@devicecloud.dev/dcd 5.9.0-beta.1 → 5.10.0-beta.1

package/dist/commands/cloud.d.ts

@@ -242,8 +242,7 @@ export declare const cloudCommand: import("citty").CommandDef<{
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly hidden: true;
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.";
     };
     readonly 'api-key': {
         readonly type: "string";

package/dist/commands/cloud.js

@@ -140,7 +140,7 @@ export const cloudCommand = defineCommand({
             // Client-side envelope encryption of every sensitive artifact: the
             // binary (#1138), the flow zip (#1151), and env vars (#1152). Kept as
             // given (--no-encrypt is an explicit false) and resolved once the
-            // compatibility data, which carries the org's default, is in.
+            // compatibility data, which carries the server default, is in.
             const encryptFlag = args.encrypt;
             const includeTags = coerceArray(collectRepeatedFlag(rawArgs, ['--include-tags']));
             // Devices and OS versions are checked against the API's live
@@ -261,7 +261,7 @@ export const cloudCommand = defineCommand({
             if (debug) {
                 out(`[DEBUG] API URL: ${apiUrl}`);
             }
-            const encryption = checkKekForEncryption(resolveEncryption({
+            const encryption = await checkKekForEncryption(resolveEncryption({
                 flag: encryptFlag,
                 serverDefault: compatibilityData.encryption?.defaultOn,
             }), apiUrl);
@@ -537,7 +537,7 @@ export const cloudCommand = defineCommand({
                 return;
             }
             if (encrypt && encryption.source === 'server') {
-                out(ui.note('Encrypting uploads (beta); opt out with --no-encrypt'));
+                out(ui.note('Encrypting uploads; opt out with --no-encrypt'));
             }
             if (!finalBinaryId) {
                 if (!finalAppFile) {

package/dist/commands/login.js

@@ -35,7 +35,8 @@ import * as p from '@clack/prompts';
 import { defineCommand } from 'citty';
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { ENVIRONMENTS, inferEnvFromApiUrl, resolveFrontendUrl } from '../config/environments.js';
+import { ENVIRONMENTS, inferEnvFromApiUrl, resolveFrontendUrl, } from '../config/environments.js';
+import { getSupabaseKey } from '../config/supabase-key.js';
 import { jsonFlag } from '../config/flags/output.flags.js';
 import { canPrompt } from '../utils/ci.js';
 import { CliError, logger } from '../utils/cli.js';
@@ -179,7 +180,7 @@ export const loginCommand = defineCommand({
                 // rejects it, the token itself is bad; if Supabase accepts, the
                 // api's JwtService is misconfigured.
                 const iss = decodeJwtIssuer(payload.access_token);
-                const supabaseUser = await probeSupabaseUser(iss, ENVIRONMENTS[env].supabase.anonKey, payload.access_token);
+                const supabaseUser = await probeSupabaseUser(iss, env, payload.access_token);
                 const parts = [
                     iss ? `token iss: ${iss}` : null,
                     `supabase /auth/v1/user: ${supabaseUser}`,
@@ -287,14 +288,14 @@ async function pollForClaim(apiUrl, state, codeVerifier) {
 function base64url(buf) {
     return buf.toString('base64').replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
 }
-async function probeSupabaseUser(iss, anonKey, token) {
+async function probeSupabaseUser(iss, env, token) {
     if (!iss)
         return 'skipped (no iss)';
     try {
         const res = await fetch(`${iss}/user`, {
             headers: {
                 authorization: `Bearer ${token}`,
-                apikey: anonKey,
+                apikey: await getSupabaseKey(env),
             },
         });
         const bodyText = await res.text().catch(() => '');

package/dist/commands/logout.js

@@ -3,7 +3,6 @@
  * it on Supabase. Leaves DEVICE_CLOUD_API_KEY (env/flag) untouched.
  */
 import { defineCommand } from 'citty';
-import { ENVIRONMENTS } from '../config/environments.js';
 import { jsonFlag } from '../config/flags/output.flags.js';
 import { CliAuthGateway } from '../gateways/cli-auth-gateway.js';
 import { logger } from '../utils/cli.js';
@@ -31,8 +30,7 @@ export const logoutCommand = defineCommand({
             }
             return;
         }
-        const { anonKey } = ENVIRONMENTS[config.env].supabase;
-        await CliAuthGateway.signOut(config.supabase_url, anonKey, config.session);
+        await CliAuthGateway.signOut(config.supabase_url, config.env, config.session);
         clearConfig();
         if (json) {
             logger.json({ status: 'SUCCESS', loggedOut: true, user: config.session.user_email });

package/dist/commands/upload.d.ts

@@ -9,8 +9,7 @@ export declare const uploadCommand: import("citty").CommandDef<{
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly hidden: true;
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.";
     };
     readonly debug: {
         readonly type: "boolean";

package/dist/commands/upload.js

@@ -46,7 +46,7 @@ export const uploadCommand = defineCommand({
             const appUrl = args['app-url'];
             const ignoreShaCheck = Boolean(args['ignore-sha-check']);
             // Kept as given, so --no-encrypt is an explicit false and a missing flag
-            // leaves DCD_ENCRYPT and then the org's default to decide.
+            // leaves DCD_ENCRYPT and then the server default to decide.
             const encryptFlag = args.encrypt;
             const debug = Boolean(args.debug);
             const positional = args.appFile;
@@ -69,7 +69,7 @@ export const uploadCommand = defineCommand({
                     out(`[DEBUG] Failed to fetch compatibility data, so the org's encryption default is off: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
-            const encryption = checkKekForEncryption(resolveEncryption({ flag: encryptFlag, serverDefault }), apiUrl);
+            const encryption = await checkKekForEncryption(resolveEncryption({ flag: encryptFlag, serverDefault }), apiUrl);
             if (encryption.notice)
                 out(ui.note(encryption.notice));
             telemetry.recordEncryption({ source: encryption.source });
@@ -102,7 +102,7 @@ export const uploadCommand = defineCommand({
             out(ui.branch([
                 ...ui.fields([['file', colors.highlight(resolvedFile)]]),
                 ...(encryption.enabled && encryption.source === 'server'
-                    ? [ui.note('Encrypting uploads (beta); opt out with --no-encrypt')]
+                    ? [ui.note('Encrypting uploads; opt out with --no-encrypt')]
                     : []),
             ]));
             const appBinaryId = await uploadBinary({

package/dist/config/cli-config.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The dcd API's public `GET /cli-config`: runtime configuration the CLI used to
+ * compile in, fetched from the API it talks to so that rotating any of it is an
+ * env change on the API rather than a CLI release.
+ *
+ * - `supabase_publishable_key` (dcd#1112): see ./supabase-key.ts.
+ * - `binary_kek_public_key` (dcd#1138): the newest KEK public key the API
+ *   publishes for client-side envelope encryption, with the version the API
+ *   unwraps it with. Absent when the API publishes none.
+ *
+ * Fetched once per process per API URL and kept in memory only. It is
+ * deliberately not cached on disk: a stale Supabase key makes GoTrue answer a
+ * refresh with a 4xx, which `resolveAuth` treats as a dead session and deletes
+ * the user's login, and a stale KEK would wrap uploads the API can no longer
+ * unwrap. A failed fetch is not cached, so the next call retries.
+ */
+export interface CliConfig {
+    supabase_url?: string;
+    supabase_publishable_key?: string;
+    binary_kek_public_key?: {
+        version: number;
+        key: string;
+    };
+}
+/** `apiUrl` without trailing slashes, so `…/` and `…` share one cache entry. */
+export declare function cliConfigUrl(apiUrl: string): string;
+/** The API's CLI config. A failed fetch is not cached, so the next call retries. */
+export declare function getCliConfig(apiUrl: string): Promise<CliConfig>;
+/** Test seam: forget fetched configs. */
+export declare function resetCliConfigCache(): void;

package/dist/config/cli-config.js

@@ -0,0 +1,49 @@
+/**
+ * The dcd API's public `GET /cli-config`: runtime configuration the CLI used to
+ * compile in, fetched from the API it talks to so that rotating any of it is an
+ * env change on the API rather than a CLI release.
+ *
+ * - `supabase_publishable_key` (dcd#1112): see ./supabase-key.ts.
+ * - `binary_kek_public_key` (dcd#1138): the newest KEK public key the API
+ *   publishes for client-side envelope encryption, with the version the API
+ *   unwraps it with. Absent when the API publishes none.
+ *
+ * Fetched once per process per API URL and kept in memory only. It is
+ * deliberately not cached on disk: a stale Supabase key makes GoTrue answer a
+ * refresh with a 4xx, which `resolveAuth` treats as a dead session and deletes
+ * the user's login, and a stale KEK would wrap uploads the API can no longer
+ * unwrap. A failed fetch is not cached, so the next call retries.
+ */
+const FETCH_TIMEOUT_MS = 10_000;
+const cache = new Map();
+/** `apiUrl` without trailing slashes, so `…/` and `…` share one cache entry. */
+export function cliConfigUrl(apiUrl) {
+    return `${apiUrl.replace(/\/+$/, '')}/cli-config`;
+}
+async function fetchCliConfig(apiUrl) {
+    const url = cliConfigUrl(apiUrl);
+    const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    if (!res.ok) {
+        throw new Error(`Failed to fetch CLI config from ${url}: HTTP ${res.status}`);
+    }
+    const body = await res.json();
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+        throw new Error(`CLI config from ${url} is not a JSON object`);
+    }
+    return body;
+}
+/** The API's CLI config. A failed fetch is not cached, so the next call retries. */
+export function getCliConfig(apiUrl) {
+    const key = cliConfigUrl(apiUrl);
+    let pending = cache.get(key);
+    if (!pending) {
+        pending = fetchCliConfig(apiUrl);
+        cache.set(key, pending);
+        pending.catch(() => cache.delete(key));
+    }
+    return pending;
+}
+/** Test seam: forget fetched configs. */
+export function resetCliConfigCache() {
+    cache.clear();
+}

package/dist/config/environments.d.ts

@@ -1,12 +1,12 @@
 /**
  * Per-env devicecloud.dev coordinates — single source of truth for the URLs
- * and Supabase credentials the CLI uses.
+ * the CLI uses.
  *
- * **These `anonKey` values are public.** Supabase anon keys are JWTs designed
- * to be embedded in client code (web apps, mobile apps, CLIs). They only
- * grant whatever the project's RLS policies expose. Don't worry about seeing
- * them here — every Supabase-based product ships its anon key the same way.
- * https://supabase.com/docs/guides/api/api-keys
+ * There is deliberately no Supabase key and no KEK public key here. A
+ * compiled-in key can never be rotated without breaking every pinned CLI
+ * version, so both are fetched from the API at runtime instead: see
+ * ./cli-config.ts (`getSupabaseKey` in ./supabase-key.ts for dcd#1112, and
+ * `resolveKekPublicKey` in ../utils/envelope.ts for dcd#1138).
  */
 export type DcdEnvName = 'dev' | 'prod';
 export interface DcdEnvironment {
@@ -15,40 +15,13 @@ export interface DcdEnvironment {
     supabase: {
         url: string;
         projectRef: string;
-        anonKey: string;
     };
-    /**
-     * Pinned KEK public key for client-side binary envelope encryption (dcd#1138).
-     * `key` is base64 of the raw 32-byte X25519 public key; `version` selects which
-     * KEK the platform API unwraps with. **Public — safe to embed** (like the anon
-     * key above): it can only *encrypt*; the private half lives solely on the API.
-     *
-     * Left `null` until the KEK is generated and provisioned. Generate a keypair
-     * with, e.g.:
-     *   node -e 'const c=require("crypto");const{publicKey,privateKey}=c.generateKeyPairSync("x25519");const pub=publicKey.export({type:"spki",format:"der"}).subarray(12);const priv=privateKey.export({type:"pkcs8",format:"der"}).subarray(16);console.log("public :",pub.toString("base64"));console.log("private:",priv.toString("base64"))'
-     * Pin `public` here; set `private` as `BINARY_KEK_PRIVATE_KEYS={"<version>":"<private base64>"}`
-     * on the API service and keep one offline escrow copy. Until then, encryption
-     * can be exercised via the `DCD_BINARY_KEK_PUBLIC` env override (see envelope.ts).
-     */
-    kekPublicKey: {
-        version: number;
-        key: string;
-    } | null;
 }
 export declare const ENVIRONMENTS: Record<DcdEnvName, DcdEnvironment>;
 /** Exact-match lookup of a known environment by API URL (trailing slashes ignored). */
 export declare function findEnvByApiUrl(apiUrl: string): DcdEnvironment | undefined;
 /** Map a caller-supplied API URL to one of the known environments. */
 export declare function inferEnvFromApiUrl(apiUrl: string): DcdEnvName;
-/**
- * The environment whose pinned KEK may encrypt uploads to `apiUrl` (dcd#1138),
- * or undefined when the URL isn't a known one. Stricter than
- * {@link inferEnvFromApiUrl}, which falls back to prod for any URL: that is
- * harmless for picking a console link, but an upload encrypted for a KEK its
- * API can't unwrap is unusable. Known means the host of a pinned `apiUrl`, or
- * `localhost`, which runs against dev.
- */
-export declare function kekEnvForApiUrl(apiUrl: string): DcdEnvName | undefined;
 /**
  * Frontend URL to open for a given API URL. Same as
  * `ENVIRONMENTS[inferEnvFromApiUrl(apiUrl)].frontendUrl`, except that when the

package/dist/config/environments.js

@@ -1,12 +1,12 @@
 /**
  * Per-env devicecloud.dev coordinates — single source of truth for the URLs
- * and Supabase credentials the CLI uses.
+ * the CLI uses.
  *
- * **These `anonKey` values are public.** Supabase anon keys are JWTs designed
- * to be embedded in client code (web apps, mobile apps, CLIs). They only
- * grant whatever the project's RLS policies expose. Don't worry about seeing
- * them here — every Supabase-based product ships its anon key the same way.
- * https://supabase.com/docs/guides/api/api-keys
+ * There is deliberately no Supabase key and no KEK public key here. A
+ * compiled-in key can never be rotated without breaking every pinned CLI
+ * version, so both are fetched from the API at runtime instead: see
+ * ./cli-config.ts (`getSupabaseKey` in ./supabase-key.ts for dcd#1112, and
+ * `resolveKekPublicKey` in ../utils/envelope.ts for dcd#1138).
  */
 export const ENVIRONMENTS = {
     prod: {
@@ -15,9 +15,7 @@ export const ENVIRONMENTS = {
         supabase: {
             url: 'https://cloud.devicecloud.dev',
             projectRef: 'pgydnphbimetinsgfkbo',
-            anonKey: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InBneWRucGhiaW1ldGluc2dma2JvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDc1OTQzNDYsImV4cCI6MjAyMzE3MDM0Nn0.hAYOMFxxwX1exkQkY9xyQJGC_GhGnyogkj2N-kBkMI8',
         },
-        kekPublicKey: { version: 1, key: 'wtfyWEwK7nJzwI4PD+9RAW8jxIR1u8kMQq2IhsrVnH4=' },
     },
     dev: {
         apiUrl: 'https://api.dev.devicecloud.dev',
@@ -25,9 +23,7 @@ export const ENVIRONMENTS = {
         supabase: {
             url: 'https://lbmsowehtjwnqlurpemb.supabase.co',
             projectRef: 'lbmsowehtjwnqlurpemb',
-            anonKey: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImxibXNvd2VodGp3bnFsdXJwZW1iIiwicm9sZSI6ImFub24iLCJpYXQiOjE3MDkyMTg0ODcsImV4cCI6MjAyNDc5NDQ4N30.zeLTMAuZ_WwYvGdeP0kdvL_Zrs-RQee5APPyxmWq7qQ',
         },
-        kekPublicKey: { version: 1, key: 'RgcToF/OJpcQI9koYvSvtj/WLaebfcN4v5GJoqtr/00=' },
     },
 };
 /** Exact-match lookup of a known environment by API URL (trailing slashes ignored). */
@@ -42,27 +38,6 @@ export function inferEnvFromApiUrl(apiUrl) {
         return 'dev';
     return 'prod';
 }
-/**
- * The environment whose pinned KEK may encrypt uploads to `apiUrl` (dcd#1138),
- * or undefined when the URL isn't a known one. Stricter than
- * {@link inferEnvFromApiUrl}, which falls back to prod for any URL: that is
- * harmless for picking a console link, but an upload encrypted for a KEK its
- * API can't unwrap is unusable. Known means the host of a pinned `apiUrl`, or
- * `localhost`, which runs against dev.
- */
-export function kekEnvForApiUrl(apiUrl) {
-    let host;
-    try {
-        host = new URL(apiUrl).hostname;
-    }
-    catch {
-        return undefined;
-    }
-    if (host === 'localhost')
-        return 'dev';
-    const names = Object.keys(ENVIRONMENTS);
-    return names.find((name) => new URL(ENVIRONMENTS[name].apiUrl).hostname === host);
-}
 /**
  * Frontend URL to open for a given API URL. Same as
  * `ENVIRONMENTS[inferEnvFromApiUrl(apiUrl)].frontendUrl`, except that when the

package/dist/config/flags/binary.flags.d.ts

@@ -21,7 +21,6 @@ export declare const binaryFlags: {
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly hidden: true;
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.";
     };
 };

package/dist/config/flags/binary.flags.js

@@ -21,9 +21,6 @@ export const binaryFlags = {
     },
     encrypt: {
         type: 'boolean',
-        // Left out of --help while encryption is a per-org beta (dcd#1138); the
-        // flag still parses, --no-encrypt included.
-        hidden: true,
-        description: 'Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.',
+        description: 'Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.',
     },
 };

package/dist/config/supabase-key.d.ts

@@ -0,0 +1,11 @@
+import { type DcdEnvName } from './environments.js';
+/** The publishable key for `env`. A failed fetch is not cached, so the next call retries. */
+export declare function getSupabaseKey(env: DcdEnvName): Promise<string>;
+/**
+ * Headers that authenticate a raw Storage/Auth request with `key` alone. A
+ * legacy anon key is a JWT and also goes in `Authorization`; an
+ * `sb_publishable_` key is not a JWT and must only be sent as `apikey`.
+ */
+export declare function supabaseKeyHeaders(key: string): Record<string, string>;
+/** Test seam: forget fetched keys. */
+export declare function resetSupabaseKeyCache(): void;

package/dist/config/supabase-key.js

@@ -0,0 +1,35 @@
+/**
+ * The Supabase publishable key, fetched from the dcd API at runtime (dcd#1112).
+ *
+ * Releases up to this one compiled the anon key in, so the key could never be
+ * rotated without breaking every CLI version pinned in customer CI. The API now
+ * serves it from the public `GET /cli-config` (see ./cli-config.ts for the
+ * fetch and its in-memory cache), and rotating it is an env change on the API.
+ *
+ * Only the key comes from the API. The Supabase URLs stay pinned in
+ * `ENVIRONMENTS`: prod goes through the `cloud.devicecloud.dev` custom domain,
+ * which customer firewalls may allow-list, not the API's raw `supabase.co` URL.
+ */
+import { cliConfigUrl, getCliConfig, resetCliConfigCache } from './cli-config.js';
+import { ENVIRONMENTS } from './environments.js';
+/** The publishable key for `env`. A failed fetch is not cached, so the next call retries. */
+export async function getSupabaseKey(env) {
+    const apiUrl = ENVIRONMENTS[env].apiUrl;
+    const key = (await getCliConfig(apiUrl)).supabase_publishable_key;
+    if (typeof key !== 'string' || key.length === 0) {
+        throw new Error(`CLI config from ${cliConfigUrl(apiUrl)} has no supabase_publishable_key`);
+    }
+    return key;
+}
+/**
+ * Headers that authenticate a raw Storage/Auth request with `key` alone. A
+ * legacy anon key is a JWT and also goes in `Authorization`; an
+ * `sb_publishable_` key is not a JWT and must only be sent as `apikey`.
+ */
+export function supabaseKeyHeaders(key) {
+    return key.startsWith('sb_') ? { apikey: key } : { apikey: key, authorization: `Bearer ${key}` };
+}
+/** Test seam: forget fetched keys. */
+export function resetSupabaseKeyCache() {
+    resetCliConfigCache();
+}

package/dist/constants.d.ts

@@ -228,8 +228,7 @@ export declare const flags: {
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly hidden: true;
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.";
     };
     readonly 'api-key': {
         readonly type: "string";

package/dist/gateways/cli-auth-gateway.d.ts

@@ -1,3 +1,4 @@
+import type { DcdEnvName } from '../config/environments.js';
 import type { StoredSession } from '../utils/config-store.js';
 /**
  * Thrown when a session refresh fails. `definitive` distinguishes "Supabase
@@ -18,6 +19,6 @@ export interface RefreshedSession {
     user_id: string;
 }
 export declare const CliAuthGateway: {
-    refresh(supabaseUrl: string, supabaseAnonKey: string, session: StoredSession): Promise<RefreshedSession>;
-    signOut(supabaseUrl: string, supabaseAnonKey: string, session: StoredSession): Promise<void>;
+    refresh(supabaseUrl: string, env: DcdEnvName, session: StoredSession): Promise<RefreshedSession>;
+    signOut(supabaseUrl: string, env: DcdEnvName, session: StoredSession): Promise<void>;
 };

package/dist/gateways/cli-auth-gateway.js

@@ -6,6 +6,7 @@
  * login command's PKCE rendezvous flow (see src/commands/login.ts).
  */
 import { createClient, isAuthApiError } from '@supabase/supabase-js';
+import { getSupabaseKey } from '../config/supabase-key.js';
 /**
  * Thrown when a session refresh fails. `definitive` distinguishes "Supabase
  * rejected this refresh token" (revoked, already used, malformed — re-login
@@ -20,14 +21,23 @@ export class SessionRefreshError extends Error {
         this.name = 'SessionRefreshError';
     }
 }
-function client(supabaseUrl, supabaseAnonKey) {
-    return createClient(supabaseUrl, supabaseAnonKey, {
+function client(supabaseUrl, supabaseKey) {
+    return createClient(supabaseUrl, supabaseKey, {
         auth: { persistSession: false, autoRefreshToken: false, detectSessionInUrl: false },
     });
 }
 export const CliAuthGateway = {
-    async refresh(supabaseUrl, supabaseAnonKey, session) {
-        const sb = client(supabaseUrl, supabaseAnonKey);
+    async refresh(supabaseUrl, env, session) {
+        let supabaseKey;
+        try {
+            supabaseKey = await getSupabaseKey(env);
+        }
+        catch (error) {
+            // Never definitive: the refresh token was not even tried, so the stored
+            // session must survive for the next attempt.
+            throw new SessionRefreshError(`Failed to refresh session: ${error.message}`, false);
+        }
+        const sb = client(supabaseUrl, supabaseKey);
         const { data, error } = await sb.auth.refreshSession({
             refresh_token: session.refresh_token,
         });
@@ -53,14 +63,14 @@ export const CliAuthGateway = {
             user_id: u.id,
         };
     },
-    async signOut(supabaseUrl, supabaseAnonKey, session) {
+    async signOut(supabaseUrl, env, session) {
         // `scope: 'local'` clears this client's SDK state only — no server call,
         // no revocation. supabase-js defaults to `scope: 'global'`, which revokes
         // EVERY session for the user (browser, mobile, other CLIs), so
         // `dcd logout` would kick the user out of the web app. We don't want
         // that — logging out locally should be local.
-        const sb = client(supabaseUrl, supabaseAnonKey);
         try {
+            const sb = client(supabaseUrl, await getSupabaseKey(env));
             await sb.auth.setSession({
                 access_token: session.access_token,
                 refresh_token: session.refresh_token,

package/dist/gateways/realtime-gateway.js

@@ -15,6 +15,7 @@
  */
 import { createClient, REALTIME_SUBSCRIBE_STATES, } from '@supabase/supabase-js';
 import { ENVIRONMENTS } from '../config/environments.js';
+import { getSupabaseKey } from '../config/supabase-key.js';
 export class RealtimeResultsGateway {
     /**
      * Open a realtime subscription to `results` changes for the given upload.
@@ -34,17 +35,28 @@ export class RealtimeResultsGateway {
             onConnectionChange?.(next);
         };
         let client;
-        try {
-            const { url, anonKey } = ENVIRONMENTS[env].supabase;
-            client = createClient(url, anonKey, {
+        let channel;
+        let closed = false;
+        // The latest JWT, so a refresh that lands while the key is still being
+        // fetched is the one the socket joins with.
+        let token = accessToken;
+        // The publishable key comes from the API (dcd#1112), so the socket opens
+        // asynchronously. `subscribe` stays synchronous for the caller: until it
+        // connects, `isConnected` is false and the backstop poll covers the gap.
+        const ready = getSupabaseKey(env)
+            .then((supabaseKey) => {
+            if (closed)
+                return;
+            const sb = createClient(ENVIRONMENTS[env].supabase.url, supabaseKey, {
                 // Match SupabaseClientGateway / the frontend; no session persistence —
                 // we set the token explicitly below.
                 auth: { autoRefreshToken: false, persistSession: false },
                 realtime: { params: { eventsPerSecond: 10 } },
             });
+            client = sb;
             // Attach the user's JWT to the socket so RLS is enforced on the channel.
-            client.realtime.setAuth(accessToken);
-            const channel = client
+            sb.realtime.setAuth(token);
+            channel = sb
                 .channel(`results-cli-${uploadId}`)
                 .on(
             // The typings don't cover the postgres_changes overload cleanly.
@@ -73,29 +85,8 @@ export class RealtimeResultsGateway {
                     setConnected(false);
                 }
             });
-            const activeClient = client;
-            return {
-                isConnected: () => connected,
-                async unsubscribe() {
-                    setConnected(false);
-                    try {
-                        await activeClient.removeChannel(channel);
-                        await activeClient.realtime.disconnect();
-                    }
-                    catch {
-                        /* best effort — process is exiting anyway */
-                    }
-                },
-                updateAccessToken(nextToken) {
-                    // setAuth updates the join payload and pushes the token to joined
-                    // channels. A failure only costs realtime; the backstop poll stays.
-                    activeClient.realtime.setAuth(nextToken).catch((error) => {
-                        dbg(`failed to update the socket's token: ${error instanceof Error ? error.message : String(error)}`);
-                    });
-                },
-            };
-        }
-        catch (error) {
+        })
+            .catch((error) => {
             dbg(`failed to subscribe: ${error instanceof Error ? error.message : String(error)}`);
             // Best-effort cleanup of a half-built client, then degrade to polling.
             try {
@@ -104,11 +95,34 @@ export class RealtimeResultsGateway {
             catch {
                 /* ignore */
             }
-            return {
-                isConnected: () => false,
-                async unsubscribe() { },
-                updateAccessToken() { },
-            };
-        }
+            client = undefined;
+            channel = undefined;
+        });
+        return {
+            isConnected: () => connected,
+            async unsubscribe() {
+                closed = true;
+                setConnected(false);
+                await ready;
+                if (!client)
+                    return;
+                try {
+                    if (channel)
+                        await client.removeChannel(channel);
+                    await client.realtime.disconnect();
+                }
+                catch {
+                    /* best effort — process is exiting anyway */
+                }
+            },
+            updateAccessToken(nextToken) {
+                token = nextToken;
+                // setAuth updates the join payload and pushes the token to joined
+                // channels. A failure only costs realtime; the backstop poll stays.
+                client?.realtime.setAuth(nextToken).catch((error) => {
+                    dbg(`failed to update the socket's token: ${error instanceof Error ? error.message : String(error)}`);
+                });
+            },
+        };
     }
 }

package/dist/gateways/supabase-gateway.d.ts

@@ -9,7 +9,7 @@ export interface ResumableUploadSource {
 export declare class SupabaseGateway {
     /**
      * Upload to Supabase using resumable uploads (TUS protocol)
-     * Uploads to staging location (uploads/{id}/) using anon key
+     * Uploads to staging location (uploads/{id}/) using the publishable key
      * File is later moved to final location by API after finalization
      * @param env - Environment (dev or prod)
      * @param path - Staging storage path (uploads/{id}/file.ext)

package/dist/gateways/supabase-gateway.js

@@ -2,10 +2,11 @@ import { createReadStream } from 'node:fs';
 import { createClient } from '@supabase/supabase-js';
 import * as tus from 'tus-js-client';
 import { ENVIRONMENTS } from '../config/environments.js';
+import { getSupabaseKey, supabaseKeyHeaders } from '../config/supabase-key.js';
 export class SupabaseGateway {
     /**
      * Upload to Supabase using resumable uploads (TUS protocol)
-     * Uploads to staging location (uploads/{id}/) using anon key
+     * Uploads to staging location (uploads/{id}/) using the publishable key
      * File is later moved to final location by API after finalization
      * @param env - Environment (dev or prod)
      * @param path - Staging storage path (uploads/{id}/file.ext)
@@ -15,7 +16,8 @@ export class SupabaseGateway {
      * @returns Promise that resolves when upload completes
      */
     static async uploadResumable(env, path, source, debug = false, onProgress) {
-        const { anonKey: SUPABASE_PUBLIC_KEY, projectRef } = ENVIRONMENTS[env].supabase;
+        const { projectRef } = ENVIRONMENTS[env].supabase;
+        const supabaseKey = await getSupabaseKey(env);
         const storageUrl = `https://${projectRef}.storage.supabase.co`;
         if (debug) {
             console.log(`[DEBUG] Resumable upload starting...`);
@@ -35,9 +37,9 @@ export class SupabaseGateway {
                 // Retry configuration - will retry 5 times with increasing delays
                 retryDelays: [0, 3000, 5000, 10_000, 20_000],
                 // Authentication and headers
-                // Use anon key for staging uploads to uploads/* folder
+                // Publishable key for staging uploads to uploads/* folder
                 headers: {
-                    authorization: `Bearer ${SUPABASE_PUBLIC_KEY}`,
+                    ...supabaseKeyHeaders(supabaseKey),
                     'x-upsert': 'true', // Allow overwriting existing files
                 },
                 // Upload metadata
@@ -93,7 +95,7 @@ export class SupabaseGateway {
         });
     }
     static async uploadToSignedUrl(env, path, token, file, debug = false) {
-        const { url: SUPABASE_URL, anonKey: SUPABASE_PUBLIC_KEY } = ENVIRONMENTS[env].supabase;
+        const { url: SUPABASE_URL } = ENVIRONMENTS[env].supabase;
         if (debug) {
             console.log(`[DEBUG] Supabase upload starting...`);
             console.log(`[DEBUG] Supabase URL: ${SUPABASE_URL}`);
@@ -102,7 +104,7 @@ export class SupabaseGateway {
             console.log(`[DEBUG] File type: ${file.type}`);
         }
         try {
-            const supabase = createClient(SUPABASE_URL, SUPABASE_PUBLIC_KEY);
+            const supabase = createClient(SUPABASE_URL, await getSupabaseKey(env));
             const uploadToUrl = await supabase.storage
                 .from('organizations')
                 .uploadToSignedUrl(path, token, file);

package/dist/index.js

@@ -14,7 +14,6 @@ import { uploadCommand } from './commands/upload.js';
 import { whoamiCommand } from './commands/whoami.js';
 import { telemetry } from './services/telemetry.service.js';
 import { CliError, getCliVersion, logger, wantsJson } from './utils/cli.js';
-import { withoutHiddenArgs } from './utils/help.js';
 // @clack/prompts ships the US spelling ("Canceled") for its built-in
 // spinner/prompt cancellation message; align it with the British spelling
 // ("Cancelled") used everywhere else in the CLI.
@@ -66,17 +65,12 @@ async function resolveSubCommand(cmd, rawArgs, parent) {
     }
     return [cmd, parent];
 }
-// Usage for the (sub)command named in rawArgs, without the args marked hidden.
-async function showHelp(rawArgs) {
-    const [cmd, parent] = await resolveSubCommand(main, rawArgs);
-    await showUsage(await withoutHiddenArgs(cmd), parent);
-}
 async function run() {
     const rawArgs = process.argv.slice(2);
     telemetry.recordCommandStart();
     try {
         if (rawArgs.includes('--help') || rawArgs.includes('-h')) {
-            await showHelp(rawArgs);
+            await showUsage(...(await resolveSubCommand(main, rawArgs)));
         }
         else if (rawArgs.length === 1 && rawArgs[0] === '--version') {
             logger.log(getCliVersion());
@@ -94,7 +88,7 @@ async function run() {
         // citty throws CLIError (by name — the class isn't exported) for usage
         // problems like unknown commands or missing required args.
         if (!json && error instanceof Error && error.name === 'CLIError') {
-            await showHelp(rawArgs);
+            await showUsage(...(await resolveSubCommand(main, rawArgs)));
         }
         const exitCode = error instanceof CliError ? error.exitCode : 1;
         // logger.error prints the message, records failure telemetry, flushes

package/dist/mcp/tools/run-cloud-test.js

@@ -84,7 +84,7 @@ export function registerRunCloudTest(server) {
             encrypt: z
                 .boolean()
                 .optional()
-                .describe('true encrypts the binary, flow zip and env vars client-side before upload; false never does. Omit to follow DCD_ENCRYPT, then the organization default.'),
+                .describe('true encrypts the binary, flow zip and env vars client-side before upload; false never does. Omit to follow DCD_ENCRYPT, then the default, which is on.'),
             wait: z
                 .boolean()
                 .optional()
@@ -152,8 +152,8 @@ export function registerRunCloudTest(server) {
             });
         }
         // Client-side envelope encryption (binary/flow/env), in the same order
-        // as `dcd cloud`: the encrypt input, DCD_ENCRYPT, then the org default.
-        const encryption = checkKekForEncryption(resolveEncryption({
+        // as `dcd cloud`: the encrypt input, DCD_ENCRYPT, then the server default.
+        const encryption = await checkKekForEncryption(resolveEncryption({
             flag: args.encrypt,
             serverDefault: compatibilityData.encryption?.defaultOn,
         }), apiUrl);
@@ -169,7 +169,7 @@ export function registerRunCloudTest(server) {
         };
         telemetryExtra.encrypt = encryptTelemetry;
         if (encrypt && encryption.source === 'server') {
-            logStderr('Encrypting uploads (beta); opt out with encrypt: false');
+            logStderr('Encrypting uploads; opt out with encrypt: false');
         }
         // Resolve the binary: existing id, or upload the local file.
         let appBinaryId = args.appBinaryId;

package/dist/methods.js

@@ -190,15 +190,15 @@ export const uploadBinary = async (config) => {
 /**
  * Encrypt the prepared upload source in place (dcd#1138): generate a per-upload
  * DEK, stream-encrypt `source.diskPath` into a temp ciphertext file, wrap the
- * DEK with the environment's pinned KEK public key, and repoint `source` at the
+ * DEK with the KEK public key the API publishes, and repoint `source` at the
  * ciphertext so the SHA, dedup check, and both uploaders operate on ciphertext.
  * Returns the envelope metadata (for `binaries.metadata.enc`) plus the temp dir
  * to clean up. Throws if no KEK is available for the environment.
  */
 async function encryptUploadSource(source, apiUrl, debug) {
-    const kek = resolveKekPublicKey(apiUrl);
+    const kek = await resolveKekPublicKey(apiUrl);
     if (!kek) {
-        throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the organization default) but no KEK public key is configured for this API. ' +
+        throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the default) but no KEK public key is configured for this API. ' +
             'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64>, or pass --no-encrypt to upload without encryption.');
     }
     const dek = generateDek();

package/dist/services/test-submission.service.js

@@ -78,9 +78,9 @@ export class TestSubmissionService {
             if (!apiUrl) {
                 throw new Error('Encryption requires apiUrl to resolve the KEK public key');
             }
-            const kek = resolveKekPublicKey(apiUrl);
+            const kek = await resolveKekPublicKey(apiUrl);
             if (!kek) {
-                throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the organization default) but no KEK public key is configured for this API. ' +
+                throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the default) but no KEK public key is configured for this API. ' +
                     'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64>, or pass --no-encrypt to upload without encryption.');
             }
             const flow = encryptFlowBuffer(plaintextZip, kek);

package/dist/utils/auth.js

@@ -9,7 +9,6 @@
  * poll), which re-checks with isAuthExpiring / refreshAuth below.
  */
 import { closeSync, openSync, rmSync, statSync } from 'node:fs';
-import { ENVIRONMENTS } from '../config/environments.js';
 import { CliAuthGateway, SessionRefreshError, } from '../gateways/cli-auth-gateway.js';
 import { telemetry } from '../services/telemetry.service.js';
 import { CliError } from './cli.js';
@@ -144,10 +143,9 @@ async function refreshSessionWithLock(initial) {
         if (session.expires_at > now + REFRESH_SKEW_SECONDS) {
             return { config: current, session };
         }
-        const { anonKey } = ENVIRONMENTS[current.env].supabase;
         let refreshed;
         try {
-            refreshed = await CliAuthGateway.refresh(current.supabase_url, anonKey, session);
+            refreshed = await CliAuthGateway.refresh(current.supabase_url, current.env, session);
         }
         catch (error) {
             if (error instanceof SessionRefreshError && error.definitive) {

package/dist/utils/compatibility.d.ts

@@ -12,9 +12,8 @@ export interface CompatibilityData {
     /** Active CLI notices, piggybacked onto the compatibility response by the API. */
     notices?: Notice[];
     /**
-     * The org's client-side encryption default (dcd#1138): on for orgs in the
-     * `client_encryption` beta unless the API's kill switch is set. An older API
-     * omits it, which means off.
+     * The client-side encryption default (dcd#1138): on for every org unless the
+     * API's kill switch is set. An older API omits it, which means off.
      */
     encryption?: {
         defaultOn: boolean;

package/dist/utils/envelope.d.ts

@@ -29,7 +29,7 @@ export interface EncryptionDecision {
  *   1. `flag`: `--encrypt` / `--no-encrypt`, or the MCP tool's `encrypt` input.
  *   2. `DCD_ENCRYPT`, then its legacy alias `DCD_ENCRYPT_BINARIES`.
  *   3. `serverDefault`: `encryption.defaultOn` from the compatibility data,
- *      which the API turns on for orgs in the `client_encryption` beta.
+ *      which the API turns on for every org unless its kill switch is set.
  *   4. Off. An API too old to send `encryption` ends up here.
  * When on, the binary, the flow zip, and the env map are each encrypted with
  * their **own** per-upload DEK (all wrapped under the same per-env KEK).
@@ -41,26 +41,32 @@ export declare function resolveEncryption(opts: {
 }): EncryptionDecision;
 /**
  * Check that `apiUrl` has a KEK before a run encrypts against it: either
- * `DCD_BINARY_KEK_PUBLIC` is set or the URL is a known devicecloud.dev API
- * (see kekEnvForApiUrl). Without one, an explicit `--encrypt` is an error,
- * while encryption from DCD_ENCRYPT or the org default is skipped with a
- * notice, so a run against another API URL uploads in plaintext as before.
+ * `DCD_BINARY_KEK_PUBLIC` is set or the API publishes one on `GET /cli-config`
+ * (see resolveKekPublicKey). Without one, an explicit `--encrypt` is an error,
+ * while encryption from DCD_ENCRYPT or the server default is skipped with a
+ * notice, so a run against an API that publishes no KEK uploads in plaintext
+ * as before. An API that cannot be asked at all is an error whatever decided
+ * encryption: silently falling back to plaintext would be the one outcome the
+ * org asked not to have.
  */
-export declare function checkKekForEncryption(decision: EncryptionDecision, apiUrl: string): EncryptionDecision;
-/** Pinned KEK public key (base64 raw 32-byte X25519) + version, per env. */
+export declare function checkKekForEncryption(decision: EncryptionDecision, apiUrl: string): Promise<EncryptionDecision>;
+/** KEK public key (raw 32-byte X25519) + the version the API unwraps it with. */
 interface KekPublicKey {
     version: number;
     keyRaw: Buffer;
 }
 /**
- * Resolve the KEK public key for the environment behind `apiUrl`. Order:
+ * Resolve the KEK public key for the API behind `apiUrl`. Order:
  *   1. `DCD_BINARY_KEK_PUBLIC` env override (`<version>:<base64>`, e.g. `1:AAAA…`)
- *      — lets the feature be exercised before keys are pinned in the release,
- *      or against an API URL that isn't a known one.
- *   2. the pinned `ENVIRONMENTS[env].kekPublicKey`, only for a known API URL.
- * Returns null when no key is available (encryption cannot proceed).
+ *      — lets the feature be exercised against an API that publishes nothing.
+ *   2. `binary_kek_public_key` from the API's own `GET /cli-config` (dcd#1138):
+ *      the newest KEK the API holds the private half of. Fetched once per
+ *      process (see ../config/cli-config.ts), so a KEK rotation is an env
+ *      change on the API and never a CLI release.
+ * Returns null when the API publishes no key (encryption cannot proceed).
+ * Throws when the API cannot be asked, or publishes something malformed.
  */
-export declare function resolveKekPublicKey(apiUrl: string): KekPublicKey | null;
+export declare function resolveKekPublicKey(apiUrl: string): Promise<KekPublicKey | null>;
 /**
  * Wrap a DEK for the given KEK public key (X25519 sealed box). Produces base64 of
  * `ephPub(32) || iv(12) || ciphertext(32) || tag(16)`.

package/dist/utils/envelope.js

@@ -1,6 +1,6 @@
 import { createCipheriv, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, } from 'node:crypto';
 import { open, stat } from 'node:fs/promises';
-import { ENVIRONMENTS, kekEnvForApiUrl } from '../config/environments.js';
+import { cliConfigUrl, getCliConfig } from '../config/cli-config.js';
 /**
  * Client-side envelope encryption of app binaries before upload (dcd#1138).
  *
@@ -10,9 +10,9 @@ import { ENVIRONMENTS, kekEnvForApiUrl } from '../config/environments.js';
  * specified in `dcd/docs/binary-envelope-encryption.md`.
  *
  * Scheme: a per-upload random 256-bit DEK encrypts the binary (chunked
- * AES-256-GCM); the DEK is wrapped with the environment's pinned X25519 KEK
- * public key (sealed box). Only the platform API holds the KEK private half, so
- * every storage/transport tier sees ciphertext only.
+ * AES-256-GCM); the DEK is wrapped with the X25519 KEK public key the API
+ * publishes on `GET /cli-config` (sealed box). Only the platform API holds the
+ * KEK private half, so every storage/transport tier sees ciphertext only.
  */
 const MAGIC = Buffer.from('DCDE', 'ascii');
 const CONTAINER_VERSION = 1;
@@ -45,7 +45,7 @@ function parseEncryptEnv(value) {
  *   1. `flag`: `--encrypt` / `--no-encrypt`, or the MCP tool's `encrypt` input.
  *   2. `DCD_ENCRYPT`, then its legacy alias `DCD_ENCRYPT_BINARIES`.
  *   3. `serverDefault`: `encryption.defaultOn` from the compatibility data,
- *      which the API turns on for orgs in the `client_encryption` beta.
+ *      which the API turns on for every org unless its kill switch is set.
  *   4. Off. An API too old to send `encryption` ends up here.
  * When on, the binary, the flow zip, and the env map are each encrypted with
  * their **own** per-upload DEK (all wrapped under the same per-env KEK).
@@ -63,21 +63,24 @@ export function resolveEncryption(opts) {
 }
 /**
  * Check that `apiUrl` has a KEK before a run encrypts against it: either
- * `DCD_BINARY_KEK_PUBLIC` is set or the URL is a known devicecloud.dev API
- * (see kekEnvForApiUrl). Without one, an explicit `--encrypt` is an error,
- * while encryption from DCD_ENCRYPT or the org default is skipped with a
- * notice, so a run against another API URL uploads in plaintext as before.
+ * `DCD_BINARY_KEK_PUBLIC` is set or the API publishes one on `GET /cli-config`
+ * (see resolveKekPublicKey). Without one, an explicit `--encrypt` is an error,
+ * while encryption from DCD_ENCRYPT or the server default is skipped with a
+ * notice, so a run against an API that publishes no KEK uploads in plaintext
+ * as before. An API that cannot be asked at all is an error whatever decided
+ * encryption: silently falling back to plaintext would be the one outcome the
+ * org asked not to have.
  */
-export function checkKekForEncryption(decision, apiUrl) {
-    if (!decision.enabled || resolveKekPublicKey(apiUrl))
+export async function checkKekForEncryption(decision, apiUrl) {
+    if (!decision.enabled || (await resolveKekPublicKey(apiUrl)))
         return decision;
     if (decision.source === 'flag') {
-        throw new Error(`--encrypt needs the KEK public key of the API it uploads to, and ${apiUrl} is not a devicecloud.dev API this CLI has one for. ` +
+        throw new Error(`--encrypt needs the KEK public key of the API it uploads to, and ${apiUrl} does not publish one. ` +
             'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64> to encrypt against it, or drop --encrypt.');
     }
     return {
         enabled: false,
-        notice: `Not encrypting uploads: ${apiUrl} is not a devicecloud.dev API this CLI has a key for. Set DCD_BINARY_KEK_PUBLIC to encrypt against it.`,
+        notice: `Not encrypting uploads: ${apiUrl} does not publish a KEK public key. Set DCD_BINARY_KEK_PUBLIC to encrypt against it.`,
         source: decision.source,
     };
 }
@@ -89,14 +92,17 @@ function x25519PublicFromRaw(raw) {
     });
 }
 /**
- * Resolve the KEK public key for the environment behind `apiUrl`. Order:
+ * Resolve the KEK public key for the API behind `apiUrl`. Order:
  *   1. `DCD_BINARY_KEK_PUBLIC` env override (`<version>:<base64>`, e.g. `1:AAAA…`)
- *      — lets the feature be exercised before keys are pinned in the release,
- *      or against an API URL that isn't a known one.
- *   2. the pinned `ENVIRONMENTS[env].kekPublicKey`, only for a known API URL.
- * Returns null when no key is available (encryption cannot proceed).
+ *      — lets the feature be exercised against an API that publishes nothing.
+ *   2. `binary_kek_public_key` from the API's own `GET /cli-config` (dcd#1138):
+ *      the newest KEK the API holds the private half of. Fetched once per
+ *      process (see ../config/cli-config.ts), so a KEK rotation is an env
+ *      change on the API and never a CLI release.
+ * Returns null when the API publishes no key (encryption cannot proceed).
+ * Throws when the API cannot be asked, or publishes something malformed.
  */
-export function resolveKekPublicKey(apiUrl) {
+export async function resolveKekPublicKey(apiUrl) {
     const override = process.env.DCD_BINARY_KEK_PUBLIC;
     if (override) {
         const [versionPart, b64] = override.split(':');
@@ -108,17 +114,15 @@ export function resolveKekPublicKey(apiUrl) {
         }
         throw new Error('DCD_BINARY_KEK_PUBLIC must be "<version>:<base64 32-byte X25519 public key>"');
     }
-    const env = kekEnvForApiUrl(apiUrl);
-    if (!env)
+    const published = (await getCliConfig(apiUrl)).binary_kek_public_key;
+    if (published === undefined || published === null)
         return null;
-    const pinned = ENVIRONMENTS[env].kekPublicKey;
-    if (!pinned)
-        return null;
-    const keyRaw = Buffer.from(pinned.key, 'base64');
-    if (keyRaw.length !== 32) {
-        throw new Error(`Pinned KEK public key for ${env} is not a 32-byte key`);
+    const { version, key } = published;
+    const keyRaw = typeof key === 'string' ? Buffer.from(key, 'base64') : Buffer.alloc(0);
+    if (!Number.isInteger(version) || keyRaw.length !== 32) {
+        throw new Error(`CLI config from ${cliConfigUrl(apiUrl)} has a malformed binary_kek_public_key; expected { version: integer, key: base64 32-byte X25519 public key }`);
     }
-    return { version: pinned.version, keyRaw };
+    return { version: version, keyRaw };
 }
 /**
  * Wrap a DEK for the given KEK public key (X25519 sealed box). Produces base64 of

package/package.json

@@ -68,7 +68,7 @@
     "test:unit": "node scripts/test-runner.mjs --unit",
     "typecheck": "tsc --noEmit -p tsconfig.test.json"
   },
-  "version": "5.9.0-beta.1",
+  "version": "5.10.0-beta.1",
   "bugs": {
     "url": "https://discord.gg/gm3mJwcNw8"
   },

package/dist/utils/help.d.ts

@@ -1,12 +0,0 @@
-import type { ArgDef, ArgsDef, CommandDef } from 'citty';
-/**
- * A citty arg definition plus a local `hidden` marker. citty (0.2) can hide a
- * command from help (`meta.hidden`) but not an arg, so {@link withoutHiddenArgs}
- * drops hidden args before usage is rendered. They still parse as normal.
- */
-export type CliArgDef = ArgDef & {
-    hidden?: boolean;
-};
-export type CliArgsDef = Record<string, CliArgDef>;
-/** `cmd` with its hidden args left out, for rendering `--help` only. */
-export declare function withoutHiddenArgs<T extends ArgsDef>(cmd: CommandDef<T>): Promise<CommandDef<T>>;

package/dist/utils/help.js

@@ -1,8 +0,0 @@
-/** `cmd` with its hidden args left out, for rendering `--help` only. */
-export async function withoutHiddenArgs(cmd) {
-    const args = typeof cmd.args === 'function' ? await cmd.args() : await cmd.args;
-    if (!args)
-        return cmd;
-    const visible = Object.fromEntries(Object.entries(args).filter(([, def]) => !def.hidden));
-    return { ...cmd, args: visible };
-}