@lazehq/cli 0.1.34 → 0.1.35

package/dist/laze.mjs

@@ -35708,7 +35708,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.34";
+var STAMPED = "0.1.35";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -62006,7 +62006,9 @@ var updateVaultConnectionInputSchemaDefinition = external_exports.object({
   maxLeaseSeconds: external_exports.number().int().positive().max(VAULT_MAX_LEASE_SECONDS).nullable().optional(),
   everyUseAsks: external_exports.boolean().optional(),
   secret: vaultSecretBundleSchema.optional(),
-  egress: vaultEgressTargetSchema.nullable().optional()
+  egress: vaultEgressTargetSchema.nullable().optional(),
+  /** A fresh passkey or Face ID proof, needed to lower a key from Always ask or Human only. */
+  reauthToken: external_exports.string().min(1).optional()
 });
 var updateVaultConnectionInputSchema = updateVaultConnectionInputSchemaDefinition;
 var vaultGrantSubjectSchemaDefinition = external_exports.object({
@@ -62023,7 +62025,9 @@ var vaultGrantSchemaDefinition = external_exports.object({
   lend: external_exports.boolean(),
   grantedByUserId: external_exports.string(),
   expiresAt: external_exports.iso.datetime().nullable(),
-  createdAt: external_exports.iso.datetime()
+  createdAt: external_exports.iso.datetime(),
+  /** A share asked from the CLI or by an agent: nothing reaches it until the owner's passkey. */
+  awaitingOwner: external_exports.boolean().optional()
 });
 var vaultGrantSchema = vaultGrantSchemaDefinition;
 var grantVaultConnectionInputSchemaDefinition = external_exports.object({
@@ -62041,6 +62045,33 @@ var lendVaultConnectionInputSchemaDefinition = external_exports.object({
   durationSeconds: external_exports.number().int().positive().nullable().default(null)
 });
 var lendVaultConnectionInputSchema = lendVaultConnectionInputSchemaDefinition;
+var shareVaultConnectionInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  connectionId: external_exports.string().min(1),
+  /** The teammate whose own agents may use the key; they never see its value. */
+  userId: external_exports.string().min(1),
+  durationSeconds: external_exports.number().int().positive().nullable().default(null),
+  /** A fresh passkey or Face ID proof makes the share live; without one it waits for the owner. */
+  reauthToken: external_exports.string().min(1).optional()
+});
+var shareVaultConnectionInputSchema = shareVaultConnectionInputSchemaDefinition;
+var approveVaultShareInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  grantId: external_exports.string().min(1),
+  reauthToken: external_exports.string().min(1)
+});
+var approveVaultShareInputSchema = approveVaultShareInputSchemaDefinition;
+var requestVaultShareInputSchemaDefinition = external_exports.object({
+  turnToken: external_exports.string().min(1),
+  connection: external_exports.string().min(1),
+  userId: external_exports.string().min(1),
+  durationSeconds: external_exports.number().int().positive().nullable().default(null)
+});
+var setVaultLevelInTurnInputSchemaDefinition = external_exports.object({
+  turnToken: external_exports.string().min(1),
+  connection: external_exports.string().min(1),
+  sensitivity: vaultSensitivitySchema
+});
 var vaultAgentKindSchema = external_exports.enum(["personal", "team"]);
 var openVaultTurnInputSchemaDefinition = external_exports.object({
   workspaceId: external_exports.string().min(1),
@@ -62298,7 +62329,14 @@ var vaultConnectionUseSchemaDefinition = external_exports.object({
   leaseId: external_exports.string().nullable().default(null),
   origin: vaultUseOriginSchema.nullable().default(null),
   /** How a person's read happened: `page` (Reveal) or `own_secret` (the CLI or Laze for them). */
-  via: external_exports.string().nullable().default(null)
+  via: external_exports.string().nullable().default(null),
+  /** On a share or a tier change: the person it named, the new tier, and the proof used. */
+  change: external_exports.object({
+    subjectUserId: external_exports.string().nullable(),
+    to: vaultSensitivitySchema.nullable(),
+    direction: external_exports.enum(["raised", "lowered"]).nullable(),
+    method: external_exports.string().nullable()
+  }).nullable().optional()
 });
 var vaultConnectionUseSchema = vaultConnectionUseSchemaDefinition;
 var vaultRevokeAtProviderSchema = external_exports.enum(["revoked", "failed", "not_supported"]);
@@ -62395,7 +62433,7 @@ var vaultTrpc = defineTrpcContract("vault").mutation("createConnection").withInp
     reason: external_exports.string().trim().min(1).max(200),
     reauthToken: external_exports.string().min(1).max(200).optional()
   })
-).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), grantId: external_exports.string().min(1) })).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
+).withOutput(external_exports.object({ fields: external_exports.record(external_exports.string(), external_exports.string()) })).mutation("beginReauth").withInput(workspaceInput).withOutput(vaultReauthChallengeSchema).mutation("confirmReauth").withInput(confirmVaultReauthInputSchema).withOutput(vaultReauthProofSchema).mutation("grantConnection").withInput(grantVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("lendToChannel").withInput(lendVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("revokeGrant").withInput(external_exports.object({ workspaceId: external_exports.string().min(1), grantId: external_exports.string().min(1) })).withOutput(external_exports.object({ revoked: external_exports.literal(true) })).query("listGrants").withInput(connectionInput).withOutput(external_exports.array(vaultGrantSchema)).mutation("shareConnection").withInput(shareVaultConnectionInputSchema).withOutput(vaultGrantSchema).mutation("approveShare").withInput(approveVaultShareInputSchema).withOutput(vaultGrantSchema).query("listApprovals").withInput(external_exports.object({ ...workspaceInput.shape, state: vaultApprovalStateSchema.optional() })).withOutput(external_exports.array(vaultApprovalRequestSchema)).mutation("answerApproval").withInput(answerVaultApprovalInputSchema).withOutput(vaultApprovalRequestSchema).query("listAudit").withInput(vaultAuditReadInputSchema).withOutput(vaultAuditPageSchema).query("listActivity").withInput(vaultAuditReadInputSchema).withOutput(external_exports.array(vaultAuditEntrySchema)).query("listLeases").withInput(workspaceInput).withOutput(external_exports.array(vaultLeaseSchema)).mutation("endLease").withInput(endVaultLeaseInputSchema).withOutput(external_exports.object({ ended: external_exports.literal(true) })).query("mostAsked").withInput(vaultMostAskedInputSchema).withOutput(vaultMostAskedSchema).query("judgeStatus").withInput(workspaceInput).withOutput(vaultJudgeStatusSchema).query("listLevelLimits").withInput(workspaceInput).withOutput(external_exports.array(vaultLevelLimitSchema)).mutation("setLevelLimit").withInput(setVaultLevelLimitInputSchema).withOutput(external_exports.array(vaultLevelLimitSchema)).query("listDevices").withInput(workspaceInput).withOutput(external_exports.array(vaultDeviceSchema)).mutation("beginDeviceEnrolment").withInput(workspaceInput).withOutput(vaultDeviceEnrolmentSchema).mutation("finishDeviceEnrolment").withInput(finishVaultDeviceEnrolmentInputSchema).withOutput(vaultDeviceSchema).mutation("beginDeviceApproval").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ challenge: external_exports.string(), sealed: external_exports.array(vaultSealedMaterialSchema) })).mutation("approveDevice").withInput(approveVaultDeviceInputSchema).withOutput(vaultDeviceSchema).mutation("removeDevice").withInput(external_exports.object({ ...workspaceInput.shape, deviceId: external_exports.string().min(1) })).withOutput(external_exports.object({ removed: external_exports.literal(true) })).mutation("createSealedConnection").withInput(createSealedConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("resealConnection").withInput(resealConnectionInputSchema).withOutput(vaultConnectionSchema).mutation("openSealedConnection").withInput(
   external_exports.object({
     ...connectionInput.shape,
     reason: external_exports.string().trim().min(1).max(200),
@@ -74504,10 +74542,15 @@ var appPull = async ({ context, args }) => {
     args,
     value: { ...pulled, folder },
     text: `Pulled ${pulled.files.length} files of ${pulled.app.name} (${site} version ${pulled.version.slice(0, 7)}) into ${where}
-` + (names.length ? `Its data: laze app records list <${names.join("|")}> --app ${pulled.app.slug}
-` : "It keeps no records.\n")
+` + recordsHint({ names, slug: pulled.app.slug })
   });
 };
+function recordsHint({ names, slug }) {
+  if (names.length === 0) return "It keeps no records.\n";
+  const which = names.length === 1 ? names[0] : `<${names.join("|")}>`;
+  return `Its data: laze app records list ${which} --app ${slug}
+`;
+}
 var appPublish = async ({ context, args }) => {
   const client = await appClient({ context, args });
   const appId = await appIdOf({ client, args, folder: folderOf({ context, word: void 0 }) });
@@ -79169,11 +79212,11 @@ async function connect({
 }
 
 // src/services/connector-commands.service.ts
-import { readFile as readFile23 } from "node:fs/promises";
+import { readFile as readFile24 } from "node:fs/promises";
 import { resolve as resolve8 } from "node:path";
 
 // src/services/vault-keychain-commands.service.ts
-import { readFile as readFile22 } from "node:fs/promises";
+import { readFile as readFile23 } from "node:fs/promises";
 
 // src/rules/vault-input.rules.ts
 function secondsOf(text2) {
@@ -79444,6 +79487,298 @@ var listDevices = async ({ context, args }) => {
   }
 };
 
+// src/services/vault-commands.service.ts
+import { createHash as createHash2 } from "node:crypto";
+import { mkdir as mkdir17, readFile as readFile22, rm as rm10, writeFile as writeFile18 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname17, join as join19 } from "node:path";
+var USAGE8 = `Usage: laze vault run <connection> --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
+Runs the command with the connection's values in its environment, on a Laze agent's computer
+or on a machine it runs on.`;
+var POLL_MS2 = 3e3;
+var RESTART_WAIT_MS = 12e4;
+var RESTART_BACKOFF_MS = [1e3, 2e3, 4e3, 8e3, 1e4];
+var P2562 = { name: "ECDH", namedCurve: "P-256" };
+var ServerGoneError = class extends Error {
+};
+function proxyOf({ env }) {
+  const raw = env.LAZE_VAULT_PROXY || env.HTTP_PROXY || env.http_proxy;
+  if (!raw) {
+    throw new CliUsageError(
+      "laze vault run works only on a Laze agent's computer or on a machine it runs on"
+    );
+  }
+  const url2 = new URL(raw);
+  const user = decodeURIComponent(url2.username);
+  const password = decodeURIComponent(url2.password);
+  return {
+    origin: url2.origin,
+    authorization: `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`
+  };
+}
+function turnFileOf({
+  env
+}) {
+  return env.LAZE_TURN_FILE || void 0;
+}
+async function turnTokenOf3({
+  env,
+  turnFile,
+  command = "laze vault run"
+}) {
+  const pinned = env.LAZE_TURN_TOKEN?.trim();
+  if (pinned) return pinned;
+  if (!turnFile) throw new CliUsageError(`${command} works only during an agent's turn`);
+  try {
+    return (await readFile22(turnFile, "utf8")).trim();
+  } catch {
+    throw new CliUsageError(`${command} works only during an agent's turn`);
+  }
+}
+function runKeyPathOf({
+  turnFile,
+  connection
+}) {
+  const name2 = createHash2("sha256").update(connection).digest("hex");
+  const base = turnFile ? dirname17(turnFile) : join19(tmpdir2(), "laze-vault");
+  return join19(base, "vault-run-keys", `${name2}.json`);
+}
+async function runKeyAt({ path }) {
+  const saved3 = await readFile22(path, "utf8").then(
+    (text2) => JSON.parse(text2),
+    () => void 0
+  );
+  if (saved3 && typeof saved3.publicKey === "string" && saved3.privateKey) {
+    const privateKey = await globalThis.crypto.subtle.importKey("jwk", saved3.privateKey, P2562, false, ["deriveBits"]).catch(() => void 0);
+    if (privateKey) return { privateKey, publicKey: saved3.publicKey };
+  }
+  const fresh = await generateEcdhKeys();
+  const jwk = await globalThis.crypto.subtle.exportKey("jwk", fresh.privateKey);
+  await mkdir17(dirname17(path), { recursive: true, mode: 448 });
+  await writeFile18(path, JSON.stringify({ publicKey: fresh.publicKey, privateKey: jwk }), {
+    mode: 384
+  });
+  return fresh;
+}
+function connectionRefused(error62) {
+  const cause = error62.cause;
+  if (cause?.code === "ECONNREFUSED") return true;
+  return cause?.errors?.some((inner) => inner.code === "ECONNREFUSED") ?? false;
+}
+async function sendOnce({
+  context,
+  url: url2,
+  init
+}) {
+  let response;
+  try {
+    response = await context.fetcher(url2, init);
+  } catch (error62) {
+    const wasRefused = connectionRefused(error62);
+    if (init.method === "POST" && !wasRefused) throw error62;
+    return { restarting: wasRefused ? "connection refused" : String(error62) };
+  }
+  if (response.status !== 502 && response.status !== 503) return { response };
+  const code = codeOf(await response.clone().text());
+  const neverReached = response.status === 503 && code === "vault_not_answering";
+  if (init.method === "POST" && !neverReached) return { response };
+  return { restarting: `status ${response.status}${code ? ` ${code}` : ""}` };
+}
+async function reach(input2) {
+  const { context } = input2;
+  const started = context.nowMs();
+  for (let attempt = 0; ; attempt += 1) {
+    const sent = await sendOnce(input2);
+    if ("response" in sent) return sent.response;
+    if (context.nowMs() - started >= RESTART_WAIT_MS) {
+      throw new ServerGoneError(
+        `laze vault: the Laze server did not come back (${sent.restarting})`
+      );
+    }
+    if (attempt === 0) {
+      context.err(
+        `laze vault: the Laze server is not answering (${sent.restarting}), probably restarting; waiting up to 2 min...
+`
+      );
+    }
+    await context.sleep(RESTART_BACKOFF_MS[Math.min(attempt, RESTART_BACKOFF_MS.length - 1)] ?? 0);
+  }
+}
+function codeOf(text2) {
+  return /"code"\s*:\s*"([^"]+)"/.exec(text2)?.[1];
+}
+async function releaseOf({ response }) {
+  const text2 = await response.text();
+  if (!response.ok) {
+    return {
+      outcome: "deny",
+      exitCode: 1,
+      message: `laze vault: the release was refused (${codeOf(text2) ?? `status ${response.status}`})`
+    };
+  }
+  return JSON.parse(text2);
+}
+async function envOf({
+  release: release2,
+  run: run4
+}) {
+  if (!release2.sealed) return release2.env;
+  const sealed = await openRunRelease({
+    release: release2.sealed,
+    runPrivateKey: run4.privateKey,
+    runPublicKey: run4.publicKey,
+    requestId: release2.sealed.requestId
+  });
+  return { ...release2.env, ...sealed };
+}
+function deadlineOf({ args, nowMs }) {
+  const wait = flagText({ args, name: "wait" }) || (args.flags.wait === true ? args.words[3] : "");
+  if (!wait) return Infinity;
+  if (!(Number(wait) >= 0)) throw new CliUsageError(`--wait takes a number of seconds
+${USAGE8}`);
+  return nowMs + Number(wait) * 1e3;
+}
+async function untilAnswered({
+  context,
+  first,
+  origin,
+  headers,
+  deadline
+}) {
+  let release2 = first;
+  while (release2.outcome === "ask") {
+    if (context.nowMs() + POLL_MS2 > deadline) {
+      context.err(`${release2.message}. Not approved yet; ask again later.
+`);
+      return "capped";
+    }
+    if (release2 === first) {
+      context.err(`${release2.message}. Waiting for an answer (cards expire after 12 hours)...
+`);
+    }
+    await context.sleep(POLL_MS2);
+    const url2 = `${origin}/vault/release/${encodeURIComponent(release2.requestId)}`;
+    release2 = await releaseOf({
+      response: await reach({ context, url: url2, init: { method: "GET", headers } })
+    });
+  }
+  return release2;
+}
+async function vaultRelease({
+  context,
+  args,
+  connection,
+  reason,
+  command
+}) {
+  const deadline = deadlineOf({ args, nowMs: context.nowMs() });
+  const env = context.environment.inherited;
+  const proxy = proxyOf({ env });
+  const turnFile = turnFileOf({ env });
+  const headers = {
+    "proxy-authorization": proxy.authorization,
+    "x-laze-turn": await turnTokenOf3({ env, turnFile })
+  };
+  const keyPath = runKeyPathOf({ turnFile, connection });
+  const run4 = await runKeyAt({ path: keyPath });
+  const body = JSON.stringify({ connection, reason, command, recipient: run4.publicKey });
+  let release2;
+  try {
+    const first = await releaseOf({
+      response: await reach({
+        context,
+        url: `${proxy.origin}/vault/release`,
+        init: { method: "POST", headers: { ...headers, "content-type": "application/json" }, body }
+      })
+    });
+    release2 = await untilAnswered({ context, first, origin: proxy.origin, headers, deadline });
+  } catch (error62) {
+    if (!(error62 instanceof ServerGoneError)) throw error62;
+    context.err(`${error62.message}. Run the command again to keep waiting.
+`);
+    return { exitCode: 75 };
+  }
+  if (release2 === "capped") return { exitCode: 75 };
+  if (release2.outcome === "deny") {
+    await rm10(keyPath, { force: true });
+    context.err(`${release2.message}
+`);
+    return { exitCode: release2.exitCode || 1 };
+  }
+  const values = await envOf({ release: release2, run: run4 });
+  await rm10(keyPath, { force: true });
+  if (release2.message) context.err(`${release2.message}
+`);
+  return { env: values };
+}
+async function vaultRun({
+  context,
+  args
+}) {
+  const connection = args.words[2];
+  const reason = flagText({ args, name: "reason" });
+  if (!connection || args.rest.length === 0) throw new CliUsageError(USAGE8);
+  if (!reason) throw new CliUsageError(`Say why with --reason "<one plain sentence>"
+${USAGE8}`);
+  const released = await vaultRelease({ context, args, connection, reason, command: args.rest });
+  if ("exitCode" in released) return released.exitCode;
+  return context.runCommand({ command: args.rest, env: released.env });
+}
+
+// src/services/vault-share-commands.service.ts
+var SHARE_USAGE2 = "Usage: laze vault share <connection> --with <email|userId> [--for 1h]";
+var WAITING_LINE = "It waits for the owner's approval with a passkey or Face ID, in Settings > Vault.";
+async function personOf({ client, who }) {
+  const members3 = await client.get("/api/workspaces/current/members");
+  const wanted = who.toLowerCase();
+  const found = members3.find(
+    (member) => member.userId === who || member.email.toLowerCase() === wanted
+  );
+  if (!found) throw new CliUsageError(`No one in this workspace is ${who}.`);
+  return found.userId;
+}
+async function inTurn({
+  context,
+  client,
+  command
+}) {
+  const env = context.environment.inherited;
+  const turn = await turnTokenOf3({ env, turnFile: turnFileOf({ env }), command });
+  return client.withHeaders({ "x-laze-turn": turn });
+}
+function printShare({ context, grant }) {
+  printGrant({ context, grant });
+  if (grant.awaitingOwner) context.out(`${WAITING_LINE}
+`);
+}
+var shareWith = async ({ context, args }) => {
+  const word3 = args.words[2];
+  const who = flagText({ args, name: "with" });
+  if (!word3 || !who) throw new CliUsageError(SHARE_USAGE2);
+  const { client, profile } = await signedIn({ context, args });
+  const userId = await personOf({ client, who });
+  const grant = profile.kind === "agent" ? await (await inTurn({ context, client, command: "laze vault share" })).post("/api/vault/turn/share", {
+    connection: word3,
+    userId,
+    ...durationOf(args)
+  }) : await client.post("/api/vault/shares", {
+    connectionId: (await connectionOf({ client, args, word: word3 })).id,
+    userId,
+    ...durationOf(args)
+  });
+  if (args.flags.json) return printJson4({ context, data: grant });
+  printShare({ context, grant });
+};
+async function setLevelInTurn({
+  context,
+  client,
+  connection,
+  sensitivity
+}) {
+  const turned = await inTurn({ context, client, command: "laze vault update --level" });
+  return turned.post("/api/vault/turn/level", { connection, sensitivity });
+}
+
 // src/services/vault-keychain-commands.service.ts
 var VAULT_USAGE = `Usage (your own key; an agent's key is refused, values are never printed):
   laze vault list [--json]                          connections you manage or see: names, fields, levels
@@ -79462,6 +79797,9 @@ var VAULT_USAGE = `Usage (your own key; an agent's key is refused, values are ne
   laze vault rm|revoke <connection>                 delete it; revoke also takes it back at the provider
   laze vault uses <connection> [--limit <n>]        who used it, how, where, under which approval
   laze vault grant <connection> --to person|group|channel|agent:<id> [--for 1h]
+  laze vault share <connection> --with <email|userId> [--for 1h]   your own key, with one teammate:
+      it waits for your passkey in Settings > Vault; Always ask and Human only keys are shared
+      only from there. Lowering a key's level is done only there too; raising works anywhere
   laze vault lend <connection> --channel <channelId> [--for 1h]
   laze vault grants <connection> | laze vault ungrant <grantId>
   laze vault leases | laze vault end-lease <leaseId>
@@ -79495,7 +79833,7 @@ async function secretText({ context, args }) {
     );
   }
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile22(file3, "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile23(file3, "utf8") : await context.readStdin();
   const trimmed = text2.replace(/\r?\n$/, "");
   if (!trimmed.trim()) throw new CliUsageError("No value: pipe it on stdin or use --from-file.");
   return trimmed;
@@ -79554,10 +79892,21 @@ var add3 = async ({ context, args }) => {
   );
 };
 var update = async ({ context, args }) => {
-  const { client } = await signedIn({ context, args });
-  const target = await connectionOf({ client, args, word: args.words[2] });
+  const { client, profile } = await signedIn({ context, args });
   const settings2 = settingsOf(args);
   if (Object.keys(settings2).length === 0) throw new CliUsageError(VAULT_USAGE);
+  const word3 = args.words[2];
+  if (profile.kind === "agent" && word3 && settings2.sensitivity && Object.keys(settings2).length === 1) {
+    const raised = await setLevelInTurn({
+      context,
+      client,
+      connection: word3,
+      sensitivity: settings2.sensitivity
+    });
+    if (args.flags.json) return printJson4({ context, data: raised });
+    return printConnection({ context, row: raised });
+  }
+  const target = await connectionOf({ client, args, word: word3 });
   const updated = await client.post("/api/vault/connections/update", {
     connectionId: target.id,
     ...settings2
@@ -79649,6 +79998,7 @@ var VAULT_COMMANDS = {
   revoke: removal("revoke"),
   uses,
   grant: grantTo,
+  share: shareWith,
   lend: lendTo,
   grants: grantsOf,
   ungrant: revokeGrant,
@@ -79705,7 +80055,7 @@ async function keyText({ context, args }) {
     throw new CliUsageError("A key never goes in a flag: pipe it on stdin or use --from-file.");
   }
   const file3 = flagText({ args, name: "from-file" });
-  const text2 = file3 ? await readFile23(resolve8(context.cwd, file3), "utf8") : await context.readStdin();
+  const text2 = file3 ? await readFile24(resolve8(context.cwd, file3), "utf8") : await context.readStdin();
   const trimmed = text2.trim();
   if (!trimmed) throw new CliUsageError("No key: pipe it on stdin or use --from-file.");
   return trimmed;
@@ -80069,16 +80419,16 @@ function dndLine({ pausedUntil }) {
 }
 
 // src/services/dnd-commands.service.ts
-var USAGE8 = "Usage: laze dnd 30m|1h|2h|until <HH:mm|ISO time> [--tz <zone>], laze dnd off";
+var USAGE9 = "Usage: laze dnd 30m|1h|2h|until <HH:mm|ISO time> [--tz <zone>], laze dnd off";
 async function dnd({ context, args }) {
   const timeZone = flagText({ args, name: "tz" }) || Intl.DateTimeFormat().resolvedOptions().timeZone;
   let input2;
   try {
     input2 = dndInputOf({ words: args.words.slice(1), now: nowInstant(), timeZone });
   } catch {
-    throw new CliUsageError(USAGE8);
+    throw new CliUsageError(USAGE9);
   }
-  if (!input2) throw new CliUsageError(USAGE8);
+  if (!input2) throw new CliUsageError(USAGE9);
   const { client } = await signedIn({ context, args });
   const settings2 = await client.post(
     "/api/agents/me/notifications/snooze",
@@ -80130,7 +80480,7 @@ async function domains({ context, args }) {
 }
 
 // src/services/feed-commands.service.ts
-import { readFile as readFile25 } from "node:fs/promises";
+import { readFile as readFile26 } from "node:fs/promises";
 import { resolve as resolve10 } from "node:path";
 
 // src/rules/feed-input.rules.ts
@@ -80255,7 +80605,7 @@ function feedFlagsOf({ args }) {
 }
 
 // src/services/feed-files.service.ts
-import { readFile as readFile24 } from "node:fs/promises";
+import { readFile as readFile25 } from "node:fs/promises";
 import { basename as basename4, resolve as resolve9 } from "node:path";
 
 // ../../modules/feed/contract/src/feed.ts
@@ -80830,7 +81180,7 @@ async function local({ context, path }) {
   return {
     fileName,
     contentType: contentTypeOf(fileName),
-    bytes: new Uint8Array(await readFile24(full))
+    bytes: new Uint8Array(await readFile25(full))
   };
 }
 async function directWith({ client, to }) {
@@ -80868,7 +81218,7 @@ async function feedAttachmentIdsOf({
 }
 
 // src/services/feed-commands.service.ts
-var USAGE9 = `Usage:
+var USAGE10 = `Usage:
   laze feed post <title> [--channel <channel>] [--tag <tag>] [--summary <line>]
     [--draft <text|@file>] [--draft-header "To: ...\\nRe: ..."]
     [--metric <json|@file.json> | --table <csv|@file.csv>]
@@ -80908,7 +81258,7 @@ async function bodyOf2({
   flags: flags2
 }) {
   const body = { ...flags2.fields };
-  const read3 = (source) => "file" in source ? readFile25(resolve10(context.cwd, source.file), "utf8") : source.text;
+  const read3 = (source) => "file" in source ? readFile26(resolve10(context.cwd, source.file), "utf8") : source.text;
   for (const [field, source] of Object.entries(flags2.texts)) body[field] = await read3(source);
   if (flags2.rich) {
     const text2 = await read3(flags2.rich.source);
@@ -80937,7 +81287,7 @@ function printItem({
 }
 async function feedPost({ context, args }) {
   const title = args.words.slice(2).join(" ").trim();
-  if (!title) throw new CliUsageError(USAGE9);
+  if (!title) throw new CliUsageError(USAGE10);
   const flags2 = flagsOf(args);
   const { client } = await signedIn({ context, args });
   const channel = flagText({ args, name: "channel" });
@@ -80959,7 +81309,7 @@ async function feedPost({ context, args }) {
 }
 async function feedUpdate({ context, args }) {
   const itemId = args.words[2];
-  if (!itemId) throw new CliUsageError(USAGE9);
+  if (!itemId) throw new CliUsageError(USAGE10);
   const flags2 = flagsOf(args);
   const { client } = await signedIn({ context, args });
   const body = await bodyOf2({ context, flags: flags2 });
@@ -80975,7 +81325,7 @@ async function feedUpdate({ context, args }) {
 async function feedReply({ context, args }) {
   const itemId = args.words[2];
   const text2 = args.words.slice(3).join(" ").trim();
-  if (!itemId || !text2) throw new CliUsageError(USAGE9);
+  if (!itemId || !text2) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const replied = await client.post("/api/feed/items/reply", {
     itemId,
@@ -80987,7 +81337,7 @@ async function feedReply({ context, args }) {
 }
 async function feedRead({ context, args }) {
   const itemId = args.words[2];
-  if (!itemId) throw new CliUsageError(USAGE9);
+  if (!itemId) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const read3 = await client.post("/api/feed/items/read", { itemId });
   printItem({ context, args, item: read3 });
@@ -81006,7 +81356,7 @@ async function feedClose({ context, args }) {
   const itemId = args.words[2];
   const loop = flagText({ args, name: "loop" });
   const note = flagText({ args, name: "note" });
-  if (!note || Boolean(itemId) === Boolean(loop)) throw new CliUsageError(USAGE9);
+  if (!note || Boolean(itemId) === Boolean(loop)) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const closed = await client.post("/api/feed/items/close", {
     ...itemId ? { itemId } : { loop },
@@ -81032,7 +81382,7 @@ async function feedLoops({ context, args }) {
 }
 async function feedGroupSummary({ context, args }) {
   const group = args.words.slice(2).join(" ").trim();
-  if (!group) throw new CliUsageError(USAGE9);
+  if (!group) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const pointer = await client.post("/api/feed/group-summary", { group });
   if (args.flags.json) return context.out(`${JSON.stringify(pointer, null, 2)}
@@ -81070,7 +81420,7 @@ async function textFlag({
 }) {
   const value = flagText({ args, name: name2 });
   if (!value.startsWith("@")) return value;
-  return readFile25(resolve10(context.cwd, value.slice(1)), "utf8");
+  return readFile26(resolve10(context.cwd, value.slice(1)), "utf8");
 }
 async function feedList({ context, args }) {
   const { client } = await signedIn({ context, args });
@@ -81102,7 +81452,7 @@ async function feedCount({ context, args }) {
 }
 async function feedAct({ context, args }) {
   const [itemId, actionId] = [args.words[2], args.words[3]];
-  if (!itemId || !actionId) throw new CliUsageError(USAGE9);
+  if (!itemId || !actionId) throw new CliUsageError(USAGE10);
   const draft = await textFlag({ context, args, name: "draft" });
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/act", {
@@ -81115,7 +81465,7 @@ async function feedAct({ context, args }) {
 async function feedComment({ context, args }) {
   const itemId = args.words[2];
   const text2 = args.words.slice(3).join(" ").trim();
-  if (!itemId || !text2) throw new CliUsageError(USAGE9);
+  if (!itemId || !text2) throw new CliUsageError(USAGE10);
   const draft = await textFlag({ context, args, name: "draft" });
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/comment", {
@@ -81129,7 +81479,7 @@ async function feedComment({ context, args }) {
 function moveItem(path) {
   return async ({ context, args }) => {
     const itemId = args.words[2];
-    if (!itemId) throw new CliUsageError(USAGE9);
+    if (!itemId) throw new CliUsageError(USAGE10);
     const { client } = await signedIn({ context, args });
     const item = await client.post(`/api/feed/mine/${path}`, { itemId });
     printMoved({ context, args, item });
@@ -81138,14 +81488,14 @@ function moveItem(path) {
 async function feedSnooze({ context, args }) {
   const itemId = args.words[2];
   const until = flagText({ args, name: "until" });
-  if (!itemId || !until) throw new CliUsageError(USAGE9);
+  if (!itemId || !until) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const item = await client.post("/api/feed/mine/snooze", { itemId, until });
   printMoved({ context, args, item });
 }
 async function feedChannel({ context, args }) {
   const channelId = args.words[2];
-  if (!channelId) throw new CliUsageError(USAGE9);
+  if (!channelId) throw new CliUsageError(USAGE10);
   const { client } = await signedIn({ context, args });
   const items = await client.post("/api/feed/channel", { channelId });
   if (args.flags.json) return context.out(`${JSON.stringify(items, null, 2)}
@@ -81175,12 +81525,12 @@ var FEED_COMMANDS = {
 async function feed({ context, args }) {
   const name2 = args.words[1] ?? "";
   const command = Object.hasOwn(FEED_COMMANDS, name2) ? FEED_COMMANDS[name2] : void 0;
-  if (!command) throw new CliUsageError(USAGE9);
+  if (!command) throw new CliUsageError(USAGE10);
   await command({ context, args });
 }
 
 // src/services/github-commands.service.ts
-import { readFile as readFile26 } from "node:fs/promises";
+import { readFile as readFile27 } from "node:fs/promises";
 
 // src/rules/github-signature.rules.ts
 var TURN_SEPARATOR = "~";
@@ -81250,7 +81600,7 @@ var REAL_GH = "/usr/bin/gh";
 var NOT_SET = "laze: agent_github_not_set: this agent has no GitHub connection. Its owner sets one on the agent's settings page or with `laze agent set-github <agent> <connection>`.";
 async function turnFileToken({ env }) {
   if (!env.LAZE_TURN_FILE) return "";
-  return readFile26(env.LAZE_TURN_FILE, "utf8").then(
+  return readFile27(env.LAZE_TURN_FILE, "utf8").then(
     (text2) => text2.trim(),
     () => ""
   );
@@ -81284,7 +81634,7 @@ async function githubGh({
     args: args.rest,
     agentName: profile.name ?? "An agent",
     threadUrl: threadUrlOf({ env, workspaceId: profile.workspaceId }),
-    readBodyFile: (path) => path === "-" ? context.readStdin() : readFile26(path, "utf8")
+    readBodyFile: (path) => path === "-" ? context.readStdin() : readFile27(path, "utf8")
   });
   return context.runCommand({
     command: [REAL_GH, ...ghArgs],
@@ -81383,7 +81733,7 @@ async function setAgentGithub({
 }
 
 // src/services/history-commands.service.ts
-import { readFile as readFile27 } from "node:fs/promises";
+import { readFile as readFile28 } from "node:fs/promises";
 
 // src/rules/history-format.rules.ts
 function timeOf2(iso) {
@@ -81474,12 +81824,12 @@ function beforeOf({ args }) {
     throw new CliUsageError(HISTORY_USAGE);
   }
 }
-async function turnTokenOf3({ context }) {
+async function turnTokenOf4({ context }) {
   const env = context.environment.inherited;
   const pinned = env.LAZE_TURN_TOKEN?.trim();
   if (pinned) return pinned;
   if (!env.LAZE_TURN_FILE) return "";
-  return readFile27(env.LAZE_TURN_FILE, "utf8").then(
+  return readFile28(env.LAZE_TURN_FILE, "utf8").then(
     (text2) => text2.trim(),
     () => ""
   );
@@ -81493,7 +81843,7 @@ async function history({
   const limit = limitOf3({ args });
   const before = beforeOf({ args });
   const { client: signed2 } = await signedIn({ context, args });
-  const turn = await turnTokenOf3({ context });
+  const turn = await turnTokenOf4({ context });
   const client = turn ? signed2.withHeaders({ "x-laze-turn": turn }) : signed2;
   const laze = await client.post("/api/agents/me/history", {
     channel,
@@ -81671,19 +82021,19 @@ async function ip({ context, args }) {
 }
 
 // src/services/join-commands.service.ts
-import { mkdir as mkdir17, readFile as readFile28, rename as rename5, rm as rm10, writeFile as writeFile18 } from "node:fs/promises";
-import { dirname as dirname17, join as join19 } from "node:path";
+import { mkdir as mkdir18, readFile as readFile29, rename as rename5, rm as rm11, writeFile as writeFile19 } from "node:fs/promises";
+import { dirname as dirname18, join as join20 } from "node:path";
 var DEFAULT_WAIT_SECONDS2 = 100;
 var JOIN_USAGE = "Usage: laze join [--workspace <name|id|invite link>] [--for <email>] [--name <name>] [--note <text>] [--timeout <seconds>] [--project <folder>]";
 function pendingPathOf({ context }) {
-  return join19(dirname17(context.environment.configPath), "join", "pending.json");
+  return join20(dirname18(context.environment.configPath), "join", "pending.json");
 }
 async function readPending({
   context,
   url: url2,
   args
 }) {
-  const pending = await readFile28(pendingPathOf({ context }), "utf8").then(
+  const pending = await readFile29(pendingPathOf({ context }), "utf8").then(
     (text2) => JSON.parse(text2),
     () => void 0
   );
@@ -81693,13 +82043,13 @@ async function readPending({
 }
 async function keepPending({ context, pending }) {
   const path = pendingPathOf({ context });
-  await mkdir17(dirname17(path), { recursive: true, mode: 448 });
+  await mkdir18(dirname18(path), { recursive: true, mode: 448 });
   const temporary = `${path}.${process.pid}.tmp`;
-  await writeFile18(temporary, JSON.stringify(pending), { mode: 384 });
+  await writeFile19(temporary, JSON.stringify(pending), { mode: 384 });
   await rename5(temporary, path);
 }
 async function dropPending({ context }) {
-  await rm10(pendingPathOf({ context }), { force: true });
+  await rm11(pendingPathOf({ context }), { force: true });
 }
 function waitSecondsOf3({ args }) {
   const raw = flagText({ args, name: "timeout" });
@@ -82011,244 +82361,6 @@ function machineAccessCommand(name2) {
   return name2 && Object.hasOwn(COMMANDS, name2) ? COMMANDS[name2] : void 0;
 }
 
-// src/services/vault-commands.service.ts
-import { createHash as createHash2 } from "node:crypto";
-import { mkdir as mkdir18, readFile as readFile29, rm as rm11, writeFile as writeFile19 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
-import { dirname as dirname18, join as join20 } from "node:path";
-var USAGE10 = `Usage: laze vault run <connection> --reason "<one plain sentence>" [--wait <s>] -- <command> [args...]
-Runs the command with the connection's values in its environment, on a Laze agent's computer
-or on a machine it runs on.`;
-var POLL_MS2 = 3e3;
-var RESTART_WAIT_MS = 12e4;
-var RESTART_BACKOFF_MS = [1e3, 2e3, 4e3, 8e3, 1e4];
-var P2562 = { name: "ECDH", namedCurve: "P-256" };
-var ServerGoneError = class extends Error {
-};
-function proxyOf({ env }) {
-  const raw = env.LAZE_VAULT_PROXY || env.HTTP_PROXY || env.http_proxy;
-  if (!raw) {
-    throw new CliUsageError(
-      "laze vault run works only on a Laze agent's computer or on a machine it runs on"
-    );
-  }
-  const url2 = new URL(raw);
-  const user = decodeURIComponent(url2.username);
-  const password = decodeURIComponent(url2.password);
-  return {
-    origin: url2.origin,
-    authorization: `Basic ${Buffer.from(`${user}:${password}`).toString("base64")}`
-  };
-}
-function turnFileOf({
-  env
-}) {
-  return env.LAZE_TURN_FILE || void 0;
-}
-async function turnTokenOf4({
-  env,
-  turnFile,
-  command = "laze vault run"
-}) {
-  const pinned = env.LAZE_TURN_TOKEN?.trim();
-  if (pinned) return pinned;
-  if (!turnFile) throw new CliUsageError(`${command} works only during an agent's turn`);
-  try {
-    return (await readFile29(turnFile, "utf8")).trim();
-  } catch {
-    throw new CliUsageError(`${command} works only during an agent's turn`);
-  }
-}
-function runKeyPathOf({
-  turnFile,
-  connection
-}) {
-  const name2 = createHash2("sha256").update(connection).digest("hex");
-  const base = turnFile ? dirname18(turnFile) : join20(tmpdir2(), "laze-vault");
-  return join20(base, "vault-run-keys", `${name2}.json`);
-}
-async function runKeyAt({ path }) {
-  const saved3 = await readFile29(path, "utf8").then(
-    (text2) => JSON.parse(text2),
-    () => void 0
-  );
-  if (saved3 && typeof saved3.publicKey === "string" && saved3.privateKey) {
-    const privateKey = await globalThis.crypto.subtle.importKey("jwk", saved3.privateKey, P2562, false, ["deriveBits"]).catch(() => void 0);
-    if (privateKey) return { privateKey, publicKey: saved3.publicKey };
-  }
-  const fresh = await generateEcdhKeys();
-  const jwk = await globalThis.crypto.subtle.exportKey("jwk", fresh.privateKey);
-  await mkdir18(dirname18(path), { recursive: true, mode: 448 });
-  await writeFile19(path, JSON.stringify({ publicKey: fresh.publicKey, privateKey: jwk }), {
-    mode: 384
-  });
-  return fresh;
-}
-function connectionRefused(error62) {
-  const cause = error62.cause;
-  if (cause?.code === "ECONNREFUSED") return true;
-  return cause?.errors?.some((inner) => inner.code === "ECONNREFUSED") ?? false;
-}
-async function sendOnce({
-  context,
-  url: url2,
-  init
-}) {
-  let response;
-  try {
-    response = await context.fetcher(url2, init);
-  } catch (error62) {
-    const wasRefused = connectionRefused(error62);
-    if (init.method === "POST" && !wasRefused) throw error62;
-    return { restarting: wasRefused ? "connection refused" : String(error62) };
-  }
-  if (response.status !== 502 && response.status !== 503) return { response };
-  const code = codeOf(await response.clone().text());
-  const neverReached = response.status === 503 && code === "vault_not_answering";
-  if (init.method === "POST" && !neverReached) return { response };
-  return { restarting: `status ${response.status}${code ? ` ${code}` : ""}` };
-}
-async function reach(input2) {
-  const { context } = input2;
-  const started = context.nowMs();
-  for (let attempt = 0; ; attempt += 1) {
-    const sent = await sendOnce(input2);
-    if ("response" in sent) return sent.response;
-    if (context.nowMs() - started >= RESTART_WAIT_MS) {
-      throw new ServerGoneError(
-        `laze vault: the Laze server did not come back (${sent.restarting})`
-      );
-    }
-    if (attempt === 0) {
-      context.err(
-        `laze vault: the Laze server is not answering (${sent.restarting}), probably restarting; waiting up to 2 min...
-`
-      );
-    }
-    await context.sleep(RESTART_BACKOFF_MS[Math.min(attempt, RESTART_BACKOFF_MS.length - 1)] ?? 0);
-  }
-}
-function codeOf(text2) {
-  return /"code"\s*:\s*"([^"]+)"/.exec(text2)?.[1];
-}
-async function releaseOf({ response }) {
-  const text2 = await response.text();
-  if (!response.ok) {
-    return {
-      outcome: "deny",
-      exitCode: 1,
-      message: `laze vault: the release was refused (${codeOf(text2) ?? `status ${response.status}`})`
-    };
-  }
-  return JSON.parse(text2);
-}
-async function envOf({
-  release: release2,
-  run: run4
-}) {
-  if (!release2.sealed) return release2.env;
-  const sealed = await openRunRelease({
-    release: release2.sealed,
-    runPrivateKey: run4.privateKey,
-    runPublicKey: run4.publicKey,
-    requestId: release2.sealed.requestId
-  });
-  return { ...release2.env, ...sealed };
-}
-function deadlineOf({ args, nowMs }) {
-  const wait = flagText({ args, name: "wait" }) || (args.flags.wait === true ? args.words[3] : "");
-  if (!wait) return Infinity;
-  if (!(Number(wait) >= 0)) throw new CliUsageError(`--wait takes a number of seconds
-${USAGE10}`);
-  return nowMs + Number(wait) * 1e3;
-}
-async function untilAnswered({
-  context,
-  first,
-  origin,
-  headers,
-  deadline
-}) {
-  let release2 = first;
-  while (release2.outcome === "ask") {
-    if (context.nowMs() + POLL_MS2 > deadline) {
-      context.err(`${release2.message}. Not approved yet; ask again later.
-`);
-      return "capped";
-    }
-    if (release2 === first) {
-      context.err(`${release2.message}. Waiting for an answer (cards expire after 12 hours)...
-`);
-    }
-    await context.sleep(POLL_MS2);
-    const url2 = `${origin}/vault/release/${encodeURIComponent(release2.requestId)}`;
-    release2 = await releaseOf({
-      response: await reach({ context, url: url2, init: { method: "GET", headers } })
-    });
-  }
-  return release2;
-}
-async function vaultRelease({
-  context,
-  args,
-  connection,
-  reason,
-  command
-}) {
-  const deadline = deadlineOf({ args, nowMs: context.nowMs() });
-  const env = context.environment.inherited;
-  const proxy = proxyOf({ env });
-  const turnFile = turnFileOf({ env });
-  const headers = {
-    "proxy-authorization": proxy.authorization,
-    "x-laze-turn": await turnTokenOf4({ env, turnFile })
-  };
-  const keyPath = runKeyPathOf({ turnFile, connection });
-  const run4 = await runKeyAt({ path: keyPath });
-  const body = JSON.stringify({ connection, reason, command, recipient: run4.publicKey });
-  let release2;
-  try {
-    const first = await releaseOf({
-      response: await reach({
-        context,
-        url: `${proxy.origin}/vault/release`,
-        init: { method: "POST", headers: { ...headers, "content-type": "application/json" }, body }
-      })
-    });
-    release2 = await untilAnswered({ context, first, origin: proxy.origin, headers, deadline });
-  } catch (error62) {
-    if (!(error62 instanceof ServerGoneError)) throw error62;
-    context.err(`${error62.message}. Run the command again to keep waiting.
-`);
-    return { exitCode: 75 };
-  }
-  if (release2 === "capped") return { exitCode: 75 };
-  if (release2.outcome === "deny") {
-    await rm11(keyPath, { force: true });
-    context.err(`${release2.message}
-`);
-    return { exitCode: release2.exitCode || 1 };
-  }
-  const values = await envOf({ release: release2, run: run4 });
-  await rm11(keyPath, { force: true });
-  if (release2.message) context.err(`${release2.message}
-`);
-  return { env: values };
-}
-async function vaultRun({
-  context,
-  args
-}) {
-  const connection = args.words[2];
-  const reason = flagText({ args, name: "reason" });
-  if (!connection || args.rest.length === 0) throw new CliUsageError(USAGE10);
-  if (!reason) throw new CliUsageError(`Say why with --reason "<one plain sentence>"
-${USAGE10}`);
-  const released = await vaultRelease({ context, args, connection, reason, command: args.rest });
-  if ("exitCode" in released) return released.exitCode;
-  return context.runCommand({ command: args.rest, env: released.env });
-}
-
 // src/services/machine-commands.service.ts
 var USAGE11 = [
   "Usage: laze machine connect <name>                       the command to run on your own machine (people)",
@@ -84665,7 +84777,7 @@ async function postInTurn({
   body
 }) {
   const env = context.environment.inherited;
-  const turn = await turnTokenOf4({
+  const turn = await turnTokenOf3({
     env,
     turnFile: turnFileOf({ env }),
     command: "laze vault save"
@@ -86301,7 +86413,7 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze vault scrub [--dry-run]                   move secrets found in messages to the vault now (admins)
   laze vault list|add|update|replace|compare|rm|revoke|uses   your keychains with your own key
       a value comes from stdin or --from-file, never a flag; no command prints a value
-  laze vault grant|lend|grants|ungrant|leases|end-lease|limits|set-limit   sharing, leases, limits
+  laze vault grant|share|lend|grants|ungrant|leases|end-lease|limits|set-limit   sharing, leases, limits
   laze vault audit|activity|most-asked|approvals|judge|devices   what happened (audit: admins)
   laze vault                                     every laze vault command, with its flags
   laze connect suggest <service> --reason "<why>"  a connect card for whoever asked (agents)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazehq/cli",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "description": "The Laze command line: sign in, read and post in chat, and connect your own Claude Code or Codex session as an agent.",
   "license": "UNLICENSED",
   "type": "module",