@bitwarden/cli 2023.9.1 → 2023.10.0

package/build/bw.js

@@ -20,7 +20,7 @@ module.exports = require("url");
 /***/ 147:
 /***/ ((module) => {
 
-module.exports = JSON.parse('{"name":"@bitwarden/cli","description":"A secure and free password manager for all of your devices.","version":"2023.9.1","keywords":["bitwarden","password","vault","password manager","cli"],"author":"Bitwarden Inc. <hello@bitwarden.com> (https://bitwarden.com)","homepage":"https://bitwarden.com","repository":{"type":"git","url":"https://github.com/bitwarden/clients"},"license":"GPL-3.0-only","scripts":{"clean":"rimraf dist","build":"webpack","build:debug":"npm run build && node --inspect ./build/bw.js","build:watch":"webpack --watch","build:prod":"cross-env NODE_ENV=production webpack","build:prod:watch":"cross-env NODE_ENV=production webpack --watch","package":"npm run package:win && npm run package:mac && npm run package:lin","package:win":"pkg . --targets win-x64 --output ./dist/windows/bw.exe","package:mac":"pkg . --targets macos-x64 --output ./dist/macos/bw","package:lin":"pkg . --targets linux-x64 --output ./dist/linux/bw","debug":"node --inspect ./build/bw.js","dist":"npm run build:prod && npm run clean && npm run package","dist:win":"npm run build:prod && npm run clean && npm run package:win","dist:mac":"npm run build:prod && npm run clean && npm run package:mac","dist:lin":"npm run build:prod && npm run clean && npm run package:lin","publish:npm":"npm run build:prod && npm publish --access public","test":"jest","test:watch":"jest --watch","test:watch:all":"jest --watchAll"},"bin":{"bw":"build/bw.js"},"pkg":{"assets":["./build/**/*","../../node_modules/argon2/**/*"]},"dependencies":{"@koa/multer":"3.0.2","@koa/router":"12.0.0","argon2":"0.31.0","big-integer":"1.6.51","browser-hrtime":"1.1.8","chalk":"4.1.2","commander":"7.2.0","form-data":"4.0.0","https-proxy-agent":"5.0.1","inquirer":"8.2.6","jsdom":"22.1.0","jszip":"3.10.1","koa":"2.14.2","koa-bodyparser":"4.4.1","koa-json":"2.0.2","lowdb":"1.0.0","lunr":"2.3.9","multer":"1.4.5-lts.1","node-fetch":"2.6.12","node-forge":"1.3.1","open":"8.4.2","papaparse":"5.4.1","proper-lockfile":"4.1.2","rxjs":"7.8.1","tldts":"6.0.14","zxcvbn":"4.4.2"}}');
+module.exports = JSON.parse('{"name":"@bitwarden/cli","description":"A secure and free password manager for all of your devices.","version":"2023.10.0","keywords":["bitwarden","password","vault","password manager","cli"],"author":"Bitwarden Inc. <hello@bitwarden.com> (https://bitwarden.com)","homepage":"https://bitwarden.com","repository":{"type":"git","url":"https://github.com/bitwarden/clients"},"license":"GPL-3.0-only","scripts":{"clean":"rimraf dist","build":"webpack","build:debug":"npm run build && node --inspect ./build/bw.js","build:watch":"webpack --watch","build:prod":"cross-env NODE_ENV=production webpack","build:prod:watch":"cross-env NODE_ENV=production webpack --watch","package":"npm run package:win && npm run package:mac && npm run package:lin","package:win":"pkg . --targets win-x64 --output ./dist/windows/bw.exe","package:mac":"pkg . --targets macos-x64 --output ./dist/macos/bw","package:lin":"pkg . --targets linux-x64 --output ./dist/linux/bw","debug":"node --inspect ./build/bw.js","dist":"npm run build:prod && npm run clean && npm run package","dist:win":"npm run build:prod && npm run clean && npm run package:win","dist:mac":"npm run build:prod && npm run clean && npm run package:mac","dist:lin":"npm run build:prod && npm run clean && npm run package:lin","publish:npm":"npm run build:prod && npm publish --access public","test":"jest","test:watch":"jest --watch","test:watch:all":"jest --watchAll"},"bin":{"bw":"build/bw.js"},"pkg":{"assets":["./build/**/*","../../node_modules/argon2/**/*"]},"dependencies":{"@koa/multer":"3.0.2","@koa/router":"12.0.0","argon2":"0.31.0","big-integer":"1.6.51","browser-hrtime":"1.1.8","chalk":"4.1.2","commander":"7.2.0","form-data":"4.0.0","https-proxy-agent":"5.0.1","inquirer":"8.2.6","jsdom":"22.1.0","jszip":"3.10.1","koa":"2.14.2","koa-bodyparser":"4.4.1","koa-json":"2.0.2","lowdb":"1.0.0","lunr":"2.3.9","multer":"1.4.5-lts.1","node-fetch":"2.6.12","node-forge":"1.3.1","open":"8.4.2","papaparse":"5.4.1","proper-lockfile":"4.1.2","rxjs":"7.8.1","tldts":"6.0.14","zxcvbn":"4.4.2"}}');
 
 /***/ })
 
@@ -360,15 +360,6 @@ class PlanResponse extends BaseResponse {
         this.nameLocalizationKey = this.getResponseProperty("NameLocalizationKey");
         this.descriptionLocalizationKey = this.getResponseProperty("DescriptionLocalizationKey");
         this.canBeUsedByBusiness = this.getResponseProperty("CanBeUsedByBusiness");
-        this.baseSeats = this.getResponseProperty("BaseSeats");
-        this.baseStorageGb = this.getResponseProperty("BaseStorageGb");
-        this.maxCollections = this.getResponseProperty("MaxCollections");
-        this.maxUsers = this.getResponseProperty("MaxUsers");
-        this.hasAdditionalSeatsOption = this.getResponseProperty("HasAdditionalSeatsOption");
-        this.maxAdditionalSeats = this.getResponseProperty("MaxAdditionalSeats");
-        this.hasAdditionalStorageOption = this.getResponseProperty("HasAdditionalStorageOption");
-        this.maxAdditionalStorage = this.getResponseProperty("MaxAdditionalStorage");
-        this.hasPremiumAccessOption = this.getResponseProperty("HasPremiumAccessOption");
         this.trialPeriodDays = this.getResponseProperty("TrialPeriodDays");
         this.hasSelfHost = this.getResponseProperty("HasSelfHost");
         this.hasPolicies = this.getResponseProperty("HasPolicies");
@@ -385,22 +376,53 @@ class PlanResponse extends BaseResponse {
         this.displaySortOrder = this.getResponseProperty("SortOrder");
         this.legacyYear = this.getResponseProperty("LegacyYear");
         this.disabled = this.getResponseProperty("Disabled");
-        this.stripePlanId = this.getResponseProperty("StripePlanId");
+        const passwordManager = this.getResponseProperty("PasswordManager");
+        const secretsManager = this.getResponseProperty("SecretsManager");
+        this.PasswordManager =
+            passwordManager == null ? null : new PasswordManagerPlanFeaturesResponse(passwordManager);
+        this.SecretsManager =
+            secretsManager == null ? null : new SecretsManagerPlanFeaturesResponse(secretsManager);
+    }
+}
+class SecretsManagerPlanFeaturesResponse extends BaseResponse {
+    constructor(response) {
+        super(response);
         this.stripeSeatPlanId = this.getResponseProperty("StripeSeatPlanId");
-        this.stripeStoragePlanId = this.getResponseProperty("StripeStoragePlanId");
-        this.stripePremiumAccessPlanId = this.getResponseProperty("StripePremiumAccessPlanId");
+        this.baseSeats = this.getResponseProperty("BaseSeats");
         this.basePrice = this.getResponseProperty("BasePrice");
         this.seatPrice = this.getResponseProperty("SeatPrice");
-        this.additionalStoragePricePerGb = this.getResponseProperty("AdditionalStoragePricePerGb");
-        this.premiumAccessOptionPrice = this.getResponseProperty("PremiumAccessOptionPrice");
-        this.bitwardenProduct = this.getResponseProperty("BitwardenProduct");
+        this.hasAdditionalSeatsOption = this.getResponseProperty("HasAdditionalSeatsOption");
+        this.maxAdditionalSeats = this.getResponseProperty("MaxAdditionalSeats");
+        this.maxSeats = this.getResponseProperty("MaxSeats");
+        this.stripeServiceAccountPlanId = this.getResponseProperty("StripeServiceAccountPlanId");
         this.additionalPricePerServiceAccount = this.getResponseProperty("AdditionalPricePerServiceAccount");
         this.baseServiceAccount = this.getResponseProperty("BaseServiceAccount");
         this.maxServiceAccount = this.getResponseProperty("MaxServiceAccount");
         this.hasAdditionalServiceAccountOption = this.getResponseProperty("HasAdditionalServiceAccountOption");
-        this.maxProjects = this.getResponseProperty("MaxProjects");
         this.maxAdditionalServiceAccounts = this.getResponseProperty("MaxAdditionalServiceAccounts");
-        this.stripeServiceAccountPlanId = this.getResponseProperty("StripeServiceAccountPlanId");
+        this.maxProjects = this.getResponseProperty("MaxProjects");
+    }
+}
+class PasswordManagerPlanFeaturesResponse extends BaseResponse {
+    constructor(response) {
+        super(response);
+        this.stripePlanId = this.getResponseProperty("StripePlanId");
+        this.stripeSeatPlanId = this.getResponseProperty("StripeSeatPlanId");
+        this.stripeStoragePlanId = this.getResponseProperty("StripeStoragePlanId");
+        this.stripePremiumAccessPlanId = this.getResponseProperty("StripePremiumAccessPlanId");
+        this.basePrice = this.getResponseProperty("BasePrice");
+        this.seatPrice = this.getResponseProperty("SeatPrice");
+        this.baseSeats = this.getResponseProperty("BaseSeats");
+        this.maxAdditionalSeats = this.getResponseProperty("MaxAdditionalSeats");
+        this.premiumAccessOptionPrice = this.getResponseProperty("PremiumAccessOptionPrice");
+        this.maxSeats = this.getResponseProperty("MaxSeats");
+        this.additionalStoragePricePerGb = this.getResponseProperty("AdditionalStoragePricePerGb");
+        this.hasAdditionalSeatsOption = this.getResponseProperty("HasAdditionalSeatsOption");
+        this.baseStorageGb = this.getResponseProperty("BaseStorageGb");
+        this.maxCollections = this.getResponseProperty("MaxCollections");
+        this.hasAdditionalStorageOption = this.getResponseProperty("HasAdditionalStorageOption");
+        this.maxAdditionalStorage = this.getResponseProperty("MaxAdditionalStorage");
+        this.hasPremiumAccessOption = this.getResponseProperty("HasPremiumAccessOption");
     }
 }
 
@@ -421,9 +443,6 @@ class OrganizationResponse extends BaseResponse {
         this.billingEmail = this.getResponseProperty("BillingEmail");
         const plan = this.getResponseProperty("Plan");
         this.plan = plan == null ? null : new PlanResponse(plan);
-        const secretsManagerPlan = this.getResponseProperty("SecretsManagerPlan");
-        this.secretsManagerPlan =
-            secretsManagerPlan == null ? null : new PlanResponse(secretsManagerPlan);
         this.planType = this.getResponseProperty("PlanType");
         this.seats = this.getResponseProperty("Seats");
         this.maxAutoscaleSeats = this.getResponseProperty("MaxAutoscaleSeats");
@@ -459,11 +478,13 @@ class SubscriptionResponse extends BaseResponse {
         this.usingInAppPurchase = this.getResponseProperty("UsingInAppPurchase");
         const subscription = this.getResponseProperty("Subscription");
         const upcomingInvoice = this.getResponseProperty("UpcomingInvoice");
+        const discount = this.getResponseProperty("Discount");
         this.subscription = subscription == null ? null : new BillingSubscriptionResponse(subscription);
         this.upcomingInvoice =
             upcomingInvoice == null
                 ? null
                 : new BillingSubscriptionUpcomingInvoiceResponse(upcomingInvoice);
+        this.discount = discount == null ? null : new BillingCustomerDiscount(discount);
     }
 }
 class BillingSubscriptionResponse extends BaseResponse {
@@ -493,7 +514,6 @@ class BillingSubscriptionItemResponse extends BaseResponse {
         this.interval = this.getResponseProperty("Interval");
         this.sponsoredSubscriptionItem = this.getResponseProperty("SponsoredSubscriptionItem");
         this.addonSubscriptionItem = this.getResponseProperty("AddonSubscriptionItem");
-        this.bitwardenProduct = this.getResponseProperty("BitwardenProduct");
     }
 }
 class BillingSubscriptionUpcomingInvoiceResponse extends BaseResponse {
@@ -503,6 +523,13 @@ class BillingSubscriptionUpcomingInvoiceResponse extends BaseResponse {
         this.amount = this.getResponseProperty("Amount");
     }
 }
+class BillingCustomerDiscount extends BaseResponse {
+    constructor(response) {
+        super(response);
+        this.id = this.getResponseProperty("Id");
+        this.active = this.getResponseProperty("Active");
+    }
+}
 
 ;// CONCATENATED MODULE: ../../libs/common/src/billing/models/response/organization-subscription.response.ts
 
@@ -519,6 +546,8 @@ class OrganizationSubscriptionResponse extends OrganizationResponse {
             upcomingInvoice == null
                 ? null
                 : new BillingSubscriptionUpcomingInvoiceResponse(upcomingInvoice);
+        const discount = this.getResponseProperty("Discount");
+        this.discount = discount == null ? null : new BillingCustomerDiscount(discount);
         this.expiration = this.getResponseProperty("Expiration");
         this.expirationWithoutGracePeriod = this.getResponseProperty("ExpirationWithoutGracePeriod");
         this.secretsManagerBeta = this.getResponseProperty("SecretsManagerBeta");
@@ -1530,9 +1559,9 @@ var ClientType;
     ClientType["Web"] = "web";
     ClientType["Browser"] = "browser";
     ClientType["Desktop"] = "desktop";
-    ClientType["Mobile"] = "mobile";
+    // Mobile = "mobile",
     ClientType["Cli"] = "cli";
-    ClientType["DirectoryConnector"] = "connector";
+    // DirectoryConnector = "connector",
 })(ClientType || (ClientType = {}));
 
 ;// CONCATENATED MODULE: ../../libs/common/src/enums/device-type.enum.ts
@@ -3308,6 +3337,96 @@ class ProviderService {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/auth/enums/authentication-status.ts
+var AuthenticationStatus;
+(function (AuthenticationStatus) {
+    AuthenticationStatus[AuthenticationStatus["LoggedOut"] = 0] = "LoggedOut";
+    AuthenticationStatus[AuthenticationStatus["Locked"] = 1] = "Locked";
+    AuthenticationStatus[AuthenticationStatus["Unlocked"] = 2] = "Unlocked";
+})(AuthenticationStatus || (AuthenticationStatus = {}));
+
+;// CONCATENATED MODULE: ../../libs/common/src/auth/services/account.service.ts
+var account_service_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+class AccountServiceImplementation {
+    constructor(messagingService, logService) {
+        this.messagingService = messagingService;
+        this.logService = logService;
+        this.accounts = new external_rxjs_namespaceObject.BehaviorSubject({});
+        this.activeAccountId = new external_rxjs_namespaceObject.BehaviorSubject(undefined);
+        this.lock = new external_rxjs_namespaceObject.Subject();
+        this.logout = new external_rxjs_namespaceObject.Subject();
+        this.accounts$ = this.accounts.asObservable();
+        this.activeAccount$ = this.activeAccountId.pipe((0,external_rxjs_namespaceObject.combineLatestWith)(this.accounts$), (0,external_rxjs_namespaceObject.map)(([id, accounts]) => (id ? Object.assign({ id }, accounts[id]) : undefined)), (0,external_rxjs_namespaceObject.distinctUntilChanged)(), (0,external_rxjs_namespaceObject.shareReplay)({ bufferSize: 1, refCount: false }));
+        this.accountLock$ = this.lock.asObservable();
+        this.accountLogout$ = this.logout.asObservable();
+    }
+    addAccount(userId, accountData) {
+        this.accounts.value[userId] = accountData;
+        this.accounts.next(this.accounts.value);
+    }
+    setAccountName(userId, name) {
+        this.setAccountInfo(userId, Object.assign(Object.assign({}, this.accounts.value[userId]), { name }));
+    }
+    setAccountEmail(userId, email) {
+        this.setAccountInfo(userId, Object.assign(Object.assign({}, this.accounts.value[userId]), { email }));
+    }
+    setAccountStatus(userId, status) {
+        this.setAccountInfo(userId, Object.assign(Object.assign({}, this.accounts.value[userId]), { status }));
+        if (status === AuthenticationStatus.LoggedOut) {
+            this.logout.next(userId);
+        }
+        else if (status === AuthenticationStatus.Locked) {
+            this.lock.next(userId);
+        }
+    }
+    switchAccount(userId) {
+        if (userId == null) {
+            // indicates no account is active
+            this.activeAccountId.next(undefined);
+            return;
+        }
+        if (this.accounts.value[userId] == null) {
+            throw new Error("Account does not exist");
+        }
+        this.activeAccountId.next(userId);
+    }
+    // TODO: update to use our own account status settings. Requires inverting direction of state service accounts flow
+    delete() {
+        var _a;
+        return account_service_awaiter(this, void 0, void 0, function* () {
+            try {
+                (_a = this.messagingService) === null || _a === void 0 ? void 0 : _a.send("logout");
+            }
+            catch (e) {
+                this.logService.error(e);
+                throw e;
+            }
+        });
+    }
+    setAccountInfo(userId, accountInfo) {
+        if (this.accounts.value[userId] == null) {
+            throw new Error("Account does not exist");
+        }
+        // Avoid unnecessary updates
+        // TODO: Faster comparison, maybe include a hash on the objects?
+        if (JSON.stringify(this.accounts.value[userId]) === JSON.stringify(accountInfo)) {
+            return;
+        }
+        this.accounts.value[userId] = accountInfo;
+        this.accounts.next(this.accounts.value);
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/platform/models/domain/symmetric-crypto-key.ts
 
 
@@ -3497,14 +3616,6 @@ class ErrorResponse extends BaseResponse {
     }
 }
 
-;// CONCATENATED MODULE: ../../libs/common/src/auth/enums/authentication-status.ts
-var AuthenticationStatus;
-(function (AuthenticationStatus) {
-    AuthenticationStatus[AuthenticationStatus["LoggedOut"] = 0] = "LoggedOut";
-    AuthenticationStatus[AuthenticationStatus["Locked"] = 1] = "Locked";
-    AuthenticationStatus[AuthenticationStatus["Unlocked"] = 2] = "Unlocked";
-})(AuthenticationStatus || (AuthenticationStatus = {}));
-
 ;// CONCATENATED MODULE: ../../libs/common/src/auth/enums/authentication-type.ts
 var authentication_type_AuthenticationType;
 (function (AuthenticationType) {
@@ -3515,6 +3626,10 @@ var authentication_type_AuthenticationType;
 })(authentication_type_AuthenticationType || (authentication_type_AuthenticationType = {}));
 
 ;// CONCATENATED MODULE: ../../libs/common/src/auth/models/domain/force-reset-password-reason.ts
+/*
+ * This enum is used to determine if a user should be forced to reset their password
+ * on login (server flag) or unlock via MP (client evaluation).
+ */
 var ForceResetPasswordReason;
 (function (ForceResetPasswordReason) {
     /**
@@ -3523,11 +3638,13 @@ var ForceResetPasswordReason;
     ForceResetPasswordReason[ForceResetPasswordReason["None"] = 0] = "None";
     /**
      * Occurs when an organization admin forces a user to reset their password.
+     * Communicated via server flag.
      */
     ForceResetPasswordReason[ForceResetPasswordReason["AdminForcePasswordReset"] = 1] = "AdminForcePasswordReset";
     /**
      * Occurs when a user logs in / unlocks their vault with a master password that does not meet an organization's
      * master password policy that is enforced on login/unlock.
+     * Only set client side b/c server can't evaluate MP.
      */
     ForceResetPasswordReason[ForceResetPasswordReason["WeakMasterPassword"] = 2] = "WeakMasterPassword";
 })(ForceResetPasswordReason || (ForceResetPasswordReason = {}));
@@ -4159,6 +4276,7 @@ var login_strategy_awaiter = (undefined && undefined.__awaiter) || function (thi
 
 
 
+
 class LogInStrategy {
     constructor(cryptoService, apiService, tokenService, appIdService, platformUtilsService, messagingService, logService, stateService, twoFactorService) {
         this.cryptoService = cryptoService;
@@ -4252,7 +4370,16 @@ class LogInStrategy {
     processTokenResponse(response) {
         return login_strategy_awaiter(this, void 0, void 0, function* () {
             const result = new AuthResult();
+            // Old encryption keys must be migrated, but is currently only available on web.
+            // Other clients shouldn't continue the login process.
+            if (this.encryptionKeyMigrationRequired(response)) {
+                result.requiresEncryptionKeyMigration = true;
+                if (this.platformUtilsService.getClientType() !== ClientType.Web) {
+                    return result;
+                }
+            }
             result.resetMasterPassword = response.resetMasterPassword;
+            // Convert boolean to enum
             if (response.forcePasswordReset) {
                 result.forcePasswordReset = ForceResetPasswordReason.AdminForcePasswordReset;
             }
@@ -4268,6 +4395,11 @@ class LogInStrategy {
             return result;
         });
     }
+    // Old accounts used master key for encryption. We are forcing migrations but only need to
+    // check on password logins
+    encryptionKeyMigrationRequired(response) {
+        return false;
+    }
     createKeyPairForOldAccount() {
         return login_strategy_awaiter(this, void 0, void 0, function* () {
             try {
@@ -4390,6 +4522,10 @@ class PasswordLogInStrategy extends LogInStrategy {
     }
     setUserKey(response) {
         return password_login_strategy_awaiter(this, void 0, void 0, function* () {
+            // If migration is required, we won't have a user key to set yet.
+            if (this.encryptionKeyMigrationRequired(response)) {
+                return;
+            }
             yield this.cryptoService.setMasterKeyEncryptedUserKey(response.key);
             const masterKey = yield this.cryptoService.getMasterKey();
             if (masterKey) {
@@ -4404,6 +4540,9 @@ class PasswordLogInStrategy extends LogInStrategy {
             yield this.cryptoService.setPrivateKey((_a = response.privateKey) !== null && _a !== void 0 ? _a : (yield this.createKeyPairForOldAccount()));
         });
     }
+    encryptionKeyMigrationRequired(response) {
+        return !response.key;
+    }
     getMasterPasswordPolicyOptionsFromResponse(response) {
         if (response == null || response instanceof IdentityCaptchaResponse) {
             return null;
@@ -4536,6 +4675,7 @@ var sso_login_strategy_awaiter = (undefined && undefined.__awaiter) || function
 
 
 
+
 class SsoLogInStrategy extends LogInStrategy {
     constructor(cryptoService, apiService, tokenService, appIdService, platformUtilsService, messagingService, logService, stateService, twoFactorService, keyConnectorService, deviceTrustCryptoService, authReqCryptoService, i18nService) {
         super(cryptoService, apiService, tokenService, appIdService, platformUtilsService, messagingService, logService, stateService, twoFactorService);
@@ -4551,6 +4691,10 @@ class SsoLogInStrategy extends LogInStrategy {
             const [ssoAuthResult] = yield this.startLogIn();
             this.email = ssoAuthResult.email;
             this.ssoEmail2FaSessionToken = ssoAuthResult.ssoEmail2FaSessionToken;
+            // Auth guard currently handles redirects for this.
+            if (ssoAuthResult.forcePasswordReset == ForceResetPasswordReason.AdminForcePasswordReset) {
+                yield this.stateService.setForcePasswordResetReason(ssoAuthResult.forcePasswordReset);
+            }
             return ssoAuthResult;
         });
     }
@@ -5214,7 +5358,7 @@ class DeviceTrustCryptoService {
     }
 }
 
-;// CONCATENATED MODULE: ../../libs/common/src/abstractions/devices/responses/device.response.ts
+;// CONCATENATED MODULE: ../../libs/common/src/auth/abstractions/devices/responses/device.response.ts
 
 class DeviceResponse extends BaseResponse {
     constructor(response) {
@@ -5229,15 +5373,6 @@ class DeviceResponse extends BaseResponse {
     }
 }
 
-;// CONCATENATED MODULE: ../../libs/common/src/services/devices/requests/trusted-device-keys.request.ts
-class TrustedDeviceKeysRequest {
-    constructor(encryptedUserKey, encryptedPublicKey, encryptedPrivateKey) {
-        this.encryptedUserKey = encryptedUserKey;
-        this.encryptedPublicKey = encryptedPublicKey;
-        this.encryptedPrivateKey = encryptedPrivateKey;
-    }
-}
-
 ;// CONCATENATED MODULE: ../../libs/common/src/auth/models/response/protected-device.response.ts
 
 
@@ -5258,6 +5393,15 @@ class ProtectedDeviceResponse extends BaseResponse {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/auth/services/devices/requests/trusted-device-keys.request.ts
+class TrustedDeviceKeysRequest {
+    constructor(encryptedUserKey, encryptedPublicKey, encryptedPrivateKey) {
+        this.encryptedUserKey = encryptedUserKey;
+        this.encryptedPublicKey = encryptedPublicKey;
+        this.encryptedPrivateKey = encryptedPrivateKey;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/auth/services/devices-api.service.implementation.ts
 var devices_api_service_implementation_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
@@ -14159,6 +14303,11 @@ class CryptoService {
             }
         });
     }
+    isLegacyUser(masterKey, userId) {
+        return crypto_service_awaiter(this, void 0, void 0, function* () {
+            return yield this.validateUserKey((masterKey !== null && masterKey !== void 0 ? masterKey : (yield this.getMasterKey(userId))));
+        });
+    }
     getUserKeyWithLegacySupport(userId) {
         return crypto_service_awaiter(this, void 0, void 0, function* () {
             const userKey = yield this.getUserKey(userId);
@@ -14546,7 +14695,8 @@ class CryptoService {
     }
     makeKeyPair(key) {
         return crypto_service_awaiter(this, void 0, void 0, function* () {
-            key || (key = yield this.getUserKey());
+            // Default to user key
+            key || (key = yield this.getUserKeyWithLegacySupport());
             const keyPair = yield this.cryptoFunctionService.rsaGenerateKeyPair(2048);
             const publicB64 = utils_Utils.fromBufferToB64(keyPair[0]);
             const privateEnc = yield this.encryptService.encrypt(keyPair[1], key);
@@ -14949,19 +15099,26 @@ class CryptoService {
     migrateAutoKeyIfNeeded(userId) {
         return crypto_service_awaiter(this, void 0, void 0, function* () {
             const oldAutoKey = yield this.stateService.getCryptoMasterKeyAuto({ userId: userId });
-            if (oldAutoKey) {
-                // decrypt
-                const masterKey = new SymmetricCryptoKey(utils_Utils.fromB64ToArray(oldAutoKey));
-                const encryptedUserKey = yield this.stateService.getEncryptedCryptoSymmetricKey({
-                    userId: userId,
-                });
-                const userKey = yield this.decryptUserKeyWithMasterKey(masterKey, new EncString(encryptedUserKey), userId);
-                // migrate
-                yield this.stateService.setUserKeyAutoUnlock(userKey.keyB64, { userId: userId });
-                yield this.stateService.setCryptoMasterKeyAuto(null, { userId: userId });
-                // set encrypted user key in case user immediately locks without syncing
-                yield this.setMasterKeyEncryptedUserKey(encryptedUserKey);
+            if (!oldAutoKey) {
+                return;
             }
+            // Decrypt
+            const masterKey = new SymmetricCryptoKey(utils_Utils.fromB64ToArray(oldAutoKey));
+            if (yield this.isLegacyUser(masterKey, userId)) {
+                // Legacy users don't have a user key, so no need to migrate.
+                // Instead, set the master key for additional isLegacyUser checks that will log the user out.
+                yield this.setMasterKey(masterKey, userId);
+                return;
+            }
+            const encryptedUserKey = yield this.stateService.getEncryptedCryptoSymmetricKey({
+                userId: userId,
+            });
+            const userKey = yield this.decryptUserKeyWithMasterKey(masterKey, new EncString(encryptedUserKey), userId);
+            // Migrate
+            yield this.stateService.setUserKeyAutoUnlock(userKey.keyB64, { userId: userId });
+            yield this.stateService.setCryptoMasterKeyAuto(null, { userId: userId });
+            // Set encrypted user key in case user immediately locks without syncing
+            yield this.setMasterKeyEncryptedUserKey(encryptedUserKey);
         });
     }
     decryptAndMigrateOldPinKey(masterPasswordOnRestart, pin, email, kdf, kdfConfig, oldPinKey) {
@@ -15219,7 +15376,7 @@ class EncryptServiceImplementation {
                     return null;
                 }
             }
-            return yield this.cryptoFunctionService.aesDecryptFast(fastParams);
+            return yield this.cryptoFunctionService.aesDecryptFast(fastParams, "cbc");
         });
     }
     decryptToBytes(encThing, key) {
@@ -15251,7 +15408,7 @@ class EncryptServiceImplementation {
                     return null;
                 }
             }
-            const result = yield this.cryptoFunctionService.aesDecrypt(encThing.dataBytes, encThing.ivBytes, key.encKey);
+            const result = yield this.cryptoFunctionService.aesDecrypt(encThing.dataBytes, encThing.ivBytes, key.encKey, "cbc");
             return result !== null && result !== void 0 ? result : null;
         });
     }
@@ -17348,6 +17505,27 @@ class IdentityData {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/vault/models/data/fido2-credential.data.ts
+class Fido2CredentialData {
+    constructor(data) {
+        if (data == null) {
+            return;
+        }
+        this.credentialId = data.credentialId;
+        this.keyType = data.keyType;
+        this.keyAlgorithm = data.keyAlgorithm;
+        this.keyCurve = data.keyCurve;
+        this.keyValue = data.keyValue;
+        this.rpId = data.rpId;
+        this.userHandle = data.userHandle;
+        this.counter = data.counter;
+        this.rpName = data.rpName;
+        this.userDisplayName = data.userDisplayName;
+        this.discoverable = data.discoverable;
+        this.creationDate = data.creationDate;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/data/login-uri.data.ts
 class LoginUriData {
     constructor(data) {
@@ -17362,8 +17540,10 @@ class LoginUriData {
 
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/data/login.data.ts
 
+
 class LoginData {
     constructor(data) {
+        var _a;
         if (data == null) {
             return;
         }
@@ -17375,6 +17555,9 @@ class LoginData {
         if (data.uris) {
             this.uris = data.uris.map((u) => new LoginUriData(u));
         }
+        if (data.fido2Credentials) {
+            this.fido2Credentials = (_a = data.fido2Credentials) === null || _a === void 0 ? void 0 : _a.map((key) => new Fido2CredentialData(key));
+        }
     }
 }
 
@@ -17465,6 +17648,7 @@ class CollectionData {
         this.name = response.name;
         this.externalId = response.externalId;
         this.readOnly = response.readOnly;
+        this.hidePasswords = response.hidePasswords;
     }
 }
 
@@ -17933,6 +18117,24 @@ identity_view_decorate([
     identity_view_metadata("design:paramtypes", [])
 ], IdentityView.prototype, "fullName", null);
 
+;// CONCATENATED MODULE: ../../libs/common/src/vault/models/view/fido2-credential.view.ts
+
+class Fido2CredentialView extends ItemView {
+    constructor() {
+        super(...arguments);
+        this.creationDate = null;
+    }
+    get subTitle() {
+        return this.userDisplayName;
+    }
+    static fromJSON(obj) {
+        const creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null;
+        return Object.assign(new Fido2CredentialView(), obj, {
+            creationDate,
+        });
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/view/login-uri.view.ts
 
 
@@ -18104,6 +18306,7 @@ var login_view_metadata = (undefined && undefined.__metadata) || function (k, v)
 
 
 
+
 class LoginView extends ItemView {
     constructor(l) {
         super();
@@ -18113,6 +18316,7 @@ class LoginView extends ItemView {
         this.totp = null;
         this.uris = null;
         this.autofillOnPageLoad = null;
+        this.fido2Credentials = null;
         if (!l) {
             return;
         }
@@ -18146,6 +18350,9 @@ class LoginView extends ItemView {
     get hasUris() {
         return this.uris != null && this.uris.length > 0;
     }
+    get hasFido2Credentials() {
+        return this.fido2Credentials != null && this.fido2Credentials.length > 0;
+    }
     matchesUri(targetUri, equivalentDomains, defaultUriMatch = null) {
         if (this.uris == null) {
             return false;
@@ -18153,12 +18360,14 @@ class LoginView extends ItemView {
         return this.uris.some((uri) => uri.matchesUri(targetUri, equivalentDomains, defaultUriMatch));
     }
     static fromJSON(obj) {
-        var _a;
+        var _a, _b;
         const passwordRevisionDate = obj.passwordRevisionDate == null ? null : new Date(obj.passwordRevisionDate);
         const uris = (_a = obj.uris) === null || _a === void 0 ? void 0 : _a.map((uri) => LoginUriView.fromJSON(uri));
+        const fido2Credentials = (_b = obj.fido2Credentials) === null || _b === void 0 ? void 0 : _b.map((key) => Fido2CredentialView.fromJSON(key));
         return Object.assign(new LoginView(), obj, {
-            passwordRevisionDate: passwordRevisionDate,
-            uris: uris,
+            passwordRevisionDate,
+            uris,
+            fido2Credentials,
         });
     }
 }
@@ -18398,6 +18607,7 @@ class CollectionView {
         this.organizationId = null;
         this.name = null;
         this.externalId = null;
+        // readOnly applies to the items within a collection
         this.readOnly = null;
         this.hidePasswords = null;
         if (!c) {
@@ -18411,6 +18621,20 @@ class CollectionView {
             this.hidePasswords = c.hidePasswords;
         }
     }
+    // For editing collection details, not the items within it.
+    canEdit(org) {
+        if (org.id !== this.organizationId) {
+            throw new Error("Id of the organization provided does not match the org id of the collection.");
+        }
+        return (org === null || org === void 0 ? void 0 : org.canEditAnyCollection) || (org === null || org === void 0 ? void 0 : org.canEditAssignedCollections);
+    }
+    // For deleting a collection, not the items within it.
+    canDelete(org) {
+        if (org.id !== this.organizationId) {
+            throw new Error("Id of the organization provided does not match the org id of the collection.");
+        }
+        return (org === null || org === void 0 ? void 0 : org.canDeleteAnyCollection) || (org === null || org === void 0 ? void 0 : org.canDeleteAssignedCollections);
+    }
 }
 
 ;// CONCATENATED MODULE: ../../libs/common/src/platform/models/domain/state.ts
@@ -18485,6 +18709,7 @@ var state_service_awaiter = (undefined && undefined.__awaiter) || function (this
 
 
 
+
 
 
 const keys = {
@@ -18505,12 +18730,13 @@ const partialKeys = {
 };
 const DDG_SHARED_KEY = "DuckDuckGoSharedKey";
 class StateService {
-    constructor(storageService, secureStorageService, memoryStorageService, logService, stateFactory, useAccountCache = true) {
+    constructor(storageService, secureStorageService, memoryStorageService, logService, stateFactory, accountService, useAccountCache = true) {
         this.storageService = storageService;
         this.secureStorageService = secureStorageService;
         this.memoryStorageService = memoryStorageService;
         this.logService = logService;
         this.stateFactory = stateFactory;
+        this.accountService = accountService;
         this.useAccountCache = useAccountCache;
         this.accountsSubject = new external_rxjs_namespaceObject.BehaviorSubject({});
         this.accounts$ = this.accountsSubject.asObservable();
@@ -18577,6 +18803,19 @@ class StateService {
                 }
                 yield this.pushAccounts();
                 this.activeAccountSubject.next(state.activeUserId);
+                // TODO: Temporary update to avoid routing all account status changes through account service for now.
+                // account service tracks logged out accounts, but State service does not, so we need to add the active account
+                // if it's not in the accounts list.
+                if (state.activeUserId != null && this.accountsSubject.value[state.activeUserId] == null) {
+                    const activeDiskAccount = yield this.getAccountFromDisk({ userId: state.activeUserId });
+                    this.accountService.addAccount(state.activeUserId, {
+                        name: activeDiskAccount.profile.name,
+                        email: activeDiskAccount.profile.email,
+                        status: AuthenticationStatus.LoggedOut,
+                    });
+                }
+                this.accountService.switchAccount(state.activeUserId);
+                // End TODO
                 return state;
             }));
         });
@@ -18593,6 +18832,12 @@ class StateService {
                 state.accounts[userId] = this.createAccount();
                 const diskAccount = yield this.getAccountFromDisk({ userId: userId });
                 state.accounts[userId].profile = diskAccount.profile;
+                // TODO: Temporary update to avoid routing all account status changes through account service for now.
+                this.accountService.addAccount(userId, {
+                    status: AuthenticationStatus.Locked,
+                    name: diskAccount.profile.name,
+                    email: diskAccount.profile.email,
+                });
                 return state;
             }));
         });
@@ -18608,6 +18853,12 @@ class StateService {
             }));
             yield this.scaffoldNewAccountStorage(account);
             yield this.setLastActive(new Date().getTime(), { userId: account.profile.userId });
+            // TODO: Temporary update to avoid routing all account status changes through account service for now.
+            this.accountService.addAccount(account.profile.userId, {
+                status: AuthenticationStatus.Locked,
+                name: account.profile.name,
+                email: account.profile.email,
+            });
             yield this.setActiveUser(account.profile.userId);
             this.activeAccountSubject.next(account.profile.userId);
         });
@@ -18619,6 +18870,8 @@ class StateService {
                 state.activeUserId = userId;
                 yield this.storageService.save(keys.activeUserId, userId);
                 this.activeAccountSubject.next(state.activeUserId);
+                // TODO: temporary update to avoid routing all account status changes through account service for now.
+                this.accountService.switchAccount(userId);
                 return state;
             }));
             yield this.pushAccounts();
@@ -18895,6 +19148,8 @@ class StateService {
             const account = yield this.getAccount(this.reconcileOptions(options, yield this.defaultInMemoryOptions()));
             account.keys.cryptoMasterKey = value;
             yield this.saveAccount(account, this.reconcileOptions(options, yield this.defaultInMemoryOptions()));
+            const nextStatus = value != null ? AuthenticationStatus.Unlocked : AuthenticationStatus.Locked;
+            this.accountService.setAccountStatus(options.userId, nextStatus);
             if (options.userId == this.activeAccountSubject.getValue()) {
                 const nextValue = value != null;
                 // Avoid emitting if we are already unlocked
@@ -18922,6 +19177,8 @@ class StateService {
             const account = yield this.getAccount(this.reconcileOptions(options, yield this.defaultInMemoryOptions()));
             account.keys.userKey = value;
             yield this.saveAccount(account, this.reconcileOptions(options, yield this.defaultInMemoryOptions()));
+            const nextStatus = value != null ? AuthenticationStatus.Unlocked : AuthenticationStatus.Locked;
+            this.accountService.setAccountStatus(options.userId, nextStatus);
             if ((options === null || options === void 0 ? void 0 : options.userId) == this.activeAccountSubject.getValue()) {
                 const nextValue = value != null;
                 // Avoid emitting if we are already unlocked
@@ -20771,7 +21028,6 @@ class StateService {
             yield this.saveAccount(account, this.reconcileOptions({ userId: account.profile.userId }, yield this.defaultOnDiskOptions()));
         });
     }
-    //
     pushAccounts() {
         return state_service_awaiter(this, void 0, void 0, function* () {
             yield this.pruneInMemoryAccounts();
@@ -20890,6 +21146,8 @@ class StateService {
                 this.deleteDiskCache(userId);
                 return state;
             }));
+            // TODO: Invert this logic, we should remove accounts based on logged out emit
+            this.accountService.setAccountStatus(userId, AuthenticationStatus.LoggedOut);
         });
     }
     pruneInMemoryAccounts() {
@@ -22236,6 +22494,7 @@ var vault_timeout_service_awaiter = (undefined && undefined.__awaiter) || functi
 
 
 
+
 class VaultTimeoutService {
     constructor(cipherService, folderService, collectionService, cryptoService, platformUtilsService, messagingService, searchService, stateService, authService, vaultTimeoutSettingsService, lockedCallback = null, loggedOutCallback = null) {
         this.cipherService = cipherService;
@@ -22349,10 +22608,18 @@ class VaultTimeoutService {
     }
     migrateKeyForNeverLockIfNeeded() {
         return vault_timeout_service_awaiter(this, void 0, void 0, function* () {
+            // Web can't set vault timeout to never
+            if (this.platformUtilsService.getClientType() == ClientType.Web) {
+                return;
+            }
             const accounts = yield (0,external_rxjs_namespaceObject.firstValueFrom)(this.stateService.accounts$);
             for (const userId in accounts) {
                 if (userId != null) {
                     yield this.cryptoService.migrateAutoKeyIfNeeded(userId);
+                    // Legacy users should be logged out since we're not on the web vault and can't migrate.
+                    if (yield this.cryptoService.isLegacyUser(null, userId)) {
+                        yield this.logOut(userId);
+                    }
                 }
             }
         });
@@ -23548,6 +23815,120 @@ class Identity extends Domain {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/vault/models/domain/fido2-credential.ts
+var fido2_credential_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+
+
+
+
+class Fido2Credential extends Domain {
+    constructor(obj) {
+        super();
+        this.credentialId = null;
+        if (obj == null) {
+            return;
+        }
+        this.buildDomainModel(this, obj, {
+            credentialId: null,
+            keyType: null,
+            keyAlgorithm: null,
+            keyCurve: null,
+            keyValue: null,
+            rpId: null,
+            userHandle: null,
+            counter: null,
+            rpName: null,
+            userDisplayName: null,
+            discoverable: null,
+        }, []);
+        this.creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null;
+    }
+    decrypt(orgId, encKey) {
+        return fido2_credential_awaiter(this, void 0, void 0, function* () {
+            const view = yield this.decryptObj(new Fido2CredentialView(), {
+                credentialId: null,
+                keyType: null,
+                keyAlgorithm: null,
+                keyCurve: null,
+                keyValue: null,
+                rpId: null,
+                userHandle: null,
+                rpName: null,
+                userDisplayName: null,
+                discoverable: null,
+            }, orgId, encKey);
+            const { counter } = yield this.decryptObj({ counter: "" }, {
+                counter: null,
+            }, orgId, encKey);
+            // Counter will end up as NaN if this fails
+            view.counter = parseInt(counter);
+            const { discoverable } = yield this.decryptObj({ discoverable: "" }, {
+                discoverable: null,
+            }, orgId, encKey);
+            view.discoverable = discoverable === "true";
+            view.creationDate = this.creationDate;
+            return view;
+        });
+    }
+    toFido2CredentialData() {
+        const i = new Fido2CredentialData();
+        i.creationDate = this.creationDate.toISOString();
+        this.buildDataModel(this, i, {
+            credentialId: null,
+            keyType: null,
+            keyAlgorithm: null,
+            keyCurve: null,
+            keyValue: null,
+            rpId: null,
+            userHandle: null,
+            counter: null,
+            rpName: null,
+            userDisplayName: null,
+            discoverable: null,
+        });
+        return i;
+    }
+    static fromJSON(obj) {
+        if (obj == null) {
+            return null;
+        }
+        const credentialId = EncString.fromJSON(obj.credentialId);
+        const keyType = EncString.fromJSON(obj.keyType);
+        const keyAlgorithm = EncString.fromJSON(obj.keyAlgorithm);
+        const keyCurve = EncString.fromJSON(obj.keyCurve);
+        const keyValue = EncString.fromJSON(obj.keyValue);
+        const rpId = EncString.fromJSON(obj.rpId);
+        const userHandle = EncString.fromJSON(obj.userHandle);
+        const counter = EncString.fromJSON(obj.counter);
+        const rpName = EncString.fromJSON(obj.rpName);
+        const userDisplayName = EncString.fromJSON(obj.userDisplayName);
+        const discoverable = EncString.fromJSON(obj.discoverable);
+        const creationDate = obj.creationDate != null ? new Date(obj.creationDate) : null;
+        return Object.assign(new Fido2Credential(), obj, {
+            credentialId,
+            keyType,
+            keyAlgorithm,
+            keyCurve,
+            keyValue,
+            rpId,
+            userHandle,
+            counter,
+            rpName,
+            userDisplayName,
+            discoverable,
+            creationDate,
+        });
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/vault/models/domain/login-uri.ts
 
 
@@ -23603,6 +23984,7 @@ var login_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar
 
 
 
+
 class Login extends Domain {
     constructor(obj) {
         super();
@@ -23623,6 +24005,9 @@ class Login extends Domain {
                 this.uris.push(new LoginUri(u));
             });
         }
+        if (obj.fido2Credentials) {
+            this.fido2Credentials = obj.fido2Credentials.map((key) => new Fido2Credential(key));
+        }
     }
     decrypt(orgId, encKey) {
         return login_awaiter(this, void 0, void 0, function* () {
@@ -23638,6 +24023,9 @@ class Login extends Domain {
                     view.uris.push(uri);
                 }
             }
+            if (this.fido2Credentials != null) {
+                view.fido2Credentials = yield Promise.all(this.fido2Credentials.map((key) => key.decrypt(orgId, encKey)));
+            }
             return view;
         });
     }
@@ -23657,10 +24045,13 @@ class Login extends Domain {
                 l.uris.push(u.toLoginUriData());
             });
         }
+        if (this.fido2Credentials != null && this.fido2Credentials.length > 0) {
+            l.fido2Credentials = this.fido2Credentials.map((key) => key.toFido2CredentialData());
+        }
         return l;
     }
     static fromJSON(obj) {
-        var _a;
+        var _a, _b, _c;
         if (obj == null) {
             return null;
         }
@@ -23669,12 +24060,14 @@ class Login extends Domain {
         const totp = EncString.fromJSON(obj.totp);
         const passwordRevisionDate = obj.passwordRevisionDate == null ? null : new Date(obj.passwordRevisionDate);
         const uris = (_a = obj.uris) === null || _a === void 0 ? void 0 : _a.map((uri) => LoginUri.fromJSON(uri));
+        const fido2Credentials = (_c = (_b = obj.fido2Credentials) === null || _b === void 0 ? void 0 : _b.map((key) => Fido2Credential.fromJSON(key))) !== null && _c !== void 0 ? _c : [];
         return Object.assign(new Login(), obj, {
             username,
             password,
             totp,
-            passwordRevisionDate: passwordRevisionDate,
-            uris: uris,
+            passwordRevisionDate,
+            uris,
+            fido2Credentials,
         });
     }
 }
@@ -24173,9 +24566,33 @@ class LoginUriApi extends BaseResponse {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/vault/api/fido2-credential.api.ts
+
+class Fido2CredentialApi extends BaseResponse {
+    constructor(data = null) {
+        super(data);
+        if (data == null) {
+            return;
+        }
+        this.credentialId = this.getResponseProperty("CredentialId");
+        this.keyType = this.getResponseProperty("KeyType");
+        this.keyAlgorithm = this.getResponseProperty("KeyAlgorithm");
+        this.keyCurve = this.getResponseProperty("KeyCurve");
+        this.keyValue = this.getResponseProperty("keyValue");
+        this.rpId = this.getResponseProperty("RpId");
+        this.userHandle = this.getResponseProperty("UserHandle");
+        this.counter = this.getResponseProperty("Counter");
+        this.rpName = this.getResponseProperty("RpName");
+        this.userDisplayName = this.getResponseProperty("UserDisplayName");
+        this.discoverable = this.getResponseProperty("Discoverable");
+        this.creationDate = this.getResponseProperty("CreationDate");
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/models/api/login.api.ts
 
 
+
 class LoginApi extends BaseResponse {
     constructor(data = null) {
         super(data);
@@ -24191,6 +24608,10 @@ class LoginApi extends BaseResponse {
         if (uris != null) {
             this.uris = uris.map((u) => new LoginUriApi(u));
         }
+        const fido2Credentials = this.getResponseProperty("Fido2Credentials");
+        if (fido2Credentials != null) {
+            this.fido2Credentials = fido2Credentials.map((key) => new Fido2CredentialApi(key));
+        }
     }
 }
 
@@ -24219,6 +24640,7 @@ class AttachmentRequest {
 
 
 
+
 class CipherRequest {
     constructor(cipher) {
         var _a;
@@ -24251,6 +24673,30 @@ class CipherRequest {
                         return uri;
                     });
                 }
+                if (cipher.login.fido2Credentials != null) {
+                    this.login.fido2Credentials = cipher.login.fido2Credentials.map((key) => {
+                        const keyApi = new Fido2CredentialApi();
+                        keyApi.credentialId =
+                            key.credentialId != null ? key.credentialId.encryptedString : null;
+                        keyApi.keyType =
+                            key.keyType != null ? key.keyType.encryptedString : null;
+                        keyApi.keyAlgorithm =
+                            key.keyAlgorithm != null ? key.keyAlgorithm.encryptedString : null;
+                        keyApi.keyCurve =
+                            key.keyCurve != null ? key.keyCurve.encryptedString : null;
+                        keyApi.keyValue = key.keyValue != null ? key.keyValue.encryptedString : null;
+                        keyApi.rpId = key.rpId != null ? key.rpId.encryptedString : null;
+                        keyApi.rpName = key.rpName != null ? key.rpName.encryptedString : null;
+                        keyApi.counter = key.counter != null ? key.counter.encryptedString : null;
+                        keyApi.userHandle = key.userHandle != null ? key.userHandle.encryptedString : null;
+                        keyApi.userDisplayName =
+                            key.userDisplayName != null ? key.userDisplayName.encryptedString : null;
+                        keyApi.discoverable =
+                            key.discoverable != null ? key.discoverable.encryptedString : null;
+                        keyApi.creationDate = key.creationDate != null ? key.creationDate.toISOString() : null;
+                        return keyApi;
+                    });
+                }
                 break;
             case CipherType.SecureNote:
                 this.secureNote = new SecureNoteApi();
@@ -24453,6 +24899,7 @@ var cipher_service_awaiter = (undefined && undefined.__awaiter) || function (thi
 
 
 
+
 
 
 const CIPHER_KEY_ENC_MIN_SERVER_VER = new external_semver_namespaceObject.SemVer("2023.9.1");
@@ -24653,10 +25100,6 @@ class CipherService {
                 yield this.reindexCiphers();
                 return yield this.getDecryptedCipherCache();
             }
-            const hasKey = yield this.cryptoService.hasUserKey();
-            if (!hasKey) {
-                throw new Error("No user key found.");
-            }
             const ciphers = yield this.getAll();
             const orgKeys = yield this.cryptoService.getOrgKeys();
             const userKey = yield this.cryptoService.getUserKeyWithLegacySupport();
@@ -24713,13 +25156,16 @@ class CipherService {
             const ciphers = yield this.getAllDecrypted();
             defaultMatch !== null && defaultMatch !== void 0 ? defaultMatch : (defaultMatch = yield this.stateService.getDefaultUriMatch());
             return ciphers.filter((cipher) => {
-                if (cipher.deletedDate != null) {
+                const cipherIsLogin = cipher.type === CipherType.Login && cipher.login !== null;
+                if (cipher.deletedDate !== null) {
                     return false;
                 }
-                if (includeOtherTypes != null && includeOtherTypes.indexOf(cipher.type) > -1) {
+                if (Array.isArray(includeOtherTypes) &&
+                    includeOtherTypes.includes(cipher.type) &&
+                    !cipherIsLogin) {
                     return true;
                 }
-                if (cipher.type === CipherType.Login && cipher.login !== null) {
+                if (cipherIsLogin) {
                     return cipher.login.matchesUri(url, equivalentDomains, defaultMatch);
                 }
                 return false;
@@ -25388,6 +25834,27 @@ class CipherService {
                             cipher.login.uris.push(loginUri);
                         }
                     }
+                    if (model.login.fido2Credentials != null) {
+                        cipher.login.fido2Credentials = yield Promise.all(model.login.fido2Credentials.map((viewKey) => cipher_service_awaiter(this, void 0, void 0, function* () {
+                            const domainKey = new Fido2Credential();
+                            yield this.encryptObjProperty(viewKey, domainKey, {
+                                credentialId: null,
+                                keyType: null,
+                                keyAlgorithm: null,
+                                keyCurve: null,
+                                keyValue: null,
+                                rpId: null,
+                                rpName: null,
+                                userHandle: null,
+                                userDisplayName: null,
+                                origin: null,
+                            }, key);
+                            domainKey.counter = yield this.cryptoService.encrypt(String(viewKey.counter), key);
+                            domainKey.discoverable = yield this.cryptoService.encrypt(String(viewKey.discoverable), key);
+                            domainKey.creationDate = viewKey.creationDate;
+                            return domainKey;
+                        })));
+                    }
                     return;
                 case CipherType.SecureNote:
                     cipher.secureNote = new SecureNote();
@@ -26932,6 +27399,117 @@ class IdentityExport {
     }
 }
 
+;// CONCATENATED MODULE: ../../libs/common/src/models/export/fido2-credential.export.ts
+
+
+
+/**
+ * Represents format of Fido2 Credentials in JSON exports.
+ */
+class Fido2CredentialExport {
+    /**
+     * Generates a template for Fido2CredentialExport
+     * @returns Instance of Fido2CredentialExport with predefined values.
+     */
+    static template() {
+        const req = new Fido2CredentialExport();
+        req.credentialId = "keyId";
+        req.keyType = "keyType";
+        req.keyAlgorithm = "keyAlgorithm";
+        req.keyCurve = "keyCurve";
+        req.keyValue = "keyValue";
+        req.rpId = "rpId";
+        req.userHandle = "userHandle";
+        req.counter = "counter";
+        req.rpName = "rpName";
+        req.userDisplayName = "userDisplayName";
+        req.discoverable = "false";
+        req.creationDate = null;
+        return req;
+    }
+    /**
+     * Converts a Fido2CredentialExport object to its view representation.
+     * @param req - The Fido2CredentialExport object to be converted.
+     * @param view - (Optional) The Fido2CredentialView object to popualte with Fido2CredentialExport data
+     * @returns Fido2CredentialView - The populated view, or a new instance if none was provided.
+     */
+    static toView(req, view = new Fido2CredentialView()) {
+        view.credentialId = req.credentialId;
+        view.keyType = req.keyType;
+        view.keyAlgorithm = req.keyAlgorithm;
+        view.keyCurve = req.keyCurve;
+        view.keyValue = req.keyValue;
+        view.rpId = req.rpId;
+        view.userHandle = req.userHandle;
+        view.counter = parseInt(req.counter);
+        view.rpName = req.rpName;
+        view.userDisplayName = req.userDisplayName;
+        view.discoverable = req.discoverable === "true";
+        view.creationDate = new Date(req.creationDate);
+        return view;
+    }
+    /**
+     * Converts a Fido2CredentialExport object to its domain representation.
+     * @param req - The Fido2CredentialExport object to be converted.
+     * @param domain - (Optional) The Fido2Credential object to popualte with Fido2CredentialExport data
+     * @returns Fido2Credential - The populated domain, or a new instance if none was provided.
+     */
+    static toDomain(req, domain = new Fido2Credential()) {
+        domain.credentialId = req.credentialId != null ? new EncString(req.credentialId) : null;
+        domain.keyType = req.keyType != null ? new EncString(req.keyType) : null;
+        domain.keyAlgorithm = req.keyAlgorithm != null ? new EncString(req.keyAlgorithm) : null;
+        domain.keyCurve = req.keyCurve != null ? new EncString(req.keyCurve) : null;
+        domain.keyValue = req.keyValue != null ? new EncString(req.keyValue) : null;
+        domain.rpId = req.rpId != null ? new EncString(req.rpId) : null;
+        domain.userHandle = req.userHandle != null ? new EncString(req.userHandle) : null;
+        domain.counter = req.counter != null ? new EncString(req.counter) : null;
+        domain.rpName = req.rpName != null ? new EncString(req.rpName) : null;
+        domain.userDisplayName =
+            req.userDisplayName != null ? new EncString(req.userDisplayName) : null;
+        domain.discoverable = req.discoverable != null ? new EncString(req.discoverable) : null;
+        domain.creationDate = req.creationDate;
+        return domain;
+    }
+    /**
+     * Constructs a new Fid2CredentialExport instance.
+     *
+     * @param o - The credential storing the data being exported. When not provided, an empty export is created instead.
+     */
+    constructor(o) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        if (o == null) {
+            return;
+        }
+        if (o instanceof Fido2CredentialView) {
+            this.credentialId = o.credentialId;
+            this.keyType = o.keyType;
+            this.keyAlgorithm = o.keyAlgorithm;
+            this.keyCurve = o.keyCurve;
+            this.keyValue = o.keyValue;
+            this.rpId = o.rpId;
+            this.userHandle = o.userHandle;
+            this.counter = String(o.counter);
+            this.rpName = o.rpName;
+            this.userDisplayName = o.userDisplayName;
+            this.discoverable = String(o.discoverable);
+        }
+        else {
+            this.credentialId = (_a = o.credentialId) === null || _a === void 0 ? void 0 : _a.encryptedString;
+            this.keyType = (_b = o.keyType) === null || _b === void 0 ? void 0 : _b.encryptedString;
+            this.keyAlgorithm = (_c = o.keyAlgorithm) === null || _c === void 0 ? void 0 : _c.encryptedString;
+            this.keyCurve = (_d = o.keyCurve) === null || _d === void 0 ? void 0 : _d.encryptedString;
+            this.keyValue = (_e = o.keyValue) === null || _e === void 0 ? void 0 : _e.encryptedString;
+            this.rpId = (_f = o.rpId) === null || _f === void 0 ? void 0 : _f.encryptedString;
+            this.userHandle = (_g = o.userHandle) === null || _g === void 0 ? void 0 : _g.encryptedString;
+            this.counter = (_h = o.counter) === null || _h === void 0 ? void 0 : _h.encryptedString;
+            this.rpName = (_j = o.rpName) === null || _j === void 0 ? void 0 : _j.encryptedString;
+            this.userDisplayName = (_k = o.userDisplayName) === null || _k === void 0 ? void 0 : _k.encryptedString;
+            this.discoverable = (_l = o.discoverable) === null || _l === void 0 ? void 0 : _l.encryptedString;
+        }
+        this.creationDate = o.creationDate;
+    }
+}
+
 ;// CONCATENATED MODULE: ../../libs/common/src/models/export/login-uri.export.ts
 
 
@@ -26974,6 +27552,7 @@ class LoginUriExport {
 
 
 
+
 class LoginExport {
     static template() {
         const req = new LoginExport();
@@ -26981,6 +27560,7 @@ class LoginExport {
         req.username = "jdoe";
         req.password = "myp@ssword123";
         req.totp = "JBSWY3DPEHPK3PXP";
+        req.fido2Credentials = [Fido2CredentialExport.template()];
         return req;
     }
     static toView(req, view = new LoginView()) {
@@ -26990,6 +27570,9 @@ class LoginExport {
         view.username = req.username;
         view.password = req.password;
         view.totp = req.totp;
+        if (req.fido2Credentials != null) {
+            view.fido2Credentials = req.fido2Credentials.map((key) => Fido2CredentialExport.toView(key));
+        }
         return view;
     }
     static toDomain(req, domain = new Login()) {
@@ -26999,10 +27582,12 @@ class LoginExport {
         domain.username = req.username != null ? new EncString(req.username) : null;
         domain.password = req.password != null ? new EncString(req.password) : null;
         domain.totp = req.totp != null ? new EncString(req.totp) : null;
+        // Fido2credentials are currently not supported for exports.
         return domain;
     }
     constructor(o) {
         var _a, _b, _c;
+        this.fido2Credentials = [];
         if (o == null) {
             return;
         }
@@ -27014,6 +27599,9 @@ class LoginExport {
                 this.uris = o.uris.map((u) => new LoginUriExport(u));
             }
         }
+        if (o.fido2Credentials != null) {
+            this.fido2Credentials = o.fido2Credentials.map((key) => new Fido2CredentialExport(key));
+        }
         if (o instanceof LoginView) {
             this.username = o.username;
             this.password = o.password;
@@ -27395,6 +27983,7 @@ class FolderWithIdExport extends FolderExport {
 
 
 
+
 
 ;// CONCATENATED MODULE: ../../libs/exporter/src/export-helper.ts
 class ExportHelper {
@@ -33792,9 +34381,9 @@ const featuredImportOptions = [
     { id: "dashlanecsv", name: "Dashlane (csv)" },
     { id: "firefoxcsv", name: "Firefox (csv)" },
     { id: "keepass2xml", name: "KeePass 2 (xml)" },
-    { id: "lastpasscsv", name: "LastPass (csv)" },
+    { id: "lastpasscsv", name: "LastPass" },
     { id: "safaricsv", name: "Safari and macOS (csv)" },
-    { id: "1password1pux", name: "1Password (1pux)" },
+    { id: "1password1pux", name: "1Password (1pux/json)" },
 ];
 const regularImportOptions = [
     { id: "keepassxcsv", name: "KeePassX (csv)" },
@@ -34220,10 +34809,13 @@ class ImportService {
     }
 }
 
-;// CONCATENATED MODULE: ../../libs/importer/src/index.ts
+;// CONCATENATED MODULE: ../../libs/importer/src/services/index.ts
+
 
 
 
+
+;// CONCATENATED MODULE: ../../libs/importer/src/index.ts
 
 
 
@@ -34386,17 +34978,17 @@ class NodeCryptoFunctionService {
         }
         return p;
     }
-    aesDecryptFast(parameters) {
+    aesDecryptFast(parameters, mode) {
         return node_crypto_function_service_awaiter(this, void 0, void 0, function* () {
-            const decBuf = yield this.aesDecrypt(parameters.data, parameters.iv, parameters.encKey);
+            const decBuf = yield this.aesDecrypt(parameters.data, parameters.iv, parameters.encKey, mode);
             return utils_Utils.fromBufferToUtf8(decBuf);
         });
     }
-    aesDecrypt(data, iv, key) {
+    aesDecrypt(data, iv, key, mode) {
         const nodeData = this.toNodeBuffer(data);
-        const nodeIv = this.toNodeBuffer(iv);
+        const nodeIv = mode === "ecb" ? null : this.toNodeBuffer(iv);
         const nodeKey = this.toNodeBuffer(key);
-        const decipher = external_crypto_namespaceObject.createDecipheriv("aes-256-cbc", nodeKey, nodeIv);
+        const decipher = external_crypto_namespaceObject.createDecipheriv(this.toNodeCryptoAesMode(mode), nodeKey, nodeIv);
         const decBuf = Buffer.concat([decipher.update(nodeData), decipher.final()]);
         return Promise.resolve(this.toUint8Buffer(decBuf));
     }
@@ -34502,6 +35094,9 @@ class NodeCryptoFunctionService {
         const publicKey = external_node_forge_namespaceObject.pki.publicKeyFromAsn1(asn1);
         return external_node_forge_namespaceObject.pki.publicKeyToPem(publicKey);
     }
+    toNodeCryptoAesMode(mode) {
+        return mode === "cbc" ? "aes-256-cbc" : "aes-256-ecb";
+    }
 }
 
 ;// CONCATENATED MODULE: ../../libs/common/src/platform/abstractions/config/server-config.ts
@@ -35345,6 +35940,7 @@ class CollectionDetailsResponse extends CollectionResponse {
     constructor(response) {
         super(response);
         this.readOnly = this.getResponseProperty("ReadOnly") || false;
+        this.hidePasswords = this.getResponseProperty("HidePasswords") || false;
     }
 }
 class CollectionAccessDetailsResponse extends CollectionResponse {
@@ -36525,7 +37121,7 @@ class ApiService {
     // Plan APIs
     getPlans() {
         return api_service_awaiter(this, void 0, void 0, function* () {
-            const r = yield this.send("GET", "/plans/all", null, false, true);
+            const r = yield this.send("GET", "/plans", null, false, true);
             return new ListResponse(r, PlanResponse);
         });
     }
@@ -37768,6 +38364,9 @@ class LoginCommand {
                 else {
                     response = yield this.authService.logIn(new PasswordLogInCredentials(email, password, null, twoFactor));
                 }
+                if (response.requiresEncryptionKeyMigration) {
+                    return Response.error("Encryption key migration required. Please login through the web vault to update your encryption key.");
+                }
                 if (response.captchaSiteKey) {
                     const credentials = new PasswordLogInCredentials(email, password);
                     const handledResponse = yield this.handleCaptchaRequired(twoFactor, credentials);
@@ -42882,7 +43481,7 @@ class ImportCommand {
             }
             try {
                 let contents;
-                if (format === "1password1pux") {
+                if (format === "1password1pux" && filepath.endsWith(".1pux")) {
                     contents = yield CliUtils.extractZipContent(filepath, "export.data");
                 }
                 else if (format === "protonpass" && filepath.endsWith(".zip")) {
@@ -43402,6 +44001,7 @@ var bw_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _argum
 
 
 
+
 
 
 // Polyfills
@@ -43438,7 +44038,8 @@ class Main {
         this.storageService = new LowdbStorageService(this.logService, null, p, false, true);
         this.secureStorageService = new NodeEnvSecureStorageService(this.storageService, this.logService, () => this.cryptoService);
         this.memoryStorageService = new MemoryStorageService();
-        this.stateService = new StateService(this.storageService, this.secureStorageService, this.memoryStorageService, this.logService, new StateFactory(GlobalState, Account));
+        this.accountService = new AccountServiceImplementation(null, this.logService);
+        this.stateService = new StateService(this.storageService, this.secureStorageService, this.memoryStorageService, this.logService, new StateFactory(GlobalState, Account), this.accountService);
         this.cryptoService = new CryptoService(this.cryptoFunctionService, this.encryptService, this.platformUtilsService, this.logService, this.stateService);
         this.appIdService = new AppIdService(this.storageService);
         this.tokenService = new TokenService(this.stateService);