@devicecloud.dev/dcd 5.9.0 → 5.10.0-beta.1

package/dist/commands/cloud.d.ts

@@ -242,8 +242,7 @@ export declare const cloudCommand: import("citty").CommandDef<{
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly hidden: true;
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.";
     };
     readonly 'api-key': {
         readonly type: "string";

package/dist/commands/cloud.js

@@ -140,7 +140,7 @@ export const cloudCommand = defineCommand({
             // Client-side envelope encryption of every sensitive artifact: the
             // binary (#1138), the flow zip (#1151), and env vars (#1152). Kept as
             // given (--no-encrypt is an explicit false) and resolved once the
-            // compatibility data, which carries the org's default, is in.
+            // compatibility data, which carries the server default, is in.
             const encryptFlag = args.encrypt;
             const includeTags = coerceArray(collectRepeatedFlag(rawArgs, ['--include-tags']));
             // Devices and OS versions are checked against the API's live
@@ -261,7 +261,7 @@ export const cloudCommand = defineCommand({
             if (debug) {
                 out(`[DEBUG] API URL: ${apiUrl}`);
             }
-            const encryption = checkKekForEncryption(resolveEncryption({
+            const encryption = await checkKekForEncryption(resolveEncryption({
                 flag: encryptFlag,
                 serverDefault: compatibilityData.encryption?.defaultOn,
             }), apiUrl);
@@ -537,7 +537,7 @@ export const cloudCommand = defineCommand({
                 return;
             }
             if (encrypt && encryption.source === 'server') {
-                out(ui.note('Encrypting uploads (beta); opt out with --no-encrypt'));
+                out(ui.note('Encrypting uploads; opt out with --no-encrypt'));
             }
             if (!finalBinaryId) {
                 if (!finalAppFile) {

package/dist/commands/upload.d.ts

@@ -9,8 +9,7 @@ export declare const uploadCommand: import("citty").CommandDef<{
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly hidden: true;
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.";
     };
     readonly debug: {
         readonly type: "boolean";

package/dist/commands/upload.js

@@ -46,7 +46,7 @@ export const uploadCommand = defineCommand({
             const appUrl = args['app-url'];
             const ignoreShaCheck = Boolean(args['ignore-sha-check']);
             // Kept as given, so --no-encrypt is an explicit false and a missing flag
-            // leaves DCD_ENCRYPT and then the org's default to decide.
+            // leaves DCD_ENCRYPT and then the server default to decide.
             const encryptFlag = args.encrypt;
             const debug = Boolean(args.debug);
             const positional = args.appFile;
@@ -69,7 +69,7 @@ export const uploadCommand = defineCommand({
                     out(`[DEBUG] Failed to fetch compatibility data, so the org's encryption default is off: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
-            const encryption = checkKekForEncryption(resolveEncryption({ flag: encryptFlag, serverDefault }), apiUrl);
+            const encryption = await checkKekForEncryption(resolveEncryption({ flag: encryptFlag, serverDefault }), apiUrl);
             if (encryption.notice)
                 out(ui.note(encryption.notice));
             telemetry.recordEncryption({ source: encryption.source });
@@ -102,7 +102,7 @@ export const uploadCommand = defineCommand({
             out(ui.branch([
                 ...ui.fields([['file', colors.highlight(resolvedFile)]]),
                 ...(encryption.enabled && encryption.source === 'server'
-                    ? [ui.note('Encrypting uploads (beta); opt out with --no-encrypt')]
+                    ? [ui.note('Encrypting uploads; opt out with --no-encrypt')]
                     : []),
             ]));
             const appBinaryId = await uploadBinary({

package/dist/config/cli-config.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The dcd API's public `GET /cli-config`: runtime configuration the CLI used to
+ * compile in, fetched from the API it talks to so that rotating any of it is an
+ * env change on the API rather than a CLI release.
+ *
+ * - `supabase_publishable_key` (dcd#1112): see ./supabase-key.ts.
+ * - `binary_kek_public_key` (dcd#1138): the newest KEK public key the API
+ *   publishes for client-side envelope encryption, with the version the API
+ *   unwraps it with. Absent when the API publishes none.
+ *
+ * Fetched once per process per API URL and kept in memory only. It is
+ * deliberately not cached on disk: a stale Supabase key makes GoTrue answer a
+ * refresh with a 4xx, which `resolveAuth` treats as a dead session and deletes
+ * the user's login, and a stale KEK would wrap uploads the API can no longer
+ * unwrap. A failed fetch is not cached, so the next call retries.
+ */
+export interface CliConfig {
+    supabase_url?: string;
+    supabase_publishable_key?: string;
+    binary_kek_public_key?: {
+        version: number;
+        key: string;
+    };
+}
+/** `apiUrl` without trailing slashes, so `…/` and `…` share one cache entry. */
+export declare function cliConfigUrl(apiUrl: string): string;
+/** The API's CLI config. A failed fetch is not cached, so the next call retries. */
+export declare function getCliConfig(apiUrl: string): Promise<CliConfig>;
+/** Test seam: forget fetched configs. */
+export declare function resetCliConfigCache(): void;

package/dist/config/cli-config.js

@@ -0,0 +1,49 @@
+/**
+ * The dcd API's public `GET /cli-config`: runtime configuration the CLI used to
+ * compile in, fetched from the API it talks to so that rotating any of it is an
+ * env change on the API rather than a CLI release.
+ *
+ * - `supabase_publishable_key` (dcd#1112): see ./supabase-key.ts.
+ * - `binary_kek_public_key` (dcd#1138): the newest KEK public key the API
+ *   publishes for client-side envelope encryption, with the version the API
+ *   unwraps it with. Absent when the API publishes none.
+ *
+ * Fetched once per process per API URL and kept in memory only. It is
+ * deliberately not cached on disk: a stale Supabase key makes GoTrue answer a
+ * refresh with a 4xx, which `resolveAuth` treats as a dead session and deletes
+ * the user's login, and a stale KEK would wrap uploads the API can no longer
+ * unwrap. A failed fetch is not cached, so the next call retries.
+ */
+const FETCH_TIMEOUT_MS = 10_000;
+const cache = new Map();
+/** `apiUrl` without trailing slashes, so `…/` and `…` share one cache entry. */
+export function cliConfigUrl(apiUrl) {
+    return `${apiUrl.replace(/\/+$/, '')}/cli-config`;
+}
+async function fetchCliConfig(apiUrl) {
+    const url = cliConfigUrl(apiUrl);
+    const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    if (!res.ok) {
+        throw new Error(`Failed to fetch CLI config from ${url}: HTTP ${res.status}`);
+    }
+    const body = await res.json();
+    if (!body || typeof body !== 'object' || Array.isArray(body)) {
+        throw new Error(`CLI config from ${url} is not a JSON object`);
+    }
+    return body;
+}
+/** The API's CLI config. A failed fetch is not cached, so the next call retries. */
+export function getCliConfig(apiUrl) {
+    const key = cliConfigUrl(apiUrl);
+    let pending = cache.get(key);
+    if (!pending) {
+        pending = fetchCliConfig(apiUrl);
+        cache.set(key, pending);
+        pending.catch(() => cache.delete(key));
+    }
+    return pending;
+}
+/** Test seam: forget fetched configs. */
+export function resetCliConfigCache() {
+    cache.clear();
+}

package/dist/config/environments.d.ts

@@ -2,9 +2,11 @@
  * Per-env devicecloud.dev coordinates — single source of truth for the URLs
  * the CLI uses.
  *
- * There is deliberately no Supabase key here. A compiled-in key can never be
- * rotated without breaking every pinned CLI version, so it is fetched from the
- * API at runtime instead: see `getSupabaseKey` in ./supabase-key.ts (dcd#1112).
+ * There is deliberately no Supabase key and no KEK public key here. A
+ * compiled-in key can never be rotated without breaking every pinned CLI
+ * version, so both are fetched from the API at runtime instead: see
+ * ./cli-config.ts (`getSupabaseKey` in ./supabase-key.ts for dcd#1112, and
+ * `resolveKekPublicKey` in ../utils/envelope.ts for dcd#1138).
  */
 export type DcdEnvName = 'dev' | 'prod';
 export interface DcdEnvironment {
@@ -14,38 +16,12 @@ export interface DcdEnvironment {
         url: string;
         projectRef: string;
     };
-    /**
-     * Pinned KEK public key for client-side binary envelope encryption (dcd#1138).
-     * `key` is base64 of the raw 32-byte X25519 public key; `version` selects which
-     * KEK the platform API unwraps with. **Public — safe to embed**: it can only
-     * *encrypt*; the private half lives solely on the API.
-     *
-     * Left `null` until the KEK is generated and provisioned. Generate a keypair
-     * with, e.g.:
-     *   node -e 'const c=require("crypto");const{publicKey,privateKey}=c.generateKeyPairSync("x25519");const pub=publicKey.export({type:"spki",format:"der"}).subarray(12);const priv=privateKey.export({type:"pkcs8",format:"der"}).subarray(16);console.log("public :",pub.toString("base64"));console.log("private:",priv.toString("base64"))'
-     * Pin `public` here; set `private` as `BINARY_KEK_PRIVATE_KEYS={"<version>":"<private base64>"}`
-     * on the API service and keep one offline escrow copy. Until then, encryption
-     * can be exercised via the `DCD_BINARY_KEK_PUBLIC` env override (see envelope.ts).
-     */
-    kekPublicKey: {
-        version: number;
-        key: string;
-    } | null;
 }
 export declare const ENVIRONMENTS: Record<DcdEnvName, DcdEnvironment>;
 /** Exact-match lookup of a known environment by API URL (trailing slashes ignored). */
 export declare function findEnvByApiUrl(apiUrl: string): DcdEnvironment | undefined;
 /** Map a caller-supplied API URL to one of the known environments. */
 export declare function inferEnvFromApiUrl(apiUrl: string): DcdEnvName;
-/**
- * The environment whose pinned KEK may encrypt uploads to `apiUrl` (dcd#1138),
- * or undefined when the URL isn't a known one. Stricter than
- * {@link inferEnvFromApiUrl}, which falls back to prod for any URL: that is
- * harmless for picking a console link, but an upload encrypted for a KEK its
- * API can't unwrap is unusable. Known means the host of a pinned `apiUrl`, or
- * `localhost`, which runs against dev.
- */
-export declare function kekEnvForApiUrl(apiUrl: string): DcdEnvName | undefined;
 /**
  * Frontend URL to open for a given API URL. Same as
  * `ENVIRONMENTS[inferEnvFromApiUrl(apiUrl)].frontendUrl`, except that when the

package/dist/config/environments.js

@@ -2,9 +2,11 @@
  * Per-env devicecloud.dev coordinates — single source of truth for the URLs
  * the CLI uses.
  *
- * There is deliberately no Supabase key here. A compiled-in key can never be
- * rotated without breaking every pinned CLI version, so it is fetched from the
- * API at runtime instead: see `getSupabaseKey` in ./supabase-key.ts (dcd#1112).
+ * There is deliberately no Supabase key and no KEK public key here. A
+ * compiled-in key can never be rotated without breaking every pinned CLI
+ * version, so both are fetched from the API at runtime instead: see
+ * ./cli-config.ts (`getSupabaseKey` in ./supabase-key.ts for dcd#1112, and
+ * `resolveKekPublicKey` in ../utils/envelope.ts for dcd#1138).
  */
 export const ENVIRONMENTS = {
     prod: {
@@ -14,7 +16,6 @@ export const ENVIRONMENTS = {
             url: 'https://cloud.devicecloud.dev',
             projectRef: 'pgydnphbimetinsgfkbo',
         },
-        kekPublicKey: { version: 1, key: 'wtfyWEwK7nJzwI4PD+9RAW8jxIR1u8kMQq2IhsrVnH4=' },
     },
     dev: {
         apiUrl: 'https://api.dev.devicecloud.dev',
@@ -23,7 +24,6 @@ export const ENVIRONMENTS = {
             url: 'https://lbmsowehtjwnqlurpemb.supabase.co',
             projectRef: 'lbmsowehtjwnqlurpemb',
         },
-        kekPublicKey: { version: 1, key: 'RgcToF/OJpcQI9koYvSvtj/WLaebfcN4v5GJoqtr/00=' },
     },
 };
 /** Exact-match lookup of a known environment by API URL (trailing slashes ignored). */
@@ -38,27 +38,6 @@ export function inferEnvFromApiUrl(apiUrl) {
         return 'dev';
     return 'prod';
 }
-/**
- * The environment whose pinned KEK may encrypt uploads to `apiUrl` (dcd#1138),
- * or undefined when the URL isn't a known one. Stricter than
- * {@link inferEnvFromApiUrl}, which falls back to prod for any URL: that is
- * harmless for picking a console link, but an upload encrypted for a KEK its
- * API can't unwrap is unusable. Known means the host of a pinned `apiUrl`, or
- * `localhost`, which runs against dev.
- */
-export function kekEnvForApiUrl(apiUrl) {
-    let host;
-    try {
-        host = new URL(apiUrl).hostname;
-    }
-    catch {
-        return undefined;
-    }
-    if (host === 'localhost')
-        return 'dev';
-    const names = Object.keys(ENVIRONMENTS);
-    return names.find((name) => new URL(ENVIRONMENTS[name].apiUrl).hostname === host);
-}
 /**
  * Frontend URL to open for a given API URL. Same as
  * `ENVIRONMENTS[inferEnvFromApiUrl(apiUrl)].frontendUrl`, except that when the

package/dist/config/flags/binary.flags.d.ts

@@ -21,7 +21,6 @@ export declare const binaryFlags: {
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly hidden: true;
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.";
     };
 };

package/dist/config/flags/binary.flags.js

@@ -21,9 +21,6 @@ export const binaryFlags = {
     },
     encrypt: {
         type: 'boolean',
-        // Left out of --help while encryption is a per-org beta (dcd#1138); the
-        // flag still parses, --no-encrypt included.
-        hidden: true,
-        description: 'Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.',
+        description: 'Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.',
     },
 };

package/dist/config/supabase-key.d.ts

@@ -1,19 +1,3 @@
-/**
- * The Supabase publishable key, fetched from the dcd API at runtime (dcd#1112).
- *
- * Releases up to this one compiled the anon key in, so the key could never be
- * rotated without breaking every CLI version pinned in customer CI. The API now
- * serves it from the public `GET /cli-config`, and rotating it is an env change
- * on the API.
- *
- * Fetched once per process and kept in memory only. It is deliberately not
- * cached on disk: a stale key makes GoTrue answer a refresh with a 4xx, which
- * `resolveAuth` treats as a dead session and deletes the user's login.
- *
- * Only the key comes from the API. The Supabase URLs stay pinned in
- * `ENVIRONMENTS`: prod goes through the `cloud.devicecloud.dev` custom domain,
- * which customer firewalls may allow-list, not the API's raw `supabase.co` URL.
- */
 import { type DcdEnvName } from './environments.js';
 /** The publishable key for `env`. A failed fetch is not cached, so the next call retries. */
 export declare function getSupabaseKey(env: DcdEnvName): Promise<string>;

package/dist/config/supabase-key.js

@@ -3,43 +3,24 @@
  *
  * Releases up to this one compiled the anon key in, so the key could never be
  * rotated without breaking every CLI version pinned in customer CI. The API now
- * serves it from the public `GET /cli-config`, and rotating it is an env change
- * on the API.
- *
- * Fetched once per process and kept in memory only. It is deliberately not
- * cached on disk: a stale key makes GoTrue answer a refresh with a 4xx, which
- * `resolveAuth` treats as a dead session and deletes the user's login.
+ * serves it from the public `GET /cli-config` (see ./cli-config.ts for the
+ * fetch and its in-memory cache), and rotating it is an env change on the API.
  *
  * Only the key comes from the API. The Supabase URLs stay pinned in
  * `ENVIRONMENTS`: prod goes through the `cloud.devicecloud.dev` custom domain,
  * which customer firewalls may allow-list, not the API's raw `supabase.co` URL.
  */
+import { cliConfigUrl, getCliConfig, resetCliConfigCache } from './cli-config.js';
 import { ENVIRONMENTS } from './environments.js';
-const FETCH_TIMEOUT_MS = 10_000;
-const cache = new Map();
-async function fetchSupabaseKey(env) {
-    const url = `${ENVIRONMENTS[env].apiUrl}/cli-config`;
-    const res = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
-    if (!res.ok) {
-        throw new Error(`Failed to fetch CLI config from ${url}: HTTP ${res.status}`);
-    }
-    const body = (await res.json());
-    const key = body.supabase_publishable_key;
+/** The publishable key for `env`. A failed fetch is not cached, so the next call retries. */
+export async function getSupabaseKey(env) {
+    const apiUrl = ENVIRONMENTS[env].apiUrl;
+    const key = (await getCliConfig(apiUrl)).supabase_publishable_key;
     if (typeof key !== 'string' || key.length === 0) {
-        throw new Error(`CLI config from ${url} has no supabase_publishable_key`);
+        throw new Error(`CLI config from ${cliConfigUrl(apiUrl)} has no supabase_publishable_key`);
     }
     return key;
 }
-/** The publishable key for `env`. A failed fetch is not cached, so the next call retries. */
-export function getSupabaseKey(env) {
-    let pending = cache.get(env);
-    if (!pending) {
-        pending = fetchSupabaseKey(env);
-        cache.set(env, pending);
-        pending.catch(() => cache.delete(env));
-    }
-    return pending;
-}
 /**
  * Headers that authenticate a raw Storage/Auth request with `key` alone. A
  * legacy anon key is a JWT and also goes in `Authorization`; an
@@ -50,5 +31,5 @@ export function supabaseKeyHeaders(key) {
 }
 /** Test seam: forget fetched keys. */
 export function resetSupabaseKeyCache() {
-    cache.clear();
+    resetCliConfigCache();
 }

package/dist/constants.d.ts

@@ -228,8 +228,7 @@ export declare const flags: {
     };
     readonly encrypt: {
         readonly type: "boolean";
-        readonly hidden: true;
-        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). The binary is still deduplicated across runs, so an unchanged app is not re-uploaded. Also turned on by DCD_ENCRYPT=1, and by default for orgs in the encryption beta; --no-encrypt or DCD_ENCRYPT=0 turns it off.";
+        readonly description: "Encrypt the app binary, flow zip, and env vars before upload (client-side envelope encryption; each gets its own key). On by default; --no-encrypt or DCD_ENCRYPT=0 turns it off. The binary is still deduplicated across runs, so an unchanged app is not re-uploaded.";
     };
     readonly 'api-key': {
         readonly type: "string";

package/dist/index.js

@@ -14,7 +14,6 @@ import { uploadCommand } from './commands/upload.js';
 import { whoamiCommand } from './commands/whoami.js';
 import { telemetry } from './services/telemetry.service.js';
 import { CliError, getCliVersion, logger, wantsJson } from './utils/cli.js';
-import { withoutHiddenArgs } from './utils/help.js';
 // @clack/prompts ships the US spelling ("Canceled") for its built-in
 // spinner/prompt cancellation message; align it with the British spelling
 // ("Cancelled") used everywhere else in the CLI.
@@ -66,17 +65,12 @@ async function resolveSubCommand(cmd, rawArgs, parent) {
     }
     return [cmd, parent];
 }
-// Usage for the (sub)command named in rawArgs, without the args marked hidden.
-async function showHelp(rawArgs) {
-    const [cmd, parent] = await resolveSubCommand(main, rawArgs);
-    await showUsage(await withoutHiddenArgs(cmd), parent);
-}
 async function run() {
     const rawArgs = process.argv.slice(2);
     telemetry.recordCommandStart();
     try {
         if (rawArgs.includes('--help') || rawArgs.includes('-h')) {
-            await showHelp(rawArgs);
+            await showUsage(...(await resolveSubCommand(main, rawArgs)));
         }
         else if (rawArgs.length === 1 && rawArgs[0] === '--version') {
             logger.log(getCliVersion());
@@ -94,7 +88,7 @@ async function run() {
         // citty throws CLIError (by name — the class isn't exported) for usage
         // problems like unknown commands or missing required args.
         if (!json && error instanceof Error && error.name === 'CLIError') {
-            await showHelp(rawArgs);
+            await showUsage(...(await resolveSubCommand(main, rawArgs)));
         }
         const exitCode = error instanceof CliError ? error.exitCode : 1;
         // logger.error prints the message, records failure telemetry, flushes

package/dist/mcp/tools/run-cloud-test.js

@@ -84,7 +84,7 @@ export function registerRunCloudTest(server) {
             encrypt: z
                 .boolean()
                 .optional()
-                .describe('true encrypts the binary, flow zip and env vars client-side before upload; false never does. Omit to follow DCD_ENCRYPT, then the organization default.'),
+                .describe('true encrypts the binary, flow zip and env vars client-side before upload; false never does. Omit to follow DCD_ENCRYPT, then the default, which is on.'),
             wait: z
                 .boolean()
                 .optional()
@@ -152,8 +152,8 @@ export function registerRunCloudTest(server) {
             });
         }
         // Client-side envelope encryption (binary/flow/env), in the same order
-        // as `dcd cloud`: the encrypt input, DCD_ENCRYPT, then the org default.
-        const encryption = checkKekForEncryption(resolveEncryption({
+        // as `dcd cloud`: the encrypt input, DCD_ENCRYPT, then the server default.
+        const encryption = await checkKekForEncryption(resolveEncryption({
             flag: args.encrypt,
             serverDefault: compatibilityData.encryption?.defaultOn,
         }), apiUrl);
@@ -169,7 +169,7 @@ export function registerRunCloudTest(server) {
         };
         telemetryExtra.encrypt = encryptTelemetry;
         if (encrypt && encryption.source === 'server') {
-            logStderr('Encrypting uploads (beta); opt out with encrypt: false');
+            logStderr('Encrypting uploads; opt out with encrypt: false');
         }
         // Resolve the binary: existing id, or upload the local file.
         let appBinaryId = args.appBinaryId;

package/dist/methods.js

@@ -190,15 +190,15 @@ export const uploadBinary = async (config) => {
 /**
  * Encrypt the prepared upload source in place (dcd#1138): generate a per-upload
  * DEK, stream-encrypt `source.diskPath` into a temp ciphertext file, wrap the
- * DEK with the environment's pinned KEK public key, and repoint `source` at the
+ * DEK with the KEK public key the API publishes, and repoint `source` at the
  * ciphertext so the SHA, dedup check, and both uploaders operate on ciphertext.
  * Returns the envelope metadata (for `binaries.metadata.enc`) plus the temp dir
  * to clean up. Throws if no KEK is available for the environment.
  */
 async function encryptUploadSource(source, apiUrl, debug) {
-    const kek = resolveKekPublicKey(apiUrl);
+    const kek = await resolveKekPublicKey(apiUrl);
     if (!kek) {
-        throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the organization default) but no KEK public key is configured for this API. ' +
+        throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the default) but no KEK public key is configured for this API. ' +
             'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64>, or pass --no-encrypt to upload without encryption.');
     }
     const dek = generateDek();

package/dist/services/test-submission.service.js

@@ -78,9 +78,9 @@ export class TestSubmissionService {
             if (!apiUrl) {
                 throw new Error('Encryption requires apiUrl to resolve the KEK public key');
             }
-            const kek = resolveKekPublicKey(apiUrl);
+            const kek = await resolveKekPublicKey(apiUrl);
             if (!kek) {
-                throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the organization default) but no KEK public key is configured for this API. ' +
+                throw new Error('Encryption is on (from --encrypt, DCD_ENCRYPT or the default) but no KEK public key is configured for this API. ' +
                     'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64>, or pass --no-encrypt to upload without encryption.');
             }
             const flow = encryptFlowBuffer(plaintextZip, kek);

package/dist/utils/compatibility.d.ts

@@ -12,9 +12,8 @@ export interface CompatibilityData {
     /** Active CLI notices, piggybacked onto the compatibility response by the API. */
     notices?: Notice[];
     /**
-     * The org's client-side encryption default (dcd#1138): on for orgs in the
-     * `client_encryption` beta unless the API's kill switch is set. An older API
-     * omits it, which means off.
+     * The client-side encryption default (dcd#1138): on for every org unless the
+     * API's kill switch is set. An older API omits it, which means off.
      */
     encryption?: {
         defaultOn: boolean;

package/dist/utils/envelope.d.ts

@@ -29,7 +29,7 @@ export interface EncryptionDecision {
  *   1. `flag`: `--encrypt` / `--no-encrypt`, or the MCP tool's `encrypt` input.
  *   2. `DCD_ENCRYPT`, then its legacy alias `DCD_ENCRYPT_BINARIES`.
  *   3. `serverDefault`: `encryption.defaultOn` from the compatibility data,
- *      which the API turns on for orgs in the `client_encryption` beta.
+ *      which the API turns on for every org unless its kill switch is set.
  *   4. Off. An API too old to send `encryption` ends up here.
  * When on, the binary, the flow zip, and the env map are each encrypted with
  * their **own** per-upload DEK (all wrapped under the same per-env KEK).
@@ -41,26 +41,32 @@ export declare function resolveEncryption(opts: {
 }): EncryptionDecision;
 /**
  * Check that `apiUrl` has a KEK before a run encrypts against it: either
- * `DCD_BINARY_KEK_PUBLIC` is set or the URL is a known devicecloud.dev API
- * (see kekEnvForApiUrl). Without one, an explicit `--encrypt` is an error,
- * while encryption from DCD_ENCRYPT or the org default is skipped with a
- * notice, so a run against another API URL uploads in plaintext as before.
+ * `DCD_BINARY_KEK_PUBLIC` is set or the API publishes one on `GET /cli-config`
+ * (see resolveKekPublicKey). Without one, an explicit `--encrypt` is an error,
+ * while encryption from DCD_ENCRYPT or the server default is skipped with a
+ * notice, so a run against an API that publishes no KEK uploads in plaintext
+ * as before. An API that cannot be asked at all is an error whatever decided
+ * encryption: silently falling back to plaintext would be the one outcome the
+ * org asked not to have.
  */
-export declare function checkKekForEncryption(decision: EncryptionDecision, apiUrl: string): EncryptionDecision;
-/** Pinned KEK public key (base64 raw 32-byte X25519) + version, per env. */
+export declare function checkKekForEncryption(decision: EncryptionDecision, apiUrl: string): Promise<EncryptionDecision>;
+/** KEK public key (raw 32-byte X25519) + the version the API unwraps it with. */
 interface KekPublicKey {
     version: number;
     keyRaw: Buffer;
 }
 /**
- * Resolve the KEK public key for the environment behind `apiUrl`. Order:
+ * Resolve the KEK public key for the API behind `apiUrl`. Order:
  *   1. `DCD_BINARY_KEK_PUBLIC` env override (`<version>:<base64>`, e.g. `1:AAAA…`)
- *      — lets the feature be exercised before keys are pinned in the release,
- *      or against an API URL that isn't a known one.
- *   2. the pinned `ENVIRONMENTS[env].kekPublicKey`, only for a known API URL.
- * Returns null when no key is available (encryption cannot proceed).
+ *      — lets the feature be exercised against an API that publishes nothing.
+ *   2. `binary_kek_public_key` from the API's own `GET /cli-config` (dcd#1138):
+ *      the newest KEK the API holds the private half of. Fetched once per
+ *      process (see ../config/cli-config.ts), so a KEK rotation is an env
+ *      change on the API and never a CLI release.
+ * Returns null when the API publishes no key (encryption cannot proceed).
+ * Throws when the API cannot be asked, or publishes something malformed.
  */
-export declare function resolveKekPublicKey(apiUrl: string): KekPublicKey | null;
+export declare function resolveKekPublicKey(apiUrl: string): Promise<KekPublicKey | null>;
 /**
  * Wrap a DEK for the given KEK public key (X25519 sealed box). Produces base64 of
  * `ephPub(32) || iv(12) || ciphertext(32) || tag(16)`.

package/dist/utils/envelope.js

@@ -1,6 +1,6 @@
 import { createCipheriv, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync, randomBytes, } from 'node:crypto';
 import { open, stat } from 'node:fs/promises';
-import { ENVIRONMENTS, kekEnvForApiUrl } from '../config/environments.js';
+import { cliConfigUrl, getCliConfig } from '../config/cli-config.js';
 /**
  * Client-side envelope encryption of app binaries before upload (dcd#1138).
  *
@@ -10,9 +10,9 @@ import { ENVIRONMENTS, kekEnvForApiUrl } from '../config/environments.js';
  * specified in `dcd/docs/binary-envelope-encryption.md`.
  *
  * Scheme: a per-upload random 256-bit DEK encrypts the binary (chunked
- * AES-256-GCM); the DEK is wrapped with the environment's pinned X25519 KEK
- * public key (sealed box). Only the platform API holds the KEK private half, so
- * every storage/transport tier sees ciphertext only.
+ * AES-256-GCM); the DEK is wrapped with the X25519 KEK public key the API
+ * publishes on `GET /cli-config` (sealed box). Only the platform API holds the
+ * KEK private half, so every storage/transport tier sees ciphertext only.
  */
 const MAGIC = Buffer.from('DCDE', 'ascii');
 const CONTAINER_VERSION = 1;
@@ -45,7 +45,7 @@ function parseEncryptEnv(value) {
  *   1. `flag`: `--encrypt` / `--no-encrypt`, or the MCP tool's `encrypt` input.
  *   2. `DCD_ENCRYPT`, then its legacy alias `DCD_ENCRYPT_BINARIES`.
  *   3. `serverDefault`: `encryption.defaultOn` from the compatibility data,
- *      which the API turns on for orgs in the `client_encryption` beta.
+ *      which the API turns on for every org unless its kill switch is set.
  *   4. Off. An API too old to send `encryption` ends up here.
  * When on, the binary, the flow zip, and the env map are each encrypted with
  * their **own** per-upload DEK (all wrapped under the same per-env KEK).
@@ -63,21 +63,24 @@ export function resolveEncryption(opts) {
 }
 /**
  * Check that `apiUrl` has a KEK before a run encrypts against it: either
- * `DCD_BINARY_KEK_PUBLIC` is set or the URL is a known devicecloud.dev API
- * (see kekEnvForApiUrl). Without one, an explicit `--encrypt` is an error,
- * while encryption from DCD_ENCRYPT or the org default is skipped with a
- * notice, so a run against another API URL uploads in plaintext as before.
+ * `DCD_BINARY_KEK_PUBLIC` is set or the API publishes one on `GET /cli-config`
+ * (see resolveKekPublicKey). Without one, an explicit `--encrypt` is an error,
+ * while encryption from DCD_ENCRYPT or the server default is skipped with a
+ * notice, so a run against an API that publishes no KEK uploads in plaintext
+ * as before. An API that cannot be asked at all is an error whatever decided
+ * encryption: silently falling back to plaintext would be the one outcome the
+ * org asked not to have.
  */
-export function checkKekForEncryption(decision, apiUrl) {
-    if (!decision.enabled || resolveKekPublicKey(apiUrl))
+export async function checkKekForEncryption(decision, apiUrl) {
+    if (!decision.enabled || (await resolveKekPublicKey(apiUrl)))
         return decision;
     if (decision.source === 'flag') {
-        throw new Error(`--encrypt needs the KEK public key of the API it uploads to, and ${apiUrl} is not a devicecloud.dev API this CLI has one for. ` +
+        throw new Error(`--encrypt needs the KEK public key of the API it uploads to, and ${apiUrl} does not publish one. ` +
             'Set DCD_BINARY_KEK_PUBLIC=<version>:<base64> to encrypt against it, or drop --encrypt.');
     }
     return {
         enabled: false,
-        notice: `Not encrypting uploads: ${apiUrl} is not a devicecloud.dev API this CLI has a key for. Set DCD_BINARY_KEK_PUBLIC to encrypt against it.`,
+        notice: `Not encrypting uploads: ${apiUrl} does not publish a KEK public key. Set DCD_BINARY_KEK_PUBLIC to encrypt against it.`,
         source: decision.source,
     };
 }
@@ -89,14 +92,17 @@ function x25519PublicFromRaw(raw) {
     });
 }
 /**
- * Resolve the KEK public key for the environment behind `apiUrl`. Order:
+ * Resolve the KEK public key for the API behind `apiUrl`. Order:
  *   1. `DCD_BINARY_KEK_PUBLIC` env override (`<version>:<base64>`, e.g. `1:AAAA…`)
- *      — lets the feature be exercised before keys are pinned in the release,
- *      or against an API URL that isn't a known one.
- *   2. the pinned `ENVIRONMENTS[env].kekPublicKey`, only for a known API URL.
- * Returns null when no key is available (encryption cannot proceed).
+ *      — lets the feature be exercised against an API that publishes nothing.
+ *   2. `binary_kek_public_key` from the API's own `GET /cli-config` (dcd#1138):
+ *      the newest KEK the API holds the private half of. Fetched once per
+ *      process (see ../config/cli-config.ts), so a KEK rotation is an env
+ *      change on the API and never a CLI release.
+ * Returns null when the API publishes no key (encryption cannot proceed).
+ * Throws when the API cannot be asked, or publishes something malformed.
  */
-export function resolveKekPublicKey(apiUrl) {
+export async function resolveKekPublicKey(apiUrl) {
     const override = process.env.DCD_BINARY_KEK_PUBLIC;
     if (override) {
         const [versionPart, b64] = override.split(':');
@@ -108,17 +114,15 @@ export function resolveKekPublicKey(apiUrl) {
         }
         throw new Error('DCD_BINARY_KEK_PUBLIC must be "<version>:<base64 32-byte X25519 public key>"');
     }
-    const env = kekEnvForApiUrl(apiUrl);
-    if (!env)
+    const published = (await getCliConfig(apiUrl)).binary_kek_public_key;
+    if (published === undefined || published === null)
         return null;
-    const pinned = ENVIRONMENTS[env].kekPublicKey;
-    if (!pinned)
-        return null;
-    const keyRaw = Buffer.from(pinned.key, 'base64');
-    if (keyRaw.length !== 32) {
-        throw new Error(`Pinned KEK public key for ${env} is not a 32-byte key`);
+    const { version, key } = published;
+    const keyRaw = typeof key === 'string' ? Buffer.from(key, 'base64') : Buffer.alloc(0);
+    if (!Number.isInteger(version) || keyRaw.length !== 32) {
+        throw new Error(`CLI config from ${cliConfigUrl(apiUrl)} has a malformed binary_kek_public_key; expected { version: integer, key: base64 32-byte X25519 public key }`);
     }
-    return { version: pinned.version, keyRaw };
+    return { version: version, keyRaw };
 }
 /**
  * Wrap a DEK for the given KEK public key (X25519 sealed box). Produces base64 of

package/package.json

@@ -68,7 +68,7 @@
     "test:unit": "node scripts/test-runner.mjs --unit",
     "typecheck": "tsc --noEmit -p tsconfig.test.json"
   },
-  "version": "5.9.0",
+  "version": "5.10.0-beta.1",
   "bugs": {
     "url": "https://discord.gg/gm3mJwcNw8"
   },

package/dist/utils/help.d.ts

@@ -1,12 +0,0 @@
-import type { ArgDef, ArgsDef, CommandDef } from 'citty';
-/**
- * A citty arg definition plus a local `hidden` marker. citty (0.2) can hide a
- * command from help (`meta.hidden`) but not an arg, so {@link withoutHiddenArgs}
- * drops hidden args before usage is rendered. They still parse as normal.
- */
-export type CliArgDef = ArgDef & {
-    hidden?: boolean;
-};
-export type CliArgsDef = Record<string, CliArgDef>;
-/** `cmd` with its hidden args left out, for rendering `--help` only. */
-export declare function withoutHiddenArgs<T extends ArgsDef>(cmd: CommandDef<T>): Promise<CommandDef<T>>;

package/dist/utils/help.js

@@ -1,8 +0,0 @@
-/** `cmd` with its hidden args left out, for rendering `--help` only. */
-export async function withoutHiddenArgs(cmd) {
-    const args = typeof cmd.args === 'function' ? await cmd.args() : await cmd.args;
-    if (!args)
-        return cmd;
-    const visible = Object.fromEntries(Object.entries(args).filter(([, def]) => !def.hidden));
-    return { ...cmd, args: visible };
-}