@ai-matrx/vault 0.1.54 → 0.1.56

package/CHANGELOG.md

@@ -1,9 +1,16 @@
 # Changelog
 
+## 0.1.56
+
+- No changes yet.
+
+## 0.1.55
+
+- Password Health can discover a prior scan when neither request nor execution handle is available, and binds recovered results and progress to the originating health port. Consumer action: custom `HealthPort` implementations must provide `discover(cursor, signal)`; `createApiVaultPort` wires it automatically. Discovery returns authorized request/execution references only. External request/execution handle changes retire pending work and recover the new address; matching self-written handles preserve the current run.
+
 ## 0.1.54
 
-UNVERIFIED: this release has no Unreleased entry and the package-input comparison could not be made (the caller supplied no source comparison). Whether package inputs changed is unknown; consumer action is unknown.
-Check the package's gitHead on npm against this version's gitHead: `git diff <previous gitHead> <this gitHead> -- apps/shared/vault`.
+- Saved health recovery shows Checking status while its read is pending. A missing execution or failed initial recovery read settles as Unavailable and keeps Retry available. Consumer action: none; the existing request/execution handle round trip is unchanged.
 
 ## 0.1.53
 
@@ -359,8 +366,6 @@ Changed shipped source files (8):
 ## 0.1.7
 ### Unreleased
 
-- Saved health recovery shows Checking status while its read is pending. A missing execution or failed initial recovery read settles as Unavailable and keeps Retry available. Consumer action: none; the existing request/execution handle round trip is unchanged.
-
 - Host-held lock: `host.lock` (`VaultLock`: `locked`, `subscribe`, `unlock`, optional `lock` and
   `unlockLabel`). While locked the vault shows only "Vault locked" with Unlock, and every port call
   (areas included) is refused at call time (`guardPort`, `VaultLockedError`). "Lock" joins the

package/dist/index.cjs

@@ -682,7 +682,7 @@ function PasswordHealthView(props) {
   const latest = (0, import_react4.useRef)(props);
   latest.current = props;
   const [result, setResult] = (0, import_react4.useState)(null);
-  const [status, setStatus] = (0, import_react4.useState)(requestId || executionId ? "Checking status" : "No report");
+  const [status, setStatus] = (0, import_react4.useState)("Checking status");
   const [error, setError] = (0, import_react4.useState)(null);
   const [progress, setProgress] = (0, import_react4.useState)(null);
   const [busy, setBusy] = (0, import_react4.useState)(false);
@@ -692,9 +692,13 @@ function PasswordHealthView(props) {
   }, [port]);
   const [retry, setRetry] = (0, import_react4.useState)(0);
   const active = (0, import_react4.useRef)(null);
-  const starting = (0, import_react4.useRef)(false);
+  const starting = (0, import_react4.useRef)(null);
   const ownedAddress = (0, import_react4.useRef)(null);
   const writeReference = (request, execution) => {
+    if (starting.current?.controller === active.current) {
+      starting.current.request = request;
+      starting.current.execution = execution;
+    }
     ownedAddress.current = { request, execution, items: latest.current.items, retry };
     latest.current.onReference(request, execution);
   };
@@ -722,7 +726,7 @@ function PasswordHealthView(props) {
     const value = await port.read(id, controller.signal);
     if (owns(controller)) {
       setStatus(STATUS_LABEL[value.execution_status]);
-      setResult({ value, items: inventory });
+      setResult({ value, items: inventory, port });
     }
     return value;
   };
@@ -740,6 +744,27 @@ function PasswordHealthView(props) {
       }
       writeReference(request, id);
     }
+    if (!id && !request) {
+      let cursor;
+      const seen = /* @__PURE__ */ new Set();
+      do {
+        const page = await port.discover(cursor, controller.signal);
+        if (!owns(controller)) return;
+        const reference = page.references[0];
+        if (reference) {
+          id = reference.execution_id;
+          writeReference(reference.request_id, reference.execution_id);
+          break;
+        }
+        cursor = page.continuation ?? void 0;
+        if (cursor && seen.has(cursor)) throw new Error("Report unavailable");
+        if (cursor) seen.add(cursor);
+      } while (cursor);
+      if (!id) {
+        setStatus("No report");
+        return;
+      }
+    }
     if (!id || !owns(controller)) return;
     const first = await read(id, controller);
     if (!owns(controller) || terminal(first.execution_status)) return;
@@ -749,7 +774,7 @@ function PasswordHealthView(props) {
         if (!owns(controller)) return;
         const detail = event.detail;
         if (event.kind === "note" && detail?.label === "password_health_progress" && detail.__kind === "password_health_progress" && typeof detail.checked === "number" && Number.isSafeInteger(detail.checked) && detail.checked >= 0 && typeof detail.skipped === "number" && Number.isSafeInteger(detail.skipped) && detail.skipped >= 0) {
-          setProgress({ checked: detail.checked, skipped: detail.skipped });
+          setProgress({ checked: detail.checked, skipped: detail.skipped, port });
         }
         const lifecycle = event.kind === "started" || event.kind === "resumed" ? "running" : event.kind === "created" ? "pending" : event.kind;
         const label = STATUS_LABEL[lifecycle];
@@ -764,14 +789,16 @@ function PasswordHealthView(props) {
     if (!inventoryReady) {
       ownedAddress.current = null;
       setResult(null);
-      if (!starting.current) active.current?.abort();
+      if (!starting.current || !owns(starting.current.controller)) active.current?.abort();
       return;
     }
-    if (!port || starting.current) return;
+    if (!port) return;
+    const start = starting.current;
+    if (start && owns(start.controller) && start.request === (requestId ?? "") && start.execution === (executionId ?? "")) return;
     const own = ownedAddress.current;
     if (own && own.request === requestId && own.execution === executionId && own.items === items && own.retry === retry && active.current && !active.current.signal.aborted) return;
     const controller = fresh();
-    setStatus(requestId || executionId ? "Checking status" : "No report");
+    setStatus("Checking status");
     void recover(requestId, executionId, controller).catch((e) => {
       if (owns(controller)) {
         setResult(null);
@@ -793,7 +820,7 @@ function PasswordHealthView(props) {
   const run = async (resume2) => {
     if (!port) return;
     const controller = fresh();
-    starting.current = true;
+    starting.current = { controller, request: "", execution: "" };
     const request = crypto.randomUUID();
     const options = { check_breaches: checkBreaches };
     let actualRequest = request;
@@ -822,7 +849,7 @@ function PasswordHealthView(props) {
           if (data && typeof data === "object" && "type" in data) {
             if (data.type === "vault_password_health_scan_reference") accept(data);
             if (data.type === "vault_password_health_progress") {
-              setProgress(data);
+              setProgress({ ...data, port });
               setStatus("Running");
             }
           }
@@ -866,20 +893,22 @@ function PasswordHealthView(props) {
       setError(problem(e));
       setStatus((value) => value === "Checking status" ? "Unavailable" : value);
     } finally {
-      starting.current = false;
+      if (starting.current?.controller === controller) starting.current = null;
       if (owns(controller)) {
         setBusy(false);
         if (startedItems !== latest.current.items) setRetry((v) => v + 1);
       }
     }
   };
-  const current = inventoryReady && result?.items === items && result.value.availability === "current" ? result.value.snapshot : null;
-  const available = result?.value.availability;
+  const ownedResult = port && result?.port === port ? result : null;
+  const shownProgress = port && progress?.port === port ? progress : null;
+  const current = inventoryReady && ownedResult?.items === items && ownedResult.value.availability === "current" ? ownedResult.value.snapshot : null;
+  const available = ownedResult?.value.availability;
   const outcomes = current?.check_breaches ? current.breach_outcomes ?? [] : [];
   const compromised = outcomes.filter((outcome) => outcome.status === "compromised").length;
   const notFound = outcomes.filter((outcome) => outcome.status === "not_found").length;
   const unknown = outcomes.filter((outcome) => outcome.status === "unknown").length;
-  const resume = result && ["failed", "cancelled"].includes(result.value.execution_status);
+  const resume = ownedResult && ["failed", "cancelled"].includes(ownedResult.value.execution_status);
   return /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)("div", { className: "flex h-full min-h-0 flex-col gap-4 overflow-auto p-4", "aria-label": "Password health", children: [
     props.header,
     /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)("div", { className: "flex items-center justify-between gap-2", children: [
@@ -913,9 +942,9 @@ function PasswordHealthView(props) {
           /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(import_controls2.InfoHint, { text: "The breach lookup could not establish a result." })
         ] }), children: unknown })
       ] }) : null,
-      !current && progress ? /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
-        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(VaultRow, { label: "Checked", children: progress.checked }),
-        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(VaultRow, { label: "Skipped", children: progress.skipped })
+      !current && shownProgress ? /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
+        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(VaultRow, { label: "Checked", children: shownProgress.checked }),
+        /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(VaultRow, { label: "Skipped", children: shownProgress.skipped })
       ] }) : null,
       current ? /* @__PURE__ */ (0, import_jsx_runtime5.jsxs)(import_jsx_runtime5.Fragment, { children: [
         /* @__PURE__ */ (0, import_jsx_runtime5.jsx)(VaultRow, { label: "Checked", children: current.checked_subjects.length }),
@@ -2673,7 +2702,7 @@ function normalizeWebsite(raw) {
 }
 function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
-  const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
+  const candidates = items.filter((i) => i.authenticatorState === "known" && !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = (0, import_react13.useState)("");
   const [image, setImage] = (0, import_react13.useState)(null);
   const [target, setTarget] = (0, import_react13.useState)(itemId && candidates.some((c) => c.id === itemId) ? itemId : NEW);
@@ -2712,7 +2741,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       }
       const it = item;
       const entry = await confirmed(() => image ? port.authenticator.enrolQrImage(it, image, image.name) : port.authenticator.enrol(it, input));
-      let next = { ...it, authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
+      let next = { ...it, authenticatorState: "known", authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
       const better = authenticatorName(it.name, { issuer: entry.issuer, account: entry.account });
       if (!isNew && better !== it.name) {
         try {
@@ -2850,6 +2879,7 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
   (0, import_react14.useEffect)(() => {
     if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
   }, [listed, added]);
+  const [incomplete, setIncomplete] = (0, import_react14.useState)(true);
   const [entries, setEntries] = (0, import_react14.useState)(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = (0, import_react14.useState)(/* @__PURE__ */ new Set());
   const [adding, setAdding] = (0, import_react14.useState)(false);
@@ -2859,8 +2889,15 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
   (0, import_react14.useEffect)(() => {
     let live = true;
     port.authenticator.list().then(
-      (list) => live && setEntries(new Map(list.map((e) => [e.itemId, e]))),
-      (e) => console.error("One-time password accounts could not be read", e)
+      (list) => {
+        if (live) {
+          setEntries(new Map(list.entries.map((e) => [e.itemId, e])));
+          setIncomplete(list.unavailableScopes.length > 0);
+        }
+      },
+      () => {
+        if (live) setIncomplete(true);
+      }
     );
     return () => {
       live = false;
@@ -2878,7 +2915,14 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
       ] }),
       total > 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
     ] }),
-    total === 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
+    total > 0 && incomplete ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "px-4 text-sm text-muted-foreground", children: [
+      "Some codes unavailable ",
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : null,
+    total === 0 && (incomplete || items.some((i) => i.authenticatorState !== "known")) ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: [
+      "Codes unavailable ",
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : total === 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(ShieldGlyph, { className: "size-6" }) }),
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { className: "text-sm font-medium text-foreground", children: "No authenticator codes yet" }),
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add authenticator" })
@@ -6925,7 +6969,10 @@ function ItemPane(props) {
           i
         )),
         /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
-        /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
+        !item || item.authenticatorState === "known" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }) : /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }),
         item && isLogin && !item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TwoFactorMethodRow, { port, item, onChanged }) : null,
         !item && isLogin && draft.authenticator.trim() === "" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(DraftTwoFactorRow, { custom: draft.custom, onCustom: (custom) => patch({ custom }) }) : null,
         recoveryEditing ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(
@@ -7004,7 +7051,10 @@ function ItemPane(props) {
         }),
         extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(SecretRow, { port, item, field: f, onTurnOn: turnOnOne(f), extra: fieldSettings(f) }, f.id)),
         item.loginUrls.length > 0 ? item.loginUrls.map((u, i) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(PlainRow, { label: i === 0 ? "Website" : `Website ${i + 1}`, value: u, openUrl: host.openUrl }, `${u}-${i}`)) : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(AddRow, { label: "Website", onAdd: canEdit ? () => onMode("edit") : null, children: "Add website" }),
-        item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
+        item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpRow, { port, item, onChanged }) : item.authenticatorState !== "known" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }) : seedField && !seedField.active ? (
           // The secret is still there, only off: turning it on brings the codes back. Never "Set up",
           // which would invite replacing a working two-factor secret.
           /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(VaultRow, { label: "Authenticator", actions: canTurnOn ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TurnOnButton, { label: "Authenticator", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: "Turned off" }) })
@@ -9687,6 +9737,30 @@ var import_account = require("@ai-matrx/api/account");
 var import_architecture = require("@ai-matrx/api/architecture");
 function createHealthPort(api) {
   return {
+    discover: async (cursor, signal) => {
+      const stream = await (0, import_account.discoverPasswordHealthScans)(api, cursor ? { query: { cursor } } : void 0, { signal, totalTimeoutMs: null });
+      let page = null;
+      let ended = false;
+      try {
+        for await (const event of stream) {
+          if (signal.aborted || ended || event.event === "error") throw new Error("Report unavailable");
+          const data = event.data;
+          if (event.event === "completion" && data && typeof data === "object" && "status" in data && data.status !== "success") throw new Error("Report unavailable");
+          if (event.event === "end") {
+            if (!data || typeof data !== "object" || !("reason" in data) || data.reason !== "complete") throw new Error("Report unavailable");
+            ended = true;
+          }
+          if (event.event !== "data") continue;
+          if (!data || typeof data !== "object" || !("type" in data) || data.type !== "vault_password_health_discovery_page") continue;
+          if (page || !("__kind" in data) || data.__kind !== "password_health_discovery_page" || !("references" in data) || !Array.isArray(data.references) || data.references.some((ref) => !ref || typeof ref !== "object" || ref.__kind !== "password_health_discovery_reference" || typeof ref.request_id !== "string" || !ref.request_id || typeof ref.execution_id !== "string" || !ref.execution_id) || !("continuation" in data) || data.continuation !== null && (typeof data.continuation !== "string" || !data.continuation)) throw new Error("Report unavailable");
+          page = data;
+        }
+        if (signal.aborted || !ended || !page) throw new Error("Report unavailable");
+        return page;
+      } finally {
+        stream.cancel();
+      }
+    },
     start: (requestId, signal, options) => (0, import_account.startPasswordHealthScan)(api, { body: options.check_breaches ? { check_breaches: true } : {} }, { requestId, signal, totalTimeoutMs: null }),
     resume: (executionId, requestId, signal) => (0, import_account.resumePasswordHealthScan)(api, { path: { execution_id: executionId } }, { requestId, signal, totalTimeoutMs: null }),
     read: (executionId, signal) => (0, import_account.getPasswordHealthScan)(api, { path: { execution_id: executionId } }, { signal }),
@@ -9809,7 +9883,7 @@ function createAuthenticatorPort(ctx) {
   return {
     async list() {
       const r = await apps.listAuthenticators(api);
-      return (r.entries ?? []).map(entryOf);
+      return { entries: (r.entries ?? []).map(entryOf), unavailableScopes: (r.unavailable_scopes ?? []).map((s) => ({ type: s.type, organizationId: s.organization_id ?? null })) };
     },
     async get(item) {
       try {
@@ -10023,6 +10097,7 @@ function trashItem(r, ctx) {
     fields: [],
     custom: [],
     authenticator: null,
+    authenticatorState: "known",
     capabilities: { canUse: false, canEdit: false, canReveal: false, canManage: true },
     attachments: [],
     uriMatchMode: "host",
@@ -10379,7 +10454,8 @@ function fieldOf(w, def) {
     active: w.is_active ?? true
   };
 }
-function itemOf(w, owner, defs, auth) {
+var scopeUnavailable = (owner, scopes) => scopes.some((s) => s.type === (owner.kind === "me" ? "user" : owner.kind === "organization" ? "organization" : "shared") && (s.type !== "organization" || !s.organization_id || s.organization_id === owner.organizationId));
+function itemOf(w, owner, defs, auth, state = "known", unavailable = [], inventoryOwner = owner) {
   const def = defs.get(w.definition_key ?? "");
   const a = auth.get(w.id);
   const cap = w.capabilities ?? {};
@@ -10397,6 +10473,7 @@ function itemOf(w, owner, defs, auth) {
     fields: (w.fields ?? []).filter((f) => f.execution_purpose !== "passkey_private").map((f) => fieldOf(f, def)),
     custom: (w.non_secret_fields ?? []).map((c) => ({ key: c["key"] ?? "", label: c["label"] ?? humanize(c["key"] ?? ""), value: c["value"] ?? "" })),
     authenticator: a ? { digits: a.digits, period: a.period, enabled: a.enabled } : null,
+    authenticatorState: a ? "known" : state === "pending" ? "pending" : state === "unavailable" || scopeUnavailable(inventoryOwner, unavailable) ? "unavailable" : "known",
     capabilities: { canUse: cap.can_use ?? false, canEdit: cap.can_edit ?? false, canReveal: cap.can_reveal ?? false, canManage: cap.can_manage ?? false },
     attachments: (w.attachments ?? []).map((a2) => ({ id: a2.id, label: a2.label, description: a2.description ?? "", fileName: a2.file_name, mediaType: a2.media_type ?? "application/octet-stream", sizeBytes: a2.size_bytes, handling: handlingOf(a2.handling), createdAt: a2.created_at, updatedAt: a2.updated_at })),
     uriMatchMode: MATCH_MODES2.find((m) => m === w.uri_match_mode) ?? "host",
@@ -10433,6 +10510,9 @@ function createApiVaultPort(hostApi, options = {}) {
   };
   let defs = /* @__PURE__ */ new Map();
   let auth = /* @__PURE__ */ new Map();
+  let authState = "pending";
+  let authUnavailable = [];
+  let inventoryOwners = /* @__PURE__ */ new Map();
   let orgs = [];
   const orgOf = (id, userId, mine) => {
     if (id) return { kind: "organization", label: orgs.find((o) => o.id === id)?.name ?? "Organization", organizationId: id };
@@ -10446,7 +10526,7 @@ function createApiVaultPort(hostApi, options = {}) {
   };
   async function refetch(id, owner) {
     const w = await account9.getItem(api, { path: { item_id: id } });
-    return itemOf(w, owner, defs, auth);
+    return itemOf(w, owner, defs, auth, authState, authUnavailable, inventoryOwners.get(id) ?? owner);
   }
   const visibleCache = /* @__PURE__ */ new Map();
   const ctx = {
@@ -10473,6 +10553,10 @@ function createApiVaultPort(hostApi, options = {}) {
     fields: createFieldsPort(ctx),
     lists: createListsPort(ctx, options.userState),
     async load(onProgress) {
+      authState = "pending";
+      auth = /* @__PURE__ */ new Map();
+      authUnavailable = [];
+      inventoryOwners = /* @__PURE__ */ new Map();
       const catalogP = retrying(() => apps2.getAppCatalogKind(api, { path: { app: "matrx", kind: "credential_definition" } }));
       const authP = retrying(() => apps2.listAuthenticators(api));
       const userP = retrying(() => account9.listItems(api, { query: { principal_type: "user" } }));
@@ -10495,9 +10579,10 @@ function createApiVaultPort(hostApi, options = {}) {
         const meId = raw.meId ?? mineItems.find((w) => w.user_id)?.user_id ?? null;
         const seen = /* @__PURE__ */ new Map();
         const deleted = /* @__PURE__ */ new Map();
-        const take = (w, owner) => {
+        const take = (w, owner, inventoryOwner = owner) => {
           if (seen.has(w.id) || deleted.has(w.id) || isHiddenItem(w)) return;
-          const item = itemOf(w, owner, defs, auth);
+          inventoryOwners.set(w.id, inventoryOwner);
+          const item = itemOf(w, owner, defs, auth, authState, authUnavailable, inventoryOwner);
           (isDeleted(w) ? deleted : seen).set(w.id, item);
         };
         for (const w of mineItems) take(w, orgOf(w.organization_id, null, true));
@@ -10505,7 +10590,7 @@ function createApiVaultPort(hostApi, options = {}) {
           const via = orgs[i];
           for (const w of l?.items ?? []) take(w, ownerInOrgList(w, via, meId));
         });
-        for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? orgOf(w.organization_id, null, false) : { kind: "shared", label: "Shared with me", organizationId: null });
+        for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? orgOf(w.organization_id, null, false) : { kind: "shared", label: "Shared with me", organizationId: null }, { kind: "shared", label: "Shared with me", organizationId: null });
         const pending = done ? [] : [...raw.orgsKnown ? orgs.filter((_, i) => raw.orgLists[i] === void 0).map((o) => o.name) : ["your organizations"], ...raw.shared ? [] : ["Shared with me"]];
         return {
           unavailable: [...unavailable],
@@ -10564,9 +10649,14 @@ function createApiVaultPort(hostApi, options = {}) {
       })();
       quiet(orgListsReady);
       const authDone = authP.then((a) => {
-        auth = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
+        authUnavailable = a.unavailable_scopes ?? [];
+        const fresh = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
+        auth = fresh;
+        authState = "known";
+        if (authUnavailable.length) unavailable.push("One-time codes");
         progress();
       }, () => {
+        authState = "unavailable";
         unavailable.push("One-time codes");
       });
       const sharedDone = sharedP.then((sh) => {