@zeph-to/mcp-server 1.16.0 → 2.0.0

package/README.md

@@ -329,9 +329,16 @@ Create an API key with the **MCP** preset in Settings > API Keys for the correct
 
 ## Encryption
 
-Push bodies are encrypted with AES-256-GCM. The wrapping key is derived via ECDH P-256 and synced across your own devices on first server startup so every device can read the same push. Toggle encryption in the Zeph app (Settings → Encryption); when disabled, the server sends plaintext. No configuration needed.
+Push bodies and file attachments are encrypted with AES-256-GCM. This server holds its own ECDH P-256 keypair, generated on first use and stored in `~/.config/zeph/device-keys.json` — the private half never leaves the machine. Each push is encrypted once, and its AES key is wrapped separately for every device on your account using ECDH against that device's public key.
 
-**Threat model honesty:** keys are persisted on the Zeph backend to enable cross-device sync, so this is *device-shared* encryption — not true end-to-end. It protects push contents from passive network observers and from a leaked database snapshot taken without the key store, but it does **not** protect against the Zeph backend itself (it has the keys it serves to your devices). A true E2E mode (per-device keypairs, server stores only public keys, no key escrow) is on the roadmap.
+Toggle encryption in the Zeph app (Settings → Encryption); when it is off, pushes go out as plaintext. No configuration needed. The opt-in is read once at startup, so **turning it on while this server is running takes effect only after a restart.**
+
+**Threat model:** against a passive backend — a leaked snapshot, an operator reading the table — the stored ciphertext and wrapped keys are useless, so push contents stay private. Three limits worth knowing:
+- **No protection from an active malicious operator.** Recipient public keys come from `GET /devices` on that same server, unsigned and unpinned. A backend that injects a device record carrying its own key gets the message key wrapped for it, and reads everything. Closing this needs out-of-band device verification (ADR-0007 Phase 4, not built).
+- **No forward secrecy.** The ECDH secret for a given sender/device pair is static, so compromising either private key opens every past push wrapped for that pair.
+- **`senderPublicKey` is unsigned**, so a swapped one makes a push undecryptable — that direction fails closed rather than leaking.
+
+A device that has not registered a per-device public key cannot be sent to; it is skipped, and if no device qualifies the push goes out in the clear rather than arriving as something nothing can open.
 
 ## License
 

package/dist/api-client.d.ts

@@ -20,8 +20,8 @@ export declare class ZephApiClient {
         sessionId?: string;
         files?: AttachedFile[];
         isEncrypted?: boolean;
-        encryptedKey?: string;
         senderPublicKey?: string;
+        deviceKeyMap?: Record<string, string>;
     }): Promise<PushResponse>;
     triggerHook(hookId: string, params: {
         title: string;

package/dist/api-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAEV,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,qBAAa,QAAS,SAAQ,KAAK;aAGf,IAAI,EAAE,MAAM;aACZ,MAAM,EAAE,MAAM;gBAF9B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAKjC;AAKD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,MAAM,EAAE,eAAe;IAK7B,QAAQ,CAAC,MAAM,EAAE;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;QACvB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GAAG,OAAO,CAAC,YAAY,CAAC;IAInB,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,QAAQ,CAAC,EAAE,SAAS,GAAG,aAAa,GAAG,OAAO,GAAG,OAAO,CAAC;QACzD,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gEAAgE;QAChE,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GACA,OAAO,CAAC,mBAAmB,CAAC;IAIzB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIzE,WAAW,IAAI,OAAO,CAAC,eAAe,CAAC;IAI7C;2DACuD;IACjD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAQtG,UAAU,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQjF,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIrD,gBAAgB,IAAI,OAAO,CAAC,eAAe,CAAC;IAI5C,YAAY,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAIzC,aAAa,CAAC,MAAM,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAI5B,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAc7E,OAAO;CA0CtB"}
+{"version":3,"file":"api-client.d.ts","sourceRoot":"","sources":["../src/api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,KAAK,EAEV,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,0BAA0B,EAC1B,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACb,MAAM,YAAY,CAAC;AAEpB,qBAAa,QAAS,SAAQ,KAAK;aAGf,IAAI,EAAE,MAAM;aACZ,MAAM,EAAE,MAAM;gBAF9B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAKjC;AAKD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,MAAM,EAAE,eAAe;IAK7B,QAAQ,CAAC,MAAM,EAAE;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;QACvB,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACvC,GAAG,OAAO,CAAC,YAAY,CAAC;IAInB,WAAW,CACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE;QACN,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,QAAQ,CAAC,EAAE,SAAS,GAAG,aAAa,GAAG,OAAO,GAAG,OAAO,CAAC;QACzD,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gEAAgE;QAChE,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GACA,OAAO,CAAC,mBAAmB,CAAC;IAIzB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIzE,WAAW,IAAI,OAAO,CAAC,eAAe,CAAC;IAI7C;2DACuD;IACjD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAQtG,UAAU,CAAC,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAQjF,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAIrD,gBAAgB,IAAI,OAAO,CAAC,eAAe,CAAC;IAI5C,YAAY,IAAI,OAAO,CAAC,gBAAgB,CAAC;IAIzC,aAAa,CAAC,MAAM,EAAE;QAC1B,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAI5B,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAc7E,OAAO;CA0CtB"}

package/dist/crypto.d.ts

@@ -1,57 +1,76 @@
 /**
- * Device-shared encryption for MCP server — self-contained ECDH P-256 +
+ * Per-device encryption for the MCP server — self-contained ECDH P-256 +
  * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
  * dependency). Uses Web Crypto API via node:crypto webcrypto — Node.js 18+
  * (the `crypto` global only exists unflagged from Node 19, so we import it).
  *
- * Threat model honesty (do not call this "E2E" without a footnote):
+ * How it works (ADR-0007):
  *
- *   The Zeph backend persists the per-user private key in plaintext so it
- *   can be synced down to a fresh device (fetchServerKeys / uploadServerKeys
- *   below). That means the backend can decrypt any push body — this is NOT
- *   end-to-end in the standard sense. What it gives you is:
- *     • Protection against passive network observers
- *     • Protection against a leaked DB snapshot taken without the key store
- *     • Cross-device readability (all your devices share one keypair)
- *   What it does NOT give you:
- *     • Protection against the Zeph backend itself
- *     • Forward secrecy — encryptPushBodyForSelf / encryptFileForSelf do
- *       ECDH(self, self), which collapses to a static derived key. A single
- *       device compromise (since all your devices share the same keypair)
- *       lets the attacker decrypt every past push for which they have the
- *       ciphertext. The per-message AES key is random, but its wrap key is
- *       static, so wrapped keys are decryptable forever.
+ *   This process holds its own ECDH keypair. The private half is generated
+ *   here, written to ~/.config/zeph/device-keys.json, and never leaves the
+ *   host — the server only ever sees public keys. A push is encrypted once
+ *   with a random AES key, and that key is wrapped separately for each of the
+ *   user's registered devices using ECDH(this host, that device).
  *
- *   True E2E would require a per-device keypair (server stores only public
- *   keys; senders wrap the message key once per recipient device public
- *   key). That refactor is on the roadmap; until then, treat push bodies as
- *   sensitive-but-not-secret.
+ *   That makes it end-to-end in the standard sense: the backend stores
+ *   ciphertext plus wrapped keys it cannot unwrap.
+ *
+ * What it still does not give you:
+ *   • Forward secrecy — the ECDH secret for a given (sender, device) pair is
+ *     static, so a compromise of either private key retroactively opens every
+ *     push wrapped for that pair. The per-message AES key is random; its wrap
+ *     key is not.
+ *   • Authenticity beyond the key pairing — nothing signs `senderPublicKey`,
+ *     so a server that swapped it could make a push undecryptable, though not
+ *     readable.
+ *
+ * Superseded scheme: a single account-wide keypair whose private half the
+ * backend escrowed so it could sync to new devices. Key escrow was removed
+ * server-side (zeph@8a6d21b), which left this client waiting for a private key
+ * the API stopped returning — encryption was silently off for months. Nothing
+ * here asks for that key any more.
  */
+/** One target device, as returned by `GET /devices`. */
+export interface DeviceRecipient {
+    deviceId: string;
+    /** Base64 SPKI of that device's per-device public key. */
+    publicKey: string;
+}
+/** deviceId → JSON `{ encryptedKey, keyIv }`, the wire shape the clients parse. */
+export type DeviceKeyMap = Record<string, string>;
 /**
  * Initialize crypto.
  *
- * The MCP server is a CONSUMER of encryption keys, not a generator. Keys
- * are created in the Zeph app where the user explicitly opts in (Settings
- * → Encryption). This function only imports keys that the server already
- * has, and only when the server confirms encryption is enabled.
+ * Encryption turns on only when the account has explicitly opted in —
+ * `encryptionEnabled` from `GET /users/me/keys` is the single authoritative
+ * signal (ADR-0008), set from the Zeph app. Server unreachable, flag off, or
+ * the hard opt-out below all leave the cache empty and every send plaintext.
  *
- * Any other state — server says disabled, server has no keys, server is
- * unreachable — leaves encryption OFF (cache empty, no fallback). A
- * previous version generated and uploaded a fresh keypair on the "no keys
- * anywhere" path; combined with a transient fetch failure, that silently
- * turned encryption on without user consent and locked the account into
- * an "encryption enabled" state on the server.
+ * When it is on, this host generates its own keypair on first use and keeps
+ * it. Unlike the superseded scheme this asks the server for nothing but the
+ * flag: the private key is created here and stays here.
  *
  * Opt-out: `ZEPH_DISABLE_ENCRYPTION=1` forces crypto off regardless of
- * server state — useful while cleaning up legacy state or for users who
- * never want encryption.
+ * server state.
  *
- * Safe to call concurrently — deduplicates to single init.
- * Returns the exported public key when encryption is active, '' otherwise.
+ * Safe to call concurrently — deduplicates to a single init.
+ * Returns this host's public key when encryption is active, '' otherwise.
  *
  * NOTE: when `apiKey` is provided, `baseUrl` is required.
  */
 export declare const initCrypto: (apiKey?: string, baseUrl?: string) => Promise<string>;
+/**
+ * Keep only devices this host can actually encrypt for.
+ *
+ * A device without a public key has never run a build that registers one, and
+ * a device still advertising the account-wide key has not migrated to
+ * per-device E2E — wrapping for either produces a push it cannot open, which
+ * is worse than sending plaintext it can read.
+ */
+export declare const selectRecipients: (devices: {
+    deviceId: string;
+    publicKey?: string;
+}[]) => DeviceRecipient[];
 export declare const getKeyPair: () => CryptoKeyPair | null;
 export declare const getPublicKey: () => string | null;
 /**
@@ -65,24 +84,28 @@ export declare const getPublicKey: () => string | null;
  */
 export declare const disableCrypto: () => void;
 /**
- * Encrypt push body for self (all own devices).
+ * Encrypt a push body for the given recipient devices.
+ *
+ * Returns the wire fields the API expects: `body` carries the ciphertext and
+ * IV, `deviceKeyMap` the per-device wrapped keys, `senderPublicKey` the half
+ * recipients need to derive the same secret back.
  */
-export declare const encryptPushBodyForSelf: (input: {
+export declare const encryptPushBodyForDevices: (input: {
     title?: string;
     body?: string;
     url?: string;
-}) => Promise<{
+}, recipients: DeviceRecipient[]) => Promise<{
     body: string;
-    encryptedKey: string;
+    deviceKeyMap: DeviceKeyMap;
     senderPublicKey: string;
     isEncrypted: true;
 }>;
 /**
- * Encrypt file content for self (all own devices).
+ * Encrypt file content for the given recipient devices.
  */
-export declare const encryptFileForSelf: (content: string | Buffer) => Promise<{
+export declare const encryptFileForDevices: (content: string | Buffer, recipients: DeviceRecipient[]) => Promise<{
     ciphertext: Buffer;
     iv: string;
-    encryptedKey: string;
+    deviceKeyMap: DeviceKeyMap;
 }>;
 //# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAiKH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAsE5E,CAAC;AAmCF,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAO,IAIhC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACrD,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAaA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,SAAS,MAAM,GAAG,MAAM,KACvB,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAQlE,CAAC"}
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAuEH,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AA6ElD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,EAAE,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CA2D5E,CAAC;AAuCF;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAC3B,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,KAClD,eAAe,EAG8C,CAAC;AAEjE,eAAO,MAAM,UAAU,QAAO,aAAa,GAAG,IAAqB,CAAC;AACpE,eAAO,MAAM,YAAY,QAAO,MAAM,GAAG,IAA+B,CAAC;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAO,IAGhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACpC,OAAO;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EACtD,YAAY,eAAe,EAAE,KAC5B,OAAO,CAAC;IACT,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,YAAY,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,IAAI,CAAC;CACnB,CAkBA,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAChC,SAAS,MAAM,GAAG,MAAM,EACxB,YAAY,eAAe,EAAE,KAC5B,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,YAAY,CAAA;CAAE,CAsBxE,CAAC"}

package/dist/crypto.js

@@ -1,35 +1,38 @@
 "use strict";
 /**
- * Device-shared encryption for MCP server — self-contained ECDH P-256 +
+ * Per-device encryption for the MCP server — self-contained ECDH P-256 +
  * AES-256-GCM. Mirrors @zeph/crypto API but bundled inline (no external
  * dependency). Uses Web Crypto API via node:crypto webcrypto — Node.js 18+
  * (the `crypto` global only exists unflagged from Node 19, so we import it).
  *
- * Threat model honesty (do not call this "E2E" without a footnote):
+ * How it works (ADR-0007):
  *
- *   The Zeph backend persists the per-user private key in plaintext so it
- *   can be synced down to a fresh device (fetchServerKeys / uploadServerKeys
- *   below). That means the backend can decrypt any push body — this is NOT
- *   end-to-end in the standard sense. What it gives you is:
- *     • Protection against passive network observers
- *     • Protection against a leaked DB snapshot taken without the key store
- *     • Cross-device readability (all your devices share one keypair)
- *   What it does NOT give you:
- *     • Protection against the Zeph backend itself
- *     • Forward secrecy — encryptPushBodyForSelf / encryptFileForSelf do
- *       ECDH(self, self), which collapses to a static derived key. A single
- *       device compromise (since all your devices share the same keypair)
- *       lets the attacker decrypt every past push for which they have the
- *       ciphertext. The per-message AES key is random, but its wrap key is
- *       static, so wrapped keys are decryptable forever.
+ *   This process holds its own ECDH keypair. The private half is generated
+ *   here, written to ~/.config/zeph/device-keys.json, and never leaves the
+ *   host — the server only ever sees public keys. A push is encrypted once
+ *   with a random AES key, and that key is wrapped separately for each of the
+ *   user's registered devices using ECDH(this host, that device).
  *
- *   True E2E would require a per-device keypair (server stores only public
- *   keys; senders wrap the message key once per recipient device public
- *   key). That refactor is on the roadmap; until then, treat push bodies as
- *   sensitive-but-not-secret.
+ *   That makes it end-to-end in the standard sense: the backend stores
+ *   ciphertext plus wrapped keys it cannot unwrap.
+ *
+ * What it still does not give you:
+ *   • Forward secrecy — the ECDH secret for a given (sender, device) pair is
+ *     static, so a compromise of either private key retroactively opens every
+ *     push wrapped for that pair. The per-message AES key is random; its wrap
+ *     key is not.
+ *   • Authenticity beyond the key pairing — nothing signs `senderPublicKey`,
+ *     so a server that swapped it could make a push undecryptable, though not
+ *     readable.
+ *
+ * Superseded scheme: a single account-wide keypair whose private half the
+ * backend escrowed so it could sync to new devices. Key escrow was removed
+ * server-side (zeph@8a6d21b), which left this client waiting for a private key
+ * the API stopped returning — encryption was silently off for months. Nothing
+ * here asks for that key any more.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.encryptFileForSelf = exports.encryptPushBodyForSelf = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.initCrypto = void 0;
+exports.encryptFileForDevices = exports.encryptPushBodyForDevices = exports.disableCrypto = exports.getPublicKey = exports.getKeyPair = exports.selectRecipients = exports.initCrypto = void 0;
 /// <reference lib="dom" />
 const fs_1 = require("fs");
 const os_1 = require("os");
@@ -49,8 +52,14 @@ const fromBase64 = (base64) => {
 };
 // ─── ECDH key management ───
 const ECDH_PARAMS = { name: 'ECDH', namedCurve: 'P-256' };
-// generateKeyPair / exportKeyPair were removed in fix/no-auto-encryption.
-// This module imports keys only; it never creates or exports them.
+const generateKeyPair = async () => crypto.subtle.generateKey(ECDH_PARAMS, true, ['deriveKey', 'deriveBits']);
+const exportKeyPair = async (keyPair) => {
+    const [publicRaw, privateRaw] = await Promise.all([
+        crypto.subtle.exportKey('spki', keyPair.publicKey),
+        crypto.subtle.exportKey('pkcs8', keyPair.privateKey),
+    ]);
+    return { publicKey: toBase64(publicRaw), privateKey: toBase64(privateRaw) };
+};
 const importPublicKey = async (base64) => crypto.subtle.importKey('spki', fromBase64(base64), ECDH_PARAMS, true, []);
 const importPrivateKey = async (base64) => crypto.subtle.importKey('pkcs8', fromBase64(base64), ECDH_PARAMS, true, ['deriveKey', 'deriveBits']);
 const importKeyPair = async (exported) => {
@@ -61,62 +70,60 @@ const importKeyPair = async (exported) => {
     return { publicKey, privateKey };
 };
 const deriveAesKey = async (privateKey, publicKey) => crypto.subtle.deriveKey({ name: 'ECDH', public: publicKey }, privateKey, { name: 'AES-GCM', length: 256 }, false, ['encrypt', 'decrypt']);
-const encrypt = async (plaintext, senderPrivateKey, recipientPublicKey) => {
-    const messageKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
-    const iv = crypto.getRandomValues(new Uint8Array(12));
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, messageKey, new TextEncoder().encode(plaintext));
-    const sharedKey = await deriveAesKey(senderPrivateKey, recipientPublicKey);
-    const rawMessageKey = await crypto.subtle.exportKey('raw', messageKey);
-    const keyIv = crypto.getRandomValues(new Uint8Array(12));
-    const encryptedKey = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawMessageKey);
-    return {
-        ciphertext: toBase64(ciphertext),
-        iv: toBase64(iv.buffer),
-        encryptedKey: toBase64(encryptedKey),
-        keyIv: toBase64(keyIv.buffer),
-    };
-};
-// ─── File encryption ───
-const encryptFileContent = async (content, senderPrivateKey, recipientPublicKey) => {
-    // Binary attachments arrive as a Buffer and must be encrypted byte for byte —
-    // running them through TextEncoder would UTF-8 mangle every non-ASCII byte.
-    // Both branches are views; subtle.encrypt honours byteOffset/byteLength, so a
-    // Buffer carved out of Node's pool encrypts only its own bytes.
-    const buffer = typeof content === 'string'
-        ? new TextEncoder().encode(content)
-        : new Uint8Array(content.buffer, content.byteOffset, content.byteLength);
-    const fileKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
-    const iv = crypto.getRandomValues(new Uint8Array(12));
-    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, fileKey, buffer);
-    const sharedKey = await deriveAesKey(senderPrivateKey, recipientPublicKey);
-    const rawFileKey = await crypto.subtle.exportKey('raw', fileKey);
-    const keyIv = crypto.getRandomValues(new Uint8Array(12));
-    const encryptedKey = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawFileKey);
-    return {
-        ciphertext: Buffer.from(ciphertext),
-        iv: toBase64(iv.buffer),
-        encryptedKey: toBase64(encryptedKey),
-        keyIv: toBase64(keyIv.buffer),
-    };
+/**
+ * Wrap one raw AES key for every recipient device.
+ *
+ * The payload is encrypted once and only the 44-byte wrapped key repeats, so
+ * an attachment costs one S3 object regardless of how many devices the account
+ * has. A recipient whose public key will not import is dropped rather than
+ * failing the send — one broken device record must not silence every push.
+ */
+const wrapForDevices = async (rawKey, senderPrivateKey, recipients) => {
+    const entries = await Promise.all(recipients.map(async ({ deviceId, publicKey }) => {
+        try {
+            const sharedKey = await deriveAesKey(senderPrivateKey, await importPublicKey(publicKey));
+            const keyIv = crypto.getRandomValues(new Uint8Array(12));
+            const wrapped = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: keyIv }, sharedKey, rawKey);
+            return [
+                deviceId,
+                JSON.stringify({ encryptedKey: toBase64(wrapped), keyIv: toBase64(keyIv.buffer) }),
+            ];
+        }
+        catch (err) {
+            console.error(`[Crypto] Skipping device ${deviceId} — unusable public key:`, err);
+            return null;
+        }
+    }));
+    const keyMap = {};
+    for (const entry of entries) {
+        if (entry)
+            keyMap[entry[0]] = entry[1];
+    }
+    if (Object.keys(keyMap).length === 0)
+        throw new Error('No recipient device accepted the wrapped key');
+    return keyMap;
 };
-// ─── Key persistence (~/.config/zeph/keys.json) ───
+// ─── Key persistence ───
 const KEYS_DIR = (0, path_1.join)(process.env.XDG_CONFIG_HOME ?? (0, path_1.join)((0, os_1.homedir)(), '.config'), 'zeph');
-const KEYS_PATH = (0, path_1.join)(KEYS_DIR, 'keys.json');
-const loadStoredKeys = () => {
+// Superseded account-wide keypair. Never written any more; only deleted.
+const LEGACY_KEYS_PATH = (0, path_1.join)(KEYS_DIR, 'keys.json');
+const DEVICE_KEYS_PATH = (0, path_1.join)(KEYS_DIR, 'device-keys.json');
+const loadDeviceKeys = () => {
     try {
-        return JSON.parse((0, fs_1.readFileSync)(KEYS_PATH, 'utf-8'));
+        const parsed = JSON.parse((0, fs_1.readFileSync)(DEVICE_KEYS_PATH, 'utf-8'));
+        return parsed.publicKey && parsed.privateKey ? parsed : null;
     }
     catch {
         return null;
     }
 };
-const storeKeys = (exported) => {
+const storeDeviceKeys = (exported) => {
     (0, fs_1.mkdirSync)(KEYS_DIR, { recursive: true, mode: 0o700 });
-    (0, fs_1.writeFileSync)(KEYS_PATH, JSON.stringify(exported, null, 2), { mode: 0o600 });
+    (0, fs_1.writeFileSync)(DEVICE_KEYS_PATH, JSON.stringify(exported, null, 2), { mode: 0o600 });
 };
-const deleteStoredKeys = () => {
+const deleteLegacyKeys = () => {
     try {
-        (0, fs_1.unlinkSync)(KEYS_PATH);
+        (0, fs_1.unlinkSync)(LEGACY_KEYS_PATH);
     }
     catch { /* not present — fine */ }
 };
@@ -127,38 +134,32 @@ const envIsTrue = (key) => {
 // ─── Cached state ───
 let cachedKeyPair = null;
 let cachedExportedPublicKey = null;
-let cachedOwnPublicKey = null;
+let cachedLegacyPublicKey = null;
 let initPromise = null;
 /**
  * Initialize crypto.
  *
- * The MCP server is a CONSUMER of encryption keys, not a generator. Keys
- * are created in the Zeph app where the user explicitly opts in (Settings
- * → Encryption). This function only imports keys that the server already
- * has, and only when the server confirms encryption is enabled.
+ * Encryption turns on only when the account has explicitly opted in —
+ * `encryptionEnabled` from `GET /users/me/keys` is the single authoritative
+ * signal (ADR-0008), set from the Zeph app. Server unreachable, flag off, or
+ * the hard opt-out below all leave the cache empty and every send plaintext.
  *
- * Any other state — server says disabled, server has no keys, server is
- * unreachable — leaves encryption OFF (cache empty, no fallback). A
- * previous version generated and uploaded a fresh keypair on the "no keys
- * anywhere" path; combined with a transient fetch failure, that silently
- * turned encryption on without user consent and locked the account into
- * an "encryption enabled" state on the server.
+ * When it is on, this host generates its own keypair on first use and keeps
+ * it. Unlike the superseded scheme this asks the server for nothing but the
+ * flag: the private key is created here and stays here.
  *
  * Opt-out: `ZEPH_DISABLE_ENCRYPTION=1` forces crypto off regardless of
- * server state — useful while cleaning up legacy state or for users who
- * never want encryption.
+ * server state.
  *
- * Safe to call concurrently — deduplicates to single init.
- * Returns the exported public key when encryption is active, '' otherwise.
+ * Safe to call concurrently — deduplicates to a single init.
+ * Returns this host's public key when encryption is active, '' otherwise.
  *
  * NOTE: when `apiKey` is provided, `baseUrl` is required.
  */
 const initCrypto = (apiKey, baseUrl) => {
     // Hard opt-out — skip everything, leave cache empty.
     if (envIsTrue('ZEPH_DISABLE_ENCRYPTION')) {
-        cachedKeyPair = null;
-        cachedExportedPublicKey = null;
-        cachedOwnPublicKey = null;
+        (0, exports.disableCrypto)();
         return Promise.resolve('');
     }
     if (apiKey && !baseUrl) {
@@ -167,49 +168,43 @@ const initCrypto = (apiKey, baseUrl) => {
     }
     if (initPromise)
         return initPromise;
-    const baseUrlRequired = apiKey ? baseUrl : baseUrl;
     initPromise = (async () => {
-        if (apiKey) {
-            const serverResult = await fetchServerKeys(apiKey, baseUrlRequired);
-            // The only path that turns encryption ON: server confirms enabled AND
-            // hands us a real keypair. Everything else leaves the cache empty.
-            const haveServerKeys = !!serverResult && serverResult.encryptionEnabled && !!serverResult.keys;
-            if (!haveServerKeys) {
-                cachedKeyPair = null;
-                cachedExportedPublicKey = null;
-                cachedOwnPublicKey = null;
-                // If the server is reachable and explicitly says encryption is off,
-                // drop any stale local cache so a future regression can't resurrect
-                // a keypair that the user already disabled.
-                if (serverResult && !serverResult.encryptionEnabled) {
-                    deleteStoredKeys();
-                }
+        // Local-only mode (no apiKey): used by tests and offline setups. There is
+        // no flag to consult, so an existing device keypair is adopted and a
+        // missing one is not created — generating here would encrypt without any
+        // signal that the user asked for it.
+        if (!apiKey) {
+            const stored = loadDeviceKeys();
+            if (!stored) {
+                (0, exports.disableCrypto)();
                 return '';
             }
-            const keys = serverResult.keys;
-            const stored = loadStoredKeys();
-            if (!stored || stored.publicKey !== keys.publicKey) {
-                storeKeys(keys);
-            }
-            cachedKeyPair = await importKeyPair(keys);
-            cachedExportedPublicKey = keys.publicKey;
-            cachedOwnPublicKey = cachedKeyPair.publicKey;
-            return keys.publicKey;
+            cachedKeyPair = await importKeyPair(stored);
+            cachedExportedPublicKey = stored.publicKey;
+            return stored.publicKey;
         }
-        // Local-only mode (no apiKey): load stored keys if they exist; do NOT
-        // generate. Used by tests and offline / pre-provisioned setups where
-        // a keypair has been dropped into ~/.config/zeph/keys.json out-of-band.
-        const stored = loadStoredKeys();
-        if (!stored) {
-            cachedKeyPair = null;
-            cachedExportedPublicKey = null;
-            cachedOwnPublicKey = null;
+        const serverResult = await fetchEncryptionState(apiKey, baseUrl);
+        if (!serverResult?.encryptionEnabled) {
+            (0, exports.disableCrypto)();
+            // The account says encryption is off. Drop the escrowed account keypair
+            // if an old build left one on disk — it holds a private key this process
+            // has no use for and the server no longer accepts.
+            if (serverResult)
+                deleteLegacyKeys();
             return '';
         }
-        cachedKeyPair = await importKeyPair(stored);
-        cachedExportedPublicKey = stored.publicKey;
-        cachedOwnPublicKey = cachedKeyPair.publicKey;
-        return stored.publicKey;
+        const stored = loadDeviceKeys();
+        if (stored) {
+            cachedKeyPair = await importKeyPair(stored);
+            cachedExportedPublicKey = stored.publicKey;
+            return stored.publicKey;
+        }
+        const keyPair = await generateKeyPair();
+        const exported = await exportKeyPair(keyPair);
+        storeDeviceKeys(exported);
+        cachedKeyPair = keyPair;
+        cachedExportedPublicKey = exported.publicKey;
+        return exported.publicKey;
     })().catch((err) => {
         initPromise = null;
         throw err;
@@ -217,7 +212,7 @@ const initCrypto = (apiKey, baseUrl) => {
     return initPromise;
 };
 exports.initCrypto = initCrypto;
-const fetchServerKeys = async (apiKey, baseUrl) => {
+const fetchEncryptionState = async (apiKey, baseUrl) => {
     try {
         const url = `${baseUrl.replace(/\/$/, '')}/users/me/keys`;
         // Bounded: index.ts awaits initCrypto before connecting the MCP
@@ -229,20 +224,29 @@ const fetchServerKeys = async (apiKey, baseUrl) => {
         if (!res.ok)
             return null;
         const json = await res.json();
-        const keys = json.data?.encryptionKeys;
-        const encryptionEnabled = json.data?.encryptionEnabled ?? (keys ? true : false);
-        return {
-            keys: keys?.publicKey && keys?.privateKey ? keys : null,
-            encryptionEnabled,
+        const state = {
+            encryptionEnabled: json.data?.encryptionEnabled === true,
+            legacyPublicKey: json.data?.encryptionKeys?.publicKey ?? null,
         };
+        cachedLegacyPublicKey = state.legacyPublicKey;
+        return state;
     }
     catch {
         return null;
     }
 };
-// uploadServerKeys was removed in fix/no-auto-encryption — the MCP server
-// must never write to /users/me/keys. Keys are created by the Zeph app
-// where the user explicitly opts in.
+/**
+ * Keep only devices this host can actually encrypt for.
+ *
+ * A device without a public key has never run a build that registers one, and
+ * a device still advertising the account-wide key has not migrated to
+ * per-device E2E — wrapping for either produces a push it cannot open, which
+ * is worse than sending plaintext it can read.
+ */
+const selectRecipients = (devices) => devices
+    .filter((d) => !!d.publicKey && d.publicKey !== cachedLegacyPublicKey)
+    .map(({ deviceId, publicKey }) => ({ deviceId, publicKey }));
+exports.selectRecipients = selectRecipients;
 const getKeyPair = () => cachedKeyPair;
 exports.getKeyPair = getKeyPair;
 const getPublicKey = () => cachedExportedPublicKey;
@@ -259,35 +263,51 @@ exports.getPublicKey = getPublicKey;
 const disableCrypto = () => {
     cachedKeyPair = null;
     cachedExportedPublicKey = null;
-    cachedOwnPublicKey = null;
 };
 exports.disableCrypto = disableCrypto;
 /**
- * Encrypt push body for self (all own devices).
+ * Encrypt a push body for the given recipient devices.
+ *
+ * Returns the wire fields the API expects: `body` carries the ciphertext and
+ * IV, `deviceKeyMap` the per-device wrapped keys, `senderPublicKey` the half
+ * recipients need to derive the same secret back.
  */
-const encryptPushBodyForSelf = async (input) => {
-    if (!cachedKeyPair || !cachedExportedPublicKey || !cachedOwnPublicKey)
+const encryptPushBodyForDevices = async (input, recipients) => {
+    if (!cachedKeyPair || !cachedExportedPublicKey)
         throw new Error('Crypto not initialized');
-    const payload = await encrypt(JSON.stringify({ title: input.title, body: input.body, url: input.url }), cachedKeyPair.privateKey, cachedOwnPublicKey);
+    const messageKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, messageKey, new TextEncoder().encode(JSON.stringify({ title: input.title, body: input.body, url: input.url })));
+    const rawMessageKey = await crypto.subtle.exportKey('raw', messageKey);
     return {
-        body: JSON.stringify({ ciphertext: payload.ciphertext, iv: payload.iv }),
-        encryptedKey: JSON.stringify({ encryptedKey: payload.encryptedKey, keyIv: payload.keyIv }),
+        body: JSON.stringify({ ciphertext: toBase64(ciphertext), iv: toBase64(iv.buffer) }),
+        deviceKeyMap: await wrapForDevices(rawMessageKey, cachedKeyPair.privateKey, recipients),
         senderPublicKey: cachedExportedPublicKey,
         isEncrypted: true,
     };
 };
-exports.encryptPushBodyForSelf = encryptPushBodyForSelf;
+exports.encryptPushBodyForDevices = encryptPushBodyForDevices;
 /**
- * Encrypt file content for self (all own devices).
+ * Encrypt file content for the given recipient devices.
  */
-const encryptFileForSelf = async (content) => {
-    if (!cachedKeyPair || !cachedOwnPublicKey)
+const encryptFileForDevices = async (content, recipients) => {
+    if (!cachedKeyPair)
         throw new Error('Crypto not initialized');
-    const result = await encryptFileContent(content, cachedKeyPair.privateKey, cachedOwnPublicKey);
+    // Binary attachments arrive as a Buffer and must be encrypted byte for byte —
+    // running them through TextEncoder would UTF-8 mangle every non-ASCII byte.
+    // Both branches are views; subtle.encrypt honours byteOffset/byteLength, so a
+    // Buffer carved out of Node's pool encrypts only its own bytes.
+    const buffer = typeof content === 'string'
+        ? new TextEncoder().encode(content)
+        : new Uint8Array(content.buffer, content.byteOffset, content.byteLength);
+    const fileKey = await crypto.subtle.generateKey({ name: 'AES-GCM', length: 256 }, true, ['encrypt', 'decrypt']);
+    const iv = crypto.getRandomValues(new Uint8Array(12));
+    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, fileKey, buffer);
+    const rawFileKey = await crypto.subtle.exportKey('raw', fileKey);
     return {
-        ciphertext: result.ciphertext,
-        iv: result.iv,
-        encryptedKey: JSON.stringify({ encryptedKey: result.encryptedKey, keyIv: result.keyIv }),
+        ciphertext: Buffer.from(ciphertext),
+        iv: toBase64(iv.buffer),
+        deviceKeyMap: await wrapForDevices(rawFileKey, cachedKeyPair.privateKey, recipients),
     };
 };
-exports.encryptFileForSelf = encryptFileForSelf;
+exports.encryptFileForDevices = encryptFileForDevices;

package/dist/e2e-fallback.d.ts

@@ -1,3 +1,15 @@
+import { type ZephApiClient } from './api-client.js';
+import { type DeviceRecipient } from './crypto.js';
+/**
+ * Resolve who a push can be encrypted for, or null when it cannot be.
+ *
+ * The device list is fetched per send rather than cached: a phone that
+ * registered its key a minute ago must be able to read the next push, and a
+ * long-lived MCP process would otherwise keep wrapping for a stale set.
+ * A failure here is not fatal — plaintext the user can read beats a
+ * notification that never arrives.
+ */
+export declare const resolveRecipients: (client: ZephApiClient) => Promise<DeviceRecipient[] | null>;
 /**
  * Run a send, and repeat it unencrypted if the server says E2E needs Pro.
  *
@@ -9,10 +21,11 @@
  * retry rebuilds the whole payload (a file re-uploads as plaintext instead of
  * leaving an undecryptable blob in S3).
  *
- * `send` receives whether it may encrypt, and must be safe to run twice — the
- * encrypted first upload is left orphaned in S3, which is the accepted cost of
- * not shipping an unreadable attachment. The retry is not itself retried: a
- * second `PRO_REQUIRED` propagates.
+ * `send` receives the recipient devices, or null when the push must go out in
+ * the clear, and must be safe to run twice — the encrypted first upload is
+ * left orphaned in S3, which is the accepted cost of not shipping an
+ * unreadable attachment. The retry is not itself retried: a second
+ * `PRO_REQUIRED` propagates.
  */
-export declare const withPlaintextFallback: <T>(send: (canEncrypt: boolean) => Promise<T>) => Promise<T>;
+export declare const withPlaintextFallback: <T>(client: ZephApiClient, send: (recipients: DeviceRecipient[] | null) => Promise<T>) => Promise<T>;
 //# sourceMappingURL=e2e-fallback.d.ts.map

package/dist/e2e-fallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"e2e-fallback.d.ts","sourceRoot":"","sources":["../src/e2e-fallback.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,qBAAqB,GAAU,CAAC,EAC3C,MAAM,CAAC,UAAU,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,KACxC,OAAO,CAAC,CAAC,CAYX,CAAC"}
+{"version":3,"file":"e2e-fallback.d.ts","sourceRoot":"","sources":["../src/e2e-fallback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAA6D,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9G;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB,GAAU,QAAQ,aAAa,KAAG,OAAO,CAAC,eAAe,EAAE,GAAG,IAAI,CAa/F,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,GAAU,CAAC,EAC3C,QAAQ,aAAa,EACrB,MAAM,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,KACzD,OAAO,CAAC,CAAC,CAYX,CAAC"}

package/dist/e2e-fallback.js

@@ -1,8 +1,34 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.withPlaintextFallback = void 0;
+exports.withPlaintextFallback = exports.resolveRecipients = void 0;
 const api_client_js_1 = require("./api-client.js");
 const crypto_js_1 = require("./crypto.js");
+/**
+ * Resolve who a push can be encrypted for, or null when it cannot be.
+ *
+ * The device list is fetched per send rather than cached: a phone that
+ * registered its key a minute ago must be able to read the next push, and a
+ * long-lived MCP process would otherwise keep wrapping for a stale set.
+ * A failure here is not fatal — plaintext the user can read beats a
+ * notification that never arrives.
+ */
+const resolveRecipients = async (client) => {
+    if (!(0, crypto_js_1.getKeyPair)() || !(0, crypto_js_1.getPublicKey)())
+        return null;
+    try {
+        const recipients = (0, crypto_js_1.selectRecipients)((await client.listDevices()).data);
+        if (recipients.length === 0) {
+            console.error('[Crypto] No device has a per-device public key — sending plaintext.');
+            return null;
+        }
+        return recipients;
+    }
+    catch (err) {
+        console.error('[Crypto] Could not list devices, sending plaintext:', err);
+        return null;
+    }
+};
+exports.resolveRecipients = resolveRecipients;
 /**
  * Run a send, and repeat it unencrypted if the server says E2E needs Pro.
  *
@@ -14,24 +40,25 @@ const crypto_js_1 = require("./crypto.js");
  * retry rebuilds the whole payload (a file re-uploads as plaintext instead of
  * leaving an undecryptable blob in S3).
  *
- * `send` receives whether it may encrypt, and must be safe to run twice — the
- * encrypted first upload is left orphaned in S3, which is the accepted cost of
- * not shipping an unreadable attachment. The retry is not itself retried: a
- * second `PRO_REQUIRED` propagates.
+ * `send` receives the recipient devices, or null when the push must go out in
+ * the clear, and must be safe to run twice — the encrypted first upload is
+ * left orphaned in S3, which is the accepted cost of not shipping an
+ * unreadable attachment. The retry is not itself retried: a second
+ * `PRO_REQUIRED` propagates.
  */
-const withPlaintextFallback = async (send) => {
-    const canEncrypt = !!(0, crypto_js_1.getKeyPair)() && !!(0, crypto_js_1.getPublicKey)();
-    if (!canEncrypt)
-        return send(false);
+const withPlaintextFallback = async (client, send) => {
+    const recipients = await (0, exports.resolveRecipients)(client);
+    if (!recipients)
+        return send(null);
     try {
-        return await send(true);
+        return await send(recipients);
     }
     catch (err) {
         if (!(err instanceof api_client_js_1.ApiError) || err.code !== 'PRO_REQUIRED')
             throw err;
         (0, crypto_js_1.disableCrypto)();
         console.error('[Crypto] End-to-end encryption requires Zeph Pro — resending as plaintext.');
-        return send(false);
+        return send(null);
     }
 };
 exports.withPlaintextFallback = withPlaintextFallback;

package/dist/index.js

@@ -77,10 +77,15 @@ const createServer = (config) => {
 };
 const main = async () => {
     const config = (0, config_js_1.loadConfig)();
-    // Initialize E2E encryption keys (sync with server)
+    // Load or create this host's keypair, if the account has opted in. Runs once
+    // per process and caches, so toggling E2E in the app while this server is
+    // running has no effect until it restarts.
     try {
         const publicKey = await (0, crypto_js_1.initCrypto)(config.apiKey, config.baseUrl);
-        console.error(`[Crypto] E2E encryption ready (publicKey: ${publicKey.slice(0, 20)}...)`);
+        if (publicKey)
+            console.error(`[Crypto] E2E encryption ready for zeph_notify / zeph_file (publicKey: ${publicKey.slice(0, 20)}...) — zeph_ask stays plaintext`);
+        else
+            console.error('[Crypto] E2E encryption off — enable it in the Zeph app, then restart this server.');
     }
     catch (err) {
         console.error('[Crypto] E2E encryption unavailable:', err);

package/dist/tools/ask.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../../src/tools/ask.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAwBxD,eAAO,MAAM,eAAe,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,EAAE,SAAS,kBAAkB,SAmI7H,CAAC"}
+{"version":3,"file":"ask.d.ts","sourceRoot":"","sources":["../../src/tools/ask.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAEzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAuBxD,eAAO,MAAM,eAAe,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,EAAE,SAAS,kBAAkB,SAyH7H,CAAC"}

package/dist/tools/ask.js

@@ -5,7 +5,6 @@ const zod_1 = require("zod");
 const error_format_js_1 = require("../error-format.js");
 const poll_js_1 = require("../poll.js");
 const config_js_1 = require("../config.js");
-const crypto_js_1 = require("../crypto.js");
 const mime_js_1 = require("../mime.js");
 const sanitize_js_1 = require("../sanitize.js");
 // The device feed shows a short preview of the body. Anything longer than
@@ -23,7 +22,7 @@ const buildAskMarkdown = (title, body, actions) => {
 };
 const registerAskTool = (server, client, config, waiter) => {
     server.registerTool('zeph_ask', {
-        description: 'Ask the user a question with optional quick-reply buttons and a text input field. Combines prompt (buttons) and input (text) in a single notification. The user can either tap a button or type a response. Blocks until the user responds or the timeout is reached. Requires ZEPH_HOOK_ID environment variable.',
+        description: 'Ask the user a question with optional quick-reply buttons and a text input field. Combines prompt (buttons) and input (text) in a single notification. The user can either tap a button or type a response. Blocks until the user responds or the timeout is reached. Requires ZEPH_HOOK_ID environment variable. NOTE: unlike zeph_notify and zeph_file, this tool is never end-to-end encrypted — the hook route it uses cannot carry the sender key — so do not put secrets in the question or expect a private answer.',
         annotations: {
             readOnlyHint: false,
             destructiveHint: false,
@@ -77,30 +76,21 @@ const registerAskTool = (server, client, config, waiter) => {
             if (exceedsPreview && cleanBody) {
                 const fileName = 'response.md';
                 const fileType = (0, mime_js_1.inferMimeType)(fileName);
-                const canEncrypt = !!(0, crypto_js_1.getKeyPair)() && !!(0, crypto_js_1.getPublicKey)();
                 // Self-contained Markdown so the file alone tells the whole story.
                 const fileMarkdown = buildAskMarkdown(title, cleanBody, effectiveActions);
                 const fileBytes = new TextEncoder().encode(fileMarkdown).byteLength;
-                let uploadContent = fileMarkdown;
-                let uploadContentType = fileType;
-                let fileIv;
-                let fileEncryptedKey;
-                if (canEncrypt) {
-                    try {
-                        const encrypted = await (0, crypto_js_1.encryptFileForSelf)(fileMarkdown);
-                        uploadContent = encrypted.ciphertext;
-                        uploadContentType = 'application/octet-stream';
-                        fileIv = encrypted.iv;
-                        fileEncryptedKey = encrypted.encryptedKey;
-                    }
-                    catch (err) {
-                        console.error('[Crypto] File encryption failed, sending plaintext:', err);
-                    }
-                }
-                const upload = await client.requestUpload({ fileName, fileType: uploadContentType, fileSize: typeof uploadContent === 'string' ? fileBytes : uploadContent.length });
-                await client.uploadToS3(upload.data.uploadUrl, uploadContent, uploadContentType);
+                // Deliberately NOT encrypted, unlike zeph_notify / zeph_file.
+                //
+                // This attachment rides `POST /hooks/:id/trigger`, which creates a
+                // plaintext push: it neither accepts nor persists `isEncrypted` or
+                // `senderPublicKey` (apps/server/src/functions/hooks.ts). Clients
+                // gate decryption on both, so an encrypted attachment here would be
+                // downloaded as raw ciphertext named response.md. Encrypting this
+                // path needs the hook route to carry the sender key first.
+                const upload = await client.requestUpload({ fileName, fileType, fileSize: fileBytes });
+                await client.uploadToS3(upload.data.uploadUrl, fileMarkdown, fileType);
                 triggerBody = cleanBody.slice(0, PREVIEW_LENGTH) + '...';
-                files = [{ fileKey: upload.data.fileKey, fileName, fileSize: fileBytes, fileType, iv: fileIv, encryptedKey: fileEncryptedKey }];
+                files = [{ fileKey: upload.data.fileKey, fileName, fileSize: fileBytes, fileType }];
             }
             const trigger = await client.triggerHook(config.hookId, {
                 title: pushTitle,

package/dist/tools/file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/tools/file.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AA4BrE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAoHjG,CAAC"}
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/tools/file.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AA4BrE,eAAO,MAAM,gBAAgB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAmIjG,CAAC"}

package/dist/tools/file.js

@@ -81,53 +81,65 @@ const registerFileTool = (server, client, config) => {
         // Runs a second time as plaintext if the server refuses E2E (Pro-only,
         // ADR-0008). The retry re-uploads the file unencrypted, so the whole
         // upload-then-send sequence has to sit inside this closure.
-        const send = async (canEncrypt) => {
-            let fileType = (0, mime_js_1.inferMimeType)(fileName);
-            // Step 1: Optionally encrypt file content
-            let uploadContent = body;
-            let uploadSize = originalSize;
-            let fileIv;
-            let fileEncryptedKey;
-            if (canEncrypt) {
+        const send = async (recipients) => {
+            const pushTitle = (0, config_js_1.formatPushTitle)(config.projectName, title ?? fileName);
+            // Step 1: Encrypt the attachment and the push body together, before
+            // anything is uploaded. Doing them one at a time around the upload let
+            // a failure land in between and ship ciphertext under a push with no
+            // `isEncrypted` — an attachment no client would even try to open.
+            let encrypted = null;
+            if (recipients) {
                 try {
-                    const encrypted = await (0, crypto_js_1.encryptFileForSelf)(body);
-                    uploadContent = encrypted.ciphertext;
-                    uploadSize = encrypted.ciphertext.length;
-                    fileType = 'application/octet-stream';
-                    fileIv = encrypted.iv;
-                    fileEncryptedKey = encrypted.encryptedKey;
+                    encrypted = {
+                        file: await (0, crypto_js_1.encryptFileForDevices)(body, recipients),
+                        push: await (0, crypto_js_1.encryptPushBodyForDevices)({ title: pushTitle }, recipients),
+                    };
                 }
                 catch (err) {
-                    console.error('[Crypto] File encryption failed, sending plaintext:', err);
+                    console.error('[Crypto] Encryption failed, sending plaintext:', err);
                 }
             }
+            const uploadContent = encrypted?.file.ciphertext ?? body;
+            const uploadType = encrypted ? 'application/octet-stream' : (0, mime_js_1.inferMimeType)(fileName);
+            const uploadSize = encrypted ? encrypted.file.ciphertext.length : originalSize;
             // Step 2: Request upload URL
-            const upload = await client.requestUpload({ fileName, fileType, fileSize: uploadSize });
+            const upload = await client.requestUpload({ fileName, fileType: uploadType, fileSize: uploadSize });
             // Step 3: Upload content to S3
-            await client.uploadToS3(upload.data.uploadUrl, uploadContent, fileType);
-            // Step 4: Send file push (encrypt push body if possible)
-            const pushTitle = (0, config_js_1.formatPushTitle)(config.projectName, title ?? fileName);
-            let pushPayload = {
-                title: pushTitle,
+            await client.uploadToS3(upload.data.uploadUrl, uploadContent, uploadType);
+            // Step 4: Send the push. `fileType` on the descriptor stays the real
+            // type — it drives how the client renders the decrypted bytes.
+            const pushPayload = {
+                title: encrypted ? undefined : pushTitle,
                 type: 'file',
-                files: [{ fileKey: upload.data.fileKey, fileName, fileSize: originalSize, fileType: (0, mime_js_1.inferMimeType)(fileName), iv: fileIv, encryptedKey: fileEncryptedKey }],
+                files: [{
+                        fileKey: upload.data.fileKey,
+                        fileName,
+                        fileSize: originalSize,
+                        fileType: (0, mime_js_1.inferMimeType)(fileName),
+                        iv: encrypted?.file.iv,
+                        deviceKeyMap: encrypted?.file.deviceKeyMap,
+                    }],
                 targetDeviceId: targetDeviceId ?? config.deviceId,
                 sessionId: config.sessionId,
+                ...(encrypted && {
+                    body: encrypted.push.body,
+                    isEncrypted: encrypted.push.isEncrypted,
+                    deviceKeyMap: encrypted.push.deviceKeyMap,
+                    senderPublicKey: encrypted.push.senderPublicKey,
+                }),
             };
-            if (canEncrypt) {
-                try {
-                    const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: pushTitle });
-                    pushPayload = { ...pushPayload, title: undefined, body: enc.body, isEncrypted: enc.isEncrypted, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
-                }
-                catch (err) {
-                    console.error('[Crypto] Push encryption failed, sending plaintext:', err);
-                }
-            }
             const result = await client.sendPush(pushPayload);
-            return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, fileKey: upload.data.fileKey, fileSize: originalSize, encrypted: canEncrypt });
+            // Report what actually went out — an encryption failure above falls
+            // back to plaintext, so the recipient list alone would over-claim.
+            return (0, error_format_js_1.textResult)({
+                pushId: result.data.pushId,
+                fileKey: upload.data.fileKey,
+                fileSize: originalSize,
+                encrypted: !!encrypted,
+            });
         };
         try {
-            return await (0, e2e_fallback_js_1.withPlaintextFallback)(send);
+            return await (0, e2e_fallback_js_1.withPlaintextFallback)(client, send);
         }
         catch (err) {
             return (0, error_format_js_1.formatToolError)(err);

package/dist/tools/notify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/tools/notify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAUrE,eAAO,MAAM,kBAAkB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAgInG,CAAC"}
+{"version":3,"file":"notify.d.ts","sourceRoot":"","sources":["../../src/tools/notify.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,cAAc,CAAC;AAUrE,eAAO,MAAM,kBAAkB,GAAI,QAAQ,SAAS,EAAE,QAAQ,aAAa,EAAE,QAAQ,eAAe,SAuInG,CAAC"}

package/dist/tools/notify.js

@@ -32,7 +32,7 @@ const registerNotifyTool = (server, client, config) => {
     }, async ({ title, body, url, priority, targetDeviceId }) => {
         // Runs a second time as plaintext if the server refuses E2E (Pro-only,
         // ADR-0008) — hence everything after the encryption decision lives here.
-        const send = async (canEncrypt) => {
+        const send = async (recipients) => {
             const deviceId = targetDeviceId ?? config.deviceId;
             const pushTitle = (0, config_js_1.formatPushTitle)(config.projectName, title);
             // Strip any tool-call markup that leaked into the body argument.
@@ -45,70 +45,74 @@ const registerNotifyTool = (server, client, config) => {
                 // Self-contained Markdown so the file alone carries the full text.
                 const fileMarkdown = `# ${title}\n\n${cleanBody}`;
                 const fileBytes = new TextEncoder().encode(fileMarkdown).byteLength;
-                // Encrypt file content if keys available
-                let uploadContent = fileMarkdown;
-                let uploadContentType = fileType;
-                let fileIv;
-                let fileEncryptedKey;
-                let fileEncrypted = false;
-                if (canEncrypt) {
+                const preview = cleanBody.slice(0, PREVIEW_LENGTH) + '...';
+                // Encrypt the attachment and the push body together, before anything
+                // is uploaded. Doing them one at a time around the upload let a
+                // failure land in between and ship ciphertext under a push with no
+                // `isEncrypted` — an attachment no client would even try to open.
+                let encrypted = null;
+                if (recipients) {
                     try {
-                        const encrypted = await (0, crypto_js_1.encryptFileForSelf)(fileMarkdown);
-                        uploadContent = encrypted.ciphertext;
-                        uploadContentType = 'application/octet-stream';
-                        fileIv = encrypted.iv;
-                        fileEncryptedKey = encrypted.encryptedKey;
-                        fileEncrypted = true;
+                        encrypted = {
+                            file: await (0, crypto_js_1.encryptFileForDevices)(fileMarkdown, recipients),
+                            push: await (0, crypto_js_1.encryptPushBodyForDevices)({ title: pushTitle, body: preview, url }, recipients),
+                        };
                     }
                     catch (err) {
-                        console.error('[Crypto] File encryption failed, sending plaintext:', err);
+                        console.error('[Crypto] Encryption failed, sending plaintext:', err);
                     }
                 }
+                const uploadContent = encrypted?.file.ciphertext ?? fileMarkdown;
+                const uploadContentType = encrypted ? 'application/octet-stream' : fileType;
                 const upload = await client.requestUpload({ fileName, fileType: uploadContentType, fileSize: typeof uploadContent === 'string' ? fileBytes : uploadContent.length });
                 await client.uploadToS3(upload.data.uploadUrl, uploadContent, uploadContentType);
-                const preview = cleanBody.slice(0, PREVIEW_LENGTH) + '...';
-                // Encrypt push body (title/preview/url) if keys available
-                let pushPayload = {
-                    title: pushTitle,
-                    body: preview,
-                    url,
+                const pushPayload = {
+                    title: encrypted ? undefined : pushTitle,
+                    body: encrypted ? encrypted.push.body : preview,
+                    // Dropped alongside the title when encrypted: the url is already
+                    // sealed inside the ciphertext, and for a link push it is the whole
+                    // payload. Leaving the plaintext copy here would hand the server the
+                    // one thing `isEncrypted` promises it cannot see.
+                    url: encrypted ? undefined : url,
                     type: 'file',
                     priority,
-                    files: [{ fileKey: upload.data.fileKey, fileName, fileSize: fileBytes, fileType, iv: fileIv, encryptedKey: fileEncryptedKey }],
+                    files: [{
+                            fileKey: upload.data.fileKey,
+                            fileName,
+                            fileSize: fileBytes,
+                            fileType,
+                            iv: encrypted?.file.iv,
+                            deviceKeyMap: encrypted?.file.deviceKeyMap,
+                        }],
                     targetDeviceId: deviceId,
                     sessionId: config.sessionId,
+                    ...(encrypted && {
+                        isEncrypted: encrypted.push.isEncrypted,
+                        deviceKeyMap: encrypted.push.deviceKeyMap,
+                        senderPublicKey: encrypted.push.senderPublicKey,
+                    }),
                 };
-                let pushEncrypted = false;
-                if (canEncrypt) {
-                    try {
-                        const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: pushTitle, body: preview, url });
-                        pushPayload = { ...pushPayload, title: undefined, body: enc.body, isEncrypted: enc.isEncrypted, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
-                        pushEncrypted = true;
-                    }
-                    catch (err) {
-                        console.error('[Crypto] Push encryption failed, sending plaintext:', err);
-                    }
-                }
                 const result = await client.sendPush(pushPayload);
                 // Report what actually went out — an encryption failure above falls
-                // back to plaintext, so `canEncrypt` alone would over-claim.
-                return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, fileKey: upload.data.fileKey, autoFile: true, encrypted: fileEncrypted && pushEncrypted });
+                // back to plaintext, so the recipient list alone would over-claim.
+                return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, fileKey: upload.data.fileKey, autoFile: true, encrypted: !!encrypted });
             }
             // Short body — encrypt push only
             let pushPayload = {
                 title: pushTitle,
                 body: cleanBody,
-                url,
+                url, // replaced below when the encrypted envelope takes over
                 type: 'hook',
                 priority,
                 targetDeviceId: deviceId,
                 sessionId: config.sessionId,
             };
             let pushEncrypted = false;
-            if (canEncrypt) {
+            if (recipients) {
                 try {
-                    const enc = await (0, crypto_js_1.encryptPushBodyForSelf)({ title: pushTitle, body: cleanBody, url });
-                    pushPayload = { ...pushPayload, title: undefined, body: enc.body, isEncrypted: enc.isEncrypted, encryptedKey: enc.encryptedKey, senderPublicKey: enc.senderPublicKey };
+                    const enc = await (0, crypto_js_1.encryptPushBodyForDevices)({ title: pushTitle, body: cleanBody, url }, recipients);
+                    // `url: undefined` for the same reason as `title` — see the file branch.
+                    pushPayload = { ...pushPayload, title: undefined, url: undefined, body: enc.body, isEncrypted: enc.isEncrypted, deviceKeyMap: enc.deviceKeyMap, senderPublicKey: enc.senderPublicKey };
                     pushEncrypted = true;
                 }
                 catch (err) {
@@ -119,7 +123,7 @@ const registerNotifyTool = (server, client, config) => {
             return (0, error_format_js_1.textResult)({ pushId: result.data.pushId, encrypted: pushEncrypted });
         };
         try {
-            return await (0, e2e_fallback_js_1.withPlaintextFallback)(send);
+            return await (0, e2e_fallback_js_1.withPlaintextFallback)(client, send);
         }
         catch (err) {
             return (0, error_format_js_1.formatToolError)(err);

package/dist/types.d.ts

@@ -95,7 +95,13 @@ export interface AttachedFile {
     fileSize: number;
     fileType: string;
     iv?: string;
-    encryptedKey?: string;
+    /**
+     * E2E: the file AES key wrapped once per recipient device, keyed by
+     * `deviceId`. Each value is a JSON string `{ encryptedKey, keyIv }`.
+     * (The superseded account-wide `encryptedKey` field is not written here —
+     * nothing can unwrap it since key escrow was removed.)
+     */
+    deviceKeyMap?: Record<string, string>;
 }
 export interface ToolError {
     error: string;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;QAC5D,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,CAAC;QAC5D,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,KAAK,CAAC,EAAE,MAAM,CAAC;YACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;KACH,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,YAAY,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,UAAU,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,OAAO,CAAC;KAClB,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,aAAa,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zeph-to/mcp-server",
-  "version": "1.16.0",
+  "version": "2.0.0",
   "description": "Zeph MCP server — AI agent notifications, prompts, and input via MCP protocol",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",