dsh-vault 0.3.0 → 0.4.0

package/README-zh.md

@@ -43,9 +43,17 @@ dsh-vault 是一个面向 DeepSeek Harness 的安全加密插件：把你在使
 | `vault_get` | 按 id 读取完整条目（含全部密钥） |
 | `vault_search` | 跨标题/分类/用户名/邮箱/手机/主机/端口/URL/备注/标签/自定义字段（含数字/布尔/嵌套值）检索，返回无密摘要；`limit` 须为 1–100 的整数 |
 | `vault_update` | 按 id 更新字段（未提供的字段保留；空字符串清除该字段；`title` 可改名） |
-| `vault_delete` | 按 id 删除条目（不可恢复） |
+| `vault_delete` | 软删除条目（移入回收站，磁盘上仍加密保留） |
+| `vault_restore` / `vault_purge` | 从回收站恢复 / 从磁盘永久移除 |
+| `vault_lock` / `vault_unlock` | 显式锁定保险库（清空内存密钥）/ 重新解锁 |
 | `vault_totp` | 为存储的 otpSecret（或直接传入的 Base32/otpauth URI）生成当前 6 位动态验证码 |
 | `vault_generate_password` | 生成强随机密码（长度/字符集/去歧义/分组可选；`group` 须为 ≥2 的整数） |
+| `vault_rotation` | 报告已过期 / 待轮换 / 即将过期的凭据（不含密钥） |
+| `vault_health` | 扫描弱密码与跨条目复用凭据（不含密钥） |
+| `vault_export` / `vault_import` | 整库加密备份/迁移（独立导出密码） |
+| `vault_fill` | 按 host/URL/用户名/标题匹配条目并返回其凭据 |
+| `vault_env` | 把标记 env 的条目（tags 含 `env`）渲染为 `KEY=VALUE` 行 |
+| `vault_templates` | 返回某类凭据（ssh/api-key/oauth 等）的推荐字段 |
 
 **典型开发场景**：存一条 SSH 凭据（`kind: ssh` + host/port/username/password 或 privateKey），开发时让模型 `vault_search` 找主机、`vault_get` 取连接信息；存 API 网关的 `api-key`/`oauth` 条目管理 access/refresh token 轮换。
 
@@ -130,6 +138,8 @@ tarball 自带预构建 `lib/` 产物,无需构建或 allowBuilds。
 | `name` | 保险库名，用于默认路径（如 `name: work` → `$DSH_HOME/vault/work.json`） |
 | `accessMode` | 模型工具的访问策略，三态：`readonly`（只读，工具与设置页的增/改/删全部被拒绝）、`ask`（默认——写入前询问，每次增/改/删都会走 harness 审批通道请你确认）、`auto`（自动读写，无需逐次确认）。设置页提供同样的三选一下拉并持久化到 `<vault 目录>/access.json`。 |
 | `autoCapture` | `false`（默认）。设为 `true` 时，系统提示词会指导模型识别对话中出现的凭据，并**按用户偏好**用 `vault_add` 提供保存。 |
+| `lockTimeoutSeconds` | 自动锁库：空闲超过该秒数后自动重新锁定（清空内存密钥），之后每次读写需 `vault_unlock`。`0`/缺省为禁用。 |
+| `exportPasswordEnv` | 存放 `vault_export`/`vault_import` 导出密码的环境变量名（绝不能作为模型参数传入）。 |
 
 示例：
 

package/README.md

@@ -45,9 +45,17 @@ Each record has a `title`, an optional `kind`, and any combination of fields:
 | `vault_get` | Read a full entry by id (including all secrets) |
 | `vault_search` | Search titles/categories/usernames/emails/phones/hosts/ports/URLs/notes/tags/custom fields (incl. numeric/boolean/nested values); returns secret-free summaries; `limit` must be an integer 1–100 |
 | `vault_update` | Update fields by id (unprovided fields kept; empty string clears a field; `title` is renamable) |
-| `vault_delete` | Delete an entry by id (irreversible) |
+| `vault_delete` | Soft-delete an entry (moves it to the trash, still encrypted on disk) |
+| `vault_restore` / `vault_purge` | Bring a trashed entry back / permanently remove it from disk |
+| `vault_lock` / `vault_unlock` | Explicitly lock the vault (wipe the in-memory key) / re-unlock it |
 | `vault_totp` | Generate the current 6-digit code for a stored otpSecret (or a bare Base32 / otpauth URI) |
 | `vault_generate_password` | Generate a strong random password (length/character classes/ambiguity exclusion/grouping; `group` must be an integer ≥ 2) |
+| `vault_rotation` | Report expired / due-for-rotation / expiring-soon credentials (no secrets) |
+| `vault_health` | Scan for weak passwords and credentials reused across entries (no secrets) |
+| `vault_export` / `vault_import` | Portable encrypted backup/migration of the whole vault (separate export password) |
+| `vault_fill` | Find the entry matching a host/URL/username/title and return its credentials |
+| `vault_env` | Render env-flagged entries (tags contain `env`) as `KEY=VALUE` lines |
+| `vault_templates` | List recommended fields for a credential kind (ssh / api-key / oauth / …) |
 
 **Typical workflows**: store an SSH credential (`kind: ssh` + host/port/username/password or privateKey) and have the model `vault_search` for the host then `vault_get` the connection details; keep `api-key`/`oauth` entries for API-gateway access/refresh token rotation.
 
@@ -132,6 +140,8 @@ The tarball ships prebuilt `lib/` artifacts, so no build step or `allowBuilds` i
 | `name` | Vault name for the default path (e.g. `name: work` → `$DSH_HOME/vault/work.json`) |
 | `accessMode` | Access policy for the model tools. Three states: `readonly` (mutations rejected on tools + UI), `ask` (default — reads free, every add/update/delete goes through the harness approval channel so the user confirms each write), or `auto` (automatic read-write, no per-call prompt). The Settings UI offers this exact three-way choice and persists it to `<vault dir>/access.json`. |
 | `autoCapture` | `false` (default). When `true`, the system prompt instructs the model to detect credentials shared in conversation and — per user preference — offer to save them with `vault_add`. |
+| `lockTimeoutSeconds` | Auto-lock: after this many seconds of inactivity the vault re-locks (key wiped) and every read/write requires `vault_unlock`. `0`/absent disables. |
+| `exportPasswordEnv` | Environment variable holding the export/import password for `vault_export`/`vault_import` (never pass it as a model argument). |
 
 Example:
 

package/lib/client.js

@@ -7,7 +7,7 @@ window.__ModuleLoader__.load({
 		let react = require("react");
 		let react_jsx_runtime = require("react/jsx-runtime");
 		//#region \0dsh-css:/Users/zhipeng/Desktop/work/dsh test/dsh-vault/src/client/VaultSection.module.css.mjs
-		const css = ".t_j5va_section{flex-direction:column;gap:12px;padding:16px 0;display:flex}.t_j5va_intro{opacity:.75;margin:0;font-size:13px}.t_j5va_toolbar{align-items:center;gap:8px;display:flex}.t_j5va_searchBox{flex:1;display:flex}.t_j5va_searchBox input{border:1px solid var(--color-border,#444);color:inherit;background:0 0;border-radius:6px;flex:1;padding:6px 10px;font-size:13px}.t_j5va_addButton,.t_j5va_saveButton{background:var(--color-accent,#4f8cff);color:#fff;cursor:pointer;border:1px solid #0000;border-radius:6px;padding:6px 12px;font-size:13px}.t_j5va_addButton:disabled,.t_j5va_saveButton:disabled,.t_j5va_rowActions button:disabled{opacity:.5;cursor:not-allowed}.t_j5va_list{flex-direction:column;gap:6px;margin:0;padding:0;list-style:none;display:flex}.t_j5va_row{border:1px solid var(--color-border,#333);border-radius:8px;justify-content:space-between;align-items:center;gap:12px;padding:8px 10px;display:flex}.t_j5va_rowMain{flex-direction:column;gap:2px;min-width:0;display:flex}.t_j5va_title{font-size:14px;font-weight:600}.t_j5va_identity{opacity:.7;text-overflow:ellipsis;white-space:nowrap;font-size:12px;overflow:hidden}.t_j5va_totp{font-family:var(--font-mono,monospace);color:var(--color-accent,#4f8cff);font-size:13px}.t_j5va_rowActions{flex-shrink:0;align-items:center;gap:6px;display:flex}.t_j5va_rowActions button{border:1px solid var(--color-border,#444);color:inherit;cursor:pointer;background:0 0;border-radius:6px;padding:4px 8px;font-size:12px}.t_j5va_deleteButton{color:#e5484d}.t_j5va_copied{color:#30a46c;font-size:12px}.t_j5va_empty,.t_j5va_status,.t_j5va_error{opacity:.8;font-size:13px}.t_j5va_modeReadonly,.t_j5va_modeAsk,.t_j5va_modeAuto{border-radius:999px;width:fit-content;margin:0;padding:4px 10px;font-size:12px;display:inline-block}.t_j5va_modeReadonly{color:#e5484d;border:1px solid #e5484d80}.t_j5va_modeAsk{color:#f5a524;border:1px solid #f5a52480}.t_j5va_modeAuto{color:#30a46c;border:1px solid #30a46c80}.t_j5va_policyBar{flex-direction:column;align-items:flex-start;gap:6px;display:flex}.t_j5va_policyField{align-items:center;gap:8px;font-size:13px;display:flex}.t_j5va_policyField select{border:1px solid var(--color-border,#444);color:inherit;background:0 0;border-radius:6px;padding:4px 8px;font-size:13px}.t_j5va_emptyBox{flex-direction:column;gap:4px;display:flex}.t_j5va_emptyHint{opacity:.65;margin:0;font-size:12px}.t_j5va_error{color:#e5484d}.t_j5va_editor{border:1px solid var(--color-border,#444);border-radius:8px;padding:12px}.t_j5va_editorBody{grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:8px 12px;display:grid}.t_j5va_field{flex-direction:column;gap:4px;font-size:12px;display:flex}.t_j5va_field input,.t_j5va_field select{border:1px solid var(--color-border,#444);color:inherit;background:0 0;border-radius:6px;padding:5px 8px;font-size:13px}.t_j5va_editorActions{justify-content:flex-end;gap:8px;margin-top:12px;display:flex}.t_j5va_editorActions button{border:1px solid var(--color-border,#444);color:inherit;cursor:pointer;background:0 0;border-radius:6px;padding:6px 12px;font-size:13px}";
+		const css = ".t_j5va_section{flex-direction:column;gap:12px;padding:16px 0;display:flex}.t_j5va_intro{opacity:.75;margin:0;font-size:13px}.t_j5va_toolbar{align-items:center;gap:8px;display:flex}.t_j5va_searchBox{flex:1;display:flex}.t_j5va_searchBox input{border:1px solid var(--color-border,#444);color:inherit;background:0 0;border-radius:6px;flex:1;padding:6px 10px;font-size:13px}.t_j5va_addButton,.t_j5va_saveButton{background:var(--color-accent,#4f8cff);color:#fff;cursor:pointer;border:1px solid #0000;border-radius:6px;padding:6px 12px;font-size:13px}.t_j5va_addButton:disabled,.t_j5va_saveButton:disabled,.t_j5va_rowActions button:disabled{opacity:.5;cursor:not-allowed}.t_j5va_list{flex-direction:column;gap:6px;margin:0;padding:0;list-style:none;display:flex}.t_j5va_row{border:1px solid var(--color-border,#333);border-radius:8px;justify-content:space-between;align-items:center;gap:12px;padding:8px 10px;display:flex}.t_j5va_rowMain{flex-direction:column;gap:2px;min-width:0;display:flex}.t_j5va_title{font-size:14px;font-weight:600}.t_j5va_identity{opacity:.7;text-overflow:ellipsis;white-space:nowrap;font-size:12px;overflow:hidden}.t_j5va_totp{font-family:var(--font-mono,monospace);color:var(--color-accent,#4f8cff);font-size:13px}.t_j5va_rowActions{flex-shrink:0;align-items:center;gap:6px;display:flex}.t_j5va_rowActions button{border:1px solid var(--color-border,#444);color:inherit;cursor:pointer;background:0 0;border-radius:6px;padding:4px 8px;font-size:12px}.t_j5va_deleteButton{color:#e5484d}.t_j5va_copied{color:#30a46c;font-size:12px}.t_j5va_empty,.t_j5va_status,.t_j5va_error{opacity:.8;font-size:13px}.t_j5va_modeReadonly,.t_j5va_modeAsk,.t_j5va_modeAuto{border-radius:999px;width:fit-content;margin:0;padding:4px 10px;font-size:12px;display:inline-block}.t_j5va_modeReadonly{color:#e5484d;border:1px solid #e5484d80}.t_j5va_modeAsk{color:#f5a524;border:1px solid #f5a52480}.t_j5va_modeAuto{color:#30a46c;border:1px solid #30a46c80}.t_j5va_policyBar{flex-direction:column;align-items:flex-start;gap:6px;display:flex}.t_j5va_policyField{align-items:center;gap:8px;font-size:13px;display:flex}.t_j5va_policyField select{border:1px solid var(--color-border,#444);color:inherit;background:0 0;border-radius:6px;padding:4px 8px;font-size:13px}.t_j5va_emptyBox{flex-direction:column;gap:4px;display:flex}.t_j5va_emptyHint{opacity:.65;margin:0;font-size:12px}.t_j5va_error{color:#e5484d}.t_j5va_editor{border:1px solid var(--color-border,#444);border-radius:8px;padding:12px}.t_j5va_editorBody{grid-template-columns:repeat(auto-fill,minmax(220px,1fr));gap:8px 12px;display:grid}.t_j5va_field{flex-direction:column;gap:4px;font-size:12px;display:flex}.t_j5va_field input,.t_j5va_field select{border:1px solid var(--color-border,#444);color:inherit;background:0 0;border-radius:6px;padding:5px 8px;font-size:13px}.t_j5va_editorActions{justify-content:flex-end;gap:8px;margin-top:12px;display:flex}.t_j5va_editorActions button{border:1px solid var(--color-border,#444);color:inherit;cursor:pointer;background:0 0;border-radius:6px;padding:6px 12px;font-size:13px}.t_j5va_reportBox{border:1px solid #f5a52466;border-radius:8px;flex-direction:column;gap:2px;padding:8px 10px;font-size:12px;display:flex}.t_j5va_reportTitle{margin:0;font-weight:600}.t_j5va_reportLine{opacity:.8;margin:0}.t_j5va_trashButton{border:1px solid var(--color-border,#444);color:inherit;cursor:pointer;background:0 0;border-radius:6px;align-self:flex-start;padding:4px 8px;font-size:12px}";
 		const tagId = "dsh-vault/VaultSection.module.css";
 		if (typeof document !== "undefined" && document.querySelector("style[data-plugin-css=" + JSON.stringify(tagId) + "]") === null) {
 			const tag = document.createElement("style");
@@ -17,35 +17,39 @@ window.__ModuleLoader__.load({
 			document.head.appendChild(tag);
 		}
 		var VaultSection_module_css_default = {
-			"emptyBox": "t_j5va_emptyBox",
-			"modeAuto": "t_j5va_modeAuto",
-			"modeAsk": "t_j5va_modeAsk",
-			"rowActions": "t_j5va_rowActions",
 			"field": "t_j5va_field",
+			"deleteButton": "t_j5va_deleteButton",
 			"totp": "t_j5va_totp",
-			"toolbar": "t_j5va_toolbar",
-			"row": "t_j5va_row",
-			"section": "t_j5va_section",
-			"identity": "t_j5va_identity",
-			"modeReadonly": "t_j5va_modeReadonly",
-			"searchBox": "t_j5va_searchBox",
-			"policyField": "t_j5va_policyField",
+			"trashButton": "t_j5va_trashButton",
+			"empty": "t_j5va_empty",
 			"saveButton": "t_j5va_saveButton",
-			"deleteButton": "t_j5va_deleteButton",
 			"copied": "t_j5va_copied",
-			"editorBody": "t_j5va_editorBody",
 			"addButton": "t_j5va_addButton",
-			"empty": "t_j5va_empty",
+			"identity": "t_j5va_identity",
+			"row": "t_j5va_row",
+			"emptyHint": "t_j5va_emptyHint",
+			"modeAsk": "t_j5va_modeAsk",
+			"policyBar": "t_j5va_policyBar",
 			"status": "t_j5va_status",
+			"modeAuto": "t_j5va_modeAuto",
+			"editor": "t_j5va_editor",
+			"editorBody": "t_j5va_editorBody",
+			"reportTitle": "t_j5va_reportTitle",
+			"rowActions": "t_j5va_rowActions",
+			"reportLine": "t_j5va_reportLine",
+			"section": "t_j5va_section",
+			"reportBox": "t_j5va_reportBox",
 			"error": "t_j5va_error",
+			"searchBox": "t_j5va_searchBox",
 			"list": "t_j5va_list",
 			"rowMain": "t_j5va_rowMain",
-			"policyBar": "t_j5va_policyBar",
+			"title": "t_j5va_title",
+			"modeReadonly": "t_j5va_modeReadonly",
+			"emptyBox": "t_j5va_emptyBox",
 			"intro": "t_j5va_intro",
 			"editorActions": "t_j5va_editorActions",
-			"editor": "t_j5va_editor",
-			"title": "t_j5va_title",
-			"emptyHint": "t_j5va_emptyHint"
+			"toolbar": "t_j5va_toolbar",
+			"policyField": "t_j5va_policyField"
 		};
 		//#endregion
 		//#region src/client/VaultSection.tsx
@@ -138,7 +142,7 @@ window.__ModuleLoader__.load({
 		}
 		/** Render the Vault settings section. */
 		function VaultSection(props) {
-			const { t, config, setAccessMode, list, search, get, add, update, remove, totp } = props;
+			const { t, config, setAccessMode, list, search, get, add, update, remove, trash, rotation, health, restore, totp } = props;
 			const searchId = (0, react.useId)();
 			const [query, setQuery] = (0, react.useState)("");
 			const [state, setState] = (0, react.useState)({ status: "loading" });
@@ -150,6 +154,9 @@ window.__ModuleLoader__.load({
 			const [codeMap, setCodeMap] = (0, react.useState)({});
 			const [tagsDraft, setTagsDraft] = (0, react.useState)("");
 			const [policy, setPolicy] = (0, react.useState)(null);
+			const [showTrash, setShowTrash] = (0, react.useState)(false);
+			const [trashEntries, setTrashEntries] = (0, react.useState)([]);
+			const [report, setReport] = (0, react.useState)(null);
 			const readonly = policy?.accessMode === "readonly";
 			(0, react.useEffect)(() => {
 				let current = true;
@@ -424,6 +431,80 @@ window.__ModuleLoader__.load({
 							children: readonly ? t("emptyHintReadonly") : t("emptyHint")
 						})]
 					}),
+					report !== null && (report.rotation.length > 0 || report.weak.length > 0 || report.reused.length > 0) && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+						className: VaultSection_module_css_default.reportBox,
+						children: [
+							/* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+								className: VaultSection_module_css_default.reportTitle,
+								children: t("reportTitle")
+							}),
+							report.rotation.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+								className: VaultSection_module_css_default.reportLine,
+								children: [
+									t("reportRotation"),
+									": ",
+									report.rotation.length
+								]
+							}),
+							report.weak.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+								className: VaultSection_module_css_default.reportLine,
+								children: [
+									t("reportWeak"),
+									": ",
+									report.weak.length
+								]
+							}),
+							report.reused.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("p", {
+								className: VaultSection_module_css_default.reportLine,
+								children: [
+									t("reportReused"),
+									": ",
+									report.reused.length
+								]
+							})
+						]
+					}),
+					/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("button", {
+						type: "button",
+						className: VaultSection_module_css_default.trashButton,
+						onClick: () => {
+							if (!showTrash) trash().then(setTrashEntries);
+							setShowTrash(!showTrash);
+						},
+						children: [showTrash ? t("hideTrash") : t("showTrash"), trashEntries.length > 0 ? ` (${trashEntries.length})` : ""]
+					}),
+					showTrash && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("ul", {
+						className: VaultSection_module_css_default.list,
+						children: [trashEntries.map((entry) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("li", {
+							className: VaultSection_module_css_default.row,
+							children: [/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
+								className: VaultSection_module_css_default.rowMain,
+								children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: VaultSection_module_css_default.title,
+									children: entry.title
+								}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+									className: VaultSection_module_css_default.identity,
+									children: t("trashed")
+								})]
+							}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
+								className: VaultSection_module_css_default.rowActions,
+								children: /* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
+									type: "button",
+									onClick: () => {
+										restore(entry.id).then(() => {
+											trash().then(setTrashEntries);
+											refresh();
+										});
+									},
+									disabled: busy || readonly,
+									children: t("restore")
+								})
+							})]
+						}, entry.id)), trashEntries.length === 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("p", {
+							className: VaultSection_module_css_default.empty,
+							children: t("trashEmpty")
+						})]
+					}),
 					state.status === "ready" && state.entries.length > 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("ul", {
 						className: VaultSection_module_css_default.list,
 						children: state.entries.map((entry) => {
@@ -564,6 +645,15 @@ window.__ModuleLoader__.load({
 			modeAutoHint: "Automatic read-write — no per-call prompt",
 			autoCaptureOn: "auto-capture on",
 			autoCaptureOff: "auto-capture off",
+			reportTitle: "Health & rotation",
+			reportRotation: "expired / due for rotation",
+			reportWeak: "weak passwords",
+			reportReused: "credentials reused across entries",
+			showTrash: "Trash",
+			hideTrash: "Hide trash",
+			trashed: "in trash",
+			trashEmpty: "Trash is empty",
+			restore: "Restore",
 			add: "Add credential",
 			cancel: "Cancel",
 			save: "Save",
@@ -616,6 +706,15 @@ window.__ModuleLoader__.load({
 			modeAutoHint: "自动读写 —— 无需逐次确认",
 			autoCaptureOn: "自动捕获已开启",
 			autoCaptureOff: "自动捕获已关闭",
+			reportTitle: "健康与轮换",
+			reportRotation: "已过期 / 待轮换",
+			reportWeak: "弱密码",
+			reportReused: "跨条目复用的凭据",
+			showTrash: "回收站",
+			hideTrash: "隐藏回收站",
+			trashed: "已删除",
+			trashEmpty: "回收站为空",
+			restore: "恢复",
 			add: "新增凭据",
 			cancel: "取消",
 			save: "保存",
@@ -693,6 +792,10 @@ window.__ModuleLoader__.load({
 					patch
 				}),
 				remove: (id) => invoke("delete", { id }),
+				trash: () => invoke("trash").then((r) => r.entries),
+				rotation: () => invoke("rotation").then((r) => r.entries),
+				health: () => invoke("health"),
+				restore: (id) => invoke("restore", { id }),
 				totp: (id) => invoke("totp", { id })
 			});
 			ctx.slots.inject("settings.section", () => ctx.slots.register({

package/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","names":["css"],"sources":["../src/client/VaultSection.tsx","../src/client/locales.ts","../src/client/index.ts"],"sourcesContent":["/**\n * Vault settings section: list, search, add, edit, delete, and copy encrypted\n * credentials. All mutations go through the host VaultGateway remote; secrets\n * are shown only inside the edit form or a copy action, never in the list.\n */\n\nimport { useEffect, useId, useMemo, useState, type ReactNode } from 'react'\nimport type { PropsLocale, PropsRuntime, InjectFace, TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'\nimport type { VaultLocaleKey } from './locales.ts'\nimport css from './VaultSection.module.css'\n\n/** Wire shapes shared with the host gateway (mirror of src/index.ts types). */\nexport interface VaultSummaryWire {\n  id: string\n  title: string\n  kind?: string\n  username?: string\n  email?: string\n  phone?: string\n  host?: string\n  port?: string\n  url?: string\n  tags?: string[]\n}\n\nexport interface VaultFullWire {\n  id: string\n  title: string\n  kind?: string\n  username?: string\n  email?: string\n  phone?: string\n  password?: string\n  host?: string\n  port?: string\n  privateKey?: string\n  apiKey?: string\n  secret?: string\n  accessToken?: string\n  refreshToken?: string\n  expiresAt?: number\n  otpSecret?: string\n  url?: string\n  notes?: string\n  tags?: string[]\n  fields?: Record<string, unknown>\n}\n\n/** Patch shape accepted by vault.add / vault.update. */\nexport type VaultPatch = Partial<Omit<VaultFullWire, 'id'>>\n\n/** Registration-side business face supplied by the plugin entry. */\nexport interface VaultSectionInjected {\n  t: TranslateNS<'settings.vault'>\n  config: () => Promise<{ accessMode: 'readonly' | 'ask' | 'auto'; autoCapture: boolean }>\n  setAccessMode: (mode: 'readonly' | 'ask' | 'auto') => Promise<{ accessMode: 'readonly' | 'ask' | 'auto'; autoCapture: boolean }>\n  list: () => Promise<VaultSummaryWire[]>\n  search: (query: string, limit?: number) => Promise<VaultSummaryWire[]>\n  get: (id: string) => Promise<{ found: boolean; entry?: VaultFullWire }>\n  add: (patch: VaultPatch & { title: string }) => Promise<VaultSummaryWire>\n  update: (id: string, patch: VaultPatch) => Promise<{ found: boolean; entry?: VaultSummaryWire }>\n  remove: (id: string) => Promise<{ deleted: boolean }>\n  totp: (id: string) => Promise<{ code: string; label?: string; secondsRemaining: number }>\n}\n\n/** Type-level alias so consumers can reference the wire shapes without values. */\nexport type VaultSectionTypes = {\n  entries: VaultSummaryWire[]\n  fullEntry: VaultFullWire\n  summaryEntry: VaultSummaryWire\n  config: { accessMode: 'readonly' | 'ask' | 'auto'; autoCapture: boolean }\n  accessModes: Array<'readonly' | 'ask' | 'auto'>\n}\n\n/** Full component props assembled by the Settings slot renderer. */\nexport type VaultSectionProps =\n  PropsRuntime<'settings.section'>\n  & PropsLocale<'settings.vault'>\n  & InjectFace<VaultSectionInjected>\n\n/** The editable form fields we render (subset of the full wire). */\ntype FormFields = Pick<\n  VaultFullWire, 'title' | 'kind' | 'username' | 'email' | 'phone' | 'password' | 'host' | 'port'\n  | 'privateKey' | 'apiKey' | 'secret' | 'accessToken' | 'refreshToken' | 'otpSecret' | 'url' | 'notes'\n>\n\nconst FORM_FIELDS: Array<{ key: keyof FormFields; label: VaultLocaleKey }> = [\n  { key: 'title', label: 'fieldTitle' },\n  { key: 'kind', label: 'fieldKind' },\n  { key: 'username', label: 'fieldUsername' },\n  { key: 'email', label: 'fieldEmail' },\n  { key: 'phone', label: 'fieldPhone' },\n  { key: 'password', label: 'fieldPassword' },\n  { key: 'host', label: 'fieldHost' },\n  { key: 'port', label: 'fieldPort' },\n  { key: 'apiKey', label: 'fieldApiKey' },\n  { key: 'secret', label: 'fieldSecret' },\n  { key: 'accessToken', label: 'fieldAccessToken' },\n  { key: 'refreshToken', label: 'fieldRefreshToken' },\n  { key: 'otpSecret', label: 'fieldOtpSecret' },\n  { key: 'url', label: 'fieldUrl' },\n  { key: 'notes', label: 'fieldNotes' },\n]\n\nconst KIND_KEYS: Record<string, VaultLocaleKey> = {\n  login: 'kindLogin',\n  ssh: 'kindSsh',\n  'api-key': 'kindApiKey',\n  secret: 'kindSecret',\n  oauth: 'kindOauth',\n  custom: 'kindCustom',\n}\n\ntype ViewState =\n  | { readonly status: 'loading' }\n  | { readonly status: 'error' }\n  | { readonly status: 'ready'; readonly entries: VaultSummaryWire[] }\n\ntype EditorState =\n  | { readonly status: 'closed' }\n  | { readonly status: 'creating' }\n  | { readonly status: 'editing'; readonly entry: VaultFullWire }\n\nfunction emptyForm(): FormFields {\n  return { title: '', kind: 'login', username: '', email: '', phone: '', password: '', host: '', port: '' }\n}\n\n/** Render the Vault settings section. */\nexport function VaultSection(props: VaultSectionProps): ReactNode {\n  const { t, config, setAccessMode, list, search, get, add, update, remove, totp } = props\n  const searchId = useId()\n  const [query, setQuery] = useState('')\n  const [state, setState] = useState<ViewState>({ status: 'loading' })\n  const [editor, setEditor] = useState<EditorState>({ status: 'closed' })\n  const [form, setForm] = useState<FormFields>(emptyForm())\n  const [busy, setBusy] = useState(false)\n  const [message, setMessage] = useState<string | null>(null)\n  const [copiedId, setCopiedId] = useState<string | null>(null)\n  const [codeMap, setCodeMap] = useState<Record<string, string>>({})\n  const [tagsDraft, setTagsDraft] = useState('')\n  const [policy, setPolicy] = useState<{ accessMode: 'readonly' | 'ask' | 'auto'; autoCapture: boolean } | null>(null)\n\n  const readonly = policy?.accessMode === 'readonly'\n\n  useEffect(() => {\n    let current = true\n    void config().then(\n      value => { if (current) setPolicy(value) },\n      () => { /* policy is informational; ignore failures */ },\n    )\n    return () => { current = false }\n  }, [config])\n\n  const refresh = useMemo(() => async () => {\n    setState({ status: 'loading' })\n    try {\n      const entries = query.trim().length === 0\n        ? await list()\n        : await search(query.trim())\n      setState({ status: 'ready', entries })\n    } catch {\n      setState({ status: 'error' })\n    }\n  }, [list, search, query])\n\n  useEffect(() => {\n    let current = true\n    void Promise.resolve().then(refresh).then(\n      () => { /* state already set inside refresh */ },\n      () => { if (current) setState({ status: 'error' }) },\n    )\n    return () => { current = false }\n    // refresh is memoized on query; list/search are stable inject faces.\n  }, [refresh])\n\n  /** Open the editor for a new entry. */\n  function startCreate(): void {\n    setForm(emptyForm())\n    setTagsDraft('')\n    setMessage(null)\n    setEditor({ status: 'creating' })\n  }\n\n  /** Open the editor for an existing entry (fetches full secrets). */\n  async function startEdit(id: string): Promise<void> {\n    setBusy(true)\n    setMessage(null)\n    try {\n      const result = await get(id)\n      if (!result.found || result.entry === undefined) {\n        setMessage(t('error'))\n        return\n      }\n      const entry = result.entry\n      setForm({\n        title: entry.title ?? '',\n        kind: entry.kind ?? 'login',\n        username: entry.username ?? '',\n        email: entry.email ?? '',\n        phone: entry.phone ?? '',\n        password: entry.password ?? '',\n        host: entry.host ?? '',\n        port: entry.port ?? '',\n        privateKey: entry.privateKey ?? '',\n        apiKey: entry.apiKey ?? '',\n        secret: entry.secret ?? '',\n        accessToken: entry.accessToken ?? '',\n        refreshToken: entry.refreshToken ?? '',\n        otpSecret: entry.otpSecret ?? '',\n        url: entry.url ?? '',\n        notes: entry.notes ?? '',\n      })\n      setTagsDraft((entry.tags ?? []).join(', '))\n      setEditor({ status: 'editing', entry })\n    } catch {\n      setMessage(t('error'))\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  /** Save the current form (create or update). */\n  async function save(): Promise<void> {\n    if (!form.title.trim()) {\n      setMessage(t('error'))\n      return\n    }\n    setBusy(true)\n    setMessage(null)\n    try {\n      const tags = tagsDraft.split(',').map(x => x.trim()).filter(x => x.length > 0)\n      const patch: VaultPatch = {\n        title: form.title.trim(),\n        ...(form.kind !== undefined ? { kind: form.kind } : {}),\n        ...(form.username !== undefined ? { username: form.username } : {}),\n        ...(form.email !== undefined ? { email: form.email } : {}),\n        ...(form.phone !== undefined ? { phone: form.phone } : {}),\n        ...(form.password !== undefined ? { password: form.password } : {}),\n        ...(form.host !== undefined ? { host: form.host } : {}),\n        ...(form.port !== undefined ? { port: form.port } : {}),\n        ...(form.privateKey !== undefined ? { privateKey: form.privateKey } : {}),\n        ...(form.apiKey !== undefined ? { apiKey: form.apiKey } : {}),\n        ...(form.secret !== undefined ? { secret: form.secret } : {}),\n        ...(form.accessToken !== undefined ? { accessToken: form.accessToken } : {}),\n        ...(form.refreshToken !== undefined ? { refreshToken: form.refreshToken } : {}),\n        ...(form.otpSecret !== undefined ? { otpSecret: form.otpSecret } : {}),\n        ...(form.url !== undefined ? { url: form.url } : {}),\n        ...(form.notes !== undefined ? { notes: form.notes } : {}),\n        // Always send tags: an empty array clears them, and the host store\n        // treats empty string values as \"clear this field\" too.\n        tags,\n      }\n      if (editor.status === 'creating') {\n        await add(patch as VaultPatch & { title: string })\n      } else if (editor.status === 'editing') {\n        await update(editor.entry.id, patch)\n      }\n      setEditor({ status: 'closed' })\n      await refresh()\n    } catch {\n      setMessage(t('error'))\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  /** Delete an entry after confirmation. */\n  async function removeEntry(id: string): Promise<void> {\n    if (!window.confirm(t('deleteConfirm'))) return\n    setBusy(true)\n    try {\n      await remove(id)\n      await refresh()\n    } catch {\n      setMessage(t('error'))\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  /** Copy a field value to the clipboard and flash the row. */\n  async function copyValue(id: string, value: string): Promise<void> {\n    try {\n      await navigator.clipboard.writeText(value)\n    } catch {\n      // Clipboard may be blocked; fall back to a temporary textarea.\n      const textarea = document.createElement('textarea')\n      textarea.value = value\n      document.body.appendChild(textarea)\n      textarea.select()\n      document.execCommand('copy')\n      textarea.remove()\n    }\n    setCopiedId(id)\n    window.setTimeout(() => setCopiedId(null), 1500)\n  }\n\n  /** Fetch and display a TOTP code for an entry with an otpSecret. */\n  async function showTotp(id: string): Promise<void> {\n    setBusy(true)\n    try {\n      const result = await totp(id)\n      setCodeMap(previous => ({ ...previous, [id]: `${result.code} (${result.secondsRemaining}s)` }))\n    } catch {\n      setCodeMap(previous => ({ ...previous, [id]: t('error') }))\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  /** Field-set summary line for one entry (non-secret). */\n  function identityLine(entry: VaultSummaryWire): string {\n    const parts = [\n      entry.kind !== undefined ? t(KIND_KEYS[entry.kind] ?? 'kindCustom') : t('kindLogin'),\n      entry.username,\n      entry.email,\n      entry.phone,\n      entry.host !== undefined ? `${entry.host}${entry.port !== undefined ? `:${entry.port}` : ''}` : undefined,\n      entry.url,\n    ].filter((value): value is string => value !== undefined && value.length > 0)\n    return parts.join(' · ')\n  }\n\n  return (\n    <section className={css.section} aria-labelledby=\"vault-heading\">\n      <h2 id=\"vault-heading\">{t('heading')}</h2>\n      <p className={css.intro}>{t('intro')}</p>\n\n      <div className={css.toolbar}>\n        <label className={css.searchBox}>\n          <span className=\"sr-only\">{t('searchPlaceholder')}</span>\n          <input\n            id={searchId}\n            type=\"search\"\n            placeholder={t('searchPlaceholder')}\n            value={query}\n            onChange={event => setQuery(event.target.value)}\n          />\n        </label>\n        <button type=\"button\" className={css.addButton} onClick={startCreate} disabled={busy || readonly}>\n          + {t('add')}\n        </button>\n      </div>\n\n      {policy !== null && (\n        <div className={css.policyBar}>\n          <label className={css.policyField}>\n            <span>{t('modeLabel')}</span>\n            <select\n              value={policy.accessMode}\n              disabled={busy}\n              onChange={event => {\n                const next = event.target.value as 'readonly' | 'ask' | 'auto'\n                setBusy(true)\n                setMessage(null)\n                void setAccessMode(next).then(\n                  value => { setPolicy(value); setBusy(false) },\n                  () => { setMessage(t('error')); setBusy(false) },\n                )\n              }}\n            >\n              <option value=\"readonly\">{t('modeReadonly')}</option>\n              <option value=\"ask\">{t('modeAsk')}</option>\n              <option value=\"auto\">{t('modeAuto')}</option>\n            </select>\n          </label>\n          <p className={policy.accessMode === 'readonly' ? css.modeReadonly : policy.accessMode === 'ask' ? css.modeAsk : css.modeAuto}>\n            {policy.accessMode === 'readonly'\n              ? t('modeReadonlyHint')\n              : policy.accessMode === 'ask'\n                ? t('modeAskHint')\n                : t('modeAutoHint')}\n            {policy.autoCapture ? ` · ${t('autoCaptureOn')}` : ` · ${t('autoCaptureOff')}`}\n          </p>\n        </div>\n      )}\n\n      {message !== null && <p role=\"alert\" className={css.error}>{message}</p>}\n\n      {state.status === 'loading' && <p className={css.status}>{t('loading')}</p>}\n      {state.status === 'error' && <p role=\"alert\" className={css.error}>{t('error')}</p>}\n      {state.status === 'ready' && state.entries.length === 0 && (\n        <div className={css.emptyBox}>\n          <p className={css.empty}>{t('empty')}</p>\n          <p className={css.emptyHint}>{readonly ? t('emptyHintReadonly') : t('emptyHint')}</p>\n        </div>\n      )}\n\n      {state.status === 'ready' && state.entries.length > 0 && (\n        <ul className={css.list}>\n          {state.entries.map(entry => {\n            const code = codeMap[entry.id]\n            return (\n              <li key={entry.id} className={css.row}>\n                <div className={css.rowMain}>\n                  <span className={css.title}>{entry.title}</span>\n                  <span className={css.identity}>{identityLine(entry)}</span>\n                  {code !== undefined && <span className={css.totp}>{code}</span>}\n                </div>\n                <div className={css.rowActions}>\n                  {copiedId === entry.id && <span className={css.copied}>{t('copied')}</span>}\n                  <button\n                    type=\"button\"\n                    onClick={() => void copyValue(entry.id, entry.username ?? entry.title)}\n                    disabled={busy}\n                  >{t('copy')}</button>\n                  <button type=\"button\" onClick={() => void showTotp(entry.id)} disabled={busy}>{t('totp')}</button>\n                  <button type=\"button\" onClick={() => void startEdit(entry.id)} disabled={busy || readonly}>{t('edit')}</button>\n                  <button\n                    type=\"button\"\n                    className={css.deleteButton}\n                    onClick={() => void removeEntry(entry.id)}\n                    disabled={busy || readonly}\n                  >{t('delete')}</button>\n                </div>\n              </li>\n            )\n          })}\n        </ul>\n      )}\n\n      {editor.status !== 'closed' && (\n        <div className={css.editor} role=\"dialog\" aria-label={editor.status === 'creating' ? t('add') : t('edit')}>\n          <div className={css.editorBody}>\n            {FORM_FIELDS.map(field => (\n              <label key={field.key} className={css.field}>\n                <span>{t(field.label)}</span>\n                {field.key === 'kind' ? (\n                  <select\n                    value={form.kind ?? 'login'}\n                    onChange={event => setForm(previous => ({ ...previous, kind: event.target.value }))}\n                  >\n                    {Object.entries(KIND_KEYS).map(([value, key]) => (\n                      <option key={value} value={value}>{t(key)}</option>\n                    ))}\n                  </select>\n                ) : field.key === 'title' ? (\n                  <input\n                    value={form.title ?? ''}\n                    onChange={event => setForm(previous => ({ ...previous, title: event.target.value }))}\n                  />\n                ) : (\n                  <input\n                    type={field.key === 'password' || field.key === 'otpSecret' ? 'password' : 'text'}\n                    value={(form[field.key] as string | undefined) ?? ''}\n                    onChange={event => setForm(previous => ({ ...previous, [field.key]: event.target.value }))}\n                  />\n                )}\n              </label>\n            ))}\n            <label className={css.field}>\n              <span>{t('fieldTags')}</span>\n              <input\n                value={tagsDraft}\n                onChange={event => setTagsDraft(event.target.value)}\n                placeholder=\"dev, prod\"\n              />\n            </label>\n          </div>\n          <div className={css.editorActions}>\n            <button type=\"button\" onClick={() => setEditor({ status: 'closed' })} disabled={busy}>{t('cancel')}</button>\n            <button type=\"button\" className={css.saveButton} onClick={() => void save()} disabled={busy}>{t('save')}</button>\n          </div>\n        </div>\n      )}\n    </section>\n  )\n}\n","/** Copy dictionaries for the Vault settings section. */\n\n/** English strings (the key-set source of truth for this pair). */\nexport const en = {\n  nav: 'Vault',\n  heading: 'Vault',\n  intro: 'Encrypted credentials stored on this machine.',\n  searchPlaceholder: 'Search title, username, email, host…',\n  loading: 'Loading…',\n  empty: 'No credentials yet. Add one to get started.',\n  emptyHint: 'Tip: you can ask the assistant to save an API key or token you share in chat — with auto-capture on it offers to store it for you.',\n  emptyHintReadonly: 'The vault is in readonly mode — credentials can be read but not added here. Switch accessMode to \"readwrite\" to enable writes.',\n  modeLabel: 'Access mode',\n  modeReadonly: 'Read-only',\n  modeAsk: 'Ask before writing',\n  modeAuto: 'Automatic read-write',\n  modeReadonlyHint: 'Read-only — mutations disabled',\n  modeAskHint: 'Prompt before writing — every add/update/delete asks you',\n  modeAutoHint: 'Automatic read-write — no per-call prompt',\n  autoCaptureOn: 'auto-capture on',\n  autoCaptureOff: 'auto-capture off',\n  add: 'Add credential',\n  cancel: 'Cancel',\n  save: 'Save',\n  edit: 'Edit',\n  delete: 'Delete',\n  deleteConfirm: 'Delete this entry? This cannot be undone.',\n  copy: 'Copy',\n  copied: 'Copied',\n  totp: 'Code',\n  fieldTitle: 'Title',\n  fieldKind: 'Kind',\n  fieldUsername: 'Username',\n  fieldEmail: 'Email',\n  fieldPhone: 'Phone',\n  fieldPassword: 'Password',\n  fieldHost: 'Host',\n  fieldPort: 'Port',\n  fieldApiKey: 'API key',\n  fieldSecret: 'Secret',\n  fieldAccessToken: 'Access token',\n  fieldRefreshToken: 'Refresh token',\n  fieldOtpSecret: 'OTP secret',\n  fieldUrl: 'URL',\n  fieldNotes: 'Notes',\n  fieldTags: 'Tags',\n  error: 'Something went wrong.',\n  kindLogin: 'Login',\n  kindSsh: 'SSH',\n  kindApiKey: 'API key',\n  kindSecret: 'Secret',\n  kindOauth: 'OAuth',\n  kindCustom: 'Custom',\n} as const\n\nexport type VaultLocaleKey = keyof typeof en\n\n/** Chinese strings (same keys as English). */\nexport const zh: Record<VaultLocaleKey, string> = {\n  nav: '凭据库',\n  heading: 'Vault 凭据库',\n  intro: '本机加密存储的凭据。',\n  searchPlaceholder: '搜索标题、用户名、邮箱、主机…',\n  loading: '加载中…',\n  empty: '还没有凭据，添加一条开始使用。',\n  emptyHint: '提示：你可以在对话中把 API Key 或 token 交给助手保存——开启自动捕获后，它会在你同意时帮你存入本库。',\n  emptyHintReadonly: '当前为只读模式——只能读取凭据，不能在此添加。将 accessMode 改为 \"readwrite\" 即可启用写入。',\n  modeLabel: '访问模式',\n  modeReadonly: '只读',\n  modeAsk: '写入前询问',\n  modeAuto: '自动读写',\n  modeReadonlyHint: '只读 —— 变更已禁用',\n  modeAskHint: '写入前询问 —— 每次增/改/删都会征求你的确认',\n  modeAutoHint: '自动读写 —— 无需逐次确认',\n  autoCaptureOn: '自动捕获已开启',\n  autoCaptureOff: '自动捕获已关闭',\n  add: '新增凭据',\n  cancel: '取消',\n  save: '保存',\n  edit: '编辑',\n  delete: '删除',\n  deleteConfirm: '确定删除该条目？此操作不可撤销。',\n  copy: '复制',\n  copied: '已复制',\n  totp: '验证码',\n  fieldTitle: '标题',\n  fieldKind: '类型',\n  fieldUsername: '用户名',\n  fieldEmail: '邮箱',\n  fieldPhone: '手机号',\n  fieldPassword: '密码',\n  fieldHost: '主机',\n  fieldPort: '端口',\n  fieldApiKey: 'API 密钥',\n  fieldSecret: 'Secret',\n  fieldAccessToken: '访问令牌',\n  fieldRefreshToken: '刷新令牌',\n  fieldOtpSecret: 'TOTP 密钥',\n  fieldUrl: 'URL',\n  fieldNotes: '备注',\n  fieldTags: '标签',\n  error: '操作失败。',\n  kindLogin: '登录',\n  kindSsh: 'SSH',\n  kindApiKey: 'API 密钥',\n  kindSecret: 'Secret',\n  kindOauth: 'OAuth',\n  kindCustom: '自定义',\n}\n","/**\n * dsh-vault browser half: a Vault settings page managing encrypted\n * credentials — list, search, add, edit, delete, and copy — through the host\n * VaultGateway remote over the /api RPC channel.\n *\n * @module dsh-vault/client\n */\n\nimport type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'\nimport type { ConnectionHandle } from '@deepseek-ai/dsh-api-remotes/client'\nimport type {} from '@deepseek-ai/dsh-client-locale/client'\nimport type {} from '@deepseek-ai/dsh-client-ui-settings/client'\nimport { VaultSection, type VaultSectionInjected } from './VaultSection.tsx'\nimport type { VaultSectionTypes } from './VaultSection.tsx'\nimport { en, zh, type VaultLocaleKey } from './locales.ts'\n\nexport type { VaultSectionInjected, VaultSectionProps } from './VaultSection.tsx'\nexport type { VaultSectionTypes } from './VaultSection.tsx'\nexport type { VaultLocaleKey } from './locales.ts'\n\ndeclare module '@deepseek-ai/dsh-client-ui-slots' {\n  interface LocaleNamespaceMap {\n    /** Vault settings page copy. */\n    'settings.vault': VaultLocaleKey\n  }\n}\n\n/** Dictionary namespace owned by this plugin. */\nexport const NS = 'settings.vault'\n\n/** Services required by the Settings registration and the RPC face. */\nexport const inject = ['slots', 'locale', 'connection']\n\n/**\n * Register the Vault settings section once the `settings.section` declaration\n * is on the ledger. The section talks to the host through the connection RPC\n * channel (endpoints `vault/*` served by the host VaultGateway remote).\n */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-vault: dictionaries')\n\n  const t = ctx.locale.bind(NS)\n  const connection = ctx.get('connection') as ConnectionHandle\n\n  /** Invoke one host vault remote and normalize the RPC envelope. */\n  async function invoke<T>(method: string, args: Record<string, unknown> = {}): Promise<T> {\n    const result = await connection.rpc.call('/api', `vault/${method}`, { args })\n    if (!result.ok) {\n      throw new Error(`vault.${method} failed: ${result.error.code}: ${result.error.message}`)\n    }\n    return result.value as T\n  }\n\n  const injected = (): VaultSectionInjected => ({\n    t,\n    config: () => invoke<VaultSectionTypes['config']>('config'),\n    setAccessMode: (mode) => invoke<VaultSectionTypes['config']>('setAccessMode', { mode }),\n    list: () => invoke<{ entries: VaultSectionTypes['entries'] }>('list').then(r => r.entries),\n    search: (query, limit) => invoke<{ entries: VaultSectionTypes['entries'] }>('search', { query, limit: limit ?? 50 }).then(r => r.entries),\n    get: (id) => invoke<{ found: boolean; entry?: VaultSectionTypes['fullEntry'] }>('get', { id }),\n    add: (patch) => invoke<VaultSectionTypes['summaryEntry']>('add', { patch }),\n    update: (id, patch) => invoke<{ found: boolean; entry?: VaultSectionTypes['summaryEntry'] }>('update', { id, patch }),\n    remove: (id) => invoke<{ deleted: boolean }>('delete', { id }),\n    totp: (id) => invoke<{ code: string; label?: string; secondsRemaining: number }>('totp', { id }),\n  })\n\n  ctx.slots.inject('settings.section', () => ctx.slots.register({\n    name: 'settings.section',\n    id: 'vault',\n    order: 30,\n    label: () => t('nav'),\n    inject: injected,\n  }, VaultSection))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsFA,MAAM,cAAuE;GAC3E;IAAE,KAAK;IAAS,OAAO;GAAa;GACpC;IAAE,KAAK;IAAQ,OAAO;GAAY;GAClC;IAAE,KAAK;IAAY,OAAO;GAAgB;GAC1C;IAAE,KAAK;IAAS,OAAO;GAAa;GACpC;IAAE,KAAK;IAAS,OAAO;GAAa;GACpC;IAAE,KAAK;IAAY,OAAO;GAAgB;GAC1C;IAAE,KAAK;IAAQ,OAAO;GAAY;GAClC;IAAE,KAAK;IAAQ,OAAO;GAAY;GAClC;IAAE,KAAK;IAAU,OAAO;GAAc;GACtC;IAAE,KAAK;IAAU,OAAO;GAAc;GACtC;IAAE,KAAK;IAAe,OAAO;GAAmB;GAChD;IAAE,KAAK;IAAgB,OAAO;GAAoB;GAClD;IAAE,KAAK;IAAa,OAAO;GAAiB;GAC5C;IAAE,KAAK;IAAO,OAAO;GAAW;GAChC;IAAE,KAAK;IAAS,OAAO;GAAa;EACtC;EAEA,MAAM,YAA4C;GAChD,OAAO;GACP,KAAK;GACL,WAAW;GACX,QAAQ;GACR,OAAO;GACP,QAAQ;EACV;EAYA,SAAS,YAAwB;GAC/B,OAAO;IAAE,OAAO;IAAI,MAAM;IAAS,UAAU;IAAI,OAAO;IAAI,OAAO;IAAI,UAAU;IAAI,MAAM;IAAI,MAAM;GAAG;EAC1G;;EAGA,SAAgB,aAAa,OAAqC;GAChE,MAAM,EAAE,GAAG,QAAQ,eAAe,MAAM,QAAQ,KAAK,KAAK,QAAQ,QAAQ,SAAS;GACnF,MAAM,YAAA,GAAA,MAAA,MAAA,CAAiB;GACvB,MAAM,CAAC,OAAO,aAAA,GAAA,MAAA,SAAA,CAAqB,EAAE;GACrC,MAAM,CAAC,OAAO,aAAA,GAAA,MAAA,SAAA,CAAgC,EAAE,QAAQ,UAAU,CAAC;GACnE,MAAM,CAAC,QAAQ,cAAA,GAAA,MAAA,SAAA,CAAmC,EAAE,QAAQ,SAAS,CAAC;GACtE,MAAM,CAAC,MAAM,YAAA,GAAA,MAAA,SAAA,CAAgC,UAAU,CAAC;GACxD,MAAM,CAAC,MAAM,YAAA,GAAA,MAAA,SAAA,CAAoB,KAAK;GACtC,MAAM,CAAC,SAAS,eAAA,GAAA,MAAA,SAAA,CAAsC,IAAI;GAC1D,MAAM,CAAC,UAAU,gBAAA,GAAA,MAAA,SAAA,CAAuC,IAAI;GAC5D,MAAM,CAAC,SAAS,eAAA,GAAA,MAAA,SAAA,CAA+C,CAAC,CAAC;GACjE,MAAM,CAAC,WAAW,iBAAA,GAAA,MAAA,SAAA,CAAyB,EAAE;GAC7C,MAAM,CAAC,QAAQ,cAAA,GAAA,MAAA,SAAA,CAAgG,IAAI;GAEnH,MAAM,WAAW,QAAQ,eAAe;GAExC,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,UAAU;IACd,OAAY,CAAC,CAAC,MACZ,UAAS;KAAE,IAAI,SAAS,UAAU,KAAK;IAAE,SACnC,CAAiD,CACzD;IACA,aAAa;KAAE,UAAU;IAAM;GACjC,GAAG,CAAC,MAAM,CAAC;GAEX,MAAM,WAAA,GAAA,MAAA,QAAA,OAAwB,YAAY;IACxC,SAAS,EAAE,QAAQ,UAAU,CAAC;IAC9B,IAAI;KAIF,SAAS;MAAE,QAAQ;MAAS,SAHZ,MAAM,KAAK,CAAC,CAAC,WAAW,IACpC,MAAM,KAAK,IACX,MAAM,OAAO,MAAM,KAAK,CAAC;KACO,CAAC;IACvC,QAAQ;KACN,SAAS,EAAE,QAAQ,QAAQ,CAAC;IAC9B;GACF,GAAG;IAAC;IAAM;IAAQ;GAAK,CAAC;GAExB,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,UAAU;IACd,QAAa,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,WAC7B,CAAyC,SACzC;KAAE,IAAI,SAAS,SAAS,EAAE,QAAQ,QAAQ,CAAC;IAAE,CACrD;IACA,aAAa;KAAE,UAAU;IAAM;GAEjC,GAAG,CAAC,OAAO,CAAC;;GAGZ,SAAS,cAAoB;IAC3B,QAAQ,UAAU,CAAC;IACnB,aAAa,EAAE;IACf,WAAW,IAAI;IACf,UAAU,EAAE,QAAQ,WAAW,CAAC;GAClC;;GAGA,eAAe,UAAU,IAA2B;IAClD,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,IAAI;KACF,MAAM,SAAS,MAAM,IAAI,EAAE;KAC3B,IAAI,CAAC,OAAO,SAAS,OAAO,UAAU,KAAA,GAAW;MAC/C,WAAW,EAAE,OAAO,CAAC;MACrB;KACF;KACA,MAAM,QAAQ,OAAO;KACrB,QAAQ;MACN,OAAO,MAAM,SAAS;MACtB,MAAM,MAAM,QAAQ;MACpB,UAAU,MAAM,YAAY;MAC5B,OAAO,MAAM,SAAS;MACtB,OAAO,MAAM,SAAS;MACtB,UAAU,MAAM,YAAY;MAC5B,MAAM,MAAM,QAAQ;MACpB,MAAM,MAAM,QAAQ;MACpB,YAAY,MAAM,cAAc;MAChC,QAAQ,MAAM,UAAU;MACxB,QAAQ,MAAM,UAAU;MACxB,aAAa,MAAM,eAAe;MAClC,cAAc,MAAM,gBAAgB;MACpC,WAAW,MAAM,aAAa;MAC9B,KAAK,MAAM,OAAO;MAClB,OAAO,MAAM,SAAS;KACxB,CAAC;KACD,cAAc,MAAM,QAAQ,CAAC,EAAA,CAAG,KAAK,IAAI,CAAC;KAC1C,UAAU;MAAE,QAAQ;MAAW;KAAM,CAAC;IACxC,QAAQ;KACN,WAAW,EAAE,OAAO,CAAC;IACvB,UAAU;KACR,QAAQ,KAAK;IACf;GACF;;GAGA,eAAe,OAAsB;IACnC,IAAI,CAAC,KAAK,MAAM,KAAK,GAAG;KACtB,WAAW,EAAE,OAAO,CAAC;KACrB;IACF;IACA,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,IAAI;KACF,MAAM,OAAO,UAAU,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAO,MAAK,EAAE,SAAS,CAAC;KAC7E,MAAM,QAAoB;MACxB,OAAO,KAAK,MAAM,KAAK;MACvB,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;MACrD,GAAI,KAAK,aAAa,KAAA,IAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;MACjE,GAAI,KAAK,UAAU,KAAA,IAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;MACxD,GAAI,KAAK,UAAU,KAAA,IAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;MACxD,GAAI,KAAK,aAAa,KAAA,IAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;MACjE,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;MACrD,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;MACrD,GAAI,KAAK,eAAe,KAAA,IAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;MACvE,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;MAC3D,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;MAC3D,GAAI,KAAK,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;MAC1E,GAAI,KAAK,iBAAiB,KAAA,IAAY,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;MAC7E,GAAI,KAAK,cAAc,KAAA,IAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;MACpE,GAAI,KAAK,QAAQ,KAAA,IAAY,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;MAClD,GAAI,KAAK,UAAU,KAAA,IAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;MAGxD;KACF;KACA,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,KAAuC;UAC5C,IAAI,OAAO,WAAW,WAC3B,MAAM,OAAO,OAAO,MAAM,IAAI,KAAK;KAErC,UAAU,EAAE,QAAQ,SAAS,CAAC;KAC9B,MAAM,QAAQ;IAChB,QAAQ;KACN,WAAW,EAAE,OAAO,CAAC;IACvB,UAAU;KACR,QAAQ,KAAK;IACf;GACF;;GAGA,eAAe,YAAY,IAA2B;IACpD,IAAI,CAAC,OAAO,QAAQ,EAAE,eAAe,CAAC,GAAG;IACzC,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,OAAO,EAAE;KACf,MAAM,QAAQ;IAChB,QAAQ;KACN,WAAW,EAAE,OAAO,CAAC;IACvB,UAAU;KACR,QAAQ,KAAK;IACf;GACF;;GAGA,eAAe,UAAU,IAAY,OAA8B;IACjE,IAAI;KACF,MAAM,UAAU,UAAU,UAAU,KAAK;IAC3C,QAAQ;KAEN,MAAM,WAAW,SAAS,cAAc,UAAU;KAClD,SAAS,QAAQ;KACjB,SAAS,KAAK,YAAY,QAAQ;KAClC,SAAS,OAAO;KAChB,SAAS,YAAY,MAAM;KAC3B,SAAS,OAAO;IAClB;IACA,YAAY,EAAE;IACd,OAAO,iBAAiB,YAAY,IAAI,GAAG,IAAI;GACjD;;GAGA,eAAe,SAAS,IAA2B;IACjD,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,SAAS,MAAM,KAAK,EAAE;KAC5B,YAAW,cAAa;MAAE,GAAG;OAAW,KAAK,GAAG,OAAO,KAAK,IAAI,OAAO,iBAAiB;KAAI,EAAE;IAChG,QAAQ;KACN,YAAW,cAAa;MAAE,GAAG;OAAW,KAAK,EAAE,OAAO;KAAE,EAAE;IAC5D,UAAU;KACR,QAAQ,KAAK;IACf;GACF;;GAGA,SAAS,aAAa,OAAiC;IASrD,OARc;KACZ,MAAM,SAAS,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,YAAY,IAAI,EAAE,WAAW;KACnF,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM,SAAS,KAAA,IAAY,GAAG,MAAM,OAAO,MAAM,SAAS,KAAA,IAAY,IAAI,MAAM,SAAS,OAAO,KAAA;KAChG,MAAM;IACR,CAAC,CAAC,QAAQ,UAA2B,UAAU,KAAA,KAAa,MAAM,SAAS,CAChE,CAAC,CAAC,KAAK,KAAK;GACzB;GAEA,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;IAAS,WAAWA,gCAAI;IAAS,mBAAgB;cAAjD;KACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD;MAAI,IAAG;gBAAiB,EAAE,SAAS;KAAM,CAAA;KACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,WAAWA,gCAAI;gBAAQ,EAAE,OAAO;KAAK,CAAA;KAExC,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;gBAApB,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;OAAO,WAAWA,gCAAI;iBAAtB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,WAAU;kBAAW,EAAE,mBAAmB;OAAQ,CAAA,GACxD,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QACE,IAAI;QACJ,MAAK;QACL,aAAa,EAAE,mBAAmB;QAClC,OAAO;QACP,WAAU,UAAS,SAAS,MAAM,OAAO,KAAK;OAC/C,CAAA,CACI;UACP,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;OAAQ,MAAK;OAAS,WAAWA,gCAAI;OAAW,SAAS;OAAa,UAAU,QAAQ;iBAAxF,CAAkG,MAC7F,EAAE,KAAK,CACJ;QACL;;KAEJ,WAAW,QACV,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;gBAApB,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;OAAO,WAAWA,gCAAI;iBAAtB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD,EAAA,UAAO,EAAE,WAAW,EAAQ,CAAA,GAC5B,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;QACE,OAAO,OAAO;QACd,UAAU;QACV,WAAU,UAAS;SACjB,MAAM,OAAO,MAAM,OAAO;SAC1B,QAAQ,IAAI;SACZ,WAAW,IAAI;SACf,cAAmB,IAAI,CAAC,CAAC,MACvB,UAAS;UAAE,UAAU,KAAK;UAAG,QAAQ,KAAK;SAAE,SACtC;UAAE,WAAW,EAAE,OAAO,CAAC;UAAG,QAAQ,KAAK;SAAE,CACjD;QACF;kBAXF;SAaE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAQ,OAAM;oBAAY,EAAE,cAAc;SAAU,CAAA;SACpD,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAQ,OAAM;oBAAO,EAAE,SAAS;SAAU,CAAA;SAC1C,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAQ,OAAM;oBAAQ,EAAE,UAAU;SAAU,CAAA;QACtC;SACH;UACP,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;OAAG,WAAW,OAAO,eAAe,aAAaA,gCAAI,eAAe,OAAO,eAAe,QAAQA,gCAAI,UAAUA,gCAAI;iBAApH,CACG,OAAO,eAAe,aACnB,EAAE,kBAAkB,IACpB,OAAO,eAAe,QACpB,EAAE,aAAa,IACf,EAAE,cAAc,GACrB,OAAO,cAAc,MAAM,EAAE,eAAe,MAAM,MAAM,EAAE,gBAAgB,GAC1E;QACA;;KAGN,YAAY,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,MAAK;MAAQ,WAAWA,gCAAI;gBAAQ;KAAW,CAAA;KAEtE,MAAM,WAAW,aAAa,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,WAAWA,gCAAI;gBAAS,EAAE,SAAS;KAAK,CAAA;KACzE,MAAM,WAAW,WAAW,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,MAAK;MAAQ,WAAWA,gCAAI;gBAAQ,EAAE,OAAO;KAAK,CAAA;KACjF,MAAM,WAAW,WAAW,MAAM,QAAQ,WAAW,KACpD,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;gBAApB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,WAAWA,gCAAI;iBAAQ,EAAE,OAAO;MAAK,CAAA,GACxC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,WAAWA,gCAAI;iBAAY,WAAW,EAAE,mBAAmB,IAAI,EAAE,WAAW;MAAK,CAAA,CACjF;;KAGN,MAAM,WAAW,WAAW,MAAM,QAAQ,SAAS,KAClD,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD;MAAI,WAAWA,gCAAI;gBAChB,MAAM,QAAQ,KAAI,UAAS;OAC1B,MAAM,OAAO,QAAQ,MAAM;OAC3B,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD;QAAmB,WAAWA,gCAAI;kBAAlC,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,WAAWA,gCAAI;mBAApB;UACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;WAAM,WAAWA,gCAAI;qBAAQ,MAAM;UAAY,CAAA;UAC/C,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;WAAM,WAAWA,gCAAI;qBAAW,aAAa,KAAK;UAAQ,CAAA;UACzD,SAAS,KAAA,KAAa,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;WAAM,WAAWA,gCAAI;qBAAO;UAAW,CAAA;SAC3D;YACL,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,WAAWA,gCAAI;mBAApB;UACG,aAAa,MAAM,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;WAAM,WAAWA,gCAAI;qBAAS,EAAE,QAAQ;UAAQ,CAAA;UAC1E,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;WACE,MAAK;WACL,eAAe,KAAK,UAAU,MAAM,IAAI,MAAM,YAAY,MAAM,KAAK;WACrE,UAAU;qBACV,EAAE,MAAM;UAAU,CAAA;UACpB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;WAAQ,MAAK;WAAS,eAAe,KAAK,SAAS,MAAM,EAAE;WAAG,UAAU;qBAAO,EAAE,MAAM;UAAU,CAAA;UACjG,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;WAAQ,MAAK;WAAS,eAAe,KAAK,UAAU,MAAM,EAAE;WAAG,UAAU,QAAQ;qBAAW,EAAE,MAAM;UAAU,CAAA;UAC9G,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;WACE,MAAK;WACL,WAAWA,gCAAI;WACf,eAAe,KAAK,YAAY,MAAM,EAAE;WACxC,UAAU,QAAQ;qBAClB,EAAE,QAAQ;UAAU,CAAA;SACnB;UACH;UAtBK,MAAM,EAsBX;MAER,CAAC;KACC,CAAA;KAGL,OAAO,WAAW,YACjB,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;MAAQ,MAAK;MAAS,cAAY,OAAO,WAAW,aAAa,EAAE,KAAK,IAAI,EAAE,MAAM;gBAAxG,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,WAAWA,gCAAI;iBAApB,CACG,YAAY,KAAI,UACf,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;QAAuB,WAAWA,gCAAI;kBAAtC,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD,EAAA,UAAO,EAAE,MAAM,KAAK,EAAQ,CAAA,GAC3B,MAAM,QAAQ,SACb,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,OAAO,KAAK,QAAQ;SACpB,WAAU,UAAS,SAAQ,cAAa;UAAE,GAAG;UAAU,MAAM,MAAM,OAAO;SAAM,EAAE;mBAEjF,OAAO,QAAQ,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,SACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAA2B;oBAAQ,EAAE,GAAG;SAAU,GAArC,KAAqC,CACnD;QACK,CAAA,IACN,MAAM,QAAQ,UAChB,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,OAAO,KAAK,SAAS;SACrB,WAAU,UAAS,SAAQ,cAAa;UAAE,GAAG;UAAU,OAAO,MAAM,OAAO;SAAM,EAAE;QACpF,CAAA,IAED,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,MAAM,MAAM,QAAQ,cAAc,MAAM,QAAQ,cAAc,aAAa;SAC3E,OAAQ,KAAK,MAAM,QAA+B;SAClD,WAAU,UAAS,SAAQ,cAAa;UAAE,GAAG;WAAW,MAAM,MAAM,MAAM,OAAO;SAAM,EAAE;QAC1F,CAAA,CAEE;UAvBK,MAAM,GAuBX,CACR,GACD,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;QAAO,WAAWA,gCAAI;kBAAtB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD,EAAA,UAAO,EAAE,WAAW,EAAQ,CAAA,GAC5B,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,OAAO;SACP,WAAU,UAAS,aAAa,MAAM,OAAO,KAAK;SAClD,aAAY;QACb,CAAA,CACI;SACJ;UACL,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,WAAWA,gCAAI;iBAApB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,MAAK;QAAS,eAAe,UAAU,EAAE,QAAQ,SAAS,CAAC;QAAG,UAAU;kBAAO,EAAE,QAAQ;OAAU,CAAA,GAC3G,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,MAAK;QAAS,WAAWA,gCAAI;QAAY,eAAe,KAAK,KAAK;QAAG,UAAU;kBAAO,EAAE,MAAM;OAAU,CAAA,CAC7G;QACF;;IAEA;;EAEb;;;;;EChdA,MAAa,KAAK;GAChB,KAAK;GACL,SAAS;GACT,OAAO;GACP,mBAAmB;GACnB,SAAS;GACT,OAAO;GACP,WAAW;GACX,mBAAmB;GACnB,WAAW;GACX,cAAc;GACd,SAAS;GACT,UAAU;GACV,kBAAkB;GAClB,aAAa;GACb,cAAc;GACd,eAAe;GACf,gBAAgB;GAChB,KAAK;GACL,QAAQ;GACR,MAAM;GACN,MAAM;GACN,QAAQ;GACR,eAAe;GACf,MAAM;GACN,QAAQ;GACR,MAAM;GACN,YAAY;GACZ,WAAW;GACX,eAAe;GACf,YAAY;GACZ,YAAY;GACZ,eAAe;GACf,WAAW;GACX,WAAW;GACX,aAAa;GACb,aAAa;GACb,kBAAkB;GAClB,mBAAmB;GACnB,gBAAgB;GAChB,UAAU;GACV,YAAY;GACZ,WAAW;GACX,OAAO;GACP,WAAW;GACX,SAAS;GACT,YAAY;GACZ,YAAY;GACZ,WAAW;GACX,YAAY;EACd;;EAKA,MAAa,KAAqC;GAChD,KAAK;GACL,SAAS;GACT,OAAO;GACP,mBAAmB;GACnB,SAAS;GACT,OAAO;GACP,WAAW;GACX,mBAAmB;GACnB,WAAW;GACX,cAAc;GACd,SAAS;GACT,UAAU;GACV,kBAAkB;GAClB,aAAa;GACb,cAAc;GACd,eAAe;GACf,gBAAgB;GAChB,KAAK;GACL,QAAQ;GACR,MAAM;GACN,MAAM;GACN,QAAQ;GACR,eAAe;GACf,MAAM;GACN,QAAQ;GACR,MAAM;GACN,YAAY;GACZ,WAAW;GACX,eAAe;GACf,YAAY;GACZ,YAAY;GACZ,eAAe;GACf,WAAW;GACX,WAAW;GACX,aAAa;GACb,aAAa;GACb,kBAAkB;GAClB,mBAAmB;GACnB,gBAAgB;GAChB,UAAU;GACV,YAAY;GACZ,WAAW;GACX,OAAO;GACP,WAAW;GACX,SAAS;GACT,YAAY;GACZ,YAAY;GACZ,WAAW;GACX,YAAY;EACd;;;;EChFA,MAAa,KAAK;;EAGlB,MAAa,SAAS;GAAC;GAAS;GAAU;EAAY;;;;;;EAOtD,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa,IAAI,OAAO,SAAS,IAAI;IAAE;IAAI;GAAG,CAAC,GAAG,yBAAyB;GAE/E,MAAM,IAAI,IAAI,OAAO,KAAK,EAAE;GAC5B,MAAM,aAAa,IAAI,IAAI,YAAY;;GAGvC,eAAe,OAAU,QAAgB,OAAgC,CAAC,GAAe;IACvF,MAAM,SAAS,MAAM,WAAW,IAAI,KAAK,QAAQ,SAAS,UAAU,EAAE,KAAK,CAAC;IAC5E,IAAI,CAAC,OAAO,IACV,MAAM,IAAI,MAAM,SAAS,OAAO,WAAW,OAAO,MAAM,KAAK,IAAI,OAAO,MAAM,SAAS;IAEzF,OAAO,OAAO;GAChB;GAEA,MAAM,kBAAwC;IAC5C;IACA,cAAc,OAAoC,QAAQ;IAC1D,gBAAgB,SAAS,OAAoC,iBAAiB,EAAE,KAAK,CAAC;IACtF,YAAY,OAAkD,MAAM,CAAC,CAAC,MAAK,MAAK,EAAE,OAAO;IACzF,SAAS,OAAO,UAAU,OAAkD,UAAU;KAAE;KAAO,OAAO,SAAS;IAAG,CAAC,CAAC,CAAC,MAAK,MAAK,EAAE,OAAO;IACxI,MAAM,OAAO,OAAmE,OAAO,EAAE,GAAG,CAAC;IAC7F,MAAM,UAAU,OAA0C,OAAO,EAAE,MAAM,CAAC;IAC1E,SAAS,IAAI,UAAU,OAAsE,UAAU;KAAE;KAAI;IAAM,CAAC;IACpH,SAAS,OAAO,OAA6B,UAAU,EAAE,GAAG,CAAC;IAC7D,OAAO,OAAO,OAAmE,QAAQ,EAAE,GAAG,CAAC;GACjG;GAEA,IAAI,MAAM,OAAO,0BAA0B,IAAI,MAAM,SAAS;IAC5D,MAAM;IACN,IAAI;IACJ,OAAO;IACP,aAAa,EAAE,KAAK;IACpB,QAAQ;GACV,GAAG,YAAY,CAAC;EAClB"}
+{"version":3,"file":"client.js","names":["css"],"sources":["../src/client/VaultSection.tsx","../src/client/locales.ts","../src/client/index.ts"],"sourcesContent":["/**\n * Vault settings section: list, search, add, edit, delete, and copy encrypted\n * credentials. All mutations go through the host VaultGateway remote; secrets\n * are shown only inside the edit form or a copy action, never in the list.\n */\n\nimport { useEffect, useId, useMemo, useState, type ReactNode } from 'react'\nimport type { PropsLocale, PropsRuntime, InjectFace, TranslateNS } from '@deepseek-ai/dsh-client-ui-slots'\nimport type { VaultLocaleKey } from './locales.ts'\nimport css from './VaultSection.module.css'\n\n/** Wire shapes shared with the host gateway (mirror of src/index.ts types). */\nexport interface VaultSummaryWire {\n  id: string\n  title: string\n  kind?: string\n  username?: string\n  email?: string\n  phone?: string\n  host?: string\n  port?: string\n  url?: string\n  tags?: string[]\n}\n\nexport interface VaultFullWire {\n  id: string\n  title: string\n  kind?: string\n  username?: string\n  email?: string\n  phone?: string\n  password?: string\n  host?: string\n  port?: string\n  privateKey?: string\n  apiKey?: string\n  secret?: string\n  accessToken?: string\n  refreshToken?: string\n  expiresAt?: number\n  otpSecret?: string\n  url?: string\n  notes?: string\n  tags?: string[]\n  fields?: Record<string, unknown>\n}\n\n/** Patch shape accepted by vault.add / vault.update. */\nexport type VaultPatch = Partial<Omit<VaultFullWire, 'id'>>\n\n/** Registration-side business face supplied by the plugin entry. */\nexport interface VaultSectionInjected {\n  t: TranslateNS<'settings.vault'>\n  config: () => Promise<{ accessMode: 'readonly' | 'ask' | 'auto'; autoCapture: boolean }>\n  setAccessMode: (mode: 'readonly' | 'ask' | 'auto') => Promise<{ accessMode: 'readonly' | 'ask' | 'auto'; autoCapture: boolean }>\n  list: () => Promise<VaultSummaryWire[]>\n  search: (query: string, limit?: number) => Promise<VaultSummaryWire[]>\n  get: (id: string) => Promise<{ found: boolean; entry?: VaultFullWire }>\n  add: (patch: VaultPatch & { title: string }) => Promise<VaultSummaryWire>\n  update: (id: string, patch: VaultPatch) => Promise<{ found: boolean; entry?: VaultSummaryWire }>\n  remove: (id: string) => Promise<{ deleted: boolean }>\n  trash: () => Promise<VaultSummaryWire[]>\n  rotation: () => Promise<unknown[]>\n  health: () => Promise<{ weak: unknown[]; reused: unknown[] }>\n  restore: (id: string) => Promise<{ restored: boolean }>\n  totp: (id: string) => Promise<{ code: string; label?: string; secondsRemaining: number }>\n}\n\n/** Type-level alias so consumers can reference the wire shapes without values. */\nexport type VaultSectionTypes = {\n  entries: VaultSummaryWire[]\n  fullEntry: VaultFullWire\n  summaryEntry: VaultSummaryWire\n  config: { accessMode: 'readonly' | 'ask' | 'auto'; autoCapture: boolean }\n  accessModes: Array<'readonly' | 'ask' | 'auto'>\n}\n\n/** Full component props assembled by the Settings slot renderer. */\nexport type VaultSectionProps =\n  PropsRuntime<'settings.section'>\n  & PropsLocale<'settings.vault'>\n  & InjectFace<VaultSectionInjected>\n\n/** The editable form fields we render (subset of the full wire). */\ntype FormFields = Pick<\n  VaultFullWire, 'title' | 'kind' | 'username' | 'email' | 'phone' | 'password' | 'host' | 'port'\n  | 'privateKey' | 'apiKey' | 'secret' | 'accessToken' | 'refreshToken' | 'otpSecret' | 'url' | 'notes'\n>\n\nconst FORM_FIELDS: Array<{ key: keyof FormFields; label: VaultLocaleKey }> = [\n  { key: 'title', label: 'fieldTitle' },\n  { key: 'kind', label: 'fieldKind' },\n  { key: 'username', label: 'fieldUsername' },\n  { key: 'email', label: 'fieldEmail' },\n  { key: 'phone', label: 'fieldPhone' },\n  { key: 'password', label: 'fieldPassword' },\n  { key: 'host', label: 'fieldHost' },\n  { key: 'port', label: 'fieldPort' },\n  { key: 'apiKey', label: 'fieldApiKey' },\n  { key: 'secret', label: 'fieldSecret' },\n  { key: 'accessToken', label: 'fieldAccessToken' },\n  { key: 'refreshToken', label: 'fieldRefreshToken' },\n  { key: 'otpSecret', label: 'fieldOtpSecret' },\n  { key: 'url', label: 'fieldUrl' },\n  { key: 'notes', label: 'fieldNotes' },\n]\n\nconst KIND_KEYS: Record<string, VaultLocaleKey> = {\n  login: 'kindLogin',\n  ssh: 'kindSsh',\n  'api-key': 'kindApiKey',\n  secret: 'kindSecret',\n  oauth: 'kindOauth',\n  custom: 'kindCustom',\n}\n\ntype ViewState =\n  | { readonly status: 'loading' }\n  | { readonly status: 'error' }\n  | { readonly status: 'ready'; readonly entries: VaultSummaryWire[] }\n\ntype EditorState =\n  | { readonly status: 'closed' }\n  | { readonly status: 'creating' }\n  | { readonly status: 'editing'; readonly entry: VaultFullWire }\n\nfunction emptyForm(): FormFields {\n  return { title: '', kind: 'login', username: '', email: '', phone: '', password: '', host: '', port: '' }\n}\n\n/** Render the Vault settings section. */\nexport function VaultSection(props: VaultSectionProps): ReactNode {\n  const { t, config, setAccessMode, list, search, get, add, update, remove, trash, rotation, health, restore, totp } = props\n  const searchId = useId()\n  const [query, setQuery] = useState('')\n  const [state, setState] = useState<ViewState>({ status: 'loading' })\n  const [editor, setEditor] = useState<EditorState>({ status: 'closed' })\n  const [form, setForm] = useState<FormFields>(emptyForm())\n  const [busy, setBusy] = useState(false)\n  const [message, setMessage] = useState<string | null>(null)\n  const [copiedId, setCopiedId] = useState<string | null>(null)\n  const [codeMap, setCodeMap] = useState<Record<string, string>>({})\n  const [tagsDraft, setTagsDraft] = useState('')\n  const [policy, setPolicy] = useState<{ accessMode: 'readonly' | 'ask' | 'auto'; autoCapture: boolean } | null>(null)\n  const [showTrash, setShowTrash] = useState(false)\n  const [trashEntries, setTrashEntries] = useState<VaultSummaryWire[]>([])\n  const [report, setReport] = useState<{ rotation: unknown[]; weak: unknown[]; reused: unknown[] } | null>(null)\n\n  const readonly = policy?.accessMode === 'readonly'\n\n  useEffect(() => {\n    let current = true\n    void config().then(\n      value => { if (current) setPolicy(value) },\n      () => { /* policy is informational; ignore failures */ },\n    )\n    return () => { current = false }\n  }, [config])\n\n  const refresh = useMemo(() => async () => {\n    setState({ status: 'loading' })\n    try {\n      const entries = query.trim().length === 0\n        ? await list()\n        : await search(query.trim())\n      setState({ status: 'ready', entries })\n    } catch {\n      setState({ status: 'error' })\n    }\n  }, [list, search, query])\n\n  useEffect(() => {\n    let current = true\n    void Promise.resolve().then(refresh).then(\n      () => { /* state already set inside refresh */ },\n      () => { if (current) setState({ status: 'error' }) },\n    )\n    return () => { current = false }\n    // refresh is memoized on query; list/search are stable inject faces.\n  }, [refresh])\n\n  /** Open the editor for a new entry. */\n  function startCreate(): void {\n    setForm(emptyForm())\n    setTagsDraft('')\n    setMessage(null)\n    setEditor({ status: 'creating' })\n  }\n\n  /** Open the editor for an existing entry (fetches full secrets). */\n  async function startEdit(id: string): Promise<void> {\n    setBusy(true)\n    setMessage(null)\n    try {\n      const result = await get(id)\n      if (!result.found || result.entry === undefined) {\n        setMessage(t('error'))\n        return\n      }\n      const entry = result.entry\n      setForm({\n        title: entry.title ?? '',\n        kind: entry.kind ?? 'login',\n        username: entry.username ?? '',\n        email: entry.email ?? '',\n        phone: entry.phone ?? '',\n        password: entry.password ?? '',\n        host: entry.host ?? '',\n        port: entry.port ?? '',\n        privateKey: entry.privateKey ?? '',\n        apiKey: entry.apiKey ?? '',\n        secret: entry.secret ?? '',\n        accessToken: entry.accessToken ?? '',\n        refreshToken: entry.refreshToken ?? '',\n        otpSecret: entry.otpSecret ?? '',\n        url: entry.url ?? '',\n        notes: entry.notes ?? '',\n      })\n      setTagsDraft((entry.tags ?? []).join(', '))\n      setEditor({ status: 'editing', entry })\n    } catch {\n      setMessage(t('error'))\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  /** Save the current form (create or update). */\n  async function save(): Promise<void> {\n    if (!form.title.trim()) {\n      setMessage(t('error'))\n      return\n    }\n    setBusy(true)\n    setMessage(null)\n    try {\n      const tags = tagsDraft.split(',').map(x => x.trim()).filter(x => x.length > 0)\n      const patch: VaultPatch = {\n        title: form.title.trim(),\n        ...(form.kind !== undefined ? { kind: form.kind } : {}),\n        ...(form.username !== undefined ? { username: form.username } : {}),\n        ...(form.email !== undefined ? { email: form.email } : {}),\n        ...(form.phone !== undefined ? { phone: form.phone } : {}),\n        ...(form.password !== undefined ? { password: form.password } : {}),\n        ...(form.host !== undefined ? { host: form.host } : {}),\n        ...(form.port !== undefined ? { port: form.port } : {}),\n        ...(form.privateKey !== undefined ? { privateKey: form.privateKey } : {}),\n        ...(form.apiKey !== undefined ? { apiKey: form.apiKey } : {}),\n        ...(form.secret !== undefined ? { secret: form.secret } : {}),\n        ...(form.accessToken !== undefined ? { accessToken: form.accessToken } : {}),\n        ...(form.refreshToken !== undefined ? { refreshToken: form.refreshToken } : {}),\n        ...(form.otpSecret !== undefined ? { otpSecret: form.otpSecret } : {}),\n        ...(form.url !== undefined ? { url: form.url } : {}),\n        ...(form.notes !== undefined ? { notes: form.notes } : {}),\n        // Always send tags: an empty array clears them, and the host store\n        // treats empty string values as \"clear this field\" too.\n        tags,\n      }\n      if (editor.status === 'creating') {\n        await add(patch as VaultPatch & { title: string })\n      } else if (editor.status === 'editing') {\n        await update(editor.entry.id, patch)\n      }\n      setEditor({ status: 'closed' })\n      await refresh()\n    } catch {\n      setMessage(t('error'))\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  /** Delete an entry after confirmation. */\n  async function removeEntry(id: string): Promise<void> {\n    if (!window.confirm(t('deleteConfirm'))) return\n    setBusy(true)\n    try {\n      await remove(id)\n      await refresh()\n    } catch {\n      setMessage(t('error'))\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  /** Copy a field value to the clipboard and flash the row. */\n  async function copyValue(id: string, value: string): Promise<void> {\n    try {\n      await navigator.clipboard.writeText(value)\n    } catch {\n      // Clipboard may be blocked; fall back to a temporary textarea.\n      const textarea = document.createElement('textarea')\n      textarea.value = value\n      document.body.appendChild(textarea)\n      textarea.select()\n      document.execCommand('copy')\n      textarea.remove()\n    }\n    setCopiedId(id)\n    window.setTimeout(() => setCopiedId(null), 1500)\n  }\n\n  /** Fetch and display a TOTP code for an entry with an otpSecret. */\n  async function showTotp(id: string): Promise<void> {\n    setBusy(true)\n    try {\n      const result = await totp(id)\n      setCodeMap(previous => ({ ...previous, [id]: `${result.code} (${result.secondsRemaining}s)` }))\n    } catch {\n      setCodeMap(previous => ({ ...previous, [id]: t('error') }))\n    } finally {\n      setBusy(false)\n    }\n  }\n\n  /** Field-set summary line for one entry (non-secret). */\n  function identityLine(entry: VaultSummaryWire): string {\n    const parts = [\n      entry.kind !== undefined ? t(KIND_KEYS[entry.kind] ?? 'kindCustom') : t('kindLogin'),\n      entry.username,\n      entry.email,\n      entry.phone,\n      entry.host !== undefined ? `${entry.host}${entry.port !== undefined ? `:${entry.port}` : ''}` : undefined,\n      entry.url,\n    ].filter((value): value is string => value !== undefined && value.length > 0)\n    return parts.join(' · ')\n  }\n\n  return (\n    <section className={css.section} aria-labelledby=\"vault-heading\">\n      <h2 id=\"vault-heading\">{t('heading')}</h2>\n      <p className={css.intro}>{t('intro')}</p>\n\n      <div className={css.toolbar}>\n        <label className={css.searchBox}>\n          <span className=\"sr-only\">{t('searchPlaceholder')}</span>\n          <input\n            id={searchId}\n            type=\"search\"\n            placeholder={t('searchPlaceholder')}\n            value={query}\n            onChange={event => setQuery(event.target.value)}\n          />\n        </label>\n        <button type=\"button\" className={css.addButton} onClick={startCreate} disabled={busy || readonly}>\n          + {t('add')}\n        </button>\n      </div>\n\n      {policy !== null && (\n        <div className={css.policyBar}>\n          <label className={css.policyField}>\n            <span>{t('modeLabel')}</span>\n            <select\n              value={policy.accessMode}\n              disabled={busy}\n              onChange={event => {\n                const next = event.target.value as 'readonly' | 'ask' | 'auto'\n                setBusy(true)\n                setMessage(null)\n                void setAccessMode(next).then(\n                  value => { setPolicy(value); setBusy(false) },\n                  () => { setMessage(t('error')); setBusy(false) },\n                )\n              }}\n            >\n              <option value=\"readonly\">{t('modeReadonly')}</option>\n              <option value=\"ask\">{t('modeAsk')}</option>\n              <option value=\"auto\">{t('modeAuto')}</option>\n            </select>\n          </label>\n          <p className={policy.accessMode === 'readonly' ? css.modeReadonly : policy.accessMode === 'ask' ? css.modeAsk : css.modeAuto}>\n            {policy.accessMode === 'readonly'\n              ? t('modeReadonlyHint')\n              : policy.accessMode === 'ask'\n                ? t('modeAskHint')\n                : t('modeAutoHint')}\n            {policy.autoCapture ? ` · ${t('autoCaptureOn')}` : ` · ${t('autoCaptureOff')}`}\n          </p>\n        </div>\n      )}\n\n      {message !== null && <p role=\"alert\" className={css.error}>{message}</p>}\n\n      {state.status === 'loading' && <p className={css.status}>{t('loading')}</p>}\n      {state.status === 'error' && <p role=\"alert\" className={css.error}>{t('error')}</p>}\n      {state.status === 'ready' && state.entries.length === 0 && (\n        <div className={css.emptyBox}>\n          <p className={css.empty}>{t('empty')}</p>\n          <p className={css.emptyHint}>{readonly ? t('emptyHintReadonly') : t('emptyHint')}</p>\n        </div>\n      )}\n\n      {report !== null && (report.rotation.length > 0 || report.weak.length > 0 || report.reused.length > 0) && (\n        <div className={css.reportBox}>\n          <p className={css.reportTitle}>{t('reportTitle')}</p>\n          {report.rotation.length > 0 && (\n            <p className={css.reportLine}>{t('reportRotation')}: {report.rotation.length}</p>\n          )}\n          {report.weak.length > 0 && (\n            <p className={css.reportLine}>{t('reportWeak')}: {report.weak.length}</p>\n          )}\n          {report.reused.length > 0 && (\n            <p className={css.reportLine}>{t('reportReused')}: {report.reused.length}</p>\n          )}\n        </div>\n      )}\n\n      <button\n        type=\"button\"\n        className={css.trashButton}\n        onClick={() => {\n          if (!showTrash) void trash().then(setTrashEntries)\n          setShowTrash(!showTrash)\n        }}\n      >{showTrash ? t('hideTrash') : t('showTrash')}{trashEntries.length > 0 ? ` (${trashEntries.length})` : ''}</button>\n\n      {showTrash && (\n        <ul className={css.list}>\n          {trashEntries.map(entry => (\n            <li key={entry.id} className={css.row}>\n              <div className={css.rowMain}>\n                <span className={css.title}>{entry.title}</span>\n                <span className={css.identity}>{t('trashed')}</span>\n              </div>\n              <div className={css.rowActions}>\n                <button\n                  type=\"button\"\n                  onClick={() => { void restore(entry.id).then(() => { void trash().then(setTrashEntries); void refresh() }) }}\n                  disabled={busy || readonly}\n                >{t('restore')}</button>\n              </div>\n            </li>\n          ))}\n          {trashEntries.length === 0 && <p className={css.empty}>{t('trashEmpty')}</p>}\n        </ul>\n      )}\n\n      {state.status === 'ready' && state.entries.length > 0 && (\n        <ul className={css.list}>\n          {state.entries.map(entry => {\n            const code = codeMap[entry.id]\n            return (\n              <li key={entry.id} className={css.row}>\n                <div className={css.rowMain}>\n                  <span className={css.title}>{entry.title}</span>\n                  <span className={css.identity}>{identityLine(entry)}</span>\n                  {code !== undefined && <span className={css.totp}>{code}</span>}\n                </div>\n                <div className={css.rowActions}>\n                  {copiedId === entry.id && <span className={css.copied}>{t('copied')}</span>}\n                  <button\n                    type=\"button\"\n                    onClick={() => void copyValue(entry.id, entry.username ?? entry.title)}\n                    disabled={busy}\n                  >{t('copy')}</button>\n                  <button type=\"button\" onClick={() => void showTotp(entry.id)} disabled={busy}>{t('totp')}</button>\n                  <button type=\"button\" onClick={() => void startEdit(entry.id)} disabled={busy || readonly}>{t('edit')}</button>\n                  <button\n                    type=\"button\"\n                    className={css.deleteButton}\n                    onClick={() => void removeEntry(entry.id)}\n                    disabled={busy || readonly}\n                  >{t('delete')}</button>\n                </div>\n              </li>\n            )\n          })}\n        </ul>\n      )}\n\n      {editor.status !== 'closed' && (\n        <div className={css.editor} role=\"dialog\" aria-label={editor.status === 'creating' ? t('add') : t('edit')}>\n          <div className={css.editorBody}>\n            {FORM_FIELDS.map(field => (\n              <label key={field.key} className={css.field}>\n                <span>{t(field.label)}</span>\n                {field.key === 'kind' ? (\n                  <select\n                    value={form.kind ?? 'login'}\n                    onChange={event => setForm(previous => ({ ...previous, kind: event.target.value }))}\n                  >\n                    {Object.entries(KIND_KEYS).map(([value, key]) => (\n                      <option key={value} value={value}>{t(key)}</option>\n                    ))}\n                  </select>\n                ) : field.key === 'title' ? (\n                  <input\n                    value={form.title ?? ''}\n                    onChange={event => setForm(previous => ({ ...previous, title: event.target.value }))}\n                  />\n                ) : (\n                  <input\n                    type={field.key === 'password' || field.key === 'otpSecret' ? 'password' : 'text'}\n                    value={(form[field.key] as string | undefined) ?? ''}\n                    onChange={event => setForm(previous => ({ ...previous, [field.key]: event.target.value }))}\n                  />\n                )}\n              </label>\n            ))}\n            <label className={css.field}>\n              <span>{t('fieldTags')}</span>\n              <input\n                value={tagsDraft}\n                onChange={event => setTagsDraft(event.target.value)}\n                placeholder=\"dev, prod\"\n              />\n            </label>\n          </div>\n          <div className={css.editorActions}>\n            <button type=\"button\" onClick={() => setEditor({ status: 'closed' })} disabled={busy}>{t('cancel')}</button>\n            <button type=\"button\" className={css.saveButton} onClick={() => void save()} disabled={busy}>{t('save')}</button>\n          </div>\n        </div>\n      )}\n    </section>\n  )\n}\n","/** Copy dictionaries for the Vault settings section. */\n\n/** English strings (the key-set source of truth for this pair). */\nexport const en = {\n  nav: 'Vault',\n  heading: 'Vault',\n  intro: 'Encrypted credentials stored on this machine.',\n  searchPlaceholder: 'Search title, username, email, host…',\n  loading: 'Loading…',\n  empty: 'No credentials yet. Add one to get started.',\n  emptyHint: 'Tip: you can ask the assistant to save an API key or token you share in chat — with auto-capture on it offers to store it for you.',\n  emptyHintReadonly: 'The vault is in readonly mode — credentials can be read but not added here. Switch accessMode to \"readwrite\" to enable writes.',\n  modeLabel: 'Access mode',\n  modeReadonly: 'Read-only',\n  modeAsk: 'Ask before writing',\n  modeAuto: 'Automatic read-write',\n  modeReadonlyHint: 'Read-only — mutations disabled',\n  modeAskHint: 'Prompt before writing — every add/update/delete asks you',\n  modeAutoHint: 'Automatic read-write — no per-call prompt',\n  autoCaptureOn: 'auto-capture on',\n  autoCaptureOff: 'auto-capture off',\n  reportTitle: 'Health & rotation',\n  reportRotation: 'expired / due for rotation',\n  reportWeak: 'weak passwords',\n  reportReused: 'credentials reused across entries',\n  showTrash: 'Trash',\n  hideTrash: 'Hide trash',\n  trashed: 'in trash',\n  trashEmpty: 'Trash is empty',\n  restore: 'Restore',\n  add: 'Add credential',\n  cancel: 'Cancel',\n  save: 'Save',\n  edit: 'Edit',\n  delete: 'Delete',\n  deleteConfirm: 'Delete this entry? This cannot be undone.',\n  copy: 'Copy',\n  copied: 'Copied',\n  totp: 'Code',\n  fieldTitle: 'Title',\n  fieldKind: 'Kind',\n  fieldUsername: 'Username',\n  fieldEmail: 'Email',\n  fieldPhone: 'Phone',\n  fieldPassword: 'Password',\n  fieldHost: 'Host',\n  fieldPort: 'Port',\n  fieldApiKey: 'API key',\n  fieldSecret: 'Secret',\n  fieldAccessToken: 'Access token',\n  fieldRefreshToken: 'Refresh token',\n  fieldOtpSecret: 'OTP secret',\n  fieldUrl: 'URL',\n  fieldNotes: 'Notes',\n  fieldTags: 'Tags',\n  error: 'Something went wrong.',\n  kindLogin: 'Login',\n  kindSsh: 'SSH',\n  kindApiKey: 'API key',\n  kindSecret: 'Secret',\n  kindOauth: 'OAuth',\n  kindCustom: 'Custom',\n} as const\n\nexport type VaultLocaleKey = keyof typeof en\n\n/** Chinese strings (same keys as English). */\nexport const zh: Record<VaultLocaleKey, string> = {\n  nav: '凭据库',\n  heading: 'Vault 凭据库',\n  intro: '本机加密存储的凭据。',\n  searchPlaceholder: '搜索标题、用户名、邮箱、主机…',\n  loading: '加载中…',\n  empty: '还没有凭据，添加一条开始使用。',\n  emptyHint: '提示：你可以在对话中把 API Key 或 token 交给助手保存——开启自动捕获后，它会在你同意时帮你存入本库。',\n  emptyHintReadonly: '当前为只读模式——只能读取凭据，不能在此添加。将 accessMode 改为 \"readwrite\" 即可启用写入。',\n  modeLabel: '访问模式',\n  modeReadonly: '只读',\n  modeAsk: '写入前询问',\n  modeAuto: '自动读写',\n  modeReadonlyHint: '只读 —— 变更已禁用',\n  modeAskHint: '写入前询问 —— 每次增/改/删都会征求你的确认',\n  modeAutoHint: '自动读写 —— 无需逐次确认',\n  autoCaptureOn: '自动捕获已开启',\n  autoCaptureOff: '自动捕获已关闭',\n  reportTitle: '健康与轮换',\n  reportRotation: '已过期 / 待轮换',\n  reportWeak: '弱密码',\n  reportReused: '跨条目复用的凭据',\n  showTrash: '回收站',\n  hideTrash: '隐藏回收站',\n  trashed: '已删除',\n  trashEmpty: '回收站为空',\n  restore: '恢复',\n  add: '新增凭据',\n  cancel: '取消',\n  save: '保存',\n  edit: '编辑',\n  delete: '删除',\n  deleteConfirm: '确定删除该条目？此操作不可撤销。',\n  copy: '复制',\n  copied: '已复制',\n  totp: '验证码',\n  fieldTitle: '标题',\n  fieldKind: '类型',\n  fieldUsername: '用户名',\n  fieldEmail: '邮箱',\n  fieldPhone: '手机号',\n  fieldPassword: '密码',\n  fieldHost: '主机',\n  fieldPort: '端口',\n  fieldApiKey: 'API 密钥',\n  fieldSecret: 'Secret',\n  fieldAccessToken: '访问令牌',\n  fieldRefreshToken: '刷新令牌',\n  fieldOtpSecret: 'TOTP 密钥',\n  fieldUrl: 'URL',\n  fieldNotes: '备注',\n  fieldTags: '标签',\n  error: '操作失败。',\n  kindLogin: '登录',\n  kindSsh: 'SSH',\n  kindApiKey: 'API 密钥',\n  kindSecret: 'Secret',\n  kindOauth: 'OAuth',\n  kindCustom: '自定义',\n}\n","/**\n * dsh-vault browser half: a Vault settings page managing encrypted\n * credentials — list, search, add, edit, delete, and copy — through the host\n * VaultGateway remote over the /api RPC channel.\n *\n * @module dsh-vault/client\n */\n\nimport type { ClientContext } from '@deepseek-ai/dsh-client-runtime/client'\nimport type { ConnectionHandle } from '@deepseek-ai/dsh-api-remotes/client'\nimport type {} from '@deepseek-ai/dsh-client-locale/client'\nimport type {} from '@deepseek-ai/dsh-client-ui-settings/client'\nimport { VaultSection, type VaultSectionInjected } from './VaultSection.tsx'\nimport type { VaultSectionTypes } from './VaultSection.tsx'\nimport { en, zh, type VaultLocaleKey } from './locales.ts'\n\nexport type { VaultSectionInjected, VaultSectionProps } from './VaultSection.tsx'\nexport type { VaultSectionTypes } from './VaultSection.tsx'\nexport type { VaultLocaleKey } from './locales.ts'\n\ndeclare module '@deepseek-ai/dsh-client-ui-slots' {\n  interface LocaleNamespaceMap {\n    /** Vault settings page copy. */\n    'settings.vault': VaultLocaleKey\n  }\n}\n\n/** Dictionary namespace owned by this plugin. */\nexport const NS = 'settings.vault'\n\n/** Services required by the Settings registration and the RPC face. */\nexport const inject = ['slots', 'locale', 'connection']\n\n/**\n * Register the Vault settings section once the `settings.section` declaration\n * is on the ledger. The section talks to the host through the connection RPC\n * channel (endpoints `vault/*` served by the host VaultGateway remote).\n */\nexport function apply(ctx: ClientContext): void {\n  ctx.effect(() => ctx.locale.register(NS, { zh, en }), 'dsh-vault: dictionaries')\n\n  const t = ctx.locale.bind(NS)\n  const connection = ctx.get('connection') as ConnectionHandle\n\n  /** Invoke one host vault remote and normalize the RPC envelope. */\n  async function invoke<T>(method: string, args: Record<string, unknown> = {}): Promise<T> {\n    const result = await connection.rpc.call('/api', `vault/${method}`, { args })\n    if (!result.ok) {\n      throw new Error(`vault.${method} failed: ${result.error.code}: ${result.error.message}`)\n    }\n    return result.value as T\n  }\n\n  const injected = (): VaultSectionInjected => ({\n    t,\n    config: () => invoke<VaultSectionTypes['config']>('config'),\n    setAccessMode: (mode) => invoke<VaultSectionTypes['config']>('setAccessMode', { mode }),\n    list: () => invoke<{ entries: VaultSectionTypes['entries'] }>('list').then(r => r.entries),\n    search: (query, limit) => invoke<{ entries: VaultSectionTypes['entries'] }>('search', { query, limit: limit ?? 50 }).then(r => r.entries),\n    get: (id) => invoke<{ found: boolean; entry?: VaultSectionTypes['fullEntry'] }>('get', { id }),\n    add: (patch) => invoke<VaultSectionTypes['summaryEntry']>('add', { patch }),\n    update: (id, patch) => invoke<{ found: boolean; entry?: VaultSectionTypes['summaryEntry'] }>('update', { id, patch }),\n    remove: (id) => invoke<{ deleted: boolean }>('delete', { id }),\n    trash: () => invoke<{ entries: VaultSectionTypes['entries'] }>('trash').then(r => r.entries),\n    rotation: () => invoke<{ entries: unknown[] }>('rotation').then(r => r.entries),\n    health: () => invoke<{ weak: unknown[]; reused: unknown[] }>('health'),\n    restore: (id) => invoke<{ restored: boolean }>('restore', { id }),\n    totp: (id) => invoke<{ code: string; label?: string; secondsRemaining: number }>('totp', { id }),\n  })\n\n  ctx.slots.inject('settings.section', () => ctx.slots.register({\n    name: 'settings.section',\n    id: 'vault',\n    order: 30,\n    label: () => t('nav'),\n    inject: injected,\n  }, VaultSection))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0FA,MAAM,cAAuE;GAC3E;IAAE,KAAK;IAAS,OAAO;GAAa;GACpC;IAAE,KAAK;IAAQ,OAAO;GAAY;GAClC;IAAE,KAAK;IAAY,OAAO;GAAgB;GAC1C;IAAE,KAAK;IAAS,OAAO;GAAa;GACpC;IAAE,KAAK;IAAS,OAAO;GAAa;GACpC;IAAE,KAAK;IAAY,OAAO;GAAgB;GAC1C;IAAE,KAAK;IAAQ,OAAO;GAAY;GAClC;IAAE,KAAK;IAAQ,OAAO;GAAY;GAClC;IAAE,KAAK;IAAU,OAAO;GAAc;GACtC;IAAE,KAAK;IAAU,OAAO;GAAc;GACtC;IAAE,KAAK;IAAe,OAAO;GAAmB;GAChD;IAAE,KAAK;IAAgB,OAAO;GAAoB;GAClD;IAAE,KAAK;IAAa,OAAO;GAAiB;GAC5C;IAAE,KAAK;IAAO,OAAO;GAAW;GAChC;IAAE,KAAK;IAAS,OAAO;GAAa;EACtC;EAEA,MAAM,YAA4C;GAChD,OAAO;GACP,KAAK;GACL,WAAW;GACX,QAAQ;GACR,OAAO;GACP,QAAQ;EACV;EAYA,SAAS,YAAwB;GAC/B,OAAO;IAAE,OAAO;IAAI,MAAM;IAAS,UAAU;IAAI,OAAO;IAAI,OAAO;IAAI,UAAU;IAAI,MAAM;IAAI,MAAM;GAAG;EAC1G;;EAGA,SAAgB,aAAa,OAAqC;GAChE,MAAM,EAAE,GAAG,QAAQ,eAAe,MAAM,QAAQ,KAAK,KAAK,QAAQ,QAAQ,OAAO,UAAU,QAAQ,SAAS,SAAS;GACrH,MAAM,YAAA,GAAA,MAAA,MAAA,CAAiB;GACvB,MAAM,CAAC,OAAO,aAAA,GAAA,MAAA,SAAA,CAAqB,EAAE;GACrC,MAAM,CAAC,OAAO,aAAA,GAAA,MAAA,SAAA,CAAgC,EAAE,QAAQ,UAAU,CAAC;GACnE,MAAM,CAAC,QAAQ,cAAA,GAAA,MAAA,SAAA,CAAmC,EAAE,QAAQ,SAAS,CAAC;GACtE,MAAM,CAAC,MAAM,YAAA,GAAA,MAAA,SAAA,CAAgC,UAAU,CAAC;GACxD,MAAM,CAAC,MAAM,YAAA,GAAA,MAAA,SAAA,CAAoB,KAAK;GACtC,MAAM,CAAC,SAAS,eAAA,GAAA,MAAA,SAAA,CAAsC,IAAI;GAC1D,MAAM,CAAC,UAAU,gBAAA,GAAA,MAAA,SAAA,CAAuC,IAAI;GAC5D,MAAM,CAAC,SAAS,eAAA,GAAA,MAAA,SAAA,CAA+C,CAAC,CAAC;GACjE,MAAM,CAAC,WAAW,iBAAA,GAAA,MAAA,SAAA,CAAyB,EAAE;GAC7C,MAAM,CAAC,QAAQ,cAAA,GAAA,MAAA,SAAA,CAAgG,IAAI;GACnH,MAAM,CAAC,WAAW,iBAAA,GAAA,MAAA,SAAA,CAAyB,KAAK;GAChD,MAAM,CAAC,cAAc,oBAAA,GAAA,MAAA,SAAA,CAAgD,CAAC,CAAC;GACvE,MAAM,CAAC,QAAQ,cAAA,GAAA,MAAA,SAAA,CAA0F,IAAI;GAE7G,MAAM,WAAW,QAAQ,eAAe;GAExC,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,UAAU;IACd,OAAY,CAAC,CAAC,MACZ,UAAS;KAAE,IAAI,SAAS,UAAU,KAAK;IAAE,SACnC,CAAiD,CACzD;IACA,aAAa;KAAE,UAAU;IAAM;GACjC,GAAG,CAAC,MAAM,CAAC;GAEX,MAAM,WAAA,GAAA,MAAA,QAAA,OAAwB,YAAY;IACxC,SAAS,EAAE,QAAQ,UAAU,CAAC;IAC9B,IAAI;KAIF,SAAS;MAAE,QAAQ;MAAS,SAHZ,MAAM,KAAK,CAAC,CAAC,WAAW,IACpC,MAAM,KAAK,IACX,MAAM,OAAO,MAAM,KAAK,CAAC;KACO,CAAC;IACvC,QAAQ;KACN,SAAS,EAAE,QAAQ,QAAQ,CAAC;IAC9B;GACF,GAAG;IAAC;IAAM;IAAQ;GAAK,CAAC;GAExB,CAAA,GAAA,MAAA,UAAA,OAAgB;IACd,IAAI,UAAU;IACd,QAAa,QAAQ,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,WAC7B,CAAyC,SACzC;KAAE,IAAI,SAAS,SAAS,EAAE,QAAQ,QAAQ,CAAC;IAAE,CACrD;IACA,aAAa;KAAE,UAAU;IAAM;GAEjC,GAAG,CAAC,OAAO,CAAC;;GAGZ,SAAS,cAAoB;IAC3B,QAAQ,UAAU,CAAC;IACnB,aAAa,EAAE;IACf,WAAW,IAAI;IACf,UAAU,EAAE,QAAQ,WAAW,CAAC;GAClC;;GAGA,eAAe,UAAU,IAA2B;IAClD,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,IAAI;KACF,MAAM,SAAS,MAAM,IAAI,EAAE;KAC3B,IAAI,CAAC,OAAO,SAAS,OAAO,UAAU,KAAA,GAAW;MAC/C,WAAW,EAAE,OAAO,CAAC;MACrB;KACF;KACA,MAAM,QAAQ,OAAO;KACrB,QAAQ;MACN,OAAO,MAAM,SAAS;MACtB,MAAM,MAAM,QAAQ;MACpB,UAAU,MAAM,YAAY;MAC5B,OAAO,MAAM,SAAS;MACtB,OAAO,MAAM,SAAS;MACtB,UAAU,MAAM,YAAY;MAC5B,MAAM,MAAM,QAAQ;MACpB,MAAM,MAAM,QAAQ;MACpB,YAAY,MAAM,cAAc;MAChC,QAAQ,MAAM,UAAU;MACxB,QAAQ,MAAM,UAAU;MACxB,aAAa,MAAM,eAAe;MAClC,cAAc,MAAM,gBAAgB;MACpC,WAAW,MAAM,aAAa;MAC9B,KAAK,MAAM,OAAO;MAClB,OAAO,MAAM,SAAS;KACxB,CAAC;KACD,cAAc,MAAM,QAAQ,CAAC,EAAA,CAAG,KAAK,IAAI,CAAC;KAC1C,UAAU;MAAE,QAAQ;MAAW;KAAM,CAAC;IACxC,QAAQ;KACN,WAAW,EAAE,OAAO,CAAC;IACvB,UAAU;KACR,QAAQ,KAAK;IACf;GACF;;GAGA,eAAe,OAAsB;IACnC,IAAI,CAAC,KAAK,MAAM,KAAK,GAAG;KACtB,WAAW,EAAE,OAAO,CAAC;KACrB;IACF;IACA,QAAQ,IAAI;IACZ,WAAW,IAAI;IACf,IAAI;KACF,MAAM,OAAO,UAAU,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAO,MAAK,EAAE,SAAS,CAAC;KAC7E,MAAM,QAAoB;MACxB,OAAO,KAAK,MAAM,KAAK;MACvB,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;MACrD,GAAI,KAAK,aAAa,KAAA,IAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;MACjE,GAAI,KAAK,UAAU,KAAA,IAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;MACxD,GAAI,KAAK,UAAU,KAAA,IAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;MACxD,GAAI,KAAK,aAAa,KAAA,IAAY,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;MACjE,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;MACrD,GAAI,KAAK,SAAS,KAAA,IAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;MACrD,GAAI,KAAK,eAAe,KAAA,IAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;MACvE,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;MAC3D,GAAI,KAAK,WAAW,KAAA,IAAY,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC;MAC3D,GAAI,KAAK,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,YAAY,IAAI,CAAC;MAC1E,GAAI,KAAK,iBAAiB,KAAA,IAAY,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;MAC7E,GAAI,KAAK,cAAc,KAAA,IAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;MACpE,GAAI,KAAK,QAAQ,KAAA,IAAY,EAAE,KAAK,KAAK,IAAI,IAAI,CAAC;MAClD,GAAI,KAAK,UAAU,KAAA,IAAY,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC;MAGxD;KACF;KACA,IAAI,OAAO,WAAW,YACpB,MAAM,IAAI,KAAuC;UAC5C,IAAI,OAAO,WAAW,WAC3B,MAAM,OAAO,OAAO,MAAM,IAAI,KAAK;KAErC,UAAU,EAAE,QAAQ,SAAS,CAAC;KAC9B,MAAM,QAAQ;IAChB,QAAQ;KACN,WAAW,EAAE,OAAO,CAAC;IACvB,UAAU;KACR,QAAQ,KAAK;IACf;GACF;;GAGA,eAAe,YAAY,IAA2B;IACpD,IAAI,CAAC,OAAO,QAAQ,EAAE,eAAe,CAAC,GAAG;IACzC,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,OAAO,EAAE;KACf,MAAM,QAAQ;IAChB,QAAQ;KACN,WAAW,EAAE,OAAO,CAAC;IACvB,UAAU;KACR,QAAQ,KAAK;IACf;GACF;;GAGA,eAAe,UAAU,IAAY,OAA8B;IACjE,IAAI;KACF,MAAM,UAAU,UAAU,UAAU,KAAK;IAC3C,QAAQ;KAEN,MAAM,WAAW,SAAS,cAAc,UAAU;KAClD,SAAS,QAAQ;KACjB,SAAS,KAAK,YAAY,QAAQ;KAClC,SAAS,OAAO;KAChB,SAAS,YAAY,MAAM;KAC3B,SAAS,OAAO;IAClB;IACA,YAAY,EAAE;IACd,OAAO,iBAAiB,YAAY,IAAI,GAAG,IAAI;GACjD;;GAGA,eAAe,SAAS,IAA2B;IACjD,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,SAAS,MAAM,KAAK,EAAE;KAC5B,YAAW,cAAa;MAAE,GAAG;OAAW,KAAK,GAAG,OAAO,KAAK,IAAI,OAAO,iBAAiB;KAAI,EAAE;IAChG,QAAQ;KACN,YAAW,cAAa;MAAE,GAAG;OAAW,KAAK,EAAE,OAAO;KAAE,EAAE;IAC5D,UAAU;KACR,QAAQ,KAAK;IACf;GACF;;GAGA,SAAS,aAAa,OAAiC;IASrD,OARc;KACZ,MAAM,SAAS,KAAA,IAAY,EAAE,UAAU,MAAM,SAAS,YAAY,IAAI,EAAE,WAAW;KACnF,MAAM;KACN,MAAM;KACN,MAAM;KACN,MAAM,SAAS,KAAA,IAAY,GAAG,MAAM,OAAO,MAAM,SAAS,KAAA,IAAY,IAAI,MAAM,SAAS,OAAO,KAAA;KAChG,MAAM;IACR,CAAC,CAAC,QAAQ,UAA2B,UAAU,KAAA,KAAa,MAAM,SAAS,CAChE,CAAC,CAAC,KAAK,KAAK;GACzB;GAEA,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,WAAD;IAAS,WAAWA,gCAAI;IAAS,mBAAgB;cAAjD;KACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD;MAAI,IAAG;gBAAiB,EAAE,SAAS;KAAM,CAAA;KACzC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,WAAWA,gCAAI;gBAAQ,EAAE,OAAO;KAAK,CAAA;KAExC,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;gBAApB,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;OAAO,WAAWA,gCAAI;iBAAtB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;QAAM,WAAU;kBAAW,EAAE,mBAAmB;OAAQ,CAAA,GACxD,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;QACE,IAAI;QACJ,MAAK;QACL,aAAa,EAAE,mBAAmB;QAClC,OAAO;QACP,WAAU,UAAS,SAAS,MAAM,OAAO,KAAK;OAC/C,CAAA,CACI;UACP,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;OAAQ,MAAK;OAAS,WAAWA,gCAAI;OAAW,SAAS;OAAa,UAAU,QAAQ;iBAAxF,CAAkG,MAC7F,EAAE,KAAK,CACJ;QACL;;KAEJ,WAAW,QACV,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;gBAApB,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;OAAO,WAAWA,gCAAI;iBAAtB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD,EAAA,UAAO,EAAE,WAAW,EAAQ,CAAA,GAC5B,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;QACE,OAAO,OAAO;QACd,UAAU;QACV,WAAU,UAAS;SACjB,MAAM,OAAO,MAAM,OAAO;SAC1B,QAAQ,IAAI;SACZ,WAAW,IAAI;SACf,cAAmB,IAAI,CAAC,CAAC,MACvB,UAAS;UAAE,UAAU,KAAK;UAAG,QAAQ,KAAK;SAAE,SACtC;UAAE,WAAW,EAAE,OAAO,CAAC;UAAG,QAAQ,KAAK;SAAE,CACjD;QACF;kBAXF;SAaE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAQ,OAAM;oBAAY,EAAE,cAAc;SAAU,CAAA;SACpD,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAQ,OAAM;oBAAO,EAAE,SAAS;SAAU,CAAA;SAC1C,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAAQ,OAAM;oBAAQ,EAAE,UAAU;SAAU,CAAA;QACtC;SACH;UACP,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;OAAG,WAAW,OAAO,eAAe,aAAaA,gCAAI,eAAe,OAAO,eAAe,QAAQA,gCAAI,UAAUA,gCAAI;iBAApH,CACG,OAAO,eAAe,aACnB,EAAE,kBAAkB,IACpB,OAAO,eAAe,QACpB,EAAE,aAAa,IACf,EAAE,cAAc,GACrB,OAAO,cAAc,MAAM,EAAE,eAAe,MAAM,MAAM,EAAE,gBAAgB,GAC1E;QACA;;KAGN,YAAY,QAAQ,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,MAAK;MAAQ,WAAWA,gCAAI;gBAAQ;KAAW,CAAA;KAEtE,MAAM,WAAW,aAAa,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,WAAWA,gCAAI;gBAAS,EAAE,SAAS;KAAK,CAAA;KACzE,MAAM,WAAW,WAAW,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;MAAG,MAAK;MAAQ,WAAWA,gCAAI;gBAAQ,EAAE,OAAO;KAAK,CAAA;KACjF,MAAM,WAAW,WAAW,MAAM,QAAQ,WAAW,KACpD,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;gBAApB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,WAAWA,gCAAI;iBAAQ,EAAE,OAAO;MAAK,CAAA,GACxC,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,WAAWA,gCAAI;iBAAY,WAAW,EAAE,mBAAmB,IAAI,EAAE,WAAW;MAAK,CAAA,CACjF;;KAGN,WAAW,SAAS,OAAO,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,KAAK,OAAO,OAAO,SAAS,MAClG,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;gBAApB;OACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;QAAG,WAAWA,gCAAI;kBAAc,EAAE,aAAa;OAAK,CAAA;OACnD,OAAO,SAAS,SAAS,KACxB,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;QAAG,WAAWA,gCAAI;kBAAlB;SAA+B,EAAE,gBAAgB;SAAE;SAAG,OAAO,SAAS;QAAU;;OAEjF,OAAO,KAAK,SAAS,KACpB,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;QAAG,WAAWA,gCAAI;kBAAlB;SAA+B,EAAE,YAAY;SAAE;SAAG,OAAO,KAAK;QAAU;;OAEzE,OAAO,OAAO,SAAS,KACtB,iBAAA,GAAA,kBAAA,KAAA,CAAC,KAAD;QAAG,WAAWA,gCAAI;kBAAlB;SAA+B,EAAE,cAAc;SAAE;SAAG,OAAO,OAAO;QAAU;;MAE3E;;KAGP,iBAAA,GAAA,kBAAA,KAAA,CAAC,UAAD;MACE,MAAK;MACL,WAAWA,gCAAI;MACf,eAAe;OACb,IAAI,CAAC,WAAW,MAAW,CAAC,CAAC,KAAK,eAAe;OACjD,aAAa,CAAC,SAAS;MACzB;gBANF,CAOE,YAAY,EAAE,WAAW,IAAI,EAAE,WAAW,GAAG,aAAa,SAAS,IAAI,KAAK,aAAa,OAAO,KAAK,EAAW;;KAEjH,aACC,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD;MAAI,WAAWA,gCAAI;gBAAnB,CACG,aAAa,KAAI,UAChB,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD;OAAmB,WAAWA,gCAAI;iBAAlC,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;QAAK,WAAWA,gCAAI;kBAApB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,WAAWA,gCAAI;mBAAQ,MAAM;QAAY,CAAA,GAC/C,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;SAAM,WAAWA,gCAAI;mBAAW,EAAE,SAAS;QAAQ,CAAA,CAChD;WACL,iBAAA,GAAA,kBAAA,IAAA,CAAC,OAAD;QAAK,WAAWA,gCAAI;kBAClB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,MAAK;SACL,eAAe;UAAE,QAAa,MAAM,EAAE,CAAC,CAAC,WAAW;WAAE,MAAW,CAAC,CAAC,KAAK,eAAe;WAAG,QAAa;UAAE,CAAC;SAAE;SAC3G,UAAU,QAAQ;mBAClB,EAAE,SAAS;QAAU,CAAA;OACpB,CAAA,CACH;SAZK,MAAM,EAYX,CACL,GACA,aAAa,WAAW,KAAK,iBAAA,GAAA,kBAAA,IAAA,CAAC,KAAD;OAAG,WAAWA,gCAAI;iBAAQ,EAAE,YAAY;MAAK,CAAA,CACzE;;KAGL,MAAM,WAAW,WAAW,MAAM,QAAQ,SAAS,KAClD,iBAAA,GAAA,kBAAA,IAAA,CAAC,MAAD;MAAI,WAAWA,gCAAI;gBAChB,MAAM,QAAQ,KAAI,UAAS;OAC1B,MAAM,OAAO,QAAQ,MAAM;OAC3B,OACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,MAAD;QAAmB,WAAWA,gCAAI;kBAAlC,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,WAAWA,gCAAI;mBAApB;UACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;WAAM,WAAWA,gCAAI;qBAAQ,MAAM;UAAY,CAAA;UAC/C,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;WAAM,WAAWA,gCAAI;qBAAW,aAAa,KAAK;UAAQ,CAAA;UACzD,SAAS,KAAA,KAAa,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;WAAM,WAAWA,gCAAI;qBAAO;UAAW,CAAA;SAC3D;YACL,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;SAAK,WAAWA,gCAAI;mBAApB;UACG,aAAa,MAAM,MAAM,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD;WAAM,WAAWA,gCAAI;qBAAS,EAAE,QAAQ;UAAQ,CAAA;UAC1E,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;WACE,MAAK;WACL,eAAe,KAAK,UAAU,MAAM,IAAI,MAAM,YAAY,MAAM,KAAK;WACrE,UAAU;qBACV,EAAE,MAAM;UAAU,CAAA;UACpB,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;WAAQ,MAAK;WAAS,eAAe,KAAK,SAAS,MAAM,EAAE;WAAG,UAAU;qBAAO,EAAE,MAAM;UAAU,CAAA;UACjG,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;WAAQ,MAAK;WAAS,eAAe,KAAK,UAAU,MAAM,EAAE;WAAG,UAAU,QAAQ;qBAAW,EAAE,MAAM;UAAU,CAAA;UAC9G,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;WACE,MAAK;WACL,WAAWA,gCAAI;WACf,eAAe,KAAK,YAAY,MAAM,EAAE;WACxC,UAAU,QAAQ;qBAClB,EAAE,QAAQ;UAAU,CAAA;SACnB;UACH;UAtBK,MAAM,EAsBX;MAER,CAAC;KACC,CAAA;KAGL,OAAO,WAAW,YACjB,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;MAAK,WAAWA,gCAAI;MAAQ,MAAK;MAAS,cAAY,OAAO,WAAW,aAAa,EAAE,KAAK,IAAI,EAAE,MAAM;gBAAxG,CACE,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,WAAWA,gCAAI;iBAApB,CACG,YAAY,KAAI,UACf,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;QAAuB,WAAWA,gCAAI;kBAAtC,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD,EAAA,UAAO,EAAE,MAAM,KAAK,EAAQ,CAAA,GAC3B,MAAM,QAAQ,SACb,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;SACE,OAAO,KAAK,QAAQ;SACpB,WAAU,UAAS,SAAQ,cAAa;UAAE,GAAG;UAAU,MAAM,MAAM,OAAO;SAAM,EAAE;mBAEjF,OAAO,QAAQ,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,SACtC,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;UAA2B;oBAAQ,EAAE,GAAG;SAAU,GAArC,KAAqC,CACnD;QACK,CAAA,IACN,MAAM,QAAQ,UAChB,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,OAAO,KAAK,SAAS;SACrB,WAAU,UAAS,SAAQ,cAAa;UAAE,GAAG;UAAU,OAAO,MAAM,OAAO;SAAM,EAAE;QACpF,CAAA,IAED,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,MAAM,MAAM,QAAQ,cAAc,MAAM,QAAQ,cAAc,aAAa;SAC3E,OAAQ,KAAK,MAAM,QAA+B;SAClD,WAAU,UAAS,SAAQ,cAAa;UAAE,GAAG;WAAW,MAAM,MAAM,MAAM,OAAO;SAAM,EAAE;QAC1F,CAAA,CAEE;UAvBK,MAAM,GAuBX,CACR,GACD,iBAAA,GAAA,kBAAA,KAAA,CAAC,SAAD;QAAO,WAAWA,gCAAI;kBAAtB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,QAAD,EAAA,UAAO,EAAE,WAAW,EAAQ,CAAA,GAC5B,iBAAA,GAAA,kBAAA,IAAA,CAAC,SAAD;SACE,OAAO;SACP,WAAU,UAAS,aAAa,MAAM,OAAO,KAAK;SAClD,aAAY;QACb,CAAA,CACI;SACJ;UACL,iBAAA,GAAA,kBAAA,KAAA,CAAC,OAAD;OAAK,WAAWA,gCAAI;iBAApB,CACE,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,MAAK;QAAS,eAAe,UAAU,EAAE,QAAQ,SAAS,CAAC;QAAG,UAAU;kBAAO,EAAE,QAAQ;OAAU,CAAA,GAC3G,iBAAA,GAAA,kBAAA,IAAA,CAAC,UAAD;QAAQ,MAAK;QAAS,WAAWA,gCAAI;QAAY,eAAe,KAAK,KAAK;QAAG,UAAU;kBAAO,EAAE,MAAM;OAAU,CAAA,CAC7G;QACF;;IAEA;;EAEb;;;;;ECpgBA,MAAa,KAAK;GAChB,KAAK;GACL,SAAS;GACT,OAAO;GACP,mBAAmB;GACnB,SAAS;GACT,OAAO;GACP,WAAW;GACX,mBAAmB;GACnB,WAAW;GACX,cAAc;GACd,SAAS;GACT,UAAU;GACV,kBAAkB;GAClB,aAAa;GACb,cAAc;GACd,eAAe;GACf,gBAAgB;GAChB,aAAa;GACb,gBAAgB;GAChB,YAAY;GACZ,cAAc;GACd,WAAW;GACX,WAAW;GACX,SAAS;GACT,YAAY;GACZ,SAAS;GACT,KAAK;GACL,QAAQ;GACR,MAAM;GACN,MAAM;GACN,QAAQ;GACR,eAAe;GACf,MAAM;GACN,QAAQ;GACR,MAAM;GACN,YAAY;GACZ,WAAW;GACX,eAAe;GACf,YAAY;GACZ,YAAY;GACZ,eAAe;GACf,WAAW;GACX,WAAW;GACX,aAAa;GACb,aAAa;GACb,kBAAkB;GAClB,mBAAmB;GACnB,gBAAgB;GAChB,UAAU;GACV,YAAY;GACZ,WAAW;GACX,OAAO;GACP,WAAW;GACX,SAAS;GACT,YAAY;GACZ,YAAY;GACZ,WAAW;GACX,YAAY;EACd;;EAKA,MAAa,KAAqC;GAChD,KAAK;GACL,SAAS;GACT,OAAO;GACP,mBAAmB;GACnB,SAAS;GACT,OAAO;GACP,WAAW;GACX,mBAAmB;GACnB,WAAW;GACX,cAAc;GACd,SAAS;GACT,UAAU;GACV,kBAAkB;GAClB,aAAa;GACb,cAAc;GACd,eAAe;GACf,gBAAgB;GAChB,aAAa;GACb,gBAAgB;GAChB,YAAY;GACZ,cAAc;GACd,WAAW;GACX,WAAW;GACX,SAAS;GACT,YAAY;GACZ,SAAS;GACT,KAAK;GACL,QAAQ;GACR,MAAM;GACN,MAAM;GACN,QAAQ;GACR,eAAe;GACf,MAAM;GACN,QAAQ;GACR,MAAM;GACN,YAAY;GACZ,WAAW;GACX,eAAe;GACf,YAAY;GACZ,YAAY;GACZ,eAAe;GACf,WAAW;GACX,WAAW;GACX,aAAa;GACb,aAAa;GACb,kBAAkB;GAClB,mBAAmB;GACnB,gBAAgB;GAChB,UAAU;GACV,YAAY;GACZ,WAAW;GACX,OAAO;GACP,WAAW;GACX,SAAS;GACT,YAAY;GACZ,YAAY;GACZ,WAAW;GACX,YAAY;EACd;;;;EClGA,MAAa,KAAK;;EAGlB,MAAa,SAAS;GAAC;GAAS;GAAU;EAAY;;;;;;EAOtD,SAAgB,MAAM,KAA0B;GAC9C,IAAI,aAAa,IAAI,OAAO,SAAS,IAAI;IAAE;IAAI;GAAG,CAAC,GAAG,yBAAyB;GAE/E,MAAM,IAAI,IAAI,OAAO,KAAK,EAAE;GAC5B,MAAM,aAAa,IAAI,IAAI,YAAY;;GAGvC,eAAe,OAAU,QAAgB,OAAgC,CAAC,GAAe;IACvF,MAAM,SAAS,MAAM,WAAW,IAAI,KAAK,QAAQ,SAAS,UAAU,EAAE,KAAK,CAAC;IAC5E,IAAI,CAAC,OAAO,IACV,MAAM,IAAI,MAAM,SAAS,OAAO,WAAW,OAAO,MAAM,KAAK,IAAI,OAAO,MAAM,SAAS;IAEzF,OAAO,OAAO;GAChB;GAEA,MAAM,kBAAwC;IAC5C;IACA,cAAc,OAAoC,QAAQ;IAC1D,gBAAgB,SAAS,OAAoC,iBAAiB,EAAE,KAAK,CAAC;IACtF,YAAY,OAAkD,MAAM,CAAC,CAAC,MAAK,MAAK,EAAE,OAAO;IACzF,SAAS,OAAO,UAAU,OAAkD,UAAU;KAAE;KAAO,OAAO,SAAS;IAAG,CAAC,CAAC,CAAC,MAAK,MAAK,EAAE,OAAO;IACxI,MAAM,OAAO,OAAmE,OAAO,EAAE,GAAG,CAAC;IAC7F,MAAM,UAAU,OAA0C,OAAO,EAAE,MAAM,CAAC;IAC1E,SAAS,IAAI,UAAU,OAAsE,UAAU;KAAE;KAAI;IAAM,CAAC;IACpH,SAAS,OAAO,OAA6B,UAAU,EAAE,GAAG,CAAC;IAC7D,aAAa,OAAkD,OAAO,CAAC,CAAC,MAAK,MAAK,EAAE,OAAO;IAC3F,gBAAgB,OAA+B,UAAU,CAAC,CAAC,MAAK,MAAK,EAAE,OAAO;IAC9E,cAAc,OAA+C,QAAQ;IACrE,UAAU,OAAO,OAA8B,WAAW,EAAE,GAAG,CAAC;IAChE,OAAO,OAAO,OAAmE,QAAQ,EAAE,GAAG,CAAC;GACjG;GAEA,IAAI,MAAM,OAAO,0BAA0B,IAAI,MAAM,SAAS;IAC5D,MAAM;IACN,IAAI;IACJ,OAAO;IACP,aAAa,EAAE,KAAK;IACpB,QAAQ;GACV,GAAG,YAAY,CAAC;EAClB"}

package/lib/index.js

@@ -71,10 +71,13 @@ export const Config = Schema.object({
         Schema.const('auto'),
     ]),
     autoCapture: Schema.boolean(),
+    lockTimeoutSeconds: Schema.number(),
+    exportPasswordEnv: Schema.string(),
 });
 export async function apply(ctx, config) {
     const masterPassword = resolveMasterPassword(config);
     const WRITE_TOOLS = new Set(['vault_add', 'vault_update', 'vault_delete']);
+    const lockTimeoutSeconds = config.lockTimeoutSeconds ?? 0;
     /** Shared access policy; resolved once, mutated by the UI via setAccessMode. */
     const policy = await sharedAccessPolicy(config);
     /** Reject mutations when the vault is in readonly mode. */
@@ -98,11 +101,29 @@ export async function apply(ctx, config) {
     /** Ensure the shared store is open (lazily on first use, so a missing
      * master password fails at the first tool call with a clear message). */
     async function ensureStore() {
-        return sharedVaultStore(masterPassword, config);
+        const store = await sharedVaultStore(masterPassword, config);
+        // Install the auto-lock policy once per store instance.
+        if (lockTimeoutSeconds > 0)
+            store.setAutoLock(lockTimeoutSeconds * 1000);
+        return store;
     }
-    /** Read a full entry (with secrets) by id. */
+    /** Guard every tool: enforce auto-lock (relock when idle, refuse when
+     * locked) and touch the activity timestamp. */
+    async function guardStore() {
+        const store = await ensureStore();
+        if (store.expired) {
+            store.lock();
+            throw new Error('vault is locked (idle timeout) — call vault_unlock to re-open it');
+        }
+        if (store.isLocked) {
+            throw new Error('vault is locked — call vault_unlock to re-open it');
+        }
+        store.touch();
+        return store;
+    }
+    /** Read a full entry (with secrets) by id (respects locking). */
     async function readEntry(id) {
-        const s = await ensureStore();
+        const s = await guardStore();
         return s.get(id);
     }
     // System prompt guidance: tells the model how the vault works, what the
@@ -186,7 +207,7 @@ export async function apply(ctx, config) {
             assertWritable('vault_add');
             if (!args.title.trim())
                 throw new Error('vault_add: title must not be empty');
-            const s = await ensureStore();
+            const s = await guardStore();
             const entry = await s.add({
                 title: args.title.trim(),
                 ...(args.kind !== undefined ? { kind: args.kind } : {}),
@@ -267,7 +288,7 @@ export async function apply(ctx, config) {
                 }],
         },
         async execute(args) {
-            const s = await ensureStore();
+            const s = await guardStore();
             const limit = validateLimit(args.limit, 'vault_search');
             const results = s.search(args.query, limit);
             return { results, total: results.length };
@@ -321,7 +342,7 @@ export async function apply(ctx, config) {
         },
         async execute(args) {
             assertWritable('vault_update');
-            const s = await ensureStore();
+            const s = await guardStore();
             const patch = {};
             for (const key of [
                 'title', 'kind', 'username', 'email', 'phone', 'password', 'host', 'port', 'privateKey',
@@ -358,7 +379,7 @@ export async function apply(ctx, config) {
         },
         async execute(args) {
             assertWritable('vault_delete');
-            const s = await ensureStore();
+            const s = await guardStore();
             const deleted = await s.delete(args.id);
             return { deleted, message: deleted ? 'entry deleted' : 'entry not found' };
         },
@@ -448,6 +469,194 @@ export async function apply(ctx, config) {
             return { password, length: password.length };
         },
     }));
+    // ── vault_lock / vault_unlock: explicit lock & unlock ──────────────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_lock',
+        description: 'Lock the vault immediately: wipe the derived key from memory so every '
+            + 'subsequent read/write requires vault_unlock. Use when leaving the machine.',
+        parameters: {},
+        output: { schema: { type: 'object', additionalProperties: false, properties: { locked: { type: 'boolean', required: true } } }, render: (_a, v) => [{ type: 'text', text: v.locked ? 'vault locked' : 'vault not unlocked' }] },
+        async execute() {
+            const s = await ensureStore();
+            const was = s.isLocked;
+            s.lock();
+            return { locked: !was };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'vault_unlock',
+        description: 'Unlock the vault with the master password (the deployment owns the password; '
+            + 'the model never supplies it). Needed after an explicit vault_lock or an auto-lock idle timeout.',
+        parameters: {},
+        output: { schema: { type: 'object', additionalProperties: false, properties: { unlocked: { type: 'boolean', required: true } } }, render: (_a, v) => [{ type: 'text', text: v.unlocked ? 'vault unlocked' : 'vault already unlocked' }] },
+        async execute() {
+            const s = await ensureStore();
+            if (!s.isLocked)
+                return { unlocked: false };
+            await s.unlock();
+            return { unlocked: true };
+        },
+    }));
+    // ── vault_rotation: expiry / rotation report ───────────────────────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_rotation',
+        description: 'Report credentials that are expired, due for rotation (rotationDays elapsed), '
+            + 'or expiring within 7 days. Returns summaries with a due state — never secrets.',
+        parameters: {},
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { entries: { type: 'array', required: true, items: { type: 'json' } } } },
+            render: (_a, v) => [{ type: 'text', text: v.entries.length === 0 ? 'no rotation items' : JSON.stringify(v.entries) }],
+        },
+        async execute() {
+            const s = await guardStore();
+            return { entries: s.rotationReport() };
+        },
+    }));
+    // ── vault_health: weak / reused credential scan ────────────────────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_health',
+        description: 'Scan the vault for weak passwords (shorter than 12 chars) and credentials reused '
+            + 'across entries. Returns non-secret findings (entry summaries grouped by the reused value).',
+        parameters: {},
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { weak: { type: 'array', required: true, items: { type: 'json' } }, reused: { type: 'array', required: true, items: { type: 'json' } } } },
+            render: (_a, v) => [{ type: 'text', text: `weak: ${v.weak.length}, reused groups: ${v.reused.length}` }],
+        },
+        async execute() {
+            const s = await guardStore();
+            return s.health();
+        },
+    }));
+    // ── vault_restore / vault_purge: trash management ──────────────────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_restore',
+        description: 'Restore a soft-deleted entry from the vault trash back into the active set.',
+        parameters: { id: { type: 'string', required: true, description: 'The trashed entry id.' } },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { restored: { type: 'boolean', required: true } } }, render: (_a, v) => [{ type: 'text', text: v.restored ? 'entry restored' : 'entry not found in trash' }] },
+        async execute(args) {
+            assertWritable('vault_restore');
+            const s = await guardStore();
+            return { restored: await s.restore(args.id) };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'vault_purge',
+        description: 'Permanently delete an entry (active or trashed). Cannot be undone — prefer vault_delete '
+            + '(soft delete) unless the entry must be removed from disk.',
+        parameters: { id: { type: 'string', required: true, description: 'The entry id to purge.' } },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { purged: { type: 'boolean', required: true } } }, render: (_a, v) => [{ type: 'text', text: v.purged ? 'entry purged' : 'entry not found' }] },
+        async execute(args) {
+            assertWritable('vault_purge');
+            const s = await guardStore();
+            return { purged: await s.purge(args.id) };
+        },
+    }));
+    // ── vault_export / vault_import: portable encrypted transfer ───────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_export',
+        description: 'Export the entire vault (including trash) as a single encrypted document under a '
+            + 'separate export password (from the exportPasswordEnv config). Use for backup or migration; '
+            + 'the export can be re-imported with vault_import. Never pass the password as an argument.',
+        parameters: {},
+        output: { schema: { type: 'object', additionalProperties: false, properties: { exported: { type: 'boolean', required: true }, note: { type: 'string', required: true } } }, render: (_a, v) => [{ type: 'text', text: v.note }] },
+        async execute() {
+            const exportPassword = resolveExportPassword(config);
+            const s = await guardStore();
+            const blob = await s.exportEncrypted(exportPassword);
+            const file = join(dirname(resolveVaultPath(config)), `vault-export-${Date.now()}.json`);
+            await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+            await writeFile(file, blob, { mode: 0o600 });
+            return { exported: true, note: `vault exported to ${file}` };
+        },
+    }));
+    ctx.tools.register(defineTool({
+        name: 'vault_import',
+        description: 'Import a previously exported vault document (see vault_export), merging entries by '
+            + 'id. Pass the document path; the export password comes from the exportPasswordEnv config.',
+        parameters: { path: { type: 'string', required: true, description: 'Absolute path of the exported vault JSON file.' } },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { imported: { type: 'integer', required: true } } }, render: (_a, v) => [{ type: 'text', text: `imported ${v.imported} entries` }] },
+        async execute(args) {
+            assertWritable('vault_import');
+            const exportPassword = resolveExportPassword(config);
+            const s = await guardStore();
+            const blob = await readFile(args.path, 'utf8');
+            const count = await s.importEncrypted(blob, exportPassword);
+            return { imported: count };
+        },
+    }));
+    // ── vault_fill: find the credential that fits a target ─────────────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_fill',
+        description: 'Find the vault entry that fits a target (host/URL/username/title) and return the '
+            + 'ready-to-use credentials (secrets included, as the caller needs them for the actual login). '
+            + 'Use instead of vault_search+vault_get when you know what you are connecting to.',
+        parameters: {
+            target: { type: 'string', required: true, description: 'Host, URL, username, or title to match.' },
+        },
+        output: {
+            schema: { type: 'object', additionalProperties: false, properties: { found: { type: 'boolean', required: true }, entry: { type: 'json' } } },
+            render: (_a, v) => [{ type: 'text', text: v.found ? `matched: ${v.entry?.title ?? 'entry'}` : 'no matching entry' }],
+        },
+        async execute(args) {
+            const s = await guardStore();
+            const needle = args.target.trim().toLowerCase();
+            for (const entry of s.list()) {
+                const haystack = [entry.title, entry.host, entry.url, entry.username, entry.email].filter(Boolean).join(' ').toLowerCase();
+                if (needle.length > 0 && haystack.includes(needle)) {
+                    return { found: true, entry: stripTimestamps(entry) };
+                }
+            }
+            return { found: false };
+        },
+    }));
+    // ── vault_env: environment-variable export ─────────────────────────────────
+    ctx.tools.register(defineTool({
+        name: 'vault_env',
+        description: 'Render entries flagged for environment export (tags contain "env") as KEY=VALUE lines '
+            + 'suitable for .env or export statements. Keys derive from the title + field name; values are the '
+            + 'secrets. Returns the lines so the caller can write them to a file (user-authorized).',
+        parameters: {},
+        output: { schema: { type: 'object', additionalProperties: false, properties: { lines: { type: 'array', required: true, items: { type: 'string' } } } }, render: (_a, v) => [{ type: 'text', text: v.lines.join('\n') }] },
+        async execute() {
+            const s = await guardStore();
+            const lines = [];
+            const keyOf = (title, field) => title.toUpperCase().replace(/[^A-Z0-9]+/g, '_').replace(/^_+|_+$/g, '') + '_' + field.toUpperCase();
+            for (const entry of s.list()) {
+                if (!(entry.tags ?? []).includes('env'))
+                    continue;
+                for (const [field, value] of Object.entries(entry)) {
+                    if (typeof value !== 'string' || value.length === 0)
+                        continue;
+                    if (['id', 'title', 'kind', 'sensitivity', 'host', 'url', 'notes', 'createdAt', 'updatedAt', 'deletedAt'].includes(field))
+                        continue;
+                    if (['username', 'email', 'phone', 'port', 'tags'].includes(field))
+                        continue;
+                    lines.push(`${keyOf(entry.title, field)}=${value}`);
+                }
+            }
+            return { lines };
+        },
+    }));
+    // ── vault_templates: field templates by kind ───────────────────────────────
+    const TEMPLATES = {
+        login: { username: 'account username', email: 'account email', password: 'account password' },
+        ssh: { host: 'server host', port: 'port (e.g. 22)', username: 'login user', password: 'password or passphrase', privateKey: 'PEM private key' },
+        'api-key': { apiKey: 'the API key', url: 'API base URL', username: 'owner/account (optional)' },
+        oauth: { accessToken: 'access token', refreshToken: 'refresh token', expiresAt: 'expiry epoch millis', clientId: 'client id (via fields)' },
+        secret: { secret: 'the shared secret', notes: 'what it is for' },
+        custom: { fields: 'arbitrary key/value pairs' },
+    };
+    ctx.tools.register(defineTool({
+        name: 'vault_templates',
+        description: 'Return the recommended fields for a credential kind, so vault_add can be called with '
+            + 'the right field names (e.g. kind ssh → host/port/username/password/privateKey).',
+        parameters: { kind: { type: 'string', description: 'Entry kind; default login.', enum: ['login', 'ssh', 'api-key', 'secret', 'oauth', 'custom'] } },
+        output: { schema: { type: 'object', additionalProperties: false, properties: { kind: { type: 'string', required: true }, fields: { type: 'json', required: true } } }, render: (_a, v) => [{ type: 'text', text: JSON.stringify(v.fields) }] },
+        async execute(args) {
+            const kind = args.kind ?? 'login';
+            return { kind, fields: TEMPLATES[kind] ?? TEMPLATES.login };
+        },
+    }));
     // UI-facing Remote gateway: the browser Settings Vault page talks to these
     // methods through the /api RPC channel (loopback-trusted), bypassing the
     // model-tool layer entirely. Secrets are returned because the UI is the
@@ -472,6 +681,10 @@ let VaultGateway = (() => {
     let _config_decorators;
     let _setAccessMode_decorators;
     let _list_decorators;
+    let _trash_decorators;
+    let _restore_decorators;
+    let _rotation_decorators;
+    let _health_decorators;
     let _get_decorators;
     let _search_decorators;
     let _add_decorators;
@@ -484,6 +697,10 @@ let VaultGateway = (() => {
             _config_decorators = [Remote('config')];
             _setAccessMode_decorators = [Remote('setAccessMode')];
             _list_decorators = [Remote('list')];
+            _trash_decorators = [Remote('trash')];
+            _restore_decorators = [Remote('restore')];
+            _rotation_decorators = [Remote('rotation')];
+            _health_decorators = [Remote('health')];
             _get_decorators = [Remote('get')];
             _search_decorators = [Remote('search')];
             _add_decorators = [Remote('add')];
@@ -493,6 +710,10 @@ let VaultGateway = (() => {
             __esDecorate(this, null, _config_decorators, { kind: "method", name: "config", static: false, private: false, access: { has: obj => "config" in obj, get: obj => obj.config }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _setAccessMode_decorators, { kind: "method", name: "setAccessMode", static: false, private: false, access: { has: obj => "setAccessMode" in obj, get: obj => obj.setAccessMode }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _list_decorators, { kind: "method", name: "list", static: false, private: false, access: { has: obj => "list" in obj, get: obj => obj.list }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _trash_decorators, { kind: "method", name: "trash", static: false, private: false, access: { has: obj => "trash" in obj, get: obj => obj.trash }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _restore_decorators, { kind: "method", name: "restore", static: false, private: false, access: { has: obj => "restore" in obj, get: obj => obj.restore }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _rotation_decorators, { kind: "method", name: "rotation", static: false, private: false, access: { has: obj => "rotation" in obj, get: obj => obj.rotation }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _health_decorators, { kind: "method", name: "health", static: false, private: false, access: { has: obj => "health" in obj, get: obj => obj.health }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _get_decorators, { kind: "method", name: "get", static: false, private: false, access: { has: obj => "get" in obj, get: obj => obj.get }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _search_decorators, { kind: "method", name: "search", static: false, private: false, access: { has: obj => "search" in obj, get: obj => obj.search }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _add_decorators, { kind: "method", name: "add", static: false, private: false, access: { has: obj => "add" in obj, get: obj => obj.add }, metadata: _metadata }, null, _instanceExtraInitializers);
@@ -552,6 +773,27 @@ let VaultGateway = (() => {
             const store = await this.ensureStore();
             return { entries: store.list().map(toSummary) };
         }
+        /** List trashed (soft-deleted) entries as non-secret summaries. */
+        async trash() {
+            const store = await this.ensureStore();
+            return { entries: store.listTrash().map(toSummary) };
+        }
+        /** Restore a trashed entry (non-secret summary returned). */
+        async restore(id) {
+            this.assertWritable('restore');
+            const store = await this.ensureStore();
+            return { restored: await store.restore(id) };
+        }
+        /** Rotation/expiry report (no secrets). */
+        async rotation() {
+            const store = await this.ensureStore();
+            return { entries: store.rotationReport() };
+        }
+        /** Health scan findings (no secrets). */
+        async health() {
+            const store = await this.ensureStore();
+            return store.health();
+        }
         /** Read one full entry (including secrets) by id. */
         async get(id) {
             const store = await this.ensureStore();
@@ -651,6 +893,18 @@ function resolveMasterPassword(config) {
     }
     throw new Error('dsh-vault: configure masterPassword or masterPasswordEnv to unlock the vault');
 }
+/** Resolve the export/import password from the configured environment
+ * variable, or fail loudly (the model must never pass it as an argument). */
+function resolveExportPassword(config) {
+    if (config.exportPasswordEnv !== undefined) {
+        const fromEnv = process.env[config.exportPasswordEnv];
+        if (fromEnv === undefined || fromEnv.length === 0) {
+            throw new Error(`dsh-vault: environment variable ${config.exportPasswordEnv} is not set (needed for vault_export/import)`);
+        }
+        return fromEnv;
+    }
+    throw new Error('dsh-vault: configure exportPasswordEnv to use vault_export / vault_import');
+}
 /**
  * Shared vault-store instances keyed by resolved path + master password. The
  * model tools and the UI-facing VaultGateway must observe ONE store so writes
@@ -698,6 +952,40 @@ async function sharedAccessPolicy(config) {
     sharedAccessPolicies.set(path, policy);
     return policy;
 }
+const MAX_ATTEMPTS = 5;
+const LOCKOUT_MS = 5 * 60 * 1000;
+/** `<vault dir>/meta.json` — failed-attempt counter and lockout window. */
+function metaFile(config) {
+    return join(dirname(resolveVaultPath(config)), 'meta.json');
+}
+async function readMeta(config) {
+    try {
+        const raw = await readFile(metaFile(config), 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return { failedAttempts: 0 };
+    }
+}
+async function writeMeta(config, meta) {
+    const file = metaFile(config);
+    await mkdir(dirname(file), { recursive: true, mode: 0o700 });
+    await writeFile(file, JSON.stringify(meta), { mode: 0o600 });
+}
+/** Record one failed unlock: increment the counter, start a lockout when the
+ * threshold is crossed. */
+async function recordFailedAttempt(config) {
+    const meta = await readMeta(config);
+    meta.failedAttempts = (meta.failedAttempts ?? 0) + 1;
+    if (meta.failedAttempts >= MAX_ATTEMPTS) {
+        meta.lockedUntil = Date.now() + LOCKOUT_MS;
+    }
+    await writeMeta(config, meta);
+}
+/** Clear the counter after a successful unlock. */
+async function clearFailedAttempts(config) {
+    await writeMeta(config, { failedAttempts: 0 });
+}
 /**
  * Open (or reuse) the vault store for one deployment configuration. All
  * callers within the process share the same instance for the same path and
@@ -706,22 +994,34 @@ async function sharedAccessPolicy(config) {
  */
 async function sharedVaultStore(masterPassword, config) {
     const path = resolveVaultPath(config);
+    // Brute-force guard: refuse to even attempt while a lockout window is open.
+    const meta = await readMeta(config);
+    if (meta.lockedUntil !== undefined && Date.now() < meta.lockedUntil) {
+        const minutes = Math.ceil((meta.lockedUntil - Date.now()) / 60000);
+        throw new Error(`vault is temporarily locked after ${MAX_ATTEMPTS} failed password attempts — retry in ~${minutes} min`);
+    }
     // The master password is part of the identity: a different password must
     // open its own store (and fail authentication) rather than reuse a store
     // unlocked with another password.
     const cacheKey = `${path}\0${masterPassword}`;
     const existing = sharedVaultStores.get(cacheKey);
-    if (existing !== undefined)
+    if (existing !== undefined) {
+        // A successful re-open of a cached store clears the failure counter.
+        await clearFailedAttempts(config);
         return existing;
+    }
     const opening = openVault({
         masterPassword,
         path,
-    }).catch((error) => {
-        // A failed open must not poison the cache for later retries.
+    }).catch(async (error) => {
+        // A failed open must not poison the cache for later retries, and counts
+        // toward the brute-force lockout.
         sharedVaultStores.delete(cacheKey);
+        await recordFailedAttempt(config);
         throw error;
     });
     sharedVaultStores.set(cacheKey, opening);
+    await clearFailedAttempts(config);
     return opening;
 }
 /** Validate a model-supplied result limit: a positive integer capped at 100. */

package/lib/store.js

@@ -57,10 +57,55 @@ export class VaultStore {
      * contend for the cross-process file lock and every write sees the latest
      * in-memory state. */
     persistChain = Promise.resolve();
+    /** Auto-lock: after this many ms of inactivity the vault re-locks (key
+     * wiped). `0`/undefined disables auto-lock. */
+    lockTimeoutMs;
+    /** Epoch millis of the last operation; used for the auto-lock timer. */
+    lastActivity = Date.now();
+    /** Whether the vault is currently locked (key wiped, requires re-unlock). */
+    locked = false;
+    /** Weak-password heuristic: too short or in a tiny common list. */
+    static MIN_PASSWORD_LENGTH = 12;
     constructor(path, masterPassword) {
         this.path = path;
         this.masterPassword = masterPassword;
     }
+    /** Enable auto-lock with the given idle timeout (ms). */
+    setAutoLock(timeoutMs) {
+        this.lockTimeoutMs = timeoutMs;
+        this.lastActivity = Date.now();
+    }
+    /** Whether the vault is currently locked. */
+    get isLocked() {
+        return this.locked;
+    }
+    /** Touch the activity timestamp; call before every read/write. */
+    touch() {
+        this.lastActivity = Date.now();
+    }
+    /** Whether the auto-lock idle window has elapsed. */
+    get expired() {
+        if (this.lockTimeoutMs === undefined || this.lockTimeoutMs <= 0)
+            return false;
+        return Date.now() - this.lastActivity > this.lockTimeoutMs;
+    }
+    /** Lock the vault: wipe the derived key and require re-unlock. */
+    lock() {
+        this.key?.fill(0);
+        this.key = undefined;
+        this.locked = true;
+        this.lastActivity = Date.now();
+    }
+    /** Re-derive the key from the master password (after a lock). */
+    async unlock() {
+        if (this.kdf === undefined) {
+            await this.load();
+            return;
+        }
+        this.key = await deriveKey(this.masterPassword, this.kdf);
+        this.locked = false;
+        this.lastActivity = Date.now();
+    }
     /**
      * Load the vault document from disk (creating an empty one on first use)
      * and derive the vault key from the document's fixed KDF parameters.
@@ -79,6 +124,8 @@ export class VaultStore {
             // First run: persist the empty document so the file exists with the
             // chosen KDF (and its verify envelope) before any entry is added.
             await this.persist();
+            this.locked = false;
+            this.lastActivity = Date.now();
             return;
         }
         for (const blob of file.entries) {
@@ -91,17 +138,28 @@ export class VaultStore {
         if (!safeEqual(verify, Buffer.from(VERIFY_PLAINTEXT, 'utf8'))) {
             throw new Error('vault master password is incorrect');
         }
+        this.locked = false;
+        this.lastActivity = Date.now();
     }
     /** The vault file path (useful for messages and debugging). */
     get filePath() {
         return this.path;
     }
-    /** All entries, in insertion order. */
+    /** All active (non-trashed) entries, in insertion order. */
     list() {
-        return [...this.entries.values()];
+        return [...this.entries.values()].filter(entry => entry.deletedAt === undefined);
+    }
+    /** All trashed entries (soft-deleted, awaiting purge or restore). */
+    listTrash() {
+        return [...this.entries.values()].filter(entry => entry.deletedAt !== undefined);
     }
-    /** Read one entry by id. */
+    /** Read one active entry by id. */
     get(id) {
+        const entry = this.entries.get(id);
+        return entry !== undefined && entry.deletedAt === undefined ? entry : undefined;
+    }
+    /** Read one entry by id, including trashed entries. */
+    getIncludingTrash(id) {
         return this.entries.get(id);
     }
     /** Search entries across text fields; returns summaries without secrets. */
@@ -163,8 +221,27 @@ export class VaultStore {
         await this.persist();
         return updated;
     }
-    /** Delete an entry; returns true when it existed. */
+    /** Soft-delete an entry (move to trash); returns true when it existed.
+     * The entry stays encrypted on disk until purged or restored. */
     async delete(id) {
+        const entry = this.entries.get(id);
+        if (!entry || entry.deletedAt !== undefined)
+            return false;
+        entry.deletedAt = Date.now();
+        await this.persist();
+        return true;
+    }
+    /** Restore a trashed entry; returns true when it existed in trash. */
+    async restore(id) {
+        const entry = this.entries.get(id);
+        if (!entry || entry.deletedAt === undefined)
+            return false;
+        delete entry.deletedAt;
+        await this.persist();
+        return true;
+    }
+    /** Permanently remove a trashed (or active) entry; returns true when it existed. */
+    async purge(id) {
         const existed = this.entries.delete(id);
         if (existed)
             await this.persist();
@@ -178,6 +255,128 @@ export class VaultStore {
     get unlocked() {
         return this.key !== undefined;
     }
+    /**
+     * Rotation & expiry report: entries whose `rotationDays` elapsed since
+     * their last update, or whose `expiresAt` is near/past. Returns only
+     * summaries plus the computed due state (no secrets).
+     */
+    rotationReport(now = Date.now()) {
+        const report = [];
+        for (const entry of this.list()) {
+            const base = entry.updatedAt ?? entry.createdAt;
+            const rotationAt = entry.rotationDays !== undefined ? base + entry.rotationDays * 86_400_000 : undefined;
+            const expiresAt = entry.expiresAt;
+            let due;
+            let daysLeft;
+            if (rotationAt !== undefined && now >= rotationAt) {
+                due = 'due';
+                daysLeft = 0;
+            }
+            else if (expiresAt !== undefined && now >= expiresAt) {
+                due = 'expired';
+                daysLeft = 0;
+            }
+            else if (expiresAt !== undefined) {
+                daysLeft = Math.ceil((expiresAt - now) / 86_400_000);
+                if (daysLeft <= 7) {
+                    due = 'soon';
+                }
+            }
+            else if (rotationAt !== undefined) {
+                daysLeft = Math.ceil((rotationAt - now) / 86_400_000);
+                if (daysLeft <= 7) {
+                    due = 'soon';
+                }
+            }
+            else {
+                continue;
+            }
+            if (due === undefined)
+                continue;
+            report.push({ ...toSummary(entry), due, daysLeft });
+        }
+        return report;
+    }
+    /**
+     * Health scan: weak passwords (too short), and passwords/API keys reused
+     * across entries. Returns non-secret findings keyed by entry id.
+     */
+    health() {
+        const weak = [];
+        const passwordCounts = new Map();
+        const keyCounts = new Map();
+        for (const entry of this.list()) {
+            const summary = toSummary(entry);
+            if (entry.password !== undefined) {
+                if (entry.password.length < VaultStore.MIN_PASSWORD_LENGTH)
+                    weak.push(summary);
+                const list = passwordCounts.get(entry.password) ?? [];
+                list.push(summary);
+                passwordCounts.set(entry.password, list);
+            }
+            for (const key of [entry.apiKey, entry.accessToken, entry.refreshToken, entry.secret]) {
+                if (key === undefined)
+                    continue;
+                const list = keyCounts.get(key) ?? [];
+                list.push(summary);
+                keyCounts.set(key, list);
+            }
+        }
+        const reused = [
+            ...[...passwordCounts.entries()].filter(([, v]) => v.length > 1),
+            ...[...keyCounts.entries()].filter(([, v]) => v.length > 1),
+        ].map(([value, entries]) => ({ value, entries }));
+        return { weak, reused };
+    }
+    /**
+     * Export the whole vault (including trash) as a single encrypted blob under
+     * a separate export password: a portable, machine-independent document that
+     * can be re-imported elsewhere. Returns the armored JSON string.
+     */
+    async exportEncrypted(exportPassword, now = Date.now()) {
+        if (exportPassword.length === 0)
+            throw new Error('vault: export password must not be empty');
+        const exportKdf = newKdfParams();
+        const exportKey = await deriveKey(exportPassword, exportKdf);
+        const payload = {
+            exportedAt: now,
+            kdf: exportKdf,
+            entries: [...this.entries.values()].map(entry => ({
+                id: entry.id,
+                ...encrypt(Buffer.from(JSON.stringify(entry), 'utf8'), exportKey),
+            })),
+        };
+        exportKey.fill(0);
+        return JSON.stringify(payload);
+    }
+    /**
+     * Import an exported vault blob, merging entries by id (existing entries win
+     * unless `overwrite`). Returns the number of entries added.
+     */
+    async importEncrypted(blob, exportPassword, overwrite = false) {
+        if (exportPassword.length === 0)
+            throw new Error('vault: export password must not be empty');
+        const parsed = JSON.parse(blob);
+        if (!parsed.kdf || !Array.isArray(parsed.entries)) {
+            throw new Error('vault: invalid export document');
+        }
+        const exportKey = await deriveKey(exportPassword, parsed.kdf);
+        let added = 0;
+        for (const blobEntry of parsed.entries) {
+            const plaintext = decrypt(blobEntry, exportKey);
+            const entry = JSON.parse(plaintext.toString('utf8'));
+            const existing = this.entries.get(entry.id);
+            if (existing !== undefined && !overwrite)
+                continue;
+            // Imported entries come back as active (clear any soft-delete marker).
+            const { deletedAt, ...active } = entry;
+            this.entries.set(entry.id, { ...active, updatedAt: Date.now() });
+            added++;
+        }
+        exportKey.fill(0);
+        await this.persist();
+        return added;
+    }
     /**
      * Persist the current in-memory state: encrypt every entry under the vault
      * key, then atomically replace the document under the cross-process lock.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-vault",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Encrypted credential vault for DeepSeek Harness: store and retrieve usernames, emails, phone numbers, passwords, TOTP secrets, SSH/API-key/OAuth developer credentials through model tools and a Settings UI page.",
   "type": "module",
   "license": "MIT",