@peers-app/peers-sdk 0.25.1 → 0.25.3

package/dist/contracts/system/identity-contract.d.ts

@@ -0,0 +1,43 @@
+import type { DevicePairingCeremonyAction, DevicePairingStartDestinationInput, DevicePairingStartSourceInput, DevicePairingState } from "../../device-pairing";
+import type { Observable } from "../../observable";
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the built-in System Identity contract. */
+export declare const IDENTITY_CONTRACT_VERSION = 1;
+/** Who is signed in on this host, and whether they registered with peers-services. */
+export interface IIdentitySessionInfo {
+    /** Signed-in user, absent on the setup screen. */
+    userId?: string;
+    /** True when this user has completed peers-services registration on this device. */
+    registered: boolean;
+}
+/**
+ * Local-only host contract for device pairing and the signed-in session.
+ *
+ * It resolves before sign-in (`requiresUserContext: false`) so the setup screen can
+ * show a pairing code. Remote device connections must not resolve it. Pairing progress
+ * is the `state` observable; there is no separate get-state tool.
+ */
+export declare function getIdentityContractDefinition(): IContractDefinition;
+/** Consumer-side TypeScript shape for System Identity. */
+export interface IIdentityConsumer extends IContractConsumerBase {
+    tools: {
+        startSource(input: DevicePairingStartSourceInput): Promise<DevicePairingState>;
+        startDestination(input?: DevicePairingStartDestinationInput): Promise<DevicePairingState>;
+        approve(input: DevicePairingCeremonyAction): Promise<DevicePairingState>;
+        reject(input: DevicePairingCeremonyAction): Promise<DevicePairingState>;
+        cancel(input: DevicePairingCeremonyAction): Promise<DevicePairingState>;
+        getSession(): Promise<IIdentitySessionInfo>;
+        signIn(input: {
+            userId: string;
+            secretKey: string;
+        }): Promise<void>;
+        signOut(): Promise<void>;
+        registerWithPeersServices(): Promise<{
+            token: string;
+        }>;
+    };
+    observables: {
+        state: Observable<DevicePairingState>;
+    };
+}

package/dist/contracts/system/identity-contract.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_CONTRACT_VERSION = void 0;
+exports.getIdentityContractDefinition = getIdentityContractDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the built-in System Identity contract. */
+exports.IDENTITY_CONTRACT_VERSION = 1;
+const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
+let definition;
+/**
+ * Fields of {@link DevicePairingState}. Ceremony tools return this object directly.
+ */
+const pairingStateFields = [
+    field("sessionId", field_type_1.FieldType.id, "Active ceremony id.", { optional: true }),
+    field("role", field_type_1.FieldType.string, "source or destination.", { optional: true }),
+    field("phase", field_type_1.FieldType.string, "idle, showing-code, connecting, authenticating, waiting-for-approval, transferring, complete, rejected, or error."),
+    field("expiresAt", field_type_1.FieldType.number, "Unix milliseconds when the ceremony expires.", {
+        optional: true,
+    }),
+    field("remoteDevice", field_type_1.FieldType.object, "Name, user, and type presented by the other device.", {
+        optional: true,
+    }),
+    field("code", field_type_1.FieldType.string, "Pairing code the destination is showing.", { optional: true }),
+    field("notice", field_type_1.FieldType.string, "Non-fatal message alongside the current phase.", {
+        optional: true,
+    }),
+    field("error", field_type_1.FieldType.string, "Failure message when the phase is error.", { optional: true }),
+];
+/**
+ * Local-only host contract for device pairing and the signed-in session.
+ *
+ * It resolves before sign-in (`requiresUserContext: false`) so the setup screen can
+ * show a pairing code. Remote device connections must not resolve it. Pairing progress
+ * is the `state` observable; there is no separate get-state tool.
+ */
+function getIdentityContractDefinition() {
+    definition ??= {
+        contractId: system_ids_1.identityContractId,
+        version: exports.IDENTITY_CONTRACT_VERSION,
+        devTag: "dev",
+        name: "System Identity",
+        description: "Device pairing ceremony and the local signed-in session.",
+        requiresUserContext: false,
+        tables: [],
+        tools: [
+            {
+                name: "startSource",
+                usageDescription: "Join a pairing room from a code shown on a new device.",
+                inputFields: [field("code", field_type_1.FieldType.string, "Pairing code from the new device.")],
+                outputFields: pairingStateFields,
+            },
+            {
+                name: "startDestination",
+                usageDescription: "Show a pairing code on this signed-out device.",
+                inputFields: [
+                    field("deviceName", field_type_1.FieldType.string, "Name to present for this device.", {
+                        optional: true,
+                    }),
+                    field("deviceType", field_type_1.FieldType.string, "Kind of device, such as browser or desktop.", {
+                        optional: true,
+                    }),
+                ],
+                outputFields: pairingStateFields,
+            },
+            {
+                name: "approve",
+                usageDescription: "Approve the active pairing ceremony and send credentials.",
+                inputFields: [field("sessionId", field_type_1.FieldType.id, "Active ceremony id.")],
+                outputFields: pairingStateFields,
+            },
+            {
+                name: "reject",
+                usageDescription: "Reject the active pairing ceremony.",
+                inputFields: [field("sessionId", field_type_1.FieldType.id, "Active ceremony id.")],
+                outputFields: pairingStateFields,
+            },
+            {
+                name: "cancel",
+                usageDescription: "Cancel the active pairing ceremony.",
+                inputFields: [field("sessionId", field_type_1.FieldType.id, "Active ceremony id.")],
+                outputFields: pairingStateFields,
+            },
+            {
+                name: "getSession",
+                usageDescription: "Return the signed-in user, if any, and peers-services registration.",
+                inputFields: [],
+                outputFields: [
+                    field("userId", field_type_1.FieldType.id, "Signed-in user id.", { optional: true }),
+                    field("registered", field_type_1.FieldType.boolean, "Whether peers-services registration completed."),
+                ],
+            },
+            {
+                name: "signIn",
+                usageDescription: "Store a user id and secret key and start the local runtime.",
+                inputFields: [
+                    field("userId", field_type_1.FieldType.id, "User id to sign in as."),
+                    field("secretKey", field_type_1.FieldType.string, "Secret key for that user."),
+                ],
+                outputFields: [],
+            },
+            {
+                name: "signOut",
+                usageDescription: "Clear the local credentials and leave the signed-in session.",
+                inputFields: [],
+                outputFields: [],
+            },
+            {
+                name: "registerWithPeersServices",
+                usageDescription: "Register or authenticate this user with peers-services and return a JWT.",
+                inputFields: [],
+                outputFields: [field("token", field_type_1.FieldType.string, "peers-services JWT.")],
+            },
+        ],
+        observables: [
+            {
+                name: "state",
+                description: "Live device-pairing ceremony state.",
+                valueType: field_type_1.FieldType.object,
+                writable: false,
+            },
+        ],
+        events: [],
+    };
+    return definition;
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: system_ids_1.peersSystemPackageId,
+    contractId: system_ids_1.identityContractId,
+    version: exports.IDENTITY_CONTRACT_VERSION,
+    getDefinition: getIdentityContractDefinition,
+});

package/dist/contracts/system/index.d.ts

@@ -3,11 +3,13 @@
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
 import "./device-operations-contract";
+import "./identity-contract";
 import "./invites-contract";
 import "./logs-contract";
 import "./network-contracts";
 import "./tool-access-control-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./device-operations-contract";
+export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentitySessionInfo, } from "./identity-contract";
 export { getInvitesContractDefinition, type IAcceptInviteResult, type ICreatedInvite, type IInvitePreview, type IInvitesConsumer, INVITES_CONTRACT_VERSION, } from "./invites-contract";
 export { getLogsContractDefinition, type ILogsConsumer, LOGS_CONTRACT_VERSION, resolveLogsContract, } from "./logs-contract";
 export * from "./network-contracts";

package/dist/contracts/system/index.js

@@ -14,12 +14,13 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContractDefinition = exports.resolveLogsContract = exports.LOGS_CONTRACT_VERSION = exports.getLogsContractDefinition = exports.INVITES_CONTRACT_VERSION = exports.getInvitesContractDefinition = exports.getDeviceOperationsContractDefinition = exports.deviceOperationsToolIds = exports.deviceOperationsProviderPackageId = exports.DEVICE_OPERATIONS_MAX_TOOLS = exports.DEVICE_OPERATIONS_MAX_ROWS = exports.DEVICE_OPERATIONS_MAX_RESULT_BYTES = exports.DEVICE_OPERATIONS_MAX_QUERY_LENGTH = exports.DEVICE_OPERATIONS_CONTRACT_VERSION = void 0;
+exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContractDefinition = exports.resolveLogsContract = exports.LOGS_CONTRACT_VERSION = exports.getLogsContractDefinition = exports.INVITES_CONTRACT_VERSION = exports.getInvitesContractDefinition = exports.IDENTITY_CONTRACT_VERSION = exports.getIdentityContractDefinition = exports.getDeviceOperationsContractDefinition = exports.deviceOperationsToolIds = exports.deviceOperationsProviderPackageId = exports.DEVICE_OPERATIONS_MAX_TOOLS = exports.DEVICE_OPERATIONS_MAX_ROWS = exports.DEVICE_OPERATIONS_MAX_RESULT_BYTES = exports.DEVICE_OPERATIONS_MAX_QUERY_LENGTH = exports.DEVICE_OPERATIONS_CONTRACT_VERSION = void 0;
 /**
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
 require("./device-operations-contract");
+require("./identity-contract");
 require("./invites-contract");
 require("./logs-contract");
 require("./network-contracts");
@@ -33,6 +34,9 @@ Object.defineProperty(exports, "DEVICE_OPERATIONS_MAX_TOOLS", { enumerable: true
 Object.defineProperty(exports, "deviceOperationsProviderPackageId", { enumerable: true, get: function () { return device_operations_contract_1.deviceOperationsProviderPackageId; } });
 Object.defineProperty(exports, "deviceOperationsToolIds", { enumerable: true, get: function () { return device_operations_contract_1.deviceOperationsToolIds; } });
 Object.defineProperty(exports, "getDeviceOperationsContractDefinition", { enumerable: true, get: function () { return device_operations_contract_1.getDeviceOperationsContractDefinition; } });
+var identity_contract_1 = require("./identity-contract");
+Object.defineProperty(exports, "getIdentityContractDefinition", { enumerable: true, get: function () { return identity_contract_1.getIdentityContractDefinition; } });
+Object.defineProperty(exports, "IDENTITY_CONTRACT_VERSION", { enumerable: true, get: function () { return identity_contract_1.IDENTITY_CONTRACT_VERSION; } });
 var invites_contract_1 = require("./invites-contract");
 Object.defineProperty(exports, "getInvitesContractDefinition", { enumerable: true, get: function () { return invites_contract_1.getInvitesContractDefinition; } });
 Object.defineProperty(exports, "INVITES_CONTRACT_VERSION", { enumerable: true, get: function () { return invites_contract_1.INVITES_CONTRACT_VERSION; } });

package/dist/contracts/types.d.ts

@@ -25,6 +25,12 @@ export interface IContractDefinition {
      * emits an array (possibly empty) and consumers read `contract.events ?? []`.
      */
     events?: IContractEvent[];
+    /**
+     * When `false`, the local host may resolve this contract before anyone is
+     * signed in. Defaults to requiring a user context. The host router honors this
+     * only when the provider registers with `requiresUserContext: false`.
+     */
+    requiresUserContext?: boolean;
 }
 /** Table shape within a contract — derived from ITableMetaData + IField[]. */
 export interface IContractTable {

package/dist/data/devices.d.ts

@@ -49,15 +49,15 @@ export declare const deviceInfoSchema: z.ZodObject<{
     publicBoxKey: string;
     userId: string;
     deviceId: string;
-    deviceName?: string | undefined;
     userName?: string | undefined;
+    deviceName?: string | undefined;
 }, {
     publicKey: string;
     publicBoxKey: string;
     userId: string;
     deviceId: string;
-    deviceName?: string | undefined;
     userName?: string | undefined;
+    deviceName?: string | undefined;
 }>;
 /** Signed identity and optional presentation hints advertised by a device. */
 export type IDeviceInfo = z.infer<typeof deviceInfoSchema>;
@@ -81,8 +81,8 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
     deviceId: string;
     connectionId: string;
     serverAddress: string;
-    deviceName?: string | undefined;
     userName?: string | undefined;
+    deviceName?: string | undefined;
 }, {
     timestamp: number;
     publicKey: string;
@@ -91,8 +91,8 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
     deviceId: string;
     connectionId: string;
     serverAddress: string;
-    deviceName?: string | undefined;
     userName?: string | undefined;
+    deviceName?: string | undefined;
 }>;
 /** Signed device information bound to one connection handshake. */
 export type IDeviceHandshake = z.infer<typeof deviceHandshakeSchema>;

package/dist/data/group-share.js

@@ -4,7 +4,6 @@ exports.generateGroupShare = generateGroupShare;
 exports.seedGroupContextFromShare = seedGroupContextFromShare;
 exports.validateGroupShare = validateGroupShare;
 exports.copyToClipboard = copyToClipboard;
-const __1 = require("..");
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const group_member_roles_1 = require("./group-member-roles");
 const group_members_1 = require("./group-members");
@@ -36,37 +35,6 @@ async function generateGroupShare(groupId) {
     };
     return groupShare;
 }
-/**
- * Imports a GroupShare object, creating the group and seeding admin members
- * @param groupShareJson JSON string containing the GroupShare data
- * @returns Promise<string> The imported group ID
- * @throws Error if JSON invalid or import fails
- */
-async function importGroupShare(groupShareJson) {
-    // Parse and validate JSON
-    let groupShare;
-    try {
-        groupShare = JSON.parse(groupShareJson);
-    }
-    catch (_error) {
-        throw new Error("Invalid JSON format");
-    }
-    // Validate structure - maybe redo this with a zod schema
-    if (!validateGroupShare(groupShare)) {
-        throw new Error("Invalid GroupShare structure");
-    }
-    const userContext = await (0, user_context_singleton_1.getUserContext)();
-    const { group } = groupShare;
-    // Check if group already exists
-    const existingGroup = await (0, groups_1.Groups)(userContext.userDataContext).get(group.groupId);
-    if (existingGroup) {
-        throw new Error(`Group "${group.name}" already exists`);
-    }
-    // Save group to user's groups table
-    await (0, groups_1.Groups)(userContext.userDataContext).save(group, { restoreIfDeleted: true });
-    await seedGroupContextFromShare(userContext, groupShare);
-    return group.groupId;
-}
 /**
  * Write a group record and missing membership rows into the group's data context.
  *
@@ -172,12 +140,6 @@ async function copyToClipboard(text) {
         return false;
     }
 }
-// get around circular dependency issue
-setTimeout(() => {
-    if (__1.rpcServerCalls) {
-        __1.rpcServerCalls.importGroupShare = (groupShareJson) => importGroupShare(groupShareJson);
-    }
-}, 10);
 function getLowestDataSource(table) {
     let ds = table.dataSource;
     for (let i = 0; i < 100; i++) {

package/dist/data/index.d.ts

@@ -21,6 +21,7 @@ export * from "./package-versions";
 export * from "./packages";
 export * from "./packages.utils";
 export * from "./peer-types";
+export * from "./peers-services-registration.pvar";
 export * from "./persistent-vars";
 export * from "./sync-recovery-queue";
 export * from "./table-definitions-table";

package/dist/data/index.js

@@ -37,6 +37,7 @@ __exportStar(require("./package-versions"), exports);
 __exportStar(require("./packages"), exports);
 __exportStar(require("./packages.utils"), exports);
 __exportStar(require("./peer-types"), exports);
+__exportStar(require("./peers-services-registration.pvar"), exports);
 __exportStar(require("./persistent-vars"), exports);
 __exportStar(require("./sync-recovery-queue"), exports);
 __exportStar(require("./table-definitions-table"), exports);

package/dist/data/invites.d.ts

@@ -10,7 +10,7 @@ export type InviteStatus = z.infer<typeof inviteStatusSchema>;
  * - `direct`: a known contact was invited to a group (3a); the payload is the approval.
  * - `approve`: group link whose join requests the inviter approves (3b).
  * - `open`: group link any Admin+ member auto-approves (3c).
- * - `profile`: the reusable contact QR on the Account screen.
+ * - `profile`: the reusable contact QR on Identity → People.
  * - `contact`: a one-off contact token.
  */
 export declare const inviteModeSchema: z.ZodEnum<["direct", "approve", "open", "profile", "contact"]>;
@@ -28,7 +28,7 @@ export declare const inviteDeliveryStateSchema: z.ZodEnum<["queued", "sent"]>;
 export declare const inviteSchema: z.ZodObject<{
     inviteId: z.ZodEffects<z.ZodString, string, string>;
     direction: z.ZodEnum<["in", "out"]>;
-    type: z.ZodEnum<["contact", "group"]>;
+    type: z.ZodEnum<["contact", "group", "device"]>;
     status: z.ZodDefault<z.ZodEnum<["pending", "accepted", "declined", "expired", "revoked"]>>;
     mode: z.ZodEnum<["direct", "approve", "open", "profile", "contact"]>;
     /** The other party, once known (unknown for outstanding link invites). */
@@ -179,25 +179,22 @@ export declare const inviteSchema: z.ZodObject<{
     resolvedAt: z.ZodOptional<z.ZodDate>;
     note: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
-    type: "group" | "contact";
+    type: "group" | "device" | "contact";
     direction: "in" | "out";
     status: "pending" | "expired" | "accepted" | "declined" | "revoked";
-    expiresAt: Date;
     createdAt: Date;
+    expiresAt: Date;
     mode: "direct" | "open" | "approve" | "contact" | "profile";
     epoch: number;
     inviteId: string;
     role?: GroupMemberRole | undefined;
     nonce?: string | undefined;
     groupId?: string | undefined;
-    counterpart?: {
-        publicKey: string;
-        publicBoxKey: string;
-        userId: string;
-        displayName?: string | undefined;
+    payload?: {
+        nonce: string;
+        contents: string;
+        fromPublicKey: string;
     } | undefined;
-    counterpartDeviceId?: string | undefined;
-    groupName?: string | undefined;
     token?: {
         type: "group" | "contact";
         nonce: string;
@@ -221,18 +218,21 @@ export declare const inviteSchema: z.ZodObject<{
             mode: "open" | "approve";
         } | undefined;
     } | undefined;
-    payload?: {
-        nonce: string;
-        contents: string;
-        fromPublicKey: string;
+    counterpart?: {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        displayName?: string | undefined;
     } | undefined;
+    counterpartDeviceId?: string | undefined;
+    groupName?: string | undefined;
     parentInviteId?: string | undefined;
     deliveryState?: "queued" | "sent" | undefined;
     recipientUserId?: string | undefined;
     resolvedAt?: Date | undefined;
     note?: string | undefined;
 }, {
-    type: "group" | "contact";
+    type: "group" | "device" | "contact";
     direction: "in" | "out";
     expiresAt: Date;
     mode: "direct" | "open" | "approve" | "contact" | "profile";
@@ -243,14 +243,11 @@ export declare const inviteSchema: z.ZodObject<{
     status?: "pending" | "expired" | "accepted" | "declined" | "revoked" | undefined;
     groupId?: string | undefined;
     createdAt?: Date | undefined;
-    counterpart?: {
-        publicKey: string;
-        publicBoxKey: string;
-        userId: string;
-        displayName?: string | undefined;
+    payload?: {
+        nonce: string;
+        contents: string;
+        fromPublicKey: string;
     } | undefined;
-    counterpartDeviceId?: string | undefined;
-    groupName?: string | undefined;
     token?: {
         type: "group" | "contact";
         nonce: string;
@@ -274,11 +271,14 @@ export declare const inviteSchema: z.ZodObject<{
             mode: "open" | "approve";
         } | undefined;
     } | undefined;
-    payload?: {
-        nonce: string;
-        contents: string;
-        fromPublicKey: string;
+    counterpart?: {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        displayName?: string | undefined;
     } | undefined;
+    counterpartDeviceId?: string | undefined;
+    groupName?: string | undefined;
     parentInviteId?: string | undefined;
     deliveryState?: "queued" | "sent" | undefined;
     recipientUserId?: string | undefined;
@@ -293,25 +293,22 @@ export type IInvite = z.infer<typeof inviteSchema>;
  * @param dataContext - Optional data context; defaults to the current singleton.
  */
 export declare function Invites(dataContext?: DataContext): import("..").Table<{
-    type: "group" | "contact";
+    type: "group" | "device" | "contact";
     direction: "in" | "out";
     status: "pending" | "expired" | "accepted" | "declined" | "revoked";
-    expiresAt: Date;
     createdAt: Date;
+    expiresAt: Date;
     mode: "direct" | "open" | "approve" | "contact" | "profile";
     epoch: number;
     inviteId: string;
     role?: GroupMemberRole | undefined;
     nonce?: string | undefined;
     groupId?: string | undefined;
-    counterpart?: {
-        publicKey: string;
-        publicBoxKey: string;
-        userId: string;
-        displayName?: string | undefined;
+    payload?: {
+        nonce: string;
+        contents: string;
+        fromPublicKey: string;
     } | undefined;
-    counterpartDeviceId?: string | undefined;
-    groupName?: string | undefined;
     token?: {
         type: "group" | "contact";
         nonce: string;
@@ -335,11 +332,14 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
             mode: "open" | "approve";
         } | undefined;
     } | undefined;
-    payload?: {
-        nonce: string;
-        contents: string;
-        fromPublicKey: string;
+    counterpart?: {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        displayName?: string | undefined;
     } | undefined;
+    counterpartDeviceId?: string | undefined;
+    groupName?: string | undefined;
     parentInviteId?: string | undefined;
     deliveryState?: "queued" | "sent" | undefined;
     recipientUserId?: string | undefined;

package/dist/data/invites.js

@@ -17,7 +17,7 @@ exports.inviteStatusSchema = zod_1.z.enum(["pending", "accepted", "declined", "e
  * - `direct`: a known contact was invited to a group (3a); the payload is the approval.
  * - `approve`: group link whose join requests the inviter approves (3b).
  * - `open`: group link any Admin+ member auto-approves (3c).
- * - `profile`: the reusable contact QR on the Account screen.
+ * - `profile`: the reusable contact QR on Identity → People.
  * - `contact`: a one-off contact token.
  */
 exports.inviteModeSchema = zod_1.z.enum(["direct", "approve", "open", "profile", "contact"]);
@@ -33,7 +33,9 @@ exports.inviteDeliveryStateSchema = zod_1.z.enum(["queued", "sent"]);
 exports.inviteSchema = zod_1.z.object({
     inviteId: zod_types_1.zodPeerId,
     direction: zod_1.z.enum(["in", "out"]).describe("Whether I issued (out) or received (in) this item"),
-    type: zod_1.z.enum(["contact", "group"]),
+    type: zod_1.z
+        .enum(["contact", "group", "device"])
+        .describe("contact, group, or a device admission slot (nothing produces device rows yet)"),
     status: exports.inviteStatusSchema.default("pending"),
     mode: exports.inviteModeSchema,
     /** The other party, once known (unknown for outstanding link invites). */

package/dist/data/peers-services-registration.pvar.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Persistent variables that record a user's registration with `peers-services`.
+ *
+ * These are the single definition of the variable names. The device runtime reads
+ * {@link PEERS_SERVICES_TOKEN_VAR} to authenticate mailbox calls; UIs and headless hosts write
+ * both variables through {@link persistPeersServicesRegistration} after a successful
+ * `registerWithPeersServices` RPC.
+ */
+/** Name of the secret user variable that holds the `peers-services` JWT. */
+export declare const PEERS_SERVICES_TOKEN_VAR = "PEERS_SERVICES_TOKEN";
+/** Name of the user variable that records when registration completed (ISO timestamp). */
+export declare const PEERS_SERVICES_REGISTERED_VAR = "PEERS_SERVICES_REGISTERED";
+/** Set when the user has completed challenge-response registration (ISO timestamp). */
+export declare const registrationStatusPvar: import("./persistent-vars").PersistentVar<string>;
+/**
+ * The `peers-services` JWT, encrypted at rest with the user's secret key and synced to all of
+ * the user's devices.
+ */
+export declare const servicesTokenPvar: import("./persistent-vars").PersistentVar<string>;
+/**
+ * Store the JWT and the local "registered" flag after a successful `registerWithPeersServices`
+ * call.
+ *
+ * Waits for both variables to finish loading first: a value written before the initial load
+ * completes is overwritten by the stored (empty) value when the load lands. Resolves once the
+ * new values have been saved, so a host can register, persist, and only then report ready.
+ * UIs may call this without awaiting.
+ */
+export declare function persistPeersServicesRegistration(token: string): Promise<void>;
+/**
+ * Replace the stored JWT after a routine re-authentication.
+ *
+ * Unlike {@link persistPeersServicesRegistration} this leaves the "registered" timestamp
+ * alone: the user registered once, and the Account screen shows that date, not the date of
+ * the latest token renewal. Same loading-promise discipline as the registration write.
+ */
+export declare function persistPeersServicesToken(token: string): Promise<void>;

package/dist/data/peers-services-registration.pvar.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * Persistent variables that record a user's registration with `peers-services`.
+ *
+ * These are the single definition of the variable names. The device runtime reads
+ * {@link PEERS_SERVICES_TOKEN_VAR} to authenticate mailbox calls; UIs and headless hosts write
+ * both variables through {@link persistPeersServicesRegistration} after a successful
+ * `registerWithPeersServices` RPC.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.servicesTokenPvar = exports.registrationStatusPvar = exports.PEERS_SERVICES_REGISTERED_VAR = exports.PEERS_SERVICES_TOKEN_VAR = void 0;
+exports.persistPeersServicesRegistration = persistPeersServicesRegistration;
+exports.persistPeersServicesToken = persistPeersServicesToken;
+const persistent_vars_1 = require("./persistent-vars");
+/** Name of the secret user variable that holds the `peers-services` JWT. */
+exports.PEERS_SERVICES_TOKEN_VAR = "PEERS_SERVICES_TOKEN";
+/** Name of the user variable that records when registration completed (ISO timestamp). */
+exports.PEERS_SERVICES_REGISTERED_VAR = "PEERS_SERVICES_REGISTERED";
+/** Set when the user has completed challenge-response registration (ISO timestamp). */
+exports.registrationStatusPvar = (0, persistent_vars_1.userVar)(exports.PEERS_SERVICES_REGISTERED_VAR, {
+    defaultValue: "",
+});
+/**
+ * The `peers-services` JWT, encrypted at rest with the user's secret key and synced to all of
+ * the user's devices.
+ */
+exports.servicesTokenPvar = (0, persistent_vars_1.userVar)(exports.PEERS_SERVICES_TOKEN_VAR, {
+    isSecret: true,
+    defaultValue: "",
+});
+/**
+ * Store the JWT and the local "registered" flag after a successful `registerWithPeersServices`
+ * call.
+ *
+ * Waits for both variables to finish loading first: a value written before the initial load
+ * completes is overwritten by the stored (empty) value when the load lands. Resolves once the
+ * new values have been saved, so a host can register, persist, and only then report ready.
+ * UIs may call this without awaiting.
+ */
+async function persistPeersServicesRegistration(token) {
+    await Promise.all([exports.servicesTokenPvar.loadingPromise, exports.registrationStatusPvar.loadingPromise]);
+    (0, exports.servicesTokenPvar)(token);
+    (0, exports.registrationStatusPvar)(new Date().toISOString());
+    await Promise.all([exports.servicesTokenPvar.loadingPromise, exports.registrationStatusPvar.loadingPromise]);
+}
+/**
+ * Replace the stored JWT after a routine re-authentication.
+ *
+ * Unlike {@link persistPeersServicesRegistration} this leaves the "registered" timestamp
+ * alone: the user registered once, and the Account screen shows that date, not the date of
+ * the latest token renewal. Same loading-promise discipline as the registration write.
+ */
+async function persistPeersServicesToken(token) {
+    await exports.servicesTokenPvar.loadingPromise;
+    (0, exports.servicesTokenPvar)(token);
+    await exports.servicesTokenPvar.loadingPromise;
+}