@ai-matrx/vault 0.1.4 → 0.1.6

package/dist/index.cjs

@@ -138,11 +138,15 @@ __export(src_exports, {
   CATEGORIES: () => CATEGORIES,
   DEFAULT_LOCATION: () => DEFAULT_LOCATION,
   GenerateButton: () => GenerateButton,
+  LOCKED_MESSAGE: () => LOCKED_MESSAGE,
   VaultApp: () => VaultApp,
+  VaultLockedError: () => VaultLockedError,
   categoryOf: () => categoryOf,
+  copyValue: () => copyValue,
   createApiVaultPort: () => createApiVaultPort,
   createSupabaseIdentity: () => createSupabaseIdentity,
   createVaultKnobs: () => createVaultKnobs,
+  guardPort: () => guardPort,
   inferFromUrl: () => inferFromUrl,
   locationFromParams: () => locationFromParams,
   locationToParams: () => locationToParams,
@@ -155,7 +159,7 @@ __export(src_exports, {
 module.exports = __toCommonJS(src_exports);
 
 // src/VaultApp.tsx
-var import_react40 = require("react");
+var import_react41 = require("react");
 var import_design_system25 = require("@ai-matrx/design-system");
 var import_controls34 = require("@ai-matrx/design-system/controls");
 var import_confirm_opener13 = require("@ai-matrx/kit/confirm-opener");
@@ -169,9 +173,28 @@ var Ctx = (0, import_react.createContext)(() => void 0);
 function useNotify() {
   return (0, import_react.useContext)(Ctx);
 }
+async function copyValue(text, label, options, deps) {
+  const secret = options.secret ?? true;
+  if (deps.clipboard) {
+    try {
+      await deps.clipboard.copy(text, { secret });
+      deps.notify(`${label} copied`, "success");
+      return true;
+    } catch (e) {
+      deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, "error");
+      return false;
+    }
+  }
+  return (0, import_clipboard.copyText)(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === "error" ? "error" : "success") });
+}
+var ClipboardCtx = (0, import_react.createContext)(void 0);
+function ClipboardProvider({ clipboard, children }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ClipboardCtx.Provider, { value: clipboard, children });
+}
 function useCopy() {
   const notify = useNotify();
-  return (0, import_react.useCallback)((text, label) => (0, import_clipboard.copyText)(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => notify(m, k === "error" ? "error" : "success") }), [notify]);
+  const clipboard = (0, import_react.useContext)(ClipboardCtx);
+  return (0, import_react.useCallback)((text, label, options = {}) => copyValue(text, label, options, { clipboard, notify }), [notify, clipboard]);
 }
 function NoticeProvider({ notify, children }) {
   const [shown, setShown] = (0, import_react.useState)(null);
@@ -549,7 +572,15 @@ var import_design_system5 = require("@ai-matrx/design-system");
 
 // src/hooks.ts
 var import_react3 = require("react");
-function useTransientSecret(ms = 2e4) {
+var DEFAULT_REVEAL_MS = 2e4;
+var RevealMs = (0, import_react3.createContext)(DEFAULT_REVEAL_MS);
+function RevealSecondsProvider({ seconds, children }) {
+  const ms = seconds !== void 0 && Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : DEFAULT_REVEAL_MS;
+  return (0, import_react3.createElement)(RevealMs.Provider, { value: ms }, children);
+}
+function useTransientSecret(given) {
+  const fromHost = (0, import_react3.useContext)(RevealMs);
+  const ms = given ?? fromHost;
   const [value, setValue] = (0, import_react3.useState)(null);
   const timer2 = (0, import_react3.useRef)(null);
   const clear = (0, import_react3.useCallback)(() => {
@@ -664,7 +695,7 @@ function SecretText({ value, multiline }) {
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
 function SecretRow({ port, item, field, extra }) {
   const confirmed = useConfirmed();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const secret = useTransientSecret();
   const [plain, setPlain] = (0, import_react5.useState)(null);
   const [busy, setBusy] = (0, import_react5.useState)(false);
@@ -705,7 +736,7 @@ function SecretRow({ port, item, field, extra }) {
   }
   async function copy() {
     const v = await fetchValue();
-    if (v !== null) await copyValue(v, field.label);
+    if (v !== null) await copyValue2(v, field.label, { secret: !visible });
   }
   const multiline = field.kind === "multiline";
   const shown = visible ? plain : secret.value;
@@ -724,7 +755,7 @@ function SecretRow({ port, item, field, extra }) {
   );
 }
 function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const isUrl = /^https?:\/\//i.test(value);
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
     Row,
@@ -735,7 +766,7 @@ function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
       actions: /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
         extra,
         isUrl && openUrl ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(ExternalGlyph, {}), "aria-label": `Open ${value}`, onClick: () => openUrl(value) }) : null,
-        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(CopyGlyph, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue(value, typeof label === "string" && label ? label : "Value") })
+        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(CopyGlyph, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue2(value, typeof label === "string" && label ? label : "Value", { secret: false }) })
       ] }),
       children: isUrl && openUrl ? (
         // A real link (right-click, copy link address, open in a new tab); a click goes through the host's opener.
@@ -1381,7 +1412,7 @@ function HistoryPanel({ item, port, arg, onClose, onChanged }) {
 function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, onError }) {
   const confirmed = useConfirmed();
   const secret = useTransientSecret();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const [busy, setBusy] = (0, import_react7.useState)(false);
   const when = formatDate(entry.recordedAt, true);
   async function read() {
@@ -1404,7 +1435,7 @@ function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, on
   }
   async function copy() {
     const v = await read();
-    if (v !== null) await copyValue(v, `Earlier ${label.toLowerCase()}`);
+    if (v !== null) await copyValue2(v, `Earlier ${label.toLowerCase()}`);
   }
   async function restore() {
     const yes = await (0, import_confirm_opener.confirm)({
@@ -1589,13 +1620,13 @@ function CountdownRing({ remaining, period, loading = false, className }) {
 }
 function useCopied() {
   const [copied, setCopied] = (0, import_react8.useState)(false);
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const t = (0, import_react8.useRef)(null);
   (0, import_react8.useEffect)(() => () => void (t.current && clearTimeout(t.current)), []);
   return {
     copied,
     copy: async (code) => {
-      const ok = await copyValue(code, "One-time code");
+      const ok = await copyValue2(code, "One-time code");
       if (!ok) return;
       setCopied(true);
       if (t.current) clearTimeout(t.current);
@@ -2810,7 +2841,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const [candidate, setCandidate] = (0, import_react15.useState)(null);
   const [revealed, setRevealed] = (0, import_react15.useState)(false);
   const [note, setNote] = (0, import_react15.useState)(null);
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const expiry = (0, import_react15.useRef)(null);
   const drop = () => {
     if (expiry.current) clearTimeout(expiry.current);
@@ -2870,7 +2901,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const strength = candidate ? strengthOf(candidate.bits) : null;
   const copy = async () => {
     if (!candidate) return;
-    const ok = await copyValue(candidate.value, "Generated password");
+    const ok = await copyValue2(candidate.value, "Generated password");
     setNote(ok ? { tone: "success", text: "Copied. Your clipboard keeps it." } : { tone: "destructive", text: "Couldn\u2019t copy. Reveal it and copy by hand." });
   };
   const use = () => {
@@ -2981,8 +3012,47 @@ function importLimitsFrom(resolved) {
   return out;
 }
 
+// src/lock.ts
+var import_react16 = require("react");
+var LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
+var VaultLockedError = class extends Error {
+  code = "vault_locked";
+  constructor() {
+    super(LOCKED_MESSAGE);
+    this.name = "VaultLockedError";
+  }
+};
+function guardPort(port, locked) {
+  const cache = /* @__PURE__ */ new WeakMap();
+  const wrap = (target) => {
+    const hit = cache.get(target);
+    if (hit) return hit;
+    const proxy = new Proxy(target, {
+      get(obj2, key, receiver) {
+        const value = Reflect.get(obj2, key, receiver);
+        if (typeof value === "function") {
+          return (...args) => {
+            if (locked()) return Promise.reject(new VaultLockedError());
+            return value.apply(obj2, args);
+          };
+        }
+        if (value && typeof value === "object") return wrap(value);
+        return value;
+      }
+    });
+    cache.set(target, proxy);
+    return proxy;
+  };
+  return wrap(port);
+}
+var NEVER = () => () => void 0;
+var UNLOCKED = () => false;
+function useLocked(lock) {
+  return (0, import_react16.useSyncExternalStore)(lock ? lock.subscribe : NEVER, lock ? () => lock.locked() : UNLOCKED, UNLOCKED);
+}
+
 // src/io/BackupPanel.tsx
-var import_react17 = require("react");
+var import_react18 = require("react");
 var import_controls13 = require("@ai-matrx/design-system/controls");
 var import_download = require("@ai-matrx/kit/download");
 var import_confirm_opener4 = require("@ai-matrx/kit/confirm-opener");
@@ -3075,7 +3145,7 @@ function startNewRestoreRun(preview) {
 }
 
 // src/io/lines.tsx
-var import_react16 = require("react");
+var import_react17 = require("react");
 var import_design_system11 = require("@ai-matrx/design-system");
 var import_controls12 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime15 = require("react/jsx-runtime");
@@ -3088,7 +3158,7 @@ function PickLine({ checked, onChange, disabled = false, title, detail, badge, t
   ] });
 }
 function Windowed({ items, size = 150, render }) {
-  const [all, setAll] = (0, import_react16.useState)(false);
+  const [all, setAll] = (0, import_react17.useState)(false);
   const shown = all ? items : items.slice(0, size);
   return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(import_jsx_runtime15.Fragment, { children: [
     shown.map(render),
@@ -3099,7 +3169,7 @@ function Windowed({ items, size = 150, render }) {
   ] });
 }
 function More({ title = "More", children }) {
-  const [open, setOpen] = (0, import_react16.useState)(false);
+  const [open, setOpen] = (0, import_react17.useState)(false);
   return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex flex-col gap-2", children: [
     /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls12.DisclosureHeader, { open, title, onClick: () => setOpen((o) => !o) }),
     open ? children : null
@@ -3138,21 +3208,21 @@ function Omissions({ omissions, accepted, onAccepted, verb }) {
 }
 function BackupPanel({ port, items, onClose, onChanged }) {
   const confirmed = useConfirmed();
-  const fileInput = (0, import_react17.useRef)(null);
-  const abort = (0, import_react17.useRef)(null);
-  const [mode, setMode] = (0, import_react17.useState)("backup");
-  const [busy, setBusy] = (0, import_react17.useState)(false);
-  const [error, setError] = (0, import_react17.useState)(null);
-  const [passphrase, setPassphrase] = (0, import_react17.useState)("");
-  const [repeat, setRepeat] = (0, import_react17.useState)("");
-  const [accepted, setAccepted] = (0, import_react17.useState)(false);
-  const [selected, setSelected] = (0, import_react17.useState)(/* @__PURE__ */ new Set());
-  const [backup, setBackup] = (0, import_react17.useState)(null);
-  const [file, setFile] = (0, import_react17.useState)(null);
-  const [restorePreview, setRestorePreview] = (0, import_react17.useState)(null);
-  const [runId, setRunId] = (0, import_react17.useState)(null);
-  const [result, setResult] = (0, import_react17.useState)(null);
-  (0, import_react17.useEffect)(() => () => abort.current?.abort(), []);
+  const fileInput = (0, import_react18.useRef)(null);
+  const abort = (0, import_react18.useRef)(null);
+  const [mode, setMode] = (0, import_react18.useState)("backup");
+  const [busy, setBusy] = (0, import_react18.useState)(false);
+  const [error, setError] = (0, import_react18.useState)(null);
+  const [passphrase, setPassphrase] = (0, import_react18.useState)("");
+  const [repeat, setRepeat] = (0, import_react18.useState)("");
+  const [accepted, setAccepted] = (0, import_react18.useState)(false);
+  const [selected, setSelected] = (0, import_react18.useState)(/* @__PURE__ */ new Set());
+  const [backup, setBackup] = (0, import_react18.useState)(null);
+  const [file, setFile] = (0, import_react18.useState)(null);
+  const [restorePreview, setRestorePreview] = (0, import_react18.useState)(null);
+  const [runId, setRunId] = (0, import_react18.useState)(null);
+  const [result, setResult] = (0, import_react18.useState)(null);
+  (0, import_react18.useEffect)(() => () => abort.current?.abort(), []);
   const switchMode = (next) => {
     abort.current?.abort();
     setMode(next);
@@ -3323,7 +3393,7 @@ function BackupPanel({ port, items, onClose, onChanged }) {
 }
 
 // src/io/ExportPanel.tsx
-var import_react18 = require("react");
+var import_react19 = require("react");
 var import_controls14 = require("@ai-matrx/design-system/controls");
 var import_download2 = require("@ai-matrx/kit/download");
 var import_confirm_opener5 = require("@ai-matrx/kit/confirm-opener");
@@ -3347,12 +3417,12 @@ function omissionText2(omissions) {
 }
 function ExportPanel({ port, items, onClose }) {
   const confirmed = useConfirmed();
-  const logins = (0, import_react18.useMemo)(() => items.filter((i) => i.definitionKey === WEBSITE_LOGIN), [items]);
-  const [profile, setProfile] = (0, import_react18.useState)("matrx_login_csv_v1");
-  const [selected, setSelected] = (0, import_react18.useState)(/* @__PURE__ */ new Set());
-  const [preview, setPreview] = (0, import_react18.useState)(null);
-  const [busy, setBusy] = (0, import_react18.useState)(false);
-  const [error, setError] = (0, import_react18.useState)(null);
+  const logins = (0, import_react19.useMemo)(() => items.filter((i) => i.definitionKey === WEBSITE_LOGIN), [items]);
+  const [profile, setProfile] = (0, import_react19.useState)("matrx_login_csv_v1");
+  const [selected, setSelected] = (0, import_react19.useState)(/* @__PURE__ */ new Set());
+  const [preview, setPreview] = (0, import_react19.useState)(null);
+  const [busy, setBusy] = (0, import_react19.useState)(false);
+  const [error, setError] = (0, import_react19.useState)(null);
   const format = FORMATS.find((f) => f.value === profile);
   const reasons = new Map(preview?.items.map((p) => [p.item_id, p]) ?? []);
   const eligible = preview?.items.filter((p) => p.eligible).length ?? 0;
@@ -3477,7 +3547,7 @@ function ExportPanel({ port, items, onClose }) {
 }
 
 // src/io/ImportPanel.tsx
-var import_react19 = require("react");
+var import_react20 = require("react");
 var import_controls15 = require("@ai-matrx/design-system/controls");
 
 // src/io/csv-import.ts
@@ -4336,24 +4406,24 @@ var STATE_BADGE = {
 var ME = "me";
 function ImportPanel({ port, host, items, organizations, onClose, onChanged, limits }) {
   const confirmed = useConfirmed();
-  const fileInput = (0, import_react19.useRef)(null);
-  const abort = (0, import_react19.useRef)(null);
-  const stop = (0, import_react19.useRef)(false);
-  const keys = (0, import_react19.useRef)(/* @__PURE__ */ new Map());
-  const [source, setSource] = (0, import_react19.useState)("auto");
-  const [envText, setEnvText] = (0, import_react19.useState)("");
-  const [injectSandbox, setInjectSandbox] = (0, import_react19.useState)(false);
-  const [fileName, setFileName] = (0, import_react19.useState)(null);
-  const [reading, setReading] = (0, import_react19.useState)(false);
-  const [draft, setDraft] = (0, import_react19.useState)(null);
-  const [destination, setDestination] = (0, import_react19.useState)(ME);
-  const [browserFill, setBrowserFill] = (0, import_react19.useState)(false);
-  const [approvedVisible, setApprovedVisible] = (0, import_react19.useState)(false);
-  const [selected, setSelected] = (0, import_react19.useState)(/* @__PURE__ */ new Set());
-  const [running, setRunning] = (0, import_react19.useState)(null);
-  const [done, setDone] = (0, import_react19.useState)(null);
-  const [error, setError] = (0, import_react19.useState)(null);
-  (0, import_react19.useEffect)(
+  const fileInput = (0, import_react20.useRef)(null);
+  const abort = (0, import_react20.useRef)(null);
+  const stop = (0, import_react20.useRef)(false);
+  const keys = (0, import_react20.useRef)(/* @__PURE__ */ new Map());
+  const [source, setSource] = (0, import_react20.useState)("auto");
+  const [envText, setEnvText] = (0, import_react20.useState)("");
+  const [injectSandbox, setInjectSandbox] = (0, import_react20.useState)(false);
+  const [fileName, setFileName] = (0, import_react20.useState)(null);
+  const [reading, setReading] = (0, import_react20.useState)(false);
+  const [draft, setDraft] = (0, import_react20.useState)(null);
+  const [destination, setDestination] = (0, import_react20.useState)(ME);
+  const [browserFill, setBrowserFill] = (0, import_react20.useState)(false);
+  const [approvedVisible, setApprovedVisible] = (0, import_react20.useState)(false);
+  const [selected, setSelected] = (0, import_react20.useState)(/* @__PURE__ */ new Set());
+  const [running, setRunning] = (0, import_react20.useState)(null);
+  const [done, setDone] = (0, import_react20.useState)(null);
+  const [error, setError] = (0, import_react20.useState)(null);
+  (0, import_react20.useEffect)(
     () => () => {
       abort.current?.abort();
       stop.current = true;
@@ -4362,9 +4432,9 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
   );
   const organizationId = destination === ME ? null : destination;
   const existingIn = (org) => items.filter((i) => org === null ? i.owner.kind === "me" : i.owner.organizationId === org).map((i) => ({ displayName: i.name, loginUrls: i.loginUrls }));
-  const existing = (0, import_react19.useMemo)(() => existingIn(organizationId), [items, organizationId]);
-  const destinationOptions = (0, import_react19.useMemo)(() => [{ value: ME, label: "Personal" }, ...organizations.map((o) => ({ value: o.id, label: o.name }))], [organizations]);
-  const lines = (0, import_react19.useMemo)(
+  const existing = (0, import_react20.useMemo)(() => existingIn(organizationId), [items, organizationId]);
+  const destinationOptions = (0, import_react20.useMemo)(() => [{ value: ME, label: "Personal" }, ...organizations.map((o) => ({ value: o.id, label: o.name }))], [organizations]);
+  const lines = (0, import_react20.useMemo)(
     () => draft?.kind === "file" ? reviewLines(draft.parsed, { organizationId, browserFill, existing, limits, mapping: draft.mapping }) : [],
     [draft, organizationId, browserFill, existing, limits]
   );
@@ -4616,7 +4686,7 @@ function Notices({ draft }) {
 }
 
 // src/ItemList.tsx
-var import_react27 = require("react");
+var import_react28 = require("react");
 var import_design_system18 = require("@ai-matrx/design-system");
 var import_design_system19 = require("@ai-matrx/design-system");
 var import_controls22 = require("@ai-matrx/design-system/controls");
@@ -4636,14 +4706,14 @@ function ItemIcon({ definitionKey, family, site, size = "md", inverted = false }
 }
 
 // src/ItemPane.tsx
-var import_react26 = require("react");
+var import_react27 = require("react");
 var import_design_system16 = require("@ai-matrx/design-system");
 var import_design_system17 = require("@ai-matrx/design-system");
 var import_controls21 = require("@ai-matrx/design-system/controls");
 var import_confirm_opener9 = require("@ai-matrx/kit/confirm-opener");
 
 // src/activity/FilesSection.tsx
-var import_react20 = require("react");
+var import_react21 = require("react");
 var import_controls16 = require("@ai-matrx/design-system/controls");
 var import_design_system13 = require("@ai-matrx/design-system");
 var import_confirm_opener6 = require("@ai-matrx/kit/confirm-opener");
@@ -4659,11 +4729,11 @@ var PROTECTION = [
 function FilesSection({ item, port, editing, onChanged }) {
   const confirmed = useConfirmed();
   const canEdit = editing && item.capabilities.canEdit;
-  const [busy, setBusy] = (0, import_react20.useState)(null);
-  const [error, setError] = (0, import_react20.useState)(null);
-  const [pending, setPending] = (0, import_react20.useState)(null);
-  const [dragging, setDragging] = (0, import_react20.useState)(false);
-  const picker = (0, import_react20.useRef)(null);
+  const [busy, setBusy] = (0, import_react21.useState)(null);
+  const [error, setError] = (0, import_react21.useState)(null);
+  const [pending, setPending] = (0, import_react21.useState)(null);
+  const [dragging, setDragging] = (0, import_react21.useState)(false);
+  const picker = (0, import_react21.useRef)(null);
   if (!canEdit && item.attachments.length === 0) return null;
   async function run(key, work, fallback) {
     setBusy(key);
@@ -4739,8 +4809,8 @@ function FilesSection({ item, port, editing, onChanged }) {
   );
 }
 function EditableFile({ port, item: it, file: a, busy: b, run: go, onDownload, onTooBig }) {
-  const [open, setOpen] = (0, import_react20.useState)(false);
-  const replacer = (0, import_react20.useRef)(null);
+  const [open, setOpen] = (0, import_react21.useState)(false);
+  const replacer = (0, import_react21.useRef)(null);
   async function remove() {
     const yes = await (0, import_confirm_opener6.confirm)({ title: `Delete ${a.label}?`, description: "The encrypted file is removed from this item.", confirmLabel: "Delete", variant: "destructive" });
     if (yes) await go(`delete:${a.id}`, () => port.activity.deleteFile(it, a.id), "The file could not be deleted.");
@@ -4798,9 +4868,9 @@ function Protection({ value, locked, onChange }) {
   );
 }
 function NewFile({ file, busy, onAdd, onCancel }) {
-  const [label, setLabel] = (0, import_react20.useState)(file.name);
-  const [description, setDescription] = (0, import_react20.useState)("");
-  const [handling, setHandling] = (0, import_react20.useState)("revealable");
+  const [label, setLabel] = (0, import_react21.useState)(file.name);
+  const [description, setDescription] = (0, import_react21.useState)("");
+  const [handling, setHandling] = (0, import_react21.useState)("revealable");
   async function add() {
     if (handling === "sealed" && !await confirmSeal(label)) return;
     await onAdd({ label: label.trim(), description: description.trim() || null, handling });
@@ -4820,10 +4890,10 @@ function NewFile({ file, busy, onAdd, onCancel }) {
   ] });
 }
 function FileDetailsRows({ file, busy, onSave, onCancel }) {
-  const [label, setLabel] = (0, import_react20.useState)(file.label);
-  const [description, setDescription] = (0, import_react20.useState)(file.description);
-  const [fileName, setFileName] = (0, import_react20.useState)(file.fileName);
-  const [handling, setHandling] = (0, import_react20.useState)(file.handling);
+  const [label, setLabel] = (0, import_react21.useState)(file.label);
+  const [description, setDescription] = (0, import_react21.useState)(file.description);
+  const [fileName, setFileName] = (0, import_react21.useState)(file.fileName);
+  const [handling, setHandling] = (0, import_react21.useState)(file.handling);
   const changed = label !== file.label || description !== file.description || fileName !== file.fileName || handling !== file.handling;
   async function save() {
     if (handling === "sealed" && file.handling !== "sealed" && !await confirmSeal(label)) return;
@@ -4850,18 +4920,18 @@ function confirmSeal(label) {
 }
 
 // src/fields/RecoveryCodesRow.tsx
-var import_react21 = require("react");
+var import_react22 = require("react");
 var import_controls17 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime21 = require("react/jsx-runtime");
 var MASK4 = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 var say2 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function RecoveryCodesRow({ item, field, port, onChanged }) {
   const confirmed = useConfirmed();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const secret = useTransientSecret();
-  const [busy, setBusy] = (0, import_react21.useState)(false);
-  const [error, setError] = (0, import_react21.useState)(null);
-  const [draft, setDraft] = (0, import_react21.useState)(null);
+  const [busy, setBusy] = (0, import_react22.useState)(false);
+  const [error, setError] = (0, import_react22.useState)(null);
+  const [draft, setDraft] = (0, import_react22.useState)(null);
   const canEdit = item.capabilities.canEdit;
   const run = async (step) => {
     setBusy(true);
@@ -4945,7 +5015,7 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
       children: sealed ? /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(import_controls17.Badge, { icon: /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(LockGlyph, {}), children: "Sealed" }) : codes ? /* @__PURE__ */ (0, import_jsx_runtime21.jsxs)("ul", { className: "flex flex-col gap-0.5", "aria-label": "Recovery codes", children: [
         codes.map((code, i) => /* @__PURE__ */ (0, import_jsx_runtime21.jsxs)("li", { className: "flex min-h-7 items-center gap-1", children: [
           /* @__PURE__ */ (0, import_jsx_runtime21.jsx)("code", { className: "min-w-0 flex-1 break-all font-mono text-sm text-foreground", children: code }),
-          /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(import_controls17.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(CopyGlyph, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue(code, "Recovery code") }),
+          /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(import_controls17.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(CopyGlyph, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue2(code, "Recovery code") }),
           canEdit ? /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(import_controls17.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(CheckGlyph, {}), disabled: busy, onClick: () => void markUsed(i), children: "Mark used" }) : null
         ] }, `${i}-${code}`)),
         error ? /* @__PURE__ */ (0, import_jsx_runtime21.jsx)("li", { role: "alert", className: "text-xs text-destructive", children: error }) : null
@@ -5096,7 +5166,7 @@ function targetLabel(t) {
 }
 
 // src/extension/UseOnSiteButton.tsx
-var import_react22 = require("react");
+var import_react23 = require("react");
 var import_controls18 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime22 = require("react/jsx-runtime");
 function canUseOnSite(item, pageUrl) {
@@ -5104,7 +5174,7 @@ function canUseOnSite(item, pageUrl) {
 }
 function UseOnSiteButton({ port, item, pageUrl, onChanged }) {
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react22.useState)(false);
+  const [busy, setBusy] = (0, import_react23.useState)(false);
   if (!canUseOnSite(item, pageUrl)) return null;
   const site = pageSite(pageUrl);
   const run = async () => {
@@ -5123,7 +5193,7 @@ function UseOnSiteButton({ port, item, pageUrl, onChanged }) {
 }
 
 // src/sharing/SharePanel.tsx
-var import_react25 = require("react");
+var import_react26 = require("react");
 var import_confirm_opener8 = require("@ai-matrx/kit/confirm-opener");
 var import_controls20 = require("@ai-matrx/design-system/controls");
 var import_design_system15 = require("@ai-matrx/design-system");
@@ -5180,7 +5250,7 @@ function shareSummary(grants) {
 var MEMBER_CHOICE_DEFAULT = "default";
 
 // src/sharing/parts.tsx
-var import_react23 = require("react");
+var import_react24 = require("react");
 var import_design_system14 = require("@ai-matrx/design-system");
 var import_jsx_runtime23 = require("react/jsx-runtime");
 var message = (e, fallback) => {
@@ -5189,9 +5259,9 @@ var message = (e, fallback) => {
 };
 function useAction() {
   const confirmed = useConfirmed();
-  const [busy, setBusy] = (0, import_react23.useState)(null);
-  const [error, setError] = (0, import_react23.useState)(null);
-  const [notice, setNotice] = (0, import_react23.useState)(null);
+  const [busy, setBusy] = (0, import_react24.useState)(null);
+  const [error, setError] = (0, import_react24.useState)(null);
+  const [notice, setNotice] = (0, import_react24.useState)(null);
   async function run(key, fn, done) {
     setBusy(key);
     setError(null);
@@ -5225,7 +5295,7 @@ function StatusLine({ error, notice }) {
 }
 
 // src/sharing/MovePanel.tsx
-var import_react24 = require("react");
+var import_react25 = require("react");
 var import_confirm_opener7 = require("@ai-matrx/kit/confirm-opener");
 var import_controls19 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime24 = require("react/jsx-runtime");
@@ -5234,9 +5304,9 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
   const { busy, error, notice, run, setNotice } = useAction();
   const moves = moveDestinations(item, organizations);
   const copies = copyDestinations(organizations, item);
-  const [moveTo, setMoveTo] = (0, import_react24.useState)("");
-  const [copyTo, setCopyTo] = (0, import_react24.useState)("");
-  const [email, setEmail] = (0, import_react24.useState)("");
+  const [moveTo, setMoveTo] = (0, import_react25.useState)("");
+  const [copyTo, setCopyTo] = (0, import_react25.useState)("");
+  const [email, setEmail] = (0, import_react25.useState)("");
   const passkey = isPasskey(item);
   const canMove = item.capabilities.canManage && !passkey && moves.length > 0;
   const canGive = item.capabilities.canManage && item.owner.kind === "me" && !passkey;
@@ -5317,11 +5387,11 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
 // src/sharing/SharePanel.tsx
 var import_jsx_runtime25 = require("react/jsx-runtime");
 function useGrants(port, item) {
-  const [grants, setGrants] = (0, import_react25.useState)(null);
-  const [loadError, setLoadError] = (0, import_react25.useState)(null);
-  const [nonce, setNonce] = (0, import_react25.useState)(0);
+  const [grants, setGrants] = (0, import_react26.useState)(null);
+  const [loadError, setLoadError] = (0, import_react26.useState)(null);
+  const [nonce, setNonce] = (0, import_react26.useState)(0);
   const allowed = item.capabilities.canManage;
-  (0, import_react25.useEffect)(() => {
+  (0, import_react26.useEffect)(() => {
     if (!allowed) return;
     let live = true;
     setLoadError(null);
@@ -5338,9 +5408,9 @@ function useGrants(port, item) {
 function SharePanel({ item, port, organizations, onClose, onChanged }) {
   const { grants, setGrants, loadError, reload } = useGrants(port, item);
   const { busy, error, notice, run } = useAction();
-  const [email, setEmail] = (0, import_react25.useState)("");
-  const [level, setLevel] = (0, import_react25.useState)("use");
-  const [more, setMore] = (0, import_react25.useState)(false);
+  const [email, setEmail] = (0, import_react26.useState)("");
+  const [level, setLevel] = (0, import_react26.useState)("use");
+  const [more, setMore] = (0, import_react26.useState)(false);
   const isOrg = item.owner.kind === "organization" && item.owner.organizationId !== null;
   const orgName = item.owner.label;
   const people = (grants ?? []).filter((g) => g.kind === "person");
@@ -5462,8 +5532,8 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
 function IntoOrganization({ item, port, organizations, grants, onShared }) {
   const { busy, error, notice, run } = useAction();
   const open = organizations.filter((o) => !grants.some((g) => g.organizationId === o.id));
-  const [target, setTarget] = (0, import_react25.useState)("");
-  const [level, setLevel] = (0, import_react25.useState)("use");
+  const [target, setTarget] = (0, import_react26.useState)("");
+  const [level, setLevel] = (0, import_react26.useState)("use");
   const chosen = open.find((o) => o.id === target);
   if (item.owner.kind !== "me") return null;
   return /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(Section, { title: "Share into organization", children: open.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime25.jsxs)(import_jsx_runtime25.Fragment, { children: [
@@ -5498,10 +5568,10 @@ var CHOICES = [
   { value: "editor", label: "Can edit", meta: "See and change" }
 ];
 function MemberAccess({ port, organizationId, organizationName }) {
-  const [list, setList] = (0, import_react25.useState)(null);
-  const [loadError, setLoadError] = (0, import_react25.useState)(null);
+  const [list, setList] = (0, import_react26.useState)(null);
+  const [loadError, setLoadError] = (0, import_react26.useState)(null);
   const { busy, error, run } = useAction();
-  (0, import_react25.useEffect)(() => {
+  (0, import_react26.useEffect)(() => {
     let live = true;
     port.sharing.memberAccess(organizationId).then(
       (l) => live && setList(l),
@@ -5533,9 +5603,9 @@ function MemberAccess({ port, organizationId, organizationName }) {
   ] });
 }
 function SharingSummary({ item, port, className }) {
-  const [text, setText] = (0, import_react25.useState)("");
+  const [text, setText] = (0, import_react26.useState)("");
   const allowed = item.capabilities.canManage;
-  (0, import_react25.useEffect)(() => {
+  (0, import_react26.useEffect)(() => {
     if (!allowed) return;
     let live = true;
     port.sharing.grants(item).then(
@@ -5560,8 +5630,8 @@ function ItemPane(props) {
   const editing = mode !== "view";
   const seedName = seed?.name ?? "";
   const seedUrl = seed?.url ?? "";
-  const [loaded, setLoaded] = (0, import_react26.useState)({});
-  const base = (0, import_react26.useMemo)(() => {
+  const [loaded, setLoaded] = (0, import_react27.useState)({});
+  const base = (0, import_react27.useMemo)(() => {
     const b = draftOf(item);
     if (!item) {
       b.name = seedName;
@@ -5570,22 +5640,22 @@ function ItemPane(props) {
     b.values = { ...loaded };
     return b;
   }, [item, seedName, seedUrl, loaded]);
-  const [draft, setDraft] = (0, import_react26.useState)(base);
-  const [tagsText, setTagsText] = (0, import_react26.useState)(base.tags.join(", "));
-  const [showTags, setShowTags] = (0, import_react26.useState)(false);
-  const [showDescription, setShowDescription] = (0, import_react26.useState)(false);
-  const [owner, setOwner] = (0, import_react26.useState)(defaultOwner ?? "me");
-  const [recipient, setRecipient] = (0, import_react26.useState)("");
-  const [generatePrivately, setGeneratePrivately] = (0, import_react26.useState)(false);
-  const [busy, setBusy] = (0, import_react26.useState)(false);
-  const [error, setError] = (0, import_react26.useState)(null);
-  const [destinations, setDestinations] = (0, import_react26.useState)({});
+  const [draft, setDraft] = (0, import_react27.useState)(base);
+  const [tagsText, setTagsText] = (0, import_react27.useState)(base.tags.join(", "));
+  const [showTags, setShowTags] = (0, import_react27.useState)(false);
+  const [showDescription, setShowDescription] = (0, import_react27.useState)(false);
+  const [owner, setOwner] = (0, import_react27.useState)(defaultOwner ?? "me");
+  const [recipient, setRecipient] = (0, import_react27.useState)("");
+  const [generatePrivately, setGeneratePrivately] = (0, import_react27.useState)(false);
+  const [busy, setBusy] = (0, import_react27.useState)(false);
+  const [error, setError] = (0, import_react27.useState)(null);
+  const [destinations, setDestinations] = (0, import_react27.useState)({});
   const dirty = editing && isDirty(base, draft);
   const declared = definition?.fields ?? [];
-  const prev = (0, import_react26.useRef)(null);
-  const paneRef = (0, import_react26.useRef)(null);
+  const prev = (0, import_react27.useRef)(null);
+  const paneRef = (0, import_react27.useRef)(null);
   const room = useRoomOf(paneRef);
-  (0, import_react26.useEffect)(() => {
+  (0, import_react27.useEffect)(() => {
     const was = prev.current;
     const id = item?.id ?? null;
     if (was && was.id === id && was.mode === mode && editing) {
@@ -5598,18 +5668,18 @@ function ItemPane(props) {
     }
     prev.current = { base, id, mode };
   }, [base, mode, item?.id, editing]);
-  (0, import_react26.useEffect)(() => {
+  (0, import_react27.useEffect)(() => {
     setLoaded({});
     setShowTags(false);
     setShowDescription(false);
   }, [item?.id, mode]);
-  (0, import_react26.useEffect)(() => onDirty(dirty), [dirty, onDirty]);
+  (0, import_react27.useEffect)(() => onDirty(dirty), [dirty, onDirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
-  (0, import_react26.useEffect)(() => {
+  (0, import_react27.useEffect)(() => {
     if (editing && dirty) keepDraft(keepKey, item?.updatedAt ?? "new", draft);
     else if (!editing) dropKeptDraft(keepKey);
   }, [editing, dirty, draft, keepKey, item?.updatedAt]);
-  (0, import_react26.useEffect)(() => {
+  (0, import_react27.useEffect)(() => {
     if (!editing || !item) return;
     let live = true;
     for (const f of item.fields) {
@@ -5955,8 +6025,8 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
   const ordered = [...pinned, ...rest];
-  const listRef = (0, import_react27.useRef)(null);
-  (0, import_react27.useEffect)(() => {
+  const listRef = (0, import_react28.useRef)(null);
+  (0, import_react28.useEffect)(() => {
     if (selectedId) listRef.current?.querySelector(`[data-item="${selectedId}"]`)?.scrollIntoView({ block: "nearest" });
   }, [selectedId, items.length]);
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -6007,14 +6077,14 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react27.useState)(false);
+  const [busy, setBusy] = (0, import_react28.useState)(false);
   const user = item.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed");
   const secret = item.fields.find((f) => f.key === "password" && f.handling === "revealable");
   const quick = async (key, label) => {
     setBusy(true);
     try {
       const v = await confirmed(() => port.reveal(item, key));
-      await copy(v, label);
+      await copy(v, label, { secret: key !== user?.key || user.handling !== "visible" });
     } catch (e) {
       if (!wasCancelled(e)) notify(e instanceof Error ? e.message : `${label} could not be read`, "error");
     } finally {
@@ -6047,7 +6117,7 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
 }
 
 // src/lists/TrashView.tsx
-var import_react29 = require("react");
+var import_react30 = require("react");
 var import_controls24 = require("@ai-matrx/design-system/controls");
 
 // src/lists/logic.ts
@@ -6120,16 +6190,16 @@ function refusalText(reason) {
 }
 
 // src/lists/RestorePanel.tsx
-var import_react28 = require("react");
+var import_react29 = require("react");
 var import_controls23 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime28 = require("react/jsx-runtime");
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 function RestorePanel({ lists, item, restore, onClose }) {
-  const [preview, setPreview] = (0, import_react28.useState)(null);
-  const [error, setError] = (0, import_react28.useState)(null);
-  const [busy, setBusy] = (0, import_react28.useState)(false);
-  const [loading, setLoading] = (0, import_react28.useState)(Boolean(lists.preview));
-  (0, import_react28.useEffect)(() => {
+  const [preview, setPreview] = (0, import_react29.useState)(null);
+  const [error, setError] = (0, import_react29.useState)(null);
+  const [busy, setBusy] = (0, import_react29.useState)(false);
+  const [loading, setLoading] = (0, import_react29.useState)(Boolean(lists.preview));
+  (0, import_react29.useEffect)(() => {
     if (!lists.preview) return;
     let live = true;
     lists.preview(item).then(
@@ -6189,10 +6259,10 @@ function RestorePanel({ lists, item, restore, onClose }) {
 var import_jsx_runtime29 = require("react/jsx-runtime");
 function TrashView({ port, deleted, query, header, onChanged }) {
   const confirmed = useConfirmed();
-  const [busyId, setBusyId] = (0, import_react29.useState)(null);
-  const [message2, setMessage] = (0, import_react29.useState)(null);
+  const [busyId, setBusyId] = (0, import_react30.useState)(null);
+  const [message2, setMessage] = (0, import_react30.useState)(null);
   const shown = deleted.filter((i) => matchesQuery2(i, query));
-  const [restoring, setRestoring] = (0, import_react29.useState)(null);
+  const [restoring, setRestoring] = (0, import_react30.useState)(null);
   const restore = async (item, deletionId) => {
     setBusyId(item.id);
     setMessage(null);
@@ -6227,15 +6297,15 @@ function TrashView({ port, deleted, query, header, onChanged }) {
 }
 
 // src/NewItemFlow.tsx
-var import_react30 = require("react");
+var import_react31 = require("react");
 var import_design_system20 = require("@ai-matrx/design-system");
 var import_controls25 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime30 = require("react/jsx-runtime");
 function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
-  const [search, setSearch] = (0, import_react30.useState)("");
-  const guess = (0, import_react30.useMemo)(() => inferFromUrl(url, definitions), [url, definitions]);
+  const [search, setSearch] = (0, import_react31.useState)("");
+  const guess = (0, import_react31.useMemo)(() => inferFromUrl(url, definitions), [url, definitions]);
   const common = COMMON_DEFINITION_KEYS.map((k) => definitions.find((d) => d.key === k)).filter((d) => d !== void 0);
-  const matches = (0, import_react30.useMemo)(() => {
+  const matches = (0, import_react31.useMemo)(() => {
     const q = search.trim().toLowerCase();
     if (!q) return [];
     return definitions.filter((d) => `${d.label} ${d.key} ${d.providerKey ?? ""} ${FAMILY_LABELS[d.family] ?? ""}`.toLowerCase().includes(q)).slice(0, 60);
@@ -6299,7 +6369,7 @@ function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
 }
 
 // src/sharing/SecureLinkPanel.tsx
-var import_react31 = require("react");
+var import_react32 = require("react");
 var import_confirm_opener10 = require("@ai-matrx/kit/confirm-opener");
 var import_design_system21 = require("@ai-matrx/design-system");
 var import_controls26 = require("@ai-matrx/design-system/controls");
@@ -6381,20 +6451,20 @@ var import_jsx_runtime31 = require("react/jsx-runtime");
 function SecureLinkPanel({ item, port, onClose }) {
   const sharing = port.sharing;
   const { busy, error, notice, run, setNotice } = useAction();
-  const [remedy, setRemedy] = (0, import_react31.useState)(null);
-  const [options, setOptions] = (0, import_react31.useState)(null);
-  const [optionsError, setOptionsError] = (0, import_react31.useState)(null);
-  const [sent, setSent] = (0, import_react31.useState)(null);
-  const [sentError, setSentError] = (0, import_react31.useState)(null);
-  const [nonce, setNonce] = (0, import_react31.useState)(0);
-  const [email, setEmail] = (0, import_react31.useState)("");
-  const [phone, setPhone] = (0, import_react31.useState)("");
-  const [name, setName] = (0, import_react31.useState)("");
-  const [linkBy, setLinkBy] = (0, import_react31.useState)("email");
-  const [fields, setFields] = (0, import_react31.useState)([]);
-  const [note, setNote] = (0, import_react31.useState)("");
-  const [sameChannelSent, setSameChannelSent] = (0, import_react31.useState)(false);
-  (0, import_react31.useEffect)(() => {
+  const [remedy, setRemedy] = (0, import_react32.useState)(null);
+  const [options, setOptions] = (0, import_react32.useState)(null);
+  const [optionsError, setOptionsError] = (0, import_react32.useState)(null);
+  const [sent, setSent] = (0, import_react32.useState)(null);
+  const [sentError, setSentError] = (0, import_react32.useState)(null);
+  const [nonce, setNonce] = (0, import_react32.useState)(0);
+  const [email, setEmail] = (0, import_react32.useState)("");
+  const [phone, setPhone] = (0, import_react32.useState)("");
+  const [name, setName] = (0, import_react32.useState)("");
+  const [linkBy, setLinkBy] = (0, import_react32.useState)("email");
+  const [fields, setFields] = (0, import_react32.useState)([]);
+  const [note, setNote] = (0, import_react32.useState)("");
+  const [sameChannelSent, setSameChannelSent] = (0, import_react32.useState)(false);
+  (0, import_react32.useEffect)(() => {
     let live = true;
     setOptionsError(null);
     sharing.secureLinkOptions(item).then(
@@ -6409,7 +6479,7 @@ function SecureLinkPanel({ item, port, onClose }) {
       live = false;
     };
   }, [sharing, item]);
-  (0, import_react31.useEffect)(() => {
+  (0, import_react32.useEffect)(() => {
     const list = sharing.sentSecureLinks;
     if (!list) return;
     let live = true;
@@ -6422,9 +6492,9 @@ function SecureLinkPanel({ item, port, onClose }) {
       live = false;
     };
   }, [sharing, item, nonce]);
-  const [phoneTyped, setPhoneTyped] = (0, import_react31.useState)(false);
-  const prefilled = (0, import_react31.useRef)(false);
-  (0, import_react31.useEffect)(() => {
+  const [phoneTyped, setPhoneTyped] = (0, import_react32.useState)(false);
+  const prefilled = (0, import_react32.useRef)(false);
+  (0, import_react32.useEffect)(() => {
     const lookup = sharing.phoneOnFile;
     if (!lookup || phoneTyped) return;
     const clear = () => {
@@ -6578,7 +6648,7 @@ function sentMeta(row, options) {
 }
 
 // src/devices/DevicesPanel.tsx
-var import_react32 = require("react");
+var import_react33 = require("react");
 var import_confirm_opener11 = require("@ai-matrx/kit/confirm-opener");
 var import_controls27 = require("@ai-matrx/design-system/controls");
 
@@ -6668,10 +6738,10 @@ function ErrorLine2({ text }) {
 function DevicesPanel({ port, onClose }) {
   const confirmed = useConfirmed();
   const notify = useNotify();
-  const [devices, setDevices] = (0, import_react32.useState)(null);
-  const [error, setError] = (0, import_react32.useState)(null);
-  const [busyId, setBusyId] = (0, import_react32.useState)(null);
-  const load = (0, import_react32.useCallback)(async () => {
+  const [devices, setDevices] = (0, import_react33.useState)(null);
+  const [error, setError] = (0, import_react33.useState)(null);
+  const [busyId, setBusyId] = (0, import_react33.useState)(null);
+  const load = (0, import_react33.useCallback)(async () => {
     setError(null);
     try {
       setDevices(await port.devices.list());
@@ -6679,7 +6749,7 @@ function DevicesPanel({ port, onClose }) {
       setError(messageOf3(e, "Your browsers could not be read."));
     }
   }, [port]);
-  (0, import_react32.useEffect)(() => {
+  (0, import_react33.useEffect)(() => {
     void load();
   }, [load]);
   const revoke = async (device) => {
@@ -6737,11 +6807,11 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
   const where = isMac ? "the Mac app" : "the extension";
   const passkeys = port.devices.passkeys;
   const here = passkeys?.available() ?? false;
-  const [methods, setMethods] = (0, import_react32.useState)(null);
-  const [busy, setBusy] = (0, import_react32.useState)(null);
-  const [error, setError] = (0, import_react32.useState)(null);
-  const [approvedUntil, setApprovedUntil] = (0, import_react32.useState)(null);
-  const load = (0, import_react32.useCallback)(async () => {
+  const [methods, setMethods] = (0, import_react33.useState)(null);
+  const [busy, setBusy] = (0, import_react33.useState)(null);
+  const [error, setError] = (0, import_react33.useState)(null);
+  const [approvedUntil, setApprovedUntil] = (0, import_react33.useState)(null);
+  const load = (0, import_react33.useCallback)(async () => {
     setError(null);
     try {
       setMethods(await port.devices.stepUpMethods());
@@ -6749,7 +6819,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
       setError(messageOf3(e, "Your account could not be checked."));
     }
   }, [port]);
-  (0, import_react32.useEffect)(() => {
+  (0, import_react33.useEffect)(() => {
     if (key && here) void load();
   }, [key, here, load]);
   const approve = async () => {
@@ -6837,7 +6907,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
 }
 
 // src/native/NativeImportPanel.tsx
-var import_react34 = require("react");
+var import_react35 = require("react");
 var import_confirm_opener12 = require("@ai-matrx/kit/confirm-opener");
 var import_controls28 = require("@ai-matrx/design-system/controls");
 
@@ -6900,19 +6970,19 @@ async function loadFullPreview(bridge, operationId, current) {
 }
 
 // src/native/use-native-import.ts
-var import_react33 = require("react");
+var import_react34 = require("react");
 var fail = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 var RESTART = "Your account changed. The import was stopped; start it again.";
 function useNativeImport(bridge, stillAllowed, onImported) {
-  const [screen, setScreen] = (0, import_react33.useState)({ kind: "idle", message: null });
-  const [busy, setBusy] = (0, import_react33.useState)(false);
-  const generation = (0, import_react33.useRef)(0);
-  const mounted = (0, import_react33.useRef)(false);
-  const op = (0, import_react33.useRef)(null);
-  const last = (0, import_react33.useRef)(null);
-  const timer2 = (0, import_react33.useRef)(null);
-  const polls = (0, import_react33.useRef)(0);
-  const refreshRef = (0, import_react33.useRef)(async () => void 0);
+  const [screen, setScreen] = (0, import_react34.useState)({ kind: "idle", message: null });
+  const [busy, setBusy] = (0, import_react34.useState)(false);
+  const generation = (0, import_react34.useRef)(0);
+  const mounted = (0, import_react34.useRef)(false);
+  const op = (0, import_react34.useRef)(null);
+  const last = (0, import_react34.useRef)(null);
+  const timer2 = (0, import_react34.useRef)(null);
+  const polls = (0, import_react34.useRef)(0);
+  const refreshRef = (0, import_react34.useRef)(async () => void 0);
   const current = (g) => mounted.current && g === generation.current;
   const stopPolling = () => {
     if (timer2.current !== null) clearTimeout(timer2.current);
@@ -7081,9 +7151,9 @@ function useNativeImport(bridge, stillAllowed, onImported) {
     setBusy(false);
     setScreen({ kind: "idle", message: null });
   };
-  const invalidateRef = (0, import_react33.useRef)(invalidate);
+  const invalidateRef = (0, import_react34.useRef)(invalidate);
   invalidateRef.current = invalidate;
-  (0, import_react33.useEffect)(() => {
+  (0, import_react34.useEffect)(() => {
     mounted.current = true;
     const off = bridge.subscribe?.(() => {
       if (op.current) invalidateRef.current(RESTART);
@@ -7115,14 +7185,14 @@ function NativeImportPanel({ bridge, readLimits, activeOrganizationId, organizat
   return /* @__PURE__ */ (0, import_jsx_runtime33.jsx)(Importer, { bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged });
 }
 function Importer({ bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged }) {
-  const options = (0, import_react34.useMemo)(() => organizations.map((o) => ({ value: o.id, label: o.name })), [organizations]);
-  const [organizationId, setOrganizationId] = (0, import_react34.useState)(() => organizations.some((o) => o.id === activeOrganizationId) ? activeOrganizationId : organizations[0]?.id ?? "");
-  const [limits, setLimits] = (0, import_react34.useState)(null);
-  const [limitError, setLimitError] = (0, import_react34.useState)(null);
+  const options = (0, import_react35.useMemo)(() => organizations.map((o) => ({ value: o.id, label: o.name })), [organizations]);
+  const [organizationId, setOrganizationId] = (0, import_react35.useState)(() => organizations.some((o) => o.id === activeOrganizationId) ? activeOrganizationId : organizations[0]?.id ?? "");
+  const [limits, setLimits] = (0, import_react35.useState)(null);
+  const [limitError, setLimitError] = (0, import_react35.useState)(null);
   const flow = useNativeImport(bridge, (id) => organizations.some((o) => o.id === id), onChanged);
   const { screen, busy } = flow;
   const orgName = organizations.find((o) => o.id === organizationId)?.name ?? "this organization";
-  (0, import_react34.useEffect)(() => {
+  (0, import_react35.useEffect)(() => {
     if (!readLimits || !organizationId) return;
     let live = true;
     setLimits(null);
@@ -7183,20 +7253,20 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
 }
 
 // src/extension/PageView.tsx
-var import_react38 = require("react");
+var import_react39 = require("react");
 var import_design_system23 = require("@ai-matrx/design-system");
 var import_controls32 = require("@ai-matrx/design-system/controls");
 
 // src/extension/CaptureCard.tsx
-var import_react35 = require("react");
+var import_react36 = require("react");
 var import_controls29 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime34 = require("react/jsx-runtime");
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
-  const prompt = (0, import_react35.useSyncExternalStore)(capture.subscribe, capture.get, capture.get);
+  const prompt = (0, import_react36.useSyncExternalStore)(capture.subscribe, capture.get, capture.get);
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react35.useState)(false);
-  const [q, setQ] = (0, import_react35.useState)("");
+  const [busy, setBusy] = (0, import_react36.useState)(false);
+  const [q, setQ] = (0, import_react36.useState)("");
   if (!prompt) return null;
   const decide = async (d) => {
     setBusy(true);
@@ -7252,15 +7322,15 @@ function CaptureCard({ capture, onChanged }) {
 }
 
 // src/extension/FillSetupCard.tsx
-var import_react36 = require("react");
+var import_react37 = require("react");
 var import_controls30 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime35 = require("react/jsx-runtime");
 function FillSetupCard({ fillSetup }) {
   const notify = useNotify();
-  const state = (0, import_react36.useSyncExternalStore)(fillSetup.subscribe, fillSetup.get, fillSetup.get);
-  const box = (0, import_react36.useRef)(null);
-  const [busy, setBusy] = (0, import_react36.useState)(false);
-  const [error, setError] = (0, import_react36.useState)(null);
+  const state = (0, import_react37.useSyncExternalStore)(fillSetup.subscribe, fillSetup.get, fillSetup.get);
+  const box = (0, import_react37.useRef)(null);
+  const [busy, setBusy] = (0, import_react37.useState)(false);
+  const [error, setError] = (0, import_react37.useState)(null);
   if (state.status !== "off") return null;
   const finish = async (run) => {
     setBusy(true);
@@ -7325,7 +7395,7 @@ function FillSetupCard({ fillSetup }) {
 }
 
 // src/extension/PageGenerator.tsx
-var import_react37 = require("react");
+var import_react38 = require("react");
 var import_design_system22 = require("@ai-matrx/design-system");
 var import_controls31 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime36 = require("react/jsx-runtime");
@@ -7334,10 +7404,10 @@ function PageGenerator({ fields }) {
   const limits = useGeneratorLimitsSource();
   const copy = useCopy();
   const held = useTransientSecret(HOLD_MS);
-  const [open, setOpen] = (0, import_react37.useState)(false);
-  const [busy, setBusy] = (0, import_react37.useState)(false);
-  const [targets, setTargets] = (0, import_react37.useState)([]);
-  const [said, setSaid] = (0, import_react37.useState)(null);
+  const [open, setOpen] = (0, import_react38.useState)(false);
+  const [busy, setBusy] = (0, import_react38.useState)(false);
+  const [targets, setTargets] = (0, import_react38.useState)([]);
+  const [said, setSaid] = (0, import_react38.useState)(null);
   if (!limits) return null;
   const say3 = setSaid;
   const put = async (targetId, value2) => {
@@ -7401,8 +7471,8 @@ function PageGenerator({ fields }) {
 // src/extension/PageView.tsx
 var import_jsx_runtime37 = require("react/jsx-runtime");
 function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, items, definitions, onOpen, onNewForPage, onBrowse, onChanged, header }) {
-  const [running, setRunning] = (0, import_react38.useState)(null);
-  const [said, setSaid] = (0, import_react38.useState)(null);
+  const [running, setRunning] = (0, import_react39.useState)(null);
+  const [said, setSaid] = (0, import_react39.useState)(null);
   const site = pageSite(page.url);
   const state = page.matchState ?? { status: "ready" };
   const fillable = new Set(page.fillableItemIds ?? page.matchingItemIds);
@@ -7456,7 +7526,7 @@ function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, ite
   return /* @__PURE__ */ (0, import_jsx_runtime37.jsx)("div", { className: "flex h-full min-h-0 flex-col overflow-y-auto bg-background text-foreground", children: /* @__PURE__ */ (0, import_jsx_runtime37.jsxs)("div", { className: "flex flex-col gap-3 px-3 pb-4 pt-3", children: [
     header,
     /* @__PURE__ */ (0, import_jsx_runtime37.jsxs)("div", { className: "flex min-h-7 items-center gap-2 px-1", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime37.jsx)(GlobeGlyph, { className: "size-4 shrink-0 text-muted-foreground" }),
+      /* @__PURE__ */ (0, import_jsx_runtime37.jsx)(import_design_system23.SiteIcon, { site: page.url, fallback: GlobeGlyph, className: "size-4" }),
       /* @__PURE__ */ (0, import_jsx_runtime37.jsx)("span", { className: "min-w-0 flex-1 truncate text-sm font-medium", title: page.url, children: site || "No page open" }),
       page.refresh ? /* @__PURE__ */ (0, import_jsx_runtime37.jsx)(import_controls32.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime37.jsx)(RefreshGlyph, {}), "aria-label": "Check again", onClick: page.refresh }) : null,
       onBrowse ? /* @__PURE__ */ (0, import_jsx_runtime37.jsx)(import_controls32.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime37.jsx)(ListGlyph, {}), onClick: onBrowse, children: "All items" }) : null
@@ -7486,7 +7556,7 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
-  const [reading, setReading] = (0, import_react38.useState)(false);
+  const [reading, setReading] = (0, import_react39.useState)(false);
   const usable = item?.capabilities.canUse ?? false;
   const user = usable ? item?.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed" && f.active) : void 0;
   const secret = usable && item?.capabilities.canReveal ? item?.fields.find((f) => f.key === "password" && f.handling === "revealable" && f.active) : void 0;
@@ -7531,7 +7601,7 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
 }
 
 // src/Sidebar.tsx
-var import_react39 = require("react");
+var import_react40 = require("react");
 var import_design_system24 = require("@ai-matrx/design-system");
 var import_controls33 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime38 = require("react/jsx-runtime");
@@ -7614,7 +7684,7 @@ function Group({ title, children }) {
   ] });
 }
 function Sidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false }) {
-  const [tagsOpen, setTagsOpen] = (0, import_react39.useState)(view.startsWith("tag:"));
+  const [tagsOpen, setTagsOpen] = (0, import_react40.useState)(view.startsWith("tag:"));
   return /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)("nav", { "aria-label": "Vault", className: "flex h-full min-h-0 flex-col border-r border-sidebar-border bg-sidebar-background text-sidebar-foreground", children: [
     /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)("div", { className: "flex items-center gap-2 px-3 pb-2 pt-3", children: [
       /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(SafeGlyph, { className: "size-5 shrink-0 text-primary" }),
@@ -7674,8 +7744,8 @@ var generatorLimitsFrom = (knobs) => knobs ? async () => {
 } : void 0;
 function ImportWithLimits(props) {
   const { knobs, ...rest } = props;
-  const [state, setState] = (0, import_react40.useState)(null);
-  (0, import_react40.useEffect)(() => {
+  const [state, setState] = (0, import_react41.useState)(null);
+  (0, import_react41.useEffect)(() => {
     if (!knobs) return setState({ error: "Import is not set up for this organization yet." });
     knobs().then(
       (r) => {
@@ -7692,31 +7762,55 @@ function ImportWithLimits(props) {
   return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
 }
 function VaultApp(props) {
-  return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(NoticeProvider, { notify: props.notify, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Workspace, { ...props }) }) }) }) });
+  const lock = props.host?.lock;
+  const locked = useLocked(lock);
+  const port = (0, import_react41.useMemo)(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
+  return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(LockedScreen, { lock }) : /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Workspace, { ...props, port }) }) }) }) }) }) });
+}
+function LockedScreen({ lock }) {
+  const [busy, setBusy] = (0, import_react41.useState)(false);
+  const [error, setError] = (0, import_react41.useState)(null);
+  const unlock = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      await lock.unlock();
+    } catch (e) {
+      setError(e instanceof Error && e.message ? e.message : "The vault stayed locked.");
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("div", { role: "region", "aria-label": "Vault locked", className: "flex h-full min-h-0 flex-col items-center justify-center gap-3 p-6 text-center", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(LockGlyph, { className: "size-8 text-muted-foreground" }),
+    /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: "text-base font-medium text-foreground", children: "Vault locked" }),
+    /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_controls34.Button, { variant: "primary", disabled: busy, onClick: () => void unlock(), children: lock.unlockLabel ?? "Unlock" }),
+    error ? /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { role: "alert", className: "max-w-sm text-sm text-destructive", children: error }) : null
+  ] });
 }
 function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocationChange }) {
-  const rootRef = (0, import_react40.useRef)(null);
+  const rootRef = (0, import_react41.useRef)(null);
   const width = useElementWidth(rootRef);
   const mode = layout !== "auto" ? layout : width >= FULL_AT ? "full" : width >= SPLIT_AT ? "split" : "stack";
   const notify = useNotify();
-  const [snap, setSnap] = (0, import_react40.useState)(null);
-  const [items, setItems] = (0, import_react40.useState)([]);
-  const [deleted, setDeleted] = (0, import_react40.useState)([]);
-  const [favorites, setFavorites] = (0, import_react40.useState)(null);
-  const [recents, setRecents] = (0, import_react40.useState)(null);
-  const [error, setError] = (0, import_react40.useState)(null);
-  const [inner, setInner] = (0, import_react40.useState)(DEFAULT_LOCATION);
+  const [snap, setSnap] = (0, import_react41.useState)(null);
+  const [items, setItems] = (0, import_react41.useState)([]);
+  const [deleted, setDeleted] = (0, import_react41.useState)([]);
+  const [favorites, setFavorites] = (0, import_react41.useState)(null);
+  const [recents, setRecents] = (0, import_react41.useState)(null);
+  const [error, setError] = (0, import_react41.useState)(null);
+  const [inner, setInner] = (0, import_react41.useState)(DEFAULT_LOCATION);
   const loc = location ?? inner;
-  const dirty = (0, import_react40.useRef)(false);
-  const [notice, setNotice] = (0, import_react40.useState)(null);
-  const move = (0, import_react40.useCallback)(
+  const dirty = (0, import_react41.useRef)(false);
+  const [notice, setNotice] = (0, import_react41.useState)(null);
+  const move = (0, import_react41.useCallback)(
     (next, how) => {
       if (!location) setInner(next);
       onLocationChange?.(next, how);
     },
     [location, onLocationChange]
   );
-  const go = (0, import_react40.useCallback)(
+  const go = (0, import_react41.useCallback)(
     (patch, how = "push") => {
       const leaving = patch.itemId !== void 0 || patch.mode !== void 0 || patch.vault !== void 0 || patch.view !== void 0;
       const next = { ...loc, ...patch };
@@ -7735,9 +7829,9 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     },
     [loc, move]
   );
-  const knobsRef = (0, import_react40.useRef)(host.knobs);
+  const knobsRef = (0, import_react41.useRef)(host.knobs);
   knobsRef.current = host.knobs;
-  const load = (0, import_react40.useCallback)(() => {
+  const load = (0, import_react41.useCallback)(() => {
     setError(null);
     port.load().then((s) => {
       setSnap(s);
@@ -7752,17 +7846,17 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     knobsRef.current?.().catch(() => void 0);
     port.lists.recents?.list().then(setRecents, () => void 0);
   }, [port]);
-  (0, import_react40.useEffect)(load, [load]);
-  (0, import_react40.useEffect)(() => {
+  (0, import_react41.useEffect)(load, [load]);
+  (0, import_react41.useEffect)(() => {
     if (!loc.itemId || !port.lists.recents) return;
     const id = loc.itemId;
     port.lists.recents.record(id).then(() => setRecents((r) => [id, ...(r ?? []).filter((x) => x !== id)]), () => void 0);
   }, [loc.itemId, port]);
   const orgs = snap?.organizations ?? [];
   const definitions = snap?.definitions ?? [];
-  const inThisVault = (0, import_react40.useMemo)(() => items.filter((i) => inVault(i, loc.vault)), [items, loc.vault]);
-  const views = (0, import_react40.useMemo)(() => buildViews(inThisVault, definitions, favorites, recents), [inThisVault, definitions, favorites, recents]);
-  const visible = (0, import_react40.useMemo)(() => {
+  const inThisVault = (0, import_react41.useMemo)(() => items.filter((i) => inVault(i, loc.vault)), [items, loc.vault]);
+  const views = (0, import_react41.useMemo)(() => buildViews(inThisVault, definitions, favorites, recents), [inThisVault, definitions, favorites, recents]);
+  const visible = (0, import_react41.useMemo)(() => {
     const filtered = inThisVault.filter((i) => {
       if (!matchesQuery(i, loc.q)) return false;
       if (loc.view === "favorites") return favorites?.has(i.id) ?? false;
@@ -7773,8 +7867,8 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     if (loc.view === "recent" && recents) return [...filtered].sort((a, b) => recents.indexOf(a.id) - recents.indexOf(b.id));
     return sortItems(filtered, loc.sort);
   }, [inThisVault, loc.view, loc.q, loc.sort, favorites, recents, definitions]);
-  const choices = (0, import_react40.useMemo)(() => vaultChoices(items, orgs, loc.vault), [items, orgs, loc.vault]);
-  const matchingIds = (0, import_react40.useMemo)(() => host.page ? new Set(host.page.matchingItemIds) : void 0, [host.page]);
+  const choices = (0, import_react41.useMemo)(() => vaultChoices(items, orgs, loc.vault), [items, orgs, loc.vault]);
+  const matchingIds = (0, import_react41.useMemo)(() => host.page ? new Set(host.page.matchingItemIds) : void 0, [host.page]);
   const selected = loc.itemId ? items.find((i) => i.id === loc.itemId) ?? null : null;
   const replaceItem = (next) => setItems((cur) => cur.some((i) => i.id === next.id) ? cur.map((i) => i.id === next.id ? next : i) : [...cur, next]);
   const toggleFavorite = (id) => {
@@ -7845,6 +7939,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)(import_design_system25.DropdownMenuItem, { onSelect: host.nativeProvider.openSetup, children: [
           /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(ShieldGlyph, { className: "size-4" }),
           "System AutoFill"
+        ] }) : null,
+        host.lock?.lock ? /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)(import_design_system25.DropdownMenuItem, { onSelect: () => void host.lock?.lock?.(), children: [
+          /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(LockGlyph, { className: "size-4" }),
+          "Lock"
         ] }) : null
       ] })
     ] })