@ai-matrx/vault 0.1.34 → 0.1.36

package/CHANGELOG.md

@@ -1,9 +1,40 @@
 # Changelog
 
+## 0.1.36
+
+- **0.1.33 migration regressions fixed** (2026-10-23): the selected list row is readable again (primary fill, `selectedStyle="primary"`, no `data-surface` on a quiet Tile) and keeps room for its More button with a one-line subtitle; every Authenticator code shows the code as its label with "Copy code" as the tooltip and never squeezes (`fit`), and the list row's name keeps its width; type families nested under a sidebar category are indented again (`level`); the desktop look's selected sidebar row is the soft fill; "Sign me in" no longer makes Fill say "Filling…" (it says "Signing in…" itself); with a passphrase minimum the backup hint keeps "It can't be recovered." Proof: `src/review-0-1-36.test.tsx`. Consumer action: needs `@ai-matrx/design-system` with the Tile options above (the release train publishes both); nothing else.
+
+## 0.1.35
+
+SOURCE CHANGED WITH NO RELEASE NOTE. This release shipped source changes that nobody described in an Unreleased entry,
+so they may include breaking API changes. Consumer action is UNKNOWN: read the diff before upgrading.
+Diff: `git diff aea0aaaeaf 0a2b8c9356 -- apps/shared/vault/src`
+
+Changed shipped source files (2):
+- `apps/shared/vault/src/identity.ts`
+- `apps/shared/vault/src/index.ts`
+
 ## 0.1.34
 
-UNVERIFIED: this release has no Unreleased entry and the source comparison could not be made (the caller supplied no source comparison). Whether source changed is unknown; consumer action is unknown.
-Check the package's gitHead on npm against this version's gitHead: `git diff <previous gitHead> <this gitHead> -- apps/shared/vault/src`.
+Automatic changed-only republish (docs/metadata drift since the last published version; verified: `git diff bbcbc0da70 aea0aaaeaf -- apps/shared/vault/src`
+has no shipped-source changes outside tests, fixtures and docs). No consumer action required.
+
+## 0.1.33
+
+SOURCE CHANGED WITH NO RELEASE NOTE. This release shipped source changes that nobody described in an Unreleased entry,
+so they may include breaking API changes. Consumer action is UNKNOWN: read the diff before upgrading.
+Diff: `git diff 0e7ef77cdc bbcbc0da70 -- apps/shared/vault/src`
+
+Changed shipped source files (9):
+- `apps/shared/vault/src/FieldRows.tsx`
+- `apps/shared/vault/src/ItemList.tsx`
+- `apps/shared/vault/src/NewItemFlow.tsx`
+- `apps/shared/vault/src/Sidebar.tsx`
+- `apps/shared/vault/src/VaultApp.tsx`
+- `apps/shared/vault/src/authenticator/AuthenticatorView.tsx`
+- `apps/shared/vault/src/authenticator/CodeParts.tsx`
+- `apps/shared/vault/src/extension/PageView.tsx`
+- `apps/shared/vault/src/io/ImportPanel.tsx`
 
 ## 0.1.32
 

package/dist/identity.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/identity.ts","../src/auth/identity.ts","../src/auth/IdentityGate.tsx","../src/glyphs.tsx","../src/notice.tsx"],"sourcesContent":["/**\n * `@ai-matrx/vault/identity` — \"Confirm it's you\" without the Vault workspace.\n *\n * The identity seam and its gate dialog, for a host that only needs a recent-sign-in check (the\n * share sheet's secure links). Importing them from the root pulled the whole Vault (every screen,\n * the importers, zip.js) into that host's build graph; this entry reaches only the gate.\n */\nexport { CONFIRM_RETURN_KEY, createSupabaseIdentity, needsRecentSignIn, type IdentityAccount, type IdentityMethod, type ReturnStore, type SupabaseAuthLike, type SupabaseIdentityOptions, type VaultIdentity } from \"./auth/identity\";\nexport { IdentityGate, useConfirmed, wasCancelled, type Confirmed } from \"./auth/IdentityGate\";\n","/**\n * CONFIRM IT'S YOU. The server shows or exports a secret only after a sign-in from the last few\n * minutes (`recent_auth_required`). Every host signs people in with Supabase, so the one way to\n * produce a fresh sign-in lives here, over the host's own auth client — whichever way the person\n * signs in: Google (or any connected provider), a password, or a code sent to their email.\n */\n\n/** How a person can prove it is them again. Ordered by what the account actually uses. */\nexport type IdentityMethod = \"provider\" | \"password\" | \"email_code\" | \"dev\";\n\nexport interface IdentityAccount {\n  email: string | null;\n  /** Connected sign-in providers on the account (`google`, `github`, …), never `email`. */\n  providers: readonly string[];\n  hasPassword: boolean;\n}\n\nexport interface VaultIdentity {\n  account(): Promise<IdentityAccount>;\n  /**\n   * Confirms with that provider. On the web it leaves the page and comes back to the same address\n   * (resolves with nothing: the page is going away). A host that confirms IN PLACE (the desktop's\n   * Touch ID, a browser sign-in it waits for) resolves `\"confirmed\"`, and the gate closes and runs\n   * the refused call again — one confirmation, never a second click.\n   */\n  withProvider(provider: string): Promise<void | \"confirmed\">;\n  withPassword(password: string): Promise<void>;\n  sendEmailCode(): Promise<void>;\n  withEmailCode(code: string): Promise<void>;\n  /** A host-only path with no human step (the playground's dev server). */\n  dev?: () => Promise<void>;\n  /**\n   * Run once when the page loads. After a provider confirmation left the page and came back, it\n   * checks the SAME person is signed in. A different account is signed out of this device and the\n   * sentence to show is returned; otherwise null.\n   */\n  checkReturn?: () => Promise<string | null>;\n}\n\n/** The slice of supabase-js `auth` this needs, so the package never depends on supabase-js itself. */\nexport interface SupabaseAuthLike {\n  getUser(): Promise<{ data: { user: { id: string; email?: string | null; identities?: { provider: string }[] | null; app_metadata?: { providers?: string[] } } | null }; error: unknown }>;\n  signInWithPassword(c: { email: string; password: string }): Promise<{ data: { user: { id: string } | null }; error: { message: string } | null }>;\n  signInWithOtp(c: { email: string; options?: { shouldCreateUser?: boolean } }): Promise<{ error: { message: string } | null }>;\n  verifyOtp(c: { email: string; token: string; type: \"email\" }): Promise<{ data: { user: { id: string } | null }; error: { message: string } | null }>;\n  signInWithOAuth(c: { provider: never; options?: { redirectTo?: string } }): Promise<{ error: { message: string } | null }>;\n  /** Used only when the host gives no `onDifferentPerson`: ends THIS device's session, never others. */\n  signOut?(o: { scope: \"local\" }): Promise<{ error: unknown }>;\n}\n\n/** Where the person confirming is remembered while the page is away at the provider. */\nexport interface ReturnStore {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\nexport interface SupabaseIdentityOptions {\n  /** The host's accepted OAuth return address carrying this page. */\n  redirectTo?: () => string;\n  dev?: () => Promise<void>;\n  /**\n   * A provider confirmation came back signed in as someone else. The host ends that session on THIS\n   * device only (its own device-scoped sign-out) and tells the person; `message` says what happened.\n   * Without it the package signs out locally through `auth.signOut({ scope: \"local\" })`.\n   */\n  onDifferentPerson?: (message: string) => Promise<void> | void;\n  /** Default: the tab's `sessionStorage`. */\n  store?: ReturnStore;\n  /** Default `Date.now`. */\n  now?: () => number;\n}\n\n/** The key the expected person is kept under across the provider's redirect. */\nexport const CONFIRM_RETURN_KEY = \"matrx-vault:confirming-as\";\n/** A remembered confirmation older than this is stale (the person never came back from it). */\nconst RETURN_WINDOW_MS = 15 * 60_000;\n\nconst SAME_PERSON = \"That signed in a different account. Use the account this vault belongs to.\";\n\n/** THE identity confirmation for every host: give it the host's `supabase.auth`. */\nexport function createSupabaseIdentity(auth: SupabaseAuthLike, options: SupabaseIdentityOptions = {}): VaultIdentity {\n  let me: { id: string; email: string | null } | null = null;\n  const now = options.now ?? Date.now;\n  const store = (): ReturnStore | null => {\n    if (options.store) return options.store;\n    try {\n      return (globalThis as { sessionStorage?: ReturnStore }).sessionStorage ?? null;\n    } catch {\n      return null;\n    }\n  };\n  const who = async () => {\n    const { data } = await auth.getUser();\n    if (!data.user) throw new Error(\"You are signed out. Sign in again.\");\n    me = { id: data.user.id, email: data.user.email ?? null };\n    return data.user;\n  };\n  const sameUser = (id: string | undefined) => {\n    if (!me || id !== me.id) throw new Error(SAME_PERSON);\n  };\n  const identity: VaultIdentity = {\n    async account() {\n      const u = await who();\n      const names = new Set([...(u.identities ?? []).map((i) => i.provider), ...(u.app_metadata?.providers ?? [])]);\n      return { email: u.email ?? null, providers: [...names].filter((p) => p !== \"email\" && p !== \"phone\"), hasPassword: names.has(\"email\") };\n    },\n    async withProvider(provider) {\n      const u = await who();\n      // Remembered across the redirect, so the page that loads back can check the same person came back.\n      store()?.setItem(CONFIRM_RETURN_KEY, JSON.stringify({ id: u.id, email: u.email ?? null, at: now() }));\n      const redirectTo = options.redirectTo?.() ?? globalThis.location?.href;\n      // `provider` is a supabase-js Provider string; the structural type keeps supabase-js out of the package.\n      const { error } = await auth.signInWithOAuth({ provider: provider as never, ...(redirectTo ? { options: { redirectTo } } : {}) });\n      if (error) {\n        store()?.removeItem(CONFIRM_RETURN_KEY);\n        throw new Error(error.message);\n      }\n    },\n    async checkReturn() {\n      const s = store();\n      const raw = s?.getItem(CONFIRM_RETURN_KEY) ?? null;\n      if (!s || raw === null) return null;\n      s.removeItem(CONFIRM_RETURN_KEY);\n      let expected: { id?: unknown; email?: unknown; at?: unknown };\n      try {\n        expected = JSON.parse(raw) as typeof expected;\n      } catch {\n        return null;\n      }\n      if (typeof expected.id !== \"string\" || typeof expected.at !== \"number\" || now() - expected.at > RETURN_WINDOW_MS) return null;\n      const { data } = await auth.getUser();\n      if (!data.user || data.user.id === expected.id) return null;\n      const email = typeof expected.email === \"string\" && expected.email ? expected.email : null;\n      const message = `That signed in a different account, so it was signed out here.${email ? ` Sign in again as ${email}.` : \" Sign in again.\"}`;\n      me = null;\n      if (options.onDifferentPerson) await options.onDifferentPerson(message);\n      else await auth.signOut?.({ scope: \"local\" });\n      return message;\n    },\n    async withPassword(password) {\n      const u = await who();\n      if (!u.email) throw new Error(\"This account has no email to confirm with.\");\n      const { data, error } = await auth.signInWithPassword({ email: u.email, password });\n      if (error) throw new Error(\"That password was not accepted.\");\n      sameUser(data.user?.id);\n    },\n    async sendEmailCode() {\n      const u = await who();\n      if (!u.email) throw new Error(\"This account has no email to send a code to.\");\n      const { error } = await auth.signInWithOtp({ email: u.email, options: { shouldCreateUser: false } });\n      if (error) throw new Error(error.message);\n    },\n    async withEmailCode(code) {\n      const u = me ?? (await who());\n      if (!u.email) throw new Error(\"This account has no email.\");\n      const { data, error } = await auth.verifyOtp({ email: u.email, token: code.trim(), type: \"email\" });\n      if (error) throw new Error(\"That code was not accepted. Check it, or send a new one.\");\n      sameUser(data.user?.id);\n    },\n  };\n  if (options.dev) identity.dev = options.dev;\n  return identity;\n}\n\n/** True when the server refused because the sign-in is not recent enough. */\nexport function needsRecentSignIn(e: unknown): boolean {\n  const err = e as { code?: unknown; status?: unknown; message?: unknown; serverDetail?: unknown } | null;\n  if (!err) return false;\n  if (err.code === \"recent_auth_required\") return true;\n  // Some routes answer with only a sentence (the shown message is a generic \"sign in\"; the server's\n  // own words say which): read those too.\n  const said = [err.message, JSON.stringify(err.serverDetail ?? \"\")].filter((x): x is string => typeof x === \"string\").join(\" \");\n  return /recent auth|recent sign|re-authenticate|authentication within the last/i.test(said);\n}\n","import { createContext, useContext, useEffect, useRef, useState, type ReactNode } from \"react\";\nimport { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from \"@ai-matrx/design-system\";\nimport { Button, Field } from \"@ai-matrx/design-system/controls\";\nimport { ShieldGlyph } from \"../glyphs\";\nimport { useNotify } from \"../notice\";\nimport { needsRecentSignIn, type IdentityAccount, type VaultIdentity } from \"./identity\";\n\n/**\n * Wrap any call that shows, copies or exports a secret. When the server answers \"sign in again\",\n * the person confirms it is them (Google, password, or an emailed code) and the call runs again —\n * they never see a dead \"Authentication required\" in the row.\n */\nexport type Confirmed = <T>(run: () => Promise<T>) => Promise<T>;\n\nconst CANCELLED = \"Not confirmed.\";\n/** Said once when the person closes \"Confirm it's you\": whatever asked for it did not happen. */\nexport const NOT_CONFIRMED_NOTICE = \"Not confirmed, so nothing was done\";\nconst Ctx = createContext<Confirmed>((run) => run());\n\nexport function useConfirmed(): Confirmed {\n  return useContext(Ctx);\n}\n\nconst PROVIDER_LABEL: Record<string, string> = { google: \"Google\", github: \"GitHub\", azure: \"Microsoft\", apple: \"Apple\", linkedin_oidc: \"LinkedIn\", slack_oidc: \"Slack\", browser: \"Browser\", touch_id: \"Touch ID\" };\nconst providerLabel = (p: string) => PROVIDER_LABEL[p] ?? p.charAt(0).toUpperCase() + p.slice(1);\n\nexport function IdentityGate({ identity, children }: { identity: VaultIdentity | undefined; children: ReactNode }) {\n  const [asking, setAsking] = useState(false);\n  const notify = useNotify();\n  const waiters = useRef<{ resolve: () => void; reject: (e: Error) => void }[]>([]);\n  // Back from a provider's confirmation: a different account that came back is signed out and said.\n  const [returnProblem, setReturnProblem] = useState<string | null>(null);\n  useEffect(() => {\n    if (!identity?.checkReturn) return;\n    let live = true;\n    identity.checkReturn().then(\n      (problem) => live && problem && setReturnProblem(problem),\n      (e: unknown) => live && setReturnProblem(e instanceof Error ? e.message : \"The account that came back could not be checked.\"),\n    );\n    return () => {\n      live = false;\n    };\n  }, [identity]);\n\n  const confirmed: Confirmed = async (run) => {\n    try {\n      return await run();\n    } catch (e) {\n      if (!identity || !needsRecentSignIn(e)) throw e;\n      await new Promise<void>((resolve, reject) => {\n        waiters.current.push({ resolve, reject });\n        setAsking(true);\n      });\n      return run();\n    }\n  };\n\n  const settle = (ok: boolean) => {\n    const w = waiters.current;\n    waiters.current = [];\n    setAsking(false);\n    for (const x of w) (ok ? x.resolve() : x.reject(new Error(CANCELLED)));\n    // Never silent: every caller stays quiet about a cancel (`wasCancelled`), so the gate says it once.\n    if (!ok && w.length > 0) notify(NOT_CONFIRMED_NOTICE, \"info\");\n  };\n\n  return (\n    <Ctx.Provider value={confirmed}>\n      {children}\n      {identity ? <ConfirmIdentityDialog open={asking} identity={identity} onDone={() => settle(true)} onCancel={() => settle(false)} /> : null}\n      <Dialog open={returnProblem !== null} onOpenChange={(o) => (o ? undefined : setReturnProblem(null))}>\n        <DialogContent size=\"sm\">\n          <DialogHeader>\n            <DialogTitle>Different account</DialogTitle>\n            <DialogDescription>{returnProblem}</DialogDescription>\n          </DialogHeader>\n          <div className=\"flex justify-end\">\n            <Button variant=\"primary\" onClick={() => setReturnProblem(null)}>OK</Button>\n          </div>\n        </DialogContent>\n      </Dialog>\n    </Ctx.Provider>\n  );\n}\n\n/** True for the rejection a canceled confirmation produces (callers stay quiet about it). */\nexport const wasCancelled = (e: unknown) => e instanceof Error && e.message === CANCELLED;\n\nfunction ConfirmIdentityDialog({ open, identity, onDone, onCancel }: { open: boolean; identity: VaultIdentity; onDone: () => void; onCancel: () => void }) {\n  const [account, setAccount] = useState<IdentityAccount | null>(null);\n  const [password, setPassword] = useState(\"\");\n  const [code, setCode] = useState(\"\");\n  const [codeSent, setCodeSent] = useState(false);\n  const [busy, setBusy] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  useEffect(() => {\n    if (!open) return;\n    setPassword(\"\");\n    setCode(\"\");\n    setCodeSent(false);\n    setError(null);\n    identity.account().then(setAccount, (e: unknown) => setError(e instanceof Error ? e.message : \"Your account could not be read.\"));\n  }, [open, identity]);\n\n  const attempt = async (step: () => Promise<void>, done = true) => {\n    setBusy(true);\n    setError(null);\n    try {\n      await step();\n      if (done) onDone();\n    } catch (e) {\n      setError(e instanceof Error ? e.message : \"That did not work. Try again.\");\n    } finally {\n      setBusy(false);\n    }\n  };\n\n  return (\n    <Dialog open={open} onOpenChange={(o) => (o ? undefined : onCancel())}>\n      <DialogContent size=\"sm\">\n        <DialogHeader>\n          <div className=\"flex items-center gap-2\">\n            <ShieldGlyph className=\"size-5 text-primary\" />\n            <DialogTitle>Confirm it’s you</DialogTitle>\n          </div>\n          <DialogDescription>This needs a recent sign-in{account?.email ? ` to ${account.email}` : \"\"}.</DialogDescription>\n        </DialogHeader>\n        <div className=\"flex flex-col gap-3\">\n          {identity.dev ? (\n            <Button variant=\"primary\" disabled={busy} onClick={() => void attempt(() => identity.dev?.() ?? Promise.resolve())}>\n              Sign in again (dev)\n            </Button>\n          ) : null}\n          {account?.providers.map((p) => (\n            <Button\n              key={p}\n              variant={identity.dev ? \"outline\" : \"primary\"}\n              disabled={busy}\n              onClick={() =>\n                void attempt(async () => {\n                  if ((await identity.withProvider(p)) === \"confirmed\") onDone();\n                }, false)\n              }\n            >\n              Continue with {providerLabel(p)}\n            </Button>\n          ))}\n          {account?.hasPassword ? (\n            <form className=\"flex gap-2\" onSubmit={(e) => { e.preventDefault(); if (password) void attempt(() => identity.withPassword(password)); }}>\n              <Field className=\"min-w-0 flex-1\" type=\"password\" autoComplete=\"current-password\" placeholder=\"Your password\" aria-label=\"Your password\" value={password} onChange={(e) => setPassword(e.target.value)} autoFocus />\n              <Button variant=\"outline\" type=\"submit\" disabled={busy || !password}>Confirm</Button>\n            </form>\n          ) : null}\n          {account?.email ? (\n            codeSent ? (\n              <form className=\"flex gap-2\" onSubmit={(e) => { e.preventDefault(); if (code.trim()) void attempt(() => identity.withEmailCode(code)); }}>\n                <Field className=\"min-w-0 flex-1\" inputMode=\"numeric\" autoComplete=\"one-time-code\" placeholder=\"Code from your email\" aria-label=\"Code from your email\" value={code} onChange={(e) => setCode(e.target.value)} autoFocus />\n                <Button variant=\"outline\" type=\"submit\" disabled={busy || !code.trim()}>Confirm</Button>\n              </form>\n            ) : (\n              <Button variant=\"quiet\" disabled={busy} onClick={() => void attempt(async () => { await identity.sendEmailCode(); setCodeSent(true); }, false)}>\n                Email me a code instead\n              </Button>\n            )\n          ) : null}\n          {error ? <p role=\"alert\" className=\"text-sm text-destructive\">{error}</p> : null}\n        </div>\n      </DialogContent>\n    </Dialog>\n  );\n}\n","import type { CSSProperties, ReactNode } from \"react\";\n\nimport {\n  GlobeIcon,\n  ArchiveIcon,\n  ArrowUpDownIcon,\n  BuildingIcon,\n  CameraIcon,\n  CheckIcon,\n  ChevronDownIcon,\n  ChevronLeftIcon,\n  ChevronRightIcon,\n  ClockIcon,\n  CodeIcon,\n  CreditCardIcon,\n  DatabaseIcon,\n  DownloadIcon,\n  ExternalLinkIcon,\n  EyeIcon,\n  EyeOffIcon,\n  FilePageIcon,\n  FileTextIcon,\n  FingerprintPatternIcon,\n  KeyIcon,\n  LayoutGridIcon,\n  ListIcon,\n  LockIcon,\n  MoreHorizontalIcon,\n  MoveIcon,\n  PencilIcon,\n  PlugIcon,\n  PlusIcon,\n  PowerIcon,\n  QrCodeIcon,\n  RefreshCwIcon,\n  RotateCcwIcon,\n  SendIcon,\n  ServerIcon,\n  ShareIcon,\n  ShieldIcon,\n  SlidersVerticalIcon,\n  StarIcon,\n  TagIcon,\n  TerminalIcon,\n  TrashIcon,\n  UploadIcon,\n  UserIcon,\n  UserRoundIcon,\n  XIcon,\n  withGlyphDefaults,\n} from \"@ai-matrx/design-system/icons\";\n\n/**\n * The vault's glyphs. Every lucide drawing lives once, in `@ai-matrx/design-system/icons` (the one lucide-free\n * glyph home, which also carries the optical-trim class); each name here is an alias of it. `SafeGlyph` is the\n * vault's own drawing (a strongbox: no lucide twin) and is the only one drawn in this file.\n */\nexport type Glyph = (props: { className?: string }) => ReactNode;\n\n/**\n * `air` = the empty 24-grid units left and right of the drawn ink (stroke included), measured with\n * getBBox. The design system's optical trim reads it (`--matrx-glyph-air-l/-r`) so an icon + label\n * button sits its INK, not its box, the same distance from both edges — exactly as it does for lucide.\n */\nfunction glyph(paths: ReactNode, air: readonly [number, number] = [1, 1]): Glyph {\n  const style = { \"--matrx-glyph-air-l\": air[0], \"--matrx-glyph-air-r\": air[1] } as CSSProperties;\n  return function VaultGlyph({ className }) {\n    return (\n      <svg className={className} style={style} viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" strokeWidth={2} strokeLinecap=\"round\" strokeLinejoin=\"round\" aria-hidden>\n        {paths}\n      </svg>\n    );\n  };\n}\n\nexport const KeyGlyph: Glyph = withGlyphDefaults(KeyIcon, {}, { air: [1, 2] });\nexport const NoteGlyph: Glyph = withGlyphDefaults(FileTextIcon, {}, { air: [3, 3] });\nexport const CardGlyph: Glyph = withGlyphDefaults(CreditCardIcon, {}, { air: [1, 1] });\nexport const PersonGlyph: Glyph = withGlyphDefaults(UserRoundIcon, {}, { air: [3, 3] });\nexport const DatabaseGlyph: Glyph = withGlyphDefaults(DatabaseIcon, {}, { air: [2, 2] });\nexport const ServerGlyph: Glyph = withGlyphDefaults(ServerIcon, {}, { air: [1, 1] });\nexport const TerminalGlyph: Glyph = withGlyphDefaults(TerminalIcon, {}, { air: [3, 3] });\nexport const FileGlyph: Glyph = withGlyphDefaults(FilePageIcon, {}, { air: [3, 3] });\nexport const CodeGlyph: Glyph = withGlyphDefaults(CodeIcon, {}, { air: [1, 1] });\nexport const StarGlyph: Glyph = withGlyphDefaults(StarIcon, {}, { air: [1, 1] });\nexport const PlusGlyph: Glyph = withGlyphDefaults(PlusIcon, {}, { air: [4, 4] });\nexport const EyeGlyph: Glyph = withGlyphDefaults(EyeIcon, {}, { air: [1, 1] });\nexport const EyeOffGlyph: Glyph = withGlyphDefaults(EyeOffIcon, {}, { air: [1, 1] });\nexport const LockGlyph: Glyph = withGlyphDefaults(LockIcon, {}, { air: [2, 2] });\nexport const ExternalGlyph: Glyph = withGlyphDefaults(ExternalLinkIcon, {}, { air: [2, 2] });\nexport const TrashGlyph: Glyph = withGlyphDefaults(TrashIcon, {}, { air: [2, 2] });\nexport const ArchiveGlyph: Glyph = withGlyphDefaults(ArchiveIcon, {}, { air: [1, 1] });\nexport const TagGlyph: Glyph = withGlyphDefaults(TagIcon, {}, { air: [1, 1] });\nexport const ShieldGlyph: Glyph = withGlyphDefaults(ShieldIcon, {}, { air: [3, 3] });\nexport const BuildingGlyph: Glyph = withGlyphDefaults(BuildingIcon, {}, { air: [3, 3] });\nexport const ChevronLeftGlyph: Glyph = withGlyphDefaults(ChevronLeftIcon, {}, { air: [8, 8] });\nexport const GridGlyph: Glyph = withGlyphDefaults(LayoutGridIcon, {}, { air: [2, 2] });\nexport const PlugGlyph: Glyph = withGlyphDefaults(PlugIcon, {}, { air: [5, 5] });\n\nconst FAMILY_GLYPHS: Record<string, Glyph> = {\n  databases: DatabaseGlyph,\n  server_network: ServerGlyph,\n  hosting_deployment: ServerGlyph,\n  source_control: CodeGlyph,\n  signing_files: FileGlyph,\n  identity_security: ShieldGlyph,\n  cloud_infrastructure: ServerGlyph,\n};\n\n/** A type's glyph: logins are a globe, then by family, else a key. */\nexport function definitionGlyph(key: string, family: string): Glyph {\n  if (key === \"username_password\" || key === \"website_login\") return GlobeIcon;\n  return FAMILY_GLYPHS[family] ?? KeyGlyph;\n}\nexport const XGlyph: Glyph = withGlyphDefaults(XIcon, {}, { air: [5, 5] });\nexport const PencilGlyph: Glyph = withGlyphDefaults(PencilIcon, {}, { air: [2, 2] });\nexport const ClockGlyph: Glyph = withGlyphDefaults(ClockIcon, {}, { air: [1, 1] });\n// ── core workspace glyphs ────────────────────────────────────────────────────\nexport const MoreGlyph: Glyph = withGlyphDefaults(MoreHorizontalIcon, {}, { air: [3, 3] });\nexport const ShareGlyph: Glyph = withGlyphDefaults(ShareIcon, {}, { air: [3, 3] });\nexport const ListGlyph: Glyph = withGlyphDefaults(ListIcon, {}, { air: [2, 2] });\nexport const ImportGlyph: Glyph = withGlyphDefaults(DownloadIcon, {}, { air: [2, 2] });\nexport const ExportGlyph: Glyph = withGlyphDefaults(UploadIcon, {}, { air: [2, 2] });\nexport const ChevronDownGlyph: Glyph = withGlyphDefaults(ChevronDownIcon, {}, { air: [5, 5] });\nexport const ChevronRightGlyph: Glyph = withGlyphDefaults(ChevronRightIcon, {}, { air: [8, 8] });\nexport const SortGlyph: Glyph = withGlyphDefaults(ArrowUpDownIcon, {}, { air: [2, 2] });\nexport const UserGlyph: Glyph = withGlyphDefaults(UserIcon, {}, { air: [5, 5] });\nexport const MoveGlyph: Glyph = withGlyphDefaults(MoveIcon, {}, { air: [1, 1] });\nexport const SafeGlyph = glyph(<><rect x=\"3\" y=\"3\" width=\"18\" height=\"18\" rx=\"2\" /><circle cx=\"12\" cy=\"12\" r=\"4\" /><path d=\"M12 8v1M12 15v1M8 12h1M15 12h1\" /></>, [2, 2]);\nexport const RestoreGlyph: Glyph = withGlyphDefaults(RotateCcwIcon, {}, { air: [2, 2] });\n// ── one-time passwords ───────────────────────────────────────────────────────\nexport const QrGlyph: Glyph = withGlyphDefaults(QrCodeIcon, {}, { air: [2, 2] });\nexport const CameraGlyph: Glyph = withGlyphDefaults(CameraIcon, {}, { air: [1, 1] });\nexport const CheckGlyph: Glyph = withGlyphDefaults(CheckIcon, {}, { air: [3, 3] });\nexport const PowerGlyph: Glyph = withGlyphDefaults(PowerIcon, {}, { air: [2, 2] });\n// ── generator and field settings ─────────────────────────────────────────────\nexport const RefreshGlyph: Glyph = withGlyphDefaults(RefreshCwIcon, {}, { air: [2, 2] });\nexport const SlidersGlyph: Glyph = withGlyphDefaults(SlidersVerticalIcon, {}, { air: [0, 0] });\nexport const UploadGlyph: Glyph = withGlyphDefaults(UploadIcon, {}, { air: [2, 2] });\n// ── browsers that can fill ───────────────────────────────────────────────────\nexport const FingerprintGlyph: Glyph = withGlyphDefaults(FingerprintPatternIcon, {}, { air: [1, 1] });\nexport const SendGlyph: Glyph = withGlyphDefaults(SendIcon, {}, { air: [1, 1] });\n","import { createContext, useCallback, useContext, useEffect, useRef, useState, type ReactNode } from \"react\";\nimport { cn } from \"@ai-matrx/design-system\";\nimport { copyText } from \"@ai-matrx/kit/clipboard\";\nimport type { VaultClipboard } from \"./lock\";\n\nexport type NoticeKind = \"success\" | \"error\" | \"info\";\nexport type Notify = (message: string, kind?: NoticeKind) => void;\n\nconst Ctx = createContext<Notify>(() => undefined);\n\n/** Say something short to the person (\"Password copied\"). Hosts with their own toasts pass `notify`. */\nexport function useNotify(): Notify {\n  return useContext(Ctx);\n}\n\nexport interface CopyOptions {\n  /** A secret (a password, a code, a key): the host's clipboard takes custody. Default true. */\n  secret?: boolean;\n}\n\n/**\n * Writes `text` and says so (or says why not). Through the host's clipboard when it has one (custody:\n * the host clears a secret later), else the browser's. Pure over its inputs, so it is tested alone.\n */\nexport async function copyValue(text: string, label: string, options: CopyOptions, deps: { clipboard?: VaultClipboard | undefined; notify: Notify }): Promise<boolean> {\n  const secret = options.secret ?? true;\n  if (deps.clipboard) {\n    try {\n      const copied = await deps.clipboard.copy(text, { secret });\n      deps.notify(copiedLine(label, copied?.clearsAtMs ?? null), \"success\");\n      return true;\n    } catch (e) {\n      deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, \"error\");\n      return false;\n    }\n  }\n  return copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === \"error\" ? \"error\" : \"success\") });\n}\n\n/** \"Password copied\", or \"Password copied. Clears at 3:42 PM\" when the host says when it clears it. */\nexport function copiedLine(label: string, clearsAtMs: number | null): string {\n  if (clearsAtMs === null || !Number.isFinite(clearsAtMs)) return `${label} copied`;\n  const at = new Date(clearsAtMs).toLocaleTimeString(undefined, { hour: \"numeric\", minute: \"2-digit\" });\n  return `${label} copied. Clears at ${at}`;\n}\n\nconst ClipboardCtx = createContext<VaultClipboard | undefined>(undefined);\n\n/** The host's clipboard (`host.clipboard`), for every copy below it. */\nexport function ClipboardProvider({ clipboard, children }: { clipboard: VaultClipboard | undefined; children: ReactNode }) {\n  return <ClipboardCtx.Provider value={clipboard}>{children}</ClipboardCtx.Provider>;\n}\n\n/** THE copy for every vault screen: writes, then says so (or says why not). */\nexport function useCopy(): (text: string, label: string, options?: CopyOptions) => Promise<boolean> {\n  const notify = useNotify();\n  const clipboard = useContext(ClipboardCtx);\n  return useCallback((text, label, options = {}) => copyValue(text, label, options, { clipboard, notify }), [notify, clipboard]);\n}\n\n/**\n * The vault's own notice line, so feedback exists in every host (an extension side panel has no app\n * toaster). A host that has one passes `notify` and this draws nothing.\n */\nexport function NoticeProvider({ notify, children }: { notify?: Notify | undefined; children: ReactNode }) {\n  const [shown, setShown] = useState<{ message: string; kind: NoticeKind; n: number } | null>(null);\n  const timer = useRef<ReturnType<typeof setTimeout> | null>(null);\n  const local = useCallback<Notify>((message, kind = \"success\") => {\n    if (timer.current) clearTimeout(timer.current);\n    setShown((s) => ({ message, kind, n: (s?.n ?? 0) + 1 }));\n    timer.current = setTimeout(() => setShown(null), kind === \"error\" ? 5000 : 2200);\n  }, []);\n  useEffect(() => () => void (timer.current && clearTimeout(timer.current)), []);\n  return (\n    <Ctx.Provider value={notify ?? local}>\n      {children}\n      {!notify ? (\n        <div aria-live=\"polite\" className=\"pointer-events-none absolute inset-x-0 bottom-4 z-30 flex justify-center px-4\">\n          {shown ? (\n            <div key={shown.n} role=\"status\" className={cn(\"rounded-full border border-border bg-popover px-4 py-2 text-sm shadow-lg\", shown.kind === \"error\" ? \"text-destructive\" : \"text-foreground\")}>\n              {shown.message}\n            </div>\n          ) : null}\n        </div>\n      ) : null}\n    </Ctx.Provider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC0EO,IAAM,qBAAqB;AAElC,IAAM,mBAAmB,KAAK;AAE9B,IAAM,cAAc;AAGb,SAAS,uBAAuB,MAAwB,UAAmC,CAAC,GAAkB;AACnH,MAAI,KAAkD;AACtD,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,QAAQ,MAA0B;AACtC,QAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,QAAI;AACF,aAAQ,WAAgD,kBAAkB;AAAA,IAC5E,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,YAAY;AACtB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,QAAQ;AACpC,QAAI,CAAC,KAAK,KAAM,OAAM,IAAI,MAAM,oCAAoC;AACpE,SAAK,EAAE,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,SAAS,KAAK;AACxD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,WAAW,CAAC,OAA2B;AAC3C,QAAI,CAAC,MAAM,OAAO,GAAG,GAAI,OAAM,IAAI,MAAM,WAAW;AAAA,EACtD;AACA,QAAM,WAA0B;AAAA,IAC9B,MAAM,UAAU;AACd,YAAM,IAAI,MAAM,IAAI;AACpB,YAAM,QAAQ,oBAAI,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,GAAI,EAAE,cAAc,aAAa,CAAC,CAAE,CAAC;AAC5G,aAAO,EAAE,OAAO,EAAE,SAAS,MAAM,WAAW,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,MAAM,MAAM,WAAW,MAAM,OAAO,GAAG,aAAa,MAAM,IAAI,OAAO,EAAE;AAAA,IACxI;AAAA,IACA,MAAM,aAAa,UAAU;AAC3B,YAAM,IAAI,MAAM,IAAI;AAEpB,YAAM,GAAG,QAAQ,oBAAoB,KAAK,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,SAAS,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;AACpG,YAAM,aAAa,QAAQ,aAAa,KAAK,WAAW,UAAU;AAElE,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB,EAAE,UAA6B,GAAI,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,EAAG,CAAC;AAChI,UAAI,OAAO;AACT,cAAM,GAAG,WAAW,kBAAkB;AACtC,cAAM,IAAI,MAAM,MAAM,OAAO;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,MAAM,cAAc;AAClB,YAAM,IAAI,MAAM;AAChB,YAAM,MAAM,GAAG,QAAQ,kBAAkB,KAAK;AAC9C,UAAI,CAAC,KAAK,QAAQ,KAAM,QAAO;AAC/B,QAAE,WAAW,kBAAkB;AAC/B,UAAI;AACJ,UAAI;AACF,mBAAW,KAAK,MAAM,GAAG;AAAA,MAC3B,QAAQ;AACN,eAAO;AAAA,MACT;AACA,UAAI,OAAO,SAAS,OAAO,YAAY,OAAO,SAAS,OAAO,YAAY,IAAI,IAAI,SAAS,KAAK,iBAAkB,QAAO;AACzH,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,QAAQ;AACpC,UAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAS,GAAI,QAAO;AACvD,YAAM,QAAQ,OAAO,SAAS,UAAU,YAAY,SAAS,QAAQ,SAAS,QAAQ;AACtF,YAAM,UAAU,iEAAiE,QAAQ,qBAAqB,KAAK,MAAM,iBAAiB;AAC1I,WAAK;AACL,UAAI,QAAQ,kBAAmB,OAAM,QAAQ,kBAAkB,OAAO;AAAA,UACjE,OAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAC5C,aAAO;AAAA,IACT;AAAA,IACA,MAAM,aAAa,UAAU;AAC3B,YAAM,IAAI,MAAM,IAAI;AACpB,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,4CAA4C;AAC1E,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,mBAAmB,EAAE,OAAO,EAAE,OAAO,SAAS,CAAC;AAClF,UAAI,MAAO,OAAM,IAAI,MAAM,iCAAiC;AAC5D,eAAS,KAAK,MAAM,EAAE;AAAA,IACxB;AAAA,IACA,MAAM,gBAAgB;AACpB,YAAM,IAAI,MAAM,IAAI;AACpB,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,8CAA8C;AAC5E,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,cAAc,EAAE,OAAO,EAAE,OAAO,SAAS,EAAE,kBAAkB,MAAM,EAAE,CAAC;AACnG,UAAI,MAAO,OAAM,IAAI,MAAM,MAAM,OAAO;AAAA,IAC1C;AAAA,IACA,MAAM,cAAc,MAAM;AACxB,YAAM,IAAI,MAAO,MAAM,IAAI;AAC3B,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,4BAA4B;AAC1D,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,UAAU,EAAE,OAAO,EAAE,OAAO,OAAO,KAAK,KAAK,GAAG,MAAM,QAAQ,CAAC;AAClG,UAAI,MAAO,OAAM,IAAI,MAAM,0DAA0D;AACrF,eAAS,KAAK,MAAM,EAAE;AAAA,IACxB;AAAA,EACF;AACA,MAAI,QAAQ,IAAK,UAAS,MAAM,QAAQ;AACxC,SAAO;AACT;AAGO,SAAS,kBAAkB,GAAqB;AACrD,QAAM,MAAM;AACZ,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,SAAS,uBAAwB,QAAO;AAGhD,QAAM,OAAO,CAAC,IAAI,SAAS,KAAK,UAAU,IAAI,gBAAgB,EAAE,CAAC,EAAE,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC7H,SAAO,0EAA0E,KAAK,IAAI;AAC5F;;;AC9KA,IAAAA,gBAAuF;AACvF,IAAAC,wBAAoF;AACpF,sBAA8B;;;ACA9B,mBAgDO;AAkBD;AAJN,SAAS,MAAM,OAAkB,MAAiC,CAAC,GAAG,CAAC,GAAU;AAC/E,QAAM,QAAQ,EAAE,uBAAuB,IAAI,CAAC,GAAG,uBAAuB,IAAI,CAAC,EAAE;AAC7E,SAAO,SAAS,WAAW,EAAE,UAAU,GAAG;AACxC,WACE,4CAAC,SAAI,WAAsB,OAAc,SAAQ,aAAY,MAAK,QAAO,QAAO,gBAAe,aAAa,GAAG,eAAc,SAAQ,gBAAe,SAAQ,eAAW,MACpK,iBACH;AAAA,EAEJ;AACF;AAEO,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,gBAAmB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,6BAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,kBAAqB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,gBAAmB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,oBAAuB,gCAAkB,+BAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACpF,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,mBAAsB,gCAAkB,0BAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,uBAA0B,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,gBAAmB,gCAAkB,6BAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAiBxE,IAAM,aAAgB,gCAAkB,oBAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE1E,IAAM,gBAAmB,gCAAkB,iCAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,kBAAqB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,uBAA0B,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,wBAA2B,gCAAkB,+BAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,IAAM,gBAAmB,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,YAAY,MAAM,4EAAE;AAAA,8CAAC,UAAK,GAAE,KAAI,GAAE,KAAI,OAAM,MAAK,QAAO,MAAK,IAAG,KAAI;AAAA,EAAE,4CAAC,YAAO,IAAG,MAAK,IAAG,MAAK,GAAE,KAAI;AAAA,EAAE,4CAAC,UAAK,GAAE,kCAAiC;AAAA,GAAE,GAAK,CAAC,GAAG,CAAC,CAAC;AAClK,IAAM,mBAAsB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAEhF,IAAM,cAAiB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE1E,IAAM,mBAAsB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,mBAAsB,gCAAkB,kCAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE5E,IAAM,uBAA0B,gCAAkB,qCAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7F,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;;;AC7I/E,mBAAoG;AACpG,2BAAmB;AACnB,uBAAyB;AAgDhB,IAAAC,sBAAA;AA1CT,IAAM,UAAM,4BAAsB,MAAM,MAAS;AAG1C,SAAS,YAAoB;AAClC,aAAO,yBAAW,GAAG;AACvB;AAiCA,IAAM,mBAAe,4BAA0C,MAAS;;;AFuBtD,IAAAC,sBAAA;AAvDlB,IAAM,YAAY;AAEX,IAAM,uBAAuB;AACpC,IAAMC,WAAM,6BAAyB,CAAC,QAAQ,IAAI,CAAC;AAE5C,SAAS,eAA0B;AACxC,aAAO,0BAAWA,IAAG;AACvB;AAEA,IAAM,iBAAyC,EAAE,QAAQ,UAAU,QAAQ,UAAU,OAAO,aAAa,OAAO,SAAS,eAAe,YAAY,YAAY,SAAS,SAAS,WAAW,UAAU,WAAW;AAClN,IAAM,gBAAgB,CAAC,MAAc,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC;AAExF,SAAS,aAAa,EAAE,UAAU,SAAS,GAAiE;AACjH,QAAM,CAAC,QAAQ,SAAS,QAAI,wBAAS,KAAK;AAC1C,QAAM,SAAS,UAAU;AACzB,QAAM,cAAU,sBAA8D,CAAC,CAAC;AAEhF,QAAM,CAAC,eAAe,gBAAgB,QAAI,wBAAwB,IAAI;AACtE,+BAAU,MAAM;AACd,QAAI,CAAC,UAAU,YAAa;AAC5B,QAAI,OAAO;AACX,aAAS,YAAY,EAAE;AAAA,MACrB,CAAC,YAAY,QAAQ,WAAW,iBAAiB,OAAO;AAAA,MACxD,CAAC,MAAe,QAAQ,iBAAiB,aAAa,QAAQ,EAAE,UAAU,kDAAkD;AAAA,IAC9H;AACA,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,YAAuB,OAAO,QAAQ;AAC1C,QAAI;AACF,aAAO,MAAM,IAAI;AAAA,IACnB,SAAS,GAAG;AACV,UAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAG,OAAM;AAC9C,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,gBAAQ,QAAQ,KAAK,EAAE,SAAS,OAAO,CAAC;AACxC,kBAAU,IAAI;AAAA,MAChB,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA,EACF;AAEA,QAAM,SAAS,CAAC,OAAgB;AAC9B,UAAM,IAAI,QAAQ;AAClB,YAAQ,UAAU,CAAC;AACnB,cAAU,KAAK;AACf,eAAW,KAAK,EAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,OAAO,IAAI,MAAM,SAAS,CAAC;AAEpE,QAAI,CAAC,MAAM,EAAE,SAAS,EAAG,QAAO,sBAAsB,MAAM;AAAA,EAC9D;AAEA,SACE,8CAACA,KAAI,UAAJ,EAAa,OAAO,WAClB;AAAA;AAAA,IACA,WAAW,6CAAC,yBAAsB,MAAM,QAAQ,UAAoB,QAAQ,MAAM,OAAO,IAAI,GAAG,UAAU,MAAM,OAAO,KAAK,GAAG,IAAK;AAAA,IACrI,6CAAC,gCAAO,MAAM,kBAAkB,MAAM,cAAc,CAAC,MAAO,IAAI,SAAY,iBAAiB,IAAI,GAC/F,wDAAC,uCAAc,MAAK,MAClB;AAAA,oDAAC,sCACC;AAAA,qDAAC,qCAAY,+BAAiB;AAAA,QAC9B,6CAAC,2CAAmB,yBAAc;AAAA,SACpC;AAAA,MACA,6CAAC,SAAI,WAAU,oBACb,uDAAC,0BAAO,SAAQ,WAAU,SAAS,MAAM,iBAAiB,IAAI,GAAG,gBAAE,GACrE;AAAA,OACF,GACF;AAAA,KACF;AAEJ;AAGO,IAAM,eAAe,CAAC,MAAe,aAAa,SAAS,EAAE,YAAY;AAEhF,SAAS,sBAAsB,EAAE,MAAM,UAAU,QAAQ,SAAS,GAAyF;AACzJ,QAAM,CAAC,SAAS,UAAU,QAAI,wBAAiC,IAAI;AACnE,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAS,EAAE;AACnC,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,KAAK;AAC9C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAS,KAAK;AACtC,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAwB,IAAI;AAEtD,+BAAU,MAAM;AACd,QAAI,CAAC,KAAM;AACX,gBAAY,EAAE;AACd,YAAQ,EAAE;AACV,gBAAY,KAAK;AACjB,aAAS,IAAI;AACb,aAAS,QAAQ,EAAE,KAAK,YAAY,CAAC,MAAe,SAAS,aAAa,QAAQ,EAAE,UAAU,iCAAiC,CAAC;AAAA,EAClI,GAAG,CAAC,MAAM,QAAQ,CAAC;AAEnB,QAAM,UAAU,OAAO,MAA2B,OAAO,SAAS;AAChE,YAAQ,IAAI;AACZ,aAAS,IAAI;AACb,QAAI;AACF,YAAM,KAAK;AACX,UAAI,KAAM,QAAO;AAAA,IACnB,SAAS,GAAG;AACV,eAAS,aAAa,QAAQ,EAAE,UAAU,+BAA+B;AAAA,IAC3E,UAAE;AACA,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAEA,SACE,6CAAC,gCAAO,MAAY,cAAc,CAAC,MAAO,IAAI,SAAY,SAAS,GACjE,wDAAC,uCAAc,MAAK,MAClB;AAAA,kDAAC,sCACC;AAAA,oDAAC,SAAI,WAAU,2BACb;AAAA,qDAAC,eAAY,WAAU,uBAAsB;AAAA,QAC7C,6CAAC,qCAAY,mCAAgB;AAAA,SAC/B;AAAA,MACA,8CAAC,2CAAkB;AAAA;AAAA,QAA4B,SAAS,QAAQ,OAAO,QAAQ,KAAK,KAAK;AAAA,QAAG;AAAA,SAAC;AAAA,OAC/F;AAAA,IACA,8CAAC,SAAI,WAAU,uBACZ;AAAA,eAAS,MACR,6CAAC,0BAAO,SAAQ,WAAU,UAAU,MAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ,CAAC,GAAG,iCAEpH,IACE;AAAA,MACH,SAAS,UAAU,IAAI,CAAC,MACvB;AAAA,QAAC;AAAA;AAAA,UAEC,SAAS,SAAS,MAAM,YAAY;AAAA,UACpC,UAAU;AAAA,UACV,SAAS,MACP,KAAK,QAAQ,YAAY;AACvB,gBAAK,MAAM,SAAS,aAAa,CAAC,MAAO,YAAa,QAAO;AAAA,UAC/D,GAAG,KAAK;AAAA,UAEX;AAAA;AAAA,YACgB,cAAc,CAAC;AAAA;AAAA;AAAA,QATzB;AAAA,MAUP,CACD;AAAA,MACA,SAAS,cACR,8CAAC,UAAK,WAAU,cAAa,UAAU,CAAC,MAAM;AAAE,UAAE,eAAe;AAAG,YAAI,SAAU,MAAK,QAAQ,MAAM,SAAS,aAAa,QAAQ,CAAC;AAAA,MAAG,GACrI;AAAA,qDAAC,yBAAM,WAAU,kBAAiB,MAAK,YAAW,cAAa,oBAAmB,aAAY,iBAAgB,cAAW,iBAAgB,OAAO,UAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK,GAAG,WAAS,MAAC;AAAA,QAClN,6CAAC,0BAAO,SAAQ,WAAU,MAAK,UAAS,UAAU,QAAQ,CAAC,UAAU,qBAAO;AAAA,SAC9E,IACE;AAAA,MACH,SAAS,QACR,WACE,8CAAC,UAAK,WAAU,cAAa,UAAU,CAAC,MAAM;AAAE,UAAE,eAAe;AAAG,YAAI,KAAK,KAAK,EAAG,MAAK,QAAQ,MAAM,SAAS,cAAc,IAAI,CAAC;AAAA,MAAG,GACrI;AAAA,qDAAC,yBAAM,WAAU,kBAAiB,WAAU,WAAU,cAAa,iBAAgB,aAAY,wBAAuB,cAAW,wBAAuB,OAAO,MAAM,UAAU,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK,GAAG,WAAS,MAAC;AAAA,QACzN,6CAAC,0BAAO,SAAQ,WAAU,MAAK,UAAS,UAAU,QAAQ,CAAC,KAAK,KAAK,GAAG,qBAAO;AAAA,SACjF,IAEA,6CAAC,0BAAO,SAAQ,SAAQ,UAAU,MAAM,SAAS,MAAM,KAAK,QAAQ,YAAY;AAAE,cAAM,SAAS,cAAc;AAAG,oBAAY,IAAI;AAAA,MAAG,GAAG,KAAK,GAAG,qCAEhJ,IAEA;AAAA,MACH,QAAQ,6CAAC,OAAE,MAAK,SAAQ,WAAU,4BAA4B,iBAAM,IAAO;AAAA,OAC9E;AAAA,KACF,GACF;AAEJ;","names":["import_react","import_design_system","import_jsx_runtime","import_jsx_runtime","Ctx"]}
+{"version":3,"sources":["../src/identity.ts","../src/auth/identity.ts","../src/auth/IdentityGate.tsx","../src/glyphs.tsx","../src/notice.tsx"],"sourcesContent":["\"use client\";\n\n/**\n * `@ai-matrx/vault/identity` — \"Confirm it's you\" without the Vault workspace.\n *\n * The identity seam and its gate dialog, for a host that only needs a recent-sign-in check (the\n * share sheet's secure links). Importing them from the root pulled the whole Vault (every screen,\n * the importers, zip.js) into that host's build graph; this entry reaches only the gate.\n */\nexport { CONFIRM_RETURN_KEY, createSupabaseIdentity, needsRecentSignIn, type IdentityAccount, type IdentityMethod, type ReturnStore, type SupabaseAuthLike, type SupabaseIdentityOptions, type VaultIdentity } from \"./auth/identity\";\nexport { IdentityGate, useConfirmed, wasCancelled, type Confirmed } from \"./auth/IdentityGate\";\n","/**\n * CONFIRM IT'S YOU. The server shows or exports a secret only after a sign-in from the last few\n * minutes (`recent_auth_required`). Every host signs people in with Supabase, so the one way to\n * produce a fresh sign-in lives here, over the host's own auth client — whichever way the person\n * signs in: Google (or any connected provider), a password, or a code sent to their email.\n */\n\n/** How a person can prove it is them again. Ordered by what the account actually uses. */\nexport type IdentityMethod = \"provider\" | \"password\" | \"email_code\" | \"dev\";\n\nexport interface IdentityAccount {\n  email: string | null;\n  /** Connected sign-in providers on the account (`google`, `github`, …), never `email`. */\n  providers: readonly string[];\n  hasPassword: boolean;\n}\n\nexport interface VaultIdentity {\n  account(): Promise<IdentityAccount>;\n  /**\n   * Confirms with that provider. On the web it leaves the page and comes back to the same address\n   * (resolves with nothing: the page is going away). A host that confirms IN PLACE (the desktop's\n   * Touch ID, a browser sign-in it waits for) resolves `\"confirmed\"`, and the gate closes and runs\n   * the refused call again — one confirmation, never a second click.\n   */\n  withProvider(provider: string): Promise<void | \"confirmed\">;\n  withPassword(password: string): Promise<void>;\n  sendEmailCode(): Promise<void>;\n  withEmailCode(code: string): Promise<void>;\n  /** A host-only path with no human step (the playground's dev server). */\n  dev?: () => Promise<void>;\n  /**\n   * Run once when the page loads. After a provider confirmation left the page and came back, it\n   * checks the SAME person is signed in. A different account is signed out of this device and the\n   * sentence to show is returned; otherwise null.\n   */\n  checkReturn?: () => Promise<string | null>;\n}\n\n/** The slice of supabase-js `auth` this needs, so the package never depends on supabase-js itself. */\nexport interface SupabaseAuthLike {\n  getUser(): Promise<{ data: { user: { id: string; email?: string | null; identities?: { provider: string }[] | null; app_metadata?: { providers?: string[] } } | null }; error: unknown }>;\n  signInWithPassword(c: { email: string; password: string }): Promise<{ data: { user: { id: string } | null }; error: { message: string } | null }>;\n  signInWithOtp(c: { email: string; options?: { shouldCreateUser?: boolean } }): Promise<{ error: { message: string } | null }>;\n  verifyOtp(c: { email: string; token: string; type: \"email\" }): Promise<{ data: { user: { id: string } | null }; error: { message: string } | null }>;\n  signInWithOAuth(c: { provider: never; options?: { redirectTo?: string } }): Promise<{ error: { message: string } | null }>;\n  /** Used only when the host gives no `onDifferentPerson`: ends THIS device's session, never others. */\n  signOut?(o: { scope: \"local\" }): Promise<{ error: unknown }>;\n}\n\n/** Where the person confirming is remembered while the page is away at the provider. */\nexport interface ReturnStore {\n  getItem(key: string): string | null;\n  setItem(key: string, value: string): void;\n  removeItem(key: string): void;\n}\n\nexport interface SupabaseIdentityOptions {\n  /** The host's accepted OAuth return address carrying this page. */\n  redirectTo?: () => string;\n  dev?: () => Promise<void>;\n  /**\n   * A provider confirmation came back signed in as someone else. The host ends that session on THIS\n   * device only (its own device-scoped sign-out) and tells the person; `message` says what happened.\n   * Without it the package signs out locally through `auth.signOut({ scope: \"local\" })`.\n   */\n  onDifferentPerson?: (message: string) => Promise<void> | void;\n  /** Default: the tab's `sessionStorage`. */\n  store?: ReturnStore;\n  /** Default `Date.now`. */\n  now?: () => number;\n}\n\n/** The key the expected person is kept under across the provider's redirect. */\nexport const CONFIRM_RETURN_KEY = \"matrx-vault:confirming-as\";\n/** A remembered confirmation older than this is stale (the person never came back from it). */\nconst RETURN_WINDOW_MS = 15 * 60_000;\n\nconst SAME_PERSON = \"That signed in a different account. Use the account this vault belongs to.\";\n\n/** THE identity confirmation for every host: give it the host's `supabase.auth`. */\nexport function createSupabaseIdentity(auth: SupabaseAuthLike, options: SupabaseIdentityOptions = {}): VaultIdentity {\n  let me: { id: string; email: string | null } | null = null;\n  const now = options.now ?? Date.now;\n  const store = (): ReturnStore | null => {\n    if (options.store) return options.store;\n    try {\n      return (globalThis as { sessionStorage?: ReturnStore }).sessionStorage ?? null;\n    } catch {\n      return null;\n    }\n  };\n  const who = async () => {\n    const { data } = await auth.getUser();\n    if (!data.user) throw new Error(\"You are signed out. Sign in again.\");\n    me = { id: data.user.id, email: data.user.email ?? null };\n    return data.user;\n  };\n  const sameUser = (id: string | undefined) => {\n    if (!me || id !== me.id) throw new Error(SAME_PERSON);\n  };\n  const identity: VaultIdentity = {\n    async account() {\n      const u = await who();\n      const names = new Set([...(u.identities ?? []).map((i) => i.provider), ...(u.app_metadata?.providers ?? [])]);\n      return { email: u.email ?? null, providers: [...names].filter((p) => p !== \"email\" && p !== \"phone\"), hasPassword: names.has(\"email\") };\n    },\n    async withProvider(provider) {\n      const u = await who();\n      // Remembered across the redirect, so the page that loads back can check the same person came back.\n      store()?.setItem(CONFIRM_RETURN_KEY, JSON.stringify({ id: u.id, email: u.email ?? null, at: now() }));\n      const redirectTo = options.redirectTo?.() ?? globalThis.location?.href;\n      // `provider` is a supabase-js Provider string; the structural type keeps supabase-js out of the package.\n      const { error } = await auth.signInWithOAuth({ provider: provider as never, ...(redirectTo ? { options: { redirectTo } } : {}) });\n      if (error) {\n        store()?.removeItem(CONFIRM_RETURN_KEY);\n        throw new Error(error.message);\n      }\n    },\n    async checkReturn() {\n      const s = store();\n      const raw = s?.getItem(CONFIRM_RETURN_KEY) ?? null;\n      if (!s || raw === null) return null;\n      s.removeItem(CONFIRM_RETURN_KEY);\n      let expected: { id?: unknown; email?: unknown; at?: unknown };\n      try {\n        expected = JSON.parse(raw) as typeof expected;\n      } catch {\n        return null;\n      }\n      if (typeof expected.id !== \"string\" || typeof expected.at !== \"number\" || now() - expected.at > RETURN_WINDOW_MS) return null;\n      const { data } = await auth.getUser();\n      if (!data.user || data.user.id === expected.id) return null;\n      const email = typeof expected.email === \"string\" && expected.email ? expected.email : null;\n      const message = `That signed in a different account, so it was signed out here.${email ? ` Sign in again as ${email}.` : \" Sign in again.\"}`;\n      me = null;\n      if (options.onDifferentPerson) await options.onDifferentPerson(message);\n      else await auth.signOut?.({ scope: \"local\" });\n      return message;\n    },\n    async withPassword(password) {\n      const u = await who();\n      if (!u.email) throw new Error(\"This account has no email to confirm with.\");\n      const { data, error } = await auth.signInWithPassword({ email: u.email, password });\n      if (error) throw new Error(\"That password was not accepted.\");\n      sameUser(data.user?.id);\n    },\n    async sendEmailCode() {\n      const u = await who();\n      if (!u.email) throw new Error(\"This account has no email to send a code to.\");\n      const { error } = await auth.signInWithOtp({ email: u.email, options: { shouldCreateUser: false } });\n      if (error) throw new Error(error.message);\n    },\n    async withEmailCode(code) {\n      const u = me ?? (await who());\n      if (!u.email) throw new Error(\"This account has no email.\");\n      const { data, error } = await auth.verifyOtp({ email: u.email, token: code.trim(), type: \"email\" });\n      if (error) throw new Error(\"That code was not accepted. Check it, or send a new one.\");\n      sameUser(data.user?.id);\n    },\n  };\n  if (options.dev) identity.dev = options.dev;\n  return identity;\n}\n\n/** True when the server refused because the sign-in is not recent enough. */\nexport function needsRecentSignIn(e: unknown): boolean {\n  const err = e as { code?: unknown; status?: unknown; message?: unknown; serverDetail?: unknown } | null;\n  if (!err) return false;\n  if (err.code === \"recent_auth_required\") return true;\n  // Some routes answer with only a sentence (the shown message is a generic \"sign in\"; the server's\n  // own words say which): read those too.\n  const said = [err.message, JSON.stringify(err.serverDetail ?? \"\")].filter((x): x is string => typeof x === \"string\").join(\" \");\n  return /recent auth|recent sign|re-authenticate|authentication within the last/i.test(said);\n}\n","import { createContext, useContext, useEffect, useRef, useState, type ReactNode } from \"react\";\nimport { Dialog, DialogContent, DialogDescription, DialogHeader, DialogTitle } from \"@ai-matrx/design-system\";\nimport { Button, Field } from \"@ai-matrx/design-system/controls\";\nimport { ShieldGlyph } from \"../glyphs\";\nimport { useNotify } from \"../notice\";\nimport { needsRecentSignIn, type IdentityAccount, type VaultIdentity } from \"./identity\";\n\n/**\n * Wrap any call that shows, copies or exports a secret. When the server answers \"sign in again\",\n * the person confirms it is them (Google, password, or an emailed code) and the call runs again —\n * they never see a dead \"Authentication required\" in the row.\n */\nexport type Confirmed = <T>(run: () => Promise<T>) => Promise<T>;\n\nconst CANCELLED = \"Not confirmed.\";\n/** Said once when the person closes \"Confirm it's you\": whatever asked for it did not happen. */\nexport const NOT_CONFIRMED_NOTICE = \"Not confirmed, so nothing was done\";\nconst Ctx = createContext<Confirmed>((run) => run());\n\nexport function useConfirmed(): Confirmed {\n  return useContext(Ctx);\n}\n\nconst PROVIDER_LABEL: Record<string, string> = { google: \"Google\", github: \"GitHub\", azure: \"Microsoft\", apple: \"Apple\", linkedin_oidc: \"LinkedIn\", slack_oidc: \"Slack\", browser: \"Browser\", touch_id: \"Touch ID\" };\nconst providerLabel = (p: string) => PROVIDER_LABEL[p] ?? p.charAt(0).toUpperCase() + p.slice(1);\n\nexport function IdentityGate({ identity, children }: { identity: VaultIdentity | undefined; children: ReactNode }) {\n  const [asking, setAsking] = useState(false);\n  const notify = useNotify();\n  const waiters = useRef<{ resolve: () => void; reject: (e: Error) => void }[]>([]);\n  // Back from a provider's confirmation: a different account that came back is signed out and said.\n  const [returnProblem, setReturnProblem] = useState<string | null>(null);\n  useEffect(() => {\n    if (!identity?.checkReturn) return;\n    let live = true;\n    identity.checkReturn().then(\n      (problem) => live && problem && setReturnProblem(problem),\n      (e: unknown) => live && setReturnProblem(e instanceof Error ? e.message : \"The account that came back could not be checked.\"),\n    );\n    return () => {\n      live = false;\n    };\n  }, [identity]);\n\n  const confirmed: Confirmed = async (run) => {\n    try {\n      return await run();\n    } catch (e) {\n      if (!identity || !needsRecentSignIn(e)) throw e;\n      await new Promise<void>((resolve, reject) => {\n        waiters.current.push({ resolve, reject });\n        setAsking(true);\n      });\n      return run();\n    }\n  };\n\n  const settle = (ok: boolean) => {\n    const w = waiters.current;\n    waiters.current = [];\n    setAsking(false);\n    for (const x of w) (ok ? x.resolve() : x.reject(new Error(CANCELLED)));\n    // Never silent: every caller stays quiet about a cancel (`wasCancelled`), so the gate says it once.\n    if (!ok && w.length > 0) notify(NOT_CONFIRMED_NOTICE, \"info\");\n  };\n\n  return (\n    <Ctx.Provider value={confirmed}>\n      {children}\n      {identity ? <ConfirmIdentityDialog open={asking} identity={identity} onDone={() => settle(true)} onCancel={() => settle(false)} /> : null}\n      <Dialog open={returnProblem !== null} onOpenChange={(o) => (o ? undefined : setReturnProblem(null))}>\n        <DialogContent size=\"sm\">\n          <DialogHeader>\n            <DialogTitle>Different account</DialogTitle>\n            <DialogDescription>{returnProblem}</DialogDescription>\n          </DialogHeader>\n          <div className=\"flex justify-end\">\n            <Button variant=\"primary\" onClick={() => setReturnProblem(null)}>OK</Button>\n          </div>\n        </DialogContent>\n      </Dialog>\n    </Ctx.Provider>\n  );\n}\n\n/** True for the rejection a canceled confirmation produces (callers stay quiet about it). */\nexport const wasCancelled = (e: unknown) => e instanceof Error && e.message === CANCELLED;\n\nfunction ConfirmIdentityDialog({ open, identity, onDone, onCancel }: { open: boolean; identity: VaultIdentity; onDone: () => void; onCancel: () => void }) {\n  const [account, setAccount] = useState<IdentityAccount | null>(null);\n  const [password, setPassword] = useState(\"\");\n  const [code, setCode] = useState(\"\");\n  const [codeSent, setCodeSent] = useState(false);\n  const [busy, setBusy] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n\n  useEffect(() => {\n    if (!open) return;\n    setPassword(\"\");\n    setCode(\"\");\n    setCodeSent(false);\n    setError(null);\n    identity.account().then(setAccount, (e: unknown) => setError(e instanceof Error ? e.message : \"Your account could not be read.\"));\n  }, [open, identity]);\n\n  const attempt = async (step: () => Promise<void>, done = true) => {\n    setBusy(true);\n    setError(null);\n    try {\n      await step();\n      if (done) onDone();\n    } catch (e) {\n      setError(e instanceof Error ? e.message : \"That did not work. Try again.\");\n    } finally {\n      setBusy(false);\n    }\n  };\n\n  return (\n    <Dialog open={open} onOpenChange={(o) => (o ? undefined : onCancel())}>\n      <DialogContent size=\"sm\">\n        <DialogHeader>\n          <div className=\"flex items-center gap-2\">\n            <ShieldGlyph className=\"size-5 text-primary\" />\n            <DialogTitle>Confirm it’s you</DialogTitle>\n          </div>\n          <DialogDescription>This needs a recent sign-in{account?.email ? ` to ${account.email}` : \"\"}.</DialogDescription>\n        </DialogHeader>\n        <div className=\"flex flex-col gap-3\">\n          {identity.dev ? (\n            <Button variant=\"primary\" disabled={busy} onClick={() => void attempt(() => identity.dev?.() ?? Promise.resolve())}>\n              Sign in again (dev)\n            </Button>\n          ) : null}\n          {account?.providers.map((p) => (\n            <Button\n              key={p}\n              variant={identity.dev ? \"outline\" : \"primary\"}\n              disabled={busy}\n              onClick={() =>\n                void attempt(async () => {\n                  if ((await identity.withProvider(p)) === \"confirmed\") onDone();\n                }, false)\n              }\n            >\n              Continue with {providerLabel(p)}\n            </Button>\n          ))}\n          {account?.hasPassword ? (\n            <form className=\"flex gap-2\" onSubmit={(e) => { e.preventDefault(); if (password) void attempt(() => identity.withPassword(password)); }}>\n              <Field className=\"min-w-0 flex-1\" type=\"password\" autoComplete=\"current-password\" placeholder=\"Your password\" aria-label=\"Your password\" value={password} onChange={(e) => setPassword(e.target.value)} autoFocus />\n              <Button variant=\"outline\" type=\"submit\" disabled={busy || !password}>Confirm</Button>\n            </form>\n          ) : null}\n          {account?.email ? (\n            codeSent ? (\n              <form className=\"flex gap-2\" onSubmit={(e) => { e.preventDefault(); if (code.trim()) void attempt(() => identity.withEmailCode(code)); }}>\n                <Field className=\"min-w-0 flex-1\" inputMode=\"numeric\" autoComplete=\"one-time-code\" placeholder=\"Code from your email\" aria-label=\"Code from your email\" value={code} onChange={(e) => setCode(e.target.value)} autoFocus />\n                <Button variant=\"outline\" type=\"submit\" disabled={busy || !code.trim()}>Confirm</Button>\n              </form>\n            ) : (\n              <Button variant=\"quiet\" disabled={busy} onClick={() => void attempt(async () => { await identity.sendEmailCode(); setCodeSent(true); }, false)}>\n                Email me a code instead\n              </Button>\n            )\n          ) : null}\n          {error ? <p role=\"alert\" className=\"text-sm text-destructive\">{error}</p> : null}\n        </div>\n      </DialogContent>\n    </Dialog>\n  );\n}\n","import type { CSSProperties, ReactNode } from \"react\";\n\nimport {\n  GlobeIcon,\n  ArchiveIcon,\n  ArrowUpDownIcon,\n  BuildingIcon,\n  CameraIcon,\n  CheckIcon,\n  ChevronDownIcon,\n  ChevronLeftIcon,\n  ChevronRightIcon,\n  ClockIcon,\n  CodeIcon,\n  CreditCardIcon,\n  DatabaseIcon,\n  DownloadIcon,\n  ExternalLinkIcon,\n  EyeIcon,\n  EyeOffIcon,\n  FilePageIcon,\n  FileTextIcon,\n  FingerprintPatternIcon,\n  KeyIcon,\n  LayoutGridIcon,\n  ListIcon,\n  LockIcon,\n  MoreHorizontalIcon,\n  MoveIcon,\n  PencilIcon,\n  PlugIcon,\n  PlusIcon,\n  PowerIcon,\n  QrCodeIcon,\n  RefreshCwIcon,\n  RotateCcwIcon,\n  SendIcon,\n  ServerIcon,\n  ShareIcon,\n  ShieldIcon,\n  SlidersVerticalIcon,\n  StarIcon,\n  TagIcon,\n  TerminalIcon,\n  TrashIcon,\n  UploadIcon,\n  UserIcon,\n  UserRoundIcon,\n  XIcon,\n  withGlyphDefaults,\n} from \"@ai-matrx/design-system/icons\";\n\n/**\n * The vault's glyphs. Every lucide drawing lives once, in `@ai-matrx/design-system/icons` (the one lucide-free\n * glyph home, which also carries the optical-trim class); each name here is an alias of it. `SafeGlyph` is the\n * vault's own drawing (a strongbox: no lucide twin) and is the only one drawn in this file.\n */\nexport type Glyph = (props: { className?: string }) => ReactNode;\n\n/**\n * `air` = the empty 24-grid units left and right of the drawn ink (stroke included), measured with\n * getBBox. The design system's optical trim reads it (`--matrx-glyph-air-l/-r`) so an icon + label\n * button sits its INK, not its box, the same distance from both edges — exactly as it does for lucide.\n */\nfunction glyph(paths: ReactNode, air: readonly [number, number] = [1, 1]): Glyph {\n  const style = { \"--matrx-glyph-air-l\": air[0], \"--matrx-glyph-air-r\": air[1] } as CSSProperties;\n  return function VaultGlyph({ className }) {\n    return (\n      <svg className={className} style={style} viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" strokeWidth={2} strokeLinecap=\"round\" strokeLinejoin=\"round\" aria-hidden>\n        {paths}\n      </svg>\n    );\n  };\n}\n\nexport const KeyGlyph: Glyph = withGlyphDefaults(KeyIcon, {}, { air: [1, 2] });\nexport const NoteGlyph: Glyph = withGlyphDefaults(FileTextIcon, {}, { air: [3, 3] });\nexport const CardGlyph: Glyph = withGlyphDefaults(CreditCardIcon, {}, { air: [1, 1] });\nexport const PersonGlyph: Glyph = withGlyphDefaults(UserRoundIcon, {}, { air: [3, 3] });\nexport const DatabaseGlyph: Glyph = withGlyphDefaults(DatabaseIcon, {}, { air: [2, 2] });\nexport const ServerGlyph: Glyph = withGlyphDefaults(ServerIcon, {}, { air: [1, 1] });\nexport const TerminalGlyph: Glyph = withGlyphDefaults(TerminalIcon, {}, { air: [3, 3] });\nexport const FileGlyph: Glyph = withGlyphDefaults(FilePageIcon, {}, { air: [3, 3] });\nexport const CodeGlyph: Glyph = withGlyphDefaults(CodeIcon, {}, { air: [1, 1] });\nexport const StarGlyph: Glyph = withGlyphDefaults(StarIcon, {}, { air: [1, 1] });\nexport const PlusGlyph: Glyph = withGlyphDefaults(PlusIcon, {}, { air: [4, 4] });\nexport const EyeGlyph: Glyph = withGlyphDefaults(EyeIcon, {}, { air: [1, 1] });\nexport const EyeOffGlyph: Glyph = withGlyphDefaults(EyeOffIcon, {}, { air: [1, 1] });\nexport const LockGlyph: Glyph = withGlyphDefaults(LockIcon, {}, { air: [2, 2] });\nexport const ExternalGlyph: Glyph = withGlyphDefaults(ExternalLinkIcon, {}, { air: [2, 2] });\nexport const TrashGlyph: Glyph = withGlyphDefaults(TrashIcon, {}, { air: [2, 2] });\nexport const ArchiveGlyph: Glyph = withGlyphDefaults(ArchiveIcon, {}, { air: [1, 1] });\nexport const TagGlyph: Glyph = withGlyphDefaults(TagIcon, {}, { air: [1, 1] });\nexport const ShieldGlyph: Glyph = withGlyphDefaults(ShieldIcon, {}, { air: [3, 3] });\nexport const BuildingGlyph: Glyph = withGlyphDefaults(BuildingIcon, {}, { air: [3, 3] });\nexport const ChevronLeftGlyph: Glyph = withGlyphDefaults(ChevronLeftIcon, {}, { air: [8, 8] });\nexport const GridGlyph: Glyph = withGlyphDefaults(LayoutGridIcon, {}, { air: [2, 2] });\nexport const PlugGlyph: Glyph = withGlyphDefaults(PlugIcon, {}, { air: [5, 5] });\n\nconst FAMILY_GLYPHS: Record<string, Glyph> = {\n  databases: DatabaseGlyph,\n  server_network: ServerGlyph,\n  hosting_deployment: ServerGlyph,\n  source_control: CodeGlyph,\n  signing_files: FileGlyph,\n  identity_security: ShieldGlyph,\n  cloud_infrastructure: ServerGlyph,\n};\n\n/** A type's glyph: logins are a globe, then by family, else a key. */\nexport function definitionGlyph(key: string, family: string): Glyph {\n  if (key === \"username_password\" || key === \"website_login\") return GlobeIcon;\n  return FAMILY_GLYPHS[family] ?? KeyGlyph;\n}\nexport const XGlyph: Glyph = withGlyphDefaults(XIcon, {}, { air: [5, 5] });\nexport const PencilGlyph: Glyph = withGlyphDefaults(PencilIcon, {}, { air: [2, 2] });\nexport const ClockGlyph: Glyph = withGlyphDefaults(ClockIcon, {}, { air: [1, 1] });\n// ── core workspace glyphs ────────────────────────────────────────────────────\nexport const MoreGlyph: Glyph = withGlyphDefaults(MoreHorizontalIcon, {}, { air: [3, 3] });\nexport const ShareGlyph: Glyph = withGlyphDefaults(ShareIcon, {}, { air: [3, 3] });\nexport const ListGlyph: Glyph = withGlyphDefaults(ListIcon, {}, { air: [2, 2] });\nexport const ImportGlyph: Glyph = withGlyphDefaults(DownloadIcon, {}, { air: [2, 2] });\nexport const ExportGlyph: Glyph = withGlyphDefaults(UploadIcon, {}, { air: [2, 2] });\nexport const ChevronDownGlyph: Glyph = withGlyphDefaults(ChevronDownIcon, {}, { air: [5, 5] });\nexport const ChevronRightGlyph: Glyph = withGlyphDefaults(ChevronRightIcon, {}, { air: [8, 8] });\nexport const SortGlyph: Glyph = withGlyphDefaults(ArrowUpDownIcon, {}, { air: [2, 2] });\nexport const UserGlyph: Glyph = withGlyphDefaults(UserIcon, {}, { air: [5, 5] });\nexport const MoveGlyph: Glyph = withGlyphDefaults(MoveIcon, {}, { air: [1, 1] });\nexport const SafeGlyph = glyph(<><rect x=\"3\" y=\"3\" width=\"18\" height=\"18\" rx=\"2\" /><circle cx=\"12\" cy=\"12\" r=\"4\" /><path d=\"M12 8v1M12 15v1M8 12h1M15 12h1\" /></>, [2, 2]);\nexport const RestoreGlyph: Glyph = withGlyphDefaults(RotateCcwIcon, {}, { air: [2, 2] });\n// ── one-time passwords ───────────────────────────────────────────────────────\nexport const QrGlyph: Glyph = withGlyphDefaults(QrCodeIcon, {}, { air: [2, 2] });\nexport const CameraGlyph: Glyph = withGlyphDefaults(CameraIcon, {}, { air: [1, 1] });\nexport const CheckGlyph: Glyph = withGlyphDefaults(CheckIcon, {}, { air: [3, 3] });\nexport const PowerGlyph: Glyph = withGlyphDefaults(PowerIcon, {}, { air: [2, 2] });\n// ── generator and field settings ─────────────────────────────────────────────\nexport const RefreshGlyph: Glyph = withGlyphDefaults(RefreshCwIcon, {}, { air: [2, 2] });\nexport const SlidersGlyph: Glyph = withGlyphDefaults(SlidersVerticalIcon, {}, { air: [0, 0] });\nexport const UploadGlyph: Glyph = withGlyphDefaults(UploadIcon, {}, { air: [2, 2] });\n// ── browsers that can fill ───────────────────────────────────────────────────\nexport const FingerprintGlyph: Glyph = withGlyphDefaults(FingerprintPatternIcon, {}, { air: [1, 1] });\nexport const SendGlyph: Glyph = withGlyphDefaults(SendIcon, {}, { air: [1, 1] });\n","import { createContext, useCallback, useContext, useEffect, useRef, useState, type ReactNode } from \"react\";\nimport { cn } from \"@ai-matrx/design-system\";\nimport { copyText } from \"@ai-matrx/kit/clipboard\";\nimport type { VaultClipboard } from \"./lock\";\n\nexport type NoticeKind = \"success\" | \"error\" | \"info\";\nexport type Notify = (message: string, kind?: NoticeKind) => void;\n\nconst Ctx = createContext<Notify>(() => undefined);\n\n/** Say something short to the person (\"Password copied\"). Hosts with their own toasts pass `notify`. */\nexport function useNotify(): Notify {\n  return useContext(Ctx);\n}\n\nexport interface CopyOptions {\n  /** A secret (a password, a code, a key): the host's clipboard takes custody. Default true. */\n  secret?: boolean;\n}\n\n/**\n * Writes `text` and says so (or says why not). Through the host's clipboard when it has one (custody:\n * the host clears a secret later), else the browser's. Pure over its inputs, so it is tested alone.\n */\nexport async function copyValue(text: string, label: string, options: CopyOptions, deps: { clipboard?: VaultClipboard | undefined; notify: Notify }): Promise<boolean> {\n  const secret = options.secret ?? true;\n  if (deps.clipboard) {\n    try {\n      const copied = await deps.clipboard.copy(text, { secret });\n      deps.notify(copiedLine(label, copied?.clearsAtMs ?? null), \"success\");\n      return true;\n    } catch (e) {\n      deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, \"error\");\n      return false;\n    }\n  }\n  return copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === \"error\" ? \"error\" : \"success\") });\n}\n\n/** \"Password copied\", or \"Password copied. Clears at 3:42 PM\" when the host says when it clears it. */\nexport function copiedLine(label: string, clearsAtMs: number | null): string {\n  if (clearsAtMs === null || !Number.isFinite(clearsAtMs)) return `${label} copied`;\n  const at = new Date(clearsAtMs).toLocaleTimeString(undefined, { hour: \"numeric\", minute: \"2-digit\" });\n  return `${label} copied. Clears at ${at}`;\n}\n\nconst ClipboardCtx = createContext<VaultClipboard | undefined>(undefined);\n\n/** The host's clipboard (`host.clipboard`), for every copy below it. */\nexport function ClipboardProvider({ clipboard, children }: { clipboard: VaultClipboard | undefined; children: ReactNode }) {\n  return <ClipboardCtx.Provider value={clipboard}>{children}</ClipboardCtx.Provider>;\n}\n\n/** THE copy for every vault screen: writes, then says so (or says why not). */\nexport function useCopy(): (text: string, label: string, options?: CopyOptions) => Promise<boolean> {\n  const notify = useNotify();\n  const clipboard = useContext(ClipboardCtx);\n  return useCallback((text, label, options = {}) => copyValue(text, label, options, { clipboard, notify }), [notify, clipboard]);\n}\n\n/**\n * The vault's own notice line, so feedback exists in every host (an extension side panel has no app\n * toaster). A host that has one passes `notify` and this draws nothing.\n */\nexport function NoticeProvider({ notify, children }: { notify?: Notify | undefined; children: ReactNode }) {\n  const [shown, setShown] = useState<{ message: string; kind: NoticeKind; n: number } | null>(null);\n  const timer = useRef<ReturnType<typeof setTimeout> | null>(null);\n  const local = useCallback<Notify>((message, kind = \"success\") => {\n    if (timer.current) clearTimeout(timer.current);\n    setShown((s) => ({ message, kind, n: (s?.n ?? 0) + 1 }));\n    timer.current = setTimeout(() => setShown(null), kind === \"error\" ? 5000 : 2200);\n  }, []);\n  useEffect(() => () => void (timer.current && clearTimeout(timer.current)), []);\n  return (\n    <Ctx.Provider value={notify ?? local}>\n      {children}\n      {!notify ? (\n        <div aria-live=\"polite\" className=\"pointer-events-none absolute inset-x-0 bottom-4 z-30 flex justify-center px-4\">\n          {shown ? (\n            <div key={shown.n} role=\"status\" className={cn(\"rounded-full border border-border bg-popover px-4 py-2 text-sm shadow-lg\", shown.kind === \"error\" ? \"text-destructive\" : \"text-foreground\")}>\n              {shown.message}\n            </div>\n          ) : null}\n        </div>\n      ) : null}\n    </Ctx.Provider>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AC0EO,IAAM,qBAAqB;AAElC,IAAM,mBAAmB,KAAK;AAE9B,IAAM,cAAc;AAGb,SAAS,uBAAuB,MAAwB,UAAmC,CAAC,GAAkB;AACnH,MAAI,KAAkD;AACtD,QAAM,MAAM,QAAQ,OAAO,KAAK;AAChC,QAAM,QAAQ,MAA0B;AACtC,QAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,QAAI;AACF,aAAQ,WAAgD,kBAAkB;AAAA,IAC5E,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,YAAY;AACtB,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,QAAQ;AACpC,QAAI,CAAC,KAAK,KAAM,OAAM,IAAI,MAAM,oCAAoC;AACpE,SAAK,EAAE,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,SAAS,KAAK;AACxD,WAAO,KAAK;AAAA,EACd;AACA,QAAM,WAAW,CAAC,OAA2B;AAC3C,QAAI,CAAC,MAAM,OAAO,GAAG,GAAI,OAAM,IAAI,MAAM,WAAW;AAAA,EACtD;AACA,QAAM,WAA0B;AAAA,IAC9B,MAAM,UAAU;AACd,YAAM,IAAI,MAAM,IAAI;AACpB,YAAM,QAAQ,oBAAI,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,GAAG,GAAI,EAAE,cAAc,aAAa,CAAC,CAAE,CAAC;AAC5G,aAAO,EAAE,OAAO,EAAE,SAAS,MAAM,WAAW,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,MAAM,MAAM,WAAW,MAAM,OAAO,GAAG,aAAa,MAAM,IAAI,OAAO,EAAE;AAAA,IACxI;AAAA,IACA,MAAM,aAAa,UAAU;AAC3B,YAAM,IAAI,MAAM,IAAI;AAEpB,YAAM,GAAG,QAAQ,oBAAoB,KAAK,UAAU,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,SAAS,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;AACpG,YAAM,aAAa,QAAQ,aAAa,KAAK,WAAW,UAAU;AAElE,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,gBAAgB,EAAE,UAA6B,GAAI,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,EAAG,CAAC;AAChI,UAAI,OAAO;AACT,cAAM,GAAG,WAAW,kBAAkB;AACtC,cAAM,IAAI,MAAM,MAAM,OAAO;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,MAAM,cAAc;AAClB,YAAM,IAAI,MAAM;AAChB,YAAM,MAAM,GAAG,QAAQ,kBAAkB,KAAK;AAC9C,UAAI,CAAC,KAAK,QAAQ,KAAM,QAAO;AAC/B,QAAE,WAAW,kBAAkB;AAC/B,UAAI;AACJ,UAAI;AACF,mBAAW,KAAK,MAAM,GAAG;AAAA,MAC3B,QAAQ;AACN,eAAO;AAAA,MACT;AACA,UAAI,OAAO,SAAS,OAAO,YAAY,OAAO,SAAS,OAAO,YAAY,IAAI,IAAI,SAAS,KAAK,iBAAkB,QAAO;AACzH,YAAM,EAAE,KAAK,IAAI,MAAM,KAAK,QAAQ;AACpC,UAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,OAAO,SAAS,GAAI,QAAO;AACvD,YAAM,QAAQ,OAAO,SAAS,UAAU,YAAY,SAAS,QAAQ,SAAS,QAAQ;AACtF,YAAM,UAAU,iEAAiE,QAAQ,qBAAqB,KAAK,MAAM,iBAAiB;AAC1I,WAAK;AACL,UAAI,QAAQ,kBAAmB,OAAM,QAAQ,kBAAkB,OAAO;AAAA,UACjE,OAAM,KAAK,UAAU,EAAE,OAAO,QAAQ,CAAC;AAC5C,aAAO;AAAA,IACT;AAAA,IACA,MAAM,aAAa,UAAU;AAC3B,YAAM,IAAI,MAAM,IAAI;AACpB,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,4CAA4C;AAC1E,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,mBAAmB,EAAE,OAAO,EAAE,OAAO,SAAS,CAAC;AAClF,UAAI,MAAO,OAAM,IAAI,MAAM,iCAAiC;AAC5D,eAAS,KAAK,MAAM,EAAE;AAAA,IACxB;AAAA,IACA,MAAM,gBAAgB;AACpB,YAAM,IAAI,MAAM,IAAI;AACpB,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,8CAA8C;AAC5E,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,cAAc,EAAE,OAAO,EAAE,OAAO,SAAS,EAAE,kBAAkB,MAAM,EAAE,CAAC;AACnG,UAAI,MAAO,OAAM,IAAI,MAAM,MAAM,OAAO;AAAA,IAC1C;AAAA,IACA,MAAM,cAAc,MAAM;AACxB,YAAM,IAAI,MAAO,MAAM,IAAI;AAC3B,UAAI,CAAC,EAAE,MAAO,OAAM,IAAI,MAAM,4BAA4B;AAC1D,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,KAAK,UAAU,EAAE,OAAO,EAAE,OAAO,OAAO,KAAK,KAAK,GAAG,MAAM,QAAQ,CAAC;AAClG,UAAI,MAAO,OAAM,IAAI,MAAM,0DAA0D;AACrF,eAAS,KAAK,MAAM,EAAE;AAAA,IACxB;AAAA,EACF;AACA,MAAI,QAAQ,IAAK,UAAS,MAAM,QAAQ;AACxC,SAAO;AACT;AAGO,SAAS,kBAAkB,GAAqB;AACrD,QAAM,MAAM;AACZ,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,SAAS,uBAAwB,QAAO;AAGhD,QAAM,OAAO,CAAC,IAAI,SAAS,KAAK,UAAU,IAAI,gBAAgB,EAAE,CAAC,EAAE,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,EAAE,KAAK,GAAG;AAC7H,SAAO,0EAA0E,KAAK,IAAI;AAC5F;;;AC9KA,IAAAA,gBAAuF;AACvF,IAAAC,wBAAoF;AACpF,sBAA8B;;;ACA9B,mBAgDO;AAkBD;AAJN,SAAS,MAAM,OAAkB,MAAiC,CAAC,GAAG,CAAC,GAAU;AAC/E,QAAM,QAAQ,EAAE,uBAAuB,IAAI,CAAC,GAAG,uBAAuB,IAAI,CAAC,EAAE;AAC7E,SAAO,SAAS,WAAW,EAAE,UAAU,GAAG;AACxC,WACE,4CAAC,SAAI,WAAsB,OAAc,SAAQ,aAAY,MAAK,QAAO,QAAO,gBAAe,aAAa,GAAG,eAAc,SAAQ,gBAAe,SAAQ,eAAW,MACpK,iBACH;AAAA,EAEJ;AACF;AAEO,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,gBAAmB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,6BAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,kBAAqB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,gBAAmB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,oBAAuB,gCAAkB,+BAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACpF,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,mBAAsB,gCAAkB,0BAAa,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,eAAkB,gCAAkB,sBAAS,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,oBAAuB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,uBAA0B,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,gBAAmB,gCAAkB,6BAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAiBxE,IAAM,aAAgB,gCAAkB,oBAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE1E,IAAM,gBAAmB,gCAAkB,iCAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAClF,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,kBAAqB,gCAAkB,2BAAc,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9E,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,uBAA0B,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,wBAA2B,gCAAkB,+BAAkB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxF,IAAM,gBAAmB,gCAAkB,8BAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/E,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,YAAY,MAAM,4EAAE;AAAA,8CAAC,UAAK,GAAE,KAAI,GAAE,KAAI,OAAM,MAAK,QAAO,MAAK,IAAG,KAAI;AAAA,EAAE,4CAAC,YAAO,IAAG,MAAK,IAAG,MAAK,GAAE,KAAI;AAAA,EAAE,4CAAC,UAAK,GAAE,kCAAiC;AAAA,GAAE,GAAK,CAAC,GAAG,CAAC,CAAC;AAClK,IAAM,mBAAsB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAEhF,IAAM,cAAiB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACxE,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC5E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1E,IAAM,iBAAoB,gCAAkB,wBAAW,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE1E,IAAM,mBAAsB,gCAAkB,4BAAe,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAChF,IAAM,mBAAsB,gCAAkB,kCAAqB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AACtF,IAAM,kBAAqB,gCAAkB,yBAAY,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAE5E,IAAM,uBAA0B,gCAAkB,qCAAwB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;AAC7F,IAAM,gBAAmB,gCAAkB,uBAAU,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;;;AC7I/E,mBAAoG;AACpG,2BAAmB;AACnB,uBAAyB;AAgDhB,IAAAC,sBAAA;AA1CT,IAAM,UAAM,4BAAsB,MAAM,MAAS;AAG1C,SAAS,YAAoB;AAClC,aAAO,yBAAW,GAAG;AACvB;AAiCA,IAAM,mBAAe,4BAA0C,MAAS;;;AFuBtD,IAAAC,sBAAA;AAvDlB,IAAM,YAAY;AAEX,IAAM,uBAAuB;AACpC,IAAMC,WAAM,6BAAyB,CAAC,QAAQ,IAAI,CAAC;AAE5C,SAAS,eAA0B;AACxC,aAAO,0BAAWA,IAAG;AACvB;AAEA,IAAM,iBAAyC,EAAE,QAAQ,UAAU,QAAQ,UAAU,OAAO,aAAa,OAAO,SAAS,eAAe,YAAY,YAAY,SAAS,SAAS,WAAW,UAAU,WAAW;AAClN,IAAM,gBAAgB,CAAC,MAAc,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC;AAExF,SAAS,aAAa,EAAE,UAAU,SAAS,GAAiE;AACjH,QAAM,CAAC,QAAQ,SAAS,QAAI,wBAAS,KAAK;AAC1C,QAAM,SAAS,UAAU;AACzB,QAAM,cAAU,sBAA8D,CAAC,CAAC;AAEhF,QAAM,CAAC,eAAe,gBAAgB,QAAI,wBAAwB,IAAI;AACtE,+BAAU,MAAM;AACd,QAAI,CAAC,UAAU,YAAa;AAC5B,QAAI,OAAO;AACX,aAAS,YAAY,EAAE;AAAA,MACrB,CAAC,YAAY,QAAQ,WAAW,iBAAiB,OAAO;AAAA,MACxD,CAAC,MAAe,QAAQ,iBAAiB,aAAa,QAAQ,EAAE,UAAU,kDAAkD;AAAA,IAC9H;AACA,WAAO,MAAM;AACX,aAAO;AAAA,IACT;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,YAAuB,OAAO,QAAQ;AAC1C,QAAI;AACF,aAAO,MAAM,IAAI;AAAA,IACnB,SAAS,GAAG;AACV,UAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,EAAG,OAAM;AAC9C,YAAM,IAAI,QAAc,CAAC,SAAS,WAAW;AAC3C,gBAAQ,QAAQ,KAAK,EAAE,SAAS,OAAO,CAAC;AACxC,kBAAU,IAAI;AAAA,MAChB,CAAC;AACD,aAAO,IAAI;AAAA,IACb;AAAA,EACF;AAEA,QAAM,SAAS,CAAC,OAAgB;AAC9B,UAAM,IAAI,QAAQ;AAClB,YAAQ,UAAU,CAAC;AACnB,cAAU,KAAK;AACf,eAAW,KAAK,EAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,EAAE,OAAO,IAAI,MAAM,SAAS,CAAC;AAEpE,QAAI,CAAC,MAAM,EAAE,SAAS,EAAG,QAAO,sBAAsB,MAAM;AAAA,EAC9D;AAEA,SACE,8CAACA,KAAI,UAAJ,EAAa,OAAO,WAClB;AAAA;AAAA,IACA,WAAW,6CAAC,yBAAsB,MAAM,QAAQ,UAAoB,QAAQ,MAAM,OAAO,IAAI,GAAG,UAAU,MAAM,OAAO,KAAK,GAAG,IAAK;AAAA,IACrI,6CAAC,gCAAO,MAAM,kBAAkB,MAAM,cAAc,CAAC,MAAO,IAAI,SAAY,iBAAiB,IAAI,GAC/F,wDAAC,uCAAc,MAAK,MAClB;AAAA,oDAAC,sCACC;AAAA,qDAAC,qCAAY,+BAAiB;AAAA,QAC9B,6CAAC,2CAAmB,yBAAc;AAAA,SACpC;AAAA,MACA,6CAAC,SAAI,WAAU,oBACb,uDAAC,0BAAO,SAAQ,WAAU,SAAS,MAAM,iBAAiB,IAAI,GAAG,gBAAE,GACrE;AAAA,OACF,GACF;AAAA,KACF;AAEJ;AAGO,IAAM,eAAe,CAAC,MAAe,aAAa,SAAS,EAAE,YAAY;AAEhF,SAAS,sBAAsB,EAAE,MAAM,UAAU,QAAQ,SAAS,GAAyF;AACzJ,QAAM,CAAC,SAAS,UAAU,QAAI,wBAAiC,IAAI;AACnE,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,EAAE;AAC3C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAS,EAAE;AACnC,QAAM,CAAC,UAAU,WAAW,QAAI,wBAAS,KAAK;AAC9C,QAAM,CAAC,MAAM,OAAO,QAAI,wBAAS,KAAK;AACtC,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAwB,IAAI;AAEtD,+BAAU,MAAM;AACd,QAAI,CAAC,KAAM;AACX,gBAAY,EAAE;AACd,YAAQ,EAAE;AACV,gBAAY,KAAK;AACjB,aAAS,IAAI;AACb,aAAS,QAAQ,EAAE,KAAK,YAAY,CAAC,MAAe,SAAS,aAAa,QAAQ,EAAE,UAAU,iCAAiC,CAAC;AAAA,EAClI,GAAG,CAAC,MAAM,QAAQ,CAAC;AAEnB,QAAM,UAAU,OAAO,MAA2B,OAAO,SAAS;AAChE,YAAQ,IAAI;AACZ,aAAS,IAAI;AACb,QAAI;AACF,YAAM,KAAK;AACX,UAAI,KAAM,QAAO;AAAA,IACnB,SAAS,GAAG;AACV,eAAS,aAAa,QAAQ,EAAE,UAAU,+BAA+B;AAAA,IAC3E,UAAE;AACA,cAAQ,KAAK;AAAA,IACf;AAAA,EACF;AAEA,SACE,6CAAC,gCAAO,MAAY,cAAc,CAAC,MAAO,IAAI,SAAY,SAAS,GACjE,wDAAC,uCAAc,MAAK,MAClB;AAAA,kDAAC,sCACC;AAAA,oDAAC,SAAI,WAAU,2BACb;AAAA,qDAAC,eAAY,WAAU,uBAAsB;AAAA,QAC7C,6CAAC,qCAAY,mCAAgB;AAAA,SAC/B;AAAA,MACA,8CAAC,2CAAkB;AAAA;AAAA,QAA4B,SAAS,QAAQ,OAAO,QAAQ,KAAK,KAAK;AAAA,QAAG;AAAA,SAAC;AAAA,OAC/F;AAAA,IACA,8CAAC,SAAI,WAAU,uBACZ;AAAA,eAAS,MACR,6CAAC,0BAAO,SAAQ,WAAU,UAAU,MAAM,SAAS,MAAM,KAAK,QAAQ,MAAM,SAAS,MAAM,KAAK,QAAQ,QAAQ,CAAC,GAAG,iCAEpH,IACE;AAAA,MACH,SAAS,UAAU,IAAI,CAAC,MACvB;AAAA,QAAC;AAAA;AAAA,UAEC,SAAS,SAAS,MAAM,YAAY;AAAA,UACpC,UAAU;AAAA,UACV,SAAS,MACP,KAAK,QAAQ,YAAY;AACvB,gBAAK,MAAM,SAAS,aAAa,CAAC,MAAO,YAAa,QAAO;AAAA,UAC/D,GAAG,KAAK;AAAA,UAEX;AAAA;AAAA,YACgB,cAAc,CAAC;AAAA;AAAA;AAAA,QATzB;AAAA,MAUP,CACD;AAAA,MACA,SAAS,cACR,8CAAC,UAAK,WAAU,cAAa,UAAU,CAAC,MAAM;AAAE,UAAE,eAAe;AAAG,YAAI,SAAU,MAAK,QAAQ,MAAM,SAAS,aAAa,QAAQ,CAAC;AAAA,MAAG,GACrI;AAAA,qDAAC,yBAAM,WAAU,kBAAiB,MAAK,YAAW,cAAa,oBAAmB,aAAY,iBAAgB,cAAW,iBAAgB,OAAO,UAAU,UAAU,CAAC,MAAM,YAAY,EAAE,OAAO,KAAK,GAAG,WAAS,MAAC;AAAA,QAClN,6CAAC,0BAAO,SAAQ,WAAU,MAAK,UAAS,UAAU,QAAQ,CAAC,UAAU,qBAAO;AAAA,SAC9E,IACE;AAAA,MACH,SAAS,QACR,WACE,8CAAC,UAAK,WAAU,cAAa,UAAU,CAAC,MAAM;AAAE,UAAE,eAAe;AAAG,YAAI,KAAK,KAAK,EAAG,MAAK,QAAQ,MAAM,SAAS,cAAc,IAAI,CAAC;AAAA,MAAG,GACrI;AAAA,qDAAC,yBAAM,WAAU,kBAAiB,WAAU,WAAU,cAAa,iBAAgB,aAAY,wBAAuB,cAAW,wBAAuB,OAAO,MAAM,UAAU,CAAC,MAAM,QAAQ,EAAE,OAAO,KAAK,GAAG,WAAS,MAAC;AAAA,QACzN,6CAAC,0BAAO,SAAQ,WAAU,MAAK,UAAS,UAAU,QAAQ,CAAC,KAAK,KAAK,GAAG,qBAAO;AAAA,SACjF,IAEA,6CAAC,0BAAO,SAAQ,SAAQ,UAAU,MAAM,SAAS,MAAM,KAAK,QAAQ,YAAY;AAAE,cAAM,SAAS,cAAc;AAAG,oBAAY,IAAI;AAAA,MAAG,GAAG,KAAK,GAAG,qCAEhJ,IAEA;AAAA,MACH,QAAQ,6CAAC,OAAE,MAAK,SAAQ,WAAU,4BAA4B,iBAAM,IAAO;AAAA,OAC9E;AAAA,KACF,GACF;AAEJ;","names":["import_react","import_design_system","import_jsx_runtime","import_jsx_runtime","Ctx"]}

package/dist/index.cjs

@@ -1774,14 +1774,12 @@ function CodeButton({ live, digits, size = "md", label }) {
       disabled: !live.code,
       onClick: () => live.code && void copy(live.code),
       "aria-label": live.code ? `Copy ${label} code` : `Getting ${label} code`,
+      ...live.code ? { tooltip: "Copy code" } : {},
       variant: "quiet",
       layout: "row",
-      title: "Copy code",
-      end: /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("span", { className: (0, import_design_system8.cn)("inline-flex shrink-0 items-center", size === "lg" ? "gap-4" : "gap-3"), children: [
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: (0, import_design_system8.cn)("whitespace-nowrap font-mono font-medium tabular-nums tracking-[0.08em]", size === "lg" ? "text-2xl" : "text-[1.0625rem]", live.code ? "text-foreground" : "text-disabled-foreground"), children: shown }),
-        copied ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "inline-flex size-6 items-center justify-center text-success", role: "status", "aria-label": "Copied", children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CheckGlyph, { className: "size-4" }) }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CountdownRing, { remaining: live.remaining, period: live.period, loading: !live.code })
-      ] }),
-      className: "max-w-full shrink-0"
+      fit: true,
+      title: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: (0, import_design_system8.cn)("whitespace-nowrap font-mono font-medium tabular-nums tracking-[0.08em]", size === "lg" ? "text-2xl" : "text-[1.0625rem]", live.code ? "text-foreground" : "text-disabled-foreground"), children: shown }),
+      end: copied ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "inline-flex size-6 items-center justify-center text-success", role: "status", "aria-label": "Copied", children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CheckGlyph, { className: "size-4" }) }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CountdownRing, { remaining: live.remaining, period: live.period, loading: !live.code })
     }
   );
 }
@@ -2583,7 +2581,7 @@ function OtpListRow({ port, item, family, entry, onOpen, onOpenInNewTab, onRenam
   const canManage = item.capabilities.canManage || item.capabilities.canEdit;
   if (a.removed) return null;
   const sub = a.error ?? [entry?.account, loginSiteOf(item) || entry?.issuer].filter((v, i, all) => Boolean(v) && all.indexOf(v) === i).join(" \xB7 ");
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-3 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
+  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-1 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
     /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
       import_controls9.Button,
       {
@@ -2604,6 +2602,7 @@ function OtpListRow({ port, item, family, entry, onOpen, onOpenInNewTab, onRenam
         onClick: onOpen,
         title: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: a.enabled ? "text-foreground" : "text-muted-foreground", children: item.name }),
         line: sub ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: a.error ? "text-destructive" : "text-muted-foreground", title: sub, children: sub }) : void 0,
+        oneLine: true,
         className: "min-w-0"
       }
     ),
@@ -3562,7 +3561,7 @@ function BackupPanel({ port, host, items, onClose, onChanged }) {
         /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Summary, { value: backup }),
         /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
         /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(VaultSection, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Passphrase", hint: minLength ? `At least ${minLength} characters. Not saved.` : "Not saved. It can't be recovered.", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", "aria-invalid": short || void 0, onChange: (e) => setPassphrase(e.target.value) }) }),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Passphrase", hint: minLength ? `At least ${minLength} characters. Not saved. It can't be recovered.` : "Not saved. It can't be recovered.", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", "aria-invalid": short || void 0, onChange: (e) => setPassphrase(e.target.value) }) }),
           short ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("p", { role: "alert", className: "px-1 text-xs text-destructive", "data-passphrase-too-short": "", children: [
             "Use at least ",
             minLength,
@@ -6763,14 +6762,17 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
           {
             type: "button",
             "aria-current": on ? "true" : void 0,
-            "data-surface": on ? "primary" : void 0,
+            selected: on,
+            selectedStyle: "primary",
             onClick: () => onSelect(item.id),
             layout: "row",
             variant: "quiet",
+            endInset: "control",
+            oneLine: true,
             icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
             title: item.name,
             line: subtitleOf(item, withOwner),
-            className: "w-full pr-10"
+            className: "w-full"
           }
         ),
         /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: "absolute right-1.5 top-1/2 flex -translate-y-1/2 items-center gap-0.5", "data-surface": on ? "primary" : void 0, children: [
@@ -8258,8 +8260,8 @@ function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, ite
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
   const canSave = isFillablePage(page.url);
   const signIn = page.signIn;
-  const act = async (itemId, run, failed) => {
-    setRunning(itemId);
+  const act = async (itemId, action, run, failed) => {
+    setRunning({ itemId, action });
     setSaid(null);
     try {
       setSaid(await run());
@@ -8292,10 +8294,10 @@ function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, ite
         family: item ? familyOf2(item.definitionKey) : "generic",
         port,
         busy: running !== null,
-        running: running === itemId,
+        running: running?.itemId === itemId ? running.action : null,
         onOpen,
-        onFill: fill && !page.blocked && fillable.has(itemId) && item?.capabilities.canUse !== false ? () => void act(itemId, async () => FILL_WORDS[await fill(itemId)], FILL_WORDS.unavailable) : null,
-        onSignIn: signIn ? () => void act(itemId, async () => SIGN_IN_WORDS[await signIn(itemId)], SIGN_IN_WORDS.unknown) : null
+        onFill: fill && !page.blocked && fillable.has(itemId) && item?.capabilities.canUse !== false ? () => void act(itemId, "fill", async () => FILL_WORDS[await fill(itemId)], FILL_WORDS.unavailable) : null,
+        onSignIn: signIn ? () => void act(itemId, "signIn", async () => SIGN_IN_WORDS[await signIn(itemId)], SIGN_IN_WORDS.unknown) : null
       },
       itemId
     )) });
@@ -8362,8 +8364,8 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
         className: "min-w-0 flex-1"
       }
     ),
-    onFill ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "primary", disabled: busy, "aria-busy": running || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running ? "Filling\u2026" : "Fill" }) : null,
-    onSignIn ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: onFill ? "outline" : "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ShieldGlyph, {}), disabled: busy, onClick: onSignIn, "aria-label": `Sign me in with ${item?.name ?? "this login"}`, title: "Sign me in", children: "Sign me in" }) : null,
+    onFill ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "primary", disabled: busy, "aria-busy": running === "fill" || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running === "fill" ? "Filling\u2026" : "Fill" }) : null,
+    onSignIn ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: onFill ? "outline" : "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ShieldGlyph, {}), disabled: busy, "aria-busy": running === "signIn" || void 0, onClick: onSignIn, "aria-label": `Sign me in with ${item?.name ?? "this login"}`, title: "Sign me in", children: running === "signIn" ? "Signing in\u2026" : "Sign me in" }) : null,
     user && item ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(UserGlyph, {}), "aria-label": `Copy ${user.label}`, title: `Copy ${user.label}`, disabled: reading, onClick: () => void read(user.label, () => port.reveal(item, user.key)) }) : null,
     secret && item ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(KeyGlyph, {}), "aria-label": "Copy password", title: "Copy password", disabled: reading, onClick: () => void read("Password", () => port.reveal(item, secret.key)) }) : null,
     otp ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null
@@ -8455,12 +8457,14 @@ function viewOptions(views, allCount, deletedCount, hasFavorites, hasRecents, ha
   ];
 }
 function Entry({ on, glyph: Icon, label, count: count2, onClick, nested = false }) {
+  const desktop = (0, import_design_system24.useLook)() === "desktop";
   return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(
     import_controls34.Tile,
     {
       type: "button",
       "aria-current": on ? "page" : void 0,
       selected: on,
+      ...desktop ? { selectedStyle: "fill" } : {},
       onClick,
       layout: "row",
       variant: "quiet",
@@ -8468,8 +8472,9 @@ function Entry({ on, glyph: Icon, label, count: count2, onClick, nested = false
       icon: nested ? void 0 : /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Icon, { className: "size-4 shrink-0" }),
       title: label,
       ...count2 !== void 0 ? { end: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("span", { className: "text-xs tabular-nums text-muted-foreground", children: count2 }) } : {},
+      ...nested ? { level: 1 } : {},
       "data-nested": nested ? "" : void 0,
-      className: (0, import_design_system24.cn)("w-full", nested && "pl-9")
+      className: "w-full"
     }
   );
 }