@peers-app/peers-sdk 0.23.14 → 0.24.0

package/dist/invites/invite-token.test.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const group_member_roles_1 = require("../data/group-member-roles");
+const keys_1 = require("../keys");
+const utils_1 = require("../utils");
+const invite_messages_1 = require("./invite-messages");
+const invite_token_1 = require("./invite-token");
+function identity(keys = (0, keys_1.newKeys)()) {
+    return {
+        userId: (0, utils_1.newid)(),
+        publicKey: keys.publicKey,
+        publicBoxKey: keys.publicBoxKey,
+        displayName: "Alice",
+        secretKey: keys.secretKey,
+    };
+}
+function contactToken(inviter = identity(), expiresAt = new Date(Date.now() + 60_000)) {
+    const { secretKey, ...publicIdentity } = inviter;
+    return (0, invite_token_1.createInviteToken)({
+        type: "contact",
+        inviter: publicIdentity,
+        expiresAt: expiresAt.toISOString(),
+        nonce: (0, invite_token_1.newInviteNonce)(),
+        epoch: 0,
+        uses: 1,
+    }, secretKey);
+}
+describe("PeersInvite tokens", () => {
+    it("round-trips through every shareable encoding and verifies the signature", () => {
+        const token = contactToken();
+        const encoded = (0, invite_token_1.encodeInviteToken)(token);
+        expect((0, invite_token_1.parseInviteToken)(encoded)).toEqual(token);
+        expect((0, invite_token_1.parseInviteToken)((0, invite_token_1.inviteUrl)(token))).toEqual(token);
+        expect((0, invite_token_1.parseInviteToken)((0, invite_token_1.inviteDeepLink)(token))).toEqual(token);
+        expect((0, invite_token_1.parseInviteToken)(`https://peers.app/?app#invite=${encoded}`)).toEqual(token);
+        expect((0, invite_token_1.parseInviteToken)(`  ${encoded}\n`)).toEqual(token);
+        expect((0, invite_token_1.extractInviteTokenText)((0, invite_token_1.inviteUrl)(token))).toBe(encoded);
+    });
+    it("rejects tampered contents without echoing the input", () => {
+        const token = contactToken();
+        const tampered = (0, invite_token_1.encodeInviteToken)({ ...token, epoch: token.epoch + 1 });
+        expect(() => (0, invite_token_1.parseInviteToken)(tampered)).toThrow("Invite signature is not valid");
+        expect(() => (0, invite_token_1.parseInviteToken)("not a token")).toThrow("not a valid Peers invite");
+    });
+    it("refuses to sign with a key that is not the inviter's", () => {
+        const inviter = identity();
+        const { secretKey: _ignored, ...publicIdentity } = inviter;
+        expect(() => (0, invite_token_1.createInviteToken)({
+            type: "contact",
+            inviter: publicIdentity,
+            expiresAt: new Date(Date.now() + 1000).toISOString(),
+            nonce: (0, invite_token_1.newInviteNonce)(),
+            epoch: 0,
+            uses: 1,
+        }, (0, keys_1.newKeys)().secretKey)).toThrow("inviter's own key");
+    });
+    it("enforces expiry and type expectations", () => {
+        const expired = contactToken(identity(), new Date(Date.now() - 1000));
+        const encoded = (0, invite_token_1.encodeInviteToken)(expired);
+        expect(() => (0, invite_token_1.parseInviteToken)(encoded)).toThrow("expired");
+        expect((0, invite_token_1.parseInviteToken)(encoded, { allowExpired: true })).toEqual(expired);
+        expect(() => (0, invite_token_1.parseInviteToken)(encoded, { allowExpired: true, expectType: "group" })).toThrow("Expected a group invite");
+    });
+    it("requires group facts exactly when the type is group", () => {
+        const inviter = identity();
+        const { secretKey, ...publicIdentity } = inviter;
+        const base = {
+            inviter: publicIdentity,
+            expiresAt: new Date(Date.now() + 1000).toISOString(),
+            nonce: (0, invite_token_1.newInviteNonce)(),
+            epoch: 0,
+            uses: "unlimited",
+        };
+        expect(() => (0, invite_token_1.createInviteToken)({ ...base, type: "group" }, secretKey)).toThrow();
+        const groupKeys = (0, keys_1.newKeys)();
+        const token = (0, invite_token_1.createInviteToken)({
+            ...base,
+            type: "group",
+            group: {
+                groupId: (0, utils_1.newid)(),
+                name: "Family",
+                publicKey: groupKeys.publicKey,
+                publicBoxKey: groupKeys.publicBoxKey,
+                role: group_member_roles_1.GroupMemberRole.Reader,
+                mode: "open",
+            },
+        }, secretKey);
+        expect((0, invite_token_1.parseInviteToken)((0, invite_token_1.encodeInviteToken)(token), { expectType: "group" }).group?.mode).toBe("open");
+    });
+});
+describe("invite envelopes", () => {
+    it("seals to the recipient and exposes the verified sender keys", () => {
+        const sender = identity();
+        const recipient = identity();
+        const message = invite_messages_1.contactReplySchema.parse({
+            kind: "contact-reply",
+            inviteNonce: (0, invite_token_1.newInviteNonce)(),
+            inviteEpoch: 0,
+            responder: {
+                userId: sender.userId,
+                publicKey: sender.publicKey,
+                publicBoxKey: sender.publicBoxKey,
+            },
+            responderDeviceId: (0, utils_1.newid)(),
+        });
+        const envelope = (0, invite_messages_1.sealInviteEnvelope)(message, {
+            publicKey: sender.publicKey,
+            publicBoxKey: sender.publicBoxKey,
+            secretKey: sender.secretKey,
+        }, { userId: recipient.userId, publicBoxKey: recipient.publicBoxKey });
+        expect(envelope.to).toBe(recipient.userId);
+        expect(JSON.stringify(envelope)).not.toContain(sender.userId);
+        const opened = (0, invite_messages_1.openInviteEnvelope)(envelope, {
+            userId: recipient.userId,
+            secretKey: recipient.secretKey,
+        });
+        expect(opened.message).toEqual(message);
+        expect(opened.senderPublicKey).toBe(sender.publicKey);
+        expect(opened.senderPublicBoxKey).toBe(sender.publicBoxKey);
+        expect(() => (0, invite_messages_1.openInviteEnvelope)(envelope, { userId: (0, utils_1.newid)(), secretKey: recipient.secretKey })).toThrow("different user");
+        expect(() => (0, invite_messages_1.openInviteEnvelope)(envelope, { userId: recipient.userId, secretKey: (0, keys_1.newKeys)().secretKey })).toThrow();
+    });
+});

package/dist/rpc-types.d.ts

@@ -1,6 +1,6 @@
 import type { IDeviceDatabaseQueryResult, IDeviceOperationStatus, IDeviceToolRunInput } from "./contracts/system/device-operations-contract";
 import type { ITool } from "./data/tools";
-import type { DevicePairingCeremonyAction, DevicePairingStartDestinationInput, DevicePairingStartSourceResult, DevicePairingState } from "./device-pairing";
+import type { DevicePairingCeremonyAction, DevicePairingStartDestinationInput, DevicePairingStartSourceInput, DevicePairingState } from "./device-pairing";
 import type { IConsoleLog } from "./logging/console-logs.table";
 import type { IAddOrUpdatePackageResult } from "./package-installer/types";
 import type { IAppNav } from "./types/app-nav";
@@ -66,13 +66,14 @@ export declare const rpcServerCalls: {
     seedBundledPeersCore: (dataContextId?: string) => Promise<boolean>;
     setUserIdAndSecretKey: (userId: string, secretKey: string) => Promise<void>;
     getUserId: () => Promise<string | undefined>;
-    devicePairingStartSource: () => Promise<DevicePairingStartSourceResult>;
-    devicePairingStartDestination: (input: DevicePairingStartDestinationInput) => Promise<DevicePairingState>;
+    /** Signed-in side: joins the room named by a typed or scanned pairing code. */
+    devicePairingStartSource: (input: DevicePairingStartSourceInput) => Promise<DevicePairingState>;
+    /** Signed-out side: creates a room and returns state whose `code` the UI shows as text and QR. */
+    devicePairingStartDestination: (input?: DevicePairingStartDestinationInput) => Promise<DevicePairingState>;
     devicePairingApprove: (input: DevicePairingCeremonyAction) => Promise<DevicePairingState>;
     devicePairingReject: (input: DevicePairingCeremonyAction) => Promise<DevicePairingState>;
     devicePairingCancel: (input: DevicePairingCeremonyAction) => Promise<DevicePairingState>;
     devicePairingGetState: () => Promise<DevicePairingState>;
-    devicePairingGetInvitationUrl: () => Promise<string | undefined>;
     encryptData: (value: string, groupId?: string) => Promise<string>;
     /**
      * Decrypt (if secret) and copy a persistent variable's value to the system clipboard

package/dist/rpc-types.js

@@ -21,13 +21,14 @@ exports.rpcServerCalls = {
     seedBundledPeersCore: rpcStub("seedBundledPeersCore"),
     setUserIdAndSecretKey: rpcStub("setUserIdAndSecretKey"),
     getUserId: rpcStub("getUserId"),
+    /** Signed-in side: joins the room named by a typed or scanned pairing code. */
     devicePairingStartSource: rpcStub("devicePairingStartSource"),
+    /** Signed-out side: creates a room and returns state whose `code` the UI shows as text and QR. */
     devicePairingStartDestination: rpcStub("devicePairingStartDestination"),
     devicePairingApprove: rpcStub("devicePairingApprove"),
     devicePairingReject: rpcStub("devicePairingReject"),
     devicePairingCancel: rpcStub("devicePairingCancel"),
     devicePairingGetState: rpcStub("devicePairingGetState"),
-    devicePairingGetInvitationUrl: rpcStub("devicePairingGetInvitationUrl"),
     encryptData: rpcStub("encryptData"),
     /**
      * Decrypt (if secret) and copy a persistent variable's value to the system clipboard

package/dist/system-ids.d.ts

@@ -17,6 +17,8 @@ export declare const runWorkflowToolId = "000peers0tool0runworkflow";
  * Distinct from Device Operations contract `queryDatabase`.
  */
 export declare const queryDatabaseToolId = "000peers0tool00querydb001";
+/** Stable ID of the `create-group` system tool (creates a group founded by the current user). */
+export declare const createGroupToolId = "000peers0tool0creategroup";
 /** Stable package ID of the bundled peers-core package. */
 export declare const peersCorePackageId = "00mh0wlipjixk2gqmurbwee0o";
 /** Canonical source repository for peers-core. */
@@ -54,3 +56,23 @@ export declare const toolAccessControlToolIds: {
     readonly reject: "000peers0tacreject0000001";
     readonly listPending: "000peers0taclist000000001";
 };
+/**
+ * Contract id for the local-only contact and group invite surface (System Invites).
+ * Not available over device-to-device connections.
+ */
+export declare const invitesContractId = "00mu8uuzvo2zux1wfb9f1r48l";
+/** Stable IDs for tools in System Invites v1. */
+export declare const invitesToolIds: {
+    readonly createContactInvite: "00mu8uuzvqbn5o23ya563wmp5";
+    readonly createGroupInvite: "00mu8uuzvqz17wedq1iqmh9i4";
+    readonly inviteContactToGroup: "00mu8uuzvqhbk5avjpew7w9ng";
+    readonly previewInvite: "00mu8uuzvqwbo180wgz4ctslm";
+    readonly acceptInvite: "00mu8uuzvq8i1boc4ml1ywk30";
+    readonly declineInvite: "00mu8uuzvq97veint1977p2ey";
+    readonly approveJoinRequest: "00mu8uuzvqisozhlfbe1oeo0e";
+    readonly denyJoinRequest: "00mu8uuzvqdars4o466eansi2";
+    readonly revokeInvite: "00mu8uuzvqndg6qdh74dob9j1";
+    readonly regenerateProfileInvite: "00mu8uuzvqbu5ri9octpk64oo";
+    readonly syncMailbox: "00mu8uuzvq4xlaiqrn5notj1j";
+    readonly listInvites: "00mu8uuzvqfego6lyjjkgr4s7";
+};

package/dist/system-ids.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
+exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
 /** Stable user ID that owns built-in Peers system records. */
 exports.peersRootUserId = "000peers0user000000000001";
 /** Default assistant used when no user-selected assistant is available. */
@@ -21,6 +21,8 @@ exports.runWorkflowToolId = "000peers0tool0runworkflow";
  * Distinct from Device Operations contract `queryDatabase`.
  */
 exports.queryDatabaseToolId = "000peers0tool00querydb001";
+/** Stable ID of the `create-group` system tool (creates a group founded by the current user). */
+exports.createGroupToolId = "000peers0tool0creategroup";
 /** Stable package ID of the bundled peers-core package. */
 exports.peersCorePackageId = "00mh0wlipjixk2gqmurbwee0o";
 /** Canonical source repository for peers-core. */
@@ -58,3 +60,23 @@ exports.toolAccessControlToolIds = {
     reject: "000peers0tacreject0000001",
     listPending: "000peers0taclist000000001",
 };
+/**
+ * Contract id for the local-only contact and group invite surface (System Invites).
+ * Not available over device-to-device connections.
+ */
+exports.invitesContractId = "00mu8uuzvo2zux1wfb9f1r48l";
+/** Stable IDs for tools in System Invites v1. */
+exports.invitesToolIds = {
+    createContactInvite: "00mu8uuzvqbn5o23ya563wmp5",
+    createGroupInvite: "00mu8uuzvqz17wedq1iqmh9i4",
+    inviteContactToGroup: "00mu8uuzvqhbk5avjpew7w9ng",
+    previewInvite: "00mu8uuzvqwbo180wgz4ctslm",
+    acceptInvite: "00mu8uuzvq8i1boc4ml1ywk30",
+    declineInvite: "00mu8uuzvq97veint1977p2ey",
+    approveJoinRequest: "00mu8uuzvqisozhlfbe1oeo0e",
+    denyJoinRequest: "00mu8uuzvqdars4o466eansi2",
+    revokeInvite: "00mu8uuzvqndg6qdh74dob9j1",
+    regenerateProfileInvite: "00mu8uuzvqbu5ri9octpk64oo",
+    syncMailbox: "00mu8uuzvq4xlaiqrn5notj1j",
+    listInvites: "00mu8uuzvqfego6lyjjkgr4s7",
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.23.14",
+  "version": "0.24.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"

package/dist/device-pairing/invitation.d.ts

@@ -1,13 +0,0 @@
-import { type DevicePairingInvitation } from "./types";
-/** Creates a five-minute, high-entropy invitation for a signaling service origin. */
-export declare function createDevicePairingInvitation({ serviceOrigin, now, ttlMs, }: {
-    serviceOrigin: string;
-    now?: number;
-    ttlMs?: number;
-}): DevicePairingInvitation;
-/** Encodes an invitation as a versioned token suitable for a URL fragment or manual entry. */
-export declare function encodeDevicePairingInvitation(invitation: DevicePairingInvitation): string;
-/** Parses and validates a versioned invitation token or fragment URL. */
-export declare function parseDevicePairingInvitation(input: string, now?: number): DevicePairingInvitation;
-/** Places the invitation in a URL fragment so it is excluded from HTTP requests and access logs. */
-export declare function createDevicePairingInvitationUrl(invitationBaseUrl: string, invitation: DevicePairingInvitation): string;

package/dist/device-pairing/invitation.js

@@ -1,85 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createDevicePairingInvitation = createDevicePairingInvitation;
-exports.encodeDevicePairingInvitation = encodeDevicePairingInvitation;
-exports.parseDevicePairingInvitation = parseDevicePairingInvitation;
-exports.createDevicePairingInvitationUrl = createDevicePairingInvitationUrl;
-const keys_1 = require("../keys");
-const constants_1 = require("./constants");
-const types_1 = require("./types");
-const INVITATION_TOKEN_PREFIX = "peers-pairing-v1.";
-const textDecoder = new TextDecoder();
-const textEncoder = new TextEncoder();
-function normalizeServiceOrigin(value) {
-    const url = new URL(value);
-    if (url.protocol !== "https:" && url.protocol !== "http:") {
-        throw new Error("Pairing service must use HTTP or HTTPS");
-    }
-    return url.origin;
-}
-function extractInvitationToken(input) {
-    const trimmed = input.trim();
-    if (trimmed.startsWith(INVITATION_TOKEN_PREFIX)) {
-        return trimmed;
-    }
-    try {
-        const url = new URL(trimmed);
-        const fragment = url.hash.slice(1);
-        if (fragment.startsWith("pair=")) {
-            return decodeURIComponent(fragment.slice("pair=".length));
-        }
-        if (fragment.startsWith("pair?")) {
-            const token = new URLSearchParams(fragment.slice("pair?".length)).get("token");
-            if (token) {
-                return token;
-            }
-        }
-    }
-    catch {
-        // The generic error below deliberately avoids echoing invitation input.
-    }
-    throw new Error("Invalid pairing invitation");
-}
-/** Creates a five-minute, high-entropy invitation for a signaling service origin. */
-function createDevicePairingInvitation({ serviceOrigin, now = Date.now(), ttlMs = constants_1.DEVICE_PAIRING_TTL_MS, }) {
-    if (!Number.isSafeInteger(now) || ttlMs <= 0 || ttlMs > constants_1.DEVICE_PAIRING_TTL_MS) {
-        throw new Error("Invalid pairing invitation lifetime");
-    }
-    return types_1.devicePairingInvitationSchema.parse({
-        version: constants_1.DEVICE_PAIRING_PROTOCOL_VERSION,
-        roomId: (0, keys_1.newToken)(16),
-        roomSecret: (0, keys_1.newToken)(32),
-        expiresAt: now + ttlMs,
-        serviceOrigin: normalizeServiceOrigin(serviceOrigin),
-    });
-}
-/** Encodes an invitation as a versioned token suitable for a URL fragment or manual entry. */
-function encodeDevicePairingInvitation(invitation) {
-    const parsed = types_1.devicePairingInvitationSchema.parse(invitation);
-    return `${INVITATION_TOKEN_PREFIX}${(0, keys_1.encodeBase64)(textEncoder.encode(JSON.stringify(parsed)))}`;
-}
-/** Parses and validates a versioned invitation token or fragment URL. */
-function parseDevicePairingInvitation(input, now = Date.now()) {
-    try {
-        const token = extractInvitationToken(input);
-        if (!token.startsWith(INVITATION_TOKEN_PREFIX)) {
-            throw new Error("unsupported");
-        }
-        const encoded = token.slice(INVITATION_TOKEN_PREFIX.length);
-        const parsed = types_1.devicePairingInvitationSchema.parse(JSON.parse(textDecoder.decode((0, keys_1.decodeBase64)(encoded))));
-        if (parsed.expiresAt <= now ||
-            parsed.expiresAt > now + constants_1.DEVICE_PAIRING_TTL_MS + constants_1.DEVICE_PAIRING_CLOCK_SKEW_MS) {
-            throw new Error("expired");
-        }
-        return parsed;
-    }
-    catch {
-        throw new Error("Invalid or expired pairing invitation");
-    }
-}
-/** Places the invitation in a URL fragment so it is excluded from HTTP requests and access logs. */
-function createDevicePairingInvitationUrl(invitationBaseUrl, invitation) {
-    const url = new URL(invitationBaseUrl);
-    url.hash = `pair=${encodeURIComponent(encodeDevicePairingInvitation(invitation))}`;
-    return url.toString();
-}

package/dist/group-invite/group-invite.d.ts

@@ -1,53 +0,0 @@
-/**
- * Utilities for group invitation flow.
- *
- * Uses a simple password that users can edit or customize.
- * The password is hashed to create an alias for network discovery.
- */
-/**
- * Generate a random memorable passphrase.
- * Format: "word-word-word-word" (4 words separated by dashes)
- *
- * @param wordCount Number of words to use (default 4)
- * @returns A memorable passphrase
- */
-export declare function generateInvitePassword(wordCount?: number): string;
-/**
- * Derive a network alias from a password.
- * Uses SHA-256 hash, takes first 8 characters as hex.
- *
- * @param password The password to derive from
- * @returns An 8-character hex alias
- */
-export declare function deriveAliasFromPassword(password: string): string;
-/**
- * Encrypt data using the invite password.
- * Uses NaCl secretbox with a key derived from the password.
- *
- * @param data Data to encrypt
- * @param password The invitation password
- * @returns Base64-encoded encrypted data with nonce
- */
-export declare function encryptWithPassword(data: any, password: string): string;
-/**
- * Decrypt data using the invite password.
- *
- * @param encrypted Base64-encoded encrypted data
- * @param password The invitation password
- * @returns Decrypted data
- */
-export declare function decryptWithPassword(encrypted: string, password: string): any;
-/**
- * Validate a password format.
- * Passwords should be at least 4 characters.
- *
- * @param password Password to validate
- * @returns true if valid
- */
-export declare function isValidInvitePassword(password: string): boolean;
-/**
- * Generate a unique request ID for tracking join requests.
- *
- * @returns A unique request ID
- */
-export declare function generateRequestId(): string;

package/dist/group-invite/group-invite.js

@@ -1,231 +0,0 @@
-"use strict";
-/**
- * Utilities for group invitation flow.
- *
- * Uses a simple password that users can edit or customize.
- * The password is hashed to create an alias for network discovery.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateInvitePassword = generateInvitePassword;
-exports.deriveAliasFromPassword = deriveAliasFromPassword;
-exports.encryptWithPassword = encryptWithPassword;
-exports.decryptWithPassword = decryptWithPassword;
-exports.isValidInvitePassword = isValidInvitePassword;
-exports.generateRequestId = generateRequestId;
-const sha2_1 = require("@noble/hashes/sha2");
-const nacl = require("tweetnacl");
-const tx_encoding_1 = require("../device/tx-encoding");
-const keys_1 = require("../keys");
-/**
- * Word list for generating memorable passphrases.
- * Using common, easy-to-spell words.
- */
-const WORD_LIST = [
-    "apple",
-    "banana",
-    "cherry",
-    "date",
-    "elder",
-    "fig",
-    "grape",
-    "honey",
-    "iris",
-    "jade",
-    "kiwi",
-    "lemon",
-    "mango",
-    "nectar",
-    "olive",
-    "peach",
-    "quince",
-    "rose",
-    "sugar",
-    "tulip",
-    "umber",
-    "violet",
-    "willow",
-    "yarrow",
-    "zebra",
-    "amber",
-    "blaze",
-    "coral",
-    "dusk",
-    "ember",
-    "frost",
-    "glow",
-    "haze",
-    "ivory",
-    "jewel",
-    "karma",
-    "lunar",
-    "maple",
-    "nova",
-    "opal",
-    "prism",
-    "quest",
-    "river",
-    "storm",
-    "terra",
-    "ultra",
-    "vivid",
-    "winter",
-    "azure",
-    "brave",
-    "calm",
-    "dawn",
-    "echo",
-    "fern",
-    "gentle",
-    "harbor",
-    "island",
-    "jungle",
-    "kindle",
-    "light",
-    "meadow",
-    "night",
-    "ocean",
-    "piano",
-    "quiet",
-    "rain",
-    "silk",
-    "tide",
-    "unity",
-    "velvet",
-    "wave",
-    "zenith",
-    "arch",
-    "beam",
-    "cloud",
-    "drift",
-    "earth",
-    "flame",
-    "green",
-    "hill",
-    "ink",
-    "jazz",
-    "keen",
-    "lake",
-    "moon",
-    "nest",
-    "oak",
-    "peak",
-    "ruby",
-    "sand",
-    "tree",
-    "vine",
-    "wind",
-    "year",
-    "zone",
-    "bold",
-    "crisp",
-    "deep",
-    "fair",
-    "glad",
-    "warm",
-    "pure",
-    "safe",
-    "true",
-];
-/**
- * Generate a random memorable passphrase.
- * Format: "word-word-word-word" (4 words separated by dashes)
- *
- * @param wordCount Number of words to use (default 4)
- * @returns A memorable passphrase
- */
-function generateInvitePassword(wordCount = 4) {
-    const words = [];
-    const bytes = nacl.randomBytes(wordCount);
-    for (let i = 0; i < wordCount; i++) {
-        const index = bytes[i] % WORD_LIST.length;
-        words.push(WORD_LIST[index]);
-    }
-    return words.join("-");
-}
-/**
- * Derive a network alias from a password.
- * Uses SHA-256 hash, takes first 8 characters as hex.
- *
- * @param password The password to derive from
- * @returns An 8-character hex alias
- */
-function deriveAliasFromPassword(password) {
-    const normalized = password.toLowerCase().trim();
-    const hash = (0, sha2_1.sha256)(new TextEncoder().encode(normalized));
-    // Convert first 4 bytes to 8-char hex string
-    const hexChars = Array.from(hash.slice(0, 4))
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("")
-        .toUpperCase();
-    return hexChars;
-}
-/**
- * Derive a 32-byte encryption key from the password.
- * Uses SHA-256 of the password.
- *
- * @param password The password to derive key from
- * @returns A 32-byte encryption key
- */
-function deriveKeyFromPassword(password) {
-    const normalized = password.toLowerCase().trim();
-    return (0, sha2_1.sha256)(new TextEncoder().encode(normalized));
-}
-/**
- * Encrypt data using the invite password.
- * Uses NaCl secretbox with a key derived from the password.
- *
- * @param data Data to encrypt
- * @param password The invitation password
- * @returns Base64-encoded encrypted data with nonce
- */
-function encryptWithPassword(data, password) {
-    const key = deriveKeyFromPassword(password);
-    const nonce = nacl.randomBytes(24);
-    const dataBytes = (0, tx_encoding_1.txEncode)(data);
-    const encrypted = nacl.secretbox(dataBytes, nonce, key);
-    // Combine nonce + encrypted data
-    const combined = new Uint8Array(nonce.length + encrypted.length);
-    combined.set(nonce);
-    combined.set(encrypted, nonce.length);
-    return (0, keys_1.encodeBase64)(combined);
-}
-/**
- * Decrypt data using the invite password.
- *
- * @param encrypted Base64-encoded encrypted data
- * @param password The invitation password
- * @returns Decrypted data
- */
-function decryptWithPassword(encrypted, password) {
-    const key = deriveKeyFromPassword(password);
-    const combined = (0, keys_1.decodeBase64)(encrypted);
-    const nonce = combined.slice(0, 24);
-    const ciphertext = combined.slice(24);
-    const decrypted = nacl.secretbox.open(ciphertext, nonce, key);
-    if (!decrypted) {
-        throw new Error("Decryption failed - invalid password or corrupted data");
-    }
-    return (0, tx_encoding_1.txDecode)(decrypted);
-}
-/**
- * Validate a password format.
- * Passwords should be at least 4 characters.
- *
- * @param password Password to validate
- * @returns true if valid
- */
-function isValidInvitePassword(password) {
-    const trimmed = password.trim();
-    return trimmed.length >= 4;
-}
-/**
- * Generate a unique request ID for tracking join requests.
- *
- * @returns A unique request ID
- */
-function generateRequestId() {
-    const bytes = nacl.randomBytes(8);
-    return Array.from(bytes)
-        .map((b) => b.toString(16).padStart(2, "0"))
-        .join("");
-}