@ai-matrx/vault

The AI Matrx Vault: one password-manager workspace for the web app, the browser extension and the desktop app — logins, API keys and secrets, one-time passwords, sharing, secure links, history, files, trash, import/export/backup — over the AI Matrx server.

import { VaultApp, createApiVaultPort, createSupabaseIdentity, createVaultKnobs } from "@ai-matrx/vault";

const port = createApiVaultPort(api, { userState: supabase, platformDoor: supabase.schema("platform"), passkeys: supabase.auth });
const host = {
  identity: createSupabaseIdentity(supabase.auth),
  knobs: createVaultKnobs(supabase, { organizationId, userId }),
  openUrl: (url: string) => window.open(url, "_blank", "noopener"),
};

<VaultApp port={port} host={host} location={location} onLocationChange={(next, how) => writeToUrl(next, how)} notify={toast} />;

• Confirm it's you returns through the host's sign-in callback: pass redirectTo to createSupabaseIdentity as the host's accepted OAuth return address carrying the current page (the web app: /auth/callback?redirectTo=<this address>). A bare page URL is usually not on the auth server's allow-list, and the person lands on the home page unconfirmed.
• Hosts own identity only: their Api (@ai-matrx/api), their Supabase client, the address.
• The address carries everything (locationToParams / locationFromParams): vault, view, search, sort, item, edit/new, the open panel.
• Extension: pass page, fill, capture, fillSetup, newPasswordFields (types in extension/host.ts) and start at view=page.
• Desktop: pass nativeProvider and nativeImport; a host that holds its own lock and clipboard passes lock (locked screen, every port call refused while locked), clipboard (copies go through it; secret: true = the host clears it later) and revealSeconds.
• Styling: Tailwind utilities on the design-system tokens — add @source "…/node_modules/@ai-matrx/vault/dist" to the host stylesheet.
• Workers: the import parsers run in module workers at dist/io/*.worker.js (new Worker(new URL(…, import.meta.url))). A Vite host excludes the package from dependency pre-bundling (optimizeDeps.exclude: ["@ai-matrx/vault"]) so the URLs stay intact.

Local mechanics and rules: FEATURE.md.