@ai-matrx/vault 0.1.35 → 0.1.37

package/dist/index.cjs

@@ -179,7 +179,7 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/VaultApp.tsx
-var import_react42 = require("react");
+var import_react43 = require("react");
 var import_design_system25 = require("@ai-matrx/design-system");
 var import_controls35 = require("@ai-matrx/design-system/controls");
 var import_confirm_opener14 = require("@ai-matrx/kit/confirm-opener");
@@ -1362,11 +1362,11 @@ function whenInDay(iso, now = /* @__PURE__ */ new Date()) {
   if (dayKey(d) === dayKey(now)) return (0, import_format.formatRelativeTime)(iso, { now: now.getTime() });
   return d.toLocaleTimeString(void 0, { hour: "numeric", minute: "2-digit" });
 }
-function collapseRuns(rows, keyOf) {
+function collapseRuns(rows, keyOf2) {
   const out = [];
   const at = /* @__PURE__ */ new Map();
   for (const row of rows) {
-    const k = keyOf(row);
+    const k = keyOf2(row);
     const seen = at.get(k);
     if (seen) seen.times += 1;
     else {
@@ -1774,14 +1774,12 @@ function CodeButton({ live, digits, size = "md", label }) {
       disabled: !live.code,
       onClick: () => live.code && void copy(live.code),
       "aria-label": live.code ? `Copy ${label} code` : `Getting ${label} code`,
+      ...live.code ? { tooltip: "Copy code" } : {},
       variant: "quiet",
       layout: "row",
-      title: "Copy code",
-      end: /* @__PURE__ */ (0, import_jsx_runtime9.jsxs)("span", { className: (0, import_design_system8.cn)("inline-flex shrink-0 items-center", size === "lg" ? "gap-4" : "gap-3"), children: [
-        /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: (0, import_design_system8.cn)("whitespace-nowrap font-mono font-medium tabular-nums tracking-[0.08em]", size === "lg" ? "text-2xl" : "text-[1.0625rem]", live.code ? "text-foreground" : "text-disabled-foreground"), children: shown }),
-        copied ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "inline-flex size-6 items-center justify-center text-success", role: "status", "aria-label": "Copied", children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CheckGlyph, { className: "size-4" }) }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CountdownRing, { remaining: live.remaining, period: live.period, loading: !live.code })
-      ] }),
-      className: "max-w-full shrink-0"
+      fit: true,
+      title: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: (0, import_design_system8.cn)("whitespace-nowrap font-mono font-medium tabular-nums tracking-[0.08em]", size === "lg" ? "text-2xl" : "text-[1.0625rem]", live.code ? "text-foreground" : "text-disabled-foreground"), children: shown }),
+      end: copied ? /* @__PURE__ */ (0, import_jsx_runtime9.jsx)("span", { className: "inline-flex size-6 items-center justify-center text-success", role: "status", "aria-label": "Copied", children: /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CheckGlyph, { className: "size-4" }) }) : /* @__PURE__ */ (0, import_jsx_runtime9.jsx)(CountdownRing, { remaining: live.remaining, period: live.period, loading: !live.code })
     }
   );
 }
@@ -1891,6 +1889,14 @@ function canDecodeQrLocally() {
 function hasCamera() {
   return typeof navigator !== "undefined" && typeof navigator.mediaDevices?.getUserMedia === "function";
 }
+async function hasCameraDevice() {
+  if (!hasCamera() || typeof navigator.mediaDevices?.enumerateDevices !== "function") return false;
+  try {
+    return (await navigator.mediaDevices.enumerateDevices()).some((d) => d.kind === "videoinput");
+  } catch {
+    return false;
+  }
+}
 async function decodeQr(source) {
   return (0, import_qr.decodeQrFromElement)(source);
 }
@@ -1922,17 +1928,15 @@ function useCanScan() {
   }, []);
   return ok;
 }
-function QrScanPanel({ open, onResult, onClose }) {
+function QrScanInline({ onResult, onClose }) {
   const video = (0, import_react10.useRef)(null);
   const [error, setError] = (0, import_react10.useState)(null);
   const done = (0, import_react10.useRef)(onResult);
   done.current = onResult;
   (0, import_react10.useEffect)(() => {
-    if (!open) return;
     let stream = null;
     let live = true;
     let timer2 = null;
-    setError(null);
     const stop = () => {
       if (timer2) clearTimeout(timer2);
       stream?.getTracks().forEach((t) => t.stop());
@@ -1975,13 +1979,26 @@ function QrScanPanel({ open, onResult, onClose }) {
       live = false;
       stop();
     };
-  }, [open]);
-  return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Panel, { title: "Scan QR code", open, onClose, size: "sm", footer: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls6.Button, { variant: "quiet", onClick: onClose, children: "Cancel" }), children: [
-    /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "relative mx-auto aspect-square w-full max-w-sm overflow-hidden rounded-xl bg-muted", children: [
+  }, []);
+  if (error) {
+    return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("p", { className: "flex items-center gap-2 px-1 pt-1 text-xs text-muted-foreground", role: "status", "data-camera-note": "", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(CameraGlyph, { className: "size-3.5 shrink-0", "aria-hidden": true }),
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("span", { className: "min-w-0 flex-1 truncate", children: [
+        error,
+        " Paste the setup key or choose a QR image."
+      ] }),
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls6.Button, { variant: "quiet", onClick: onClose, children: "Dismiss" })
+    ] });
+  }
+  return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "flex flex-col items-center gap-1.5 pt-2", role: "region", "aria-label": "Scan QR code", "data-camera-preview": "", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "relative aspect-square w-full max-w-56 overflow-hidden rounded-xl bg-muted", children: [
       /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("video", { ref: video, className: "size-full object-cover", playsInline: true, muted: true, "aria-label": "Camera" }),
-      error ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "absolute inset-0 flex items-center justify-center p-6 text-center text-sm text-destructive", children: error }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "pointer-events-none absolute inset-[18%] rounded-lg border-2 border-primary", "aria-hidden": true })
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("div", { className: "pointer-events-none absolute inset-[18%] rounded-lg border-2 border-primary", "aria-hidden": true })
     ] }),
-    /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("p", { className: "text-center text-xs text-muted-foreground", children: "Point at the site's QR code" })
+    /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)("div", { className: "flex items-center gap-2", children: [
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("span", { className: "text-xs text-muted-foreground", children: "Point at the site's QR code" }),
+      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_controls6.Button, { variant: "quiet", onClick: onClose, children: "Stop camera" })
+    ] })
   ] });
 }
 function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "Paste setup key or otpauth link", disabled = false, autoFocus = false, onImage, onRecognized, status, autoStartCamera = false }) {
@@ -1991,8 +2008,15 @@ function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "
   const autoStarted = (0, import_react10.useRef)(false);
   (0, import_react10.useEffect)(() => {
     if (!autoStartCamera || !canScan || disabled || autoStarted.current || value) return;
-    autoStarted.current = true;
-    setScanning(true);
+    let live = true;
+    void hasCameraDevice().then((has) => {
+      if (!live || !has || autoStarted.current) return;
+      autoStarted.current = true;
+      setScanning(true);
+    });
+    return () => {
+      live = false;
+    };
   }, [autoStartCamera, canScan, disabled, value]);
   const [reading, setReading] = (0, import_react10.useState)(false);
   const [imageError, setImageError] = (0, import_react10.useState)(null);
@@ -2094,10 +2118,9 @@ function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = "
             ]
           }
         ),
-        canScan ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
-          QrScanPanel,
+        canScan && scanning ? /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+          QrScanInline,
           {
-            open: scanning,
             onClose: () => setScanning(false),
             onResult: (text) => {
               setScanning(false);
@@ -2583,7 +2606,7 @@ function OtpListRow({ port, item, family, entry, onOpen, onOpenInNewTab, onRenam
   const canManage = item.capabilities.canManage || item.capabilities.canEdit;
   if (a.removed) return null;
   const sub = a.error ?? [entry?.account, loginSiteOf(item) || entry?.issuer].filter((v, i, all) => Boolean(v) && all.indexOf(v) === i).join(" \xB7 ");
-  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-3 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
+  return /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-1 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
     /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(
       import_controls9.Button,
       {
@@ -2604,6 +2627,7 @@ function OtpListRow({ port, item, family, entry, onOpen, onOpenInNewTab, onRenam
         onClick: onOpen,
         title: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: a.enabled ? "text-foreground" : "text-muted-foreground", children: item.name }),
         line: sub ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: a.error ? "text-destructive" : "text-muted-foreground", title: sub, children: sub }) : void 0,
+        oneLine: true,
         className: "min-w-0"
       }
     ),
@@ -3207,14 +3231,58 @@ function createVaultKnobs(client, address) {
 }
 var REVEAL_SECONDS_KNOB = "desktop.vault.reveal_hide_seconds";
 var BACKUP_PASSPHRASE_MIN_KNOB = "desktop.vault.backup_passphrase_min_length";
+var ORGANIZATION_SEARCH_AT_KNOB = "vault.organization_search_at";
+var ORGANIZATION_SEARCH_AT_UNREAD = 8;
 function positiveKnob(resolved, key) {
   const v = resolved[key];
   const n = typeof v === "string" && v.trim() !== "" ? Number(v) : v;
   return typeof n === "number" && Number.isFinite(n) && n > 0 ? Math.floor(n) : null;
 }
 
-// src/lock.ts
+// src/organizations.ts
+var import_record_id_format = require("@ai-matrx/design-system/record-id-format");
+function orderOrganizations(orgs, items, recentItemIds) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const i of items) if (i.owner.organizationId) counts.set(i.owner.organizationId, (counts.get(i.owner.organizationId) ?? 0) + 1);
+  const byId = new Map(items.map((i) => [i.id, i]));
+  const recent = /* @__PURE__ */ new Map();
+  for (const id of recentItemIds ?? []) {
+    const org = byId.get(id)?.owner.organizationId;
+    if (org && !recent.has(org)) recent.set(org, recent.size);
+  }
+  const group = (o) => recent.has(o.id) ? 0 : (counts.get(o.id) ?? 0) > 0 ? 1 : 2;
+  return [...orgs].sort((a, b) => group(a) - group(b) || (recent.get(a.id) ?? 0) - (recent.get(b.id) ?? 0) || a.name.localeCompare(b.name, void 0, { sensitivity: "base" }) || a.id.localeCompare(b.id));
+}
+function organizationHints(orgs) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const o of orgs) seen.set(o.name.trim().toLowerCase(), (seen.get(o.name.trim().toLowerCase()) ?? 0) + 1);
+  return new Map(orgs.filter((o) => (seen.get(o.name.trim().toLowerCase()) ?? 0) > 1).map((o) => [o.id, (0, import_record_id_format.shortUuid)(o.id)]));
+}
+
+// src/shown-until-move.ts
 var import_react16 = require("react");
+var keyOf = (loc) => `${String(loc.vault)}|${loc.view}|${loc.itemId ?? ""}|${loc.mode}|${loc.panel ?? ""}|${loc.kind ?? ""}`;
+function useShownUntilMove(loc) {
+  const [shown, setShown] = (0, import_react16.useState)(null);
+  const home = (0, import_react16.useRef)(null);
+  const key = keyOf(loc);
+  (0, import_react16.useEffect)(() => {
+    if (!shown) {
+      home.current = null;
+      return;
+    }
+    if (home.current?.id !== shown.id) home.current = { id: shown.id, key: null };
+    if (home.current.key === null) {
+      if (loc.itemId === shown.id && loc.mode === "view") home.current.key = key;
+      return;
+    }
+    if (key !== home.current.key) setShown(null);
+  }, [shown, key, loc.itemId, loc.mode]);
+  return [shown, setShown];
+}
+
+// src/lock.ts
+var import_react17 = require("react");
 var LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
 var VaultLockedError = class extends Error {
   code = "vault_locked";
@@ -3249,12 +3317,12 @@ function guardPort(port, locked) {
 var NEVER = () => () => void 0;
 var UNLOCKED = () => false;
 function useLocked(lock) {
-  return (0, import_react16.useSyncExternalStore)(lock ? lock.subscribe : NEVER, lock ? () => lock.locked() : UNLOCKED, UNLOCKED);
+  return (0, import_react17.useSyncExternalStore)(lock ? lock.subscribe : NEVER, lock ? () => lock.locked() : UNLOCKED, UNLOCKED);
 }
 
 // src/io/BackupPanel.tsx
 var import_format6 = require("@ai-matrx/kit/format");
-var import_react18 = require("react");
+var import_react19 = require("react");
 var import_controls13 = require("@ai-matrx/design-system/controls");
 var import_download = require("@ai-matrx/kit/download");
 var import_confirm_opener4 = require("@ai-matrx/kit/confirm-opener");
@@ -3347,7 +3415,7 @@ function startNewRestoreRun(preview) {
 }
 
 // src/io/lines.tsx
-var import_react17 = require("react");
+var import_react18 = require("react");
 var import_design_system12 = require("@ai-matrx/design-system");
 var import_controls12 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime16 = require("react/jsx-runtime");
@@ -3360,7 +3428,7 @@ function PickLine({ checked, onChange, disabled = false, title, detail, badge, t
   ] });
 }
 function Windowed({ items, size = 150, render }) {
-  const [all, setAll] = (0, import_react17.useState)(false);
+  const [all, setAll] = (0, import_react18.useState)(false);
   const shown = all ? items : items.slice(0, size);
   return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)(import_jsx_runtime16.Fragment, { children: [
     shown.map(render),
@@ -3371,7 +3439,7 @@ function Windowed({ items, size = 150, render }) {
   ] });
 }
 function More({ title = "More", children }) {
-  const [open, setOpen] = (0, import_react17.useState)(false);
+  const [open, setOpen] = (0, import_react18.useState)(false);
   return /* @__PURE__ */ (0, import_jsx_runtime16.jsxs)("div", { className: "flex flex-col gap-2", children: [
     /* @__PURE__ */ (0, import_jsx_runtime16.jsx)(import_controls12.DisclosureHeader, { open, title, onClick: () => setOpen((o) => !o) }),
     open ? children : null
@@ -3411,21 +3479,21 @@ function Omissions({ omissions, accepted, onAccepted, verb }) {
 function BackupPanel({ port, host, items, onClose, onChanged }) {
   const minLength = passphraseMinimum(host.backupPassphraseMinLength);
   const confirmed = useConfirmed();
-  const fileInput = (0, import_react18.useRef)(null);
-  const abort = (0, import_react18.useRef)(null);
-  const [mode, setMode] = (0, import_react18.useState)("backup");
-  const [busy, setBusy] = (0, import_react18.useState)(false);
-  const [error, setError] = (0, import_react18.useState)(null);
-  const [passphrase, setPassphrase] = (0, import_react18.useState)("");
-  const [repeat, setRepeat] = (0, import_react18.useState)("");
-  const [accepted, setAccepted] = (0, import_react18.useState)(false);
-  const [selected, setSelected] = (0, import_react18.useState)(/* @__PURE__ */ new Set());
-  const [backup, setBackup] = (0, import_react18.useState)(null);
-  const [file, setFile] = (0, import_react18.useState)(null);
-  const [restorePreview, setRestorePreview] = (0, import_react18.useState)(null);
-  const [runId, setRunId] = (0, import_react18.useState)(null);
-  const [result, setResult] = (0, import_react18.useState)(null);
-  (0, import_react18.useEffect)(() => () => abort.current?.abort(), []);
+  const fileInput = (0, import_react19.useRef)(null);
+  const abort = (0, import_react19.useRef)(null);
+  const [mode, setMode] = (0, import_react19.useState)("backup");
+  const [busy, setBusy] = (0, import_react19.useState)(false);
+  const [error, setError] = (0, import_react19.useState)(null);
+  const [passphrase, setPassphrase] = (0, import_react19.useState)("");
+  const [repeat, setRepeat] = (0, import_react19.useState)("");
+  const [accepted, setAccepted] = (0, import_react19.useState)(false);
+  const [selected, setSelected] = (0, import_react19.useState)(/* @__PURE__ */ new Set());
+  const [backup, setBackup] = (0, import_react19.useState)(null);
+  const [file, setFile] = (0, import_react19.useState)(null);
+  const [restorePreview, setRestorePreview] = (0, import_react19.useState)(null);
+  const [runId, setRunId] = (0, import_react19.useState)(null);
+  const [result, setResult] = (0, import_react19.useState)(null);
+  (0, import_react19.useEffect)(() => () => abort.current?.abort(), []);
   const switchMode = (next) => {
     abort.current?.abort();
     setMode(next);
@@ -3562,7 +3630,7 @@ function BackupPanel({ port, host, items, onClose, onChanged }) {
         /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Summary, { value: backup }),
         /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(Omissions, { omissions: backup.omissions, accepted, onAccepted: setAccepted, verb: "Back up" }),
         /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)(VaultSection, { children: [
-          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Passphrase", hint: minLength ? `At least ${minLength} characters. Not saved.` : "Not saved. It can't be recovered.", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", "aria-invalid": short || void 0, onChange: (e) => setPassphrase(e.target.value) }) }),
+          /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(VaultRow, { label: "Passphrase", hint: minLength ? `At least ${minLength} characters. Not saved. It can't be recovered.` : "Not saved. It can't be recovered.", children: /* @__PURE__ */ (0, import_jsx_runtime17.jsx)(import_controls13.Field, { type: "password", value: passphrase, autoComplete: "new-password", "aria-label": "Backup passphrase", "aria-invalid": short || void 0, onChange: (e) => setPassphrase(e.target.value) }) }),
           short ? /* @__PURE__ */ (0, import_jsx_runtime17.jsxs)("p", { role: "alert", className: "px-1 text-xs text-destructive", "data-passphrase-too-short": "", children: [
             "Use at least ",
             minLength,
@@ -3610,7 +3678,7 @@ function tooShort(passphrase, minLength) {
 }
 
 // src/io/ExportPanel.tsx
-var import_react19 = require("react");
+var import_react20 = require("react");
 var import_controls14 = require("@ai-matrx/design-system/controls");
 var import_download2 = require("@ai-matrx/kit/download");
 var import_confirm_opener5 = require("@ai-matrx/kit/confirm-opener");
@@ -3634,12 +3702,12 @@ function omissionText2(omissions) {
 }
 function ExportPanel({ port, items, onClose }) {
   const confirmed = useConfirmed();
-  const logins = (0, import_react19.useMemo)(() => items.filter((i) => i.definitionKey === WEBSITE_LOGIN), [items]);
-  const [profile, setProfile] = (0, import_react19.useState)("matrx_login_csv_v1");
-  const [selected, setSelected] = (0, import_react19.useState)(/* @__PURE__ */ new Set());
-  const [preview, setPreview] = (0, import_react19.useState)(null);
-  const [busy, setBusy] = (0, import_react19.useState)(false);
-  const [error, setError] = (0, import_react19.useState)(null);
+  const logins = (0, import_react20.useMemo)(() => items.filter((i) => i.definitionKey === WEBSITE_LOGIN), [items]);
+  const [profile, setProfile] = (0, import_react20.useState)("matrx_login_csv_v1");
+  const [selected, setSelected] = (0, import_react20.useState)(/* @__PURE__ */ new Set());
+  const [preview, setPreview] = (0, import_react20.useState)(null);
+  const [busy, setBusy] = (0, import_react20.useState)(false);
+  const [error, setError] = (0, import_react20.useState)(null);
   const format = FORMATS.find((f) => f.value === profile);
   const reasons = new Map(preview?.items.map((p) => [p.item_id, p]) ?? []);
   const eligible = preview?.items.filter((p) => p.eligible).length ?? 0;
@@ -3764,7 +3832,7 @@ function ExportPanel({ port, items, onClose }) {
 }
 
 // src/io/ImportPanel.tsx
-var import_react20 = require("react");
+var import_react21 = require("react");
 var import_controls15 = require("@ai-matrx/design-system/controls");
 
 // src/io/csv-import.ts
@@ -4626,25 +4694,25 @@ var STATE_BADGE = {
 var ME = "me";
 function ImportPanel({ port, host, items, definitions, organizations, onClose, onChanged, limits }) {
   const confirmed = useConfirmed();
-  const [otpFor, setOtpFor] = (0, import_react20.useState)(null);
-  const fileInput = (0, import_react20.useRef)(null);
-  const abort = (0, import_react20.useRef)(null);
-  const stop = (0, import_react20.useRef)(false);
-  const keys = (0, import_react20.useRef)(/* @__PURE__ */ new Map());
-  const [source, setSource] = (0, import_react20.useState)("auto");
-  const [envText, setEnvText] = (0, import_react20.useState)("");
-  const [injectSandbox, setInjectSandbox] = (0, import_react20.useState)(false);
-  const [fileName, setFileName] = (0, import_react20.useState)(null);
-  const [reading, setReading] = (0, import_react20.useState)(false);
-  const [draft, setDraft] = (0, import_react20.useState)(null);
-  const [destination, setDestination] = (0, import_react20.useState)(ME);
-  const [browserFill, setBrowserFill] = (0, import_react20.useState)(false);
-  const [approvedVisible, setApprovedVisible] = (0, import_react20.useState)(false);
-  const [selected, setSelected] = (0, import_react20.useState)(/* @__PURE__ */ new Set());
-  const [running, setRunning] = (0, import_react20.useState)(null);
-  const [done, setDone] = (0, import_react20.useState)(null);
-  const [error, setError] = (0, import_react20.useState)(null);
-  (0, import_react20.useEffect)(
+  const [otpFor, setOtpFor] = (0, import_react21.useState)(null);
+  const fileInput = (0, import_react21.useRef)(null);
+  const abort = (0, import_react21.useRef)(null);
+  const stop = (0, import_react21.useRef)(false);
+  const keys = (0, import_react21.useRef)(/* @__PURE__ */ new Map());
+  const [source, setSource] = (0, import_react21.useState)("auto");
+  const [envText, setEnvText] = (0, import_react21.useState)("");
+  const [injectSandbox, setInjectSandbox] = (0, import_react21.useState)(false);
+  const [fileName, setFileName] = (0, import_react21.useState)(null);
+  const [reading, setReading] = (0, import_react21.useState)(false);
+  const [draft, setDraft] = (0, import_react21.useState)(null);
+  const [destination, setDestination] = (0, import_react21.useState)(ME);
+  const [browserFill, setBrowserFill] = (0, import_react21.useState)(false);
+  const [approvedVisible, setApprovedVisible] = (0, import_react21.useState)(false);
+  const [selected, setSelected] = (0, import_react21.useState)(/* @__PURE__ */ new Set());
+  const [running, setRunning] = (0, import_react21.useState)(null);
+  const [done, setDone] = (0, import_react21.useState)(null);
+  const [error, setError] = (0, import_react21.useState)(null);
+  (0, import_react21.useEffect)(
     () => () => {
       abort.current?.abort();
       stop.current = true;
@@ -4653,9 +4721,9 @@ function ImportPanel({ port, host, items, definitions, organizations, onClose, o
   );
   const organizationId = destination === ME ? null : destination;
   const existingIn = (org) => items.filter((i) => org === null ? i.owner.kind === "me" : i.owner.organizationId === org).map((i) => ({ displayName: i.name, loginUrls: i.loginUrls }));
-  const existing = (0, import_react20.useMemo)(() => existingIn(organizationId), [items, organizationId]);
-  const destinationOptions = (0, import_react20.useMemo)(() => [{ value: ME, label: "Personal" }, ...organizations.map((o) => ({ value: o.id, label: o.name }))], [organizations]);
-  const lines = (0, import_react20.useMemo)(
+  const existing = (0, import_react21.useMemo)(() => existingIn(organizationId), [items, organizationId]);
+  const destinationOptions = (0, import_react21.useMemo)(() => [{ value: ME, label: "Personal" }, ...organizations.map((o) => ({ value: o.id, label: o.name }))], [organizations]);
+  const lines = (0, import_react21.useMemo)(
     () => draft?.kind === "file" ? reviewLines(draft.parsed, { organizationId, browserFill, existing, limits, mapping: draft.mapping }) : [],
     [draft, organizationId, browserFill, existing, limits]
   );
@@ -4931,14 +4999,14 @@ function Notices({ draft }) {
 }
 
 // src/ItemList.tsx
-var import_react29 = require("react");
+var import_react30 = require("react");
 var import_design_system19 = require("@ai-matrx/design-system");
 var import_design_system20 = require("@ai-matrx/design-system");
 var import_controls23 = require("@ai-matrx/design-system/controls");
 var import_icons12 = require("@ai-matrx/design-system/icons");
 
 // src/ItemPane.tsx
-var import_react28 = require("react");
+var import_react29 = require("react");
 var import_design_system17 = require("@ai-matrx/design-system");
 var import_design_system18 = require("@ai-matrx/design-system");
 var import_controls22 = require("@ai-matrx/design-system/controls");
@@ -4946,7 +5014,7 @@ var import_confirm_opener10 = require("@ai-matrx/kit/confirm-opener");
 
 // src/activity/FilesSection.tsx
 var import_format7 = require("@ai-matrx/kit/format");
-var import_react21 = require("react");
+var import_react22 = require("react");
 var import_controls16 = require("@ai-matrx/design-system/controls");
 var import_design_system13 = require("@ai-matrx/design-system");
 var import_confirm_opener6 = require("@ai-matrx/kit/confirm-opener");
@@ -4964,11 +5032,11 @@ function FilesSection({ item, port, editing, onChanged }) {
   const confirmed = useConfirmed();
   const canEdit = editing && item.capabilities.canEdit;
   const canAdd = item.capabilities.canEdit;
-  const [busy, setBusy] = (0, import_react21.useState)(null);
-  const [error, setError] = (0, import_react21.useState)(null);
-  const [pending, setPending] = (0, import_react21.useState)(null);
-  const [dragging, setDragging] = (0, import_react21.useState)(false);
-  const picker = (0, import_react21.useRef)(null);
+  const [busy, setBusy] = (0, import_react22.useState)(null);
+  const [error, setError] = (0, import_react22.useState)(null);
+  const [pending, setPending] = (0, import_react22.useState)(null);
+  const [dragging, setDragging] = (0, import_react22.useState)(false);
+  const picker = (0, import_react22.useRef)(null);
   if (!canAdd && item.attachments.length === 0) return null;
   async function run(key, work, fallback) {
     setBusy(key);
@@ -5045,8 +5113,8 @@ function FilesSection({ item, port, editing, onChanged }) {
   );
 }
 function EditableFile({ port, item: it, file: a, busy: b, run: go, onDownload, onTooBig }) {
-  const [open, setOpen] = (0, import_react21.useState)(false);
-  const replacer = (0, import_react21.useRef)(null);
+  const [open, setOpen] = (0, import_react22.useState)(false);
+  const replacer = (0, import_react22.useRef)(null);
   async function remove() {
     const yes = await (0, import_confirm_opener6.confirm)({ title: `Delete ${a.label}?`, description: "The encrypted file is removed from this item.", confirmLabel: "Delete", variant: "destructive" });
     if (yes) await go(`delete:${a.id}`, () => port.activity.deleteFile(it, a.id), "The file could not be deleted.");
@@ -5104,9 +5172,9 @@ function Protection({ value, locked, onChange }) {
   );
 }
 function NewFile({ file, busy, onAdd, onCancel }) {
-  const [label, setLabel] = (0, import_react21.useState)(file.name);
-  const [description, setDescription] = (0, import_react21.useState)("");
-  const [handling, setHandling] = (0, import_react21.useState)("revealable");
+  const [label, setLabel] = (0, import_react22.useState)(file.name);
+  const [description, setDescription] = (0, import_react22.useState)("");
+  const [handling, setHandling] = (0, import_react22.useState)("revealable");
   async function add() {
     if (handling === "sealed" && !await confirmSeal(label)) return;
     await onAdd({ label: label.trim(), description: description.trim() || null, handling });
@@ -5126,10 +5194,10 @@ function NewFile({ file, busy, onAdd, onCancel }) {
   ] });
 }
 function FileDetailsRows({ file, busy, onSave, onCancel }) {
-  const [label, setLabel] = (0, import_react21.useState)(file.label);
-  const [description, setDescription] = (0, import_react21.useState)(file.description);
-  const [fileName, setFileName] = (0, import_react21.useState)(file.fileName);
-  const [handling, setHandling] = (0, import_react21.useState)(file.handling);
+  const [label, setLabel] = (0, import_react22.useState)(file.label);
+  const [description, setDescription] = (0, import_react22.useState)(file.description);
+  const [fileName, setFileName] = (0, import_react22.useState)(file.fileName);
+  const [handling, setHandling] = (0, import_react22.useState)(file.handling);
   const changed = label !== file.label || description !== file.description || fileName !== file.fileName || handling !== file.handling;
   async function save() {
     if (handling === "sealed" && file.handling !== "sealed" && !await confirmSeal(label)) return;
@@ -5155,10 +5223,10 @@ function confirmSeal(label) {
   });
 }
 function DraftFilesSection({ files, onFiles }) {
-  const [pending, setPending] = (0, import_react21.useState)(null);
-  const [error, setError] = (0, import_react21.useState)(null);
-  const [dragging, setDragging] = (0, import_react21.useState)(false);
-  const picker = (0, import_react21.useRef)(null);
+  const [pending, setPending] = (0, import_react22.useState)(null);
+  const [error, setError] = (0, import_react22.useState)(null);
+  const [dragging, setDragging] = (0, import_react22.useState)(false);
+  const picker = (0, import_react22.useRef)(null);
   const choose = (file) => {
     if (!file) return;
     if (fileTooBig(file.size)) return setError(TOO_BIG);
@@ -5207,7 +5275,7 @@ function DraftFilesSection({ files, onFiles }) {
 }
 
 // src/fields/RecoveryCodesRow.tsx
-var import_react22 = require("react");
+var import_react23 = require("react");
 var import_controls17 = require("@ai-matrx/design-system/controls");
 var import_icons9 = require("@ai-matrx/design-system/icons");
 var import_jsx_runtime21 = require("react/jsx-runtime");
@@ -5217,9 +5285,9 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
   const confirmed = useConfirmed();
   const copyValue2 = useCopy();
   const secret = useTransientSecret();
-  const [busy, setBusy] = (0, import_react22.useState)(false);
-  const [error, setError] = (0, import_react22.useState)(null);
-  const [draft, setDraft] = (0, import_react22.useState)(null);
+  const [busy, setBusy] = (0, import_react23.useState)(false);
+  const [error, setError] = (0, import_react23.useState)(null);
+  const [draft, setDraft] = (0, import_react23.useState)(null);
   const canEdit = item.capabilities.canEdit;
   const run = async (step) => {
     setBusy(true);
@@ -5314,7 +5382,7 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
 }
 
 // src/fields/DraftRows.tsx
-var import_react23 = require("react");
+var import_react24 = require("react");
 var import_controls18 = require("@ai-matrx/design-system/controls");
 var import_design_system14 = require("@ai-matrx/design-system");
 var import_confirm_opener7 = require("@ai-matrx/kit/confirm-opener");
@@ -5369,7 +5437,7 @@ function FieldSettingsRows({ name, value, defaultHandling = "revealable", onChan
 var hasSecretSettings = (s) => saysMore(s, "revealable");
 var hasDeclaredSettings = (s, defaultHandling) => Boolean(s && saysMore(s, defaultHandling));
 function SecretBuilderRow({ field, onChange, onRemove }) {
-  const [open, setOpen] = (0, import_react23.useState)(hasSecretSettings(field));
+  const [open, setOpen] = (0, import_react24.useState)(hasSecretSettings(field));
   const handling = field.handling ?? "revealable";
   const name = field.label.trim() || "Secret";
   return /* @__PURE__ */ (0, import_jsx_runtime22.jsxs)(import_jsx_runtime22.Fragment, { children: [
@@ -5610,7 +5678,7 @@ function targetLabel(t) {
 }
 
 // src/extension/UseOnSiteButton.tsx
-var import_react24 = require("react");
+var import_react25 = require("react");
 var import_controls19 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime23 = require("react/jsx-runtime");
 function canUseOnSite(item, pageUrl) {
@@ -5618,7 +5686,7 @@ function canUseOnSite(item, pageUrl) {
 }
 function UseOnSiteButton({ port, item, pageUrl, onChanged }) {
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react24.useState)(false);
+  const [busy, setBusy] = (0, import_react25.useState)(false);
   if (!canUseOnSite(item, pageUrl)) return null;
   const site = pageSite(pageUrl);
   const run = async () => {
@@ -5637,7 +5705,7 @@ function UseOnSiteButton({ port, item, pageUrl, onChanged }) {
 }
 
 // src/sharing/SharePanel.tsx
-var import_react27 = require("react");
+var import_react28 = require("react");
 var import_confirm_opener9 = require("@ai-matrx/kit/confirm-opener");
 var import_controls21 = require("@ai-matrx/design-system/controls");
 var import_design_system16 = require("@ai-matrx/design-system");
@@ -5660,14 +5728,17 @@ function isEmail(value) {
 }
 var PERSONAL = "personal";
 var destinationOf = (key) => key === PERSONAL ? null : key;
+var orgChoice = (o, hints) => ({ value: o.id, label: o.name, ...hints.has(o.id) ? { hint: hints.get(o.id) } : {} });
 function moveDestinations(item, orgs) {
   if (item.owner.kind === "shared") return [];
   const here = item.owner.organizationId;
-  return [...here ? [{ value: PERSONAL, label: "Personal" }] : [], ...orgs.filter((o) => o.id !== here).map((o) => ({ value: o.id, label: o.name }))];
+  const hints = organizationHints(orgs);
+  return [...here ? [{ value: PERSONAL, label: "Personal" }] : [], ...orgs.filter((o) => o.id !== here).map((o) => orgChoice(o, hints))];
 }
 function copyDestinations(orgs, item) {
   const here = item ? item.owner.kind === "me" ? PERSONAL : item.owner.organizationId : void 0;
-  return [{ value: PERSONAL, label: "Personal" }, ...orgs.map((o) => ({ value: o.id, label: o.name }))].filter((d) => d.value !== here);
+  const hints = organizationHints(orgs);
+  return [{ value: PERSONAL, label: "Personal" }, ...orgs.map((o) => orgChoice(o, hints))].filter((d) => d.value !== here);
 }
 function copyRefusal(message2) {
   return /duplicate/i.test(message2) ? "There is already a copy of this item there." : null;
@@ -5695,7 +5766,7 @@ function shareSummary(grants) {
 var MEMBER_CHOICE_DEFAULT = "default";
 
 // src/sharing/parts.tsx
-var import_react25 = require("react");
+var import_react26 = require("react");
 var import_design_system15 = require("@ai-matrx/design-system");
 var import_jsx_runtime24 = require("react/jsx-runtime");
 var message = (e, fallback) => {
@@ -5704,9 +5775,9 @@ var message = (e, fallback) => {
 };
 function useConfirmedChange() {
   const confirmed = useConfirmed();
-  const [busy, setBusy] = (0, import_react25.useState)(null);
-  const [error, setError] = (0, import_react25.useState)(null);
-  const [notice, setNotice] = (0, import_react25.useState)(null);
+  const [busy, setBusy] = (0, import_react26.useState)(null);
+  const [error, setError] = (0, import_react26.useState)(null);
+  const [notice, setNotice] = (0, import_react26.useState)(null);
   async function run(key, fn, done) {
     setBusy(key);
     setError(null);
@@ -5740,18 +5811,20 @@ function StatusLine({ error, notice }) {
 }
 
 // src/sharing/MovePanel.tsx
-var import_react26 = require("react");
+var import_react27 = require("react");
 var import_confirm_opener8 = require("@ai-matrx/kit/confirm-opener");
 var import_controls20 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime25 = require("react/jsx-runtime");
 var NONE = "__none__";
-function MovePanel({ item, port, organizations, onClose, onChanged }) {
+function MovePanel({ item, port, host, organizations, onClose, onChanged, onOpenItem }) {
   const { busy, error, notice, run, setNotice } = useConfirmedChange();
   const moves = moveDestinations(item, organizations);
   const copies = copyDestinations(organizations, item);
-  const [moveTo, setMoveTo] = (0, import_react26.useState)("");
-  const [copyTo, setCopyTo] = (0, import_react26.useState)("");
-  const [email, setEmail] = (0, import_react26.useState)("");
+  const [moveTo, setMoveTo] = (0, import_react27.useState)("");
+  const [copyTo, setCopyTo] = (0, import_react27.useState)("");
+  const [email, setEmail] = (0, import_react27.useState)("");
+  const [made, setMade] = (0, import_react27.useState)(null);
+  const searchAt = host.organizationSearchAt ?? ORGANIZATION_SEARCH_AT_UNREAD;
   const passkey = isPasskey(item);
   const canMove = item.capabilities.canManage && !passkey && moves.length > 0;
   const canGive = item.capabilities.canManage && item.owner.kind === "me" && !passkey;
@@ -5785,8 +5858,10 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
   };
   const copy = async () => {
     if (!copyChoice) return;
-    const made = await run("copy", () => port.sharing.copy(item, destinationOf(copyChoice.value)), `Copy made in ${copyChoice.label}`);
-    if (made) onChanged();
+    const copied = await run("copy", () => port.sharing.copy(item, destinationOf(copyChoice.value)), `Copy made in ${copyChoice.label}`);
+    if (!copied) return;
+    setMade(copied);
+    onChanged();
   };
   const nothing = !canMove && !canGive && !canCopy;
   return /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(
@@ -5795,7 +5870,10 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
       title: "Move or copy",
       size: "md",
       onClose,
-      footer: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(PanelFooter, { status: error || notice ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(StatusLine, { error, notice }) : null, children: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Button, { variant: "primary", onClick: onClose, children: "Done" }) }),
+      footer: /* @__PURE__ */ (0, import_jsx_runtime25.jsxs)(PanelFooter, { status: error || notice ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(StatusLine, { error, notice }) : null, children: [
+        made && onOpenItem ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Button, { variant: "outline", onClick: () => onOpenItem(made), children: "Open copy" }) : null,
+        /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Button, { variant: "primary", onClick: onClose, children: "Done" })
+      ] }),
       children: nothing ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(VaultSection, { children: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(Empty, { children: passkey ? "A passkey stays where it was created." : "Only the owner can move or give this item." }) }) : /* @__PURE__ */ (0, import_jsx_runtime25.jsxs)(VaultSection, { children: [
         canMove && moves.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(
           VaultRow,
@@ -5803,7 +5881,7 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
             label: "Move to",
             hint: moveChoice ? itemMoveConsequence(item, destinationOf(moveChoice.value)) : void 0,
             actions: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Button, { variant: "outline", disabled: busy !== null || !moveChoice, onClick: () => void move(), children: "Move" }),
-            children: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Select, { className: "w-full", "aria-label": "Move to", value: moveTo || NONE, onValueChange: (v) => setMoveTo(v === NONE ? "" : v), options: [{ value: NONE, label: "Choose where" }, ...moves] })
+            children: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Select, { className: "w-full", "aria-label": "Move to", searchAt, value: moveTo || NONE, onValueChange: (v) => setMoveTo(v === NONE ? "" : v), options: [{ value: NONE, label: "Choose where" }, ...moves] })
           }
         ) : null,
         canGive ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(VaultRow, { label: "Give to", hint: "You lose all access; your shares end", actions: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Button, { variant: "danger", disabled: busy !== null || !isEmail(email), onClick: () => void give(), children: "Give" }), children: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(
@@ -5820,7 +5898,7 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
             onChange: (e) => setEmail(e.target.value)
           }
         ) }) : null,
-        canCopy && copies.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(VaultRow, { label: "Copy to", hint: "A separate item; edits no longer sync", actions: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Button, { variant: "outline", disabled: busy !== null || !copyChoice, onClick: () => void copy(), children: "Copy" }), children: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Select, { className: "w-full", "aria-label": "Copy to", value: copyTo || NONE, onValueChange: (v) => setCopyTo(v === NONE ? "" : v), options: [{ value: NONE, label: "Choose where" }, ...copies] }) }) : null
+        canCopy && copies.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(VaultRow, { label: "Copy to", hint: "A separate item; edits no longer sync", actions: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Button, { variant: "outline", disabled: busy !== null || !copyChoice, onClick: () => void copy(), children: "Copy" }), children: /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(import_controls20.Select, { className: "w-full", "aria-label": "Copy to", searchAt, value: copyTo || NONE, onValueChange: (v) => setCopyTo(v === NONE ? "" : v), options: [{ value: NONE, label: "Choose where" }, ...copies] }) }) : null
       ] })
     }
   );
@@ -5829,11 +5907,11 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
 // src/sharing/SharePanel.tsx
 var import_jsx_runtime26 = require("react/jsx-runtime");
 function useGrants(port, item) {
-  const [grants, setGrants] = (0, import_react27.useState)(null);
-  const [loadError, setLoadError] = (0, import_react27.useState)(null);
-  const [nonce, setNonce] = (0, import_react27.useState)(0);
+  const [grants, setGrants] = (0, import_react28.useState)(null);
+  const [loadError, setLoadError] = (0, import_react28.useState)(null);
+  const [nonce, setNonce] = (0, import_react28.useState)(0);
   const allowed = item.capabilities.canManage;
-  (0, import_react27.useEffect)(() => {
+  (0, import_react28.useEffect)(() => {
     if (!allowed) return;
     let live = true;
     setLoadError(null);
@@ -5850,9 +5928,9 @@ function useGrants(port, item) {
 function SharePanel({ item, port, organizations, onClose, onChanged }) {
   const { grants, setGrants, loadError, reload } = useGrants(port, item);
   const { busy, error, notice, run } = useConfirmedChange();
-  const [email, setEmail] = (0, import_react27.useState)("");
-  const [level, setLevel] = (0, import_react27.useState)("use");
-  const [more, setMore] = (0, import_react27.useState)(false);
+  const [email, setEmail] = (0, import_react28.useState)("");
+  const [level, setLevel] = (0, import_react28.useState)("use");
+  const [more, setMore] = (0, import_react28.useState)(false);
   const isOrg = item.owner.kind === "organization" && item.owner.organizationId !== null;
   const orgName = item.owner.label;
   const people = (grants ?? []).filter((g) => g.kind === "person");
@@ -5971,8 +6049,8 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
 function IntoOrganization({ item, port, organizations, grants, onShared }) {
   const { busy, error, notice, run } = useConfirmedChange();
   const open = organizations.filter((o) => !grants.some((g) => g.organizationId === o.id));
-  const [target, setTarget] = (0, import_react27.useState)("");
-  const [level, setLevel] = (0, import_react27.useState)("use");
+  const [target, setTarget] = (0, import_react28.useState)("");
+  const [level, setLevel] = (0, import_react28.useState)("use");
   const chosen = open.find((o) => o.id === target);
   if (item.owner.kind !== "me") return null;
   return /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(VaultSection, { title: "Share into organization", children: open.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime26.jsxs)(import_jsx_runtime26.Fragment, { children: [
@@ -6007,10 +6085,10 @@ var CHOICES = [
   { value: "editor", label: "Can edit", meta: "See and change" }
 ];
 function MemberAccess({ port, organizationId, organizationName }) {
-  const [list, setList] = (0, import_react27.useState)(null);
-  const [loadError, setLoadError] = (0, import_react27.useState)(null);
+  const [list, setList] = (0, import_react28.useState)(null);
+  const [loadError, setLoadError] = (0, import_react28.useState)(null);
   const { busy, error, run } = useConfirmedChange();
-  (0, import_react27.useEffect)(() => {
+  (0, import_react28.useEffect)(() => {
     let live = true;
     port.sharing.memberAccess(organizationId).then(
       (l) => live && setList(l),
@@ -6042,9 +6120,9 @@ function MemberAccess({ port, organizationId, organizationName }) {
   ] });
 }
 function SharingSummary({ item, port, className }) {
-  const [text, setText] = (0, import_react27.useState)("");
+  const [text, setText] = (0, import_react28.useState)("");
   const allowed = item.capabilities.canManage;
-  (0, import_react27.useEffect)(() => {
+  (0, import_react28.useEffect)(() => {
     if (!allowed) return;
     let live = true;
     port.sharing.grants(item).then(
@@ -6075,8 +6153,8 @@ function ItemPane(props) {
   const editing = mode !== "view";
   const seedName = seed?.name ?? "";
   const seedUrl = seed?.url ?? "";
-  const [loaded, setLoaded] = (0, import_react28.useState)({});
-  const base = (0, import_react28.useMemo)(() => {
+  const [loaded, setLoaded] = (0, import_react29.useState)({});
+  const base = (0, import_react29.useMemo)(() => {
     const b = draftOf(item);
     if (!item) {
       b.name = seedName;
@@ -6085,28 +6163,28 @@ function ItemPane(props) {
     b.values = { ...loaded };
     return b;
   }, [item, seedName, seedUrl, loaded]);
-  const [draft, setDraft] = (0, import_react28.useState)(base);
-  const [tagsText, setTagsText] = (0, import_react28.useState)(base.tags.join(", "));
-  const [showTags, setShowTags] = (0, import_react28.useState)(false);
-  const [showDescription, setShowDescription] = (0, import_react28.useState)(false);
-  const [showRecovery, setShowRecovery] = (0, import_react28.useState)(false);
-  const [settingUpOtp, setSettingUpOtp] = (0, import_react28.useState)(false);
-  const [owner, setOwner] = (0, import_react28.useState)(defaultOwner ?? "me");
-  const [recipient, setRecipient] = (0, import_react28.useState)("");
-  const [generatePrivately, setGeneratePrivately] = (0, import_react28.useState)(false);
-  const [busy, setBusy] = (0, import_react28.useState)(false);
-  const [sent, setSent] = (0, import_react28.useState)(null);
-  const [queuedFiles, setQueuedFiles] = (0, import_react28.useState)([]);
-  const [showBrowser, setShowBrowser] = (0, import_react28.useState)(false);
-  const [error, setError] = (0, import_react28.useState)(null);
-  const [destinations, setDestinations] = (0, import_react28.useState)({});
-  const [savedNew, setSavedNew] = (0, import_react28.useState)(false);
+  const [draft, setDraft] = (0, import_react29.useState)(base);
+  const [tagsText, setTagsText] = (0, import_react29.useState)(base.tags.join(", "));
+  const [showTags, setShowTags] = (0, import_react29.useState)(false);
+  const [showDescription, setShowDescription] = (0, import_react29.useState)(false);
+  const [showRecovery, setShowRecovery] = (0, import_react29.useState)(false);
+  const [settingUpOtp, setSettingUpOtp] = (0, import_react29.useState)(false);
+  const [owner, setOwner] = (0, import_react29.useState)(defaultOwner ?? "me");
+  const [recipient, setRecipient] = (0, import_react29.useState)("");
+  const [generatePrivately, setGeneratePrivately] = (0, import_react29.useState)(false);
+  const [busy, setBusy] = (0, import_react29.useState)(false);
+  const [sent, setSent] = (0, import_react29.useState)(null);
+  const [queuedFiles, setQueuedFiles] = (0, import_react29.useState)([]);
+  const [showBrowser, setShowBrowser] = (0, import_react29.useState)(false);
+  const [error, setError] = (0, import_react29.useState)(null);
+  const [destinations, setDestinations] = (0, import_react29.useState)({});
+  const [savedNew, setSavedNew] = (0, import_react29.useState)(false);
   const dirty = editing && !savedNew && isDirty(base, draft);
   const declared = definition?.fields ?? [];
-  const prev = (0, import_react28.useRef)(null);
-  const paneRef = (0, import_react28.useRef)(null);
+  const prev = (0, import_react29.useRef)(null);
+  const paneRef = (0, import_react29.useRef)(null);
   const room = useRoomOf(paneRef);
-  (0, import_react28.useEffect)(() => {
+  (0, import_react29.useEffect)(() => {
     const was = prev.current;
     const id = item?.id ?? null;
     if (was && was.id === id && was.mode === mode && editing) {
@@ -6119,22 +6197,22 @@ function ItemPane(props) {
     }
     prev.current = { base, id, mode };
   }, [base, mode, item?.id, editing]);
-  (0, import_react28.useEffect)(() => {
+  (0, import_react29.useEffect)(() => {
     setLoaded({});
     setShowTags(false);
     setShowDescription(false);
     setShowRecovery(false);
     setSavedNew(false);
   }, [item?.id, mode]);
-  const onDirtyRef = (0, import_react28.useRef)(onDirty);
+  const onDirtyRef = (0, import_react29.useRef)(onDirty);
   onDirtyRef.current = onDirty;
-  (0, import_react28.useEffect)(() => onDirtyRef.current(dirty), [dirty]);
+  (0, import_react29.useEffect)(() => onDirtyRef.current(dirty), [dirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
-  (0, import_react28.useEffect)(() => {
+  (0, import_react29.useEffect)(() => {
     if (editing && dirty) (0, import_drafts.keepDraft)(keepKey, keptFieldsOf(draft), { basedOn: item?.updatedAt ?? "new" });
     else if (!editing) (0, import_drafts.dropKeptDraft)(keepKey);
   }, [editing, dirty, draft, keepKey, item?.updatedAt]);
-  (0, import_react28.useEffect)(() => {
+  (0, import_react29.useEffect)(() => {
     if (!editing || !item) return;
     let live = true;
     for (const f of item.fields) {
@@ -6259,7 +6337,7 @@ function ItemPane(props) {
   const turnOnOne = canTurnOn ? (f) => () => turnOn([f]) : () => void 0;
   const declaredKeys = new Set(declared.map((f) => f.key));
   const hasSecureNote = declaredKeys.has(SECURE_NOTE_KEY) || Boolean(item?.fields.some((f) => f.key === SECURE_NOTE_KEY)) || draft.secrets.some((x) => x.key === SECURE_NOTE_KEY);
-  const [settingsToggled, setSettingsToggled] = (0, import_react28.useState)(/* @__PURE__ */ new Set());
+  const [settingsToggled, setSettingsToggled] = (0, import_react29.useState)(/* @__PURE__ */ new Set());
   const settingsOpen = (f) => settingsToggled.has(f.key) !== (definition?.key === ENV_VALUE_KEY || hasDeclaredSettings(draft.fieldSettings?.[f.key], f.handling));
   const toggleSettings = (key) => setSettingsToggled((cur) => {
     const next = new Set(cur);
@@ -6414,7 +6492,7 @@ function ItemPane(props) {
           const hidden = existing && existing.handling !== "visible" && !(f.key in loaded);
           const newSecret = mode === "new" && f.storage === "encrypted" && owner !== "person";
           const open = newSecret && settingsOpen(f);
-          return /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_react28.Fragment, { children: [
+          return /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)(import_react29.Fragment, { children: [
             /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(
               EditRow,
               {
@@ -6636,8 +6714,8 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
   const ordered = [...pinned, ...rest];
-  const listRef = (0, import_react29.useRef)(null);
-  (0, import_react29.useEffect)(() => {
+  const listRef = (0, import_react30.useRef)(null);
+  (0, import_react30.useEffect)(() => {
     if (selectedId) listRef.current?.querySelector(`[data-item="${selectedId}"]`)?.scrollIntoView({ block: "nearest" });
   }, [selectedId, items.length]);
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -6700,8 +6778,8 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react29.useState)(false);
-  const [menuOpen, setMenuOpen] = (0, import_react29.useState)(false);
+  const [busy, setBusy] = (0, import_react30.useState)(false);
+  const [menuOpen, setMenuOpen] = (0, import_react30.useState)(false);
   const canUse = item.capabilities.canUse;
   const user = canUse ? item.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed" && f.active !== false) : void 0;
   const secret = canUse && item.capabilities.canReveal ? item.fields.find((f) => f.key === "password" && f.handling === "revealable" && f.active !== false) : void 0;
@@ -6740,7 +6818,7 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
     ...manageEntries(item, onAction),
     ...hostEntries.map((h) => ({ ...h, kind: h.kind ?? "host" }))
   ];
-  const entriesRef = (0, import_react29.useRef)(entries);
+  const entriesRef = (0, import_react30.useRef)(entries);
   entriesRef.current = entries;
   const glyphOf = (e) => e.id === "copy:username" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(UserGlyph, { className: "size-4" }) : e.id === "copy:password" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, { className: "size-4" }) : e.id === "copy:code" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ClockGlyph, { className: "size-4" }) : e.kind === "favorite" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(StarGlyph, { className: (0, import_design_system20.cn)("size-4", favorite?.on && "fill-current text-warning") }) : e.kind === "open" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ChevronRightGlyph, { className: "size-4" }) : e.kind === "host" || e.kind === "manage" ? null : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_icons12.CopyIcon, { className: "size-4" });
   const menuItem = (e) => /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenuItem, { disabled: e.disabled ?? false, onSelect: e.onSelect, children: [
@@ -6763,21 +6841,25 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
           {
             type: "button",
             "aria-current": on ? "true" : void 0,
-            "data-surface": on ? "primary" : void 0,
+            selected: on,
+            selectedStyle: "primary",
             onClick: () => onSelect(item.id),
             layout: "row",
             variant: "quiet",
+            endInset: "control",
+            oneLine: true,
             icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
             title: item.name,
             line: subtitleOf(item, withOwner),
-            className: "w-full pr-10"
+            className: "w-full"
           }
         ),
         /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: "absolute right-1.5 top-1/2 flex -translate-y-1/2 items-center gap-0.5", "data-surface": on ? "primary" : void 0, children: [
-          user || secret || favorite ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: (0, import_design_system20.cn)("hidden items-center gap-0.5 rounded-md pl-2 [@media(hover:hover)]:group-hover:flex [@media(hover:hover)]:group-focus-within:flex", on ? "bg-primary" : "bg-accent"), "data-row-quick": "", children: [
+          user || secret || code || favorite ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { className: (0, import_design_system20.cn)("hidden items-center gap-0.5 rounded-md pl-2 [@media(hover:hover)]:group-hover:flex [@media(hover:hover)]:group-focus-within:flex", on ? "bg-primary" : "bg-accent"), "data-row-quick": "", children: [
             favorite ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(StarGlyph, { className: favorite.on ? "fill-current text-warning" : "" }), "aria-label": favorite.on ? "Remove from favorites" : "Add to favorites", "aria-pressed": favorite.on, onClick: favorite.toggle }) : null,
             user ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(UserGlyph, {}), "aria-label": `Copy ${user.label}`, disabled: busy, onClick: copyUser }) : null,
-            secret ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, {}), "aria-label": "Copy password", disabled: busy, onClick: copyPassword }) : null
+            secret ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(KeyGlyph, {}), "aria-label": "Copy password", disabled: busy, onClick: copyPassword }) : null,
+            code ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(ClockGlyph, {}), "aria-label": "Copy one-time code", disabled: busy, onClick: copyCode }) : null
           ] }) : null,
           /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(import_design_system19.DropdownMenu, { open: menuOpen, onOpenChange: setMenuOpen, children: [
             /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_design_system19.DropdownMenuTrigger, { asChild: true, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(
@@ -6818,7 +6900,7 @@ function manageEntries(item, onAction) {
 }
 
 // src/lists/TrashView.tsx
-var import_react31 = require("react");
+var import_react32 = require("react");
 var import_controls25 = require("@ai-matrx/design-system/controls");
 var import_format9 = require("@ai-matrx/kit/format");
 
@@ -6892,7 +6974,7 @@ function refusalText(reason) {
 }
 
 // src/lists/RestorePanel.tsx
-var import_react30 = require("react");
+var import_react31 = require("react");
 var import_controls24 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime29 = require("react/jsx-runtime");
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
@@ -6903,13 +6985,13 @@ function RestorePanel({
   turnOn,
   onClose
 }) {
-  const [preview, setPreview] = (0, import_react30.useState)(null);
-  const [restored, setRestored] = (0, import_react30.useState)(null);
-  const [turnedOn, setTurnedOn] = (0, import_react30.useState)(null);
-  const [error, setError] = (0, import_react30.useState)(null);
-  const [busy, setBusy] = (0, import_react30.useState)(false);
-  const [loading, setLoading] = (0, import_react30.useState)(Boolean(lists.preview));
-  (0, import_react30.useEffect)(() => {
+  const [preview, setPreview] = (0, import_react31.useState)(null);
+  const [restored, setRestored] = (0, import_react31.useState)(null);
+  const [turnedOn, setTurnedOn] = (0, import_react31.useState)(null);
+  const [error, setError] = (0, import_react31.useState)(null);
+  const [busy, setBusy] = (0, import_react31.useState)(false);
+  const [loading, setLoading] = (0, import_react31.useState)(Boolean(lists.preview));
+  (0, import_react31.useEffect)(() => {
     if (!lists.preview) return;
     let live = true;
     lists.preview(item).then(
@@ -7013,10 +7095,10 @@ function trashLineOf(item) {
 }
 function TrashView({ port, deleted, query, header, onChanged }) {
   const confirmed = useConfirmed();
-  const [busyId, setBusyId] = (0, import_react31.useState)(null);
-  const [message2, setMessage] = (0, import_react31.useState)(null);
+  const [busyId, setBusyId] = (0, import_react32.useState)(null);
+  const [message2, setMessage] = (0, import_react32.useState)(null);
   const shown = deleted.filter((i) => trashItemMatchesQuery(i, query));
-  const [restoring, setRestoring] = (0, import_react31.useState)(null);
+  const [restoring, setRestoring] = (0, import_react32.useState)(null);
   const restore = async (item, deletionId) => {
     setBusyId(item.id);
     setMessage(null);
@@ -7064,15 +7146,15 @@ function TrashView({ port, deleted, query, header, onChanged }) {
 }
 
 // src/NewItemFlow.tsx
-var import_react32 = require("react");
+var import_react33 = require("react");
 var import_controls26 = require("@ai-matrx/design-system/controls");
 var import_icons13 = require("@ai-matrx/design-system/icons");
 var import_jsx_runtime31 = require("react/jsx-runtime");
 function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
-  const [search, setSearch] = (0, import_react32.useState)("");
-  const guess = (0, import_react32.useMemo)(() => inferFromUrl(url, definitions), [url, definitions]);
+  const [search, setSearch] = (0, import_react33.useState)("");
+  const guess = (0, import_react33.useMemo)(() => inferFromUrl(url, definitions), [url, definitions]);
   const common = COMMON_DEFINITION_KEYS.map((k) => definitions.find((d) => d.key === k)).filter((d) => d !== void 0);
-  const matches = (0, import_react32.useMemo)(() => {
+  const matches = (0, import_react33.useMemo)(() => {
     const q = search.trim().toLowerCase();
     if (!q) return [];
     return definitions.filter((d) => `${d.label} ${d.key} ${d.providerKey ?? ""} ${FAMILY_LABELS[d.family] ?? ""}`.toLowerCase().includes(q)).slice(0, 60);
@@ -7143,7 +7225,7 @@ function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
 }
 
 // src/sharing/SecureLinkPanel.tsx
-var import_react33 = require("react");
+var import_react34 = require("react");
 var import_confirm_opener11 = require("@ai-matrx/kit/confirm-opener");
 var import_design_system21 = require("@ai-matrx/design-system");
 var import_controls27 = require("@ai-matrx/design-system/controls");
@@ -7226,20 +7308,20 @@ var import_jsx_runtime32 = require("react/jsx-runtime");
 function SecureLinkPanel({ item, port, onClose }) {
   const sharing = port.sharing;
   const { busy, error, notice, run, setNotice } = useConfirmedChange();
-  const [remedy, setRemedy] = (0, import_react33.useState)(null);
-  const [options, setOptions] = (0, import_react33.useState)(null);
-  const [optionsError, setOptionsError] = (0, import_react33.useState)(null);
-  const [sent, setSent] = (0, import_react33.useState)(null);
-  const [sentError, setSentError] = (0, import_react33.useState)(null);
-  const [nonce, setNonce] = (0, import_react33.useState)(0);
-  const [email, setEmail] = (0, import_react33.useState)("");
-  const [phone, setPhone] = (0, import_react33.useState)("");
-  const [name, setName] = (0, import_react33.useState)("");
-  const [linkBy, setLinkBy] = (0, import_react33.useState)("email");
-  const [fields, setFields] = (0, import_react33.useState)([]);
-  const [note, setNote] = (0, import_react33.useState)("");
-  const [sameChannelSent, setSameChannelSent] = (0, import_react33.useState)(false);
-  (0, import_react33.useEffect)(() => {
+  const [remedy, setRemedy] = (0, import_react34.useState)(null);
+  const [options, setOptions] = (0, import_react34.useState)(null);
+  const [optionsError, setOptionsError] = (0, import_react34.useState)(null);
+  const [sent, setSent] = (0, import_react34.useState)(null);
+  const [sentError, setSentError] = (0, import_react34.useState)(null);
+  const [nonce, setNonce] = (0, import_react34.useState)(0);
+  const [email, setEmail] = (0, import_react34.useState)("");
+  const [phone, setPhone] = (0, import_react34.useState)("");
+  const [name, setName] = (0, import_react34.useState)("");
+  const [linkBy, setLinkBy] = (0, import_react34.useState)("email");
+  const [fields, setFields] = (0, import_react34.useState)([]);
+  const [note, setNote] = (0, import_react34.useState)("");
+  const [sameChannelSent, setSameChannelSent] = (0, import_react34.useState)(false);
+  (0, import_react34.useEffect)(() => {
     let live = true;
     setOptionsError(null);
     sharing.secureLinkOptions(item).then(
@@ -7254,7 +7336,7 @@ function SecureLinkPanel({ item, port, onClose }) {
       live = false;
     };
   }, [sharing, item]);
-  (0, import_react33.useEffect)(() => {
+  (0, import_react34.useEffect)(() => {
     const list = sharing.sentSecureLinks;
     if (!list) return;
     let live = true;
@@ -7267,9 +7349,9 @@ function SecureLinkPanel({ item, port, onClose }) {
       live = false;
     };
   }, [sharing, item, nonce]);
-  const [phoneTyped, setPhoneTyped] = (0, import_react33.useState)(false);
-  const prefilled = (0, import_react33.useRef)(false);
-  (0, import_react33.useEffect)(() => {
+  const [phoneTyped, setPhoneTyped] = (0, import_react34.useState)(false);
+  const prefilled = (0, import_react34.useRef)(false);
+  (0, import_react34.useEffect)(() => {
     const lookup = sharing.phoneOnFile;
     if (!lookup || phoneTyped) return;
     const clear = () => {
@@ -7422,7 +7504,7 @@ function sentMeta(row, options) {
 }
 
 // src/devices/DevicesPanel.tsx
-var import_react34 = require("react");
+var import_react35 = require("react");
 var import_confirm_opener12 = require("@ai-matrx/kit/confirm-opener");
 var import_controls28 = require("@ai-matrx/design-system/controls");
 var import_format12 = require("@ai-matrx/kit/format");
@@ -7513,10 +7595,10 @@ function ErrorLine2({ text }) {
 function DevicesPanel({ port, onClose }) {
   const confirmed = useConfirmed();
   const notify = useNotify();
-  const [devices, setDevices] = (0, import_react34.useState)(null);
-  const [error, setError] = (0, import_react34.useState)(null);
-  const [busyId, setBusyId] = (0, import_react34.useState)(null);
-  const load = (0, import_react34.useCallback)(async () => {
+  const [devices, setDevices] = (0, import_react35.useState)(null);
+  const [error, setError] = (0, import_react35.useState)(null);
+  const [busyId, setBusyId] = (0, import_react35.useState)(null);
+  const load = (0, import_react35.useCallback)(async () => {
     setError(null);
     try {
       setDevices(await port.devices.list());
@@ -7524,7 +7606,7 @@ function DevicesPanel({ port, onClose }) {
       setError(messageOf3(e, "Your browsers could not be read."));
     }
   }, [port]);
-  (0, import_react34.useEffect)(() => {
+  (0, import_react35.useEffect)(() => {
     void load();
   }, [load]);
   const revoke = async (device) => {
@@ -7582,11 +7664,11 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
   const where = isMac ? "the Mac app" : "the extension";
   const passkeys = port.devices.passkeys;
   const here = passkeys?.available() ?? false;
-  const [methods, setMethods] = (0, import_react34.useState)(null);
-  const [busy, setBusy] = (0, import_react34.useState)(null);
-  const [error, setError] = (0, import_react34.useState)(null);
-  const [approvedUntil, setApprovedUntil] = (0, import_react34.useState)(null);
-  const load = (0, import_react34.useCallback)(async () => {
+  const [methods, setMethods] = (0, import_react35.useState)(null);
+  const [busy, setBusy] = (0, import_react35.useState)(null);
+  const [error, setError] = (0, import_react35.useState)(null);
+  const [approvedUntil, setApprovedUntil] = (0, import_react35.useState)(null);
+  const load = (0, import_react35.useCallback)(async () => {
     setError(null);
     try {
       setMethods(await port.devices.stepUpMethods());
@@ -7594,7 +7676,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
       setError(messageOf3(e, "Your account could not be checked."));
     }
   }, [port]);
-  (0, import_react34.useEffect)(() => {
+  (0, import_react35.useEffect)(() => {
     if (key && here) void load();
   }, [key, here, load]);
   const approve = async () => {
@@ -7682,7 +7764,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
 }
 
 // src/native/NativeImportPanel.tsx
-var import_react36 = require("react");
+var import_react37 = require("react");
 var import_confirm_opener13 = require("@ai-matrx/kit/confirm-opener");
 var import_controls29 = require("@ai-matrx/design-system/controls");
 
@@ -7745,19 +7827,19 @@ async function loadFullPreview(bridge, operationId, current) {
 }
 
 // src/native/use-native-import.ts
-var import_react35 = require("react");
+var import_react36 = require("react");
 var fail = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 var RESTART = "Your account changed. The import was stopped; start it again.";
 function useNativeImport(bridge, stillAllowed, onImported) {
-  const [screen, setScreen] = (0, import_react35.useState)({ kind: "idle", message: null });
-  const [busy, setBusy] = (0, import_react35.useState)(false);
-  const generation = (0, import_react35.useRef)(0);
-  const mounted = (0, import_react35.useRef)(false);
-  const op = (0, import_react35.useRef)(null);
-  const last = (0, import_react35.useRef)(null);
-  const timer2 = (0, import_react35.useRef)(null);
-  const polls = (0, import_react35.useRef)(0);
-  const refreshRef = (0, import_react35.useRef)(async () => void 0);
+  const [screen, setScreen] = (0, import_react36.useState)({ kind: "idle", message: null });
+  const [busy, setBusy] = (0, import_react36.useState)(false);
+  const generation = (0, import_react36.useRef)(0);
+  const mounted = (0, import_react36.useRef)(false);
+  const op = (0, import_react36.useRef)(null);
+  const last = (0, import_react36.useRef)(null);
+  const timer2 = (0, import_react36.useRef)(null);
+  const polls = (0, import_react36.useRef)(0);
+  const refreshRef = (0, import_react36.useRef)(async () => void 0);
   const current = (g) => mounted.current && g === generation.current;
   const stopPolling = () => {
     if (timer2.current !== null) clearTimeout(timer2.current);
@@ -7926,9 +8008,9 @@ function useNativeImport(bridge, stillAllowed, onImported) {
     setBusy(false);
     setScreen({ kind: "idle", message: null });
   };
-  const invalidateRef = (0, import_react35.useRef)(invalidate);
+  const invalidateRef = (0, import_react36.useRef)(invalidate);
   invalidateRef.current = invalidate;
-  (0, import_react35.useEffect)(() => {
+  (0, import_react36.useEffect)(() => {
     mounted.current = true;
     const off = bridge.subscribe?.(() => {
       if (op.current) invalidateRef.current(RESTART);
@@ -7960,14 +8042,14 @@ function NativeImportPanel({ bridge, readLimits, activeOrganizationId, organizat
   return /* @__PURE__ */ (0, import_jsx_runtime34.jsx)(Importer, { bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged });
 }
 function Importer({ bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged }) {
-  const options = (0, import_react36.useMemo)(() => organizations.map((o) => ({ value: o.id, label: o.name })), [organizations]);
-  const [organizationId, setOrganizationId] = (0, import_react36.useState)(() => organizations.some((o) => o.id === activeOrganizationId) ? activeOrganizationId : organizations[0]?.id ?? "");
-  const [limits, setLimits] = (0, import_react36.useState)(null);
-  const [limitError, setLimitError] = (0, import_react36.useState)(null);
+  const options = (0, import_react37.useMemo)(() => organizations.map((o) => ({ value: o.id, label: o.name })), [organizations]);
+  const [organizationId, setOrganizationId] = (0, import_react37.useState)(() => organizations.some((o) => o.id === activeOrganizationId) ? activeOrganizationId : organizations[0]?.id ?? "");
+  const [limits, setLimits] = (0, import_react37.useState)(null);
+  const [limitError, setLimitError] = (0, import_react37.useState)(null);
   const flow = useNativeImport(bridge, (id) => organizations.some((o) => o.id === id), onChanged);
   const { screen, busy } = flow;
   const orgName = organizations.find((o) => o.id === organizationId)?.name ?? "this organization";
-  (0, import_react36.useEffect)(() => {
+  (0, import_react37.useEffect)(() => {
     if (!readLimits || !organizationId) return;
     let live = true;
     setLimits(null);
@@ -8028,21 +8110,21 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
 }
 
 // src/extension/PageView.tsx
-var import_react40 = require("react");
+var import_react41 = require("react");
 var import_design_system23 = require("@ai-matrx/design-system");
 var import_controls33 = require("@ai-matrx/design-system/controls");
 var import_icons15 = require("@ai-matrx/design-system/icons");
 
 // src/extension/CaptureCard.tsx
-var import_react37 = require("react");
+var import_react38 = require("react");
 var import_controls30 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime35 = require("react/jsx-runtime");
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
-  const prompt = (0, import_react37.useSyncExternalStore)(capture.subscribe, capture.get, capture.get);
+  const prompt = (0, import_react38.useSyncExternalStore)(capture.subscribe, capture.get, capture.get);
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react37.useState)(false);
-  const [q, setQ] = (0, import_react37.useState)("");
+  const [busy, setBusy] = (0, import_react38.useState)(false);
+  const [q, setQ] = (0, import_react38.useState)("");
   if (!prompt) return null;
   const decide = async (d) => {
     setBusy(true);
@@ -8098,15 +8180,15 @@ function CaptureCard({ capture, onChanged }) {
 }
 
 // src/extension/FillSetupCard.tsx
-var import_react38 = require("react");
+var import_react39 = require("react");
 var import_controls31 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime36 = require("react/jsx-runtime");
 function FillSetupCard({ fillSetup }) {
   const notify = useNotify();
-  const state = (0, import_react38.useSyncExternalStore)(fillSetup.subscribe, fillSetup.get, fillSetup.get);
-  const box = (0, import_react38.useRef)(null);
-  const [busy, setBusy] = (0, import_react38.useState)(false);
-  const [error, setError] = (0, import_react38.useState)(null);
+  const state = (0, import_react39.useSyncExternalStore)(fillSetup.subscribe, fillSetup.get, fillSetup.get);
+  const box = (0, import_react39.useRef)(null);
+  const [busy, setBusy] = (0, import_react39.useState)(false);
+  const [error, setError] = (0, import_react39.useState)(null);
   if (state.status !== "off") return null;
   const finish = async (run) => {
     setBusy(true);
@@ -8171,7 +8253,7 @@ function FillSetupCard({ fillSetup }) {
 }
 
 // src/extension/PageGenerator.tsx
-var import_react39 = require("react");
+var import_react40 = require("react");
 var import_design_system22 = require("@ai-matrx/design-system");
 var import_controls32 = require("@ai-matrx/design-system/controls");
 var import_icons14 = require("@ai-matrx/design-system/icons");
@@ -8181,10 +8263,10 @@ function PageGenerator({ fields }) {
   const limits = useGeneratorLimitsSource();
   const copy = useCopy();
   const held = useTransientSecret(HOLD_MS);
-  const [open, setOpen] = (0, import_react39.useState)(false);
-  const [busy, setBusy] = (0, import_react39.useState)(false);
-  const [targets, setTargets] = (0, import_react39.useState)([]);
-  const [said, setSaid] = (0, import_react39.useState)(null);
+  const [open, setOpen] = (0, import_react40.useState)(false);
+  const [busy, setBusy] = (0, import_react40.useState)(false);
+  const [targets, setTargets] = (0, import_react40.useState)([]);
+  const [said, setSaid] = (0, import_react40.useState)(null);
   if (!limits) return null;
   const say3 = setSaid;
   const put = async (targetId, value2) => {
@@ -8248,8 +8330,8 @@ function PageGenerator({ fields }) {
 // src/extension/PageView.tsx
 var import_jsx_runtime38 = require("react/jsx-runtime");
 function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, items, definitions, onOpen, onNewForPage, onBrowse, onChanged, header }) {
-  const [running, setRunning] = (0, import_react40.useState)(null);
-  const [said, setSaid] = (0, import_react40.useState)(null);
+  const [running, setRunning] = (0, import_react41.useState)(null);
+  const [said, setSaid] = (0, import_react41.useState)(null);
   const site = pageSite(page.url);
   const state = page.matchState ?? { status: "ready" };
   const fillable = new Set(page.fillableItemIds ?? page.matchingItemIds);
@@ -8258,8 +8340,8 @@ function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, ite
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
   const canSave = isFillablePage(page.url);
   const signIn = page.signIn;
-  const act = async (itemId, run, failed) => {
-    setRunning(itemId);
+  const act = async (itemId, action, run, failed) => {
+    setRunning({ itemId, action });
     setSaid(null);
     try {
       setSaid(await run());
@@ -8292,10 +8374,10 @@ function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, ite
         family: item ? familyOf2(item.definitionKey) : "generic",
         port,
         busy: running !== null,
-        running: running === itemId,
+        running: running?.itemId === itemId ? running.action : null,
         onOpen,
-        onFill: fill && !page.blocked && fillable.has(itemId) && item?.capabilities.canUse !== false ? () => void act(itemId, async () => FILL_WORDS[await fill(itemId)], FILL_WORDS.unavailable) : null,
-        onSignIn: signIn ? () => void act(itemId, async () => SIGN_IN_WORDS[await signIn(itemId)], SIGN_IN_WORDS.unknown) : null
+        onFill: fill && !page.blocked && fillable.has(itemId) && item?.capabilities.canUse !== false ? () => void act(itemId, "fill", async () => FILL_WORDS[await fill(itemId)], FILL_WORDS.unavailable) : null,
+        onSignIn: signIn ? () => void act(itemId, "signIn", async () => SIGN_IN_WORDS[await signIn(itemId)], SIGN_IN_WORDS.unknown) : null
       },
       itemId
     )) });
@@ -8333,7 +8415,7 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
-  const [reading, setReading] = (0, import_react40.useState)(false);
+  const [reading, setReading] = (0, import_react41.useState)(false);
   const usable = item?.capabilities.canUse ?? false;
   const user = usable ? item?.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed" && f.active) : void 0;
   const secret = usable && item?.capabilities.canReveal ? item?.fields.find((f) => f.key === "password" && f.handling === "revealable" && f.active) : void 0;
@@ -8362,8 +8444,8 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
         className: "min-w-0 flex-1"
       }
     ),
-    onFill ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "primary", disabled: busy, "aria-busy": running || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running ? "Filling\u2026" : "Fill" }) : null,
-    onSignIn ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: onFill ? "outline" : "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ShieldGlyph, {}), disabled: busy, onClick: onSignIn, "aria-label": `Sign me in with ${item?.name ?? "this login"}`, title: "Sign me in", children: "Sign me in" }) : null,
+    onFill ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "primary", disabled: busy, "aria-busy": running === "fill" || void 0, onClick: onFill, "aria-label": `Fill ${item?.name ?? "this login"}`, children: running === "fill" ? "Filling\u2026" : "Fill" }) : null,
+    onSignIn ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: onFill ? "outline" : "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ShieldGlyph, {}), disabled: busy, "aria-busy": running === "signIn" || void 0, onClick: onSignIn, "aria-label": `Sign me in with ${item?.name ?? "this login"}`, title: "Sign me in", children: running === "signIn" ? "Signing in\u2026" : "Sign me in" }) : null,
     user && item ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(UserGlyph, {}), "aria-label": `Copy ${user.label}`, title: `Copy ${user.label}`, disabled: reading, onClick: () => void read(user.label, () => port.reveal(item, user.key)) }) : null,
     secret && item ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(KeyGlyph, {}), "aria-label": "Copy password", title: "Copy password", disabled: reading, onClick: () => void read("Password", () => port.reveal(item, secret.key)) }) : null,
     otp ? /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(import_controls33.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(ClockGlyph, {}), "aria-label": "Copy one-time code", title: "Copy one-time code", disabled: reading, onClick: () => void read("One-time code", async () => (await port.authenticator.code(otp)).code) }) : null
@@ -8371,7 +8453,7 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
 }
 
 // src/Sidebar.tsx
-var import_react41 = require("react");
+var import_react42 = require("react");
 var import_design_system24 = require("@ai-matrx/design-system");
 var import_controls34 = require("@ai-matrx/design-system/controls");
 var import_icons16 = require("@ai-matrx/design-system/icons");
@@ -8380,6 +8462,7 @@ var AUTHENTICATOR_LABEL = "Authenticator";
 function vaultChoices(items, organizations, _current) {
   const n = (f) => items.filter(f).length;
   const shared = n((i) => i.owner.kind === "shared");
+  const hints = organizationHints(organizations);
   return [
     { value: "all", label: "All items", count: items.length },
     { value: "mine", label: "Personal", count: n((i) => i.owner.kind === "me") },
@@ -8387,11 +8470,11 @@ function vaultChoices(items, organizations, _current) {
     // Every organization the person belongs to, empty ones too: an empty vault opens on its own
     // "Nothing here yet" with New item, so the first credential can go there. (The organization
     // list carries no role, so who may add is the server's answer to the save, said in place.)
-    ...organizations.map((o) => ({ value: o.id, label: o.name, count: n((i) => i.owner.organizationId === o.id) }))
+    ...organizations.map((o) => ({ value: o.id, label: o.name, count: n((i) => i.owner.organizationId === o.id), ...hints.has(o.id) ? { hint: hints.get(o.id) } : {} }))
   ];
 }
-function VaultSelect({ value, choices, onChange }) {
-  return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_controls34.Select, { value, onValueChange: onChange, "aria-label": "Vault", options: choices.map((c) => ({ value: c.value, label: c.label, meta: String(c.count) })) });
+function VaultSelect({ value, choices, onChange, searchAt = ORGANIZATION_SEARCH_AT_UNREAD }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_controls34.Select, { value, onValueChange: onChange, "aria-label": "Vault", searchAt, options: choices.map((c) => ({ value: c.value, label: c.label, meta: String(c.count), ...c.hint ? { hint: c.hint } : {} })) });
 }
 var CATEGORY_GLYPHS = { logins: import_icons16.GlobeIcon, passkeys: ShieldGlyph, api: KeyGlyph, oauth: PlugGlyph, infra: DatabaseGlyph, env: TerminalGlyph, files: FileGlyph, other: NoteGlyph };
 var familyOf = (key, definitions) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -8455,12 +8538,14 @@ function viewOptions(views, allCount, deletedCount, hasFavorites, hasRecents, ha
   ];
 }
 function Entry({ on, glyph: Icon, label, count: count2, onClick, nested = false }) {
+  const desktop = (0, import_design_system24.useLook)() === "desktop";
   return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(
     import_controls34.Tile,
     {
       type: "button",
       "aria-current": on ? "page" : void 0,
       selected: on,
+      ...desktop ? { selectedStyle: "fill" } : {},
       onClick,
       layout: "row",
       variant: "quiet",
@@ -8468,8 +8553,9 @@ function Entry({ on, glyph: Icon, label, count: count2, onClick, nested = false
       icon: nested ? void 0 : /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Icon, { className: "size-4 shrink-0" }),
       title: label,
       ...count2 !== void 0 ? { end: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("span", { className: "text-xs tabular-nums text-muted-foreground", children: count2 }) } : {},
+      ...nested ? { level: 1 } : {},
       "data-nested": nested ? "" : void 0,
-      className: (0, import_design_system24.cn)("w-full", nested && "pl-9")
+      className: "w-full"
     }
   );
 }
@@ -8479,12 +8565,12 @@ function Group({ title, children }) {
     children
   ] });
 }
-function VaultSidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false, onLock, onOpenWeb }) {
-  const [tagsOpen, setTagsOpen] = (0, import_react41.useState)(view.startsWith("tag:"));
+function VaultSidebar({ vault, choices, onVault, organizationSearchAt, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false, onLock, onOpenWeb }) {
+  const [tagsOpen, setTagsOpen] = (0, import_react42.useState)(view.startsWith("tag:"));
   return /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("nav", { "aria-label": "Vault", className: "flex h-full min-h-0 flex-col border-r border-sidebar-border bg-sidebar-background text-sidebar-foreground", children: [
     /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("div", { className: "flex items-center gap-2 px-3 pb-2 pt-3", children: [
       /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(SafeGlyph, { className: "size-5 shrink-0 text-primary" }),
-      /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: "min-w-0 flex-1", children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(VaultSelect, { value: vault, choices, onChange: onVault }) })
+      /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: "min-w-0 flex-1", children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(VaultSelect, { value: vault, choices, onChange: onVault, searchAt: organizationSearchAt }) })
     ] }),
     /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("div", { className: "flex min-h-0 flex-1 flex-col gap-5 overflow-y-auto px-2 pb-3 pt-1", children: [
       /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("div", { className: "flex flex-col gap-0.5", children: [
@@ -8561,8 +8647,8 @@ var generatorLimitsFrom = (knobs) => knobs ? async () => {
 } : void 0;
 function ImportWithLimits(props) {
   const { knobs, ...rest } = props;
-  const [state, setState] = (0, import_react42.useState)(null);
-  (0, import_react42.useEffect)(() => {
+  const [state, setState] = (0, import_react43.useState)(null);
+  (0, import_react43.useEffect)(() => {
     if (!knobs) return setState({ error: "Import is not set up for this organization yet." });
     knobs().then(
       (r) => {
@@ -8582,18 +8668,18 @@ function VaultApp(given) {
   const props = { ...given, host: useOrganizationSettings(given.host ?? NO_HOST) };
   const lock = props.host?.lock;
   const locked = useLocked(lock);
-  const port = (0, import_react42.useMemo)(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
+  const port = (0, import_react43.useMemo)(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
   return /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(import_design_system25.LookScope, { look: props.look ?? "web", className: "h-full min-h-0 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(LockedScreen, { lock }) : /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(Workspace, { ...props, port }) }) }) }) }) }) }) });
 }
 function useOrganizationSettings(host) {
   const knobs = host.knobs;
-  const needs = knobs !== void 0 && (host.revealSeconds === void 0 || host.backupPassphraseMinLength === void 0);
-  const [read, setRead] = (0, import_react42.useState)(null);
-  (0, import_react42.useEffect)(() => {
+  const needs = knobs !== void 0 && (host.revealSeconds === void 0 || host.backupPassphraseMinLength === void 0 || host.organizationSearchAt === void 0);
+  const [read, setRead] = (0, import_react43.useState)(null);
+  (0, import_react43.useEffect)(() => {
     if (!needs || !knobs) return;
     let live = true;
     knobs().then(
-      (r) => live && setRead({ reveal: positiveKnob(r, REVEAL_SECONDS_KNOB), backupMin: positiveKnob(r, BACKUP_PASSPHRASE_MIN_KNOB) }),
+      (r) => live && setRead({ reveal: positiveKnob(r, REVEAL_SECONDS_KNOB), backupMin: positiveKnob(r, BACKUP_PASSPHRASE_MIN_KNOB), searchAt: positiveKnob(r, ORGANIZATION_SEARCH_AT_KNOB) }),
       () => void 0
     );
     return () => {
@@ -8604,19 +8690,20 @@ function useOrganizationSettings(host) {
   return {
     ...host,
     ...host.revealSeconds === void 0 && read.reveal !== null ? { revealSeconds: read.reveal } : {},
-    ...host.backupPassphraseMinLength === void 0 && read.backupMin !== null ? { backupPassphraseMinLength: read.backupMin } : {}
+    ...host.backupPassphraseMinLength === void 0 && read.backupMin !== null ? { backupPassphraseMinLength: read.backupMin } : {},
+    ...host.organizationSearchAt === void 0 && read.searchAt !== null ? { organizationSearchAt: read.searchAt } : {}
   };
 }
 var NO_STORE = () => () => void 0;
 var NOTHING = () => null;
 function useHostPrompts(capture, fillSetup) {
-  const prompt = (0, import_react42.useSyncExternalStore)(capture ? capture.subscribe : NO_STORE, capture ? capture.get : NOTHING, capture ? capture.get : NOTHING);
-  const setup = (0, import_react42.useSyncExternalStore)(fillSetup ? fillSetup.subscribe : NO_STORE, fillSetup ? fillSetup.get : NOTHING, fillSetup ? fillSetup.get : NOTHING);
+  const prompt = (0, import_react43.useSyncExternalStore)(capture ? capture.subscribe : NO_STORE, capture ? capture.get : NOTHING, capture ? capture.get : NOTHING);
+  const setup = (0, import_react43.useSyncExternalStore)(fillSetup ? fillSetup.subscribe : NO_STORE, fillSetup ? fillSetup.get : NOTHING, fillSetup ? fillSetup.get : NOTHING);
   return prompt !== null || setup?.status === "off";
 }
 function LockedScreen({ lock }) {
-  const [busy, setBusy] = (0, import_react42.useState)(false);
-  const [error, setError] = (0, import_react42.useState)(null);
+  const [busy, setBusy] = (0, import_react43.useState)(false);
+  const [error, setError] = (0, import_react43.useState)(null);
   const unlock = async () => {
     setBusy(true);
     setError(null);
@@ -8636,29 +8723,29 @@ function LockedScreen({ lock }) {
   ] });
 }
 function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocationChange, onInventory }) {
-  const rootRef = (0, import_react42.useRef)(null);
+  const rootRef = (0, import_react43.useRef)(null);
   const width = useElementWidth(rootRef);
   const mode = layout !== "auto" ? layout : width >= FULL_AT ? "full" : width >= SPLIT_AT ? "split" : "stack";
   const notify = useNotify();
-  const [snap, setSnap] = (0, import_react42.useState)(null);
-  const [items, setItems] = (0, import_react42.useState)([]);
-  const [deleted, setDeleted] = (0, import_react42.useState)([]);
-  const [favorites, setFavorites] = (0, import_react42.useState)(null);
-  const [recents, setRecents] = (0, import_react42.useState)(null);
-  const [error, setError] = (0, import_react42.useState)(null);
-  const [inner, setInner] = (0, import_react42.useState)(DEFAULT_LOCATION);
+  const [snap, setSnap] = (0, import_react43.useState)(null);
+  const [items, setItems] = (0, import_react43.useState)([]);
+  const [deleted, setDeleted] = (0, import_react43.useState)([]);
+  const [favorites, setFavorites] = (0, import_react43.useState)(null);
+  const [recents, setRecents] = (0, import_react43.useState)(null);
+  const [error, setError] = (0, import_react43.useState)(null);
+  const [inner, setInner] = (0, import_react43.useState)(DEFAULT_LOCATION);
   const loc = location ?? inner;
-  const dirty = (0, import_react42.useRef)(false);
-  const [notice, setNotice] = (0, import_react42.useState)(null);
-  const [firstCode, setFirstCode] = (0, import_react42.useState)(null);
-  const move = (0, import_react42.useCallback)(
+  const dirty = (0, import_react43.useRef)(false);
+  const [notice, setNotice] = (0, import_react43.useState)(null);
+  const [firstCode, setFirstCode] = useShownUntilMove(loc);
+  const move = (0, import_react43.useCallback)(
     (next, how) => {
       if (!location) setInner(next);
       onLocationChange?.(next, how);
     },
     [location, onLocationChange]
   );
-  const go = (0, import_react42.useCallback)(
+  const go = (0, import_react43.useCallback)(
     (patch, how = "push") => {
       const leaving = patch.itemId !== void 0 || patch.mode !== void 0 || patch.vault !== void 0 || patch.view !== void 0;
       const next = { ...loc, ...patch };
@@ -8677,9 +8764,9 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     },
     [loc, move]
   );
-  const keyState = (0, import_react42.useRef)({ loc, go });
+  const keyState = (0, import_react43.useRef)({ loc, go });
   keyState.current = { loc, go };
-  (0, import_react42.useEffect)(() => {
+  (0, import_react43.useEffect)(() => {
     const onKey = (e) => {
       if (e.defaultPrevented || e.metaKey || e.ctrlKey || e.altKey) return;
       const root = rootRef.current;
@@ -8701,8 +8788,8 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     document.addEventListener("keydown", onKey);
     return () => document.removeEventListener("keydown", onKey);
   }, []);
-  const keepSearchFocus = (0, import_react42.useRef)(false);
-  (0, import_react42.useEffect)(() => {
+  const keepSearchFocus = (0, import_react43.useRef)(false);
+  (0, import_react43.useEffect)(() => {
     if (!keepSearchFocus.current) return;
     keepSearchFocus.current = false;
     const search = rootRef.current?.querySelector('input[aria-label^="Search"]');
@@ -8711,14 +8798,14 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     search.setSelectionRange(search.value.length, search.value.length);
   }, [loc.q]);
   const hasPrompts = useHostPrompts(host.capture, host.fillSetup);
-  const knobsRef = (0, import_react42.useRef)(host.knobs);
+  const knobsRef = (0, import_react43.useRef)(host.knobs);
   knobsRef.current = host.knobs;
-  const [signedOut, setSignedOut] = (0, import_react42.useState)(false);
-  const [refreshError, setRefreshError] = (0, import_react42.useState)(null);
-  const [refreshing, setRefreshing] = (0, import_react42.useState)(false);
-  const loadedAt = (0, import_react42.useRef)(0);
-  const inFlight = (0, import_react42.useRef)(false);
-  const apply = (0, import_react42.useCallback)(
+  const [signedOut, setSignedOut] = (0, import_react43.useState)(false);
+  const [refreshError, setRefreshError] = (0, import_react43.useState)(null);
+  const [refreshing, setRefreshing] = (0, import_react43.useState)(false);
+  const loadedAt = (0, import_react43.useRef)(0);
+  const inFlight = (0, import_react43.useRef)(false);
+  const apply = (0, import_react43.useCallback)(
     (s) => {
       loadedAt.current = Date.now();
       setSnap(s);
@@ -8731,7 +8818,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     },
     [port]
   );
-  const refresh = (0, import_react42.useCallback)(() => {
+  const refresh = (0, import_react43.useCallback)(() => {
     if (inFlight.current) return;
     inFlight.current = true;
     setRefreshing(true);
@@ -8745,7 +8832,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     port.lists.favorites?.list().then((ids) => setFavorites(new Set(ids)), () => void 0);
     port.lists.recents?.list().then(setRecents, () => void 0);
   }, [port, apply]);
-  const load = (0, import_react42.useCallback)(() => {
+  const load = (0, import_react43.useCallback)(() => {
     setError(null);
     setRefreshError(null);
     let finished = false;
@@ -8765,11 +8852,11 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     knobsRef.current?.().catch(() => void 0);
     port.lists.recents?.list().then(setRecents, () => void 0);
   }, [port, apply]);
-  (0, import_react42.useEffect)(load, [load]);
-  const quietRef = (0, import_react42.useRef)({ loc, ready: false });
+  (0, import_react43.useEffect)(load, [load]);
+  const quietRef = (0, import_react43.useRef)({ loc, ready: false });
   quietRef.current = { loc, ready: snap !== null && !error };
-  const [knobSeconds, setKnobSeconds] = (0, import_react42.useState)(null);
-  (0, import_react42.useEffect)(() => {
+  const [knobSeconds, setKnobSeconds] = (0, import_react43.useState)(null);
+  (0, import_react43.useEffect)(() => {
     if (host.refreshSeconds !== void 0 || !knobsRef.current) return;
     let live = true;
     knobsRef.current().then(
@@ -8784,7 +8871,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     };
   }, [host.refreshSeconds]);
   const everySeconds = host.refreshSeconds ?? knobSeconds;
-  (0, import_react42.useEffect)(() => {
+  (0, import_react43.useEffect)(() => {
     const quietly = (minGapMs) => {
       const { loc: here, ready } = quietRef.current;
       if (!ready || document.visibilityState === "hidden" || dirty.current || here.mode !== "view") return;
@@ -8802,22 +8889,22 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       if (timer2) clearInterval(timer2);
     };
   }, [refresh, everySeconds]);
-  const inventoryRef = (0, import_react42.useRef)(onInventory);
+  const inventoryRef = (0, import_react43.useRef)(onInventory);
   inventoryRef.current = onInventory;
-  (0, import_react42.useEffect)(() => {
+  (0, import_react43.useEffect)(() => {
     if (snap) inventoryRef.current?.({ items, definitions: snap.definitions });
   }, [snap, items]);
-  (0, import_react42.useEffect)(() => {
+  (0, import_react43.useEffect)(() => {
     if (!loc.itemId || !port.lists.recents) return;
     const id = loc.itemId;
     port.lists.recents.record(id).then(() => setRecents((r) => [id, ...(r ?? []).filter((x) => x !== id)]), () => void 0);
   }, [loc.itemId, port]);
-  const orgs = snap?.organizations ?? [];
+  const orgs = (0, import_react43.useMemo)(() => orderOrganizations(snap?.organizations ?? [], items, recents), [snap?.organizations, items, recents]);
   const definitions = snap?.definitions ?? [];
-  const inThisVault = (0, import_react42.useMemo)(() => items.filter((i) => inVault(i, loc.vault)), [items, loc.vault]);
+  const inThisVault = (0, import_react43.useMemo)(() => items.filter((i) => inVault(i, loc.vault)), [items, loc.vault]);
   const vaultMixesOwners = new Set(inThisVault.map((i) => i.owner.organizationId ?? i.owner.kind)).size > 1;
-  const views = (0, import_react42.useMemo)(() => buildViews(inThisVault, definitions, favorites, recents), [inThisVault, definitions, favorites, recents]);
-  const visible = (0, import_react42.useMemo)(() => {
+  const views = (0, import_react43.useMemo)(() => buildViews(inThisVault, definitions, favorites, recents), [inThisVault, definitions, favorites, recents]);
+  const visible = (0, import_react43.useMemo)(() => {
     const filtered = inThisVault.filter((i) => {
       if (!matchesQuery(i, loc.q, familyLabel(itemFamily(i, definitions)))) return false;
       if (loc.view === "favorites") return favorites?.has(i.id) ?? false;
@@ -8829,8 +8916,8 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     if (loc.view === "recent" && recents) return [...filtered].sort((a, b) => recents.indexOf(a.id) - recents.indexOf(b.id));
     return sortItems(filtered, loc.sort, recents);
   }, [inThisVault, loc.view, loc.q, loc.sort, favorites, recents, definitions]);
-  const choices = (0, import_react42.useMemo)(() => vaultChoices(items, orgs, loc.vault), [items, orgs, loc.vault]);
-  const matchingIds = (0, import_react42.useMemo)(() => host.page ? new Set(host.page.matchingItemIds) : void 0, [host.page]);
+  const choices = (0, import_react43.useMemo)(() => vaultChoices(items, orgs, loc.vault), [items, orgs, loc.vault]);
+  const matchingIds = (0, import_react43.useMemo)(() => host.page ? new Set(host.page.matchingItemIds) : void 0, [host.page]);
   const selected = loc.itemId ? items.find((i) => i.id === loc.itemId) ?? null : null;
   const replaceItem = (next) => setItems((cur) => cur.some((i) => i.id === next.id) ? cur.map((i) => i.id === next.id ? next : i) : [...cur, next]);
   const toggleFavorite = (id) => {
@@ -8895,7 +8982,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const hasFavorites = port.lists.favorites !== void 0;
   const title = loc.vault === "all" && loc.view === "all" ? "All items" : viewLabel(loc.view, views);
   const compactHeader = mode === "full" ? void 0 : /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { className: "grid grid-cols-[repeat(auto-fit,minmax(11rem,1fr))] gap-2", "data-vault-compact-header": "", children: [
-    /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(VaultSelect, { value: loc.vault, choices, onChange: (vault) => go({ vault, itemId: null, panel: null }) }),
+    /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(VaultSelect, { value: loc.vault, choices, searchAt: host.organizationSearchAt, onChange: (vault) => go({ vault, itemId: null, panel: null }) }),
     /* @__PURE__ */ (0, import_jsx_runtime40.jsx)(import_controls35.Select, { value: loc.view, onValueChange: (view) => go({ view, itemId: null, panel: null }), options: viewOptions(views, inThisVault.length, deleted.length, hasFavorites, port.lists.recents !== void 0, host.page !== void 0, loc.view), "aria-label": "Show" })
   ] });
   const compactActions = mode === "full" ? void 0 : /* @__PURE__ */ (0, import_jsx_runtime40.jsxs)("div", { className: "flex shrink-0 items-center gap-2", "data-vault-compact-actions": "", children: [
@@ -9132,6 +9219,11 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         arg: panelArg ?? null,
         onClose: closePanel,
         onPanel,
+        onOpenItem: (next) => {
+          replaceItem(next);
+          const holds = loc.vault === "all" || loc.vault === "mine" && next.owner.kind === "me" || loc.vault === next.owner.organizationId;
+          go({ ...holds ? {} : { vault: "all" }, itemId: next.id, mode: "view", panel: null });
+        },
         onChanged: (next) => {
           if (next) replaceItem(next);
           else if (next === null) {
@@ -9171,6 +9263,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
           vault: loc.vault,
           choices,
           onVault: (vault) => go({ vault, itemId: null, panel: null }),
+          organizationSearchAt: host.organizationSearchAt,
           view: loc.view,
           allCount: inThisVault.length,
           deletedCount: deleted.length,