Open a vault for support, or import one

The support commands open a vault only while its account allows it; whoever runs the server can still read every vault (see Encryption). A person grants access to one vault on the Account page (/account/settings), for an hour, a day or seven days, and can end it early. Every access is logged with time, vault, operator and reason, and the log shows on the Account page. Support access to a shared vault is the owner's to grant.

Each command names who runs it and why, and refuses without the grant. --vault <slug> names the vault when the account has more than one.

Read a vault

mindin support files ann@example.com --vault workshop --operator sam --reason "lost note"
mindin support read ann@example.com Areas/home.md --vault workshop --operator sam --reason "lost note"

Import a plaintext vault

accounts import seals every file of a plaintext vault, from a folder or a bucket, into one of the account's personal vaults:

mindin accounts import ann@example.com --from-path ~/old-vault --operator sam --reason "move in"
mindin accounts import ann@example.com --from-s3-bucket old-vault --from-s3-prefix ann \
  --operator sam --reason "move in"

From a bucket it reads with IMPORT_S3_ACCESS_KEY and IMPORT_S3_SECRET_KEY, or the server's own S3_ACCESS_KEY and S3_SECRET_KEY when those are not set. --from-s3-endpoint and --from-s3-region name the old bucket's endpoint and region when they differ from the server's.

A person can import a zip into a personal vault themselves on its page; files with the same path are replaced. A shared vault refuses both imports: its notes arrive through its connections, so each change is kept in its history.