@ai-matrx/vault 0.1.5 → 0.1.6

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.1.6
+### Unreleased
+
+- Host-held lock: `host.lock` (`VaultLock`: `locked`, `subscribe`, `unlock`, optional `lock` and
+  `unlockLabel`). While locked the vault shows only "Vault locked" with Unlock, and every port call
+  (areas included) is refused at call time (`guardPort`, `VaultLockedError`). "Lock" joins the
+  vault menu when the host can lock on demand.
+- Host clipboard custody: `host.clipboard` (`VaultClipboard.copy(text, { secret })`). Every copy goes
+  through it; secrets (passwords, codes, keys, revealable fields) carry `secret: true` so the host
+  can clear them later; a website or a visible username carries `secret: false`.
+- `host.revealSeconds`: how long a shown value stays shown (default 20 s).
+- Without these the web app and extension behave exactly as before.
+
+### Consumer action
+
+- None for the web app and extension. The desktop app passes `lock`, `clipboard` and `revealSeconds`.
+
 ## 0.1.5
 ### Unreleased
 
@@ -56,3 +73,4 @@ extension's vault side panel and the desktop's vault import.
 - Vite hosts: `optimizeDeps.exclude: ["@ai-matrx/vault"]` (keeps the import workers' URLs).
 - Delete the host's own vault screens and client once adopted (no twins).
 
+

package/README.md

@@ -26,7 +26,7 @@ const host = {
   sort, item, edit/new, the open panel.
 - **Extension**: pass `page`, `fill`, `capture`, `fillSetup`, `newPasswordFields` (types in
   `extension/host.ts`) and start at `view=page`.
-- **Desktop**: pass `nativeProvider` and `nativeImport`.
+- **Desktop**: pass `nativeProvider` and `nativeImport`; a host that holds its own lock and clipboard passes `lock` (locked screen, every port call refused while locked), `clipboard` (copies go through it; `secret: true` = the host clears it later) and `revealSeconds`.
 - **Styling**: Tailwind utilities on the design-system tokens — add `@source "…/node_modules/@ai-matrx/vault/dist"` to the host stylesheet.
 - **Workers**: the import parsers run in module workers at `dist/io/*.worker.js` (`new Worker(new URL(…, import.meta.url))`). A Vite host excludes the package from dependency pre-bundling (`optimizeDeps.exclude: ["@ai-matrx/vault"]`) so the URLs stay intact.