autho 2.0.0 → 3.0.1

package/dist/autho.js

@@ -1,15 +1,21 @@
 #!/usr/bin/env bun
 // @bun
-
-// apps/cli/src/index.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync4 } from "fs";
-import { createInterface } from "readline/promises";
-import { resolve as resolve3 } from "path";
-
-// packages/core/src/daemon.ts
-import { createHash, timingSafeEqual } from "crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
+var __defProp = Object.defineProperty;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
+var __require = import.meta.require;
 
 // packages/storage/src/index.ts
 import { Database } from "bun:sqlite";
@@ -100,6 +106,13 @@ class AuthoDatabase {
   setVaultConfig(config) {
     this.db.query("INSERT OR REPLACE INTO meta (key, value) VALUES (?1, ?2)").run("vault.config", JSON.stringify(config));
   }
+  getVaultAuth() {
+    const row = this.db.query("SELECT value FROM meta WHERE key = ?1").get("vault.auth");
+    return row ? parseJson(row.value) : null;
+  }
+  setVaultAuth(auth) {
+    this.db.query("INSERT OR REPLACE INTO meta (key, value) VALUES (?1, ?2)").run("vault.auth", JSON.stringify(auth));
+  }
   countSecrets() {
     const row = this.db.query("SELECT COUNT(*) AS count FROM secrets").get();
     return row.count;
@@ -144,6 +157,31 @@ class AuthoDatabase {
          LIMIT 1`).get(ref);
     return row ?? null;
   }
+  updateSecret(id, updates) {
+    const parts = [];
+    const values = [];
+    let idx = 1;
+    if (updates.name !== undefined) {
+      parts.push(`name = ?${idx}`);
+      values.push(updates.name);
+      idx++;
+    }
+    if (updates.type !== undefined) {
+      parts.push(`type = ?${idx}`);
+      values.push(updates.type);
+      idx++;
+    }
+    if (updates.payload !== undefined) {
+      parts.push(`payload = ?${idx}`);
+      values.push(updates.payload);
+      idx++;
+    }
+    parts.push(`updated_at = ?${idx}`);
+    values.push(updates.updatedAt);
+    idx++;
+    values.push(id);
+    this.db.query(`UPDATE secrets SET ${parts.join(", ")} WHERE id = ?${idx}`).run(...values);
+  }
   deleteSecret(id) {
     this.db.query("DELETE FROM secrets WHERE id = ?1").run(id);
   }
@@ -185,22 +223,16 @@ class AuthoDatabase {
          LIMIT ?1`).all(limit);
   }
 }
+var init_src = () => {};
 
 // packages/crypto/src/index.ts
 import {
   createCipheriv,
   createDecipheriv,
+  createHmac,
   randomBytes,
   scryptSync
 } from "crypto";
-var DEFAULT_KDF = {
-  keyLength: 32,
-  name: "scrypt",
-  salt: "",
-  N: 1 << 17,
-  p: 1,
-  r: 8
-};
 function toBuffer(value) {
   return Buffer.isBuffer(value) ? value : Buffer.from(value, "utf8");
 }
@@ -257,24 +289,89 @@ function unlockRootKey(password, config) {
   const key = deriveKeyFromPassword(password, config.kdf);
   return decryptWithKey(config.wrappedRootKey, key, "autho:vault-root");
 }
-
-// packages/core/src/index.ts
-import { spawnSync } from "child_process";
-import { createHmac, randomBytes as randomBytes3 } from "crypto";
-import {
-  existsSync as existsSync2,
-  readFileSync as readFileSync2
-} from "fs";
-import { basename as basename2 } from "path";
-
-// packages/core/src/artifacts.ts
-import { randomBytes as randomBytes2 } from "crypto";
-import {
-  readdirSync,
-  readFileSync,
-  statSync
-} from "fs";
-import { basename, join as join2, relative, resolve as resolve2, sep } from "path";
+function decodeBase32(input) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const normalized = input.toUpperCase().replace(/=+$/g, "").replace(/\s+/g, "");
+  let bits = 0;
+  let value = 0;
+  const output = [];
+  for (const char of normalized) {
+    const index = alphabet.indexOf(char);
+    if (index === -1) {
+      throw new Error("OTP secret must be valid base32");
+    }
+    value = value << 5 | index;
+    bits += 5;
+    if (bits >= 8) {
+      output.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Uint8Array.from(output);
+}
+function generateTotpCode(secret, options, now) {
+  const algorithm = (options?.algorithm ?? "sha1").toLowerCase();
+  const digits = options?.digits ?? 6;
+  const key = decodeBase32(secret);
+  const counter = Math.floor(now / 30000);
+  const message = Buffer.alloc(8);
+  let cursor = counter;
+  for (let index = 7;index >= 0; index -= 1) {
+    message[index] = cursor & 255;
+    cursor >>= 8;
+  }
+  const hash = createHmac(algorithm, Buffer.from(key)).update(message).digest();
+  const offset = hash[hash.length - 1] & 15;
+  const binary = (hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255;
+  const mod = 10 ** digits;
+  return String(binary % mod).padStart(digits, "0");
+}
+function generateTotpSecret() {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const bytes = randomBytes(20);
+  let bits = 0;
+  let value = 0;
+  let result = "";
+  for (const byte of bytes) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      result += alphabet[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) {
+    result += alphabet[value << 5 - bits & 31];
+  }
+  return result;
+}
+function totpUri(secret, issuer, account) {
+  return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(account)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=6&period=30`;
+}
+function verifyTotpCode(secret, code, opts) {
+  const digits = opts?.digits ?? 6;
+  if (code.length !== digits) {
+    return false;
+  }
+  const now = Date.now();
+  for (const offset of [-30000, 0, 30000]) {
+    if (generateTotpCode(secret, opts, now + offset) === code) {
+      return true;
+    }
+  }
+  return false;
+}
+var DEFAULT_KDF;
+var init_src2 = __esm(() => {
+  DEFAULT_KDF = {
+    keyLength: 32,
+    name: "scrypt",
+    salt: "",
+    N: 1 << 17,
+    p: 1,
+    r: 8
+  };
+});
 
 // packages/core/src/paths.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, writeFileSync } from "fs";
@@ -323,8 +420,16 @@ function writeBinaryFileSecure(path, content) {
   writeFileSync(path, content, { mode: 384 });
   hardenFilePermissions(path);
 }
+var init_paths = () => {};
 
 // packages/core/src/artifacts.ts
+import { randomBytes as randomBytes2 } from "crypto";
+import {
+  readdirSync,
+  readFileSync,
+  statSync
+} from "fs";
+import { basename, join as join2, relative, resolve as resolve2, sep } from "path";
 function normalizeRelativePath(input) {
   return input.replace(/\\/g, "/");
 }
@@ -434,15 +539,26 @@ function assertPathIsFile(path) {
     throw new Error(`Expected file: ${path}`);
   }
 }
+var init_artifacts = __esm(() => {
+  init_src2();
+  init_paths();
+});
 
 // packages/core/src/index.ts
+import { spawnSync } from "child_process";
+import { createHmac as createHmac2, randomBytes as randomBytes3 } from "crypto";
+import {
+  existsSync as existsSync2,
+  readFileSync as readFileSync2
+} from "fs";
+import { basename as basename2 } from "path";
 function requireValue(value, label) {
   if (!value) {
     throw new Error(`Missing required option: ${label}`);
   }
   return value;
 }
-function decodeBase32(input) {
+function decodeBase322(input) {
   const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
   const normalized = input.toUpperCase().replace(/=+$/g, "").replace(/\s+/g, "");
   let bits = 0;
@@ -465,7 +581,7 @@ function decodeBase32(input) {
 function generateTotp(secret, options, now = Date.now()) {
   const algorithm = (options?.algorithm ?? "sha1").toLowerCase();
   const digits = options?.digits ?? 6;
-  const key = decodeBase32(secret);
+  const key = decodeBase322(secret);
   const counter = Math.floor(now / 30000);
   const message = Buffer.alloc(8);
   let cursor = counter;
@@ -473,7 +589,7 @@ function generateTotp(secret, options, now = Date.now()) {
     message[index] = cursor & 255;
     cursor >>= 8;
   }
-  const hash = createHmac(algorithm, Buffer.from(key)).update(message).digest();
+  const hash = createHmac2(algorithm, Buffer.from(key)).update(message).digest();
   const offset = hash[hash.length - 1] & 15;
   const binary = (hash[offset] & 127) << 24 | (hash[offset + 1] & 255) << 16 | (hash[offset + 2] & 255) << 8 | hash[offset + 3] & 255;
   const mod = 10 ** digits;
@@ -675,21 +791,212 @@ class VaultService {
       db.close();
     }
   }
-  static unlock(vaultPath, password) {
+  static unlock(vaultPath, credentials) {
+    const creds = typeof credentials === "string" ? { password: credentials } : credentials;
     const db = new AuthoDatabase(vaultPath);
     const config = db.getVaultConfig();
     if (!config) {
       db.close();
       throw new Error(`Vault is not initialized at ${vaultPath}`);
     }
+    const vaultAuth = db.getVaultAuth();
+    if (creds.recovery) {
+      if (!vaultAuth?.recovery) {
+        db.close();
+        throw new Error("No recovery token configured for this vault");
+      }
+      try {
+        const recoveryKEK = deriveKeyFromPassword(creds.recovery, vaultAuth.recovery.kdf);
+        const rootKey = decryptWithKey(vaultAuth.recovery.wrappedRootKey, recoveryKEK, "autho:vault-recovery");
+        db.insertAudit({
+          createdAt: new Date().toISOString(),
+          eventType: "auth.unlock.recovery",
+          id: randomId(),
+          message: "Vault unlocked via recovery file",
+          metadata: JSON.stringify({}),
+          subjectRef: null,
+          subjectType: "vault"
+        });
+        return new VaultSession(db, rootKey);
+      } catch (error) {
+        db.close();
+        throw new Error("Invalid recovery token", { cause: error });
+      }
+    }
     try {
-      const rootKey = unlockRootKey(password, config);
+      const passwordKEK = deriveKeyFromPassword(creds.password, config.kdf);
+      if (vaultAuth?.totp) {
+        const totpSecret = decryptWithKey(vaultAuth.totp.encryptedSecret, passwordKEK, "autho:vault-totp").toString("utf8");
+        if (!creds.totp || !verifyTotpCode(totpSecret, creds.totp)) {
+          throw new Error("Invalid or missing TOTP code");
+        }
+      }
+      const rootKey = decryptWithKey(config.wrappedRootKey, passwordKEK, "autho:vault-root");
       return new VaultSession(db, rootKey);
     } catch (error) {
       db.close();
+      if (error instanceof Error && error.message === "Invalid or missing TOTP code") {
+        throw error;
+      }
       throw new Error("Invalid vault password", { cause: error });
     }
   }
+  static getAuthConfig(vaultPath) {
+    const db = new AuthoDatabase(vaultPath);
+    try {
+      return db.getVaultAuth();
+    } finally {
+      db.close();
+    }
+  }
+  static setupTotp(vaultPath) {
+    const secret = generateTotpSecret();
+    const uri = totpUri(secret, "autho", vaultPath);
+    return { secret, uri };
+  }
+  static enableTotp(vaultPath, credentials, secret, code) {
+    if (!verifyTotpCode(secret, code)) {
+      throw new Error("Invalid TOTP code \u2014 make sure your authenticator app is showing the right code");
+    }
+    const session = VaultService.unlock(vaultPath, credentials);
+    session.close();
+    const db = new AuthoDatabase(vaultPath);
+    try {
+      const config = db.getVaultConfig();
+      const passwordKEK = deriveKeyFromPassword(credentials.password, config.kdf);
+      const encryptedSecret = encryptWithKey(Buffer.from(secret, "utf8"), passwordKEK, "autho:vault-totp");
+      const existing = db.getVaultAuth();
+      db.setVaultAuth({
+        version: 1,
+        ...existing,
+        totp: {
+          algorithm: "SHA1",
+          digits: 6,
+          encryptedSecret,
+          period: 30
+        }
+      });
+      db.insertAudit({
+        createdAt: new Date().toISOString(),
+        eventType: "auth.totp.enabled",
+        id: randomId(),
+        message: "TOTP vault unlock enabled",
+        metadata: JSON.stringify({}),
+        subjectRef: null,
+        subjectType: "vault"
+      });
+    } finally {
+      db.close();
+    }
+  }
+  static removeTotp(vaultPath, credentials) {
+    const session = VaultService.unlock(vaultPath, credentials);
+    session.close();
+    const db = new AuthoDatabase(vaultPath);
+    try {
+      const existing = db.getVaultAuth();
+      if (existing) {
+        const { totp: _removed, ...rest } = existing;
+        db.setVaultAuth({ ...rest, version: 1 });
+      }
+      db.insertAudit({
+        createdAt: new Date().toISOString(),
+        eventType: "auth.totp.removed",
+        id: randomId(),
+        message: "TOTP vault unlock removed",
+        metadata: JSON.stringify({}),
+        subjectRef: null,
+        subjectType: "vault"
+      });
+    } finally {
+      db.close();
+    }
+  }
+  static generateRecovery(vaultPath, credentials) {
+    const session = VaultService.unlock(vaultPath, credentials);
+    const rootKey = session.getRootKey();
+    session.close();
+    const db = new AuthoDatabase(vaultPath);
+    try {
+      const tokenBytes = randomBytes3(32);
+      const token = tokenBytes.toString("hex");
+      const recoverySalt = randomBytes3(16).toString("base64");
+      const recoveryKdf = {
+        keyLength: 32,
+        name: "scrypt",
+        salt: recoverySalt,
+        N: 1 << 17,
+        p: 1,
+        r: 8
+      };
+      const recoveryKEK = deriveKeyFromPassword(token, recoveryKdf);
+      const wrappedRootKey = encryptWithKey(rootKey, recoveryKEK, "autho:vault-recovery");
+      const existing = db.getVaultAuth();
+      db.setVaultAuth({
+        version: 1,
+        ...existing,
+        recovery: {
+          createdAt: new Date().toISOString(),
+          kdf: recoveryKdf,
+          wrappedRootKey
+        }
+      });
+      const formattedToken = token.toUpperCase().match(/.{1,8}/g).join("-");
+      const fileContent = [
+        "================================================================================",
+        "AUTHO VAULT RECOVERY FILE",
+        "================================================================================",
+        `Generated : ${new Date().toISOString()}`,
+        `Vault     : ${vaultPath}`,
+        "",
+        "WARNING: Anyone with this file can open your vault regardless of password,",
+        "PIN, or authenticator app. Store it offline (printed paper, encrypted USB,",
+        "safety deposit box). Revoke with: autho recovery revoke",
+        "",
+        "RECOVERY TOKEN:",
+        formattedToken,
+        "",
+        "To use: autho unlock --recovery-file <path-to-this-file>",
+        "================================================================================"
+      ].join(`
+`);
+      db.insertAudit({
+        createdAt: new Date().toISOString(),
+        eventType: "auth.recovery.generated",
+        id: randomId(),
+        message: "Recovery file generated",
+        metadata: JSON.stringify({}),
+        subjectRef: null,
+        subjectType: "vault"
+      });
+      return { fileContent };
+    } finally {
+      db.close();
+    }
+  }
+  static revokeRecovery(vaultPath, credentials) {
+    const session = VaultService.unlock(vaultPath, credentials);
+    session.close();
+    const db = new AuthoDatabase(vaultPath);
+    try {
+      const existing = db.getVaultAuth();
+      if (existing) {
+        const { recovery: _removed, ...rest } = existing;
+        db.setVaultAuth({ ...rest, version: 1 });
+      }
+      db.insertAudit({
+        createdAt: new Date().toISOString(),
+        eventType: "auth.recovery.revoked",
+        id: randomId(),
+        message: "Recovery file revoked",
+        metadata: JSON.stringify({}),
+        subjectRef: null,
+        subjectType: "vault"
+      });
+    } finally {
+      db.close();
+    }
+  }
 }
 
 class VaultSession {
@@ -699,6 +1006,9 @@ class VaultSession {
     this.db = db;
     this.rootKey = rootKey;
   }
+  getRootKey() {
+    return Buffer.from(this.rootKey);
+  }
   close() {
     this.db.close();
   }
@@ -808,6 +1118,44 @@ class VaultSession {
       updatedAt: now
     };
   }
+  updateSecret(ref, updates) {
+    const existing = this.getSecretOrThrow(ref);
+    if (updates.name && updates.name !== existing.name) {
+      const conflict = this.db.findSecret(updates.name);
+      if (conflict && conflict.id !== existing.id) {
+        throw new Error(`Secret already exists: ${updates.name}`);
+      }
+    }
+    const newName = updates.name ?? existing.name;
+    const newType = updates.type ? normalizeSecretType(updates.type) : existing.type;
+    const newValue = updates.value ?? existing.value;
+    const newUsername = updates.username !== undefined ? updates.username || null : existing.username;
+    const newMetadata = updates.metadata ? normalizeMetadata({ ...existing.metadata, ...updates.metadata }) : existing.metadata;
+    const now = new Date().toISOString();
+    const wrappedKeyBlob = JSON.parse(this.db.findSecret(existing.id).wrappedKey);
+    const dek = decryptWithKey(wrappedKeyBlob, this.rootKey, `autho:secret:${existing.id}:dek`);
+    const payload = encryptWithKey(JSON.stringify({
+      metadata: newMetadata,
+      username: newUsername,
+      value: newValue
+    }), dek, `autho:secret:${existing.id}:payload`);
+    this.db.updateSecret(existing.id, {
+      name: newName,
+      payload: JSON.stringify(payload),
+      type: newType,
+      updatedAt: now
+    });
+    this.audit("secret.updated", "secret", existing.id, "Secret updated", {
+      fields: Object.keys(updates).filter((k) => updates[k] !== undefined)
+    });
+    return {
+      createdAt: existing.createdAt,
+      id: existing.id,
+      name: newName,
+      type: newType,
+      updatedAt: now
+    };
+  }
   importLegacyFile(filePath, options) {
     const raw = JSON.parse(readFileSync2(filePath, "utf8"));
     let imported = 0;
@@ -1045,67 +1393,1884 @@ class VaultSession {
     return this.db.listAudit(limit).map(toAuditEvent);
   }
 }
+var init_src3 = __esm(() => {
+  init_src2();
+  init_artifacts();
+  init_src();
+  init_paths();
+  init_paths();
+});
 
-// packages/core/src/daemon.ts
-var DAEMON_TOKEN_SERVICE = "autho.daemon";
-function daemonTokenName(statePath) {
-  return createHash("sha256").update(statePath).digest("hex");
+// packages/core/src/os-secrets.ts
+import { createHash as createHash2, randomBytes as randomBytes4, scryptSync as scryptSync2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import { resolve as resolve3 } from "path";
+function vaultPasswordName(vaultPath) {
+  return createHash2("sha256").update(resolve3(vaultPath)).digest("hex");
 }
-async function storeDaemonToken(statePath, token) {
-  const tokenName = daemonTokenName(statePath);
-  if (process.env.AUTHO_DISABLE_OS_SECRETS !== "1") {
-    try {
-      await Bun.secrets.set({
-        name: tokenName,
-        service: DAEMON_TOKEN_SERVICE,
-        value: token
-      });
-      return {
-        token: null,
-        tokenName,
-        tokenStorage: "os"
-      };
-    } catch {}
-  }
-  return {
-    token,
-    tokenName: null,
-    tokenStorage: "file"
-  };
+function osSecretsDisabled() {
+  return process.env.AUTHO_DISABLE_OS_SECRETS === "1";
 }
-async function resolveDaemonToken(state) {
-  if (state.tokenStorage === "os") {
-    if (!state.tokenName) {
-      throw new Error("Daemon state is missing tokenName for OS secret storage");
-    }
-    const token = await Bun.secrets.get({
-      name: state.tokenName,
-      service: DAEMON_TOKEN_SERVICE
+async function storeVaultPassword(vaultPath, password) {
+  if (osSecretsDisabled()) {
+    return false;
+  }
+  try {
+    await Bun.secrets.set({
+      name: vaultPasswordName(vaultPath),
+      service: VAULT_PASSWORD_SERVICE,
+      value: password
     });
-    if (!token) {
-      throw new Error("Daemon token not found in OS secret storage");
-    }
-    return token;
+    return true;
+  } catch {
+    return false;
   }
-  if (!state.token) {
-    throw new Error("Daemon state is missing token");
+}
+async function loadVaultPassword(vaultPath) {
+  if (osSecretsDisabled()) {
+    return null;
+  }
+  try {
+    const password = await Bun.secrets.get({
+      name: vaultPasswordName(vaultPath),
+      service: VAULT_PASSWORD_SERVICE
+    });
+    return password ?? null;
+  } catch {
+    return null;
   }
-  return state.token;
 }
-async function deleteStoredDaemonToken(state) {
-  if (!state || state.tokenStorage !== "os" || !state.tokenName) {
-    return;
+async function deleteVaultPassword(vaultPath) {
+  if (osSecretsDisabled()) {
+    return false;
   }
   try {
-    await Bun.secrets.delete({
-      name: state.tokenName,
-      service: DAEMON_TOKEN_SERVICE
+    return await Bun.secrets.delete({
+      name: vaultPasswordName(vaultPath),
+      service: VAULT_PASSWORD_SERVICE
     });
-  } catch {}
+  } catch {
+    return false;
+  }
 }
-function readDaemonState(statePath) {
-  if (!existsSync3(statePath)) {
-    return null;
+async function setOsSecret(name, value) {
+  if (osSecretsDisabled()) {
+    return false;
+  }
+  try {
+    await Bun.secrets.set({ name, service: USER_SECRETS_SERVICE, value });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function getOsSecret(name) {
+  if (osSecretsDisabled()) {
+    return null;
+  }
+  try {
+    const value = await Bun.secrets.get({ name, service: USER_SECRETS_SERVICE });
+    return value ?? null;
+  } catch {
+    return null;
+  }
+}
+async function deleteOsSecret(name) {
+  if (osSecretsDisabled()) {
+    return false;
+  }
+  try {
+    return await Bun.secrets.delete({ name, service: USER_SECRETS_SERVICE });
+  } catch {
+    return false;
+  }
+}
+async function storePinHash(vaultPath, pin) {
+  if (osSecretsDisabled()) {
+    return false;
+  }
+  try {
+    const salt = randomBytes4(16);
+    const hash = scryptSync2(pin, salt, 32, { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 });
+    const value = `${salt.toString("base64")}:${hash.toString("base64")}`;
+    await Bun.secrets.set({ name: vaultPasswordName(vaultPath), service: PIN_SERVICE, value });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function verifyPin(vaultPath, pin) {
+  if (osSecretsDisabled()) {
+    return false;
+  }
+  try {
+    const stored = await Bun.secrets.get({ name: vaultPasswordName(vaultPath), service: PIN_SERVICE });
+    if (!stored)
+      return false;
+    const colonIdx = stored.indexOf(":");
+    if (colonIdx === -1)
+      return false;
+    const salt = Buffer.from(stored.slice(0, colonIdx), "base64");
+    const expectedHash = Buffer.from(stored.slice(colonIdx + 1), "base64");
+    const actualHash = scryptSync2(pin, salt, 32, { N: 1 << 15, r: 8, p: 1, maxmem: 64 * 1024 * 1024 });
+    return timingSafeEqual2(actualHash, expectedHash);
+  } catch {
+    return false;
+  }
+}
+async function hasPinSet(vaultPath) {
+  if (osSecretsDisabled()) {
+    return false;
+  }
+  try {
+    const stored = await Bun.secrets.get({ name: vaultPasswordName(vaultPath), service: PIN_SERVICE });
+    return stored != null;
+  } catch {
+    return false;
+  }
+}
+async function deletePin(vaultPath) {
+  if (osSecretsDisabled()) {
+    return false;
+  }
+  try {
+    return await Bun.secrets.delete({ name: vaultPasswordName(vaultPath), service: PIN_SERVICE });
+  } catch {
+    return false;
+  }
+}
+var VAULT_PASSWORD_SERVICE = "autho.vault", USER_SECRETS_SERVICE = "autho", PIN_SERVICE = "autho.pin";
+var init_os_secrets = () => {};
+
+// apps/cli/src/tui.tsx
+var exports_tui = {};
+__export(exports_tui, {
+  runTui: () => runTui
+});
+import { createCliRenderer } from "@opentui/core";
+import { createRoot, useKeyboard, useRenderer, useTerminalDimensions } from "@opentui/react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { jsxDEV } from "@opentui/react/jsx-dev-runtime";
+function typeLabel(type) {
+  switch (type) {
+    case "password":
+      return "Login";
+    case "note":
+      return "Secure Note";
+    case "otp":
+      return "OTP Secret";
+    default:
+      return type;
+  }
+}
+function Header({ title, subtitle }) {
+  return /* @__PURE__ */ jsxDEV("box", {
+    width: "100%",
+    paddingLeft: 2,
+    paddingTop: 1,
+    paddingBottom: 1,
+    borderBottom: true,
+    borderColor: "#333333",
+    children: [
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: "#FFD700",
+        children: /* @__PURE__ */ jsxDEV("strong", {
+          children: title
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      subtitle ? /* @__PURE__ */ jsxDEV("text", {
+        fg: "#555555",
+        children: [
+          " ",
+          subtitle
+        ]
+      }, undefined, true, undefined, this) : null
+    ]
+  }, undefined, true, undefined, this);
+}
+function StatusBar({ message }) {
+  return /* @__PURE__ */ jsxDEV("box", {
+    width: "100%",
+    height: 1,
+    backgroundColor: "#1a1a1a",
+    paddingLeft: 1,
+    paddingRight: 1,
+    children: /* @__PURE__ */ jsxDEV("text", {
+      fg: "#666666",
+      children: message
+    }, undefined, false, undefined, this)
+  }, undefined, false, undefined, this);
+}
+function ToastBar({ toast }) {
+  if (!toast)
+    return null;
+  const color = toast.type === "success" ? "#00CC66" : "#FF4444";
+  const icon = toast.type === "success" ? "+" : "!";
+  return /* @__PURE__ */ jsxDEV("box", {
+    width: "100%",
+    height: 1,
+    backgroundColor: color,
+    paddingLeft: 1,
+    children: /* @__PURE__ */ jsxDEV("text", {
+      fg: "#000000",
+      children: /* @__PURE__ */ jsxDEV("strong", {
+        children: [
+          " ",
+          icon,
+          " ",
+          toast.message
+        ]
+      }, undefined, true, undefined, this)
+    }, undefined, false, undefined, this)
+  }, undefined, false, undefined, this);
+}
+function KeyValue({ label, value, labelColor = "#888888", valueColor = "#FFFFFF" }) {
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "row",
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: labelColor,
+        width: 14,
+        children: label
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: valueColor,
+        children: value
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function useToast() {
+  const [toast, setToast] = useState(null);
+  const timerRef = useRef(null);
+  const show = useCallback((message, type = "success") => {
+    if (timerRef.current)
+      clearTimeout(timerRef.current);
+    setToast({ message, type });
+    timerRef.current = setTimeout(() => setToast(null), 3000);
+  }, []);
+  useEffect(() => () => {
+    if (timerRef.current)
+      clearTimeout(timerRef.current);
+  }, []);
+  return { toast, show };
+}
+function tryUnlockWithPassword(vaultPath, password) {
+  try {
+    return VaultService.unlock(vaultPath, { password });
+  } catch {
+    return null;
+  }
+}
+function tryUnlockWithRecovery(vaultPath, token) {
+  try {
+    return VaultService.unlock(vaultPath, { password: "", recovery: token });
+  } catch {
+    return null;
+  }
+}
+function PasswordMethod({ onSubmit, vaultPath: _vaultPath }) {
+  const [password, setPassword] = useState("");
+  const [submitting, setSubmitting] = useState(false);
+  useKeyboard((key) => {
+    if (key.eventType !== "press" && key.eventType !== "repeat")
+      return;
+    if (submitting)
+      return;
+    if (key.name === "enter" || key.name === "return") {
+      if (!password)
+        return;
+      setSubmitting(true);
+      onSubmit(password);
+      return;
+    }
+    if (key.name === "backspace") {
+      setPassword((p) => p.slice(0, -1));
+      return;
+    }
+    if (key.ctrl || key.meta || key.name === "escape" || key.name === "tab" || key.name === "up" || key.name === "down" || key.name === "left" || key.name === "right" || key.name === "home" || key.name === "end" || key.name === "delete" || key.name === "insert" || key.name === "pageup" || key.name === "pagedown" || key.name.startsWith("f") && /^f\d+$/.test(key.name))
+      return;
+    const char = key.sequence;
+    if (char && char.length === 1 && char.charCodeAt(0) >= 32)
+      setPassword((p) => p + char);
+  });
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "row",
+    gap: 1,
+    marginTop: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: "#AAAAAA",
+        children: "Password "
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        backgroundColor: "#111111",
+        flexGrow: 1,
+        paddingX: 1,
+        height: 1,
+        children: /* @__PURE__ */ jsxDEV("text", {
+          fg: "#FFD700",
+          children: password ? "*".repeat(password.length) : ""
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      submitting ? /* @__PURE__ */ jsxDEV("text", {
+        fg: "#FFD700",
+        children: " ..."
+      }, undefined, false, undefined, this) : null
+    ]
+  }, undefined, true, undefined, this);
+}
+function PinMethod({ vaultPath, password, onVerified, onError }) {
+  const [pin, setPin] = useState("");
+  const [verifying, setVerifying] = useState(false);
+  useKeyboard((key) => {
+    if (key.eventType !== "press" && key.eventType !== "repeat")
+      return;
+    if (verifying)
+      return;
+    if (key.name === "enter" || key.name === "return") {
+      if (!pin)
+        return;
+      setVerifying(true);
+      verifyPin(vaultPath, pin).then((ok) => {
+        if (ok) {
+          onVerified(password);
+        } else {
+          onError("Wrong PIN");
+          setPin("");
+          setVerifying(false);
+        }
+      });
+      return;
+    }
+    if (key.name === "backspace") {
+      setPin((p) => p.slice(0, -1));
+      return;
+    }
+    if (key.ctrl || key.meta || key.name === "escape" || key.name === "tab" || key.name === "up" || key.name === "down" || key.name === "left" || key.name === "right" || key.name === "home" || key.name === "end" || key.name === "delete" || key.name === "insert" || key.name === "pageup" || key.name === "pagedown" || key.name.startsWith("f") && /^f\d+$/.test(key.name))
+      return;
+    const char = key.sequence;
+    if (char && char.length === 1 && char.charCodeAt(0) >= 32)
+      setPin((p) => p + char);
+  });
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "row",
+    gap: 1,
+    marginTop: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: "#AAAAAA",
+        children: "PIN      "
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        backgroundColor: "#111111",
+        flexGrow: 1,
+        paddingX: 1,
+        height: 1,
+        children: /* @__PURE__ */ jsxDEV("text", {
+          fg: "#FFD700",
+          children: pin ? "*".repeat(pin.length) : ""
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      verifying ? /* @__PURE__ */ jsxDEV("text", {
+        fg: "#FFD700",
+        children: " ..."
+      }, undefined, false, undefined, this) : null
+    ]
+  }, undefined, true, undefined, this);
+}
+function TotpMethod({ onSubmit, onError: _onError }) {
+  const [code, setCode] = useState("");
+  const [remaining, setRemaining] = useState(0);
+  useEffect(() => {
+    const update = () => {
+      const secs = Math.ceil((30000 - Date.now() % 30000) / 1000);
+      setRemaining(secs);
+    };
+    update();
+    const interval = setInterval(update, 1000);
+    return () => clearInterval(interval);
+  }, []);
+  useKeyboard((key) => {
+    if (key.eventType !== "press" && key.eventType !== "repeat")
+      return;
+    if (key.name === "enter" || key.name === "return") {
+      if (code.length !== 6)
+        return;
+      onSubmit(code);
+      return;
+    }
+    if (key.name === "backspace") {
+      setCode((c) => c.slice(0, -1));
+      return;
+    }
+    if (key.ctrl || key.meta || key.name === "escape" || key.name === "tab" || key.name === "up" || key.name === "down" || key.name === "left" || key.name === "right" || key.name === "home" || key.name === "end" || key.name === "delete" || key.name === "insert" || key.name === "pageup" || key.name === "pagedown" || key.name.startsWith("f") && /^f\d+$/.test(key.name))
+      return;
+    const char = key.sequence;
+    if (char && /^\d$/.test(char) && code.length < 6) {
+      const next = code + char;
+      setCode(next);
+      if (next.length === 6) {
+        onSubmit(next);
+      }
+    }
+  });
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    gap: 1,
+    marginTop: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV("box", {
+        flexDirection: "row",
+        gap: 1,
+        children: [
+          /* @__PURE__ */ jsxDEV("text", {
+            fg: "#AAAAAA",
+            children: "Auth code "
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV("box", {
+            backgroundColor: "#111111",
+            flexGrow: 1,
+            paddingX: 1,
+            height: 1,
+            children: /* @__PURE__ */ jsxDEV("text", {
+              fg: "#FFD700",
+              children: code || "_".repeat(6)
+            }, undefined, false, undefined, this)
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV("text", {
+            fg: remaining <= 5 ? "#FF4444" : "#555555",
+            children: [
+              " ",
+              remaining,
+              "s"
+            ]
+          }, undefined, true, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: "#555555",
+        children: "Enter 6-digit authenticator code"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function UnlockScreen({ onUnlock, vaultPath }) {
+  const [step, setStep] = useState("loading");
+  const [error, setError] = useState("");
+  const [password, setPasswordState] = useState("");
+  const [pinNeeded, setPinNeeded] = useState(false);
+  const [totpNeeded, setTotpNeeded] = useState(false);
+  useEffect(() => {
+    let cancelled = false;
+    (async () => {
+      const recoveryFile = process.env.AUTHO_RECOVERY_FILE;
+      if (recoveryFile) {
+        try {
+          const { readFileSync: readFileSync4 } = await import("fs");
+          const content = readFileSync4(recoveryFile, "utf8");
+          const lines = content.split(`
+`);
+          const idx = lines.findIndex((l) => l.trim() === "RECOVERY TOKEN:");
+          if (idx !== -1) {
+            const rawToken = lines.slice(idx + 1).find((l) => l.trim() !== "") ?? "";
+            const token = rawToken.replace(/-/g, "").toLowerCase();
+            if (token) {
+              const session = tryUnlockWithRecovery(vaultPath, token);
+              if (!cancelled && session) {
+                onUnlock(session);
+                return;
+              }
+              if (!cancelled)
+                setError("Recovery file failed \u2014 enter password instead");
+            } else {
+              if (!cancelled)
+                setError("Recovery file is malformed \u2014 enter password instead");
+            }
+          } else {
+            if (!cancelled)
+              setError("Recovery file is malformed \u2014 enter password instead");
+          }
+        } catch {
+          if (!cancelled)
+            setError("Recovery file could not be read \u2014 enter password instead");
+        }
+      }
+      const pinSet = await hasPinSet(vaultPath);
+      if (!cancelled)
+        setPinNeeded(pinSet);
+      const authConfig = VaultService.getAuthConfig(vaultPath);
+      if (!cancelled)
+        setTotpNeeded(authConfig?.totp !== undefined);
+      if (!pinSet) {
+        const pw = await loadVaultPassword(vaultPath);
+        if (!cancelled && pw && !authConfig?.totp) {
+          const session = tryUnlockWithPassword(vaultPath, pw);
+          if (!cancelled && session) {
+            onUnlock(session);
+            return;
+          }
+        }
+        if (!cancelled && pw) {
+          setPasswordState(pw);
+          if (!cancelled)
+            setStep(authConfig?.totp ? "totp" : "password");
+          return;
+        }
+      }
+      if (!cancelled)
+        setStep("password");
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [vaultPath, onUnlock]);
+  const doUnlock = useCallback((pw, totp) => {
+    const creds = { password: pw, totp };
+    try {
+      const session = VaultService.unlock(vaultPath, creds);
+      onUnlock(session);
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e));
+      setStep("password");
+      setPasswordState("");
+    }
+  }, [vaultPath, onUnlock]);
+  const handlePasswordSubmit = useCallback((pw) => {
+    setPasswordState(pw);
+    if (pinNeeded) {
+      setStep("pin");
+    } else if (totpNeeded) {
+      setStep("totp");
+    } else {
+      setStep("unlocking");
+      doUnlock(pw, undefined);
+    }
+  }, [pinNeeded, totpNeeded, doUnlock]);
+  const handlePinVerified = useCallback((pw) => {
+    if (totpNeeded) {
+      setStep("totp");
+    } else {
+      setStep("unlocking");
+      doUnlock(pw, undefined);
+    }
+  }, [totpNeeded, doUnlock]);
+  const handleTotpSubmit = useCallback((totp) => {
+    setStep("unlocking");
+    doUnlock(password, totp);
+  }, [password, doUnlock]);
+  if (step === "loading" || step === "unlocking") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      alignItems: "center",
+      justifyContent: "center",
+      width: "100%",
+      height: "100%",
+      children: /* @__PURE__ */ jsxDEV("text", {
+        fg: "#FFD700",
+        children: step === "loading" ? "Unlocking..." : "Verifying..."
+      }, undefined, false, undefined, this)
+    }, undefined, false, undefined, this);
+  }
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    alignItems: "center",
+    justifyContent: "center",
+    width: "100%",
+    height: "100%",
+    children: /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      border: true,
+      borderStyle: "rounded",
+      padding: 2,
+      width: 52,
+      gap: 1,
+      children: [
+        /* @__PURE__ */ jsxDEV("ascii-font", {
+          text: "autho",
+          font: "tiny",
+          color: "#FFD700"
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("text", {
+          fg: "#888888",
+          children: "Unlock your vault"
+        }, undefined, false, undefined, this),
+        error ? /* @__PURE__ */ jsxDEV("box", {
+          backgroundColor: "#331111",
+          paddingX: 1,
+          width: "100%",
+          children: /* @__PURE__ */ jsxDEV("text", {
+            fg: "#FF4444",
+            children: error
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this) : null,
+        step === "password" && /* @__PURE__ */ jsxDEV(PasswordMethod, {
+          vaultPath,
+          onSubmit: handlePasswordSubmit
+        }, undefined, false, undefined, this),
+        step === "pin" && /* @__PURE__ */ jsxDEV(PinMethod, {
+          vaultPath,
+          password,
+          onVerified: handlePinVerified,
+          onError: setError
+        }, undefined, false, undefined, this),
+        step === "totp" && /* @__PURE__ */ jsxDEV(TotpMethod, {
+          onSubmit: handleTotpSubmit,
+          onError: setError
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("text", {
+          fg: "#444444",
+          children: "Enter to unlock | Ctrl+C to exit"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this)
+  }, undefined, false, undefined, this);
+}
+function buildDescription(s, availableWidth) {
+  const label = typeLabel(s.type);
+  let desc = label;
+  if (s.username) {
+    const withUser = `${label} \xB7 ${s.username}`;
+    if (withUser.length <= availableWidth) {
+      desc = withUser;
+    } else {
+      return desc;
+    }
+  }
+  const url = s.metadata?.url ? String(s.metadata.url) : "";
+  if (url) {
+    const shortUrl = url.replace(/^https?:\/\//, "");
+    const withUrl = `${desc} \xB7 ${shortUrl}`;
+    if (withUrl.length <= availableWidth) {
+      desc = withUrl;
+    } else {
+      return desc;
+    }
+  }
+  const note = s.metadata?.description ? String(s.metadata.description) : "";
+  if (note) {
+    const withNote = `${desc} \xB7 ${note}`;
+    if (withNote.length <= availableWidth) {
+      desc = withNote;
+    } else {
+      const budget = availableWidth - desc.length - 5;
+      if (budget > 5) {
+        desc = `${desc} \u2014 ${note.slice(0, budget)}\u2026`;
+      }
+    }
+  }
+  return desc;
+}
+function HomeScreen({ session, onSelect, onCreate, toast }) {
+  const renderer = useRenderer();
+  const { width: termWidth } = useTerminalDimensions();
+  const [secrets, setSecrets] = useState([]);
+  const [query, setQuery] = useState("");
+  const [searchFocused, setSearchFocused] = useState(false);
+  const reload = useCallback(() => {
+    try {
+      const summaries = session.listSecrets();
+      const enriched = summaries.map((s) => {
+        try {
+          return session.getSecret(s.id);
+        } catch {
+          return s;
+        }
+      });
+      setSecrets(enriched);
+    } catch {
+      setSecrets([]);
+    }
+  }, [session]);
+  useEffect(reload, [reload]);
+  const filtered = useMemo(() => {
+    if (!query)
+      return secrets;
+    const q = query.toLowerCase();
+    return secrets.filter((s) => s.name.toLowerCase().includes(q) || s.type.toLowerCase().includes(q) || s.username && s.username.toLowerCase().includes(q) || s.metadata?.url && String(s.metadata.url).toLowerCase().includes(q) || s.metadata?.description && String(s.metadata.description).toLowerCase().includes(q));
+  }, [secrets, query]);
+  const descWidth = Math.max(20, termWidth - 30);
+  const options = useMemo(() => filtered.map((s) => ({
+    name: s.name,
+    description: buildDescription(s, descWidth),
+    value: s.id
+  })), [filtered, descWidth]);
+  useKeyboard((key) => {
+    if (key.eventType !== "press")
+      return;
+    if (key.name === "q" && !searchFocused) {
+      session.close();
+      renderer.destroy();
+      return;
+    }
+    if (key.name === "n" && !searchFocused) {
+      onCreate();
+      return;
+    }
+    if (key.name === "/" && !searchFocused) {
+      setSearchFocused(true);
+      return;
+    }
+    if (key.name === "escape" && searchFocused) {
+      setSearchFocused(false);
+      setQuery("");
+      return;
+    }
+    if (key.name === "escape" && !searchFocused) {
+      session.close();
+      renderer.destroy();
+      return;
+    }
+    if (key.name === "tab") {
+      setSearchFocused((f) => !f);
+      return;
+    }
+  });
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    width: "100%",
+    height: "100%",
+    children: [
+      /* @__PURE__ */ jsxDEV(Header, {
+        title: "Autho",
+        subtitle: `${secrets.length} secrets`
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        flexDirection: "row",
+        paddingX: 2,
+        paddingTop: 1,
+        gap: 2,
+        alignItems: "center",
+        children: [
+          /* @__PURE__ */ jsxDEV("input", {
+            value: query,
+            onChange: setQuery,
+            placeholder: "/ search...",
+            focused: searchFocused,
+            flexGrow: 1,
+            backgroundColor: "#111111",
+            focusedBackgroundColor: "#1a1a1a",
+            textColor: "#FFFFFF",
+            placeholderColor: "#444444"
+          }, undefined, false, undefined, this),
+          /* @__PURE__ */ jsxDEV("text", {
+            fg: "#555555",
+            children: "[n] new"
+          }, undefined, false, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        flexGrow: 1,
+        paddingX: 2,
+        paddingTop: 1,
+        children: filtered.length === 0 ? /* @__PURE__ */ jsxDEV("box", {
+          padding: 1,
+          children: /* @__PURE__ */ jsxDEV("text", {
+            fg: "#555555",
+            children: secrets.length === 0 ? "No secrets yet. Press [n] to create one." : "No matches."
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV("select", {
+          options,
+          onSelect: (index) => onSelect(filtered[index]),
+          focused: !searchFocused,
+          height: Math.min(filtered.length * 2 + 1, 18),
+          selectedBackgroundColor: "#222222",
+          selectedTextColor: "#FFD700"
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV(ToastBar, {
+        toast
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV(StatusBar, {
+        message: "\u2191\u2193 navigate  Enter open  / search  n new  q quit"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function DetailScreen({ session, secret, onBack, onDeleted, onEdit }) {
+  const renderer = useRenderer();
+  const [revealing, setRevealing] = useState(false);
+  const [copied, setCopied] = useState("");
+  const [confirmDelete, setConfirmDelete] = useState(false);
+  const [otpResult, setOtpResult] = useState(null);
+  const [otpCountdown, setOtpCountdown] = useState(0);
+  const [error, setError] = useState("");
+  const hideTimerRef = useRef(null);
+  const countdownRef = useRef(null);
+  let detail;
+  try {
+    detail = session.getSecret(secret.name ?? secret.id);
+  } catch {
+    detail = secret;
+  }
+  const isOtp = detail.type === "otp";
+  useEffect(() => () => {
+    if (hideTimerRef.current)
+      clearTimeout(hideTimerRef.current);
+    if (countdownRef.current)
+      clearInterval(countdownRef.current);
+  }, []);
+  useEffect(() => {
+    if (!otpResult) {
+      if (countdownRef.current)
+        clearInterval(countdownRef.current);
+      return;
+    }
+    const update = () => {
+      const remaining = Math.max(0, Math.ceil((new Date(otpResult.expiresAt).getTime() - Date.now()) / 1000));
+      setOtpCountdown(remaining);
+      if (remaining <= 0 && countdownRef.current) {
+        clearInterval(countdownRef.current);
+      }
+    };
+    update();
+    countdownRef.current = setInterval(update, 1000);
+    return () => {
+      if (countdownRef.current)
+        clearInterval(countdownRef.current);
+    };
+  }, [otpResult]);
+  useKeyboard((key) => {
+    if (key.name === "s" && !confirmDelete && (key.eventType === "press" || key.eventType === "repeat")) {
+      setRevealing(true);
+      if (hideTimerRef.current)
+        clearTimeout(hideTimerRef.current);
+      hideTimerRef.current = setTimeout(() => setRevealing(false), 600);
+      return;
+    }
+    if (key.eventType !== "press")
+      return;
+    if (key.name === "escape") {
+      if (confirmDelete) {
+        setConfirmDelete(false);
+        return;
+      }
+      if (otpResult) {
+        setOtpResult(null);
+        return;
+      }
+      onBack();
+      return;
+    }
+    if (key.name === "c" && !confirmDelete) {
+      const toCopy = otpResult ? otpResult.code : detail.value ?? "";
+      if (toCopy) {
+        renderer.copyToClipboardOSC52(toCopy);
+        setCopied(otpResult ? "OTP code" : "Value");
+        setTimeout(() => setCopied(""), 2000);
+      }
+      return;
+    }
+    if (key.name === "e" && !confirmDelete && !otpResult) {
+      onEdit();
+      return;
+    }
+    if (key.name === "d" && !confirmDelete && !otpResult) {
+      setConfirmDelete(true);
+      return;
+    }
+    if (key.name === "o" && isOtp && !confirmDelete) {
+      try {
+        const result = session.generateOtp(detail.name);
+        setOtpResult(result);
+        setError("");
+      } catch (e) {
+        setError(e instanceof Error ? e.message : String(e));
+      }
+      return;
+    }
+    if (key.name === "r" && otpResult) {
+      try {
+        const result = session.generateOtp(detail.name);
+        setOtpResult(result);
+        setError("");
+      } catch (e) {
+        setError(e instanceof Error ? e.message : String(e));
+      }
+      return;
+    }
+  });
+  if (confirmDelete) {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "Delete",
+          subtitle: detail.name
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("box", {
+              border: true,
+              borderStyle: "rounded",
+              borderColor: "#FF4444",
+              padding: 1,
+              flexDirection: "column",
+              gap: 0,
+              children: [
+                /* @__PURE__ */ jsxDEV("text", {
+                  fg: "#FF4444",
+                  children: /* @__PURE__ */ jsxDEV("strong", {
+                    children: "Permanently delete this secret?"
+                  }, undefined, false, undefined, this)
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Name",
+                  value: detail.name,
+                  valueColor: "#FFD700"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Type",
+                  value: detail.type
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this),
+            /* @__PURE__ */ jsxDEV("select", {
+              options: [
+                { name: "Cancel", description: "Keep the secret", value: "cancel" },
+                { name: "Delete forever", description: "Cannot be undone", value: "delete" }
+              ],
+              onSelect: (_i, opt) => {
+                if (opt.value === "delete") {
+                  try {
+                    session.removeSecret(detail.name ?? detail.id);
+                    onDeleted(`"${detail.name}" deleted`);
+                  } catch (e) {
+                    onDeleted(`Error: ${e instanceof Error ? e.message : String(e)}`);
+                  }
+                } else {
+                  setConfirmDelete(false);
+                }
+              },
+              focused: true,
+              height: 4,
+              selectedBackgroundColor: "#222222",
+              selectedTextColor: "#FF4444"
+            }, undefined, false, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "\u2191\u2193 navigate  Enter confirm  Esc cancel"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  let maskedValue = "\u2014";
+  if (detail.value) {
+    maskedValue = revealing ? detail.value : "*".repeat(Math.min(detail.value.length, 32));
+  }
+  const hints = ["Hold s reveal", "c copy", "e edit", "d delete"];
+  if (isOtp)
+    hints.push(otpResult ? "r regen" : "o OTP");
+  hints.push("Esc back");
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    width: "100%",
+    height: "100%",
+    children: [
+      /* @__PURE__ */ jsxDEV(Header, {
+        title: detail.name,
+        subtitle: typeLabel(detail.type)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        flexDirection: "column",
+        flexGrow: 1,
+        padding: 2,
+        gap: 1,
+        children: [
+          /* @__PURE__ */ jsxDEV("box", {
+            flexDirection: "column",
+            border: true,
+            borderStyle: "rounded",
+            borderColor: "#333333",
+            padding: 1,
+            gap: 0,
+            width: "100%",
+            children: [
+              /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Name",
+                value: detail.name,
+                valueColor: "#FFD700"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Type",
+                value: typeLabel(detail.type)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "ID",
+                value: detail.id,
+                valueColor: "#555555"
+              }, undefined, false, undefined, this),
+              detail.username ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Username",
+                value: detail.username
+              }, undefined, false, undefined, this) : null,
+              /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Value",
+                value: maskedValue,
+                valueColor: revealing ? "#00FF00" : "#FF4444"
+              }, undefined, false, undefined, this),
+              detail.metadata?.url ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "URL",
+                value: String(detail.metadata.url)
+              }, undefined, false, undefined, this) : null,
+              detail.metadata?.description ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                label: "Description",
+                value: String(detail.metadata.description)
+              }, undefined, false, undefined, this) : null
+            ]
+          }, undefined, true, undefined, this),
+          /* @__PURE__ */ jsxDEV("text", {
+            fg: revealing ? "#00FF00" : "#666666",
+            children: revealing ? "Revealing \u2014 release [s] to hide" : "Hold [s] to reveal secret value"
+          }, undefined, false, undefined, this),
+          otpResult ? /* @__PURE__ */ jsxDEV("box", {
+            border: true,
+            borderStyle: "rounded",
+            borderColor: "#00CC66",
+            paddingX: 2,
+            height: 3,
+            flexDirection: "row",
+            alignItems: "center",
+            gap: 2,
+            children: [
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#888888",
+                children: "OTP"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#00FF00",
+                children: /* @__PURE__ */ jsxDEV("strong", {
+                  children: otpResult.code
+                }, undefined, false, undefined, this)
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: otpCountdown <= 5 ? "#FF4444" : "#888888",
+                children: otpCountdown > 0 ? `${otpCountdown}s` : "expired"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#555555",
+                children: "[r] refresh"
+              }, undefined, false, undefined, this)
+            ]
+          }, undefined, true, undefined, this) : null,
+          error ? /* @__PURE__ */ jsxDEV("text", {
+            fg: "#FF4444",
+            children: error
+          }, undefined, false, undefined, this) : null,
+          copied ? /* @__PURE__ */ jsxDEV("text", {
+            fg: "#00CC66",
+            children: [
+              copied,
+              " copied to clipboard"
+            ]
+          }, undefined, true, undefined, this) : null,
+          /* @__PURE__ */ jsxDEV("box", {
+            flexDirection: "row",
+            gap: 3,
+            marginTop: 1,
+            children: [
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#00CC66",
+                children: "[c] Copy"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#FFD700",
+                children: "[e] Edit"
+              }, undefined, false, undefined, this),
+              /* @__PURE__ */ jsxDEV("text", {
+                fg: "#FF4444",
+                children: "[d] Delete"
+              }, undefined, false, undefined, this),
+              isOtp ? /* @__PURE__ */ jsxDEV("text", {
+                fg: "#00CCFF",
+                children: "[o] Generate OTP"
+              }, undefined, false, undefined, this) : null
+            ]
+          }, undefined, true, undefined, this)
+        ]
+      }, undefined, true, undefined, this),
+      /* @__PURE__ */ jsxDEV(StatusBar, {
+        message: hints.join("  ")
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function CreateScreen({ session, onDone, onBack }) {
+  const [step, setStep] = useState(0);
+  const [secretType, setSecretType] = useState("password");
+  const [name, setName] = useState("");
+  const [value, setValue] = useState("");
+  const [username, setUsername] = useState("");
+  const [url, setUrl] = useState("");
+  const [description, setDescription] = useState("");
+  const typeOptions = [
+    { name: "Login", description: "Username, password, and URL", value: "password" },
+    { name: "Secure Note", description: "Encrypted text note", value: "note" },
+    { name: "OTP Secret", description: "TOTP key for 2FA codes", value: "otp" }
+  ];
+  const steps = (() => {
+    switch (secretType) {
+      case "password":
+        return ["type", "name", "value", "username", "url", "description"];
+      case "note":
+        return ["type", "name", "value", "description"];
+      case "otp":
+        return ["type", "name", "value", "username", "description"];
+      default:
+        return ["type", "name", "value", "description"];
+    }
+  })();
+  const currentField = steps[step] ?? "description";
+  const totalSteps = steps.length;
+  const label = typeLabel(secretType);
+  const doCreate = useCallback(() => {
+    try {
+      const metadata = Object.fromEntries(Object.entries({
+        description: description || undefined,
+        url: url || undefined
+      }).filter(([, v]) => v !== undefined));
+      session.addSecret({
+        metadata,
+        name,
+        type: secretType,
+        username: username || undefined,
+        value
+      });
+      onDone(`"${name}" created`);
+    } catch (e) {
+      onDone(`Error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }, [session, name, value, secretType, username, url, description, onDone]);
+  useKeyboard((key) => {
+    if (key.eventType !== "press")
+      return;
+    if (key.name === "escape") {
+      if (step > 0)
+        setStep((s) => s - 1);
+      else
+        onBack();
+    }
+  });
+  const progress = `${step + 1}/${totalSteps}`;
+  const nextStep = () => setStep((s) => s + 1);
+  const inputRow = (label2, val, onChange, onSubmit, placeholder) => /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "row",
+    gap: 1,
+    children: [
+      /* @__PURE__ */ jsxDEV("text", {
+        fg: "#AAAAAA",
+        width: 12,
+        children: label2
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("input", {
+        value: val,
+        onChange,
+        onSubmit,
+        placeholder,
+        focused: true,
+        flexGrow: 1,
+        backgroundColor: "#111111",
+        focusedBackgroundColor: "#1a1a1a",
+        textColor: "#FFFFFF"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+  if (step === 0) {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: progress
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          paddingLeft: 2,
+          paddingTop: 1,
+          children: /* @__PURE__ */ jsxDEV("text", {
+            fg: "#888888",
+            children: "What type of secret?"
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          flexGrow: 1,
+          paddingLeft: 2,
+          paddingTop: 1,
+          children: /* @__PURE__ */ jsxDEV("select", {
+            options: typeOptions,
+            onSelect: (_i, opt) => {
+              setSecretType(opt.value ?? "password");
+              nextStep();
+            },
+            focused: true,
+            height: 6,
+            selectedBackgroundColor: "#222222",
+            selectedTextColor: "#FFD700"
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter select  Esc cancel"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "name") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 ${label}`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: "Give it a name"
+            }, undefined, false, undefined, this),
+            inputRow("Name", name, setName, () => {
+              if (name.trim())
+                nextStep();
+            }, "e.g. github-login")
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter next  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "value") {
+    const hint = secretType === "password" ? "Enter the password" : secretType === "otp" ? "Enter the TOTP base32 secret key" : "Enter the note content";
+    const placeholder = secretType === "password" ? "password..." : secretType === "otp" ? "e.g. JBSWY3DPEHPK3PXP" : "note content...";
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 ${name}`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: hint
+            }, undefined, false, undefined, this),
+            inputRow(secretType === "note" ? "Note" : "Value", value, setValue, () => {
+              if (value.trim())
+                nextStep();
+            }, placeholder)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter next  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "username") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 optional`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: "Username or email (optional)"
+            }, undefined, false, undefined, this),
+            inputRow("Username", username, setUsername, nextStep, "skip with Enter")
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter next (empty = skip)  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "url") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 optional`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: "Website URL (optional)"
+            }, undefined, false, undefined, this),
+            inputRow("URL", url, setUrl, nextStep, "e.g. https://github.com")
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter next (empty = skip)  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  if (currentField === "description") {
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: "New Secret",
+          subtitle: `${progress} \xB7 save`
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: "Description (optional) \u2014 Enter to save"
+            }, undefined, false, undefined, this),
+            inputRow("Description", description, setDescription, doCreate, "skip with Enter"),
+            /* @__PURE__ */ jsxDEV("box", {
+              flexDirection: "column",
+              border: true,
+              borderStyle: "rounded",
+              borderColor: "#333333",
+              padding: 1,
+              marginTop: 1,
+              gap: 0,
+              children: [
+                /* @__PURE__ */ jsxDEV("text", {
+                  fg: "#555555",
+                  children: /* @__PURE__ */ jsxDEV("strong", {
+                    children: "Summary"
+                  }, undefined, false, undefined, this)
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Type",
+                  value: label
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Name",
+                  value: name,
+                  valueColor: "#FFD700"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Value",
+                  value: "*".repeat(Math.min(value.length, 20)),
+                  valueColor: "#FF4444"
+                }, undefined, false, undefined, this),
+                username ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "Username",
+                  value: username
+                }, undefined, false, undefined, this) : null,
+                url ? /* @__PURE__ */ jsxDEV(KeyValue, {
+                  label: "URL",
+                  value: url
+                }, undefined, false, undefined, this) : null
+              ]
+            }, undefined, true, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter save  Esc back"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  return null;
+}
+function EditScreen({ session, secret, onDone, onBack }) {
+  let detail;
+  try {
+    detail = session.getSecret(secret.id);
+  } catch {
+    detail = secret;
+  }
+  const secretType = detail.type;
+  const fields = EDIT_FIELDS.filter((f) => f.forTypes.includes(secretType));
+  const [editing, setEditing] = useState(null);
+  const [values, setValues] = useState({
+    name: detail.name,
+    value: detail.value ?? "",
+    username: detail.username ?? "",
+    url: detail.metadata?.url ? String(detail.metadata.url) : "",
+    description: detail.metadata?.description ? String(detail.metadata.description) : ""
+  });
+  const [inputVal, setInputVal] = useState("");
+  const inputValRef = useRef("");
+  const [editGeneration, setEditGeneration] = useState(0);
+  const doSave = useCallback(() => {
+    try {
+      const updates = {};
+      if (values.name !== detail.name)
+        updates.name = values.name;
+      if (values.value !== (detail.value ?? ""))
+        updates.value = values.value;
+      if (values.username !== (detail.username ?? ""))
+        updates.username = values.username;
+      const metaUpdates = {};
+      const oldUrl = detail.metadata?.url ? String(detail.metadata.url) : "";
+      const oldDesc = detail.metadata?.description ? String(detail.metadata.description) : "";
+      if (values.url !== oldUrl)
+        metaUpdates.url = values.url || undefined;
+      if (values.description !== oldDesc)
+        metaUpdates.description = values.description || undefined;
+      if (Object.keys(metaUpdates).length > 0)
+        updates.metadata = metaUpdates;
+      if (Object.keys(updates).length === 0) {
+        onDone("No changes");
+        return;
+      }
+      session.updateSecret(detail.id, updates);
+      onDone(`"${values.name}" updated`);
+    } catch (e) {
+      onDone(`Error: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  }, [values, detail, session, onDone]);
+  useKeyboard((key) => {
+    if (key.eventType !== "press")
+      return;
+    if (key.name === "escape") {
+      if (editing) {
+        setEditing(null);
+      } else {
+        onBack();
+      }
+    }
+    if (key.ctrl && key.name === "s" && !editing) {
+      doSave();
+    }
+  });
+  if (editing) {
+    const fieldDef = fields.find((f) => f.key === editing);
+    return /* @__PURE__ */ jsxDEV("box", {
+      flexDirection: "column",
+      width: "100%",
+      height: "100%",
+      children: [
+        /* @__PURE__ */ jsxDEV(Header, {
+          title: `Edit ${fieldDef?.label ?? editing}`,
+          subtitle: detail.name
+        }, undefined, false, undefined, this),
+        /* @__PURE__ */ jsxDEV("box", {
+          padding: 2,
+          flexDirection: "column",
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsxDEV("text", {
+              fg: "#888888",
+              children: [
+                "Current: ",
+                /* @__PURE__ */ jsxDEV("span", {
+                  fg: "#555555",
+                  children: values[editing] || "(empty)"
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this),
+            /* @__PURE__ */ jsxDEV("box", {
+              flexDirection: "row",
+              gap: 1,
+              children: [
+                /* @__PURE__ */ jsxDEV("text", {
+                  fg: "#AAAAAA",
+                  width: 12,
+                  children: "New value"
+                }, undefined, false, undefined, this),
+                /* @__PURE__ */ jsxDEV("input", {
+                  value: inputVal,
+                  onChange: (v) => {
+                    setInputVal(v);
+                    inputValRef.current = v;
+                  },
+                  onSubmit: () => {
+                    const saved = inputValRef.current;
+                    const field = editing;
+                    if (field) {
+                      setValues((prev) => ({ ...prev, [field]: saved }));
+                    }
+                    setEditing(null);
+                    setInputVal("");
+                    inputValRef.current = "";
+                    setEditGeneration((g) => g + 1);
+                  },
+                  placeholder: values[editing] || "enter new value...",
+                  focused: true,
+                  flexGrow: 1,
+                  backgroundColor: "#111111",
+                  focusedBackgroundColor: "#1a1a1a",
+                  textColor: "#FFFFFF"
+                }, undefined, false, undefined, this)
+              ]
+            }, undefined, true, undefined, this)
+          ]
+        }, undefined, true, undefined, this),
+        /* @__PURE__ */ jsxDEV(StatusBar, {
+          message: "Enter save field  Esc cancel"
+        }, undefined, false, undefined, this)
+      ]
+    }, undefined, true, undefined, this);
+  }
+  const options = fields.map((f) => {
+    let display;
+    if (f.key === "value") {
+      display = values[f.key] ? "***" : "(empty)";
+    } else {
+      display = values[f.key] || "(empty)";
+    }
+    return {
+      name: `${f.label}: ${display}`,
+      description: "Enter to edit",
+      value: f.key
+    };
+  });
+  return /* @__PURE__ */ jsxDEV("box", {
+    flexDirection: "column",
+    width: "100%",
+    height: "100%",
+    children: [
+      /* @__PURE__ */ jsxDEV(Header, {
+        title: "Edit Secret",
+        subtitle: detail.name
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        flexGrow: 1,
+        paddingX: 2,
+        paddingTop: 1,
+        children: /* @__PURE__ */ jsxDEV("select", {
+          options,
+          onSelect: (_i, opt) => {
+            const val = opt.value ?? "";
+            const current = values[val] ?? "";
+            setEditing(val);
+            setInputVal(current);
+            inputValRef.current = current;
+          },
+          focused: true,
+          height: Math.min(options.length * 2 + 1, 14),
+          selectedBackgroundColor: "#222222",
+          selectedTextColor: "#FFD700"
+        }, editGeneration, false, undefined, this)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV("box", {
+        paddingX: 2,
+        paddingBottom: 1,
+        children: /* @__PURE__ */ jsxDEV("box", {
+          border: true,
+          borderStyle: "rounded",
+          borderColor: "#FFD700",
+          paddingX: 2,
+          height: 3,
+          flexDirection: "row",
+          alignItems: "center",
+          gap: 2,
+          onMouseDown: doSave,
+          children: /* @__PURE__ */ jsxDEV("text", {
+            fg: "#FFD700",
+            children: /* @__PURE__ */ jsxDEV("strong", {
+              children: "Ctrl+S Save"
+            }, undefined, false, undefined, this)
+          }, undefined, false, undefined, this)
+        }, undefined, false, undefined, this)
+      }, undefined, false, undefined, this),
+      /* @__PURE__ */ jsxDEV(StatusBar, {
+        message: "Enter edit field  Ctrl+S save  Esc back"
+      }, undefined, false, undefined, this)
+    ]
+  }, undefined, true, undefined, this);
+}
+function App({ vaultPath }) {
+  const [screen, setScreen] = useState("unlock");
+  const [session, setSession] = useState(null);
+  const [selectedSecret, setSelectedSecret] = useState(null);
+  const { toast, show: showToast } = useToast();
+  const [refreshKey, setRefreshKey] = useState(0);
+  const goHome = useCallback(() => {
+    setScreen("home");
+    setSelectedSecret(null);
+    setRefreshKey((k) => k + 1);
+  }, []);
+  const handleDone = useCallback((msg) => {
+    goHome();
+    showToast(msg, msg.startsWith("Error:") ? "error" : "success");
+  }, [goHome, showToast]);
+  if (screen === "unlock") {
+    return /* @__PURE__ */ jsxDEV(UnlockScreen, {
+      vaultPath,
+      onUnlock: (s) => {
+        setSession(s);
+        setScreen("home");
+      }
+    }, undefined, false, undefined, this);
+  }
+  if (!session)
+    return /* @__PURE__ */ jsxDEV("box", {
+      padding: 2,
+      children: /* @__PURE__ */ jsxDEV("text", {
+        fg: "#FF4444",
+        children: "No session."
+      }, undefined, false, undefined, this)
+    }, undefined, false, undefined, this);
+  switch (screen) {
+    case "home":
+      return /* @__PURE__ */ jsxDEV(HomeScreen, {
+        session,
+        onSelect: (s) => {
+          setSelectedSecret(s);
+          setScreen("detail");
+        },
+        onCreate: () => setScreen("create"),
+        toast
+      }, refreshKey, false, undefined, this);
+    case "detail":
+      return selectedSecret ? /* @__PURE__ */ jsxDEV(DetailScreen, {
+        session,
+        secret: selectedSecret,
+        onBack: goHome,
+        onDeleted: handleDone,
+        onEdit: () => setScreen("edit")
+      }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV(HomeScreen, {
+        session,
+        onSelect: (s) => {
+          setSelectedSecret(s);
+          setScreen("detail");
+        },
+        onCreate: () => setScreen("create"),
+        toast
+      }, refreshKey, false, undefined, this);
+    case "edit":
+      return selectedSecret ? /* @__PURE__ */ jsxDEV(EditScreen, {
+        session,
+        secret: selectedSecret,
+        onDone: handleDone,
+        onBack: () => setScreen("detail")
+      }, undefined, false, undefined, this) : /* @__PURE__ */ jsxDEV(HomeScreen, {
+        session,
+        onSelect: (s) => {
+          setSelectedSecret(s);
+          setScreen("detail");
+        },
+        onCreate: () => setScreen("create"),
+        toast
+      }, refreshKey, false, undefined, this);
+    case "create":
+      return /* @__PURE__ */ jsxDEV(CreateScreen, {
+        session,
+        onDone: handleDone,
+        onBack: goHome
+      }, undefined, false, undefined, this);
+    default:
+      return /* @__PURE__ */ jsxDEV(HomeScreen, {
+        session,
+        onSelect: (s) => {
+          setSelectedSecret(s);
+          setScreen("detail");
+        },
+        onCreate: () => setScreen("create"),
+        toast
+      }, refreshKey, false, undefined, this);
+  }
+}
+async function runTui(vaultPath) {
+  const vault = vaultPath ?? defaultVaultPath();
+  const renderer = await createCliRenderer({ exitOnCtrlC: true });
+  createRoot(renderer).render(/* @__PURE__ */ jsxDEV(App, {
+    vaultPath: vault
+  }, undefined, false, undefined, this));
+}
+var EDIT_FIELDS;
+var init_tui = __esm(() => {
+  init_src3();
+  init_os_secrets();
+  EDIT_FIELDS = [
+    { key: "name", label: "Name", forTypes: ["password", "note", "otp"] },
+    { key: "value", label: "Value", forTypes: ["password", "note", "otp"] },
+    { key: "username", label: "Username", forTypes: ["password", "otp"] },
+    { key: "url", label: "URL", forTypes: ["password"] },
+    { key: "description", label: "Description", forTypes: ["password", "note", "otp"] }
+  ];
+});
+
+// apps/cli/src/index.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
+import { createInterface as createInterface2 } from "readline/promises";
+import { resolve as resolve4 } from "path";
+
+// apps/cli/src/password.ts
+import { createInterface } from "readline/promises";
+async function readLine(prompt) {
+  if (!process.stdin.isTTY) {
+    throw new Error("Cannot read input: stdin is not a TTY");
+  }
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(prompt);
+  } finally {
+    rl.close();
+  }
+}
+async function confirm(question, defaultYes = true) {
+  const hint = defaultYes ? "Y/n" : "y/N";
+  const answer = (await readLine(`${question} (${hint}) `)).trim().toLowerCase();
+  if (answer === "")
+    return defaultYes;
+  return answer === "y" || answer === "yes";
+}
+async function readPasswordMasked(prompt = "Master password: ") {
+  if (!process.stdin.isTTY) {
+    throw new Error("Cannot read password: stdin is not a TTY");
+  }
+  process.stdout.write(prompt);
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+  process.stdin.setEncoding("utf8");
+  let password = "";
+  return new Promise((resolve, reject) => {
+    const onData = (char) => {
+      const code = char.charCodeAt(0);
+      if (char === "\r" || char === `
+`) {
+        cleanup();
+        process.stdout.write(`
+`);
+        resolve(password);
+        return;
+      }
+      if (code === 3) {
+        cleanup();
+        process.stdout.write(`
+`);
+        reject(new Error("Password input cancelled"));
+        return;
+      }
+      if (code === 4) {
+        cleanup();
+        process.stdout.write(`
+`);
+        resolve(password);
+        return;
+      }
+      if (code === 127 || code === 8) {
+        if (password.length > 0) {
+          password = password.slice(0, -1);
+          process.stdout.write("\b \b");
+        }
+        return;
+      }
+      if (code === 27)
+        return;
+      if (code >= 32) {
+        password += char;
+        process.stdout.write("*");
+      }
+    };
+    const cleanup = () => {
+      process.stdin.setRawMode(false);
+      process.stdin.pause();
+      process.stdin.removeListener("data", onData);
+    };
+    process.stdin.on("data", onData);
+  });
+}
+
+// packages/core/src/daemon.ts
+init_src();
+init_src2();
+init_src3();
+init_paths();
+init_paths();
+import { createHash, timingSafeEqual } from "crypto";
+import { existsSync as existsSync3, readFileSync as readFileSync3, rmSync } from "fs";
+var DAEMON_TOKEN_SERVICE = "autho.daemon";
+function daemonTokenName(statePath) {
+  return createHash("sha256").update(statePath).digest("hex");
+}
+async function storeDaemonToken(statePath, token) {
+  const tokenName = daemonTokenName(statePath);
+  if (process.env.AUTHO_DISABLE_OS_SECRETS !== "1") {
+    try {
+      await Bun.secrets.set({
+        name: tokenName,
+        service: DAEMON_TOKEN_SERVICE,
+        value: token
+      });
+      return {
+        token: null,
+        tokenName,
+        tokenStorage: "os"
+      };
+    } catch {}
+  }
+  return {
+    token,
+    tokenName: null,
+    tokenStorage: "file"
+  };
+}
+async function resolveDaemonToken(state) {
+  if (state.tokenStorage === "os") {
+    if (!state.tokenName) {
+      throw new Error("Daemon state is missing tokenName for OS secret storage");
+    }
+    const token = await Bun.secrets.get({
+      name: state.tokenName,
+      service: DAEMON_TOKEN_SERVICE
+    });
+    if (!token) {
+      throw new Error("Daemon token not found in OS secret storage");
+    }
+    return token;
+  }
+  if (!state.token) {
+    throw new Error("Daemon state is missing token");
+  }
+  return state.token;
+}
+async function deleteStoredDaemonToken(state) {
+  if (!state || state.tokenStorage !== "os" || !state.tokenName) {
+    return;
+  }
+  try {
+    await Bun.secrets.delete({
+      name: state.tokenName,
+      service: DAEMON_TOKEN_SERVICE
+    });
+  } catch {}
+}
+function readDaemonState(statePath) {
+  if (!existsSync3(statePath)) {
+    return null;
   }
   const stored = JSON.parse(readFileSync3(statePath, "utf8"));
   return {
@@ -1402,6 +3567,8 @@ async function daemonStop(options) {
 }
 
 // apps/cli/src/index.ts
+init_src3();
+init_os_secrets();
 function parseArgs(argv) {
   const dashDashIndex = argv.indexOf("--");
   const main = dashDashIndex === -1 ? argv : argv.slice(0, dashDashIndex);
@@ -1478,7 +3645,7 @@ function output(value, jsonMode = false) {
   console.log(value);
 }
 function absolutePath(path) {
-  return resolve3(path);
+  return resolve4(path);
 }
 function buildSecretMetadata(args) {
   return Object.fromEntries(Object.entries({
@@ -1498,7 +3665,7 @@ async function readBufferedStdin() {
 }
 async function createPromptAdapter() {
   if (process.stdin.isTTY) {
-    const rl = createInterface({
+    const rl = createInterface2({
       input: process.stdin,
       output: process.stdout
     });
@@ -1525,6 +3692,9 @@ async function askPassword(prompt, initial) {
   if (initial) {
     return initial;
   }
+  if (process.stdin.isTTY) {
+    return readPasswordMasked("Master password: ");
+  }
   return prompt.ask("Master password: ");
 }
 async function runPromptMode(vaultPath, initialPassword) {
@@ -1587,6 +3757,128 @@ async function runPromptMode(vaultPath, initialPassword) {
     prompt.close();
   }
 }
+async function resolveUnlockCredentials(vaultPath, args, existingPassword) {
+  let password = existingPassword ?? getString(args, "password") ?? process.env.AUTHO_MASTER_PASSWORD;
+  if (!password) {
+    password = await loadVaultPassword(vaultPath) ?? undefined;
+  }
+  if (!password && process.stdin.isTTY) {
+    password = await readPasswordMasked("Master password: ");
+  }
+  const creds = { password: required(password, "--password") };
+  if (await hasPinSet(vaultPath)) {
+    const pin = process.env.AUTHO_PIN ?? getString(args, "pin") ?? (process.stdin.isTTY ? await readPasswordMasked("PIN: ") : undefined);
+    if (!pin)
+      throw new Error("PIN is set on this vault \u2014 provide it with AUTHO_PIN, --pin, or interactively");
+    const ok = await verifyPin(vaultPath, pin);
+    if (!ok)
+      throw new Error("Wrong PIN");
+  }
+  const authConfig = VaultService.getAuthConfig(vaultPath);
+  if (authConfig?.totp) {
+    const totp = process.env.AUTHO_TOTP_CODE ?? getString(args, "totp") ?? (process.stdin.isTTY ? await readPasswordMasked("Authenticator code: ") : undefined);
+    if (!totp)
+      throw new Error("TOTP is enabled \u2014 provide a 6-digit code with AUTHO_TOTP_CODE, --totp, or interactively");
+    creds.totp = totp;
+  }
+  return creds;
+}
+function osKeychainName() {
+  const p = process.platform;
+  if (p === "darwin")
+    return "macOS Keychain";
+  if (p === "win32")
+    return "Windows Credential Manager";
+  return "Secret Service (libsecret)";
+}
+async function runInitWizard(vaultPath, password, existingCreds) {
+  const creds = existingCreds ?? { password };
+  console.log("");
+  if (!osSecretsDisabled()) {
+    const passwordStored = await loadVaultPassword(vaultPath) !== null;
+    if (passwordStored) {
+      console.log(`\x1B[32m\u2713\x1B[0m Master password is saved in ${osKeychainName()}.`);
+      if (await confirm("  Remove it?", false)) {
+        const deleted = await deleteVaultPassword(vaultPath);
+        console.log(deleted ? "  Removed." : "  Could not remove.");
+      }
+    } else {
+      console.log(`\x1B[33m?\x1B[0m Save master password to ${osKeychainName()}?`);
+      console.log("  This lets all vault commands unlock without prompting on this machine.");
+      if (await confirm("  Save to keychain?")) {
+        const stored = await storeVaultPassword(vaultPath, password);
+        console.log(stored ? "  \x1B[32m\u2713\x1B[0m Saved." : "  Could not save \u2014 OS secret store may be unavailable.");
+      } else {
+        console.log("  Skipped.");
+      }
+    }
+    console.log("");
+  }
+  if (!osSecretsDisabled()) {
+    const pinSet = await hasPinSet(vaultPath);
+    if (pinSet) {
+      console.log("\x1B[32m\u2713\x1B[0m PIN is set on this machine.");
+      if (await confirm("  Remove PIN?", false)) {
+        const pin = await readPasswordMasked("  Enter current PIN: ");
+        const ok = await verifyPin(vaultPath, pin);
+        if (ok) {
+          await deletePin(vaultPath);
+          console.log("  Removed.");
+        } else {
+          console.log("  Wrong PIN, not removed.");
+        }
+      }
+    } else {
+      if (await confirm("Set up a PIN for quick unlock on this machine?", false)) {
+        const newPin = await readPasswordMasked("  New PIN: ");
+        if (!newPin) {
+          console.log("  PIN cannot be empty, skipped.");
+        } else {
+          const confirmPin = await readPasswordMasked("  Confirm PIN: ");
+          if (newPin !== confirmPin) {
+            console.log("  PINs do not match, skipped.");
+          } else {
+            await storePinHash(vaultPath, newPin);
+            console.log("  \x1B[32m\u2713\x1B[0m PIN set.");
+          }
+        }
+      }
+    }
+    console.log("");
+  }
+  const authConfig = VaultService.getAuthConfig(vaultPath);
+  const totpEnabled = authConfig?.totp !== undefined;
+  if (totpEnabled) {
+    console.log("\x1B[32m\u2713\x1B[0m TOTP is enabled (authenticator app required to unlock).");
+    if (await confirm("  Disable TOTP?", false)) {
+      const code = await readPasswordMasked("  Enter current TOTP code: ");
+      try {
+        VaultService.removeTotp(vaultPath, { ...creds, totp: code });
+        console.log("  Disabled.");
+      } catch (e) {
+        console.log(`  Error: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+  } else {
+    if (await confirm("Enable TOTP (authenticator app verification)?", false)) {
+      const { secret, uri } = VaultService.setupTotp(vaultPath);
+      console.log("");
+      console.log(`  Secret: ${secret}`);
+      console.log(`  URI:    ${uri}`);
+      console.log("");
+      console.log("  Add this to your authenticator app, then enter the 6-digit code.");
+      const code = await readPasswordMasked("  Code: ");
+      try {
+        VaultService.enableTotp(vaultPath, creds, secret, code);
+        console.log("  \x1B[32m\u2713\x1B[0m TOTP enabled.");
+      } catch (e) {
+        console.log(`  Error: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+  }
+  console.log("");
+  console.log("Setup complete. Run \x1B[1mautho init\x1B[0m anytime to change these settings.");
+}
 async function runWebServer(vaultPath, args) {
   const commandArgs = [
     "run",
@@ -1620,44 +3912,73 @@ async function runWebServer(vaultPath, args) {
 }
 function help() {
   return [
-    "Autho Bun CLI",
+    "Autho \u2013 Local-first secret manager for humans and coding agents",
+    "",
+    "Usage:",
+    "  autho                  Open interactive TUI (terminal UI)",
+    "  autho <command>        Run a CLI command (see below)",
     "",
     "Commands:",
-    "  prompt [--password <value>] [--vault <path>]",
-    "  init --password <value> [--vault <path>]",
-    "  status [--password <value>] [--vault <path>] [--project-file <path>] [--json]",
-    "  project init --map <ENV_NAME=secretRef> [--map <ENV_NAME=secretRef>] [--output <path>] [--force] [--json]",
+    "  prompt [--vault <path>]",
+    "  init [--vault <path>]",
+    "  status [--vault <path>] [--project-file <path>] [--json]",
+    "  project init --map <ENV=ref> [--output <path>] [--force] [--json]",
     "  web serve [--vault <path>] [--host <value>] [--port <value>]",
     "  daemon serve [--vault <path>] [--state-file <path>] [--host <value>] [--port <value>]",
     "  daemon status [--state-file <path>] [--json]",
-    "  daemon unlock --password <value> [--ttl <seconds>] [--state-file <path>] [--json]",
+    "  daemon unlock [--ttl <seconds>] [--state-file <path>] [--json]",
     "  daemon lock --session <id> [--state-file <path>] [--json]",
     "  daemon stop [--state-file <path>] [--json]",
-    "  daemon env render --session <id> --map <ENV_NAME=secretRef> [--project-file <path>] [--lease <lease-id>] [--state-file <path>] [--json]",
-    "  daemon exec --session <id> --map <ENV_NAME=secretRef> [--project-file <path>] [--lease <lease-id>] [--state-file <path>] -- <command>",
-    "  import legacy --password <value> --file <path> [--skip-existing] [--vault <path>] [--json]",
-    "  secrets add --password <value> --name <name> --type <password|note|otp> --value <value> [--username <value>] [--url <value>] [--description <value>] [--digits <value>] [--algorithm <value>] [--vault <path>]",
-    "  secrets list --password <value> [--vault <path>] [--json]",
-    "  secrets get --password <value> --ref <name-or-id> [--vault <path>] [--json]",
-    "  secrets rm --password <value> --ref <name-or-id> [--vault <path>] [--json]",
-    "  otp code --password <value> --ref <name-or-id> [--vault <path>] [--json]",
-    "  lease create --password <value> --secret <name-or-id> [--secret <name-or-id>] --ttl <seconds> [--name <value>] [--vault <path>] [--json]",
-    "  lease revoke --password <value> --lease <lease-id> [--vault <path>] [--json]",
-    "  env render --password <value> --map <ENV_NAME=secretRef> [--map <ENV_NAME=secretRef>] [--project-file <path>] [--lease <lease-id>] [--vault <path>] [--json]",
-    "  env sync --password <value> --map <ENV_NAME=secretRef> [--project-file <path>] [--lease <lease-id>] [--ttl <seconds>] [--output <path>] [--force] [--vault <path>] [--json]",
-    "  exec --password <value> --map <ENV_NAME=secretRef> [--project-file <path>] [--lease <lease-id>] [--vault <path>] -- <command>",
-    "  file encrypt --password <value> --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
-    "  file decrypt --password <value> --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
-    "  files encrypt --password <value> --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
-    "  files decrypt --password <value> --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
-    "  audit list --password <value> [--limit <number>] [--vault <path>] [--json]",
+    "  daemon env render --session <id> --map <ENV=ref> [--project-file <path>] [--lease <id>] [--state-file <path>] [--json]",
+    "  daemon exec --session <id> --map <ENV=ref> [--project-file <path>] [--lease <id>] [--state-file <path>] -- <cmd>",
+    "  import legacy --file <path> [--skip-existing] [--vault <path>] [--json]",
+    "  secrets add --name <name> --type <password|note|otp> --value <value> [--username <v>] [--url <v>] [--description <v>] [--digits <v>] [--algorithm <v>] [--vault <path>]",
+    "  secrets list [--vault <path>] [--json]",
+    "  secrets get --ref <name-or-id> [--vault <path>] [--json]",
+    "  secrets rm --ref <name-or-id> [--vault <path>] [--json]",
+    "  secrets edit --ref <name-or-id> [--new-name <v>] [--value <v>] [--username <v>] [--url <v>] [--description <v>] [--vault <path>] [--json]",
+    "  otp code --ref <name-or-id> [--vault <path>] [--json]",
+    "  lease create --secret <ref> [--secret <ref>] --ttl <seconds> [--name <v>] [--vault <path>] [--json]",
+    "  lease revoke --lease <id> [--vault <path>] [--json]",
+    "  env render --map <ENV=ref> [--project-file <path>] [--lease <id>] [--vault <path>] [--json]",
+    "  env sync --map <ENV=ref> [--project-file <path>] [--lease <id>] [--ttl <seconds>] [--output <path>] [--force] [--vault <path>] [--json]",
+    "  exec --map <ENV=ref> [--project-file <path>] [--lease <id>] [--vault <path>] -- <cmd>",
+    "  file encrypt --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
+    "  file decrypt --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
+    "  files encrypt --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
+    "  files decrypt --input <path> [--output <path>] [--force] [--vault <path>] [--json]",
+    "  audit list [--limit <number>] [--vault <path>] [--json]",
+    "  recovery generate --output <path> [--vault <path>] [--json]",
+    "  recovery revoke [--vault <path>] [--json]",
+    "  unlock --recovery-file <path> [--vault <path>] [--json]",
+    "  os-secrets set --name <name> [--value <value>] [--json]",
+    "  os-secrets get --name <name> [--json]",
+    "  os-secrets delete --name <name> [--json]",
+    "",
+    "Authentication:",
+    "  When running interactively (TTY), you will be securely prompted for your",
+    "  master password with masked input (no --password flag needed).",
+    "",
+    "  For automation and coding agents, use one of:",
+    "    autho init                        Setup wizard \u2014 choose to save password in OS keychain, set PIN, enable TOTP",
+    "    AUTHO_MASTER_PASSWORD=<value>    Environment variable (master password)",
+    "    AUTHO_PIN=<value>                Environment variable (PIN, if set on this machine)",
+    "    AUTHO_TOTP_CODE=<value>          Environment variable (TOTP code, if enabled)",
+    "    --password <value>               CLI flag (visible in shell history - avoid!)",
+    "",
+    "  Native OS secret store support (via Bun.secrets):",
+    "    macOS   \u2192 Keychain Services",
+    "    Linux   \u2192 libsecret / GNOME Keyring / KWallet",
+    "    Windows \u2192 Windows Credential Manager",
+    "",
+    "  The OS secret store is checked automatically before prompting.",
+    "  Set AUTHO_DISABLE_OS_SECRETS=1 to opt out.",
     "",
     "Notes:",
-    "  Running `autho` with no command enters interactive prompt mode.",
-    "  The default vault path is ~/.autho/vault.db (or AUTHO_HOME/vault.db).",
-    "  The default project file is ~/.autho/project.json when it exists (or AUTHO_HOME/project.json).",
-    "  The default daemon state file is ~/.autho/daemon.json (or AUTHO_HOME/daemon.json).",
-    "  AUTHO_MASTER_PASSWORD can be used instead of --password."
+    "  Running `autho` with no arguments opens the interactive TUI.",
+    "  The default vault path is ~/.autho/vault.db (override with AUTHO_HOME).",
+    "  The default project file is ~/.autho/project.json.",
+    "  The default daemon state file is ~/.autho/daemon.json."
   ].join(`
 `);
 }
@@ -1670,8 +3991,16 @@ async function main() {
   const explicitProjectFile = getString(args, "project-file");
   const fallbackProjectFile = defaultProjectFilePath();
   const projectFile = explicitProjectFile ?? (existsSync4(fallbackProjectFile) ? fallbackProjectFile : undefined);
-  const password = getString(args, "password") ?? process.env.AUTHO_MASTER_PASSWORD;
+  let password = getString(args, "password") ?? process.env.AUTHO_MASTER_PASSWORD;
+  if (!password) {
+    password = await loadVaultPassword(vaultPath) ?? undefined;
+  }
   if (!scope) {
+    if (process.stdin.isTTY) {
+      const { runTui: runTui2 } = await Promise.resolve().then(() => (init_tui(), exports_tui));
+      await runTui2(vaultPath);
+      return;
+    }
     await runPromptMode(vaultPath, password);
     return;
   }
@@ -1683,8 +4012,41 @@ async function main() {
     await runPromptMode(vaultPath, password);
     return;
   }
+  if (!password && process.stdin.isTTY) {
+    const needsPassword = [
+      "secrets",
+      "otp",
+      "lease",
+      "env",
+      "exec",
+      "file",
+      "files",
+      "audit",
+      "import",
+      "recovery",
+      "unlock"
+    ].includes(scope);
+    const daemonNeedsPassword = scope === "daemon" && action === "unlock";
+    if (needsPassword || daemonNeedsPassword) {
+      password = await readPasswordMasked("Master password: ");
+    }
+  }
   if (scope === "init") {
-    output(VaultService.initialize(vaultPath, required(password, "--password")), jsonMode);
+    const existingStatus = VaultService.status(vaultPath);
+    if (!existingStatus.initialized) {
+      const pw = required(password, "--password");
+      output(VaultService.initialize(vaultPath, pw), jsonMode);
+      if (process.stdin.isTTY && !jsonMode) {
+        await runInitWizard(vaultPath, pw);
+      }
+    } else {
+      const creds2 = await resolveUnlockCredentials(vaultPath, args, password);
+      if (process.stdin.isTTY && !jsonMode) {
+        await runInitWizard(vaultPath, creds2.password, creds2);
+      } else {
+        console.log("Vault already initialized. Use interactive mode (TTY) to reconfigure.");
+      }
+    }
     return;
   }
   if (scope === "status") {
@@ -1702,6 +4064,31 @@ async function main() {
     }), jsonMode);
     return;
   }
+  if (scope === "os-secrets" && action === "set") {
+    const name = required(getString(args, "name"), "--name");
+    const value = getString(args, "value") ?? await readPasswordMasked(`Value for "${name}": `);
+    const stored = await setOsSecret(name, value);
+    if (!stored) {
+      throw new Error("OS secret store is unavailable on this system (try AUTHO_DISABLE_OS_SECRETS=1 to confirm, or check that a secret service daemon is running on Linux)");
+    }
+    output({ name, stored: true }, jsonMode);
+    return;
+  }
+  if (scope === "os-secrets" && action === "get") {
+    const name = required(getString(args, "name"), "--name");
+    const value = await getOsSecret(name);
+    if (value === null) {
+      throw new Error(`Secret "${name}" not found in OS secret store`);
+    }
+    output({ name, value }, jsonMode);
+    return;
+  }
+  if (scope === "os-secrets" && action === "delete") {
+    const name = required(getString(args, "name"), "--name");
+    const deleted = await deleteOsSecret(name);
+    output({ deleted, name }, jsonMode);
+    return;
+  }
   if (scope === "web" && action === "serve") {
     await runWebServer(vaultPath, args);
     return;
@@ -1759,7 +4146,44 @@ async function main() {
     process.stderr.write(result.stderr);
     process.exit(result.exitCode);
   }
-  const session = VaultService.unlock(vaultPath, required(password, "--password"));
+  if (scope === "recovery" && action === "generate") {
+    const outputPath = absolutePath(required(getString(args, "output"), "--output"));
+    const creds2 = await resolveUnlockCredentials(vaultPath, args, password);
+    const { fileContent } = VaultService.generateRecovery(vaultPath, creds2);
+    writeFileSync2(outputPath, fileContent, { encoding: "utf8", mode: 384 });
+    if (!jsonMode) {
+      console.log(`Recovery file written to ${outputPath}`);
+      console.log("WARNING: Anyone with this file can open your vault. Store it offline.");
+    } else {
+      output({ outputPath, written: true }, jsonMode);
+    }
+    return;
+  }
+  if (scope === "recovery" && action === "revoke") {
+    const creds2 = await resolveUnlockCredentials(vaultPath, args, password);
+    VaultService.revokeRecovery(vaultPath, creds2);
+    output({ revoked: true }, jsonMode);
+    return;
+  }
+  if (scope === "unlock" && getString(args, "recovery-file")) {
+    const recoveryFilePath = absolutePath(getString(args, "recovery-file"));
+    const content = readFileSync4(recoveryFilePath, "utf8");
+    const lines = content.split(`
+`);
+    const tokenLineIdx = lines.findIndex((l) => l.trim() === "RECOVERY TOKEN:");
+    if (tokenLineIdx === -1)
+      throw new Error("Invalid recovery file format");
+    const rawTokenLine = lines.slice(tokenLineIdx + 1).find((l) => l.trim() !== "") ?? "";
+    const token = rawTokenLine.replace(/-/g, "").toLowerCase();
+    if (!token)
+      throw new Error("Invalid recovery file format: missing token");
+    const recoverySession = VaultService.unlock(vaultPath, { password: "", recovery: token });
+    output({ unlocked: true, vaultPath }, jsonMode);
+    recoverySession.close();
+    return;
+  }
+  const creds = await resolveUnlockCredentials(vaultPath, args, password);
+  const session = VaultService.unlock(vaultPath, creds);
   try {
     if (scope === "import" && action === "legacy") {
       output(session.importLegacyFile(absolutePath(required(getString(args, "file"), "--file")), {
@@ -1791,6 +4215,23 @@ async function main() {
       output(session.removeSecret(required(ref, "--ref")), jsonMode);
       return;
     }
+    if (scope === "secrets" && action === "edit") {
+      const ref = getString(args, "ref") ?? getString(args, "name") ?? getString(args, "id");
+      const updates = {};
+      if (getString(args, "new-name"))
+        updates.name = getString(args, "new-name");
+      if (getString(args, "value"))
+        updates.value = getString(args, "value");
+      if (getString(args, "username"))
+        updates.username = getString(args, "username");
+      if (getString(args, "type"))
+        updates.type = getString(args, "type");
+      const meta = buildSecretMetadata(args);
+      if (Object.keys(meta).length > 0)
+        updates.metadata = meta;
+      output(session.updateSecret(required(ref, "--ref"), updates), jsonMode);
+      return;
+    }
     if (scope === "otp" && action === "code") {
       const ref = getString(args, "ref") ?? getString(args, "name") ?? getString(args, "id");
       output(session.generateOtp(required(ref, "--ref")), jsonMode);