@peers-app/peers-sdk 0.25.10 → 0.25.12

package/dist/contracts/index.d.ts

@@ -15,7 +15,7 @@ export { createRemoteContractEndpoint, getRemoteContractTransportFactory, type I
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./system/device-operations-contract";
 export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentitySessionInfo, } from "./system/identity-contract";
 export { getInvitesContractDefinition, type IAcceptInviteResult, type ICreatedInvite, type IInvitePreview, type IInvitesConsumer, INVITES_CONTRACT_VERSION, } from "./system/invites-contract";
-export { getLocalFoldersContractDefinition, type ILocalFolderChange, type ILocalFolderChangedEvent, type ILocalFolderEntry, type ILocalFolderFileBlocks, type ILocalFolderFileBlocksInput, type ILocalFolderGrantInfo, type ILocalFolderIndexInput, type ILocalFolderJobFinishedEvent, type ILocalFolderJobHandle, type ILocalFolderJobInfo, type ILocalFolderJobProgressEvent, type ILocalFolderListInput, type ILocalFolderMoveInput, type ILocalFolderPathInput, type ILocalFolderPurgeTrashInput, type ILocalFolderReadRangeInput, type ILocalFolderReadRangeResult, type ILocalFolderRequestGrantInput, type ILocalFolderStatInput, LOCAL_FOLDERS_CHUNK_AVG, LOCAL_FOLDERS_CHUNK_MAX, LOCAL_FOLDERS_CHUNK_MIN, LOCAL_FOLDERS_CONTRACT_VERSION, LOCAL_FOLDERS_JOB_TTL_MS, LOCAL_FOLDERS_READ_RANGE_MAX, LOCAL_FOLDERS_RESERVED_DIR, type LocalFolderChangeKind, type LocalFolderEntryKind, type LocalFolderMode, localFoldersProviderPackageId, } from "./system/local-folders-contract";
+export { getLocalFoldersContractDefinition, type ILocalFolderAssembleInput, type ILocalFolderAssembleResult, type ILocalFolderChange, type ILocalFolderChangedEvent, type ILocalFolderEntry, type ILocalFolderFileBlocks, type ILocalFolderFileBlocksInput, type ILocalFolderGrantInfo, type ILocalFolderIndexInput, type ILocalFolderIndexResult, type ILocalFolderJobFinishedEvent, type ILocalFolderJobHandle, type ILocalFolderJobInfo, type ILocalFolderJobProgressEvent, type ILocalFolderListInput, type ILocalFolderManifestBlock, type ILocalFolderMoveInput, type ILocalFolderPathInput, type ILocalFolderPurgeTrashInput, type ILocalFolderReadRangeInput, type ILocalFolderReadRangeResult, type ILocalFolderRequestGrantInput, type ILocalFolderStatInput, LOCAL_FOLDERS_ASSEMBLE_STALL_MS, LOCAL_FOLDERS_CHUNK_AVG, LOCAL_FOLDERS_CHUNK_MAX, LOCAL_FOLDERS_CHUNK_MIN, LOCAL_FOLDERS_CONTRACT_VERSION, LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS, LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES, LOCAL_FOLDERS_HAVE_BATCH, LOCAL_FOLDERS_JOB_TTL_MS, LOCAL_FOLDERS_READ_RANGE_MAX, LOCAL_FOLDERS_RESERVED_DIR, type LocalFolderChangeKind, type LocalFolderEntryKind, type LocalFolderJobKind, type LocalFolderMode, localFoldersProviderPackageId, } from "./system/local-folders-contract";
 export { getLogsContractDefinition, type ILogsConsumer, LOGS_CONTRACT_VERSION, resolveLogsContract, } from "./system/logs-contract";
 export * from "./system/network-contracts";
 export { getToolAccessControlContractDefinition, type IToolAccessControlConsumer, TOOL_ACCESS_CONTROL_CONTRACT_VERSION, } from "./system/tool-access-control-contract";

package/dist/contracts/index.js

@@ -15,7 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEVICE_OPERATIONS_MAX_ROWS = exports.DEVICE_OPERATIONS_MAX_RESULT_BYTES = exports.DEVICE_OPERATIONS_MAX_QUERY_LENGTH = exports.DEVICE_OPERATIONS_CONTRACT_VERSION = exports.setRemoteContractTransportFactory = exports.resolveRemoteTargetEndpoint = exports.getRemoteContractTransportFactory = exports.createRemoteContractEndpoint = exports.ContractRegistry = exports.PersistentContractRegistry = exports.waitForHostContractTransport = exports.subscribeHostContractTransport = exports.registerHostContractTransport = exports.getHostContractTransport = exports.hostContractConsumer = exports.setSchemaToFieldsFn = exports.extractToolShape = exports.extractTableShape = exports.createLocalContractConsumer = exports.contractsSchema = exports.contractsMetaData = exports.ContractsTable = exports.Contracts = exports.inProcessTransportPair = exports.connectionContractTransport = exports.CONTRACT_REQUEST_CHANNEL = exports.CONTRACT_NOTIFY_CHANNEL = exports.verifyRemoteContractIdentity = exports.registerContractResolver = exports.isSelfTrustedContractCaller = exports.handleContractCall = exports.getContractResolver = exports.createUserContextContractProviderRouter = exports.createLocalUserContextContractProviderRouter = exports.authorizeRemoteContractCall = exports.sameUserContractPermissionCheck = exports.createRemoteContractConsumer = exports.createContractProviderSession = exports.createContractProviderEndpoint = exports.createContractProvider = exports.createContractConsumer = exports.CONTRACT_CALL_RPC = exports.contractProvidersSchema = exports.contractProvidersMetaData = exports.ContractProvidersTable = exports.ContractProviders = exports.createContractProviderRouter = exports.PackageBuilder = exports.definePackage = exports.ContractBuilder = void 0;
-exports.validateProviderSatisfiesContract = exports.validateImmutability = exports.validateAlsoImplements = exports.contractKey = exports.registerSystemContract = exports.listSystemContracts = exports.installSystemContracts = exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContractDefinition = exports.resolveLogsContract = exports.LOGS_CONTRACT_VERSION = exports.getLogsContractDefinition = exports.localFoldersProviderPackageId = exports.LOCAL_FOLDERS_RESERVED_DIR = exports.LOCAL_FOLDERS_READ_RANGE_MAX = exports.LOCAL_FOLDERS_JOB_TTL_MS = exports.LOCAL_FOLDERS_CONTRACT_VERSION = exports.LOCAL_FOLDERS_CHUNK_MIN = exports.LOCAL_FOLDERS_CHUNK_MAX = exports.LOCAL_FOLDERS_CHUNK_AVG = exports.getLocalFoldersContractDefinition = exports.INVITES_CONTRACT_VERSION = exports.getInvitesContractDefinition = exports.IDENTITY_CONTRACT_VERSION = exports.getIdentityContractDefinition = exports.getDeviceOperationsContractDefinition = exports.deviceOperationsToolIds = exports.deviceOperationsProviderPackageId = exports.DEVICE_OPERATIONS_MAX_TOOLS = void 0;
+exports.validateProviderSatisfiesContract = exports.validateImmutability = exports.validateAlsoImplements = exports.contractKey = exports.registerSystemContract = exports.listSystemContracts = exports.installSystemContracts = exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContractDefinition = exports.resolveLogsContract = exports.LOGS_CONTRACT_VERSION = exports.getLogsContractDefinition = exports.localFoldersProviderPackageId = exports.LOCAL_FOLDERS_RESERVED_DIR = exports.LOCAL_FOLDERS_READ_RANGE_MAX = exports.LOCAL_FOLDERS_JOB_TTL_MS = exports.LOCAL_FOLDERS_HAVE_BATCH = exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES = exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS = exports.LOCAL_FOLDERS_CONTRACT_VERSION = exports.LOCAL_FOLDERS_CHUNK_MIN = exports.LOCAL_FOLDERS_CHUNK_MAX = exports.LOCAL_FOLDERS_CHUNK_AVG = exports.LOCAL_FOLDERS_ASSEMBLE_STALL_MS = exports.getLocalFoldersContractDefinition = exports.INVITES_CONTRACT_VERSION = exports.getInvitesContractDefinition = exports.IDENTITY_CONTRACT_VERSION = exports.getIdentityContractDefinition = exports.getDeviceOperationsContractDefinition = exports.deviceOperationsToolIds = exports.deviceOperationsProviderPackageId = exports.DEVICE_OPERATIONS_MAX_TOOLS = void 0;
 var builder_1 = require("./builder");
 Object.defineProperty(exports, "ContractBuilder", { enumerable: true, get: function () { return builder_1.ContractBuilder; } });
 Object.defineProperty(exports, "definePackage", { enumerable: true, get: function () { return builder_1.definePackage; } });
@@ -93,10 +93,14 @@ Object.defineProperty(exports, "getInvitesContractDefinition", { enumerable: tru
 Object.defineProperty(exports, "INVITES_CONTRACT_VERSION", { enumerable: true, get: function () { return invites_contract_1.INVITES_CONTRACT_VERSION; } });
 var local_folders_contract_1 = require("./system/local-folders-contract");
 Object.defineProperty(exports, "getLocalFoldersContractDefinition", { enumerable: true, get: function () { return local_folders_contract_1.getLocalFoldersContractDefinition; } });
+Object.defineProperty(exports, "LOCAL_FOLDERS_ASSEMBLE_STALL_MS", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_ASSEMBLE_STALL_MS; } });
 Object.defineProperty(exports, "LOCAL_FOLDERS_CHUNK_AVG", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_CHUNK_AVG; } });
 Object.defineProperty(exports, "LOCAL_FOLDERS_CHUNK_MAX", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_CHUNK_MAX; } });
 Object.defineProperty(exports, "LOCAL_FOLDERS_CHUNK_MIN", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_CHUNK_MIN; } });
 Object.defineProperty(exports, "LOCAL_FOLDERS_CONTRACT_VERSION", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_CONTRACT_VERSION; } });
+Object.defineProperty(exports, "LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS; } });
+Object.defineProperty(exports, "LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES; } });
+Object.defineProperty(exports, "LOCAL_FOLDERS_HAVE_BATCH", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_HAVE_BATCH; } });
 Object.defineProperty(exports, "LOCAL_FOLDERS_JOB_TTL_MS", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_JOB_TTL_MS; } });
 Object.defineProperty(exports, "LOCAL_FOLDERS_READ_RANGE_MAX", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_READ_RANGE_MAX; } });
 Object.defineProperty(exports, "LOCAL_FOLDERS_RESERVED_DIR", { enumerable: true, get: function () { return local_folders_contract_1.LOCAL_FOLDERS_RESERVED_DIR; } });

package/dist/contracts/system/local-folders-contract.d.ts

@@ -11,8 +11,20 @@ export declare const LOCAL_FOLDERS_CHUNK_AVG: number;
 export declare const LOCAL_FOLDERS_CHUNK_MAX: number;
 /** Directory name reserved inside every grant for trash and in-flight files. */
 export declare const LOCAL_FOLDERS_RESERVED_DIR = ".peers";
-/** How long finished index jobs stay readable via `getJob`. */
+/** How long finished index and assemble jobs stay readable via `getJob`. */
 export declare const LOCAL_FOLDERS_JOB_TTL_MS: number;
+/**
+ * How long an assemble job waits without receiving a block before it fails
+ * with `stalled`. A later assemble of the same block list resumes from the
+ * partial file.
+ */
+export declare const LOCAL_FOLDERS_ASSEMBLE_STALL_MS: number;
+/** Maximum hashes in one `haveBlocks` request on the block-exchange path. */
+export declare const LOCAL_FOLDERS_HAVE_BATCH = 2000;
+/** Maximum blocks in one `getBlocks` request. */
+export declare const LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS = 32;
+/** Maximum total bytes in one `getBlocks` request. */
+export declare const LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES: number;
 /** Package ID used by live System Local Folders tool instances. */
 export declare const localFoldersProviderPackageId = "000peers0system0000000001";
 /** Grant mode accepted by `requestGrant`. */
@@ -101,20 +113,48 @@ export interface ILocalFolderFileBlocks {
         size: number;
     }[];
 }
-/** Index job snapshot returned by `getJob`. */
+/** One content-defined block in an assemble manifest. */
+export interface ILocalFolderManifestBlock {
+    hash: string;
+    size: number;
+}
+/** Input for `assemble`. `blocks` is the ordered manifest to write. */
+export interface ILocalFolderAssembleInput {
+    grantId: string;
+    /** Relative file path to create or replace. */
+    relPath: string;
+    blocks: ILocalFolderManifestBlock[];
+    /** mtime applied to the finished file, in unix epoch milliseconds. */
+    mtimeMs?: number;
+    /** Unix permission bits. Only the low 9 bits are applied. */
+    mode?: number;
+    /** Device ids allowed to serve blocks. Omit to ask every eligible peer. */
+    sources?: string[];
+}
+/** Counts from a finished index job. */
+export interface ILocalFolderIndexResult {
+    files: number;
+    rehashed: number;
+    skipped: number;
+    removed: number;
+}
+/** Counts from a finished assemble job. `sources` is how many peers sent bytes. */
+export interface ILocalFolderAssembleResult {
+    bytesPulled: number;
+    bytesReused: number;
+    sources: number;
+}
+/** Host job kind reported by `getJob`. */
+export type LocalFolderJobKind = "index" | "assemble";
+/** Index or assemble job snapshot returned by `getJob`. */
 export interface ILocalFolderJobInfo {
     jobId: string;
-    kind: "index";
+    kind: LocalFolderJobKind;
     status: "running" | "done" | "error" | "cancelled";
     done: number;
     total: number;
     error?: string;
-    result?: {
-        files: number;
-        rehashed: number;
-        skipped: number;
-        removed: number;
-    };
+    result?: ILocalFolderIndexResult | ILocalFolderAssembleResult;
 }
 /** Input for `move`. */
 export interface ILocalFolderMoveInput {

package/dist/contracts/system/local-folders-contract.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.localFoldersProviderPackageId = exports.LOCAL_FOLDERS_JOB_TTL_MS = exports.LOCAL_FOLDERS_RESERVED_DIR = exports.LOCAL_FOLDERS_CHUNK_MAX = exports.LOCAL_FOLDERS_CHUNK_AVG = exports.LOCAL_FOLDERS_CHUNK_MIN = exports.LOCAL_FOLDERS_READ_RANGE_MAX = exports.LOCAL_FOLDERS_CONTRACT_VERSION = void 0;
+exports.localFoldersProviderPackageId = exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES = exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS = exports.LOCAL_FOLDERS_HAVE_BATCH = exports.LOCAL_FOLDERS_ASSEMBLE_STALL_MS = exports.LOCAL_FOLDERS_JOB_TTL_MS = exports.LOCAL_FOLDERS_RESERVED_DIR = exports.LOCAL_FOLDERS_CHUNK_MAX = exports.LOCAL_FOLDERS_CHUNK_AVG = exports.LOCAL_FOLDERS_CHUNK_MIN = exports.LOCAL_FOLDERS_READ_RANGE_MAX = exports.LOCAL_FOLDERS_CONTRACT_VERSION = void 0;
 exports.getLocalFoldersContractDefinition = getLocalFoldersContractDefinition;
 const system_ids_1 = require("../../system-ids");
 const field_type_1 = require("../../types/field-type");
@@ -17,8 +17,20 @@ exports.LOCAL_FOLDERS_CHUNK_AVG = 1024 * 1024;
 exports.LOCAL_FOLDERS_CHUNK_MAX = 4 * 1024 * 1024;
 /** Directory name reserved inside every grant for trash and in-flight files. */
 exports.LOCAL_FOLDERS_RESERVED_DIR = ".peers";
-/** How long finished index jobs stay readable via `getJob`. */
+/** How long finished index and assemble jobs stay readable via `getJob`. */
 exports.LOCAL_FOLDERS_JOB_TTL_MS = 60 * 60 * 1000;
+/**
+ * How long an assemble job waits without receiving a block before it fails
+ * with `stalled`. A later assemble of the same block list resumes from the
+ * partial file.
+ */
+exports.LOCAL_FOLDERS_ASSEMBLE_STALL_MS = 10 * 60 * 1000;
+/** Maximum hashes in one `haveBlocks` request on the block-exchange path. */
+exports.LOCAL_FOLDERS_HAVE_BATCH = 2000;
+/** Maximum blocks in one `getBlocks` request. */
+exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS = 32;
+/** Maximum total bytes in one `getBlocks` request. */
+exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES = 64 * 1024 * 1024;
 /** Package ID used by live System Local Folders tool instances. */
 exports.localFoldersProviderPackageId = system_ids_1.peersSystemPackageId;
 const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
@@ -36,7 +48,7 @@ function getLocalFoldersContractDefinition() {
         version: exports.LOCAL_FOLDERS_CONTRACT_VERSION,
         devTag: "dev",
         name: "System Local Folders",
-        description: "Scoped access to operator-granted folders on this device: listing, bounded reads, indexing, move, and trash.",
+        description: "Scoped access to operator-granted folders on this device: listing, bounded reads, indexing, assemble, move, and trash.",
         tables: [],
         tools: [
             {
@@ -144,26 +156,44 @@ function getLocalFoldersContractDefinition() {
                     }),
                 ],
             },
+            {
+                name: "assemble",
+                usageDescription: "Start a host job that writes a file from an ordered block list. Missing blocks are pulled from opted-in devices. Requires a readwrite grant.",
+                inputFields: [
+                    grantIdField,
+                    field("relPath", field_type_1.FieldType.string, "Relative file path to create or replace."),
+                    field("blocks", field_type_1.FieldType.object, "Ordered blocks with hash and size.", {
+                        isArray: true,
+                    }),
+                    field("mtimeMs", field_type_1.FieldType.number, "mtime applied to the finished file.", {
+                        optional: true,
+                    }),
+                    field("mode", field_type_1.FieldType.number, "Unix permission bits (low 9 bits).", { optional: true }),
+                    field("sources", field_type_1.FieldType.id, "Device ids allowed to serve blocks.", {
+                        optional: true,
+                        isArray: true,
+                    }),
+                ],
+                outputFields: [field("jobId", field_type_1.FieldType.id, "Assemble job id.")],
+            },
             {
                 name: "getJob",
-                usageDescription: "Return the status of an index job, including after it finishes.",
-                inputFields: [field("jobId", field_type_1.FieldType.id, "Job id returned by index.")],
+                usageDescription: "Return the status of an index or assemble job, including after it finishes.",
+                inputFields: [field("jobId", field_type_1.FieldType.id, "Job id returned by index or assemble.")],
                 outputFields: [
                     field("jobId", field_type_1.FieldType.id, "Job id."),
-                    field("kind", field_type_1.FieldType.string, "Job kind. v1 is index."),
+                    field("kind", field_type_1.FieldType.string, 'Job kind: "index" or "assemble".'),
                     field("status", field_type_1.FieldType.string, "running, done, error, or cancelled."),
                     field("done", field_type_1.FieldType.number, "Units completed."),
                     field("total", field_type_1.FieldType.number, "Units discovered."),
                     field("error", field_type_1.FieldType.string, "Failure message.", { optional: true }),
-                    field("result", field_type_1.FieldType.object, "Index counts when status is done.", {
-                        optional: true,
-                    }),
+                    field("result", field_type_1.FieldType.object, "Index counts ({ files, rehashed, skipped, removed }) or assemble counts ({ bytesPulled, bytesReused, sources }) when status is done.", { optional: true }),
                 ],
             },
             {
                 name: "cancelJob",
-                usageDescription: "Cancel a running index job.",
-                inputFields: [field("jobId", field_type_1.FieldType.id, "Job id returned by index.")],
+                usageDescription: "Cancel a running index or assemble job. An assemble keeps its partial file.",
+                inputFields: [field("jobId", field_type_1.FieldType.id, "Job id returned by index or assemble.")],
                 outputFields: [field("cancelled", field_type_1.FieldType.boolean, "Whether the job was cancelled.")],
             },
             {
@@ -207,7 +237,7 @@ function getLocalFoldersContractDefinition() {
             },
             {
                 name: "jobProgress",
-                description: "Progress for a host index job.",
+                description: "Progress for a host index or assemble job.",
                 payloadFields: [
                     field("jobId", field_type_1.FieldType.id, "Job id."),
                     field("done", field_type_1.FieldType.number, "Units completed."),
@@ -216,7 +246,7 @@ function getLocalFoldersContractDefinition() {
             },
             {
                 name: "jobFinished",
-                description: "An index job finished, failed, or was cancelled.",
+                description: "An index or assemble job finished, failed, or was cancelled.",
                 payloadFields: [
                     field("jobId", field_type_1.FieldType.id, "Job id."),
                     field("status", field_type_1.FieldType.string, "done, error, or cancelled."),

package/dist/package-installer/index.d.ts

@@ -10,4 +10,5 @@ export * from "./package-remote-checker";
 export * from "./package-seed-installer";
 export * from "./package-tarball";
 export * from "./peers-core-installer";
+export * from "./peers-core-trust-anchor";
 export * from "./types";

package/dist/package-installer/index.js

@@ -26,4 +26,5 @@ __exportStar(require("./package-remote-checker"), exports);
 __exportStar(require("./package-seed-installer"), exports);
 __exportStar(require("./package-tarball"), exports);
 __exportStar(require("./peers-core-installer"), exports);
+__exportStar(require("./peers-core-trust-anchor"), exports);
 __exportStar(require("./types"), exports);

package/dist/package-installer/package-author-signing.d.ts

@@ -2,6 +2,16 @@ import type { IPackageVersion } from "../data/package-versions";
 import type { IAppNav } from "../types/app-nav";
 /** Prefix for the persistent variable name that stores a package's signing secret key. */
 export declare const PACKAGE_SIGNING_KEY_PREFIX = "packageSigningKey_";
+/**
+ * Whether `publicKey` is a publisher key that must never be trusted again.
+ *
+ * The built-in list is {@link peersCoreRevokedPublishPublicKeys}; callers (and tests) may pass
+ * their own. An empty or missing key is not "revoked", it is simply not a key.
+ *
+ * @param publicKey - base64url Ed25519 public key to check
+ * @param revoked - list to check against; defaults to the peers-core revocations
+ */
+export declare function isRevokedPublisherKey(publicKey: string | undefined, revoked?: readonly string[]): boolean;
 /**
  * The subset of PackageVersion fields that the publisher signs.
  * The `publicKey` field is included so verifiers know which key to check against.
@@ -47,8 +57,13 @@ export interface IVerifyAuthorSignatureResult {
  * is NOT in the signature itself — it must be provided via `expectedPublicKey` (TOFU check)
  * to reconstruct the payload and verify.
  *
+ * A key in {@link peersCoreRevokedPublishPublicKeys} never verifies, even with a
+ * mathematically valid signature: a revoked key may be in an attacker's hands, so anything it
+ * signed after revocation is untrustworthy and anything before is already installed.
+ *
  * @param pv - The PackageVersion record with `packageAuthorSignature` set
  * @param expectedPublicKey - The public key to verify against (from Package.publishPublicKey)
- * @returns `{ valid, publicKey }` — valid is true if signature verifies and key matches
+ * @returns `{ valid, publicKey }` — valid is true if signature verifies, key matches, and the
+ *   key is not revoked
  */
 export declare function verifyPackageAuthorSignature(pv: AuthorSignableFields & Pick<IPackageVersion, "packageAuthorSignature">, expectedPublicKey: string): IVerifyAuthorSignatureResult;

package/dist/package-installer/package-author-signing.js

@@ -1,14 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PACKAGE_SIGNING_KEY_PREFIX = void 0;
+exports.isRevokedPublisherKey = isRevokedPublisherKey;
 exports.buildAuthorSignedPayload = buildAuthorSignedPayload;
 exports.signPackageAuthor = signPackageAuthor;
 exports.verifyPackageAuthorSignature = verifyPackageAuthorSignature;
 const nacl = require("tweetnacl");
 const tweetnacl_util_1 = require("tweetnacl-util");
 const keys_1 = require("../keys");
+const system_ids_1 = require("../system-ids");
 /** Prefix for the persistent variable name that stores a package's signing secret key. */
 exports.PACKAGE_SIGNING_KEY_PREFIX = "packageSigningKey_";
+/**
+ * Whether `publicKey` is a publisher key that must never be trusted again.
+ *
+ * The built-in list is {@link peersCoreRevokedPublishPublicKeys}; callers (and tests) may pass
+ * their own. An empty or missing key is not "revoked", it is simply not a key.
+ *
+ * @param publicKey - base64url Ed25519 public key to check
+ * @param revoked - list to check against; defaults to the peers-core revocations
+ */
+function isRevokedPublisherKey(publicKey, revoked = system_ids_1.peersCoreRevokedPublishPublicKeys) {
+    return !!publicKey && revoked.includes(publicKey);
+}
 /**
  * Extracts the signable payload from a PackageVersion record.
  * Only includes optional fields when they have a value (undefined fields are omitted
@@ -59,13 +73,18 @@ function signPackageAuthor(pv, secretKey) {
  * is NOT in the signature itself — it must be provided via `expectedPublicKey` (TOFU check)
  * to reconstruct the payload and verify.
  *
+ * A key in {@link peersCoreRevokedPublishPublicKeys} never verifies, even with a
+ * mathematically valid signature: a revoked key may be in an attacker's hands, so anything it
+ * signed after revocation is untrustworthy and anything before is already installed.
+ *
  * @param pv - The PackageVersion record with `packageAuthorSignature` set
  * @param expectedPublicKey - The public key to verify against (from Package.publishPublicKey)
- * @returns `{ valid, publicKey }` — valid is true if signature verifies and key matches
+ * @returns `{ valid, publicKey }` — valid is true if signature verifies, key matches, and the
+ *   key is not revoked
  */
 function verifyPackageAuthorSignature(pv, expectedPublicKey) {
     const result = { valid: false, publicKey: expectedPublicKey };
-    if (!pv.packageAuthorSignature) {
+    if (!pv.packageAuthorSignature || isRevokedPublisherKey(expectedPublicKey)) {
         return result;
     }
     try {

package/dist/package-installer/package-propagation.js

@@ -11,6 +11,7 @@ const package_versions_1 = require("../data/package-versions");
 const packages_1 = require("../data/packages");
 const utils_1 = require("../utils");
 const package_author_signing_1 = require("./package-author-signing");
+const peers_core_trust_anchor_1 = require("./peers-core-trust-anchor");
 // --- Module-level state ---
 const RETRY_DELAYS_MS = [2_000, 10_000, 30_000, 60_000, 120_000];
 const pvPropagateMap = {};
@@ -190,6 +191,12 @@ async function retryOrFail(source, dest, pv, retryCnt, reason) {
  * transient failures (missing source key).
  */
 async function verifyOrEstablishTofu(sourceContext, targetContext, targetPkg, pv) {
+    // peers-core pinned to a revoked key: move the pin to the host's current key first so a
+    // version signed by the replacement key can be accepted.
+    const repinned = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(targetContext, targetPkg);
+    if (repinned !== targetPkg) {
+        targetPkg.publishPublicKey = repinned.publishPublicKey;
+    }
     if (targetPkg.publishPublicKey) {
         if (!(0, package_author_signing_1.verifyPackageAuthorSignature)(pv, targetPkg.publishPublicKey).valid) {
             console.error(`[propagation] Invalid signature for ${pv.packageVersionId}`);
@@ -201,6 +208,11 @@ async function verifyOrEstablishTofu(sourceContext, targetContext, targetPkg, pv
     const sourcePkg = await (0, packages_1.Packages)(sourceContext).get(targetPkg.packageId);
     if (!sourcePkg?.publishPublicKey)
         return false;
+    // Never adopt a revoked key as a trust anchor, however it reached the source group.
+    if ((0, package_author_signing_1.isRevokedPublisherKey)(sourcePkg.publishPublicKey)) {
+        console.error(`[propagation] Refusing revoked publisher key for ${targetPkg.packageId} from ${sourceContext.dataContextId}`);
+        return false;
+    }
     if (!(0, package_author_signing_1.verifyPackageAuthorSignature)(pv, sourcePkg.publishPublicKey).valid) {
         console.error(`[propagation] Invalid signature for ${pv.packageVersionId} (TOFU)`);
         return false;

package/dist/package-installer/package-propagation.test.js

@@ -2,10 +2,26 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const package_versions_1 = require("../data/package-versions");
 const keys_1 = require("../keys");
+const systemIds = require("../system-ids");
 const utils_1 = require("../utils");
 const package_author_signing_1 = require("./package-author-signing");
 const package_propagation_1 = require("./package-propagation");
 // --- Mocks ---
+// Pin the host to a fresh "current" peers-core key and revoke a fresh "old" one so the
+// revocation tests do not depend on the real constants.
+jest.mock("../system-ids", () => {
+    const actual = jest.requireActual("../system-ids");
+    const { newKeys: makeKeys } = jest.requireActual("../keys");
+    const revoked = makeKeys();
+    const current = makeKeys();
+    return {
+        ...actual,
+        peersCorePublishPublicKey: current.publicKey,
+        peersCoreRevokedPublishPublicKeys: [revoked.publicKey],
+        __testKeys: { revoked, current },
+    };
+});
+const { revoked: revokedCoreKeys, current: currentCoreKeys } = systemIds.__testKeys;
 const mockGetUserRole = jest.fn();
 jest.mock("../data/group-permissions", () => ({
     getUserRole: (...args) => mockGetUserRole(...args),
@@ -589,6 +605,114 @@ describe("discoverAndPropagateVersions", () => {
         expect(results).toHaveLength(0);
         consoleError.mockRestore();
     });
+    describe("revoked publisher keys", () => {
+        function twoGroupSetup() {
+            const groupA = "group-a";
+            const groupB = "group-b";
+            const groups = new Map([
+                [groupA, makeDataContext(groupA)],
+                [groupB, makeDataContext(groupB)],
+            ]);
+            const roles = new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]);
+            return { groupA, groupB, userContext: makeUserContext({ userId, groups }), roles };
+        }
+        let consoleError;
+        let consoleWarn;
+        beforeEach(() => {
+            consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
+            consoleWarn = jest.spyOn(console, "warn").mockImplementation(() => { });
+        });
+        afterEach(() => {
+            consoleError.mockRestore();
+            consoleWarn.mockRestore();
+        });
+        it("refuses to establish TOFU from a source pinned to a revoked key", async () => {
+            const { groupA, groupB, userContext, roles } = twoGroupSetup();
+            const packageId = (0, utils_1.newid)();
+            const sourcePkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
+            const targetPkg = makePkg({ packageId, publishPublicKey: "" });
+            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
+                version: "2.0.0",
+            });
+            setupMocksForScenario({
+                packages: new Map([[groupB, [targetPkg]]]),
+                pvs: new Map([
+                    [groupA, [pv]],
+                    [groupB, []],
+                ]),
+                roles,
+                sourcePackages: new Map([[groupA, new Map([[packageId, sourcePkg]])]]),
+            });
+            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+            expect(results).toHaveLength(0);
+            expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+            expect(mockPvSignAndSave).not.toHaveBeenCalled();
+            expect(consoleError).toHaveBeenCalledWith(expect.stringContaining("Refusing revoked publisher key"));
+        });
+        it("re-pins peers-core from a revoked key and accepts a version signed by the current key", async () => {
+            const { groupA, groupB, userContext, roles } = twoGroupSetup();
+            const packageId = systemIds.peersCorePackageId;
+            const sourcePkg = makePkg({ packageId, publishPublicKey: currentCoreKeys.publicKey });
+            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
+            const pv = makeSignedPVWithSecretKey(packageId, currentCoreKeys.secretKey, {
+                version: "2.0.0",
+            });
+            setupMocksForScenario({
+                packages: new Map([[groupB, [targetPkg]]]),
+                pvs: new Map([
+                    [groupA, [pv]],
+                    [groupB, []],
+                ]),
+                roles,
+                sourcePackages: new Map([[groupA, new Map([[packageId, sourcePkg]])]]),
+            });
+            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+            expect(results).toHaveLength(1);
+            expect(results[0]).toMatchObject({ groupId: groupB, packageId, version: "2.0.0" });
+            expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({ packageId, publishPublicKey: currentCoreKeys.publicKey }));
+        });
+        it("rejects a peers-core version signed by the revoked key even where that key is pinned", async () => {
+            const { groupA, groupB, userContext, roles } = twoGroupSetup();
+            const packageId = systemIds.peersCorePackageId;
+            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
+            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
+                version: "2.0.0",
+            });
+            setupMocksForScenario({
+                packages: new Map([[groupB, [targetPkg]]]),
+                pvs: new Map([
+                    [groupA, [pv]],
+                    [groupB, []],
+                ]),
+                roles,
+            });
+            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+            expect(results).toHaveLength(0);
+            expect(mockPvSignAndSave).not.toHaveBeenCalled();
+        });
+        it("does not re-pin other packages pinned to a revoked key; their versions are rejected", async () => {
+            const { groupA, groupB, userContext, roles } = twoGroupSetup();
+            const packageId = (0, utils_1.newid)();
+            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
+            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
+                version: "2.0.0",
+            });
+            setupMocksForScenario({
+                packages: new Map([[groupB, [targetPkg]]]),
+                pvs: new Map([
+                    [groupA, [pv]],
+                    [groupB, []],
+                ]),
+                roles,
+            });
+            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+            expect(results).toHaveLength(0);
+            expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+        });
+    });
     it("skips PV when packageVersionId already exists in target (dedup)", async () => {
         const groupA = "group-a";
         const groupB = "group-b";

package/dist/package-installer/package-remote-checker.js

@@ -19,6 +19,7 @@ const package_author_signing_1 = require("./package-author-signing");
 const package_installer_1 = require("./package-installer");
 const package_propagation_1 = require("./package-propagation");
 const package_tarball_1 = require("./package-tarball");
+const peers_core_trust_anchor_1 = require("./peers-core-trust-anchor");
 // Module-level memoization: unique by `updateUrl + ":" + tag`
 const remoteCheckCache = new Map();
 /**
@@ -44,9 +45,13 @@ function checkPackageRemoteForNewVersion(packageId, updateUrl, tag, http) {
  * group does not already have the remote PackageVersion.
  */
 async function checkAndInstallPackageRemoteVersion(dataContext, pkg, tag, http) {
-    if (!pkg.updateUrl || pkg.disabled)
+    const updateUrl = pkg.updateUrl;
+    if (!updateUrl || pkg.disabled)
         return null;
-    const result = await checkPackageRemoteForNewVersion(pkg.packageId, pkg.updateUrl, tag, http);
+    // A peers-core row pinned to a revoked publisher key would reject every new release; move
+    // it to the host's current anchor before looking at the remote.
+    await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(dataContext, pkg);
+    const result = await checkPackageRemoteForNewVersion(pkg.packageId, updateUrl, tag, http);
     if (!result)
         return null;
     const existing = await (0, package_versions_1.PackageVersions)(dataContext).get(result.pointer.packageVersionId);

package/dist/package-installer/package-remote-checker.test.js

@@ -32,13 +32,30 @@ const mockResolveDevicePackageVersion = jest.fn();
 jest.mock("../data/package-version-resolver", () => ({
     resolveDevicePackageVersion: (...args) => mockResolveDevicePackageVersion(...args),
 }));
+// Pin the host to a fresh "current" peers-core key and revoke a fresh "old" one so the
+// revocation tests do not depend on the real constants.
+jest.mock("../system-ids", () => {
+    const actual = jest.requireActual("../system-ids");
+    const { newKeys: makeKeys } = jest.requireActual("../keys");
+    const revoked = makeKeys();
+    const current = makeKeys();
+    return {
+        ...actual,
+        peersCorePublishPublicKey: current.publicKey,
+        peersCoreRevokedPublishPublicKeys: [revoked.publicKey],
+        __testKeys: { revoked, current },
+    };
+});
 const file_types_1 = require("../data/files/file.types");
 const keys_1 = require("../keys");
+const systemIds = require("../system-ids");
 const package_author_signing_1 = require("./package-author-signing");
 const package_remote_checker_1 = require("./package-remote-checker");
 const package_tarball_1 = require("./package-tarball");
+// PKG_ID is peers-core's id so the trust-anchor re-pin path is exercised.
 const PKG_ID = "00mh0wlipjixk2gqmurbwee0o";
 const PV_ID = "00mpdg7xstwt3oe51x9brk15i";
+const { revoked: revokedCoreKeys, current: currentCoreKeys } = systemIds.__testKeys;
 function makeContext(dataContextId) {
     return { dataContextId };
 }
@@ -234,6 +251,54 @@ describe("package-remote-checker", () => {
             expect(http.fetchJson).toHaveBeenCalledTimes(1);
             expect(mockSaveBundleFile).toHaveBeenCalled();
         });
+        it("re-pins peers-core from a revoked key and installs a release signed by the current key", async () => {
+            expect(PKG_ID).toBe(systemIds.peersCorePackageId);
+            const ctx = makeContext("user-ctx");
+            const { pointer, tarball } = await makeSignedRemoteResult(currentCoreKeys.secretKey, currentCoreKeys.publicKey);
+            let pkg = {
+                packageId: PKG_ID,
+                name: "peers-core",
+                publishPublicKey: revokedCoreKeys.publicKey,
+                updateUrl: "https://example.com/peers-core",
+            };
+            const http = {
+                fetchJson: jest.fn().mockResolvedValue(pointer),
+                fetchBinary: jest.fn().mockResolvedValue(tarball),
+            };
+            mockPackageVersionsGet.mockResolvedValue(undefined);
+            mockPackagesGet.mockImplementation(async () => pkg);
+            mockPackagesSignAndSave.mockImplementation(async (_ctx, saved) => {
+                pkg = saved;
+            });
+            const warn = jest.spyOn(console, "warn").mockImplementation(() => { });
+            const installed = await (0, package_remote_checker_1.checkAndInstallPackageRemoteVersion)(ctx, pkg, "stable", http);
+            expect(installed?.packageVersion.packageVersionId).toBe(PV_ID);
+            expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ packageId: PKG_ID, publishPublicKey: currentCoreKeys.publicKey }));
+            expect(pkg.publishPublicKey).toBe(currentCoreKeys.publicKey);
+            warn.mockRestore();
+        });
+        it("rejects a remote release signed by a revoked key", async () => {
+            const ctx = makeContext("user-ctx");
+            const { pointer, tarball } = await makeSignedRemoteResult(revokedCoreKeys.secretKey, revokedCoreKeys.publicKey);
+            const pkg = {
+                packageId: PKG_ID,
+                name: "peers-core",
+                publishPublicKey: currentCoreKeys.publicKey,
+                updateUrl: "https://example.com/peers-core-old",
+            };
+            const http = {
+                fetchJson: jest.fn().mockResolvedValue(pointer),
+                fetchBinary: jest.fn().mockResolvedValue(tarball),
+            };
+            mockPackageVersionsGet.mockResolvedValue(undefined);
+            mockPackagesGet.mockResolvedValue(pkg);
+            const error = jest.spyOn(console, "error").mockImplementation(() => { });
+            const installed = await (0, package_remote_checker_1.checkAndInstallPackageRemoteVersion)(ctx, pkg, "stable", http);
+            expect(installed).toBeNull();
+            expect(mockSaveBundleFile).not.toHaveBeenCalled();
+            expect(mockPackageVersionsSignAndSave).not.toHaveBeenCalled();
+            error.mockRestore();
+        });
     });
     describe("installRemotePackageVersion", () => {
         it("rejects publisher key mismatch before saving files", async () => {

package/dist/package-installer/peers-core-installer.d.ts

@@ -43,6 +43,10 @@ export interface IEnsurePeersCoreOpts {
  * Ensure peers-core is installed (with a usable, loaded version) in
  * `dataContext`, applying the layered strategy described in the module docs.
  *
+ * Before anything else, an already-installed peers-core whose pinned publisher key has been
+ * revoked is re-pinned to the host's current key (see `peers-core-trust-anchor.ts`), so the
+ * later remote check can accept releases signed by the replacement key.
+ *
  * @returns true if an install occurred, false if it was already present or no
  *   strategy succeeded.
  */

package/dist/package-installer/peers-core-installer.js

@@ -23,16 +23,22 @@ const packages_utils_1 = require("../data/packages.utils");
 const system_ids_1 = require("../system-ids");
 const package_remote_checker_1 = require("./package-remote-checker");
 const package_seed_installer_1 = require("./package-seed-installer");
+const peers_core_trust_anchor_1 = require("./peers-core-trust-anchor");
 const PEERS_CORE_NAME = "peers-core";
 const PEERS_CORE_DESCRIPTION = "Core system package for Peers platform";
 /**
  * Ensure peers-core is installed (with a usable, loaded version) in
  * `dataContext`, applying the layered strategy described in the module docs.
  *
+ * Before anything else, an already-installed peers-core whose pinned publisher key has been
+ * revoked is re-pinned to the host's current key (see `peers-core-trust-anchor.ts`), so the
+ * later remote check can accept releases signed by the replacement key.
+ *
  * @returns true if an install occurred, false if it was already present or no
  *   strategy succeeded.
  */
 async function ensurePeersCore(userContext, dataContext, opts) {
+    await (0, peers_core_trust_anchor_1.repinInstalledPeersCoreIfRevoked)(dataContext);
     const existingPvs = await (0, package_versions_1.PackageVersions)(dataContext).list({ packageId: system_ids_1.peersCorePackageId });
     if (existingPvs.length > 0)
         return false;

package/dist/package-installer/peers-core-installer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-installer/peers-core-installer.test.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mockPvList = jest.fn();
+jest.mock("../data/package-versions", () => ({
+    PackageVersions: (ctx) => ({
+        list: (...args) => mockPvList(ctx, ...args),
+    }),
+}));
+const mockRepinInstalled = jest.fn();
+jest.mock("./peers-core-trust-anchor", () => ({
+    repinInstalledPeersCoreIfRevoked: (...args) => mockRepinInstalled(...args),
+}));
+jest.mock("../data/packages", () => ({ Packages: () => ({}) }));
+jest.mock("../data/packages.utils", () => ({ copyPackageToAnotherDataContext: jest.fn() }));
+jest.mock("../data/package-version-resolver", () => ({
+    resolveDevicePackageVersion: jest.fn(),
+}));
+jest.mock("./package-remote-checker", () => ({
+    checkAndInstallPackageRemoteVersion: jest.fn(),
+}));
+jest.mock("./package-seed-installer", () => ({
+    ensurePackageRecord: jest.fn(),
+    seedPackageInContext: jest.fn(),
+}));
+const system_ids_1 = require("../system-ids");
+const peers_core_installer_1 = require("./peers-core-installer");
+describe("ensurePeersCore", () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockRepinInstalled.mockResolvedValue(null);
+    });
+    it("re-pins a revoked peers-core key before checking for existing versions", async () => {
+        const dataContext = { dataContextId: "user-ctx" };
+        const order = [];
+        mockRepinInstalled.mockImplementation(async () => {
+            order.push("repin");
+            return null;
+        });
+        mockPvList.mockImplementation(async () => {
+            order.push("list");
+            return [{ packageVersionId: "existing" }];
+        });
+        const installed = await (0, peers_core_installer_1.ensurePeersCore)({}, dataContext, {});
+        expect(installed).toBe(false);
+        expect(mockRepinInstalled).toHaveBeenCalledWith(dataContext);
+        expect(mockPvList).toHaveBeenCalledWith(dataContext, { packageId: system_ids_1.peersCorePackageId });
+        expect(order).toEqual(["repin", "list"]);
+    });
+});

package/dist/package-installer/peers-core-trust-anchor.d.ts

@@ -0,0 +1,47 @@
+import type { DataContext } from "../context/data-context";
+import { type IPackage } from "../data/packages";
+/**
+ * Migration of the peers-core trust anchor after a publisher-key rotation.
+ *
+ * `Packages.publishPublicKey` is pinned on first install (TOFU) and otherwise never changes, so
+ * a client that installed peers-core under a key that was later revoked would keep that key
+ * forever and reject every version signed by its replacement. This module replaces a pinned
+ * key that appears in {@link peersCoreRevokedPublishPublicKeys} with the host's current
+ * {@link peersCorePublishPublicKey}. Only peers-core is handled here: it is the one package
+ * whose trust anchor ships inside the host.
+ */
+/** Options for {@link repinPeersCoreIfRevoked}, mainly for tests. */
+export interface IRepinOptions {
+    /** Current trusted key. Defaults to {@link peersCorePublishPublicKey}. */
+    currentPublicKey?: string;
+    /** Keys that must be replaced. Defaults to {@link peersCoreRevokedPublishPublicKeys}. */
+    revokedPublicKeys?: readonly string[];
+}
+/**
+ * Whether `pkg` is the peers-core package pinned to a revoked publisher key.
+ *
+ * @param pkg - package row to inspect
+ * @param opts - alternative key lists (tests)
+ */
+export declare function needsPeersCoreRepin(pkg: Pick<IPackage, "packageId" | "publishPublicKey">, opts?: IRepinOptions): boolean;
+/**
+ * If `pkg` is peers-core pinned to a revoked key, re-pin it to the current key in
+ * `dataContext` and return the updated row; otherwise return `pkg` unchanged.
+ *
+ * Safe to call on every remote check and propagation: it is a no-op unless the pin is revoked.
+ * In a group where the caller may not write package rows, `signAndSave` throws; the error is
+ * logged and the original row returned, so verification keeps failing closed there until an
+ * admin's device performs the re-pin and the row syncs.
+ *
+ * @param dataContext - context holding the package row
+ * @param pkg - the package row as currently loaded
+ * @param opts - alternative key lists (tests)
+ * @returns the (possibly re-pinned) package row
+ */
+export declare function repinPeersCoreIfRevoked(dataContext: DataContext, pkg: IPackage, opts?: IRepinOptions): Promise<IPackage>;
+/**
+ * Look up peers-core in `dataContext` and re-pin it if its key is revoked.
+ *
+ * @returns the package row when peers-core is installed in the context, else null
+ */
+export declare function repinInstalledPeersCoreIfRevoked(dataContext: DataContext, opts?: IRepinOptions): Promise<IPackage | null>;

package/dist/package-installer/peers-core-trust-anchor.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.needsPeersCoreRepin = needsPeersCoreRepin;
+exports.repinPeersCoreIfRevoked = repinPeersCoreIfRevoked;
+exports.repinInstalledPeersCoreIfRevoked = repinInstalledPeersCoreIfRevoked;
+const packages_1 = require("../data/packages");
+const system_ids_1 = require("../system-ids");
+const package_author_signing_1 = require("./package-author-signing");
+/**
+ * Whether `pkg` is the peers-core package pinned to a revoked publisher key.
+ *
+ * @param pkg - package row to inspect
+ * @param opts - alternative key lists (tests)
+ */
+function needsPeersCoreRepin(pkg, opts = {}) {
+    const current = opts.currentPublicKey ?? system_ids_1.peersCorePublishPublicKey;
+    const revoked = opts.revokedPublicKeys ?? system_ids_1.peersCoreRevokedPublishPublicKeys;
+    return (pkg.packageId === system_ids_1.peersCorePackageId &&
+        !!current &&
+        pkg.publishPublicKey !== current &&
+        (0, package_author_signing_1.isRevokedPublisherKey)(pkg.publishPublicKey, revoked));
+}
+/**
+ * If `pkg` is peers-core pinned to a revoked key, re-pin it to the current key in
+ * `dataContext` and return the updated row; otherwise return `pkg` unchanged.
+ *
+ * Safe to call on every remote check and propagation: it is a no-op unless the pin is revoked.
+ * In a group where the caller may not write package rows, `signAndSave` throws; the error is
+ * logged and the original row returned, so verification keeps failing closed there until an
+ * admin's device performs the re-pin and the row syncs.
+ *
+ * @param dataContext - context holding the package row
+ * @param pkg - the package row as currently loaded
+ * @param opts - alternative key lists (tests)
+ * @returns the (possibly re-pinned) package row
+ */
+async function repinPeersCoreIfRevoked(dataContext, pkg, opts = {}) {
+    if (!needsPeersCoreRepin(pkg, opts))
+        return pkg;
+    const current = opts.currentPublicKey ?? system_ids_1.peersCorePublishPublicKey;
+    try {
+        const updated = { ...pkg, publishPublicKey: current };
+        await (0, packages_1.Packages)(dataContext).signAndSave(updated);
+        console.warn(`[peers-core-trust-anchor] Replaced revoked peers-core publisher key in ${dataContext.dataContextId}`);
+        return updated;
+    }
+    catch (err) {
+        console.error(`[peers-core-trust-anchor] Could not re-pin peers-core in ${dataContext.dataContextId}:`, err);
+        return pkg;
+    }
+}
+/**
+ * Look up peers-core in `dataContext` and re-pin it if its key is revoked.
+ *
+ * @returns the package row when peers-core is installed in the context, else null
+ */
+async function repinInstalledPeersCoreIfRevoked(dataContext, opts = {}) {
+    const pkg = await (0, packages_1.Packages)(dataContext).get(system_ids_1.peersCorePackageId);
+    if (!pkg)
+        return null;
+    return repinPeersCoreIfRevoked(dataContext, pkg, opts);
+}

package/dist/package-installer/peers-core-trust-anchor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-installer/peers-core-trust-anchor.test.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const keys_1 = require("../keys");
+const systemIds = require("../system-ids");
+const utils_1 = require("../utils");
+const package_author_signing_1 = require("./package-author-signing");
+const peers_core_trust_anchor_1 = require("./peers-core-trust-anchor");
+// Pin the host to a fresh "current" key and revoke a fresh "old" key so the tests do not
+// depend on the real constants. Keys are created inside the factory because jest hoists
+// `jest.mock` above module-level declarations.
+jest.mock("../system-ids", () => {
+    const actual = jest.requireActual("../system-ids");
+    const { newKeys: makeKeys } = jest.requireActual("../keys");
+    const revoked = makeKeys();
+    const current = makeKeys();
+    return {
+        ...actual,
+        peersCorePublishPublicKey: current.publicKey,
+        peersCoreRevokedPublishPublicKeys: [revoked.publicKey],
+        __testKeys: { revoked, current },
+    };
+});
+const { revoked: revokedKeys, current: currentKeys } = systemIds.__testKeys;
+const mockPackagesGet = jest.fn();
+const mockPackagesSignAndSave = jest.fn();
+jest.mock("../data/packages", () => ({
+    Packages: () => ({
+        get: (...args) => mockPackagesGet(...args),
+        signAndSave: (...args) => mockPackagesSignAndSave(...args),
+    }),
+}));
+function makeCtx(id = "ctx") {
+    return { dataContextId: id };
+}
+function makePkg(overrides) {
+    return {
+        packageId: systemIds.peersCorePackageId,
+        name: "peers-core",
+        publishPublicKey: revokedKeys.publicKey,
+        ...overrides,
+    };
+}
+function makePV() {
+    return {
+        packageId: systemIds.peersCorePackageId,
+        packageVersionId: (0, utils_1.newid)(),
+        version: "1.0.0",
+        versionTag: "stable",
+        packageBundleFileHash: "hash",
+    };
+}
+beforeEach(() => {
+    jest.clearAllMocks();
+    jest.spyOn(console, "warn").mockImplementation(() => { });
+    jest.spyOn(console, "error").mockImplementation(() => { });
+});
+afterEach(() => {
+    jest.restoreAllMocks();
+});
+describe("isRevokedPublisherKey", () => {
+    it("uses the host revocation list by default", () => {
+        expect((0, package_author_signing_1.isRevokedPublisherKey)(revokedKeys.publicKey)).toBe(true);
+        expect((0, package_author_signing_1.isRevokedPublisherKey)(currentKeys.publicKey)).toBe(false);
+    });
+    it("accepts an explicit list", () => {
+        expect((0, package_author_signing_1.isRevokedPublisherKey)("abc", ["abc"])).toBe(true);
+        expect((0, package_author_signing_1.isRevokedPublisherKey)(revokedKeys.publicKey, [])).toBe(false);
+    });
+    it("treats empty or missing keys as not revoked", () => {
+        expect((0, package_author_signing_1.isRevokedPublisherKey)("", ["", "x"])).toBe(false);
+        expect((0, package_author_signing_1.isRevokedPublisherKey)(undefined)).toBe(false);
+    });
+});
+describe("verifyPackageAuthorSignature with a revoked key", () => {
+    it("rejects a mathematically valid signature from a revoked key", () => {
+        const pv = { ...makePV(), packageAuthorSignature: "" };
+        pv.packageAuthorSignature = (0, package_author_signing_1.signPackageAuthor)(pv, revokedKeys.secretKey);
+        const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(pv, revokedKeys.publicKey);
+        expect(result).toEqual({ valid: false, publicKey: revokedKeys.publicKey });
+    });
+    it("still accepts the current key", () => {
+        const pv = { ...makePV(), packageAuthorSignature: "" };
+        pv.packageAuthorSignature = (0, package_author_signing_1.signPackageAuthor)(pv, currentKeys.secretKey);
+        expect((0, package_author_signing_1.verifyPackageAuthorSignature)(pv, currentKeys.publicKey).valid).toBe(true);
+    });
+});
+describe("needsPeersCoreRepin", () => {
+    it("is true only for peers-core pinned to a revoked key", () => {
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg())).toBe(true);
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg({ publishPublicKey: currentKeys.publicKey }))).toBe(false);
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg({ publishPublicKey: "" }))).toBe(false);
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg({ packageId: (0, utils_1.newid)() }))).toBe(false);
+    });
+    it("honours explicit key lists", () => {
+        const other = (0, keys_1.newKeys)();
+        const pkg = makePkg({ publishPublicKey: other.publicKey });
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(pkg)).toBe(false);
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(pkg, {
+            currentPublicKey: currentKeys.publicKey,
+            revokedPublicKeys: [other.publicKey],
+        })).toBe(true);
+    });
+    it("is false when the host has no current key to pin", () => {
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg(), { currentPublicKey: "" })).toBe(false);
+    });
+});
+describe("repinPeersCoreIfRevoked", () => {
+    it("re-pins and saves when the key is revoked", async () => {
+        mockPackagesSignAndSave.mockResolvedValue(undefined);
+        const pkg = makePkg();
+        const result = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(makeCtx(), pkg);
+        expect(result).not.toBe(pkg);
+        expect(result.publishPublicKey).toBe(currentKeys.publicKey);
+        expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
+            packageId: systemIds.peersCorePackageId,
+            publishPublicKey: currentKeys.publicKey,
+        }));
+        expect(console.warn).toHaveBeenCalled();
+    });
+    it("returns the same row and does not save when nothing is revoked", async () => {
+        const pkg = makePkg({ publishPublicKey: currentKeys.publicKey });
+        const result = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(makeCtx(), pkg);
+        expect(result).toBe(pkg);
+        expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+    });
+    it("does not touch other packages even when their key is revoked", async () => {
+        const pkg = makePkg({ packageId: (0, utils_1.newid)() });
+        const result = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(makeCtx(), pkg);
+        expect(result).toBe(pkg);
+        expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+    });
+    it("returns the original row when the save is not permitted", async () => {
+        mockPackagesSignAndSave.mockRejectedValue(new Error("not a writer"));
+        const pkg = makePkg();
+        const result = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(makeCtx("group-ro"), pkg);
+        expect(result).toBe(pkg);
+        expect(result.publishPublicKey).toBe(revokedKeys.publicKey);
+        expect(console.error).toHaveBeenCalled();
+    });
+});
+describe("repinInstalledPeersCoreIfRevoked", () => {
+    it("returns null when peers-core is not installed", async () => {
+        mockPackagesGet.mockResolvedValue(undefined);
+        expect(await (0, peers_core_trust_anchor_1.repinInstalledPeersCoreIfRevoked)(makeCtx())).toBeNull();
+        expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+    });
+    it("loads peers-core and re-pins it", async () => {
+        mockPackagesGet.mockResolvedValue(makePkg());
+        mockPackagesSignAndSave.mockResolvedValue(undefined);
+        const result = await (0, peers_core_trust_anchor_1.repinInstalledPeersCoreIfRevoked)(makeCtx());
+        expect(mockPackagesGet).toHaveBeenCalledWith(systemIds.peersCorePackageId);
+        expect(result?.publishPublicKey).toBe(currentKeys.publicKey);
+        expect(mockPackagesSignAndSave).toHaveBeenCalledTimes(1);
+    });
+});

package/dist/system-ids.d.ts

@@ -23,8 +23,28 @@ export declare const createGroupToolId = "000peers0tool0creategroup";
 export declare const peersCorePackageId = "00mh0wlipjixk2gqmurbwee0o";
 /** Canonical source repository for peers-core. */
 export declare const peersCorePackageRepoUrl = "https://github.com/peers-app/peers-core";
-/** Trusted publishing key for official peers-core releases. */
-export declare const peersCorePublishPublicKey = "S7cQqnvVz-FVDO6Lk5zC7epSvcP_-NyBVZz9gdcj73c";
+/**
+ * Trusted publishing key for official peers-core releases (Ed25519, base64url).
+ *
+ * This is the bootstrap trust anchor shipped with every host. It seeds `Packages.publishPublicKey`
+ * for peers-core and is what `verifyPackageAuthorSignature` checks remote and propagated
+ * peers-core versions against. The same key is registered as the active key of subject
+ * {@link peersCorePackageId} in the peers-services key registry (`GET /api/v1/keys/:subjectId`).
+ *
+ * Rotation: generate a new pair with `scripts/generate-publisher-key.mjs`, move the previous
+ * value into {@link peersCoreRevokedPublishPublicKeys}, seed the registry, and ship a host release.
+ */
+export declare const peersCorePublishPublicKey = "8S1pAWvka0RZauJnwM13n7qO01NtdGV7FSU_aSJw0dc";
+/**
+ * peers-core publishing keys that must never be trusted again, whatever a local `Packages` row
+ * or a propagating peer says. A version signed by one of these fails author verification, a
+ * peer offering one as a TOFU anchor is refused, and `ensurePeersCore` replaces a pinned
+ * revoked key with {@link peersCorePublishPublicKey}.
+ *
+ * Append-only. Entries are retained forever so a client coming back after a long time still
+ * rejects them.
+ */
+export declare const peersCoreRevokedPublishPublicKeys: readonly string[];
 /**
  * Stable id of the peers **system** itself, used as the `providerPackageId` for
  * built-in system contracts (contracts the platform provides rather than a package).
@@ -109,6 +129,7 @@ export declare const localFoldersToolIds: {
     readonly readRange: "00mukk9dwdih6mh8rrofph80o";
     readonly index: "00mukk9dwdm01bxg3hrby6pli";
     readonly getFileBlocks: "00mumw1pmmf3y2ujfdc99h4ib";
+    readonly assemble: "00mungara9ixeolgxukzj2aku";
     readonly getJob: "00mukk9dwd1c1f51xjysssgtv";
     readonly cancelJob: "00mukk9dweizvif4ghp6kfa92";
     readonly move: "00mukk9dwer8wsw5eiwis8tzm";

package/dist/system-ids.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
+exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCoreRevokedPublishPublicKeys = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
 /** Stable user ID that owns built-in Peers system records. */
 exports.peersRootUserId = "000peers0user000000000001";
 /** Default assistant used when no user-selected assistant is available. */
@@ -27,8 +27,31 @@ exports.createGroupToolId = "000peers0tool0creategroup";
 exports.peersCorePackageId = "00mh0wlipjixk2gqmurbwee0o";
 /** Canonical source repository for peers-core. */
 exports.peersCorePackageRepoUrl = "https://github.com/peers-app/peers-core";
-/** Trusted publishing key for official peers-core releases. */
-exports.peersCorePublishPublicKey = "S7cQqnvVz-FVDO6Lk5zC7epSvcP_-NyBVZz9gdcj73c";
+/**
+ * Trusted publishing key for official peers-core releases (Ed25519, base64url).
+ *
+ * This is the bootstrap trust anchor shipped with every host. It seeds `Packages.publishPublicKey`
+ * for peers-core and is what `verifyPackageAuthorSignature` checks remote and propagated
+ * peers-core versions against. The same key is registered as the active key of subject
+ * {@link peersCorePackageId} in the peers-services key registry (`GET /api/v1/keys/:subjectId`).
+ *
+ * Rotation: generate a new pair with `scripts/generate-publisher-key.mjs`, move the previous
+ * value into {@link peersCoreRevokedPublishPublicKeys}, seed the registry, and ship a host release.
+ */
+exports.peersCorePublishPublicKey = "8S1pAWvka0RZauJnwM13n7qO01NtdGV7FSU_aSJw0dc";
+/**
+ * peers-core publishing keys that must never be trusted again, whatever a local `Packages` row
+ * or a propagating peer says. A version signed by one of these fails author verification, a
+ * peer offering one as a TOFU anchor is refused, and `ensurePeersCore` replaces a pinned
+ * revoked key with {@link peersCorePublishPublicKey}.
+ *
+ * Append-only. Entries are retained forever so a client coming back after a long time still
+ * rejects them.
+ */
+exports.peersCoreRevokedPublishPublicKeys = [
+    // Exposed in packaged macOS builds v0.19.9 through v0.25.11 (2026-10-02 incident).
+    "S7cQqnvVz-FVDO6Lk5zC7epSvcP_-NyBVZz9gdcj73c",
+];
 /**
  * Stable id of the peers **system** itself, used as the `providerPackageId` for
  * built-in system contracts (contracts the platform provides rather than a package).
@@ -113,6 +136,7 @@ exports.localFoldersToolIds = {
     readRange: "00mukk9dwdih6mh8rrofph80o",
     index: "00mukk9dwdm01bxg3hrby6pli",
     getFileBlocks: "00mumw1pmmf3y2ujfdc99h4ib",
+    assemble: "00mungara9ixeolgxukzj2aku",
     getJob: "00mukk9dwd1c1f51xjysssgtv",
     cancelJob: "00mukk9dweizvif4ghp6kfa92",
     move: "00mukk9dwer8wsw5eiwis8tzm",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.25.10",
+  "version": "0.25.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"
@@ -28,9 +28,11 @@
     "build": "npm run clean && tsc",
     "dev": "tsc -w",
     "test": "jest",
-    "release:patch": "npm run build && npm version patch && git push && git push --tags",
-    "release:minor": "npm run build && npm version minor && git push && git push --tags",
-    "release:major": "npm run build && npm version major && git push && git push --tags",
+    "release:guard": "node release-guard.js",
+    "prepublishOnly": "npm run release:guard",
+    "release:patch": "npm run release:guard && npm run build && npm version patch && git push && git push --tags",
+    "release:minor": "npm run release:guard && npm run build && npm version minor && git push && git push --tags",
+    "release:major": "npm run release:guard && npm run build && npm version major && git push && git push --tags",
     "release": "npm run release:patch"
   },
   "dependencies": {