openmates 0.15.0-alpha.29 → 0.15.0-alpha.30

package/dist/{chunk-LPJME5IC.js → chunk-XG7OFIXM.js}

@@ -39,14 +39,14 @@ function base64ToBytes(input) {
 function bytesToBase64(input) {
   return Buffer.from(input).toString("base64");
 }
+function bytesToBase64Url(input) {
+  return Buffer.from(input).toString("base64url");
+}
 function toArrayBuffer(input) {
   const output = new ArrayBuffer(input.byteLength);
   new Uint8Array(output).set(input);
   return output;
 }
-function bytesToBase64Url(input) {
-  return Buffer.from(input).toString("base64url");
-}
 function base64UrlToBytes(input, field, expectedLength) {
   if (!input || input.includes("=")) {
     throw new Error(`${field} must be non-empty unpadded base64url`);
@@ -60,6 +60,17 @@ function base64UrlToBytes(input, field, expectedLength) {
   }
   return decoded;
 }
+async function deriveTeamInviteKey(input) {
+  const secretBytes = base64UrlToBytes(input.inviteSecret, "invite secret", 32);
+  const salt = await sha256(new TextEncoder().encode("openmates:team-invite:v1"));
+  const info = concatBytes(
+    lengthPrefix(new TextEncoder().encode(input.recipientEmail.trim().toLowerCase())),
+    lengthPrefix(new TextEncoder().encode(input.inviteId)),
+    lengthPrefix(new TextEncoder().encode(input.teamId)),
+    lengthPrefix(new TextEncoder().encode(input.origin.replace(/\/$/, "")))
+  );
+  return hkdfSha256(secretBytes, salt, info);
+}
 function uint32(value, field) {
   if (!Number.isInteger(value) || value < 0 || value > 4294967295) {
     throw new Error(`${field} must be an unsigned 32-bit integer`);
@@ -1053,6 +1064,9 @@ function clearSession() {
   if (onDisk?.emailEncryptionKeyStorage) {
     deleteMasterKey(onDisk.emailEncryptionKeyStorage, `${onDisk.hashedEmail}:email`);
   }
+  if (onDisk?.activeTeamId) {
+    deleteLocalTeamKey(onDisk.hashedEmail, onDisk.activeTeamId);
+  }
   if (existsSync2(filePath)) {
     rmSync(filePath);
   }
@@ -1089,6 +1103,41 @@ function buildSession(onDisk, masterKey, emailEncryptionKey) {
   };
 }
 var SYNC_CACHE_FILE = "sync_cache.json";
+var LOCAL_TEAM_KEYS_FILE = "team_keys.json";
+function teamKeyStorageId(hashedEmail, teamId) {
+  const digest = createHash3("sha256").update(teamId).digest("hex").slice(0, 32);
+  return `${hashedEmail}:team:${digest}`;
+}
+function saveLocalTeamKey(hashedEmail, teamId, teamKeyB64) {
+  const storageId = teamKeyStorageId(hashedEmail, teamId);
+  const result = storeMasterKey(teamKeyB64, storageId);
+  const filePath = join(ensureStateDir(), LOCAL_TEAM_KEYS_FILE);
+  const keys = readJsonFile(filePath) ?? { teams: {} };
+  keys.teams[storageId] = {
+    storage: result.type,
+    ...result.type === "encrypted" ? { encryptedData: result.encryptedData } : {},
+    ...result.type === "plaintext" ? { plaintextKeyB64: teamKeyB64 } : {}
+  };
+  writeJsonFile(filePath, keys);
+}
+function loadLocalTeamKey(hashedEmail, teamId) {
+  const storageId = teamKeyStorageId(hashedEmail, teamId);
+  const filePath = join(ensureStateDir(), LOCAL_TEAM_KEYS_FILE);
+  const entry = readJsonFile(filePath)?.teams[storageId];
+  if (!entry) return null;
+  if (entry.storage === "plaintext") return entry.plaintextKeyB64 ?? null;
+  return retrieveMasterKey(entry.storage, storageId, entry.encryptedData);
+}
+function deleteLocalTeamKey(hashedEmail, teamId) {
+  const storageId = teamKeyStorageId(hashedEmail, teamId);
+  deleteMasterKey("keychain", storageId);
+  const filePath = join(ensureStateDir(), LOCAL_TEAM_KEYS_FILE);
+  const keys = readJsonFile(filePath);
+  if (keys?.teams[storageId]) {
+    delete keys.teams[storageId];
+    writeJsonFile(filePath, keys);
+  }
+}
 function syncCacheFile(teamId) {
   if (!teamId) return SYNC_CACHE_FILE;
   const digest = createHash3("sha256").update(teamId).digest("hex").slice(0, 32);
@@ -4784,14 +4833,17 @@ var OpenMatesClient = class _OpenMatesClient {
     this.requireSession();
     const response = await this.http.get("/v1/teams", this.getCliRequestHeaders());
     if (!response.ok) throw new Error(`Team list failed with HTTP ${response.status}`);
-    return response.data.teams ?? [];
+    const teams = response.data.teams ?? [];
+    await Promise.all(teams.map((team) => this.cacheTeamKeyFromRecord(team)));
+    return teams;
   }
   async createTeam(input) {
     this.requireSession();
     const now = Math.floor(Date.now() / 1e3);
     const teamKeyBytes = randomBytes3(32);
+    const teamId = input.teamId ?? randomUUID5();
     const payload = {
-      team_id: input.teamId ?? randomUUID5(),
+      team_id: teamId,
       slug: input.slug ?? void 0,
       encrypted_name: input.encryptedName ?? await encryptWithAesGcmCombined(input.name ?? "Untitled team", teamKeyBytes),
       encrypted_description: input.encryptedDescription ?? (input.description ? await encryptWithAesGcmCombined(input.description, teamKeyBytes) : void 0),
@@ -4802,14 +4854,26 @@ var OpenMatesClient = class _OpenMatesClient {
     };
     const response = await this.http.post("/v1/teams", payload, this.getCliRequestHeaders());
     if (!response.ok || !response.data.team) throw new Error(`Team create failed with HTTP ${response.status}`);
+    if (!input.encryptedTeamKey) {
+      saveLocalTeamKey(this.requireSession().hashedEmail, teamId, bytesToBase64(teamKeyBytes));
+    }
     return response.data.team;
   }
   async getTeam(teamId) {
     this.requireSession();
     const response = await this.http.get(`/v1/teams/${encodeURIComponent(teamId)}`, this.getCliRequestHeaders());
     if (!response.ok || !response.data.team) throw new Error(`Team get failed with HTTP ${response.status}`);
+    await this.cacheTeamKeyFromRecord(response.data.team);
     return response.data.team;
   }
+  async cacheTeamKeyFromRecord(team) {
+    const session = this.requireSession();
+    const teamId = typeof team.team_id === "string" ? team.team_id : null;
+    const encryptedTeamKey = typeof team.encrypted_team_key === "string" ? team.encrypted_team_key : null;
+    if (!teamId || !encryptedTeamKey || loadLocalTeamKey(session.hashedEmail, teamId)) return;
+    const teamKey = await decryptBytesWithAesGcm(encryptedTeamKey, this.getMasterKeyBytes());
+    if (teamKey) saveLocalTeamKey(session.hashedEmail, teamId, bytesToBase64(teamKey));
+  }
   async updateTeam(teamId, input) {
     this.requireSession();
     const response = await this.http.patch(`/v1/teams/${encodeURIComponent(teamId)}`, {
@@ -4825,21 +4889,81 @@ var OpenMatesClient = class _OpenMatesClient {
     if (!response.ok) throw new Error(`Team delete failed with HTTP ${response.status}`);
     return { success: response.data.success === true };
   }
+  async loadTeamKeyBytes(teamId) {
+    const session = this.requireSession();
+    const localTeamKey = loadLocalTeamKey(session.hashedEmail, teamId);
+    if (localTeamKey) return base64ToBytes(localTeamKey);
+    const team = await this.getTeam(teamId);
+    const encryptedTeamKey = typeof team.encrypted_team_key === "string" ? team.encrypted_team_key : null;
+    if (!encryptedTeamKey) return null;
+    const teamKey = await decryptBytesWithAesGcm(encryptedTeamKey, this.getMasterKeyBytes());
+    if (!teamKey) return null;
+    saveLocalTeamKey(session.hashedEmail, teamId, bytesToBase64(teamKey));
+    return teamKey;
+  }
   async createTeamInvite(teamId, input) {
     this.requireSession();
-    const response = await this.http.post(`/v1/teams/${encodeURIComponent(teamId)}/invites`, {
-      invite_id: input.invite_id ?? randomUUID5(),
+    const inviteId = typeof input.invite_id === "string" ? input.invite_id : randomUUID5();
+    const payload = {
+      invite_id: inviteId,
       created_at: input.created_at ?? Math.floor(Date.now() / 1e3),
       ...input
+    };
+    const recipientEmail = typeof input.recipient_email === "string" ? input.recipient_email.trim().toLowerCase() : null;
+    const explicitInviteSecret = typeof input.invite_secret === "string" ? input.invite_secret : null;
+    const cachedTeamKey = loadLocalTeamKey(this.requireSession().hashedEmail, teamId);
+    const inviteSecret = explicitInviteSecret ?? (recipientEmail && cachedTeamKey ? bytesToBase64Url(randomBytes3(32)) : null);
+    if (recipientEmail && inviteSecret) {
+      const teamKey = cachedTeamKey ? base64ToBytes(cachedTeamKey) : await this.loadTeamKeyBytes(teamId);
+      if (!teamKey && explicitInviteSecret) throw new Error("Unable to load local team key for encrypted invite.");
+      if (teamKey) {
+        const origin = deriveAppUrl(this.apiUrl);
+        const inviteKey = await deriveTeamInviteKey({ recipientEmail, inviteSecret, inviteId, teamId, origin });
+        payload.encrypted_invite_team_key = await encryptBytesWithAesGcm(teamKey, inviteKey);
+        payload.invite_key_kdf_context = {
+          v: 1,
+          kdf: "HKDF-SHA256",
+          cipher: "AES-256-GCM",
+          team_id: teamId,
+          invite_id: inviteId,
+          origin
+        };
+      }
+    }
+    const response = await this.http.post(`/v1/teams/${encodeURIComponent(teamId)}/invites`, {
+      ...payload,
+      invite_secret: void 0
     }, this.getCliRequestHeaders());
     if (!response.ok || !response.data.invite) throw new Error(`Team invite create failed with HTTP ${response.status}`);
+    return inviteSecret ? { ...response.data.invite, invite_secret: inviteSecret, invite_url: `${deriveAppUrl(this.apiUrl)}/teams/invites/${inviteId}#key=${inviteSecret}` } : response.data.invite;
+  }
+  async getTeamInvite(inviteId) {
+    this.requireSession();
+    const response = await this.http.get(`/v1/teams/invites/${encodeURIComponent(inviteId)}`, this.getCliRequestHeaders());
+    if (!response.ok || !response.data.invite) throw new Error(`Team invite get failed with HTTP ${response.status}`);
     return response.data.invite;
   }
-  async acceptTeamInvite(inviteId) {
+  async acceptTeamInvite(inviteId, input = {}) {
     this.requireSession();
-    const response = await this.http.post(`/v1/teams/invites/${encodeURIComponent(inviteId)}/accept`, { accepted_at: Math.floor(Date.now() / 1e3) }, this.getCliRequestHeaders());
-    if (!response.ok || !response.data.access_request) throw new Error(`Team invite accept failed with HTTP ${response.status}`);
-    return { access_request: response.data.access_request, status_label: response.data.status_label };
+    const payload = { accepted_at: Math.floor(Date.now() / 1e3) };
+    if (input.inviteSecret) {
+      const invite = await this.getTeamInvite(inviteId);
+      const context = invite.invite_key_kdf_context;
+      const teamId = typeof context?.team_id === "string" ? context.team_id : null;
+      const origin = typeof context?.origin === "string" ? context.origin : deriveAppUrl(this.apiUrl);
+      const encryptedInviteTeamKey = typeof invite.encrypted_invite_team_key === "string" ? invite.encrypted_invite_team_key : null;
+      if (!teamId || !encryptedInviteTeamKey) throw new Error("Team invite is missing encrypted key material.");
+      if (!input.recipientEmail) throw new Error("Accepting an encrypted team invite requires --email <recipient-email>.");
+      const recipientEmail = input.recipientEmail;
+      const inviteKey = await deriveTeamInviteKey({ recipientEmail, inviteSecret: input.inviteSecret, inviteId, teamId, origin });
+      const teamKey = await decryptBytesWithAesGcm(encryptedInviteTeamKey, inviteKey);
+      if (!teamKey) throw new Error("Unable to decrypt team invite key.");
+      payload.encrypted_team_key = await encryptBytesWithAesGcm(teamKey, this.getMasterKeyBytes());
+      saveLocalTeamKey(this.requireSession().hashedEmail, teamId, bytesToBase64(teamKey));
+    }
+    const response = await this.http.post(`/v1/teams/invites/${encodeURIComponent(inviteId)}/accept`, payload, this.getCliRequestHeaders());
+    if (!response.ok || !response.data.access_request && !response.data.membership) throw new Error(`Team invite accept failed with HTTP ${response.status}`);
+    return { access_request: response.data.access_request, membership: response.data.membership, status: response.data.status, status_label: response.data.status_label };
   }
   async declineTeamInvite(inviteId) {
     this.requireSession();
@@ -5554,26 +5678,33 @@ var OpenMatesClient = class _OpenMatesClient {
   async decryptChatKey(encryptedChatKey, masterKey) {
     return decryptBytesWithAesGcm(encryptedChatKey, masterKey);
   }
-  getMasterWrapperEncryptedChatKey(cache, chatId) {
+  getContextWrapperEncryptedChatKey(cache, chatId, teamId = null) {
     const hashedChatId = createHash7("sha256").update(chatId).digest("hex");
+    const hashedTeamId = teamId ? createHash7("sha256").update(teamId).digest("hex") : null;
     const wrapper = (cache?.chatKeyWrappers ?? []).find(
-      (entry) => entry.key_type === "master" && entry.hashed_chat_id === hashedChatId && typeof entry.encrypted_chat_key === "string"
+      (entry) => entry.key_type === (teamId ? "team" : "master") && entry.hashed_chat_id === hashedChatId && (!hashedTeamId || entry.hashed_team_id === hashedTeamId) && typeof entry.encrypted_chat_key === "string"
     );
     return typeof wrapper?.encrypted_chat_key === "string" ? wrapper.encrypted_chat_key : null;
   }
-  async resolveChatKey(cache, cached, masterKey) {
+  async getChatWrappingKey(teamId, masterKey) {
+    if (!teamId) return masterKey;
+    const teamKey = await this.loadTeamKeyBytes(teamId);
+    if (!teamKey) throw new Error(`Team key not available locally for team '${teamId}'. Run 'openmates teams show ${teamId}' and try again.`);
+    return teamKey;
+  }
+  async resolveChatKey(cache, cached, wrappingKey, teamId = null) {
     const chatId = String(cached.details.id ?? "");
-    const wrapperKey = chatId ? this.getMasterWrapperEncryptedChatKey(cache, chatId) : null;
+    const wrapperKey = chatId ? this.getContextWrapperEncryptedChatKey(cache, chatId, teamId) : null;
     const encryptedChatKey = wrapperKey ?? (typeof cached.details.encrypted_chat_key === "string" ? cached.details.encrypted_chat_key : null);
-    return encryptedChatKey ? this.decryptChatKey(encryptedChatKey, masterKey) : null;
+    return encryptedChatKey ? this.decryptChatKey(encryptedChatKey, wrappingKey) : null;
   }
   /**
    * Decrypt a single chat record from the sync cache into a ChatListItem.
    */
-  async decryptChatListItem(cached, masterKey, cache = loadSyncCache()) {
+  async decryptChatListItem(cached, wrappingKey, cache = loadSyncCache(), teamId = null) {
     const d = cached.details;
     const id = String(d.id ?? "");
-    const chatKeyBytes = await this.resolveChatKey(cache, cached, masterKey);
+    const chatKeyBytes = await this.resolveChatKey(cache, cached, wrappingKey, teamId);
     const title = typeof d.encrypted_title === "string" && chatKeyBytes ? await decryptWithAesGcmCombined(d.encrypted_title, chatKeyBytes) : null;
     const summary = typeof d.encrypted_chat_summary === "string" && chatKeyBytes ? await decryptWithAesGcmCombined(
       d.encrypted_chat_summary,
@@ -5591,14 +5722,16 @@ var OpenMatesClient = class _OpenMatesClient {
     };
   }
   async listChats(limit = 10, page = 1, options = {}) {
+    const teamId = this.resolveTeamContext(options);
     const cache = await this.ensureSynced(false, [], options);
     const masterKey = this.getMasterKeyBytes();
+    const wrappingKey = await this.getChatWrappingKey(teamId, masterKey);
     const total = cache.chats.length;
     const offset = (page - 1) * limit;
     const slice = cache.chats.slice(offset, offset + limit);
     const output = [];
     for (const chat of slice) {
-      output.push(await this.decryptChatListItem(chat, masterKey, cache));
+      output.push(await this.decryptChatListItem(chat, wrappingKey, cache, teamId));
     }
     return {
       chats: output,
@@ -5760,12 +5893,14 @@ var OpenMatesClient = class _OpenMatesClient {
     };
   }
   async searchChats(query, options = {}) {
+    const teamId = this.resolveTeamContext(options);
     const cache = await this.ensureSynced(false, [], options);
     const masterKey = this.getMasterKeyBytes();
+    const wrappingKey = await this.getChatWrappingKey(teamId, masterKey);
     const normalized = query.trim().toLowerCase();
     const results = [];
     for (const cached of cache.chats) {
-      const item = await this.decryptChatListItem(cached, masterKey);
+      const item = await this.decryptChatListItem(cached, wrappingKey, cache, teamId);
       const title = (item.title ?? "").toLowerCase();
       const summary = (item.summary ?? "").toLowerCase();
       const cat = (item.category ?? "").toLowerCase();
@@ -5788,8 +5923,10 @@ var OpenMatesClient = class _OpenMatesClient {
    * @param query Full UUID, 8-char short ID, or chat title.
    */
   async getChatMessages(query, options = {}) {
+    const teamId = this.resolveTeamContext(options);
     const cache = await this.ensureSynced(true, [], options);
     const masterKey = this.getMasterKeyBytes();
+    const wrappingKey = await this.getChatWrappingKey(teamId, masterKey);
     const normalized = query.trim().toLowerCase();
     let found;
     if (query === "__last__" || query.toLowerCase() === "last") {
@@ -5807,7 +5944,7 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     if (!found) {
       for (const cached of cache.chats) {
-        const item = await this.decryptChatListItem(cached, masterKey, cache);
+        const item = await this.decryptChatListItem(cached, wrappingKey, cache, teamId);
         const title = (item.title ?? "").toLowerCase();
         if (title === normalized) {
           found = cached;
@@ -5817,7 +5954,7 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     if (!found) {
       for (const cached of cache.chats) {
-        const item = await this.decryptChatListItem(cached, masterKey);
+        const item = await this.decryptChatListItem(cached, wrappingKey, cache, teamId);
         const title = (item.title ?? "").toLowerCase();
         if (title.includes(normalized)) {
           found = cached;
@@ -5830,8 +5967,8 @@ var OpenMatesClient = class _OpenMatesClient {
         `Chat '${query}' not found. Try 'openmates chats search "${query}"' to browse matches.`
       );
     }
-    const chatItem = await this.decryptChatListItem(found, masterKey, cache);
-    const chatKeyBytes = await this.resolveChatKey(cache, found, masterKey);
+    const chatItem = await this.decryptChatListItem(found, wrappingKey, cache, teamId);
+    const chatKeyBytes = await this.resolveChatKey(cache, found, wrappingKey, teamId);
     const messages = [];
     for (const raw of found.messages) {
       const m = typeof raw === "string" ? JSON.parse(raw) : raw;
@@ -6145,11 +6282,12 @@ var OpenMatesClient = class _OpenMatesClient {
     const refreshChatId = String(cachedMatch?.details.id ?? chatId);
     const cache = await this.ensureSynced(true, [refreshChatId], { teamId });
     const masterKey = this.getMasterKeyBytes();
+    const wrappingKey = await this.getChatWrappingKey(teamId, masterKey);
     const found = cache.chats.find(
       (c) => String(c.details.id ?? "") === chatId || String(c.details.id ?? "").startsWith(chatId)
     );
     if (!found) return [];
-    const chatKeyBytes = await this.resolveChatKey(cache, found, masterKey);
+    const chatKeyBytes = await this.resolveChatKey(cache, found, wrappingKey, teamId);
     if (!chatKeyBytes) return [];
     const encSuggestions = typeof found.details.encrypted_follow_up_request_suggestions === "string" ? found.details.encrypted_follow_up_request_suggestions : null;
     if (!encSuggestions) return [];
@@ -6230,6 +6368,7 @@ var OpenMatesClient = class _OpenMatesClient {
     let savedTurnId = null;
     if (!params.incognito) {
       const masterKey = this.getMasterKeyBytes();
+      const wrappingKey = await this.getChatWrappingKey(teamId, masterKey);
       if (isNewChat) {
         chatKeyBytes = globalThis.crypto ? new Uint8Array(globalThis.crypto.getRandomValues(new Uint8Array(32))) : new Uint8Array(
           (await import("crypto")).webcrypto.getRandomValues(
@@ -6238,7 +6377,7 @@ var OpenMatesClient = class _OpenMatesClient {
         );
         encryptedChatKey = await encryptBytesWithAesGcm(
           chatKeyBytes,
-          masterKey
+          wrappingKey
         );
       } else {
         const cache = loadSyncCache(teamId) ?? await this.ensureSynced(false, [], { teamId });
@@ -6249,7 +6388,7 @@ var OpenMatesClient = class _OpenMatesClient {
           baselineMessagesV = typeof chat.details.messages_v === "number" ? chat.details.messages_v : 0;
           const encKey = typeof chat.details.encrypted_chat_key === "string" ? chat.details.encrypted_chat_key : null;
           if (encKey) {
-            chatKeyBytes = await decryptBytesWithAesGcm(encKey, masterKey);
+            chatKeyBytes = await decryptBytesWithAesGcm(encKey, wrappingKey);
             encryptedChatKey = encKey;
           }
         }
@@ -6867,6 +7006,7 @@ var OpenMatesClient = class _OpenMatesClient {
             ws,
             jobs: pendingTaskUpdateJobs,
             events: taskEvents,
+            teamId,
             activeChatId: chatId,
             activeChatKeyBytes: chatKeyBytes,
             fallbackUserMessageId: messageId,
@@ -6913,17 +7053,18 @@ var OpenMatesClient = class _OpenMatesClient {
     const handledJobIds = /* @__PURE__ */ new Set();
     if (params.jobs.length === 0) return handledJobIds;
     const masterKey = this.getMasterKeyBytes();
+    const wrappingKey = await this.getChatWrappingKey(params.teamId ?? null, masterKey);
     let decryptedTasksCache = null;
     const eventByJobId = new Map(params.events.map((event) => [event.task_update_job_id, event]));
     const resolveChatKey = async (targetChatId) => {
       if (targetChatId === params.activeChatId && params.activeChatKeyBytes) return params.activeChatKeyBytes;
       const findChat = (chats) => chats?.find((chat) => String(chat.details.id ?? "") === targetChatId);
-      const targetChat = findChat(params.syncedChats) ?? findChat(loadSyncCache()?.chats);
+      const targetChat = findChat(params.syncedChats) ?? findChat(loadSyncCache(params.teamId)?.chats);
       const encryptedTargetChatKey = typeof targetChat?.details.encrypted_chat_key === "string" ? targetChat.details.encrypted_chat_key : null;
       if (!encryptedTargetChatKey) {
         throw new Error(`Encrypted chat key not found for task update job target '${targetChatId}'. Sync and try again.`);
       }
-      const targetChatKey = await decryptBytesWithAesGcm(encryptedTargetChatKey, masterKey);
+      const targetChatKey = await decryptBytesWithAesGcm(encryptedTargetChatKey, wrappingKey);
       if (!targetChatKey) {
         throw new Error(`Failed to decrypt chat key for task update job target '${targetChatId}'.`);
       }
@@ -7598,6 +7739,21 @@ var OpenMatesClient = class _OpenMatesClient {
     }
     return response.data;
   }
+  async getRaw(path, apiKey) {
+    const headers = {
+      ...this.getCliRequestHeaders(),
+      Accept: "image/svg+xml,application/octet-stream"
+    };
+    if (apiKey) headers.Authorization = `Bearer ${apiKey}`;
+    const response = await this.http.getBinary(path, headers);
+    if (!response.ok) {
+      throw new Error(`Raw resource request failed with HTTP ${response.status}`);
+    }
+    return {
+      contentType: response.headers.get("content-type") ?? "application/octet-stream",
+      data: response.data
+    };
+  }
   // -------------------------------------------------------------------------
   // Travel: booking link resolution
   // -------------------------------------------------------------------------
@@ -9788,6 +9944,7 @@ Required: ${schema.required.join(", ")}`
         ws,
         jobs: pendingTaskUpdateJobs,
         events: [],
+        teamId,
         activeChatId: null,
         activeChatKeyBytes: null,
         fallbackUserMessageId: null,
@@ -9817,6 +9974,7 @@ Required: ${schema.required.join(", ")}`
   async persistPendingAIResponsesFromSync(ws, chats, pendingResponses, teamId) {
     if (pendingResponses.length === 0) return;
     const masterKey = this.getMasterKeyBytes();
+    const wrappingKey = await this.getChatWrappingKey(teamId ?? null, masterKey);
     for (const pending of pendingResponses) {
       const chatId = pending.chat_id;
       const messageId = pending.message_id;
@@ -9840,7 +9998,7 @@ Required: ${schema.required.join(", ")}`
         } catch {
         }
       }
-      const chatKeyBytes = await this.resolveChatKey(loadSyncCache(teamId), chat, masterKey);
+      const chatKeyBytes = await this.resolveChatKey(loadSyncCache(teamId), chat, wrappingKey, teamId ?? null);
       if (!chatKeyBytes) continue;
       const completedAt = normalizeUnixSeconds(
         pending.fired_at,

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   getExtForLang,
   serializeToYaml
-} from "./chunk-LPJME5IC.js";
+} from "./chunk-XG7OFIXM.js";
 import "./chunk-AXNRPVLE.js";
 export {
   getExtForLang,

package/dist/index.d.ts

@@ -486,6 +486,16 @@ interface TeamCreateInput {
     encryptedZeroBalance?: string;
     createdAt?: number;
 }
+interface TeamInviteCreateInput extends Record<string, unknown> {
+    role?: Exclude<TeamRole, "owner">;
+    recipient_email?: string;
+    invite_id?: string;
+    invite_secret?: string;
+}
+interface TeamInviteAcceptInput {
+    inviteSecret?: string | null;
+    recipientEmail?: string | null;
+}
 type LearningModeAgeGroup = "under_10" | "10_12" | "13_15" | "16_18" | "adult";
 interface LearningModeStatus {
     enabled: boolean;
@@ -1214,12 +1224,15 @@ declare class OpenMatesClient {
     listTeams(): Promise<TeamRecord[]>;
     createTeam(input: TeamCreateInput): Promise<TeamRecord>;
     getTeam(teamId: string): Promise<TeamRecord>;
+    private cacheTeamKeyFromRecord;
     updateTeam(teamId: string, input: Record<string, unknown>): Promise<TeamRecord>;
     deleteTeam(teamId: string): Promise<{
         success: boolean;
     }>;
-    createTeamInvite(teamId: string, input: Record<string, unknown>): Promise<Record<string, unknown>>;
-    acceptTeamInvite(inviteId: string): Promise<Record<string, unknown>>;
+    private loadTeamKeyBytes;
+    createTeamInvite(teamId: string, input: TeamInviteCreateInput): Promise<Record<string, unknown>>;
+    getTeamInvite(inviteId: string): Promise<Record<string, unknown>>;
+    acceptTeamInvite(inviteId: string, input?: TeamInviteAcceptInput): Promise<Record<string, unknown>>;
     declineTeamInvite(inviteId: string): Promise<{
         success: boolean;
     }>;
@@ -1355,7 +1368,8 @@ declare class OpenMatesClient {
      * encrypt/decrypt the chat's title, category, messages, etc.
      */
     private decryptChatKey;
-    private getMasterWrapperEncryptedChatKey;
+    private getContextWrapperEncryptedChatKey;
+    private getChatWrappingKey;
     private resolveChatKey;
     /**
      * Decrypt a single chat record from the sync cache into a ChatListItem.
@@ -1557,6 +1571,10 @@ declare class OpenMatesClient {
         fallbackToken?: string;
     } | null>;
     getCodeRunStatus(path: string, apiKey?: string): Promise<Record<string, unknown>>;
+    getRaw(path: string, apiKey?: string): Promise<{
+        contentType: string;
+        data: Uint8Array;
+    }>;
     /**
      * Look up a booking URL for a flight using its booking_token.
      *

package/dist/index.js

@@ -18,7 +18,7 @@ import {
   reconcileAuthoritativeChats,
   renderSupportInfo,
   serializeToYaml
-} from "./chunk-LPJME5IC.js";
+} from "./chunk-XG7OFIXM.js";
 import "./chunk-AXNRPVLE.js";
 export {
   APP_SKILL_METADATA,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openmates",
-  "version": "0.15.0-alpha.29",
+  "version": "0.15.0-alpha.30",
   "description": "OpenMates CLI and SDK",
   "type": "module",
   "main": "dist/index.js",