@tuskydp/cli 0.1.0

package/dist/src/lib/keyring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.d.ts","sourceRoot":"","sources":["../../../src/lib/keyring.ts"],"names":[],"mappings":"AAcA,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAStD;AAED,wBAAgB,aAAa,IAAI,MAAM,GAAG,IAAI,CAc7C;AAED,wBAAgB,YAAY,IAAI,IAAI,CAUnC"}

package/dist/src/lib/keyring.js

@@ -0,0 +1,51 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { createCipheriv, createDecipheriv, randomBytes, createHash } from 'crypto';
+const SESSION_DIR = join(homedir(), '.tusky');
+const SESSION_FILE = join(SESSION_DIR, 'session.enc');
+// Derive a machine-specific key from hostname + user
+function getMachineKey() {
+    const machineId = `${homedir()}-tusky-session-key`;
+    return createHash('sha256').update(machineId).digest();
+}
+export function storeMasterKey(masterKey) {
+    mkdirSync(SESSION_DIR, { recursive: true });
+    const key = getMachineKey();
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    const encrypted = Buffer.concat([cipher.update(masterKey), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    const data = Buffer.concat([iv, tag, encrypted]);
+    writeFileSync(SESSION_FILE, data);
+}
+export function loadMasterKey() {
+    if (!existsSync(SESSION_FILE))
+        return null;
+    try {
+        const data = readFileSync(SESSION_FILE);
+        const key = getMachineKey();
+        const iv = data.subarray(0, 12);
+        const tag = data.subarray(12, 28);
+        const encrypted = data.subarray(28);
+        const decipher = createDecipheriv('aes-256-gcm', key, iv);
+        decipher.setAuthTag(tag);
+        return Buffer.concat([decipher.update(encrypted), decipher.final()]);
+    }
+    catch {
+        return null;
+    }
+}
+export function clearSession() {
+    try {
+        if (existsSync(SESSION_FILE)) {
+            writeFileSync(SESSION_FILE, '');
+            const { unlinkSync } = require('fs');
+            unlinkSync(SESSION_FILE);
+        }
+    }
+    catch {
+        // Ignore
+    }
+}
+//# sourceMappingURL=keyring.js.map

package/dist/src/lib/keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.js","sourceRoot":"","sources":["../../../src/lib/keyring.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEnF,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAEtD,qDAAqD;AACrD,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,GAAG,OAAO,EAAE,oBAAoB,CAAC;IACnD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IACjD,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAChC,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YACrC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;AACH,CAAC"}

package/dist/src/lib/output.d.ts

@@ -0,0 +1,6 @@
+import Table from 'cli-table3';
+export declare function formatBytes(bytes: number): string;
+export declare function createTable(head: string[]): Table.Table;
+export declare function formatDate(date: string | Date): string;
+export declare function shortId(id: string): string;
+//# sourceMappingURL=output.d.ts.map

package/dist/src/lib/output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../src/lib/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAG/B,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMjD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAKvD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAatD;AAED,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE1C"}

package/dist/src/lib/output.js

@@ -0,0 +1,37 @@
+import Table from 'cli-table3';
+import chalk from 'chalk';
+export function formatBytes(bytes) {
+    if (bytes === 0)
+        return '0 B';
+    const k = 1024;
+    const sizes = ['B', 'KB', 'MB', 'GB', 'TB'];
+    const i = Math.floor(Math.log(bytes) / Math.log(k));
+    return `${parseFloat((bytes / Math.pow(k, i)).toFixed(1))} ${sizes[i]}`;
+}
+export function createTable(head) {
+    return new Table({
+        head: head.map(h => chalk.cyan(h)),
+        style: { head: [] },
+    });
+}
+export function formatDate(date) {
+    const d = new Date(date);
+    const now = new Date();
+    const diffMs = now.getTime() - d.getTime();
+    const diffMins = Math.floor(diffMs / 60000);
+    const diffHours = Math.floor(diffMs / 3600000);
+    const diffDays = Math.floor(diffMs / 86400000);
+    if (diffMins < 1)
+        return 'just now';
+    if (diffMins < 60)
+        return `${diffMins} min ago`;
+    if (diffHours < 24)
+        return `${diffHours}h ago`;
+    if (diffDays < 7)
+        return `${diffDays}d ago`;
+    return d.toLocaleDateString();
+}
+export function shortId(id) {
+    return id.slice(0, 8) + '...';
+}
+//# sourceMappingURL=output.js.map

package/dist/src/lib/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../../../src/lib/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,GAAG,UAAU,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAc;IACxC,OAAO,IAAI,KAAK,CAAC;QACf,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAmB;IAC5C,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,CAAC;IAE/C,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACpC,IAAI,QAAQ,GAAG,EAAE;QAAE,OAAO,GAAG,QAAQ,UAAU,CAAC;IAChD,IAAI,SAAS,GAAG,EAAE;QAAE,OAAO,GAAG,SAAS,OAAO,CAAC;IAC/C,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,GAAG,QAAQ,OAAO,CAAC;IAC5C,OAAO,CAAC,CAAC,kBAAkB,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;AAChC,CAAC"}

package/dist/src/lib/progress.d.ts

@@ -0,0 +1,2 @@
+export declare function createSpinner(text: string): import("ora").Ora;
+//# sourceMappingURL=progress.d.ts.map

package/dist/src/lib/progress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.d.ts","sourceRoot":"","sources":["../../../src/lib/progress.ts"],"names":[],"mappings":"AAEA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,qBAEzC"}

package/dist/src/lib/progress.js

@@ -0,0 +1,5 @@
+import ora from 'ora';
+export function createSpinner(text) {
+    return ora({ text, spinner: 'dots' });
+}
+//# sourceMappingURL=progress.js.map

package/dist/src/lib/progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress.js","sourceRoot":"","sources":["../../../src/lib/progress.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC"}

package/dist/src/lib/resolve.d.ts

@@ -0,0 +1,3 @@
+import type { TuskyClient } from '@tuskydp/sdk';
+export declare function resolveVault(sdk: TuskyClient, vaultRef?: string): Promise<string>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/src/lib/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/lib/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD,wBAAsB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBvF"}

package/dist/src/lib/resolve.js

@@ -0,0 +1,25 @@
+import { cliConfig } from '../config.js';
+export async function resolveVault(sdk, vaultRef) {
+    // If no vault specified, use the configured default
+    if (!vaultRef) {
+        const defaultVault = cliConfig.get('defaultVault');
+        if (defaultVault)
+            return defaultVault;
+        // Fall back to the user's default vault
+        const vaults = await sdk.vaults.list();
+        const defaultV = vaults.find((v) => v.isDefault);
+        if (defaultV)
+            return defaultV.id;
+        throw new Error('No default vault found. Create one with: tusky vault create <name>');
+    }
+    // If it looks like a UUID, use it directly
+    if (vaultRef.match(/^[0-9a-f]{8}-/))
+        return vaultRef;
+    // Otherwise, treat it as a slug and look it up
+    const vaults = await sdk.vaults.list();
+    const match = vaults.find((v) => v.slug === vaultRef || v.name === vaultRef);
+    if (!match)
+        throw new Error(`Vault "${vaultRef}" not found`);
+    return match.id;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/src/lib/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/lib/resolve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAgB,EAAE,QAAiB;IACpE,oDAAoD;IACpD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,wCAAwC;QACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;QAEjC,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IACxF,CAAC;IAED,2CAA2C;IAC3C,IAAI,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC7E,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,aAAa,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC"}

package/dist/src/mcp/context.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared context for MCP tool handlers.
+ *
+ * Holds the authenticated SDK client and (optionally) the unlocked
+ * master key for client-side encryption/decryption of private vault files.
+ */
+import type { TuskyClient } from '@tuskydp/sdk';
+export interface McpContext {
+    /** Authenticated Tusky SDK client. */
+    sdk: TuskyClient;
+    /**
+     * Returns the in-memory master key, or null if encryption was not
+     * unlocked (i.e. TUSKYDP_PASSWORD was not provided or setup is incomplete).
+     */
+    getMasterKey(): Buffer | null;
+    /** True when the master key is available for encrypt/decrypt operations. */
+    isEncryptionReady(): boolean;
+}
+//# sourceMappingURL=context.d.ts.map

package/dist/src/mcp/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/mcp/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,UAAU;IACzB,sCAAsC;IACtC,GAAG,EAAE,WAAW,CAAC;IAEjB;;;OAGG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI,CAAC;IAE9B,4EAA4E;IAC5E,iBAAiB,IAAI,OAAO,CAAC;CAC9B"}

package/dist/src/mcp/context.js

@@ -0,0 +1,8 @@
+/**
+ * Shared context for MCP tool handlers.
+ *
+ * Holds the authenticated SDK client and (optionally) the unlocked
+ * master key for client-side encryption/decryption of private vault files.
+ */
+export {};
+//# sourceMappingURL=context.js.map

package/dist/src/mcp/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/mcp/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}

package/dist/src/mcp/server.d.ts

@@ -0,0 +1,13 @@
+/**
+ * MCP Server for Tusky — exposes Tusky storage as tools over stdio.
+ *
+ * Agents (Claude Code, Cursor, etc.) spawn this process and communicate
+ * via JSON-RPC over stdin/stdout.  All human-readable logging goes to
+ * stderr because stdout is reserved for the MCP protocol.
+ */
+export interface McpServerOptions {
+    apiKey: string;
+    apiUrl: string;
+}
+export declare function startMcpServer(options: McpServerOptions): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/src/mcp/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4EH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,cAAc,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoD7E"}

package/dist/src/mcp/server.js

@@ -0,0 +1,113 @@
+/**
+ * MCP Server for Tusky — exposes Tusky storage as tools over stdio.
+ *
+ * Agents (Claude Code, Cursor, etc.) spawn this process and communicate
+ * via JSON-RPC over stdin/stdout.  All human-readable logging goes to
+ * stderr because stdout is reserved for the MCP protocol.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { TuskyClient, TuskyError } from '@tuskydp/sdk';
+import { deriveMasterKey, verifyPassphrase, unwrapMasterKey, } from '../crypto.js';
+import { loadMasterKey } from '../lib/keyring.js';
+// Tool registrars
+import { registerAccountTools } from './tools/account.js';
+import { registerVaultTools } from './tools/vaults.js';
+import { registerFolderTools } from './tools/folders.js';
+import { registerFileTools } from './tools/files.js';
+import { registerTrashTools } from './tools/trash.js';
+// ---------------------------------------------------------------------------
+// Encryption bootstrap
+// ---------------------------------------------------------------------------
+/**
+ * Attempt to unlock the master key using (in order):
+ *   1. TUSKYDP_PASSWORD env var  →  derive wrapping key  →  unwrap master key
+ *   2. Existing session file (~/.tusky/session.enc)
+ *
+ * Returns the master key Buffer, or null if neither method works.
+ */
+async function unlockMasterKey(sdk) {
+    const password = process.env.TUSKYDP_PASSWORD;
+    if (password) {
+        try {
+            const params = await sdk.account.getEncryptionParams();
+            if (!params.setupComplete) {
+                console.error('[tusky-mcp] Encryption not set up on this account. Skipping encryption unlock.');
+                return null;
+            }
+            const salt = Buffer.from(params.salt, 'base64');
+            const verifier = Buffer.from(params.verifier, 'base64');
+            const wrappingKey = deriveMasterKey(password, salt);
+            if (!verifyPassphrase(wrappingKey, verifier)) {
+                console.error('[tusky-mcp] TUSKYDP_PASSWORD is incorrect. Encryption will be unavailable.');
+                return null;
+            }
+            if (params.encryptedMasterKey) {
+                return unwrapMasterKey(Buffer.from(params.encryptedMasterKey, 'base64'), wrappingKey);
+            }
+            // Legacy accounts where wrapping key IS the master key
+            return wrappingKey;
+        }
+        catch (err) {
+            console.error(`[tusky-mcp] Failed to unlock encryption: ${err.message}`);
+            return null;
+        }
+    }
+    // Fallback: try existing session file
+    const sessionKey = loadMasterKey();
+    if (sessionKey) {
+        console.error('[tusky-mcp] Using encryption key from existing session.');
+        return sessionKey;
+    }
+    return null;
+}
+export async function startMcpServer(options) {
+    const { apiKey, apiUrl } = options;
+    // Create SDK client
+    const sdk = new TuskyClient({ apiKey, baseUrl: apiUrl });
+    // Validate connection by fetching account info
+    try {
+        const account = await sdk.account.get();
+        console.error(`[tusky-mcp] Authenticated as ${account.email} (${account.planName})`);
+    }
+    catch (err) {
+        if (err instanceof TuskyError) {
+            console.error(`[tusky-mcp] Authentication failed: ${err.message}`);
+        }
+        else {
+            console.error(`[tusky-mcp] Cannot reach Tusky API at ${apiUrl}: ${err.message}`);
+        }
+        process.exit(1);
+    }
+    // Unlock encryption (best effort)
+    const masterKey = await unlockMasterKey(sdk);
+    if (masterKey) {
+        console.error('[tusky-mcp] Encryption unlocked — private vault operations are available.');
+    }
+    else {
+        console.error('[tusky-mcp] Encryption not unlocked — private vault encrypt/decrypt unavailable.');
+        console.error('[tusky-mcp] Set TUSKYDP_PASSWORD env var or run `tusky encryption unlock` first.');
+    }
+    // Build context
+    const ctx = {
+        sdk,
+        getMasterKey: () => masterKey,
+        isEncryptionReady: () => masterKey !== null,
+    };
+    // Create MCP server
+    const server = new McpServer({
+        name: 'tusky',
+        version: '0.1.0',
+    });
+    // Register all tools
+    registerAccountTools(server, ctx);
+    registerVaultTools(server, ctx);
+    registerFolderTools(server, ctx);
+    registerFileTools(server, ctx);
+    registerTrashTools(server, ctx);
+    // Connect via stdio transport
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+    console.error('[tusky-mcp] MCP server running on stdio');
+}
+//# sourceMappingURL=server.js.map

package/dist/src/mcp/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/mcp/server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGlD,kBAAkB;AAClB,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,GAAgB;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAE9C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;gBAChG,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAK,EAAE,QAAQ,CAAC,CAAC;YACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAS,EAAE,QAAQ,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAEpD,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;gBAC5F,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC9B,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;YACxF,CAAC;YACD,uDAAuD;YACvD,OAAO,WAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,4CAA4C,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAG,aAAa,EAAE,CAAC;IACnC,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACzE,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAyB;IAC5D,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAEnC,oBAAoB;IACpB,MAAM,GAAG,GAAG,IAAI,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAEzD,+CAA+C;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,gCAAgC,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,sCAAsC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,yCAAyC,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,kCAAkC;IAClC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC7F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;QAClG,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;IACpG,CAAC;IAED,gBAAgB;IAChB,MAAM,GAAG,GAAe;QACtB,GAAG;QACH,YAAY,EAAE,GAAG,EAAE,CAAC,SAAS;QAC7B,iBAAiB,EAAE,GAAG,EAAE,CAAC,SAAS,KAAK,IAAI;KAC5C,CAAC;IAEF,oBAAoB;IACpB,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,qBAAqB;IACrB,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAChC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACjC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhC,8BAA8B;IAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/mcp/tools/account.d.ts

@@ -0,0 +1,7 @@
+/**
+ * MCP tools — Account
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { McpContext } from '../context.js';
+export declare function registerAccountTools(server: McpServer, ctx: McpContext): void;
+//# sourceMappingURL=account.d.ts.map

package/dist/src/mcp/tools/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../src/mcp/tools/account.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGhD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,QA+BtE"}

package/dist/src/mcp/tools/account.js

@@ -0,0 +1,31 @@
+/**
+ * MCP tools — Account
+ */
+import { wrapToolError } from './helpers.js';
+export function registerAccountTools(server, ctx) {
+    server.tool('tusky_account_info', 'Get account information including email, plan, storage usage, and encryption status', {}, async () => {
+        try {
+            const account = await ctx.sdk.account.get();
+            const info = {
+                id: account.id,
+                email: account.email,
+                plan: account.planName,
+                planTier: account.planTier,
+                storageUsed: account.storageUsedFormatted,
+                storageLimit: account.storageLimitFormatted,
+                storageUsedBytes: account.storageUsedBytes,
+                storageLimitBytes: account.storageLimitBytes,
+                encryptionSetup: account.encryptionSetupComplete,
+                encryptionUnlocked: ctx.isEncryptionReady(),
+                createdAt: account.createdAt,
+            };
+            return {
+                content: [{ type: 'text', text: JSON.stringify(info, null, 2) }],
+            };
+        }
+        catch (err) {
+            return wrapToolError(err);
+        }
+    });
+}
+//# sourceMappingURL=account.js.map

package/dist/src/mcp/tools/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../../src/mcp/tools/account.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,UAAU,oBAAoB,CAAC,MAAiB,EAAE,GAAe;IACrE,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,qFAAqF,EACrF,EAAE,EACF,KAAK,IAAI,EAAE;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAE5C,MAAM,IAAI,GAAG;gBACX,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,IAAI,EAAE,OAAO,CAAC,QAAQ;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,OAAO,CAAC,oBAAoB;gBACzC,YAAY,EAAE,OAAO,CAAC,qBAAqB;gBAC3C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,eAAe,EAAE,OAAO,CAAC,uBAAuB;gBAChD,kBAAkB,EAAE,GAAG,CAAC,iBAAiB,EAAE;gBAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;aAC7B,CAAC;YAEF,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aAC1E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/src/mcp/tools/files.d.ts

@@ -0,0 +1,10 @@
+/**
+ * MCP tools — File operations
+ *
+ * Handles upload with client-side encryption for private vaults,
+ * download with decryption and rehydration polling for cold files.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { McpContext } from '../context.js';
+export declare function registerFileTools(server: McpServer, ctx: McpContext): void;
+//# sourceMappingURL=files.d.ts.map

package/dist/src/mcp/tools/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../../src/mcp/tools/files.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAkKhD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,QAoOnE"}