@ai-matrx/vault 0.1.5 → 0.1.6

package/dist/index.d.cts

@@ -147,9 +147,6 @@ interface ItemDraft {
     authenticator: string;
 }
 
-type NoticeKind = "success" | "error" | "info";
-type Notify = (message: string, kind?: NoticeKind) => void;
-
 /** One recorded earlier value of a secret field. Value-free: the value comes only from `revealHistory`. */
 interface HistoryEntry {
     fieldId: string;
@@ -1096,7 +1093,8 @@ interface VaultPort {
  * What only some hosts can do. A missing capability hides its control; it never shows a dead one.
  * - Every host with a signed-in person supplies `identity` (confirm it's you before a secret shows).
  * - The browser extension supplies `page` (the tab's address, the logins that match it) and `fill`.
- * - The desktop app supplies `nativeProvider` (the system credential provider's state).
+ * - The desktop app supplies `nativeProvider` (the system credential provider's state), and its own
+ *   `lock`, `clipboard` custody and `revealSeconds`.
  */
 interface VaultHostCapabilities {
     identity?: VaultIdentity;
@@ -1114,12 +1112,71 @@ interface VaultHostCapabilities {
     /** Desktop: the native passkey importer (file chooser, parsing and keys stay native). */
     nativeImport?: NativeImportBridge;
     openUrl?: (url: string) => void;
+    /** A lock the host holds (`lock.ts`): while locked the vault shows Unlock and refuses every port call. */
+    lock?: VaultLock;
+    /** The host's clipboard: every copy goes through it; a secret is the host's to clear (`lock.ts`). */
+    clipboard?: VaultClipboard;
+    /** How long a shown value stays shown, in seconds (an organization knob the host reads); default 20. */
+    revealSeconds?: number;
     nativeProvider?: {
         status: "ready" | "needs_setup" | "unavailable";
         openSetup: () => void;
     };
 }
 
+/**
+ * A HOST-HELD LOCK. Some hosts lock the vault themselves (the desktop app: Touch ID, starts locked,
+ * locks after idle, on sleep and on screen lock). The host owns the lock and enforces it on its own
+ * side; the vault shows a locked screen with Unlock, and while locked refuses every port call — a
+ * value never reaches a screen while the host says locked. Without `lock` nothing changes.
+ */
+interface VaultLock {
+    /** Locked right now. */
+    locked(): boolean;
+    /** Told on every change; returns the unsubscribe. */
+    subscribe(listener: () => void): () => void;
+    /** Ask the host to unlock (Touch ID, a click…). Rejects with a sentence a person can act on. */
+    unlock(): Promise<void>;
+    /** Lock now. When given, the vault offers "Lock". */
+    lock?: () => void | Promise<void>;
+    /** The unlock button's words ("Unlock with Touch ID"); default "Unlock". */
+    unlockLabel?: string;
+}
+/**
+ * HOST CLIPBOARD CUSTODY. When given, every copy in the vault goes through the host. `secret` asks
+ * the host to take custody: clear it after a while if it is still there, and on lock or quit.
+ */
+interface VaultClipboard {
+    copy(text: string, how: {
+        secret: boolean;
+    }): Promise<void>;
+}
+declare const LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
+declare class VaultLockedError extends Error {
+    readonly code = "vault_locked";
+    constructor();
+}
+/**
+ * The port with every method (areas included) refused while `locked()` says so. The check runs at
+ * call time, so a screen still mounted when the lock lands cannot read a value.
+ */
+declare function guardPort(port: VaultPort, locked: () => boolean): VaultPort;
+
+type NoticeKind = "success" | "error" | "info";
+type Notify = (message: string, kind?: NoticeKind) => void;
+interface CopyOptions {
+    /** A secret (a password, a code, a key): the host's clipboard takes custody. Default true. */
+    secret?: boolean;
+}
+/**
+ * Writes `text` and says so (or says why not). Through the host's clipboard when it has one (custody:
+ * the host clears a secret later), else the browser's. Pure over its inputs, so it is tested alone.
+ */
+declare function copyValue(text: string, label: string, options: CopyOptions, deps: {
+    clipboard?: VaultClipboard | undefined;
+    notify: Notify;
+}): Promise<boolean>;
+
 type VaultLayout = "auto" | "full" | "split" | "stack";
 interface VaultAppProps {
     port: VaultPort;
@@ -1183,4 +1240,4 @@ declare function GenerateButton({ onUse, label, limits, disabled }: {
     disabled?: boolean;
 }): react.JSX.Element | null;
 
-export { type ApiVaultPortOptions, CATEGORIES, type CategoryId, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, type IdentityAccount, type IdentityMethod, type ItemDraft, type NoticeKind, type Notify, type SaveResult, type SupabaseAuthLike, type TotpReading, type UriMatchMode, type UrlGuess, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, inferFromUrl, locationFromParams, locationToParams, matchesQuery, needsRecentSignIn, parseDefinitions, siteOf, sortItems };
+export { type ApiVaultPortOptions, CATEGORIES, type CategoryId, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, type IdentityAccount, type IdentityMethod, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, type SaveResult, type SupabaseAuthLike, type TotpReading, type UriMatchMode, type UrlGuess, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copyValue, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, guardPort, inferFromUrl, locationFromParams, locationToParams, matchesQuery, needsRecentSignIn, parseDefinitions, siteOf, sortItems };

package/dist/index.d.ts

@@ -147,9 +147,6 @@ interface ItemDraft {
     authenticator: string;
 }
 
-type NoticeKind = "success" | "error" | "info";
-type Notify = (message: string, kind?: NoticeKind) => void;
-
 /** One recorded earlier value of a secret field. Value-free: the value comes only from `revealHistory`. */
 interface HistoryEntry {
     fieldId: string;
@@ -1096,7 +1093,8 @@ interface VaultPort {
  * What only some hosts can do. A missing capability hides its control; it never shows a dead one.
  * - Every host with a signed-in person supplies `identity` (confirm it's you before a secret shows).
  * - The browser extension supplies `page` (the tab's address, the logins that match it) and `fill`.
- * - The desktop app supplies `nativeProvider` (the system credential provider's state).
+ * - The desktop app supplies `nativeProvider` (the system credential provider's state), and its own
+ *   `lock`, `clipboard` custody and `revealSeconds`.
  */
 interface VaultHostCapabilities {
     identity?: VaultIdentity;
@@ -1114,12 +1112,71 @@ interface VaultHostCapabilities {
     /** Desktop: the native passkey importer (file chooser, parsing and keys stay native). */
     nativeImport?: NativeImportBridge;
     openUrl?: (url: string) => void;
+    /** A lock the host holds (`lock.ts`): while locked the vault shows Unlock and refuses every port call. */
+    lock?: VaultLock;
+    /** The host's clipboard: every copy goes through it; a secret is the host's to clear (`lock.ts`). */
+    clipboard?: VaultClipboard;
+    /** How long a shown value stays shown, in seconds (an organization knob the host reads); default 20. */
+    revealSeconds?: number;
     nativeProvider?: {
         status: "ready" | "needs_setup" | "unavailable";
         openSetup: () => void;
     };
 }
 
+/**
+ * A HOST-HELD LOCK. Some hosts lock the vault themselves (the desktop app: Touch ID, starts locked,
+ * locks after idle, on sleep and on screen lock). The host owns the lock and enforces it on its own
+ * side; the vault shows a locked screen with Unlock, and while locked refuses every port call — a
+ * value never reaches a screen while the host says locked. Without `lock` nothing changes.
+ */
+interface VaultLock {
+    /** Locked right now. */
+    locked(): boolean;
+    /** Told on every change; returns the unsubscribe. */
+    subscribe(listener: () => void): () => void;
+    /** Ask the host to unlock (Touch ID, a click…). Rejects with a sentence a person can act on. */
+    unlock(): Promise<void>;
+    /** Lock now. When given, the vault offers "Lock". */
+    lock?: () => void | Promise<void>;
+    /** The unlock button's words ("Unlock with Touch ID"); default "Unlock". */
+    unlockLabel?: string;
+}
+/**
+ * HOST CLIPBOARD CUSTODY. When given, every copy in the vault goes through the host. `secret` asks
+ * the host to take custody: clear it after a while if it is still there, and on lock or quit.
+ */
+interface VaultClipboard {
+    copy(text: string, how: {
+        secret: boolean;
+    }): Promise<void>;
+}
+declare const LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
+declare class VaultLockedError extends Error {
+    readonly code = "vault_locked";
+    constructor();
+}
+/**
+ * The port with every method (areas included) refused while `locked()` says so. The check runs at
+ * call time, so a screen still mounted when the lock lands cannot read a value.
+ */
+declare function guardPort(port: VaultPort, locked: () => boolean): VaultPort;
+
+type NoticeKind = "success" | "error" | "info";
+type Notify = (message: string, kind?: NoticeKind) => void;
+interface CopyOptions {
+    /** A secret (a password, a code, a key): the host's clipboard takes custody. Default true. */
+    secret?: boolean;
+}
+/**
+ * Writes `text` and says so (or says why not). Through the host's clipboard when it has one (custody:
+ * the host clears a secret later), else the browser's. Pure over its inputs, so it is tested alone.
+ */
+declare function copyValue(text: string, label: string, options: CopyOptions, deps: {
+    clipboard?: VaultClipboard | undefined;
+    notify: Notify;
+}): Promise<boolean>;
+
 type VaultLayout = "auto" | "full" | "split" | "stack";
 interface VaultAppProps {
     port: VaultPort;
@@ -1183,4 +1240,4 @@ declare function GenerateButton({ onUse, label, limits, disabled }: {
     disabled?: boolean;
 }): react.JSX.Element | null;
 
-export { type ApiVaultPortOptions, CATEGORIES, type CategoryId, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, type IdentityAccount, type IdentityMethod, type ItemDraft, type NoticeKind, type Notify, type SaveResult, type SupabaseAuthLike, type TotpReading, type UriMatchMode, type UrlGuess, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, inferFromUrl, locationFromParams, locationToParams, matchesQuery, needsRecentSignIn, parseDefinitions, siteOf, sortItems };
+export { type ApiVaultPortOptions, CATEGORIES, type CategoryId, type CopyOptions, DEFAULT_LOCATION, type DefinitionField, type FieldHandling, type FieldKind, GenerateButton, type IdentityAccount, type IdentityMethod, type ItemDraft, LOCKED_MESSAGE, type NoticeKind, type Notify, type SaveResult, type SupabaseAuthLike, type TotpReading, type UriMatchMode, type UrlGuess, VaultApp, type VaultAppProps, type VaultAttachment, type VaultAuthenticator, type VaultClipboard, type VaultCustomField, type VaultDefinition, type VaultField, type VaultHostCapabilities, type VaultIdentity, type VaultItem, type VaultItemCapabilities, type VaultKnobs, type VaultLayout, type VaultLocation, type VaultLock, VaultLockedError, type VaultOrganizationRef, type VaultOwner, type VaultPort, type VaultSelection, type VaultSnapshot, type VaultSort, type VaultUserStateDoor, categoryOf, copyValue, createApiVaultPort, createSupabaseIdentity, createVaultKnobs, guardPort, inferFromUrl, locationFromParams, locationToParams, matchesQuery, needsRecentSignIn, parseDefinitions, siteOf, sortItems };

package/dist/index.js

@@ -115,9 +115,28 @@ var Ctx = createContext(() => void 0);
 function useNotify() {
   return useContext(Ctx);
 }
+async function copyValue(text, label, options, deps) {
+  const secret = options.secret ?? true;
+  if (deps.clipboard) {
+    try {
+      await deps.clipboard.copy(text, { secret });
+      deps.notify(`${label} copied`, "success");
+      return true;
+    } catch (e) {
+      deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, "error");
+      return false;
+    }
+  }
+  return copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === "error" ? "error" : "success") });
+}
+var ClipboardCtx = createContext(void 0);
+function ClipboardProvider({ clipboard, children }) {
+  return /* @__PURE__ */ jsx(ClipboardCtx.Provider, { value: clipboard, children });
+}
 function useCopy() {
   const notify = useNotify();
-  return useCallback((text, label) => copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => notify(m, k === "error" ? "error" : "success") }), [notify]);
+  const clipboard = useContext(ClipboardCtx);
+  return useCallback((text, label, options = {}) => copyValue(text, label, options, { clipboard, notify }), [notify, clipboard]);
 }
 function NoticeProvider({ notify, children }) {
   const [shown, setShown] = useState(null);
@@ -494,8 +513,16 @@ import { Badge, Button as Button2, Field as Field2, Textarea } from "@ai-matrx/d
 import { cn as cn3 } from "@ai-matrx/design-system";
 
 // src/hooks.ts
-import { useCallback as useCallback2, useEffect as useEffect3, useLayoutEffect, useRef as useRef3, useState as useState3 } from "react";
-function useTransientSecret(ms = 2e4) {
+import { createContext as createContext3, createElement, useCallback as useCallback2, useContext as useContext3, useEffect as useEffect3, useLayoutEffect, useRef as useRef3, useState as useState3 } from "react";
+var DEFAULT_REVEAL_MS = 2e4;
+var RevealMs = createContext3(DEFAULT_REVEAL_MS);
+function RevealSecondsProvider({ seconds, children }) {
+  const ms = seconds !== void 0 && Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : DEFAULT_REVEAL_MS;
+  return createElement(RevealMs.Provider, { value: ms }, children);
+}
+function useTransientSecret(given) {
+  const fromHost = useContext3(RevealMs);
+  const ms = given ?? fromHost;
   const [value, setValue] = useState3(null);
   const timer2 = useRef3(null);
   const clear = useCallback2(() => {
@@ -531,12 +558,12 @@ function useElementWidth(ref) {
 }
 
 // src/ui.tsx
-import { createContext as createContext3, useContext as useContext3, useEffect as useEffect4, useState as useState4 } from "react";
+import { createContext as createContext4, useContext as useContext4, useEffect as useEffect4, useState as useState4 } from "react";
 import { Dialog as Dialog2, DialogContent as DialogContent2, DialogFooter, DialogHeader as DialogHeader2, DialogTitle as DialogTitle2 } from "@ai-matrx/design-system";
 import { cn as cn2 } from "@ai-matrx/design-system";
 import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
-var InPanel = createContext3(false);
-var Room = createContext3(null);
+var InPanel = createContext4(false);
+var Room = createContext4(null);
 var ROOMY_AT = 560;
 function useRoomOf(ref) {
   const [room, setRoom] = useState4(null);
@@ -553,7 +580,7 @@ function useRoomOf(ref) {
 }
 var RoomProvider = Room.Provider;
 function Section({ title, actions, children, className }) {
-  const flat = useContext3(InPanel);
+  const flat = useContext4(InPanel);
   return /* @__PURE__ */ jsxs4("section", { className: cn2("flex flex-col gap-1.5", className), children: [
     title || actions ? /* @__PURE__ */ jsxs4("div", { className: "flex min-h-7 items-center justify-between gap-2 px-1", children: [
       title ? /* @__PURE__ */ jsx4("h3", { className: "text-xs font-medium text-muted-foreground", children: title }) : /* @__PURE__ */ jsx4("span", {}),
@@ -568,7 +595,7 @@ var ROW_GRID = {
   viewport: "grid-cols-[5.75rem_minmax(0,1fr)_auto] gap-x-2 px-3 sm:grid-cols-[9rem_minmax(0,1fr)_auto] sm:gap-x-3 sm:px-4"
 };
 function Row({ label, hint, children, actions, top = false, className }) {
-  const room = useContext3(Room);
+  const room = useContext4(Room);
   return /* @__PURE__ */ jsxs4("div", { className: cn2("grid min-h-11 py-1", ROW_GRID[room ?? "viewport"], top ? "items-start" : "items-center", className), children: [
     /* @__PURE__ */ jsxs4("div", { className: cn2("flex min-w-0 flex-col text-xs leading-tight text-muted-foreground", top && "pt-2.5"), children: [
       /* @__PURE__ */ jsx4("span", { className: room === "roomy" ? "truncate" : room === "compact" ? "line-clamp-2 break-words" : "line-clamp-2 break-words sm:truncate", children: label }),
@@ -610,7 +637,7 @@ function SecretText({ value, multiline }) {
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
 function SecretRow({ port, item, field, extra }) {
   const confirmed = useConfirmed();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const secret = useTransientSecret();
   const [plain, setPlain] = useState5(null);
   const [busy, setBusy] = useState5(false);
@@ -651,7 +678,7 @@ function SecretRow({ port, item, field, extra }) {
   }
   async function copy() {
     const v = await fetchValue();
-    if (v !== null) await copyValue(v, field.label);
+    if (v !== null) await copyValue2(v, field.label, { secret: !visible });
   }
   const multiline = field.kind === "multiline";
   const shown = visible ? plain : secret.value;
@@ -670,7 +697,7 @@ function SecretRow({ port, item, field, extra }) {
   );
 }
 function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const isUrl = /^https?:\/\//i.test(value);
   return /* @__PURE__ */ jsx5(
     Row,
@@ -681,7 +708,7 @@ function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
       actions: /* @__PURE__ */ jsxs5(Fragment2, { children: [
         extra,
         isUrl && openUrl ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: /* @__PURE__ */ jsx5(ExternalGlyph, {}), "aria-label": `Open ${value}`, onClick: () => openUrl(value) }) : null,
-        /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: /* @__PURE__ */ jsx5(CopyGlyph, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue(value, typeof label === "string" && label ? label : "Value") })
+        /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: /* @__PURE__ */ jsx5(CopyGlyph, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue2(value, typeof label === "string" && label ? label : "Value", { secret: false }) })
       ] }),
       children: isUrl && openUrl ? (
         // A real link (right-click, copy link address, open in a new tab); a click goes through the host's opener.
@@ -1327,7 +1354,7 @@ function HistoryPanel({ item, port, arg, onClose, onChanged }) {
 function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, onError }) {
   const confirmed = useConfirmed();
   const secret = useTransientSecret();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const [busy, setBusy] = useState7(false);
   const when = formatDate(entry.recordedAt, true);
   async function read() {
@@ -1350,7 +1377,7 @@ function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, on
   }
   async function copy() {
     const v = await read();
-    if (v !== null) await copyValue(v, `Earlier ${label.toLowerCase()}`);
+    if (v !== null) await copyValue2(v, `Earlier ${label.toLowerCase()}`);
   }
   async function restore() {
     const yes = await confirm({
@@ -1535,13 +1562,13 @@ function CountdownRing({ remaining, period, loading = false, className }) {
 }
 function useCopied() {
   const [copied, setCopied] = useState8(false);
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const t = useRef6(null);
   useEffect8(() => () => void (t.current && clearTimeout(t.current)), []);
   return {
     copied,
     copy: async (code) => {
-      const ok = await copyValue(code, "One-time code");
+      const ok = await copyValue2(code, "One-time code");
       if (!ok) return;
       setCopied(true);
       if (t.current) clearTimeout(t.current);
@@ -2683,7 +2710,7 @@ function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
 }
 
 // src/generator/PasswordGenerator.tsx
-import { createContext as createContext4, useContext as useContext4, useEffect as useEffect12, useRef as useRef10, useState as useState15 } from "react";
+import { createContext as createContext5, useContext as useContext5, useEffect as useEffect12, useRef as useRef10, useState as useState15 } from "react";
 import { Popover, PopoverContent, PopoverTrigger, cn as cn7 } from "@ai-matrx/design-system";
 import { Button as Button11, NumberStepper, SegmentedControl as SegmentedControl2, Select as Select4, Switch as Switch2 } from "@ai-matrx/design-system/controls";
 
@@ -2744,12 +2771,12 @@ function strengthOf(bits) {
 
 // src/generator/PasswordGenerator.tsx
 import { jsx as jsx14, jsxs as jsxs14 } from "react/jsx-runtime";
-var LimitsCtx = createContext4(null);
+var LimitsCtx = createContext5(null);
 function GeneratorLimitsProvider({ resolve: resolve2, children }) {
   return /* @__PURE__ */ jsx14(LimitsCtx.Provider, { value: resolve2 ?? null, children });
 }
 function useGeneratorLimitsSource() {
-  return useContext4(LimitsCtx);
+  return useContext5(LimitsCtx);
 }
 var MASK3 = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
@@ -2759,7 +2786,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const [candidate, setCandidate] = useState15(null);
   const [revealed, setRevealed] = useState15(false);
   const [note, setNote] = useState15(null);
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const expiry = useRef10(null);
   const drop = () => {
     if (expiry.current) clearTimeout(expiry.current);
@@ -2819,7 +2846,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const strength = candidate ? strengthOf(candidate.bits) : null;
   const copy = async () => {
     if (!candidate) return;
-    const ok = await copyValue(candidate.value, "Generated password");
+    const ok = await copyValue2(candidate.value, "Generated password");
     setNote(ok ? { tone: "success", text: "Copied. Your clipboard keeps it." } : { tone: "destructive", text: "Couldn\u2019t copy. Reveal it and copy by hand." });
   };
   const use = () => {
@@ -2930,6 +2957,45 @@ function importLimitsFrom(resolved) {
   return out;
 }
 
+// src/lock.ts
+import { useSyncExternalStore as useSyncExternalStore2 } from "react";
+var LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
+var VaultLockedError = class extends Error {
+  code = "vault_locked";
+  constructor() {
+    super(LOCKED_MESSAGE);
+    this.name = "VaultLockedError";
+  }
+};
+function guardPort(port, locked) {
+  const cache = /* @__PURE__ */ new WeakMap();
+  const wrap = (target) => {
+    const hit = cache.get(target);
+    if (hit) return hit;
+    const proxy = new Proxy(target, {
+      get(obj2, key, receiver) {
+        const value = Reflect.get(obj2, key, receiver);
+        if (typeof value === "function") {
+          return (...args) => {
+            if (locked()) return Promise.reject(new VaultLockedError());
+            return value.apply(obj2, args);
+          };
+        }
+        if (value && typeof value === "object") return wrap(value);
+        return value;
+      }
+    });
+    cache.set(target, proxy);
+    return proxy;
+  };
+  return wrap(port);
+}
+var NEVER = () => () => void 0;
+var UNLOCKED = () => false;
+function useLocked(lock) {
+  return useSyncExternalStore2(lock ? lock.subscribe : NEVER, lock ? () => lock.locked() : UNLOCKED, UNLOCKED);
+}
+
 // src/io/BackupPanel.tsx
 import { useEffect as useEffect13, useRef as useRef11, useState as useState17 } from "react";
 import { Button as Button13, Field as Field6, SegmentedControl as SegmentedControl3, Switch as Switch3 } from "@ai-matrx/design-system/controls";
@@ -4806,7 +4872,7 @@ var MASK4 = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\
 var say2 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function RecoveryCodesRow({ item, field, port, onChanged }) {
   const confirmed = useConfirmed();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const secret = useTransientSecret();
   const [busy, setBusy] = useState21(false);
   const [error, setError] = useState21(null);
@@ -4894,7 +4960,7 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
       children: sealed ? /* @__PURE__ */ jsx21(Badge6, { icon: /* @__PURE__ */ jsx21(LockGlyph, {}), children: "Sealed" }) : codes ? /* @__PURE__ */ jsxs20("ul", { className: "flex flex-col gap-0.5", "aria-label": "Recovery codes", children: [
         codes.map((code, i) => /* @__PURE__ */ jsxs20("li", { className: "flex min-h-7 items-center gap-1", children: [
           /* @__PURE__ */ jsx21("code", { className: "min-w-0 flex-1 break-all font-mono text-sm text-foreground", children: code }),
-          /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(CopyGlyph, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue(code, "Recovery code") }),
+          /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(CopyGlyph, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue2(code, "Recovery code") }),
           canEdit ? /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(CheckGlyph, {}), disabled: busy, onClick: () => void markUsed(i), children: "Mark used" }) : null
         ] }, `${i}-${code}`)),
         error ? /* @__PURE__ */ jsx21("li", { role: "alert", className: "text-xs text-destructive", children: error }) : null
@@ -5963,7 +6029,7 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
     setBusy(true);
     try {
       const v = await confirmed(() => port.reveal(item, key));
-      await copy(v, label);
+      await copy(v, label, { secret: key !== user?.key || user.handling !== "visible" });
     } catch (e) {
       if (!wasCancelled(e)) notify(e instanceof Error ? e.message : `${label} could not be read`, "error");
     } finally {
@@ -7137,12 +7203,12 @@ import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuConte
 import { Button as Button32 } from "@ai-matrx/design-system/controls";
 
 // src/extension/CaptureCard.tsx
-import { useState as useState35, useSyncExternalStore as useSyncExternalStore2 } from "react";
+import { useState as useState35, useSyncExternalStore as useSyncExternalStore3 } from "react";
 import { Button as Button29, SearchField as SearchField3 } from "@ai-matrx/design-system/controls";
 import { Fragment as Fragment19, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
-  const prompt = useSyncExternalStore2(capture.subscribe, capture.get, capture.get);
+  const prompt = useSyncExternalStore3(capture.subscribe, capture.get, capture.get);
   const notify = useNotify();
   const [busy, setBusy] = useState35(false);
   const [q, setQ] = useState35("");
@@ -7201,12 +7267,12 @@ function CaptureCard({ capture, onChanged }) {
 }
 
 // src/extension/FillSetupCard.tsx
-import { useRef as useRef18, useState as useState36, useSyncExternalStore as useSyncExternalStore3 } from "react";
+import { useRef as useRef18, useState as useState36, useSyncExternalStore as useSyncExternalStore4 } from "react";
 import { Button as Button30, Field as Field12 } from "@ai-matrx/design-system/controls";
 import { jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
 function FillSetupCard({ fillSetup }) {
   const notify = useNotify();
-  const state = useSyncExternalStore3(fillSetup.subscribe, fillSetup.get, fillSetup.get);
+  const state = useSyncExternalStore4(fillSetup.subscribe, fillSetup.get, fillSetup.get);
   const box = useRef18(null);
   const [busy, setBusy] = useState36(false);
   const [error, setError] = useState36(null);
@@ -7641,7 +7707,31 @@ function ImportWithLimits(props) {
   return /* @__PURE__ */ jsx39(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ jsx39(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
 }
 function VaultApp(props) {
-  return /* @__PURE__ */ jsx39("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ jsx39(NoticeProvider, { notify: props.notify, children: /* @__PURE__ */ jsx39(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ jsx39(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ jsx39(Workspace, { ...props }) }) }) }) });
+  const lock = props.host?.lock;
+  const locked = useLocked(lock);
+  const port = useMemo6(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
+  return /* @__PURE__ */ jsx39("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ jsx39(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ jsx39(LockedScreen, { lock }) : /* @__PURE__ */ jsx39(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ jsx39(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ jsx39(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ jsx39(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ jsx39(Workspace, { ...props, port }) }) }) }) }) }) });
+}
+function LockedScreen({ lock }) {
+  const [busy, setBusy] = useState40(false);
+  const [error, setError] = useState40(null);
+  const unlock = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      await lock.unlock();
+    } catch (e) {
+      setError(e instanceof Error && e.message ? e.message : "The vault stayed locked.");
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ jsxs37("div", { role: "region", "aria-label": "Vault locked", className: "flex h-full min-h-0 flex-col items-center justify-center gap-3 p-6 text-center", children: [
+    /* @__PURE__ */ jsx39(LockGlyph, { className: "size-8 text-muted-foreground" }),
+    /* @__PURE__ */ jsx39("div", { className: "text-base font-medium text-foreground", children: "Vault locked" }),
+    /* @__PURE__ */ jsx39(Button33, { variant: "primary", disabled: busy, onClick: () => void unlock(), children: lock.unlockLabel ?? "Unlock" }),
+    error ? /* @__PURE__ */ jsx39("div", { role: "alert", className: "max-w-sm text-sm text-destructive", children: error }) : null
+  ] });
 }
 function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocationChange }) {
   const rootRef = useRef19(null);
@@ -7794,6 +7884,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: host.nativeProvider.openSetup, children: [
           /* @__PURE__ */ jsx39(ShieldGlyph, { className: "size-4" }),
           "System AutoFill"
+        ] }) : null,
+        host.lock?.lock ? /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: () => void host.lock?.lock?.(), children: [
+          /* @__PURE__ */ jsx39(LockGlyph, { className: "size-4" }),
+          "Lock"
         ] }) : null
       ] })
     ] })
@@ -8826,11 +8920,15 @@ export {
   CATEGORIES,
   DEFAULT_LOCATION,
   GenerateButton,
+  LOCKED_MESSAGE,
   VaultApp,
+  VaultLockedError,
   categoryOf,
+  copyValue,
   createApiVaultPort,
   createSupabaseIdentity,
   createVaultKnobs,
+  guardPort,
   inferFromUrl,
   locationFromParams,
   locationToParams,