@peers-app/peers-sdk 0.25.11 → 0.25.12

package/dist/package-installer/index.d.ts

@@ -10,4 +10,5 @@ export * from "./package-remote-checker";
 export * from "./package-seed-installer";
 export * from "./package-tarball";
 export * from "./peers-core-installer";
+export * from "./peers-core-trust-anchor";
 export * from "./types";

package/dist/package-installer/index.js

@@ -26,4 +26,5 @@ __exportStar(require("./package-remote-checker"), exports);
 __exportStar(require("./package-seed-installer"), exports);
 __exportStar(require("./package-tarball"), exports);
 __exportStar(require("./peers-core-installer"), exports);
+__exportStar(require("./peers-core-trust-anchor"), exports);
 __exportStar(require("./types"), exports);

package/dist/package-installer/package-author-signing.d.ts

@@ -2,6 +2,16 @@ import type { IPackageVersion } from "../data/package-versions";
 import type { IAppNav } from "../types/app-nav";
 /** Prefix for the persistent variable name that stores a package's signing secret key. */
 export declare const PACKAGE_SIGNING_KEY_PREFIX = "packageSigningKey_";
+/**
+ * Whether `publicKey` is a publisher key that must never be trusted again.
+ *
+ * The built-in list is {@link peersCoreRevokedPublishPublicKeys}; callers (and tests) may pass
+ * their own. An empty or missing key is not "revoked", it is simply not a key.
+ *
+ * @param publicKey - base64url Ed25519 public key to check
+ * @param revoked - list to check against; defaults to the peers-core revocations
+ */
+export declare function isRevokedPublisherKey(publicKey: string | undefined, revoked?: readonly string[]): boolean;
 /**
  * The subset of PackageVersion fields that the publisher signs.
  * The `publicKey` field is included so verifiers know which key to check against.
@@ -47,8 +57,13 @@ export interface IVerifyAuthorSignatureResult {
  * is NOT in the signature itself — it must be provided via `expectedPublicKey` (TOFU check)
  * to reconstruct the payload and verify.
  *
+ * A key in {@link peersCoreRevokedPublishPublicKeys} never verifies, even with a
+ * mathematically valid signature: a revoked key may be in an attacker's hands, so anything it
+ * signed after revocation is untrustworthy and anything before is already installed.
+ *
  * @param pv - The PackageVersion record with `packageAuthorSignature` set
  * @param expectedPublicKey - The public key to verify against (from Package.publishPublicKey)
- * @returns `{ valid, publicKey }` — valid is true if signature verifies and key matches
+ * @returns `{ valid, publicKey }` — valid is true if signature verifies, key matches, and the
+ *   key is not revoked
  */
 export declare function verifyPackageAuthorSignature(pv: AuthorSignableFields & Pick<IPackageVersion, "packageAuthorSignature">, expectedPublicKey: string): IVerifyAuthorSignatureResult;

package/dist/package-installer/package-author-signing.js

@@ -1,14 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PACKAGE_SIGNING_KEY_PREFIX = void 0;
+exports.isRevokedPublisherKey = isRevokedPublisherKey;
 exports.buildAuthorSignedPayload = buildAuthorSignedPayload;
 exports.signPackageAuthor = signPackageAuthor;
 exports.verifyPackageAuthorSignature = verifyPackageAuthorSignature;
 const nacl = require("tweetnacl");
 const tweetnacl_util_1 = require("tweetnacl-util");
 const keys_1 = require("../keys");
+const system_ids_1 = require("../system-ids");
 /** Prefix for the persistent variable name that stores a package's signing secret key. */
 exports.PACKAGE_SIGNING_KEY_PREFIX = "packageSigningKey_";
+/**
+ * Whether `publicKey` is a publisher key that must never be trusted again.
+ *
+ * The built-in list is {@link peersCoreRevokedPublishPublicKeys}; callers (and tests) may pass
+ * their own. An empty or missing key is not "revoked", it is simply not a key.
+ *
+ * @param publicKey - base64url Ed25519 public key to check
+ * @param revoked - list to check against; defaults to the peers-core revocations
+ */
+function isRevokedPublisherKey(publicKey, revoked = system_ids_1.peersCoreRevokedPublishPublicKeys) {
+    return !!publicKey && revoked.includes(publicKey);
+}
 /**
  * Extracts the signable payload from a PackageVersion record.
  * Only includes optional fields when they have a value (undefined fields are omitted
@@ -59,13 +73,18 @@ function signPackageAuthor(pv, secretKey) {
  * is NOT in the signature itself — it must be provided via `expectedPublicKey` (TOFU check)
  * to reconstruct the payload and verify.
  *
+ * A key in {@link peersCoreRevokedPublishPublicKeys} never verifies, even with a
+ * mathematically valid signature: a revoked key may be in an attacker's hands, so anything it
+ * signed after revocation is untrustworthy and anything before is already installed.
+ *
  * @param pv - The PackageVersion record with `packageAuthorSignature` set
  * @param expectedPublicKey - The public key to verify against (from Package.publishPublicKey)
- * @returns `{ valid, publicKey }` — valid is true if signature verifies and key matches
+ * @returns `{ valid, publicKey }` — valid is true if signature verifies, key matches, and the
+ *   key is not revoked
  */
 function verifyPackageAuthorSignature(pv, expectedPublicKey) {
     const result = { valid: false, publicKey: expectedPublicKey };
-    if (!pv.packageAuthorSignature) {
+    if (!pv.packageAuthorSignature || isRevokedPublisherKey(expectedPublicKey)) {
         return result;
     }
     try {

package/dist/package-installer/package-propagation.js

@@ -11,6 +11,7 @@ const package_versions_1 = require("../data/package-versions");
 const packages_1 = require("../data/packages");
 const utils_1 = require("../utils");
 const package_author_signing_1 = require("./package-author-signing");
+const peers_core_trust_anchor_1 = require("./peers-core-trust-anchor");
 // --- Module-level state ---
 const RETRY_DELAYS_MS = [2_000, 10_000, 30_000, 60_000, 120_000];
 const pvPropagateMap = {};
@@ -190,6 +191,12 @@ async function retryOrFail(source, dest, pv, retryCnt, reason) {
  * transient failures (missing source key).
  */
 async function verifyOrEstablishTofu(sourceContext, targetContext, targetPkg, pv) {
+    // peers-core pinned to a revoked key: move the pin to the host's current key first so a
+    // version signed by the replacement key can be accepted.
+    const repinned = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(targetContext, targetPkg);
+    if (repinned !== targetPkg) {
+        targetPkg.publishPublicKey = repinned.publishPublicKey;
+    }
     if (targetPkg.publishPublicKey) {
         if (!(0, package_author_signing_1.verifyPackageAuthorSignature)(pv, targetPkg.publishPublicKey).valid) {
             console.error(`[propagation] Invalid signature for ${pv.packageVersionId}`);
@@ -201,6 +208,11 @@ async function verifyOrEstablishTofu(sourceContext, targetContext, targetPkg, pv
     const sourcePkg = await (0, packages_1.Packages)(sourceContext).get(targetPkg.packageId);
     if (!sourcePkg?.publishPublicKey)
         return false;
+    // Never adopt a revoked key as a trust anchor, however it reached the source group.
+    if ((0, package_author_signing_1.isRevokedPublisherKey)(sourcePkg.publishPublicKey)) {
+        console.error(`[propagation] Refusing revoked publisher key for ${targetPkg.packageId} from ${sourceContext.dataContextId}`);
+        return false;
+    }
     if (!(0, package_author_signing_1.verifyPackageAuthorSignature)(pv, sourcePkg.publishPublicKey).valid) {
         console.error(`[propagation] Invalid signature for ${pv.packageVersionId} (TOFU)`);
         return false;

package/dist/package-installer/package-propagation.test.js

@@ -2,10 +2,26 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const package_versions_1 = require("../data/package-versions");
 const keys_1 = require("../keys");
+const systemIds = require("../system-ids");
 const utils_1 = require("../utils");
 const package_author_signing_1 = require("./package-author-signing");
 const package_propagation_1 = require("./package-propagation");
 // --- Mocks ---
+// Pin the host to a fresh "current" peers-core key and revoke a fresh "old" one so the
+// revocation tests do not depend on the real constants.
+jest.mock("../system-ids", () => {
+    const actual = jest.requireActual("../system-ids");
+    const { newKeys: makeKeys } = jest.requireActual("../keys");
+    const revoked = makeKeys();
+    const current = makeKeys();
+    return {
+        ...actual,
+        peersCorePublishPublicKey: current.publicKey,
+        peersCoreRevokedPublishPublicKeys: [revoked.publicKey],
+        __testKeys: { revoked, current },
+    };
+});
+const { revoked: revokedCoreKeys, current: currentCoreKeys } = systemIds.__testKeys;
 const mockGetUserRole = jest.fn();
 jest.mock("../data/group-permissions", () => ({
     getUserRole: (...args) => mockGetUserRole(...args),
@@ -589,6 +605,114 @@ describe("discoverAndPropagateVersions", () => {
         expect(results).toHaveLength(0);
         consoleError.mockRestore();
     });
+    describe("revoked publisher keys", () => {
+        function twoGroupSetup() {
+            const groupA = "group-a";
+            const groupB = "group-b";
+            const groups = new Map([
+                [groupA, makeDataContext(groupA)],
+                [groupB, makeDataContext(groupB)],
+            ]);
+            const roles = new Map([
+                [groupA, 60],
+                [groupB, 60],
+            ]);
+            return { groupA, groupB, userContext: makeUserContext({ userId, groups }), roles };
+        }
+        let consoleError;
+        let consoleWarn;
+        beforeEach(() => {
+            consoleError = jest.spyOn(console, "error").mockImplementation(() => { });
+            consoleWarn = jest.spyOn(console, "warn").mockImplementation(() => { });
+        });
+        afterEach(() => {
+            consoleError.mockRestore();
+            consoleWarn.mockRestore();
+        });
+        it("refuses to establish TOFU from a source pinned to a revoked key", async () => {
+            const { groupA, groupB, userContext, roles } = twoGroupSetup();
+            const packageId = (0, utils_1.newid)();
+            const sourcePkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
+            const targetPkg = makePkg({ packageId, publishPublicKey: "" });
+            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
+                version: "2.0.0",
+            });
+            setupMocksForScenario({
+                packages: new Map([[groupB, [targetPkg]]]),
+                pvs: new Map([
+                    [groupA, [pv]],
+                    [groupB, []],
+                ]),
+                roles,
+                sourcePackages: new Map([[groupA, new Map([[packageId, sourcePkg]])]]),
+            });
+            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+            expect(results).toHaveLength(0);
+            expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+            expect(mockPvSignAndSave).not.toHaveBeenCalled();
+            expect(consoleError).toHaveBeenCalledWith(expect.stringContaining("Refusing revoked publisher key"));
+        });
+        it("re-pins peers-core from a revoked key and accepts a version signed by the current key", async () => {
+            const { groupA, groupB, userContext, roles } = twoGroupSetup();
+            const packageId = systemIds.peersCorePackageId;
+            const sourcePkg = makePkg({ packageId, publishPublicKey: currentCoreKeys.publicKey });
+            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
+            const pv = makeSignedPVWithSecretKey(packageId, currentCoreKeys.secretKey, {
+                version: "2.0.0",
+            });
+            setupMocksForScenario({
+                packages: new Map([[groupB, [targetPkg]]]),
+                pvs: new Map([
+                    [groupA, [pv]],
+                    [groupB, []],
+                ]),
+                roles,
+                sourcePackages: new Map([[groupA, new Map([[packageId, sourcePkg]])]]),
+            });
+            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+            expect(results).toHaveLength(1);
+            expect(results[0]).toMatchObject({ groupId: groupB, packageId, version: "2.0.0" });
+            expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({ packageId, publishPublicKey: currentCoreKeys.publicKey }));
+        });
+        it("rejects a peers-core version signed by the revoked key even where that key is pinned", async () => {
+            const { groupA, groupB, userContext, roles } = twoGroupSetup();
+            const packageId = systemIds.peersCorePackageId;
+            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
+            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
+                version: "2.0.0",
+            });
+            setupMocksForScenario({
+                packages: new Map([[groupB, [targetPkg]]]),
+                pvs: new Map([
+                    [groupA, [pv]],
+                    [groupB, []],
+                ]),
+                roles,
+            });
+            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+            expect(results).toHaveLength(0);
+            expect(mockPvSignAndSave).not.toHaveBeenCalled();
+        });
+        it("does not re-pin other packages pinned to a revoked key; their versions are rejected", async () => {
+            const { groupA, groupB, userContext, roles } = twoGroupSetup();
+            const packageId = (0, utils_1.newid)();
+            const targetPkg = makePkg({ packageId, publishPublicKey: revokedCoreKeys.publicKey });
+            const pv = makeSignedPVWithSecretKey(packageId, revokedCoreKeys.secretKey, {
+                version: "2.0.0",
+            });
+            setupMocksForScenario({
+                packages: new Map([[groupB, [targetPkg]]]),
+                pvs: new Map([
+                    [groupA, [pv]],
+                    [groupB, []],
+                ]),
+                roles,
+            });
+            const results = await (0, package_propagation_1.discoverAndPropagateVersions)(userContext);
+            expect(results).toHaveLength(0);
+            expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+        });
+    });
     it("skips PV when packageVersionId already exists in target (dedup)", async () => {
         const groupA = "group-a";
         const groupB = "group-b";

package/dist/package-installer/package-remote-checker.js

@@ -19,6 +19,7 @@ const package_author_signing_1 = require("./package-author-signing");
 const package_installer_1 = require("./package-installer");
 const package_propagation_1 = require("./package-propagation");
 const package_tarball_1 = require("./package-tarball");
+const peers_core_trust_anchor_1 = require("./peers-core-trust-anchor");
 // Module-level memoization: unique by `updateUrl + ":" + tag`
 const remoteCheckCache = new Map();
 /**
@@ -44,9 +45,13 @@ function checkPackageRemoteForNewVersion(packageId, updateUrl, tag, http) {
  * group does not already have the remote PackageVersion.
  */
 async function checkAndInstallPackageRemoteVersion(dataContext, pkg, tag, http) {
-    if (!pkg.updateUrl || pkg.disabled)
+    const updateUrl = pkg.updateUrl;
+    if (!updateUrl || pkg.disabled)
         return null;
-    const result = await checkPackageRemoteForNewVersion(pkg.packageId, pkg.updateUrl, tag, http);
+    // A peers-core row pinned to a revoked publisher key would reject every new release; move
+    // it to the host's current anchor before looking at the remote.
+    await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(dataContext, pkg);
+    const result = await checkPackageRemoteForNewVersion(pkg.packageId, updateUrl, tag, http);
     if (!result)
         return null;
     const existing = await (0, package_versions_1.PackageVersions)(dataContext).get(result.pointer.packageVersionId);

package/dist/package-installer/package-remote-checker.test.js

@@ -32,13 +32,30 @@ const mockResolveDevicePackageVersion = jest.fn();
 jest.mock("../data/package-version-resolver", () => ({
     resolveDevicePackageVersion: (...args) => mockResolveDevicePackageVersion(...args),
 }));
+// Pin the host to a fresh "current" peers-core key and revoke a fresh "old" one so the
+// revocation tests do not depend on the real constants.
+jest.mock("../system-ids", () => {
+    const actual = jest.requireActual("../system-ids");
+    const { newKeys: makeKeys } = jest.requireActual("../keys");
+    const revoked = makeKeys();
+    const current = makeKeys();
+    return {
+        ...actual,
+        peersCorePublishPublicKey: current.publicKey,
+        peersCoreRevokedPublishPublicKeys: [revoked.publicKey],
+        __testKeys: { revoked, current },
+    };
+});
 const file_types_1 = require("../data/files/file.types");
 const keys_1 = require("../keys");
+const systemIds = require("../system-ids");
 const package_author_signing_1 = require("./package-author-signing");
 const package_remote_checker_1 = require("./package-remote-checker");
 const package_tarball_1 = require("./package-tarball");
+// PKG_ID is peers-core's id so the trust-anchor re-pin path is exercised.
 const PKG_ID = "00mh0wlipjixk2gqmurbwee0o";
 const PV_ID = "00mpdg7xstwt3oe51x9brk15i";
+const { revoked: revokedCoreKeys, current: currentCoreKeys } = systemIds.__testKeys;
 function makeContext(dataContextId) {
     return { dataContextId };
 }
@@ -234,6 +251,54 @@ describe("package-remote-checker", () => {
             expect(http.fetchJson).toHaveBeenCalledTimes(1);
             expect(mockSaveBundleFile).toHaveBeenCalled();
         });
+        it("re-pins peers-core from a revoked key and installs a release signed by the current key", async () => {
+            expect(PKG_ID).toBe(systemIds.peersCorePackageId);
+            const ctx = makeContext("user-ctx");
+            const { pointer, tarball } = await makeSignedRemoteResult(currentCoreKeys.secretKey, currentCoreKeys.publicKey);
+            let pkg = {
+                packageId: PKG_ID,
+                name: "peers-core",
+                publishPublicKey: revokedCoreKeys.publicKey,
+                updateUrl: "https://example.com/peers-core",
+            };
+            const http = {
+                fetchJson: jest.fn().mockResolvedValue(pointer),
+                fetchBinary: jest.fn().mockResolvedValue(tarball),
+            };
+            mockPackageVersionsGet.mockResolvedValue(undefined);
+            mockPackagesGet.mockImplementation(async () => pkg);
+            mockPackagesSignAndSave.mockImplementation(async (_ctx, saved) => {
+                pkg = saved;
+            });
+            const warn = jest.spyOn(console, "warn").mockImplementation(() => { });
+            const installed = await (0, package_remote_checker_1.checkAndInstallPackageRemoteVersion)(ctx, pkg, "stable", http);
+            expect(installed?.packageVersion.packageVersionId).toBe(PV_ID);
+            expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ packageId: PKG_ID, publishPublicKey: currentCoreKeys.publicKey }));
+            expect(pkg.publishPublicKey).toBe(currentCoreKeys.publicKey);
+            warn.mockRestore();
+        });
+        it("rejects a remote release signed by a revoked key", async () => {
+            const ctx = makeContext("user-ctx");
+            const { pointer, tarball } = await makeSignedRemoteResult(revokedCoreKeys.secretKey, revokedCoreKeys.publicKey);
+            const pkg = {
+                packageId: PKG_ID,
+                name: "peers-core",
+                publishPublicKey: currentCoreKeys.publicKey,
+                updateUrl: "https://example.com/peers-core-old",
+            };
+            const http = {
+                fetchJson: jest.fn().mockResolvedValue(pointer),
+                fetchBinary: jest.fn().mockResolvedValue(tarball),
+            };
+            mockPackageVersionsGet.mockResolvedValue(undefined);
+            mockPackagesGet.mockResolvedValue(pkg);
+            const error = jest.spyOn(console, "error").mockImplementation(() => { });
+            const installed = await (0, package_remote_checker_1.checkAndInstallPackageRemoteVersion)(ctx, pkg, "stable", http);
+            expect(installed).toBeNull();
+            expect(mockSaveBundleFile).not.toHaveBeenCalled();
+            expect(mockPackageVersionsSignAndSave).not.toHaveBeenCalled();
+            error.mockRestore();
+        });
     });
     describe("installRemotePackageVersion", () => {
         it("rejects publisher key mismatch before saving files", async () => {

package/dist/package-installer/peers-core-installer.d.ts

@@ -43,6 +43,10 @@ export interface IEnsurePeersCoreOpts {
  * Ensure peers-core is installed (with a usable, loaded version) in
  * `dataContext`, applying the layered strategy described in the module docs.
  *
+ * Before anything else, an already-installed peers-core whose pinned publisher key has been
+ * revoked is re-pinned to the host's current key (see `peers-core-trust-anchor.ts`), so the
+ * later remote check can accept releases signed by the replacement key.
+ *
  * @returns true if an install occurred, false if it was already present or no
  *   strategy succeeded.
  */

package/dist/package-installer/peers-core-installer.js

@@ -23,16 +23,22 @@ const packages_utils_1 = require("../data/packages.utils");
 const system_ids_1 = require("../system-ids");
 const package_remote_checker_1 = require("./package-remote-checker");
 const package_seed_installer_1 = require("./package-seed-installer");
+const peers_core_trust_anchor_1 = require("./peers-core-trust-anchor");
 const PEERS_CORE_NAME = "peers-core";
 const PEERS_CORE_DESCRIPTION = "Core system package for Peers platform";
 /**
  * Ensure peers-core is installed (with a usable, loaded version) in
  * `dataContext`, applying the layered strategy described in the module docs.
  *
+ * Before anything else, an already-installed peers-core whose pinned publisher key has been
+ * revoked is re-pinned to the host's current key (see `peers-core-trust-anchor.ts`), so the
+ * later remote check can accept releases signed by the replacement key.
+ *
  * @returns true if an install occurred, false if it was already present or no
  *   strategy succeeded.
  */
 async function ensurePeersCore(userContext, dataContext, opts) {
+    await (0, peers_core_trust_anchor_1.repinInstalledPeersCoreIfRevoked)(dataContext);
     const existingPvs = await (0, package_versions_1.PackageVersions)(dataContext).list({ packageId: system_ids_1.peersCorePackageId });
     if (existingPvs.length > 0)
         return false;

package/dist/package-installer/peers-core-installer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-installer/peers-core-installer.test.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const mockPvList = jest.fn();
+jest.mock("../data/package-versions", () => ({
+    PackageVersions: (ctx) => ({
+        list: (...args) => mockPvList(ctx, ...args),
+    }),
+}));
+const mockRepinInstalled = jest.fn();
+jest.mock("./peers-core-trust-anchor", () => ({
+    repinInstalledPeersCoreIfRevoked: (...args) => mockRepinInstalled(...args),
+}));
+jest.mock("../data/packages", () => ({ Packages: () => ({}) }));
+jest.mock("../data/packages.utils", () => ({ copyPackageToAnotherDataContext: jest.fn() }));
+jest.mock("../data/package-version-resolver", () => ({
+    resolveDevicePackageVersion: jest.fn(),
+}));
+jest.mock("./package-remote-checker", () => ({
+    checkAndInstallPackageRemoteVersion: jest.fn(),
+}));
+jest.mock("./package-seed-installer", () => ({
+    ensurePackageRecord: jest.fn(),
+    seedPackageInContext: jest.fn(),
+}));
+const system_ids_1 = require("../system-ids");
+const peers_core_installer_1 = require("./peers-core-installer");
+describe("ensurePeersCore", () => {
+    beforeEach(() => {
+        jest.clearAllMocks();
+        mockRepinInstalled.mockResolvedValue(null);
+    });
+    it("re-pins a revoked peers-core key before checking for existing versions", async () => {
+        const dataContext = { dataContextId: "user-ctx" };
+        const order = [];
+        mockRepinInstalled.mockImplementation(async () => {
+            order.push("repin");
+            return null;
+        });
+        mockPvList.mockImplementation(async () => {
+            order.push("list");
+            return [{ packageVersionId: "existing" }];
+        });
+        const installed = await (0, peers_core_installer_1.ensurePeersCore)({}, dataContext, {});
+        expect(installed).toBe(false);
+        expect(mockRepinInstalled).toHaveBeenCalledWith(dataContext);
+        expect(mockPvList).toHaveBeenCalledWith(dataContext, { packageId: system_ids_1.peersCorePackageId });
+        expect(order).toEqual(["repin", "list"]);
+    });
+});

package/dist/package-installer/peers-core-trust-anchor.d.ts

@@ -0,0 +1,47 @@
+import type { DataContext } from "../context/data-context";
+import { type IPackage } from "../data/packages";
+/**
+ * Migration of the peers-core trust anchor after a publisher-key rotation.
+ *
+ * `Packages.publishPublicKey` is pinned on first install (TOFU) and otherwise never changes, so
+ * a client that installed peers-core under a key that was later revoked would keep that key
+ * forever and reject every version signed by its replacement. This module replaces a pinned
+ * key that appears in {@link peersCoreRevokedPublishPublicKeys} with the host's current
+ * {@link peersCorePublishPublicKey}. Only peers-core is handled here: it is the one package
+ * whose trust anchor ships inside the host.
+ */
+/** Options for {@link repinPeersCoreIfRevoked}, mainly for tests. */
+export interface IRepinOptions {
+    /** Current trusted key. Defaults to {@link peersCorePublishPublicKey}. */
+    currentPublicKey?: string;
+    /** Keys that must be replaced. Defaults to {@link peersCoreRevokedPublishPublicKeys}. */
+    revokedPublicKeys?: readonly string[];
+}
+/**
+ * Whether `pkg` is the peers-core package pinned to a revoked publisher key.
+ *
+ * @param pkg - package row to inspect
+ * @param opts - alternative key lists (tests)
+ */
+export declare function needsPeersCoreRepin(pkg: Pick<IPackage, "packageId" | "publishPublicKey">, opts?: IRepinOptions): boolean;
+/**
+ * If `pkg` is peers-core pinned to a revoked key, re-pin it to the current key in
+ * `dataContext` and return the updated row; otherwise return `pkg` unchanged.
+ *
+ * Safe to call on every remote check and propagation: it is a no-op unless the pin is revoked.
+ * In a group where the caller may not write package rows, `signAndSave` throws; the error is
+ * logged and the original row returned, so verification keeps failing closed there until an
+ * admin's device performs the re-pin and the row syncs.
+ *
+ * @param dataContext - context holding the package row
+ * @param pkg - the package row as currently loaded
+ * @param opts - alternative key lists (tests)
+ * @returns the (possibly re-pinned) package row
+ */
+export declare function repinPeersCoreIfRevoked(dataContext: DataContext, pkg: IPackage, opts?: IRepinOptions): Promise<IPackage>;
+/**
+ * Look up peers-core in `dataContext` and re-pin it if its key is revoked.
+ *
+ * @returns the package row when peers-core is installed in the context, else null
+ */
+export declare function repinInstalledPeersCoreIfRevoked(dataContext: DataContext, opts?: IRepinOptions): Promise<IPackage | null>;

package/dist/package-installer/peers-core-trust-anchor.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.needsPeersCoreRepin = needsPeersCoreRepin;
+exports.repinPeersCoreIfRevoked = repinPeersCoreIfRevoked;
+exports.repinInstalledPeersCoreIfRevoked = repinInstalledPeersCoreIfRevoked;
+const packages_1 = require("../data/packages");
+const system_ids_1 = require("../system-ids");
+const package_author_signing_1 = require("./package-author-signing");
+/**
+ * Whether `pkg` is the peers-core package pinned to a revoked publisher key.
+ *
+ * @param pkg - package row to inspect
+ * @param opts - alternative key lists (tests)
+ */
+function needsPeersCoreRepin(pkg, opts = {}) {
+    const current = opts.currentPublicKey ?? system_ids_1.peersCorePublishPublicKey;
+    const revoked = opts.revokedPublicKeys ?? system_ids_1.peersCoreRevokedPublishPublicKeys;
+    return (pkg.packageId === system_ids_1.peersCorePackageId &&
+        !!current &&
+        pkg.publishPublicKey !== current &&
+        (0, package_author_signing_1.isRevokedPublisherKey)(pkg.publishPublicKey, revoked));
+}
+/**
+ * If `pkg` is peers-core pinned to a revoked key, re-pin it to the current key in
+ * `dataContext` and return the updated row; otherwise return `pkg` unchanged.
+ *
+ * Safe to call on every remote check and propagation: it is a no-op unless the pin is revoked.
+ * In a group where the caller may not write package rows, `signAndSave` throws; the error is
+ * logged and the original row returned, so verification keeps failing closed there until an
+ * admin's device performs the re-pin and the row syncs.
+ *
+ * @param dataContext - context holding the package row
+ * @param pkg - the package row as currently loaded
+ * @param opts - alternative key lists (tests)
+ * @returns the (possibly re-pinned) package row
+ */
+async function repinPeersCoreIfRevoked(dataContext, pkg, opts = {}) {
+    if (!needsPeersCoreRepin(pkg, opts))
+        return pkg;
+    const current = opts.currentPublicKey ?? system_ids_1.peersCorePublishPublicKey;
+    try {
+        const updated = { ...pkg, publishPublicKey: current };
+        await (0, packages_1.Packages)(dataContext).signAndSave(updated);
+        console.warn(`[peers-core-trust-anchor] Replaced revoked peers-core publisher key in ${dataContext.dataContextId}`);
+        return updated;
+    }
+    catch (err) {
+        console.error(`[peers-core-trust-anchor] Could not re-pin peers-core in ${dataContext.dataContextId}:`, err);
+        return pkg;
+    }
+}
+/**
+ * Look up peers-core in `dataContext` and re-pin it if its key is revoked.
+ *
+ * @returns the package row when peers-core is installed in the context, else null
+ */
+async function repinInstalledPeersCoreIfRevoked(dataContext, opts = {}) {
+    const pkg = await (0, packages_1.Packages)(dataContext).get(system_ids_1.peersCorePackageId);
+    if (!pkg)
+        return null;
+    return repinPeersCoreIfRevoked(dataContext, pkg, opts);
+}

package/dist/package-installer/peers-core-trust-anchor.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/package-installer/peers-core-trust-anchor.test.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const keys_1 = require("../keys");
+const systemIds = require("../system-ids");
+const utils_1 = require("../utils");
+const package_author_signing_1 = require("./package-author-signing");
+const peers_core_trust_anchor_1 = require("./peers-core-trust-anchor");
+// Pin the host to a fresh "current" key and revoke a fresh "old" key so the tests do not
+// depend on the real constants. Keys are created inside the factory because jest hoists
+// `jest.mock` above module-level declarations.
+jest.mock("../system-ids", () => {
+    const actual = jest.requireActual("../system-ids");
+    const { newKeys: makeKeys } = jest.requireActual("../keys");
+    const revoked = makeKeys();
+    const current = makeKeys();
+    return {
+        ...actual,
+        peersCorePublishPublicKey: current.publicKey,
+        peersCoreRevokedPublishPublicKeys: [revoked.publicKey],
+        __testKeys: { revoked, current },
+    };
+});
+const { revoked: revokedKeys, current: currentKeys } = systemIds.__testKeys;
+const mockPackagesGet = jest.fn();
+const mockPackagesSignAndSave = jest.fn();
+jest.mock("../data/packages", () => ({
+    Packages: () => ({
+        get: (...args) => mockPackagesGet(...args),
+        signAndSave: (...args) => mockPackagesSignAndSave(...args),
+    }),
+}));
+function makeCtx(id = "ctx") {
+    return { dataContextId: id };
+}
+function makePkg(overrides) {
+    return {
+        packageId: systemIds.peersCorePackageId,
+        name: "peers-core",
+        publishPublicKey: revokedKeys.publicKey,
+        ...overrides,
+    };
+}
+function makePV() {
+    return {
+        packageId: systemIds.peersCorePackageId,
+        packageVersionId: (0, utils_1.newid)(),
+        version: "1.0.0",
+        versionTag: "stable",
+        packageBundleFileHash: "hash",
+    };
+}
+beforeEach(() => {
+    jest.clearAllMocks();
+    jest.spyOn(console, "warn").mockImplementation(() => { });
+    jest.spyOn(console, "error").mockImplementation(() => { });
+});
+afterEach(() => {
+    jest.restoreAllMocks();
+});
+describe("isRevokedPublisherKey", () => {
+    it("uses the host revocation list by default", () => {
+        expect((0, package_author_signing_1.isRevokedPublisherKey)(revokedKeys.publicKey)).toBe(true);
+        expect((0, package_author_signing_1.isRevokedPublisherKey)(currentKeys.publicKey)).toBe(false);
+    });
+    it("accepts an explicit list", () => {
+        expect((0, package_author_signing_1.isRevokedPublisherKey)("abc", ["abc"])).toBe(true);
+        expect((0, package_author_signing_1.isRevokedPublisherKey)(revokedKeys.publicKey, [])).toBe(false);
+    });
+    it("treats empty or missing keys as not revoked", () => {
+        expect((0, package_author_signing_1.isRevokedPublisherKey)("", ["", "x"])).toBe(false);
+        expect((0, package_author_signing_1.isRevokedPublisherKey)(undefined)).toBe(false);
+    });
+});
+describe("verifyPackageAuthorSignature with a revoked key", () => {
+    it("rejects a mathematically valid signature from a revoked key", () => {
+        const pv = { ...makePV(), packageAuthorSignature: "" };
+        pv.packageAuthorSignature = (0, package_author_signing_1.signPackageAuthor)(pv, revokedKeys.secretKey);
+        const result = (0, package_author_signing_1.verifyPackageAuthorSignature)(pv, revokedKeys.publicKey);
+        expect(result).toEqual({ valid: false, publicKey: revokedKeys.publicKey });
+    });
+    it("still accepts the current key", () => {
+        const pv = { ...makePV(), packageAuthorSignature: "" };
+        pv.packageAuthorSignature = (0, package_author_signing_1.signPackageAuthor)(pv, currentKeys.secretKey);
+        expect((0, package_author_signing_1.verifyPackageAuthorSignature)(pv, currentKeys.publicKey).valid).toBe(true);
+    });
+});
+describe("needsPeersCoreRepin", () => {
+    it("is true only for peers-core pinned to a revoked key", () => {
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg())).toBe(true);
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg({ publishPublicKey: currentKeys.publicKey }))).toBe(false);
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg({ publishPublicKey: "" }))).toBe(false);
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg({ packageId: (0, utils_1.newid)() }))).toBe(false);
+    });
+    it("honours explicit key lists", () => {
+        const other = (0, keys_1.newKeys)();
+        const pkg = makePkg({ publishPublicKey: other.publicKey });
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(pkg)).toBe(false);
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(pkg, {
+            currentPublicKey: currentKeys.publicKey,
+            revokedPublicKeys: [other.publicKey],
+        })).toBe(true);
+    });
+    it("is false when the host has no current key to pin", () => {
+        expect((0, peers_core_trust_anchor_1.needsPeersCoreRepin)(makePkg(), { currentPublicKey: "" })).toBe(false);
+    });
+});
+describe("repinPeersCoreIfRevoked", () => {
+    it("re-pins and saves when the key is revoked", async () => {
+        mockPackagesSignAndSave.mockResolvedValue(undefined);
+        const pkg = makePkg();
+        const result = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(makeCtx(), pkg);
+        expect(result).not.toBe(pkg);
+        expect(result.publishPublicKey).toBe(currentKeys.publicKey);
+        expect(mockPackagesSignAndSave).toHaveBeenCalledWith(expect.objectContaining({
+            packageId: systemIds.peersCorePackageId,
+            publishPublicKey: currentKeys.publicKey,
+        }));
+        expect(console.warn).toHaveBeenCalled();
+    });
+    it("returns the same row and does not save when nothing is revoked", async () => {
+        const pkg = makePkg({ publishPublicKey: currentKeys.publicKey });
+        const result = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(makeCtx(), pkg);
+        expect(result).toBe(pkg);
+        expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+    });
+    it("does not touch other packages even when their key is revoked", async () => {
+        const pkg = makePkg({ packageId: (0, utils_1.newid)() });
+        const result = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(makeCtx(), pkg);
+        expect(result).toBe(pkg);
+        expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+    });
+    it("returns the original row when the save is not permitted", async () => {
+        mockPackagesSignAndSave.mockRejectedValue(new Error("not a writer"));
+        const pkg = makePkg();
+        const result = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(makeCtx("group-ro"), pkg);
+        expect(result).toBe(pkg);
+        expect(result.publishPublicKey).toBe(revokedKeys.publicKey);
+        expect(console.error).toHaveBeenCalled();
+    });
+});
+describe("repinInstalledPeersCoreIfRevoked", () => {
+    it("returns null when peers-core is not installed", async () => {
+        mockPackagesGet.mockResolvedValue(undefined);
+        expect(await (0, peers_core_trust_anchor_1.repinInstalledPeersCoreIfRevoked)(makeCtx())).toBeNull();
+        expect(mockPackagesSignAndSave).not.toHaveBeenCalled();
+    });
+    it("loads peers-core and re-pins it", async () => {
+        mockPackagesGet.mockResolvedValue(makePkg());
+        mockPackagesSignAndSave.mockResolvedValue(undefined);
+        const result = await (0, peers_core_trust_anchor_1.repinInstalledPeersCoreIfRevoked)(makeCtx());
+        expect(mockPackagesGet).toHaveBeenCalledWith(systemIds.peersCorePackageId);
+        expect(result?.publishPublicKey).toBe(currentKeys.publicKey);
+        expect(mockPackagesSignAndSave).toHaveBeenCalledTimes(1);
+    });
+});

package/dist/system-ids.d.ts

@@ -23,8 +23,28 @@ export declare const createGroupToolId = "000peers0tool0creategroup";
 export declare const peersCorePackageId = "00mh0wlipjixk2gqmurbwee0o";
 /** Canonical source repository for peers-core. */
 export declare const peersCorePackageRepoUrl = "https://github.com/peers-app/peers-core";
-/** Trusted publishing key for official peers-core releases. */
-export declare const peersCorePublishPublicKey = "S7cQqnvVz-FVDO6Lk5zC7epSvcP_-NyBVZz9gdcj73c";
+/**
+ * Trusted publishing key for official peers-core releases (Ed25519, base64url).
+ *
+ * This is the bootstrap trust anchor shipped with every host. It seeds `Packages.publishPublicKey`
+ * for peers-core and is what `verifyPackageAuthorSignature` checks remote and propagated
+ * peers-core versions against. The same key is registered as the active key of subject
+ * {@link peersCorePackageId} in the peers-services key registry (`GET /api/v1/keys/:subjectId`).
+ *
+ * Rotation: generate a new pair with `scripts/generate-publisher-key.mjs`, move the previous
+ * value into {@link peersCoreRevokedPublishPublicKeys}, seed the registry, and ship a host release.
+ */
+export declare const peersCorePublishPublicKey = "8S1pAWvka0RZauJnwM13n7qO01NtdGV7FSU_aSJw0dc";
+/**
+ * peers-core publishing keys that must never be trusted again, whatever a local `Packages` row
+ * or a propagating peer says. A version signed by one of these fails author verification, a
+ * peer offering one as a TOFU anchor is refused, and `ensurePeersCore` replaces a pinned
+ * revoked key with {@link peersCorePublishPublicKey}.
+ *
+ * Append-only. Entries are retained forever so a client coming back after a long time still
+ * rejects them.
+ */
+export declare const peersCoreRevokedPublishPublicKeys: readonly string[];
 /**
  * Stable id of the peers **system** itself, used as the `providerPackageId` for
  * built-in system contracts (contracts the platform provides rather than a package).

package/dist/system-ids.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
+exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCoreRevokedPublishPublicKeys = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
 /** Stable user ID that owns built-in Peers system records. */
 exports.peersRootUserId = "000peers0user000000000001";
 /** Default assistant used when no user-selected assistant is available. */
@@ -27,8 +27,31 @@ exports.createGroupToolId = "000peers0tool0creategroup";
 exports.peersCorePackageId = "00mh0wlipjixk2gqmurbwee0o";
 /** Canonical source repository for peers-core. */
 exports.peersCorePackageRepoUrl = "https://github.com/peers-app/peers-core";
-/** Trusted publishing key for official peers-core releases. */
-exports.peersCorePublishPublicKey = "S7cQqnvVz-FVDO6Lk5zC7epSvcP_-NyBVZz9gdcj73c";
+/**
+ * Trusted publishing key for official peers-core releases (Ed25519, base64url).
+ *
+ * This is the bootstrap trust anchor shipped with every host. It seeds `Packages.publishPublicKey`
+ * for peers-core and is what `verifyPackageAuthorSignature` checks remote and propagated
+ * peers-core versions against. The same key is registered as the active key of subject
+ * {@link peersCorePackageId} in the peers-services key registry (`GET /api/v1/keys/:subjectId`).
+ *
+ * Rotation: generate a new pair with `scripts/generate-publisher-key.mjs`, move the previous
+ * value into {@link peersCoreRevokedPublishPublicKeys}, seed the registry, and ship a host release.
+ */
+exports.peersCorePublishPublicKey = "8S1pAWvka0RZauJnwM13n7qO01NtdGV7FSU_aSJw0dc";
+/**
+ * peers-core publishing keys that must never be trusted again, whatever a local `Packages` row
+ * or a propagating peer says. A version signed by one of these fails author verification, a
+ * peer offering one as a TOFU anchor is refused, and `ensurePeersCore` replaces a pinned
+ * revoked key with {@link peersCorePublishPublicKey}.
+ *
+ * Append-only. Entries are retained forever so a client coming back after a long time still
+ * rejects them.
+ */
+exports.peersCoreRevokedPublishPublicKeys = [
+    // Exposed in packaged macOS builds v0.19.9 through v0.25.11 (2026-10-02 incident).
+    "S7cQqnvVz-FVDO6Lk5zC7epSvcP_-NyBVZz9gdcj73c",
+];
 /**
  * Stable id of the peers **system** itself, used as the `providerPackageId` for
  * built-in system contracts (contracts the platform provides rather than a package).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.25.11",
+  "version": "0.25.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"
@@ -28,9 +28,11 @@
     "build": "npm run clean && tsc",
     "dev": "tsc -w",
     "test": "jest",
-    "release:patch": "npm run build && npm version patch && git push && git push --tags",
-    "release:minor": "npm run build && npm version minor && git push && git push --tags",
-    "release:major": "npm run build && npm version major && git push && git push --tags",
+    "release:guard": "node release-guard.js",
+    "prepublishOnly": "npm run release:guard",
+    "release:patch": "npm run release:guard && npm run build && npm version patch && git push && git push --tags",
+    "release:minor": "npm run release:guard && npm run build && npm version minor && git push && git push --tags",
+    "release:major": "npm run release:guard && npm run build && npm version major && git push && git push --tags",
     "release": "npm run release:patch"
   },
   "dependencies": {