@zeph-to/mcp-server 1.15.1 → 1.15.2

package/dist/crypto.d.ts

@@ -54,6 +54,16 @@
 export declare const initCrypto: (apiKey?: string, baseUrl?: string) => Promise<string>;
 export declare const getKeyPair: () => CryptoKeyPair | null;
 export declare const getPublicKey: () => string | null;
+/**
+ * Drop the cached keys so every later send goes out as plaintext.
+ *
+ * Used when the server refuses an encrypted send with `PRO_REQUIRED`
+ * (ADR-0008): E2E is Pro-only, and this server initialized crypto once at
+ * startup — a downgrade after that is only visible at send time. Same end
+ * state as the `ZEPH_DISABLE_ENCRYPTION` opt-out. Keys on disk are untouched;
+ * a restart after an upgrade re-adopts them.
+ */
+export declare const disableCrypto: () => void;
 /**
  * Encrypt push body for self (all own devices).
  */

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA0JH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AAmCF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA0JH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AAmCF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,KACd,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}

package/dist/crypto.js

@@ -29,7 +29,7 @@
  *   sensitive-but-not-secret.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.encryptFileForSelf = exports.encryptPushBodyForSelf = exports.getPublicKey = exports.getKeyPair = exports.initCrypto = void 0;
+exports.encryptFileForSelf = exports.encryptPushBodyForSelf = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.initCrypto = void 0;
 /// <reference lib="dom" />
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -241,6 +241,21 @@ const getKeyPair = () => cachedKeyPair;
 exports.getKeyPair = getKeyPair;
 const getPublicKey = () => cachedExportedPublicKey;
 exports.getPublicKey = getPublicKey;
+/**
+ * Drop the cached keys so every later send goes out as plaintext.
+ *
+ * Used when the server refuses an encrypted send with `PRO_REQUIRED`
+ * (ADR-0008): E2E is Pro-only, and this server initialized crypto once at
+ * startup — a downgrade after that is only visible at send time. Same end
+ * state as the `ZEPH_DISABLE_ENCRYPTION` opt-out. Keys on disk are untouched;
+ * a restart after an upgrade re-adopts them.
+ */
+const disableCrypto = () => {
+    cachedKeyPair = null;
+    cachedExportedPublicKey = null;
+    cachedOwnPublicKey = null;
+};
+exports.disableCrypto = disableCrypto;
 /**
  * Encrypt push body for self (all own devices).
  */

package/dist/e2e-fallback.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Run a send, and repeat it unencrypted if the server says E2E needs Pro.
+ *
+ * E2E is Pro-only (ADR-0008) and `POST /pushes/send` rejects `isEncrypted`
+ * from a free account with 403 `PRO_REQUIRED`. Crypto initializes once at
+ * server startup, so a downgrade after that is only visible at send time — and
+ * a notification must not be lost over a billing state change. The keys are
+ * dropped before the retry, so later sends skip encryption outright and the
+ * retry rebuilds the whole payload (a file re-uploads as plaintext instead of
+ * leaving an undecryptable blob in S3).
+ *
+ * `send` receives whether it may encrypt, and must be safe to run twice — the
+ * encrypted first upload is left orphaned in S3, which is the accepted cost of
+ * not shipping an unreadable attachment. The retry is not itself retried: a
+ * second `PRO_REQUIRED` propagates.
+ */
+export declare const withPlaintextFallback: <T>(send: (canEncrypt: boolean) => Promise<T>) => Promise<T>;
+//# sourceMappingURL=e2e-fallback.d.ts.map

package/dist/e2e-fallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-fallback.d.ts","sourceRoot":"","sources":["../src/e2e-fallback.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,GAAU,CAAC,EAC3C,MAAM,CAAC,UAAU,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KACxC,OAAO,CAAC,CAAC,CAYX,CAAC"}

package/dist/e2e-fallback.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withPlaintextFallback = void 0;
+const api_client_js_1 = require("./api-client.js");
+const crypto_js_1 = require("./crypto.js");
+/**
+ * Run a send, and repeat it unencrypted if the server says E2E needs Pro.
+ *
+ * E2E is Pro-only (ADR-0008) and `POST /pushes/send` rejects `isEncrypted`
+ * from a free account with 403 `PRO_REQUIRED`. Crypto initializes once at
+ * server startup, so a downgrade after that is only visible at send time — and
+ * a notification must not be lost over a billing state change. The keys are
+ * dropped before the retry, so later sends skip encryption outright and the
+ * retry rebuilds the whole payload (a file re-uploads as plaintext instead of
+ * leaving an undecryptable blob in S3).
+ *
+ * `send` receives whether it may encrypt, and must be safe to run twice — the
+ * encrypted first upload is left orphaned in S3, which is the accepted cost of
+ * not shipping an unreadable attachment. The retry is not itself retried: a
+ * second `PRO_REQUIRED` propagates.
+ */
+const withPlaintextFallback = async (send) => {
+    const canEncrypt = !!(0, crypto_js_1.getKeyPair)() && !!(0, crypto_js_1.getPublicKey)();
+    if (!canEncrypt)
+        return send(false);
+    try {
+        return await send(true);
+    }
+    catch (err) {
+        if (!(err instanceof api_client_js_1.ApiError) || err.code !== 'PRO_REQUIRED')
+            throw err;
+        (0, crypto_js_1.disableCrypto)();
+        console.error('[Crypto] End-to-end encryption requires Zeph Pro — resending as plaintext.');
+        return send(false);
+    }
+};
+exports.withPlaintextFallback = withPlaintextFallback;

package/dist/tools/file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/tools/file.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAKrE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SA2EjG,CAAC"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/tools/file.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAMrE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAiFjG,CAAC"}

package/dist/tools/file.js

@@ -5,6 +5,7 @@ const zod_1 = require("zod");
 const config_js_1 = require("../config.js");
 const error_format_js_1 = require("../error-format.js");
 const crypto_js_1 = require("../crypto.js");
+const e2e_fallback_js_1 = require("../e2e-fallback.js");
 const mime_js_1 = require("../mime.js");
 const registerFileTool = (server, client, config) => {
     server.registerTool('zeph_file', {
@@ -21,8 +22,10 @@ const registerFileTool = (server, client, config) => {
             targetDeviceId: zod_1.z.string().optional().describe('Target device ID. Omit to use configured default or send to all devices.'),
         },
     }, async ({ fileName, content, title, targetDeviceId }) => {
-        try {
-            const canEncrypt = !!(0, crypto_js_1.getKeyPair)() && !!(0, crypto_js_1.getPublicKey)();
+        // Runs a second time as plaintext if the server refuses E2E (Pro-only,
+        // ADR-0008). The retry re-uploads the file unencrypted, so the whole
+        // upload-then-send sequence has to sit inside this closure.
+        const send = async (canEncrypt) => {
             let fileType = (0, mime_js_1.inferMimeType)(fileName);
             const originalSize = new TextEncoder().encode(content).byteLength;
             // Step 1: Optionally encrypt file content
@@ -67,6 +70,9 @@ const registerFileTool = (server, client, config) => {
             }
             const result = await client.sendPush(pushPayload);
             return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, fileKey: upload.data.fileKey, fileSize: originalSize, encrypted: canEncrypt });
+        };
+        try {
+            return await (0, e2e_fallback_js_1.withPlaintextFallback)(send);
         }
         catch (err) {
             return (0, error_format_js_1.formatToolError)(err);

package/dist/tools/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/tools/notify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AASrE,eAAO,MAAM,kBAAkB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SA2HnG,CAAC"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/tools/notify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAUrE,eAAO,MAAM,kBAAkB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAgInG,CAAC"}

package/dist/tools/notify.js

@@ -5,6 +5,7 @@ const zod_1 = require("zod");
 const error_format_js_1 = require("../error-format.js");
 const config_js_1 = require("../config.js");
 const crypto_js_1 = require("../crypto.js");
+const e2e_fallback_js_1 = require("../e2e-fallback.js");
 const mime_js_1 = require("../mime.js");
 const sanitize_js_1 = require("../sanitize.js");
 // The device feed shows a short preview of the body. Anything longer gets
@@ -29,14 +30,15 @@ const registerNotifyTool = (server, client, config) => {
             targetDeviceId: zod_1.z.string().optional().describe('Target device ID. Omit to use configured default or send to all devices.'),
         },
     }, async ({ title, body, url, priority, targetDeviceId }) => {
-        try {
+        // Runs a second time as plaintext if the server refuses E2E (Pro-only,
+        // ADR-0008) — hence everything after the encryption decision lives here.
+        const send = async (canEncrypt) => {
             const deviceId = targetDeviceId ?? config.deviceId;
             const pushTitle = (0, config_js_1.formatPushTitle)(config.projectName, title);
             // Strip any tool-call markup that leaked into the body argument.
             const cleanBody = (0, sanitize_js_1.sanitizeText)(body);
             // Attach a file whenever the body would be clipped in the feed preview.
             const isLongBody = !!cleanBody && cleanBody.length > PREVIEW_LENGTH;
-            const canEncrypt = !!(0, crypto_js_1.getKeyPair)() && !!(0, crypto_js_1.getPublicKey)();
             if (isLongBody && cleanBody) {
                 const fileName = 'response.md';
                 const fileType = (0, mime_js_1.inferMimeType)(fileName);
@@ -115,6 +117,9 @@ const registerNotifyTool = (server, client, config) => {
             }
             const result = await client.sendPush(pushPayload);
             return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, encrypted: pushEncrypted });
+        };
+        try {
+            return await (0, e2e_fallback_js_1.withPlaintextFallback)(send);
         }
         catch (err) {
             return (0, error_format_js_1.formatToolError)(err);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/mcp-server",
-  "version": "1.15.1",
+  "version": "1.15.2",
   "description": "Zeph MCP server — AI agent notifications, prompts, and input via MCP protocol",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",