@ai-matrx/vault 0.1.5 → 0.1.7

package/dist/index.cjs

@@ -138,24 +138,28 @@ __export(src_exports, {
   CATEGORIES: () => CATEGORIES,
   DEFAULT_LOCATION: () => DEFAULT_LOCATION,
   GenerateButton: () => GenerateButton,
+  LOCKED_MESSAGE: () => LOCKED_MESSAGE,
   VaultApp: () => VaultApp,
+  VaultLockedError: () => VaultLockedError,
   categoryOf: () => categoryOf,
+  copyValue: () => copyValue,
   createApiVaultPort: () => createApiVaultPort,
   createSupabaseIdentity: () => createSupabaseIdentity,
   createVaultKnobs: () => createVaultKnobs,
+  guardPort: () => guardPort,
   inferFromUrl: () => inferFromUrl,
   locationFromParams: () => locationFromParams,
   locationToParams: () => locationToParams,
+  loginSiteOf: () => loginSiteOf,
   matchesQuery: () => matchesQuery,
   needsRecentSignIn: () => needsRecentSignIn,
   parseDefinitions: () => parseDefinitions,
-  siteOf: () => siteOf,
   sortItems: () => sortItems
 });
 module.exports = __toCommonJS(src_exports);
 
 // src/VaultApp.tsx
-var import_react40 = require("react");
+var import_react41 = require("react");
 var import_design_system25 = require("@ai-matrx/design-system");
 var import_controls34 = require("@ai-matrx/design-system/controls");
 var import_confirm_opener13 = require("@ai-matrx/kit/confirm-opener");
@@ -169,9 +173,28 @@ var Ctx = (0, import_react.createContext)(() => void 0);
 function useNotify() {
   return (0, import_react.useContext)(Ctx);
 }
+async function copyValue(text, label, options, deps) {
+  const secret = options.secret ?? true;
+  if (deps.clipboard) {
+    try {
+      await deps.clipboard.copy(text, { secret });
+      deps.notify(`${label} copied`, "success");
+      return true;
+    } catch (e) {
+      deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, "error");
+      return false;
+    }
+  }
+  return (0, import_clipboard.copyText)(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === "error" ? "error" : "success") });
+}
+var ClipboardCtx = (0, import_react.createContext)(void 0);
+function ClipboardProvider({ clipboard, children }) {
+  return /* @__PURE__ */ (0, import_jsx_runtime.jsx)(ClipboardCtx.Provider, { value: clipboard, children });
+}
 function useCopy() {
   const notify = useNotify();
-  return (0, import_react.useCallback)((text, label) => (0, import_clipboard.copyText)(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => notify(m, k === "error" ? "error" : "success") }), [notify]);
+  const clipboard = (0, import_react.useContext)(ClipboardCtx);
+  return (0, import_react.useCallback)((text, label, options = {}) => copyValue(text, label, options, { clipboard, notify }), [notify, clipboard]);
 }
 function NoticeProvider({ notify, children }) {
   const [shown, setShown] = (0, import_react.useState)(null);
@@ -549,7 +572,15 @@ var import_design_system5 = require("@ai-matrx/design-system");
 
 // src/hooks.ts
 var import_react3 = require("react");
-function useTransientSecret(ms = 2e4) {
+var DEFAULT_REVEAL_MS = 2e4;
+var RevealMs = (0, import_react3.createContext)(DEFAULT_REVEAL_MS);
+function RevealSecondsProvider({ seconds, children }) {
+  const ms = seconds !== void 0 && Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : DEFAULT_REVEAL_MS;
+  return (0, import_react3.createElement)(RevealMs.Provider, { value: ms }, children);
+}
+function useTransientSecret(given) {
+  const fromHost = (0, import_react3.useContext)(RevealMs);
+  const ms = given ?? fromHost;
   const [value, setValue] = (0, import_react3.useState)(null);
   const timer2 = (0, import_react3.useRef)(null);
   const clear = (0, import_react3.useCallback)(() => {
@@ -647,12 +678,7 @@ function formatBytes(n) {
   if (n < 1024 * 1024) return `${(n / 1024).toFixed(n < 10 * 1024 ? 1 : 0)} KB`;
   return `${(n / 1024 / 1024).toFixed(1)} MB`;
 }
-function formatDate(iso, withTime = false) {
-  if (!iso) return "";
-  const d = new Date(iso);
-  if (Number.isNaN(d.getTime())) return iso;
-  return d.toLocaleString(void 0, withTime ? { year: "numeric", month: "short", day: "numeric", hour: "numeric", minute: "2-digit" } : { year: "numeric", month: "short", day: "numeric" });
-}
+var DAY_FORMAT = { year: "numeric", month: "short", day: "numeric" };
 
 // src/FieldRows.tsx
 var import_jsx_runtime5 = require("react/jsx-runtime");
@@ -664,7 +690,7 @@ function SecretText({ value, multiline }) {
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
 function SecretRow({ port, item, field, extra }) {
   const confirmed = useConfirmed();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const secret = useTransientSecret();
   const [plain, setPlain] = (0, import_react5.useState)(null);
   const [busy, setBusy] = (0, import_react5.useState)(false);
@@ -705,7 +731,7 @@ function SecretRow({ port, item, field, extra }) {
   }
   async function copy() {
     const v = await fetchValue();
-    if (v !== null) await copyValue(v, field.label);
+    if (v !== null) await copyValue2(v, field.label, { secret: !visible });
   }
   const multiline = field.kind === "multiline";
   const shown = visible ? plain : secret.value;
@@ -724,7 +750,7 @@ function SecretRow({ port, item, field, extra }) {
   );
 }
 function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const isUrl = /^https?:\/\//i.test(value);
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(
     Row,
@@ -735,7 +761,7 @@ function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
       actions: /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
         extra,
         isUrl && openUrl ? /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(ExternalGlyph, {}), "aria-label": `Open ${value}`, onClick: () => openUrl(value) }) : null,
-        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(CopyGlyph, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue(value, typeof label === "string" && label ? label : "Value") })
+        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(CopyGlyph, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue2(value, typeof label === "string" && label ? label : "Value", { secret: false }) })
       ] }),
       children: isUrl && openUrl ? (
         // A real link (right-click, copy link address, open in a new tab); a click goes through the host's opener.
@@ -792,6 +818,9 @@ function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove }) {
   );
 }
 
+// src/activity/HistoryPanel.tsx
+var import_format3 = require("@ai-matrx/kit/format");
+
 // src/activity/logic.ts
 var import_format = require("@ai-matrx/kit/format");
 
@@ -843,7 +872,7 @@ function matchesQuery(item, query) {
   return [item.name, item.definitionLabel, ...item.tags, ...item.loginUrls, ...item.custom.map((c) => `${c.label} ${c.value}`)].some((h) => h.toLowerCase().includes(q));
 }
 var isAuthenticatorStorage = (key) => key === "totp_seed" || key.startsWith("totp_") || key === "authenticator_last_time_step";
-function siteOf(item) {
+function loginSiteOf(item) {
   const raw = item.loginUrls[0];
   if (!raw) return "";
   try {
@@ -857,7 +886,7 @@ function sortItems(items, sort) {
   const byName = (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" });
   if (sort === "name") return out.sort(byName);
   if (sort === "website") return out.sort((a, b) => {
-    const x = siteOf(a), y = siteOf(b);
+    const x = loginSiteOf(a), y = loginSiteOf(b);
     return x && y ? x.localeCompare(y) || byName(a, b) : x ? -1 : y ? 1 : byName(a, b);
   });
   if (sort === "updated") return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
@@ -1249,6 +1278,7 @@ var HistoryChangedError = class extends Error {
 var import_react6 = require("react");
 var import_controls3 = require("@ai-matrx/design-system/controls");
 var import_design_system6 = require("@ai-matrx/design-system");
+var import_format2 = require("@ai-matrx/kit/format");
 var import_jsx_runtime6 = require("react/jsx-runtime");
 var PAGE = 50;
 var MAX = 500;
@@ -1285,7 +1315,7 @@ function ActivityPanel({ item, port, onClose }) {
           day.entries.map((entry) => ({ entry, s: auditSentence(entry, item, me) })),
           (r) => `${r.s.what}|${r.s.who ?? ""}`
         ).map(({ row: { entry, s }, times }) => {
-          return /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)("div", { className: "flex min-h-9 items-center gap-1.5 px-3 text-sm sm:px-4", title: formatDate(entry.at, true), children: [
+          return /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)("div", { className: "flex min-h-9 items-center gap-1.5 px-3 text-sm sm:px-4", title: (0, import_format2.formatAbsoluteDate)(entry.at, void 0, ""), children: [
             /* @__PURE__ */ (0, import_jsx_runtime6.jsx)("span", { className: (0, import_design_system6.cn)("truncate", s.refused ? "text-destructive" : "text-foreground"), children: s.what }),
             /* @__PURE__ */ (0, import_jsx_runtime6.jsxs)("span", { className: "shrink-0 text-muted-foreground", children: [
               times > 1 ? ` \xB7 ${times} times` : "",
@@ -1370,7 +1400,7 @@ function HistoryPanel({ item, port, arg, onClose, onChanged }) {
         page && (page.captureStartedAt || page.incomplete) ? /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)("div", { className: "flex flex-wrap gap-x-3 gap-y-1 px-1 text-xs", children: [
           page.captureStartedAt ? /* @__PURE__ */ (0, import_jsx_runtime7.jsxs)("span", { className: "text-muted-foreground", children: [
             "Kept since ",
-            formatDate(page.captureStartedAt, true)
+            (0, import_format3.formatAbsoluteDate)(page.captureStartedAt, void 0, "")
           ] }) : null,
           page.incomplete ? /* @__PURE__ */ (0, import_jsx_runtime7.jsx)("span", { className: "text-warning", children: "Some changes could not be read" }) : null
         ] }) : null
@@ -1381,9 +1411,9 @@ function HistoryPanel({ item, port, arg, onClose, onChanged }) {
 function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, onError }) {
   const confirmed = useConfirmed();
   const secret = useTransientSecret();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const [busy, setBusy] = (0, import_react7.useState)(false);
-  const when = formatDate(entry.recordedAt, true);
+  const when = (0, import_format3.formatAbsoluteDate)(entry.recordedAt, void 0, "");
   async function read() {
     if (secret.value !== null) return secret.value;
     setBusy(true);
@@ -1404,7 +1434,7 @@ function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, on
   }
   async function copy() {
     const v = await read();
-    if (v !== null) await copyValue(v, `Earlier ${label.toLowerCase()}`);
+    if (v !== null) await copyValue2(v, `Earlier ${label.toLowerCase()}`);
   }
   async function restore() {
     const yes = await (0, import_confirm_opener.confirm)({
@@ -1545,11 +1575,11 @@ function authenticatorName(current, parsed) {
   if (name && !PLACEHOLDER_NAMES.includes(name.toLowerCase())) return name;
   return parsed.issuer || parsed.account || name || "One-time password";
 }
-function matchIssuerToSite(issuer, candidates, siteOf2) {
+function matchIssuerToSite(issuer, candidates, siteOf) {
   const key = (issuer ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
   if (key.length < 2) return null;
   for (const c of candidates) {
-    const host = siteOf2(c).toLowerCase();
+    const host = siteOf(c).toLowerCase();
     if (!host) continue;
     const labels = host.split(".");
     if (labels.some((l) => l.replace(/[^a-z0-9]/g, "") === key)) return c;
@@ -1589,13 +1619,13 @@ function CountdownRing({ remaining, period, loading = false, className }) {
 }
 function useCopied() {
   const [copied, setCopied] = (0, import_react8.useState)(false);
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const t = (0, import_react8.useRef)(null);
   (0, import_react8.useEffect)(() => () => void (t.current && clearTimeout(t.current)), []);
   return {
     copied,
     copy: async (code) => {
-      const ok = await copyValue(code, "One-time code");
+      const ok = await copyValue2(code, "One-time code");
       if (!ok) return;
       setCopied(true);
       if (t.current) clearTimeout(t.current);
@@ -2170,7 +2200,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
   const recognise = (p) => {
     if (!nameTouched) setName((n) => authenticatorName(n, p));
     if (!targetChosen) {
-      const match = matchIssuerToSite(p.issuer, candidates, siteOf);
+      const match = matchIssuerToSite(p.issuer, candidates, loginSiteOf);
       setTarget(match ? match.id : NEW);
     }
   };
@@ -2248,7 +2278,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
               value: target,
               disabled: busy || created !== null,
               "aria-label": "Add to",
-              options: [{ value: NEW, label: "New login" }, ...candidates.map((c) => ({ value: c.id, label: siteOf(c) ? `${c.name} \xB7 ${siteOf(c)}` : c.name }))],
+              options: [{ value: NEW, label: "New login" }, ...candidates.map((c) => ({ value: c.id, label: loginSiteOf(c) ? `${c.name} \xB7 ${loginSiteOf(c)}` : c.name }))],
               onValueChange: (v) => {
                 setTarget(v);
                 setTargetChosen(true);
@@ -2410,7 +2440,7 @@ function OtpListRow({ port, item, family, entry, onOpen, onRename, onChanged, on
   const Icon = definitionGlyph(item.definitionKey, family);
   const canManage = item.capabilities.canManage || item.capabilities.canEdit;
   if (a.removed) return null;
-  const sub = a.error ?? [entry?.account, siteOf(item) || entry?.issuer].filter((v, i, all) => Boolean(v) && all.indexOf(v) === i).join(" \xB7 ");
+  const sub = a.error ?? [entry?.account, loginSiteOf(item) || entry?.issuer].filter((v, i, all) => Boolean(v) && all.indexOf(v) === i).join(" \xB7 ");
   return /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-3 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
     /* @__PURE__ */ (0, import_jsx_runtime12.jsx)("button", { type: "button", onClick: onOpen, "aria-label": `Open ${item.name}`, tabIndex: -1, className: (0, import_design_system9.cn)("flex size-8 items-center justify-center rounded-lg bg-muted", a.enabled ? "text-foreground" : "text-disabled-foreground"), children: /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(Icon, { className: "size-4" }) }),
     /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)("button", { type: "button", onClick: onOpen, className: "flex min-w-0 flex-col items-start rounded-md text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring", children: [
@@ -2810,7 +2840,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const [candidate, setCandidate] = (0, import_react15.useState)(null);
   const [revealed, setRevealed] = (0, import_react15.useState)(false);
   const [note, setNote] = (0, import_react15.useState)(null);
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const expiry = (0, import_react15.useRef)(null);
   const drop = () => {
     if (expiry.current) clearTimeout(expiry.current);
@@ -2870,7 +2900,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const strength = candidate ? strengthOf(candidate.bits) : null;
   const copy = async () => {
     if (!candidate) return;
-    const ok = await copyValue(candidate.value, "Generated password");
+    const ok = await copyValue2(candidate.value, "Generated password");
     setNote(ok ? { tone: "success", text: "Copied. Your clipboard keeps it." } : { tone: "destructive", text: "Couldn\u2019t copy. Reveal it and copy by hand." });
   };
   const use = () => {
@@ -2981,8 +3011,47 @@ function importLimitsFrom(resolved) {
   return out;
 }
 
+// src/lock.ts
+var import_react16 = require("react");
+var LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
+var VaultLockedError = class extends Error {
+  code = "vault_locked";
+  constructor() {
+    super(LOCKED_MESSAGE);
+    this.name = "VaultLockedError";
+  }
+};
+function guardPort(port, locked) {
+  const cache = /* @__PURE__ */ new WeakMap();
+  const wrap = (target) => {
+    const hit = cache.get(target);
+    if (hit) return hit;
+    const proxy = new Proxy(target, {
+      get(obj2, key, receiver) {
+        const value = Reflect.get(obj2, key, receiver);
+        if (typeof value === "function") {
+          return (...args) => {
+            if (locked()) return Promise.reject(new VaultLockedError());
+            return value.apply(obj2, args);
+          };
+        }
+        if (value && typeof value === "object") return wrap(value);
+        return value;
+      }
+    });
+    cache.set(target, proxy);
+    return proxy;
+  };
+  return wrap(port);
+}
+var NEVER = () => () => void 0;
+var UNLOCKED = () => false;
+function useLocked(lock) {
+  return (0, import_react16.useSyncExternalStore)(lock ? lock.subscribe : NEVER, lock ? () => lock.locked() : UNLOCKED, UNLOCKED);
+}
+
 // src/io/BackupPanel.tsx
-var import_react17 = require("react");
+var import_react18 = require("react");
 var import_controls13 = require("@ai-matrx/design-system/controls");
 var import_download = require("@ai-matrx/kit/download");
 var import_confirm_opener4 = require("@ai-matrx/kit/confirm-opener");
@@ -3075,7 +3144,7 @@ function startNewRestoreRun(preview) {
 }
 
 // src/io/lines.tsx
-var import_react16 = require("react");
+var import_react17 = require("react");
 var import_design_system11 = require("@ai-matrx/design-system");
 var import_controls12 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime15 = require("react/jsx-runtime");
@@ -3088,7 +3157,7 @@ function PickLine({ checked, onChange, disabled = false, title, detail, badge, t
   ] });
 }
 function Windowed({ items, size = 150, render }) {
-  const [all, setAll] = (0, import_react16.useState)(false);
+  const [all, setAll] = (0, import_react17.useState)(false);
   const shown = all ? items : items.slice(0, size);
   return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)(import_jsx_runtime15.Fragment, { children: [
     shown.map(render),
@@ -3099,7 +3168,7 @@ function Windowed({ items, size = 150, render }) {
   ] });
 }
 function More({ title = "More", children }) {
-  const [open, setOpen] = (0, import_react16.useState)(false);
+  const [open, setOpen] = (0, import_react17.useState)(false);
   return /* @__PURE__ */ (0, import_jsx_runtime15.jsxs)("div", { className: "flex flex-col gap-2", children: [
     /* @__PURE__ */ (0, import_jsx_runtime15.jsx)(import_controls12.DisclosureHeader, { open, title, onClick: () => setOpen((o) => !o) }),
     open ? children : null
@@ -3138,21 +3207,21 @@ function Omissions({ omissions, accepted, onAccepted, verb }) {
 }
 function BackupPanel({ port, items, onClose, onChanged }) {
   const confirmed = useConfirmed();
-  const fileInput = (0, import_react17.useRef)(null);
-  const abort = (0, import_react17.useRef)(null);
-  const [mode, setMode] = (0, import_react17.useState)("backup");
-  const [busy, setBusy] = (0, import_react17.useState)(false);
-  const [error, setError] = (0, import_react17.useState)(null);
-  const [passphrase, setPassphrase] = (0, import_react17.useState)("");
-  const [repeat, setRepeat] = (0, import_react17.useState)("");
-  const [accepted, setAccepted] = (0, import_react17.useState)(false);
-  const [selected, setSelected] = (0, import_react17.useState)(/* @__PURE__ */ new Set());
-  const [backup, setBackup] = (0, import_react17.useState)(null);
-  const [file, setFile] = (0, import_react17.useState)(null);
-  const [restorePreview, setRestorePreview] = (0, import_react17.useState)(null);
-  const [runId, setRunId] = (0, import_react17.useState)(null);
-  const [result, setResult] = (0, import_react17.useState)(null);
-  (0, import_react17.useEffect)(() => () => abort.current?.abort(), []);
+  const fileInput = (0, import_react18.useRef)(null);
+  const abort = (0, import_react18.useRef)(null);
+  const [mode, setMode] = (0, import_react18.useState)("backup");
+  const [busy, setBusy] = (0, import_react18.useState)(false);
+  const [error, setError] = (0, import_react18.useState)(null);
+  const [passphrase, setPassphrase] = (0, import_react18.useState)("");
+  const [repeat, setRepeat] = (0, import_react18.useState)("");
+  const [accepted, setAccepted] = (0, import_react18.useState)(false);
+  const [selected, setSelected] = (0, import_react18.useState)(/* @__PURE__ */ new Set());
+  const [backup, setBackup] = (0, import_react18.useState)(null);
+  const [file, setFile] = (0, import_react18.useState)(null);
+  const [restorePreview, setRestorePreview] = (0, import_react18.useState)(null);
+  const [runId, setRunId] = (0, import_react18.useState)(null);
+  const [result, setResult] = (0, import_react18.useState)(null);
+  (0, import_react18.useEffect)(() => () => abort.current?.abort(), []);
   const switchMode = (next) => {
     abort.current?.abort();
     setMode(next);
@@ -3323,7 +3392,7 @@ function BackupPanel({ port, items, onClose, onChanged }) {
 }
 
 // src/io/ExportPanel.tsx
-var import_react18 = require("react");
+var import_react19 = require("react");
 var import_controls14 = require("@ai-matrx/design-system/controls");
 var import_download2 = require("@ai-matrx/kit/download");
 var import_confirm_opener5 = require("@ai-matrx/kit/confirm-opener");
@@ -3347,12 +3416,12 @@ function omissionText2(omissions) {
 }
 function ExportPanel({ port, items, onClose }) {
   const confirmed = useConfirmed();
-  const logins = (0, import_react18.useMemo)(() => items.filter((i) => i.definitionKey === WEBSITE_LOGIN), [items]);
-  const [profile, setProfile] = (0, import_react18.useState)("matrx_login_csv_v1");
-  const [selected, setSelected] = (0, import_react18.useState)(/* @__PURE__ */ new Set());
-  const [preview, setPreview] = (0, import_react18.useState)(null);
-  const [busy, setBusy] = (0, import_react18.useState)(false);
-  const [error, setError] = (0, import_react18.useState)(null);
+  const logins = (0, import_react19.useMemo)(() => items.filter((i) => i.definitionKey === WEBSITE_LOGIN), [items]);
+  const [profile, setProfile] = (0, import_react19.useState)("matrx_login_csv_v1");
+  const [selected, setSelected] = (0, import_react19.useState)(/* @__PURE__ */ new Set());
+  const [preview, setPreview] = (0, import_react19.useState)(null);
+  const [busy, setBusy] = (0, import_react19.useState)(false);
+  const [error, setError] = (0, import_react19.useState)(null);
   const format = FORMATS.find((f) => f.value === profile);
   const reasons = new Map(preview?.items.map((p) => [p.item_id, p]) ?? []);
   const eligible = preview?.items.filter((p) => p.eligible).length ?? 0;
@@ -3477,7 +3546,7 @@ function ExportPanel({ port, items, onClose }) {
 }
 
 // src/io/ImportPanel.tsx
-var import_react19 = require("react");
+var import_react20 = require("react");
 var import_controls15 = require("@ai-matrx/design-system/controls");
 
 // src/io/csv-import.ts
@@ -4336,24 +4405,24 @@ var STATE_BADGE = {
 var ME = "me";
 function ImportPanel({ port, host, items, organizations, onClose, onChanged, limits }) {
   const confirmed = useConfirmed();
-  const fileInput = (0, import_react19.useRef)(null);
-  const abort = (0, import_react19.useRef)(null);
-  const stop = (0, import_react19.useRef)(false);
-  const keys = (0, import_react19.useRef)(/* @__PURE__ */ new Map());
-  const [source, setSource] = (0, import_react19.useState)("auto");
-  const [envText, setEnvText] = (0, import_react19.useState)("");
-  const [injectSandbox, setInjectSandbox] = (0, import_react19.useState)(false);
-  const [fileName, setFileName] = (0, import_react19.useState)(null);
-  const [reading, setReading] = (0, import_react19.useState)(false);
-  const [draft, setDraft] = (0, import_react19.useState)(null);
-  const [destination, setDestination] = (0, import_react19.useState)(ME);
-  const [browserFill, setBrowserFill] = (0, import_react19.useState)(false);
-  const [approvedVisible, setApprovedVisible] = (0, import_react19.useState)(false);
-  const [selected, setSelected] = (0, import_react19.useState)(/* @__PURE__ */ new Set());
-  const [running, setRunning] = (0, import_react19.useState)(null);
-  const [done, setDone] = (0, import_react19.useState)(null);
-  const [error, setError] = (0, import_react19.useState)(null);
-  (0, import_react19.useEffect)(
+  const fileInput = (0, import_react20.useRef)(null);
+  const abort = (0, import_react20.useRef)(null);
+  const stop = (0, import_react20.useRef)(false);
+  const keys = (0, import_react20.useRef)(/* @__PURE__ */ new Map());
+  const [source, setSource] = (0, import_react20.useState)("auto");
+  const [envText, setEnvText] = (0, import_react20.useState)("");
+  const [injectSandbox, setInjectSandbox] = (0, import_react20.useState)(false);
+  const [fileName, setFileName] = (0, import_react20.useState)(null);
+  const [reading, setReading] = (0, import_react20.useState)(false);
+  const [draft, setDraft] = (0, import_react20.useState)(null);
+  const [destination, setDestination] = (0, import_react20.useState)(ME);
+  const [browserFill, setBrowserFill] = (0, import_react20.useState)(false);
+  const [approvedVisible, setApprovedVisible] = (0, import_react20.useState)(false);
+  const [selected, setSelected] = (0, import_react20.useState)(/* @__PURE__ */ new Set());
+  const [running, setRunning] = (0, import_react20.useState)(null);
+  const [done, setDone] = (0, import_react20.useState)(null);
+  const [error, setError] = (0, import_react20.useState)(null);
+  (0, import_react20.useEffect)(
     () => () => {
       abort.current?.abort();
       stop.current = true;
@@ -4362,9 +4431,9 @@ function ImportPanel({ port, host, items, organizations, onClose, onChanged, lim
   );
   const organizationId = destination === ME ? null : destination;
   const existingIn = (org) => items.filter((i) => org === null ? i.owner.kind === "me" : i.owner.organizationId === org).map((i) => ({ displayName: i.name, loginUrls: i.loginUrls }));
-  const existing = (0, import_react19.useMemo)(() => existingIn(organizationId), [items, organizationId]);
-  const destinationOptions = (0, import_react19.useMemo)(() => [{ value: ME, label: "Personal" }, ...organizations.map((o) => ({ value: o.id, label: o.name }))], [organizations]);
-  const lines = (0, import_react19.useMemo)(
+  const existing = (0, import_react20.useMemo)(() => existingIn(organizationId), [items, organizationId]);
+  const destinationOptions = (0, import_react20.useMemo)(() => [{ value: ME, label: "Personal" }, ...organizations.map((o) => ({ value: o.id, label: o.name }))], [organizations]);
+  const lines = (0, import_react20.useMemo)(
     () => draft?.kind === "file" ? reviewLines(draft.parsed, { organizationId, browserFill, existing, limits, mapping: draft.mapping }) : [],
     [draft, organizationId, browserFill, existing, limits]
   );
@@ -4616,7 +4685,7 @@ function Notices({ draft }) {
 }
 
 // src/ItemList.tsx
-var import_react27 = require("react");
+var import_react28 = require("react");
 var import_design_system18 = require("@ai-matrx/design-system");
 var import_design_system19 = require("@ai-matrx/design-system");
 var import_controls22 = require("@ai-matrx/design-system/controls");
@@ -4636,14 +4705,14 @@ function ItemIcon({ definitionKey, family, site, size = "md", inverted = false }
 }
 
 // src/ItemPane.tsx
-var import_react26 = require("react");
+var import_react27 = require("react");
 var import_design_system16 = require("@ai-matrx/design-system");
 var import_design_system17 = require("@ai-matrx/design-system");
 var import_controls21 = require("@ai-matrx/design-system/controls");
 var import_confirm_opener9 = require("@ai-matrx/kit/confirm-opener");
 
 // src/activity/FilesSection.tsx
-var import_react20 = require("react");
+var import_react21 = require("react");
 var import_controls16 = require("@ai-matrx/design-system/controls");
 var import_design_system13 = require("@ai-matrx/design-system");
 var import_confirm_opener6 = require("@ai-matrx/kit/confirm-opener");
@@ -4659,11 +4728,11 @@ var PROTECTION = [
 function FilesSection({ item, port, editing, onChanged }) {
   const confirmed = useConfirmed();
   const canEdit = editing && item.capabilities.canEdit;
-  const [busy, setBusy] = (0, import_react20.useState)(null);
-  const [error, setError] = (0, import_react20.useState)(null);
-  const [pending, setPending] = (0, import_react20.useState)(null);
-  const [dragging, setDragging] = (0, import_react20.useState)(false);
-  const picker = (0, import_react20.useRef)(null);
+  const [busy, setBusy] = (0, import_react21.useState)(null);
+  const [error, setError] = (0, import_react21.useState)(null);
+  const [pending, setPending] = (0, import_react21.useState)(null);
+  const [dragging, setDragging] = (0, import_react21.useState)(false);
+  const picker = (0, import_react21.useRef)(null);
   if (!canEdit && item.attachments.length === 0) return null;
   async function run(key, work, fallback) {
     setBusy(key);
@@ -4739,8 +4808,8 @@ function FilesSection({ item, port, editing, onChanged }) {
   );
 }
 function EditableFile({ port, item: it, file: a, busy: b, run: go, onDownload, onTooBig }) {
-  const [open, setOpen] = (0, import_react20.useState)(false);
-  const replacer = (0, import_react20.useRef)(null);
+  const [open, setOpen] = (0, import_react21.useState)(false);
+  const replacer = (0, import_react21.useRef)(null);
   async function remove() {
     const yes = await (0, import_confirm_opener6.confirm)({ title: `Delete ${a.label}?`, description: "The encrypted file is removed from this item.", confirmLabel: "Delete", variant: "destructive" });
     if (yes) await go(`delete:${a.id}`, () => port.activity.deleteFile(it, a.id), "The file could not be deleted.");
@@ -4798,9 +4867,9 @@ function Protection({ value, locked, onChange }) {
   );
 }
 function NewFile({ file, busy, onAdd, onCancel }) {
-  const [label, setLabel] = (0, import_react20.useState)(file.name);
-  const [description, setDescription] = (0, import_react20.useState)("");
-  const [handling, setHandling] = (0, import_react20.useState)("revealable");
+  const [label, setLabel] = (0, import_react21.useState)(file.name);
+  const [description, setDescription] = (0, import_react21.useState)("");
+  const [handling, setHandling] = (0, import_react21.useState)("revealable");
   async function add() {
     if (handling === "sealed" && !await confirmSeal(label)) return;
     await onAdd({ label: label.trim(), description: description.trim() || null, handling });
@@ -4820,10 +4889,10 @@ function NewFile({ file, busy, onAdd, onCancel }) {
   ] });
 }
 function FileDetailsRows({ file, busy, onSave, onCancel }) {
-  const [label, setLabel] = (0, import_react20.useState)(file.label);
-  const [description, setDescription] = (0, import_react20.useState)(file.description);
-  const [fileName, setFileName] = (0, import_react20.useState)(file.fileName);
-  const [handling, setHandling] = (0, import_react20.useState)(file.handling);
+  const [label, setLabel] = (0, import_react21.useState)(file.label);
+  const [description, setDescription] = (0, import_react21.useState)(file.description);
+  const [fileName, setFileName] = (0, import_react21.useState)(file.fileName);
+  const [handling, setHandling] = (0, import_react21.useState)(file.handling);
   const changed = label !== file.label || description !== file.description || fileName !== file.fileName || handling !== file.handling;
   async function save() {
     if (handling === "sealed" && file.handling !== "sealed" && !await confirmSeal(label)) return;
@@ -4850,18 +4919,18 @@ function confirmSeal(label) {
 }
 
 // src/fields/RecoveryCodesRow.tsx
-var import_react21 = require("react");
+var import_react22 = require("react");
 var import_controls17 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime21 = require("react/jsx-runtime");
 var MASK4 = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 var say2 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function RecoveryCodesRow({ item, field, port, onChanged }) {
   const confirmed = useConfirmed();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const secret = useTransientSecret();
-  const [busy, setBusy] = (0, import_react21.useState)(false);
-  const [error, setError] = (0, import_react21.useState)(null);
-  const [draft, setDraft] = (0, import_react21.useState)(null);
+  const [busy, setBusy] = (0, import_react22.useState)(false);
+  const [error, setError] = (0, import_react22.useState)(null);
+  const [draft, setDraft] = (0, import_react22.useState)(null);
   const canEdit = item.capabilities.canEdit;
   const run = async (step) => {
     setBusy(true);
@@ -4945,7 +5014,7 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
       children: sealed ? /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(import_controls17.Badge, { icon: /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(LockGlyph, {}), children: "Sealed" }) : codes ? /* @__PURE__ */ (0, import_jsx_runtime21.jsxs)("ul", { className: "flex flex-col gap-0.5", "aria-label": "Recovery codes", children: [
         codes.map((code, i) => /* @__PURE__ */ (0, import_jsx_runtime21.jsxs)("li", { className: "flex min-h-7 items-center gap-1", children: [
           /* @__PURE__ */ (0, import_jsx_runtime21.jsx)("code", { className: "min-w-0 flex-1 break-all font-mono text-sm text-foreground", children: code }),
-          /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(import_controls17.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(CopyGlyph, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue(code, "Recovery code") }),
+          /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(import_controls17.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(CopyGlyph, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue2(code, "Recovery code") }),
           canEdit ? /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(import_controls17.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime21.jsx)(CheckGlyph, {}), disabled: busy, onClick: () => void markUsed(i), children: "Mark used" }) : null
         ] }, `${i}-${code}`)),
         error ? /* @__PURE__ */ (0, import_jsx_runtime21.jsx)("li", { role: "alert", className: "text-xs text-destructive", children: error }) : null
@@ -5096,7 +5165,7 @@ function targetLabel(t) {
 }
 
 // src/extension/UseOnSiteButton.tsx
-var import_react22 = require("react");
+var import_react23 = require("react");
 var import_controls18 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime22 = require("react/jsx-runtime");
 function canUseOnSite(item, pageUrl) {
@@ -5104,7 +5173,7 @@ function canUseOnSite(item, pageUrl) {
 }
 function UseOnSiteButton({ port, item, pageUrl, onChanged }) {
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react22.useState)(false);
+  const [busy, setBusy] = (0, import_react23.useState)(false);
   if (!canUseOnSite(item, pageUrl)) return null;
   const site = pageSite(pageUrl);
   const run = async () => {
@@ -5123,7 +5192,7 @@ function UseOnSiteButton({ port, item, pageUrl, onChanged }) {
 }
 
 // src/sharing/SharePanel.tsx
-var import_react25 = require("react");
+var import_react26 = require("react");
 var import_confirm_opener8 = require("@ai-matrx/kit/confirm-opener");
 var import_controls20 = require("@ai-matrx/design-system/controls");
 var import_design_system15 = require("@ai-matrx/design-system");
@@ -5137,7 +5206,7 @@ var MEMBER_ACCESS_LABEL = { none: "No access", use: "Can use", editor: "Can edit
 function levelOf(flags) {
   return flags.can_manage ? "edit" : "use";
 }
-function flagsOf(level) {
+function shareFlagsOf(level) {
   return { can_use: true, can_manage: level === "edit" };
 }
 function isEmail(value) {
@@ -5180,7 +5249,7 @@ function shareSummary(grants) {
 var MEMBER_CHOICE_DEFAULT = "default";
 
 // src/sharing/parts.tsx
-var import_react23 = require("react");
+var import_react24 = require("react");
 var import_design_system14 = require("@ai-matrx/design-system");
 var import_jsx_runtime23 = require("react/jsx-runtime");
 var message = (e, fallback) => {
@@ -5189,9 +5258,9 @@ var message = (e, fallback) => {
 };
 function useAction() {
   const confirmed = useConfirmed();
-  const [busy, setBusy] = (0, import_react23.useState)(null);
-  const [error, setError] = (0, import_react23.useState)(null);
-  const [notice, setNotice] = (0, import_react23.useState)(null);
+  const [busy, setBusy] = (0, import_react24.useState)(null);
+  const [error, setError] = (0, import_react24.useState)(null);
+  const [notice, setNotice] = (0, import_react24.useState)(null);
   async function run(key, fn, done) {
     setBusy(key);
     setError(null);
@@ -5225,7 +5294,7 @@ function StatusLine({ error, notice }) {
 }
 
 // src/sharing/MovePanel.tsx
-var import_react24 = require("react");
+var import_react25 = require("react");
 var import_confirm_opener7 = require("@ai-matrx/kit/confirm-opener");
 var import_controls19 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime24 = require("react/jsx-runtime");
@@ -5234,9 +5303,9 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
   const { busy, error, notice, run, setNotice } = useAction();
   const moves = moveDestinations(item, organizations);
   const copies = copyDestinations(organizations, item);
-  const [moveTo, setMoveTo] = (0, import_react24.useState)("");
-  const [copyTo, setCopyTo] = (0, import_react24.useState)("");
-  const [email, setEmail] = (0, import_react24.useState)("");
+  const [moveTo, setMoveTo] = (0, import_react25.useState)("");
+  const [copyTo, setCopyTo] = (0, import_react25.useState)("");
+  const [email, setEmail] = (0, import_react25.useState)("");
   const passkey = isPasskey(item);
   const canMove = item.capabilities.canManage && !passkey && moves.length > 0;
   const canGive = item.capabilities.canManage && item.owner.kind === "me" && !passkey;
@@ -5317,11 +5386,11 @@ function MovePanel({ item, port, organizations, onClose, onChanged }) {
 // src/sharing/SharePanel.tsx
 var import_jsx_runtime25 = require("react/jsx-runtime");
 function useGrants(port, item) {
-  const [grants, setGrants] = (0, import_react25.useState)(null);
-  const [loadError, setLoadError] = (0, import_react25.useState)(null);
-  const [nonce, setNonce] = (0, import_react25.useState)(0);
+  const [grants, setGrants] = (0, import_react26.useState)(null);
+  const [loadError, setLoadError] = (0, import_react26.useState)(null);
+  const [nonce, setNonce] = (0, import_react26.useState)(0);
   const allowed = item.capabilities.canManage;
-  (0, import_react25.useEffect)(() => {
+  (0, import_react26.useEffect)(() => {
     if (!allowed) return;
     let live = true;
     setLoadError(null);
@@ -5338,9 +5407,9 @@ function useGrants(port, item) {
 function SharePanel({ item, port, organizations, onClose, onChanged }) {
   const { grants, setGrants, loadError, reload } = useGrants(port, item);
   const { busy, error, notice, run } = useAction();
-  const [email, setEmail] = (0, import_react25.useState)("");
-  const [level, setLevel] = (0, import_react25.useState)("use");
-  const [more, setMore] = (0, import_react25.useState)(false);
+  const [email, setEmail] = (0, import_react26.useState)("");
+  const [level, setLevel] = (0, import_react26.useState)("use");
+  const [more, setMore] = (0, import_react26.useState)(false);
   const isOrg = item.owner.kind === "organization" && item.owner.organizationId !== null;
   const orgName = item.owner.label;
   const people = (grants ?? []).filter((g) => g.kind === "person");
@@ -5462,8 +5531,8 @@ function SharePanel({ item, port, organizations, onClose, onChanged }) {
 function IntoOrganization({ item, port, organizations, grants, onShared }) {
   const { busy, error, notice, run } = useAction();
   const open = organizations.filter((o) => !grants.some((g) => g.organizationId === o.id));
-  const [target, setTarget] = (0, import_react25.useState)("");
-  const [level, setLevel] = (0, import_react25.useState)("use");
+  const [target, setTarget] = (0, import_react26.useState)("");
+  const [level, setLevel] = (0, import_react26.useState)("use");
   const chosen = open.find((o) => o.id === target);
   if (item.owner.kind !== "me") return null;
   return /* @__PURE__ */ (0, import_jsx_runtime25.jsx)(Section, { title: "Share into organization", children: open.length > 0 ? /* @__PURE__ */ (0, import_jsx_runtime25.jsxs)(import_jsx_runtime25.Fragment, { children: [
@@ -5498,10 +5567,10 @@ var CHOICES = [
   { value: "editor", label: "Can edit", meta: "See and change" }
 ];
 function MemberAccess({ port, organizationId, organizationName }) {
-  const [list, setList] = (0, import_react25.useState)(null);
-  const [loadError, setLoadError] = (0, import_react25.useState)(null);
+  const [list, setList] = (0, import_react26.useState)(null);
+  const [loadError, setLoadError] = (0, import_react26.useState)(null);
   const { busy, error, run } = useAction();
-  (0, import_react25.useEffect)(() => {
+  (0, import_react26.useEffect)(() => {
     let live = true;
     port.sharing.memberAccess(organizationId).then(
       (l) => live && setList(l),
@@ -5533,9 +5602,9 @@ function MemberAccess({ port, organizationId, organizationName }) {
   ] });
 }
 function SharingSummary({ item, port, className }) {
-  const [text, setText] = (0, import_react25.useState)("");
+  const [text, setText] = (0, import_react26.useState)("");
   const allowed = item.capabilities.canManage;
-  (0, import_react25.useEffect)(() => {
+  (0, import_react26.useEffect)(() => {
     if (!allowed) return;
     let live = true;
     port.sharing.grants(item).then(
@@ -5551,6 +5620,7 @@ function SharingSummary({ item, port, className }) {
 }
 
 // src/ItemPane.tsx
+var import_format4 = require("@ai-matrx/kit/format");
 var import_jsx_runtime26 = require("react/jsx-runtime");
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
@@ -5560,8 +5630,8 @@ function ItemPane(props) {
   const editing = mode !== "view";
   const seedName = seed?.name ?? "";
   const seedUrl = seed?.url ?? "";
-  const [loaded, setLoaded] = (0, import_react26.useState)({});
-  const base = (0, import_react26.useMemo)(() => {
+  const [loaded, setLoaded] = (0, import_react27.useState)({});
+  const base = (0, import_react27.useMemo)(() => {
     const b = draftOf(item);
     if (!item) {
       b.name = seedName;
@@ -5570,22 +5640,22 @@ function ItemPane(props) {
     b.values = { ...loaded };
     return b;
   }, [item, seedName, seedUrl, loaded]);
-  const [draft, setDraft] = (0, import_react26.useState)(base);
-  const [tagsText, setTagsText] = (0, import_react26.useState)(base.tags.join(", "));
-  const [showTags, setShowTags] = (0, import_react26.useState)(false);
-  const [showDescription, setShowDescription] = (0, import_react26.useState)(false);
-  const [owner, setOwner] = (0, import_react26.useState)(defaultOwner ?? "me");
-  const [recipient, setRecipient] = (0, import_react26.useState)("");
-  const [generatePrivately, setGeneratePrivately] = (0, import_react26.useState)(false);
-  const [busy, setBusy] = (0, import_react26.useState)(false);
-  const [error, setError] = (0, import_react26.useState)(null);
-  const [destinations, setDestinations] = (0, import_react26.useState)({});
+  const [draft, setDraft] = (0, import_react27.useState)(base);
+  const [tagsText, setTagsText] = (0, import_react27.useState)(base.tags.join(", "));
+  const [showTags, setShowTags] = (0, import_react27.useState)(false);
+  const [showDescription, setShowDescription] = (0, import_react27.useState)(false);
+  const [owner, setOwner] = (0, import_react27.useState)(defaultOwner ?? "me");
+  const [recipient, setRecipient] = (0, import_react27.useState)("");
+  const [generatePrivately, setGeneratePrivately] = (0, import_react27.useState)(false);
+  const [busy, setBusy] = (0, import_react27.useState)(false);
+  const [error, setError] = (0, import_react27.useState)(null);
+  const [destinations, setDestinations] = (0, import_react27.useState)({});
   const dirty = editing && isDirty(base, draft);
   const declared = definition?.fields ?? [];
-  const prev = (0, import_react26.useRef)(null);
-  const paneRef = (0, import_react26.useRef)(null);
+  const prev = (0, import_react27.useRef)(null);
+  const paneRef = (0, import_react27.useRef)(null);
   const room = useRoomOf(paneRef);
-  (0, import_react26.useEffect)(() => {
+  (0, import_react27.useEffect)(() => {
     const was = prev.current;
     const id = item?.id ?? null;
     if (was && was.id === id && was.mode === mode && editing) {
@@ -5598,18 +5668,18 @@ function ItemPane(props) {
     }
     prev.current = { base, id, mode };
   }, [base, mode, item?.id, editing]);
-  (0, import_react26.useEffect)(() => {
+  (0, import_react27.useEffect)(() => {
     setLoaded({});
     setShowTags(false);
     setShowDescription(false);
   }, [item?.id, mode]);
-  (0, import_react26.useEffect)(() => onDirty(dirty), [dirty, onDirty]);
+  (0, import_react27.useEffect)(() => onDirty(dirty), [dirty, onDirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
-  (0, import_react26.useEffect)(() => {
+  (0, import_react27.useEffect)(() => {
     if (editing && dirty) keepDraft(keepKey, item?.updatedAt ?? "new", draft);
     else if (!editing) dropKeptDraft(keepKey);
   }, [editing, dirty, draft, keepKey, item?.updatedAt]);
-  (0, import_react26.useEffect)(() => {
+  (0, import_react27.useEffect)(() => {
     if (!editing || !item) return;
     let live = true;
     for (const f of item.fields) {
@@ -5698,7 +5768,7 @@ function ItemPane(props) {
   const descriptionVisible = showDescription || draft.description !== "";
   const header = /* @__PURE__ */ (0, import_jsx_runtime26.jsxs)("header", { className: "flex min-h-14 items-center gap-2 border-b border-border px-3 py-2 sm:gap-3 sm:px-5", children: [
     onBack ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(import_controls21.Button, { variant: "quiet", icon: /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(ChevronLeftGlyph, {}), "aria-label": "Back", onClick: mode === "new" ? onCancelNew : onBack }) : null,
-    /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(ItemIcon, { definitionKey: definition?.key ?? item?.definitionKey ?? "custom", family: definition?.family ?? "generic", site: item ? siteOf(item) : siteOf({ loginUrls: draft.loginUrls }), size: "lg" }),
+    /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(ItemIcon, { definitionKey: definition?.key ?? item?.definitionKey ?? "custom", family: definition?.family ?? "generic", site: item ? loginSiteOf(item) : loginSiteOf({ loginUrls: draft.loginUrls }), size: "lg" }),
     /* @__PURE__ */ (0, import_jsx_runtime26.jsxs)("div", { className: "flex min-w-0 flex-1 flex-col", children: [
       /* @__PURE__ */ (0, import_jsx_runtime26.jsx)("h2", { className: "truncate text-base font-semibold leading-tight", children: editing ? draft.name || (mode === "new" ? `New ${typeLabel.toLowerCase()}` : item?.name) : item?.name }),
       /* @__PURE__ */ (0, import_jsx_runtime26.jsxs)("span", { className: "flex min-w-0 items-center gap-1 text-xs text-muted-foreground", children: [
@@ -5931,9 +6001,9 @@ function ItemPane(props) {
       filesProps ? /* @__PURE__ */ (0, import_jsx_runtime26.jsx)(FilesSection, { ...filesProps, editing: false }) : null,
       /* @__PURE__ */ (0, import_jsx_runtime26.jsxs)("p", { className: (0, import_design_system17.cn)("px-1 text-xs text-muted-foreground"), children: [
         "Modified ",
-        formatDate(item.updatedAt),
+        (0, import_format4.formatAbsoluteDate)(item.updatedAt, DAY_FORMAT, ""),
         " \xB7 Created ",
-        formatDate(item.createdAt)
+        (0, import_format4.formatAbsoluteDate)(item.createdAt, DAY_FORMAT, "")
       ] })
     ] }) : null }) })
   ] }) });
@@ -5948,15 +6018,15 @@ var SORTS2 = [
   { value: "created", label: "Recently added" }
 ];
 function subtitleOf(item, withOwner) {
-  const what = siteOf(item) || item.definitionLabel;
+  const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
 function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header }) {
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
   const ordered = [...pinned, ...rest];
-  const listRef = (0, import_react27.useRef)(null);
-  (0, import_react27.useEffect)(() => {
+  const listRef = (0, import_react28.useRef)(null);
+  (0, import_react28.useEffect)(() => {
     if (selectedId) listRef.current?.querySelector(`[data-item="${selectedId}"]`)?.scrollIntoView({ block: "nearest" });
   }, [selectedId, items.length]);
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -6007,14 +6077,14 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react27.useState)(false);
+  const [busy, setBusy] = (0, import_react28.useState)(false);
   const user = item.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed");
   const secret = item.fields.find((f) => f.key === "password" && f.handling === "revealable");
   const quick = async (key, label) => {
     setBusy(true);
     try {
       const v = await confirmed(() => port.reveal(item, key));
-      await copy(v, label);
+      await copy(v, label, { secret: key !== user?.key || user.handling !== "visible" });
     } catch (e) {
       if (!wasCancelled(e)) notify(e instanceof Error ? e.message : `${label} could not be read`, "error");
     } finally {
@@ -6031,7 +6101,7 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
         onClick: () => onSelect(item.id),
         className: (0, import_design_system19.cn)("flex h-12 w-full items-center gap-3 rounded-lg px-2 text-left", on ? "bg-primary text-primary-foreground" : "hover:bg-accent"),
         children: [
-          /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(ItemIcon, { definitionKey: item.definitionKey, family, site: siteOf(item), inverted: on }),
+          /* @__PURE__ */ (0, import_jsx_runtime27.jsx)(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
           /* @__PURE__ */ (0, import_jsx_runtime27.jsxs)("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
             /* @__PURE__ */ (0, import_jsx_runtime27.jsx)("span", { className: "truncate text-sm font-medium", children: item.name }),
             /* @__PURE__ */ (0, import_jsx_runtime27.jsx)("span", { className: "truncate text-xs text-muted-foreground", children: subtitleOf(item, withOwner) })
@@ -6047,8 +6117,9 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
 }
 
 // src/lists/TrashView.tsx
-var import_react29 = require("react");
+var import_react30 = require("react");
 var import_controls24 = require("@ai-matrx/design-system/controls");
+var import_format5 = require("@ai-matrx/kit/format");
 
 // src/lists/logic.ts
 var ENTITY_TYPE = "credential_item";
@@ -6059,7 +6130,7 @@ function favoriteIds(data) {
 function recentIds(data, limit = 50) {
   return rowsOf(data).filter((r) => typeof r.last_viewed_at === "string" && r.last_viewed_at !== "").sort((a, b) => Date.parse(b.last_viewed_at) - Date.parse(a.last_viewed_at)).slice(0, limit).map((r) => r.entity_id);
 }
-function matchesQuery2(item, query) {
+function trashItemMatchesQuery(item, query) {
   const q = query.trim().toLowerCase();
   if (!q) return true;
   return [item.name, item.definitionLabel, item.owner.label, ...item.tags].some((s) => s.toLowerCase().includes(q));
@@ -6120,16 +6191,16 @@ function refusalText(reason) {
 }
 
 // src/lists/RestorePanel.tsx
-var import_react28 = require("react");
+var import_react29 = require("react");
 var import_controls23 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime28 = require("react/jsx-runtime");
 var count = (n, one) => `${n} ${one}${n === 1 ? "" : "s"}`;
 function RestorePanel({ lists, item, restore, onClose }) {
-  const [preview, setPreview] = (0, import_react28.useState)(null);
-  const [error, setError] = (0, import_react28.useState)(null);
-  const [busy, setBusy] = (0, import_react28.useState)(false);
-  const [loading, setLoading] = (0, import_react28.useState)(Boolean(lists.preview));
-  (0, import_react28.useEffect)(() => {
+  const [preview, setPreview] = (0, import_react29.useState)(null);
+  const [error, setError] = (0, import_react29.useState)(null);
+  const [busy, setBusy] = (0, import_react29.useState)(false);
+  const [loading, setLoading] = (0, import_react29.useState)(Boolean(lists.preview));
+  (0, import_react29.useEffect)(() => {
     if (!lists.preview) return;
     let live = true;
     lists.preview(item).then(
@@ -6189,10 +6260,10 @@ function RestorePanel({ lists, item, restore, onClose }) {
 var import_jsx_runtime29 = require("react/jsx-runtime");
 function TrashView({ port, deleted, query, header, onChanged }) {
   const confirmed = useConfirmed();
-  const [busyId, setBusyId] = (0, import_react29.useState)(null);
-  const [message2, setMessage] = (0, import_react29.useState)(null);
-  const shown = deleted.filter((i) => matchesQuery2(i, query));
-  const [restoring, setRestoring] = (0, import_react29.useState)(null);
+  const [busyId, setBusyId] = (0, import_react30.useState)(null);
+  const [message2, setMessage] = (0, import_react30.useState)(null);
+  const shown = deleted.filter((i) => trashItemMatchesQuery(i, query));
+  const [restoring, setRestoring] = (0, import_react30.useState)(null);
   const restore = async (item, deletionId) => {
     setBusyId(item.id);
     setMessage(null);
@@ -6216,7 +6287,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
       /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)("div", { className: "flex min-h-12 items-center gap-3 px-3 py-1.5 sm:px-4", children: [
         /* @__PURE__ */ (0, import_jsx_runtime29.jsxs)("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
           /* @__PURE__ */ (0, import_jsx_runtime29.jsx)("span", { className: "truncate text-sm text-foreground", children: item.name }),
-          /* @__PURE__ */ (0, import_jsx_runtime29.jsx)("span", { className: "truncate text-xs text-muted-foreground", children: [item.deletion?.deletedAt ? `Deleted ${formatDate(item.deletion.deletedAt)}` : null, item.owner.kind !== "me" ? item.owner.label : null].filter(Boolean).join(" \xB7 ") })
+          /* @__PURE__ */ (0, import_jsx_runtime29.jsx)("span", { className: "truncate text-xs text-muted-foreground", children: [item.deletion?.deletedAt ? `Deleted ${(0, import_format5.formatAbsoluteDate)(item.deletion.deletedAt, DAY_FORMAT, "")}` : null, item.owner.kind !== "me" ? item.owner.label : null].filter(Boolean).join(" \xB7 ") })
         ] }),
         /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(import_controls24.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime29.jsx)(RestoreGlyph, {}), disabled: busyId !== null || !item.deletion, onClick: () => setRestoring(item), children: "Restore" })
       ] }, item.id)
@@ -6227,15 +6298,15 @@ function TrashView({ port, deleted, query, header, onChanged }) {
 }
 
 // src/NewItemFlow.tsx
-var import_react30 = require("react");
+var import_react31 = require("react");
 var import_design_system20 = require("@ai-matrx/design-system");
 var import_controls25 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime30 = require("react/jsx-runtime");
 function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
-  const [search, setSearch] = (0, import_react30.useState)("");
-  const guess = (0, import_react30.useMemo)(() => inferFromUrl(url, definitions), [url, definitions]);
+  const [search, setSearch] = (0, import_react31.useState)("");
+  const guess = (0, import_react31.useMemo)(() => inferFromUrl(url, definitions), [url, definitions]);
   const common = COMMON_DEFINITION_KEYS.map((k) => definitions.find((d) => d.key === k)).filter((d) => d !== void 0);
-  const matches = (0, import_react30.useMemo)(() => {
+  const matches = (0, import_react31.useMemo)(() => {
     const q = search.trim().toLowerCase();
     if (!q) return [];
     return definitions.filter((d) => `${d.label} ${d.key} ${d.providerKey ?? ""} ${FAMILY_LABELS[d.family] ?? ""}`.toLowerCase().includes(q)).slice(0, 60);
@@ -6299,13 +6370,14 @@ function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
 }
 
 // src/sharing/SecureLinkPanel.tsx
-var import_react31 = require("react");
+var import_react32 = require("react");
 var import_confirm_opener10 = require("@ai-matrx/kit/confirm-opener");
 var import_design_system21 = require("@ai-matrx/design-system");
 var import_controls26 = require("@ai-matrx/design-system/controls");
+var import_format7 = require("@ai-matrx/kit/format");
 
 // src/sharing/secure-link-logic.ts
-var import_format2 = require("@ai-matrx/kit/format");
+var import_format6 = require("@ai-matrx/kit/format");
 var SECURE_RESOURCE_TYPE = "credential_item";
 var NOTE_MAX = 1e3;
 var CHANNEL_WORD = { email: "email", sms: "text" };
@@ -6343,7 +6415,7 @@ function carriedWords(keys, fields) {
   const known = new Map(fields.map((f) => [f.key, f.label]));
   return keys.map((k) => known.get(k) ?? fieldNames([k])).join(", ");
 }
-var lifetimeWords = (minutes) => (0, import_format2.formatDurationMinutes)(minutes, { style: "long" });
+var lifetimeWords = (minutes) => (0, import_format6.formatDurationMinutes)(minutes, { style: "long" });
 function remedyOf(e) {
   const body = e?.serverDetail;
   if (!body || typeof body !== "object") return null;
@@ -6381,20 +6453,20 @@ var import_jsx_runtime31 = require("react/jsx-runtime");
 function SecureLinkPanel({ item, port, onClose }) {
   const sharing = port.sharing;
   const { busy, error, notice, run, setNotice } = useAction();
-  const [remedy, setRemedy] = (0, import_react31.useState)(null);
-  const [options, setOptions] = (0, import_react31.useState)(null);
-  const [optionsError, setOptionsError] = (0, import_react31.useState)(null);
-  const [sent, setSent] = (0, import_react31.useState)(null);
-  const [sentError, setSentError] = (0, import_react31.useState)(null);
-  const [nonce, setNonce] = (0, import_react31.useState)(0);
-  const [email, setEmail] = (0, import_react31.useState)("");
-  const [phone, setPhone] = (0, import_react31.useState)("");
-  const [name, setName] = (0, import_react31.useState)("");
-  const [linkBy, setLinkBy] = (0, import_react31.useState)("email");
-  const [fields, setFields] = (0, import_react31.useState)([]);
-  const [note, setNote] = (0, import_react31.useState)("");
-  const [sameChannelSent, setSameChannelSent] = (0, import_react31.useState)(false);
-  (0, import_react31.useEffect)(() => {
+  const [remedy, setRemedy] = (0, import_react32.useState)(null);
+  const [options, setOptions] = (0, import_react32.useState)(null);
+  const [optionsError, setOptionsError] = (0, import_react32.useState)(null);
+  const [sent, setSent] = (0, import_react32.useState)(null);
+  const [sentError, setSentError] = (0, import_react32.useState)(null);
+  const [nonce, setNonce] = (0, import_react32.useState)(0);
+  const [email, setEmail] = (0, import_react32.useState)("");
+  const [phone, setPhone] = (0, import_react32.useState)("");
+  const [name, setName] = (0, import_react32.useState)("");
+  const [linkBy, setLinkBy] = (0, import_react32.useState)("email");
+  const [fields, setFields] = (0, import_react32.useState)([]);
+  const [note, setNote] = (0, import_react32.useState)("");
+  const [sameChannelSent, setSameChannelSent] = (0, import_react32.useState)(false);
+  (0, import_react32.useEffect)(() => {
     let live = true;
     setOptionsError(null);
     sharing.secureLinkOptions(item).then(
@@ -6409,7 +6481,7 @@ function SecureLinkPanel({ item, port, onClose }) {
       live = false;
     };
   }, [sharing, item]);
-  (0, import_react31.useEffect)(() => {
+  (0, import_react32.useEffect)(() => {
     const list = sharing.sentSecureLinks;
     if (!list) return;
     let live = true;
@@ -6422,9 +6494,9 @@ function SecureLinkPanel({ item, port, onClose }) {
       live = false;
     };
   }, [sharing, item, nonce]);
-  const [phoneTyped, setPhoneTyped] = (0, import_react31.useState)(false);
-  const prefilled = (0, import_react31.useRef)(false);
-  (0, import_react31.useEffect)(() => {
+  const [phoneTyped, setPhoneTyped] = (0, import_react32.useState)(false);
+  const prefilled = (0, import_react32.useRef)(false);
+  (0, import_react32.useEffect)(() => {
     const lookup = sharing.phoneOnFile;
     if (!lookup || phoneTyped) return;
     const clear = () => {
@@ -6572,15 +6644,16 @@ function SecureLinkPanel({ item, port, onClose }) {
   );
 }
 function sentMeta(row, options) {
-  const when = row.status === "pending" ? `Until ${formatDate(row.expiresAt, true)}` : row.status === "viewed" && row.viewedAt ? formatDate(row.viewedAt, true) : formatDate(row.createdAt);
+  const when = row.status === "pending" ? `Until ${(0, import_format7.formatAbsoluteDate)(row.expiresAt, void 0, "")}` : row.status === "viewed" && row.viewedAt ? (0, import_format7.formatAbsoluteDate)(row.viewedAt, void 0, "") : (0, import_format7.formatAbsoluteDate)(row.createdAt, DAY_FORMAT, "");
   const carried = row.fieldKeys.length ? carriedWords(row.fieldKeys, options?.fields ?? []) : "";
   return [when, carried].filter(Boolean).join(" \xB7 ");
 }
 
 // src/devices/DevicesPanel.tsx
-var import_react32 = require("react");
+var import_react33 = require("react");
 var import_confirm_opener11 = require("@ai-matrx/kit/confirm-opener");
 var import_controls27 = require("@ai-matrx/design-system/controls");
+var import_format8 = require("@ai-matrx/kit/format");
 
 // src/devices/logic.ts
 var PASSKEY_RP_ID = "aimatrx.com";
@@ -6668,10 +6741,10 @@ function ErrorLine2({ text }) {
 function DevicesPanel({ port, onClose }) {
   const confirmed = useConfirmed();
   const notify = useNotify();
-  const [devices, setDevices] = (0, import_react32.useState)(null);
-  const [error, setError] = (0, import_react32.useState)(null);
-  const [busyId, setBusyId] = (0, import_react32.useState)(null);
-  const load = (0, import_react32.useCallback)(async () => {
+  const [devices, setDevices] = (0, import_react33.useState)(null);
+  const [error, setError] = (0, import_react33.useState)(null);
+  const [busyId, setBusyId] = (0, import_react33.useState)(null);
+  const load = (0, import_react33.useCallback)(async () => {
     setError(null);
     try {
       setDevices(await port.devices.list());
@@ -6679,7 +6752,7 @@ function DevicesPanel({ port, onClose }) {
       setError(messageOf3(e, "Your browsers could not be read."));
     }
   }, [port]);
-  (0, import_react32.useEffect)(() => {
+  (0, import_react33.useEffect)(() => {
     void load();
   }, [load]);
   const revoke = async (device) => {
@@ -6710,13 +6783,13 @@ function DevicesPanel({ port, onClose }) {
         Row,
         {
           label: off ? "Turned off" : "Can fill",
-          hint: off ? formatDate(device.revokedAt) : void 0,
+          hint: off ? (0, import_format8.formatAbsoluteDate)(device.revokedAt, DAY_FORMAT, "") : void 0,
           actions: off ? null : /* @__PURE__ */ (0, import_jsx_runtime32.jsx)(import_controls27.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime32.jsx)(PowerGlyph, {}), disabled: busyId !== null, onClick: () => void revoke(device), children: "Revoke" }),
           children: /* @__PURE__ */ (0, import_jsx_runtime32.jsxs)("span", { className: "flex min-w-0 flex-col", children: [
             /* @__PURE__ */ (0, import_jsx_runtime32.jsx)("span", { className: off ? "truncate text-muted-foreground" : "truncate text-foreground", children: device.label }),
             /* @__PURE__ */ (0, import_jsx_runtime32.jsxs)("span", { className: "truncate text-xs text-muted-foreground", children: [
-              device.lastUsedAt ? `Last used ${formatDate(device.lastUsedAt, true)}` : "Never used",
-              device.addedAt ? ` \xB7 added ${formatDate(device.addedAt)}` : ""
+              device.lastUsedAt ? `Last used ${(0, import_format8.formatAbsoluteDate)(device.lastUsedAt, void 0, "")}` : "Never used",
+              device.addedAt ? ` \xB7 added ${(0, import_format8.formatAbsoluteDate)(device.addedAt, DAY_FORMAT, "")}` : ""
             ] })
           ] })
         },
@@ -6737,11 +6810,11 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
   const where = isMac ? "the Mac app" : "the extension";
   const passkeys = port.devices.passkeys;
   const here = passkeys?.available() ?? false;
-  const [methods, setMethods] = (0, import_react32.useState)(null);
-  const [busy, setBusy] = (0, import_react32.useState)(null);
-  const [error, setError] = (0, import_react32.useState)(null);
-  const [approvedUntil, setApprovedUntil] = (0, import_react32.useState)(null);
-  const load = (0, import_react32.useCallback)(async () => {
+  const [methods, setMethods] = (0, import_react33.useState)(null);
+  const [busy, setBusy] = (0, import_react33.useState)(null);
+  const [error, setError] = (0, import_react33.useState)(null);
+  const [approvedUntil, setApprovedUntil] = (0, import_react33.useState)(null);
+  const load = (0, import_react33.useCallback)(async () => {
     setError(null);
     try {
       setMethods(await port.devices.stepUpMethods());
@@ -6749,7 +6822,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
       setError(messageOf3(e, "Your account could not be checked."));
     }
   }, [port]);
-  (0, import_react32.useEffect)(() => {
+  (0, import_react33.useEffect)(() => {
     if (key && here) void load();
   }, [key, here, load]);
   const approve = async () => {
@@ -6810,7 +6883,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
       "Return to ",
       where,
       " by ",
-      formatDate(approvedUntil, true),
+      (0, import_format8.formatAbsoluteDate)(approvedUntil, void 0, ""),
       "."
     ] }) }) : !passkeys ? /* @__PURE__ */ (0, import_jsx_runtime32.jsxs)(Empty, { children: [
       "Approve with your password in ",
@@ -6837,7 +6910,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
 }
 
 // src/native/NativeImportPanel.tsx
-var import_react34 = require("react");
+var import_react35 = require("react");
 var import_confirm_opener12 = require("@ai-matrx/kit/confirm-opener");
 var import_controls28 = require("@ai-matrx/design-system/controls");
 
@@ -6900,19 +6973,19 @@ async function loadFullPreview(bridge, operationId, current) {
 }
 
 // src/native/use-native-import.ts
-var import_react33 = require("react");
+var import_react34 = require("react");
 var fail = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 var RESTART = "Your account changed. The import was stopped; start it again.";
 function useNativeImport(bridge, stillAllowed, onImported) {
-  const [screen, setScreen] = (0, import_react33.useState)({ kind: "idle", message: null });
-  const [busy, setBusy] = (0, import_react33.useState)(false);
-  const generation = (0, import_react33.useRef)(0);
-  const mounted = (0, import_react33.useRef)(false);
-  const op = (0, import_react33.useRef)(null);
-  const last = (0, import_react33.useRef)(null);
-  const timer2 = (0, import_react33.useRef)(null);
-  const polls = (0, import_react33.useRef)(0);
-  const refreshRef = (0, import_react33.useRef)(async () => void 0);
+  const [screen, setScreen] = (0, import_react34.useState)({ kind: "idle", message: null });
+  const [busy, setBusy] = (0, import_react34.useState)(false);
+  const generation = (0, import_react34.useRef)(0);
+  const mounted = (0, import_react34.useRef)(false);
+  const op = (0, import_react34.useRef)(null);
+  const last = (0, import_react34.useRef)(null);
+  const timer2 = (0, import_react34.useRef)(null);
+  const polls = (0, import_react34.useRef)(0);
+  const refreshRef = (0, import_react34.useRef)(async () => void 0);
   const current = (g) => mounted.current && g === generation.current;
   const stopPolling = () => {
     if (timer2.current !== null) clearTimeout(timer2.current);
@@ -7081,9 +7154,9 @@ function useNativeImport(bridge, stillAllowed, onImported) {
     setBusy(false);
     setScreen({ kind: "idle", message: null });
   };
-  const invalidateRef = (0, import_react33.useRef)(invalidate);
+  const invalidateRef = (0, import_react34.useRef)(invalidate);
   invalidateRef.current = invalidate;
-  (0, import_react33.useEffect)(() => {
+  (0, import_react34.useEffect)(() => {
     mounted.current = true;
     const off = bridge.subscribe?.(() => {
       if (op.current) invalidateRef.current(RESTART);
@@ -7115,14 +7188,14 @@ function NativeImportPanel({ bridge, readLimits, activeOrganizationId, organizat
   return /* @__PURE__ */ (0, import_jsx_runtime33.jsx)(Importer, { bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged });
 }
 function Importer({ bridge, readLimits, activeOrganizationId, organizations, onClose, onChanged }) {
-  const options = (0, import_react34.useMemo)(() => organizations.map((o) => ({ value: o.id, label: o.name })), [organizations]);
-  const [organizationId, setOrganizationId] = (0, import_react34.useState)(() => organizations.some((o) => o.id === activeOrganizationId) ? activeOrganizationId : organizations[0]?.id ?? "");
-  const [limits, setLimits] = (0, import_react34.useState)(null);
-  const [limitError, setLimitError] = (0, import_react34.useState)(null);
+  const options = (0, import_react35.useMemo)(() => organizations.map((o) => ({ value: o.id, label: o.name })), [organizations]);
+  const [organizationId, setOrganizationId] = (0, import_react35.useState)(() => organizations.some((o) => o.id === activeOrganizationId) ? activeOrganizationId : organizations[0]?.id ?? "");
+  const [limits, setLimits] = (0, import_react35.useState)(null);
+  const [limitError, setLimitError] = (0, import_react35.useState)(null);
   const flow = useNativeImport(bridge, (id) => organizations.some((o) => o.id === id), onChanged);
   const { screen, busy } = flow;
   const orgName = organizations.find((o) => o.id === organizationId)?.name ?? "this organization";
-  (0, import_react34.useEffect)(() => {
+  (0, import_react35.useEffect)(() => {
     if (!readLimits || !organizationId) return;
     let live = true;
     setLimits(null);
@@ -7183,20 +7256,20 @@ function Importer({ bridge, readLimits, activeOrganizationId, organizations, onC
 }
 
 // src/extension/PageView.tsx
-var import_react38 = require("react");
+var import_react39 = require("react");
 var import_design_system23 = require("@ai-matrx/design-system");
 var import_controls32 = require("@ai-matrx/design-system/controls");
 
 // src/extension/CaptureCard.tsx
-var import_react35 = require("react");
+var import_react36 = require("react");
 var import_controls29 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime34 = require("react/jsx-runtime");
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
-  const prompt = (0, import_react35.useSyncExternalStore)(capture.subscribe, capture.get, capture.get);
+  const prompt = (0, import_react36.useSyncExternalStore)(capture.subscribe, capture.get, capture.get);
   const notify = useNotify();
-  const [busy, setBusy] = (0, import_react35.useState)(false);
-  const [q, setQ] = (0, import_react35.useState)("");
+  const [busy, setBusy] = (0, import_react36.useState)(false);
+  const [q, setQ] = (0, import_react36.useState)("");
   if (!prompt) return null;
   const decide = async (d) => {
     setBusy(true);
@@ -7252,15 +7325,15 @@ function CaptureCard({ capture, onChanged }) {
 }
 
 // src/extension/FillSetupCard.tsx
-var import_react36 = require("react");
+var import_react37 = require("react");
 var import_controls30 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime35 = require("react/jsx-runtime");
 function FillSetupCard({ fillSetup }) {
   const notify = useNotify();
-  const state = (0, import_react36.useSyncExternalStore)(fillSetup.subscribe, fillSetup.get, fillSetup.get);
-  const box = (0, import_react36.useRef)(null);
-  const [busy, setBusy] = (0, import_react36.useState)(false);
-  const [error, setError] = (0, import_react36.useState)(null);
+  const state = (0, import_react37.useSyncExternalStore)(fillSetup.subscribe, fillSetup.get, fillSetup.get);
+  const box = (0, import_react37.useRef)(null);
+  const [busy, setBusy] = (0, import_react37.useState)(false);
+  const [error, setError] = (0, import_react37.useState)(null);
   if (state.status !== "off") return null;
   const finish = async (run) => {
     setBusy(true);
@@ -7325,7 +7398,7 @@ function FillSetupCard({ fillSetup }) {
 }
 
 // src/extension/PageGenerator.tsx
-var import_react37 = require("react");
+var import_react38 = require("react");
 var import_design_system22 = require("@ai-matrx/design-system");
 var import_controls31 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime36 = require("react/jsx-runtime");
@@ -7334,10 +7407,10 @@ function PageGenerator({ fields }) {
   const limits = useGeneratorLimitsSource();
   const copy = useCopy();
   const held = useTransientSecret(HOLD_MS);
-  const [open, setOpen] = (0, import_react37.useState)(false);
-  const [busy, setBusy] = (0, import_react37.useState)(false);
-  const [targets, setTargets] = (0, import_react37.useState)([]);
-  const [said, setSaid] = (0, import_react37.useState)(null);
+  const [open, setOpen] = (0, import_react38.useState)(false);
+  const [busy, setBusy] = (0, import_react38.useState)(false);
+  const [targets, setTargets] = (0, import_react38.useState)([]);
+  const [said, setSaid] = (0, import_react38.useState)(null);
   if (!limits) return null;
   const say3 = setSaid;
   const put = async (targetId, value2) => {
@@ -7401,8 +7474,8 @@ function PageGenerator({ fields }) {
 // src/extension/PageView.tsx
 var import_jsx_runtime37 = require("react/jsx-runtime");
 function PageView({ port, page, fill, capture, fillSetup, newPasswordFields, items, definitions, onOpen, onNewForPage, onBrowse, onChanged, header }) {
-  const [running, setRunning] = (0, import_react38.useState)(null);
-  const [said, setSaid] = (0, import_react38.useState)(null);
+  const [running, setRunning] = (0, import_react39.useState)(null);
+  const [said, setSaid] = (0, import_react39.useState)(null);
   const site = pageSite(page.url);
   const state = page.matchState ?? { status: "ready" };
   const fillable = new Set(page.fillableItemIds ?? page.matchingItemIds);
@@ -7486,7 +7559,7 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
   const confirmed = useConfirmed();
   const copy = useCopy();
   const notify = useNotify();
-  const [reading, setReading] = (0, import_react38.useState)(false);
+  const [reading, setReading] = (0, import_react39.useState)(false);
   const usable = item?.capabilities.canUse ?? false;
   const user = usable ? item?.fields.find((f) => USERNAME_KEYS.test(f.key) && f.handling !== "sealed" && f.active) : void 0;
   const secret = usable && item?.capabilities.canReveal ? item?.fields.find((f) => f.key === "password" && f.handling === "revealable" && f.active) : void 0;
@@ -7501,10 +7574,10 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
       setReading(false);
     }
   };
-  const subtitle = [item ? siteOf(item) || item.definitionLabel : "", tag].filter(Boolean).join(" \xB7 ");
+  const subtitle = [item ? loginSiteOf(item) || item.definitionLabel : "", tag].filter(Boolean).join(" \xB7 ");
   return /* @__PURE__ */ (0, import_jsx_runtime37.jsxs)("li", { className: "flex h-12 items-center gap-1 pl-1 pr-2", "data-item": itemId, children: [
     /* @__PURE__ */ (0, import_jsx_runtime37.jsxs)("button", { type: "button", onClick: () => onOpen(itemId), className: "flex h-11 min-w-0 flex-1 items-center gap-3 rounded-lg px-2 text-left hover:bg-accent", children: [
-      /* @__PURE__ */ (0, import_jsx_runtime37.jsx)(ItemIcon, { definitionKey: item?.definitionKey ?? "website_login", family, site: item ? siteOf(item) : "" }),
+      /* @__PURE__ */ (0, import_jsx_runtime37.jsx)(ItemIcon, { definitionKey: item?.definitionKey ?? "website_login", family, site: item ? loginSiteOf(item) : "" }),
       /* @__PURE__ */ (0, import_jsx_runtime37.jsxs)("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
         /* @__PURE__ */ (0, import_jsx_runtime37.jsx)("span", { className: "truncate text-sm font-medium", children: item?.name ?? "Saved login" }),
         subtitle ? /* @__PURE__ */ (0, import_jsx_runtime37.jsx)("span", { className: "truncate text-xs text-muted-foreground", children: subtitle }) : null
@@ -7531,7 +7604,7 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
 }
 
 // src/Sidebar.tsx
-var import_react39 = require("react");
+var import_react40 = require("react");
 var import_design_system24 = require("@ai-matrx/design-system");
 var import_controls33 = require("@ai-matrx/design-system/controls");
 var import_jsx_runtime38 = require("react/jsx-runtime");
@@ -7614,7 +7687,7 @@ function Group({ title, children }) {
   ] });
 }
 function Sidebar({ vault, choices, onVault, view, allCount, deletedCount, views, hasFavorites, hasRecents, onView, onPanel, nativeProvider, hasNativeImport = false, hasPage = false }) {
-  const [tagsOpen, setTagsOpen] = (0, import_react39.useState)(view.startsWith("tag:"));
+  const [tagsOpen, setTagsOpen] = (0, import_react40.useState)(view.startsWith("tag:"));
   return /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)("nav", { "aria-label": "Vault", className: "flex h-full min-h-0 flex-col border-r border-sidebar-border bg-sidebar-background text-sidebar-foreground", children: [
     /* @__PURE__ */ (0, import_jsx_runtime38.jsxs)("div", { className: "flex items-center gap-2 px-3 pb-2 pt-3", children: [
       /* @__PURE__ */ (0, import_jsx_runtime38.jsx)(SafeGlyph, { className: "size-5 shrink-0 text-primary" }),
@@ -7674,8 +7747,8 @@ var generatorLimitsFrom = (knobs) => knobs ? async () => {
 } : void 0;
 function ImportWithLimits(props) {
   const { knobs, ...rest } = props;
-  const [state, setState] = (0, import_react40.useState)(null);
-  (0, import_react40.useEffect)(() => {
+  const [state, setState] = (0, import_react41.useState)(null);
+  (0, import_react41.useEffect)(() => {
     if (!knobs) return setState({ error: "Import is not set up for this organization yet." });
     knobs().then(
       (r) => {
@@ -7692,31 +7765,55 @@ function ImportWithLimits(props) {
   return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
 }
 function VaultApp(props) {
-  return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(NoticeProvider, { notify: props.notify, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Workspace, { ...props }) }) }) }) });
+  const lock = props.host?.lock;
+  const locked = useLocked(lock);
+  const port = (0, import_react41.useMemo)(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
+  return /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(LockedScreen, { lock }) : /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(Workspace, { ...props, port }) }) }) }) }) }) });
+}
+function LockedScreen({ lock }) {
+  const [busy, setBusy] = (0, import_react41.useState)(false);
+  const [error, setError] = (0, import_react41.useState)(null);
+  const unlock = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      await lock.unlock();
+    } catch (e) {
+      setError(e instanceof Error && e.message ? e.message : "The vault stayed locked.");
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)("div", { role: "region", "aria-label": "Vault locked", className: "flex h-full min-h-0 flex-col items-center justify-center gap-3 p-6 text-center", children: [
+    /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(LockGlyph, { className: "size-8 text-muted-foreground" }),
+    /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { className: "text-base font-medium text-foreground", children: "Vault locked" }),
+    /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(import_controls34.Button, { variant: "primary", disabled: busy, onClick: () => void unlock(), children: lock.unlockLabel ?? "Unlock" }),
+    error ? /* @__PURE__ */ (0, import_jsx_runtime39.jsx)("div", { role: "alert", className: "max-w-sm text-sm text-destructive", children: error }) : null
+  ] });
 }
 function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocationChange }) {
-  const rootRef = (0, import_react40.useRef)(null);
+  const rootRef = (0, import_react41.useRef)(null);
   const width = useElementWidth(rootRef);
   const mode = layout !== "auto" ? layout : width >= FULL_AT ? "full" : width >= SPLIT_AT ? "split" : "stack";
   const notify = useNotify();
-  const [snap, setSnap] = (0, import_react40.useState)(null);
-  const [items, setItems] = (0, import_react40.useState)([]);
-  const [deleted, setDeleted] = (0, import_react40.useState)([]);
-  const [favorites, setFavorites] = (0, import_react40.useState)(null);
-  const [recents, setRecents] = (0, import_react40.useState)(null);
-  const [error, setError] = (0, import_react40.useState)(null);
-  const [inner, setInner] = (0, import_react40.useState)(DEFAULT_LOCATION);
+  const [snap, setSnap] = (0, import_react41.useState)(null);
+  const [items, setItems] = (0, import_react41.useState)([]);
+  const [deleted, setDeleted] = (0, import_react41.useState)([]);
+  const [favorites, setFavorites] = (0, import_react41.useState)(null);
+  const [recents, setRecents] = (0, import_react41.useState)(null);
+  const [error, setError] = (0, import_react41.useState)(null);
+  const [inner, setInner] = (0, import_react41.useState)(DEFAULT_LOCATION);
   const loc = location ?? inner;
-  const dirty = (0, import_react40.useRef)(false);
-  const [notice, setNotice] = (0, import_react40.useState)(null);
-  const move = (0, import_react40.useCallback)(
+  const dirty = (0, import_react41.useRef)(false);
+  const [notice, setNotice] = (0, import_react41.useState)(null);
+  const move = (0, import_react41.useCallback)(
     (next, how) => {
       if (!location) setInner(next);
       onLocationChange?.(next, how);
     },
     [location, onLocationChange]
   );
-  const go = (0, import_react40.useCallback)(
+  const go = (0, import_react41.useCallback)(
     (patch, how = "push") => {
       const leaving = patch.itemId !== void 0 || patch.mode !== void 0 || patch.vault !== void 0 || patch.view !== void 0;
       const next = { ...loc, ...patch };
@@ -7735,9 +7832,9 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     },
     [loc, move]
   );
-  const knobsRef = (0, import_react40.useRef)(host.knobs);
+  const knobsRef = (0, import_react41.useRef)(host.knobs);
   knobsRef.current = host.knobs;
-  const load = (0, import_react40.useCallback)(() => {
+  const load = (0, import_react41.useCallback)(() => {
     setError(null);
     port.load().then((s) => {
       setSnap(s);
@@ -7752,17 +7849,17 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     knobsRef.current?.().catch(() => void 0);
     port.lists.recents?.list().then(setRecents, () => void 0);
   }, [port]);
-  (0, import_react40.useEffect)(load, [load]);
-  (0, import_react40.useEffect)(() => {
+  (0, import_react41.useEffect)(load, [load]);
+  (0, import_react41.useEffect)(() => {
     if (!loc.itemId || !port.lists.recents) return;
     const id = loc.itemId;
     port.lists.recents.record(id).then(() => setRecents((r) => [id, ...(r ?? []).filter((x) => x !== id)]), () => void 0);
   }, [loc.itemId, port]);
   const orgs = snap?.organizations ?? [];
   const definitions = snap?.definitions ?? [];
-  const inThisVault = (0, import_react40.useMemo)(() => items.filter((i) => inVault(i, loc.vault)), [items, loc.vault]);
-  const views = (0, import_react40.useMemo)(() => buildViews(inThisVault, definitions, favorites, recents), [inThisVault, definitions, favorites, recents]);
-  const visible = (0, import_react40.useMemo)(() => {
+  const inThisVault = (0, import_react41.useMemo)(() => items.filter((i) => inVault(i, loc.vault)), [items, loc.vault]);
+  const views = (0, import_react41.useMemo)(() => buildViews(inThisVault, definitions, favorites, recents), [inThisVault, definitions, favorites, recents]);
+  const visible = (0, import_react41.useMemo)(() => {
     const filtered = inThisVault.filter((i) => {
       if (!matchesQuery(i, loc.q)) return false;
       if (loc.view === "favorites") return favorites?.has(i.id) ?? false;
@@ -7773,8 +7870,8 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     if (loc.view === "recent" && recents) return [...filtered].sort((a, b) => recents.indexOf(a.id) - recents.indexOf(b.id));
     return sortItems(filtered, loc.sort);
   }, [inThisVault, loc.view, loc.q, loc.sort, favorites, recents, definitions]);
-  const choices = (0, import_react40.useMemo)(() => vaultChoices(items, orgs, loc.vault), [items, orgs, loc.vault]);
-  const matchingIds = (0, import_react40.useMemo)(() => host.page ? new Set(host.page.matchingItemIds) : void 0, [host.page]);
+  const choices = (0, import_react41.useMemo)(() => vaultChoices(items, orgs, loc.vault), [items, orgs, loc.vault]);
+  const matchingIds = (0, import_react41.useMemo)(() => host.page ? new Set(host.page.matchingItemIds) : void 0, [host.page]);
   const selected = loc.itemId ? items.find((i) => i.id === loc.itemId) ?? null : null;
   const replaceItem = (next) => setItems((cur) => cur.some((i) => i.id === next.id) ? cur.map((i) => i.id === next.id ? next : i) : [...cur, next]);
   const toggleFavorite = (id) => {
@@ -7845,6 +7942,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)(import_design_system25.DropdownMenuItem, { onSelect: host.nativeProvider.openSetup, children: [
           /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(ShieldGlyph, { className: "size-4" }),
           "System AutoFill"
+        ] }) : null,
+        host.lock?.lock ? /* @__PURE__ */ (0, import_jsx_runtime39.jsxs)(import_design_system25.DropdownMenuItem, { onSelect: () => void host.lock?.lock?.(), children: [
+          /* @__PURE__ */ (0, import_jsx_runtime39.jsx)(LockGlyph, { className: "size-4" }),
+          "Lock"
         ] }) : null
       ] })
     ] })
@@ -8459,7 +8560,7 @@ function createSharingPort(ctx, options = {}) {
       return r.grants.map(grantOf);
     },
     async addPerson(item, email, level) {
-      const w = await account6.addGrant(api, { path: { item_id: item.id }, body: { recipient_email: email.trim(), ...flagsOf(level), initiation: "user" } }, ctx.optsFor(item));
+      const w = await account6.addGrant(api, { path: { item_id: item.id }, body: { recipient_email: email.trim(), ...shareFlagsOf(level), initiation: "user" } }, ctx.optsFor(item));
       return grantOf(w);
     },
     async addOrganization(item, organizationId, level) {
@@ -8467,14 +8568,14 @@ function createSharingPort(ctx, options = {}) {
       return grantOf(w);
     },
     async setLevel(item, grant, level) {
-      const w = await account6.updateGrant(api, { path: { item_id: item.id, grant_id: grant.id }, body: { ...flagsOf(level), initiation: "user" } }, ctx.optsFor(item));
+      const w = await account6.updateGrant(api, { path: { item_id: item.id, grant_id: grant.id }, body: { ...shareFlagsOf(level), initiation: "user" } }, ctx.optsFor(item));
       return grantOf(w);
     },
     async revoke(item, grant) {
       await account6.removeGrant(api, { path: { item_id: item.id, grant_id: grant.id } }, ctx.optsFor(item));
     },
     async setAccessMode(item, mode, people) {
-      const grantees = mode === "restricted" ? people.filter((g) => g.kind === "person" && g.userId).map((g) => ({ user_id: g.userId, ...flagsOf(g.level) })) : [];
+      const grantees = mode === "restricted" ? people.filter((g) => g.kind === "person" && g.userId).map((g) => ({ user_id: g.userId, ...shareFlagsOf(g.level) })) : [];
       await account6.share(api, { path: { item_id: item.id }, body: { access_mode: mode, grantees, initiation: "user" } }, ctx.optsFor(item));
       return ctx.refetch(item.id, item.owner);
     },