@zeph-to/cli 1.12.0

package/dist/crypto.js

@@ -0,0 +1,291 @@
+"use strict";
+/**
+ * Device-shared encryption for Hook SDK — self-contained ECDH P-256 +
+ * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
+ * dependency). Uses Web Crypto API (globalThis.crypto.subtle) — Node.js 18+.
+ *
+ * Threat model honesty (do not call this "E2E" without a footnote):
+ *
+ *   The Zeph backend persists the per-user private key in plaintext so it
+ *   can be synced down to a fresh device (fetchServerKeys / uploadServerKeys
+ *   below). That means the backend can decrypt any push body — this is NOT
+ *   end-to-end in the standard sense. What it gives you is:
+ *     • Protection against passive network observers
+ *     • Protection against a leaked DB snapshot taken without the key store
+ *     • Cross-device readability (all your devices share one keypair)
+ *   What it does NOT give you:
+ *     • Protection against the Zeph backend itself
+ *     • Forward secrecy — encryptPushBodyForSelf / encryptFileForSelf do
+ *       ECDH(self, self), which collapses to a static derived key. A single
+ *       device compromise (since all your devices share the same keypair)
+ *       lets the attacker decrypt every past push for which they have the
+ *       ciphertext. The per-message AES key is random, but its wrap key is
+ *       static, so wrapped keys are decryptable forever.
+ *
+ *   True E2E would require a per-device keypair (server stores only public
+ *   keys; senders wrap the message key once per recipient device public
+ *   key). That refactor is on the roadmap; until then, treat push bodies as
+ *   sensitive-but-not-secret.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptFileForSelf = exports.encryptFileForRecipient = exports.encryptPushBodyForSelf = exports.encryptPushBody = exports.getPublicKey = exports.getKeyPair = exports.initCrypto = void 0;
+/// <reference lib="dom" />
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+// ─── Base64 helpers ───
+const toBase64 = (buffer) => {
+    const bytes = new Uint8Array(buffer);
+    let binary = '';
+    for (let i = 0; i < bytes.length; i++) {
+        binary += String.fromCharCode(bytes[i]);
+    }
+    return btoa(binary);
+};
+const fromBase64 = (base64) => {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes.buffer;
+};
+// ─── ECDH key management ───
+const ECDH_PARAMS = { name: 'ECDH', namedCurve: 'P-256' };
+const generateKeyPair = async () => crypto.subtle.generateKey(ECDH_PARAMS, true, ['deriveKey', 'deriveBits']);
+const exportKeyPair = async (keyPair) => {
+    const [publicRaw, privateRaw] = await Promise.all([
+        crypto.subtle.exportKey('spki', keyPair.publicKey),
+        crypto.subtle.exportKey('pkcs8', keyPair.privateKey),
+    ]);
+    return { publicKey: toBase64(publicRaw), privateKey: toBase64(privateRaw) };
+};
+const importPublicKey = async (base64) => crypto.subtle.importKey('spki', fromBase64(base64), ECDH_PARAMS, true, []);
+const importPrivateKey = async (base64) => crypto.subtle.importKey('pkcs8', fromBase64(base64), ECDH_PARAMS, true, ['deriveKey', 'deriveBits']);
+const importKeyPair = async (exported) => {
+    const [publicKey, privateKey] = await Promise.all([
+        importPublicKey(exported.publicKey),
+        importPrivateKey(exported.privateKey),
+    ]);
+    return { publicKey, privateKey };
+};
+const deriveAesKey = async (privateKey, publicKey) => crypto.subtle.deriveKey({ name: 'ECDH', public: publicKey }, privateKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
+const encrypt = async (plaintext, senderPrivateKey, recipientPublicKey) => {
+    const messageKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, messageKey, new TextEncoder().encode(plaintext));
+    const sharedKey = await deriveAesKey(senderPrivateKey, recipientPublicKey);
+    const rawMessageKey = await crypto.subtle.exportKey('raw', messageKey);
+    const keyIv = crypto.getRandomValues(new Uint8Array(12));
+    const encryptedKey = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawMessageKey);
+    return {
+        ciphertext: toBase64(ciphertext),
+        iv: toBase64(iv.buffer),
+        encryptedKey: toBase64(encryptedKey),
+        keyIv: toBase64(keyIv.buffer),
+    };
+};
+// ─── File encryption ───
+const encryptFileContent = async (content, senderPrivateKey, recipientPublicKey) => {
+    const buffer = new TextEncoder().encode(content).buffer;
+    const fileKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, fileKey, buffer);
+    const sharedKey = await deriveAesKey(senderPrivateKey, recipientPublicKey);
+    const rawFileKey = await crypto.subtle.exportKey('raw', fileKey);
+    const keyIv = crypto.getRandomValues(new Uint8Array(12));
+    const encryptedKey = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawFileKey);
+    return {
+        ciphertext: Buffer.from(ciphertext),
+        iv: toBase64(iv.buffer),
+        encryptedKey: toBase64(encryptedKey),
+        keyIv: toBase64(keyIv.buffer),
+    };
+};
+// ─── Key persistence (~/.config/zeph/keys.json) ───
+const KEYS_DIR = (0, path_1.join)((0, os_1.homedir)(), '.config', 'zeph');
+const KEYS_PATH = (0, path_1.join)(KEYS_DIR, 'keys.json');
+const loadStoredKeys = () => {
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(KEYS_PATH, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+};
+const storeKeys = (exported) => {
+    (0, fs_1.mkdirSync)(KEYS_DIR, { recursive: true, mode: 0o700 });
+    (0, fs_1.writeFileSync)(KEYS_PATH, JSON.stringify(exported, null, 2), { mode: 0o600 });
+};
+// ─── Cached state ───
+let cachedKeyPair = null;
+let cachedExportedPublicKey = null;
+let cachedOwnPublicKey = null;
+let initPromise = null;
+/**
+ * Initialize crypto: sync keys with server, then fallback to local/generate.
+ * Server is source of truth for per-user key pair.
+ * Safe to call concurrently — deduplicates to single init.
+ * Returns the exported public key (Base64 SPKI).
+ */
+const initCrypto = (apiKey, baseUrl) => {
+    if (initPromise)
+        return initPromise;
+    initPromise = (async () => {
+        // Try local cache first
+        const stored = loadStoredKeys();
+        // Try server sync if API key available
+        if (apiKey) {
+            const serverResult = await fetchServerKeys(apiKey, baseUrl);
+            // Server says encryption disabled — skip crypto init
+            if (serverResult && !serverResult.encryptionEnabled) {
+                cachedKeyPair = null;
+                cachedExportedPublicKey = null;
+                cachedOwnPublicKey = null;
+                return '';
+            }
+            if (serverResult?.keys) {
+                // Server has keys — adopt them (server is source of truth)
+                if (!stored || stored.publicKey !== serverResult.keys.publicKey) {
+                    storeKeys(serverResult.keys);
+                }
+                cachedKeyPair = await importKeyPair(serverResult.keys);
+                cachedExportedPublicKey = serverResult.keys.publicKey;
+                cachedOwnPublicKey = cachedKeyPair.publicKey;
+                return serverResult.keys.publicKey;
+            }
+            // Server has no keys
+            if (stored) {
+                // Upload local keys to server
+                await uploadServerKeys(stored, apiKey, baseUrl);
+                cachedKeyPair = await importKeyPair(stored);
+                cachedExportedPublicKey = stored.publicKey;
+                cachedOwnPublicKey = cachedKeyPair.publicKey;
+                return stored.publicKey;
+            }
+            // No keys anywhere — generate + upload
+            const keyPair = await generateKeyPair();
+            const exported = await exportKeyPair(keyPair);
+            storeKeys(exported);
+            await uploadServerKeys(exported, apiKey, baseUrl);
+            cachedKeyPair = keyPair;
+            cachedExportedPublicKey = exported.publicKey;
+            cachedOwnPublicKey = keyPair.publicKey;
+            return exported.publicKey;
+        }
+        // No API key — local-only mode
+        if (stored) {
+            cachedKeyPair = await importKeyPair(stored);
+            cachedExportedPublicKey = stored.publicKey;
+            cachedOwnPublicKey = cachedKeyPair.publicKey;
+            return stored.publicKey;
+        }
+        const keyPair = await generateKeyPair();
+        const exported = await exportKeyPair(keyPair);
+        storeKeys(exported);
+        cachedKeyPair = keyPair;
+        cachedExportedPublicKey = exported.publicKey;
+        cachedOwnPublicKey = keyPair.publicKey;
+        return exported.publicKey;
+    })().catch((err) => {
+        initPromise = null;
+        throw err;
+    });
+    return initPromise;
+};
+exports.initCrypto = initCrypto;
+const fetchServerKeys = async (apiKey, baseUrl) => {
+    try {
+        const url = `${(baseUrl ?? 'https://api.zeph.to/v1').replace(/\/$/, '')}/users/me/keys`;
+        const res = await fetch(url, { headers: { 'X-API-Key': apiKey } });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        const keys = json.data?.encryptionKeys;
+        const encryptionEnabled = json.data?.encryptionEnabled ?? (keys ? true : false);
+        return {
+            keys: keys?.publicKey && keys?.privateKey ? keys : null,
+            encryptionEnabled,
+        };
+    }
+    catch {
+        return null;
+    }
+};
+const uploadServerKeys = async (keys, apiKey, baseUrl) => {
+    try {
+        const url = `${(baseUrl ?? 'https://api.zeph.to/v1').replace(/\/$/, '')}/users/me/keys`;
+        await fetch(url, {
+            method: 'PUT',
+            headers: { 'X-API-Key': apiKey, 'Content-Type': 'application/json' },
+            body: JSON.stringify(keys),
+        });
+    }
+    catch { /* non-critical */ }
+};
+const getKeyPair = () => cachedKeyPair;
+exports.getKeyPair = getKeyPair;
+const getPublicKey = () => cachedExportedPublicKey;
+exports.getPublicKey = getPublicKey;
+/**
+ * Encrypt push body for a recipient.
+ * Returns fields ready to merge into the sendPush payload.
+ */
+const encryptPushBody = async (input, recipientPublicKeyRaw) => {
+    if (!cachedKeyPair || !cachedExportedPublicKey)
+        throw new Error('Crypto not initialized');
+    const recipientKey = await importPublicKey(recipientPublicKeyRaw);
+    const payload = await encrypt(JSON.stringify({ title: input.title, body: input.body, url: input.url }), cachedKeyPair.privateKey, recipientKey);
+    return {
+        body: JSON.stringify({ ciphertext: payload.ciphertext, iv: payload.iv }),
+        encryptedKey: JSON.stringify({ encryptedKey: payload.encryptedKey, keyIv: payload.keyIv }),
+        senderPublicKey: cachedExportedPublicKey,
+        isEncrypted: true,
+    };
+};
+exports.encryptPushBody = encryptPushBody;
+/**
+ * Encrypt push body for self (all own devices).
+ */
+const encryptPushBodyForSelf = async (input) => {
+    if (!cachedKeyPair || !cachedExportedPublicKey || !cachedOwnPublicKey)
+        throw new Error('Crypto not initialized');
+    const payload = await encrypt(JSON.stringify({ title: input.title, body: input.body, url: input.url }), cachedKeyPair.privateKey, cachedOwnPublicKey);
+    return {
+        body: JSON.stringify({ ciphertext: payload.ciphertext, iv: payload.iv }),
+        encryptedKey: JSON.stringify({ encryptedKey: payload.encryptedKey, keyIv: payload.keyIv }),
+        senderPublicKey: cachedExportedPublicKey,
+        isEncrypted: true,
+    };
+};
+exports.encryptPushBodyForSelf = encryptPushBodyForSelf;
+/**
+ * Encrypt file content for a recipient.
+ * Returns encrypted buffer + key material for file attachment metadata.
+ */
+const encryptFileForRecipient = async (content, recipientPublicKeyRaw) => {
+    if (!cachedKeyPair)
+        throw new Error('Crypto not initialized');
+    const recipientKey = await importPublicKey(recipientPublicKeyRaw);
+    const result = await encryptFileContent(content, cachedKeyPair.privateKey, recipientKey);
+    return {
+        ciphertext: result.ciphertext,
+        iv: result.iv,
+        encryptedKey: JSON.stringify({ encryptedKey: result.encryptedKey, keyIv: result.keyIv }),
+    };
+};
+exports.encryptFileForRecipient = encryptFileForRecipient;
+/**
+ * Encrypt file content for self (all own devices).
+ */
+const encryptFileForSelf = async (content) => {
+    if (!cachedKeyPair || !cachedOwnPublicKey)
+        throw new Error('Crypto not initialized');
+    const result = await encryptFileContent(content, cachedKeyPair.privateKey, cachedOwnPublicKey);
+    return {
+        ciphertext: result.ciphertext,
+        iv: result.iv,
+        encryptedKey: JSON.stringify({ encryptedKey: result.encryptedKey, keyIv: result.keyIv }),
+    };
+};
+exports.encryptFileForSelf = encryptFileForSelf;

package/dist/errors.d.ts

@@ -0,0 +1,12 @@
+export declare class ZephError extends Error {
+    code: string;
+    status: number;
+    constructor(message: string, code: string, status: number);
+}
+export declare class AuthenticationError extends ZephError {
+    constructor(message?: string);
+}
+export declare class QuotaExceededError extends ZephError {
+    constructor(message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,SAAU,SAAQ,KAAK;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;gBAEH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAM1D;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,SAA0B;CAI9C;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,SAAmB;CAIvC"}

package/dist/errors.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QuotaExceededError = exports.AuthenticationError = exports.ZephError = void 0;
+class ZephError extends Error {
+    code;
+    status;
+    constructor(message, code, status) {
+        super(message);
+        this.name = 'ZephError';
+        this.code = code;
+        this.status = status;
+    }
+}
+exports.ZephError = ZephError;
+class AuthenticationError extends ZephError {
+    constructor(message = 'Authentication failed') {
+        super(message, 'AUTHENTICATION_ERROR', 401);
+        this.name = 'AuthenticationError';
+    }
+}
+exports.AuthenticationError = AuthenticationError;
+class QuotaExceededError extends ZephError {
+    constructor(message = 'Quota exceeded') {
+        super(message, 'QUOTA_EXCEEDED', 403);
+        this.name = 'QuotaExceededError';
+    }
+}
+exports.QuotaExceededError = QuotaExceededError;

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { ZephHook } from './zeph-hook.js';
+export { ZephError, AuthenticationError, QuotaExceededError } from './errors.js';
+export type { ZephOptions, NotifyPayload, NotifyResult, ListParams, ListResult, DismissOneResult, DismissAllResult, PushItem } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjF,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QuotaExceededError = exports.AuthenticationError = exports.ZephError = exports.ZephHook = void 0;
+var zeph_hook_js_1 = require("./zeph-hook.js");
+Object.defineProperty(exports, "ZephHook", { enumerable: true, get: function () { return zeph_hook_js_1.ZephHook; } });
+var errors_js_1 = require("./errors.js");
+Object.defineProperty(exports, "ZephError", { enumerable: true, get: function () { return errors_js_1.ZephError; } });
+Object.defineProperty(exports, "AuthenticationError", { enumerable: true, get: function () { return errors_js_1.AuthenticationError; } });
+Object.defineProperty(exports, "QuotaExceededError", { enumerable: true, get: function () { return errors_js_1.QuotaExceededError; } });

package/dist/installer.d.ts

@@ -0,0 +1,14 @@
+import type { Agent } from './agents.js';
+/**
+ * True when install should auto-open browser login (ADR 0002): interactive
+ * context with no existing credential (--key/env/config all absent).
+ */
+export declare const shouldTriggerLogin: (nonInteractive: boolean, currentKey: string | undefined) => boolean;
+/**
+ * Resolve agents from a non-interactive `--only cursor,gemini` flag.
+ * Matches on agent id; unknown ids are silently dropped. Exported for
+ * unit testing.
+ */
+export declare const filterAgentsByIds: (detected: Agent[], only: string) => Agent[];
+export declare const handleInstall: (args: Record<string, string | boolean>) => Promise<number>;
+//# sourceMappingURL=installer.d.ts.map

package/dist/installer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installer.d.ts","sourceRoot":"","sources":["../src/installer.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AA2BzC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,gBAAgB,OAAO,EAAE,YAAY,MAAM,GAAG,SAAS,KAAG,OAC7D,CAAC;AA+QjC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,KAAK,EAAE,EAAE,MAAM,MAAM,KAAG,KAAK,EAKxE,CAAC;AA4FF,eAAO,MAAM,aAAa,GAAU,MAAM,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAG,OAAO,CAAC,MAAM,CAkG1F,CAAC"}