@devicecloud.dev/dcd 5.6.0 → 5.7.0

package/dist/commands/cloud.d.ts

@@ -136,7 +136,7 @@ export declare const cloudCommand: import("citty").CommandDef<{
     readonly 'runner-type': {
         readonly type: "string";
         readonly default: "default";
-        readonly description: "[experimental] The type of runner to use (options: default, m4, m1, gpu1, cpu1) - note: anything other than default or cpu1 will incur premium pricing tiers, see https://docs.devicecloud.dev/configuration/runner-type for more information.";
+        readonly description: "[experimental] The type of runner to use (options: default, m4, m1, gpu1, cpu1) - note: anything other than default or cpu1 will incur premium pricing tiers; gpu1 is deprecated and will be removed on 9 November 2026 (gpu1 runs will then use cpu1). See https://docs.devicecloud.dev/configuration/runner-type for more information.";
     };
     readonly env: {
         readonly type: "string";
@@ -237,7 +237,8 @@ export declare const cloudCommand: import("citty").CommandDef<{
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.";
+        readonly hidden: true;
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
     };
     readonly 'api-key': {
         readonly type: "string";

package/dist/commands/cloud.js

@@ -17,7 +17,7 @@ import { VersionService } from '../services/version.service.js';
 import { isIosMatrixConfig } from '../types/domain/device.types.js';
 import { resolveAuth } from '../utils/auth.js';
 import { assertMatrixSupported, matrixIsIos, parseDeviceMatrix, } from '../utils/device-matrix.js';
-import { isEncryptionEnabled } from '../utils/envelope.js';
+import { checkKekForEncryption, resolveEncryption } from '../utils/envelope.js';
 import { detectCiContext, isCI } from '../utils/ci.js';
 import { CliError, coerceArray, collectRepeatedFlag, getCliVersion, getUpgradeCommand, logger, parseIntFlag, validateEnum, } from '../utils/cli.js';
 import { fetchCompatibilityData, } from '../utils/compatibility.js';
@@ -135,10 +135,11 @@ export const cloudCommand = defineCommand({
             const cancelPrevious = Boolean(args['cancel-previous']);
             const googlePlay = Boolean(args['google-play']);
             const ignoreShaCheck = Boolean(args['ignore-sha-check']);
-            // Single opt-in for client-side envelope encryption of every sensitive
-            // artifact — the binary (#1138), the flow zip (#1151), and env vars
-            // (#1152). Flag wins; otherwise DCD_ENCRYPT / DCD_ENCRYPT_BINARIES.
-            const encrypt = isEncryptionEnabled(args['encrypt'] ? true : undefined);
+            // Client-side envelope encryption of every sensitive artifact: the
+            // binary (#1138), the flow zip (#1151), and env vars (#1152). Kept as
+            // given (--no-encrypt is an explicit false) and resolved once the
+            // compatibility data, which carries the org's default, is in.
+            const encryptFlag = args.encrypt;
             const includeTags = coerceArray(collectRepeatedFlag(rawArgs, ['--include-tags']));
             // Devices and OS versions are checked against the API's live
             // compatibility data further down (DeviceValidationService), not the
@@ -257,6 +258,17 @@ export const cloudCommand = defineCommand({
             if (debug) {
                 out(`[DEBUG] API URL: ${apiUrl}`);
             }
+            const encryption = checkKekForEncryption(resolveEncryption({
+                flag: encryptFlag,
+                serverDefault: compatibilityData.encryption?.defaultOn,
+            }), apiUrl);
+            const encrypt = encryption.enabled;
+            if (encryption.notice)
+                out(ui.note(encryption.notice));
+            telemetry.recordEncryption({ source: encryption.source });
+            if (debug) {
+                out(`[DEBUG] Encryption: ${encrypt ? 'on' : 'off'} (${encryption.source})`);
+            }
             const resolvedMaestroVersion = versionService.resolveMaestroVersion(maestroVersion, compatibilityData, {
                 debug,
                 logger: (m) => out(m),
@@ -271,9 +283,6 @@ export const cloudCommand = defineCommand({
             if (runnerType === 'm1') {
                 out(ui.info('runnerType m1 is experimental and currently supports Android only (all devices, API level 34-36).'));
             }
-            if (runnerType === 'gpu1') {
-                out(ui.info('runnerType gpu1 is Android-only (all devices, API level 34+), available to all users.'));
-            }
             const firstFile = args.firstFile;
             const secondFile = args.secondFile;
             let finalBinaryId = appBinaryId;
@@ -342,6 +351,9 @@ export const cloudCommand = defineCommand({
                 // customer relied on the default), so a notice can target either.
                 maestro_version: resolvedMaestroVersion,
                 requested_maestro_version: maestroVersion,
+                // As requested ('default' when not passed), not as the API resolves
+                // it: the gpu1 retirement notice is aimed at runs that ask for gpu1.
+                runner_type: runnerType,
                 cli_version: cliVersion,
                 ci_provider: ciContext.provider,
                 ci_wrapper_version: ciContext.wrapperVersion,
@@ -521,6 +533,9 @@ export const cloudCommand = defineCommand({
                 }
                 return;
             }
+            if (encrypt && encryption.source === 'server') {
+                out(ui.note('Encrypting uploads (beta); opt out with --no-encrypt'));
+            }
             if (!finalBinaryId) {
                 if (!finalAppFile) {
                     throw new CliError('You must provide either an app binary id or an app file');
@@ -538,6 +553,7 @@ export const cloudCommand = defineCommand({
                     log: !json,
                 });
                 finalBinaryId = binaryId;
+                telemetry.recordEncryption({ binary: encrypt });
                 if (debug) {
                     out(`[DEBUG] Binary uploaded with ID: ${binaryId}`);
                 }
@@ -593,6 +609,7 @@ export const cloudCommand = defineCommand({
                 disableAnimations,
                 renderEngine,
             });
+            telemetry.recordEncryption({ env: encrypt && env.length > 0, flow: encrypt });
             // Device-matrix cost preview: the server prices the exact fan-out (quote
             // == charge) so the user sees the cell count and estimated cost before the
             // flow zip is uploaded. An unsupported cell fails fast here. Skipped when

package/dist/commands/upload.d.ts

@@ -9,7 +9,8 @@ export declare const uploadCommand: import("citty").CommandDef<{
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.";
+        readonly hidden: true;
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
     };
     readonly debug: {
         readonly type: "boolean";

package/dist/commands/upload.js

@@ -4,10 +4,13 @@ import { apiFlags } from '../config/flags/api.flags.js';
 import { binaryFlags } from '../config/flags/binary.flags.js';
 import { outputFlags } from '../config/flags/output.flags.js';
 import { uploadBinary, verifyAppZip } from '../methods.js';
+import { telemetry } from '../services/telemetry.service.js';
 import { resolveAuth } from '../utils/auth.js';
-import { CliError, logger } from '../utils/cli.js';
+import { detectCiContext } from '../utils/ci.js';
+import { CliError, getCliVersion, logger } from '../utils/cli.js';
+import { fetchCompatibilityData } from '../utils/compatibility.js';
 import { resolveApiUrl } from '../utils/config-store.js';
-import { isEncryptionEnabled } from '../utils/envelope.js';
+import { checkKekForEncryption, resolveEncryption } from '../utils/envelope.js';
 import { downloadExpoUrl, extractTarGz, findAppBundle, isUrl } from '../utils/expo.js';
 import { colors, formatId } from '../utils/styling.js';
 import { ui } from '../utils/ui.js';
@@ -42,13 +45,34 @@ export const uploadCommand = defineCommand({
             const apiUrl = resolveApiUrl(args['api-url']);
             const appUrl = args['app-url'];
             const ignoreShaCheck = Boolean(args['ignore-sha-check']);
-            // Same rule as `dcd cloud`: the flag turns encryption on, and without it
-            // DCD_ENCRYPT decides. Passing `false` here used to mean "explicitly
-            // off", which silently beat DCD_ENCRYPT=1 for every `dcd upload`.
-            const encryptBinary = isEncryptionEnabled(args['encrypt'] ? true : undefined);
+            // Kept as given, so --no-encrypt is an explicit false and a missing flag
+            // leaves DCD_ENCRYPT and then the org's default to decide.
+            const encryptFlag = args.encrypt;
             const debug = Boolean(args.debug);
             const positional = args.appFile;
             const auth = await resolveAuth({ apiKeyFlag });
+            // Same order as `dcd cloud`, whose compatibility fetch carries the org's
+            // encryption default. `dcd upload` never needed that data before, so a
+            // failed fetch leaves the default off rather than failing the upload.
+            let serverDefault;
+            try {
+                const ciContext = detectCiContext();
+                const compatibilityData = await fetchCompatibilityData(apiUrl, auth, {
+                    cliVersion: getCliVersion(),
+                    ciProvider: ciContext.provider,
+                    ciWrapperVersion: ciContext.wrapperVersion,
+                });
+                serverDefault = compatibilityData.encryption?.defaultOn;
+            }
+            catch (error) {
+                if (debug) {
+                    out(`[DEBUG] Failed to fetch compatibility data, so the org's encryption default is off: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            const encryption = checkKekForEncryption(resolveEncryption({ flag: encryptFlag, serverDefault }), apiUrl);
+            if (encryption.notice)
+                out(ui.note(encryption.notice));
+            telemetry.recordEncryption({ source: encryption.source });
             let resolvedFile = appUrl ?? positional;
             if (!resolvedFile) {
                 throw new CliError('You must provide an app file path or a signed Expo URL via --app-url');
@@ -75,16 +99,22 @@ export const uploadCommand = defineCommand({
                 await verifyAppZip(resolvedFile);
             }
             out(ui.section('Uploading app binary'));
-            out(ui.branch(ui.fields([['file', colors.highlight(resolvedFile)]])));
+            out(ui.branch([
+                ...ui.fields([['file', colors.highlight(resolvedFile)]]),
+                ...(encryption.enabled && encryption.source === 'server'
+                    ? [ui.note('Encrypting uploads (beta); opt out with --no-encrypt')]
+                    : []),
+            ]));
             const appBinaryId = await uploadBinary({
                 auth,
                 apiUrl,
                 debug,
-                encrypt: encryptBinary,
+                encrypt: encryption.enabled,
                 filePath: resolvedFile,
                 ignoreShaCheck,
                 log: !json,
             });
+            telemetry.recordEncryption({ binary: encryption.enabled });
             if (json) {
                 // eslint-disable-next-line no-console
                 console.log(JSON.stringify({ appBinaryId }, null, 2));

package/dist/config/environments.d.ts

@@ -40,6 +40,15 @@ export declare const ENVIRONMENTS: Record<DcdEnvName, DcdEnvironment>;
 export declare function findEnvByApiUrl(apiUrl: string): DcdEnvironment | undefined;
 /** Map a caller-supplied API URL to one of the known environments. */
 export declare function inferEnvFromApiUrl(apiUrl: string): DcdEnvName;
+/**
+ * The environment whose pinned KEK may encrypt uploads to `apiUrl` (dcd#1138),
+ * or undefined when the URL isn't a known one. Stricter than
+ * {@link inferEnvFromApiUrl}, which falls back to prod for any URL: that is
+ * harmless for picking a console link, but an upload encrypted for a KEK its
+ * API can't unwrap is unusable. Known means the host of a pinned `apiUrl`, or
+ * `localhost`, which runs against dev.
+ */
+export declare function kekEnvForApiUrl(apiUrl: string): DcdEnvName | undefined;
 /**
  * Frontend URL to open for a given API URL. Same as
  * `ENVIRONMENTS[inferEnvFromApiUrl(apiUrl)].frontendUrl`, except that when the

package/dist/config/environments.js

@@ -42,6 +42,27 @@ export function inferEnvFromApiUrl(apiUrl) {
         return 'dev';
     return 'prod';
 }
+/**
+ * The environment whose pinned KEK may encrypt uploads to `apiUrl` (dcd#1138),
+ * or undefined when the URL isn't a known one. Stricter than
+ * {@link inferEnvFromApiUrl}, which falls back to prod for any URL: that is
+ * harmless for picking a console link, but an upload encrypted for a KEK its
+ * API can't unwrap is unusable. Known means the host of a pinned `apiUrl`, or
+ * `localhost`, which runs against dev.
+ */
+export function kekEnvForApiUrl(apiUrl) {
+    let host;
+    try {
+        host = new URL(apiUrl).hostname;
+    }
+    catch {
+        return undefined;
+    }
+    if (host === 'localhost')
+        return 'dev';
+    const names = Object.keys(ENVIRONMENTS);
+    return names.find((name) => new URL(ENVIRONMENTS[name].apiUrl).hostname === host);
+}
 /**
  * Frontend URL to open for a given API URL. Same as
  * `ENVIRONMENTS[inferEnvFromApiUrl(apiUrl)].frontendUrl`, except that when the

package/dist/config/flags/binary.flags.d.ts

@@ -21,6 +21,7 @@ export declare const binaryFlags: {
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.";
+        readonly hidden: true;
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
     };
 };

package/dist/config/flags/binary.flags.js

@@ -21,6 +21,9 @@ export const binaryFlags = {
     },
     encrypt: {
         type: 'boolean',
-        description: 'Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.',
+        // Left out of --help while encryption is a per-org beta (dcd#1138); the
+        // flag still parses, --no-encrypt included.
+        hidden: true,
+        description: 'Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.',
     },
 };

package/dist/config/flags/execution.flags.d.ts

@@ -40,6 +40,6 @@ export declare const executionFlags: {
     readonly 'runner-type': {
         readonly type: "string";
         readonly default: "default";
-        readonly description: "[experimental] The type of runner to use (options: default, m4, m1, gpu1, cpu1) - note: anything other than default or cpu1 will incur premium pricing tiers, see https://docs.devicecloud.dev/configuration/runner-type for more information.";
+        readonly description: "[experimental] The type of runner to use (options: default, m4, m1, gpu1, cpu1) - note: anything other than default or cpu1 will incur premium pricing tiers; gpu1 is deprecated and will be removed on 9 November 2026 (gpu1 runs will then use cpu1). See https://docs.devicecloud.dev/configuration/runner-type for more information.";
     };
 };

package/dist/config/flags/execution.flags.js

@@ -40,6 +40,6 @@ export const executionFlags = {
     'runner-type': {
         type: 'string',
         default: 'default',
-        description: '[experimental] The type of runner to use (options: default, m4, m1, gpu1, cpu1) - note: anything other than default or cpu1 will incur premium pricing tiers, see https://docs.devicecloud.dev/configuration/runner-type for more information.',
+        description: '[experimental] The type of runner to use (options: default, m4, m1, gpu1, cpu1) - note: anything other than default or cpu1 will incur premium pricing tiers; gpu1 is deprecated and will be removed on 9 November 2026 (gpu1 runs will then use cpu1). See https://docs.devicecloud.dev/configuration/runner-type for more information.',
     },
 };

package/dist/constants.d.ts

@@ -122,7 +122,7 @@ export declare const flags: {
     readonly 'runner-type': {
         readonly type: "string";
         readonly default: "default";
-        readonly description: "[experimental] The type of runner to use (options: default, m4, m1, gpu1, cpu1) - note: anything other than default or cpu1 will incur premium pricing tiers, see https://docs.devicecloud.dev/configuration/runner-type for more information.";
+        readonly description: "[experimental] The type of runner to use (options: default, m4, m1, gpu1, cpu1) - note: anything other than default or cpu1 will incur premium pricing tiers; gpu1 is deprecated and will be removed on 9 November 2026 (gpu1 runs will then use cpu1). See https://docs.devicecloud.dev/configuration/runner-type for more information.";
     };
     readonly env: {
         readonly type: "string";
@@ -223,7 +223,8 @@ export declare const flags: {
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Can also be enabled with DCD_ENCRYPT=1.";
+        readonly hidden: true;
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
     };
     readonly 'api-key': {
         readonly type: "string";

package/dist/index.js

@@ -14,6 +14,7 @@ import { uploadCommand } from './commands/upload.js';
 import { whoamiCommand } from './commands/whoami.js';
 import { telemetry } from './services/telemetry.service.js';
 import { CliError, getCliVersion, logger } from './utils/cli.js';
+import { withoutHiddenArgs } from './utils/help.js';
 // @clack/prompts ships the US spelling ("Canceled") for its built-in
 // spinner/prompt cancellation message; align it with the British spelling
 // ("Cancelled") used everywhere else in the CLI.
@@ -65,12 +66,17 @@ async function resolveSubCommand(cmd, rawArgs, parent) {
     }
     return [cmd, parent];
 }
+// Usage for the (sub)command named in rawArgs, without the args marked hidden.
+async function showHelp(rawArgs) {
+    const [cmd, parent] = await resolveSubCommand(main, rawArgs);
+    await showUsage(await withoutHiddenArgs(cmd), parent);
+}
 async function run() {
     const rawArgs = process.argv.slice(2);
     telemetry.recordCommandStart();
     try {
         if (rawArgs.includes('--help') || rawArgs.includes('-h')) {
-            await showUsage(...(await resolveSubCommand(main, rawArgs)));
+            await showHelp(rawArgs);
         }
         else if (rawArgs.length === 1 && rawArgs[0] === '--version') {
             logger.log(getCliVersion());
@@ -85,7 +91,7 @@ async function run() {
         // citty throws CLIError (by name — the class isn't exported) for usage
         // problems like unknown commands or missing required args.
         if (error instanceof Error && error.name === 'CLIError') {
-            await showUsage(...(await resolveSubCommand(main, rawArgs)));
+            await showHelp(rawArgs);
         }
         const exitCode = error instanceof CliError ? error.exitCode : 1;
         // logger.error prints the message, records failure telemetry, flushes

package/dist/mcp/helpers.d.ts

@@ -11,6 +11,8 @@ export declare function errorResult(message: string): CallToolResult;
 /**
  * Wrap a tool handler: emit start/success/failure telemetry, flush it
  * (fire-and-forget — the process outlives the call), and translate thrown
- * errors into an `isError` result instead of rejecting.
+ * errors into an `isError` result instead of rejecting. Fields the handler
+ * puts on `telemetryExtra` ride on that call's completed or failed event; it
+ * is per call, since one long-lived server can run several tools at once.
  */
-export declare function runTool(name: string, fn: () => Promise<CallToolResult>): Promise<CallToolResult>;
+export declare function runTool(name: string, fn: (telemetryExtra: Record<string, unknown>) => Promise<CallToolResult>): Promise<CallToolResult>;

package/dist/mcp/helpers.js

@@ -15,19 +15,22 @@ export function errorResult(message) {
 /**
  * Wrap a tool handler: emit start/success/failure telemetry, flush it
  * (fire-and-forget — the process outlives the call), and translate thrown
- * errors into an `isError` result instead of rejecting.
+ * errors into an `isError` result instead of rejecting. Fields the handler
+ * puts on `telemetryExtra` ride on that call's completed or failed event; it
+ * is per call, since one long-lived server can run several tools at once.
  */
 export async function runTool(name, fn) {
     const start = Date.now();
+    const telemetryExtra = {};
     telemetry.recordMcpToolStart(name);
     try {
-        const result = await fn();
-        telemetry.recordMcpToolSuccess(name, Date.now() - start);
+        const result = await fn(telemetryExtra);
+        telemetry.recordMcpToolSuccess(name, Date.now() - start, telemetryExtra);
         void telemetry.flush();
         return result;
     }
     catch (error) {
-        telemetry.recordMcpToolFailure(name, error, Date.now() - start);
+        telemetry.recordMcpToolFailure(name, error, Date.now() - start, telemetryExtra);
         void telemetry.flush();
         return errorResult(error instanceof Error ? error.message : String(error));
     }

package/dist/mcp/tools/run-cloud-test.js

@@ -11,7 +11,7 @@ import { uploadBinary, uploadFlowZip, verifyAppZip } from '../../methods.js';
 import { refreshAuth } from '../../utils/auth.js';
 import { getCliVersion } from '../../utils/cli.js';
 import { fetchCompatibilityData } from '../../utils/compatibility.js';
-import { isEncryptionEnabled } from '../../utils/envelope.js';
+import { checkKekForEncryption, resolveEncryption } from '../../utils/envelope.js';
 import { getConsoleUrl } from '../../utils/styling.js';
 import { getContext, logStderr } from '../context.js';
 import { jsonResult, runTool } from '../helpers.js';
@@ -69,13 +69,17 @@ export function registerRunCloudTest(server) {
             runnerType: z
                 .enum(['default', 'm4', 'm1', 'gpu1', 'cpu1'])
                 .optional()
-                .describe('Runner type (default "default")'),
+                .describe('Runner type (default "default"). gpu1 is deprecated and will be removed on 9 November 2026; prefer cpu1.'),
             configFile: z.string().optional().describe('Path to a workspace config.yaml'),
             ignoreShaCheck: z
                 .boolean()
                 .optional()
                 .describe('Force re-upload of the binary even if an identical one exists'),
             dryRun: z.boolean().optional().describe('Preview flows that would run without submitting'),
+            encrypt: z
+                .boolean()
+                .optional()
+                .describe('true encrypts the binary, flow zip and env vars client-side before upload; false never does. Omit to follow DCD_ENCRYPT, then the organization default.'),
             wait: z
                 .boolean()
                 .optional()
@@ -94,7 +98,7 @@ export function registerRunCloudTest(server) {
             destructiveHint: true,
             openWorldHint: true,
         },
-    }, async (args) => runTool('dcd_run_cloud_test', async () => {
+    }, async (args) => runTool('dcd_run_cloud_test', async (telemetryExtra) => {
         if (args.appFile && args.appBinaryId) {
             throw new Error('Provide only one of appFile or appBinaryId, not both.');
         }
@@ -142,9 +146,26 @@ export function registerRunCloudTest(server) {
                 sequentialFlowCount: executionPlan.sequence?.flows.length ?? 0,
             });
         }
-        // Client-side envelope encryption (binary/flow/env). No MCP flag, so
-        // it's env-driven: DCD_ENCRYPT / DCD_ENCRYPT_BINARIES.
-        const encrypt = isEncryptionEnabled();
+        // Client-side envelope encryption (binary/flow/env), in the same order
+        // as `dcd cloud`: the encrypt input, DCD_ENCRYPT, then the org default.
+        const encryption = checkKekForEncryption(resolveEncryption({
+            flag: args.encrypt,
+            serverDefault: compatibilityData.encryption?.defaultOn,
+        }), apiUrl);
+        const encrypt = encryption.enabled;
+        if (encryption.notice)
+            logStderr(encryption.notice);
+        // Filled in as each part is encrypted; sent on this call's telemetry.
+        const encryptTelemetry = {
+            binary: false,
+            env: false,
+            flow: false,
+            source: encryption.source,
+        };
+        telemetryExtra.encrypt = encryptTelemetry;
+        if (encrypt && encryption.source === 'server') {
+            logStderr('Encrypting uploads (beta); opt out with encrypt: false');
+        }
         // Resolve the binary: existing id, or upload the local file.
         let appBinaryId = args.appBinaryId;
         if (!appBinaryId) {
@@ -165,6 +186,7 @@ export function registerRunCloudTest(server) {
                 ignoreShaCheck: Boolean(args.ignoreShaCheck),
                 log: false,
             });
+            encryptTelemetry.binary = encrypt;
         }
         const { continueOnFailure = true } = executionPlan.sequence ?? {};
         const testSubmissionService = new TestSubmissionService();
@@ -191,6 +213,8 @@ export function registerRunCloudTest(server) {
             retry: args.retry,
             logger: logStderr,
         });
+        encryptTelemetry.flow = encrypt;
+        encryptTelemetry.env = encrypt && (args.env?.length ?? 0) > 0;
         // New path: upload the zip to storage, then submit a JSON test
         // referencing it. Older API deployments lack these endpoints (404/405);
         // fall back to the legacy multipart POST /uploads/flow. Mirrors

package/dist/methods.d.ts

@@ -7,10 +7,10 @@ interface UploadBinaryConfig {
     debug?: boolean;
     /**
      * Encrypt the binary before upload (client-side envelope encryption, #1138).
-     * Defaults to `DCD_ENCRYPT` / `DCD_ENCRYPT_BINARIES` when unset (see
-     * {@link isEncryptionEnabled}).
+     * Required: callers pass the decision from `resolveEncryption`, so nothing
+     * here falls back to a default of its own.
      */
-    encrypt?: boolean;
+    encrypt: boolean;
     filePath: string;
     ignoreShaCheck?: boolean;
     log?: boolean;

package/dist/methods.js

@@ -10,8 +10,8 @@ import * as yazl from 'yazl';
 import { inferEnvFromApiUrl } from './config/environments.js';
 import { ApiError, ApiGateway } from './gateways/api-gateway.js';
 import { SupabaseGateway } from './gateways/supabase-gateway.js';
-import { MetadataExtractorService } from './services/metadata-extractor.service.js';
-import { encryptFileToPath, generateDek, isEncryptionEnabled, resolveKekPublicKey, wrapDek, } from './utils/envelope.js';
+import { detectFlutterEngine, MetadataExtractorService, } from './services/metadata-extractor.service.js';
+import { encryptFileToPath, generateDek, resolveKekPublicKey, wrapDek, } from './utils/envelope.js';
 import { colors, formatId } from './utils/styling.js';
 const mimeTypeLookupByExtension = {
     apk: 'application/vnd.android.package-archive',
@@ -94,8 +94,7 @@ export const verifyAppZip = async (zipPath) => {
     }
 };
 export const uploadBinary = async (config) => {
-    const { filePath, apiUrl, auth, ignoreShaCheck = false, log = true, debug = false } = config;
-    const encrypt = isEncryptionEnabled(config.encrypt);
+    const { filePath, apiUrl, auth, encrypt, ignoreShaCheck = false, log = true, debug = false } = config;
     if (log) {
         ux.action.start(colors.bold('Checking and uploading binary'), colors.dim('Initializing'), {
             stdout: true,
@@ -199,8 +198,8 @@ export const uploadBinary = async (config) => {
 async function encryptUploadSource(source, apiUrl, debug) {
     const kek = resolveKekPublicKey(apiUrl);
     if (!kek) {
-        throw new Error('Binary encryption was requested but no KEK public key is configured for this environment. ' +
-            'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64> or pin one in src/config/environments.ts.');
+        throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the organization default) but no KEK public key is configured for this API. ' +
+            'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64>, or pass --no-encrypt to upload without encryption.');
     }
     const dek = generateDek();
     const enc = wrapDek(dek, kek);
@@ -359,7 +358,7 @@ async function checkExistingUpload(apiUrl, auth, lookup, debug) {
         }
         if (exists && lookup.encrypted && encrypted !== true) {
             if (debug) {
-                console.log('[DEBUG] Ignoring dedup hit: encryption was requested but the matched binary is not encrypted');
+                console.log('[DEBUG] Ignoring dedup hit: encryption is on but the matched binary is not encrypted');
             }
             return { exists: false };
         }
@@ -597,6 +596,17 @@ async function performUpload(config) {
     const metadata = await extractBinaryMetadata(filePath, debug);
     if (enc) {
         metadata.enc = enc;
+        // The API can only look for the Flutter engine in a plaintext APK, so an
+        // encrypted one carries the verdict the API would have reached itself.
+        if (metadata.platform === 'android') {
+            const usesFlutterEngine = await detectFlutterEngine(filePath);
+            if (usesFlutterEngine !== undefined) {
+                metadata.usesFlutterEngine = usesFlutterEngine;
+            }
+            if (debug) {
+                console.log(`[DEBUG] Flutter engine: ${usesFlutterEngine ?? 'unknown'}`);
+            }
+        }
     }
     const env = inferEnvFromApiUrl(apiUrl);
     // Upload to Backblaze first (primary)

package/dist/services/metadata-extractor.service.d.ts

@@ -16,6 +16,25 @@ export declare class AndroidMetadataExtractor implements IMetadataExtractor {
     canHandle(filePath: string): boolean;
     extract(filePath: string): Promise<TAppMetadata>;
 }
+/**
+ * The entry that marks an APK as shipping the Flutter engine: the x86_64
+ * build, the one an emulator loads. Must match FLUTTER_ENGINE_ENTRY in the
+ * dcd API (api/src/apps/uploads/flutter-detection.ts).
+ */
+export declare const FLUTTER_ENGINE_ENTRY = "lib/x86_64/libflutter.so";
+/**
+ * Whether the APK at `apkPath` ships the Flutter engine, read from the zip's
+ * central directory. The API works this out itself for a plaintext binary
+ * but can't see inside an encrypted one, so an encrypted upload sends the
+ * verdict in its metadata (dcd#1138). Without it a Flutter app runs on the
+ * lavapipe renderer, which crashes it.
+ *
+ * Same rule as the API, which byte-searches the central directory for the
+ * entry name, so a name that contains it counts too: an APK then gets the
+ * same renderer whether or not it was encrypted. Undefined when the APK
+ * can't be read, which the API also treats as unknown.
+ */
+export declare function detectFlutterEngine(apkPath: string): Promise<boolean | undefined>;
 /**
  * Extracts metadata from iOS .app directories
  */

package/dist/services/metadata-extractor.service.js

@@ -46,6 +46,37 @@ export class AndroidMetadataExtractor {
         }
     }
 }
+/**
+ * The entry that marks an APK as shipping the Flutter engine: the x86_64
+ * build, the one an emulator loads. Must match FLUTTER_ENGINE_ENTRY in the
+ * dcd API (api/src/apps/uploads/flutter-detection.ts).
+ */
+export const FLUTTER_ENGINE_ENTRY = 'lib/x86_64/libflutter.so';
+/**
+ * Whether the APK at `apkPath` ships the Flutter engine, read from the zip's
+ * central directory. The API works this out itself for a plaintext binary
+ * but can't see inside an encrypted one, so an encrypted upload sends the
+ * verdict in its metadata (dcd#1138). Without it a Flutter app runs on the
+ * lavapipe renderer, which crashes it.
+ *
+ * Same rule as the API, which byte-searches the central directory for the
+ * entry name, so a name that contains it counts too: an APK then gets the
+ * same renderer whether or not it was encrypted. Undefined when the APK
+ * can't be read, which the API also treats as unknown.
+ */
+export async function detectFlutterEngine(apkPath) {
+    const zip = new StreamZip.async({ file: apkPath });
+    try {
+        const names = Object.keys(await zip.entries());
+        return names.some((name) => name.includes(FLUTTER_ENGINE_ENTRY));
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        await zip.close().catch(() => { });
+    }
+}
 /**
  * Extracts metadata from iOS .app directories
  */