@ai-matrx/vault 0.1.5 → 0.1.7

package/dist/index.js

@@ -115,9 +115,28 @@ var Ctx = createContext(() => void 0);
 function useNotify() {
   return useContext(Ctx);
 }
+async function copyValue(text, label, options, deps) {
+  const secret = options.secret ?? true;
+  if (deps.clipboard) {
+    try {
+      await deps.clipboard.copy(text, { secret });
+      deps.notify(`${label} copied`, "success");
+      return true;
+    } catch (e) {
+      deps.notify(e instanceof Error && e.message ? e.message : `${label} could not be copied`, "error");
+      return false;
+    }
+  }
+  return copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => deps.notify(m, k === "error" ? "error" : "success") });
+}
+var ClipboardCtx = createContext(void 0);
+function ClipboardProvider({ clipboard, children }) {
+  return /* @__PURE__ */ jsx(ClipboardCtx.Provider, { value: clipboard, children });
+}
 function useCopy() {
   const notify = useNotify();
-  return useCallback((text, label) => copyText(text, { successMessage: `${label} copied`, failureMessage: `${label} could not be copied`, notify: (m, k) => notify(m, k === "error" ? "error" : "success") }), [notify]);
+  const clipboard = useContext(ClipboardCtx);
+  return useCallback((text, label, options = {}) => copyValue(text, label, options, { clipboard, notify }), [notify, clipboard]);
 }
 function NoticeProvider({ notify, children }) {
   const [shown, setShown] = useState(null);
@@ -494,8 +513,16 @@ import { Badge, Button as Button2, Field as Field2, Textarea } from "@ai-matrx/d
 import { cn as cn3 } from "@ai-matrx/design-system";
 
 // src/hooks.ts
-import { useCallback as useCallback2, useEffect as useEffect3, useLayoutEffect, useRef as useRef3, useState as useState3 } from "react";
-function useTransientSecret(ms = 2e4) {
+import { createContext as createContext3, createElement, useCallback as useCallback2, useContext as useContext3, useEffect as useEffect3, useLayoutEffect, useRef as useRef3, useState as useState3 } from "react";
+var DEFAULT_REVEAL_MS = 2e4;
+var RevealMs = createContext3(DEFAULT_REVEAL_MS);
+function RevealSecondsProvider({ seconds, children }) {
+  const ms = seconds !== void 0 && Number.isFinite(seconds) && seconds > 0 ? seconds * 1e3 : DEFAULT_REVEAL_MS;
+  return createElement(RevealMs.Provider, { value: ms }, children);
+}
+function useTransientSecret(given) {
+  const fromHost = useContext3(RevealMs);
+  const ms = given ?? fromHost;
   const [value, setValue] = useState3(null);
   const timer2 = useRef3(null);
   const clear = useCallback2(() => {
@@ -531,12 +558,12 @@ function useElementWidth(ref) {
 }
 
 // src/ui.tsx
-import { createContext as createContext3, useContext as useContext3, useEffect as useEffect4, useState as useState4 } from "react";
+import { createContext as createContext4, useContext as useContext4, useEffect as useEffect4, useState as useState4 } from "react";
 import { Dialog as Dialog2, DialogContent as DialogContent2, DialogFooter, DialogHeader as DialogHeader2, DialogTitle as DialogTitle2 } from "@ai-matrx/design-system";
 import { cn as cn2 } from "@ai-matrx/design-system";
 import { jsx as jsx4, jsxs as jsxs4 } from "react/jsx-runtime";
-var InPanel = createContext3(false);
-var Room = createContext3(null);
+var InPanel = createContext4(false);
+var Room = createContext4(null);
 var ROOMY_AT = 560;
 function useRoomOf(ref) {
   const [room, setRoom] = useState4(null);
@@ -553,7 +580,7 @@ function useRoomOf(ref) {
 }
 var RoomProvider = Room.Provider;
 function Section({ title, actions, children, className }) {
-  const flat = useContext3(InPanel);
+  const flat = useContext4(InPanel);
   return /* @__PURE__ */ jsxs4("section", { className: cn2("flex flex-col gap-1.5", className), children: [
     title || actions ? /* @__PURE__ */ jsxs4("div", { className: "flex min-h-7 items-center justify-between gap-2 px-1", children: [
       title ? /* @__PURE__ */ jsx4("h3", { className: "text-xs font-medium text-muted-foreground", children: title }) : /* @__PURE__ */ jsx4("span", {}),
@@ -568,7 +595,7 @@ var ROW_GRID = {
   viewport: "grid-cols-[5.75rem_minmax(0,1fr)_auto] gap-x-2 px-3 sm:grid-cols-[9rem_minmax(0,1fr)_auto] sm:gap-x-3 sm:px-4"
 };
 function Row({ label, hint, children, actions, top = false, className }) {
-  const room = useContext3(Room);
+  const room = useContext4(Room);
   return /* @__PURE__ */ jsxs4("div", { className: cn2("grid min-h-11 py-1", ROW_GRID[room ?? "viewport"], top ? "items-start" : "items-center", className), children: [
     /* @__PURE__ */ jsxs4("div", { className: cn2("flex min-w-0 flex-col text-xs leading-tight text-muted-foreground", top && "pt-2.5"), children: [
       /* @__PURE__ */ jsx4("span", { className: room === "roomy" ? "truncate" : room === "compact" ? "line-clamp-2 break-words" : "line-clamp-2 break-words sm:truncate", children: label }),
@@ -593,12 +620,7 @@ function formatBytes(n) {
   if (n < 1024 * 1024) return `${(n / 1024).toFixed(n < 10 * 1024 ? 1 : 0)} KB`;
   return `${(n / 1024 / 1024).toFixed(1)} MB`;
 }
-function formatDate(iso, withTime = false) {
-  if (!iso) return "";
-  const d = new Date(iso);
-  if (Number.isNaN(d.getTime())) return iso;
-  return d.toLocaleString(void 0, withTime ? { year: "numeric", month: "short", day: "numeric", hour: "numeric", minute: "2-digit" } : { year: "numeric", month: "short", day: "numeric" });
-}
+var DAY_FORMAT = { year: "numeric", month: "short", day: "numeric" };
 
 // src/FieldRows.tsx
 import { Fragment as Fragment2, jsx as jsx5, jsxs as jsxs5 } from "react/jsx-runtime";
@@ -610,7 +632,7 @@ function SecretText({ value, multiline }) {
 var quietError = (e, fallback) => wasCancelled(e) ? null : e instanceof Error ? e.message : fallback;
 function SecretRow({ port, item, field, extra }) {
   const confirmed = useConfirmed();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const secret = useTransientSecret();
   const [plain, setPlain] = useState5(null);
   const [busy, setBusy] = useState5(false);
@@ -651,7 +673,7 @@ function SecretRow({ port, item, field, extra }) {
   }
   async function copy() {
     const v = await fetchValue();
-    if (v !== null) await copyValue(v, field.label);
+    if (v !== null) await copyValue2(v, field.label, { secret: !visible });
   }
   const multiline = field.kind === "multiline";
   const shown = visible ? plain : secret.value;
@@ -670,7 +692,7 @@ function SecretRow({ port, item, field, extra }) {
   );
 }
 function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const isUrl = /^https?:\/\//i.test(value);
   return /* @__PURE__ */ jsx5(
     Row,
@@ -681,7 +703,7 @@ function PlainRow({ label, value, hint, openUrl, extra, multiline = false }) {
       actions: /* @__PURE__ */ jsxs5(Fragment2, { children: [
         extra,
         isUrl && openUrl ? /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: /* @__PURE__ */ jsx5(ExternalGlyph, {}), "aria-label": `Open ${value}`, onClick: () => openUrl(value) }) : null,
-        /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: /* @__PURE__ */ jsx5(CopyGlyph, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue(value, typeof label === "string" && label ? label : "Value") })
+        /* @__PURE__ */ jsx5(Button2, { variant: "quiet", icon: /* @__PURE__ */ jsx5(CopyGlyph, {}), "aria-label": `Copy ${typeof label === "string" ? label : "value"}`, onClick: () => void copyValue2(value, typeof label === "string" && label ? label : "Value", { secret: false }) })
       ] }),
       children: isUrl && openUrl ? (
         // A real link (right-click, copy link address, open in a new tab); a click goes through the host's opener.
@@ -738,6 +760,9 @@ function CustomEditRow({ label, value, onLabel, onValue, secret, onRemove }) {
   );
 }
 
+// src/activity/HistoryPanel.tsx
+import { formatAbsoluteDate as formatAbsoluteDate2 } from "@ai-matrx/kit/format";
+
 // src/activity/logic.ts
 import { formatRelativeTime } from "@ai-matrx/kit/format";
 
@@ -789,7 +814,7 @@ function matchesQuery(item, query) {
   return [item.name, item.definitionLabel, ...item.tags, ...item.loginUrls, ...item.custom.map((c) => `${c.label} ${c.value}`)].some((h) => h.toLowerCase().includes(q));
 }
 var isAuthenticatorStorage = (key) => key === "totp_seed" || key.startsWith("totp_") || key === "authenticator_last_time_step";
-function siteOf(item) {
+function loginSiteOf(item) {
   const raw = item.loginUrls[0];
   if (!raw) return "";
   try {
@@ -803,7 +828,7 @@ function sortItems(items, sort) {
   const byName = (a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" });
   if (sort === "name") return out.sort(byName);
   if (sort === "website") return out.sort((a, b) => {
-    const x = siteOf(a), y = siteOf(b);
+    const x = loginSiteOf(a), y = loginSiteOf(b);
     return x && y ? x.localeCompare(y) || byName(a, b) : x ? -1 : y ? 1 : byName(a, b);
   });
   if (sort === "updated") return out.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
@@ -1195,6 +1220,7 @@ var HistoryChangedError = class extends Error {
 import { useEffect as useEffect6, useRef as useRef4, useState as useState6 } from "react";
 import { Button as Button3 } from "@ai-matrx/design-system/controls";
 import { cn as cn4 } from "@ai-matrx/design-system";
+import { formatAbsoluteDate } from "@ai-matrx/kit/format";
 import { jsx as jsx6, jsxs as jsxs6 } from "react/jsx-runtime";
 var PAGE = 50;
 var MAX = 500;
@@ -1231,7 +1257,7 @@ function ActivityPanel({ item, port, onClose }) {
           day.entries.map((entry) => ({ entry, s: auditSentence(entry, item, me) })),
           (r) => `${r.s.what}|${r.s.who ?? ""}`
         ).map(({ row: { entry, s }, times }) => {
-          return /* @__PURE__ */ jsxs6("div", { className: "flex min-h-9 items-center gap-1.5 px-3 text-sm sm:px-4", title: formatDate(entry.at, true), children: [
+          return /* @__PURE__ */ jsxs6("div", { className: "flex min-h-9 items-center gap-1.5 px-3 text-sm sm:px-4", title: formatAbsoluteDate(entry.at, void 0, ""), children: [
             /* @__PURE__ */ jsx6("span", { className: cn4("truncate", s.refused ? "text-destructive" : "text-foreground"), children: s.what }),
             /* @__PURE__ */ jsxs6("span", { className: "shrink-0 text-muted-foreground", children: [
               times > 1 ? ` \xB7 ${times} times` : "",
@@ -1316,7 +1342,7 @@ function HistoryPanel({ item, port, arg, onClose, onChanged }) {
         page && (page.captureStartedAt || page.incomplete) ? /* @__PURE__ */ jsxs7("div", { className: "flex flex-wrap gap-x-3 gap-y-1 px-1 text-xs", children: [
           page.captureStartedAt ? /* @__PURE__ */ jsxs7("span", { className: "text-muted-foreground", children: [
             "Kept since ",
-            formatDate(page.captureStartedAt, true)
+            formatAbsoluteDate2(page.captureStartedAt, void 0, "")
           ] }) : null,
           page.incomplete ? /* @__PURE__ */ jsx7("span", { className: "text-warning", children: "Some changes could not be read" }) : null
         ] }) : null
@@ -1327,9 +1353,9 @@ function HistoryPanel({ item, port, arg, onClose, onChanged }) {
 function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, onError }) {
   const confirmed = useConfirmed();
   const secret = useTransientSecret();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const [busy, setBusy] = useState7(false);
-  const when = formatDate(entry.recordedAt, true);
+  const when = formatAbsoluteDate2(entry.recordedAt, void 0, "");
   async function read() {
     if (secret.value !== null) return secret.value;
     setBusy(true);
@@ -1350,7 +1376,7 @@ function HistoryRow({ item, port, page, entry, label, onRestored, onConflict, on
   }
   async function copy() {
     const v = await read();
-    if (v !== null) await copyValue(v, `Earlier ${label.toLowerCase()}`);
+    if (v !== null) await copyValue2(v, `Earlier ${label.toLowerCase()}`);
   }
   async function restore() {
     const yes = await confirm({
@@ -1491,11 +1517,11 @@ function authenticatorName(current, parsed) {
   if (name && !PLACEHOLDER_NAMES.includes(name.toLowerCase())) return name;
   return parsed.issuer || parsed.account || name || "One-time password";
 }
-function matchIssuerToSite(issuer, candidates, siteOf2) {
+function matchIssuerToSite(issuer, candidates, siteOf) {
   const key = (issuer ?? "").toLowerCase().replace(/[^a-z0-9]/g, "");
   if (key.length < 2) return null;
   for (const c of candidates) {
-    const host = siteOf2(c).toLowerCase();
+    const host = siteOf(c).toLowerCase();
     if (!host) continue;
     const labels = host.split(".");
     if (labels.some((l) => l.replace(/[^a-z0-9]/g, "") === key)) return c;
@@ -1535,13 +1561,13 @@ function CountdownRing({ remaining, period, loading = false, className }) {
 }
 function useCopied() {
   const [copied, setCopied] = useState8(false);
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const t = useRef6(null);
   useEffect8(() => () => void (t.current && clearTimeout(t.current)), []);
   return {
     copied,
     copy: async (code) => {
-      const ok = await copyValue(code, "One-time code");
+      const ok = await copyValue2(code, "One-time code");
       if (!ok) return;
       setCopied(true);
       if (t.current) clearTimeout(t.current);
@@ -2116,7 +2142,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
   const recognise = (p) => {
     if (!nameTouched) setName((n) => authenticatorName(n, p));
     if (!targetChosen) {
-      const match = matchIssuerToSite(p.issuer, candidates, siteOf);
+      const match = matchIssuerToSite(p.issuer, candidates, loginSiteOf);
       setTarget(match ? match.id : NEW);
     }
   };
@@ -2194,7 +2220,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
               value: target,
               disabled: busy || created !== null,
               "aria-label": "Add to",
-              options: [{ value: NEW, label: "New login" }, ...candidates.map((c) => ({ value: c.id, label: siteOf(c) ? `${c.name} \xB7 ${siteOf(c)}` : c.name }))],
+              options: [{ value: NEW, label: "New login" }, ...candidates.map((c) => ({ value: c.id, label: loginSiteOf(c) ? `${c.name} \xB7 ${loginSiteOf(c)}` : c.name }))],
               onValueChange: (v) => {
                 setTarget(v);
                 setTargetChosen(true);
@@ -2356,7 +2382,7 @@ function OtpListRow({ port, item, family, entry, onOpen, onRename, onChanged, on
   const Icon = definitionGlyph(item.definitionKey, family);
   const canManage = item.capabilities.canManage || item.capabilities.canEdit;
   if (a.removed) return null;
-  const sub = a.error ?? [entry?.account, siteOf(item) || entry?.issuer].filter((v, i, all) => Boolean(v) && all.indexOf(v) === i).join(" \xB7 ");
+  const sub = a.error ?? [entry?.account, loginSiteOf(item) || entry?.issuer].filter((v, i, all) => Boolean(v) && all.indexOf(v) === i).join(" \xB7 ");
   return /* @__PURE__ */ jsxs12("div", { className: "grid min-h-14 grid-cols-[2rem_minmax(0,1fr)_auto_auto] items-center gap-x-3 rounded-lg px-2 py-1.5 transition-colors hover:bg-accent/50", children: [
     /* @__PURE__ */ jsx12("button", { type: "button", onClick: onOpen, "aria-label": `Open ${item.name}`, tabIndex: -1, className: cn6("flex size-8 items-center justify-center rounded-lg bg-muted", a.enabled ? "text-foreground" : "text-disabled-foreground"), children: /* @__PURE__ */ jsx12(Icon, { className: "size-4" }) }),
     /* @__PURE__ */ jsxs12("button", { type: "button", onClick: onOpen, className: "flex min-w-0 flex-col items-start rounded-md text-left focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring", children: [
@@ -2683,7 +2709,7 @@ function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
 }
 
 // src/generator/PasswordGenerator.tsx
-import { createContext as createContext4, useContext as useContext4, useEffect as useEffect12, useRef as useRef10, useState as useState15 } from "react";
+import { createContext as createContext5, useContext as useContext5, useEffect as useEffect12, useRef as useRef10, useState as useState15 } from "react";
 import { Popover, PopoverContent, PopoverTrigger, cn as cn7 } from "@ai-matrx/design-system";
 import { Button as Button11, NumberStepper, SegmentedControl as SegmentedControl2, Select as Select4, Switch as Switch2 } from "@ai-matrx/design-system/controls";
 
@@ -2744,12 +2770,12 @@ function strengthOf(bits) {
 
 // src/generator/PasswordGenerator.tsx
 import { jsx as jsx14, jsxs as jsxs14 } from "react/jsx-runtime";
-var LimitsCtx = createContext4(null);
+var LimitsCtx = createContext5(null);
 function GeneratorLimitsProvider({ resolve: resolve2, children }) {
   return /* @__PURE__ */ jsx14(LimitsCtx.Provider, { value: resolve2 ?? null, children });
 }
 function useGeneratorLimitsSource() {
-  return useContext4(LimitsCtx);
+  return useContext5(LimitsCtx);
 }
 var MASK3 = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
@@ -2759,7 +2785,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const [candidate, setCandidate] = useState15(null);
   const [revealed, setRevealed] = useState15(false);
   const [note, setNote] = useState15(null);
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const expiry = useRef10(null);
   const drop = () => {
     if (expiry.current) clearTimeout(expiry.current);
@@ -2819,7 +2845,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const strength = candidate ? strengthOf(candidate.bits) : null;
   const copy = async () => {
     if (!candidate) return;
-    const ok = await copyValue(candidate.value, "Generated password");
+    const ok = await copyValue2(candidate.value, "Generated password");
     setNote(ok ? { tone: "success", text: "Copied. Your clipboard keeps it." } : { tone: "destructive", text: "Couldn\u2019t copy. Reveal it and copy by hand." });
   };
   const use = () => {
@@ -2930,6 +2956,45 @@ function importLimitsFrom(resolved) {
   return out;
 }
 
+// src/lock.ts
+import { useSyncExternalStore as useSyncExternalStore2 } from "react";
+var LOCKED_MESSAGE = "The vault is locked. Unlock it first.";
+var VaultLockedError = class extends Error {
+  code = "vault_locked";
+  constructor() {
+    super(LOCKED_MESSAGE);
+    this.name = "VaultLockedError";
+  }
+};
+function guardPort(port, locked) {
+  const cache = /* @__PURE__ */ new WeakMap();
+  const wrap = (target) => {
+    const hit = cache.get(target);
+    if (hit) return hit;
+    const proxy = new Proxy(target, {
+      get(obj2, key, receiver) {
+        const value = Reflect.get(obj2, key, receiver);
+        if (typeof value === "function") {
+          return (...args) => {
+            if (locked()) return Promise.reject(new VaultLockedError());
+            return value.apply(obj2, args);
+          };
+        }
+        if (value && typeof value === "object") return wrap(value);
+        return value;
+      }
+    });
+    cache.set(target, proxy);
+    return proxy;
+  };
+  return wrap(port);
+}
+var NEVER = () => () => void 0;
+var UNLOCKED = () => false;
+function useLocked(lock) {
+  return useSyncExternalStore2(lock ? lock.subscribe : NEVER, lock ? () => lock.locked() : UNLOCKED, UNLOCKED);
+}
+
 // src/io/BackupPanel.tsx
 import { useEffect as useEffect13, useRef as useRef11, useState as useState17 } from "react";
 import { Button as Button13, Field as Field6, SegmentedControl as SegmentedControl3, Switch as Switch3 } from "@ai-matrx/design-system/controls";
@@ -4806,7 +4871,7 @@ var MASK4 = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022\
 var say2 = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 function RecoveryCodesRow({ item, field, port, onChanged }) {
   const confirmed = useConfirmed();
-  const copyValue = useCopy();
+  const copyValue2 = useCopy();
   const secret = useTransientSecret();
   const [busy, setBusy] = useState21(false);
   const [error, setError] = useState21(null);
@@ -4894,7 +4959,7 @@ function RecoveryCodesRow({ item, field, port, onChanged }) {
       children: sealed ? /* @__PURE__ */ jsx21(Badge6, { icon: /* @__PURE__ */ jsx21(LockGlyph, {}), children: "Sealed" }) : codes ? /* @__PURE__ */ jsxs20("ul", { className: "flex flex-col gap-0.5", "aria-label": "Recovery codes", children: [
         codes.map((code, i) => /* @__PURE__ */ jsxs20("li", { className: "flex min-h-7 items-center gap-1", children: [
           /* @__PURE__ */ jsx21("code", { className: "min-w-0 flex-1 break-all font-mono text-sm text-foreground", children: code }),
-          /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(CopyGlyph, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue(code, "Recovery code") }),
+          /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(CopyGlyph, {}), "aria-label": `Copy code ${i + 1}`, onClick: () => void copyValue2(code, "Recovery code") }),
           canEdit ? /* @__PURE__ */ jsx21(Button17, { variant: "quiet", icon: /* @__PURE__ */ jsx21(CheckGlyph, {}), disabled: busy, onClick: () => void markUsed(i), children: "Mark used" }) : null
         ] }, `${i}-${code}`)),
         error ? /* @__PURE__ */ jsx21("li", { role: "alert", className: "text-xs text-destructive", children: error }) : null
@@ -5086,7 +5151,7 @@ var MEMBER_ACCESS_LABEL = { none: "No access", use: "Can use", editor: "Can edit
 function levelOf(flags) {
   return flags.can_manage ? "edit" : "use";
 }
-function flagsOf(level) {
+function shareFlagsOf(level) {
   return { can_use: true, can_manage: level === "edit" };
 }
 function isEmail(value) {
@@ -5500,6 +5565,7 @@ function SharingSummary({ item, port, className }) {
 }
 
 // src/ItemPane.tsx
+import { formatAbsoluteDate as formatAbsoluteDate3 } from "@ai-matrx/kit/format";
 import { Fragment as Fragment15, jsx as jsx26, jsxs as jsxs24 } from "react/jsx-runtime";
 var USERNAME_KEYS = /^(username|user_name|email|login|username_or_email|account_email)$/;
 function ItemPane(props) {
@@ -5647,7 +5713,7 @@ function ItemPane(props) {
   const descriptionVisible = showDescription || draft.description !== "";
   const header = /* @__PURE__ */ jsxs24("header", { className: "flex min-h-14 items-center gap-2 border-b border-border px-3 py-2 sm:gap-3 sm:px-5", children: [
     onBack ? /* @__PURE__ */ jsx26(Button21, { variant: "quiet", icon: /* @__PURE__ */ jsx26(ChevronLeftGlyph, {}), "aria-label": "Back", onClick: mode === "new" ? onCancelNew : onBack }) : null,
-    /* @__PURE__ */ jsx26(ItemIcon, { definitionKey: definition?.key ?? item?.definitionKey ?? "custom", family: definition?.family ?? "generic", site: item ? siteOf(item) : siteOf({ loginUrls: draft.loginUrls }), size: "lg" }),
+    /* @__PURE__ */ jsx26(ItemIcon, { definitionKey: definition?.key ?? item?.definitionKey ?? "custom", family: definition?.family ?? "generic", site: item ? loginSiteOf(item) : loginSiteOf({ loginUrls: draft.loginUrls }), size: "lg" }),
     /* @__PURE__ */ jsxs24("div", { className: "flex min-w-0 flex-1 flex-col", children: [
       /* @__PURE__ */ jsx26("h2", { className: "truncate text-base font-semibold leading-tight", children: editing ? draft.name || (mode === "new" ? `New ${typeLabel.toLowerCase()}` : item?.name) : item?.name }),
       /* @__PURE__ */ jsxs24("span", { className: "flex min-w-0 items-center gap-1 text-xs text-muted-foreground", children: [
@@ -5880,9 +5946,9 @@ function ItemPane(props) {
       filesProps ? /* @__PURE__ */ jsx26(FilesSection, { ...filesProps, editing: false }) : null,
       /* @__PURE__ */ jsxs24("p", { className: cn12("px-1 text-xs text-muted-foreground"), children: [
         "Modified ",
-        formatDate(item.updatedAt),
+        formatAbsoluteDate3(item.updatedAt, DAY_FORMAT, ""),
         " \xB7 Created ",
-        formatDate(item.createdAt)
+        formatAbsoluteDate3(item.createdAt, DAY_FORMAT, "")
       ] })
     ] }) : null }) })
   ] }) });
@@ -5897,7 +5963,7 @@ var SORTS2 = [
   { value: "created", label: "Recently added" }
 ];
 function subtitleOf(item, withOwner) {
-  const what = siteOf(item) || item.definitionLabel;
+  const what = loginSiteOf(item) || item.definitionLabel;
   return withOwner ? `${what} \xB7 ${item.owner.label}` : what;
 }
 function ItemList({ title, items, definitions, port, selectedId, onSelect, query, onQuery, sort, onSort, onNew, matchingIds, header }) {
@@ -5963,7 +6029,7 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
     setBusy(true);
     try {
       const v = await confirmed(() => port.reveal(item, key));
-      await copy(v, label);
+      await copy(v, label, { secret: key !== user?.key || user.handling !== "visible" });
     } catch (e) {
       if (!wasCancelled(e)) notify(e instanceof Error ? e.message : `${label} could not be read`, "error");
     } finally {
@@ -5980,7 +6046,7 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
         onClick: () => onSelect(item.id),
         className: cn13("flex h-12 w-full items-center gap-3 rounded-lg px-2 text-left", on ? "bg-primary text-primary-foreground" : "hover:bg-accent"),
         children: [
-          /* @__PURE__ */ jsx27(ItemIcon, { definitionKey: item.definitionKey, family, site: siteOf(item), inverted: on }),
+          /* @__PURE__ */ jsx27(ItemIcon, { definitionKey: item.definitionKey, family, site: loginSiteOf(item), inverted: on }),
           /* @__PURE__ */ jsxs25("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
             /* @__PURE__ */ jsx27("span", { className: "truncate text-sm font-medium", children: item.name }),
             /* @__PURE__ */ jsx27("span", { className: "truncate text-xs text-muted-foreground", children: subtitleOf(item, withOwner) })
@@ -5998,6 +6064,7 @@ function ListRow({ item, family, port, on, onSelect, withOwner }) {
 // src/lists/TrashView.tsx
 import { useState as useState29 } from "react";
 import { Button as Button24 } from "@ai-matrx/design-system/controls";
+import { formatAbsoluteDate as formatAbsoluteDate4 } from "@ai-matrx/kit/format";
 
 // src/lists/logic.ts
 var ENTITY_TYPE = "credential_item";
@@ -6008,7 +6075,7 @@ function favoriteIds(data) {
 function recentIds(data, limit = 50) {
   return rowsOf(data).filter((r) => typeof r.last_viewed_at === "string" && r.last_viewed_at !== "").sort((a, b) => Date.parse(b.last_viewed_at) - Date.parse(a.last_viewed_at)).slice(0, limit).map((r) => r.entity_id);
 }
-function matchesQuery2(item, query) {
+function trashItemMatchesQuery(item, query) {
   const q = query.trim().toLowerCase();
   if (!q) return true;
   return [item.name, item.definitionLabel, item.owner.label, ...item.tags].some((s) => s.toLowerCase().includes(q));
@@ -6140,7 +6207,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
   const confirmed = useConfirmed();
   const [busyId, setBusyId] = useState29(null);
   const [message2, setMessage] = useState29(null);
-  const shown = deleted.filter((i) => matchesQuery2(i, query));
+  const shown = deleted.filter((i) => trashItemMatchesQuery(i, query));
   const [restoring, setRestoring] = useState29(null);
   const restore = async (item, deletionId) => {
     setBusyId(item.id);
@@ -6165,7 +6232,7 @@ function TrashView({ port, deleted, query, header, onChanged }) {
       /* @__PURE__ */ jsxs27("div", { className: "flex min-h-12 items-center gap-3 px-3 py-1.5 sm:px-4", children: [
         /* @__PURE__ */ jsxs27("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
           /* @__PURE__ */ jsx29("span", { className: "truncate text-sm text-foreground", children: item.name }),
-          /* @__PURE__ */ jsx29("span", { className: "truncate text-xs text-muted-foreground", children: [item.deletion?.deletedAt ? `Deleted ${formatDate(item.deletion.deletedAt)}` : null, item.owner.kind !== "me" ? item.owner.label : null].filter(Boolean).join(" \xB7 ") })
+          /* @__PURE__ */ jsx29("span", { className: "truncate text-xs text-muted-foreground", children: [item.deletion?.deletedAt ? `Deleted ${formatAbsoluteDate4(item.deletion.deletedAt, DAY_FORMAT, "")}` : null, item.owner.kind !== "me" ? item.owner.label : null].filter(Boolean).join(" \xB7 ") })
         ] }),
         /* @__PURE__ */ jsx29(Button24, { variant: "outline", icon: /* @__PURE__ */ jsx29(RestoreGlyph, {}), disabled: busyId !== null || !item.deletion, onClick: () => setRestoring(item), children: "Restore" })
       ] }, item.id)
@@ -6252,6 +6319,7 @@ import { useEffect as useEffect19, useRef as useRef16, useState as useState31 }
 import { confirm as confirm10 } from "@ai-matrx/kit/confirm-opener";
 import { Checkbox as Checkbox2 } from "@ai-matrx/design-system";
 import { Badge as Badge8, Button as Button26, Field as Field11, RegionSkeleton as RegionSkeleton2, SegmentedControl as SegmentedControl5, Textarea as Textarea4 } from "@ai-matrx/design-system/controls";
+import { formatAbsoluteDate as formatAbsoluteDate5 } from "@ai-matrx/kit/format";
 
 // src/sharing/secure-link-logic.ts
 import { formatDurationMinutes } from "@ai-matrx/kit/format";
@@ -6521,7 +6589,7 @@ function SecureLinkPanel({ item, port, onClose }) {
   );
 }
 function sentMeta(row, options) {
-  const when = row.status === "pending" ? `Until ${formatDate(row.expiresAt, true)}` : row.status === "viewed" && row.viewedAt ? formatDate(row.viewedAt, true) : formatDate(row.createdAt);
+  const when = row.status === "pending" ? `Until ${formatAbsoluteDate5(row.expiresAt, void 0, "")}` : row.status === "viewed" && row.viewedAt ? formatAbsoluteDate5(row.viewedAt, void 0, "") : formatAbsoluteDate5(row.createdAt, DAY_FORMAT, "");
   const carried = row.fieldKeys.length ? carriedWords(row.fieldKeys, options?.fields ?? []) : "";
   return [when, carried].filter(Boolean).join(" \xB7 ");
 }
@@ -6530,6 +6598,7 @@ function sentMeta(row, options) {
 import { useCallback as useCallback4, useEffect as useEffect20, useState as useState32 } from "react";
 import { confirm as confirm11 } from "@ai-matrx/kit/confirm-opener";
 import { Button as Button27, RegionSkeleton as RegionSkeleton3 } from "@ai-matrx/design-system/controls";
+import { formatAbsoluteDate as formatAbsoluteDate6 } from "@ai-matrx/kit/format";
 
 // src/devices/logic.ts
 var PASSKEY_RP_ID = "aimatrx.com";
@@ -6659,13 +6728,13 @@ function DevicesPanel({ port, onClose }) {
         Row,
         {
           label: off ? "Turned off" : "Can fill",
-          hint: off ? formatDate(device.revokedAt) : void 0,
+          hint: off ? formatAbsoluteDate6(device.revokedAt, DAY_FORMAT, "") : void 0,
           actions: off ? null : /* @__PURE__ */ jsx32(Button27, { variant: "outline", icon: /* @__PURE__ */ jsx32(PowerGlyph, {}), disabled: busyId !== null, onClick: () => void revoke(device), children: "Revoke" }),
           children: /* @__PURE__ */ jsxs30("span", { className: "flex min-w-0 flex-col", children: [
             /* @__PURE__ */ jsx32("span", { className: off ? "truncate text-muted-foreground" : "truncate text-foreground", children: device.label }),
             /* @__PURE__ */ jsxs30("span", { className: "truncate text-xs text-muted-foreground", children: [
-              device.lastUsedAt ? `Last used ${formatDate(device.lastUsedAt, true)}` : "Never used",
-              device.addedAt ? ` \xB7 added ${formatDate(device.addedAt)}` : ""
+              device.lastUsedAt ? `Last used ${formatAbsoluteDate6(device.lastUsedAt, void 0, "")}` : "Never used",
+              device.addedAt ? ` \xB7 added ${formatAbsoluteDate6(device.addedAt, DAY_FORMAT, "")}` : ""
             ] })
           ] })
         },
@@ -6759,7 +6828,7 @@ function ApprovePanel({ port, host, onClose, approvalKey, label, kind = "browser
       "Return to ",
       where,
       " by ",
-      formatDate(approvedUntil, true),
+      formatAbsoluteDate6(approvedUntil, void 0, ""),
       "."
     ] }) }) : !passkeys ? /* @__PURE__ */ jsxs30(Empty, { children: [
       "Approve with your password in ",
@@ -7137,12 +7206,12 @@ import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuConte
 import { Button as Button32 } from "@ai-matrx/design-system/controls";
 
 // src/extension/CaptureCard.tsx
-import { useState as useState35, useSyncExternalStore as useSyncExternalStore2 } from "react";
+import { useState as useState35, useSyncExternalStore as useSyncExternalStore3 } from "react";
 import { Button as Button29, SearchField as SearchField3 } from "@ai-matrx/design-system/controls";
 import { Fragment as Fragment19, jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
 var SEARCH_FROM = 4;
 function CaptureCard({ capture, onChanged }) {
-  const prompt = useSyncExternalStore2(capture.subscribe, capture.get, capture.get);
+  const prompt = useSyncExternalStore3(capture.subscribe, capture.get, capture.get);
   const notify = useNotify();
   const [busy, setBusy] = useState35(false);
   const [q, setQ] = useState35("");
@@ -7201,12 +7270,12 @@ function CaptureCard({ capture, onChanged }) {
 }
 
 // src/extension/FillSetupCard.tsx
-import { useRef as useRef18, useState as useState36, useSyncExternalStore as useSyncExternalStore3 } from "react";
+import { useRef as useRef18, useState as useState36, useSyncExternalStore as useSyncExternalStore4 } from "react";
 import { Button as Button30, Field as Field12 } from "@ai-matrx/design-system/controls";
 import { jsx as jsx35, jsxs as jsxs33 } from "react/jsx-runtime";
 function FillSetupCard({ fillSetup }) {
   const notify = useNotify();
-  const state = useSyncExternalStore3(fillSetup.subscribe, fillSetup.get, fillSetup.get);
+  const state = useSyncExternalStore4(fillSetup.subscribe, fillSetup.get, fillSetup.get);
   const box = useRef18(null);
   const [busy, setBusy] = useState36(false);
   const [error, setError] = useState36(null);
@@ -7450,10 +7519,10 @@ function MatchRow({ itemId, item, tag, family, port, busy, running, onOpen, onFi
       setReading(false);
     }
   };
-  const subtitle = [item ? siteOf(item) || item.definitionLabel : "", tag].filter(Boolean).join(" \xB7 ");
+  const subtitle = [item ? loginSiteOf(item) || item.definitionLabel : "", tag].filter(Boolean).join(" \xB7 ");
   return /* @__PURE__ */ jsxs35("li", { className: "flex h-12 items-center gap-1 pl-1 pr-2", "data-item": itemId, children: [
     /* @__PURE__ */ jsxs35("button", { type: "button", onClick: () => onOpen(itemId), className: "flex h-11 min-w-0 flex-1 items-center gap-3 rounded-lg px-2 text-left hover:bg-accent", children: [
-      /* @__PURE__ */ jsx37(ItemIcon, { definitionKey: item?.definitionKey ?? "website_login", family, site: item ? siteOf(item) : "" }),
+      /* @__PURE__ */ jsx37(ItemIcon, { definitionKey: item?.definitionKey ?? "website_login", family, site: item ? loginSiteOf(item) : "" }),
       /* @__PURE__ */ jsxs35("span", { className: "flex min-w-0 flex-1 flex-col leading-tight", children: [
         /* @__PURE__ */ jsx37("span", { className: "truncate text-sm font-medium", children: item?.name ?? "Saved login" }),
         subtitle ? /* @__PURE__ */ jsx37("span", { className: "truncate text-xs text-muted-foreground", children: subtitle }) : null
@@ -7641,7 +7710,31 @@ function ImportWithLimits(props) {
   return /* @__PURE__ */ jsx39(Panel, { title: "Import", onClose: rest.onClose, children: /* @__PURE__ */ jsx39(Empty, { children: state ? state.error : "Reading this organization\u2019s import settings\u2026" }) });
 }
 function VaultApp(props) {
-  return /* @__PURE__ */ jsx39("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ jsx39(NoticeProvider, { notify: props.notify, children: /* @__PURE__ */ jsx39(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ jsx39(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ jsx39(Workspace, { ...props }) }) }) }) });
+  const lock = props.host?.lock;
+  const locked = useLocked(lock);
+  const port = useMemo6(() => lock ? guardPort(props.port, () => lock.locked()) : props.port, [props.port, lock]);
+  return /* @__PURE__ */ jsx39("div", { className: "relative h-full min-h-0 w-full", children: /* @__PURE__ */ jsx39(NoticeProvider, { notify: props.notify, children: lock && locked ? /* @__PURE__ */ jsx39(LockedScreen, { lock }) : /* @__PURE__ */ jsx39(ClipboardProvider, { clipboard: props.host?.clipboard, children: /* @__PURE__ */ jsx39(RevealSecondsProvider, { seconds: props.host?.revealSeconds, children: /* @__PURE__ */ jsx39(IdentityGate, { identity: props.host?.identity, children: /* @__PURE__ */ jsx39(GeneratorLimitsProvider, { resolve: generatorLimitsFrom(props.host?.knobs), children: /* @__PURE__ */ jsx39(Workspace, { ...props, port }) }) }) }) }) }) });
+}
+function LockedScreen({ lock }) {
+  const [busy, setBusy] = useState40(false);
+  const [error, setError] = useState40(null);
+  const unlock = async () => {
+    setBusy(true);
+    setError(null);
+    try {
+      await lock.unlock();
+    } catch (e) {
+      setError(e instanceof Error && e.message ? e.message : "The vault stayed locked.");
+    } finally {
+      setBusy(false);
+    }
+  };
+  return /* @__PURE__ */ jsxs37("div", { role: "region", "aria-label": "Vault locked", className: "flex h-full min-h-0 flex-col items-center justify-center gap-3 p-6 text-center", children: [
+    /* @__PURE__ */ jsx39(LockGlyph, { className: "size-8 text-muted-foreground" }),
+    /* @__PURE__ */ jsx39("div", { className: "text-base font-medium text-foreground", children: "Vault locked" }),
+    /* @__PURE__ */ jsx39(Button33, { variant: "primary", disabled: busy, onClick: () => void unlock(), children: lock.unlockLabel ?? "Unlock" }),
+    error ? /* @__PURE__ */ jsx39("div", { role: "alert", className: "max-w-sm text-sm text-destructive", children: error }) : null
+  ] });
 }
 function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocationChange }) {
   const rootRef = useRef19(null);
@@ -7794,6 +7887,10 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
         host.nativeProvider && host.nativeProvider.status !== "unavailable" ? /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: host.nativeProvider.openSetup, children: [
           /* @__PURE__ */ jsx39(ShieldGlyph, { className: "size-4" }),
           "System AutoFill"
+        ] }) : null,
+        host.lock?.lock ? /* @__PURE__ */ jsxs37(DropdownMenuItem5, { onSelect: () => void host.lock?.lock?.(), children: [
+          /* @__PURE__ */ jsx39(LockGlyph, { className: "size-4" }),
+          "Lock"
         ] }) : null
       ] })
     ] })
@@ -8408,7 +8505,7 @@ function createSharingPort(ctx, options = {}) {
       return r.grants.map(grantOf);
     },
     async addPerson(item, email, level) {
-      const w = await account6.addGrant(api, { path: { item_id: item.id }, body: { recipient_email: email.trim(), ...flagsOf(level), initiation: "user" } }, ctx.optsFor(item));
+      const w = await account6.addGrant(api, { path: { item_id: item.id }, body: { recipient_email: email.trim(), ...shareFlagsOf(level), initiation: "user" } }, ctx.optsFor(item));
       return grantOf(w);
     },
     async addOrganization(item, organizationId, level) {
@@ -8416,14 +8513,14 @@ function createSharingPort(ctx, options = {}) {
       return grantOf(w);
     },
     async setLevel(item, grant, level) {
-      const w = await account6.updateGrant(api, { path: { item_id: item.id, grant_id: grant.id }, body: { ...flagsOf(level), initiation: "user" } }, ctx.optsFor(item));
+      const w = await account6.updateGrant(api, { path: { item_id: item.id, grant_id: grant.id }, body: { ...shareFlagsOf(level), initiation: "user" } }, ctx.optsFor(item));
       return grantOf(w);
     },
     async revoke(item, grant) {
       await account6.removeGrant(api, { path: { item_id: item.id, grant_id: grant.id } }, ctx.optsFor(item));
     },
     async setAccessMode(item, mode, people) {
-      const grantees = mode === "restricted" ? people.filter((g) => g.kind === "person" && g.userId).map((g) => ({ user_id: g.userId, ...flagsOf(g.level) })) : [];
+      const grantees = mode === "restricted" ? people.filter((g) => g.kind === "person" && g.userId).map((g) => ({ user_id: g.userId, ...shareFlagsOf(g.level) })) : [];
       await account6.share(api, { path: { item_id: item.id }, body: { access_mode: mode, grantees, initiation: "user" } }, ctx.optsFor(item));
       return ctx.refetch(item.id, item.owner);
     },
@@ -8826,18 +8923,22 @@ export {
   CATEGORIES,
   DEFAULT_LOCATION,
   GenerateButton,
+  LOCKED_MESSAGE,
   VaultApp,
+  VaultLockedError,
   categoryOf,
+  copyValue,
   createApiVaultPort,
   createSupabaseIdentity,
   createVaultKnobs,
+  guardPort,
   inferFromUrl,
   locationFromParams,
   locationToParams,
+  loginSiteOf,
   matchesQuery,
   needsRecentSignIn,
   parseDefinitions,
-  siteOf,
   sortItems
 };
 //# sourceMappingURL=index.js.map