Fix project encryption and gateway vault CLI

tests/test_project_encryption_enable_payload.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Smoke-test project encryption enable payload generation."""
+
+import base64
+import importlib.util
+import pathlib
+import sys
+
+
+def load_module():
+    script_path = pathlib.Path(__file__).resolve().parents[1] / "resources" / "scripts" / "napseer_mcp_server.py"
+    sys.path.insert(0, str(script_path.parent))
+    spec = importlib.util.spec_from_file_location("napseer_mcp_server", script_path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    spec.loader.exec_module(module)
+    return module
+
+
+def run():
+    mod = load_module()
+    calls = []
+
+    mod.DEFAULT_PROJECT_ID = "project-1"
+    mod.AUTH = {"agent_id": "agent-1"}
+    mod.request_project_write = lambda method, path, body, project_id, purpose, scope_type="project": calls.append(
+        (method, path, body, project_id, purpose, scope_type)
+    ) or {"state": "encrypted", "active_project_key_version": {"version": 1}}
+    mod.save_auth = lambda payload: None
+
+    result = mod.project_encryption_transition({"state": "encrypted", "passphrase": "pw"})
+    assert result["status"] == "updated"
+    assert calls, "encryption enable should call backend"
+    method, path, body, project_id, purpose, scope_type = calls[0]
+    assert method == "POST"
+    assert path == "/v1/projects/project-1/encryption/enable"
+    assert project_id == "project-1"
+    assert scope_type == "encryption"
+    assert body["state"] == "encrypted"
+    wrapped = body["wrapped_project_key"]
+    assert wrapped["credential_id"] == "local-passphrase:agent-1"
+    assert wrapped["wrap_alg"] == "AES-GCM-256"
+    assert wrapped["kdf_alg"] == "PBKDF2-SHA256"
+    assert wrapped["kdf_params"]["source"] == "local_passphrase"
+    assert wrapped["kdf_params"]["iterations"] == mod.PROJECT_KEY_KDF_ITERATIONS
+    assert len(base64.b64decode(wrapped["salt_b64"])) == 16
+    assert len(base64.b64decode(wrapped["kdf_params"]["nonce_b64"])) == 12
+    assert len(base64.b64decode(wrapped["wrapped_project_key_b64"])) == 48
+
+    calls.clear()
+    result = mod.project_encryption_transition({"state": "plaintext"})
+    assert result["status"] == "updated"
+    assert "wrapped_project_key" not in calls[0][2]
+
+    print("ok: project encryption enable payload smoke passed")
+
+
+if __name__ == "__main__":
+    run()