diff --git a/apponly.proto b/apponly.proto
new file mode 100644
index 0000000..4f02a22
--- /dev/null
+++ b/apponly.proto
@@ -0,0 +1,23 @@
+syntax = "proto3";
+
+option java_package = "com.geeksville.mesh";
+option java_outer_classname = "AppOnly";
+option optimize_for = LITE_RUNTIME;
+
+import "mesh.proto";
+
+/**
+This message wraps a MeshPacket with extra metadata about the sender and how it arrived.
+*/
+message ServiceEnvelope {
+    /** The (probably encrypted) packet */
+    MeshPacket packet = 1;
+
+    /** The global channel ID it was sent on */
+    string channel_id = 2;
+
+    /** The sending mesh. FIXME, is this necessary? can we use this to authenticate/prevent fake
+    nodeid impersonation for senders - i.e. use mesh id (which is authenticated) + local node id as
+    the globally trusted nodenum */
+    string mesh_id = 3;
+}
\ No newline at end of file
diff --git a/deviceonly.proto b/deviceonly.proto
index c08982c..a8f615c 100644
--- a/deviceonly.proto
+++ b/deviceonly.proto
@@ -1,7 +1,7 @@
 syntax = "proto3";
 
 option java_package = "com.geeksville.mesh";
-option java_outer_classname = "MeshProtos";
+option java_outer_classname = "DeviceOnly";
 option optimize_for = LITE_RUNTIME;
 
 import "mesh.proto";
diff --git a/docs/docs.md b/docs/docs.md
index 0195f4a..afd80f7 100644
--- a/docs/docs.md
+++ b/docs/docs.md
@@ -3,6 +3,9 @@
 
 ## Table of Contents
 
+- [apponly.proto](#apponly.proto)
+    - [ServiceEnvelope](#.ServiceEnvelope)
+  
 - [deviceonly.proto](#deviceonly.proto)
     - [DeviceState](#.DeviceState)
   
@@ -43,6 +46,39 @@
 
 
 
+<a name="apponly.proto"></a>
+<p align="right"><a href="#top">Top</a></p>
+
+## apponly.proto
+
+
+
+<a name=".ServiceEnvelope"></a>
+
+### ServiceEnvelope
+This message wraps a MeshPacket with extra metadata about the sender and how it arrived.
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| packet | [MeshPacket](#MeshPacket) |  | The (probably encrypted) packet |
+| channel_id | [string](#string) |  | The global channel ID it was sent on |
+| mesh_id | [string](#string) |  | The sending mesh. FIXME, is this necessary? can we use this to authenticate/prevent fake nodeid impersonation for senders - i.e. use mesh id (which is authenticated) &#43; local node id as the globally trusted nodenum |
+
+
+
+
+
+ 
+
+ 
+
+ 
+
+ 
+
+
+
 <a name="deviceonly.proto"></a>
 <p align="right"><a href="#top">Top</a></p>