;AACb,QAAI;AACF,YAAM,KAAK;AACX,UAAI,KAAM,QAAO;AAAA,IACnB,SAAS,GAAG;AACV,eAAS,aAAa,QAAQ,EAAE,UAAU,+BAA+B;AAAA,IAC3E,UAAE;AACA,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAEA,SACE,6CAAC,gCAAO,MAAY,cAAc,CAAC,MAAO,IAAI,SAAY,SAAS,GACjE,wDAAC,uCAAc,MAAK,MAClB;AAAA,kDAAC,sCACC;AAAA,oDAAC,SAAI,WAAU,2BACb;AAAA,qDAAC,eAAY,WAAU,uBAAsB;AAAA,QAC7C,6CAAC,qCAAY,mCAAgB;AAAA,SAC/B;AAAA,MACA,8CAAC,2CAAkB;AAAA;AAAA,QAA4B,SAAS,QAAQ,OAAO,QAAQ,KAAK,KAAK;AAAA,QAAG;AAAA,SAAC;AAAA,OAC/F;AAAA,IACA,8CAAC,SAAI,WAAU,uBACZ;AAAA,eAAS,MACR,6CAAC,0BAAO,SAAQ,WAAU,UAAU,MAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ,CAAC,GAAG,iCAEpH,IACE;AAAA,MACH,SAAS,UAAU,IAAI,CAAC,MACvB;AAAA,QAAC;AAAA;AAAA,UAEC,SAAS,SAAS,MAAM,YAAY;AAAA,UACpC,UAAU;AAAA,UACV,SAAS,MACP,KAAK,QAAQ,YAAY;AACvB,gBAAK,MAAM,SAAS,aAAa,CAAC,MAAO,YAAa,QAAO;AAAA,UAC/D,GAAG,KAAK;AAAA,UAEX;AAAA;AAAA,YACgB,cAAc,CAAC;AAAA;AAAA;AAAA,QATzB;AAAA,MAUP,CACD;AAAA,MACA,SAAS,cACR,8CAAC,UAAK,WAAU,cAAa,UAAU,CAAC,MAAM;AAAE,UAAE,eAAe;AAAG,YAAI,SAAU,MAAK,QAAQ,MAAM,SAAS,aAAa,QAAQ,CAAC;AAAA,MAAG,GACrI;AAAA,qDAAC,yBAAM,WAAU,kBAAiB,MAAK,YAAW,cAAa,oBAAmB,aAAY,iBAAgB,cAAW,iBAAgB,OAAO,UAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK,GAAG,WAAS,MAAC;AAAA,QAClN,6CAAC,0BAAO,SAAQ,WAAU,MAAK,UAAS,UAAU,QAAQ,CAAC,UAAU,qBAAO;AAAA,SAC9E,IACE;AAAA,MACH,SAAS,QACR,WACE,8CAAC,UAAK,WAAU,cAAa,UAAU,CAAC,MAAM;AAAE,UAAE,eAAe;AAAG,YAAI,KAAK,KAAK,EAAG,MAAK,QAAQ,MAAM,SAAS,cAAc,IAAI,CAAC;AAAA,MAAG,GACrI;AAAA,qDAAC,yBAAM,WAAU,kBAAiB,WAAU,WAAU,cAAa,iBAAgB,aAAY,wBAAuB,cAAW,wBAAuB,OAAO,MAAM,UAAU,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK,GAAG,WAAS,MAAC;AAAA,QACzN,6CAAC,0BAAO,SAAQ,WAAU,MAAK,UAAS,UAAU,QAAQ,CAAC,KAAK,KAAK,GAAG,qBAAO;AAAA,SACjF,IAEA,6CAAC,0BAAO,SAAQ,SAAQ,UAAU,MAAM,SAAS,MAAM,KAAK,QAAQ,YAAY;AAAE,cAAM,SAAS,cAAc;AAAG,oBAAY,IAAI;AAAA,MAAG,GAAG,KAAK,GAAG,qCAEhJ,IAEA;AAAA,MACH,QAAQ,6CAAC,OAAE,MAAK,SAAQ,WAAU,4BAA4B,iBAAM,IAAO;AAAA,OAC9E;AAAA,KACF,GACF;AAEJ;","names":["import_react","import_design_system","import_jsx_runtime","import_jsx_runtime","Ctx"]}

package/dist/identity.d.cts

@@ -0,0 +1,152 @@
+import * as react from 'react';
+import { ReactNode } from 'react';
+
+/**
+ * CONFIRM IT'S YOU. The server shows or exports a secret only after a sign-in from the last few
+ * minutes (`recent_auth_required`). Every host signs people in with Supabase, so the one way to
+ * produce a fresh sign-in lives here, over the host's own auth client — whichever way the person
+ * signs in: Google (or any connected provider), a password, or a code sent to their email.
+ */
+/** How a person can prove it is them again. Ordered by what the account actually uses. */
+type IdentityMethod = "provider" | "password" | "email_code" | "dev";
+interface IdentityAccount {
+    email: string | null;
+    /** Connected sign-in providers on the account (`google`, `github`, …), never `email`. */
+    providers: readonly string[];
+    hasPassword: boolean;
+}
+interface VaultIdentity {
+    account(): Promise<IdentityAccount>;
+    /**
+     * Confirms with that provider. On the web it leaves the page and comes back to the same address
+     * (resolves with nothing: the page is going away). A host that confirms IN PLACE (the desktop's
+     * Touch ID, a browser sign-in it waits for) resolves `"confirmed"`, and the gate closes and runs
+     * the refused call again — one confirmation, never a second click.
+     */
+    withProvider(provider: string): Promise<void | "confirmed">;
+    withPassword(password: string): Promise<void>;
+    sendEmailCode(): Promise<void>;
+    withEmailCode(code: string): Promise<void>;
+    /** A host-only path with no human step (the playground's dev server). */
+    dev?: () => Promise<void>;
+    /**
+     * Run once when the page loads. After a provider confirmation left the page and came back, it
+     * checks the SAME person is signed in. A different account is signed out of this device and the
+     * sentence to show is returned; otherwise null.
+     */
+    checkReturn?: () => Promise<string | null>;
+}
+/** The slice of supabase-js `auth` this needs, so the package never depends on supabase-js itself. */
+interface SupabaseAuthLike {
+    getUser(): Promise<{
+        data: {
+            user: {
+                id: string;
+                email?: string | null;
+                identities?: {
+                    provider: string;
+                }[] | null;
+                app_metadata?: {
+                    providers?: string[];
+                };
+            } | null;
+        };
+        error: unknown;
+    }>;
+    signInWithPassword(c: {
+        email: string;
+        password: string;
+    }): Promise<{
+        data: {
+            user: {
+                id: string;
+            } | null;
+        };
+        error: {
+            message: string;
+        } | null;
+    }>;
+    signInWithOtp(c: {
+        email: string;
+        options?: {
+            shouldCreateUser?: boolean;
+        };
+    }): Promise<{
+        error: {
+            message: string;
+        } | null;
+    }>;
+    verifyOtp(c: {
+        email: string;
+        token: string;
+        type: "email";
+    }): Promise<{
+        data: {
+            user: {
+                id: string;
+            } | null;
+        };
+        error: {
+            message: string;
+        } | null;
+    }>;
+    signInWithOAuth(c: {
+        provider: never;
+        options?: {
+            redirectTo?: string;
+        };
+    }): Promise<{
+        error: {
+            message: string;
+        } | null;
+    }>;
+    /** Used only when the host gives no `onDifferentPerson`: ends THIS device's session, never others. */
+    signOut?(o: {
+        scope: "local";
+    }): Promise<{
+        error: unknown;
+    }>;
+}
+/** Where the person confirming is remembered while the page is away at the provider. */
+interface ReturnStore {
+    getItem(key: string): string | null;
+    setItem(key: string, value: string): void;
+    removeItem(key: string): void;
+}
+interface SupabaseIdentityOptions {
+    /** The host's accepted OAuth return address carrying this page. */
+    redirectTo?: () => string;
+    dev?: () => Promise<void>;
+    /**
+     * A provider confirmation came back signed in as someone else. The host ends that session on THIS
+     * device only (its own device-scoped sign-out) and tells the person; `message` says what happened.
+     * Without it the package signs out locally through `auth.signOut({ scope: "local" })`.
+     */
+    onDifferentPerson?: (message: string) => Promise<void> | void;
+    /** Default: the tab's `sessionStorage`. */
+    store?: ReturnStore;
+    /** Default `Date.now`. */
+    now?: () => number;
+}
+/** The key the expected person is kept under across the provider's redirect. */
+declare const CONFIRM_RETURN_KEY = "matrx-vault:confirming-as";
+/** THE identity confirmation for every host: give it the host's `supabase.auth`. */
+declare function createSupabaseIdentity(auth: SupabaseAuthLike, options?: SupabaseIdentityOptions): VaultIdentity;
+/** True when the server refused because the sign-in is not recent enough. */
+declare function needsRecentSignIn(e: unknown): boolean;
+
+/**
+ * Wrap any call that shows, copies or exports a secret. When the server answers "sign in again",
+ * the person confirms it is them (Google, password, or an emailed code) and the call runs again —
+ * they never see a dead "Authentication required" in the row.
+ */
+type Confirmed = <T>(run: () => Promise<T>) => Promise<T>;
+declare function useConfirmed(): Confirmed;
+declare function IdentityGate({ identity, children }: {
+    identity: VaultIdentity | undefined;
+    children: ReactNode;
+}): react.JSX.Element;
+/** True for the rejection a canceled confirmation produces (callers stay quiet about it). */
+declare const wasCancelled: (e: unknown) => boolean;
+
+export { CONFIRM_RETURN_KEY, type Confirmed, type IdentityAccount, IdentityGate, type IdentityMethod, type ReturnStore, type SupabaseAuthLike, type SupabaseIdentityOptions, type VaultIdentity, createSupabaseIdentity, needsRecentSignIn, useConfirmed, wasCancelled };