@ai-matrx/vault 0.1.54 → 0.1.56

package/dist/index.d.cts

@@ -3,6 +3,7 @@ import { Look } from '@ai-matrx/design-system';
 import { ApiStream, NdjsonEvent, JsonOrStream, FollowRuntimeOperationToEndOptions, FollowRuntimeOperationToEndResult, Api } from '@ai-matrx/api';
 import * as account from '@ai-matrx/api/account';
 import { VaultPasswordHealthScanRequest, VaultPasswordHealthScanReferenceData, PasswordHealthDurableResult } from '@ai-matrx/api/account';
+import { VaultPasswordHealthDiscoveryPageData } from '@ai-matrx/api/stream';
 import { OperationStatusResult } from '@ai-matrx/api/architecture';
 import { VaultIdentity } from './identity.cjs';
 export { CONFIRM_RETURN_KEY, Confirmed, IdentityAccount, IdentityGate, IdentityMethod, ReturnStore, SupabaseAuthLike, SupabaseIdentityOptions, createSupabaseIdentity, needsRecentSignIn, useConfirmed, wasCancelled } from './identity.cjs';
@@ -89,6 +90,7 @@ interface VaultItem {
     fields: VaultField[];
     custom: VaultCustomField[];
     authenticator: VaultAuthenticator | null;
+    authenticatorState: "known" | "pending" | "unavailable";
     capabilities: VaultItemCapabilities;
     attachments: VaultAttachment[];
     uriMatchMode: UriMatchMode;
@@ -222,6 +224,7 @@ type HealthScanOptions = VaultPasswordHealthScanRequest;
 type HealthResult = PasswordHealthDurableResult;
 type HealthReference = VaultPasswordHealthScanReferenceData;
 interface HealthPort {
+    discover(cursor: string | undefined, signal: AbortSignal): Promise<VaultPasswordHealthDiscoveryPageData>;
     start(requestId: string, signal: AbortSignal, options: HealthScanOptions): Promise<ApiStream<NdjsonEvent>>;
     resume(executionId: string, requestId: string, signal: AbortSignal): Promise<JsonOrStream<HealthReference, NdjsonEvent>>;
     read(executionId: string, signal: AbortSignal): Promise<HealthResult>;
@@ -321,7 +324,13 @@ type ItemRef = Pick<VaultItem, "id" | "owner">;
  */
 interface AuthenticatorPort {
     /** Every account the signed-in person holds a one-time password for. */
-    list(): Promise<AuthenticatorEntry[]>;
+    list(): Promise<{
+        entries: AuthenticatorEntry[];
+        unavailableScopes: {
+            type: "user" | "organization" | "shared";
+            organizationId?: string | null;
+        }[];
+    }>;
     /** null when the item has none. */
     get(item: ItemRef): Promise<AuthenticatorEntry | null>;
     /** The current code and how long it lives. */

package/dist/index.d.ts

@@ -3,6 +3,7 @@ import { Look } from '@ai-matrx/design-system';
 import { ApiStream, NdjsonEvent, JsonOrStream, FollowRuntimeOperationToEndOptions, FollowRuntimeOperationToEndResult, Api } from '@ai-matrx/api';
 import * as account from '@ai-matrx/api/account';
 import { VaultPasswordHealthScanRequest, VaultPasswordHealthScanReferenceData, PasswordHealthDurableResult } from '@ai-matrx/api/account';
+import { VaultPasswordHealthDiscoveryPageData } from '@ai-matrx/api/stream';
 import { OperationStatusResult } from '@ai-matrx/api/architecture';
 import { VaultIdentity } from './identity.js';
 export { CONFIRM_RETURN_KEY, Confirmed, IdentityAccount, IdentityGate, IdentityMethod, ReturnStore, SupabaseAuthLike, SupabaseIdentityOptions, createSupabaseIdentity, needsRecentSignIn, useConfirmed, wasCancelled } from './identity.js';
@@ -89,6 +90,7 @@ interface VaultItem {
     fields: VaultField[];
     custom: VaultCustomField[];
     authenticator: VaultAuthenticator | null;
+    authenticatorState: "known" | "pending" | "unavailable";
     capabilities: VaultItemCapabilities;
     attachments: VaultAttachment[];
     uriMatchMode: UriMatchMode;
@@ -222,6 +224,7 @@ type HealthScanOptions = VaultPasswordHealthScanRequest;
 type HealthResult = PasswordHealthDurableResult;
 type HealthReference = VaultPasswordHealthScanReferenceData;
 interface HealthPort {
+    discover(cursor: string | undefined, signal: AbortSignal): Promise<VaultPasswordHealthDiscoveryPageData>;
     start(requestId: string, signal: AbortSignal, options: HealthScanOptions): Promise<ApiStream<NdjsonEvent>>;
     resume(executionId: string, requestId: string, signal: AbortSignal): Promise<JsonOrStream<HealthReference, NdjsonEvent>>;
     read(executionId: string, signal: AbortSignal): Promise<HealthResult>;
@@ -321,7 +324,13 @@ type ItemRef = Pick<VaultItem, "id" | "owner">;
  */
 interface AuthenticatorPort {
     /** Every account the signed-in person holds a one-time password for. */
-    list(): Promise<AuthenticatorEntry[]>;
+    list(): Promise<{
+        entries: AuthenticatorEntry[];
+        unavailableScopes: {
+            type: "user" | "organization" | "shared";
+            organizationId?: string | null;
+        }[];
+    }>;
     /** null when the item has none. */
     get(item: ItemRef): Promise<AuthenticatorEntry | null>;
     /** The current code and how long it lives. */

package/dist/index.js

@@ -146,7 +146,7 @@ function PasswordHealthView(props) {
   const latest = useRef(props);
   latest.current = props;
   const [result, setResult] = useState2(null);
-  const [status, setStatus] = useState2(requestId || executionId ? "Checking status" : "No report");
+  const [status, setStatus] = useState2("Checking status");
   const [error, setError] = useState2(null);
   const [progress, setProgress] = useState2(null);
   const [busy, setBusy] = useState2(false);
@@ -156,9 +156,13 @@ function PasswordHealthView(props) {
   }, [port]);
   const [retry, setRetry] = useState2(0);
   const active = useRef(null);
-  const starting = useRef(false);
+  const starting = useRef(null);
   const ownedAddress = useRef(null);
   const writeReference = (request, execution) => {
+    if (starting.current?.controller === active.current) {
+      starting.current.request = request;
+      starting.current.execution = execution;
+    }
     ownedAddress.current = { request, execution, items: latest.current.items, retry };
     latest.current.onReference(request, execution);
   };
@@ -186,7 +190,7 @@ function PasswordHealthView(props) {
     const value = await port.read(id, controller.signal);
     if (owns(controller)) {
       setStatus(STATUS_LABEL[value.execution_status]);
-      setResult({ value, items: inventory });
+      setResult({ value, items: inventory, port });
     }
     return value;
   };
@@ -204,6 +208,27 @@ function PasswordHealthView(props) {
       }
       writeReference(request, id);
     }
+    if (!id && !request) {
+      let cursor;
+      const seen = /* @__PURE__ */ new Set();
+      do {
+        const page = await port.discover(cursor, controller.signal);
+        if (!owns(controller)) return;
+        const reference = page.references[0];
+        if (reference) {
+          id = reference.execution_id;
+          writeReference(reference.request_id, reference.execution_id);
+          break;
+        }
+        cursor = page.continuation ?? void 0;
+        if (cursor && seen.has(cursor)) throw new Error("Report unavailable");
+        if (cursor) seen.add(cursor);
+      } while (cursor);
+      if (!id) {
+        setStatus("No report");
+        return;
+      }
+    }
     if (!id || !owns(controller)) return;
     const first = await read(id, controller);
     if (!owns(controller) || terminal(first.execution_status)) return;
@@ -213,7 +238,7 @@ function PasswordHealthView(props) {
         if (!owns(controller)) return;
         const detail = event.detail;
         if (event.kind === "note" && detail?.label === "password_health_progress" && detail.__kind === "password_health_progress" && typeof detail.checked === "number" && Number.isSafeInteger(detail.checked) && detail.checked >= 0 && typeof detail.skipped === "number" && Number.isSafeInteger(detail.skipped) && detail.skipped >= 0) {
-          setProgress({ checked: detail.checked, skipped: detail.skipped });
+          setProgress({ checked: detail.checked, skipped: detail.skipped, port });
         }
         const lifecycle = event.kind === "started" || event.kind === "resumed" ? "running" : event.kind === "created" ? "pending" : event.kind;
         const label = STATUS_LABEL[lifecycle];
@@ -228,14 +253,16 @@ function PasswordHealthView(props) {
     if (!inventoryReady) {
       ownedAddress.current = null;
       setResult(null);
-      if (!starting.current) active.current?.abort();
+      if (!starting.current || !owns(starting.current.controller)) active.current?.abort();
       return;
     }
-    if (!port || starting.current) return;
+    if (!port) return;
+    const start = starting.current;
+    if (start && owns(start.controller) && start.request === (requestId ?? "") && start.execution === (executionId ?? "")) return;
     const own = ownedAddress.current;
     if (own && own.request === requestId && own.execution === executionId && own.items === items && own.retry === retry && active.current && !active.current.signal.aborted) return;
     const controller = fresh();
-    setStatus(requestId || executionId ? "Checking status" : "No report");
+    setStatus("Checking status");
     void recover(requestId, executionId, controller).catch((e) => {
       if (owns(controller)) {
         setResult(null);
@@ -257,7 +284,7 @@ function PasswordHealthView(props) {
   const run = async (resume2) => {
     if (!port) return;
     const controller = fresh();
-    starting.current = true;
+    starting.current = { controller, request: "", execution: "" };
     const request = crypto.randomUUID();
     const options = { check_breaches: checkBreaches };
     let actualRequest = request;
@@ -286,7 +313,7 @@ function PasswordHealthView(props) {
           if (data && typeof data === "object" && "type" in data) {
             if (data.type === "vault_password_health_scan_reference") accept(data);
             if (data.type === "vault_password_health_progress") {
-              setProgress(data);
+              setProgress({ ...data, port });
               setStatus("Running");
             }
           }
@@ -330,20 +357,22 @@ function PasswordHealthView(props) {
       setError(problem(e));
       setStatus((value) => value === "Checking status" ? "Unavailable" : value);
     } finally {
-      starting.current = false;
+      if (starting.current?.controller === controller) starting.current = null;
       if (owns(controller)) {
         setBusy(false);
         if (startedItems !== latest.current.items) setRetry((v) => v + 1);
       }
     }
   };
-  const current = inventoryReady && result?.items === items && result.value.availability === "current" ? result.value.snapshot : null;
-  const available = result?.value.availability;
+  const ownedResult = port && result?.port === port ? result : null;
+  const shownProgress = port && progress?.port === port ? progress : null;
+  const current = inventoryReady && ownedResult?.items === items && ownedResult.value.availability === "current" ? ownedResult.value.snapshot : null;
+  const available = ownedResult?.value.availability;
   const outcomes = current?.check_breaches ? current.breach_outcomes ?? [] : [];
   const compromised = outcomes.filter((outcome) => outcome.status === "compromised").length;
   const notFound = outcomes.filter((outcome) => outcome.status === "not_found").length;
   const unknown = outcomes.filter((outcome) => outcome.status === "unknown").length;
-  const resume = result && ["failed", "cancelled"].includes(result.value.execution_status);
+  const resume = ownedResult && ["failed", "cancelled"].includes(ownedResult.value.execution_status);
   return /* @__PURE__ */ jsxs2("div", { className: "flex h-full min-h-0 flex-col gap-4 overflow-auto p-4", "aria-label": "Password health", children: [
     props.header,
     /* @__PURE__ */ jsxs2("div", { className: "flex items-center justify-between gap-2", children: [
@@ -377,9 +406,9 @@ function PasswordHealthView(props) {
           /* @__PURE__ */ jsx2(InfoHint, { text: "The breach lookup could not establish a result." })
         ] }), children: unknown })
       ] }) : null,
-      !current && progress ? /* @__PURE__ */ jsxs2(Fragment, { children: [
-        /* @__PURE__ */ jsx2(VaultRow, { label: "Checked", children: progress.checked }),
-        /* @__PURE__ */ jsx2(VaultRow, { label: "Skipped", children: progress.skipped })
+      !current && shownProgress ? /* @__PURE__ */ jsxs2(Fragment, { children: [
+        /* @__PURE__ */ jsx2(VaultRow, { label: "Checked", children: shownProgress.checked }),
+        /* @__PURE__ */ jsx2(VaultRow, { label: "Skipped", children: shownProgress.skipped })
       ] }) : null,
       current ? /* @__PURE__ */ jsxs2(Fragment, { children: [
         /* @__PURE__ */ jsx2(VaultRow, { label: "Checked", children: current.checked_subjects.length }),
@@ -2137,7 +2166,7 @@ function normalizeWebsite(raw) {
 }
 function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
-  const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
+  const candidates = items.filter((i) => i.authenticatorState === "known" && !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = useState11("");
   const [image, setImage] = useState11(null);
   const [target, setTarget] = useState11(itemId && candidates.some((c) => c.id === itemId) ? itemId : NEW);
@@ -2176,7 +2205,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       }
       const it = item;
       const entry = await confirmed(() => image ? port.authenticator.enrolQrImage(it, image, image.name) : port.authenticator.enrol(it, input));
-      let next = { ...it, authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
+      let next = { ...it, authenticatorState: "known", authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
       const better = authenticatorName(it.name, { issuer: entry.issuer, account: entry.account });
       if (!isNew && better !== it.name) {
         try {
@@ -2314,6 +2343,7 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
   useEffect10(() => {
     if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
   }, [listed, added]);
+  const [incomplete, setIncomplete] = useState12(true);
   const [entries, setEntries] = useState12(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = useState12(/* @__PURE__ */ new Set());
   const [adding, setAdding] = useState12(false);
@@ -2323,8 +2353,15 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
   useEffect10(() => {
     let live = true;
     port.authenticator.list().then(
-      (list) => live && setEntries(new Map(list.map((e) => [e.itemId, e]))),
-      (e) => console.error("One-time password accounts could not be read", e)
+      (list) => {
+        if (live) {
+          setEntries(new Map(list.entries.map((e) => [e.itemId, e])));
+          setIncomplete(list.unavailableScopes.length > 0);
+        }
+      },
+      () => {
+        if (live) setIncomplete(true);
+      }
     );
     return () => {
       live = false;
@@ -2342,7 +2379,14 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
       ] }),
       total > 0 ? /* @__PURE__ */ jsx11(Button9, { variant: "outline", icon: /* @__PURE__ */ jsx11(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
     ] }),
-    total === 0 ? /* @__PURE__ */ jsxs10("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
+    total > 0 && incomplete ? /* @__PURE__ */ jsxs10("div", { className: "px-4 text-sm text-muted-foreground", children: [
+      "Some codes unavailable ",
+      /* @__PURE__ */ jsx11(Button9, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : null,
+    total === 0 && (incomplete || items.some((i) => i.authenticatorState !== "known")) ? /* @__PURE__ */ jsxs10("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: [
+      "Codes unavailable ",
+      /* @__PURE__ */ jsx11(Button9, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : total === 0 ? /* @__PURE__ */ jsxs10("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
       /* @__PURE__ */ jsx11("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ jsx11(ShieldGlyph, { className: "size-6" }) }),
       /* @__PURE__ */ jsx11("p", { className: "text-sm font-medium text-foreground", children: "No authenticator codes yet" }),
       /* @__PURE__ */ jsx11(Button9, { variant: "primary", icon: /* @__PURE__ */ jsx11(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add authenticator" })
@@ -6392,7 +6436,10 @@ function ItemPane(props) {
           i
         )),
         /* @__PURE__ */ jsx25(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
-        /* @__PURE__ */ jsx25(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
+        !item || item.authenticatorState === "known" ? /* @__PURE__ */ jsx25(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }) : /* @__PURE__ */ jsxs23(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ jsx25("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ jsx25(Button22, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }),
         item && isLogin && !item.authenticator ? /* @__PURE__ */ jsx25(TwoFactorMethodRow, { port, item, onChanged }) : null,
         !item && isLogin && draft.authenticator.trim() === "" ? /* @__PURE__ */ jsx25(DraftTwoFactorRow, { custom: draft.custom, onCustom: (custom) => patch({ custom }) }) : null,
         recoveryEditing ? /* @__PURE__ */ jsx25(
@@ -6471,7 +6518,10 @@ function ItemPane(props) {
         }),
         extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ jsx25(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ jsx25(SecretRow, { port, item, field: f, onTurnOn: turnOnOne(f), extra: fieldSettings(f) }, f.id)),
         item.loginUrls.length > 0 ? item.loginUrls.map((u, i) => /* @__PURE__ */ jsx25(PlainRow, { label: i === 0 ? "Website" : `Website ${i + 1}`, value: u, openUrl: host.openUrl }, `${u}-${i}`)) : /* @__PURE__ */ jsx25(AddRow, { label: "Website", onAdd: canEdit ? () => onMode("edit") : null, children: "Add website" }),
-        item.authenticator ? /* @__PURE__ */ jsx25(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
+        item.authenticator ? /* @__PURE__ */ jsx25(TotpRow, { port, item, onChanged }) : item.authenticatorState !== "known" ? /* @__PURE__ */ jsxs23(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ jsx25("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ jsx25(Button22, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }) : seedField && !seedField.active ? (
           // The secret is still there, only off: turning it on brings the codes back. Never "Set up",
           // which would invite replacing a working two-factor secret.
           /* @__PURE__ */ jsx25(VaultRow, { label: "Authenticator", actions: canTurnOn ? /* @__PURE__ */ jsx25(TurnOnButton, { label: "Authenticator", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ jsx25("span", { className: "text-muted-foreground", children: "Turned off" }) })
@@ -9150,10 +9200,34 @@ function Blank({ children }) {
 
 // src/health/api.ts
 import { followRuntimeOperationToEndWithApi } from "@ai-matrx/api";
-import { startPasswordHealthScan, getPasswordHealthScan, resumePasswordHealthScan } from "@ai-matrx/api/account";
+import { startPasswordHealthScan, getPasswordHealthScan, resumePasswordHealthScan, discoverPasswordHealthScans } from "@ai-matrx/api/account";
 import { operationStatus } from "@ai-matrx/api/architecture";
 function createHealthPort(api) {
   return {
+    discover: async (cursor, signal) => {
+      const stream = await discoverPasswordHealthScans(api, cursor ? { query: { cursor } } : void 0, { signal, totalTimeoutMs: null });
+      let page = null;
+      let ended = false;
+      try {
+        for await (const event of stream) {
+          if (signal.aborted || ended || event.event === "error") throw new Error("Report unavailable");
+          const data = event.data;
+          if (event.event === "completion" && data && typeof data === "object" && "status" in data && data.status !== "success") throw new Error("Report unavailable");
+          if (event.event === "end") {
+            if (!data || typeof data !== "object" || !("reason" in data) || data.reason !== "complete") throw new Error("Report unavailable");
+            ended = true;
+          }
+          if (event.event !== "data") continue;
+          if (!data || typeof data !== "object" || !("type" in data) || data.type !== "vault_password_health_discovery_page") continue;
+          if (page || !("__kind" in data) || data.__kind !== "password_health_discovery_page" || !("references" in data) || !Array.isArray(data.references) || data.references.some((ref) => !ref || typeof ref !== "object" || ref.__kind !== "password_health_discovery_reference" || typeof ref.request_id !== "string" || !ref.request_id || typeof ref.execution_id !== "string" || !ref.execution_id) || !("continuation" in data) || data.continuation !== null && (typeof data.continuation !== "string" || !data.continuation)) throw new Error("Report unavailable");
+          page = data;
+        }
+        if (signal.aborted || !ended || !page) throw new Error("Report unavailable");
+        return page;
+      } finally {
+        stream.cancel();
+      }
+    },
     start: (requestId, signal, options) => startPasswordHealthScan(api, { body: options.check_breaches ? { check_breaches: true } : {} }, { requestId, signal, totalTimeoutMs: null }),
     resume: (executionId, requestId, signal) => resumePasswordHealthScan(api, { path: { execution_id: executionId } }, { requestId, signal, totalTimeoutMs: null }),
     read: (executionId, signal) => getPasswordHealthScan(api, { path: { execution_id: executionId } }, { signal }),
@@ -9276,7 +9350,7 @@ function createAuthenticatorPort(ctx) {
   return {
     async list() {
       const r = await apps.listAuthenticators(api);
-      return (r.entries ?? []).map(entryOf);
+      return { entries: (r.entries ?? []).map(entryOf), unavailableScopes: (r.unavailable_scopes ?? []).map((s) => ({ type: s.type, organizationId: s.organization_id ?? null })) };
     },
     async get(item) {
       try {
@@ -9490,6 +9564,7 @@ function trashItem(r, ctx) {
     fields: [],
     custom: [],
     authenticator: null,
+    authenticatorState: "known",
     capabilities: { canUse: false, canEdit: false, canReveal: false, canManage: true },
     attachments: [],
     uriMatchMode: "host",
@@ -9846,7 +9921,8 @@ function fieldOf(w, def) {
     active: w.is_active ?? true
   };
 }
-function itemOf(w, owner, defs, auth) {
+var scopeUnavailable = (owner, scopes) => scopes.some((s) => s.type === (owner.kind === "me" ? "user" : owner.kind === "organization" ? "organization" : "shared") && (s.type !== "organization" || !s.organization_id || s.organization_id === owner.organizationId));
+function itemOf(w, owner, defs, auth, state = "known", unavailable = [], inventoryOwner = owner) {
   const def = defs.get(w.definition_key ?? "");
   const a = auth.get(w.id);
   const cap = w.capabilities ?? {};
@@ -9864,6 +9940,7 @@ function itemOf(w, owner, defs, auth) {
     fields: (w.fields ?? []).filter((f) => f.execution_purpose !== "passkey_private").map((f) => fieldOf(f, def)),
     custom: (w.non_secret_fields ?? []).map((c) => ({ key: c["key"] ?? "", label: c["label"] ?? humanize(c["key"] ?? ""), value: c["value"] ?? "" })),
     authenticator: a ? { digits: a.digits, period: a.period, enabled: a.enabled } : null,
+    authenticatorState: a ? "known" : state === "pending" ? "pending" : state === "unavailable" || scopeUnavailable(inventoryOwner, unavailable) ? "unavailable" : "known",
     capabilities: { canUse: cap.can_use ?? false, canEdit: cap.can_edit ?? false, canReveal: cap.can_reveal ?? false, canManage: cap.can_manage ?? false },
     attachments: (w.attachments ?? []).map((a2) => ({ id: a2.id, label: a2.label, description: a2.description ?? "", fileName: a2.file_name, mediaType: a2.media_type ?? "application/octet-stream", sizeBytes: a2.size_bytes, handling: handlingOf(a2.handling), createdAt: a2.created_at, updatedAt: a2.updated_at })),
     uriMatchMode: MATCH_MODES2.find((m) => m === w.uri_match_mode) ?? "host",
@@ -9900,6 +9977,9 @@ function createApiVaultPort(hostApi, options = {}) {
   };
   let defs = /* @__PURE__ */ new Map();
   let auth = /* @__PURE__ */ new Map();
+  let authState = "pending";
+  let authUnavailable = [];
+  let inventoryOwners = /* @__PURE__ */ new Map();
   let orgs = [];
   const orgOf = (id, userId, mine) => {
     if (id) return { kind: "organization", label: orgs.find((o) => o.id === id)?.name ?? "Organization", organizationId: id };
@@ -9913,7 +9993,7 @@ function createApiVaultPort(hostApi, options = {}) {
   };
   async function refetch(id, owner) {
     const w = await account9.getItem(api, { path: { item_id: id } });
-    return itemOf(w, owner, defs, auth);
+    return itemOf(w, owner, defs, auth, authState, authUnavailable, inventoryOwners.get(id) ?? owner);
   }
   const visibleCache = /* @__PURE__ */ new Map();
   const ctx = {
@@ -9940,6 +10020,10 @@ function createApiVaultPort(hostApi, options = {}) {
     fields: createFieldsPort(ctx),
     lists: createListsPort(ctx, options.userState),
     async load(onProgress) {
+      authState = "pending";
+      auth = /* @__PURE__ */ new Map();
+      authUnavailable = [];
+      inventoryOwners = /* @__PURE__ */ new Map();
       const catalogP = retrying(() => apps2.getAppCatalogKind(api, { path: { app: "matrx", kind: "credential_definition" } }));
       const authP = retrying(() => apps2.listAuthenticators(api));
       const userP = retrying(() => account9.listItems(api, { query: { principal_type: "user" } }));
@@ -9962,9 +10046,10 @@ function createApiVaultPort(hostApi, options = {}) {
         const meId = raw.meId ?? mineItems.find((w) => w.user_id)?.user_id ?? null;
         const seen = /* @__PURE__ */ new Map();
         const deleted = /* @__PURE__ */ new Map();
-        const take = (w, owner) => {
+        const take = (w, owner, inventoryOwner = owner) => {
           if (seen.has(w.id) || deleted.has(w.id) || isHiddenItem(w)) return;
-          const item = itemOf(w, owner, defs, auth);
+          inventoryOwners.set(w.id, inventoryOwner);
+          const item = itemOf(w, owner, defs, auth, authState, authUnavailable, inventoryOwner);
           (isDeleted(w) ? deleted : seen).set(w.id, item);
         };
         for (const w of mineItems) take(w, orgOf(w.organization_id, null, true));
@@ -9972,7 +10057,7 @@ function createApiVaultPort(hostApi, options = {}) {
           const via = orgs[i];
           for (const w of l?.items ?? []) take(w, ownerInOrgList(w, via, meId));
         });
-        for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? orgOf(w.organization_id, null, false) : { kind: "shared", label: "Shared with me", organizationId: null });
+        for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? orgOf(w.organization_id, null, false) : { kind: "shared", label: "Shared with me", organizationId: null }, { kind: "shared", label: "Shared with me", organizationId: null });
         const pending = done ? [] : [...raw.orgsKnown ? orgs.filter((_, i) => raw.orgLists[i] === void 0).map((o) => o.name) : ["your organizations"], ...raw.shared ? [] : ["Shared with me"]];
         return {
           unavailable: [...unavailable],
@@ -10031,9 +10116,14 @@ function createApiVaultPort(hostApi, options = {}) {
       })();
       quiet(orgListsReady);
       const authDone = authP.then((a) => {
-        auth = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
+        authUnavailable = a.unavailable_scopes ?? [];
+        const fresh = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
+        auth = fresh;
+        authState = "known";
+        if (authUnavailable.length) unavailable.push("One-time codes");
         progress();
       }, () => {
+        authState = "unavailable";
         unavailable.push("One-time codes");
       });
       const sharedDone = sharedP.then((sh) => {