@zeph-to/cli 1.12.0

package/dist/agents.d.ts

@@ -0,0 +1,8 @@
+export interface Agent {
+    name: string;
+    id: string;
+    detected: boolean;
+}
+export declare const hasCommand: (cmd: string) => boolean;
+export declare const detectAgents: () => Agent[];
+//# sourceMappingURL=agents.d.ts.map

package/dist/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../src/agents.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,KAAK;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,OAAO,CAAC;CACrB;AAID,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,OAOxC,CAAC;AAEF,eAAO,MAAM,YAAY,QAAO,KAAK,EASpC,CAAC"}

package/dist/agents.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAgents = exports.hasCommand = void 0;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const HOME = (0, os_1.homedir)();
+const hasCommand = (cmd) => {
+    try {
+        (0, child_process_1.execSync)(`which ${cmd}`, { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+exports.hasCommand = hasCommand;
+const detectAgents = () => [
+    { name: 'Claude Code', id: 'claude', detected: (0, exports.hasCommand)('claude') },
+    { name: 'Cursor', id: 'cursor', detected: (0, fs_1.existsSync)((0, path_1.join)(HOME, '.cursor')) },
+    { name: 'Windsurf', id: 'windsurf', detected: (0, fs_1.existsSync)((0, path_1.join)(HOME, '.codeium')) },
+    { name: 'Gemini CLI', id: 'gemini', detected: (0, exports.hasCommand)('gemini') },
+    { name: 'Codex CLI', id: 'codex', detected: (0, exports.hasCommand)('codex') },
+    { name: 'Copilot CLI', id: 'copilot', detected: (0, fs_1.existsSync)((0, path_1.join)(HOME, '.copilot')) },
+    { name: 'Cline', id: 'cline', detected: (0, fs_1.existsSync)((0, path_1.join)(HOME, '.cline')) },
+    { name: 'Aider', id: 'aider', detected: (0, exports.hasCommand)('aider') },
+];
+exports.detectAgents = detectAgents;

package/dist/check-update.d.ts

@@ -0,0 +1,4 @@
+/** Semver-ish compare: returns true when `latest` is strictly newer than `current`. */
+export declare const isNewer: (latest: string, current: string) => boolean;
+export declare const handleCheckUpdate: (args: Record<string, string | boolean>) => Promise<number>;
+//# sourceMappingURL=check-update.d.ts.map

package/dist/check-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-update.d.ts","sourceRoot":"","sources":["../src/check-update.ts"],"names":[],"mappings":"AAsBA,uFAAuF;AACvF,eAAO,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,SAAS,MAAM,KAAG,OAQzD,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CA4C9F,CAAC"}

package/dist/check-update.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.handleCheckUpdate = exports.isNewer = void 0;
+const config_js_1 = require("./config.js");
+// Compares installed versions against the npm registry. Pure read-only —
+// never installs anything; just tells the user if a newer release exists.
+const PACKAGES = ['@zeph-to/cli', '@zeph-to/mcp-server'];
+/** Fetch the `latest` dist-tag version for a package from the npm registry. */
+const fetchLatest = async (pkg) => {
+    try {
+        const res = await fetch(`https://registry.npmjs.org/${pkg}/latest`, {
+            headers: { Accept: 'application/json' },
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        return json.version ?? null;
+    }
+    catch {
+        return null;
+    }
+};
+/** Semver-ish compare: returns true when `latest` is strictly newer than `current`. */
+const isNewer = (latest, current) => {
+    const norm = (v) => v.replace(/^v/, '').split('-')[0].split('.').map((n) => parseInt(n, 10) || 0);
+    const [a, b] = [norm(latest), norm(current)];
+    for (let i = 0; i < 3; i++) {
+        if ((a[i] ?? 0) > (b[i] ?? 0))
+            return true;
+        if ((a[i] ?? 0) < (b[i] ?? 0))
+            return false;
+    }
+    return false;
+};
+exports.isNewer = isNewer;
+const handleCheckUpdate = async (args) => {
+    const isJson = args.json === true;
+    // The CLI's own installed version is known from package.json.
+    // mcp-server's installed version isn't reliably knowable from here
+    // (it's a separate package, often run via npx), so we only report its
+    // latest — the user compares against whatever they have.
+    const results = [];
+    for (const pkg of PACKAGES) {
+        const latest = await fetchLatest(pkg);
+        const current = pkg === '@zeph-to/cli' ? config_js_1.VERSION : null;
+        const outdated = !!(latest && current && (0, exports.isNewer)(latest, current));
+        results.push({ pkg, current, latest, outdated });
+    }
+    if (isJson) {
+        console.log(JSON.stringify({ results }, null, 2));
+        return results.some((r) => r.outdated) ? 0 : 0;
+    }
+    console.log('\n  Zeph — update check\n');
+    let anyOutdated = false;
+    for (const r of results) {
+        if (!r.latest) {
+            console.log(`    ?  ${r.pkg}: could not reach npm registry`);
+            continue;
+        }
+        if (r.current === null) {
+            console.log(`    •  ${r.pkg}: latest is v${r.latest}`);
+        }
+        else if (r.outdated) {
+            anyOutdated = true;
+            console.log(`    ⬆  ${r.pkg}: v${r.current} → v${r.latest} (update available)`);
+        }
+        else {
+            console.log(`    ✓  ${r.pkg}: v${r.current} (up to date)`);
+        }
+    }
+    if (anyOutdated) {
+        console.log('\n  Update with: npx @zeph-to/cli install\n');
+    }
+    else {
+        console.log('');
+    }
+    return 0;
+};
+exports.handleCheckUpdate = handleCheckUpdate;

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,374 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs_1 = require("fs");
+const child_process_1 = require("child_process");
+const zeph_hook_js_1 = require("./zeph-hook.js");
+const errors_js_1 = require("./errors.js");
+const installer_js_1 = require("./installer.js");
+const login_js_1 = require("./login.js");
+const uninstall_js_1 = require("./uninstall.js");
+const verify_js_1 = require("./verify.js");
+const check_update_js_1 = require("./check-update.js");
+const wrapper_js_1 = require("./wrapper.js");
+const listener_js_1 = require("./listener.js");
+const config_js_1 = require("./config.js");
+const PROJECT_DIR_VARS = ['CLAUDE_PROJECT_DIR', 'CURSOR_PROJECT_DIR', 'WINDSURF_PROJECT_DIR'];
+const detectProjectDir = () => PROJECT_DIR_VARS.reduce((found, key) => found || process.env[key], undefined) ?? process.cwd();
+const isMuted = () => {
+    try {
+        const dir = detectProjectDir();
+        const raw = (0, child_process_1.execFileSync)('cksum', { input: dir, encoding: 'utf-8' });
+        const hash = raw.split(' ')[0];
+        return (0, fs_1.existsSync)(`/tmp/zeph-muted-${hash}`);
+    }
+    catch {
+        return false;
+    }
+};
+const detectBranchAndProject = () => {
+    const dir = detectProjectDir();
+    const project = dir.split('/').filter(Boolean).pop() ?? 'project';
+    let branch;
+    try {
+        branch = (0, child_process_1.execFileSync)('git', ['-C', dir, 'rev-parse', '--abbrev-ref', 'HEAD'], {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        if (!branch || branch === 'HEAD')
+            branch = undefined;
+    }
+    catch { /* not a git repo */ }
+    return { branch, project };
+};
+// ── Arg Parser ──────────────────────────────────────────────────
+const parseArgs = (argv) => {
+    const result = {};
+    const positional = [];
+    const args = argv.slice(2);
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (!arg.startsWith('--')) {
+            positional.push(arg);
+            continue;
+        }
+        const key = arg.slice(2);
+        const next = args[i + 1];
+        if (!next || next.startsWith('--')) {
+            result[key] = true;
+        }
+        else {
+            result[key] = next;
+            i++;
+        }
+    }
+    result._command = positional[0] ?? '';
+    result._arg1 = positional[1] ?? '';
+    return result;
+};
+// ── Output ──────────────────────────────────────────────────────
+const printUsage = () => {
+    console.log(`Usage: zeph <command> [options]
+
+Commands:
+  install         One-command setup: detect agents, save config, install rules
+  login           Browser sign-in: auto-fetch API key + hook into ~/.zeph/config.json
+  uninstall       Remove Zeph from all detected agents
+  verify          Check installation health across detected agents
+  check-update    Check whether a newer Zeph version is available
+  notify          Send a push notification
+  list            List recent push notifications
+  dismiss <id>    Dismiss a push notification (or --all)
+  test            Send a test notification to verify setup
+  cc [args…]      Run 'claude' in a named tmux session ('zeph-<project>')
+  codex [args…]   Run 'codex' in a named tmux session
+  gemini [args…]  Run 'gemini' in a named tmux session
+                  (auto-suffixed -2/-3/… when another zeph cc is already
+                   attached to the default name; any args after the
+                   subcommand are forwarded verbatim, e.g.
+                   'zeph cc --resume')
+  listener        Resident daemon — receives 'agent.command' pushes from
+                  the phone picker and injects them into the matching
+                  tmux session.
+
+Notify options:
+  --title <text>     Push title
+  --body <text>      Push body
+  --url <url>        URL to include
+  --type <type>      Push type (note|link|file|hook) [default: hook]
+  --priority <p>     Priority (low|normal|high|urgent) [default: normal]
+  --device <id>      Target device ID
+  --session <id>     AI session ID (or set ZEPH_SESSION_ID env)
+
+List options:
+  --limit <n>        Number of pushes (1-20, default 5)
+  --type <type>      Filter by push type
+
+Dismiss options:
+  --all              Dismiss all notifications
+
+Login options:
+  --web-url <url>    Web app URL to sign in at [default: https://app.zeph.to]
+  --timeout <sec>    Seconds to wait for the browser [default: 300]
+
+Install options:
+  (no --key, no saved config → opens browser login automatically;
+   headless falls back to manual key entry)
+  --key <api-key>    API key (non-interactive; skips browser login)
+  --hook <hook-id>   Hook ID (non-interactive)
+  --base-url <url>   Base URL (non-interactive)
+  --web-url <url>    Login web app URL [default: https://app.zeph.to]
+  --only <agents>    Comma-separated agent ids to install for
+                     (claude,cursor,windsurf,gemini,codex,copilot,cline,aider).
+                     Skips the interactive picker.
+
+Uninstall options:
+  --dry-run          Preview what would be removed, change nothing
+  --purge            Also delete ~/.zeph/config.json (kept by default)
+
+Verify options:
+  --ping             Also make a live API call to confirm the key works
+
+Global options:
+  --key <api-key>    API key (or set ZEPH_API_KEY env)
+  --base-url <url>   API base URL (or set ZEPH_BASE_URL env)
+  --json             Output JSON format
+  --version          Show version
+
+Environment:
+  ZEPH_API_KEY       API key (fallback when --key not provided)
+  ZEPH_BASE_URL      API base URL (fallback when --base-url not provided)
+  ZEPH_SESSION_ID    AI session ID (fallback when --session not provided)`);
+};
+const printError = (message, isJson) => {
+    if (isJson) {
+        console.error(JSON.stringify({ error: message, status: 'error' }));
+    }
+    else {
+        console.error(`Error: ${message}`);
+    }
+};
+const printJson = (data) => {
+    console.log(JSON.stringify(data, null, 2));
+};
+// ── Commands ────────────────────────────────────────────────────
+const createHook = (args) => {
+    const config = (0, config_js_1.loadConfig)();
+    const apiKey = args.key || (0, config_js_1.resolvedEnv)('ZEPH_API_KEY') || config.apiKey;
+    const isJson = args.json === true;
+    if (!apiKey) {
+        printError('API key required. Run "zeph install" or set ZEPH_API_KEY', isJson);
+        return null;
+    }
+    const baseUrl = args['base-url'] || (0, config_js_1.resolvedEnv)('ZEPH_BASE_URL') || config.baseUrl;
+    return new zeph_hook_js_1.ZephHook({
+        apiKey,
+        ...(baseUrl && { baseUrl }),
+    });
+};
+const handleNotify = async (args) => {
+    const isJson = args.json === true;
+    if (isMuted())
+        return 0;
+    const hook = createHook(args);
+    if (!hook)
+        return 3;
+    try {
+        const sessionId = args.session || (0, config_js_1.resolvedEnv)('ZEPH_SESSION_ID') || undefined;
+        // When body isn't supplied (common case for hook-driven invocations like
+        // `zeph notify --title "Task done"`), auto-fill with branch + project so
+        // the user can tell which session finished without opening the app.
+        let title = args.title;
+        let body = args.body;
+        if (!body) {
+            const { branch, project } = detectBranchAndProject();
+            body = branch ? `${project} · ${branch}` : project;
+        }
+        if (!title)
+            title = 'Task done';
+        const result = await hook.notify({
+            title,
+            body,
+            url: args.url,
+            type: args.type || 'hook',
+            priority: args.priority || undefined,
+            targetDeviceId: args.device,
+            sessionId,
+        });
+        if (isJson) {
+            printJson({ pushId: result.pushId, status: 'ok' });
+        }
+        else {
+            console.log(`Push sent: ${result.pushId}`);
+        }
+        return 0;
+    }
+    catch (err) {
+        return handleError(err, isJson);
+    }
+};
+const handleList = async (args) => {
+    const isJson = args.json === true;
+    const hook = createHook(args);
+    if (!hook)
+        return 3;
+    try {
+        const limit = args.limit ? Number(args.limit) : undefined;
+        const result = await hook.list({
+            limit,
+            type: args.type,
+        });
+        if (isJson) {
+            printJson(result);
+        }
+        else {
+            if (result.pushes.length === 0) {
+                console.log('No pushes found.');
+            }
+            else {
+                for (const p of result.pushes) {
+                    const title = p.title ?? '(no title)';
+                    const time = new Date(p.createdAt).toLocaleString();
+                    console.log(`  ${p.pushId}  [${p.type}]  ${title}  (${time})`);
+                }
+                if (result.hasMore)
+                    console.log(`  ... more available (use --limit to increase)`);
+            }
+        }
+        return 0;
+    }
+    catch (err) {
+        return handleError(err, isJson);
+    }
+};
+const handleDismiss = async (args) => {
+    const isJson = args.json === true;
+    const hook = createHook(args);
+    if (!hook)
+        return 3;
+    try {
+        if (args.all === true) {
+            const result = await hook.dismissAll();
+            if (isJson) {
+                printJson({ dismissed: result.dismissed, status: 'ok' });
+            }
+            else {
+                console.log(`Dismissed ${result.dismissed} pushes.`);
+            }
+        }
+        else {
+            const pushId = args._arg1;
+            if (!pushId) {
+                printError('Push ID required. Usage: zeph dismiss <push-id> or zeph dismiss --all', isJson);
+                return 1;
+            }
+            await hook.dismiss(pushId);
+            if (isJson) {
+                printJson({ dismissed: true, pushId, status: 'ok' });
+            }
+            else {
+                console.log(`Dismissed: ${pushId}`);
+            }
+        }
+        return 0;
+    }
+    catch (err) {
+        return handleError(err, isJson);
+    }
+};
+const handleTest = async (args) => {
+    const isJson = args.json === true;
+    const hook = createHook(args);
+    if (!hook)
+        return 3;
+    try {
+        const result = await hook.notify({
+            title: 'Zeph Test',
+            body: `CLI connected successfully (v${config_js_1.VERSION})`,
+        });
+        if (isJson) {
+            printJson({ pushId: result.pushId, status: 'ok', message: 'Test notification sent' });
+        }
+        else {
+            console.log(`Test notification sent: ${result.pushId}`);
+        }
+        return 0;
+    }
+    catch (err) {
+        return handleError(err, isJson);
+    }
+};
+// ── Error Handler ───────────────────────────────────────────────
+const handleError = (err, isJson) => {
+    if (err instanceof errors_js_1.QuotaExceededError) {
+        printError(err.message, isJson);
+        return 2;
+    }
+    if (err instanceof errors_js_1.AuthenticationError) {
+        printError(err.message, isJson);
+        return 3;
+    }
+    if (err instanceof errors_js_1.ZephError) {
+        printError(err.message, isJson);
+        return 1;
+    }
+    printError(err instanceof Error ? err.message : 'Unknown error', isJson);
+    return 1;
+};
+// ── Passthrough ─────────────────────────────────────────────────
+/**
+ * Collect raw argv after the given subcommand token so flags like
+ * `--resume` reach the wrapped agent verbatim instead of being swallowed
+ * by `parseArgs`. Returns [] when the command isn't found.
+ */
+const collectPassthrough = (argv, cmd) => {
+    const idx = argv.indexOf(cmd, 2);
+    return idx >= 0 ? argv.slice(idx + 1) : [];
+};
+// ── Main ────────────────────────────────────────────────────────
+const main = async () => {
+    const args = parseArgs(process.argv);
+    const command = args._command;
+    if (args.version === true) {
+        console.log(config_js_1.VERSION);
+        return 0;
+    }
+    if (!command || command === 'help') {
+        printUsage();
+        return 0;
+    }
+    switch (command) {
+        case 'install':
+        case 'setup':
+            return (0, installer_js_1.handleInstall)(args);
+        case 'login':
+            return (0, login_js_1.handleLogin)(args);
+        case 'uninstall':
+            return (0, uninstall_js_1.handleUninstall)(args);
+        case 'verify':
+            return (0, verify_js_1.handleVerify)(args);
+        case 'check-update':
+            return (0, check_update_js_1.handleCheckUpdate)(args);
+        case 'notify':
+            return handleNotify(args);
+        case 'list':
+            return handleList(args);
+        case 'dismiss':
+            return handleDismiss(args);
+        case 'test':
+            return handleTest(args);
+        case 'cc':
+            return (0, wrapper_js_1.handleAgentSession)('claude', collectPassthrough(process.argv, 'cc'));
+        case 'codex':
+            return (0, wrapper_js_1.handleAgentSession)('codex', collectPassthrough(process.argv, 'codex'));
+        case 'gemini':
+            return (0, wrapper_js_1.handleAgentSession)('gemini', collectPassthrough(process.argv, 'gemini'));
+        case 'listener':
+            return (0, listener_js_1.handleListener)(args);
+        default:
+            printError(`Unknown command: ${command}`, args.json === true);
+            printUsage();
+            return 1;
+    }
+};
+main().then((code) => process.exit(code));

package/dist/config.d.ts

@@ -0,0 +1,14 @@
+export declare const CONFIG_DIR: string;
+export declare const CONFIG_FILE: string;
+export interface ZephConfig {
+    apiKey?: string;
+    hookId?: string;
+    baseUrl?: string;
+    wsUrl?: string;
+    deviceId?: string;
+}
+export declare const resolvedEnv: (key: string) => string | undefined;
+export declare const loadConfig: () => ZephConfig;
+export declare const saveConfig: (config: ZephConfig) => void;
+export declare const VERSION: string;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,UAAU,QAA2B,CAAC;AACnD,eAAO,MAAM,WAAW,QAAkC,CAAC;AAE3D,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAAM,GAAG,SAGlD,CAAC;AAEF,eAAO,MAAM,UAAU,QAAO,UAM7B,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,QAAQ,UAAU,KAAG,IAG/C,CAAC;AAEF,eAAO,MAAM,OAAO,QAOhB,CAAC"}

package/dist/config.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERSION = exports.saveConfig = exports.loadConfig = exports.resolvedEnv = exports.CONFIG_FILE = exports.CONFIG_DIR = void 0;
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+exports.CONFIG_DIR = (0, path_1.join)((0, os_1.homedir)(), '.zeph');
+exports.CONFIG_FILE = (0, path_1.join)(exports.CONFIG_DIR, 'config.json');
+const resolvedEnv = (key) => {
+    const val = process.env[key];
+    return val && !val.startsWith('${') ? val : undefined;
+};
+exports.resolvedEnv = resolvedEnv;
+const loadConfig = () => {
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(exports.CONFIG_FILE, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+};
+exports.loadConfig = loadConfig;
+const saveConfig = (config) => {
+    (0, fs_1.mkdirSync)(exports.CONFIG_DIR, { recursive: true });
+    (0, fs_1.writeFileSync)(exports.CONFIG_FILE, JSON.stringify(config, null, 2) + '\n');
+};
+exports.saveConfig = saveConfig;
+exports.VERSION = (() => {
+    try {
+        const pkg = JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(__dirname, '..', 'package.json'), 'utf-8'));
+        return pkg.version;
+    }
+    catch {
+        return '0.0.0';
+    }
+})();

package/dist/crypto.d.ts

@@ -0,0 +1,82 @@
+/**
+ * Device-shared encryption for Hook SDK — self-contained ECDH P-256 +
+ * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
+ * dependency). Uses Web Crypto API (globalThis.crypto.subtle) — Node.js 18+.
+ *
+ * Threat model honesty (do not call this "E2E" without a footnote):
+ *
+ *   The Zeph backend persists the per-user private key in plaintext so it
+ *   can be synced down to a fresh device (fetchServerKeys / uploadServerKeys
+ *   below). That means the backend can decrypt any push body — this is NOT
+ *   end-to-end in the standard sense. What it gives you is:
+ *     • Protection against passive network observers
+ *     • Protection against a leaked DB snapshot taken without the key store
+ *     • Cross-device readability (all your devices share one keypair)
+ *   What it does NOT give you:
+ *     • Protection against the Zeph backend itself
+ *     • Forward secrecy — encryptPushBodyForSelf / encryptFileForSelf do
+ *       ECDH(self, self), which collapses to a static derived key. A single
+ *       device compromise (since all your devices share the same keypair)
+ *       lets the attacker decrypt every past push for which they have the
+ *       ciphertext. The per-message AES key is random, but its wrap key is
+ *       static, so wrapped keys are decryptable forever.
+ *
+ *   True E2E would require a per-device keypair (server stores only public
+ *   keys; senders wrap the message key once per recipient device public
+ *   key). That refactor is on the roadmap; until then, treat push bodies as
+ *   sensitive-but-not-secret.
+ */
+/**
+ * Initialize crypto: sync keys with server, then fallback to local/generate.
+ * Server is source of truth for per-user key pair.
+ * Safe to call concurrently — deduplicates to single init.
+ * Returns the exported public key (Base64 SPKI).
+ */
+export declare const initCrypto: (apiKey?: string, baseUrl?: string) => Promise<string>;
+export declare const getKeyPair: () => CryptoKeyPair | null;
+export declare const getPublicKey: () => string | null;
+/**
+ * Encrypt push body for a recipient.
+ * Returns fields ready to merge into the sendPush payload.
+ */
+export declare const encryptPushBody: (input: {
+    title?: string;
+    body?: string;
+    url?: string;
+}, recipientPublicKeyRaw: string) => Promise<{
+    body: string;
+    encryptedKey: string;
+    senderPublicKey: string;
+    isEncrypted: true;
+}>;
+/**
+ * Encrypt push body for self (all own devices).
+ */
+export declare const encryptPushBodyForSelf: (input: {
+    title?: string;
+    body?: string;
+    url?: string;
+}) => Promise<{
+    body: string;
+    encryptedKey: string;
+    senderPublicKey: string;
+    isEncrypted: true;
+}>;
+/**
+ * Encrypt file content for a recipient.
+ * Returns encrypted buffer + key material for file attachment metadata.
+ */
+export declare const encryptFileForRecipient: (content: string, recipientPublicKeyRaw: string) => Promise<{
+    ciphertext: Buffer;
+    iv: string;
+    encryptedKey: string;
+}>;
+/**
+ * Encrypt file content for self (all own devices).
+ */
+export declare const encryptFileForSelf: (content: string) => Promise<{
+    ciphertext: Buffer;
+    iv: string;
+    encryptedKey: string;
+}>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AA2JH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AAqCF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAeA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CASlE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}