@peers-app/peers-sdk 0.21.0 → 0.21.1

package/dist/package-installer/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./package-author-signer";
 export * from "./package-author-signing";
 export * from "./package-cloner";
 export * from "./package-creator";

package/dist/package-installer/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./package-author-signer"), exports);
 __exportStar(require("./package-author-signing"), exports);
 __exportStar(require("./package-cloner"), exports);
 __exportStar(require("./package-creator"), exports);

package/dist/package-installer/package-author-signer.d.ts

@@ -0,0 +1,25 @@
+import { type AuthorSignableFields } from "./package-author-signing";
+/**
+ * Load and decrypt the package author signing secret key from the user's personal group.
+ * Returns `undefined` when the key is missing or cannot be decrypted.
+ *
+ * @param packageId - Package whose `packageSigningKey_<id>` secret pvar to load
+ * @param getUserSecretKey - Platform callback that returns the signed-in user's secret key
+ */
+export declare function loadPackageSigningKey(packageId: string, getUserSecretKey: () => Promise<string>): Promise<string | undefined>;
+/**
+ * Sign a package version with the package author's key.
+ *
+ * Safe to call from Electron (main process) or PWA (single-process client). The
+ * signing key is loaded from a secret persistent variable and never returned to
+ * callers — only the detached signature is.
+ *
+ * Returns the base64url detached signature, or `undefined` if the signing key
+ * isn't available or signing fails. Callers that require a signature (e.g.
+ * remote publish) should treat `undefined` as an error; create/promote may leave
+ * `packageAuthorSignature` unset.
+ *
+ * @param pvFields - Author-signable PackageVersion fields
+ * @param getUserSecretKey - Platform callback that returns the signed-in user's secret key
+ */
+export declare function trySignPackageAuthorVersion(pvFields: AuthorSignableFields, getUserSecretKey: () => Promise<string>): Promise<string | undefined>;

package/dist/package-installer/package-author-signer.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadPackageSigningKey = loadPackageSigningKey;
+exports.trySignPackageAuthorVersion = trySignPackageAuthorVersion;
+const user_context_singleton_1 = require("../context/user-context-singleton");
+const persistent_vars_1 = require("../data/persistent-vars");
+const keys_1 = require("../keys");
+const package_author_signing_1 = require("./package-author-signing");
+/**
+ * Load and decrypt the package author signing secret key from the user's personal group.
+ * Returns `undefined` when the key is missing or cannot be decrypted.
+ *
+ * @param packageId - Package whose `packageSigningKey_<id>` secret pvar to load
+ * @param getUserSecretKey - Platform callback that returns the signed-in user's secret key
+ */
+async function loadPackageSigningKey(packageId, getUserSecretKey) {
+    try {
+        const userContext = await (0, user_context_singleton_1.getUserContext)();
+        const secretKey = await getUserSecretKey();
+        const keyName = `${package_author_signing_1.PACKAGE_SIGNING_KEY_PREFIX}${packageId}`;
+        const keyPvar = await (0, persistent_vars_1.PersistentVars)(userContext.userDataContext).findOne({ name: keyName });
+        if (!keyPvar?.value?.value || !keyPvar.isSecret) {
+            return undefined;
+        }
+        return (0, keys_1.decryptData)(keyPvar.value.value, secretKey) || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Sign a package version with the package author's key.
+ *
+ * Safe to call from Electron (main process) or PWA (single-process client). The
+ * signing key is loaded from a secret persistent variable and never returned to
+ * callers — only the detached signature is.
+ *
+ * Returns the base64url detached signature, or `undefined` if the signing key
+ * isn't available or signing fails. Callers that require a signature (e.g.
+ * remote publish) should treat `undefined` as an error; create/promote may leave
+ * `packageAuthorSignature` unset.
+ *
+ * @param pvFields - Author-signable PackageVersion fields
+ * @param getUserSecretKey - Platform callback that returns the signed-in user's secret key
+ */
+async function trySignPackageAuthorVersion(pvFields, getUserSecretKey) {
+    try {
+        const signingKey = await loadPackageSigningKey(pvFields.packageId, getUserSecretKey);
+        if (!signingKey) {
+            return undefined;
+        }
+        return (0, package_author_signing_1.signPackageAuthor)(pvFields, signingKey);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/package-installer/package-installer.d.ts

@@ -1,4 +1,5 @@
 import type { DataContext } from "../context/data-context";
+import type { IPackageVersion } from "../data/package-versions";
 import type { IInstallOpts, IInstallResult, IPackageInfo, IPackageInstallerDeps } from "./types";
 /**
  * Install or update a dev PackageVersion from locally-built bundle files.
@@ -9,6 +10,20 @@ import type { IInstallOpts, IInstallResult, IPackageInfo, IPackageInstallerDeps
  * triggers the package loader and device version resolution.
  */
 export declare function installPackageFromBundles(dataContext: DataContext, deps: IPackageInstallerDeps, packageId: string, opts?: IInstallOpts): Promise<IInstallResult>;
+/**
+ * Ensure a PackageVersion has `appNavs` from its package definition.
+ * No-ops when appNavs are already present or the package cannot be loaded.
+ *
+ * Used to repair PVs that were created with `skipLoad` (startup sync while the
+ * group was not on `dev`) and later activated/promoted without nav metadata.
+ *
+ * @param dataContext - Group or personal data context holding the PV
+ * @param deps - Filesystem / path helpers
+ * @param packageId - Package that owns the version
+ * @param packageVersionId - Specific PV to repair
+ * @returns The PV after any update, or `undefined` if not found
+ */
+export declare function ensurePackageVersionAppNavs(dataContext: DataContext, deps: IPackageInstallerDeps, packageId: string, packageVersionId: string): Promise<IPackageVersion | undefined>;
 /**
  * Install bundles for all non-disabled packages in a data context.
  * Errors are caught per-package so one failure doesn't block others.
@@ -30,3 +45,15 @@ export declare function saveBundleFile(dataContext: DataContext, content: string
  * Uses `deps.fs.readJson` instead of `require()` — no cache issues.
  */
 export declare function getPackageInfo(deps: IPackageInstallerDeps, localPath: string): Promise<IPackageInfo>;
+/**
+ * Resolve the local filesystem path for a package based on device vars.
+ * Awaits the loading promise to ensure the DB-stored value is available
+ * before reading. Falls back to paths from other data contexts on this device,
+ * then to `{packagesRootDir}/{name-slug}` when that directory exists.
+ *
+ * @param packageId - Package to resolve
+ * @param dataContext - Preferred data context for the `packageLocalPath_*` device var
+ * @param deps - Filesystem / path helpers used by the package installer
+ * @returns Absolute (or deps-resolved) path to the package directory
+ */
+export declare function getPackageLocalPath(packageId: string, dataContext: DataContext, deps: IPackageInstallerDeps): Promise<string>;

package/dist/package-installer/package-installer.js

@@ -1,15 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.installPackageFromBundles = installPackageFromBundles;
+exports.ensurePackageVersionAppNavs = ensurePackageVersionAppNavs;
 exports.installAllPackageBundles = installAllPackageBundles;
 exports.saveBundleFile = saveBundleFile;
 exports.getPackageInfo = getPackageInfo;
+exports.getPackageLocalPath = getPackageLocalPath;
 const file_types_1 = require("../data/files/file.types");
 const files_1 = require("../data/files/files");
 const package_version_resolver_1 = require("../data/package-version-resolver");
 const package_versions_1 = require("../data/package-versions");
 const packages_1 = require("../data/packages");
 const persistent_vars_1 = require("../data/persistent-vars");
+const rpc_types_1 = require("../rpc-types");
 const utils_1 = require("../utils");
 /**
  * Install or update a dev PackageVersion from locally-built bundle files.
@@ -50,14 +53,22 @@ async function installPackageFromBundles(dataContext, deps, packageId, opts) {
     const uiHash = uiBundle ? (0, file_types_1.computeFileHash)(uiBundle) : undefined;
     // 5. Compute PV hash
     const pvHash = (0, package_versions_1.computePackageVersionHash)(version, "", packageHash, routesHash, uiHash);
-    // 6. Early exit if unchanged
+    // 6. Early exit if unchanged (still repair missing appNavs — see syncDevBundles skipLoad)
     const pvTable = (0, package_versions_1.PackageVersions)(dataContext);
     const existingPv = await pvTable.findOne({ packageId, versionTag });
     if (existingPv && existingPv.packageVersionHash === pvHash) {
+        if (existingPv.appNavs?.length) {
+            return {
+                packageVersion: existingPv,
+                loaded: undefined,
+                unchanged: true,
+            };
+        }
+        const loaded = await loadAndPersistAppNavs(dataContext, packageId, existingPv, localPath);
         return {
             packageVersion: existingPv,
-            loaded: undefined,
-            unchanged: true,
+            loaded,
+            unchanged: !loaded?.appNavs?.length,
         };
     }
     // 7. Save bundle files (deduped by hash)
@@ -91,22 +102,13 @@ async function installPackageFromBundles(dataContext, deps, packageId, opts) {
         createdAt: now,
     };
     const savedPv = await pvTable.signAndSave(pv);
-    // 9. Load package (unless skipLoad)
+    // 9. Load package for in-memory use and/or appNavs backfill.
+    // `skipLoad` is used by startup sync when the group is not on `dev` (avoid
+    // activating), but we must still persist appNavs or the apps list stays empty
+    // after that PV is later activated/promoted.
     let loaded;
-    if (!opts?.skipLoad) {
-        const pkg = await (0, packages_1.Packages)(dataContext).get(packageId);
-        if (pkg) {
-            loaded = await dataContext.packageLoader.loadPackage(pkg, {
-                force: true,
-                localPath,
-                packageVersionId: savedPv.packageVersionId,
-            });
-            // Extract appNavs from loaded instance onto the PV
-            if (loaded?.appNavs && JSON.stringify(loaded.appNavs) !== JSON.stringify(savedPv.appNavs)) {
-                savedPv.appNavs = loaded.appNavs;
-                await pvTable.signAndSave(savedPv);
-            }
-        }
+    if (!opts?.skipLoad || !savedPv.appNavs?.length) {
+        loaded = await loadAndPersistAppNavs(dataContext, packageId, savedPv, localPath);
     }
     // 10. Update package record if needed (description, first-install activation)
     const pkg = await (0, packages_1.Packages)(dataContext).get(packageId);
@@ -134,6 +136,69 @@ async function installPackageFromBundles(dataContext, deps, packageId, opts) {
     }
     return { packageVersion: savedPv, loaded, unchanged: false };
 }
+/**
+ * Load a package bundle and persist `appNavs` onto the PackageVersion when the
+ * definition provides them.
+ *
+ * If the PV already has a `packageAuthorSignature`, refresh it (or clear it when
+ * the signing key is unavailable) because `appNavs` is part of the author-signed
+ * payload.
+ */
+async function loadAndPersistAppNavs(dataContext, packageId, pv, localPath) {
+    const pkg = await (0, packages_1.Packages)(dataContext).get(packageId);
+    if (!pkg)
+        return undefined;
+    const loaded = await dataContext.packageLoader.loadPackage(pkg, {
+        force: true,
+        localPath,
+        packageVersionId: pv.packageVersionId,
+    });
+    if (!loaded?.appNavs?.length)
+        return loaded;
+    if (JSON.stringify(loaded.appNavs) === JSON.stringify(pv.appNavs))
+        return loaded;
+    pv.appNavs = loaded.appNavs;
+    if (pv.packageAuthorSignature) {
+        const authorSig = await rpc_types_1.rpcServerCalls.signPackageAuthorVersion({
+            packageId: pv.packageId,
+            packageVersionId: pv.packageVersionId,
+            version: pv.version,
+            versionTag: pv.versionTag ?? "",
+            packageBundleFileHash: pv.packageBundleFileHash,
+            routesBundleFileHash: pv.routesBundleFileHash,
+            uiBundleFileHash: pv.uiBundleFileHash,
+            appNavs: pv.appNavs,
+            createdBy: pv.createdBy,
+            createdAt: pv.createdAt,
+        });
+        pv.packageAuthorSignature = authorSig;
+    }
+    await (0, package_versions_1.PackageVersions)(dataContext).signAndSave(pv);
+    return loaded;
+}
+/**
+ * Ensure a PackageVersion has `appNavs` from its package definition.
+ * No-ops when appNavs are already present or the package cannot be loaded.
+ *
+ * Used to repair PVs that were created with `skipLoad` (startup sync while the
+ * group was not on `dev`) and later activated/promoted without nav metadata.
+ *
+ * @param dataContext - Group or personal data context holding the PV
+ * @param deps - Filesystem / path helpers
+ * @param packageId - Package that owns the version
+ * @param packageVersionId - Specific PV to repair
+ * @returns The PV after any update, or `undefined` if not found
+ */
+async function ensurePackageVersionAppNavs(dataContext, deps, packageId, packageVersionId) {
+    const pv = await (0, package_versions_1.PackageVersions)(dataContext).get(packageVersionId);
+    if (!pv)
+        return undefined;
+    if (pv.appNavs?.length)
+        return pv;
+    const localPath = await getPackageLocalPath(packageId, dataContext, deps);
+    await loadAndPersistAppNavs(dataContext, packageId, pv, localPath);
+    return pv;
+}
 /**
  * Install bundles for all non-disabled packages in a data context.
  * Errors are caught per-package so one failure doesn't block others.
@@ -247,6 +312,11 @@ function packageNameToFolderSlug(name) {
  * Awaits the loading promise to ensure the DB-stored value is available
  * before reading. Falls back to paths from other data contexts on this device,
  * then to `{packagesRootDir}/{name-slug}` when that directory exists.
+ *
+ * @param packageId - Package to resolve
+ * @param dataContext - Preferred data context for the `packageLocalPath_*` device var
+ * @param deps - Filesystem / path helpers used by the package installer
+ * @returns Absolute (or deps-resolved) path to the package directory
  */
 async function getPackageLocalPath(packageId, dataContext, deps) {
     const candidates = [];

package/dist/package-installer/package-installer.test.js

@@ -440,6 +440,55 @@ describe("installPackageFromBundles", () => {
         const secondCall = mockSignAndSavePV.mock.calls[1][0];
         expect(secondCall.appNavs).toEqual(appNavs);
     });
+    it("backfills appNavs even when skipLoad is true", async () => {
+        const { deps } = setupBasicInstall();
+        const appNavs = [{ name: "App", iconClassName: "bi bi-app", navigationPath: "app" }];
+        const mockLoadPackage = jest.fn().mockResolvedValue({ packageId, appNavs });
+        const dc = mockDataContext({
+            packageLoader: { loadPackage: mockLoadPackage },
+        });
+        await (0, package_installer_1.installPackageFromBundles)(dc, deps, packageId, {
+            skipLoad: true,
+            skipResolve: true,
+        });
+        expect(mockLoadPackage).toHaveBeenCalled();
+        expect(mockSignAndSavePV).toHaveBeenCalledTimes(2);
+        expect(mockSignAndSavePV.mock.calls[1][0].appNavs).toEqual(appNavs);
+    });
+    it("repairs missing appNavs on unchanged early-return", async () => {
+        const { deps } = setupBasicInstall();
+        const packageHash = (0, file_types_1.computeFileHash)(packageBundle);
+        const routesHash = (0, file_types_1.computeFileHash)(routesBundle);
+        const uiHash = (0, file_types_1.computeFileHash)(uiBundle);
+        const { computePackageVersionHash } = jest.requireActual("../data/package-versions");
+        const expectedPvHash = computePackageVersionHash("1.2.3", "", packageHash, routesHash, uiHash);
+        const appNavs = [{ name: "App", iconClassName: "bi bi-app", navigationPath: "app" }];
+        mockFindOnePV.mockResolvedValue({
+            packageVersionId: (0, utils_1.newid)(),
+            packageId,
+            version: "1.2.3",
+            versionTag: "dev",
+            packageVersionHash: expectedPvHash,
+            packageBundleFileHash: packageHash,
+            routesBundleFileHash: routesHash,
+            uiBundleFileHash: uiHash,
+            appNavs: undefined,
+            signature: "sig",
+            createdBy: "user1",
+            createdAt: "2024-01-01T00:00:00.000Z",
+        });
+        const mockLoadPackage = jest.fn().mockResolvedValue({ packageId, appNavs });
+        const dc = mockDataContext({
+            packageLoader: { loadPackage: mockLoadPackage },
+        });
+        const result = await (0, package_installer_1.installPackageFromBundles)(dc, deps, packageId, {
+            skipLoad: true,
+            skipResolve: true,
+        });
+        expect(mockLoadPackage).toHaveBeenCalled();
+        expect(result.packageVersion.appNavs).toEqual(appNavs);
+        expect(mockSignAndSavePV).toHaveBeenCalledTimes(1);
+    });
     it("calls updatePackagePrefs and resolveDevicePackageVersion when skipResolve is false", async () => {
         const { deps } = setupBasicInstall();
         const dc = mockDataContext();

package/dist/package-installer/types.d.ts

@@ -47,7 +47,7 @@ export interface IInstallOpts {
     localPath?: string;
     /** Version tag for the created PackageVersion. Defaults to `"dev"`. */
     versionTag?: string;
-    /** Skip `packageLoader.loadPackage` (useful for batch installs). */
+    /** Skip keeping the package in the loader cache for activation. AppNavs are still backfilled when missing. */
     skipLoad?: boolean;
     /** Skip `resolveDevicePackageVersion` after install. */
     skipResolve?: boolean;

package/dist/package-loader/package-loader.d.ts

@@ -23,9 +23,9 @@ export declare class PackageLoader {
     private _readLocalBundle;
     /**
      * Post-correction: if the package definition carries a version string,
-     * update the active IPackageVersion record to match. This fixes cases where
-     * the PV record was created with stale or placeholder values (e.g. "0.0.1")
-     * before the bundle was evaluated.
+     * update the active IPackageVersion record to match — but only when that
+     * active version is the mutable `dev` working copy. Never rewrite
+     * beta/stable version labels from a local package.json bump.
      */
     private correctPackageVersion;
     private _evaluateBundle;

package/dist/package-loader/package-loader.js

@@ -104,9 +104,9 @@ class PackageLoader {
     }
     /**
      * Post-correction: if the package definition carries a version string,
-     * update the active IPackageVersion record to match. This fixes cases where
-     * the PV record was created with stale or placeholder values (e.g. "0.0.1")
-     * before the bundle was evaluated.
+     * update the active IPackageVersion record to match — but only when that
+     * active version is the mutable `dev` working copy. Never rewrite
+     * beta/stable version labels from a local package.json bump.
      */
     correctPackageVersion(pkg, def) {
         if (!pkg.activePackageVersionId)
@@ -119,8 +119,18 @@ class PackageLoader {
             .then((pv) => {
             if (!pv)
                 return;
+            if (pv.versionTag !== "dev")
+                return;
             if (def.version && pv.version !== def.version) {
-                return pvTable.signAndSave({ ...pv, version: def.version });
+                const packageVersionHash = (0, package_versions_1.computePackageVersionHash)(def.version, pv.versionTag || "dev", pv.packageBundleFileHash, pv.routesBundleFileHash, pv.uiBundleFileHash);
+                // Version is part of both the content hash and the author-signed
+                // payload — clear any prior author signature so it cannot go stale.
+                const { packageAuthorSignature: _staleSig, ...rest } = pv;
+                return pvTable.signAndSave({
+                    ...rest,
+                    version: def.version,
+                    packageVersionHash,
+                });
             }
         })
             .catch((err) => {

package/dist/package-loader/package-loader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-loader/package-loader.test.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mockGet = jest.fn();
+const mockSignAndSave = jest.fn();
+const mockComputePackageVersionHash = jest.fn((version, _tag, packageBundleFileHash, _routesBundleFileHash, _uiBundleFileHash) => `hash-${version}-${packageBundleFileHash}`);
+jest.mock("../data/package-versions", () => ({
+    PackageVersions: () => ({
+        get: (...args) => mockGet(...args),
+        signAndSave: (...args) => mockSignAndSave(...args),
+    }),
+    computePackageVersionHash: (version, versionTag, packageBundleFileHash, routesBundleFileHash, uiBundleFileHash) => mockComputePackageVersionHash(version, versionTag, packageBundleFileHash, routesBundleFileHash, uiBundleFileHash),
+}));
+const package_loader_1 = require("./package-loader");
+describe("PackageLoader.correctPackageVersion", () => {
+    const activePvId = "pv-active";
+    const pkg = {
+        packageId: "pkg-1",
+        name: "Test Package",
+        activePackageVersionId: activePvId,
+    };
+    const def = { version: "0.3.6" };
+    let loader;
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockSignAndSave.mockResolvedValue(undefined);
+        loader = new package_loader_1.PackageLoader({ dataContextId: "ctx" });
+    });
+    async function correctPackageVersion() {
+        loader.correctPackageVersion(pkg, def);
+        // Flush the fire-and-forget promise chain
+        await new Promise((r) => setImmediate(r));
+    }
+    it("updates the active PV hash and clears a stale author signature", async () => {
+        mockGet.mockResolvedValue({
+            packageVersionId: activePvId,
+            version: "0.3.1",
+            versionTag: "dev",
+            packageBundleFileHash: "bundle-hash",
+            routesBundleFileHash: "routes-hash",
+            uiBundleFileHash: "ui-hash",
+            packageAuthorSignature: "stale-sig",
+            packageVersionHash: "old-hash",
+        });
+        await correctPackageVersion();
+        expect(mockComputePackageVersionHash).toHaveBeenCalledWith("0.3.6", "dev", "bundle-hash", "routes-hash", "ui-hash");
+        expect(mockSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
+            packageVersionId: activePvId,
+            version: "0.3.6",
+            versionTag: "dev",
+            packageVersionHash: "hash-0.3.6-bundle-hash",
+        }));
+        expect(mockSignAndSave.mock.calls[0][0].packageAuthorSignature).toBeUndefined();
+    });
+    it("does not update the active PV when it is stable", async () => {
+        mockGet.mockResolvedValue({
+            packageVersionId: activePvId,
+            version: "0.3.5",
+            versionTag: "stable",
+        });
+        await correctPackageVersion();
+        expect(mockSignAndSave).not.toHaveBeenCalled();
+    });
+    it("does not update the active PV when it is beta", async () => {
+        mockGet.mockResolvedValue({
+            packageVersionId: activePvId,
+            version: "0.3.5",
+            versionTag: "beta",
+        });
+        await correctPackageVersion();
+        expect(mockSignAndSave).not.toHaveBeenCalled();
+    });
+    it("does nothing when the active PV version already matches", async () => {
+        mockGet.mockResolvedValue({
+            packageVersionId: activePvId,
+            version: "0.3.6",
+            versionTag: "dev",
+        });
+        await correctPackageVersion();
+        expect(mockSignAndSave).not.toHaveBeenCalled();
+    });
+});

package/dist/rpc-types.d.ts

@@ -2,6 +2,7 @@ import type { IDeviceDatabaseQueryResult, IDeviceOperationStatus, IDeviceToolRun
 import type { ITool } from "./data/tools";
 import type { DevicePairingCeremonyAction, DevicePairingStartDestinationInput, DevicePairingStartSourceResult, DevicePairingState } from "./device-pairing";
 import type { IConsoleLog } from "./logging/console-logs.table";
+import type { IAppNav } from "./types/app-nav";
 /** Named event payload sent across the frontend RPC bridge. */
 export interface IEventData<T = any> {
     name: string;
@@ -115,6 +116,8 @@ export declare const rpcServerCalls: {
     /**
      * Sign a package version with the package author's key (server-side only — key never leaves the server).
      * Returns the base64url detached signature, or undefined if the signing key isn't available.
+     * Optional fields (appNavs, createdBy, createdAt) must match the PV record when present so
+     * propagation verification of the full record succeeds.
      */
     signPackageAuthorVersion: (pvFields: {
         packageId: string;
@@ -124,6 +127,9 @@ export declare const rpcServerCalls: {
         packageBundleFileHash: string;
         routesBundleFileHash?: string;
         uiBundleFileHash?: string;
+        appNavs?: IAppNav[];
+        createdBy?: string;
+        createdAt?: string;
     }) => Promise<string | undefined>;
     registerWithPeersServices: () => Promise<string>;
     appQuit: () => Promise<void>;

package/dist/rpc-types.js

@@ -58,6 +58,8 @@ exports.rpcServerCalls = {
     /**
      * Sign a package version with the package author's key (server-side only — key never leaves the server).
      * Returns the base64url detached signature, or undefined if the signing key isn't available.
+     * Optional fields (appNavs, createdBy, createdAt) must match the PV record when present so
+     * propagation verification of the full record succeeds.
      */
     signPackageAuthorVersion: rpcStub("signPackageAuthorVersion"),
     registerWithPeersServices: rpcStub("registerWithPeersServices"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"