@ai-matrx/vault 0.1.55 → 0.1.57

package/dist/index.js

@@ -432,7 +432,7 @@ function PasswordHealthView(props) {
 }
 
 // src/VaultApp.tsx
-import { useCallback as useCallback4, useEffect as useEffect23, useMemo as useMemo6, useRef as useRef19, useState as useState41, useSyncExternalStore as useSyncExternalStore5 } from "react";
+import { useCallback as useCallback4, useEffect as useEffect23, useMemo as useMemo6, useRef as useRef21, useState as useState41, useSyncExternalStore as useSyncExternalStore5 } from "react";
 import { DropdownMenu as DropdownMenu5, DropdownMenuContent as DropdownMenuContent5, DropdownMenuItem as DropdownMenuItem5, DropdownMenuTrigger as DropdownMenuTrigger5, LookScope } from "@ai-matrx/design-system";
 import { Button as Button34, SearchField as SearchField4, Select as Select12 } from "@ai-matrx/design-system/controls";
 import { confirm as confirm14 } from "@ai-matrx/kit/confirm-opener";
@@ -1440,7 +1440,7 @@ function ItemIcon({ definitionKey, family, site, size = "md", inverted = false }
 }
 
 // src/authenticator/AddOtpPanel.tsx
-import { useState as useState11 } from "react";
+import { useRef as useRef9, useState as useState11 } from "react";
 import { Button as Button8, Field as Field3, Select as Select2 } from "@ai-matrx/design-system/controls";
 
 // src/authenticator/CodeParts.tsx
@@ -1968,7 +1968,7 @@ function OtpSetupRow({ value, onChange, label = "Authenticator", placeholder = S
 }
 
 // src/authenticator/TotpRows.tsx
-import { useState as useState10 } from "react";
+import { useRef as useRef8, useState as useState10 } from "react";
 import { Button as Button7, Select } from "@ai-matrx/design-system/controls";
 import { DropdownMenu, DropdownMenuContent, DropdownMenuItem, DropdownMenuSeparator, DropdownMenuTrigger } from "@ai-matrx/design-system";
 import { confirm as confirm2 } from "@ai-matrx/kit/confirm-opener";
@@ -2085,10 +2085,22 @@ function TotpRow({ port, item, onChanged }) {
 function TotpEditRow({ value, onChange, hasExisting, item, port, onEnrolled, onRecognized }) {
   const confirmed = useConfirmed();
   const [status, setStatus] = useState10(null);
+  const [retryImage, setRetryImage] = useState10(null);
+  const latestItem = useRef8(item);
+  latestItem.current = item;
   const uploadImage = item && port ? async (file) => {
+    setRetryImage(file);
     setStatus("Adding from image\u2026");
     try {
-      const entry = await confirmed(() => port.authenticator.enrolQrImage(item, file, file.name));
+      const entry = await confirmed(async () => {
+        const current = await port.get(item);
+        const visible = latestItem.current;
+        if (!visible || visible.id !== item.id || visible.authenticatorState !== "known" || current.authenticatorState !== "known" || !item.authenticator && (visible.authenticator || current.authenticator)) {
+          throw new Error("Authenticator status unavailable. Retry after refreshing.");
+        }
+        return port.authenticator.enrolQrImage(current, file, file.name);
+      });
+      setRetryImage(null);
       setStatus(entry.issuer ? `Added \xB7 ${entry.issuer}` : "Added");
       onChange("");
       onEnrolled?.({ ...item, authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } });
@@ -2105,7 +2117,11 @@ function TotpEditRow({ value, onChange, hasExisting, item, port, onEnrolled, onR
         onChange(v);
       },
       placeholder: hasExisting ? "Paste a new key to replace" : SETUP_KEY_PLACEHOLDER,
-      status,
+      status: status && retryImage && uploadImage ? /* @__PURE__ */ jsxs8(Fragment6, { children: [
+        status,
+        " ",
+        /* @__PURE__ */ jsx9(Button7, { variant: "quiet", onClick: () => void uploadImage(retryImage), children: "Retry" })
+      ] }) : status,
       ...uploadImage ? { onImage: (f) => void uploadImage(f) } : {},
       ...onRecognized ? { onRecognized } : {}
     }
@@ -2166,7 +2182,9 @@ function normalizeWebsite(raw) {
 }
 function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChanged, onAdded, onDone }) {
   const confirmed = useConfirmed();
-  const candidates = items.filter((i) => !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
+  const itemsRef = useRef9(items);
+  itemsRef.current = items;
+  const candidates = items.filter((i) => i.authenticatorState === "known" && !i.authenticator && !i.deletion && (i.capabilities.canEdit || i.capabilities.canManage)).sort((a, b) => a.name.localeCompare(b.name, void 0, { sensitivity: "base" }));
   const [input, setInput] = useState11("");
   const [image, setImage] = useState11(null);
   const [target, setTarget] = useState11(itemId && candidates.some((c) => c.id === itemId) ? itemId : NEW);
@@ -2194,18 +2212,26 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
     setBusy(true);
     setError(null);
     try {
-      let item = isNew ? created : items.find((i) => i.id === target) ?? null;
+      let item = isNew ? created : itemsRef.current.find((i) => i.id === target) ?? null;
+      let freshlyCreated = false;
+      if (!isNew && (!item || item.authenticatorState !== "known" || item.authenticator)) throw new Error("Authenticator status unavailable. Retry after refreshing.");
       if (!item) {
         const def = LOGIN_KEYS.map((k) => definitions.find((d) => d.key === k)).find((d) => Boolean(d));
         if (!def) throw new Error("No login type is available.");
         const r = await port.create(def, null, { ...draftOf(null), name: name.trim(), loginUrls: websiteUrl ? [websiteUrl] : [] });
         item = r.item;
+        freshlyCreated = true;
         setCreated(item);
         onChanged();
       }
       const it = item;
-      const entry = await confirmed(() => image ? port.authenticator.enrolQrImage(it, image, image.name) : port.authenticator.enrol(it, input));
-      let next = { ...it, authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
+      const entry = await confirmed(async () => {
+        const latest = freshlyCreated ? it : await port.get(it);
+        const listed = itemsRef.current.find((i) => i.id === it.id);
+        if (!freshlyCreated && (latest.authenticatorState !== "known" || latest.authenticator || !isNew && !listed) || listed && (listed.authenticatorState !== "known" || listed.authenticator)) throw new Error("Authenticator status unavailable. Retry after refreshing.");
+        return image ? port.authenticator.enrolQrImage(latest, image, image.name) : port.authenticator.enrol(latest, input);
+      });
+      let next = { ...it, authenticatorState: "known", authenticator: { digits: entry.digits, period: entry.period, enabled: entry.enabled } };
       const better = authenticatorName(it.name, { issuer: entry.issuer, account: entry.account });
       if (!isNew && better !== it.name) {
         try {
@@ -2291,7 +2317,11 @@ function AddOtpPanel({ port, items, definitions, itemId = null, onClose, onChang
             /* @__PURE__ */ jsx10(VaultRow, { label: "Website", hint: websiteBad ? /* @__PURE__ */ jsx10("span", { className: "text-destructive", children: "Not a web address" }) : void 0, children: /* @__PURE__ */ jsx10(Field3, { className: "w-full", type: "url", value: website, disabled: busy || created !== null, onChange: (e) => setWebsite(e.target.value), placeholder: "example.com", "aria-label": "Website", "aria-invalid": websiteBad || void 0 }) })
           ] }) : null
         ] }),
-        error ? /* @__PURE__ */ jsx10("p", { className: "px-1 text-sm text-destructive", role: "alert", children: error }) : null
+        error ? /* @__PURE__ */ jsxs9("p", { className: "px-1 text-sm text-destructive", role: "alert", children: [
+          error,
+          " ",
+          /* @__PURE__ */ jsx10(Button8, { variant: "quiet", onClick: onChanged, children: "Retry" })
+        ] }) : null
       ]
     }
   );
@@ -2326,23 +2356,8 @@ function otpGroups(items, entries, query, hidden = /* @__PURE__ */ new Set()) {
   const rank = (k) => k === "me" ? 0 : k === "shared" ? 2 : 1;
   return [...groups.entries()].sort(([a, x], [b, y]) => rank(a) - rank(b) || x.label.localeCompare(y.label)).map(([key, g]) => ({ key, ...g }));
 }
-function withAdded(items, added) {
-  if (added.size === 0) return items;
-  const seen = /* @__PURE__ */ new Set();
-  const out = items.map((i) => {
-    seen.add(i.id);
-    const mine = added.get(i.id);
-    return mine && !i.authenticator ? { ...i, authenticator: mine.authenticator, name: mine.name } : i;
-  });
-  for (const [id, a] of added) if (!seen.has(id)) out.push(a);
-  return out;
-}
-function AuthenticatorView({ port, host, items: listed, definitions, query, onOpen, onChanged, header }) {
-  const [added, setAdded] = useState12(/* @__PURE__ */ new Map());
-  const items = withAdded(listed, added);
-  useEffect10(() => {
-    if (added.size > 0 && [...added.keys()].every((id) => listed.some((i) => i.id === id && i.authenticator))) setAdded(/* @__PURE__ */ new Map());
-  }, [listed, added]);
+function AuthenticatorView({ port, host, items, definitions, query, onOpen, onChanged, header }) {
+  const [incomplete, setIncomplete] = useState12(true);
   const [entries, setEntries] = useState12(/* @__PURE__ */ new Map());
   const [hidden, setHidden] = useState12(/* @__PURE__ */ new Set());
   const [adding, setAdding] = useState12(false);
@@ -2352,13 +2367,20 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
   useEffect10(() => {
     let live = true;
     port.authenticator.list().then(
-      (list) => live && setEntries(new Map(list.map((e) => [e.itemId, e]))),
-      (e) => console.error("One-time password accounts could not be read", e)
+      (list) => {
+        if (live) {
+          setEntries(new Map(list.entries.map((e) => [e.itemId, e])));
+          setIncomplete(list.unavailableScopes.length > 0);
+        }
+      },
+      () => {
+        if (live) setIncomplete(true);
+      }
     );
     return () => {
       live = false;
     };
-  }, [port, listed, added]);
+  }, [port, items]);
   const groups = otpGroups(items, entries, query, hidden);
   const total = items.filter((i) => i.authenticator && !i.deletion && !hidden.has(i.id)).length;
   const familyOf2 = (key) => definitions.find((d) => d.key === key)?.family ?? "generic";
@@ -2371,7 +2393,14 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
       ] }),
       total > 0 ? /* @__PURE__ */ jsx11(Button9, { variant: "outline", icon: /* @__PURE__ */ jsx11(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add" }) : null
     ] }),
-    total === 0 ? /* @__PURE__ */ jsxs10("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
+    total > 0 && (incomplete || items.some((i) => i.authenticatorState !== "known")) ? /* @__PURE__ */ jsxs10("div", { className: "px-4 text-sm text-muted-foreground", children: [
+      "Some codes unavailable ",
+      /* @__PURE__ */ jsx11(Button9, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : null,
+    total === 0 && (incomplete || items.some((i) => i.authenticatorState !== "known")) ? /* @__PURE__ */ jsxs10("div", { className: "px-4 py-10 text-center text-sm text-muted-foreground", children: [
+      "Codes unavailable ",
+      /* @__PURE__ */ jsx11(Button9, { variant: "quiet", onClick: onChanged, children: "Retry" })
+    ] }) : total === 0 ? /* @__PURE__ */ jsxs10("div", { className: "flex flex-1 flex-col items-center justify-center gap-3 px-6 pb-12 text-center", children: [
       /* @__PURE__ */ jsx11("span", { className: "flex size-12 items-center justify-center rounded-full bg-muted text-muted-foreground", children: /* @__PURE__ */ jsx11(ShieldGlyph, { className: "size-6" }) }),
       /* @__PURE__ */ jsx11("p", { className: "text-sm font-medium text-foreground", children: "No authenticator codes yet" }),
       /* @__PURE__ */ jsx11(Button9, { variant: "primary", icon: /* @__PURE__ */ jsx11(PlusGlyph, {}), onClick: () => setAdding(true), children: "Add authenticator" })
@@ -2404,7 +2433,6 @@ function AuthenticatorView({ port, host, items: listed, definitions, query, onOp
         definitions,
         onClose: () => setAdding(false),
         onChanged,
-        onAdded: (item) => setAdded((cur) => new Map(cur).set(item.id, item)),
         onDone: (id) => {
           setAdding(false);
           onOpen(id);
@@ -2522,7 +2550,7 @@ function OtpListRow({ port, item, family, entry, onOpen, onOpenInNewTab, onRenam
 }
 
 // src/fields/SettingsPanels.tsx
-import { useRef as useRef8, useState as useState13 } from "react";
+import { useRef as useRef10, useState as useState13 } from "react";
 import { Badge as Badge3, Button as Button10, DisclosureHeader, Field as Field4, SegmentedControl, Select as Select3, Switch } from "@ai-matrx/design-system/controls";
 import { confirm as confirm3 } from "@ai-matrx/kit/confirm-opener";
 import { GlobeIcon } from "@ai-matrx/design-system/icons";
@@ -2655,7 +2683,7 @@ function FieldSettings({ item, port, field, onClose, onChanged }) {
   const { busy, error, setError, save } = useSaver((next) => onChanged(next));
   const [envDraft, setEnvDraft] = useState13(field.envKey ?? "");
   const [descDraft, setDescDraft] = useState13(field.description);
-  const envRef = useRef8(null);
+  const envRef = useRef10(null);
   const canEdit = item.capabilities.canEdit;
   const envProblem = envKeyProblem(envDraft);
   const blocker = sandboxBlocker(envDraft, field.envKey);
@@ -2819,7 +2847,7 @@ function ItemSettingsPanel({ item, port, onClose, onChanged, onPanel }) {
 }
 
 // src/generator/PasswordGenerator.tsx
-import { createContext as createContext3, useContext as useContext3, useEffect as useEffect11, useRef as useRef9, useState as useState14 } from "react";
+import { createContext as createContext3, useContext as useContext3, useEffect as useEffect11, useRef as useRef11, useState as useState14 } from "react";
 import { Popover, PopoverContent, PopoverTrigger, cn as cn6 } from "@ai-matrx/design-system";
 import { Button as Button11, NumberStepper, SegmentedControl as SegmentedControl2, Select as Select4, Switch as Switch2 } from "@ai-matrx/design-system/controls";
 import { CopyIcon as CopyIcon6 } from "@ai-matrx/design-system/icons";
@@ -2897,7 +2925,7 @@ function PasswordGenerator({ limits: source, onUse, useLabel = "Use" }) {
   const [revealed, setRevealed] = useState14(false);
   const [note, setNote] = useState14(null);
   const copyValue2 = useCopy();
-  const expiry = useRef9(null);
+  const expiry = useRef11(null);
   const drop = () => {
     if (expiry.current) clearTimeout(expiry.current);
     expiry.current = null;
@@ -3123,11 +3151,11 @@ function organizationHints(orgs) {
 }
 
 // src/shown-until-move.ts
-import { useEffect as useEffect12, useRef as useRef10, useState as useState15 } from "react";
+import { useEffect as useEffect12, useRef as useRef12, useState as useState15 } from "react";
 var keyOf = (loc) => `${String(loc.vault)}|${loc.view}|${loc.itemId ?? ""}|${loc.mode}|${loc.panel ?? ""}|${loc.kind ?? ""}`;
 function useShownUntilMove(loc) {
   const [shown, setShown] = useState15(null);
-  const home = useRef10(null);
+  const home = useRef12(null);
   const key = keyOf(loc);
   useEffect12(() => {
     if (!shown) {
@@ -3185,7 +3213,7 @@ function useLocked(lock) {
 
 // src/io/BackupPanel.tsx
 import { formatFileSize } from "@ai-matrx/kit/format";
-import { useEffect as useEffect13, useRef as useRef11, useState as useState17 } from "react";
+import { useEffect as useEffect13, useRef as useRef13, useState as useState17 } from "react";
 import { Button as Button13, Field as Field5, SegmentedControl as SegmentedControl3, Switch as Switch3 } from "@ai-matrx/design-system/controls";
 import { downloadFile } from "@ai-matrx/kit/download";
 import { confirm as confirm4 } from "@ai-matrx/kit/confirm-opener";
@@ -3342,8 +3370,8 @@ function Omissions({ omissions, accepted, onAccepted, verb }) {
 function BackupPanel({ port, host, items, onClose, onChanged }) {
   const minLength = passphraseMinimum(host.backupPassphraseMinLength);
   const confirmed = useConfirmed();
-  const fileInput = useRef11(null);
-  const abort = useRef11(null);
+  const fileInput = useRef13(null);
+  const abort = useRef13(null);
   const [mode, setMode] = useState17("backup");
   const [busy, setBusy] = useState17(false);
   const [error, setError] = useState17(null);
@@ -3695,7 +3723,7 @@ function ExportPanel({ port, items, onClose }) {
 }
 
 // src/io/ImportPanel.tsx
-import { useEffect as useEffect14, useMemo as useMemo2, useRef as useRef12, useState as useState19 } from "react";
+import { useEffect as useEffect14, useMemo as useMemo2, useRef as useRef14, useState as useState19 } from "react";
 import { Button as Button15, Select as Select6, Switch as Switch4, Textarea as Textarea2 } from "@ai-matrx/design-system/controls";
 
 // src/io/csv-import.ts
@@ -4558,10 +4586,10 @@ var ME = "me";
 function ImportPanel({ port, host, items, definitions, organizations, onClose, onChanged, limits }) {
   const confirmed = useConfirmed();
   const [otpFor, setOtpFor] = useState19(null);
-  const fileInput = useRef12(null);
-  const abort = useRef12(null);
-  const stop = useRef12(false);
-  const keys = useRef12(/* @__PURE__ */ new Map());
+  const fileInput = useRef14(null);
+  const abort = useRef14(null);
+  const stop = useRef14(false);
+  const keys = useRef14(/* @__PURE__ */ new Map());
   const [source, setSource] = useState19("auto");
   const [envText, setEnvText] = useState19("");
   const [injectSandbox, setInjectSandbox] = useState19(false);
@@ -4862,14 +4890,14 @@ function Notices({ draft }) {
 }
 
 // src/ItemList.tsx
-import { useEffect as useEffect17, useRef as useRef15, useState as useState28 } from "react";
+import { useEffect as useEffect17, useRef as useRef17, useState as useState28 } from "react";
 import { DropdownMenu as DropdownMenu4, DropdownMenuContent as DropdownMenuContent4, DropdownMenuItem as DropdownMenuItem4, DropdownMenuRadioGroup, DropdownMenuRadioItem, DropdownMenuSeparator as DropdownMenuSeparator4, DropdownMenuTrigger as DropdownMenuTrigger4 } from "@ai-matrx/design-system";
 import { cn as cn11 } from "@ai-matrx/design-system";
 import { Button as Button23, SearchField, Tile as Tile3 } from "@ai-matrx/design-system/controls";
 import { CopyIcon as CopyIcon8 } from "@ai-matrx/design-system/icons";
 
 // src/ItemPane.tsx
-import { Fragment as Fragment17, useEffect as useEffect16, useMemo as useMemo3, useRef as useRef14, useState as useState27 } from "react";
+import { Fragment as Fragment17, useEffect as useEffect16, useMemo as useMemo3, useRef as useRef16, useState as useState27 } from "react";
 import { DropdownMenu as DropdownMenu3, DropdownMenuContent as DropdownMenuContent3, DropdownMenuItem as DropdownMenuItem3, DropdownMenuSeparator as DropdownMenuSeparator3, DropdownMenuTrigger as DropdownMenuTrigger3 } from "@ai-matrx/design-system";
 import { cn as cn10 } from "@ai-matrx/design-system";
 import { Badge as Badge7, Button as Button22, CONTROLS_CONTAINER_CLASS, OptionCombobox, Switch as Switch6 } from "@ai-matrx/design-system/controls";
@@ -4877,7 +4905,7 @@ import { confirm as confirm10 } from "@ai-matrx/kit/confirm-opener";
 
 // src/activity/FilesSection.tsx
 import { formatFileSize as formatFileSize2 } from "@ai-matrx/kit/format";
-import { useRef as useRef13, useState as useState20 } from "react";
+import { useRef as useRef15, useState as useState20 } from "react";
 import { Badge as Badge5, Button as Button16, Field as Field6, SegmentedControl as SegmentedControl4 } from "@ai-matrx/design-system/controls";
 import { cn as cn7 } from "@ai-matrx/design-system";
 import { confirm as confirm6 } from "@ai-matrx/kit/confirm-opener";
@@ -4899,7 +4927,7 @@ function FilesSection({ item, port, editing, onChanged }) {
   const [error, setError] = useState20(null);
   const [pending, setPending] = useState20(null);
   const [dragging, setDragging] = useState20(false);
-  const picker = useRef13(null);
+  const picker = useRef15(null);
   if (!canAdd && item.attachments.length === 0) return null;
   async function run(key, work, fallback) {
     setBusy(key);
@@ -4977,7 +5005,7 @@ function FilesSection({ item, port, editing, onChanged }) {
 }
 function EditableFile({ port, item: it, file: a, busy: b, run: go, onDownload, onTooBig }) {
   const [open, setOpen] = useState20(false);
-  const replacer = useRef13(null);
+  const replacer = useRef15(null);
   async function remove() {
     const yes = await confirm6({ title: `Delete ${a.label}?`, description: "The encrypted file is removed from this item.", confirmLabel: "Delete", variant: "destructive" });
     if (yes) await go(`delete:${a.id}`, () => port.activity.deleteFile(it, a.id), "The file could not be deleted.");
@@ -5089,7 +5117,7 @@ function DraftFilesSection({ files, onFiles }) {
   const [pending, setPending] = useState20(null);
   const [error, setError] = useState20(null);
   const [dragging, setDragging] = useState20(false);
-  const picker = useRef13(null);
+  const picker = useRef15(null);
   const choose = (file) => {
     if (!file) return;
     if (fileTooBig(file.size)) return setError(TOO_BIG);
@@ -6012,6 +6040,10 @@ function confirmDelete(item) {
 function ItemPane(props) {
   const { port, item, definition, mode, host, organizations, defaultOwner, seed, onBack, onMode, onSaved, onDeleted, onDirty, onCancelNew, onPanel, onChanged, favorite, notice, refreshKey } = props;
   const confirmed = useConfirmed();
+  const latestItem = useRef16(item);
+  latestItem.current = item;
+  const [createdForRetry, setCreatedForRetry] = useState27(null);
+  const enrolledForRetry = useRef16(null);
   const notify = useNotify();
   const editing = mode !== "view";
   const seedName = seed?.name ?? "";
@@ -6044,8 +6076,8 @@ function ItemPane(props) {
   const [savedNew, setSavedNew] = useState27(false);
   const dirty = editing && !savedNew && isDirty(base, draft);
   const declared = definition?.fields ?? [];
-  const prev = useRef14(null);
-  const paneRef = useRef14(null);
+  const prev = useRef16(null);
+  const paneRef = useRef16(null);
   const room = useRoomOf(paneRef);
   useEffect16(() => {
     const was = prev.current;
@@ -6067,7 +6099,7 @@ function ItemPane(props) {
     setShowRecovery(false);
     setSavedNew(false);
   }, [item?.id, mode]);
-  const onDirtyRef = useRef14(onDirty);
+  const onDirtyRef = useRef16(onDirty);
   onDirtyRef.current = onDirty;
   useEffect16(() => onDirtyRef.current(dirty), [dirty]);
   const keepKey = draftKey(item?.id ?? null, definition?.key ?? item?.definitionKey ?? null);
@@ -6097,23 +6129,39 @@ function ItemPane(props) {
     setError(null);
     const out = { ...draft, values: Object.fromEntries(changedValues(base, draft)) };
     if (out.values[RECOVERY_CODES_KEY] !== void 0) out.values[RECOVERY_CODES_KEY] = parseRecoveryCodes(out.values[RECOVERY_CODES_KEY]).join("\n");
-    const withOtp = async (saved, notice2) => {
+    const withOtp = async (saved, notice2, freshlyCreated = false) => {
       const setup = out.authenticator.trim();
       if (!setup) return [saved, notice2, false];
       try {
-        await confirmed(() => port.authenticator.enrol(saved, setup));
+        if (enrolledForRetry.current?.itemId !== saved.id || enrolledForRetry.current.setup !== setup) await confirmed(async () => {
+          const current = freshlyCreated ? saved : await port.get(saved);
+          const visible = latestItem.current?.id === saved.id ? latestItem.current : null;
+          const ownEnrollment = enrolledForRetry.current?.itemId === saved.id;
+          if (!freshlyCreated && (current.authenticatorState !== "known" || !item?.authenticator && current.authenticator && !ownEnrollment || item && !visible) || visible && (visible.authenticatorState !== "known" || !item?.authenticator && visible.authenticator && !ownEnrollment)) throw new Error("Authenticator status unavailable. Retry after refreshing");
+          await port.authenticator.enrol(current, setup);
+          enrolledForRetry.current = { itemId: saved.id, setup };
+        });
         return [await port.get(saved), notice2, true];
       } catch (e) {
+        if (enrolledForRetry.current?.itemId === saved.id && enrolledForRetry.current.setup === setup) return [saved, `Saved and authenticator set up, but refresh failed: ${e instanceof Error ? e.message : "Retry"}.`, false];
         const why = wasCancelled(e) ? "it was not confirmed" : e instanceof Error ? e.message : "it was refused";
         return [saved, `Saved, but the authenticator was not set up: ${why}. Add it with Edit.`, false];
       }
     };
     try {
-      if (item) {
-        const r = await port.save(item, definition, out);
+      if (item || createdForRetry) {
+        const r = await port.save(item ?? createdForRetry, definition, out);
         const [next, n, enrolled] = await withOtp(r.item, r.notice);
-        dropKeptDraft(keepKey);
-        onSaved(next, false, n, enrolled);
+        if (out.authenticator.trim() && !enrolled) {
+          setError(n);
+          onChanged();
+          return;
+        }
+        if (createdForRetry) await finishNew(next, n, enrolled);
+        else {
+          dropKeptDraft(keepKey);
+          onSaved(next, false, n, enrolled);
+        }
       } else if (definition && owner === "person") {
         const secretKey = declared.find((f) => f.storage === "encrypted" && f.kind === "secret")?.key ?? null;
         const r = await port.sharing.assign({ recipientEmail: recipient.trim(), definition, draft: out, generateFieldKey: generatePrivately ? secretKey : null });
@@ -6123,12 +6171,14 @@ function ItemPane(props) {
         setSent(r);
       } else if (definition) {
         const r = await port.create(definition, owner === "me" ? null : owner, out);
-        const [withCode, n0, enrolled] = await withOtp(r.item, r.notice);
-        const [next, n] = await storeQueuedFiles(withCode, n0);
-        dropKeptDraft(keepKey);
-        setSavedNew(true);
-        onDirty(false);
-        onSaved(next, true, n, enrolled);
+        setCreatedForRetry(r.item);
+        const [withCode, n0, enrolled] = await withOtp(r.item, r.notice, true);
+        if (out.authenticator.trim() && !enrolled) {
+          setError(n0);
+          onChanged();
+          return;
+        }
+        await finishNew(withCode, n0, enrolled);
       }
     } catch (e) {
       setError(e instanceof Error ? e.message : "Saving failed. Nothing was changed.");
@@ -6136,6 +6186,13 @@ function ItemPane(props) {
       setBusy(false);
     }
   }
+  async function finishNew(saved, notice2, enrolled) {
+    const [next, finalNotice] = await storeQueuedFiles(saved, notice2);
+    dropKeptDraft(keepKey);
+    setSavedNew(true);
+    onDirty(false);
+    onSaved(next, true, finalNotice, enrolled);
+  }
   async function storeQueuedFiles(saved, notice2) {
     let next = saved;
     const failed = [];
@@ -6317,7 +6374,11 @@ function ItemPane(props) {
   const filesProps = item ? { item, port, host, definition, organizations, arg: null, onClose: () => void 0, onChanged, onPanel } : null;
   return /* @__PURE__ */ jsx25(RoomProvider, { value: room, children: /* @__PURE__ */ jsxs23("article", { ref: paneRef, "aria-label": item?.name ?? "New item", className: cn10(CONTROLS_CONTAINER_CLASS, "flex h-full min-h-0 flex-col bg-background"), children: [
     header,
-    error ? /* @__PURE__ */ jsx25("div", { role: "alert", className: "border-b border-border bg-muted px-5 py-2 text-sm text-destructive", children: error }) : null,
+    error ? /* @__PURE__ */ jsxs23("div", { role: "alert", className: "border-b border-border bg-muted px-5 py-2 text-sm text-destructive", children: [
+      error,
+      " ",
+      error.includes("Retry after refreshing") ? /* @__PURE__ */ jsx25(Button22, { variant: "quiet", onClick: () => onChanged(), children: "Retry" }) : null
+    ] }) : null,
     notice && !editing ? /* @__PURE__ */ jsx25("div", { role: "status", className: "border-b border-border bg-muted px-5 py-2 text-sm text-warning", children: notice }) : null,
     item && !editing && (itemOff || offFields.length > 0) ? /* @__PURE__ */ jsxs23("div", { role: "status", className: "flex items-center gap-3 border-b border-border bg-muted px-5 py-2 text-sm", children: [
       /* @__PURE__ */ jsx25("span", { className: "min-w-0 flex-1 truncate text-warning", children: offFields.length === 0 ? "This item is turned off" : offFields.length === 1 ? "1 field is turned off" : `${offFields.length} fields are turned off` }),
@@ -6421,7 +6482,11 @@ function ItemPane(props) {
           i
         )),
         /* @__PURE__ */ jsx25(AddRow, { label: draft.loginUrls.length === 0 ? "Website" : "", onAdd: () => patch({ loginUrls: [...draft.loginUrls, ""] }), children: draft.loginUrls.length === 0 ? "Add website" : "Add another website" }),
-        /* @__PURE__ */ jsx25(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }),
+        /* @__PURE__ */ jsx25("div", { hidden: Boolean(item && item.authenticatorState !== "known"), children: /* @__PURE__ */ jsx25(TotpEditRow, { value: draft.authenticator, onChange: (v) => patch({ authenticator: v }), hasExisting: Boolean(item?.authenticator || seedField), item, port, onEnrolled: onChanged }) }),
+        item && item.authenticatorState !== "known" ? /* @__PURE__ */ jsxs23(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ jsx25("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ jsx25(Button22, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }) : null,
         item && isLogin && !item.authenticator ? /* @__PURE__ */ jsx25(TwoFactorMethodRow, { port, item, onChanged }) : null,
         !item && isLogin && draft.authenticator.trim() === "" ? /* @__PURE__ */ jsx25(DraftTwoFactorRow, { custom: draft.custom, onCustom: (custom) => patch({ custom }) }) : null,
         recoveryEditing ? /* @__PURE__ */ jsx25(
@@ -6500,7 +6565,10 @@ function ItemPane(props) {
         }),
         extraFields.map((f) => isRecoveryCodesField(f) ? /* @__PURE__ */ jsx25(RecoveryCodesRow, { item, field: f, port, onChanged }, f.id) : /* @__PURE__ */ jsx25(SecretRow, { port, item, field: f, onTurnOn: turnOnOne(f), extra: fieldSettings(f) }, f.id)),
         item.loginUrls.length > 0 ? item.loginUrls.map((u, i) => /* @__PURE__ */ jsx25(PlainRow, { label: i === 0 ? "Website" : `Website ${i + 1}`, value: u, openUrl: host.openUrl }, `${u}-${i}`)) : /* @__PURE__ */ jsx25(AddRow, { label: "Website", onAdd: canEdit ? () => onMode("edit") : null, children: "Add website" }),
-        item.authenticator ? /* @__PURE__ */ jsx25(TotpRow, { port, item, onChanged }) : seedField && !seedField.active ? (
+        item.authenticator ? /* @__PURE__ */ jsx25(TotpRow, { port, item, onChanged }) : item.authenticatorState !== "known" ? /* @__PURE__ */ jsxs23(VaultRow, { label: "Authenticator", children: [
+          /* @__PURE__ */ jsx25("span", { className: "text-muted-foreground", children: item.authenticatorState === "pending" ? "Loading" : "Unavailable" }),
+          item.authenticatorState === "unavailable" ? /* @__PURE__ */ jsx25(Button22, { variant: "quiet", onClick: () => onChanged?.(), children: "Retry" }) : null
+        ] }) : seedField && !seedField.active ? (
           // The secret is still there, only off: turning it on brings the codes back. Never "Set up",
           // which would invite replacing a working two-factor secret.
           /* @__PURE__ */ jsx25(VaultRow, { label: "Authenticator", actions: canTurnOn ? /* @__PURE__ */ jsx25(TurnOnButton, { label: "Authenticator", onTurnOn: () => turnOn([seedField]) }) : null, children: /* @__PURE__ */ jsx25("span", { className: "text-muted-foreground", children: "Turned off" }) })
@@ -6577,7 +6645,7 @@ function ItemList({ title, items, definitions, port, selectedId, onSelect, query
   const pinned = matchingIds ? items.filter((i) => matchingIds.has(i.id)) : [];
   const rest = matchingIds ? items.filter((i) => !matchingIds.has(i.id)) : items;
   const ordered = [...pinned, ...rest];
-  const listRef = useRef15(null);
+  const listRef = useRef17(null);
   useEffect17(() => {
     if (selectedId) listRef.current?.querySelector(`[data-item="${selectedId}"]`)?.scrollIntoView({ block: "nearest" });
   }, [selectedId, items.length]);
@@ -6681,7 +6749,7 @@ function ListRow({ item, family, port, on, onSelect, withOwner, ownContextMenu,
     ...manageEntries(item, onAction),
     ...hostEntries.map((h) => ({ ...h, kind: h.kind ?? "host" }))
   ];
-  const entriesRef = useRef15(entries);
+  const entriesRef = useRef17(entries);
   entriesRef.current = entries;
   const glyphOf = (e) => e.id === "copy:username" ? /* @__PURE__ */ jsx26(UserGlyph, { className: "size-4" }) : e.id === "copy:password" ? /* @__PURE__ */ jsx26(KeyGlyph, { className: "size-4" }) : e.id === "copy:code" ? /* @__PURE__ */ jsx26(ClockGlyph, { className: "size-4" }) : e.kind === "favorite" ? /* @__PURE__ */ jsx26(StarGlyph, { className: cn11("size-4", favorite?.on && "fill-current text-warning") }) : e.kind === "open" ? /* @__PURE__ */ jsx26(ChevronRightGlyph, { className: "size-4" }) : e.kind === "host" || e.kind === "manage" ? null : /* @__PURE__ */ jsx26(CopyIcon8, { className: "size-4" });
   const menuItem = (e) => /* @__PURE__ */ jsxs24(DropdownMenuItem4, { disabled: e.disabled ?? false, onSelect: e.onSelect, children: [
@@ -7088,7 +7156,7 @@ function NewItemFlow({ definitions, url, onUrl, onChoose, onCancel }) {
 }
 
 // src/sharing/SecureLinkPanel.tsx
-import { useEffect as useEffect19, useRef as useRef16, useState as useState32 } from "react";
+import { useEffect as useEffect19, useRef as useRef18, useState as useState32 } from "react";
 import { confirm as confirm11 } from "@ai-matrx/kit/confirm-opener";
 import { Checkbox as Checkbox3 } from "@ai-matrx/design-system";
 import { Badge as Badge8, Button as Button27, Field as Field11, RegionSkeleton as RegionSkeleton2, SegmentedControl as SegmentedControl6, Textarea as Textarea4 } from "@ai-matrx/design-system/controls";
@@ -7213,7 +7281,7 @@ function SecureLinkPanel({ item, port, onClose }) {
     };
   }, [sharing, item, nonce]);
   const [phoneTyped, setPhoneTyped] = useState32(false);
-  const prefilled = useRef16(false);
+  const prefilled = useRef18(false);
   useEffect19(() => {
     const lookup = sharing.phoneOnFile;
     if (!lookup || phoneTyped) return;
@@ -7690,19 +7758,19 @@ async function loadFullPreview(bridge, operationId, current) {
 }
 
 // src/native/use-native-import.ts
-import { useEffect as useEffect21, useRef as useRef17, useState as useState34 } from "react";
+import { useEffect as useEffect21, useRef as useRef19, useState as useState34 } from "react";
 var fail = (e, fallback) => e instanceof Error && e.message ? e.message : fallback;
 var RESTART = "Your account changed. The import was stopped; start it again.";
 function useNativeImport(bridge, stillAllowed, onImported) {
   const [screen, setScreen] = useState34({ kind: "idle", message: null });
   const [busy, setBusy] = useState34(false);
-  const generation = useRef17(0);
-  const mounted = useRef17(false);
-  const op = useRef17(null);
-  const last = useRef17(null);
-  const timer2 = useRef17(null);
-  const polls = useRef17(0);
-  const refreshRef = useRef17(async () => void 0);
+  const generation = useRef19(0);
+  const mounted = useRef19(false);
+  const op = useRef19(null);
+  const last = useRef19(null);
+  const timer2 = useRef19(null);
+  const polls = useRef19(0);
+  const refreshRef = useRef19(async () => void 0);
   const current = (g) => mounted.current && g === generation.current;
   const stopPolling = () => {
     if (timer2.current !== null) clearTimeout(timer2.current);
@@ -7871,7 +7939,7 @@ function useNativeImport(bridge, stillAllowed, onImported) {
     setBusy(false);
     setScreen({ kind: "idle", message: null });
   };
-  const invalidateRef = useRef17(invalidate);
+  const invalidateRef = useRef19(invalidate);
   invalidateRef.current = invalidate;
   useEffect21(() => {
     mounted.current = true;
@@ -8043,13 +8111,13 @@ function CaptureCard({ capture, onChanged }) {
 }
 
 // src/extension/FillSetupCard.tsx
-import { useRef as useRef18, useState as useState37, useSyncExternalStore as useSyncExternalStore4 } from "react";
+import { useRef as useRef20, useState as useState37, useSyncExternalStore as useSyncExternalStore4 } from "react";
 import { Button as Button31, Field as Field12 } from "@ai-matrx/design-system/controls";
 import { jsx as jsx34, jsxs as jsxs32 } from "react/jsx-runtime";
 function FillSetupCard({ fillSetup }) {
   const notify = useNotify();
   const state = useSyncExternalStore4(fillSetup.subscribe, fillSetup.get, fillSetup.get);
-  const box = useRef18(null);
+  const box = useRef20(null);
   const [busy, setBusy] = useState37(false);
   const [error, setError] = useState37(null);
   if (state.status !== "off") return null;
@@ -8589,7 +8657,7 @@ function LockedScreen({ lock }) {
   ] });
 }
 function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocationChange, onInventory }) {
-  const rootRef = useRef19(null);
+  const rootRef = useRef21(null);
   const width = useElementWidth(rootRef);
   const mode = layout !== "auto" ? layout : width >= FULL_AT ? "full" : width >= SPLIT_AT ? "split" : "stack";
   const notify = useNotify();
@@ -8601,7 +8669,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const [error, setError] = useState41(null);
   const [inner, setInner] = useState41(DEFAULT_LOCATION);
   const loc = location ?? inner;
-  const dirty = useRef19(false);
+  const dirty = useRef21(false);
   const [notice, setNotice] = useState41(null);
   const [firstCode, setFirstCode] = useShownUntilMove(loc);
   const move = useCallback4(
@@ -8630,7 +8698,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     },
     [loc, move]
   );
-  const keyState = useRef19({ loc, go });
+  const keyState = useRef21({ loc, go });
   keyState.current = { loc, go };
   useEffect23(() => {
     const onKey = (e) => {
@@ -8654,7 +8722,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     document.addEventListener("keydown", onKey);
     return () => document.removeEventListener("keydown", onKey);
   }, []);
-  const keepSearchFocus = useRef19(false);
+  const keepSearchFocus = useRef21(false);
   useEffect23(() => {
     if (!keepSearchFocus.current) return;
     keepSearchFocus.current = false;
@@ -8664,13 +8732,14 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     search.setSelectionRange(search.value.length, search.value.length);
   }, [loc.q]);
   const hasPrompts = useHostPrompts(host.capture, host.fillSetup);
-  const knobsRef = useRef19(host.knobs);
+  const knobsRef = useRef21(host.knobs);
   knobsRef.current = host.knobs;
   const [signedOut, setSignedOut] = useState41(false);
   const [refreshError, setRefreshError] = useState41(null);
   const [refreshing, setRefreshing] = useState41(false);
-  const loadedAt = useRef19(0);
-  const inFlight = useRef19(false);
+  const loadedAt = useRef21(0);
+  const inFlight = useRef21(false);
+  const loadGeneration = useRef21(0);
   const apply = useCallback4(
     (s) => {
       loadedAt.current = Date.now();
@@ -8687,11 +8756,15 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
   const refresh = useCallback4(() => {
     if (inFlight.current) return;
     inFlight.current = true;
+    const generation = ++loadGeneration.current;
     setRefreshing(true);
     port.load().then((s) => {
+      if (generation !== loadGeneration.current) return;
       setRefreshError(null);
       apply(s);
-    }).catch((e) => setRefreshError(plainLoadError(e instanceof Error && e.message ? e.message : "The vault could not be read."))).finally(() => {
+    }).catch((e) => {
+      if (generation === loadGeneration.current) setRefreshError(plainLoadError(e instanceof Error && e.message ? e.message : "The vault could not be read."));
+    }).finally(() => {
       inFlight.current = false;
       setRefreshing(false);
     });
@@ -8699,18 +8772,20 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     port.lists.recents?.list().then(setRecents, () => void 0);
   }, [port, apply]);
   const load = useCallback4(() => {
+    const generation = ++loadGeneration.current;
     setError(null);
     setRefreshError(null);
     let finished = false;
     port.load((partial) => {
-      if (finished) return;
+      if (finished || generation !== loadGeneration.current) return;
       setSnap(partial);
       setItems(partial.items);
       setDeleted(partial.deleted);
     }).then((s) => {
       finished = true;
-      apply(s);
+      if (generation === loadGeneration.current) apply(s);
     }).catch((e) => {
+      if (generation !== loadGeneration.current) return;
       setSignedOut(e?.status === 401);
       setError(e instanceof Error ? e.message : "The vault could not be loaded.");
     });
@@ -8719,7 +8794,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
     port.lists.recents?.list().then(setRecents, () => void 0);
   }, [port, apply]);
   useEffect23(load, [load]);
-  const quietRef = useRef19({ loc, ready: false });
+  const quietRef = useRef21({ loc, ready: false });
   quietRef.current = { loc, ready: snap !== null && !error };
   const [knobSeconds, setKnobSeconds] = useState41(null);
   useEffect23(() => {
@@ -8755,7 +8830,7 @@ function Workspace({ port, host = NO_HOST, layout = "auto", location, onLocation
       if (timer2) clearInterval(timer2);
     };
   }, [refresh, everySeconds]);
-  const inventoryRef = useRef19(onInventory);
+  const inventoryRef = useRef21(onInventory);
   inventoryRef.current = onInventory;
   useEffect23(() => {
     if (snap) inventoryRef.current?.({ items, definitions: snap.definitions });
@@ -9329,7 +9404,7 @@ function createAuthenticatorPort(ctx) {
   return {
     async list() {
       const r = await apps.listAuthenticators(api);
-      return (r.entries ?? []).map(entryOf);
+      return { entries: (r.entries ?? []).map(entryOf), unavailableScopes: (r.unavailable_scopes ?? []).map((s) => ({ type: s.type, organizationId: s.organization_id ?? null })) };
     },
     async get(item) {
       try {
@@ -9543,6 +9618,7 @@ function trashItem(r, ctx) {
     fields: [],
     custom: [],
     authenticator: null,
+    authenticatorState: "known",
     capabilities: { canUse: false, canEdit: false, canReveal: false, canManage: true },
     attachments: [],
     uriMatchMode: "host",
@@ -9899,7 +9975,8 @@ function fieldOf(w, def) {
     active: w.is_active ?? true
   };
 }
-function itemOf(w, owner, defs, auth) {
+var scopeUnavailable = (owner, scopes) => scopes.some((s) => s.type === (owner.kind === "me" ? "user" : owner.kind === "organization" ? "organization" : "shared") && (s.type !== "organization" || !s.organization_id || s.organization_id === owner.organizationId));
+function itemOf(w, owner, defs, auth, state = "known", unavailable = [], inventoryOwner = owner) {
   const def = defs.get(w.definition_key ?? "");
   const a = auth.get(w.id);
   const cap = w.capabilities ?? {};
@@ -9917,6 +9994,7 @@ function itemOf(w, owner, defs, auth) {
     fields: (w.fields ?? []).filter((f) => f.execution_purpose !== "passkey_private").map((f) => fieldOf(f, def)),
     custom: (w.non_secret_fields ?? []).map((c) => ({ key: c["key"] ?? "", label: c["label"] ?? humanize(c["key"] ?? ""), value: c["value"] ?? "" })),
     authenticator: a ? { digits: a.digits, period: a.period, enabled: a.enabled } : null,
+    authenticatorState: a ? "known" : state === "pending" ? "pending" : state === "unavailable" || scopeUnavailable(inventoryOwner, unavailable) || (w.fields ?? []).some((f) => f.field_key === OTP_SEED_KEY && f.is_active !== false) ? "unavailable" : "known",
     capabilities: { canUse: cap.can_use ?? false, canEdit: cap.can_edit ?? false, canReveal: cap.can_reveal ?? false, canManage: cap.can_manage ?? false },
     attachments: (w.attachments ?? []).map((a2) => ({ id: a2.id, label: a2.label, description: a2.description ?? "", fileName: a2.file_name, mediaType: a2.media_type ?? "application/octet-stream", sizeBytes: a2.size_bytes, handling: handlingOf(a2.handling), createdAt: a2.created_at, updatedAt: a2.updated_at })),
     uriMatchMode: MATCH_MODES2.find((m) => m === w.uri_match_mode) ?? "host",
@@ -9953,20 +10031,19 @@ function createApiVaultPort(hostApi, options = {}) {
   };
   let defs = /* @__PURE__ */ new Map();
   let auth = /* @__PURE__ */ new Map();
+  let authState = "pending";
+  let authUnavailable = [];
+  let inventoryOwners = /* @__PURE__ */ new Map();
   let orgs = [];
+  let loadGeneration = 0;
+  let authMutation = 0;
   const orgOf = (id, userId, mine) => {
     if (id) return { kind: "organization", label: orgs.find((o) => o.id === id)?.name ?? "Organization", organizationId: id };
     return mine || userId ? { kind: "me", label: "Personal", organizationId: null } : { kind: "shared", label: "Shared with me", organizationId: null };
   };
-  const ownerInOrgList = (w, via, meId) => {
-    if (w.organization_id) return orgOf(w.organization_id, null, false);
-    if (w.user_id && meId && w.user_id === meId) return { kind: "me", label: "Personal", organizationId: null };
-    if (via) return { kind: "organization", label: via.name, organizationId: via.id, memberShared: { userId: w.user_id ?? null } };
-    return { kind: "shared", label: "Shared with me", organizationId: null };
-  };
   async function refetch(id, owner) {
     const w = await account9.getItem(api, { path: { item_id: id } });
-    return itemOf(w, owner, defs, auth);
+    return itemOf(w, owner, defs, auth, authState, authUnavailable, inventoryOwners.get(id) ?? owner);
   }
   const visibleCache = /* @__PURE__ */ new Map();
   const ctx = {
@@ -9976,6 +10053,7 @@ function createApiVaultPort(hostApi, options = {}) {
     definition: (key) => defs.get(key),
     organizations: () => orgs,
     setAuthenticator: (itemId, entry) => {
+      authMutation++;
       const next = new Map(auth);
       if (entry) next.set(itemId, entry);
       else next.delete(itemId);
@@ -9993,124 +10071,155 @@ function createApiVaultPort(hostApi, options = {}) {
     fields: createFieldsPort(ctx),
     lists: createListsPort(ctx, options.userState),
     async load(onProgress) {
-      const catalogP = retrying(() => apps2.getAppCatalogKind(api, { path: { app: "matrx", kind: "credential_definition" } }));
-      const authP = retrying(() => apps2.listAuthenticators(api));
-      const userP = retrying(() => account9.listItems(api, { query: { principal_type: "user" } }));
-      const sharedP = retrying(() => account9.sharedWithMe(api));
-      const quiet = (p) => void p.catch(() => void 0);
-      [catalogP, authP, userP, sharedP].forEach(quiet);
-      const orgItemsP = retrying(() => account9.organizationItems(api));
-      quiet(orgItemsP);
-      const raw = {
-        orgLists: [],
-        orgsKnown: options.organizations !== void 0,
-        meId: null
-      };
-      const unavailable = [];
-      let done = false;
-      const build = () => {
-        const catalog2 = raw.catalog ?? [];
-        defs = new Map(parseDefinitions(catalog2.filter((e) => e.is_active).map((e) => ({ key: e.key, payload: e.payload, sort_order: e.sort_order }))).map((d) => [d.key, d]));
-        const mineItems = raw.mine?.items ?? [];
-        const meId = raw.meId ?? mineItems.find((w) => w.user_id)?.user_id ?? null;
-        const seen = /* @__PURE__ */ new Map();
-        const deleted = /* @__PURE__ */ new Map();
-        const take = (w, owner) => {
-          if (seen.has(w.id) || deleted.has(w.id) || isHiddenItem(w)) return;
-          const item = itemOf(w, owner, defs, auth);
-          (isDeleted(w) ? deleted : seen).set(w.id, item);
+      const run = async (restarts) => {
+        const generation = ++loadGeneration;
+        const mutationAtStart = authMutation;
+        let localAuth = /* @__PURE__ */ new Map();
+        let localState = "pending";
+        let localUnavailable = [];
+        let localDefs = /* @__PURE__ */ new Map();
+        let localOrgs = [];
+        const localOwners = /* @__PURE__ */ new Map();
+        const catalogP = retrying(() => apps2.getAppCatalogKind(api, { path: { app: "matrx", kind: "credential_definition" } }));
+        const authP = retrying(() => apps2.listAuthenticators(api));
+        const userP = retrying(() => account9.listItems(api, { query: { principal_type: "user" } }));
+        const sharedP = retrying(() => account9.sharedWithMe(api));
+        const quiet = (p) => void p.catch(() => void 0);
+        [catalogP, authP, userP, sharedP].forEach(quiet);
+        const orgItemsP = retrying(() => account9.organizationItems(api));
+        quiet(orgItemsP);
+        const raw = {
+          orgLists: [],
+          orgsKnown: options.organizations !== void 0,
+          meId: null
         };
-        for (const w of mineItems) take(w, orgOf(w.organization_id, null, true));
-        raw.orgLists.forEach((l, i) => {
-          const via = orgs[i];
-          for (const w of l?.items ?? []) take(w, ownerInOrgList(w, via, meId));
-        });
-        for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? orgOf(w.organization_id, null, false) : { kind: "shared", label: "Shared with me", organizationId: null });
-        const pending = done ? [] : [...raw.orgsKnown ? orgs.filter((_, i) => raw.orgLists[i] === void 0).map((o) => o.name) : ["your organizations"], ...raw.shared ? [] : ["Shared with me"]];
-        return {
-          unavailable: [...unavailable],
-          ...pending.length > 0 ? { pending } : {},
-          items: [...seen.values()],
-          deleted: [...deleted.values()],
-          organizations: orgs,
-          definitions: [...defs.values()].sort((a, b) => a.sortOrder - b.sortOrder || a.label.localeCompare(b.label))
+        const unavailable = [];
+        let done = false;
+        const build = () => {
+          const catalog2 = raw.catalog ?? [];
+          localDefs = new Map(parseDefinitions(catalog2.filter((e) => e.is_active).map((e) => ({ key: e.key, payload: e.payload, sort_order: e.sort_order }))).map((d) => [d.key, d]));
+          const mineItems = raw.mine?.items ?? [];
+          const meId = raw.meId ?? mineItems.find((w) => w.user_id)?.user_id ?? null;
+          const seen = /* @__PURE__ */ new Map();
+          const deleted = /* @__PURE__ */ new Map();
+          const localOrgOf = (id, mine2) => id ? { kind: "organization", label: localOrgs.find((o) => o.id === id)?.name ?? "Organization", organizationId: id } : mine2 ? { kind: "me", label: "Personal", organizationId: null } : { kind: "shared", label: "Shared with me", organizationId: null };
+          const take = (w, owner, inventoryOwner = owner) => {
+            if (seen.has(w.id) || deleted.has(w.id) || isHiddenItem(w)) return;
+            localOwners.set(w.id, inventoryOwner);
+            const item = itemOf(w, owner, localDefs, localAuth, localState, localUnavailable, inventoryOwner);
+            (isDeleted(w) ? deleted : seen).set(w.id, item);
+          };
+          for (const w of mineItems) take(w, localOrgOf(w.organization_id, true));
+          raw.orgLists.forEach((l, i) => {
+            const via = localOrgs[i];
+            for (const w of l?.items ?? []) take(w, w.organization_id ? localOrgOf(w.organization_id, false) : w.user_id && meId && w.user_id === meId ? localOrgOf(null, true) : via ? { kind: "organization", label: via.name, organizationId: via.id, memberShared: { userId: w.user_id ?? null } } : localOrgOf(null, false));
+          });
+          for (const w of raw.shared?.items ?? []) take(w, w.organization_id ? localOrgOf(w.organization_id, false) : { kind: "shared", label: "Shared with me", organizationId: null }, { kind: "shared", label: "Shared with me", organizationId: null });
+          const pending = done ? [] : [...raw.orgsKnown ? localOrgs.filter((_, i) => raw.orgLists[i] === void 0).map((o) => o.name) : ["your organizations"], ...raw.shared ? [] : ["Shared with me"]];
+          return {
+            unavailable: [...unavailable],
+            ...pending.length > 0 ? { pending } : {},
+            items: [...seen.values()],
+            deleted: [...deleted.values()],
+            organizations: localOrgs,
+            definitions: [...localDefs.values()].sort((a, b) => a.sortOrder - b.sortOrder || a.label.localeCompare(b.label))
+          };
         };
-      };
-      const progress = () => {
-        if (!done && onProgress && raw.catalog && raw.mine) onProgress(build());
-      };
-      const orgReportP = options.organizations ? null : retrying(() => platform.listMyOrganizations(api));
-      if (orgReportP) quiet(orgReportP);
-      const orgListsReady = (async () => {
-        const report = orgReportP ? await orgReportP : null;
-        raw.meId = report?.user_id ?? null;
-        orgs = [...new Map((options.organizations ?? (report?.organizations ?? []).filter((o) => !o.archived_at).map((o) => ({ id: o.id, name: o.name }))).map((o) => [o.id, o])).values()];
-        raw.orgLists = orgs.map(() => void 0);
-        raw.orgsKnown = true;
-        progress();
-        const one = await orgItemsP.then(
-          (r) => r,
-          (e) => {
-            if (e?.status === 404) {
-              hostProblem("GET /vault/organization-items answered 404; reading each organization vault separately", e);
-              return null;
+        const progress = () => {
+          if (!done && generation === loadGeneration && mutationAtStart === authMutation && onProgress && raw.catalog && raw.mine) onProgress(build());
+        };
+        const orgReportP = options.organizations ? null : retrying(() => platform.listMyOrganizations(api));
+        if (orgReportP) quiet(orgReportP);
+        const orgListsReady = (async () => {
+          const report = orgReportP ? await orgReportP : null;
+          raw.meId = report?.user_id ?? null;
+          localOrgs = [...new Map((options.organizations ?? (report?.organizations ?? []).filter((o) => !o.archived_at).map((o) => ({ id: o.id, name: o.name }))).map((o) => [o.id, o])).values()];
+          raw.orgLists = localOrgs.map(() => void 0);
+          raw.orgsKnown = true;
+          progress();
+          const one = await orgItemsP.then(
+            (r) => r,
+            (e) => {
+              if (e?.status === 404) {
+                hostProblem("GET /vault/organization-items answered 404; reading each organization vault separately", e);
+                return null;
+              }
+              return "failed";
             }
-            return "failed";
+          );
+          if (one) {
+            const byOrg = one === "failed" ? /* @__PURE__ */ new Map() : new Map(one.views.map((v) => [v.organization_id, v.items]));
+            const failed = one === "failed" ? new Set(localOrgs.map((o) => o.id)) : new Set(one.unavailable);
+            const settled = localOrgs.map((o, i) => {
+              const items = byOrg.get(o.id);
+              if (failed.has(o.id) || items === void 0) return Promise.reject(new Error(`${o.name} is unavailable`));
+              raw.orgLists[i] = { items, count: items.length };
+              return Promise.resolve(raw.orgLists[i]);
+            });
+            settled.forEach(quiet);
+            progress();
+            return settled;
           }
-        );
-        if (one) {
-          const byOrg = one === "failed" ? /* @__PURE__ */ new Map() : new Map(one.views.map((v) => [v.organization_id, v.items]));
-          const failed = one === "failed" ? new Set(orgs.map((o) => o.id)) : new Set(one.unavailable);
-          const settled = orgs.map((o, i) => {
-            const items = byOrg.get(o.id);
-            if (failed.has(o.id) || items === void 0) return Promise.reject(new Error(`${o.name} is unavailable`));
-            raw.orgLists[i] = { items, count: items.length };
-            return Promise.resolve(raw.orgLists[i]);
+          return localOrgs.map((o, i) => {
+            const p = retrying(() => account9.listItems(api, { query: { principal_type: "organization", organization_id: o.id } }, { organizationId: o.id }));
+            const arrived = p.then((l) => {
+              raw.orgLists[i] = l;
+              progress();
+              return l;
+            });
+            quiet(arrived);
+            return arrived;
           });
-          settled.forEach(quiet);
+        })();
+        quiet(orgListsReady);
+        const authDone = authP.then((a) => {
+          localUnavailable = a.unavailable_scopes ?? [];
+          const fresh = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
+          localAuth = fresh;
+          localState = "known";
+          if (localUnavailable.length) unavailable.push("One-time codes");
           progress();
-          return settled;
-        }
-        return orgs.map((o, i) => {
-          const p = retrying(() => account9.listItems(api, { query: { principal_type: "organization", organization_id: o.id } }, { organizationId: o.id }));
-          const arrived = p.then((l) => {
-            raw.orgLists[i] = l;
-            progress();
-            return l;
-          });
-          quiet(arrived);
-          return arrived;
+        }, () => {
+          localState = "unavailable";
+          unavailable.push("One-time codes");
         });
-      })();
-      quiet(orgListsReady);
-      const authDone = authP.then((a) => {
-        auth = new Map((a.entries ?? []).map((e) => [e.credential_item_id, e]));
-        progress();
-      }, () => {
-        unavailable.push("One-time codes");
-      });
-      const sharedDone = sharedP.then((sh) => {
-        raw.shared = sh;
+        const sharedDone = sharedP.then((sh) => {
+          raw.shared = sh;
+          progress();
+        }, () => {
+          raw.shared = { items: [], count: 0 };
+          unavailable.push("Shared with me");
+        });
+        const [catalog, mine] = await Promise.all([catalogP, userP]);
+        raw.catalog = catalog;
+        raw.mine = mine;
         progress();
-      }, () => {
-        raw.shared = { items: [], count: 0 };
-        unavailable.push("Shared with me");
-      });
-      const [catalog, mine] = await Promise.all([catalogP, userP]);
-      raw.catalog = catalog;
-      raw.mine = mine;
-      progress();
-      const orgPs = await orgListsReady;
-      const orgSettled = await Promise.allSettled(orgPs);
-      orgSettled.forEach((r, i) => {
-        if (r.status === "rejected") {
-          raw.orgLists[i] = { items: [], count: 0 };
-          unavailable.push(orgs[i]?.name ?? "An organization");
+        const orgPs = await orgListsReady;
+        const orgSettled = await Promise.allSettled(orgPs);
+        orgSettled.forEach((r, i) => {
+          if (r.status === "rejected") {
+            raw.orgLists[i] = { items: [], count: 0 };
+            unavailable.push(localOrgs[i]?.name ?? "An organization");
+          }
+        });
+        await Promise.all([authDone, sharedDone]);
+        done = true;
+        if (generation === loadGeneration && mutationAtStart !== authMutation) {
+          if (restarts >= 2) throw new Error("Authenticator changed while loading. Retry");
+          return run(restarts + 1);
         }
-      });
-      await Promise.all([authDone, sharedDone]);
-      done = true;
-      return build();
+        const snapshot = build();
+        if (generation === loadGeneration) {
+          defs = localDefs;
+          auth = localAuth;
+          authState = localState;
+          authUnavailable = localUnavailable;
+          inventoryOwners = localOwners;
+          orgs = localOrgs;
+        }
+        return snapshot;
+      };
+      return run(0);
     },
     async reveal(item, fieldKey2) {
       const field = item.fields.find((f) => f.key === fieldKey2);