autho 2.0.0 → 3.0.0

package/dist/autho.js

@@ -1,15 +1,20 @@
 #!/usr/bin/env bun
 // @bun
-
-// apps/cli/src/index.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import { createInterface } from "readline/promises";
-import { resolve as resolve3 } from "path";
-
-// packages/core/src/daemon.ts
-import { createHash, timingSafeEqual } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 
 // packages/storage/src/index.ts
 import { Database } from "bun:sqlite";
@@ -144,6 +149,31 @@ class AuthoDatabase {
          LIMIT 1`).get(ref);
     return row ?? null;
   }
+  updateSecret(id, updates) {
+    const parts = [];
+    const values = [];
+    let idx = 1;
+    if (updates.name !== undefined) {
+      parts.push(`name = ?${idx}`);
+      values.push(updates.name);
+      idx++;
+    }
+    if (updates.type !== undefined) {
+      parts.push(`type = ?${idx}`);
+      values.push(updates.type);
+      idx++;
+    }
+    if (updates.payload !== undefined) {
+      parts.push(`payload = ?${idx}`);
+      values.push(updates.payload);
+      idx++;
+    }
+    parts.push(`updated_at = ?${idx}`);
+    values.push(updates.updatedAt);
+    idx++;
+    values.push(id);
+    this.db.query(`UPDATE secrets SET ${parts.join(", ")} WHERE id = ?${idx}`).run(...values);
+  }
   deleteSecret(id) {
     this.db.query("DELETE FROM secrets WHERE id = ?1").run(id);
   }
@@ -185,6 +215,7 @@ class AuthoDatabase {
          LIMIT ?1`).all(limit);
   }
 }
+var init_src = () => {};
 
 // packages/crypto/src/index.ts
 import {
@@ -193,14 +224,6 @@ import {
   randomBytes,
   scryptSync
 } from "crypto";
-var DEFAULT_KDF = {
-  keyLength: 32,
-  name: "scrypt",
-  salt: "",
-  N: 1 << 17,
-  p: 1,
-  r: 8
-};
 function toBuffer(value) {
   return Buffer.isBuffer(value) ? value : Buffer.from(value, "utf8");
 }
@@ -257,24 +280,17 @@ function unlockRootKey(password, config) {
   const key = deriveKeyFromPassword(password, config.kdf);
   return decryptWithKey(config.wrappedRootKey, key, "autho:vault-root");
 }
-
-// packages/core/src/index.ts
-import { spawnSync } from "child_process";
-import { createHmac, randomBytes as randomBytes3 } from "crypto";
-import {
-  existsSync as existsSync2,
-  readFileSync as readFileSync2
-} from "fs";
-import { basename as basename2 } from "path";
-
-// packages/core/src/artifacts.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import {
-  readdirSync,
-  readFileSync,
-  statSync
-} from "fs";
-import { basename, join as join2, relative, resolve as resolve2, sep } from "path";
+var DEFAULT_KDF;
+var init_src2 = __esm(() => {
+  DEFAULT_KDF = {
+    keyLength: 32,
+    name: "scrypt",
+    salt: "",
+    N: 1 << 17,
+    p: 1,
+    r: 8
+  };
+});
 
 // packages/core/src/paths.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, writeFileSync } from "fs";
@@ -323,8 +339,16 @@ function writeBinaryFileSecure(path, content) {
   writeFileSync(path, content, { mode: 384 });
   hardenFilePermissions(path);
 }
+var init_paths = () => {};
 
 // packages/core/src/artifacts.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import {
+  readdirSync,
+  readFileSync,
+  statSync
+} from "fs";
+import { basename, join as join2, relative, resolve as resolve2, sep } from "path";
 function normalizeRelativePath(input) {
   return input.replace(/\\/g, "/");
 }
@@ -434,8 +458,19 @@ function assertPathIsFile(path) {
     throw new Error(`Expected file: ${path}`);
   }
 }
+var init_artifacts = __esm(() => {
+  init_src2();
+  init_paths();
+});
 
 // packages/core/src/index.ts
+import { spawnSync } from "child_process";
+import { createHmac, randomBytes as randomBytes3 } from "crypto";
+import {
+  existsSync as existsSync2,
+  readFileSync as readFileSync2
+} from "fs";
+import { basename as basename2 } from "path";
 function requireValue(value, label) {
   if (!value) {
     throw new Error(`Missing required option: ${label}`);
@@ -808,6 +843,44 @@ class VaultSession {
       updatedAt: now
     };
   }
+  updateSecret(ref, updates) {
+    const existing = this.getSecretOrThrow(ref);
+    if (updates.name && updates.name !== existing.name) {
+      const conflict = this.db.findSecret(updates.name);
+      if (conflict && conflict.id !== existing.id) {
+        throw new Error(`Secret already exists: ${updates.name}`);
+      }
+    }
+    const newName = updates.name ?? existing.name;
+    const newType = updates.type ? normalizeSecretType(updates.type) : existing.type;
+    const newValue = updates.value ?? existing.value;
+    const newUsername = updates.username !== undefined ? updates.username || null : existing.username;
+    const newMetadata = updates.metadata ? normalizeMetadata({ ...existing.metadata, ...updates.metadata }) : existing.metadata;
+    const now = new Date().toISOString();
+    const wrappedKeyBlob = JSON.parse(this.db.findSecret(existing.id).wrappedKey);
+    const dek = decryptWithKey(wrappedKeyBlob, this.rootKey, `autho:secret:${existing.id}:dek`);
+    const payload = encryptWithKey(JSON.stringify({
+      metadata: newMetadata,
+      username: newUsername,
+      value: newValue
+    }), dek, `autho:secret:${existing.id}:payload`);
+    this.db.updateSecret(existing.id, {
+      name: newName,
+      payload: JSON.stringify(payload),
+      type: newType,
+      updatedAt: now
+    });
+    this.audit("secret.updated", "secret", existing.id, "Secret updated", {
+      fields: Object.keys(updates).filter((k) => updates[k] !== undefined)
+    });
+    return {
+      createdAt: existing.createdAt,
+      id: existing.id,
+      name: newName,
+      type: newType,
+      updatedAt: now
+    };
+  }
   importLegacyFile(filePath, options) {
     const raw = JSON.parse(readFileSync2(filePath, "utf8"));
     let imported = 0;
@@ -1045,8 +1118,1393 @@ class VaultSession {
     return this.db.listAudit(limit).map(toAuditEvent);
   }
 }
+var init_src3 = __esm(() => {
+  init_src2();
+  init_artifacts();
+  init_src();
+  init_paths();
+  init_paths();
+});
+
+// apps/cli/src/tui.tsx
+var exports_tui = {};
+__export(exports_tui, {
+  runTui: () => runTui
+});
+import { createCliRenderer } from "@opentui/core";
+import { createRoot, useKeyboard, useRenderer, useTerminalDimensions } from "@opentui/react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { jsxDEV } from "@opentui/react/jsx-dev-runtime";
+function typeLabel(type) {
+  switch (type) {
+    case "password":
+      return "Login";
+    case "note":
+      return "Secure Note";
+    case "otp":
+      return "OTP Secret";
+    default:
+      return type;
+  }
+}
+function Header({ title, subtitle }) {
+  return /* @__PURE__ */ jsxDEV("box", {
+    width: "100%",
+    paddingLeft: 2,
+    paddingTop: 1,
+    paddingBottom: 1,
+    borderBottom: true,
+    borderColor: "#333333",
+    children: [
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: "#FFD700",
+        children: /* @__PURE__ */ jsxDEV("strong", {
+          children: title
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      subtitle ? /* @__PURE__ */ jsxDEV("text", {
+        fg: "#555555",
+        children: [
+          " ",
+          subtitle
+        ]
+      }, undefined, true, undefined, this) : null
+    ]
+  }, undefined, true, undefined, this);
+}
+function StatusBar({ message }) {
+  return /* @__PURE__ */ jsxDEV("box", {
+    width: "100%",
+    height: 1,
+    backgroundColor: "#1a1a1a",
+    paddingLeft: 1,
+    paddingRight: 1,
+    children: /* @__PURE__ */ jsxDEV("text", {
+      fg: "#666666",
+      children: message
+    }, undefined, false, undefined, this)
+  }, undefined, false, undefined, this);
+}
+function ToastBar({ toast }) {
+  if (!toast)
+    return null;
+  const color = toast.type === "success" ? "#00CC66" : "#FF4444";
+  const icon = toast.type === "success" ? "+" : "!";
+  return /* @__PURE__ */ jsxDEV("box", {
+    width: "100%",
+    height: 1,
+    backgroundColor: color,
+    paddingLeft: 1,
+    children: /* @__PURE__ */ jsxDEV("text", {
+      fg: "#000000",
+      children: /* @__PURE__ */ jsxDEV("strong", {
+        children: [
+          " ",
+          icon,
+          " ",
+          toast.message
+        ]
+      }, undefined, true, undefined, this)
+    }, undefined, false, undefined, this)
+  }, undefined, false, undefined, this);
+}
+function KeyValue({ label, value, labelColor = "#888888", valueColor = "#FFFFFF" }) {
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "row",
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: labelColor,
+        width: 14,
+        children: label
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: valueColor,
+        children: value
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function useToast() {
+  const [toast, setToast] = useState(null);
+  const timerRef = useRef(null);
+  const show = useCallback((message, type = "success") => {
+    if (timerRef.current)
+      clearTimeout(timerRef.current);
+    setToast({ message, type });
+    timerRef.current = setTimeout(() => setToast(null), 3000);
+  }, []);
+  useEffect(() => () => {
+    if (timerRef.current)
+      clearTimeout(timerRef.current);
+  }, []);
+  return { toast, show };
+}
+function PasswordScreen({ onUnlock, vaultPath }) {
+  const [password, setPassword] = useState("");
+  const [error, setError] = useState("");
+  const [unlocking, setUnlocking] = useState(false);
+  useKeyboard((key) => {
+    if (key.eventType !== "press" && key.eventType !== "repeat")
+      return;
+    if (unlocking)
+      return;
+    if (key.name === "enter" || key.name === "return") {
+      if (!password)
+        return;
+      setUnlocking(true);
+      setError("");
+      try {
+        const session = VaultService.unlock(vaultPath, password);
+        onUnlock(session);
+      } catch {
+        setError("Wrong password");
+        setPassword("");
+        setUnlocking(false);
+      }
+      return;
+    }
+    if (key.name === "backspace") {
+      setPassword((p) => p.slice(0, -1));
+      return;
+    }
+    if (key.ctrl || key.meta || key.name === "escape" || key.name === "tab" || key.name === "up" || key.name === "down" || key.name === "left" || key.name === "right" || key.name === "home" || key.name === "end" || key.name === "delete" || key.name === "insert" || key.name === "pageup" || key.name === "pagedown" || key.name.startsWith("f") && /^f\d+$/.test(key.name))
+      return;
+    const char = key.sequence;
+    if (char && char.length === 1 && char.charCodeAt(0) >= 32)
+      setPassword((p) => p + char);
+  });
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    alignItems: "center",
+    justifyContent: "center",
+    width: "100%",
+    height: "100%",
+    children: /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      border: true,
+      borderStyle: "rounded",
+      padding: 2,
+      width: 52,
+      gap: 1,
+      children: [
+        /* @__PURE__ */ jsxDEV("ascii-font", {
+          text: "autho",
+          font: "tiny",
+          color: "#FFD700"
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("text", {
+          fg: "#888888",
+          children: "Unlock your vault"
+        }, undefined, false, undefined, this),
+        error ? /* @__PURE__ */ jsxDEV("box", {
+          backgroundColor: "#331111",
+          paddingX: 1,
+          width: "100%",
+          children: /* @__PURE__ */ jsxDEV("text", {
+            fg: "#FF4444",
+            children: error
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this) : null,
+        /* @__PURE__ */ jsxDEV("box", {
+          flexDirection: "row",
+          gap: 1,
+          marginTop: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#AAAAAA",
+              children: "Password "
+            }, undefined, false, undefined, this),
+            /* @__PURE__ */ jsxDEV("box", {
+              backgroundColor: "#111111",
+              flexGrow: 1,
+              paddingX: 1,
+              height: 1,
+              children: /* @__PURE__ */ jsxDEV("text", {
+                fg: "#FFD700",
+                children: password ? "*".repeat(password.length) : ""
+              }, undefined, false, undefined, this)
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        unlocking ? /* @__PURE__ */ jsxDEV("text", {
+          fg: "#FFD700",
+          children: "Unlocking..."
+        }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV("text", {
+          fg: "#444444",
+          children: "Enter to unlock | Ctrl+C to exit"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this)
+  }, undefined, false, undefined, this);
+}
+function buildDescription(s, availableWidth) {
+  const label = typeLabel(s.type);
+  let desc = label;
+  if (s.username) {
+    const withUser = `${label} \xB7 ${s.username}`;
+    if (withUser.length <= availableWidth) {
+      desc = withUser;
+    } else {
+      return desc;
+    }
+  }
+  const url = s.metadata?.url ? String(s.metadata.url) : "";
+  if (url) {
+    const shortUrl = url.replace(/^https?:\/\//, "");
+    const withUrl = `${desc} \xB7 ${shortUrl}`;
+    if (withUrl.length <= availableWidth) {
+      desc = withUrl;
+    } else {
+      return desc;
+    }
+  }
+  const note = s.metadata?.description ? String(s.metadata.description) : "";
+  if (note) {
+    const withNote = `${desc} \xB7 ${note}`;
+    if (withNote.length <= availableWidth) {
+      desc = withNote;
+    } else {
+      const budget = availableWidth - desc.length - 5;
+      if (budget > 5) {
+        desc = `${desc} \u2014 ${note.slice(0, budget)}\u2026`;
+      }
+    }
+  }
+  return desc;
+}
+function HomeScreen({ session, onSelect, onCreate, toast }) {
+  const renderer = useRenderer();
+  const { width: termWidth } = useTerminalDimensions();
+  const [secrets, setSecrets] = useState([]);
+  const [query, setQuery] = useState("");
+  const [searchFocused, setSearchFocused] = useState(false);
+  const reload = useCallback(() => {
+    try {
+      const summaries = session.listSecrets();
+      const enriched = summaries.map((s) => {
+        try {
+          return session.getSecret(s.id);
+        } catch {
+          return s;
+        }
+      });
+      setSecrets(enriched);
+    } catch {
+      setSecrets([]);
+    }
+  }, [session]);
+  useEffect(reload, [reload]);
+  const filtered = useMemo(() => {
+    if (!query)
+      return secrets;
+    const q = query.toLowerCase();
+    return secrets.filter((s) => s.name.toLowerCase().includes(q) || s.type.toLowerCase().includes(q) || s.username && s.username.toLowerCase().includes(q) || s.metadata?.url && String(s.metadata.url).toLowerCase().includes(q) || s.metadata?.description && String(s.metadata.description).toLowerCase().includes(q));
+  }, [secrets, query]);
+  const descWidth = Math.max(20, termWidth - 30);
+  const options = useMemo(() => filtered.map((s) => ({
+    name: s.name,
+    description: buildDescription(s, descWidth),
+    value: s.id
+  })), [filtered, descWidth]);
+  useKeyboard((key) => {
+    if (key.eventType !== "press")
+      return;
+    if (key.name === "q" && !searchFocused) {
+      session.close();
+      renderer.destroy();
+      return;
+    }
+    if (key.name === "n" && !searchFocused) {
+      onCreate();
+      return;
+    }
+    if (key.name === "/" && !searchFocused) {
+      setSearchFocused(true);
+      return;
+    }
+    if (key.name === "escape" && searchFocused) {
+      setSearchFocused(false);
+      setQuery("");
+      return;
+    }
+    if (key.name === "escape" && !searchFocused) {
+      session.close();
+      renderer.destroy();
+      return;
+    }
+    if (key.name === "tab") {
+      setSearchFocused((f) => !f);
+      return;
+    }
+  });
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    width: "100%",
+    height: "100%",
+    children: [
+      /* @__PURE__ */ jsxDEV(Header, {
+        title: "Autho",
+        subtitle: `${secrets.length} secrets`
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        flexDirection: "row",
+        paddingX: 2,
+        paddingTop: 1,
+        gap: 2,
+        alignItems: "center",
+        children: [
+          /* @__PURE__ */ jsxDEV("input", {
+            value: query,
+            onChange: setQuery,
+            placeholder: "/ search...",
+            focused: searchFocused,
+            flexGrow: 1,
+            backgroundColor: "#111111",
+            focusedBackgroundColor: "#1a1a1a",
+            textColor: "#FFFFFF",
+            placeholderColor: "#444444"
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV("text", {
+            fg: "#555555",
+            children: "[n] new"
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        flexGrow: 1,
+        paddingX: 2,
+        paddingTop: 1,
+        children: filtered.length === 0 ? /* @__PURE__ */ jsxDEV("box", {
+          padding: 1,
+          children: /* @__PURE__ */ jsxDEV("text", {
+            fg: "#555555",
+            children: secrets.length === 0 ? "No secrets yet. Press [n] to create one." : "No matches."
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV("select", {
+          options,
+          onSelect: (index) => onSelect(filtered[index]),
+          focused: !searchFocused,
+          height: Math.min(filtered.length * 2 + 1, 18),
+          selectedBackgroundColor: "#222222",
+          selectedTextColor: "#FFD700"
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV(ToastBar, {
+        toast
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV(StatusBar, {
+        message: "\u2191\u2193 navigate  Enter open  / search  n new  q quit"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function DetailScreen({ session, secret, onBack, onDeleted, onEdit }) {
+  const renderer = useRenderer();
+  const [revealing, setRevealing] = useState(false);
+  const [copied, setCopied] = useState("");
+  const [confirmDelete, setConfirmDelete] = useState(false);
+  const [otpResult, setOtpResult] = useState(null);
+  const [otpCountdown, setOtpCountdown] = useState(0);
+  const [error, setError] = useState("");
+  const hideTimerRef = useRef(null);
+  const countdownRef = useRef(null);
+  let detail;
+  try {
+    detail = session.getSecret(secret.name ?? secret.id);
+  } catch {
+    detail = secret;
+  }
+  const isOtp = detail.type === "otp";
+  useEffect(() => () => {
+    if (hideTimerRef.current)
+      clearTimeout(hideTimerRef.current);
+    if (countdownRef.current)
+      clearInterval(countdownRef.current);
+  }, []);
+  useEffect(() => {
+    if (!otpResult) {
+      if (countdownRef.current)
+        clearInterval(countdownRef.current);
+      return;
+    }
+    const update = () => {
+      const remaining = Math.max(0, Math.ceil((new Date(otpResult.expiresAt).getTime() - Date.now()) / 1000));
+      setOtpCountdown(remaining);
+      if (remaining <= 0 && countdownRef.current) {
+        clearInterval(countdownRef.current);
+      }
+    };
+    update();
+    countdownRef.current = setInterval(update, 1000);
+    return () => {
+      if (countdownRef.current)
+        clearInterval(countdownRef.current);
+    };
+  }, [otpResult]);
+  useKeyboard((key) => {
+    if (key.name === "s" && !confirmDelete && (key.eventType === "press" || key.eventType === "repeat")) {
+      setRevealing(true);
+      if (hideTimerRef.current)
+        clearTimeout(hideTimerRef.current);
+      hideTimerRef.current = setTimeout(() => setRevealing(false), 600);
+      return;
+    }
+    if (key.eventType !== "press")
+      return;
+    if (key.name === "escape") {
+      if (confirmDelete) {
+        setConfirmDelete(false);
+        return;
+      }
+      if (otpResult) {
+        setOtpResult(null);
+        return;
+      }
+      onBack();
+      return;
+    }
+    if (key.name === "c" && !confirmDelete) {
+      const toCopy = otpResult ? otpResult.code : detail.value ?? "";
+      if (toCopy) {
+        renderer.copyToClipboardOSC52(toCopy);
+        setCopied(otpResult ? "OTP code" : "Value");
+        setTimeout(() => setCopied(""), 2000);
+      }
+      return;
+    }
+    if (key.name === "e" && !confirmDelete && !otpResult) {
+      onEdit();
+      return;
+    }
+    if (key.name === "d" && !confirmDelete && !otpResult) {
+      setConfirmDelete(true);
+      return;
+    }
+    if (key.name === "o" && isOtp && !confirmDelete) {
+      try {
+        const result = session.generateOtp(detail.name);
+        setOtpResult(result);
+        setError("");
+      } catch (e) {
+        setError(e instanceof Error ? e.message : String(e));
+      }
+      return;
+    }
+    if (key.name === "r" && otpResult) {
+      try {
+        const result = session.generateOtp(detail.name);
+        setOtpResult(result);
+        setError("");
+      } catch (e) {
+        setError(e instanceof Error ? e.message : String(e));
+      }
+      return;
+    }
+  });
+  if (confirmDelete) {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "Delete",
+          subtitle: detail.name
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("box", {
+              border: true,
+              borderStyle: "rounded",
+              borderColor: "#FF4444",
+              padding: 1,
+              flexDirection: "column",
+              gap: 0,
+              children: [
+                /* @__PURE__ */ jsxDEV("text", {
+                  fg: "#FF4444",
+                  children: /* @__PURE__ */ jsxDEV("strong", {
+                    children: "Permanently delete this secret?"
+                  }, undefined, false, undefined, this)
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Name",
+                  value: detail.name,
+                  valueColor: "#FFD700"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Type",
+                  value: detail.type
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this),
+            /* @__PURE__ */ jsxDEV("select", {
+              options: [
+                { name: "Cancel", description: "Keep the secret", value: "cancel" },
+                { name: "Delete forever", description: "Cannot be undone", value: "delete" }
+              ],
+              onSelect: (_i, opt) => {
+                if (opt.value === "delete") {
+                  try {
+                    session.removeSecret(detail.name ?? detail.id);
+                    onDeleted(`"${detail.name}" deleted`);
+                  } catch (e) {
+                    onDeleted(`Error: ${e instanceof Error ? e.message : String(e)}`);
+                  }
+                } else {
+                  setConfirmDelete(false);
+                }
+              },
+              focused: true,
+              height: 4,
+              selectedBackgroundColor: "#222222",
+              selectedTextColor: "#FF4444"
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "\u2191\u2193 navigate  Enter confirm  Esc cancel"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  let maskedValue = "\u2014";
+  if (detail.value) {
+    maskedValue = revealing ? detail.value : "*".repeat(Math.min(detail.value.length, 32));
+  }
+  const hints = ["Hold s reveal", "c copy", "e edit", "d delete"];
+  if (isOtp)
+    hints.push(otpResult ? "r regen" : "o OTP");
+  hints.push("Esc back");
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    width: "100%",
+    height: "100%",
+    children: [
+      /* @__PURE__ */ jsxDEV(Header, {
+        title: detail.name,
+        subtitle: typeLabel(detail.type)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        flexDirection: "column",
+        flexGrow: 1,
+        padding: 2,
+        gap: 1,
+        children: [
+          /* @__PURE__ */ jsxDEV("box", {
+            flexDirection: "column",
+            border: true,
+            borderStyle: "rounded",
+            borderColor: "#333333",
+            padding: 1,
+            gap: 0,
+            width: "100%",
+            children: [
+              /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Name",
+                value: detail.name,
+                valueColor: "#FFD700"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Type",
+                value: typeLabel(detail.type)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "ID",
+                value: detail.id,
+                valueColor: "#555555"
+              }, undefined, false, undefined, this),
+              detail.username ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Username",
+                value: detail.username
+              }, undefined, false, undefined, this) : null,
+              /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Value",
+                value: maskedValue,
+                valueColor: revealing ? "#00FF00" : "#FF4444"
+              }, undefined, false, undefined, this),
+              detail.metadata?.url ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "URL",
+                value: String(detail.metadata.url)
+              }, undefined, false, undefined, this) : null,
+              detail.metadata?.description ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Description",
+                value: String(detail.metadata.description)
+              }, undefined, false, undefined, this) : null
+            ]
+          }, undefined, true, undefined, this),
+          /* @__PURE__ */ jsxDEV("text", {
+            fg: revealing ? "#00FF00" : "#666666",
+            children: revealing ? "Revealing \u2014 release [s] to hide" : "Hold [s] to reveal secret value"
+          }, undefined, false, undefined, this),
+          otpResult ? /* @__PURE__ */ jsxDEV("box", {
+            border: true,
+            borderStyle: "rounded",
+            borderColor: "#00CC66",
+            paddingX: 2,
+            height: 3,
+            flexDirection: "row",
+            alignItems: "center",
+            gap: 2,
+            children: [
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#888888",
+                children: "OTP"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#00FF00",
+                children: /* @__PURE__ */ jsxDEV("strong", {
+                  children: otpResult.code
+                }, undefined, false, undefined, this)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: otpCountdown <= 5 ? "#FF4444" : "#888888",
+                children: otpCountdown > 0 ? `${otpCountdown}s` : "expired"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#555555",
+                children: "[r] refresh"
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this) : null,
+          error ? /* @__PURE__ */ jsxDEV("text", {
+            fg: "#FF4444",
+            children: error
+          }, undefined, false, undefined, this) : null,
+          copied ? /* @__PURE__ */ jsxDEV("text", {
+            fg: "#00CC66",
+            children: [
+              copied,
+              " copied to clipboard"
+            ]
+          }, undefined, true, undefined, this) : null,
+          /* @__PURE__ */ jsxDEV("box", {
+            flexDirection: "row",
+            gap: 3,
+            marginTop: 1,
+            children: [
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#00CC66",
+                children: "[c] Copy"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#FFD700",
+                children: "[e] Edit"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#FF4444",
+                children: "[d] Delete"
+              }, undefined, false, undefined, this),
+              isOtp ? /* @__PURE__ */ jsxDEV("text", {
+                fg: "#00CCFF",
+                children: "[o] Generate OTP"
+              }, undefined, false, undefined, this) : null
+            ]
+          }, undefined, true, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV(StatusBar, {
+        message: hints.join("  ")
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function CreateScreen({ session, onDone, onBack }) {
+  const [step, setStep] = useState(0);
+  const [secretType, setSecretType] = useState("password");
+  const [name, setName] = useState("");
+  const [value, setValue] = useState("");
+  const [username, setUsername] = useState("");
+  const [url, setUrl] = useState("");
+  const [description, setDescription] = useState("");
+  const typeOptions = [
+    { name: "Login", description: "Username, password, and URL", value: "password" },
+    { name: "Secure Note", description: "Encrypted text note", value: "note" },
+    { name: "OTP Secret", description: "TOTP key for 2FA codes", value: "otp" }
+  ];
+  const steps = (() => {
+    switch (secretType) {
+      case "password":
+        return ["type", "name", "value", "username", "url", "description"];
+      case "note":
+        return ["type", "name", "value", "description"];
+      case "otp":
+        return ["type", "name", "value", "username", "description"];
+      default:
+        return ["type", "name", "value", "description"];
+    }
+  })();
+  const currentField = steps[step] ?? "description";
+  const totalSteps = steps.length;
+  const label = typeLabel(secretType);
+  const doCreate = useCallback(() => {
+    try {
+      const metadata = Object.fromEntries(Object.entries({
+        description: description || undefined,
+        url: url || undefined
+      }).filter(([, v]) => v !== undefined));
+      session.addSecret({
+        metadata,
+        name,
+        type: secretType,
+        username: username || undefined,
+        value
+      });
+      onDone(`"${name}" created`);
+    } catch (e) {
+      onDone(`Error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }, [session, name, value, secretType, username, url, description, onDone]);
+  useKeyboard((key) => {
+    if (key.eventType !== "press")
+      return;
+    if (key.name === "escape") {
+      if (step > 0)
+        setStep((s) => s - 1);
+      else
+        onBack();
+    }
+  });
+  const progress = `${step + 1}/${totalSteps}`;
+  const nextStep = () => setStep((s) => s + 1);
+  const inputRow = (label2, val, onChange, onSubmit, placeholder) => /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "row",
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: "#AAAAAA",
+        width: 12,
+        children: label2
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("input", {
+        value: val,
+        onChange,
+        onSubmit,
+        placeholder,
+        focused: true,
+        flexGrow: 1,
+        backgroundColor: "#111111",
+        focusedBackgroundColor: "#1a1a1a",
+        textColor: "#FFFFFF"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+  if (step === 0) {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: progress
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          paddingLeft: 2,
+          paddingTop: 1,
+          children: /* @__PURE__ */ jsxDEV("text", {
+            fg: "#888888",
+            children: "What type of secret?"
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          flexGrow: 1,
+          paddingLeft: 2,
+          paddingTop: 1,
+          children: /* @__PURE__ */ jsxDEV("select", {
+            options: typeOptions,
+            onSelect: (_i, opt) => {
+              setSecretType(opt.value ?? "password");
+              nextStep();
+            },
+            focused: true,
+            height: 6,
+            selectedBackgroundColor: "#222222",
+            selectedTextColor: "#FFD700"
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter select  Esc cancel"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "name") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 ${label}`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: "Give it a name"
+            }, undefined, false, undefined, this),
+            inputRow("Name", name, setName, () => {
+              if (name.trim())
+                nextStep();
+            }, "e.g. github-login")
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter next  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "value") {
+    const hint = secretType === "password" ? "Enter the password" : secretType === "otp" ? "Enter the TOTP base32 secret key" : "Enter the note content";
+    const placeholder = secretType === "password" ? "password..." : secretType === "otp" ? "e.g. JBSWY3DPEHPK3PXP" : "note content...";
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 ${name}`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: hint
+            }, undefined, false, undefined, this),
+            inputRow(secretType === "note" ? "Note" : "Value", value, setValue, () => {
+              if (value.trim())
+                nextStep();
+            }, placeholder)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter next  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "username") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 optional`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: "Username or email (optional)"
+            }, undefined, false, undefined, this),
+            inputRow("Username", username, setUsername, nextStep, "skip with Enter")
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter next (empty = skip)  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "url") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 optional`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: "Website URL (optional)"
+            }, undefined, false, undefined, this),
+            inputRow("URL", url, setUrl, nextStep, "e.g. https://github.com")
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter next (empty = skip)  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "description") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 save`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: "Description (optional) \u2014 Enter to save"
+            }, undefined, false, undefined, this),
+            inputRow("Description", description, setDescription, doCreate, "skip with Enter"),
+            /* @__PURE__ */ jsxDEV("box", {
+              flexDirection: "column",
+              border: true,
+              borderStyle: "rounded",
+              borderColor: "#333333",
+              padding: 1,
+              marginTop: 1,
+              gap: 0,
+              children: [
+                /* @__PURE__ */ jsxDEV("text", {
+                  fg: "#555555",
+                  children: /* @__PURE__ */ jsxDEV("strong", {
+                    children: "Summary"
+                  }, undefined, false, undefined, this)
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Type",
+                  value: label
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Name",
+                  value: name,
+                  valueColor: "#FFD700"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Value",
+                  value: "*".repeat(Math.min(value.length, 20)),
+                  valueColor: "#FF4444"
+                }, undefined, false, undefined, this),
+                username ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Username",
+                  value: username
+                }, undefined, false, undefined, this) : null,
+                url ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "URL",
+                  value: url
+                }, undefined, false, undefined, this) : null
+              ]
+            }, undefined, true, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter save  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  return null;
+}
+function EditScreen({ session, secret, onDone, onBack }) {
+  let detail;
+  try {
+    detail = session.getSecret(secret.id);
+  } catch {
+    detail = secret;
+  }
+  const secretType = detail.type;
+  const fields = EDIT_FIELDS.filter((f) => f.forTypes.includes(secretType));
+  const [editing, setEditing] = useState(null);
+  const [values, setValues] = useState({
+    name: detail.name,
+    value: detail.value ?? "",
+    username: detail.username ?? "",
+    url: detail.metadata?.url ? String(detail.metadata.url) : "",
+    description: detail.metadata?.description ? String(detail.metadata.description) : ""
+  });
+  const [inputVal, setInputVal] = useState("");
+  const inputValRef = useRef("");
+  const [editGeneration, setEditGeneration] = useState(0);
+  const doSave = useCallback(() => {
+    try {
+      const updates = {};
+      if (values.name !== detail.name)
+        updates.name = values.name;
+      if (values.value !== (detail.value ?? ""))
+        updates.value = values.value;
+      if (values.username !== (detail.username ?? ""))
+        updates.username = values.username;
+      const metaUpdates = {};
+      const oldUrl = detail.metadata?.url ? String(detail.metadata.url) : "";
+      const oldDesc = detail.metadata?.description ? String(detail.metadata.description) : "";
+      if (values.url !== oldUrl)
+        metaUpdates.url = values.url || undefined;
+      if (values.description !== oldDesc)
+        metaUpdates.description = values.description || undefined;
+      if (Object.keys(metaUpdates).length > 0)
+        updates.metadata = metaUpdates;
+      if (Object.keys(updates).length === 0) {
+        onDone("No changes");
+        return;
+      }
+      session.updateSecret(detail.id, updates);
+      onDone(`"${values.name}" updated`);
+    } catch (e) {
+      onDone(`Error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }, [values, detail, session, onDone]);
+  useKeyboard((key) => {
+    if (key.eventType !== "press")
+      return;
+    if (key.name === "escape") {
+      if (editing) {
+        setEditing(null);
+      } else {
+        onBack();
+      }
+    }
+    if (key.ctrl && key.name === "s" && !editing) {
+      doSave();
+    }
+  });
+  if (editing) {
+    const fieldDef = fields.find((f) => f.key === editing);
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: `Edit ${fieldDef?.label ?? editing}`,
+          subtitle: detail.name
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: [
+                "Current: ",
+                /* @__PURE__ */ jsxDEV("span", {
+                  fg: "#555555",
+                  children: values[editing] || "(empty)"
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this),
+            /* @__PURE__ */ jsxDEV("box", {
+              flexDirection: "row",
+              gap: 1,
+              children: [
+                /* @__PURE__ */ jsxDEV("text", {
+                  fg: "#AAAAAA",
+                  width: 12,
+                  children: "New value"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV("input", {
+                  value: inputVal,
+                  onChange: (v) => {
+                    setInputVal(v);
+                    inputValRef.current = v;
+                  },
+                  onSubmit: () => {
+                    const saved = inputValRef.current;
+                    const field = editing;
+                    if (field) {
+                      setValues((prev) => ({ ...prev, [field]: saved }));
+                    }
+                    setEditing(null);
+                    setInputVal("");
+                    inputValRef.current = "";
+                    setEditGeneration((g) => g + 1);
+                  },
+                  placeholder: values[editing] || "enter new value...",
+                  focused: true,
+                  flexGrow: 1,
+                  backgroundColor: "#111111",
+                  focusedBackgroundColor: "#1a1a1a",
+                  textColor: "#FFFFFF"
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter save field  Esc cancel"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  const options = fields.map((f) => {
+    let display;
+    if (f.key === "value") {
+      display = values[f.key] ? "***" : "(empty)";
+    } else {
+      display = values[f.key] || "(empty)";
+    }
+    return {
+      name: `${f.label}: ${display}`,
+      description: "Enter to edit",
+      value: f.key
+    };
+  });
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    width: "100%",
+    height: "100%",
+    children: [
+      /* @__PURE__ */ jsxDEV(Header, {
+        title: "Edit Secret",
+        subtitle: detail.name
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        flexGrow: 1,
+        paddingX: 2,
+        paddingTop: 1,
+        children: /* @__PURE__ */ jsxDEV("select", {
+          options,
+          onSelect: (_i, opt) => {
+            const val = opt.value ?? "";
+            const current = values[val] ?? "";
+            setEditing(val);
+            setInputVal(current);
+            inputValRef.current = current;
+          },
+          focused: true,
+          height: Math.min(options.length * 2 + 1, 14),
+          selectedBackgroundColor: "#222222",
+          selectedTextColor: "#FFD700"
+        }, editGeneration, false, undefined, this)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        paddingX: 2,
+        paddingBottom: 1,
+        children: /* @__PURE__ */ jsxDEV("box", {
+          border: true,
+          borderStyle: "rounded",
+          borderColor: "#FFD700",
+          paddingX: 2,
+          height: 3,
+          flexDirection: "row",
+          alignItems: "center",
+          gap: 2,
+          onMouseDown: doSave,
+          children: /* @__PURE__ */ jsxDEV("text", {
+            fg: "#FFD700",
+            children: /* @__PURE__ */ jsxDEV("strong", {
+              children: "Ctrl+S Save"
+            }, undefined, false, undefined, this)
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV(StatusBar, {
+        message: "Enter edit field  Ctrl+S save  Esc back"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function App({ vaultPath }) {
+  const [screen, setScreen] = useState("password");
+  const [session, setSession] = useState(null);
+  const [selectedSecret, setSelectedSecret] = useState(null);
+  const { toast, show: showToast } = useToast();
+  const [refreshKey, setRefreshKey] = useState(0);
+  const goHome = useCallback(() => {
+    setScreen("home");
+    setSelectedSecret(null);
+    setRefreshKey((k) => k + 1);
+  }, []);
+  const handleDone = useCallback((msg) => {
+    goHome();
+    showToast(msg, msg.startsWith("Error:") ? "error" : "success");
+  }, [goHome, showToast]);
+  if (screen === "password") {
+    return /* @__PURE__ */ jsxDEV(PasswordScreen, {
+      vaultPath,
+      onUnlock: (s) => {
+        setSession(s);
+        setScreen("home");
+      }
+    }, undefined, false, undefined, this);
+  }
+  if (!session)
+    return /* @__PURE__ */ jsxDEV("box", {
+      padding: 2,
+      children: /* @__PURE__ */ jsxDEV("text", {
+        fg: "#FF4444",
+        children: "No session."
+      }, undefined, false, undefined, this)
+    }, undefined, false, undefined, this);
+  switch (screen) {
+    case "home":
+      return /* @__PURE__ */ jsxDEV(HomeScreen, {
+        session,
+        onSelect: (s) => {
+          setSelectedSecret(s);
+          setScreen("detail");
+        },
+        onCreate: () => setScreen("create"),
+        toast
+      }, refreshKey, false, undefined, this);
+    case "detail":
+      return selectedSecret ? /* @__PURE__ */ jsxDEV(DetailScreen, {
+        session,
+        secret: selectedSecret,
+        onBack: goHome,
+        onDeleted: handleDone,
+        onEdit: () => setScreen("edit")
+      }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV(HomeScreen, {
+        session,
+        onSelect: (s) => {
+          setSelectedSecret(s);
+          setScreen("detail");
+        },
+        onCreate: () => setScreen("create"),
+        toast
+      }, refreshKey, false, undefined, this);
+    case "edit":
+      return selectedSecret ? /* @__PURE__ */ jsxDEV(EditScreen, {
+        session,
+        secret: selectedSecret,
+        onDone: handleDone,
+        onBack: () => setScreen("detail")
+      }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV(HomeScreen, {
+        session,
+        onSelect: (s) => {
+          setSelectedSecret(s);
+          setScreen("detail");
+        },
+        onCreate: () => setScreen("create"),
+        toast
+      }, refreshKey, false, undefined, this);
+    case "create":
+      return /* @__PURE__ */ jsxDEV(CreateScreen, {
+        session,
+        onDone: handleDone,
+        onBack: goHome
+      }, undefined, false, undefined, this);
+    default:
+      return /* @__PURE__ */ jsxDEV(HomeScreen, {
+        session,
+        onSelect: (s) => {
+          setSelectedSecret(s);
+          setScreen("detail");
+        },
+        onCreate: () => setScreen("create"),
+        toast
+      }, refreshKey, false, undefined, this);
+  }
+}
+async function runTui(vaultPath) {
+  const vault = vaultPath ?? defaultVaultPath();
+  const renderer = await createCliRenderer({ exitOnCtrlC: true });
+  createRoot(renderer).render(/* @__PURE__ */ jsxDEV(App, {
+    vaultPath: vault
+  }, undefined, false, undefined, this));
+}
+var EDIT_FIELDS;
+var init_tui = __esm(() => {
+  init_src3();
+  EDIT_FIELDS = [
+    { key: "name", label: "Name", forTypes: ["password", "note", "otp"] },
+    { key: "value", label: "Value", forTypes: ["password", "note", "otp"] },
+    { key: "username", label: "Username", forTypes: ["password", "otp"] },
+    { key: "url", label: "URL", forTypes: ["password"] },
+    { key: "description", label: "Description", forTypes: ["password", "note", "otp"] }
+  ];
+});
+
+// apps/cli/src/index.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { createInterface } from "readline/promises";
+import { resolve as resolve3 } from "path";
+
+// apps/cli/src/password.ts
+async function readPasswordMasked(prompt = "Master password: ") {
+  if (!process.stdin.isTTY) {
+    throw new Error("Cannot read password: stdin is not a TTY");
+  }
+  process.stdout.write(prompt);
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  process.stdin.setEncoding("utf8");
+  let password = "";
+  return new Promise((resolve, reject) => {
+    const onData = (char) => {
+      const code = char.charCodeAt(0);
+      if (char === "\r" || char === `
+`) {
+        cleanup();
+        process.stdout.write(`
+`);
+        resolve(password);
+        return;
+      }
+      if (code === 3) {
+        cleanup();
+        process.stdout.write(`
+`);
+        reject(new Error("Password input cancelled"));
+        return;
+      }
+      if (code === 4) {
+        cleanup();
+        process.stdout.write(`
+`);
+        resolve(password);
+        return;
+      }
+      if (code === 127 || code === 8) {
+        if (password.length > 0) {
+          password = password.slice(0, -1);
+          process.stdout.write("\b \b");
+        }
+        return;
+      }
+      if (code === 27) {
+        return;
+      }
+      if (code >= 32) {
+        password += char;
+        process.stdout.write("*");
+      }
+    };
+    const cleanup = () => {
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stdin.removeListener("data", onData);
+    };
+    process.stdin.on("data", onData);
+  });
+}
 
 // packages/core/src/daemon.ts
+init_src();
+init_src2();
+init_src3();
+init_paths();
+init_paths();
+import { createHash, timingSafeEqual } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
 var DAEMON_TOKEN_SERVICE = "autho.daemon";
 function daemonTokenName(statePath) {
   return createHash("sha256").update(statePath).digest("hex");
@@ -1402,6 +2860,7 @@ async function daemonStop(options) {
 }
 
 // apps/cli/src/index.ts
+init_src3();
 function parseArgs(argv) {
   const dashDashIndex = argv.indexOf("--");
   const main = dashDashIndex === -1 ? argv : argv.slice(0, dashDashIndex);
@@ -1525,6 +2984,9 @@ async function askPassword(prompt, initial) {
   if (initial) {
     return initial;
   }
+  if (process.stdin.isTTY) {
+    return readPasswordMasked("Master password: ");
+  }
   return prompt.ask("Master password: ");
 }
 async function runPromptMode(vaultPath, initialPassword) {
@@ -1620,44 +3082,56 @@ async function runWebServer(vaultPath, args) {
 }
 function help() {
   return [
-    "Autho Bun CLI",
+    "Autho \u2013 Local-first secret manager for humans and coding agents",
+    "",
+    "Usage:",
+    "  autho                  Open interactive TUI (terminal UI)",
+    "  autho <command>        Run a CLI command (see below)",
     "",
     "Commands:",
-    "  prompt [--password <value>] [--vault <path>]",
-    "  init --password <value> [--vault <path>]",
-    "  status [--password <value>] [--vault <path>] [--project-file <path>] [--json]",
-    "  project init --map <ENV_NAME=secretRef> [--map <ENV_NAME=secretRef>] [--output <path>] [--force] [--json]",
+    "  prompt [--vault <path>]",
+    "  init [--vault <path>]",
+    "  status [--vault <path>] [--project-file <path>] [--json]",
+    "  project init --map <ENV=ref> [--output <path>] [--force] [--json]",
     "  web serve [--vault <path>] [--host <value>] [--port <value>]",
     "  daemon serve [--vault <path>] [--state-file <path>] [--host <value>] [--port <value>]",
     "  daemon status [--state-file <path>] [--json]",
-    "  daemon unlock --password <value> [--ttl <seconds>] [--state-file <path>] [--json]",
+    "  daemon unlock [--ttl <seconds>] [--state-file <path>] [--json]",
     "  daemon lock --session <id> [--state-file <path>] [--json]",
     "  daemon stop [--state-file <path>] [--json]",
-    "  daemon env render --session <id> --map <ENV_NAME=secretRef> [--project-file <path>] [--lease <lease-id>] [--state-file <path>] [--json]",
-    "  daemon exec --session <id> --map <ENV_NAME=secretRef> [--project-file <path>] [--lease <lease-id>] [--state-file <path>] -- <command>",
-    "  import legacy --password <value> --file <path> [--skip-existing] [--vault <path>] [--json]",
-    "  secrets add --password <value> --name <name> --type <password|note|otp> --value <value> [--username <value>] [--url <value>] [--description <value>] [--digits <value>] [--algorithm <value>] [--vault <path>]",
-    "  secrets list --password <value> [--vault <path>] [--json]",
-    "  secrets get --password <value> --ref <name-or-id> [--vault <path>] [--json]",
-    "  secrets rm --password <value> --ref <name-or-id> [--vault <path>] [--json]",
-    "  otp code --password <value> --ref <name-or-id> [--vault <path>] [--json]",
-    "  lease create --password <value> --secret <name-or-id> [--secret <name-or-id>] --ttl <seconds> [--name <value>] [--vault <path>] [--json]",
-    "  lease revoke --password <value> --lease <lease-id> [--vault <path>] [--json]",
-    "  env render --password <value> --map <ENV_NAME=secretRef> [--map <ENV_NAME=secretRef>] [--project-file <path>] [--lease <lease-id>] [--vault <path>] [--json]",
-    "  env sync --password <value> --map <ENV_NAME=secretRef> [--project-file <path>] [--lease <lease-id>] [--ttl <seconds>] [--output <path>] [--force] [--vault <path>] [--json]",
-    "  exec --password <value> --map <ENV_NAME=secretRef> [--project-file <path>] [--lease <lease-id>] [--vault <path>] -- <command>",
-    "  file encrypt --password <value> --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
-    "  file decrypt --password <value> --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
-    "  files encrypt --password <value> --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
-    "  files decrypt --password <value> --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
-    "  audit list --password <value> [--limit <number>] [--vault <path>] [--json]",
+    "  daemon env render --session <id> --map <ENV=ref> [--project-file <path>] [--lease <id>] [--state-file <path>] [--json]",
+    "  daemon exec --session <id> --map <ENV=ref> [--project-file <path>] [--lease <id>] [--state-file <path>] -- <cmd>",
+    "  import legacy --file <path> [--skip-existing] [--vault <path>] [--json]",
+    "  secrets add --name <name> --type <password|note|otp> --value <value> [--username <v>] [--url <v>] [--description <v>] [--digits <v>] [--algorithm <v>] [--vault <path>]",
+    "  secrets list [--vault <path>] [--json]",
+    "  secrets get --ref <name-or-id> [--vault <path>] [--json]",
+    "  secrets rm --ref <name-or-id> [--vault <path>] [--json]",
+    "  secrets edit --ref <name-or-id> [--new-name <v>] [--value <v>] [--username <v>] [--url <v>] [--description <v>] [--vault <path>] [--json]",
+    "  otp code --ref <name-or-id> [--vault <path>] [--json]",
+    "  lease create --secret <ref> [--secret <ref>] --ttl <seconds> [--name <v>] [--vault <path>] [--json]",
+    "  lease revoke --lease <id> [--vault <path>] [--json]",
+    "  env render --map <ENV=ref> [--project-file <path>] [--lease <id>] [--vault <path>] [--json]",
+    "  env sync --map <ENV=ref> [--project-file <path>] [--lease <id>] [--ttl <seconds>] [--output <path>] [--force] [--vault <path>] [--json]",
+    "  exec --map <ENV=ref> [--project-file <path>] [--lease <id>] [--vault <path>] -- <cmd>",
+    "  file encrypt --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
+    "  file decrypt --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
+    "  files encrypt --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
+    "  files decrypt --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
+    "  audit list [--limit <number>] [--vault <path>] [--json]",
+    "",
+    "Authentication:",
+    "  When running interactively (TTY), you will be securely prompted for your",
+    "  master password with masked input (no --password flag needed).",
+    "",
+    "  For automation and coding agents, use one of:",
+    "    AUTHO_MASTER_PASSWORD=<value>    Environment variable (recommended for agents)",
+    "    --password <value>               CLI flag (visible in shell history - avoid!)",
     "",
     "Notes:",
-    "  Running `autho` with no command enters interactive prompt mode.",
-    "  The default vault path is ~/.autho/vault.db (or AUTHO_HOME/vault.db).",
-    "  The default project file is ~/.autho/project.json when it exists (or AUTHO_HOME/project.json).",
-    "  The default daemon state file is ~/.autho/daemon.json (or AUTHO_HOME/daemon.json).",
-    "  AUTHO_MASTER_PASSWORD can be used instead of --password."
+    "  Running `autho` with no arguments opens the interactive TUI.",
+    "  The default vault path is ~/.autho/vault.db (override with AUTHO_HOME).",
+    "  The default project file is ~/.autho/project.json.",
+    "  The default daemon state file is ~/.autho/daemon.json."
   ].join(`
 `);
 }
@@ -1670,8 +3144,13 @@ async function main() {
   const explicitProjectFile = getString(args, "project-file");
   const fallbackProjectFile = defaultProjectFilePath();
   const projectFile = explicitProjectFile ?? (existsSync4(fallbackProjectFile) ? fallbackProjectFile : undefined);
-  const password = getString(args, "password") ?? process.env.AUTHO_MASTER_PASSWORD;
+  let password = getString(args, "password") ?? process.env.AUTHO_MASTER_PASSWORD;
   if (!scope) {
+    if (process.stdin.isTTY) {
+      const { runTui: runTui2 } = await Promise.resolve().then(() => (init_tui(), exports_tui));
+      await runTui2(vaultPath);
+      return;
+    }
     await runPromptMode(vaultPath, password);
     return;
   }
@@ -1683,6 +3162,24 @@ async function main() {
     await runPromptMode(vaultPath, password);
     return;
   }
+  if (!password && process.stdin.isTTY) {
+    const needsPassword = [
+      "init",
+      "secrets",
+      "otp",
+      "lease",
+      "env",
+      "exec",
+      "file",
+      "files",
+      "audit",
+      "import"
+    ].includes(scope);
+    const daemonNeedsPassword = scope === "daemon" && action === "unlock";
+    if (needsPassword || daemonNeedsPassword) {
+      password = await readPasswordMasked("Master password: ");
+    }
+  }
   if (scope === "init") {
     output(VaultService.initialize(vaultPath, required(password, "--password")), jsonMode);
     return;
@@ -1791,6 +3288,23 @@ async function main() {
       output(session.removeSecret(required(ref, "--ref")), jsonMode);
       return;
     }
+    if (scope === "secrets" && action === "edit") {
+      const ref = getString(args, "ref") ?? getString(args, "name") ?? getString(args, "id");
+      const updates = {};
+      if (getString(args, "new-name"))
+        updates.name = getString(args, "new-name");
+      if (getString(args, "value"))
+        updates.value = getString(args, "value");
+      if (getString(args, "username"))
+        updates.username = getString(args, "username");
+      if (getString(args, "type"))
+        updates.type = getString(args, "type");
+      const meta = buildSecretMetadata(args);
+      if (Object.keys(meta).length > 0)
+        updates.metadata = meta;
+      output(session.updateSecret(required(ref, "--ref"), updates), jsonMode);
+      return;
+    }
     if (scope === "otp" && action === "code") {
       const ref = getString(args, "ref") ?? getString(args, "name") ?? getString(args, "id");
       output(session.generateOtp(required(ref, "--ref")), jsonMode);