@peers-app/peers-sdk 0.21.0 → 0.21.2

package/dist/contracts/system-contracts.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerSystemContract = registerSystemContract;
+exports.installSystemContracts = installSystemContracts;
+exports.listSystemContracts = listSystemContracts;
+exports._clearSystemContractsForTests = _clearSystemContractsForTests;
+const systemContracts = [];
+function systemContractKey(contractId, version) {
+    return `${contractId}@${version}`;
+}
+/**
+ * Self-register a built-in system contract.
+ *
+ * Call once from the contract module (side effect at import). Later
+ * {@link installSystemContracts} installs every registered entry into a
+ * concrete registry. New system contracts only need this one call.
+ */
+function registerSystemContract(registration) {
+    if (registration.resolve) {
+        if (!registration.contractId || registration.version == null) {
+            throw new Error("registerSystemContract: contractId and version are required when resolve is provided");
+        }
+        // Defer resolver registration so self-registration during SDK barrel / package-loader
+        // import cannot re-enter contract-resolvers mid-initialization.
+        const { contractId, version, resolve } = registration;
+        queueMicrotask(() => {
+            const { registerContractResolver } = require("./contract-resolvers");
+            registerContractResolver(contractId, version, resolve);
+        });
+    }
+    const key = registration.contractId && registration.version != null
+        ? systemContractKey(registration.contractId, registration.version)
+        : undefined;
+    if (key) {
+        const existingIdx = systemContracts.findIndex((entry) => entry.contractId &&
+            entry.version != null &&
+            systemContractKey(entry.contractId, entry.version) === key);
+        if (existingIdx >= 0) {
+            systemContracts[existingIdx] = registration;
+            return;
+        }
+    }
+    systemContracts.push(registration);
+}
+/**
+ * Register every known system contract into `registry` as a provider.
+ * Safe to call more than once for the same registry (provider updates in place).
+ */
+function installSystemContracts(registry) {
+    for (const entry of systemContracts) {
+        const definition = entry.getDefinition();
+        const result = registry.register(entry.providerPackageId, definition);
+        if (!result.valid) {
+            console.error(`[SystemContracts] Failed to register ${definition.name} (${definition.contractId}@${definition.version}):`, result.errors);
+        }
+    }
+}
+/** Snapshot of registered system contracts (for tests and diagnostics). */
+function listSystemContracts() {
+    return systemContracts;
+}
+/**
+ * Clear the system-contract catalog. Test-only — production code must not call this.
+ *
+ * @internal
+ */
+function _clearSystemContractsForTests() {
+    systemContracts.length = 0;
+}

package/dist/contracts/types.d.ts

@@ -4,6 +4,7 @@ import type { IToolInstance } from "../data/tools";
 import type { Event } from "../events";
 import type { Observable } from "../observable";
 import type { FieldType, IField } from "../types/field-type";
+import type { IContractConsumer, IContractConsumerBase } from "./contract-proxy";
 /**
  * A versioned interface definition declaring the shape of tables, tools,
  * observables, and events that a package provides. Pure data — no executable code.
@@ -58,6 +59,43 @@ export interface IContractEvent {
     /** Shape of the payload delivered to subscribers when the event fires. */
     payloadFields: IField[];
 }
+/**
+ * Options for {@link PackageBuilder.consumes}.
+ *
+ * Provider selection (`providerPackageIds`, `fallbackToDefaultProvider`) is
+ * recorded here for the package-loader; wiring that resolves the deferred
+ * handle is a follow-up step.
+ */
+export interface IConsumedContractOptions {
+    /**
+     * When true, a missing provider settles the handle with `undefined` instead
+     * of rejecting. Defaults to false (required).
+     */
+    optional?: boolean;
+    /**
+     * Ordered preference of provider package IDs. The loader tries these in
+     * order before considering the active/default provider.
+     */
+    providerPackageIds?: string[];
+    /**
+     * When true and none of {@link providerPackageIds} is available, fall back
+     * to the active/default provider for the contract. Ignored when
+     * `providerPackageIds` is omitted (default provider is used directly).
+     */
+    fallbackToDefaultProvider?: boolean;
+}
+/**
+ * Deferred handle returned by {@link PackageBuilder.consumes}.
+ *
+ * The handle itself is not thenable — await {@link consumer} from runtime
+ * code after `definePackage` finishes, not inside the define callback.
+ * Settlement is owned by the SDK (package-loader); package code cannot
+ * resolve or reject the promise.
+ */
+export interface IConsumedContractHandle<T extends IContractConsumerBase | undefined = IContractConsumer> {
+    /** Resolves to the live consumer proxy, or `undefined` when optional and unmatched. */
+    readonly consumer: Promise<T>;
+}
 /**
  * A reference to a contract that a package wants to consume.
  * Recorded during `definePackage` and checked at install time.
@@ -66,6 +104,12 @@ export interface IConsumedContract {
     contractId: string;
     version: number;
     optional?: boolean;
+    /** Ordered preferred provider package IDs, if any. */
+    providerPackageIds?: string[];
+    /** Whether to fall back to the default provider when preferred ones are missing. */
+    fallbackToDefaultProvider?: boolean;
+    /** Deferred handle returned by `consumes()` for this dependency. */
+    handle?: IConsumedContractHandle<IContractConsumerBase | undefined>;
 }
 /**
  * Declares that the owning contract's implementation also satisfies another

package/dist/package-installer/index.d.ts

@@ -1,3 +1,4 @@
+export * from "./package-author-signer";
 export * from "./package-author-signing";
 export * from "./package-cloner";
 export * from "./package-creator";

package/dist/package-installer/index.js

@@ -14,6 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./package-author-signer"), exports);
 __exportStar(require("./package-author-signing"), exports);
 __exportStar(require("./package-cloner"), exports);
 __exportStar(require("./package-creator"), exports);

package/dist/package-installer/package-author-signer.d.ts

@@ -0,0 +1,25 @@
+import { type AuthorSignableFields } from "./package-author-signing";
+/**
+ * Load and decrypt the package author signing secret key from the user's personal group.
+ * Returns `undefined` when the key is missing or cannot be decrypted.
+ *
+ * @param packageId - Package whose `packageSigningKey_<id>` secret pvar to load
+ * @param getUserSecretKey - Platform callback that returns the signed-in user's secret key
+ */
+export declare function loadPackageSigningKey(packageId: string, getUserSecretKey: () => Promise<string>): Promise<string | undefined>;
+/**
+ * Sign a package version with the package author's key.
+ *
+ * Safe to call from Electron (main process) or PWA (single-process client). The
+ * signing key is loaded from a secret persistent variable and never returned to
+ * callers — only the detached signature is.
+ *
+ * Returns the base64url detached signature, or `undefined` if the signing key
+ * isn't available or signing fails. Callers that require a signature (e.g.
+ * remote publish) should treat `undefined` as an error; create/promote may leave
+ * `packageAuthorSignature` unset.
+ *
+ * @param pvFields - Author-signable PackageVersion fields
+ * @param getUserSecretKey - Platform callback that returns the signed-in user's secret key
+ */
+export declare function trySignPackageAuthorVersion(pvFields: AuthorSignableFields, getUserSecretKey: () => Promise<string>): Promise<string | undefined>;

package/dist/package-installer/package-author-signer.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadPackageSigningKey = loadPackageSigningKey;
+exports.trySignPackageAuthorVersion = trySignPackageAuthorVersion;
+const user_context_singleton_1 = require("../context/user-context-singleton");
+const persistent_vars_1 = require("../data/persistent-vars");
+const keys_1 = require("../keys");
+const package_author_signing_1 = require("./package-author-signing");
+/**
+ * Load and decrypt the package author signing secret key from the user's personal group.
+ * Returns `undefined` when the key is missing or cannot be decrypted.
+ *
+ * @param packageId - Package whose `packageSigningKey_<id>` secret pvar to load
+ * @param getUserSecretKey - Platform callback that returns the signed-in user's secret key
+ */
+async function loadPackageSigningKey(packageId, getUserSecretKey) {
+    try {
+        const userContext = await (0, user_context_singleton_1.getUserContext)();
+        const secretKey = await getUserSecretKey();
+        const keyName = `${package_author_signing_1.PACKAGE_SIGNING_KEY_PREFIX}${packageId}`;
+        const keyPvar = await (0, persistent_vars_1.PersistentVars)(userContext.userDataContext).findOne({ name: keyName });
+        if (!keyPvar?.value?.value || !keyPvar.isSecret) {
+            return undefined;
+        }
+        return (0, keys_1.decryptData)(keyPvar.value.value, secretKey) || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Sign a package version with the package author's key.
+ *
+ * Safe to call from Electron (main process) or PWA (single-process client). The
+ * signing key is loaded from a secret persistent variable and never returned to
+ * callers — only the detached signature is.
+ *
+ * Returns the base64url detached signature, or `undefined` if the signing key
+ * isn't available or signing fails. Callers that require a signature (e.g.
+ * remote publish) should treat `undefined` as an error; create/promote may leave
+ * `packageAuthorSignature` unset.
+ *
+ * @param pvFields - Author-signable PackageVersion fields
+ * @param getUserSecretKey - Platform callback that returns the signed-in user's secret key
+ */
+async function trySignPackageAuthorVersion(pvFields, getUserSecretKey) {
+    try {
+        const signingKey = await loadPackageSigningKey(pvFields.packageId, getUserSecretKey);
+        if (!signingKey) {
+            return undefined;
+        }
+        return (0, package_author_signing_1.signPackageAuthor)(pvFields, signingKey);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/package-installer/package-installer.d.ts

@@ -1,4 +1,5 @@
 import type { DataContext } from "../context/data-context";
+import type { IPackageVersion } from "../data/package-versions";
 import type { IInstallOpts, IInstallResult, IPackageInfo, IPackageInstallerDeps } from "./types";
 /**
  * Install or update a dev PackageVersion from locally-built bundle files.
@@ -9,6 +10,20 @@ import type { IInstallOpts, IInstallResult, IPackageInfo, IPackageInstallerDeps
  * triggers the package loader and device version resolution.
  */
 export declare function installPackageFromBundles(dataContext: DataContext, deps: IPackageInstallerDeps, packageId: string, opts?: IInstallOpts): Promise<IInstallResult>;
+/**
+ * Ensure a PackageVersion has `appNavs` from its package definition.
+ * No-ops when appNavs are already present or the package cannot be loaded.
+ *
+ * Used to repair PVs that were created with `skipLoad` (startup sync while the
+ * group was not on `dev`) and later activated/promoted without nav metadata.
+ *
+ * @param dataContext - Group or personal data context holding the PV
+ * @param deps - Filesystem / path helpers
+ * @param packageId - Package that owns the version
+ * @param packageVersionId - Specific PV to repair
+ * @returns The PV after any update, or `undefined` if not found
+ */
+export declare function ensurePackageVersionAppNavs(dataContext: DataContext, deps: IPackageInstallerDeps, packageId: string, packageVersionId: string): Promise<IPackageVersion | undefined>;
 /**
  * Install bundles for all non-disabled packages in a data context.
  * Errors are caught per-package so one failure doesn't block others.
@@ -30,3 +45,15 @@ export declare function saveBundleFile(dataContext: DataContext, content: string
  * Uses `deps.fs.readJson` instead of `require()` — no cache issues.
  */
 export declare function getPackageInfo(deps: IPackageInstallerDeps, localPath: string): Promise<IPackageInfo>;
+/**
+ * Resolve the local filesystem path for a package based on device vars.
+ * Awaits the loading promise to ensure the DB-stored value is available
+ * before reading. Falls back to paths from other data contexts on this device,
+ * then to `{packagesRootDir}/{name-slug}` when that directory exists.
+ *
+ * @param packageId - Package to resolve
+ * @param dataContext - Preferred data context for the `packageLocalPath_*` device var
+ * @param deps - Filesystem / path helpers used by the package installer
+ * @returns Absolute (or deps-resolved) path to the package directory
+ */
+export declare function getPackageLocalPath(packageId: string, dataContext: DataContext, deps: IPackageInstallerDeps): Promise<string>;

package/dist/package-installer/package-installer.js

@@ -1,15 +1,18 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.installPackageFromBundles = installPackageFromBundles;
+exports.ensurePackageVersionAppNavs = ensurePackageVersionAppNavs;
 exports.installAllPackageBundles = installAllPackageBundles;
 exports.saveBundleFile = saveBundleFile;
 exports.getPackageInfo = getPackageInfo;
+exports.getPackageLocalPath = getPackageLocalPath;
 const file_types_1 = require("../data/files/file.types");
 const files_1 = require("../data/files/files");
 const package_version_resolver_1 = require("../data/package-version-resolver");
 const package_versions_1 = require("../data/package-versions");
 const packages_1 = require("../data/packages");
 const persistent_vars_1 = require("../data/persistent-vars");
+const rpc_types_1 = require("../rpc-types");
 const utils_1 = require("../utils");
 /**
  * Install or update a dev PackageVersion from locally-built bundle files.
@@ -50,14 +53,22 @@ async function installPackageFromBundles(dataContext, deps, packageId, opts) {
     const uiHash = uiBundle ? (0, file_types_1.computeFileHash)(uiBundle) : undefined;
     // 5. Compute PV hash
     const pvHash = (0, package_versions_1.computePackageVersionHash)(version, "", packageHash, routesHash, uiHash);
-    // 6. Early exit if unchanged
+    // 6. Early exit if unchanged (still repair missing appNavs — see syncDevBundles skipLoad)
     const pvTable = (0, package_versions_1.PackageVersions)(dataContext);
     const existingPv = await pvTable.findOne({ packageId, versionTag });
     if (existingPv && existingPv.packageVersionHash === pvHash) {
+        if (existingPv.appNavs?.length) {
+            return {
+                packageVersion: existingPv,
+                loaded: undefined,
+                unchanged: true,
+            };
+        }
+        const loaded = await loadAndPersistAppNavs(dataContext, packageId, existingPv, localPath);
         return {
             packageVersion: existingPv,
-            loaded: undefined,
-            unchanged: true,
+            loaded,
+            unchanged: !loaded?.appNavs?.length,
         };
     }
     // 7. Save bundle files (deduped by hash)
@@ -91,22 +102,13 @@ async function installPackageFromBundles(dataContext, deps, packageId, opts) {
         createdAt: now,
     };
     const savedPv = await pvTable.signAndSave(pv);
-    // 9. Load package (unless skipLoad)
+    // 9. Load package for in-memory use and/or appNavs backfill.
+    // `skipLoad` is used by startup sync when the group is not on `dev` (avoid
+    // activating), but we must still persist appNavs or the apps list stays empty
+    // after that PV is later activated/promoted.
     let loaded;
-    if (!opts?.skipLoad) {
-        const pkg = await (0, packages_1.Packages)(dataContext).get(packageId);
-        if (pkg) {
-            loaded = await dataContext.packageLoader.loadPackage(pkg, {
-                force: true,
-                localPath,
-                packageVersionId: savedPv.packageVersionId,
-            });
-            // Extract appNavs from loaded instance onto the PV
-            if (loaded?.appNavs && JSON.stringify(loaded.appNavs) !== JSON.stringify(savedPv.appNavs)) {
-                savedPv.appNavs = loaded.appNavs;
-                await pvTable.signAndSave(savedPv);
-            }
-        }
+    if (!opts?.skipLoad || !savedPv.appNavs?.length) {
+        loaded = await loadAndPersistAppNavs(dataContext, packageId, savedPv, localPath);
     }
     // 10. Update package record if needed (description, first-install activation)
     const pkg = await (0, packages_1.Packages)(dataContext).get(packageId);
@@ -134,6 +136,69 @@ async function installPackageFromBundles(dataContext, deps, packageId, opts) {
     }
     return { packageVersion: savedPv, loaded, unchanged: false };
 }
+/**
+ * Load a package bundle and persist `appNavs` onto the PackageVersion when the
+ * definition provides them.
+ *
+ * If the PV already has a `packageAuthorSignature`, refresh it (or clear it when
+ * the signing key is unavailable) because `appNavs` is part of the author-signed
+ * payload.
+ */
+async function loadAndPersistAppNavs(dataContext, packageId, pv, localPath) {
+    const pkg = await (0, packages_1.Packages)(dataContext).get(packageId);
+    if (!pkg)
+        return undefined;
+    const loaded = await dataContext.packageLoader.loadPackage(pkg, {
+        force: true,
+        localPath,
+        packageVersionId: pv.packageVersionId,
+    });
+    if (!loaded?.appNavs?.length)
+        return loaded;
+    if (JSON.stringify(loaded.appNavs) === JSON.stringify(pv.appNavs))
+        return loaded;
+    pv.appNavs = loaded.appNavs;
+    if (pv.packageAuthorSignature) {
+        const authorSig = await rpc_types_1.rpcServerCalls.signPackageAuthorVersion({
+            packageId: pv.packageId,
+            packageVersionId: pv.packageVersionId,
+            version: pv.version,
+            versionTag: pv.versionTag ?? "",
+            packageBundleFileHash: pv.packageBundleFileHash,
+            routesBundleFileHash: pv.routesBundleFileHash,
+            uiBundleFileHash: pv.uiBundleFileHash,
+            appNavs: pv.appNavs,
+            createdBy: pv.createdBy,
+            createdAt: pv.createdAt,
+        });
+        pv.packageAuthorSignature = authorSig;
+    }
+    await (0, package_versions_1.PackageVersions)(dataContext).signAndSave(pv);
+    return loaded;
+}
+/**
+ * Ensure a PackageVersion has `appNavs` from its package definition.
+ * No-ops when appNavs are already present or the package cannot be loaded.
+ *
+ * Used to repair PVs that were created with `skipLoad` (startup sync while the
+ * group was not on `dev`) and later activated/promoted without nav metadata.
+ *
+ * @param dataContext - Group or personal data context holding the PV
+ * @param deps - Filesystem / path helpers
+ * @param packageId - Package that owns the version
+ * @param packageVersionId - Specific PV to repair
+ * @returns The PV after any update, or `undefined` if not found
+ */
+async function ensurePackageVersionAppNavs(dataContext, deps, packageId, packageVersionId) {
+    const pv = await (0, package_versions_1.PackageVersions)(dataContext).get(packageVersionId);
+    if (!pv)
+        return undefined;
+    if (pv.appNavs?.length)
+        return pv;
+    const localPath = await getPackageLocalPath(packageId, dataContext, deps);
+    await loadAndPersistAppNavs(dataContext, packageId, pv, localPath);
+    return pv;
+}
 /**
  * Install bundles for all non-disabled packages in a data context.
  * Errors are caught per-package so one failure doesn't block others.
@@ -247,6 +312,11 @@ function packageNameToFolderSlug(name) {
  * Awaits the loading promise to ensure the DB-stored value is available
  * before reading. Falls back to paths from other data contexts on this device,
  * then to `{packagesRootDir}/{name-slug}` when that directory exists.
+ *
+ * @param packageId - Package to resolve
+ * @param dataContext - Preferred data context for the `packageLocalPath_*` device var
+ * @param deps - Filesystem / path helpers used by the package installer
+ * @returns Absolute (or deps-resolved) path to the package directory
  */
 async function getPackageLocalPath(packageId, dataContext, deps) {
     const candidates = [];

package/dist/package-installer/package-installer.test.js

@@ -440,6 +440,55 @@ describe("installPackageFromBundles", () => {
         const secondCall = mockSignAndSavePV.mock.calls[1][0];
         expect(secondCall.appNavs).toEqual(appNavs);
     });
+    it("backfills appNavs even when skipLoad is true", async () => {
+        const { deps } = setupBasicInstall();
+        const appNavs = [{ name: "App", iconClassName: "bi bi-app", navigationPath: "app" }];
+        const mockLoadPackage = jest.fn().mockResolvedValue({ packageId, appNavs });
+        const dc = mockDataContext({
+            packageLoader: { loadPackage: mockLoadPackage },
+        });
+        await (0, package_installer_1.installPackageFromBundles)(dc, deps, packageId, {
+            skipLoad: true,
+            skipResolve: true,
+        });
+        expect(mockLoadPackage).toHaveBeenCalled();
+        expect(mockSignAndSavePV).toHaveBeenCalledTimes(2);
+        expect(mockSignAndSavePV.mock.calls[1][0].appNavs).toEqual(appNavs);
+    });
+    it("repairs missing appNavs on unchanged early-return", async () => {
+        const { deps } = setupBasicInstall();
+        const packageHash = (0, file_types_1.computeFileHash)(packageBundle);
+        const routesHash = (0, file_types_1.computeFileHash)(routesBundle);
+        const uiHash = (0, file_types_1.computeFileHash)(uiBundle);
+        const { computePackageVersionHash } = jest.requireActual("../data/package-versions");
+        const expectedPvHash = computePackageVersionHash("1.2.3", "", packageHash, routesHash, uiHash);
+        const appNavs = [{ name: "App", iconClassName: "bi bi-app", navigationPath: "app" }];
+        mockFindOnePV.mockResolvedValue({
+            packageVersionId: (0, utils_1.newid)(),
+            packageId,
+            version: "1.2.3",
+            versionTag: "dev",
+            packageVersionHash: expectedPvHash,
+            packageBundleFileHash: packageHash,
+            routesBundleFileHash: routesHash,
+            uiBundleFileHash: uiHash,
+            appNavs: undefined,
+            signature: "sig",
+            createdBy: "user1",
+            createdAt: "2024-01-01T00:00:00.000Z",
+        });
+        const mockLoadPackage = jest.fn().mockResolvedValue({ packageId, appNavs });
+        const dc = mockDataContext({
+            packageLoader: { loadPackage: mockLoadPackage },
+        });
+        const result = await (0, package_installer_1.installPackageFromBundles)(dc, deps, packageId, {
+            skipLoad: true,
+            skipResolve: true,
+        });
+        expect(mockLoadPackage).toHaveBeenCalled();
+        expect(result.packageVersion.appNavs).toEqual(appNavs);
+        expect(mockSignAndSavePV).toHaveBeenCalledTimes(1);
+    });
     it("calls updatePackagePrefs and resolveDevicePackageVersion when skipResolve is false", async () => {
         const { deps } = setupBasicInstall();
         const dc = mockDataContext();

package/dist/package-installer/types.d.ts

@@ -47,7 +47,7 @@ export interface IInstallOpts {
     localPath?: string;
     /** Version tag for the created PackageVersion. Defaults to `"dev"`. */
     versionTag?: string;
-    /** Skip `packageLoader.loadPackage` (useful for batch installs). */
+    /** Skip keeping the package in the loader cache for activation. AppNavs are still backfilled when missing. */
     skipLoad?: boolean;
     /** Skip `resolveDevicePackageVersion` after install. */
     skipResolve?: boolean;

package/dist/package-loader/contract-package-loader.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-loader/contract-package-loader.test.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+jest.mock("../data/tools", () => ({
+    Tools: () => ({
+        save: jest.fn().mockResolvedValue(undefined),
+    }),
+}));
+jest.mock("../tools", () => ({
+    registerTool: jest.fn(),
+}));
+jest.mock("../data/assistants", () => ({
+    Assistants: () => ({
+        save: jest.fn().mockResolvedValue(undefined),
+    }),
+}));
+const registry_1 = require("../contracts/registry");
+const utils_1 = require("../utils");
+const contract_package_loader_1 = require("./contract-package-loader");
+describe("installContractPackage registry wiring", () => {
+    const packageId = (0, utils_1.newid)();
+    const contractId = (0, utils_1.newid)();
+    function makeDefinition(overrides = {}) {
+        return {
+            packageId,
+            version: "1.0.0",
+            contracts: [
+                {
+                    contractId,
+                    version: 1,
+                    devTag: "dev",
+                    name: "Test Contract",
+                    description: "For registry install tests",
+                    tables: [],
+                    tools: [],
+                    observables: [],
+                    events: [],
+                },
+            ],
+            consumes: [],
+            alsoImplements: new Map(),
+            assistants: [],
+            appNavs: [],
+            toolInstances: [],
+            tableDefinitions: [],
+            ...overrides,
+        };
+    }
+    function mockDataContext() {
+        return {
+            dataContextId: "test-ctx",
+            tableContainer: {
+                registerTableDefinition: jest.fn(),
+            },
+        };
+    }
+    it("registers contract providers into the provided ContractRegistry", async () => {
+        const registry = new registry_1.ContractRegistry();
+        const dataContext = mockDataContext();
+        const definition = makeDefinition();
+        await (0, contract_package_loader_1.installContractPackage)(dataContext, definition, { registry });
+        expect(registry.resolve(contractId, 1)?.name).toBe("Test Contract");
+        expect(registry.getProviderPackageId(contractId, 1)).toBe(packageId);
+        expect(registry.getContractKeysForPackage(packageId)).toEqual([`${contractId}@1`]);
+    });
+    it("does not register providers when no registry is provided", async () => {
+        const dataContext = mockDataContext();
+        await expect((0, contract_package_loader_1.installContractPackage)(dataContext, makeDefinition())).resolves.toBeUndefined();
+    });
+});
+describe("extractPackageDefinition", () => {
+    it("returns a package definition when packageId and contracts are present", () => {
+        const packageId = (0, utils_1.newid)();
+        const def = {
+            packageId,
+            contracts: [],
+            consumes: [],
+            alsoImplements: new Map(),
+            assistants: [],
+            appNavs: [],
+            toolInstances: [],
+            tableDefinitions: [],
+        };
+        expect((0, contract_package_loader_1.extractPackageDefinition)({ packageDefinition: def })).toBe(def);
+    });
+    it("returns undefined when packageDefinition is missing", () => {
+        expect((0, contract_package_loader_1.extractPackageDefinition)({})).toBeUndefined();
+    });
+});

package/dist/package-loader/package-loader.d.ts

@@ -1,6 +1,8 @@
 import type { DataContext } from "../context/data-context";
+import { ContractRegistry } from "../contracts/registry";
 import { type IPackage } from "../data/packages";
 import type { IPeersPackage } from "../types/peers-package";
+import "../contracts/system";
 export declare class PackageLoader {
     readonly dataContext: DataContext;
     static PeersSDK: any;
@@ -8,6 +10,12 @@ export declare class PackageLoader {
     private packageInstances;
     /** Packages that were installed via the contract-based path (tools/assistants/tables already saved with packageId). */
     private contractInstalledPackages;
+    /**
+     * In-memory contract providers for this data context. Seeded with system
+     * contracts at construction; package providers are added via
+     * {@link installContractPackage}.
+     */
+    readonly contractRegistry: ContractRegistry;
     require: (<T>(module: string) => T) | undefined;
     constructor(dataContext: DataContext);
     /** Returns true if a package was installed via the contract-based definePackage() path. */
@@ -23,9 +31,9 @@ export declare class PackageLoader {
     private _readLocalBundle;
     /**
      * Post-correction: if the package definition carries a version string,
-     * update the active IPackageVersion record to match. This fixes cases where
-     * the PV record was created with stale or placeholder values (e.g. "0.0.1")
-     * before the bundle was evaluated.
+     * update the active IPackageVersion record to match — but only when that
+     * active version is the mutable `dev` working copy. Never rewrite
+     * beta/stable version labels from a local package.json bump.
      */
     private correctPackageVersion;
     private _evaluateBundle;