@bitwarden/cli 2023.9.0 → 2023.10.0

package/build/bw.js

@@ -20,7 +20,7 @@ module.exports = require("url");
 /***/ 147:
 /***/ ((module) => {
 
-module.exports = JSON.parse('{"name":"@bitwarden/cli","description":"A secure and free password manager for all of your devices.","version":"2023.9.0","keywords":["bitwarden","password","vault","password manager","cli"],"author":"Bitwarden Inc. <hello@bitwarden.com> (https://bitwarden.com)","homepage":"https://bitwarden.com","repository":{"type":"git","url":"https://github.com/bitwarden/clients"},"license":"GPL-3.0-only","scripts":{"clean":"rimraf dist","build":"webpack","build:debug":"npm run build && node --inspect ./build/bw.js","build:watch":"webpack --watch","build:prod":"cross-env NODE_ENV=production webpack","build:prod:watch":"cross-env NODE_ENV=production webpack --watch","package":"npm run package:win && npm run package:mac && npm run package:lin","package:win":"pkg . --targets win-x64 --output ./dist/windows/bw.exe","package:mac":"pkg . --targets macos-x64 --output ./dist/macos/bw","package:lin":"pkg . --targets linux-x64 --output ./dist/linux/bw","debug":"node --inspect ./build/bw.js","dist":"npm run build:prod && npm run clean && npm run package","dist:win":"npm run build:prod && npm run clean && npm run package:win","dist:mac":"npm run build:prod && npm run clean && npm run package:mac","dist:lin":"npm run build:prod && npm run clean && npm run package:lin","publish:npm":"npm run build:prod && npm publish --access public","test":"jest","test:watch":"jest --watch","test:watch:all":"jest --watchAll"},"bin":{"bw":"build/bw.js"},"pkg":{"assets":["./build/**/*","../../node_modules/argon2/**/*"]},"dependencies":{"@koa/multer":"3.0.2","@koa/router":"12.0.0","argon2":"0.31.0","big-integer":"1.6.51","browser-hrtime":"1.1.8","chalk":"4.1.2","commander":"7.2.0","form-data":"4.0.0","https-proxy-agent":"5.0.1","inquirer":"8.2.6","jsdom":"22.1.0","jszip":"3.10.1","koa":"2.14.2","koa-bodyparser":"4.4.1","koa-json":"2.0.2","lowdb":"1.0.0","lunr":"2.3.9","multer":"1.4.5-lts.1","node-fetch":"2.6.12","node-forge":"1.3.1","open":"8.4.2","papaparse":"5.4.1","proper-lockfile":"4.1.2","rxjs":"7.8.1","tldts":"6.0.14","zxcvbn":"4.4.2"}}');
+module.exports = JSON.parse('{"name":"@bitwarden/cli","description":"A secure and free password manager for all of your devices.","version":"2023.10.0","keywords":["bitwarden","password","vault","password manager","cli"],"author":"Bitwarden Inc. <hello@bitwarden.com> (https://bitwarden.com)","homepage":"https://bitwarden.com","repository":{"type":"git","url":"https://github.com/bitwarden/clients"},"license":"GPL-3.0-only","scripts":{"clean":"rimraf dist","build":"webpack","build:debug":"npm run build && node --inspect ./build/bw.js","build:watch":"webpack --watch","build:prod":"cross-env NODE_ENV=production webpack","build:prod:watch":"cross-env NODE_ENV=production webpack --watch","package":"npm run package:win && npm run package:mac && npm run package:lin","package:win":"pkg . --targets win-x64 --output ./dist/windows/bw.exe","package:mac":"pkg . --targets macos-x64 --output ./dist/macos/bw","package:lin":"pkg . --targets linux-x64 --output ./dist/linux/bw","debug":"node --inspect ./build/bw.js","dist":"npm run build:prod && npm run clean && npm run package","dist:win":"npm run build:prod && npm run clean && npm run package:win","dist:mac":"npm run build:prod && npm run clean && npm run package:mac","dist:lin":"npm run build:prod && npm run clean && npm run package:lin","publish:npm":"npm run build:prod && npm publish --access public","test":"jest","test:watch":"jest --watch","test:watch:all":"jest --watchAll"},"bin":{"bw":"build/bw.js"},"pkg":{"assets":["./build/**/*","../../node_modules/argon2/**/*"]},"dependencies":{"@koa/multer":"3.0.2","@koa/router":"12.0.0","argon2":"0.31.0","big-integer":"1.6.51","browser-hrtime":"1.1.8","chalk":"4.1.2","commander":"7.2.0","form-data":"4.0.0","https-proxy-agent":"5.0.1","inquirer":"8.2.6","jsdom":"22.1.0","jszip":"3.10.1","koa":"2.14.2","koa-bodyparser":"4.4.1","koa-json":"2.0.2","lowdb":"1.0.0","lunr":"2.3.9","multer":"1.4.5-lts.1","node-fetch":"2.6.12","node-forge":"1.3.1","open":"8.4.2","papaparse":"5.4.1","proper-lockfile":"4.1.2","rxjs":"7.8.1","tldts":"6.0.14","zxcvbn":"4.4.2"}}');
 
 /***/ })
 
@@ -360,15 +360,6 @@ class PlanResponse extends BaseResponse {
         this.nameLocalizationKey = this.getResponseProperty("NameLocalizationKey");
         this.descriptionLocalizationKey = this.getResponseProperty("DescriptionLocalizationKey");
         this.canBeUsedByBusiness = this.getResponseProperty("CanBeUsedByBusiness");
-        this.baseSeats = this.getResponseProperty("BaseSeats");
-        this.baseStorageGb = this.getResponseProperty("BaseStorageGb");
-        this.maxCollections = this.getResponseProperty("MaxCollections");
-        this.maxUsers = this.getResponseProperty("MaxUsers");
-        this.hasAdditionalSeatsOption = this.getResponseProperty("HasAdditionalSeatsOption");
-        this.maxAdditionalSeats = this.getResponseProperty("MaxAdditionalSeats");
-        this.hasAdditionalStorageOption = this.getResponseProperty("HasAdditionalStorageOption");
-        this.maxAdditionalStorage = this.getResponseProperty("MaxAdditionalStorage");
-        this.hasPremiumAccessOption = this.getResponseProperty("HasPremiumAccessOption");
         this.trialPeriodDays = this.getResponseProperty("TrialPeriodDays");
         this.hasSelfHost = this.getResponseProperty("HasSelfHost");
         this.hasPolicies = this.getResponseProperty("HasPolicies");
@@ -385,22 +376,53 @@ class PlanResponse extends BaseResponse {
         this.displaySortOrder = this.getResponseProperty("SortOrder");
         this.legacyYear = this.getResponseProperty("LegacyYear");
         this.disabled = this.getResponseProperty("Disabled");
-        this.stripePlanId = this.getResponseProperty("StripePlanId");
+        const passwordManager = this.getResponseProperty("PasswordManager");
+        const secretsManager = this.getResponseProperty("SecretsManager");
+        this.PasswordManager =
+            passwordManager == null ? null : new PasswordManagerPlanFeaturesResponse(passwordManager);
+        this.SecretsManager =
+            secretsManager == null ? null : new SecretsManagerPlanFeaturesResponse(secretsManager);
+    }
+}
+class SecretsManagerPlanFeaturesResponse extends BaseResponse {
+    constructor(response) {
+        super(response);
         this.stripeSeatPlanId = this.getResponseProperty("StripeSeatPlanId");
-        this.stripeStoragePlanId = this.getResponseProperty("StripeStoragePlanId");
-        this.stripePremiumAccessPlanId = this.getResponseProperty("StripePremiumAccessPlanId");
+        this.baseSeats = this.getResponseProperty("BaseSeats");
         this.basePrice = this.getResponseProperty("BasePrice");
         this.seatPrice = this.getResponseProperty("SeatPrice");
-        this.additionalStoragePricePerGb = this.getResponseProperty("AdditionalStoragePricePerGb");
-        this.premiumAccessOptionPrice = this.getResponseProperty("PremiumAccessOptionPrice");
-        this.bitwardenProduct = this.getResponseProperty("BitwardenProduct");
+        this.hasAdditionalSeatsOption = this.getResponseProperty("HasAdditionalSeatsOption");
+        this.maxAdditionalSeats = this.getResponseProperty("MaxAdditionalSeats");
+        this.maxSeats = this.getResponseProperty("MaxSeats");
+        this.stripeServiceAccountPlanId = this.getResponseProperty("StripeServiceAccountPlanId");
         this.additionalPricePerServiceAccount = this.getResponseProperty("AdditionalPricePerServiceAccount");
         this.baseServiceAccount = this.getResponseProperty("BaseServiceAccount");
         this.maxServiceAccount = this.getResponseProperty("MaxServiceAccount");
         this.hasAdditionalServiceAccountOption = this.getResponseProperty("HasAdditionalServiceAccountOption");
-        this.maxProjects = this.getResponseProperty("MaxProjects");
         this.maxAdditionalServiceAccounts = this.getResponseProperty("MaxAdditionalServiceAccounts");
-        this.stripeServiceAccountPlanId = this.getResponseProperty("StripeServiceAccountPlanId");
+        this.maxProjects = this.getResponseProperty("MaxProjects");
+    }
+}
+class PasswordManagerPlanFeaturesResponse extends BaseResponse {
+    constructor(response) {
+        super(response);
+        this.stripePlanId = this.getResponseProperty("StripePlanId");
+        this.stripeSeatPlanId = this.getResponseProperty("StripeSeatPlanId");
+        this.stripeStoragePlanId = this.getResponseProperty("StripeStoragePlanId");
+        this.stripePremiumAccessPlanId = this.getResponseProperty("StripePremiumAccessPlanId");
+        this.basePrice = this.getResponseProperty("BasePrice");
+        this.seatPrice = this.getResponseProperty("SeatPrice");
+        this.baseSeats = this.getResponseProperty("BaseSeats");
+        this.maxAdditionalSeats = this.getResponseProperty("MaxAdditionalSeats");
+        this.premiumAccessOptionPrice = this.getResponseProperty("PremiumAccessOptionPrice");
+        this.maxSeats = this.getResponseProperty("MaxSeats");
+        this.additionalStoragePricePerGb = this.getResponseProperty("AdditionalStoragePricePerGb");
+        this.hasAdditionalSeatsOption = this.getResponseProperty("HasAdditionalSeatsOption");
+        this.baseStorageGb = this.getResponseProperty("BaseStorageGb");
+        this.maxCollections = this.getResponseProperty("MaxCollections");
+        this.hasAdditionalStorageOption = this.getResponseProperty("HasAdditionalStorageOption");
+        this.maxAdditionalStorage = this.getResponseProperty("MaxAdditionalStorage");
+        this.hasPremiumAccessOption = this.getResponseProperty("HasPremiumAccessOption");
     }
 }
 
@@ -421,9 +443,6 @@ class OrganizationResponse extends BaseResponse {
         this.billingEmail = this.getResponseProperty("BillingEmail");
         const plan = this.getResponseProperty("Plan");
         this.plan = plan == null ? null : new PlanResponse(plan);
-        const secretsManagerPlan = this.getResponseProperty("SecretsManagerPlan");
-        this.secretsManagerPlan =
-            secretsManagerPlan == null ? null : new PlanResponse(secretsManagerPlan);
         this.planType = this.getResponseProperty("PlanType");
         this.seats = this.getResponseProperty("Seats");
         this.maxAutoscaleSeats = this.getResponseProperty("MaxAutoscaleSeats");
@@ -459,11 +478,13 @@ class SubscriptionResponse extends BaseResponse {
         this.usingInAppPurchase = this.getResponseProperty("UsingInAppPurchase");
         const subscription = this.getResponseProperty("Subscription");
         const upcomingInvoice = this.getResponseProperty("UpcomingInvoice");
+        const discount = this.getResponseProperty("Discount");
         this.subscription = subscription == null ? null : new BillingSubscriptionResponse(subscription);
         this.upcomingInvoice =
             upcomingInvoice == null
                 ? null
                 : new BillingSubscriptionUpcomingInvoiceResponse(upcomingInvoice);
+        this.discount = discount == null ? null : new BillingCustomerDiscount(discount);
     }
 }
 class BillingSubscriptionResponse extends BaseResponse {
@@ -493,7 +514,6 @@ class BillingSubscriptionItemResponse extends BaseResponse {
         this.interval = this.getResponseProperty("Interval");
         this.sponsoredSubscriptionItem = this.getResponseProperty("SponsoredSubscriptionItem");
         this.addonSubscriptionItem = this.getResponseProperty("AddonSubscriptionItem");
-        this.bitwardenProduct = this.getResponseProperty("BitwardenProduct");
     }
 }
 class BillingSubscriptionUpcomingInvoiceResponse extends BaseResponse {
@@ -503,6 +523,13 @@ class BillingSubscriptionUpcomingInvoiceResponse extends BaseResponse {
         this.amount = this.getResponseProperty("Amount");
     }
 }
+class BillingCustomerDiscount extends BaseResponse {
+    constructor(response) {
+        super(response);
+        this.id = this.getResponseProperty("Id");
+        this.active = this.getResponseProperty("Active");
+    }
+}
 
 ;// CONCATENATED MODULE: ../../libs/common/src/billing/models/response/organization-subscription.response.ts
 
@@ -519,6 +546,8 @@ class OrganizationSubscriptionResponse extends OrganizationResponse {
             upcomingInvoice == null
                 ? null
                 : new BillingSubscriptionUpcomingInvoiceResponse(upcomingInvoice);
+        const discount = this.getResponseProperty("Discount");
+        this.discount = discount == null ? null : new BillingCustomerDiscount(discount);
         this.expiration = this.getResponseProperty("Expiration");
         this.expirationWithoutGracePeriod = this.getResponseProperty("ExpirationWithoutGracePeriod");
         this.secretsManagerBeta = this.getResponseProperty("SecretsManagerBeta");
@@ -1530,9 +1559,9 @@ var ClientType;
     ClientType["Web"] = "web";
     ClientType["Browser"] = "browser";
     ClientType["Desktop"] = "desktop";
-    ClientType["Mobile"] = "mobile";
+    // Mobile = "mobile",
     ClientType["Cli"] = "cli";
-    ClientType["DirectoryConnector"] = "connector";
+    // DirectoryConnector = "connector",
 })(ClientType || (ClientType = {}));
 
 ;// CONCATENATED MODULE: ../../libs/common/src/enums/device-type.enum.ts
@@ -3308,6 +3337,96 @@ class ProviderService {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/auth/enums/authentication-status.ts
+var AuthenticationStatus;
+(function (AuthenticationStatus) {
+    AuthenticationStatus[AuthenticationStatus["LoggedOut"] = 0] = "LoggedOut";
+    AuthenticationStatus[AuthenticationStatus["Locked"] = 1] = "Locked";
+    AuthenticationStatus[AuthenticationStatus["Unlocked"] = 2] = "Unlocked";
+})(AuthenticationStatus || (AuthenticationStatus = {}));
+
+;// CONCATENATED MODULE: ../../libs/common/src/auth/services/account.service.ts
+var account_service_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+class AccountServiceImplementation {
+    constructor(messagingService, logService) {
+        this.messagingService = messagingService;
+        this.logService = logService;
+        this.accounts = new external_rxjs_namespaceObject.BehaviorSubject({});
+        this.activeAccountId = new external_rxjs_namespaceObject.BehaviorSubject(undefined);
+        this.lock = new external_rxjs_namespaceObject.Subject();
+        this.logout = new external_rxjs_namespaceObject.Subject();
+        this.accounts$ = this.accounts.asObservable();
+        this.activeAccount$ = this.activeAccountId.pipe((0,external_rxjs_namespaceObject.combineLatestWith)(this.accounts$), (0,external_rxjs_namespaceObject.map)(([id, accounts]) => (id ? Object.assign({ id }, accounts[id]) : undefined)), (0,external_rxjs_namespaceObject.distinctUntilChanged)(), (0,external_rxjs_namespaceObject.shareReplay)({ bufferSize: 1, refCount: false }));
+        this.accountLock$ = this.lock.asObservable();
+        this.accountLogout$ = this.logout.asObservable();
+    }
+    addAccount(userId, accountData) {
+        this.accounts.value[userId] = accountData;
+        this.accounts.next(this.accounts.value);
+    }
+    setAccountName(userId, name) {
+        this.setAccountInfo(userId, Object.assign(Object.assign({}, this.accounts.value[userId]), { name }));
+    }
+    setAccountEmail(userId, email) {
+        this.setAccountInfo(userId, Object.assign(Object.assign({}, this.accounts.value[userId]), { email }));
+    }
+    setAccountStatus(userId, status) {
+        this.setAccountInfo(userId, Object.assign(Object.assign({}, this.accounts.value[userId]), { status }));
+        if (status === AuthenticationStatus.LoggedOut) {
+            this.logout.next(userId);
+        }
+        else if (status === AuthenticationStatus.Locked) {
+            this.lock.next(userId);
+        }
+    }
+    switchAccount(userId) {
+        if (userId == null) {
+            // indicates no account is active
+            this.activeAccountId.next(undefined);
+            return;
+        }
+        if (this.accounts.value[userId] == null) {
+            throw new Error("Account does not exist");
+        }
+        this.activeAccountId.next(userId);
+    }
+    // TODO: update to use our own account status settings. Requires inverting direction of state service accounts flow
+    delete() {
+        var _a;
+        return account_service_awaiter(this, void 0, void 0, function* () {
+            try {
+                (_a = this.messagingService) === null || _a === void 0 ? void 0 : _a.send("logout");
+            }
+            catch (e) {
+                this.logService.error(e);
+                throw e;
+            }
+        });
+    }
+    setAccountInfo(userId, accountInfo) {
+        if (this.accounts.value[userId] == null) {
+            throw new Error("Account does not exist");
+        }
+        // Avoid unnecessary updates
+        // TODO: Faster comparison, maybe include a hash on the objects?
+        if (JSON.stringify(this.accounts.value[userId]) === JSON.stringify(accountInfo)) {
+            return;
+        }
+        this.accounts.value[userId] = accountInfo;
+        this.accounts.next(this.accounts.value);
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/platform/models/domain/symmetric-crypto-key.ts
 
 
@@ -3497,14 +3616,6 @@ class ErrorResponse extends BaseResponse {
     }
 }
 
-;// CONCATENATED MODULE: ../../libs/common/src/auth/enums/authentication-status.ts
-var AuthenticationStatus;
-(function (AuthenticationStatus) {
-    AuthenticationStatus[AuthenticationStatus["LoggedOut"] = 0] = "LoggedOut";
-    AuthenticationStatus[AuthenticationStatus["Locked"] = 1] = "Locked";
-    AuthenticationStatus[AuthenticationStatus["Unlocked"] = 2] = "Unlocked";
-})(AuthenticationStatus || (AuthenticationStatus = {}));
-
 ;// CONCATENATED MODULE: ../../libs/common/src/auth/enums/authentication-type.ts
 var authentication_type_AuthenticationType;
 (function (AuthenticationType) {
@@ -3515,6 +3626,10 @@ var authentication_type_AuthenticationType;
 })(authentication_type_AuthenticationType || (authentication_type_AuthenticationType = {}));
 
 ;// CONCATENATED MODULE: ../../libs/common/src/auth/models/domain/force-reset-password-reason.ts
+/*
+ * This enum is used to determine if a user should be forced to reset their password
+ * on login (server flag) or unlock via MP (client evaluation).
+ */
 var ForceResetPasswordReason;
 (function (ForceResetPasswordReason) {
     /**
@@ -3523,11 +3638,13 @@ var ForceResetPasswordReason;
     ForceResetPasswordReason[ForceResetPasswordReason["None"] = 0] = "None";
     /**
      * Occurs when an organization admin forces a user to reset their password.
+     * Communicated via server flag.
      */
     ForceResetPasswordReason[ForceResetPasswordReason["AdminForcePasswordReset"] = 1] = "AdminForcePasswordReset";
     /**
      * Occurs when a user logs in / unlocks their vault with a master password that does not meet an organization's
      * master password policy that is enforced on login/unlock.
+     * Only set client side b/c server can't evaluate MP.
      */
     ForceResetPasswordReason[ForceResetPasswordReason["WeakMasterPassword"] = 2] = "WeakMasterPassword";
 })(ForceResetPasswordReason || (ForceResetPasswordReason = {}));
@@ -4159,6 +4276,7 @@ var login_strategy_awaiter = (undefined && undefined.__awaiter) || function (thi
 
 
 
+
 class LogInStrategy {
     constructor(cryptoService, apiService, tokenService, appIdService, platformUtilsService, messagingService, logService, stateService, twoFactorService) {
         this.cryptoService = cryptoService;
@@ -4252,7 +4370,16 @@ class LogInStrategy {
     processTokenResponse(response) {
         return login_strategy_awaiter(this, void 0, void 0, function* () {
             const result = new AuthResult();
+            // Old encryption keys must be migrated, but is currently only available on web.
+            // Other clients shouldn't continue the login process.
+            if (this.encryptionKeyMigrationRequired(response)) {
+                result.requiresEncryptionKeyMigration = true;
+                if (this.platformUtilsService.getClientType() !== ClientType.Web) {
+                    return result;
+                }
+            }
             result.resetMasterPassword = response.resetMasterPassword;
+            // Convert boolean to enum
             if (response.forcePasswordReset) {
                 result.forcePasswordReset = ForceResetPasswordReason.AdminForcePasswordReset;
             }
@@ -4268,6 +4395,11 @@ class LogInStrategy {
             return result;
         });
     }
+    // Old accounts used master key for encryption. We are forcing migrations but only need to
+    // check on password logins
+    encryptionKeyMigrationRequired(response) {
+        return false;
+    }
     createKeyPairForOldAccount() {
         return login_strategy_awaiter(this, void 0, void 0, function* () {
             try {
@@ -4390,6 +4522,10 @@ class PasswordLogInStrategy extends LogInStrategy {
     }
     setUserKey(response) {
         return password_login_strategy_awaiter(this, void 0, void 0, function* () {
+            // If migration is required, we won't have a user key to set yet.
+            if (this.encryptionKeyMigrationRequired(response)) {
+                return;
+            }
             yield this.cryptoService.setMasterKeyEncryptedUserKey(response.key);
             const masterKey = yield this.cryptoService.getMasterKey();
             if (masterKey) {
@@ -4404,6 +4540,9 @@ class PasswordLogInStrategy extends LogInStrategy {
             yield this.cryptoService.setPrivateKey((_a = response.privateKey) !== null && _a !== void 0 ? _a : (yield this.createKeyPairForOldAccount()));
         });
     }
+    encryptionKeyMigrationRequired(response) {
+        return !response.key;
+    }
     getMasterPasswordPolicyOptionsFromResponse(response) {
         if (response == null || response instanceof IdentityCaptchaResponse) {
             return null;
@@ -4536,6 +4675,7 @@ var sso_login_strategy_awaiter = (undefined && undefined.__awaiter) || function
 
 
 
+
 class SsoLogInStrategy extends LogInStrategy {
     constructor(cryptoService, apiService, tokenService, appIdService, platformUtilsService, messagingService, logService, stateService, twoFactorService, keyConnectorService, deviceTrustCryptoService, authReqCryptoService, i18nService) {
         super(cryptoService, apiService, tokenService, appIdService, platformUtilsService, messagingService, logService, stateService, twoFactorService);
@@ -4551,6 +4691,10 @@ class SsoLogInStrategy extends LogInStrategy {
             const [ssoAuthResult] = yield this.startLogIn();
             this.email = ssoAuthResult.email;
             this.ssoEmail2FaSessionToken = ssoAuthResult.ssoEmail2FaSessionToken;
+            // Auth guard currently handles redirects for this.
+            if (ssoAuthResult.forcePasswordReset == ForceResetPasswordReason.AdminForcePasswordReset) {
+                yield this.stateService.setForcePasswordResetReason(ssoAuthResult.forcePasswordReset);
+            }
             return ssoAuthResult;
         });
     }
@@ -5214,7 +5358,7 @@ class DeviceTrustCryptoService {
     }
 }
 
-;// CONCATENATED MODULE: ../../libs/common/src/abstractions/devices/responses/device.response.ts
+;// CONCATENATED MODULE: ../../libs/common/src/auth/abstractions/devices/responses/device.response.ts
 
 class DeviceResponse extends BaseResponse {
     constructor(response) {
@@ -5229,15 +5373,6 @@ class DeviceResponse extends BaseResponse {
     }
 }
 
-;// CONCATENATED MODULE: ../../libs/common/src/services/devices/requests/trusted-device-keys.request.ts
-class TrustedDeviceKeysRequest {
-    constructor(encryptedUserKey, encryptedPublicKey, encryptedPrivateKey) {
-        this.encryptedUserKey = encryptedUserKey;
-        this.encryptedPublicKey = encryptedPublicKey;
-        this.encryptedPrivateKey = encryptedPrivateKey;
-    }
-}
-
 ;// CONCATENATED MODULE: ../../libs/common/src/auth/models/response/protected-device.response.ts
 
 
@@ -5258,6 +5393,15 @@ class ProtectedDeviceResponse extends BaseResponse {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/auth/services/devices/requests/trusted-device-keys.request.ts
+class TrustedDeviceKeysRequest {
+    constructor(encryptedUserKey, encryptedPublicKey, encryptedPrivateKey) {
+        this.encryptedUserKey = encryptedUserKey;
+        this.encryptedPublicKey = encryptedPublicKey;
+        this.encryptedPrivateKey = encryptedPrivateKey;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/auth/services/devices-api.service.implementation.ts
 var devices_api_service_implementation_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -6090,6 +6234,73 @@ class BroadcasterService {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/platform/models/response/server-config.response.ts
+
+class ServerConfigResponse extends BaseResponse {
+    constructor(response) {
+        super(response);
+        this.featureStates = {};
+        if (response == null) {
+            return;
+        }
+        this.version = this.getResponseProperty("Version");
+        this.gitHash = this.getResponseProperty("GitHash");
+        this.server = new ThirdPartyServerConfigResponse(this.getResponseProperty("Server"));
+        this.environment = new EnvironmentServerConfigResponse(this.getResponseProperty("Environment"));
+        this.featureStates = this.getResponseProperty("FeatureStates");
+    }
+}
+class EnvironmentServerConfigResponse extends BaseResponse {
+    constructor(data = null) {
+        super(data);
+        if (data == null) {
+            return;
+        }
+        this.cloudRegion = this.getResponseProperty("CloudRegion");
+        this.vault = this.getResponseProperty("Vault");
+        this.api = this.getResponseProperty("Api");
+        this.identity = this.getResponseProperty("Identity");
+        this.notifications = this.getResponseProperty("Notifications");
+        this.sso = this.getResponseProperty("Sso");
+    }
+}
+class ThirdPartyServerConfigResponse extends BaseResponse {
+    constructor(data = null) {
+        super(data);
+        if (data == null) {
+            return;
+        }
+        this.name = this.getResponseProperty("Name");
+        this.url = this.getResponseProperty("Url");
+    }
+}
+
+;// CONCATENATED MODULE: ../../libs/common/src/platform/services/config/config-api.service.ts
+var config_api_service_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+class ConfigApiService {
+    constructor(apiService, authService) {
+        this.apiService = apiService;
+        this.authService = authService;
+    }
+    get() {
+        return config_api_service_awaiter(this, void 0, void 0, function* () {
+            const authed = (yield this.authService.getAuthStatus()) !== AuthenticationStatus.LoggedOut;
+            const r = yield this.apiService.send("GET", "/config", null, authed, true);
+            return new ServerConfigResponse(r);
+        });
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/platform/services/container.service.ts
 class ContainerService {
     constructor(cryptoService, encryptService) {
@@ -14092,6 +14303,11 @@ class CryptoService {
             }
         });
     }
+    isLegacyUser(masterKey, userId) {
+        return crypto_service_awaiter(this, void 0, void 0, function* () {
+            return yield this.validateUserKey((masterKey !== null && masterKey !== void 0 ? masterKey : (yield this.getMasterKey(userId))));
+        });
+    }
     getUserKeyWithLegacySupport(userId) {
         return crypto_service_awaiter(this, void 0, void 0, function* () {
             const userKey = yield this.getUserKey(userId);
@@ -14479,7 +14695,8 @@ class CryptoService {
     }
     makeKeyPair(key) {
         return crypto_service_awaiter(this, void 0, void 0, function* () {
-            key || (key = yield this.getUserKey());
+            // Default to user key
+            key || (key = yield this.getUserKeyWithLegacySupport());
             const keyPair = yield this.cryptoFunctionService.rsaGenerateKeyPair(2048);
             const publicB64 = utils_Utils.fromBufferToB64(keyPair[0]);
             const privateEnc = yield this.encryptService.encrypt(keyPair[1], key);
@@ -14545,6 +14762,12 @@ class CryptoService {
             return new SymmetricCryptoKey(sendKey);
         });
     }
+    makeCipherKey() {
+        return crypto_service_awaiter(this, void 0, void 0, function* () {
+            const randomBytes = yield this.cryptoFunctionService.aesGenerateKey(512);
+            return new SymmetricCryptoKey(randomBytes);
+        });
+    }
     clearKeys(userId) {
         return crypto_service_awaiter(this, void 0, void 0, function* () {
             yield this.clearUserKey(true, userId);
@@ -14876,19 +15099,26 @@ class CryptoService {
     migrateAutoKeyIfNeeded(userId) {
         return crypto_service_awaiter(this, void 0, void 0, function* () {
             const oldAutoKey = yield this.stateService.getCryptoMasterKeyAuto({ userId: userId });
-            if (oldAutoKey) {
-                // decrypt
-                const masterKey = new SymmetricCryptoKey(utils_Utils.fromB64ToArray(oldAutoKey));
-                const encryptedUserKey = yield this.stateService.getEncryptedCryptoSymmetricKey({
-                    userId: userId,
-                });
-                const userKey = yield this.decryptUserKeyWithMasterKey(masterKey, new EncString(encryptedUserKey), userId);
-                // migrate
-                yield this.stateService.setUserKeyAutoUnlock(userKey.keyB64, { userId: userId });
-                yield this.stateService.setCryptoMasterKeyAuto(null, { userId: userId });
-                // set encrypted user key in case user immediately locks without syncing
-                yield this.setMasterKeyEncryptedUserKey(encryptedUserKey);
+            if (!oldAutoKey) {
+                return;
+            }
+            // Decrypt
+            const masterKey = new SymmetricCryptoKey(utils_Utils.fromB64ToArray(oldAutoKey));
+            if (yield this.isLegacyUser(masterKey, userId)) {
+                // Legacy users don't have a user key, so no need to migrate.
+                // Instead, set the master key for additional isLegacyUser checks that will log the user out.
+                yield this.setMasterKey(masterKey, userId);
+                return;
             }
+            const encryptedUserKey = yield this.stateService.getEncryptedCryptoSymmetricKey({
+                userId: userId,
+            });
+            const userKey = yield this.decryptUserKeyWithMasterKey(masterKey, new EncString(encryptedUserKey), userId);
+            // Migrate
+            yield this.stateService.setUserKeyAutoUnlock(userKey.keyB64, { userId: userId });
+            yield this.stateService.setCryptoMasterKeyAuto(null, { userId: userId });
+            // Set encrypted user key in case user immediately locks without syncing
+            yield this.setMasterKeyEncryptedUserKey(encryptedUserKey);
         });
     }
     decryptAndMigrateOldPinKey(masterPasswordOnRestart, pin, email, kdf, kdfConfig, oldPinKey) {
@@ -15146,7 +15376,7 @@ class EncryptServiceImplementation {
                     return null;
                 }
             }
-            return yield this.cryptoFunctionService.aesDecryptFast(fastParams);
+            return yield this.cryptoFunctionService.aesDecryptFast(fastParams, "cbc");
         });
     }
     decryptToBytes(encThing, key) {
@@ -15178,7 +15408,7 @@ class EncryptServiceImplementation {
                     return null;
                 }
             }
-            const result = yield this.cryptoFunctionService.aesDecrypt(encThing.dataBytes, encThing.ivBytes, key.encKey);
+            const result = yield this.cryptoFunctionService.aesDecrypt(encThing.dataBytes, encThing.ivBytes, key.encKey, "cbc");
             return result !== null && result !== void 0 ? result : null;
         });
     }
@@ -17275,6 +17505,27 @@ class IdentityData {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/vault/models/data/fido2-credential.data.ts
+class Fido2CredentialData {
+    constructor(data) {
+        if (data == null) {
+            return;
+        }
+        this.credentialId = data.credentialId;
+        this.keyType = data.keyType;
+        this.keyAlgorithm = data.keyAlgorithm;
+        this.keyCurve = data.keyCurve;
+        this.keyValue = data.keyValue;
+        this.rpId = data.rpId;
+        this.userHandle = data.userHandle;
+        this.counter = data.counter;
+        this.rpName = data.rpName;
+        this.userDisplayName = data.userDisplayName;
+        this.discoverable = data.discoverable;
+        this.creationDate = data.creationDate;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/data/login-uri.data.ts
 class LoginUriData {
     constructor(data) {
@@ -17289,8 +17540,10 @@ class LoginUriData {
 
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/data/login.data.ts
 
+
 class LoginData {
     constructor(data) {
+        var _a;
         if (data == null) {
             return;
         }
@@ -17302,6 +17555,9 @@ class LoginData {
         if (data.uris) {
             this.uris = data.uris.map((u) => new LoginUriData(u));
         }
+        if (data.fido2Credentials) {
+            this.fido2Credentials = (_a = data.fido2Credentials) === null || _a === void 0 ? void 0 : _a.map((key) => new Fido2CredentialData(key));
+        }
     }
 }
 
@@ -17355,6 +17611,7 @@ class CipherData {
         this.creationDate = response.creationDate;
         this.deletedDate = response.deletedDate;
         this.reprompt = response.reprompt;
+        this.key = response.key;
         switch (this.type) {
             case CipherType.Login:
                 this.login = new LoginData(response.login);
@@ -17391,6 +17648,7 @@ class CollectionData {
         this.name = response.name;
         this.externalId = response.externalId;
         this.readOnly = response.readOnly;
+        this.hidePasswords = response.hidePasswords;
     }
 }
 
@@ -17859,6 +18117,24 @@ identity_view_decorate([
     identity_view_metadata("design:paramtypes", [])
 ], IdentityView.prototype, "fullName", null);
 
+;// CONCATENATED MODULE: ../../libs/common/src/vault/models/view/fido2-credential.view.ts
+
+class Fido2CredentialView extends ItemView {
+    constructor() {
+        super(...arguments);
+        this.creationDate = null;
+    }
+    get subTitle() {
+        return this.userDisplayName;
+    }
+    static fromJSON(obj) {
+        const creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null;
+        return Object.assign(new Fido2CredentialView(), obj, {
+            creationDate,
+        });
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/view/login-uri.view.ts
 
 
@@ -18030,6 +18306,7 @@ var login_view_metadata = (undefined && undefined.__metadata) || function (k, v)
 
 
 
+
 class LoginView extends ItemView {
     constructor(l) {
         super();
@@ -18039,6 +18316,7 @@ class LoginView extends ItemView {
         this.totp = null;
         this.uris = null;
         this.autofillOnPageLoad = null;
+        this.fido2Credentials = null;
         if (!l) {
             return;
         }
@@ -18072,6 +18350,9 @@ class LoginView extends ItemView {
     get hasUris() {
         return this.uris != null && this.uris.length > 0;
     }
+    get hasFido2Credentials() {
+        return this.fido2Credentials != null && this.fido2Credentials.length > 0;
+    }
     matchesUri(targetUri, equivalentDomains, defaultUriMatch = null) {
         if (this.uris == null) {
             return false;
@@ -18079,12 +18360,14 @@ class LoginView extends ItemView {
         return this.uris.some((uri) => uri.matchesUri(targetUri, equivalentDomains, defaultUriMatch));
     }
     static fromJSON(obj) {
-        var _a;
+        var _a, _b;
         const passwordRevisionDate = obj.passwordRevisionDate == null ? null : new Date(obj.passwordRevisionDate);
         const uris = (_a = obj.uris) === null || _a === void 0 ? void 0 : _a.map((uri) => LoginUriView.fromJSON(uri));
+        const fido2Credentials = (_b = obj.fido2Credentials) === null || _b === void 0 ? void 0 : _b.map((key) => Fido2CredentialView.fromJSON(key));
         return Object.assign(new LoginView(), obj, {
-            passwordRevisionDate: passwordRevisionDate,
-            uris: uris,
+            passwordRevisionDate,
+            uris,
+            fido2Credentials,
         });
     }
 }
@@ -18324,6 +18607,7 @@ class CollectionView {
         this.organizationId = null;
         this.name = null;
         this.externalId = null;
+        // readOnly applies to the items within a collection
         this.readOnly = null;
         this.hidePasswords = null;
         if (!c) {
@@ -18337,6 +18621,20 @@ class CollectionView {
             this.hidePasswords = c.hidePasswords;
         }
     }
+    // For editing collection details, not the items within it.
+    canEdit(org) {
+        if (org.id !== this.organizationId) {
+            throw new Error("Id of the organization provided does not match the org id of the collection.");
+        }
+        return (org === null || org === void 0 ? void 0 : org.canEditAnyCollection) || (org === null || org === void 0 ? void 0 : org.canEditAssignedCollections);
+    }
+    // For deleting a collection, not the items within it.
+    canDelete(org) {
+        if (org.id !== this.organizationId) {
+            throw new Error("Id of the organization provided does not match the org id of the collection.");
+        }
+        return (org === null || org === void 0 ? void 0 : org.canDeleteAnyCollection) || (org === null || org === void 0 ? void 0 : org.canDeleteAssignedCollections);
+    }
 }
 
 ;// CONCATENATED MODULE: ../../libs/common/src/platform/models/domain/state.ts
@@ -18411,6 +18709,7 @@ var state_service_awaiter = (undefined && undefined.__awaiter) || function (this
 
 
 
+
 
 
 const keys = {
@@ -18431,12 +18730,13 @@ const partialKeys = {
 };
 const DDG_SHARED_KEY = "DuckDuckGoSharedKey";
 class StateService {
-    constructor(storageService, secureStorageService, memoryStorageService, logService, stateFactory, useAccountCache = true) {
+    constructor(storageService, secureStorageService, memoryStorageService, logService, stateFactory, accountService, useAccountCache = true) {
         this.storageService = storageService;
         this.secureStorageService = secureStorageService;
         this.memoryStorageService = memoryStorageService;
         this.logService = logService;
         this.stateFactory = stateFactory;
+        this.accountService = accountService;
         this.useAccountCache = useAccountCache;
         this.accountsSubject = new external_rxjs_namespaceObject.BehaviorSubject({});
         this.accounts$ = this.accountsSubject.asObservable();
@@ -18503,6 +18803,19 @@ class StateService {
                 }
                 yield this.pushAccounts();
                 this.activeAccountSubject.next(state.activeUserId);
+                // TODO: Temporary update to avoid routing all account status changes through account service for now.
+                // account service tracks logged out accounts, but State service does not, so we need to add the active account
+                // if it's not in the accounts list.
+                if (state.activeUserId != null && this.accountsSubject.value[state.activeUserId] == null) {
+                    const activeDiskAccount = yield this.getAccountFromDisk({ userId: state.activeUserId });
+                    this.accountService.addAccount(state.activeUserId, {
+                        name: activeDiskAccount.profile.name,
+                        email: activeDiskAccount.profile.email,
+                        status: AuthenticationStatus.LoggedOut,
+                    });
+                }
+                this.accountService.switchAccount(state.activeUserId);
+                // End TODO
                 return state;
             }));
         });
@@ -18519,6 +18832,12 @@ class StateService {
                 state.accounts[userId] = this.createAccount();
                 const diskAccount = yield this.getAccountFromDisk({ userId: userId });
                 state.accounts[userId].profile = diskAccount.profile;
+                // TODO: Temporary update to avoid routing all account status changes through account service for now.
+                this.accountService.addAccount(userId, {
+                    status: AuthenticationStatus.Locked,
+                    name: diskAccount.profile.name,
+                    email: diskAccount.profile.email,
+                });
                 return state;
             }));
         });
@@ -18534,6 +18853,12 @@ class StateService {
             }));
             yield this.scaffoldNewAccountStorage(account);
             yield this.setLastActive(new Date().getTime(), { userId: account.profile.userId });
+            // TODO: Temporary update to avoid routing all account status changes through account service for now.
+            this.accountService.addAccount(account.profile.userId, {
+                status: AuthenticationStatus.Locked,
+                name: account.profile.name,
+                email: account.profile.email,
+            });
             yield this.setActiveUser(account.profile.userId);
             this.activeAccountSubject.next(account.profile.userId);
         });
@@ -18545,6 +18870,8 @@ class StateService {
                 state.activeUserId = userId;
                 yield this.storageService.save(keys.activeUserId, userId);
                 this.activeAccountSubject.next(state.activeUserId);
+                // TODO: temporary update to avoid routing all account status changes through account service for now.
+                this.accountService.switchAccount(userId);
                 return state;
             }));
             yield this.pushAccounts();
@@ -18821,6 +19148,8 @@ class StateService {
             const account = yield this.getAccount(this.reconcileOptions(options, yield this.defaultInMemoryOptions()));
             account.keys.cryptoMasterKey = value;
             yield this.saveAccount(account, this.reconcileOptions(options, yield this.defaultInMemoryOptions()));
+            const nextStatus = value != null ? AuthenticationStatus.Unlocked : AuthenticationStatus.Locked;
+            this.accountService.setAccountStatus(options.userId, nextStatus);
             if (options.userId == this.activeAccountSubject.getValue()) {
                 const nextValue = value != null;
                 // Avoid emitting if we are already unlocked
@@ -18848,6 +19177,8 @@ class StateService {
             const account = yield this.getAccount(this.reconcileOptions(options, yield this.defaultInMemoryOptions()));
             account.keys.userKey = value;
             yield this.saveAccount(account, this.reconcileOptions(options, yield this.defaultInMemoryOptions()));
+            const nextStatus = value != null ? AuthenticationStatus.Unlocked : AuthenticationStatus.Locked;
+            this.accountService.setAccountStatus(options.userId, nextStatus);
             if ((options === null || options === void 0 ? void 0 : options.userId) == this.activeAccountSubject.getValue()) {
                 const nextValue = value != null;
                 // Avoid emitting if we are already unlocked
@@ -20697,7 +21028,6 @@ class StateService {
             yield this.saveAccount(account, this.reconcileOptions({ userId: account.profile.userId }, yield this.defaultOnDiskOptions()));
         });
     }
-    //
     pushAccounts() {
         return state_service_awaiter(this, void 0, void 0, function* () {
             yield this.pruneInMemoryAccounts();
@@ -20816,6 +21146,8 @@ class StateService {
                 this.deleteDiskCache(userId);
                 return state;
             }));
+            // TODO: Invert this logic, we should remove accounts based on logged out emit
+            this.accountService.setAccountStatus(userId, AuthenticationStatus.LoggedOut);
         });
     }
     pruneInMemoryAccounts() {
@@ -22162,6 +22494,7 @@ var vault_timeout_service_awaiter = (undefined && undefined.__awaiter) || functi
 
 
 
+
 class VaultTimeoutService {
     constructor(cipherService, folderService, collectionService, cryptoService, platformUtilsService, messagingService, searchService, stateService, authService, vaultTimeoutSettingsService, lockedCallback = null, loggedOutCallback = null) {
         this.cipherService = cipherService;
@@ -22275,10 +22608,18 @@ class VaultTimeoutService {
     }
     migrateKeyForNeverLockIfNeeded() {
         return vault_timeout_service_awaiter(this, void 0, void 0, function* () {
+            // Web can't set vault timeout to never
+            if (this.platformUtilsService.getClientType() == ClientType.Web) {
+                return;
+            }
             const accounts = yield (0,external_rxjs_namespaceObject.firstValueFrom)(this.stateService.accounts$);
             for (const userId in accounts) {
                 if (userId != null) {
                     yield this.cryptoService.migrateAutoKeyIfNeeded(userId);
+                    // Legacy users should be logged out since we're not on the web vault and can't migrate.
+                    if (yield this.cryptoService.isLegacyUser(null, userId)) {
+                        yield this.logOut(userId);
+                    }
                 }
             }
         });
@@ -23100,6 +23441,57 @@ class SendService {
     }
 }
 
+;// CONCATENATED MODULE: external "semver"
+const external_semver_namespaceObject = require("semver");
+;// CONCATENATED MODULE: ../../libs/common/src/platform/misc/flags.ts
+function getFlags(envFlags) {
+    if (typeof envFlags === "string") {
+        return JSON.parse(envFlags);
+    }
+    else {
+        return envFlags;
+    }
+}
+/**
+ * Gets the value of a feature flag from environment.
+ * All flags default to "on" (true).
+ * Only use for shared code in `libs`, otherwise use the client-specific function.
+ * @param flag The name of the feature flag to check
+ * @returns The value of the flag
+ */
+function flagEnabled(flag) {
+    const flags = getFlags({"enableCipherKeyEncryption":false});
+    return flags[flag] == null || !!flags[flag];
+}
+/**
+ * Gets the value of a dev flag from environment.
+ * Will always return false unless in development.
+ * Only use for shared code in `libs`, otherwise use the client-specific function.
+ * @param flag The name of the dev flag to check
+ * @returns The value of the flag
+ */
+function devFlagEnabled(flag) {
+    if (process.env.ENV !== "development") {
+        return false;
+    }
+    const devFlags = getFlags(process.env.DEV_FLAGS);
+    return devFlags[flag] == null || !!devFlags[flag];
+}
+/**
+ * Gets the value of a dev flag from environment.
+ * Will always return false unless in development.
+ * @param flag The name of the dev flag to check
+ * @returns The value of the flag
+ * @throws Error if the flag is not enabled
+ */
+function devFlagValue(flag) {
+    if (!devFlagEnabled(flag)) {
+        throw new Error(`This method should not be called, it is protected by a disabled dev flag.`);
+    }
+    const devFlags = getFlags(process.env.DEV_FLAGS);
+    return devFlags[flag];
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/domain/attachment.ts
 var attachment_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -23423,6 +23815,120 @@ class Identity extends Domain {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/vault/models/domain/fido2-credential.ts
+var fido2_credential_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+
+
+class Fido2Credential extends Domain {
+    constructor(obj) {
+        super();
+        this.credentialId = null;
+        if (obj == null) {
+            return;
+        }
+        this.buildDomainModel(this, obj, {
+            credentialId: null,
+            keyType: null,
+            keyAlgorithm: null,
+            keyCurve: null,
+            keyValue: null,
+            rpId: null,
+            userHandle: null,
+            counter: null,
+            rpName: null,
+            userDisplayName: null,
+            discoverable: null,
+        }, []);
+        this.creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null;
+    }
+    decrypt(orgId, encKey) {
+        return fido2_credential_awaiter(this, void 0, void 0, function* () {
+            const view = yield this.decryptObj(new Fido2CredentialView(), {
+                credentialId: null,
+                keyType: null,
+                keyAlgorithm: null,
+                keyCurve: null,
+                keyValue: null,
+                rpId: null,
+                userHandle: null,
+                rpName: null,
+                userDisplayName: null,
+                discoverable: null,
+            }, orgId, encKey);
+            const { counter } = yield this.decryptObj({ counter: "" }, {
+                counter: null,
+            }, orgId, encKey);
+            // Counter will end up as NaN if this fails
+            view.counter = parseInt(counter);
+            const { discoverable } = yield this.decryptObj({ discoverable: "" }, {
+                discoverable: null,
+            }, orgId, encKey);
+            view.discoverable = discoverable === "true";
+            view.creationDate = this.creationDate;
+            return view;
+        });
+    }
+    toFido2CredentialData() {
+        const i = new Fido2CredentialData();
+        i.creationDate = this.creationDate.toISOString();
+        this.buildDataModel(this, i, {
+            credentialId: null,
+            keyType: null,
+            keyAlgorithm: null,
+            keyCurve: null,
+            keyValue: null,
+            rpId: null,
+            userHandle: null,
+            counter: null,
+            rpName: null,
+            userDisplayName: null,
+            discoverable: null,
+        });
+        return i;
+    }
+    static fromJSON(obj) {
+        if (obj == null) {
+            return null;
+        }
+        const credentialId = EncString.fromJSON(obj.credentialId);
+        const keyType = EncString.fromJSON(obj.keyType);
+        const keyAlgorithm = EncString.fromJSON(obj.keyAlgorithm);
+        const keyCurve = EncString.fromJSON(obj.keyCurve);
+        const keyValue = EncString.fromJSON(obj.keyValue);
+        const rpId = EncString.fromJSON(obj.rpId);
+        const userHandle = EncString.fromJSON(obj.userHandle);
+        const counter = EncString.fromJSON(obj.counter);
+        const rpName = EncString.fromJSON(obj.rpName);
+        const userDisplayName = EncString.fromJSON(obj.userDisplayName);
+        const discoverable = EncString.fromJSON(obj.discoverable);
+        const creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null;
+        return Object.assign(new Fido2Credential(), obj, {
+            credentialId,
+            keyType,
+            keyAlgorithm,
+            keyCurve,
+            keyValue,
+            rpId,
+            userHandle,
+            counter,
+            rpName,
+            userDisplayName,
+            discoverable,
+            creationDate,
+        });
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/domain/login-uri.ts
 
 
@@ -23478,6 +23984,7 @@ var login_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
 
 
 
+
 class Login extends Domain {
     constructor(obj) {
         super();
@@ -23498,6 +24005,9 @@ class Login extends Domain {
                 this.uris.push(new LoginUri(u));
             });
         }
+        if (obj.fido2Credentials) {
+            this.fido2Credentials = obj.fido2Credentials.map((key) => new Fido2Credential(key));
+        }
     }
     decrypt(orgId, encKey) {
         return login_awaiter(this, void 0, void 0, function* () {
@@ -23513,6 +24023,9 @@ class Login extends Domain {
                     view.uris.push(uri);
                 }
             }
+            if (this.fido2Credentials != null) {
+                view.fido2Credentials = yield Promise.all(this.fido2Credentials.map((key) => key.decrypt(orgId, encKey)));
+            }
             return view;
         });
     }
@@ -23532,10 +24045,13 @@ class Login extends Domain {
                 l.uris.push(u.toLoginUriData());
             });
         }
+        if (this.fido2Credentials != null && this.fido2Credentials.length > 0) {
+            l.fido2Credentials = this.fido2Credentials.map((key) => key.toFido2CredentialData());
+        }
         return l;
     }
     static fromJSON(obj) {
-        var _a;
+        var _a, _b, _c;
         if (obj == null) {
             return null;
         }
@@ -23544,12 +24060,14 @@ class Login extends Domain {
         const totp = EncString.fromJSON(obj.totp);
         const passwordRevisionDate = obj.passwordRevisionDate == null ? null : new Date(obj.passwordRevisionDate);
         const uris = (_a = obj.uris) === null || _a === void 0 ? void 0 : _a.map((uri) => LoginUri.fromJSON(uri));
+        const fido2Credentials = (_c = (_b = obj.fido2Credentials) === null || _b === void 0 ? void 0 : _b.map((key) => Fido2Credential.fromJSON(key))) !== null && _c !== void 0 ? _c : [];
         return Object.assign(new Login(), obj, {
             username,
             password,
             totp,
-            passwordRevisionDate: passwordRevisionDate,
-            uris: uris,
+            passwordRevisionDate,
+            uris,
+            fido2Credentials,
         });
     }
 }
@@ -23647,6 +24165,8 @@ var cipher_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _a
 
 
 
+
+
 class Cipher extends Domain {
     constructor(obj, localData = null) {
         super();
@@ -23660,6 +24180,7 @@ class Cipher extends Domain {
             folderId: null,
             name: null,
             notes: null,
+            key: null,
         }, ["id", "organizationId", "folderId"]);
         this.type = obj.type;
         this.favorite = obj.favorite;
@@ -23712,9 +24233,16 @@ class Cipher extends Domain {
             this.passwordHistory = null;
         }
     }
+    // We are passing the organizationId into the EncString.decrypt() method here, but because the encKey will always be
+    // present and so the organizationId will not be used.
+    // We will refactor the EncString.decrypt() in https://bitwarden.atlassian.net/browse/PM-3762 to remove the dependency on the organizationId.
     decrypt(encKey) {
         return cipher_awaiter(this, void 0, void 0, function* () {
             const model = new CipherView(this);
+            if (this.key != null) {
+                const encryptService = utils_Utils.getContainerService().getEncryptService();
+                encKey = new SymmetricCryptoKey(yield encryptService.decryptToBytes(this.key, encKey));
+            }
             yield this.decryptObj(model, {
                 name: null,
                 notes: null,
@@ -23735,13 +24263,12 @@ class Cipher extends Domain {
                 default:
                     break;
             }
-            const orgId = this.organizationId;
             if (this.attachments != null && this.attachments.length > 0) {
                 const attachments = [];
                 yield this.attachments.reduce((promise, attachment) => {
                     return promise
                         .then(() => {
-                        return attachment.decrypt(orgId, encKey);
+                        return attachment.decrypt(this.organizationId, encKey);
                     })
                         .then((decAttachment) => {
                         attachments.push(decAttachment);
@@ -23754,7 +24281,7 @@ class Cipher extends Domain {
                 yield this.fields.reduce((promise, field) => {
                     return promise
                         .then(() => {
-                        return field.decrypt(orgId, encKey);
+                        return field.decrypt(this.organizationId, encKey);
                     })
                         .then((decField) => {
                         fields.push(decField);
@@ -23767,7 +24294,7 @@ class Cipher extends Domain {
                 yield this.passwordHistory.reduce((promise, ph) => {
                     return promise
                         .then(() => {
-                        return ph.decrypt(orgId, encKey);
+                        return ph.decrypt(this.organizationId, encKey);
                     })
                         .then((decPh) => {
                         passwordHistory.push(decPh);
@@ -23779,6 +24306,7 @@ class Cipher extends Domain {
         });
     }
     toCipherData() {
+        var _a;
         const c = new CipherData();
         c.id = this.id;
         c.organizationId = this.organizationId;
@@ -23793,6 +24321,7 @@ class Cipher extends Domain {
         c.creationDate = this.creationDate != null ? this.creationDate.toISOString() : null;
         c.deletedDate = this.deletedDate != null ? this.deletedDate.toISOString() : null;
         c.reprompt = this.reprompt;
+        c.key = (_a = this.key) === null || _a === void 0 ? void 0 : _a.encryptedString;
         this.buildDataModel(this, c, {
             name: null,
             notes: null,
@@ -23837,6 +24366,7 @@ class Cipher extends Domain {
         const attachments = (_a = obj.attachments) === null || _a === void 0 ? void 0 : _a.map((a) => Attachment.fromJSON(a));
         const fields = (_b = obj.fields) === null || _b === void 0 ? void 0 : _b.map((f) => Field.fromJSON(f));
         const passwordHistory = (_c = obj.passwordHistory) === null || _c === void 0 ? void 0 : _c.map((ph) => Password.fromJSON(ph));
+        const key = EncString.fromJSON(obj.key);
         Object.assign(domain, obj, {
             name,
             notes,
@@ -23845,6 +24375,7 @@ class Cipher extends Domain {
             attachments,
             fields,
             passwordHistory,
+            key,
         });
         switch (obj.type) {
             case CipherType.Card:
@@ -24035,9 +24566,33 @@ class LoginUriApi extends BaseResponse {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/vault/api/fido2-credential.api.ts
+
+class Fido2CredentialApi extends BaseResponse {
+    constructor(data = null) {
+        super(data);
+        if (data == null) {
+            return;
+        }
+        this.credentialId = this.getResponseProperty("CredentialId");
+        this.keyType = this.getResponseProperty("KeyType");
+        this.keyAlgorithm = this.getResponseProperty("KeyAlgorithm");
+        this.keyCurve = this.getResponseProperty("KeyCurve");
+        this.keyValue = this.getResponseProperty("keyValue");
+        this.rpId = this.getResponseProperty("RpId");
+        this.userHandle = this.getResponseProperty("UserHandle");
+        this.counter = this.getResponseProperty("Counter");
+        this.rpName = this.getResponseProperty("RpName");
+        this.userDisplayName = this.getResponseProperty("UserDisplayName");
+        this.discoverable = this.getResponseProperty("Discoverable");
+        this.creationDate = this.getResponseProperty("CreationDate");
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/models/api/login.api.ts
 
 
+
 class LoginApi extends BaseResponse {
     constructor(data = null) {
         super(data);
@@ -24053,6 +24608,10 @@ class LoginApi extends BaseResponse {
         if (uris != null) {
             this.uris = uris.map((u) => new LoginUriApi(u));
         }
+        const fido2Credentials = this.getResponseProperty("Fido2Credentials");
+        if (fido2Credentials != null) {
+            this.fido2Credentials = fido2Credentials.map((key) => new Fido2CredentialApi(key));
+        }
     }
 }
 
@@ -24081,8 +24640,10 @@ class AttachmentRequest {
 
 
 
+
 class CipherRequest {
     constructor(cipher) {
+        var _a;
         this.type = cipher.type;
         this.folderId = cipher.folderId;
         this.organizationId = cipher.organizationId;
@@ -24091,6 +24652,7 @@ class CipherRequest {
         this.favorite = cipher.favorite;
         this.lastKnownRevisionDate = cipher.revisionDate;
         this.reprompt = cipher.reprompt;
+        this.key = (_a = cipher.key) === null || _a === void 0 ? void 0 : _a.encryptedString;
         switch (this.type) {
             case CipherType.Login:
                 this.login = new LoginApi();
@@ -24111,6 +24673,30 @@ class CipherRequest {
                         return uri;
                     });
                 }
+                if (cipher.login.fido2Credentials != null) {
+                    this.login.fido2Credentials = cipher.login.fido2Credentials.map((key) => {
+                        const keyApi = new Fido2CredentialApi();
+                        keyApi.credentialId =
+                            key.credentialId != null ? key.credentialId.encryptedString : null;
+                        keyApi.keyType =
+                            key.keyType != null ? key.keyType.encryptedString : null;
+                        keyApi.keyAlgorithm =
+                            key.keyAlgorithm != null ? key.keyAlgorithm.encryptedString : null;
+                        keyApi.keyCurve =
+                            key.keyCurve != null ? key.keyCurve.encryptedString : null;
+                        keyApi.keyValue = key.keyValue != null ? key.keyValue.encryptedString : null;
+                        keyApi.rpId = key.rpId != null ? key.rpId.encryptedString : null;
+                        keyApi.rpName = key.rpName != null ? key.rpName.encryptedString : null;
+                        keyApi.counter = key.counter != null ? key.counter.encryptedString : null;
+                        keyApi.userHandle = key.userHandle != null ? key.userHandle.encryptedString : null;
+                        keyApi.userDisplayName =
+                            key.userDisplayName != null ? key.userDisplayName.encryptedString : null;
+                        keyApi.discoverable =
+                            key.discoverable != null ? key.discoverable.encryptedString : null;
+                        keyApi.creationDate = key.creationDate != null ? key.creationDate.toISOString() : null;
+                        return keyApi;
+                    });
+                }
                 break;
             case CipherType.SecureNote:
                 this.secureNote = new SecureNoteApi();
@@ -24311,8 +24897,14 @@ var cipher_service_awaiter = (undefined && undefined.__awaiter) || function (thi
 
 
 
+
+
+
+
+
+const CIPHER_KEY_ENC_MIN_SERVER_VER = new external_semver_namespaceObject.SemVer("2023.9.1");
 class CipherService {
-    constructor(cryptoService, settingsService, apiService, i18nService, searchService, stateService, encryptService, cipherFileUploadService) {
+    constructor(cryptoService, settingsService, apiService, i18nService, searchService, stateService, encryptService, cipherFileUploadService, configService) {
         this.cryptoService = cryptoService;
         this.settingsService = settingsService;
         this.apiService = apiService;
@@ -24321,6 +24913,7 @@ class CipherService {
         this.stateService = stateService;
         this.encryptService = encryptService;
         this.cipherFileUploadService = cipherFileUploadService;
+        this.configService = configService;
         this.sortedCiphersCache = new SortedCiphersCache(this.sortCiphersByLastUsed);
     }
     getDecryptedCipherCache() {
@@ -24347,56 +24940,17 @@ class CipherService {
             yield this.clearDecryptedCiphersState(userId);
         });
     }
-    encrypt(model, key, originalCipher = null) {
+    encrypt(model, keyForEncryption, keyForCipherKeyDecryption, originalCipher = null) {
+        var _a;
         return cipher_service_awaiter(this, void 0, void 0, function* () {
-            // Adjust password history
             if (model.id != null) {
                 if (originalCipher == null) {
                     originalCipher = yield this.get(model.id);
                 }
                 if (originalCipher != null) {
-                    const existingCipher = yield originalCipher.decrypt();
-                    model.passwordHistory = existingCipher.passwordHistory || [];
-                    if (model.type === CipherType.Login && existingCipher.type === CipherType.Login) {
-                        if (existingCipher.login.password != null &&
-                            existingCipher.login.password !== "" &&
-                            existingCipher.login.password !== model.login.password) {
-                            const ph = new PasswordHistoryView();
-                            ph.password = existingCipher.login.password;
-                            ph.lastUsedDate = model.login.passwordRevisionDate = new Date();
-                            model.passwordHistory.splice(0, 0, ph);
-                        }
-                        else {
-                            model.login.passwordRevisionDate = existingCipher.login.passwordRevisionDate;
-                        }
-                    }
-                    if (existingCipher.hasFields) {
-                        const existingHiddenFields = existingCipher.fields.filter((f) => f.type === FieldType.Hidden &&
-                            f.name != null &&
-                            f.name !== "" &&
-                            f.value != null &&
-                            f.value !== "");
-                        const hiddenFields = model.fields == null
-                            ? []
-                            : model.fields.filter((f) => f.type === FieldType.Hidden && f.name != null && f.name !== "");
-                        existingHiddenFields.forEach((ef) => {
-                            const matchedField = hiddenFields.find((f) => f.name === ef.name);
-                            if (matchedField == null || matchedField.value !== ef.value) {
-                                const ph = new PasswordHistoryView();
-                                ph.password = ef.name + ": " + ef.value;
-                                ph.lastUsedDate = new Date();
-                                model.passwordHistory.splice(0, 0, ph);
-                            }
-                        });
-                    }
-                }
-                if (model.passwordHistory != null && model.passwordHistory.length === 0) {
-                    model.passwordHistory = null;
-                }
-                else if (model.passwordHistory != null && model.passwordHistory.length > 5) {
-                    // only save last 5 history
-                    model.passwordHistory = model.passwordHistory.slice(0, 5);
+                    yield this.updateModelfromExistingCipher(model, originalCipher);
                 }
+                this.adjustPasswordHistoryLength(model);
             }
             const cipher = new Cipher();
             cipher.id = model.id;
@@ -24408,29 +24962,28 @@ class CipherService {
             cipher.revisionDate = model.revisionDate;
             cipher.reprompt = model.reprompt;
             cipher.edit = model.edit;
-            if (key == null && cipher.organizationId != null) {
-                key = yield this.cryptoService.getOrgKey(cipher.organizationId);
-                if (key == null) {
-                    throw new Error("Cannot encrypt cipher for organization. No key.");
+            if (yield this.getCipherKeyEncryptionEnabled()) {
+                cipher.key = (_a = originalCipher === null || originalCipher === void 0 ? void 0 : originalCipher.key) !== null && _a !== void 0 ? _a : null;
+                const userOrOrgKey = yield this.getKeyForCipherKeyDecryption(cipher);
+                // The keyForEncryption is only used for encrypting the cipher key, not the cipher itself, since cipher key encryption is enabled.
+                // If the caller has provided a key for cipher key encryption, use it. Otherwise, use the user or org key.
+                keyForEncryption || (keyForEncryption = userOrOrgKey);
+                // If the caller has provided a key for cipher key decryption, use it. Otherwise, use the user or org key.
+                keyForCipherKeyDecryption || (keyForCipherKeyDecryption = userOrOrgKey);
+                return this.encryptCipherWithCipherKey(model, cipher, keyForEncryption, keyForCipherKeyDecryption);
+            }
+            else {
+                if (keyForEncryption == null && cipher.organizationId != null) {
+                    keyForEncryption = yield this.cryptoService.getOrgKey(cipher.organizationId);
+                    if (keyForEncryption == null) {
+                        throw new Error("Cannot encrypt cipher for organization. No key.");
+                    }
                 }
+                // We want to ensure that the cipher key is null if cipher key encryption is disabled
+                // so that decryption uses the proper key.
+                cipher.key = null;
+                return this.encryptCipher(model, cipher, keyForEncryption);
             }
-            yield Promise.all([
-                this.encryptObjProperty(model, cipher, {
-                    name: null,
-                    notes: null,
-                }, key),
-                this.encryptCipherData(cipher, model, key),
-                this.encryptFields(model.fields, key).then((fields) => {
-                    cipher.fields = fields;
-                }),
-                this.encryptPasswordHistories(model.passwordHistory, key).then((ph) => {
-                    cipher.passwordHistory = ph;
-                }),
-                this.encryptAttachments(model.attachments, key).then((attachments) => {
-                    cipher.attachments = attachments;
-                }),
-            ]);
-            return cipher;
         });
     }
     encryptAttachments(attachmentsModel, key) {
@@ -24547,10 +25100,6 @@ class CipherService {
                 yield this.reindexCiphers();
                 return yield this.getDecryptedCipherCache();
             }
-            const hasKey = yield this.cryptoService.hasUserKey();
-            if (!hasKey) {
-                throw new Error("No user key found.");
-            }
             const ciphers = yield this.getAll();
             const orgKeys = yield this.cryptoService.getOrgKeys();
             const userKey = yield this.cryptoService.getUserKeyWithLegacySupport();
@@ -24607,13 +25156,16 @@ class CipherService {
             const ciphers = yield this.getAllDecrypted();
             defaultMatch !== null && defaultMatch !== void 0 ? defaultMatch : (defaultMatch = yield this.stateService.getDefaultUriMatch());
             return ciphers.filter((cipher) => {
-                if (cipher.deletedDate != null) {
+                const cipherIsLogin = cipher.type === CipherType.Login && cipher.login !== null;
+                if (cipher.deletedDate !== null) {
                     return false;
                 }
-                if (includeOtherTypes != null && includeOtherTypes.indexOf(cipher.type) > -1) {
+                if (Array.isArray(includeOtherTypes) &&
+                    includeOtherTypes.includes(cipher.type) &&
+                    !cipherIsLogin) {
                     return true;
                 }
-                if (cipher.type === CipherType.Login && cipher.login !== null) {
+                if (cipherIsLogin) {
                     return cipher.login.matchesUri(url, equivalentDomains, defaultMatch);
                 }
                 return false;
@@ -24774,7 +25326,7 @@ class CipherService {
             yield Promise.all(attachmentPromises);
             cipher.organizationId = organizationId;
             cipher.collectionIds = collectionIds;
-            const encCipher = yield this.encrypt(cipher);
+            const encCipher = yield this.encryptSharedCipher(cipher);
             const request = new CipherShareRequest(encCipher);
             const response = yield this.apiService.putShareCipher(cipher.id, request);
             const data = new CipherData(response, collectionIds);
@@ -24788,7 +25340,7 @@ class CipherService {
             for (const cipher of ciphers) {
                 cipher.organizationId = organizationId;
                 cipher.collectionIds = collectionIds;
-                promises.push(this.encrypt(cipher).then((c) => {
+                promises.push(this.encryptSharedCipher(cipher).then((c) => {
                     encCiphers.push(c);
                 }));
             }
@@ -24827,12 +25379,22 @@ class CipherService {
     }
     saveAttachmentRawWithServer(cipher, filename, data, admin = false) {
         return cipher_service_awaiter(this, void 0, void 0, function* () {
-            let encKey;
-            encKey = yield this.cryptoService.getOrgKey(cipher.organizationId);
-            encKey || (encKey = yield this.cryptoService.getUserKeyWithLegacySupport());
-            const dataEncKey = yield this.cryptoService.makeDataEncKey(encKey);
-            const encFileName = yield this.encryptService.encrypt(filename, encKey);
-            const encData = yield this.encryptService.encryptToBytes(data, dataEncKey[0]);
+            const encKey = yield this.getKeyForCipherKeyDecryption(cipher);
+            const cipherKeyEncryptionEnabled = yield this.getCipherKeyEncryptionEnabled();
+            const cipherEncKey = cipherKeyEncryptionEnabled && cipher.key != null
+                ? new SymmetricCryptoKey(yield this.encryptService.decryptToBytes(cipher.key, encKey))
+                : encKey;
+            //if cipher key encryption is disabled but the item has an individual key,
+            //then we rollback to using the user key as the main key of encryption of the item
+            //in order to keep item and it's attachments with the same encryption level
+            if (cipher.key != null && !cipherKeyEncryptionEnabled) {
+                const model = yield cipher.decrypt(yield this.getKeyForCipherKeyDecryption(cipher));
+                cipher = yield this.encrypt(model);
+                yield this.updateWithServer(cipher);
+            }
+            const encFileName = yield this.encryptService.encrypt(filename, cipherEncKey);
+            const dataEncKey = yield this.cryptoService.makeDataEncKey(cipherEncKey);
+            const encData = yield this.encryptService.encryptToBytes(new Uint8Array(data), dataEncKey[0]);
             const response = yield this.cipherFileUploadService.upload(cipher, encFileName, encData, admin, dataEncKey);
             const cData = new CipherData(response, cipher.collectionIds);
             if (!admin) {
@@ -25120,7 +25682,68 @@ class CipherService {
             yield this.restore(restores);
         });
     }
+    getKeyForCipherKeyDecryption(cipher) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            return ((yield this.cryptoService.getOrgKey(cipher.organizationId)) ||
+                (yield this.cryptoService.getUserKeyWithLegacySupport()));
+        });
+    }
     // Helpers
+    // In the case of a cipher that is being shared with an organization, we want to decrypt the
+    // cipher key with the user's key and then re-encrypt it with the organization's key.
+    encryptSharedCipher(model) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            const keyForCipherKeyDecryption = yield this.cryptoService.getUserKeyWithLegacySupport();
+            return yield this.encrypt(model, null, keyForCipherKeyDecryption);
+        });
+    }
+    updateModelfromExistingCipher(model, originalCipher) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            const existingCipher = yield originalCipher.decrypt(yield this.getKeyForCipherKeyDecryption(originalCipher));
+            model.passwordHistory = existingCipher.passwordHistory || [];
+            if (model.type === CipherType.Login && existingCipher.type === CipherType.Login) {
+                if (existingCipher.login.password != null &&
+                    existingCipher.login.password !== "" &&
+                    existingCipher.login.password !== model.login.password) {
+                    const ph = new PasswordHistoryView();
+                    ph.password = existingCipher.login.password;
+                    ph.lastUsedDate = model.login.passwordRevisionDate = new Date();
+                    model.passwordHistory.splice(0, 0, ph);
+                }
+                else {
+                    model.login.passwordRevisionDate = existingCipher.login.passwordRevisionDate;
+                }
+            }
+            if (existingCipher.hasFields) {
+                const existingHiddenFields = existingCipher.fields.filter((f) => f.type === FieldType.Hidden &&
+                    f.name != null &&
+                    f.name !== "" &&
+                    f.value != null &&
+                    f.value !== "");
+                const hiddenFields = model.fields == null
+                    ? []
+                    : model.fields.filter((f) => f.type === FieldType.Hidden && f.name != null && f.name !== "");
+                existingHiddenFields.forEach((ef) => {
+                    const matchedField = hiddenFields.find((f) => f.name === ef.name);
+                    if (matchedField == null || matchedField.value !== ef.value) {
+                        const ph = new PasswordHistoryView();
+                        ph.password = ef.name + ": " + ef.value;
+                        ph.lastUsedDate = new Date();
+                        model.passwordHistory.splice(0, 0, ph);
+                    }
+                });
+            }
+        });
+    }
+    adjustPasswordHistoryLength(model) {
+        if (model.passwordHistory != null && model.passwordHistory.length === 0) {
+            model.passwordHistory = null;
+        }
+        else if (model.passwordHistory != null && model.passwordHistory.length > 5) {
+            // only save last 5 history
+            model.passwordHistory = model.passwordHistory.slice(0, 5);
+        }
+    }
     shareAttachmentWithServer(attachmentView, cipherId, organizationId) {
         return cipher_service_awaiter(this, void 0, void 0, function* () {
             const attachmentResponse = yield this.apiService.nativeFetch(new Request(attachmentView.url, { cache: "no-store" }));
@@ -25211,6 +25834,27 @@ class CipherService {
                             cipher.login.uris.push(loginUri);
                         }
                     }
+                    if (model.login.fido2Credentials != null) {
+                        cipher.login.fido2Credentials = yield Promise.all(model.login.fido2Credentials.map((viewKey) => cipher_service_awaiter(this, void 0, void 0, function* () {
+                            const domainKey = new Fido2Credential();
+                            yield this.encryptObjProperty(viewKey, domainKey, {
+                                credentialId: null,
+                                keyType: null,
+                                keyAlgorithm: null,
+                                keyCurve: null,
+                                keyValue: null,
+                                rpId: null,
+                                rpName: null,
+                                userHandle: null,
+                                userDisplayName: null,
+                                origin: null,
+                            }, key);
+                            domainKey.counter = yield this.cryptoService.encrypt(String(viewKey.counter), key);
+                            domainKey.discoverable = yield this.cryptoService.encrypt(String(viewKey.discoverable), key);
+                            domainKey.creationDate = viewKey.creationDate;
+                            return domainKey;
+                        })));
+                    }
                     return;
                 case CipherType.SecureNote:
                     cipher.secureNote = new SecureNote();
@@ -25298,6 +25942,49 @@ class CipherService {
     clearSortedCiphers() {
         this.sortedCiphersCache.clear();
     }
+    encryptCipher(model, cipher, key) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            yield Promise.all([
+                this.encryptObjProperty(model, cipher, {
+                    name: null,
+                    notes: null,
+                }, key),
+                this.encryptCipherData(cipher, model, key),
+                this.encryptFields(model.fields, key).then((fields) => {
+                    cipher.fields = fields;
+                }),
+                this.encryptPasswordHistories(model.passwordHistory, key).then((ph) => {
+                    cipher.passwordHistory = ph;
+                }),
+                this.encryptAttachments(model.attachments, key).then((attachments) => {
+                    cipher.attachments = attachments;
+                }),
+            ]);
+            return cipher;
+        });
+    }
+    encryptCipherWithCipherKey(model, cipher, keyForCipherKeyEncryption, keyForCipherKeyDecryption) {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            // First, we get the key for cipher key encryption, in its decrypted form
+            let decryptedCipherKey;
+            if (cipher.key == null) {
+                decryptedCipherKey = yield this.cryptoService.makeCipherKey();
+            }
+            else {
+                decryptedCipherKey = new SymmetricCryptoKey(yield this.encryptService.decryptToBytes(cipher.key, keyForCipherKeyDecryption));
+            }
+            // Then, we have to encrypt the cipher key with the proper key.
+            cipher.key = yield this.encryptService.encrypt(decryptedCipherKey.key, keyForCipherKeyEncryption);
+            // Finally, we can encrypt the cipher with the decrypted cipher key.
+            return this.encryptCipher(model, cipher, decryptedCipherKey);
+        });
+    }
+    getCipherKeyEncryptionEnabled() {
+        return cipher_service_awaiter(this, void 0, void 0, function* () {
+            return (flagEnabled("enableCipherKeyEncryption") &&
+                (yield (0,external_rxjs_namespaceObject.firstValueFrom)(this.configService.checkServerMeetsVersionRequirement$(CIPHER_KEY_ENC_MIN_SERVER_VER))));
+        });
+    }
 }
 cipher_service_decorate([
     sequentialize(() => "getAllDecrypted"),
@@ -26712,6 +27399,117 @@ class IdentityExport {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/models/export/fido2-credential.export.ts
+
+
+
+/**
+ * Represents format of Fido2 Credentials in JSON exports.
+ */
+class Fido2CredentialExport {
+    /**
+     * Generates a template for Fido2CredentialExport
+     * @returns Instance of Fido2CredentialExport with predefined values.
+     */
+    static template() {
+        const req = new Fido2CredentialExport();
+        req.credentialId = "keyId";
+        req.keyType = "keyType";
+        req.keyAlgorithm = "keyAlgorithm";
+        req.keyCurve = "keyCurve";
+        req.keyValue = "keyValue";
+        req.rpId = "rpId";
+        req.userHandle = "userHandle";
+        req.counter = "counter";
+        req.rpName = "rpName";
+        req.userDisplayName = "userDisplayName";
+        req.discoverable = "false";
+        req.creationDate = null;
+        return req;
+    }
+    /**
+     * Converts a Fido2CredentialExport object to its view representation.
+     * @param req - The Fido2CredentialExport object to be converted.
+     * @param view - (Optional) The Fido2CredentialView object to popualte with Fido2CredentialExport data
+     * @returns Fido2CredentialView - The populated view, or a new instance if none was provided.
+     */
+    static toView(req, view = new Fido2CredentialView()) {
+        view.credentialId = req.credentialId;
+        view.keyType = req.keyType;
+        view.keyAlgorithm = req.keyAlgorithm;
+        view.keyCurve = req.keyCurve;
+        view.keyValue = req.keyValue;
+        view.rpId = req.rpId;
+        view.userHandle = req.userHandle;
+        view.counter = parseInt(req.counter);
+        view.rpName = req.rpName;
+        view.userDisplayName = req.userDisplayName;
+        view.discoverable = req.discoverable === "true";
+        view.creationDate = new Date(req.creationDate);
+        return view;
+    }
+    /**
+     * Converts a Fido2CredentialExport object to its domain representation.
+     * @param req - The Fido2CredentialExport object to be converted.
+     * @param domain - (Optional) The Fido2Credential object to popualte with Fido2CredentialExport data
+     * @returns Fido2Credential - The populated domain, or a new instance if none was provided.
+     */
+    static toDomain(req, domain = new Fido2Credential()) {
+        domain.credentialId = req.credentialId != null ? new EncString(req.credentialId) : null;
+        domain.keyType = req.keyType != null ? new EncString(req.keyType) : null;
+        domain.keyAlgorithm = req.keyAlgorithm != null ? new EncString(req.keyAlgorithm) : null;
+        domain.keyCurve = req.keyCurve != null ? new EncString(req.keyCurve) : null;
+        domain.keyValue = req.keyValue != null ? new EncString(req.keyValue) : null;
+        domain.rpId = req.rpId != null ? new EncString(req.rpId) : null;
+        domain.userHandle = req.userHandle != null ? new EncString(req.userHandle) : null;
+        domain.counter = req.counter != null ? new EncString(req.counter) : null;
+        domain.rpName = req.rpName != null ? new EncString(req.rpName) : null;
+        domain.userDisplayName =
+            req.userDisplayName != null ? new EncString(req.userDisplayName) : null;
+        domain.discoverable = req.discoverable != null ? new EncString(req.discoverable) : null;
+        domain.creationDate = req.creationDate;
+        return domain;
+    }
+    /**
+     * Constructs a new Fid2CredentialExport instance.
+     *
+     * @param o - The credential storing the data being exported. When not provided, an empty export is created instead.
+     */
+    constructor(o) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        if (o == null) {
+            return;
+        }
+        if (o instanceof Fido2CredentialView) {
+            this.credentialId = o.credentialId;
+            this.keyType = o.keyType;
+            this.keyAlgorithm = o.keyAlgorithm;
+            this.keyCurve = o.keyCurve;
+            this.keyValue = o.keyValue;
+            this.rpId = o.rpId;
+            this.userHandle = o.userHandle;
+            this.counter = String(o.counter);
+            this.rpName = o.rpName;
+            this.userDisplayName = o.userDisplayName;
+            this.discoverable = String(o.discoverable);
+        }
+        else {
+            this.credentialId = (_a = o.credentialId) === null || _a === void 0 ? void 0 : _a.encryptedString;
+            this.keyType = (_b = o.keyType) === null || _b === void 0 ? void 0 : _b.encryptedString;
+            this.keyAlgorithm = (_c = o.keyAlgorithm) === null || _c === void 0 ? void 0 : _c.encryptedString;
+            this.keyCurve = (_d = o.keyCurve) === null || _d === void 0 ? void 0 : _d.encryptedString;
+            this.keyValue = (_e = o.keyValue) === null || _e === void 0 ? void 0 : _e.encryptedString;
+            this.rpId = (_f = o.rpId) === null || _f === void 0 ? void 0 : _f.encryptedString;
+            this.userHandle = (_g = o.userHandle) === null || _g === void 0 ? void 0 : _g.encryptedString;
+            this.counter = (_h = o.counter) === null || _h === void 0 ? void 0 : _h.encryptedString;
+            this.rpName = (_j = o.rpName) === null || _j === void 0 ? void 0 : _j.encryptedString;
+            this.userDisplayName = (_k = o.userDisplayName) === null || _k === void 0 ? void 0 : _k.encryptedString;
+            this.discoverable = (_l = o.discoverable) === null || _l === void 0 ? void 0 : _l.encryptedString;
+        }
+        this.creationDate = o.creationDate;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/models/export/login-uri.export.ts
 
 
@@ -26754,6 +27552,7 @@ class LoginUriExport {
 
 
 
+
 class LoginExport {
     static template() {
         const req = new LoginExport();
@@ -26761,6 +27560,7 @@ class LoginExport {
         req.username = "jdoe";
         req.password = "myp@ssword123";
         req.totp = "JBSWY3DPEHPK3PXP";
+        req.fido2Credentials = [Fido2CredentialExport.template()];
         return req;
     }
     static toView(req, view = new LoginView()) {
@@ -26770,6 +27570,9 @@ class LoginExport {
         view.username = req.username;
         view.password = req.password;
         view.totp = req.totp;
+        if (req.fido2Credentials != null) {
+            view.fido2Credentials = req.fido2Credentials.map((key) => Fido2CredentialExport.toView(key));
+        }
         return view;
     }
     static toDomain(req, domain = new Login()) {
@@ -26779,10 +27582,12 @@ class LoginExport {
         domain.username = req.username != null ? new EncString(req.username) : null;
         domain.password = req.password != null ? new EncString(req.password) : null;
         domain.totp = req.totp != null ? new EncString(req.totp) : null;
+        // Fido2credentials are currently not supported for exports.
         return domain;
     }
     constructor(o) {
         var _a, _b, _c;
+        this.fido2Credentials = [];
         if (o == null) {
             return;
         }
@@ -26794,6 +27599,9 @@ class LoginExport {
                 this.uris = o.uris.map((u) => new LoginUriExport(u));
             }
         }
+        if (o.fido2Credentials != null) {
+            this.fido2Credentials = o.fido2Credentials.map((key) => new Fido2CredentialExport(key));
+        }
         if (o instanceof LoginView) {
             this.username = o.username;
             this.password = o.password;
@@ -26961,6 +27769,7 @@ class CipherExport {
         domain.notes = req.notes != null ? new EncString(req.notes) : null;
         domain.favorite = req.favorite;
         domain.reprompt = (_a = req.reprompt) !== null && _a !== void 0 ? _a : CipherRepromptType.None;
+        domain.key = req.key != null ? new EncString(req.key) : null;
         if (req.fields != null) {
             domain.fields = req.fields.map((f) => FieldExport.toDomain(f));
         }
@@ -26988,7 +27797,7 @@ class CipherExport {
     }
     // Use build method instead of ctor so that we can control order of JSON stringify for pretty print
     build(o) {
-        var _a, _b;
+        var _a, _b, _c;
         this.organizationId = o.organizationId;
         this.folderId = o.folderId;
         this.type = o.type;
@@ -27000,6 +27809,7 @@ class CipherExport {
         else {
             this.name = (_a = o.name) === null || _a === void 0 ? void 0 : _a.encryptedString;
             this.notes = (_b = o.notes) === null || _b === void 0 ? void 0 : _b.encryptedString;
+            this.key = (_c = o.key) === null || _c === void 0 ? void 0 : _c.encryptedString;
         }
         this.favorite = o.favorite;
         if (o.fields != null) {
@@ -27173,6 +27983,7 @@ class FolderWithIdExport extends FolderExport {
 
 
 
+
 
 ;// CONCATENATED MODULE: ../../libs/exporter/src/export-helper.ts
 class ExportHelper {
@@ -27398,12 +28209,15 @@ class VaultExportService {
                     if (exportData.ciphers != null && exportData.ciphers.length > 0) {
                         exportData.ciphers
                             .filter((c) => c.deletedDate === null)
-                            .forEach((c) => {
+                            .forEach((c) => vault_export_service_awaiter(this, void 0, void 0, function* () {
                             const cipher = new Cipher(new CipherData(c));
-                            exportPromises.push(cipher.decrypt().then((decCipher) => {
+                            exportPromises.push(this.cipherService
+                                .getKeyForCipherKeyDecryption(cipher)
+                                .then((key) => cipher.decrypt(key))
+                                .then((decCipher) => {
                                 decCiphers.push(decCipher);
                             }));
-                        });
+                        }));
                     }
                 }
                 return Promise.all(exportPromises);
@@ -28409,10 +29223,11 @@ var bitwarden_json_importer_awaiter = (undefined && undefined.__awaiter) || func
 
 
 class BitwardenJsonImporter extends base_importer_BaseImporter {
-    constructor(cryptoService, i18nService) {
+    constructor(cryptoService, i18nService, cipherService) {
         super();
         this.cryptoService = cryptoService;
         this.i18nService = i18nService;
+        this.cipherService = cipherService;
     }
     parse(data) {
         return bitwarden_json_importer_awaiter(this, void 0, void 0, function* () {
@@ -28472,7 +29287,7 @@ class BitwardenJsonImporter extends base_importer_BaseImporter {
                         }
                     });
                 }
-                const view = yield cipher.decrypt();
+                const view = yield cipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(cipher));
                 this.cleanupCipher(view);
                 this.result.ciphers.push(view);
             }
@@ -28584,8 +29399,8 @@ var bitwarden_password_protected_importer_awaiter = (undefined && undefined.__aw
 
 
 class BitwardenPasswordProtectedImporter extends BitwardenJsonImporter {
-    constructor(cryptoService, i18nService, promptForPassword_callback) {
-        super(cryptoService, i18nService);
+    constructor(cryptoService, i18nService, cipherService, promptForPassword_callback) {
+        super(cryptoService, i18nService, cipherService);
         this.promptForPassword_callback = promptForPassword_callback;
     }
     parse(data) {
@@ -33566,9 +34381,9 @@ const featuredImportOptions = [
     { id: "dashlanecsv", name: "Dashlane (csv)" },
     { id: "firefoxcsv", name: "Firefox (csv)" },
     { id: "keepass2xml", name: "KeePass 2 (xml)" },
-    { id: "lastpasscsv", name: "LastPass (csv)" },
+    { id: "lastpasscsv", name: "LastPass" },
     { id: "safaricsv", name: "Safari and macOS (csv)" },
-    { id: "1password1pux", name: "1Password (1pux)" },
+    { id: "1password1pux", name: "1Password (1pux/json)" },
 ];
 const regularImportOptions = [
     { id: "keepassxcsv", name: "KeePassX (csv)" },
@@ -33736,7 +34551,7 @@ class ImportService {
                 return new BitwardenCsvImporter();
             case "bitwardenjson":
             case "bitwardenpasswordprotected":
-                return new BitwardenPasswordProtectedImporter(this.cryptoService, this.i18nService, promptForPassword_callback);
+                return new BitwardenPasswordProtectedImporter(this.cryptoService, this.i18nService, this.cipherService, promptForPassword_callback);
             case "lastpasscsv":
             case "passboltcsv":
                 return new LastPassCsvImporter();
@@ -33994,11 +34809,14 @@ class ImportService {
     }
 }
 
-;// CONCATENATED MODULE: ../../libs/importer/src/index.ts
+;// CONCATENATED MODULE: ../../libs/importer/src/services/index.ts
 
 
 
 
+
+;// CONCATENATED MODULE: ../../libs/importer/src/index.ts
+
 
 
 ;// CONCATENATED MODULE: external "crypto"
@@ -34160,17 +34978,17 @@ class NodeCryptoFunctionService {
         }
         return p;
     }
-    aesDecryptFast(parameters) {
+    aesDecryptFast(parameters, mode) {
         return node_crypto_function_service_awaiter(this, void 0, void 0, function* () {
-            const decBuf = yield this.aesDecrypt(parameters.data, parameters.iv, parameters.encKey);
+            const decBuf = yield this.aesDecrypt(parameters.data, parameters.iv, parameters.encKey, mode);
             return utils_Utils.fromBufferToUtf8(decBuf);
         });
     }
-    aesDecrypt(data, iv, key) {
+    aesDecrypt(data, iv, key, mode) {
         const nodeData = this.toNodeBuffer(data);
-        const nodeIv = this.toNodeBuffer(iv);
+        const nodeIv = mode === "ecb" ? null : this.toNodeBuffer(iv);
         const nodeKey = this.toNodeBuffer(key);
-        const decipher = external_crypto_namespaceObject.createDecipheriv("aes-256-cbc", nodeKey, nodeIv);
+        const decipher = external_crypto_namespaceObject.createDecipheriv(this.toNodeCryptoAesMode(mode), nodeKey, nodeIv);
         const decBuf = Buffer.concat([decipher.update(nodeData), decipher.final()]);
         return Promise.resolve(this.toUint8Buffer(decBuf));
     }
@@ -34276,6 +35094,150 @@ class NodeCryptoFunctionService {
         const publicKey = external_node_forge_namespaceObject.pki.publicKeyFromAsn1(asn1);
         return external_node_forge_namespaceObject.pki.publicKeyToPem(publicKey);
     }
+    toNodeCryptoAesMode(mode) {
+        return mode === "cbc" ? "aes-256-cbc" : "aes-256-ecb";
+    }
+}
+
+;// CONCATENATED MODULE: ../../libs/common/src/platform/abstractions/config/server-config.ts
+const dayInMilliseconds = 24 * 3600 * 1000;
+const eighteenHoursInMilliseconds = 18 * 3600 * 1000;
+class ServerConfig {
+    constructor(serverConfigData) {
+        var _a, _b;
+        this.featureStates = {};
+        this.version = serverConfigData.version;
+        this.gitHash = serverConfigData.gitHash;
+        this.server = serverConfigData.server;
+        this.utcDate = new Date(serverConfigData.utcDate);
+        this.environment = serverConfigData.environment;
+        this.featureStates = serverConfigData.featureStates;
+        if (((_a = this.server) === null || _a === void 0 ? void 0 : _a.name) == null && ((_b = this.server) === null || _b === void 0 ? void 0 : _b.url) == null) {
+            this.server = null;
+        }
+    }
+    getAgeInMilliseconds() {
+        var _a;
+        return new Date().getTime() - ((_a = this.utcDate) === null || _a === void 0 ? void 0 : _a.getTime());
+    }
+    isValid() {
+        return this.getAgeInMilliseconds() <= dayInMilliseconds;
+    }
+    expiresSoon() {
+        return this.getAgeInMilliseconds() >= eighteenHoursInMilliseconds;
+    }
+    static fromJSON(obj) {
+        if (obj == null) {
+            return null;
+        }
+        return new ServerConfig(obj);
+    }
+}
+
+;// CONCATENATED MODULE: ../../libs/common/src/platform/services/config/config.service.ts
+var config_service_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+
+
+
+
+const ONE_HOUR_IN_MILLISECONDS = 1000 * 3600;
+class ConfigService {
+    constructor(stateService, configApiService, authService, environmentService, logService, 
+    // Used to avoid duplicate subscriptions, e.g. in browser between the background and popup
+    subscribe = true) {
+        this.stateService = stateService;
+        this.configApiService = configApiService;
+        this.authService = authService;
+        this.environmentService = environmentService;
+        this.logService = logService;
+        this.subscribe = subscribe;
+        this.inited = false;
+        this._serverConfig = new external_rxjs_namespaceObject.ReplaySubject(1);
+        this.serverConfig$ = this._serverConfig.asObservable();
+        this._forceFetchConfig = new external_rxjs_namespaceObject.Subject();
+        this.refreshTimer$ = (0,external_rxjs_namespaceObject.timer)(ONE_HOUR_IN_MILLISECONDS, ONE_HOUR_IN_MILLISECONDS); // after 1 hour, then every hour
+        this.cloudRegion$ = this.serverConfig$.pipe((0,external_rxjs_namespaceObject.map)((config) => { var _a, _b; return (_b = (_a = config === null || config === void 0 ? void 0 : config.environment) === null || _a === void 0 ? void 0 : _a.cloudRegion) !== null && _b !== void 0 ? _b : Region.US; }));
+    }
+    init() {
+        if (!this.subscribe || this.inited) {
+            return;
+        }
+        const latestServerConfig$ = (0,external_rxjs_namespaceObject.defer)(() => this.configApiService.get()).pipe((0,external_rxjs_namespaceObject.map)((response) => new ServerConfigData(response)), (0,external_rxjs_namespaceObject.delayWhen)((data) => this.saveConfig(data)), (0,external_rxjs_namespaceObject.catchError)((e) => {
+            // fall back to stored ServerConfig (if any)
+            this.logService.error("Unable to fetch ServerConfig: " + (e === null || e === void 0 ? void 0 : e.message));
+            return this.stateService.getServerConfig();
+        }));
+        // If you need to fetch a new config when an event occurs, add an observable that emits on that event here
+        (0,external_rxjs_namespaceObject.merge)(this.refreshTimer$, // an overridable interval
+        this.environmentService.urls, // when environment URLs change (including when app is started)
+        this._forceFetchConfig // manual
+        )
+            .pipe((0,external_rxjs_namespaceObject.concatMap)(() => latestServerConfig$), (0,external_rxjs_namespaceObject.map)((data) => (data == null ? null : new ServerConfig(data))))
+            .subscribe((config) => this._serverConfig.next(config));
+        this.inited = true;
+    }
+    getFeatureFlag$(key, defaultValue) {
+        return this.serverConfig$.pipe((0,external_rxjs_namespaceObject.map)((serverConfig) => {
+            if ((serverConfig === null || serverConfig === void 0 ? void 0 : serverConfig.featureStates) == null || serverConfig.featureStates[key] == null) {
+                return defaultValue;
+            }
+            return serverConfig.featureStates[key];
+        }));
+    }
+    getFeatureFlag(key, defaultValue) {
+        return config_service_awaiter(this, void 0, void 0, function* () {
+            return yield (0,external_rxjs_namespaceObject.firstValueFrom)(this.getFeatureFlag$(key, defaultValue));
+        });
+    }
+    triggerServerConfigFetch() {
+        this._forceFetchConfig.next();
+    }
+    saveConfig(data) {
+        var _a;
+        return config_service_awaiter(this, void 0, void 0, function* () {
+            if ((yield this.authService.getAuthStatus()) === AuthenticationStatus.LoggedOut) {
+                return;
+            }
+            yield this.stateService.setServerConfig(data);
+            this.environmentService.setCloudWebVaultUrl((_a = data.environment) === null || _a === void 0 ? void 0 : _a.cloudRegion);
+        });
+    }
+    /**
+     * Verifies whether the server version meets the minimum required version
+     * @param minimumRequiredServerVersion The minimum version required
+     * @returns True if the server version is greater than or equal to the minimum required version
+     */
+    checkServerMeetsVersionRequirement$(minimumRequiredServerVersion) {
+        return this.serverConfig$.pipe((0,external_rxjs_namespaceObject.map)((serverConfig) => {
+            if (serverConfig == null) {
+                return false;
+            }
+            const serverVersion = new external_semver_namespaceObject.SemVer(serverConfig.version);
+            return serverVersion.compare(minimumRequiredServerVersion) >= 0;
+        }));
+    }
+}
+
+;// CONCATENATED MODULE: ./src/platform/services/cli-config.service.ts
+
+
+class CliConfigService extends ConfigService {
+    constructor() {
+        super(...arguments);
+        // The rxjs timer uses setTimeout/setInterval under the hood, which prevents the node process from exiting
+        // when the command is finished. Cli should never be alive long enough to use the timer, so we disable it.
+        this.refreshTimer$ = external_rxjs_namespaceObject.NEVER;
+    }
 }
 
 ;// CONCATENATED MODULE: external "child_process"
@@ -34958,6 +35920,7 @@ class CipherResponse extends BaseResponse {
             this.passwordHistory = passwordHistory.map((h) => new PasswordHistoryResponse(h));
         }
         this.reprompt = this.getResponseProperty("Reprompt") || CipherRepromptType.None;
+        this.key = this.getResponseProperty("Key") || null;
     }
 }
 
@@ -34977,6 +35940,7 @@ class CollectionDetailsResponse extends CollectionResponse {
     constructor(response) {
         super(response);
         this.readOnly = this.getResponseProperty("ReadOnly") || false;
+        this.hidePasswords = this.getResponseProperty("HidePasswords") || false;
     }
 }
 class CollectionAccessDetailsResponse extends CollectionResponse {
@@ -36157,7 +37121,7 @@ class ApiService {
     // Plan APIs
     getPlans() {
         return api_service_awaiter(this, void 0, void 0, function* () {
-            const r = yield this.send("GET", "/plans/all", null, false, true);
+            const r = yield this.send("GET", "/plans", null, false, true);
             return new ListResponse(r, PlanResponse);
         });
     }
@@ -37400,6 +38364,9 @@ class LoginCommand {
                 else {
                     response = yield this.authService.logIn(new PasswordLogInCredentials(email, password, null, twoFactor));
                 }
+                if (response.requiresEncryptionKeyMigration) {
+                    return Response.error("Encryption key migration required. Please login through the web vault to update your encryption key.");
+                }
                 if (response.captchaSiteKey) {
                     const credentials = new PasswordLogInCredentials(email, password);
                     const handledResponse = yield this.handleCaptchaRequired(twoFactor, credentials);
@@ -38724,11 +39691,11 @@ class ShareCommand {
             if (cipher.organizationId != null) {
                 return Response.badRequest("This item already belongs to an organization.");
             }
-            const cipherView = yield cipher.decrypt();
+            const cipherView = yield cipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(cipher));
             try {
                 yield this.cipherService.shareWithServer(cipherView, organizationId, req);
                 const updatedCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield updatedCipher.decrypt();
+                const decCipher = yield updatedCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(updatedCipher));
                 const res = new cipher_response_CipherResponse(decCipher);
                 return Response.success(res);
             }
@@ -39824,7 +40791,7 @@ class CreateCommand {
             try {
                 yield this.cipherService.createWithServer(cipher);
                 const newCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield newCipher.decrypt();
+                const decCipher = yield newCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(newCipher));
                 const res = new cipher_response_CipherResponse(decCipher);
                 return Response.success(res);
             }
@@ -39877,7 +40844,7 @@ class CreateCommand {
             try {
                 yield this.cipherService.saveAttachmentRawWithServer(cipher, fileName, new Uint8Array(fileBuf).buffer);
                 const updatedCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield updatedCipher.decrypt();
+                const decCipher = yield updatedCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(updatedCipher));
                 return Response.success(new cipher_response_CipherResponse(decCipher));
             }
             catch (e) {
@@ -40200,7 +41167,7 @@ class EditCommand {
             if (cipher == null) {
                 return Response.notFound();
             }
-            let cipherView = yield cipher.decrypt();
+            let cipherView = yield cipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(cipher));
             if (cipherView.isDeleted) {
                 return Response.badRequest("You may not edit a deleted item. Use the restore command first.");
             }
@@ -40209,7 +41176,7 @@ class EditCommand {
             try {
                 yield this.cipherService.updateWithServer(encCipher);
                 const updatedCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield updatedCipher.decrypt();
+                const decCipher = yield updatedCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(updatedCipher));
                 const res = new cipher_response_CipherResponse(decCipher);
                 return Response.success(res);
             }
@@ -40231,7 +41198,7 @@ class EditCommand {
             try {
                 yield this.cipherService.saveCollectionsWithServer(cipher);
                 const updatedCipher = yield this.cipherService.get(cipher.id);
-                const decCipher = yield updatedCipher.decrypt();
+                const decCipher = yield updatedCipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(updatedCipher));
                 const res = new cipher_response_CipherResponse(decCipher);
                 return Response.success(res);
             }
@@ -40448,7 +41415,7 @@ class GetCommand extends DownloadCommand {
             if (utils_Utils.isGuid(id)) {
                 const cipher = yield this.cipherService.get(id);
                 if (cipher != null) {
-                    decCipher = yield cipher.decrypt();
+                    decCipher = yield cipher.decrypt(yield this.cipherService.getKeyForCipherKeyDecryption(cipher));
                 }
             }
             else if (id.trim() !== "") {
@@ -42514,7 +43481,7 @@ class ImportCommand {
             }
             try {
                 let contents;
-                if (format === "1password1pux") {
+                if (format === "1password1pux" && filepath.endsWith(".1pux")) {
                     contents = yield CliUtils.extractZipContent(filepath, "export.data");
                 }
                 else if (format === "protonpass" && filepath.endsWith(".zip")) {
@@ -43030,6 +43997,9 @@ var bw_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _argum
 
 
 
+
+
+
 
 
 
@@ -43068,7 +44038,8 @@ class Main {
         this.storageService = new LowdbStorageService(this.logService, null, p, false, true);
         this.secureStorageService = new NodeEnvSecureStorageService(this.storageService, this.logService, () => this.cryptoService);
         this.memoryStorageService = new MemoryStorageService();
-        this.stateService = new StateService(this.storageService, this.secureStorageService, this.memoryStorageService, this.logService, new StateFactory(GlobalState, Account));
+        this.accountService = new AccountServiceImplementation(null, this.logService);
+        this.stateService = new StateService(this.storageService, this.secureStorageService, this.memoryStorageService, this.logService, new StateFactory(GlobalState, Account), this.accountService);
         this.cryptoService = new CryptoService(this.cryptoFunctionService, this.encryptService, this.platformUtilsService, this.logService, this.stateService);
         this.appIdService = new AppIdService(this.storageService);
         this.tokenService = new TokenService(this.stateService);
@@ -43089,10 +44060,7 @@ class Main {
         this.cipherFileUploadService = new CipherFileUploadService(this.apiService, this.fileUploadService);
         this.sendApiService = this.sendApiService = new SendApiService(this.apiService, this.fileUploadService, this.sendService);
         this.searchService = new SearchService(this.logService, this.i18nService);
-        this.cipherService = new CipherService(this.cryptoService, this.settingsService, this.apiService, this.i18nService, this.searchService, this.stateService, this.encryptService, this.cipherFileUploadService);
         this.broadcasterService = new BroadcasterService();
-        this.folderService = new FolderService(this.cryptoService, this.i18nService, this.cipherService, this.stateService);
-        this.folderApiService = new FolderApiService(this.folderService, this.apiService);
         this.collectionService = new CollectionService(this.cryptoService, this.i18nService, this.stateService);
         this.providerService = new ProviderService(this.stateService);
         this.organizationService = new organization_service_OrganizationService(this.stateService);
@@ -43107,6 +44075,11 @@ class Main {
         this.deviceTrustCryptoService = new DeviceTrustCryptoService(this.cryptoFunctionService, this.cryptoService, this.encryptService, this.stateService, this.appIdService, this.devicesApiService, this.i18nService, this.platformUtilsService);
         this.authRequestCryptoService = new AuthRequestCryptoServiceImplementation(this.cryptoService);
         this.authService = new AuthService(this.cryptoService, this.apiService, this.tokenService, this.appIdService, this.platformUtilsService, this.messagingService, this.logService, this.keyConnectorService, this.environmentService, this.stateService, this.twoFactorService, this.i18nService, this.encryptService, this.passwordStrengthService, this.policyService, this.deviceTrustCryptoService, this.authRequestCryptoService);
+        this.configApiService = new ConfigApiService(this.apiService, this.authService);
+        this.configService = new CliConfigService(this.stateService, this.configApiService, this.authService, this.environmentService, this.logService, true);
+        this.cipherService = new CipherService(this.cryptoService, this.settingsService, this.apiService, this.i18nService, this.searchService, this.stateService, this.encryptService, this.cipherFileUploadService, this.configService);
+        this.folderService = new FolderService(this.cryptoService, this.i18nService, this.cipherService, this.stateService);
+        this.folderApiService = new FolderApiService(this.folderService, this.apiService);
         const lockedCallback = (userId) => bw_awaiter(this, void 0, void 0, function* () { return yield this.cryptoService.clearStoredUserKey(KeySuffixOptions.Auto); });
         this.userVerificationService = new UserVerificationService(this.stateService, this.cryptoService, this.i18nService, this.userVerificationApiService);
         this.vaultTimeoutSettingsService = new VaultTimeoutSettingsService(this.cryptoService, this.tokenService, this.policyService, this.stateService, this.userVerificationService);
@@ -43163,6 +44136,7 @@ class Main {
             const locale = yield this.stateService.getLocale();
             yield this.i18nService.init(locale);
             this.twoFactorService.init();
+            this.configService.init();
             const installedVersion = yield this.stateService.getInstalledVersion();
             const currentVersion = yield this.platformUtilsService.getApplicationVersion();
             if (installedVersion == null || installedVersion !== currentVersion) {