@peers-app/peers-sdk 0.19.0 → 0.19.6

package/dist/data/package-version-resolver.d.ts

@@ -1,14 +1,14 @@
 /**
  * Device-local package version resolver.
  *
- * Each device independently decides which package version to run based on a
- * per-package `groupDeviceVar` containing the active PV ID and follow
- * preferences. The shared `IPackage.activePackageVersionId` serves only as
- * the group-level default for new devices.
+ * Each device resolves which package version to run from the shared group
+ * package settings plus optional device-local prefs. When an admin device
+ * upgrades a non-dev version while following group settings, the shared
+ * `IPackage.activePackageVersionId` advances so the group stays aligned.
  */
 import type { DataContext } from "../context/data-context";
 import { type IPackageVersion } from "./package-versions";
-import type { IPackage } from "./packages";
+import { type IPackage } from "./packages";
 import { type PersistentVar } from "./persistent-vars";
 /**
  * Device-local preferences for a single package. Stored in a `groupDeviceVar`
@@ -68,6 +68,7 @@ export interface IEffectivePackagePrefs {
  * resolver and by UI components that need to reflect device behavior.
  */
 export declare function getEffectivePackagePrefs(pkg: IPackage, devicePrefs: IDevicePackagePrefs | undefined): IEffectivePackagePrefs;
+/** Result of a device-level package version resolution attempt. */
 export interface IResolveResult {
     /** Whether a package was successfully loaded */
     loaded: boolean;
@@ -90,3 +91,10 @@ export declare function resolveDevicePackageVersion(pkg: IPackage, dataContext:
     force?: boolean;
     localPath?: string;
 }): Promise<IResolveResult>;
+/**
+ * Returns true when the device has an explicit follow-policy override
+ * (`followRange`, `followTags`, or `pinned`). Used by the UI to drive the
+ * "Override on this device" toggle and by the resolver to decide whether
+ * to advance the group-level active version on upgrade.
+ */
+export declare function hasDeviceFollowOverride(prefs: IDevicePackagePrefs | undefined): boolean;

package/dist/data/package-version-resolver.js

@@ -2,19 +2,23 @@
 /**
  * Device-local package version resolver.
  *
- * Each device independently decides which package version to run based on a
- * per-package `groupDeviceVar` containing the active PV ID and follow
- * preferences. The shared `IPackage.activePackageVersionId` serves only as
- * the group-level default for new devices.
+ * Each device resolves which package version to run from the shared group
+ * package settings plus optional device-local prefs. When an admin device
+ * upgrades a non-dev version while following group settings, the shared
+ * `IPackage.activePackageVersionId` advances so the group stays aligned.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.packagePrefsVar = packagePrefsVar;
 exports.updatePackagePrefs = updatePackagePrefs;
 exports.getEffectivePackagePrefs = getEffectivePackagePrefs;
 exports.resolveDevicePackageVersion = resolveDevicePackageVersion;
+exports.hasDeviceFollowOverride = hasDeviceFollowOverride;
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const assistants_1 = require("./assistants");
+const group_member_roles_1 = require("./group-member-roles");
+const group_permissions_1 = require("./group-permissions");
 const package_versions_1 = require("./package-versions");
+const packages_1 = require("./packages");
 const persistent_vars_1 = require("./persistent-vars");
 const workflows_1 = require("./workflows");
 /**
@@ -129,6 +133,17 @@ async function resolveDevicePackageVersion(pkg, dataContext, opts) {
             .get(effectiveActivePvId)
             .catch(() => undefined);
     }
+    // Dev versions are intentionally local working versions. If a device is
+    // currently running dev, keep loading that exact PV until the user manually
+    // activates a non-dev version.
+    if (activePv?.versionTag === "dev") {
+        const instance = await dataContext.packageLoader.loadPackage(pkg, {
+            force: opts?.force,
+            localPath: opts?.localPath,
+            packageVersionId: effectiveActivePvId,
+        });
+        return { loaded: !!instance, pv: activePv, upgraded: false };
+    }
     // Evaluate all available PVs to find the best one
     const allVersions = await (0, package_versions_1.PackageVersions)(dataContext).list({ packageId: pkg.packageId });
     let bestPv = activePv;
@@ -178,9 +193,41 @@ async function resolveDevicePackageVersion(pkg, dataContext, opts) {
         }
         return { loaded: false, upgraded: false };
     }
-    // Load succeeded - install assistants/workflows, then update device prefs
+    // Load succeeded - install assistants/workflows, then persist the activation
+    // either as a group-level active version or as device-local state.
     await installPackageContents(dataContext, pkg, instance);
-    await updatePackagePrefs(pkg.packageId, { activePackageVersionId: bestPv.packageVersionId }, dataContext);
+    // When the device is following group settings (no device-level follow
+    // override) and the upgraded version is non-dev, also advance the group's
+    // activePackageVersionId so other devices stay in sync. Only admin+ users
+    // are allowed to write to the Packages record.
+    let advancedGroupActiveVersion = false;
+    if (bestPv.versionTag !== "dev" && !hasDeviceFollowOverride(rawPrefs)) {
+        try {
+            const groupId = dataContext.groupId;
+            if (groupId) {
+                const userCtx = await (0, user_context_singleton_1.getUserContext)();
+                const role = await (0, group_permissions_1.getUserRole)(groupId, userCtx.userId);
+                if (role >= group_member_roles_1.GroupMemberRole.Admin) {
+                    const freshPkg = await (0, packages_1.Packages)(dataContext).get(pkg.packageId);
+                    if (freshPkg) {
+                        if (freshPkg.activePackageVersionId !== bestPv.packageVersionId) {
+                            freshPkg.activePackageVersionId = bestPv.packageVersionId;
+                            await (0, packages_1.Packages)(dataContext).signAndSave(freshPkg);
+                        }
+                        advancedGroupActiveVersion = true;
+                    }
+                }
+            }
+        }
+        catch {
+            // Non-critical: personal contexts have no group, signature checks may
+            // fail for non-admins. Swallow and continue — the device upgrade
+            // already succeeded.
+        }
+    }
+    await updatePackagePrefs(pkg.packageId, {
+        activePackageVersionId: advancedGroupActiveVersion ? undefined : bestPv.packageVersionId,
+    }, dataContext);
     return { loaded: true, pv: bestPv, upgraded: true };
 }
 /**
@@ -197,6 +244,17 @@ async function installPackageContents(dataContext, pkg, instance) {
     ];
     await Promise.all(saves);
 }
+/**
+ * Returns true when the device has an explicit follow-policy override
+ * (`followRange`, `followTags`, or `pinned`). Used by the UI to drive the
+ * "Override on this device" toggle and by the resolver to decide whether
+ * to advance the group-level active version on upgrade.
+ */
+function hasDeviceFollowOverride(prefs) {
+    if (!prefs)
+        return false;
+    return prefs.followRange != null || prefs.followTags != null || prefs.pinned != null;
+}
 /** Convert `IPackage.versionFollowRange` to the resolver's range type. */
 function rangeFromPkg(pkg) {
     const r = pkg.versionFollowRange;

package/dist/data/package-version-resolver.test.d.ts

@@ -1,8 +1,4 @@
 /**
  * Regression tests for device-local package version resolution.
- *
- * Several cases document known gaps from the device-local package versions review.
- * They are expected to fail until the resolver honors group-level pinned, legacy
- * deviceVersionTag, and pinned devices are not overridden before resolve.
  */
 export {};

package/dist/data/package-version-resolver.test.js

@@ -1,10 +1,6 @@
 "use strict";
 /**
  * Regression tests for device-local package version resolution.
- *
- * Several cases document known gaps from the device-local package versions review.
- * They are expected to fail until the resolver honors group-level pinned, legacy
- * deviceVersionTag, and pinned devices are not overridden before resolve.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 const SQLiteDB = require("better-sqlite3");
@@ -12,6 +8,8 @@ const user_context_1 = require("../context/user-context");
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const utils_1 = require("../utils");
 const assistants_1 = require("./assistants");
+const group_member_roles_1 = require("./group-member-roles");
+const groups_1 = require("./groups");
 const sql_data_source_1 = require("./orm/sql.data-source");
 const package_version_resolver_1 = require("./package-version-resolver");
 const package_versions_1 = require("./package-versions");
@@ -51,6 +49,11 @@ function groupDc() {
     dc.setAsDefault();
     return dc;
 }
+function freshGroupDc() {
+    const dc = userContext.getDataContext((0, utils_1.newid)());
+    dc.setAsDefault();
+    return dc;
+}
 function makePV(packageId, overrides = {}) {
     return {
         packageVersionId: (0, utils_1.newid)(),
@@ -85,6 +88,7 @@ beforeAll(async () => {
     userContext.deviceId((0, utils_1.newid)());
     (0, user_context_singleton_1.setUserContext)(userContext);
     packages_1.PackagesTable.isPassthrough = true;
+    packages_1.PackagesTable.enablePackageSigning((pkg) => pkg);
     package_versions_1.PackageVersionsTable.isPassthrough = true;
 });
 afterAll(async () => {
@@ -96,7 +100,7 @@ afterAll(async () => {
 afterEach(() => {
     jest.restoreAllMocks();
 });
-describe("resolveDevicePackageVersion — known gaps (expected to fail until fixed)", () => {
+describe("resolveDevicePackageVersion — regression coverage", () => {
     it("does not auto-upgrade when IPackage.versionFollowRange is pinned (no device prefs)", async () => {
         const dc = groupDc();
         const packageId = (0, utils_1.newid)();
@@ -177,6 +181,123 @@ describe("resolveDevicePackageVersion — known gaps (expected to fail until fix
     });
 });
 describe("resolveDevicePackageVersion — expected behavior (control)", () => {
+    it("advances the group active version when an admin auto-upgrades without device overrides", async () => {
+        const dc = freshGroupDc();
+        const packageId = (0, utils_1.newid)();
+        const stablePv = makePV(packageId, { version: "1.0.0", versionTag: "stable" });
+        const stableV2 = makePV(packageId, { version: "2.0.0", versionTag: "stable" });
+        await (0, package_versions_1.PackageVersions)(dc).save(stablePv);
+        await (0, package_versions_1.PackageVersions)(dc).save(stableV2);
+        const pkg = makePkg({
+            packageId,
+            activePackageVersionId: stablePv.packageVersionId,
+            versionFollowRange: "latest",
+            followVersionTags: "stable",
+        });
+        await (0, packages_1.Packages)(dc).save(pkg);
+        jest.spyOn(dc.packageLoader, "loadPackage").mockResolvedValue({ packageId });
+        const result = await (0, package_version_resolver_1.resolveDevicePackageVersion)(pkg, dc, { force: true });
+        expect(result.upgraded).toBe(true);
+        expect(result.pv?.packageVersionId).toBe(stableV2.packageVersionId);
+        const savedPkg = await (0, packages_1.Packages)(dc).get(packageId);
+        expect(savedPkg?.activePackageVersionId).toBe(stableV2.packageVersionId);
+        const pvar = (0, package_version_resolver_1.packagePrefsVar)(packageId, dc);
+        await pvar.loadingPromise;
+        expect(pvar()?.activePackageVersionId).toBeUndefined();
+    });
+    it("keeps an auto-upgrade device-local when device follow overrides are enabled", async () => {
+        const dc = freshGroupDc();
+        const packageId = (0, utils_1.newid)();
+        const stablePv = makePV(packageId, { version: "1.0.0", versionTag: "stable" });
+        const stableV2 = makePV(packageId, { version: "2.0.0", versionTag: "stable" });
+        await (0, package_versions_1.PackageVersions)(dc).save(stablePv);
+        await (0, package_versions_1.PackageVersions)(dc).save(stableV2);
+        const pkg = makePkg({
+            packageId,
+            activePackageVersionId: stablePv.packageVersionId,
+            versionFollowRange: "latest",
+            followVersionTags: "stable",
+        });
+        await (0, packages_1.Packages)(dc).save(pkg);
+        await (0, package_version_resolver_1.updatePackagePrefs)(packageId, { followRange: "latest", followTags: "stable" }, dc);
+        jest.spyOn(dc.packageLoader, "loadPackage").mockResolvedValue({ packageId });
+        const result = await (0, package_version_resolver_1.resolveDevicePackageVersion)(pkg, dc, { force: true });
+        expect(result.upgraded).toBe(true);
+        expect(result.pv?.packageVersionId).toBe(stableV2.packageVersionId);
+        const savedPkg = await (0, packages_1.Packages)(dc).get(packageId);
+        expect(savedPkg?.activePackageVersionId).toBe(stablePv.packageVersionId);
+        const pvar = (0, package_version_resolver_1.packagePrefsVar)(packageId, dc);
+        await pvar.loadingPromise;
+        expect(pvar()?.activePackageVersionId).toBe(stableV2.packageVersionId);
+    });
+    it("keeps an auto-upgrade device-local when the device user is not a group admin", async () => {
+        const dc = freshGroupDc();
+        const packageId = (0, utils_1.newid)();
+        const stablePv = makePV(packageId, { version: "1.0.0", versionTag: "stable" });
+        const stableV2 = makePV(packageId, { version: "2.0.0", versionTag: "stable" });
+        await (0, package_versions_1.PackageVersions)(dc).save(stablePv);
+        await (0, package_versions_1.PackageVersions)(dc).save(stableV2);
+        await (0, groups_1.Groups)(userContext.userDataContext).save({
+            groupId: dc.dataContextId,
+            name: "Non-admin resolver test",
+            description: "test",
+            founderUserId: (0, utils_1.newid)(),
+            publicRole: group_member_roles_1.GroupMemberRole.Writer,
+            publicKey: "",
+            publicBoxKey: "",
+            signature: "",
+        });
+        const pkg = makePkg({
+            packageId,
+            activePackageVersionId: stablePv.packageVersionId,
+            versionFollowRange: "latest",
+            followVersionTags: "stable",
+        });
+        await (0, packages_1.Packages)(dc).save(pkg);
+        jest.spyOn(dc.packageLoader, "loadPackage").mockResolvedValue({ packageId });
+        const result = await (0, package_version_resolver_1.resolveDevicePackageVersion)(pkg, dc, { force: true });
+        expect(result.upgraded).toBe(true);
+        expect(result.pv?.packageVersionId).toBe(stableV2.packageVersionId);
+        const savedPkg = await (0, packages_1.Packages)(dc).get(packageId);
+        expect(savedPkg?.activePackageVersionId).toBe(stablePv.packageVersionId);
+        const pvar = (0, package_version_resolver_1.packagePrefsVar)(packageId, dc);
+        await pvar.loadingPromise;
+        expect(pvar()?.activePackageVersionId).toBe(stableV2.packageVersionId);
+    });
+    it("keeps a local dev activation on this device without turning override on", async () => {
+        const dc = freshGroupDc();
+        const packageId = (0, utils_1.newid)();
+        const stablePv = makePV(packageId, { version: "1.0.0", versionTag: "stable" });
+        const devPv = makePV(packageId, { version: "1.2.0", versionTag: "dev" });
+        const stableV2 = makePV(packageId, { version: "2.0.0", versionTag: "stable" });
+        await (0, package_versions_1.PackageVersions)(dc).save(stablePv);
+        await (0, package_versions_1.PackageVersions)(dc).save(devPv);
+        await (0, package_versions_1.PackageVersions)(dc).save(stableV2);
+        const pkg = makePkg({
+            packageId,
+            activePackageVersionId: stablePv.packageVersionId,
+            versionFollowRange: "latest",
+            followVersionTags: "stable",
+        });
+        await (0, packages_1.Packages)(dc).save(pkg);
+        await (0, package_version_resolver_1.updatePackagePrefs)(packageId, { activePackageVersionId: devPv.packageVersionId }, dc);
+        const pvar = (0, package_version_resolver_1.packagePrefsVar)(packageId, dc);
+        await pvar.loadingPromise;
+        expect((0, package_version_resolver_1.hasDeviceFollowOverride)(pvar())).toBe(false);
+        const loadedPvIds = [];
+        jest.spyOn(dc.packageLoader, "loadPackage").mockImplementation(async (_pkg, opts) => {
+            if (opts?.packageVersionId)
+                loadedPvIds.push(opts.packageVersionId);
+            return { packageId };
+        });
+        const result = await (0, package_version_resolver_1.resolveDevicePackageVersion)(pkg, dc, { force: true });
+        expect(result.upgraded).toBe(false);
+        expect(result.pv?.packageVersionId).toBe(devPv.packageVersionId);
+        expect(loadedPvIds).toEqual([devPv.packageVersionId]);
+        const savedPkg = await (0, packages_1.Packages)(dc).get(packageId);
+        expect(savedPkg?.activePackageVersionId).toBe(stablePv.packageVersionId);
+        expect(pvar()?.activePackageVersionId).toBe(devPv.packageVersionId);
+    });
     it("does not auto-activate dev when device has no prefs and group default is stable", async () => {
         const dc = groupDc();
         const packageId = (0, utils_1.newid)();

package/dist/data/packages.d.ts

@@ -9,23 +9,6 @@ declare const schema: z.ZodObject<{
     createdBy: z.ZodEffects<z.ZodString, string, string>;
     disabled: z.ZodOptional<z.ZodBoolean>;
     remoteRepo: z.ZodOptional<z.ZodString>;
-    /** @deprecated Read appNavs from the active IPackageVersion record instead. */
-    appNavs: z.ZodOptional<z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        displayName: z.ZodOptional<z.ZodString>;
-        iconClassName: z.ZodString;
-        navigationPath: z.ZodString;
-    }, "strip", z.ZodTypeAny, {
-        name: string;
-        iconClassName: string;
-        navigationPath: string;
-        displayName?: string | undefined;
-    }, {
-        name: string;
-        iconClassName: string;
-        navigationPath: string;
-        displayName?: string | undefined;
-    }>, "many">>;
     activePackageVersionId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
     versionFollowRange: z.ZodOptional<z.ZodEnum<["pinned", "patch", "minor", "latest"]>>;
     followVersionTags: z.ZodOptional<z.ZodString>;
@@ -40,12 +23,6 @@ declare const schema: z.ZodObject<{
     createdBy: string;
     publishPublicKey: string;
     disabled?: boolean | undefined;
-    appNavs?: {
-        name: string;
-        iconClassName: string;
-        navigationPath: string;
-        displayName?: string | undefined;
-    }[] | undefined;
     remoteRepo?: string | undefined;
     activePackageVersionId?: string | undefined;
     versionFollowRange?: "pinned" | "patch" | "minor" | "latest" | undefined;
@@ -59,12 +36,6 @@ declare const schema: z.ZodObject<{
     createdBy: string;
     publishPublicKey: string;
     disabled?: boolean | undefined;
-    appNavs?: {
-        name: string;
-        iconClassName: string;
-        navigationPath: string;
-        displayName?: string | undefined;
-    }[] | undefined;
     remoteRepo?: string | undefined;
     activePackageVersionId?: string | undefined;
     versionFollowRange?: "pinned" | "patch" | "minor" | "latest" | undefined;

package/dist/data/packages.js

@@ -38,7 +38,6 @@ exports.autoUpdatePeersCore = exports.reloadPackagesOnPageRefresh = exports.pack
 exports.Packages = Packages;
 const zod_1 = require("zod");
 const context_1 = require("../context");
-const app_nav_1 = require("../types/app-nav");
 const zod_types_1 = require("../types/zod-types");
 const decorators_1 = require("./orm/decorators");
 const table_1 = require("./orm/table");
@@ -56,11 +55,6 @@ const schema = zod_1.z.object({
         .optional()
         .describe("Whether the package's components should be loaded and included in the app runtime"),
     remoteRepo: zod_1.z.string().optional().describe("The remote repository where the package is stored"),
-    /** @deprecated Read appNavs from the active IPackageVersion record instead. */
-    appNavs: app_nav_1.appNavSchema
-        .array()
-        .optional()
-        .describe("DEPRECATED: Read appNavs from the active IPackageVersion record instead"),
     activePackageVersionId: zod_types_1.zodPeerId
         .optional()
         .describe("FK to PackageVersions — the currently active version"),

package/dist/package-installer/package-author-signing.d.ts

@@ -1,4 +1,5 @@
 import type { IPackageVersion } from "../data/package-versions";
+import type { IAppNav } from "../types/app-nav";
 /** Prefix for the persistent variable name that stores a package's signing secret key. */
 export declare const PACKAGE_SIGNING_KEY_PREFIX = "packageSigningKey_";
 /**
@@ -14,18 +15,23 @@ export interface IAuthorSignedPayload {
     routesBundleFileHash?: string;
     uiBundleFileHash?: string;
     publicKey: string;
+    appNavs?: IAppNav[];
+    createdBy?: string;
+    createdAt?: string;
 }
+/** PV fields required by {@link buildAuthorSignedPayload} and related signing/verification functions. */
+export type AuthorSignableFields = Pick<IPackageVersion, "packageId" | "packageVersionId" | "version" | "versionTag" | "packageBundleFileHash" | "routesBundleFileHash" | "uiBundleFileHash" | "appNavs"> & Partial<Pick<IPackageVersion, "createdBy" | "createdAt">>;
 /**
  * Extracts the signable payload from a PackageVersion record.
- * Only includes optional hash fields when they have a value (undefined fields are omitted
+ * Only includes optional fields when they have a value (undefined fields are omitted
  * entirely so `stableStringify` produces a consistent output).
  */
-export declare function buildAuthorSignedPayload(pv: Pick<IPackageVersion, "packageId" | "packageVersionId" | "version" | "versionTag" | "packageBundleFileHash" | "routesBundleFileHash" | "uiBundleFileHash">, publicKey: string): IAuthorSignedPayload;
+export declare function buildAuthorSignedPayload(pv: AuthorSignableFields, publicKey: string): IAuthorSignedPayload;
 /**
  * Signs a PackageVersion with the publisher's Ed25519 secret key.
  * @returns A base64url-encoded detached Ed25519 signature over `stableStringify(payload)`.
  */
-export declare function signPackageAuthor(pv: Pick<IPackageVersion, "packageId" | "packageVersionId" | "version" | "versionTag" | "packageBundleFileHash" | "routesBundleFileHash" | "uiBundleFileHash">, secretKey: string): string;
+export declare function signPackageAuthor(pv: AuthorSignableFields, secretKey: string): string;
 /**
  * Result of verifying a packageAuthorSignature.
  * `publicKey` is the key embedded in the payload (extracted from the signature verification process).
@@ -45,4 +51,4 @@ export interface IVerifyAuthorSignatureResult {
  * @param expectedPublicKey - The public key to verify against (from Package.publishPublicKey)
  * @returns `{ valid, publicKey }` — valid is true if signature verifies and key matches
  */
-export declare function verifyPackageAuthorSignature(pv: Pick<IPackageVersion, "packageId" | "packageVersionId" | "version" | "versionTag" | "packageBundleFileHash" | "routesBundleFileHash" | "uiBundleFileHash" | "packageAuthorSignature">, expectedPublicKey: string): IVerifyAuthorSignatureResult;
+export declare function verifyPackageAuthorSignature(pv: AuthorSignableFields & Pick<IPackageVersion, "packageAuthorSignature">, expectedPublicKey: string): IVerifyAuthorSignatureResult;

package/dist/package-installer/package-author-signing.js

@@ -11,7 +11,7 @@ const keys_1 = require("../keys");
 exports.PACKAGE_SIGNING_KEY_PREFIX = "packageSigningKey_";
 /**
  * Extracts the signable payload from a PackageVersion record.
- * Only includes optional hash fields when they have a value (undefined fields are omitted
+ * Only includes optional fields when they have a value (undefined fields are omitted
  * entirely so `stableStringify` produces a consistent output).
  */
 function buildAuthorSignedPayload(pv, publicKey) {
@@ -29,6 +29,15 @@ function buildAuthorSignedPayload(pv, publicKey) {
     if (pv.uiBundleFileHash) {
         payload.uiBundleFileHash = pv.uiBundleFileHash;
     }
+    if (pv.appNavs) {
+        payload.appNavs = pv.appNavs;
+    }
+    if (pv.createdBy) {
+        payload.createdBy = pv.createdBy;
+    }
+    if (pv.createdAt) {
+        payload.createdAt = pv.createdAt;
+    }
     return payload;
 }
 /**

package/dist/package-installer/package-propagation.js

@@ -342,6 +342,7 @@ function buildPropagatedPv(pv, files) {
         routesBundleFileHash: routesBundle?.expectedHash,
         uiBundleFileId: uiBundle?.file.fileId,
         uiBundleFileHash: uiBundle?.expectedHash,
+        appNavs: pv.appNavs,
         packageAuthorSignature: pv.packageAuthorSignature,
         signature: "",
         createdBy: pv.createdBy,

package/dist/package-installer/package-publisher.d.ts

@@ -6,6 +6,7 @@
  * I/O — callers (the system tool, tests) provide bundle strings and receive
  * artifacts in memory.
  */
+import type { IAppNav } from "../types/app-nav";
 import { type IAuthorSignedPayload } from "./package-author-signing";
 import type { ILatestPointer } from "./package-remote-checker";
 import { type ITarballPayload } from "./package-tarball";
@@ -30,6 +31,10 @@ export interface IBuildPublishArtifactsOpts {
     publicKey: string;
     /** Pre-generated packageVersionId. If omitted, a new one is created via {@link newid}. */
     packageVersionId?: string;
+    /** App navigation items to include in the tarball metadata. */
+    appNavs?: IAppNav[];
+    /** Peer ID of the publisher. Recorded as `createdBy` on the PV. */
+    createdBy?: string;
 }
 /** Artifacts produced by {@link buildPublishArtifacts}. */
 export interface IPublishArtifacts {

package/dist/package-installer/package-publisher.js

@@ -32,6 +32,7 @@ async function buildPublishArtifacts(opts) {
         ? (0, file_types_1.computeFileHash)(bundles.routesBundle)
         : undefined;
     const uiBundleFileHash = bundles.uiBundle ? (0, file_types_1.computeFileHash)(bundles.uiBundle) : undefined;
+    const now = new Date().toISOString();
     const pvFields = {
         packageId,
         packageVersionId,
@@ -40,6 +41,9 @@ async function buildPublishArtifacts(opts) {
         packageBundleFileHash,
         routesBundleFileHash,
         uiBundleFileHash,
+        appNavs: opts.appNavs,
+        createdBy: opts.createdBy,
+        createdAt: now,
     };
     const payload = (0, package_author_signing_1.buildAuthorSignedPayload)(pvFields, publicKey);
     const packageAuthorSignature = await sign(payload);

package/dist/package-installer/package-remote-checker.js

@@ -14,6 +14,7 @@ const file_types_1 = require("../data/files/file.types");
 const package_versions_1 = require("../data/package-versions");
 const packages_1 = require("../data/packages");
 const keys_1 = require("../keys");
+const package_version_resolver_1 = require("../data/package-version-resolver");
 const package_author_signing_1 = require("./package-author-signing");
 const package_installer_1 = require("./package-installer");
 const package_propagation_1 = require("./package-propagation");
@@ -84,6 +85,9 @@ async function doRemoteCheck(packageId, updateUrl, tag, http) {
         packageBundleFileHash: unpacked.payload.packageBundleFileHash,
         routesBundleFileHash: unpacked.payload.routesBundleFileHash,
         uiBundleFileHash: unpacked.payload.uiBundleFileHash,
+        appNavs: unpacked.payload.appNavs,
+        createdBy: unpacked.payload.createdBy,
+        createdAt: unpacked.payload.createdAt,
         packageAuthorSignature: unpacked.payload.packageAuthorSignature,
     }, unpacked.payload.publicKey);
     if (!sigResult.valid) {
@@ -160,10 +164,11 @@ async function installRemotePackageVersion(dataContext, result) {
         routesBundleFileHash: routesFile?.fileHash,
         uiBundleFileId: uiFile?.fileId,
         uiBundleFileHash: uiFile?.fileHash,
+        appNavs: unpacked.payload.appNavs,
         packageAuthorSignature: unpacked.payload.packageAuthorSignature,
         signature: "",
-        createdBy: packageId,
-        createdAt: new Date().toISOString(),
+        createdBy: unpacked.payload.createdBy ?? packageId,
+        createdAt: unpacked.payload.createdAt ?? new Date().toISOString(),
     };
     const pvTable = (0, package_versions_1.PackageVersions)(dataContext);
     const savedPv = await pvTable.signAndSave(pv);
@@ -173,8 +178,11 @@ async function installRemotePackageVersion(dataContext, result) {
         await (0, packages_1.Packages)(dataContext).signAndSave(pkg);
     }
     const activationResult = await (0, package_propagation_1.activateBestEligibleVersion)(dataContext, pkg);
+    // Also run the device-level resolver so this device picks up the new version
+    // (activateBestEligibleVersion only updates the group-level default).
+    const resolveResult = await (0, package_version_resolver_1.resolveDevicePackageVersion)(pkg, dataContext, { force: true });
     return {
-        activated: activationResult?.activated ?? false,
+        activated: activationResult?.activated || resolveResult.upgraded,
         packageVersion: savedPv,
     };
 }

package/dist/package-installer/package-remote-checker.test.js

@@ -28,6 +28,10 @@ const mockActivateBestEligibleVersion = jest.fn();
 jest.mock("./package-propagation", () => ({
     activateBestEligibleVersion: (...args) => mockActivateBestEligibleVersion(...args),
 }));
+const mockResolveDevicePackageVersion = jest.fn();
+jest.mock("../data/package-version-resolver", () => ({
+    resolveDevicePackageVersion: (...args) => mockResolveDevicePackageVersion(...args),
+}));
 const file_types_1 = require("../data/files/file.types");
 const keys_1 = require("../keys");
 const package_author_signing_1 = require("./package-author-signing");
@@ -96,6 +100,7 @@ describe("package-remote-checker", () => {
             activated: true,
             activePackageVersionId: PV_ID,
         });
+        mockResolveDevicePackageVersion.mockResolvedValue({ loaded: true, upgraded: true });
     });
     describe("checkPackageRemoteForNewVersion", () => {
         it("downloads and verifies tarball when new version available", async () => {
@@ -258,6 +263,7 @@ describe("package-remote-checker", () => {
             expect(installed.activated).toBe(true);
             expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ publishPublicKey: keys.publicKey }));
             expect(mockPackageVersionsSignAndSave).toHaveBeenCalled();
+            expect(mockResolveDevicePackageVersion).toHaveBeenCalledWith(expect.objectContaining({ packageId: PKG_ID }), expect.anything(), { force: true });
         });
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.19.0",
+  "version": "0.19.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"