@ai-matrx/vault 0.1.55 → 0.1.57

package/dist/index.cjs

@@ -2621,10 +2621,22 @@ function TotpRow({ port, item, onChanged }) {
 function TotpEditRow({ value, onChange, hasExisting, item, port, onEnrolled, onRecognized }) {
   const confirmed = useConfirmed();
   const [status, setStatus] = (0, import_react12.useState)(null);
+  const [retryImage, setRetryImage] = (0, import_react12.useState)(null);
+  const latestItem = (0, import_react12.useRef)(item);
+  latestItem.current = item;
   const uploadImage = item && port ? async (file) => {
+    setRetryImage(file);
     setStatus("Adding from image\u2026");
     try {
-      const entry = await confirmed(() => port.authenticator.enrolQrImage(item, file, file.name));
+      const entry = await confirmed(async () => {
+        const current = await port.get(item);
+        const visible = latestItem.current;
+        if (!visible || visible.id !== item.id || visible.authenticatorState !== "known" || current.authenticatorState !== "known" || !item.authenticator && (visible.authenticator || current.authenticator)) {
+          throw new Error("Authenticator status unavailable. Retry after refreshing.");
+        }
+        return port.authenticator.enrolQrImage(current, file, file.name);
+      });
+      setRetryImage(null);
       setStatus(entry.issuer ? `Added \xB7 ${entry.issuer}` : "Added");
       onChange("");
       onEnrolled?.({ ...item, authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } });
@@ -2641,7 +2653,11 @@ function TotpEditRow({ value, onChange, hasExisting, item, port, onEnrolled, onR
         onChange(v);
       },
       placeholder: hasExisting ? "Paste a new key to replace" : SETUP_KEY_PLACEHOLDER,
-      status,
+      status: status && retryImage && uploadImage ? /* @__PURE__ */ (0, import_jsx_runtime12.jsxs)(import_jsx_runtime12.Fragment, { children: [
+        status,
+        " ",
+        /* @__PURE__ */ (0, import_jsx_runtime12.jsx)(import_controls8.Button, { variant: "quiet", onClick: () => void uploadImage(retryImage), children: "Retry" })
+      ] }) : status,
       ...uploadImage ? { onImage: (f) => void uploadImage(f) } : {},
       ...onRecognized ? { onRecognized } : {}
     }
@@ -2702,7 +2718,9 @@ function normalizeWebsite(raw) {
 }
 function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
-  const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
+  const itemsRef = (0, import_react13.useRef)(items);
+  itemsRef.current = items;
+  const candidates = items.filter((i) => i.authenticatorState === "known" && !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = (0, import_react13.useState)("");
   const [image, setImage] = (0, import_react13.useState)(null);
   const [target, setTarget] = (0, import_react13.useState)(itemId && candidates.some((c) => c.id === itemId) ? itemId : NEW);
@@ -2730,18 +2748,26 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
     setBusy(true);
     setError(null);
     try {
-      let item = isNew ? created : items.find((i) => i.id === target) ?? null;
+      let item = isNew ? created : itemsRef.current.find((i) => i.id === target) ?? null;
+      let freshlyCreated = false;
+      if (!isNew && (!item || item.authenticatorState !== "known" || item.authenticator)) throw new Error("Authenticator status unavailable. Retry after refreshing.");
       if (!item) {
         const def = LOGIN_KEYS.map((k) => definitions.find((d) => d.key === k)).find((d) => Boolean(d));
         if (!def) throw new Error("No login type is available.");
         const r = await port.create(def, null, { ...draftOf(null), name: name.trim(), loginUrls: websiteUrl ? [websiteUrl] : [] });
         item = r.item;
+        freshlyCreated = true;
         setCreated(item);
         onChanged();
       }
       const it = item;
-      const entry = await confirmed(() => image ? port.authenticator.enrolQrImage(it, image, image.name) : port.authenticator.enrol(it, input));
-      let next = { ...it, authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
+      const entry = await confirmed(async () => {
+        const latest = freshlyCreated ? it : await port.get(it);
+        const listed = itemsRef.current.find((i) => i.id === it.id);
+        if (!freshlyCreated && (latest.authenticatorState !== "known" || latest.authenticator || !isNew && !listed) || listed && (listed.authenticatorState !== "known" || listed.authenticator)) throw new Error("Authenticator status unavailable. Retry after refreshing.");
+        return image ? port.authenticator.enrolQrImage(latest, image, image.name) : port.authenticator.enrol(latest, input);
+      });
+      let next = { ...it, authenticatorState: "known", authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
       const better = authenticatorName(it.name, { issuer: entry.issuer, account: entry.account });
       if (!isNew && better !== it.name) {
         try {
@@ -2827,7 +2853,11 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
             /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(VaultRow, { label: "Website", hint: websiteBad ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("span", { className: "text-destructive", children: "Not a web address" }) : void 0, children: /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls9.Field, { className: "w-full", type: "url", value: website, disabled: busy || created !== null, onChange: (e) => setWebsite(e.target.value), placeholder: "example.com", "aria-label": "Website", "aria-invalid": websiteBad || void 0 }) })
           ] }) : null
         ] }),
-        error ? /* @__PURE__ */ (0, import_jsx_runtime13.jsx)("p", { className: "px-1 text-sm text-destructive", role: "alert", children: error }) : null
+        error ? /* @__PURE__ */ (0, import_jsx_runtime13.jsxs)("p", { className: "px-1 text-sm text-destructive", role: "alert", children: [
+          error,
+          " ",
+          /* @__PURE__ */ (0, import_jsx_runtime13.jsx)(import_controls9.Button, { variant: "quiet", onClick: onChanged, children: "Retry" })
+        ] }) : null
       ]
     }
   );
@@ -2862,23 +2892,8 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function withAdded(items, added) {
-  if (added.size === 0) return items;
-  const seen = /* @__PURE__ */ new Set();
-  const out = items.map((i) => {
-    seen.add(i.id);
-    const mine = added.get(i.id);
-    return mine && !i.authenticator ? { ...i, authenticator: mine.authenticator, name: mine.name } : i;
-  });
-  for (const [id, a] of added) if (!seen.has(id)) out.push(a);
-  return out;
-}
-function AuthenticatorView({ port, host, items: listed, definitions, query, onOpen, onChanged, header }) {
-  const [added, setAdded] = (0, import_react14.useState)(/* @__PURE__ */ new Map());
-  const items = withAdded(listed, added);
-  (0, import_react14.useEffect)(() => {
-    if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
-  }, [listed, added]);
+function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
+  const [incomplete, setIncomplete] = (0, import_react14.useState)(true);
   const [entries, setEntries] = (0, import_react14.useState)(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = (0, import_react14.useState)(/* @__PURE__ */ new Set());
   const [adding, setAdding] = (0, import_react14.useState)(false);
@@ -2888,13 +2903,20 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
   (0, import_react14.useEffect)(() => {
     let live = true;
     port.authenticator.list().then(
-      (list) => live && setEntries(new Map(list.map((e) => [e.itemId, e]))),
-      (e) => console.error("One-time password accounts could not be read", e)
+      (list) => {
+        if (live) {
+          setEntries(new Map(list.entries.map((e) => [e.itemId, e])));
+          setIncomplete(list.unavailableScopes.length > 0);
+        }
+      },
+      () => {
+        if (live) setIncomplete(true);
+      }
     );
     return () => {
       live = false;
     };
-  }, [port, listed, added]);
+  }, [port, items]);
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -2907,7 +2929,14 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
       ] }),
       total > 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "outline", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
     ] }),
-    total === 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
+    total > 0 && (incomplete || items.some((i) => i.authenticatorState !== "known")) ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "px-4 text-sm text-muted-foreground", children: [
+      "Some codes unavailable ",
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : null,
+    total === 0 && (incomplete || items.some((i) => i.authenticatorState !== "known")) ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: [
+      "Codes unavailable ",
+      /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : total === 0 ? /* @__PURE__ */ (0, import_jsx_runtime14.jsxs)("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(ShieldGlyph, { className: "size-6" }) }),
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)("p", { className: "text-sm font-medium text-foreground", children: "No authenticator codes yet" }),
       /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(import_controls10.Button, { variant: "primary", icon: /* @__PURE__ */ (0, import_jsx_runtime14.jsx)(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add authenticator" })
@@ -2940,7 +2969,6 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
         definitions,
         onClose: () => setAdding(false),
         onChanged,
-        onAdded: (item) => setAdded((cur) => new Map(cur).set(item.id, item)),
         onDone: (id) => {
           setAdding(false);
           onOpen(id);
@@ -6545,6 +6573,10 @@ function confirmDelete(item) {
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
   const confirmed = useConfirmed();
+  const latestItem = (0, import_react30.useRef)(item);
+  latestItem.current = item;
+  const [createdForRetry, setCreatedForRetry] = (0, import_react30.useState)(null);
+  const enrolledForRetry = (0, import_react30.useRef)(null);
   const notify = useNotify();
   const editing = mode !== "view";
   const seedName = seed?.name ?? "";
@@ -6630,23 +6662,39 @@ function ItemPane(props) {
     setError(null);
     const out = { ...draft, values: Object.fromEntries(changedValues(base, draft)) };
     if (out.values[RECOVERY_CODES_KEY] !== void 0) out.values[RECOVERY_CODES_KEY] = parseRecoveryCodes(out.values[RECOVERY_CODES_KEY]).join("\n");
-    const withOtp = async (saved, notice2) => {
+    const withOtp = async (saved, notice2, freshlyCreated = false) => {
       const setup = out.authenticator.trim();
       if (!setup) return [saved, notice2, false];
       try {
-        await confirmed(() => port.authenticator.enrol(saved, setup));
+        if (enrolledForRetry.current?.itemId !== saved.id || enrolledForRetry.current.setup !== setup) await confirmed(async () => {
+          const current = freshlyCreated ? saved : await port.get(saved);
+          const visible = latestItem.current?.id === saved.id ? latestItem.current : null;
+          const ownEnrollment = enrolledForRetry.current?.itemId === saved.id;
+          if (!freshlyCreated && (current.authenticatorState !== "known" || !item?.authenticator && current.authenticator && !ownEnrollment || item && !visible) || visible && (visible.authenticatorState !== "known" || !item?.authenticator && visible.authenticator && !ownEnrollment)) throw new Error("Authenticator status unavailable. Retry after refreshing");
+          await port.authenticator.enrol(current, setup);
+          enrolledForRetry.current = { itemId: saved.id, setup };
+        });
         return [await port.get(saved), notice2, true];
       } catch (e) {
+        if (enrolledForRetry.current?.itemId === saved.id && enrolledForRetry.current.setup === setup) return [saved, `Saved and authenticator set up, but refresh failed: ${e instanceof Error ? e.message : "Retry"}.`, false];
         const why = wasCancelled(e) ? "it was not confirmed" : e instanceof Error ? e.message : "it was refused";
         return [saved, `Saved, but the authenticator was not set up: ${why}. Add it with Edit.`, false];
       }
     };
     try {
-      if (item) {
-        const r = await port.save(item, definition, out);
+      if (item || createdForRetry) {
+        const r = await port.save(item ?? createdForRetry, definition, out);
         const [next, n, enrolled] = await withOtp(r.item, r.notice);
-        (0, import_drafts.dropKeptDraft)(keepKey);
-        onSaved(next, false, n, enrolled);
+        if (out.authenticator.trim() && !enrolled) {
+          setError(n);
+          onChanged();
+          return;
+        }
+        if (createdForRetry) await finishNew(next, n, enrolled);
+        else {
+          (0, import_drafts.dropKeptDraft)(keepKey);
+          onSaved(next, false, n, enrolled);
+        }
       } else if (definition && owner === "person") {
         const secretKey = declared.find((f) => f.storage === "encrypted" && f.kind === "secret")?.key ?? null;
         const r = await port.sharing.assign({ recipientEmail: recipient.trim(), definition, draft: out, generateFieldKey: generatePrivately ? secretKey : null });
@@ -6656,12 +6704,14 @@ function ItemPane(props) {
         setSent(r);
       } else if (definition) {
         const r = await port.create(definition, owner === "me" ? null : owner, out);
-        const [withCode, n0, enrolled] = await withOtp(r.item, r.notice);
-        const [next, n] = await storeQueuedFiles(withCode, n0);
-        (0, import_drafts.dropKeptDraft)(keepKey);
-        setSavedNew(true);
-        onDirty(false);
-        onSaved(next, true, n, enrolled);
+        setCreatedForRetry(r.item);
+        const [withCode, n0, enrolled] = await withOtp(r.item, r.notice, true);
+        if (out.authenticator.trim() && !enrolled) {
+          setError(n0);
+          onChanged();
+          return;
+        }
+        await finishNew(withCode, n0, enrolled);
       }
     } catch (e) {
       setError(e instanceof Error ? e.message : "Saving failed. Nothing was changed.");
@@ -6669,6 +6719,13 @@ function ItemPane(props) {
       setBusy(false);
     }
   }
+  async function finishNew(saved, notice2, enrolled) {
+    const [next, finalNotice] = await storeQueuedFiles(saved, notice2);
+    (0, import_drafts.dropKeptDraft)(keepKey);
+    setSavedNew(true);
+    onDirty(false);
+    onSaved(next, true, finalNotice, enrolled);
+  }
   async function storeQueuedFiles(saved, notice2) {
     let next = saved;
     const failed = [];
@@ -6850,7 +6907,11 @@ function ItemPane(props) {
   const filesProps = item ? { item, port, host, definition, organizations, arg: null, onClose: () => void 0, onChanged, onPanel } : null;
   return /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(RoomProvider, { value: room, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("article", { ref: paneRef, "aria-label": item?.name ?? "New item", className: (0, import_design_system19.cn)(import_controls23.CONTROLS_CONTAINER_CLASS, "flex h-full min-h-0 flex-col bg-background"), children: [
     header,
-    error ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("div", { role: "alert", className: "border-b border-border bg-muted px-5 py-2 text-sm text-destructive", children: error }) : null,
+    error ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { role: "alert", className: "border-b border-border bg-muted px-5 py-2 text-sm text-destructive", children: [
+      error,
+      " ",
+      error.includes("Retry after refreshing") ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", onClick: () => onChanged(), children: "Retry" }) : null
+    ] }) : null,
     notice && !editing ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("div", { role: "status", className: "border-b border-border bg-muted px-5 py-2 text-sm text-warning", children: notice }) : null,
     item && !editing && (itemOff || offFields.length > 0) ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-5 py-2 text-sm", children: [
       /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "min-w-0 flex-1 truncate text-warning", children: offFields.length === 0 ? "This item is turned off" : offFields.length === 1 ? "1 field is turned off" : `${offFields.length} fields are turned off` }),
@@ -6954,7 +7015,11 @@ function ItemPane(props) {
           i
         )),
         /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
-        /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
+        /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("div", { hidden: Boolean(item && item.authenticatorState !== "known"), children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }) }),
+        item && item.authenticatorState !== "known" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }) : null,
         item && isLogin && !item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TwoFactorMethodRow, { port, item, onChanged }) : null,
         !item && isLogin && draft.authenticator.trim() === "" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(DraftTwoFactorRow, { custom: draft.custom, onCustom: (custom) => patch({ custom }) }) : null,
         recoveryEditing ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(
@@ -7033,7 +7098,10 @@ function ItemPane(props) {
         }),
         extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(SecretRow, { port, item, field: f, onTurnOn: turnOnOne(f), extra: fieldSettings(f) }, f.id)),
         item.loginUrls.length > 0 ? item.loginUrls.map((u, i) => /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(PlainRow, { label: i === 0 ? "Website" : `Website ${i + 1}`, value: u, openUrl: host.openUrl }, `${u}-${i}`)) : /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(AddRow, { label: "Website", onAdd: canEdit ? () => onMode("edit") : null, children: "Add website" }),
-        item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
+        item.authenticator ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TotpRow, { port, item, onChanged }) : item.authenticatorState !== "known" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsxs)(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(import_controls23.Button, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }) : seedField && !seedField.active ? (
           // The secret is still there, only off: turning it on brings the codes back. Never "Set up",
           // which would invite replacing a working two-factor secret.
           /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(VaultRow, { label: "Authenticator", actions: canTurnOn ? /* @__PURE__ */ (0, import_jsx_runtime28.jsx)(TurnOnButton, { label: "Authenticator", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ (0, import_jsx_runtime28.jsx)("span", { className: "text-muted-foreground", children: "Turned off" }) })
@@ -9204,6 +9272,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const [refreshing, setRefreshing] = (0, import_react44.useState)(false);
   const loadedAt = (0, import_react44.useRef)(0);
   const inFlight = (0, import_react44.useRef)(false);
+  const loadGeneration = (0, import_react44.useRef)(0);
   const apply = (0, import_react44.useCallback)(
     (s) => {
       loadedAt.current = Date.now();
@@ -9220,11 +9289,15 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const refresh = (0, import_react44.useCallback)(() => {
     if (inFlight.current) return;
     inFlight.current = true;
+    const generation = ++loadGeneration.current;
     setRefreshing(true);
     port.load().then((s) => {
+      if (generation !== loadGeneration.current) return;
       setRefreshError(null);
       apply(s);
-    }).catch((e) => setRefreshError(plainLoadError(e instanceof Error && e.message ? e.message : "The vault could not be read."))).finally(() => {
+    }).catch((e) => {
+      if (generation === loadGeneration.current) setRefreshError(plainLoadError(e instanceof Error && e.message ? e.message : "The vault could not be read."));
+    }).finally(() => {
       inFlight.current = false;
       setRefreshing(false);
     });
@@ -9232,18 +9305,20 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     port.lists.recents?.list().then(setRecents, () => void 0);
   }, [port, apply]);
   const load = (0, import_react44.useCallback)(() => {
+    const generation = ++loadGeneration.current;
     setError(null);
     setRefreshError(null);
     let finished = false;
     port.load((partial) => {
-      if (finished) return;
+      if (finished || generation !== loadGeneration.current) return;
       setSnap(partial);
       setItems(partial.items);
       setDeleted(partial.deleted);
     }).then((s) => {
       finished = true;
-      apply(s);
+      if (generation === loadGeneration.current) apply(s);
     }).catch((e) => {
+      if (generation !== loadGeneration.current) return;
       setSignedOut(e?.status === 401);
       setError(e instanceof Error ? e.message : "The vault could not be loaded.");
     });
@@ -9862,7 +9937,7 @@ function createAuthenticatorPort(ctx) {
   return {
     async list() {
       const r = await apps.listAuthenticators(api);
-      return (r.entries ?? []).map(entryOf);
+      return { entries: (r.entries ?? []).map(entryOf), unavailableScopes: (r.unavailable_scopes ?? []).map((s) => ({ type: s.type, organizationId: s.organization_id ?? null })) };
     },
     async get(item) {
       try {
@@ -10076,6 +10151,7 @@ function trashItem(r, ctx) {
     fields: [],
     custom: [],
     authenticator: null,
+    authenticatorState: "known",
     capabilities: { canUse: false, canEdit: false, canReveal: false, canManage: true },
     attachments: [],
     uriMatchMode: "host",
@@ -10432,7 +10508,8 @@ function fieldOf(w, def) {
     active: w.is_active ?? true
   };
 }
-function itemOf(w, owner, defs, auth) {
+var scopeUnavailable = (owner, scopes) => scopes.some((s) => s.type === (owner.kind === "me" ? "user" : owner.kind === "organization" ? "organization" : "shared") && (s.type !== "organization" || !s.organization_id || s.organization_id === owner.organizationId));
+function itemOf(w, owner, defs, auth, state = "known", unavailable = [], inventoryOwner = owner) {
   const def = defs.get(w.definition_key ?? "");
   const a = auth.get(w.id);
   const cap = w.capabilities ?? {};
@@ -10450,6 +10527,7 @@ function itemOf(w, owner, defs, auth) {
     fields: (w.fields ?? []).filter((f) => f.execution_purpose !== "passkey_private").map((f) => fieldOf(f, def)),
     custom: (w.non_secret_fields ?? []).map((c) => ({ key: c["key"] ?? "", label: c["label"] ?? humanize(c["key"] ?? ""), value: c["value"] ?? "" })),
     authenticator: a ? { digits: a.digits, period: a.period, enabled: a.enabled } : null,
+    authenticatorState: a ? "known" : state === "pending" ? "pending" : state === "unavailable" || scopeUnavailable(inventoryOwner, unavailable) || (w.fields ?? []).some((f) => f.field_key === OTP_SEED_KEY && f.is_active !== false) ? "unavailable" : "known",
     capabilities: { canUse: cap.can_use ?? false, canEdit: cap.can_edit ?? false, canReveal: cap.can_reveal ?? false, canManage: cap.can_manage ?? false },
     attachments: (w.attachments ?? []).map((a2) => ({ id: a2.id, label: a2.label, description: a2.description ?? "", fileName: a2.file_name, mediaType: a2.media_type ?? "application/octet-stream", sizeBytes: a2.size_bytes, handling: handlingOf(a2.handling), createdAt: a2.created_at, updatedAt: a2.updated_at })),
     uriMatchMode: MATCH_MODES2.find((m) => m === w.uri_match_mode) ?? "host",
@@ -10486,20 +10564,19 @@ function createApiVaultPort(hostApi, options = {}) {
   };
   let defs = /* @__PURE__ */ new Map();
   let auth = /* @__PURE__ */ new Map();
+  let authState = "pending";
+  let authUnavailable = [];
+  let inventoryOwners = /* @__PURE__ */ new Map();
   let orgs = [];
+  let loadGeneration = 0;
+  let authMutation = 0;
   const orgOf = (id, userId, mine) => {
     if (id) return { kind: "organization", label: orgs.find((o) => o.id === id)?.name ?? "Organization", organizationId: id };
     return mine || userId ? { kind: "me", label: "Personal", organizationId: null } : { kind: "shared", label: "Shared with me", organizationId: null };
   };
-  const ownerInOrgList = (w, via, meId) => {
-    if (w.organization_id) return orgOf(w.organization_id, null, false);
-    if (w.user_id && meId && w.user_id === meId) return { kind: "me", label: "Personal", organizationId: null };
-    if (via) return { kind: "organization", label: via.name, organizationId: via.id, memberShared: { userId: w.user_id ?? null } };
-    return { kind: "shared", label: "Shared with me", organizationId: null };
-  };
   async function refetch(id, owner) {
     const w = await account9.getItem(api, { path: { item_id: id } });
-    return itemOf(w, owner, defs, auth);
+    return itemOf(w, owner, defs, auth, authState, authUnavailable, inventoryOwners.get(id) ?? owner);
   }
   const visibleCache = /* @__PURE__ */ new Map();
   const ctx = {
@@ -10509,6 +10586,7 @@ function createApiVaultPort(hostApi, options = {}) {
     definition: (key) => defs.get(key),
     organizations: () => orgs,
     setAuthenticator: (itemId, entry) => {
+      authMutation++;
       const next = new Map(auth);
       if (entry) next.set(itemId, entry);
       else next.delete(itemId);
@@ -10526,124 +10604,155 @@ function createApiVaultPort(hostApi, options = {}) {
     fields: createFieldsPort(ctx),
     lists: createListsPort(ctx, options.userState),
     async load(onProgress) {
-      const catalogP = retrying(() => apps2.getAppCatalogKind(api, { path: { app: "matrx", kind: "credential_definition" } }));
-      const authP = retrying(() => apps2.listAuthenticators(api));
-      const userP = retrying(() => account9.listItems(api, { query: { principal_type: "user" } }));
-      const sharedP = retrying(() => account9.sharedWithMe(api));
-      const quiet = (p) => void p.catch(() => void 0);
-      [catalogP, authP, userP, sharedP].forEach(quiet);
-      const orgItemsP = retrying(() => account9.organizationItems(api));
-      quiet(orgItemsP);
-      const raw = {
-        orgLists: [],
-        orgsKnown: options.organizations !== void 0,
-        meId: null
-      };
-      const unavailable = [];
-      let done = false;
-      const build = () => {
-        const catalog2 = raw.catalog ?? [];
-        defs = new Map(parseDefinitions(catalog2.filter((e) => e.is_active).map((e) => ({ key: e.key, payload: e.payload, sort_order: e.sort_order }))).map((d) => [d.key, d]));
-        const mineItems = raw.mine?.items ?? [];
-        const meId = raw.meId ?? mineItems.find((w) => w.user_id)?.user_id ?? null;
-        const seen = /* @__PURE__ */ new Map();
-        const deleted = /* @__PURE__ */ new Map();
-        const take = (w, owner) => {
-          if (seen.has(w.id) || deleted.has(w.id) || isHiddenItem(w)) return;
-          const item = itemOf(w, owner, defs, auth);
-          (isDeleted(w) ? deleted : seen).set(w.id, item);
+      const run = async (restarts) => {
+        const generation = ++loadGeneration;
+        const mutationAtStart = authMutation;
+        let localAuth = /* @__PURE__ */ new Map();
+        let localState = "pending";
+        let localUnavailable = [];
+        let localDefs = /* @__PURE__ */ new Map();
+        let localOrgs = [];
+        const localOwners = /* @__PURE__ */ new Map();
+        const catalogP = retrying(() => apps2.getAppCatalogKind(api, { path: { app: "matrx", kind: "credential_definition" } }));
+        const authP = retrying(() => apps2.listAuthenticators(api));
+        const userP = retrying(() => account9.listItems(api, { query: { principal_type: "user" } }));
+        const sharedP = retrying(() => account9.sharedWithMe(api));
+        const quiet = (p) => void p.catch(() => void 0);
+        [catalogP, authP, userP, sharedP].forEach(quiet);
+        const orgItemsP = retrying(() => account9.organizationItems(api));
+        quiet(orgItemsP);
+        const raw = {
+          orgLists: [],
+          orgsKnown: options.organizations !== void 0,
+          meId: null
         };
-        for (const w of mineItems) take(w, orgOf(w.organization_id, null, true));
-        raw.orgLists.forEach((l, i) => {
-          const via = orgs[i];
-          for (const w of l?.items ?? []) take(w, ownerInOrgList(w, via, meId));
-        });
-        for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? orgOf(w.organization_id, null, false) : { kind: "shared", label: "Shared with me", organizationId: null });
-        const pending = done ? [] : [...raw.orgsKnown ? orgs.filter((_, i) => raw.orgLists[i] === void 0).map((o) => o.name) : ["your organizations"], ...raw.shared ? [] : ["Shared with me"]];
-        return {
-          unavailable: [...unavailable],
-          ...pending.length > 0 ? { pending } : {},
-          items: [...seen.values()],
-          deleted: [...deleted.values()],
-          organizations: orgs,
-          definitions: [...defs.values()].sort((a, b) => a.sortOrder - b.sortOrder || a.label.localeCompare(b.label))
+        const unavailable = [];
+        let done = false;
+        const build = () => {
+          const catalog2 = raw.catalog ?? [];
+          localDefs = new Map(parseDefinitions(catalog2.filter((e) => e.is_active).map((e) => ({ key: e.key, payload: e.payload, sort_order: e.sort_order }))).map((d) => [d.key, d]));
+          const mineItems = raw.mine?.items ?? [];
+          const meId = raw.meId ?? mineItems.find((w) => w.user_id)?.user_id ?? null;
+          const seen = /* @__PURE__ */ new Map();
+          const deleted = /* @__PURE__ */ new Map();
+          const localOrgOf = (id, mine2) => id ? { kind: "organization", label: localOrgs.find((o) => o.id === id)?.name ?? "Organization", organizationId: id } : mine2 ? { kind: "me", label: "Personal", organizationId: null } : { kind: "shared", label: "Shared with me", organizationId: null };
+          const take = (w, owner, inventoryOwner = owner) => {
+            if (seen.has(w.id) || deleted.has(w.id) || isHiddenItem(w)) return;
+            localOwners.set(w.id, inventoryOwner);
+            const item = itemOf(w, owner, localDefs, localAuth, localState, localUnavailable, inventoryOwner);
+            (isDeleted(w) ? deleted : seen).set(w.id, item);
+          };
+          for (const w of mineItems) take(w, localOrgOf(w.organization_id, true));
+          raw.orgLists.forEach((l, i) => {
+            const via = localOrgs[i];
+            for (const w of l?.items ?? []) take(w, w.organization_id ? localOrgOf(w.organization_id, false) : w.user_id && meId && w.user_id === meId ? localOrgOf(null, true) : via ? { kind: "organization", label: via.name, organizationId: via.id, memberShared: { userId: w.user_id ?? null } } : localOrgOf(null, false));
+          });
+          for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? localOrgOf(w.organization_id, false) : { kind: "shared", label: "Shared with me", organizationId: null }, { kind: "shared", label: "Shared with me", organizationId: null });
+          const pending = done ? [] : [...raw.orgsKnown ? localOrgs.filter((_, i) => raw.orgLists[i] === void 0).map((o) => o.name) : ["your organizations"], ...raw.shared ? [] : ["Shared with me"]];
+          return {
+            unavailable: [...unavailable],
+            ...pending.length > 0 ? { pending } : {},
+            items: [...seen.values()],
+            deleted: [...deleted.values()],
+            organizations: localOrgs,
+            definitions: [...localDefs.values()].sort((a, b) => a.sortOrder - b.sortOrder || a.label.localeCompare(b.label))
+          };
         };
-      };
-      const progress = () => {
-        if (!done && onProgress && raw.catalog && raw.mine) onProgress(build());
-      };
-      const orgReportP = options.organizations ? null : retrying(() => platform.listMyOrganizations(api));
-      if (orgReportP) quiet(orgReportP);
-      const orgListsReady = (async () => {
-        const report = orgReportP ? await orgReportP : null;
-        raw.meId = report?.user_id ?? null;
-        orgs = [...new Map((options.organizations ?? (report?.organizations ?? []).filter((o) => !o.archived_at).map((o) => ({ id: o.id, name: o.name }))).map((o) => [o.id, o])).values()];
-        raw.orgLists = orgs.map(() => void 0);
-        raw.orgsKnown = true;
-        progress();
-        const one = await orgItemsP.then(
-          (r) => r,
-          (e) => {
-            if (e?.status === 404) {
-              hostProblem("GET /vault/organization-items answered 404; reading each organization vault separately", e);
-              return null;
+        const progress = () => {
+          if (!done && generation === loadGeneration && mutationAtStart === authMutation && onProgress && raw.catalog && raw.mine) onProgress(build());
+        };
+        const orgReportP = options.organizations ? null : retrying(() => platform.listMyOrganizations(api));
+        if (orgReportP) quiet(orgReportP);
+        const orgListsReady = (async () => {
+          const report = orgReportP ? await orgReportP : null;
+          raw.meId = report?.user_id ?? null;
+          localOrgs = [...new Map((options.organizations ?? (report?.organizations ?? []).filter((o) => !o.archived_at).map((o) => ({ id: o.id, name: o.name }))).map((o) => [o.id, o])).values()];
+          raw.orgLists = localOrgs.map(() => void 0);
+          raw.orgsKnown = true;
+          progress();
+          const one = await orgItemsP.then(
+            (r) => r,
+            (e) => {
+              if (e?.status === 404) {
+                hostProblem("GET /vault/organization-items answered 404; reading each organization vault separately", e);
+                return null;
+              }
+              return "failed";
             }
-            return "failed";
+          );
+          if (one) {
+            const byOrg = one === "failed" ? /* @__PURE__ */ new Map() : new Map(one.views.map((v) => [v.organization_id, v.items]));
+            const failed = one === "failed" ? new Set(localOrgs.map((o) => o.id)) : new Set(one.unavailable);
+            const settled = localOrgs.map((o, i) => {
+              const items = byOrg.get(o.id);
+              if (failed.has(o.id) || items === void 0) return Promise.reject(new Error(`${o.name} is unavailable`));
+              raw.orgLists[i] = { items, count: items.length };
+              return Promise.resolve(raw.orgLists[i]);
+            });
+            settled.forEach(quiet);
+            progress();
+            return settled;
           }
-        );
-        if (one) {
-          const byOrg = one === "failed" ? /* @__PURE__ */ new Map() : new Map(one.views.map((v) => [v.organization_id, v.items]));
-          const failed = one === "failed" ? new Set(orgs.map((o) => o.id)) : new Set(one.unavailable);
-          const settled = orgs.map((o, i) => {
-            const items = byOrg.get(o.id);
-            if (failed.has(o.id) || items === void 0) return Promise.reject(new Error(`${o.name} is unavailable`));
-            raw.orgLists[i] = { items, count: items.length };
-            return Promise.resolve(raw.orgLists[i]);
+          return localOrgs.map((o, i) => {
+            const p = retrying(() => account9.listItems(api, { query: { principal_type: "organization", organization_id: o.id } }, { organizationId: o.id }));
+            const arrived = p.then((l) => {
+              raw.orgLists[i] = l;
+              progress();
+              return l;
+            });
+            quiet(arrived);
+            return arrived;
           });
-          settled.forEach(quiet);
+        })();
+        quiet(orgListsReady);
+        const authDone = authP.then((a) => {
+          localUnavailable = a.unavailable_scopes ?? [];
+          const fresh = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
+          localAuth = fresh;
+          localState = "known";
+          if (localUnavailable.length) unavailable.push("One-time codes");
           progress();
-          return settled;
-        }
-        return orgs.map((o, i) => {
-          const p = retrying(() => account9.listItems(api, { query: { principal_type: "organization", organization_id: o.id } }, { organizationId: o.id }));
-          const arrived = p.then((l) => {
-            raw.orgLists[i] = l;
-            progress();
-            return l;
-          });
-          quiet(arrived);
-          return arrived;
+        }, () => {
+          localState = "unavailable";
+          unavailable.push("One-time codes");
         });
-      })();
-      quiet(orgListsReady);
-      const authDone = authP.then((a) => {
-        auth = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
-        progress();
-      }, () => {
-        unavailable.push("One-time codes");
-      });
-      const sharedDone = sharedP.then((sh) => {
-        raw.shared = sh;
+        const sharedDone = sharedP.then((sh) => {
+          raw.shared = sh;
+          progress();
+        }, () => {
+          raw.shared = { items: [], count: 0 };
+          unavailable.push("Shared with me");
+        });
+        const [catalog, mine] = await Promise.all([catalogP, userP]);
+        raw.catalog = catalog;
+        raw.mine = mine;
         progress();
-      }, () => {
-        raw.shared = { items: [], count: 0 };
-        unavailable.push("Shared with me");
-      });
-      const [catalog, mine] = await Promise.all([catalogP, userP]);
-      raw.catalog = catalog;
-      raw.mine = mine;
-      progress();
-      const orgPs = await orgListsReady;
-      const orgSettled = await Promise.allSettled(orgPs);
-      orgSettled.forEach((r, i) => {
-        if (r.status === "rejected") {
-          raw.orgLists[i] = { items: [], count: 0 };
-          unavailable.push(orgs[i]?.name ?? "An organization");
+        const orgPs = await orgListsReady;
+        const orgSettled = await Promise.allSettled(orgPs);
+        orgSettled.forEach((r, i) => {
+          if (r.status === "rejected") {
+            raw.orgLists[i] = { items: [], count: 0 };
+            unavailable.push(localOrgs[i]?.name ?? "An organization");
+          }
+        });
+        await Promise.all([authDone, sharedDone]);
+        done = true;
+        if (generation === loadGeneration && mutationAtStart !== authMutation) {
+          if (restarts >= 2) throw new Error("Authenticator changed while loading. Retry");
+          return run(restarts + 1);
         }
-      });
-      await Promise.all([authDone, sharedDone]);
-      done = true;
-      return build();
+        const snapshot = build();
+        if (generation === loadGeneration) {
+          defs = localDefs;
+          auth = localAuth;
+          authState = localState;
+          authUnavailable = localUnavailable;
+          inventoryOwners = localOwners;
+          orgs = localOrgs;
+        }
+        return snapshot;
+      };
+      return run(0);
     },
     async reveal(item, fieldKey2) {
       const field = item.fields.find((f) => f.key === fieldKey2);