@peers-app/peers-sdk 0.23.14 → 0.25.0

package/dist/invites/invite-token.test.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const group_member_roles_1 = require("../data/group-member-roles");
+const keys_1 = require("../keys");
+const utils_1 = require("../utils");
+const invite_messages_1 = require("./invite-messages");
+const invite_token_1 = require("./invite-token");
+function identity(keys = (0, keys_1.newKeys)()) {
+    return {
+        userId: (0, utils_1.newid)(),
+        publicKey: keys.publicKey,
+        publicBoxKey: keys.publicBoxKey,
+        displayName: "Alice",
+        secretKey: keys.secretKey,
+    };
+}
+function contactToken(inviter = identity(), expiresAt = new Date(Date.now() + 60_000)) {
+    const { secretKey, ...publicIdentity } = inviter;
+    return (0, invite_token_1.createInviteToken)({
+        type: "contact",
+        inviter: publicIdentity,
+        expiresAt: expiresAt.toISOString(),
+        nonce: (0, invite_token_1.newInviteNonce)(),
+        epoch: 0,
+        uses: 1,
+    }, secretKey);
+}
+describe("PeersInvite tokens", () => {
+    it("round-trips through every shareable encoding and verifies the signature", () => {
+        const token = contactToken();
+        const encoded = (0, invite_token_1.encodeInviteToken)(token);
+        expect((0, invite_token_1.parseInviteToken)(encoded)).toEqual(token);
+        expect((0, invite_token_1.parseInviteToken)((0, invite_token_1.inviteUrl)(token))).toEqual(token);
+        expect((0, invite_token_1.parseInviteToken)((0, invite_token_1.inviteDeepLink)(token))).toEqual(token);
+        expect((0, invite_token_1.parseInviteToken)(`https://peers.app/?app#invite=${encoded}`)).toEqual(token);
+        expect((0, invite_token_1.parseInviteToken)(`  ${encoded}\n`)).toEqual(token);
+        expect((0, invite_token_1.extractInviteTokenText)((0, invite_token_1.inviteUrl)(token))).toBe(encoded);
+    });
+    it("rejects tampered contents without echoing the input", () => {
+        const token = contactToken();
+        const tampered = (0, invite_token_1.encodeInviteToken)({ ...token, epoch: token.epoch + 1 });
+        expect(() => (0, invite_token_1.parseInviteToken)(tampered)).toThrow("Invite signature is not valid");
+        expect(() => (0, invite_token_1.parseInviteToken)("not a token")).toThrow("not a valid Peers invite");
+    });
+    it("refuses to sign with a key that is not the inviter's", () => {
+        const inviter = identity();
+        const { secretKey: _ignored, ...publicIdentity } = inviter;
+        expect(() => (0, invite_token_1.createInviteToken)({
+            type: "contact",
+            inviter: publicIdentity,
+            expiresAt: new Date(Date.now() + 1000).toISOString(),
+            nonce: (0, invite_token_1.newInviteNonce)(),
+            epoch: 0,
+            uses: 1,
+        }, (0, keys_1.newKeys)().secretKey)).toThrow("inviter's own key");
+    });
+    it("enforces expiry and type expectations", () => {
+        const expired = contactToken(identity(), new Date(Date.now() - 1000));
+        const encoded = (0, invite_token_1.encodeInviteToken)(expired);
+        expect(() => (0, invite_token_1.parseInviteToken)(encoded)).toThrow("expired");
+        expect((0, invite_token_1.parseInviteToken)(encoded, { allowExpired: true })).toEqual(expired);
+        expect(() => (0, invite_token_1.parseInviteToken)(encoded, { allowExpired: true, expectType: "group" })).toThrow("Expected a group invite");
+    });
+    it("requires group facts exactly when the type is group", () => {
+        const inviter = identity();
+        const { secretKey, ...publicIdentity } = inviter;
+        const base = {
+            inviter: publicIdentity,
+            expiresAt: new Date(Date.now() + 1000).toISOString(),
+            nonce: (0, invite_token_1.newInviteNonce)(),
+            epoch: 0,
+            uses: "unlimited",
+        };
+        expect(() => (0, invite_token_1.createInviteToken)({ ...base, type: "group" }, secretKey)).toThrow();
+        const groupKeys = (0, keys_1.newKeys)();
+        const token = (0, invite_token_1.createInviteToken)({
+            ...base,
+            type: "group",
+            group: {
+                groupId: (0, utils_1.newid)(),
+                name: "Family",
+                publicKey: groupKeys.publicKey,
+                publicBoxKey: groupKeys.publicBoxKey,
+                role: group_member_roles_1.GroupMemberRole.Reader,
+                mode: "open",
+            },
+        }, secretKey);
+        expect((0, invite_token_1.parseInviteToken)((0, invite_token_1.encodeInviteToken)(token), { expectType: "group" }).group?.mode).toBe("open");
+    });
+});
+describe("invite envelopes", () => {
+    it("seals to the recipient and exposes the verified sender keys", () => {
+        const sender = identity();
+        const recipient = identity();
+        const message = invite_messages_1.contactReplySchema.parse({
+            kind: "contact-reply",
+            inviteNonce: (0, invite_token_1.newInviteNonce)(),
+            inviteEpoch: 0,
+            responder: {
+                userId: sender.userId,
+                publicKey: sender.publicKey,
+                publicBoxKey: sender.publicBoxKey,
+            },
+            responderDeviceId: (0, utils_1.newid)(),
+        });
+        const envelope = (0, invite_messages_1.sealInviteEnvelope)(message, {
+            publicKey: sender.publicKey,
+            publicBoxKey: sender.publicBoxKey,
+            secretKey: sender.secretKey,
+        }, { userId: recipient.userId, publicBoxKey: recipient.publicBoxKey });
+        expect(envelope.to).toBe(recipient.userId);
+        expect(JSON.stringify(envelope)).not.toContain(sender.userId);
+        const opened = (0, invite_messages_1.openInviteEnvelope)(envelope, {
+            userId: recipient.userId,
+            secretKey: recipient.secretKey,
+        });
+        expect(opened.message).toEqual(message);
+        expect(opened.senderPublicKey).toBe(sender.publicKey);
+        expect(opened.senderPublicBoxKey).toBe(sender.publicBoxKey);
+        expect(() => (0, invite_messages_1.openInviteEnvelope)(envelope, { userId: (0, utils_1.newid)(), secretKey: recipient.secretKey })).toThrow("different user");
+        expect(() => (0, invite_messages_1.openInviteEnvelope)(envelope, { userId: recipient.userId, secretKey: (0, keys_1.newKeys)().secretKey })).toThrow();
+    });
+});

package/dist/keys.d.ts

@@ -10,6 +10,17 @@ export declare function stableStringify(obj: any): string;
 export declare function hashObject(obj: {
     [key: string]: any;
 }): string;
+/**
+ * Canonical JSON used for object signatures.
+ *
+ * Signed objects round-trip through SQLite (rows come back in schema column order and `NULL`
+ * becomes `undefined`), msgpack, and object spreads, all of which reorder keys or blur
+ * absent / `null` / `undefined`. The signed bytes must not depend on any of that, so this form:
+ * drops `null` / `undefined` valued keys, encodes extended types via {@link toJSON}, and sorts keys
+ * at every level. Sign and verify with this and only this; see {@link openSignedObject} for the
+ * legacy insertion-order fallback that keeps pre-existing signatures valid.
+ */
+export declare function canonicalJSONString(obj: any): string;
 /** Base64 with URL-safe alphabet and no `=` padding (used throughout keys and wire formats). */
 export declare function encodeBase64(data: Uint8Array): string;
 /**
@@ -52,12 +63,17 @@ export declare function signMessageWithSecretKey(msg: string, secretKey: string)
  */
 export declare function openMessageWithPublicKey(msg: string, publicKey: string): string;
 /**
- * Detached sign over stable JSON: `undefined` / `null` are encoded with sentinel fields for round-trip.
+ * Detached sign over {@link canonicalJSONString} (sorted keys, `null` / `undefined` keys dropped),
+ * so the signature survives key reordering and storage round-trips. A top-level `undefined` /
+ * `null` is encoded with a sentinel object so it can be signed and restored.
  * @returns Payload with original `contents`, `signature`, and signer's Ed25519 public key (32-byte slice, base64url)
  */
 export declare function signObjectWithSecretKey<T>(obj: T, secretKey: string): ISignedObject<T>;
 /**
  * Verifies a detached signature and returns `contents` after undoing the undefined/null sentinels.
+ * Verifies against {@link canonicalJSONString} first and falls back to the legacy insertion-order
+ * serialization so signatures written by older builds (already in databases, invite tokens, and
+ * `peers-services`) stay valid. New signatures are always canonical.
  * @throws If the signature is invalid
  */
 export declare function openSignedObject<T>(signedObj: ISignedObject<T>): T;

package/dist/keys.js

@@ -5,6 +5,7 @@ exports.hashValue = hashValue;
 exports.hashBytes = hashBytes;
 exports.stableStringify = stableStringify;
 exports.hashObject = hashObject;
+exports.canonicalJSONString = canonicalJSONString;
 exports.encodeBase64 = encodeBase64;
 exports.decodeBase64 = decodeBase64;
 exports.newToken = newToken;
@@ -60,6 +61,53 @@ function hashObject(obj) {
     const hash = hashValue(stableJson);
     return hash;
 }
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Recursively drops `null` / `undefined` valued keys from plain objects and rebuilds them with
+ * sorted keys. Arrays keep every element (position is meaning); non-plain objects (Date, Buffer,
+ * Uint8Array, RegExp, Error, …) pass through untouched for {@link toJSON} to encode.
+ */
+function canonicalize(value) {
+    if (Array.isArray(value)) {
+        return value.map(canonicalize);
+    }
+    if (!isPlainObject(value)) {
+        return value;
+    }
+    const out = {};
+    for (const key of Object.keys(value).sort()) {
+        const v = value[key];
+        if (v === undefined || v === null)
+            continue;
+        out[key] = canonicalize(v);
+    }
+    return out;
+}
+/**
+ * Canonical JSON used for object signatures.
+ *
+ * Signed objects round-trip through SQLite (rows come back in schema column order and `NULL`
+ * becomes `undefined`), msgpack, and object spreads, all of which reorder keys or blur
+ * absent / `null` / `undefined`. The signed bytes must not depend on any of that, so this form:
+ * drops `null` / `undefined` valued keys, encodes extended types via {@link toJSON}, and sorts keys
+ * at every level. Sign and verify with this and only this; see {@link openSignedObject} for the
+ * legacy insertion-order fallback that keeps pre-existing signatures valid.
+ */
+function canonicalJSONString(obj) {
+    return stableStringify((0, serial_json_1.toJSON)(canonicalize(obj)));
+}
+/**
+ * Pre-canonical serialization: insertion-order keys, `undefined` kept as a sentinel string.
+ * Only used to verify signatures written before {@link canonicalJSONString} existed.
+ */
+function legacySignatureJSONString(obj) {
+    return (0, serial_json_1.toJSONString)(obj);
+}
 /** Base64 with URL-safe alphabet and no `=` padding (used throughout keys and wire formats). */
 function encodeBase64(data) {
     // return Buffer.from(data).toString("base64url"); // no padding by default
@@ -127,7 +175,9 @@ function openMessageWithPublicKey(msg, publicKey) {
     return (0, tweetnacl_util_1.encodeUTF8)(msgOpened);
 }
 /**
- * Detached sign over stable JSON: `undefined` / `null` are encoded with sentinel fields for round-trip.
+ * Detached sign over {@link canonicalJSONString} (sorted keys, `null` / `undefined` keys dropped),
+ * so the signature survives key reordering and storage round-trips. A top-level `undefined` /
+ * `null` is encoded with a sentinel object so it can be signed and restored.
  * @returns Payload with original `contents`, `signature`, and signer's Ed25519 public key (32-byte slice, base64url)
  */
 function signObjectWithSecretKey(obj, secretKey) {
@@ -138,7 +188,7 @@ function signObjectWithSecretKey(obj, secretKey) {
     if (obj === null) {
         obj = { __isNull: true };
     }
-    const objStr = (0, serial_json_1.toJSONString)(obj);
+    const objStr = canonicalJSONString(obj);
     const objDecoded = (0, tweetnacl_util_1.decodeUTF8)(objStr);
     const signatureByteArray = nacl.sign.detached(objDecoded, _secretKey);
     return {
@@ -149,14 +199,17 @@ function signObjectWithSecretKey(obj, secretKey) {
 }
 /**
  * Verifies a detached signature and returns `contents` after undoing the undefined/null sentinels.
+ * Verifies against {@link canonicalJSONString} first and falls back to the legacy insertion-order
+ * serialization so signatures written by older builds (already in databases, invite tokens, and
+ * `peers-services`) stay valid. New signatures are always canonical.
  * @throws If the signature is invalid
  */
 function openSignedObject(signedObj) {
     const _publicKey = decodeBase64(signedObj.publicKey);
-    const objStr = (0, serial_json_1.toJSONString)(signedObj.contents);
-    const objDecoded = (0, tweetnacl_util_1.decodeUTF8)(objStr);
     const signature = decodeBase64(signedObj.signature);
-    const valid = nacl.sign.detached.verify(objDecoded, signature, _publicKey);
+    const verify = (objStr) => nacl.sign.detached.verify((0, tweetnacl_util_1.decodeUTF8)(objStr), signature, _publicKey);
+    const valid = verify(canonicalJSONString(signedObj.contents)) ||
+        verify(legacySignatureJSONString(signedObj.contents));
     if (!valid) {
         throw new Error("Signature verification failed");
     }

package/dist/keys.test.js

@@ -1,6 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const SQLiteDB = require("better-sqlite3");
+const nacl = require("tweetnacl");
+const tweetnacl_util_1 = require("tweetnacl-util");
+const zod_1 = require("zod");
+const sql_data_source_1 = require("./data/orm/sql.data-source");
+const types_1 = require("./data/orm/types");
 const keys_1 = require("./keys");
+const serial_json_1 = require("./serial-json");
+const zod_types_1 = require("./types/zod-types");
+const utils_1 = require("./utils");
 describe("keys", () => {
     it("should allow creating a new key pair", () => {
         const keys = (0, keys_1.newKeys)();
@@ -220,4 +229,108 @@ describe("keys", () => {
             expect((0, keys_1.getPublicKeyFromObjectSignature)(signedObj)).toBe(keys.publicKey);
         });
     });
+    describe("canonical signatures", () => {
+        it("canonicalJSONString sorts keys at every level and drops null/undefined keys", () => {
+            const a = { z: 1, a: { y: [3, { q: 1, p: 2 }], x: undefined, w: null }, m: undefined };
+            const b = { a: { y: [3, { p: 2, q: 1 }] }, z: 1 };
+            expect((0, keys_1.canonicalJSONString)(a)).toBe((0, keys_1.canonicalJSONString)(b));
+            expect((0, keys_1.canonicalJSONString)(a)).toBe('{"a":{"y":[3,{"p":2,"q":1}]},"z":1}');
+        });
+        it("canonicalJSONString keeps array elements and encodes extended types", () => {
+            const date = new Date("2026-01-02T03:04:05.000Z");
+            expect((0, keys_1.canonicalJSONString)([1, null, undefined])).toBe('[1,null,"__UNDEFINED"]');
+            expect((0, keys_1.canonicalJSONString)({ when: date })).toBe(`{"when":"__DATE ${date.toISOString()}"}`);
+            expect((0, keys_1.canonicalJSONString)({ b: Buffer.from("hi") })).toBe('{"b":"__BUFFER aGk="}');
+        });
+        it("verifies after the keys are reordered", () => {
+            const keys = (0, keys_1.newKeys)();
+            const signed = (0, keys_1.addSignatureToObject)({ userId: "u1", name: "Alice", publicKey: keys.publicKey }, keys.secretKey);
+            // Same fields, different insertion order (as a row read back from SQLite would be).
+            const reordered = {
+                publicKey: signed.publicKey,
+                signature: signed.signature,
+                name: signed.name,
+                userId: signed.userId,
+            };
+            expect(() => (0, keys_1.verifyObjectSignature)(reordered)).not.toThrow();
+        });
+        it("treats an absent, undefined, and null optional field identically", () => {
+            const keys = (0, keys_1.newKeys)();
+            const signed = (0, keys_1.addSignatureToObject)({ userId: "u1", name: "Alice" }, keys.secretKey);
+            expect((0, keys_1.isObjectSignatureValid)({ ...signed, avatar: undefined })).toBe(true);
+            expect((0, keys_1.isObjectSignatureValid)({ ...signed, avatar: null })).toBe(true);
+            // A real value change still fails.
+            expect((0, keys_1.isObjectSignatureValid)({ ...signed, avatar: "x" })).toBe(false);
+        });
+        it("still fails when a value changes, regardless of order", () => {
+            const keys = (0, keys_1.newKeys)();
+            const signed = (0, keys_1.addSignatureToObject)({ a: 1, b: 2 }, keys.secretKey);
+            expect((0, keys_1.isObjectSignatureValid)({ b: 3, a: 1, signature: signed.signature })).toBe(false);
+        });
+        it("accepts legacy insertion-order signatures written before canonicalization", () => {
+            const keys = (0, keys_1.newKeys)();
+            // Key order deliberately not sorted, so canonical and legacy bytes differ.
+            const contents = { userId: "u1", name: "Alice", publicKey: keys.publicKey, maybe: undefined };
+            const legacyBytes = (0, tweetnacl_util_1.decodeUTF8)((0, serial_json_1.toJSONString)(contents));
+            expect((0, serial_json_1.toJSONString)(contents)).not.toBe((0, keys_1.canonicalJSONString)(contents));
+            const legacySig = nacl.sign.detached(legacyBytes, (0, keys_1.decodeBase64)(keys.secretKey));
+            const signature = Buffer.from(legacySig).toString("base64url");
+            expect(() => (0, keys_1.openSignedObject)({ contents, signature, publicKey: keys.publicKey })).not.toThrow();
+            expect(() => (0, keys_1.verifyObjectSignature)({ ...contents, signature: `${keys.publicKey}:${signature}` })).not.toThrow();
+            // Tampering is still caught on the legacy path.
+            expect(() => (0, keys_1.openSignedObject)({
+                contents: { ...contents, name: "Mallory" },
+                signature,
+                publicKey: keys.publicKey,
+            })).toThrow(/signature/i);
+        });
+        it("survives a round trip through a SQLite table", async () => {
+            const db = new SQLiteDB(":memory:");
+            const harness = {
+                get: async (sql, params = []) => db.prepare(sql).get(params),
+                all: async (sql, params = []) => db.prepare(sql).all(params),
+                exec: async (sql, params = []) => ({
+                    changes: db.prepare(sql).run(params).changes,
+                }),
+                close: async () => {
+                    db.close();
+                },
+            };
+            const schema = zod_1.z.object({
+                userId: zod_types_1.zodPeerId,
+                name: zod_1.z.string(),
+                publicKey: zod_1.z.string(),
+                publicBoxKey: zod_1.z.string(),
+                avatar: zod_1.z.string().optional(),
+                signature: zod_1.z.string(),
+            });
+            const metaData = {
+                name: "test_signed_users",
+                description: "signed users",
+                primaryKeyName: "userId",
+                fields: (0, types_1.schemaToFields)(schema),
+            };
+            const table = new sql_data_source_1.SQLDataSource(harness, metaData);
+            try {
+                const keys = (0, keys_1.newKeys)();
+                // Signed with keys in an order that differs from the schema's column order and with an
+                // optional field omitted; SQLite will hand back column order and `avatar: undefined`.
+                const signed = (0, keys_1.addSignatureToObject)({
+                    publicBoxKey: keys.publicBoxKey,
+                    name: "Alice",
+                    userId: (0, utils_1.newid)(),
+                    publicKey: keys.publicKey,
+                }, keys.secretKey);
+                await table.save(signed);
+                const stored = await table.get(signed.userId);
+                if (!stored)
+                    throw new Error("row was not stored");
+                expect(Object.keys(stored)).not.toEqual(Object.keys(signed));
+                expect(() => (0, keys_1.verifyObjectSignature)(stored)).not.toThrow();
+            }
+            finally {
+                await harness.close();
+            }
+        });
+    });
 });

package/dist/rpc-types.d.ts

@@ -1,6 +1,6 @@
 import type { IDeviceDatabaseQueryResult, IDeviceOperationStatus, IDeviceToolRunInput } from "./contracts/system/device-operations-contract";
 import type { ITool } from "./data/tools";
-import type { DevicePairingCeremonyAction, DevicePairingStartDestinationInput, DevicePairingStartSourceResult, DevicePairingState } from "./device-pairing";
+import type { DevicePairingCeremonyAction, DevicePairingStartDestinationInput, DevicePairingStartSourceInput, DevicePairingState } from "./device-pairing";
 import type { IConsoleLog } from "./logging/console-logs.table";
 import type { IAddOrUpdatePackageResult } from "./package-installer/types";
 import type { IAppNav } from "./types/app-nav";
@@ -66,13 +66,14 @@ export declare const rpcServerCalls: {
     seedBundledPeersCore: (dataContextId?: string) => Promise<boolean>;
     setUserIdAndSecretKey: (userId: string, secretKey: string) => Promise<void>;
     getUserId: () => Promise<string | undefined>;
-    devicePairingStartSource: () => Promise<DevicePairingStartSourceResult>;
-    devicePairingStartDestination: (input: DevicePairingStartDestinationInput) => Promise<DevicePairingState>;
+    /** Signed-in side: joins the room named by a typed or scanned pairing code. */
+    devicePairingStartSource: (input: DevicePairingStartSourceInput) => Promise<DevicePairingState>;
+    /** Signed-out side: creates a room and returns state whose `code` the UI shows as text and QR. */
+    devicePairingStartDestination: (input?: DevicePairingStartDestinationInput) => Promise<DevicePairingState>;
     devicePairingApprove: (input: DevicePairingCeremonyAction) => Promise<DevicePairingState>;
     devicePairingReject: (input: DevicePairingCeremonyAction) => Promise<DevicePairingState>;
     devicePairingCancel: (input: DevicePairingCeremonyAction) => Promise<DevicePairingState>;
     devicePairingGetState: () => Promise<DevicePairingState>;
-    devicePairingGetInvitationUrl: () => Promise<string | undefined>;
     encryptData: (value: string, groupId?: string) => Promise<string>;
     /**
      * Decrypt (if secret) and copy a persistent variable's value to the system clipboard

package/dist/rpc-types.js

@@ -21,13 +21,14 @@ exports.rpcServerCalls = {
     seedBundledPeersCore: rpcStub("seedBundledPeersCore"),
     setUserIdAndSecretKey: rpcStub("setUserIdAndSecretKey"),
     getUserId: rpcStub("getUserId"),
+    /** Signed-in side: joins the room named by a typed or scanned pairing code. */
     devicePairingStartSource: rpcStub("devicePairingStartSource"),
+    /** Signed-out side: creates a room and returns state whose `code` the UI shows as text and QR. */
     devicePairingStartDestination: rpcStub("devicePairingStartDestination"),
     devicePairingApprove: rpcStub("devicePairingApprove"),
     devicePairingReject: rpcStub("devicePairingReject"),
     devicePairingCancel: rpcStub("devicePairingCancel"),
     devicePairingGetState: rpcStub("devicePairingGetState"),
-    devicePairingGetInvitationUrl: rpcStub("devicePairingGetInvitationUrl"),
     encryptData: rpcStub("encryptData"),
     /**
      * Decrypt (if secret) and copy a persistent variable's value to the system clipboard

package/dist/serial-json.d.ts

@@ -10,7 +10,10 @@ export declare function toJSON(obj: any): any;
  * @param _externalReferences Reserved for future use (function revival, etc.)
  */
 export declare function fromJSON(obj: any, _externalReferences?: any): any;
-/** `JSON.stringify` of {@link toJSON} (stable, extended types). */
+/**
+ * `JSON.stringify` of {@link toJSON}: extended types are encoded deterministically, but keys keep
+ * insertion order. Not canonical; for signatures use `canonicalJSONString` in `keys.ts`.
+ */
 export declare function toJSONString(obj: any): string;
 /** `JSON.parse` then {@link fromJSON}. */
 export declare function fromJSONString(str: string): any;

package/dist/serial-json.js

@@ -194,7 +194,10 @@ function fromJSON(obj, _externalReferences) {
     obj = recurse(obj);
     return obj;
 }
-/** `JSON.stringify` of {@link toJSON} (stable, extended types). */
+/**
+ * `JSON.stringify` of {@link toJSON}: extended types are encoded deterministically, but keys keep
+ * insertion order. Not canonical; for signatures use `canonicalJSONString` in `keys.ts`.
+ */
 function toJSONString(obj) {
     return JSON.stringify(toJSON(obj));
 }

package/dist/system-ids.d.ts

@@ -17,6 +17,8 @@ export declare const runWorkflowToolId = "000peers0tool0runworkflow";
  * Distinct from Device Operations contract `queryDatabase`.
  */
 export declare const queryDatabaseToolId = "000peers0tool00querydb001";
+/** Stable ID of the `create-group` system tool (creates a group founded by the current user). */
+export declare const createGroupToolId = "000peers0tool0creategroup";
 /** Stable package ID of the bundled peers-core package. */
 export declare const peersCorePackageId = "00mh0wlipjixk2gqmurbwee0o";
 /** Canonical source repository for peers-core. */
@@ -54,3 +56,23 @@ export declare const toolAccessControlToolIds: {
     readonly reject: "000peers0tacreject0000001";
     readonly listPending: "000peers0taclist000000001";
 };
+/**
+ * Contract id for the local-only contact and group invite surface (System Invites).
+ * Not available over device-to-device connections.
+ */
+export declare const invitesContractId = "00mu8uuzvo2zux1wfb9f1r48l";
+/** Stable IDs for tools in System Invites v1. */
+export declare const invitesToolIds: {
+    readonly createContactInvite: "00mu8uuzvqbn5o23ya563wmp5";
+    readonly createGroupInvite: "00mu8uuzvqz17wedq1iqmh9i4";
+    readonly inviteContactToGroup: "00mu8uuzvqhbk5avjpew7w9ng";
+    readonly previewInvite: "00mu8uuzvqwbo180wgz4ctslm";
+    readonly acceptInvite: "00mu8uuzvq8i1boc4ml1ywk30";
+    readonly declineInvite: "00mu8uuzvq97veint1977p2ey";
+    readonly approveJoinRequest: "00mu8uuzvqisozhlfbe1oeo0e";
+    readonly denyJoinRequest: "00mu8uuzvqdars4o466eansi2";
+    readonly revokeInvite: "00mu8uuzvqndg6qdh74dob9j1";
+    readonly regenerateProfileInvite: "00mu8uuzvqbu5ri9octpk64oo";
+    readonly syncMailbox: "00mu8uuzvq4xlaiqrn5notj1j";
+    readonly listInvites: "00mu8uuzvqfego6lyjjkgr4s7";
+};

package/dist/system-ids.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
+exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
 /** Stable user ID that owns built-in Peers system records. */
 exports.peersRootUserId = "000peers0user000000000001";
 /** Default assistant used when no user-selected assistant is available. */
@@ -21,6 +21,8 @@ exports.runWorkflowToolId = "000peers0tool0runworkflow";
  * Distinct from Device Operations contract `queryDatabase`.
  */
 exports.queryDatabaseToolId = "000peers0tool00querydb001";
+/** Stable ID of the `create-group` system tool (creates a group founded by the current user). */
+exports.createGroupToolId = "000peers0tool0creategroup";
 /** Stable package ID of the bundled peers-core package. */
 exports.peersCorePackageId = "00mh0wlipjixk2gqmurbwee0o";
 /** Canonical source repository for peers-core. */
@@ -58,3 +60,23 @@ exports.toolAccessControlToolIds = {
     reject: "000peers0tacreject0000001",
     listPending: "000peers0taclist000000001",
 };
+/**
+ * Contract id for the local-only contact and group invite surface (System Invites).
+ * Not available over device-to-device connections.
+ */
+exports.invitesContractId = "00mu8uuzvo2zux1wfb9f1r48l";
+/** Stable IDs for tools in System Invites v1. */
+exports.invitesToolIds = {
+    createContactInvite: "00mu8uuzvqbn5o23ya563wmp5",
+    createGroupInvite: "00mu8uuzvqz17wedq1iqmh9i4",
+    inviteContactToGroup: "00mu8uuzvqhbk5avjpew7w9ng",
+    previewInvite: "00mu8uuzvqwbo180wgz4ctslm",
+    acceptInvite: "00mu8uuzvq8i1boc4ml1ywk30",
+    declineInvite: "00mu8uuzvq97veint1977p2ey",
+    approveJoinRequest: "00mu8uuzvqisozhlfbe1oeo0e",
+    denyJoinRequest: "00mu8uuzvqdars4o466eansi2",
+    revokeInvite: "00mu8uuzvqndg6qdh74dob9j1",
+    regenerateProfileInvite: "00mu8uuzvqbu5ri9octpk64oo",
+    syncMailbox: "00mu8uuzvq4xlaiqrn5notj1j",
+    listInvites: "00mu8uuzvqfego6lyjjkgr4s7",
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.23.14",
+  "version": "0.25.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"

package/dist/device-pairing/invitation.d.ts

@@ -1,13 +0,0 @@
-import { type DevicePairingInvitation } from "./types";
-/** Creates a five-minute, high-entropy invitation for a signaling service origin. */
-export declare function createDevicePairingInvitation({ serviceOrigin, now, ttlMs, }: {
-    serviceOrigin: string;
-    now?: number;
-    ttlMs?: number;
-}): DevicePairingInvitation;
-/** Encodes an invitation as a versioned token suitable for a URL fragment or manual entry. */
-export declare function encodeDevicePairingInvitation(invitation: DevicePairingInvitation): string;
-/** Parses and validates a versioned invitation token or fragment URL. */
-export declare function parseDevicePairingInvitation(input: string, now?: number): DevicePairingInvitation;
-/** Places the invitation in a URL fragment so it is excluded from HTTP requests and access logs. */
-export declare function createDevicePairingInvitationUrl(invitationBaseUrl: string, invitation: DevicePairingInvitation): string;

package/dist/device-pairing/invitation.js

@@ -1,85 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createDevicePairingInvitation = createDevicePairingInvitation;
-exports.encodeDevicePairingInvitation = encodeDevicePairingInvitation;
-exports.parseDevicePairingInvitation = parseDevicePairingInvitation;
-exports.createDevicePairingInvitationUrl = createDevicePairingInvitationUrl;
-const keys_1 = require("../keys");
-const constants_1 = require("./constants");
-const types_1 = require("./types");
-const INVITATION_TOKEN_PREFIX = "peers-pairing-v1.";
-const textDecoder = new TextDecoder();
-const textEncoder = new TextEncoder();
-function normalizeServiceOrigin(value) {
-    const url = new URL(value);
-    if (url.protocol !== "https:" && url.protocol !== "http:") {
-        throw new Error("Pairing service must use HTTP or HTTPS");
-    }
-    return url.origin;
-}
-function extractInvitationToken(input) {
-    const trimmed = input.trim();
-    if (trimmed.startsWith(INVITATION_TOKEN_PREFIX)) {
-        return trimmed;
-    }
-    try {
-        const url = new URL(trimmed);
-        const fragment = url.hash.slice(1);
-        if (fragment.startsWith("pair=")) {
-            return decodeURIComponent(fragment.slice("pair=".length));
-        }
-        if (fragment.startsWith("pair?")) {
-            const token = new URLSearchParams(fragment.slice("pair?".length)).get("token");
-            if (token) {
-                return token;
-            }
-        }
-    }
-    catch {
-        // The generic error below deliberately avoids echoing invitation input.
-    }
-    throw new Error("Invalid pairing invitation");
-}
-/** Creates a five-minute, high-entropy invitation for a signaling service origin. */
-function createDevicePairingInvitation({ serviceOrigin, now = Date.now(), ttlMs = constants_1.DEVICE_PAIRING_TTL_MS, }) {
-    if (!Number.isSafeInteger(now) || ttlMs <= 0 || ttlMs > constants_1.DEVICE_PAIRING_TTL_MS) {
-        throw new Error("Invalid pairing invitation lifetime");
-    }
-    return types_1.devicePairingInvitationSchema.parse({
-        version: constants_1.DEVICE_PAIRING_PROTOCOL_VERSION,
-        roomId: (0, keys_1.newToken)(16),
-        roomSecret: (0, keys_1.newToken)(32),
-        expiresAt: now + ttlMs,
-        serviceOrigin: normalizeServiceOrigin(serviceOrigin),
-    });
-}
-/** Encodes an invitation as a versioned token suitable for a URL fragment or manual entry. */
-function encodeDevicePairingInvitation(invitation) {
-    const parsed = types_1.devicePairingInvitationSchema.parse(invitation);
-    return `${INVITATION_TOKEN_PREFIX}${(0, keys_1.encodeBase64)(textEncoder.encode(JSON.stringify(parsed)))}`;
-}
-/** Parses and validates a versioned invitation token or fragment URL. */
-function parseDevicePairingInvitation(input, now = Date.now()) {
-    try {
-        const token = extractInvitationToken(input);
-        if (!token.startsWith(INVITATION_TOKEN_PREFIX)) {
-            throw new Error("unsupported");
-        }
-        const encoded = token.slice(INVITATION_TOKEN_PREFIX.length);
-        const parsed = types_1.devicePairingInvitationSchema.parse(JSON.parse(textDecoder.decode((0, keys_1.decodeBase64)(encoded))));
-        if (parsed.expiresAt <= now ||
-            parsed.expiresAt > now + constants_1.DEVICE_PAIRING_TTL_MS + constants_1.DEVICE_PAIRING_CLOCK_SKEW_MS) {
-            throw new Error("expired");
-        }
-        return parsed;
-    }
-    catch {
-        throw new Error("Invalid or expired pairing invitation");
-    }
-}
-/** Places the invitation in a URL fragment so it is excluded from HTTP requests and access logs. */
-function createDevicePairingInvitationUrl(invitationBaseUrl, invitation) {
-    const url = new URL(invitationBaseUrl);
-    url.hash = `pair=${encodeURIComponent(encodeDevicePairingInvitation(invitation))}`;
-    return url.toString();
-}