@zeph-to/hook-sdk 1.5.0 → 1.5.1

package/dist/crypto.d.ts

@@ -4,11 +4,12 @@
  * Uses Web Crypto API (globalThis.crypto.subtle) — Node.js 18+.
  */
 /**
- * Initialize crypto: load or generate ECDH key pair.
+ * Initialize crypto: sync keys with server, then fallback to local/generate.
+ * Server is source of truth for per-user key pair.
  * Safe to call concurrently — deduplicates to single init.
  * Returns the exported public key (Base64 SPKI).
  */
-export declare const initCrypto: () => Promise<string>;
+export declare const initCrypto: (apiKey?: string, baseUrl?: string) => Promise<string>;
 export declare const getKeyPair: () => CryptoKeyPair | null;
 export declare const getPublicKey: () => string | null;
 /**

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0JH;;;;GAIG;AACH,eAAO,MAAM,UAAU,QAAO,OAAO,CAAC,MAAM,CAoB3C,CAAC;AAEF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAeA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CASlE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0JH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CA6D5E,CAAC;AA4BF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;GAGG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAeA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,uBAAuB,MAAM,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CASlE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}

package/dist/crypto.js

@@ -90,7 +90,7 @@ const loadStoredKeys = () => {
     }
 };
 const storeKeys = (exported) => {
-    (0, fs_1.mkdirSync)(KEYS_DIR, { recursive: true });
+    (0, fs_1.mkdirSync)(KEYS_DIR, { recursive: true, mode: 0o700 });
     (0, fs_1.writeFileSync)(KEYS_PATH, JSON.stringify(exported, null, 2), { mode: 0o600 });
 };
 // ─── Cached state ───
@@ -99,15 +99,50 @@ let cachedExportedPublicKey = null;
 let cachedOwnPublicKey = null;
 let initPromise = null;
 /**
- * Initialize crypto: load or generate ECDH key pair.
+ * Initialize crypto: sync keys with server, then fallback to local/generate.
+ * Server is source of truth for per-user key pair.
  * Safe to call concurrently — deduplicates to single init.
  * Returns the exported public key (Base64 SPKI).
  */
-const initCrypto = () => {
+const initCrypto = (apiKey, baseUrl) => {
     if (initPromise)
         return initPromise;
     initPromise = (async () => {
+        // Try local cache first
         const stored = loadStoredKeys();
+        // Try server sync if API key available
+        if (apiKey) {
+            const serverKeys = await fetchServerKeys(apiKey, baseUrl);
+            if (serverKeys) {
+                // Server has keys — adopt them (server is source of truth)
+                if (!stored || stored.publicKey !== serverKeys.publicKey) {
+                    storeKeys(serverKeys);
+                }
+                cachedKeyPair = await importKeyPair(serverKeys);
+                cachedExportedPublicKey = serverKeys.publicKey;
+                cachedOwnPublicKey = cachedKeyPair.publicKey;
+                return serverKeys.publicKey;
+            }
+            // Server has no keys
+            if (stored) {
+                // Upload local keys to server
+                await uploadServerKeys(stored, apiKey, baseUrl);
+                cachedKeyPair = await importKeyPair(stored);
+                cachedExportedPublicKey = stored.publicKey;
+                cachedOwnPublicKey = cachedKeyPair.publicKey;
+                return stored.publicKey;
+            }
+            // No keys anywhere — generate + upload
+            const keyPair = await generateKeyPair();
+            const exported = await exportKeyPair(keyPair);
+            storeKeys(exported);
+            await uploadServerKeys(exported, apiKey, baseUrl);
+            cachedKeyPair = keyPair;
+            cachedExportedPublicKey = exported.publicKey;
+            cachedOwnPublicKey = keyPair.publicKey;
+            return exported.publicKey;
+        }
+        // No API key — local-only mode
         if (stored) {
             cachedKeyPair = await importKeyPair(stored);
             cachedExportedPublicKey = stored.publicKey;
@@ -121,10 +156,39 @@ const initCrypto = () => {
         cachedExportedPublicKey = exported.publicKey;
         cachedOwnPublicKey = keyPair.publicKey;
         return exported.publicKey;
-    })();
+    })().catch((err) => {
+        initPromise = null;
+        throw err;
+    });
     return initPromise;
 };
 exports.initCrypto = initCrypto;
+// ─── Server key sync helpers ───
+const fetchServerKeys = async (apiKey, baseUrl) => {
+    try {
+        const url = `${(baseUrl ?? 'https://api.zeph.to/v1').replace(/\/$/, '')}/users/me/keys`;
+        const res = await fetch(url, { headers: { 'X-API-Key': apiKey } });
+        if (!res.ok)
+            return null;
+        const json = await res.json();
+        const keys = json.data?.encryptionKeys;
+        return keys?.publicKey && keys?.privateKey ? keys : null;
+    }
+    catch {
+        return null;
+    }
+};
+const uploadServerKeys = async (keys, apiKey, baseUrl) => {
+    try {
+        const url = `${(baseUrl ?? 'https://api.zeph.to/v1').replace(/\/$/, '')}/users/me/keys`;
+        await fetch(url, {
+            method: 'PUT',
+            headers: { 'X-API-Key': apiKey, 'Content-Type': 'application/json' },
+            body: JSON.stringify(keys),
+        });
+    }
+    catch { /* non-critical */ }
+};
 const getKeyPair = () => cachedKeyPair;
 exports.getKeyPair = getKeyPair;
 const getPublicKey = () => cachedExportedPublicKey;

package/dist/zeph-hook.js

@@ -5,7 +5,7 @@ const errors_js_1 = require("./errors.js");
 const crypto_js_1 = require("./crypto.js");
 const DEFAULT_BASE_URL = 'https://api.zeph.to/v1';
 const DEFAULT_TIMEOUT_MS = 30_000;
-const BODY_FILE_THRESHOLD = 0;
+const BODY_FILE_THRESHOLD = 512;
 const PREVIEW_LENGTH = 200;
 const inferMimeType = (fileName) => {
     const ext = fileName.split('.').pop()?.toLowerCase();
@@ -29,7 +29,7 @@ class ZephHook {
         if (this.cryptoInitialized)
             return !!(0, crypto_js_1.getKeyPair)();
         try {
-            await (0, crypto_js_1.initCrypto)();
+            await (0, crypto_js_1.initCrypto)(this.apiKey, this.baseUrl);
             this.cryptoInitialized = true;
             return !!(0, crypto_js_1.getKeyPair)();
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/hook-sdk",
-  "version": "1.5.0",
+  "version": "1.5.1",
   "description": "Zeph push notification SDK + CLI — zero dependencies",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",