@ai-matrx/vault 0.1.55 → 0.1.56

package/CHANGELOG.md

@@ -1,8 +1,12 @@
 # Changelog
 
+## 0.1.56
+
+- No changes yet.
+
 ## 0.1.55
 
-- Password Health can discover a prior scan when neither request nor execution handle is available, and binds recovered results and progress to the originating health port. Consumer action: custom `HealthPort` implementations must provide `discover(cursor, signal)`; `createApiVaultPort` wires it automatically. Discovery returns authorized request/execution references only.
+- Password Health can discover a prior scan when neither request nor execution handle is available, and binds recovered results and progress to the originating health port. Consumer action: custom `HealthPort` implementations must provide `discover(cursor, signal)`; `createApiVaultPort` wires it automatically. Discovery returns authorized request/execution references only. External request/execution handle changes retire pending work and recover the new address; matching self-written handles preserve the current run.
 
 ## 0.1.54
 

package/dist/index.cjs

@@ -2702,7 +2702,7 @@ function normalizeWebsite(raw) {
 }
 function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
-  const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
+  const candidates = items.filter((i) => i.authenticatorState === "known" && !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = (0, import_react13.useState)("");
   const [image, setImage] = (0, import_react13.useState)(null);
   const [target, setTarget] = (0, import_react13.useState)(itemId && candidates.some((c) => c.id === itemId) ? itemId : NEW);
@@ -2741,7 +2741,7 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
       }
       const it = item;
       const entry = await confirmed(() => image ? port.authenticator.enrolQrImage(it, image, image.name) : port.authenticator.enrol(it, input));
-      let next = { ...it, authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
+      let next = { ...it, authenticatorState: "known", authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
       const better = authenticatorName(it.name, { issuer: entry.issuer, account: entry.account });
       if (!isNew && better !== it.name) {
         try {
@@ -2879,6 +2879,7 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
   (0, import_react14.useEffect)(() => {
     if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
   }, [listed, added]);
+  const [incomplete, setIncomplete] = (0, import_react14.useState)(true);
   const [entries, setEntries] = (0, import_react14.useState)(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = (0, import_react14.useState)(/* @__PURE__ */ new Set());
   const [adding, setAdding] = (0, import_react14.useState)(false);
@@ -2888,8 +2889,15 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
   (0, import_react14.useEffect)(() => {
     let live = true;
     port.authenticator.list().then(
-      (list) => live && setEntries(new Map(list.map((e) => [e.itemId, e]))),
-      (e) => console.error("One-time password accounts could not be read", e)
+      (list) => {
+        if (live) {
+          setEntries(new Map(list.entries.map((e) => [e.itemId, e])));
+          setIncomplete(list.unavailableScopes.length > 0);
+        }
+      },
+      () => {
+        if (live) setIncomplete(true);
+      }
     );
     return () => {
       live = false;
@@ -2907,7 +2915,14 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
       ] }),
       total > 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
     ] }),
-    total === 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
+    total > 0 && incomplete ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "px-4 text-sm text-muted-foreground", children: [
+      "Some codes unavailable ",
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : null,
+    total === 0 && (incomplete || items.some((i) => i.authenticatorState !== "known")) ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: [
+      "Codes unavailable ",
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : total === 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(ShieldGlyph, { className: "size-6" }) }),
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { className: "text-sm font-medium text-foreground", children: "No authenticator codes yet" }),
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add authenticator" })
@@ -6954,7 +6969,10 @@ function ItemPane(props) {
           i
         )),
         /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
-        /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
+        !item || item.authenticatorState === "known" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }) : /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }),
         item && isLogin && !item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TwoFactorMethodRow, { port, item, onChanged }) : null,
         !item && isLogin && draft.authenticator.trim() === "" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(DraftTwoFactorRow, { custom: draft.custom, onCustom: (custom) => patch({ custom }) }) : null,
         recoveryEditing ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(
@@ -7033,7 +7051,10 @@ function ItemPane(props) {
         }),
         extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(SecretRow, { port, item, field: f, onTurnOn: turnOnOne(f), extra: fieldSettings(f) }, f.id)),
         item.loginUrls.length > 0 ? item.loginUrls.map((u, i) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(PlainRow, { label: i === 0 ? "Website" : `Website ${i + 1}`, value: u, openUrl: host.openUrl }, `${u}-${i}`)) : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(AddRow, { label: "Website", onAdd: canEdit ? () => onMode("edit") : null, children: "Add website" }),
-        item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
+        item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpRow, { port, item, onChanged }) : item.authenticatorState !== "known" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }) : seedField && !seedField.active ? (
           // The secret is still there, only off: turning it on brings the codes back. Never "Set up",
           // which would invite replacing a working two-factor secret.
           /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(VaultRow, { label: "Authenticator", actions: canTurnOn ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TurnOnButton, { label: "Authenticator", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: "Turned off" }) })
@@ -9862,7 +9883,7 @@ function createAuthenticatorPort(ctx) {
   return {
     async list() {
       const r = await apps.listAuthenticators(api);
-      return (r.entries ?? []).map(entryOf);
+      return { entries: (r.entries ?? []).map(entryOf), unavailableScopes: (r.unavailable_scopes ?? []).map((s) => ({ type: s.type, organizationId: s.organization_id ?? null })) };
     },
     async get(item) {
       try {
@@ -10076,6 +10097,7 @@ function trashItem(r, ctx) {
     fields: [],
     custom: [],
     authenticator: null,
+    authenticatorState: "known",
     capabilities: { canUse: false, canEdit: false, canReveal: false, canManage: true },
     attachments: [],
     uriMatchMode: "host",
@@ -10432,7 +10454,8 @@ function fieldOf(w, def) {
     active: w.is_active ?? true
   };
 }
-function itemOf(w, owner, defs, auth) {
+var scopeUnavailable = (owner, scopes) => scopes.some((s) => s.type === (owner.kind === "me" ? "user" : owner.kind === "organization" ? "organization" : "shared") && (s.type !== "organization" || !s.organization_id || s.organization_id === owner.organizationId));
+function itemOf(w, owner, defs, auth, state = "known", unavailable = [], inventoryOwner = owner) {
   const def = defs.get(w.definition_key ?? "");
   const a = auth.get(w.id);
   const cap = w.capabilities ?? {};
@@ -10450,6 +10473,7 @@ function itemOf(w, owner, defs, auth) {
     fields: (w.fields ?? []).filter((f) => f.execution_purpose !== "passkey_private").map((f) => fieldOf(f, def)),
     custom: (w.non_secret_fields ?? []).map((c) => ({ key: c["key"] ?? "", label: c["label"] ?? humanize(c["key"] ?? ""), value: c["value"] ?? "" })),
     authenticator: a ? { digits: a.digits, period: a.period, enabled: a.enabled } : null,
+    authenticatorState: a ? "known" : state === "pending" ? "pending" : state === "unavailable" || scopeUnavailable(inventoryOwner, unavailable) ? "unavailable" : "known",
     capabilities: { canUse: cap.can_use ?? false, canEdit: cap.can_edit ?? false, canReveal: cap.can_reveal ?? false, canManage: cap.can_manage ?? false },
     attachments: (w.attachments ?? []).map((a2) => ({ id: a2.id, label: a2.label, description: a2.description ?? "", fileName: a2.file_name, mediaType: a2.media_type ?? "application/octet-stream", sizeBytes: a2.size_bytes, handling: handlingOf(a2.handling), createdAt: a2.created_at, updatedAt: a2.updated_at })),
     uriMatchMode: MATCH_MODES2.find((m) => m === w.uri_match_mode) ?? "host",
@@ -10486,6 +10510,9 @@ function createApiVaultPort(hostApi, options = {}) {
   };
   let defs = /* @__PURE__ */ new Map();
   let auth = /* @__PURE__ */ new Map();
+  let authState = "pending";
+  let authUnavailable = [];
+  let inventoryOwners = /* @__PURE__ */ new Map();
   let orgs = [];
   const orgOf = (id, userId, mine) => {
     if (id) return { kind: "organization", label: orgs.find((o) => o.id === id)?.name ?? "Organization", organizationId: id };
@@ -10499,7 +10526,7 @@ function createApiVaultPort(hostApi, options = {}) {
   };
   async function refetch(id, owner) {
     const w = await account9.getItem(api, { path: { item_id: id } });
-    return itemOf(w, owner, defs, auth);
+    return itemOf(w, owner, defs, auth, authState, authUnavailable, inventoryOwners.get(id) ?? owner);
   }
   const visibleCache = /* @__PURE__ */ new Map();
   const ctx = {
@@ -10526,6 +10553,10 @@ function createApiVaultPort(hostApi, options = {}) {
     fields: createFieldsPort(ctx),
     lists: createListsPort(ctx, options.userState),
     async load(onProgress) {
+      authState = "pending";
+      auth = /* @__PURE__ */ new Map();
+      authUnavailable = [];
+      inventoryOwners = /* @__PURE__ */ new Map();
       const catalogP = retrying(() => apps2.getAppCatalogKind(api, { path: { app: "matrx", kind: "credential_definition" } }));
       const authP = retrying(() => apps2.listAuthenticators(api));
       const userP = retrying(() => account9.listItems(api, { query: { principal_type: "user" } }));
@@ -10548,9 +10579,10 @@ function createApiVaultPort(hostApi, options = {}) {
         const meId = raw.meId ?? mineItems.find((w) => w.user_id)?.user_id ?? null;
         const seen = /* @__PURE__ */ new Map();
         const deleted = /* @__PURE__ */ new Map();
-        const take = (w, owner) => {
+        const take = (w, owner, inventoryOwner = owner) => {
           if (seen.has(w.id) || deleted.has(w.id) || isHiddenItem(w)) return;
-          const item = itemOf(w, owner, defs, auth);
+          inventoryOwners.set(w.id, inventoryOwner);
+          const item = itemOf(w, owner, defs, auth, authState, authUnavailable, inventoryOwner);
           (isDeleted(w) ? deleted : seen).set(w.id, item);
         };
         for (const w of mineItems) take(w, orgOf(w.organization_id, null, true));
@@ -10558,7 +10590,7 @@ function createApiVaultPort(hostApi, options = {}) {
           const via = orgs[i];
           for (const w of l?.items ?? []) take(w, ownerInOrgList(w, via, meId));
         });
-        for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? orgOf(w.organization_id, null, false) : { kind: "shared", label: "Shared with me", organizationId: null });
+        for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? orgOf(w.organization_id, null, false) : { kind: "shared", label: "Shared with me", organizationId: null }, { kind: "shared", label: "Shared with me", organizationId: null });
         const pending = done ? [] : [...raw.orgsKnown ? orgs.filter((_, i) => raw.orgLists[i] === void 0).map((o) => o.name) : ["your organizations"], ...raw.shared ? [] : ["Shared with me"]];
         return {
           unavailable: [...unavailable],
@@ -10617,9 +10649,14 @@ function createApiVaultPort(hostApi, options = {}) {
       })();
       quiet(orgListsReady);
       const authDone = authP.then((a) => {
-        auth = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
+        authUnavailable = a.unavailable_scopes ?? [];
+        const fresh = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
+        auth = fresh;
+        authState = "known";
+        if (authUnavailable.length) unavailable.push("One-time codes");
         progress();
       }, () => {
+        authState = "unavailable";
         unavailable.push("One-time codes");
       });
       const sharedDone = sharedP.then((sh) => {