autho 3.0.4 → 3.0.6

package/dist/autho.js

@@ -590,7 +590,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "autho",
-    version: "3.0.4",
+    version: "3.0.6",
     description: "Local-first secret manager for humans and coding agents, rebuilt on Bun",
     type: "module",
     bin: {
@@ -4105,7 +4105,7 @@ var init_palette = __esm(() => {
 // apps/cli/src/tui/settings.tsx
 import { existsSync as existsSync5, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3, resolve as resolve4 } from "path";
+import { dirname as dirname3, join as join3, resolve as resolve5 } from "path";
 import { useKeyboard as useKeyboard4, useTerminalDimensions as useTerminalDimensions3 } from "@opentui/react";
 import { useCallback, useEffect as useEffect4, useMemo as useMemo3, useRef as useRef5, useState as useState4 } from "react";
 import { jsx as jsx4, jsxs as jsxs4, Fragment } from "@opentui/react/jsx-runtime";
@@ -4372,7 +4372,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
         return;
       case "vaultDir": {
         const config = { ...loadConfig() };
-        const target = first.trim() ? resolve4(first.trim()).replace(/\\/g, "/") : null;
+        const target = first.trim() ? resolve5(first.trim()).replace(/\\/g, "/") : null;
         if (target)
           config.vaultDir = target;
         else
@@ -4440,7 +4440,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
         registerPasskey(first.trim());
         return;
       case "recoveryPath": {
-        const target = resolve4(first.trim() || join3(homedir2(), "autho-recovery.txt"));
+        const target = resolve5(first.trim() || join3(homedir2(), "autho-recovery.txt"));
         if (existsSync5(target)) {
           setError("That file already exists \u2014 pick another name");
           return;
@@ -5305,24 +5305,203 @@ var init_unlock = __esm(() => {
   init_theme();
 });
 
-// apps/cli/src/tui/vault.tsx
+// apps/cli/src/tui/links.tsx
 import { useKeyboard as useKeyboard6, useTerminalDimensions as useTerminalDimensions4 } from "@opentui/react";
-import { useCallback as useCallback3, useEffect as useEffect6, useMemo as useMemo5, useState as useState6 } from "react";
-import { jsx as jsx6, jsxs as jsxs6, Fragment as Fragment2 } from "@opentui/react/jsx-runtime";
+import { useMemo as useMemo5, useRef as useRef7, useState as useState6 } from "react";
+import { jsx as jsx6, jsxs as jsxs6 } from "@opentui/react/jsx-runtime";
+function LinkPicker({ primary, entries, linkedIds, onToggle, onClose }) {
+  const { width, height } = useTerminalDimensions4();
+  const [query, setQuery] = useState6("");
+  const [index, setIndex] = useState6(0);
+  const latestQuery = useRef7("");
+  const candidates = useMemo5(() => entries.filter((e) => e.id !== primary.id), [entries, primary.id]);
+  const search = (q) => fuzzyFilter(candidates, q, (e) => [e.name, e.username, e.url, typeLabel(e.type)]);
+  const results = useMemo5(() => search(query), [candidates, query]);
+  const current = Math.min(index, Math.max(0, results.length - 1));
+  useKeyboard6((key) => {
+    if (key.name === "escape") {
+      key.preventDefault();
+      onClose();
+      return;
+    }
+    if (key.name === "up") {
+      key.preventDefault();
+      setIndex(Math.max(0, current - 1));
+      return;
+    }
+    if (key.name === "down") {
+      key.preventDefault();
+      setIndex(Math.min(results.length - 1, current + 1));
+      return;
+    }
+    if (key.name === "pageup") {
+      key.preventDefault();
+      setIndex(Math.max(0, current - 10));
+      return;
+    }
+    if (key.name === "pagedown") {
+      key.preventDefault();
+      setIndex(Math.min(results.length - 1, current + 10));
+      return;
+    }
+    if (isEnter(key)) {
+      key.preventDefault();
+      const fresh = latestQuery.current === query ? results : search(latestQuery.current);
+      const entry = fresh[latestQuery.current === query ? current : 0];
+      if (entry)
+        onToggle(entry);
+    }
+  });
+  const boxWidth = Math.min(72, Math.max(30, width - 4));
+  const rows = Math.max(3, Math.min(14, height - 8));
+  const offset = Math.max(0, Math.min(current - Math.floor(rows / 2), results.length - rows));
+  const visible = results.slice(offset, offset + rows);
+  const inner = boxWidth - 4;
+  return /* @__PURE__ */ jsx6("box", {
+    position: "absolute",
+    top: 2,
+    left: Math.max(0, Math.floor((width - boxWidth) / 2)),
+    width: boxWidth,
+    zIndex: 100,
+    children: /* @__PURE__ */ jsxs6("box", {
+      flexDirection: "column",
+      border: true,
+      borderStyle: "rounded",
+      borderColor: theme.borderFocus,
+      backgroundColor: theme.panel,
+      paddingX: 1,
+      title: ` Link to ${truncate(primary.name, 40)} `,
+      titleColor: theme.accent,
+      titleAlignment: "center",
+      children: [
+        /* @__PURE__ */ jsxs6("box", {
+          flexDirection: "row",
+          height: 1,
+          gap: 1,
+          children: [
+            /* @__PURE__ */ jsx6("text", {
+              fg: theme.accent,
+              children: /* @__PURE__ */ jsx6("strong", {
+                children: "\u203A"
+              })
+            }),
+            /* @__PURE__ */ jsx6(TextField, {
+              value: query,
+              onChange: (v) => {
+                latestQuery.current = v;
+                setQuery(v);
+                setIndex(0);
+              },
+              focused: true,
+              placeholder: "search secrets to link"
+            })
+          ]
+        }),
+        /* @__PURE__ */ jsxs6("box", {
+          flexDirection: "column",
+          marginTop: 1,
+          children: [
+            visible.length === 0 ? /* @__PURE__ */ jsx6("text", {
+              fg: theme.dim,
+              children: "No matching secrets"
+            }) : null,
+            visible.map((entry, i) => {
+              const on = offset + i === current;
+              const linked = linkedIds.has(entry.id);
+              const badge = typeBadge(entry.type);
+              const name = truncate(entry.name, Math.max(4, inner - 6));
+              return /* @__PURE__ */ jsx6("box", {
+                flexDirection: "row",
+                height: 1,
+                backgroundColor: on ? theme.selection : undefined,
+                onMouseDown: (event) => {
+                  event.preventDefault();
+                  onToggle(entry);
+                },
+                onMouseOver: () => setIndex(offset + i),
+                children: /* @__PURE__ */ jsxs6("text", {
+                  children: [
+                    /* @__PURE__ */ jsx6("span", {
+                      fg: linked ? theme.success : theme.dim,
+                      children: linked ? " \u2713 " : "   "
+                    }),
+                    /* @__PURE__ */ jsxs6("span", {
+                      fg: badge.color,
+                      children: [
+                        badge.glyph,
+                        " "
+                      ]
+                    }),
+                    on ? /* @__PURE__ */ jsx6("strong", {
+                      fg: theme.accent,
+                      children: name
+                    }) : /* @__PURE__ */ jsx6("span", {
+                      fg: theme.text,
+                      children: name
+                    })
+                  ]
+                })
+              }, entry.id);
+            })
+          ]
+        }),
+        /* @__PURE__ */ jsxs6("text", {
+          marginTop: 1,
+          children: [
+            /* @__PURE__ */ jsx6(Chip, {
+              label: "\u2191\u2193"
+            }),
+            /* @__PURE__ */ jsx6("span", {
+              fg: theme.muted,
+              children: " move  "
+            }),
+            /* @__PURE__ */ jsx6(Chip, {
+              label: "enter"
+            }),
+            /* @__PURE__ */ jsx6("span", {
+              fg: theme.muted,
+              children: " link/unlink  "
+            }),
+            /* @__PURE__ */ jsx6(Chip, {
+              label: "esc"
+            }),
+            /* @__PURE__ */ jsx6("span", {
+              fg: theme.muted,
+              children: " done"
+            })
+          ]
+        })
+      ]
+    })
+  });
+}
+var init_links = __esm(() => {
+  init_components();
+  init_theme();
+  init_util();
+});
+
+// apps/cli/src/tui/vault.tsx
+import { useKeyboard as useKeyboard7, useTerminalDimensions as useTerminalDimensions5 } from "@opentui/react";
+import { useCallback as useCallback3, useEffect as useEffect6, useMemo as useMemo6, useState as useState7 } from "react";
+import { jsx as jsx7, jsxs as jsxs7, Fragment as Fragment2 } from "@opentui/react/jsx-runtime";
 function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings, setHints, revealMs }) {
   const app = useApp();
-  const { width, height } = useTerminalDimensions4();
+  const { width, height } = useTerminalDimensions5();
   const wide = width >= WIDE_MIN_COLUMNS;
-  const [entries, setEntries] = useState6([]);
-  const [query, setQuery] = useState6("");
-  const [pane, setPane] = useState6("list");
-  const [actionIndex, setActionIndex] = useState6(0);
+  const [entries, setEntries] = useState7([]);
+  const [query, setQuery] = useState7("");
+  const [pane, setPane] = useState7("list");
+  const [actionIndex, setActionIndex] = useState7(0);
   const searchFocused = pane === "search";
-  const [selectedId, setSelectedId] = useState6(initialSelectedId ?? null);
-  const [detailOpen, setDetailOpen] = useState6(false);
-  const [revealed, setRevealed] = useState6(null);
-  const [otp, setOtp] = useState6(null);
-  const [confirmDelete, setConfirmDelete] = useState6(false);
+  const [selectedId, setSelectedId] = useState7(initialSelectedId ?? null);
+  const [detailOpen, setDetailOpen] = useState7(false);
+  const [revealed, setRevealed] = useState7(null);
+  const [otp, setOtp] = useState7(null);
+  const [confirmDelete, setConfirmDelete] = useState7(false);
+  const [links, setLinks] = useState7(null);
+  const [linkPickerOpen, setLinkPickerOpen] = useState7(false);
+  const [linkedOtp, setLinkedOtp] = useState7(null);
   const reload = useCallback3(() => {
     try {
       setEntries(session.listSecretIndex());
@@ -5332,7 +5511,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     }
   }, [session, app]);
   useEffect6(reload, [reload]);
-  const filtered = useMemo5(() => fuzzyFilter(entries, query, (e) => [e.name, e.username, e.url, e.description, typeLabel(e.type)]), [entries, query]);
+  const filtered = useMemo6(() => fuzzyFilter(entries, query, (e) => [e.name, e.username, e.url, e.description, typeLabel(e.type)]), [entries, query]);
   const selectedIndex = Math.max(0, filtered.findIndex((e) => e.id === selectedId));
   const selected = filtered[selectedIndex] ?? null;
   useEffect6(() => {
@@ -5343,10 +5522,25 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
   useEffect6(() => {
     setRevealed((r) => r && r.id !== selected?.id ? null : r);
     setOtp((o) => o && o.id !== selected?.id ? null : o);
+    setLinkedOtp(null);
     setConfirmDelete(false);
     setActionIndex(0);
   }, [selected?.id]);
-  const now = useNow(1000, Boolean(revealed || otp));
+  const loadLinks = useCallback3((id) => {
+    if (!id) {
+      setLinks(null);
+      return;
+    }
+    try {
+      setLinks(session.getLinks(id));
+    } catch (e) {
+      app.toast(e instanceof Error ? e.message : String(e), "error");
+      setLinks(null);
+    }
+  }, [session, app]);
+  useEffect6(() => loadLinks(selected?.id), [loadLinks, selected?.id, selected?.linkCount]);
+  const linkedOtpSecret = links?.links.find((l) => l.type === "otp") ?? null;
+  const now = useNow(1000, Boolean(revealed || otp || linkedOtp));
   useEffect6(() => {
     if (revealed && now >= revealed.until) {
       setRevealed(null);
@@ -5360,22 +5554,56 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       return null;
     }
   }, [session, app]);
-  const generateOtp = useCallback3((entry, options) => {
+  const makeOtp = useCallback3((id, options) => {
     try {
-      const result = session.generateOtp(entry.id, options);
-      const next = { id: entry.id, code: result.code, expiresAt: Date.parse(result.expiresAt) };
-      setOtp(next);
-      return next;
+      const result = session.generateOtp(id, options);
+      return { id, code: result.code, expiresAt: Date.parse(result.expiresAt) };
     } catch (e) {
       app.toast(e instanceof Error ? e.message : String(e), "error");
       return null;
     }
   }, [session, app]);
+  const generateOtp = useCallback3((entry, options) => {
+    const next = makeOtp(entry.id, options);
+    if (next)
+      setOtp(next);
+    return next;
+  }, [makeOtp]);
   useEffect6(() => {
     if (otp && selected && otp.id === selected.id && now >= otp.expiresAt) {
       generateOtp(selected, { audit: false });
     }
   }, [now, otp, selected, generateOtp]);
+  useEffect6(() => {
+    if (linkedOtp && linkedOtp.id === linkedOtpSecret?.id && now >= linkedOtp.expiresAt) {
+      setLinkedOtp(makeOtp(linkedOtp.id, { audit: false }));
+    }
+  }, [now, linkedOtp, linkedOtpSecret?.id, makeOtp]);
+  const copyLinkedOtp = useCallback3(() => {
+    if (!linkedOtpSecret) {
+      app.toast("No OTP linked to this secret", "info");
+      return;
+    }
+    const code = makeOtp(linkedOtpSecret.id);
+    if (!code)
+      return;
+    setLinkedOtp(code);
+    app.copy("OTP code", code.code, { secret: true });
+  }, [app, linkedOtpSecret, makeOtp]);
+  const toggleLink = useCallback3((primary, target) => {
+    const linked = links?.links.some((l) => l.id === target.id) ?? false;
+    try {
+      if (linked)
+        session.unlinkSecrets(primary.id, target.id);
+      else
+        session.linkSecrets(primary.id, target.id);
+      app.toast(linked ? `Unlinked ${target.name}` : `Linked ${target.name}`, "info");
+    } catch (e) {
+      app.toast(e instanceof Error ? e.message : String(e), "error");
+    }
+    reload();
+    loadLinks(primary.id);
+  }, [links, session, app, reload, loadLinks]);
   const copyPrimary = useCallback3((entry) => {
     if (!entry)
       return;
@@ -5418,10 +5646,12 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       setRevealed({ id: entry.id, value, until: Date.now() + revealMs });
     }
   }, [revealed, readValue, revealMs]);
-  const remove = useCallback3((entry) => {
+  const remove = useCallback3((entry, withLinked = false) => {
     try {
-      session.removeSecret(entry.id);
-      app.toast(`Deleted "${entry.name}"`);
+      const { removedLinked, keptLinked } = session.removeSecret(entry.id, { withLinked });
+      const also = removedLinked.length ? ` and ${removedLinked.map((l) => l.name).join(", ")}` : "";
+      const kept = keptLinked.length ? ` \xB7 kept ${keptLinked.map((l) => l.name).join(", ")} (linked elsewhere)` : "";
+      app.toast(`Deleted "${entry.name}"${also}${kept}`);
       setConfirmDelete(false);
       setDetailOpen(false);
       setPane("list");
@@ -5451,6 +5681,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     ...selected.type !== "otp" ? [{ id: "reveal", hotkey: "s", label: revealed?.id === selected.id ? "hide" : "reveal", color: theme.revealed, run: () => toggleReveal(selected) }] : [],
     ...selected.url && selected.type !== "otp" ? [{ id: "open", hotkey: "o", label: "open", color: theme.info, run: () => open(selected) }] : [],
     { id: "edit", hotkey: "e", label: "edit", color: theme.accent, run: () => onEdit(selected.id) },
+    { id: "link", hotkey: "L", label: "link", color: theme.info, run: () => setLinkPickerOpen(true) },
     { id: "delete", hotkey: "d", label: "delete", color: theme.danger, run: () => setConfirmDelete(true) }
   ] : [];
   const currentAction = Math.min(actionIndex, Math.max(0, actions.length - 1));
@@ -5472,13 +5703,15 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     while (PANES[index] === "actions" && !selected);
     focusPane(PANES[index]);
   };
-  useKeyboard6((key) => {
-    if (!app.active || key.ctrl || key.meta)
+  useKeyboard7((key) => {
+    if (!app.active || key.ctrl || key.meta || linkPickerOpen)
       return;
     if (confirmDelete) {
       key.preventDefault();
       if ((key.name === "y" || isEnter(key)) && selected)
         remove(selected);
+      else if (key.name === "a" && selected && links?.links.length)
+        remove(selected, true);
       else if (key.name === "n" || key.name === "escape")
         setConfirmDelete(false);
       return;
@@ -5498,6 +5731,10 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       }
       return;
     }
+    if (key.name === "l" && key.shift && selected) {
+      setLinkPickerOpen(true);
+      return;
+    }
     switch (key.name) {
       case "up":
       case "k":
@@ -5611,13 +5848,16 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       case "e":
         onEdit(selected.id);
         return;
+      case "t":
+        copyLinkedOtp();
+        return;
       case "d":
       case "delete":
         setConfirmDelete(true);
         return;
     }
   });
-  const commands = useMemo5(() => {
+  const commands = useMemo6(() => {
     const list = [
       { id: "new", title: "New secret", hint: "n", group: "Vault", run: onCreate },
       { id: "search", title: "Search secrets", hint: "/", group: "Vault", run: () => setPane("search") },
@@ -5625,11 +5865,26 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     ];
     if (selected) {
       const name = selected.name;
-      list.unshift({ id: "copy", title: `Copy ${selected.type === "otp" ? "OTP code" : selected.type === "note" ? "note" : "password"} \u2014 ${name}`, hint: "c / enter", group: "Selected", run: () => copyPrimary(selected) }, { id: "copy-user", title: `Copy username \u2014 ${name}`, hint: "u", group: "Selected", run: () => copyUsername(selected) }, { id: "reveal", title: `${revealed ? "Hide" : "Reveal"} value \u2014 ${name}`, hint: "s", group: "Selected", run: () => toggleReveal(selected) }, { id: "edit", title: `Edit \u2014 ${name}`, hint: "e", group: "Selected", run: () => onEdit(selected.id) }, { id: "delete", title: `Delete \u2014 ${name}`, hint: "d", group: "Selected", run: () => setConfirmDelete(true) });
+      list.unshift({ id: "copy", title: `Copy ${selected.type === "otp" ? "OTP code" : selected.type === "note" ? "note" : "password"} \u2014 ${name}`, hint: "c / enter", group: "Selected", run: () => copyPrimary(selected) }, { id: "copy-user", title: `Copy username \u2014 ${name}`, hint: "u", group: "Selected", run: () => copyUsername(selected) }, { id: "reveal", title: `${revealed ? "Hide" : "Reveal"} value \u2014 ${name}`, hint: "s", group: "Selected", run: () => toggleReveal(selected) }, { id: "edit", title: `Edit \u2014 ${name}`, hint: "e", group: "Selected", run: () => onEdit(selected.id) }, { id: "link", title: `Link secrets \u2014 ${name}`, hint: "L", group: "Selected", run: () => setLinkPickerOpen(true) }, { id: "delete", title: `Delete \u2014 ${name}`, hint: "d", group: "Selected", run: () => setConfirmDelete(true) });
+      if (linkedOtpSecret) {
+        list.splice(1, 0, { id: "copy-linked-otp", title: `Copy ${linkedOtpSecret.name} code \u2014 ${name}`, hint: "t", group: "Selected", run: copyLinkedOtp });
+      }
       if (selected.url) {
         list.splice(2, 0, { id: "copy-url", title: `Copy URL \u2014 ${name}`, hint: "w", group: "Selected", run: () => copyUrl(selected) }, { id: "open-url", title: `Open ${hostOf(selected.url)} in browser`, hint: selected.type === "otp" ? undefined : "o", group: "Selected", run: () => open(selected) });
       }
     }
+    for (const link of [...links?.links ?? [], ...links?.linkedFrom ?? []]) {
+      list.push({
+        id: `goto-linked:${link.id}`,
+        title: `Go to ${link.name}`,
+        hint: typeLabel(link.type),
+        group: "Linked",
+        run: () => {
+          setQuery("");
+          setSelectedId(link.id);
+        }
+      });
+    }
     for (const entry of entries) {
       list.push({
         id: `goto:${entry.id}`,
@@ -5645,7 +5900,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       });
     }
     return list;
-  }, [entries, selected, revealed, onCreate, onEdit, reload, copyPrimary, copyUsername, copyUrl, toggleReveal]);
+  }, [entries, selected, revealed, links, linkedOtpSecret, onCreate, onEdit, reload, copyPrimary, copyUsername, copyUrl, toggleReveal, copyLinkedOtp]);
   useScreenContext(commands, selected ? {
     label: selected.type === "otp" ? "OTP code" : selected.type === "note" ? "Note" : "Password",
     read: () => selected.type === "otp" ? generateOtp(selected)?.code ?? null : readValue(selected),
@@ -5654,7 +5909,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
   useEffect6(() => {
     let hints;
     if (confirmDelete)
-      hints = [["y", "delete"], ["n/esc", "cancel"]];
+      hints = links?.links.length ? [["y", "delete"], ["a", "with linked"], ["n/esc", "cancel"]] : [["y", "delete"], ["n/esc", "cancel"]];
     else if (searchFocused)
       hints = [["type", "filter"], ["enter/\u2193", "results"], ["esc", "clear"]];
     else if (pane === "actions")
@@ -5664,11 +5919,11 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     else
       hints = [["\u2191\u2193", "move"], ["enter", "copy"], ["\u2192/tab", "actions"], ["/", "search"], ["n", "new"], ["q", "quit"]];
     setHints(hints);
-  }, [confirmDelete, searchFocused, pane, showDetail, setHints]);
+  }, [confirmDelete, links, searchFocused, pane, showDetail, setHints]);
   const listWidth = wide ? Math.max(32, Math.floor(width * 0.38)) : width;
   const offset = Math.max(0, Math.min(selectedIndex - Math.floor(listHeight / 2), filtered.length - listHeight));
   const visible = filtered.slice(offset, offset + listHeight);
-  const list = /* @__PURE__ */ jsx6("box", {
+  const list = /* @__PURE__ */ jsx7("box", {
     flexDirection: "column",
     width: wide ? listWidth : "100%",
     flexShrink: 0,
@@ -5678,9 +5933,9 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
     title: ` ${filtered.length}/${entries.length} secrets `,
     titleColor: theme.muted,
     onMouseScroll: (event) => move(event.scroll?.direction === "up" ? -3 : 3),
-    children: filtered.length === 0 ? /* @__PURE__ */ jsx6("box", {
+    children: filtered.length === 0 ? /* @__PURE__ */ jsx7("box", {
       padding: 1,
-      children: /* @__PURE__ */ jsx6("text", {
+      children: /* @__PURE__ */ jsx7("text", {
         fg: theme.dim,
         children: entries.length === 0 ? "No secrets yet \u2014 press n to add one." : `No match for "${query}".`
       })
@@ -5690,7 +5945,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
       const sub = entry.username ?? (entry.url ? hostOf(entry.url) : "");
       const room = listWidth - 6;
       const name = truncate(entry.name, Math.max(8, Math.min(room, Math.ceil(room * 0.55))));
-      return /* @__PURE__ */ jsx6("box", {
+      return /* @__PURE__ */ jsx7("box", {
         flexDirection: "row",
         height: 1,
         paddingX: 1,
@@ -5704,66 +5959,75 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
             setPane("actions");
           }
         },
-        children: /* @__PURE__ */ jsxs6("text", {
+        children: /* @__PURE__ */ jsxs7("text", {
           children: [
-            /* @__PURE__ */ jsxs6("span", {
+            /* @__PURE__ */ jsxs7("span", {
               fg: badge.color,
               children: [
                 badge.glyph,
                 " "
               ]
             }),
-            isSelected ? /* @__PURE__ */ jsx6("strong", {
+            isSelected ? /* @__PURE__ */ jsx7("strong", {
               fg: theme.accent,
               children: name
-            }) : /* @__PURE__ */ jsx6("span", {
+            }) : /* @__PURE__ */ jsx7("span", {
               fg: theme.text,
               children: name
             }),
-            /* @__PURE__ */ jsx6("span", {
+            entry.linkCount ? /* @__PURE__ */ jsxs7("span", {
+              fg: theme.muted,
+              children: [
+                " \xB7",
+                entry.linkCount
+              ]
+            }) : null,
+            /* @__PURE__ */ jsx7("span", {
               fg: theme.dim,
-              children: sub ? `  ${truncate(sub, Math.max(0, room - name.length - 2))}` : ""
+              children: sub ? `  ${truncate(sub, Math.max(0, room - name.length - 2 - (entry.linkCount ? 3 : 0)))}` : ""
             })
           ]
         })
       }, entry.id);
     })
   });
-  const detail = selected ? /* @__PURE__ */ jsx6(Detail, {
+  const detail = selected ? /* @__PURE__ */ jsx7(Detail, {
     entry: selected,
     revealed: revealed?.id === selected.id ? revealed : null,
     otp: otp?.id === selected.id ? otp : null,
     now,
     confirmDelete,
+    links,
+    linkedOtp,
     actions,
     focusedAction: pane === "actions" ? currentAction : null
-  }) : /* @__PURE__ */ jsx6("box", {
+  }) : /* @__PURE__ */ jsx7("box", {
     flexGrow: 1,
     border: true,
     borderStyle: "rounded",
     borderColor: theme.border,
     padding: 1,
-    children: /* @__PURE__ */ jsx6("text", {
+    children: /* @__PURE__ */ jsx7("text", {
       fg: theme.dim,
       children: "Nothing selected."
     })
   });
-  return /* @__PURE__ */ jsxs6("box", {
+  return /* @__PURE__ */ jsxs7("box", {
     flexDirection: "column",
     flexGrow: 1,
     width: "100%",
     children: [
-      /* @__PURE__ */ jsxs6("box", {
+      /* @__PURE__ */ jsxs7("box", {
         flexDirection: "row",
         paddingX: 1,
         height: 1,
         children: [
-          /* @__PURE__ */ jsx6("text", {
+          /* @__PURE__ */ jsx7("text", {
             bg: searchFocused ? theme.accent : theme.chip,
             fg: searchFocused ? theme.onAccent : theme.muted,
             children: " / "
           }),
-          /* @__PURE__ */ jsx6(TextField, {
+          /* @__PURE__ */ jsx7(TextField, {
             value: query,
             onChange: setQuery,
             focused: searchFocused && app.active,
@@ -5771,7 +6035,7 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
           })
         ]
       }),
-      /* @__PURE__ */ jsxs6("box", {
+      /* @__PURE__ */ jsxs7("box", {
         flexDirection: "row",
         flexGrow: 1,
         gap: 1,
@@ -5779,21 +6043,69 @@ function VaultScreen({ session, initialSelectedId, onCreate, onEdit, onSettings,
           wide || !detailOpen ? list : null,
           showDetail ? detail : null
         ]
-      })
+      }),
+      linkPickerOpen && selected ? /* @__PURE__ */ jsx7(LinkPicker, {
+        primary: selected,
+        entries,
+        linkedIds: new Set(links?.links.map((l) => l.id) ?? []),
+        onToggle: (target) => toggleLink(selected, target),
+        onClose: () => setLinkPickerOpen(false)
+      }) : null
+    ]
+  });
+}
+function LinkedRow({ link, otp, now }) {
+  const badge = typeBadge(link.type);
+  const seconds = otp ? Math.max(0, Math.ceil((otp.expiresAt - now) / 1000)) : 0;
+  return /* @__PURE__ */ jsxs7("text", {
+    children: [
+      /* @__PURE__ */ jsxs7("span", {
+        fg: badge.color,
+        children: [
+          " ",
+          badge.glyph,
+          " "
+        ]
+      }),
+      /* @__PURE__ */ jsx7("span", {
+        fg: theme.text,
+        children: link.name
+      }),
+      link.type === "otp" ? otp ? /* @__PURE__ */ jsxs7(Fragment2, {
+        children: [
+          /* @__PURE__ */ jsx7("span", {
+            fg: theme.success,
+            children: /* @__PURE__ */ jsx7("strong", {
+              children: `   ${otp.code.slice(0, 3)} ${otp.code.slice(3)}`
+            })
+          }),
+          /* @__PURE__ */ jsxs7("span", {
+            fg: seconds <= 5 ? theme.danger : theme.muted,
+            children: [
+              " ",
+              seconds,
+              "s"
+            ]
+          })
+        ]
+      }) : /* @__PURE__ */ jsx7("span", {
+        fg: theme.dim,
+        children: "   press t for the code"
+      }) : null
     ]
   });
 }
 function valueName(type) {
   return type === "note" ? "Note" : type === "otp" ? "Secret key" : "Password";
 }
-function Detail({ entry, revealed, otp, now, confirmDelete, actions, focusedAction }) {
+function Detail({ entry, revealed, otp, now, confirmDelete, links, linkedOtp, actions, focusedAction }) {
   const badge = typeBadge(entry.type);
   const valueLabel = valueName(entry.type);
   const revealSeconds = revealed ? Math.max(0, Math.ceil((revealed.until - now) / 1000)) : 0;
   const otpSeconds = otp ? Math.max(0, Math.ceil((otp.expiresAt - now) / 1000)) : 0;
   const otpBar = 10;
   const otpFilled = Math.round(otpSeconds / 30 * otpBar);
-  return /* @__PURE__ */ jsxs6("box", {
+  return /* @__PURE__ */ jsxs7("box", {
     flexDirection: "column",
     flexGrow: 1,
     border: true,
@@ -5804,51 +6116,51 @@ function Detail({ entry, revealed, otp, now, confirmDelete, actions, focusedActi
     title: ` ${typeLabel(entry.type)} `,
     titleColor: badge.color,
     children: [
-      /* @__PURE__ */ jsxs6("text", {
+      /* @__PURE__ */ jsxs7("text", {
         children: [
-          /* @__PURE__ */ jsxs6("span", {
+          /* @__PURE__ */ jsxs7("span", {
             fg: badge.color,
             children: [
               badge.glyph,
               " "
             ]
           }),
-          /* @__PURE__ */ jsx6("strong", {
+          /* @__PURE__ */ jsx7("strong", {
             fg: theme.accent,
             children: entry.name
           })
         ]
       }),
-      /* @__PURE__ */ jsxs6("box", {
+      /* @__PURE__ */ jsxs7("box", {
         flexDirection: "column",
         children: [
-          entry.type !== "note" ? /* @__PURE__ */ jsx6(FieldRow, {
+          entry.type !== "note" ? /* @__PURE__ */ jsx7(FieldRow, {
             label: "Username",
             value: entry.username ?? "\u2014",
             color: entry.username ? theme.text : theme.dim
           }) : null,
-          /* @__PURE__ */ jsx6(FieldRow, {
+          /* @__PURE__ */ jsx7(FieldRow, {
             label: valueLabel,
             value: revealed ? revealed.value : MASK,
             color: revealed ? theme.revealed : theme.dim
           }),
-          entry.url ? /* @__PURE__ */ jsx6(FieldRow, {
+          entry.url ? /* @__PURE__ */ jsx7(FieldRow, {
             label: "URL",
             value: entry.url,
             color: theme.info
           }) : null,
-          entry.description ? /* @__PURE__ */ jsx6(FieldRow, {
+          entry.description ? /* @__PURE__ */ jsx7(FieldRow, {
             label: "Notes",
             value: entry.description
           }) : null,
-          /* @__PURE__ */ jsx6(FieldRow, {
+          /* @__PURE__ */ jsx7(FieldRow, {
             label: "Updated",
             value: entry.updatedAt.slice(0, 16).replace("T", " "),
             color: theme.dim
           })
         ]
       }),
-      entry.type === "otp" ? /* @__PURE__ */ jsx6("box", {
+      entry.type === "otp" ? /* @__PURE__ */ jsx7("box", {
         flexDirection: "row",
         border: true,
         borderStyle: "rounded",
@@ -5856,26 +6168,26 @@ function Detail({ entry, revealed, otp, now, confirmDelete, actions, focusedActi
         paddingX: 1,
         gap: 2,
         alignSelf: "flex-start",
-        children: otp ? /* @__PURE__ */ jsxs6(Fragment2, {
+        children: otp ? /* @__PURE__ */ jsxs7(Fragment2, {
           children: [
-            /* @__PURE__ */ jsx6("text", {
+            /* @__PURE__ */ jsx7("text", {
               fg: theme.success,
               selectable: true,
-              children: /* @__PURE__ */ jsx6("strong", {
+              children: /* @__PURE__ */ jsx7("strong", {
                 children: `${otp.code.slice(0, 3)} ${otp.code.slice(3)}`
               })
             }),
-            /* @__PURE__ */ jsxs6("text", {
+            /* @__PURE__ */ jsxs7("text", {
               children: [
-                /* @__PURE__ */ jsx6("span", {
+                /* @__PURE__ */ jsx7("span", {
                   fg: otpSeconds <= 5 ? theme.danger : theme.success,
                   children: "\u2588".repeat(otpFilled)
                 }),
-                /* @__PURE__ */ jsx6("span", {
+                /* @__PURE__ */ jsx7("span", {
                   fg: theme.chip,
                   children: "\u2588".repeat(otpBar - otpFilled)
                 }),
-                /* @__PURE__ */ jsxs6("span", {
+                /* @__PURE__ */ jsxs7("span", {
                   fg: otpSeconds <= 5 ? theme.danger : theme.muted,
                   children: [
                     " ",
@@ -5886,12 +6198,38 @@ function Detail({ entry, revealed, otp, now, confirmDelete, actions, focusedActi
               ]
             })
           ]
-        }) : /* @__PURE__ */ jsx6("text", {
+        }) : /* @__PURE__ */ jsx7("text", {
           fg: theme.dim,
           children: "press o to show the code"
         })
       }) : null,
-      revealed ? /* @__PURE__ */ jsxs6("text", {
+      links && (links.links.length > 0 || links.linkedFrom.length > 0) ? /* @__PURE__ */ jsxs7("box", {
+        flexDirection: "column",
+        children: [
+          links.links.length > 0 ? /* @__PURE__ */ jsx7("text", {
+            fg: theme.muted,
+            children: "Linked"
+          }) : null,
+          links.links.map((link) => /* @__PURE__ */ jsx7(LinkedRow, {
+            link,
+            otp: linkedOtp?.id === link.id ? linkedOtp : null,
+            now
+          }, link.id)),
+          links.linkedFrom.length > 0 ? /* @__PURE__ */ jsxs7("text", {
+            children: [
+              /* @__PURE__ */ jsx7("span", {
+                fg: theme.muted,
+                children: "Linked from  "
+              }),
+              /* @__PURE__ */ jsx7("span", {
+                fg: theme.text,
+                children: links.linkedFrom.map((l) => l.name).join(", ")
+              })
+            ]
+          }) : null
+        ]
+      }) : null,
+      revealed ? /* @__PURE__ */ jsxs7("text", {
         fg: theme.dim,
         children: [
           "Visible for ",
@@ -5899,30 +6237,30 @@ function Detail({ entry, revealed, otp, now, confirmDelete, actions, focusedActi
           "s \u2014 drag to select, ctrl+c to copy the selection."
         ]
       }) : null,
-      confirmDelete ? /* @__PURE__ */ jsx6("box", {
+      confirmDelete ? /* @__PURE__ */ jsx7("box", {
         backgroundColor: theme.dangerBg,
         paddingX: 1,
-        children: /* @__PURE__ */ jsxs6("text", {
+        children: /* @__PURE__ */ jsxs7("text", {
           fg: theme.danger,
           children: [
-            /* @__PURE__ */ jsxs6("strong", {
+            /* @__PURE__ */ jsxs7("strong", {
               children: [
                 'Delete "',
                 entry.name,
                 '" permanently?'
               ]
             }),
-            /* @__PURE__ */ jsx6("span", {
+            /* @__PURE__ */ jsx7("span", {
               fg: theme.muted,
-              children: "  y = delete \xB7 n = cancel"
+              children: links?.links.length ? `  y = only this \xB7 a = also its ${links.links.length} linked \xB7 n = cancel` : "  y = delete \xB7 n = cancel"
             })
           ]
         })
-      }) : /* @__PURE__ */ jsx6("box", {
+      }) : /* @__PURE__ */ jsx7("box", {
         flexDirection: "row",
         gap: 1,
         flexWrap: "wrap",
-        children: actions.map((action, i) => /* @__PURE__ */ jsx6(Button, {
+        children: actions.map((action, i) => /* @__PURE__ */ jsx7(Button, {
           hotkey: action.hotkey,
           label: action.label,
           onPress: action.run,
@@ -5937,6 +6275,7 @@ var PANES, WIDE_MIN_COLUMNS = 96;
 var init_vault = __esm(() => {
   init_components();
   init_context();
+  init_links();
   init_theme();
   init_util();
   PANES = ["search", "list", "actions"];
@@ -5945,29 +6284,29 @@ var init_vault = __esm(() => {
 // apps/cli/src/tui.tsx
 import { basename as basename3 } from "path";
 import { createCliRenderer } from "@opentui/core";
-import { createRoot, useKeyboard as useKeyboard7, useRenderer, useSelectionHandler } from "@opentui/react";
-import { useCallback as useCallback4, useEffect as useEffect7, useMemo as useMemo6, useRef as useRef7, useState as useState7 } from "react";
-import { jsx as jsx7, jsxs as jsxs7 } from "@opentui/react/jsx-runtime";
+import { createRoot, useKeyboard as useKeyboard8, useRenderer, useSelectionHandler } from "@opentui/react";
+import { useCallback as useCallback4, useEffect as useEffect7, useMemo as useMemo7, useRef as useRef8, useState as useState8 } from "react";
+import { jsx as jsx8, jsxs as jsxs8 } from "@opentui/react/jsx-runtime";
 function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs: initialClipboardClearMs, idleLockMs: initialIdleLockMs, onQuit, sessionSink, passkeyRunner }) {
   const renderer = useRenderer();
-  const [timings, setTimingsState] = useState7({ revealMs: initialRevealMs, clipboardClearMs: initialClipboardClearMs, idleLockMs: initialIdleLockMs });
+  const [timings, setTimingsState] = useState8({ revealMs: initialRevealMs, clipboardClearMs: initialClipboardClearMs, idleLockMs: initialIdleLockMs });
   const { revealMs, clipboardClearMs, idleLockMs } = timings;
   const setTimings = useCallback4((next) => setTimingsState((prev) => ({ ...prev, ...next })), []);
-  const [route, setRoute] = useState7({ name: "unlock" });
-  const [session, setSession] = useState7(null);
-  const [toastState, setToastState] = useState7(null);
-  const [hints, setHints] = useState7([]);
-  const [paletteOpen, setPaletteOpen] = useState7(false);
-  const commandsRef = useRef7([]);
-  const copyTargetRef = useRef7(null);
-  const sessionRef = useRef7(null);
+  const [route, setRoute] = useState8({ name: "unlock" });
+  const [session, setSession] = useState8(null);
+  const [toastState, setToastState] = useState8(null);
+  const [hints, setHints] = useState8([]);
+  const [paletteOpen, setPaletteOpen] = useState8(false);
+  const commandsRef = useRef8([]);
+  const copyTargetRef = useRef8(null);
+  const sessionRef = useRef8(null);
   sessionRef.current = session;
   if (sessionSink)
     sessionSink.current = session;
-  const lastCtrlC = useRef7(0);
-  const lastActivity = useRef7(Date.now());
-  const toastTimer = useRef7(null);
-  const quitting = useRef7(false);
+  const lastCtrlC = useRef8(0);
+  const lastActivity = useRef8(Date.now());
+  const toastTimer = useRef8(null);
+  const quitting = useRef8(false);
   const toast = useCallback4((message, kind = "success") => {
     if (toastTimer.current)
       clearTimeout(toastTimer.current);
@@ -6001,7 +6340,7 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
     onQuit();
   }, [onQuit]);
   const openPalette = useCallback4(() => setPaletteOpen(true), []);
-  const api = useMemo6(() => ({
+  const api = useMemo7(() => ({
     active: !paletteOpen,
     toast,
     copy,
@@ -6039,7 +6378,7 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
     }
     toast("Press ctrl+c again to quit", "info");
   }, [renderer, clipboard, clipboardClearMs, quit, toast]);
-  useKeyboard7((key) => {
+  useKeyboard8((key) => {
     lastActivity.current = Date.now();
     if (!key.ctrl || key.meta)
       return;
@@ -6105,7 +6444,7 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
   const vaultName = basename3(vaultPath);
   let screen;
   if (route.name === "unlock" || !session) {
-    screen = /* @__PURE__ */ jsx7(UnlockScreen, {
+    screen = /* @__PURE__ */ jsx8(UnlockScreen, {
       vaultPath,
       onUnlock,
       setHints,
@@ -6113,7 +6452,7 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
       passkeyRunner
     }, `unlock:${route.name === "unlock" ? route.notice ?? "" : ""}`);
   } else if (route.name === "form") {
-    screen = /* @__PURE__ */ jsx7(SecretForm, {
+    screen = /* @__PURE__ */ jsx8(SecretForm, {
       session,
       editing: route.editing,
       setHints,
@@ -6125,14 +6464,14 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
       }
     });
   } else if (route.name === "settings") {
-    screen = /* @__PURE__ */ jsx7(SettingsScreen, {
+    screen = /* @__PURE__ */ jsx8(SettingsScreen, {
       vaultPath,
       setHints,
       onBack: goVault,
       passkeyRunner
     });
   } else {
-    screen = /* @__PURE__ */ jsx7(VaultScreen, {
+    screen = /* @__PURE__ */ jsx8(VaultScreen, {
       session,
       initialSelectedId: route.focusId,
       onCreate: () => setRoute({ name: "form", editing: null }),
@@ -6142,9 +6481,9 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
       revealMs
     }, route.focusId ?? "vault");
   }
-  return /* @__PURE__ */ jsx7(AppContext.Provider, {
+  return /* @__PURE__ */ jsx8(AppContext.Provider, {
     value: api,
-    children: /* @__PURE__ */ jsxs7("box", {
+    children: /* @__PURE__ */ jsxs8("box", {
       flexDirection: "column",
       width: "100%",
       height: "100%",
@@ -6155,15 +6494,15 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
         lastActivity.current = Date.now();
       },
       children: [
-        /* @__PURE__ */ jsx7(Header, {
+        /* @__PURE__ */ jsx8(Header, {
           title,
-          right: /* @__PURE__ */ jsxs7("text", {
+          right: /* @__PURE__ */ jsxs8("text", {
             fg: theme.dim,
             children: [
-              session ? /* @__PURE__ */ jsx7("span", {
+              session ? /* @__PURE__ */ jsx8("span", {
                 fg: theme.success,
                 children: "\u25CF unlocked"
-              }) : /* @__PURE__ */ jsx7("span", {
+              }) : /* @__PURE__ */ jsx8("span", {
                 fg: theme.muted,
                 children: "\u25CB locked"
               }),
@@ -6172,17 +6511,17 @@ function App({ vaultPath, clipboard, revealMs: initialRevealMs, clipboardClearMs
             ]
           })
         }),
-        /* @__PURE__ */ jsx7("box", {
+        /* @__PURE__ */ jsx8("box", {
           flexDirection: "column",
           flexGrow: 1,
           children: screen
         }),
-        /* @__PURE__ */ jsx7(StatusBar, {
+        /* @__PURE__ */ jsx8(StatusBar, {
           hints,
           pinned: globalHints,
           toast: toastState
         }),
-        paletteOpen ? /* @__PURE__ */ jsx7(CommandPalette, {
+        paletteOpen ? /* @__PURE__ */ jsx8(CommandPalette, {
           commands: [...commandsRef.current, ...globalCommands],
           onClose: () => setPaletteOpen(false)
         }) : null
@@ -6210,7 +6549,7 @@ async function runTui(vaultPath) {
       closeSessionAndRecordSeal(vault, sessionSink.current).catch(() => {});
     sessionSink.current = null;
   });
-  createRoot(renderer).render(/* @__PURE__ */ jsx7(App, {
+  createRoot(renderer).render(/* @__PURE__ */ jsx8(App, {
     vaultPath: vault,
     clipboard,
     revealMs: numberPreference("revealSeconds") * 1000,
@@ -6238,10 +6577,9 @@ var init_tui = __esm(() => {
 init_clipboard();
 init_passkey();
 init_package();
-import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
-import { basename as basename4, isAbsolute, resolve as resolve5 } from "path";
+import { basename as basename4, isAbsolute, resolve as resolve6 } from "path";
 
 // apps/cli/src/password.ts
 import { createInterface } from "readline/promises";
@@ -6683,6 +7021,321 @@ async function daemonStop(options) {
 // apps/cli/src/index.ts
 init_src3();
 init_os_secrets();
+
+// apps/web/src/server.ts
+init_src();
+init_src3();
+init_os_secrets();
+import { randomBytes as randomBytes6 } from "crypto";
+import { resolve as resolve4 } from "path";
+function json2(data, status = 200, headers) {
+  return new Response(JSON.stringify(data, null, 2), {
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      ...headers ?? {}
+    },
+    status
+  });
+}
+function html(body) {
+  return new Response(body, {
+    headers: {
+      "content-type": "text/html; charset=utf-8"
+    }
+  });
+}
+function parseCookies(request) {
+  const cookieHeader = request.headers.get("cookie") ?? "";
+  return Object.fromEntries(cookieHeader.split(";").map((part) => part.trim()).filter(Boolean).map((part) => {
+    const index = part.indexOf("=");
+    return [part.slice(0, index), decodeURIComponent(part.slice(index + 1))];
+  }));
+}
+async function openSession(vaultPath, state) {
+  return new VaultSession(new AuthoDatabase(vaultPath), state.rootKey, {
+    sealBound: state.sealBound,
+    sealRecord: await loadSealRecord(vaultPath)
+  });
+}
+function requireSession(request, sessions) {
+  const cookies = parseCookies(request);
+  const sessionId = cookies.autho_session;
+  if (!sessionId) {
+    throw new Error("Missing web session");
+  }
+  const session = sessions.get(sessionId);
+  if (!session) {
+    throw new Error("Unknown web session");
+  }
+  if (Date.parse(session.expiresAt) <= Date.now()) {
+    sessions.delete(sessionId);
+    throw new Error("Expired web session");
+  }
+  return { ...session, id: sessionId };
+}
+async function readJson2(request) {
+  return await request.json();
+}
+function page2() {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Autho</title>
+  <style>
+    :root { color-scheme: light; font-family: ui-sans-serif, system-ui, sans-serif; }
+    body { margin: 0; background: #f5f1e8; color: #1f2937; }
+    main { max-width: 760px; margin: 0 auto; padding: 32px 20px 64px; }
+    section { background: #fffdf8; border: 1px solid #d6cbb8; border-radius: 16px; padding: 20px; margin-bottom: 16px; box-shadow: 0 8px 30px rgba(83,58,18,0.08); }
+    h1 { margin-top: 0; font-size: 2rem; }
+    input, select, button { font: inherit; padding: 10px 12px; border-radius: 10px; border: 1px solid #bca889; }
+    button { background: #1f4d3a; color: white; border: none; cursor: pointer; }
+    form { display: flex; gap: 8px; flex-wrap: wrap; }
+    pre { background: #1f2937; color: #f9fafb; padding: 12px; border-radius: 12px; overflow: auto; }
+    ul { padding-left: 18px; }
+  </style>
+</head>
+<body>
+  <main>
+    <section>
+      <h1>Autho Local Web</h1>
+      <p>Local-only Bun web UI for vault unlock and secret browsing.</p>
+      <form id="unlock-form">
+        <input id="password" type="password" placeholder="Master password" required />
+        <input id="totp" inputmode="numeric" autocomplete="one-time-code" placeholder="Authenticator code (if enabled)" />
+        <button type="submit">Unlock</button>
+      </form>
+    </section>
+    <section>
+      <h2>Secrets</h2>
+      <button id="refresh">Refresh</button>
+      <ul id="secret-list"></ul>
+      <pre id="output"></pre>
+    </section>
+    <section id="linked" hidden>
+      <h2>Linked to <span id="linked-name"></span></h2>
+      <ul id="linked-list"></ul>
+      <p id="linked-from"></p>
+      <form id="link-form">
+        <input id="link-ref" placeholder="Secret name or id to link" required />
+        <button type="submit">Link</button>
+      </form>
+    </section>
+  </main>
+  <script>
+    const output = document.getElementById('output');
+    const secretList = document.getElementById('secret-list');
+    async function refresh() {
+      const response = await fetch('/api/secrets');
+      if (!response.ok) {
+        output.textContent = await response.text();
+        return;
+      }
+      const data = await response.json();
+      secretList.innerHTML = '';
+      data.data.forEach((secret) => {
+        const item = document.createElement('li');
+        const open = document.createElement('a');
+        open.href = '#';
+        open.textContent = secret.name + " (" + secret.type + ")" + (secret.linkCount ? " \xB7 " + secret.linkCount + " linked" : "");
+        open.addEventListener('click', (event) => { event.preventDefault(); showSecret(secret.id); });
+        item.appendChild(open);
+        secretList.appendChild(item);
+      });
+      output.textContent = JSON.stringify(data, null, 2);
+    }
+    let current = null;
+    async function showSecret(ref) {
+      const response = await fetch('/api/secrets/' + encodeURIComponent(ref));
+      if (!response.ok) {
+        output.textContent = await response.text();
+        return;
+      }
+      const secret = (await response.json()).data;
+      current = secret;
+      const { links, linkedFrom, ...rest } = secret;
+      output.textContent = JSON.stringify(rest, null, 2);
+      document.getElementById('linked').hidden = false;
+      document.getElementById('linked-name').textContent = secret.name;
+      const list = document.getElementById('linked-list');
+      list.innerHTML = '';
+      if (!links.length) {
+        list.innerHTML = '<li>No linked secrets</li>';
+      }
+      links.forEach((linked) => {
+        const item = document.createElement('li');
+        const open = document.createElement('a');
+        open.href = '#';
+        open.textContent = linked.name + " (" + linked.type + ") ";
+        open.addEventListener('click', (event) => { event.preventDefault(); showSecret(linked.id); });
+        const unlink = document.createElement('button');
+        unlink.textContent = 'Unlink';
+        unlink.addEventListener('click', () => changeLink('DELETE', linked.id));
+        item.append(open, unlink);
+        list.appendChild(item);
+      });
+      document.getElementById('linked-from').textContent = linkedFrom.length
+        ? 'Linked from: ' + linkedFrom.map((primary) => primary.name).join(', ')
+        : '';
+    }
+    async function changeLink(method, secret) {
+      const response = await fetch('/api/links', {
+        method,
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ primary: current.id, secret })
+      });
+      if (!response.ok) {
+        output.textContent = await response.text();
+        return;
+      }
+      await showSecret(current.id);
+      await refresh();
+    }
+    document.getElementById('link-form').addEventListener('submit', async (event) => {
+      event.preventDefault();
+      const input = document.getElementById('link-ref');
+      await changeLink('POST', input.value);
+      input.value = '';
+    });
+    document.getElementById('unlock-form').addEventListener('submit', async (event) => {
+      event.preventDefault();
+      const response = await fetch('/api/session/unlock', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          password: document.getElementById('password').value,
+          totp: document.getElementById('totp').value || undefined
+        })
+      });
+      output.textContent = await response.text();
+      if (response.ok) {
+        await refresh();
+      }
+    });
+    document.getElementById('refresh').addEventListener('click', refresh);
+  </script>
+</body>
+</html>`;
+}
+async function startWebServer(options = {}) {
+  const vaultPath = resolve4(options.vaultPath ?? defaultVaultPath());
+  const host = options.host ?? "127.0.0.1";
+  const port = options.port ?? 8061;
+  const sessions = new Map;
+  const cleanup = () => {
+    for (const [id, session] of sessions.entries()) {
+      if (Date.parse(session.expiresAt) <= Date.now()) {
+        sessions.delete(id);
+      }
+    }
+  };
+  const server = Bun.serve({
+    fetch: async (request) => {
+      cleanup();
+      const url = new URL(request.url);
+      try {
+        if (request.method === "GET" && url.pathname === "/health") {
+          return json2({ ok: true, running: true, vaultPath });
+        }
+        if (request.method === "GET" && url.pathname === "/") {
+          return html(page2());
+        }
+        if (request.method === "POST" && url.pathname === "/api/session/unlock") {
+          const body = await readJson2(request);
+          const ttlSeconds = body.ttlSeconds ?? 3600;
+          if (ttlSeconds <= 0 || ttlSeconds > 86400) {
+            return json2({ error: "Session TTL must be between 1 and 86400 seconds" }, 400);
+          }
+          const { rootKey, sealBound } = VaultService.unlockRootKey(vaultPath, {
+            password: body.password,
+            sealRecord: await loadSealRecord(vaultPath),
+            totp: body.totp
+          });
+          const sessionId = randomBytes6(16).toString("hex");
+          const expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
+          sessions.set(sessionId, { expiresAt, rootKey, sealBound });
+          return json2({ expiresAt, sessionId }, 200, { "set-cookie": `autho_session=${sessionId}; HttpOnly; SameSite=Strict; Path=/; Secure` });
+        }
+        if (request.method === "POST" && url.pathname === "/api/session/lock") {
+          const cookies = parseCookies(request);
+          if (cookies.autho_session) {
+            sessions.delete(cookies.autho_session);
+          }
+          return json2({ locked: true }, 200, { "set-cookie": "autho_session=; Max-Age=0; Path=/; Secure" });
+        }
+        if (url.pathname.startsWith("/api/")) {
+          const webSession = requireSession(request, sessions);
+          const session = await openSession(vaultPath, webSession);
+          try {
+            if (request.method === "GET" && url.pathname === "/api/status") {
+              return json2({
+                initialized: true,
+                secretCount: session.listSecrets().length,
+                unlocked: true,
+                vaultPath
+              });
+            }
+            if (request.method === "GET" && url.pathname === "/api/secrets") {
+              return json2({ data: session.listSecretIndex() });
+            }
+            if (request.method === "GET" && url.pathname.startsWith("/api/secrets/")) {
+              const ref = decodeURIComponent(url.pathname.slice("/api/secrets/".length));
+              const { linkedFrom, links } = session.getLinks(ref);
+              return json2({ data: { ...session.getSecret(ref), linkedFrom, links } });
+            }
+            if ((request.method === "POST" || request.method === "DELETE") && url.pathname === "/api/links") {
+              const body = await readJson2(request);
+              return json2({
+                data: request.method === "POST" ? session.linkSecrets(body.primary, body.secret) : session.unlinkSecrets(body.primary, body.secret)
+              });
+            }
+            if (request.method === "POST" && url.pathname === "/api/secrets") {
+              const body = await readJson2(request);
+              return json2({
+                data: session.addSecret({
+                  metadata: Object.fromEntries(Object.entries({
+                    algorithm: body.algorithm,
+                    description: body.description,
+                    digits: body.digits,
+                    url: body.url
+                  }).filter(([, value]) => value !== undefined)),
+                  name: body.name,
+                  type: body.type,
+                  username: body.username,
+                  value: body.value
+                })
+              }, 201);
+            }
+            if (request.method === "DELETE" && url.pathname.startsWith("/api/secrets/")) {
+              const ref = decodeURIComponent(url.pathname.slice("/api/secrets/".length));
+              return json2({ data: session.removeSecret(ref, { withLinked: url.searchParams.get("withLinked") === "1" }) });
+            }
+            if (request.method === "GET" && url.pathname.startsWith("/api/otp/")) {
+              const ref = decodeURIComponent(url.pathname.slice("/api/otp/".length));
+              return json2({ data: session.generateOtp(ref) });
+            }
+          } finally {
+            await closeSessionAndRecordSeal(vaultPath, session);
+          }
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const status = /session/i.test(message) ? 401 : 400;
+        return json2({ error: message }, status);
+      }
+      return json2({ error: "Not found" }, 404);
+    },
+    hostname: host,
+    port
+  });
+  process.on("SIGINT", () => process.exit(0));
+  process.on("SIGTERM", () => process.exit(0));
+  console.log(`Autho web server listening on http://${host}:${server.port}`);
+  await new Promise(() => {});
+}
+
+// apps/cli/src/index.ts
 function parseArgs(argv) {
   const dashDashIndex = argv.indexOf("--");
   const main = dashDashIndex === -1 ? argv : argv.slice(0, dashDashIndex);
@@ -6776,7 +7429,7 @@ function printSealChanges(changes, diffTrusted) {
   }
 }
 function absolutePath(path) {
-  return resolve5(path);
+  return resolve6(path);
 }
 function buildSecretMetadata(args) {
   return Object.fromEntries(Object.entries({
@@ -7031,34 +7684,10 @@ async function runInitWizard(vaultPath, password, existingCreds) {
   console.log("Setup complete. Run \x1B[1mautho init\x1B[0m anytime to change these settings.");
 }
 async function runWebServer(vaultPath, args) {
-  const commandArgs = [
-    "run",
-    absolutePath("./apps/web/src/index.ts"),
-    "serve",
-    "--vault",
-    absolutePath(vaultPath)
-  ];
-  const host = getString(args, "host");
-  const port = getString(args, "port") ?? String(numberPreference("webPort"));
-  if (host) {
-    commandArgs.push("--host", host);
-  }
-  if (port) {
-    commandArgs.push("--port", port);
-  }
-  await new Promise((resolvePromise, rejectPromise) => {
-    const child = spawn3(process.execPath, commandArgs, {
-      cwd: process.cwd(),
-      stdio: "inherit"
-    });
-    child.on("exit", (code) => {
-      if (code === 0) {
-        resolvePromise();
-        return;
-      }
-      rejectPromise(new Error(`Web server exited with code ${code ?? 1}`));
-    });
-    child.on("error", rejectPromise);
+  await startWebServer({
+    host: getString(args, "host"),
+    port: Number(getString(args, "port") ?? numberPreference("webPort")),
+    vaultPath: absolutePath(vaultPath)
   });
 }
 function help() {
@@ -7235,7 +7864,7 @@ async function main() {
       console.log("  Tip: Use a cloud-synced folder (e.g. Google Drive) to share the vault across machines.");
       const customDir = (await readLine(`  Path (Enter to keep default): `)).trim();
       if (customDir && customDir !== currentDir) {
-        const resolved = resolve5(customDir).replace(/\\/g, "/");
+        const resolved = resolve6(customDir).replace(/\\/g, "/");
         saveConfig({ ...config, vaultDir: resolved });
         effectiveVaultPath = resolved + "/vault.db";
         console.log(`  \x1B[32m\u2713\x1B[0m Vault directory set to ${resolved}`);
@@ -7303,7 +7932,7 @@ async function main() {
         if (key === "autoLock") {
           updated.autoLock = value === "true";
         } else if (key === "vaultDir") {
-          updated.vaultDir = isAbsolute(value) ? value : resolve5(value);
+          updated.vaultDir = isAbsolute(value) ? value : resolve6(value);
         } else if (key === "editor") {
           updated.editor = value;
         } else if (key === "autoLockTimeout") {