@devicecloud.dev/dcd 5.2.0 → 5.3.1-beta.1

package/dist/commands/cloud.d.ts

@@ -144,14 +144,6 @@ export declare const cloudCommand: import("citty").CommandDef<{
         readonly alias: ["m"];
         readonly description: "Arbitrary key-value metadata to include with your test run (format: key=value, may be repeated)";
     };
-    readonly mitmHost: {
-        readonly type: "string";
-        readonly description: "used for mitmproxy support, enterprise only, contact support if interested";
-    };
-    readonly mitmPath: {
-        readonly type: "string";
-        readonly description: "used for mitmproxy support, enterprise only, contact support if interested";
-    };
     readonly 'moropo-v1-api-key': {
         readonly type: "string";
         readonly description: "API key for Moropo v1 integration";
@@ -234,6 +226,10 @@ export declare const cloudCommand: import("citty").CommandDef<{
         readonly type: "boolean";
         readonly description: "Ignore the sha hash check and upload the binary regardless of whether it already exists (not recommended)";
     };
+    readonly encrypt: {
+        readonly type: "boolean";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.";
+    };
     readonly 'api-key': {
         readonly type: "string";
         readonly alias: ["apiKey"];

package/dist/commands/cloud.js

@@ -17,6 +17,7 @@ import { VersionService } from '../services/version.service.js';
 import { EAndroidApiLevels, EAndroidDevices, EiOSDevices, EiOSVersions, isIosMatrixConfig, } from '../types/domain/device.types.js';
 import { resolveAuth } from '../utils/auth.js';
 import { assertMatrixSupported, matrixIsIos, parseDeviceMatrix, } from '../utils/device-matrix.js';
+import { isEncryptionEnabled } from '../utils/envelope.js';
 import { detectCiContext, isCI } from '../utils/ci.js';
 import { CliError, coerceArray, collectRepeatedFlag, getCliVersion, getUpgradeCommand, logger, parseIntFlag, validateEnum, } from '../utils/cli.js';
 import { fetchCompatibilityData, } from '../utils/compatibility.js';
@@ -132,6 +133,10 @@ export const cloudCommand = defineCommand({
             let flows = args.flows;
             const googlePlay = Boolean(args['google-play']);
             const ignoreShaCheck = Boolean(args['ignore-sha-check']);
+            // Single opt-in for client-side envelope encryption of every sensitive
+            // artifact — the binary (#1138), the flow zip (#1151), and env vars
+            // (#1152). Flag wins; otherwise DCD_ENCRYPT / DCD_ENCRYPT_BINARIES.
+            const encrypt = isEncryptionEnabled(args['encrypt'] ? true : undefined);
             const includeTags = coerceArray(collectRepeatedFlag(rawArgs, ['--include-tags']));
             const iOSDevice = validateEnum(args['ios-device'], Object.values(EiOSDevices), 'ios-device');
             const iOSVersion = validateEnum(args['ios-version'], Object.values(EiOSVersions), 'ios-version');
@@ -147,8 +152,6 @@ export const cloudCommand = defineCommand({
             const jsonFileName = args['json-file-name'];
             const maestroVersion = args['maestro-version'];
             const metadata = coerceArray(collectRepeatedFlag(rawArgs, ['--metadata', '-m']), false);
-            const mitmHost = args.mitmHost;
-            const mitmPath = args.mitmPath;
             const moropoApiKey = args['moropo-v1-api-key'];
             const name = args.name;
             const orientation = validateEnum(args.orientation, ORIENTATION_OPTIONS, 'orientation');
@@ -176,9 +179,6 @@ export const cloudCommand = defineCommand({
                 quiet = true;
                 out('--json-file is true: JSON output will be written to file, forcing --quiet flag for better CI output');
             }
-            if (mitmPath && !mitmHost) {
-                throw new CliError('--mitmPath requires --mitmHost to be set');
-            }
             if (jsonFileName && !jsonFileFlag) {
                 throw new CliError('--json-file-name requires --json-file');
             }
@@ -260,10 +260,10 @@ export const cloudCommand = defineCommand({
                 out(ui.info('runnerType m4 is experimental and currently supports iOS only, Android will revert to default.'));
             }
             if (runnerType === 'm1') {
-                out(ui.info('runnerType m1 is experimental and currently supports Android (Pixel 7, API Level 34) only.'));
+                out(ui.info('runnerType m1 is experimental and currently supports Android only (all devices, API level 34-36).'));
             }
             if (runnerType === 'gpu1') {
-                out(ui.info('runnerType gpu1 is Android-only (all devices, API Level 34 or 35), available to all users.'));
+                out(ui.info('runnerType gpu1 is Android-only (all devices, API level 34+), available to all users.'));
             }
             const firstFile = args.firstFile;
             const secondFile = args.secondFile;
@@ -498,6 +498,7 @@ export const cloudCommand = defineCommand({
                     auth,
                     apiUrl,
                     debug,
+                    encrypt,
                     filePath: finalAppFile,
                     ignoreShaCheck,
                     log: !json,
@@ -526,6 +527,7 @@ export const cloudCommand = defineCommand({
                 androidApiLevel,
                 androidDevice,
                 androidNoSnapshot,
+                apiUrl,
                 appBinaryId: finalBinaryId,
                 cliVersion,
                 commonRoot,
@@ -533,6 +535,7 @@ export const cloudCommand = defineCommand({
                 debug,
                 deviceLocale,
                 deviceMatrix,
+                encrypt,
                 env,
                 executionPlan,
                 flowFile,
@@ -542,8 +545,6 @@ export const cloudCommand = defineCommand({
                 logger: (m) => out(m),
                 maestroVersion: resolvedMaestroVersion,
                 metadata: mergedMetadata,
-                mitmHost,
-                mitmPath,
                 name,
                 orientation,
                 raw: [],

package/dist/commands/upload.d.ts

@@ -7,6 +7,10 @@ export declare const uploadCommand: import("citty").CommandDef<{
         readonly type: "boolean";
         readonly description: "Ignore the sha hash check and upload the binary regardless of whether it already exists (not recommended)";
     };
+    readonly encrypt: {
+        readonly type: "boolean";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.";
+    };
     readonly debug: {
         readonly type: "boolean";
         readonly default: false;

package/dist/commands/upload.js

@@ -19,6 +19,7 @@ export const uploadCommand = defineCommand({
         ...apiFlags,
         'app-url': binaryFlags['app-url'],
         'ignore-sha-check': binaryFlags['ignore-sha-check'],
+        encrypt: binaryFlags.encrypt,
         debug: outputFlags.debug,
         json: outputFlags.json,
         appFile: {
@@ -40,6 +41,7 @@ export const uploadCommand = defineCommand({
             const apiUrl = resolveApiUrl(args['api-url']);
             const appUrl = args['app-url'];
             const ignoreShaCheck = Boolean(args['ignore-sha-check']);
+            const encryptBinary = Boolean(args['encrypt']);
             const debug = Boolean(args.debug);
             const positional = args.appFile;
             const auth = await resolveAuth({ apiKeyFlag });
@@ -74,6 +76,7 @@ export const uploadCommand = defineCommand({
                 auth,
                 apiUrl,
                 debug,
+                encrypt: encryptBinary,
                 filePath: resolvedFile,
                 ignoreShaCheck,
                 log: !json,

package/dist/config/environments.d.ts

@@ -17,6 +17,23 @@ export interface DcdEnvironment {
         projectRef: string;
         anonKey: string;
     };
+    /**
+     * Pinned KEK public key for client-side binary envelope encryption (dcd#1138).
+     * `key` is base64 of the raw 32-byte X25519 public key; `version` selects which
+     * KEK the platform API unwraps with. **Public — safe to embed** (like the anon
+     * key above): it can only *encrypt*; the private half lives solely on the API.
+     *
+     * Left `null` until the KEK is generated and provisioned. Generate a keypair
+     * with, e.g.:
+     *   node -e 'const c=require("crypto");const{publicKey,privateKey}=c.generateKeyPairSync("x25519");const pub=publicKey.export({type:"spki",format:"der"}).subarray(12);const priv=privateKey.export({type:"pkcs8",format:"der"}).subarray(16);console.log("public :",pub.toString("base64"));console.log("private:",priv.toString("base64"))'
+     * Pin `public` here; set `private` as `BINARY_KEK_PRIVATE_KEYS={"<version>":"<private base64>"}`
+     * on the API service and keep one offline escrow copy. Until then, encryption
+     * can be exercised via the `DCD_BINARY_KEK_PUBLIC` env override (see envelope.ts).
+     */
+    kekPublicKey: {
+        version: number;
+        key: string;
+    } | null;
 }
 export declare const ENVIRONMENTS: Record<DcdEnvName, DcdEnvironment>;
 /** Exact-match lookup of a known environment by API URL (trailing slashes ignored). */

package/dist/config/environments.js

@@ -17,6 +17,7 @@ export const ENVIRONMENTS = {
             projectRef: 'pgydnphbimetinsgfkbo',
             anonKey: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InBneWRucGhiaW1ldGluc2dma2JvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDc1OTQzNDYsImV4cCI6MjAyMzE3MDM0Nn0.hAYOMFxxwX1exkQkY9xyQJGC_GhGnyogkj2N-kBkMI8',
         },
+        kekPublicKey: { version: 1, key: 'wtfyWEwK7nJzwI4PD+9RAW8jxIR1u8kMQq2IhsrVnH4=' },
     },
     dev: {
         apiUrl: 'https://api.dev.devicecloud.dev',
@@ -26,6 +27,7 @@ export const ENVIRONMENTS = {
             projectRef: 'lbmsowehtjwnqlurpemb',
             anonKey: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxibXNvd2VodGp3bnFsdXJwZW1iIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDkyMTg0ODcsImV4cCI6MjAyNDc5NDQ4N30.zeLTMAuZ_WwYvGdeP0kdvL_Zrs-RQee5APPyxmWq7qQ',
         },
+        kekPublicKey: { version: 1, key: 'RgcToF/OJpcQI9koYvSvtj/WLaebfcN4v5GJoqtr/00=' },
     },
 };
 /** Exact-match lookup of a known environment by API URL (trailing slashes ignored). */

package/dist/config/flags/binary.flags.d.ts

@@ -19,4 +19,8 @@ export declare const binaryFlags: {
         readonly type: "boolean";
         readonly description: "Ignore the sha hash check and upload the binary regardless of whether it already exists (not recommended)";
     };
+    readonly encrypt: {
+        readonly type: "boolean";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.";
+    };
 };

package/dist/config/flags/binary.flags.js

@@ -19,4 +19,8 @@ export const binaryFlags = {
         type: 'boolean',
         description: 'Ignore the sha hash check and upload the binary regardless of whether it already exists (not recommended)',
     },
+    encrypt: {
+        type: 'boolean',
+        description: 'Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.',
+    },
 };

package/dist/config/flags/environment.flags.d.ts

@@ -13,14 +13,6 @@ export declare const environmentFlags: {
         readonly alias: ["m"];
         readonly description: "Arbitrary key-value metadata to include with your test run (format: key=value, may be repeated)";
     };
-    readonly mitmHost: {
-        readonly type: "string";
-        readonly description: "used for mitmproxy support, enterprise only, contact support if interested";
-    };
-    readonly mitmPath: {
-        readonly type: "string";
-        readonly description: "used for mitmproxy support, enterprise only, contact support if interested";
-    };
     readonly 'moropo-v1-api-key': {
         readonly type: "string";
         readonly description: "API key for Moropo v1 integration";

package/dist/config/flags/environment.flags.js

@@ -13,14 +13,6 @@ export const environmentFlags = {
         alias: ['m'],
         description: 'Arbitrary key-value metadata to include with your test run (format: key=value, may be repeated)',
     },
-    mitmHost: {
-        type: 'string',
-        description: 'used for mitmproxy support, enterprise only, contact support if interested',
-    },
-    mitmPath: {
-        type: 'string',
-        description: 'used for mitmproxy support, enterprise only, contact support if interested',
-    },
     'moropo-v1-api-key': {
         type: 'string',
         description: 'API key for Moropo v1 integration',

package/dist/constants.d.ts

@@ -130,14 +130,6 @@ export declare const flags: {
         readonly alias: ["m"];
         readonly description: "Arbitrary key-value metadata to include with your test run (format: key=value, may be repeated)";
     };
-    readonly mitmHost: {
-        readonly type: "string";
-        readonly description: "used for mitmproxy support, enterprise only, contact support if interested";
-    };
-    readonly mitmPath: {
-        readonly type: "string";
-        readonly description: "used for mitmproxy support, enterprise only, contact support if interested";
-    };
     readonly 'moropo-v1-api-key': {
         readonly type: "string";
         readonly description: "API key for Moropo v1 integration";
@@ -220,6 +212,10 @@ export declare const flags: {
         readonly type: "boolean";
         readonly description: "Ignore the sha hash check and upload the binary regardless of whether it already exists (not recommended)";
     };
+    readonly encrypt: {
+        readonly type: "boolean";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.";
+    };
     readonly 'api-key': {
         readonly type: "string";
         readonly alias: ["apiKey"];

package/dist/gateways/api-gateway.d.ts

@@ -31,9 +31,45 @@ export declare const ApiGateway: {
      * the download methods.
      */
     streamResponseToFile(res: Response, destinationPath: string, operation: string): Promise<void>;
-    checkForExistingUpload(baseUrl: string, auth: AuthContext, sha: string): Promise<{
+    /**
+     * Prefer server-assembled bundle delivery. The API returns a signed manifest
+     * plus a URL to a delivery service that streams the ZIP straight from
+     * storage, so large downloads don't flow through the API itself. The client
+     * just relays the signed `{ manifest, sig }` to that URL — no auth header,
+     * because the manifest is already signed.
+     *
+     * Returns true once the bundle has been streamed to disk. Returns false when
+     * the bundle path is unavailable or anything about it doesn't pan out — a
+     * `501` (deployment doesn't offer it), a non-OK manifest response, a body
+     * that isn't a manifest, or a delivery-service error — so the caller can fall
+     * back to the inline download endpoint. Definitive errors (e.g. not found)
+     * surface through that inline path instead.
+     */
+    tryBundleDownload(baseUrl: string, auth: AuthContext, manifestEndpoint: string, destinationPath: string, operation: string): Promise<boolean>;
+    /**
+     * Look for an already-uploaded binary to skip re-uploading.
+     *
+     * Two lookup keys, because encryption changes what is stable (dcd#1168).
+     * Unencrypted uploads pass `sha` (the hash of exactly what gets stored).
+     * Encrypted uploads pass `shaPlain` plus `encrypted: true`: their ciphertext is
+     * freshly keyed on every upload, so its hash never matches, and the plaintext
+     * hash is the only stable key. `sha` is deliberately not sent in that case —
+     * see the caller in methods.ts for why sending it would be unsafe.
+     *
+     * `encrypted` in the response reports whether the *matched* binary is stored
+     * encrypted, so the caller can verify the invariant it asked for instead of
+     * trusting the server to have applied the right predicate.
+     */
+    checkForExistingUpload(baseUrl: string, auth: AuthContext, lookup: {
+        encrypted?: boolean;
+        sha?: string;
+        shaPlain?: string;
+    } | string): Promise<{
         appBinaryId: string;
         exists: boolean;
+        encrypted?: boolean;
+    } & {
+        encrypted?: boolean;
     }>;
     downloadArtifactsZip(baseUrl: string, auth: AuthContext, uploadId: string, results: "ALL" | "FAILED", artifactsPath?: string): Promise<void>;
     finaliseUpload(config: {
@@ -45,6 +81,12 @@ export declare const ApiGateway: {
         metadata: TAppMetadata;
         path: string;
         sha?: string;
+        /**
+         * Hash of the PLAINTEXT, sent only for encrypted uploads (dcd#1168). Stored
+         * as `binaries.sha_plain` so later encrypted uploads of the same input can
+         * dedup; `sha` remains the ciphertext hash.
+         */
+        shaPlain?: string;
         supabaseSuccess: boolean;
     }): Promise<Record<string, never>>;
     getBinaryUploadUrl(baseUrl: string, auth: AuthContext, platform: "android" | "ios", fileSize: number): Promise<{

package/dist/gateways/api-gateway.js

@@ -139,10 +139,93 @@ export const ApiGateway = {
         const fileStream = createWriteStream(expandedPath, { flags: 'w' });
         await pipeline(Readable.fromWeb(res.body), fileStream);
     },
-    async checkForExistingUpload(baseUrl, auth, sha) {
+    /**
+     * Prefer server-assembled bundle delivery. The API returns a signed manifest
+     * plus a URL to a delivery service that streams the ZIP straight from
+     * storage, so large downloads don't flow through the API itself. The client
+     * just relays the signed `{ manifest, sig }` to that URL — no auth header,
+     * because the manifest is already signed.
+     *
+     * Returns true once the bundle has been streamed to disk. Returns false when
+     * the bundle path is unavailable or anything about it doesn't pan out — a
+     * `501` (deployment doesn't offer it), a non-OK manifest response, a body
+     * that isn't a manifest, or a delivery-service error — so the caller can fall
+     * back to the inline download endpoint. Definitive errors (e.g. not found)
+     * surface through that inline path instead.
+     */
+    async tryBundleDownload(baseUrl, auth, manifestEndpoint, destinationPath, operation) {
+        let manifestRes;
+        try {
+            manifestRes = await fetch(`${baseUrl}${manifestEndpoint}`, {
+                headers: { ...auth.headers },
+                method: 'GET',
+            });
+        }
+        catch {
+            return false;
+        }
+        // 501 => this deployment has no bundle delivery; any other non-OK => let
+        // the inline path re-request and surface the real error.
+        if (!manifestRes.ok) {
+            return false;
+        }
+        let bundle;
+        try {
+            bundle = (await manifestRes.json());
+        }
+        catch {
+            return false;
+        }
+        if (!bundle?.bundleUrl || !bundle?.manifest || !bundle?.sig) {
+            return false;
+        }
+        let zipRes;
+        try {
+            zipRes = await fetch(bundle.bundleUrl, {
+                body: JSON.stringify({ manifest: bundle.manifest, sig: bundle.sig }),
+                // No auth header: the manifest is signed and is the access token.
+                headers: { 'content-type': 'application/json' },
+                method: 'POST',
+            });
+        }
+        catch {
+            return false;
+        }
+        if (!zipRes.ok) {
+            return false;
+        }
+        // A mid-stream failure (dropped/truncated connection) or a null body on an
+        // otherwise-OK response throws here — fall back to the inline path rather
+        // than let it escape past the caller's fallback. The inline path re-opens
+        // the destination with flags: 'w', truncating any partial file left behind.
+        try {
+            await this.streamResponseToFile(zipRes, destinationPath, operation);
+        }
+        catch {
+            return false;
+        }
+        return true;
+    },
+    /**
+     * Look for an already-uploaded binary to skip re-uploading.
+     *
+     * Two lookup keys, because encryption changes what is stable (dcd#1168).
+     * Unencrypted uploads pass `sha` (the hash of exactly what gets stored).
+     * Encrypted uploads pass `shaPlain` plus `encrypted: true`: their ciphertext is
+     * freshly keyed on every upload, so its hash never matches, and the plaintext
+     * hash is the only stable key. `sha` is deliberately not sent in that case —
+     * see the caller in methods.ts for why sending it would be unsafe.
+     *
+     * `encrypted` in the response reports whether the *matched* binary is stored
+     * encrypted, so the caller can verify the invariant it asked for instead of
+     * trusting the server to have applied the right predicate.
+     */
+    async checkForExistingUpload(baseUrl, auth, lookup) {
+        // Historically this took a bare sha string; keep that shape working.
+        const body = typeof lookup === 'string' ? { sha: lookup } : { ...lookup };
         try {
             const res = await fetch(`${baseUrl}/uploads/checkForExistingUpload`, {
-                body: JSON.stringify({ sha }),
+                body: JSON.stringify(body),
                 headers: {
                     'content-type': 'application/json',
                     ...auth.headers,
@@ -163,6 +246,10 @@ export const ApiGateway = {
         }
     },
     async downloadArtifactsZip(baseUrl, auth, uploadId, results, artifactsPath = './artifacts.zip') {
+        // Prefer bundle delivery; fall back to the inline download below.
+        if (await this.tryBundleDownload(baseUrl, auth, `/results/${uploadId}/artifacts-bundle?results=${results}`, artifactsPath, 'Failed to download artifacts')) {
+            return;
+        }
         try {
             const res = await fetch(`${baseUrl}/results/${uploadId}/download`, {
                 body: JSON.stringify({ results }),
@@ -185,7 +272,7 @@ export const ApiGateway = {
         }
     },
     async finaliseUpload(config) {
-        const { baseUrl, auth, id, metadata, path, sha, supabaseSuccess, backblazeSuccess, bytes } = config;
+        const { baseUrl, auth, id, metadata, path, sha, shaPlain, supabaseSuccess, backblazeSuccess, bytes } = config;
         try {
             const res = await fetch(`${baseUrl}/uploads/finaliseUpload`, {
                 body: JSON.stringify({
@@ -195,6 +282,7 @@ export const ApiGateway = {
                     metadata,
                     path, // This is tempPath for TUS uploads
                     ...(sha ? { sha } : {}),
+                    ...(shaPlain ? { shaPlain } : {}),
                     supabaseSuccess,
                 }),
                 headers: {
@@ -486,6 +574,13 @@ export const ApiGateway = {
         const { endpoint, defaultFilename, notFoundMessage, errorPrefix } = config[reportType];
         const finalReportPath = reportPath || path.resolve(process.cwd(), defaultFilename);
         const url = `${baseUrl}${endpoint}`;
+        // The HTML report is a ZIP bundle; prefer bundle delivery when available.
+        // (junit is a single small file and allure has its own endpoint — both stay
+        // on the inline path.)
+        if (reportType === 'html' &&
+            (await this.tryBundleDownload(baseUrl, auth, `/results/${uploadId}/report-bundle`, finalReportPath, errorPrefix))) {
+            return;
+        }
         try {
             // Make the download request
             const res = await fetch(url, {

package/dist/mcp/tools/run-cloud-test.d.ts

@@ -9,6 +9,6 @@ import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
  * `waitTimeoutSeconds`.
  *
  * Mirrors the `dcd cloud` command's submission path but headless: no Expo URL
- * download, mitm, GitHub metadata, or JSON-file output. Use the CLI for those.
+ * download, GitHub metadata, or JSON-file output. Use the CLI for those.
  */
 export declare function registerRunCloudTest(server: McpServer): void;

package/dist/mcp/tools/run-cloud-test.js

@@ -9,6 +9,7 @@ import { VersionService } from '../../services/version.service.js';
 import { uploadBinary, uploadFlowZip, verifyAppZip } from '../../methods.js';
 import { getCliVersion } from '../../utils/cli.js';
 import { fetchCompatibilityData } from '../../utils/compatibility.js';
+import { isEncryptionEnabled } from '../../utils/envelope.js';
 import { getConsoleUrl } from '../../utils/styling.js';
 import { getContext, logStderr } from '../context.js';
 import { jsonResult, runTool } from '../helpers.js';
@@ -26,7 +27,7 @@ const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
  * `waitTimeoutSeconds`.
  *
  * Mirrors the `dcd cloud` command's submission path but headless: no Expo URL
- * download, mitm, GitHub metadata, or JSON-file output. Use the CLI for those.
+ * download, GitHub metadata, or JSON-file output. Use the CLI for those.
  */
 export function registerRunCloudTest(server) {
     server.registerTool('dcd_run_cloud_test', {
@@ -130,6 +131,9 @@ export function registerRunCloudTest(server) {
                 sequentialFlowCount: executionPlan.sequence?.flows.length ?? 0,
             });
         }
+        // Client-side envelope encryption (binary/flow/env). No MCP flag, so
+        // it's env-driven: DCD_ENCRYPT / DCD_ENCRYPT_BINARIES.
+        const encrypt = isEncryptionEnabled();
         // Resolve the binary: existing id, or upload the local file.
         let appBinaryId = args.appBinaryId;
         if (!appBinaryId) {
@@ -145,6 +149,7 @@ export function registerRunCloudTest(server) {
             appBinaryId = await uploadBinary({
                 auth,
                 apiUrl,
+                encrypt,
                 filePath: args.appFile,
                 ignoreShaCheck: Boolean(args.ignoreShaCheck),
                 log: false,
@@ -153,10 +158,12 @@ export function registerRunCloudTest(server) {
         const { continueOnFailure = true } = executionPlan.sequence ?? {};
         const testSubmissionService = new TestSubmissionService();
         const { buffer, fields } = await testSubmissionService.buildTestPayload({
+            apiUrl,
             appBinaryId,
             cliVersion,
             commonRoot,
             continueOnFailure,
+            encrypt,
             executionPlan,
             flowFile,
             env: args.env ?? [],

package/dist/methods.d.ts

@@ -5,6 +5,12 @@ interface UploadBinaryConfig {
     auth: AuthContext;
     apiUrl: string;
     debug?: boolean;
+    /**
+     * Encrypt the binary before upload (client-side envelope encryption, #1138).
+     * Defaults to `DCD_ENCRYPT` / `DCD_ENCRYPT_BINARIES` when unset (see
+     * {@link isEncryptionEnabled}).
+     */
+    encrypt?: boolean;
     filePath: string;
     ignoreShaCheck?: boolean;
     log?: boolean;