@peers-app/peers-sdk 0.25.14 → 0.25.15

package/dist/contracts/system/identity-contract.js

@@ -112,6 +112,178 @@ function getIdentityContractDefinition() {
                 inputFields: [],
                 outputFields: [field("token", field_type_1.FieldType.string, "peers-services JWT.")],
             },
+            {
+                name: "getKeyInfo",
+                usageDescription: "Return the signed-in user's current signing key, previous keys, on-record anchors, and registry status.",
+                inputFields: [],
+                outputFields: [
+                    field("userId", field_type_1.FieldType.id, "Signed-in user id."),
+                    field("publicKey", field_type_1.FieldType.string, "Current Ed25519 public key."),
+                    field("publicBoxKey", field_type_1.FieldType.string, "Current X25519 box public key."),
+                    field("previousPublicKeys", field_type_1.FieldType.object, "Keys retired on this host.", {
+                        isArray: true,
+                    }),
+                    field("canRotate", field_type_1.FieldType.boolean, "Whether this host can rotate the key."),
+                    field("anchors", field_type_1.FieldType.object, "On-record anchors and what each one currently lists.", {
+                        optional: true,
+                    }),
+                    field("registry", field_type_1.FieldType.object, "Key registry view of this user's keys.", {
+                        optional: true,
+                    }),
+                ],
+            },
+            {
+                name: "rotateKey",
+                usageDescription: "Replace the signed-in user's signing key once every on-record anchor lists the new key. When an anchor must be updated by hand the call returns the document with committed false; call again with confirm true to wait for the anchors. The host restarts after a committed rotation.",
+                inputFields: [
+                    field("reason", field_type_1.FieldType.string, "rotation (default) retires the old key; compromised or lost revokes it.", { optional: true }),
+                    field("publish", field_type_1.FieldType.string, "anchors (default) writes through installed writers and polls the other on-record anchors. manual writes nowhere and polls every anchor.", { optional: true }),
+                    field("confirm", field_type_1.FieldType.boolean, "When an anchor needs the document by hand, false returns it; true waits for every anchor and then rotates.", { optional: true }),
+                ],
+                outputFields: [
+                    field("oldPublicKey", field_type_1.FieldType.string, "The key this device holds, or the retired key."),
+                    field("newPublicKey", field_type_1.FieldType.string, "The new key."),
+                    field("reason", field_type_1.FieldType.string, "Reason recorded with the new key."),
+                    field("committed", field_type_1.FieldType.boolean, "True once the local key has changed."),
+                    field("restartRequired", field_type_1.FieldType.boolean, "True when the host will restart."),
+                    field("rewrappedSecrets", field_type_1.FieldType.number, "Personal secrets re-encrypted."),
+                    field("anchors", field_type_1.FieldType.object, "Per-anchor publish results.", { isArray: true }),
+                    field("manualDocument", field_type_1.FieldType.object, "Document to place at an anchor.", {
+                        optional: true,
+                    }),
+                    field("warnings", field_type_1.FieldType.string, "Non-fatal problems.", { isArray: true }),
+                ],
+            },
+            {
+                name: "getRecoveryEmail",
+                usageDescription: "Return the recovery email bound for this user, if any.",
+                inputFields: [],
+                outputFields: [
+                    field("email", field_type_1.FieldType.string, "Verified recovery email.", { optional: true }),
+                ],
+            },
+            {
+                name: "bindEmailStart",
+                usageDescription: "Mail a code to bind a recovery email. The current key signs the request.",
+                inputFields: [field("email", field_type_1.FieldType.string, "Mailbox to bind.")],
+                outputFields: [field("status", field_type_1.FieldType.string, "sent when the code was mailed.")],
+            },
+            {
+                name: "bindEmailVerify",
+                usageDescription: "Confirm the mailed code and store the recovery email.",
+                inputFields: [
+                    field("email", field_type_1.FieldType.string, "Mailbox the code was sent to."),
+                    field("code", field_type_1.FieldType.string, "Code from the mailbox."),
+                ],
+                outputFields: [field("email", field_type_1.FieldType.string, "Verified recovery email.")],
+            },
+            {
+                name: "unbindEmail",
+                usageDescription: "Remove the recovery email. peers-services will not accept a new key until another is bound.",
+                inputFields: [],
+                outputFields: [field("status", field_type_1.FieldType.string, "unbound.")],
+            },
+            {
+                name: "startAnchorSession",
+                usageDescription: "Mail a code to the recovery email. The signing key is not required. Pass userId when signed out.",
+                inputFields: [
+                    field("userId", field_type_1.FieldType.id, "User to recover when no one is signed in.", {
+                        optional: true,
+                    }),
+                ],
+                outputFields: [field("status", field_type_1.FieldType.string, "sent when the code was mailed.")],
+            },
+            {
+                name: "confirmAnchorSession",
+                usageDescription: "Exchange the mailed code for a short-lived session that can publish a key to peers-services.",
+                inputFields: [
+                    field("code", field_type_1.FieldType.string, "Code from the recovery mailbox."),
+                    field("userId", field_type_1.FieldType.id, "User to recover when no one is signed in.", {
+                        optional: true,
+                    }),
+                ],
+                outputFields: [
+                    field("expiresIn", field_type_1.FieldType.number, "Seconds the session can publish a key."),
+                ],
+            },
+            {
+                name: "contestRecovery",
+                usageDescription: "Object to a recovery with the key on record. Peers hold the new key until someone accepts it.",
+                inputFields: [field("pendingKey", field_type_1.FieldType.string, "Public key being recovered.")],
+                outputFields: [field("status", field_type_1.FieldType.string, "contested.")],
+            },
+            {
+                name: "acceptRecovery",
+                usageDescription: "Adopt a recovered key that the anchors confirmed, before or after a contest.",
+                inputFields: [
+                    field("userId", field_type_1.FieldType.id, "User whose key is being recovered."),
+                    field("pendingKey", field_type_1.FieldType.string, "Public key to adopt."),
+                ],
+                outputFields: [field("status", field_type_1.FieldType.string, "accepted.")],
+            },
+            {
+                name: "recoverKey",
+                usageDescription: "On a signed-out host, publish a new key without the old key's signature and sign in. Groups need a new invite. Secrets wrapped under the lost key stay unreadable.",
+                inputFields: [
+                    field("userId", field_type_1.FieldType.id, "User to recover."),
+                    field("publish", field_type_1.FieldType.string, "anchors uses an open recovery-email session. manual stages a document.", { optional: true }),
+                    field("confirm", field_type_1.FieldType.boolean, "With manual, false returns the document. true waits and then signs in.", { optional: true }),
+                ],
+                outputFields: [
+                    field("publicKey", field_type_1.FieldType.string, "The new public key."),
+                    field("committed", field_type_1.FieldType.boolean, "True once this host signed in with the new key."),
+                    field("manualDocument", field_type_1.FieldType.object, "Document to place at an anchor.", {
+                        optional: true,
+                    }),
+                    field("warnings", field_type_1.FieldType.string, "What a recovery cannot restore.", { isArray: true }),
+                ],
+            },
+            {
+                name: "setAnchors",
+                usageDescription: "Publish a new anchor list at the anchors already on record, then store it on this profile.",
+                inputFields: [
+                    field("anchors", field_type_1.FieldType.object, "The full list to publish.", { isArray: true }),
+                ],
+                outputFields: [
+                    field("anchors", field_type_1.FieldType.object, "The list now on record.", { isArray: true }),
+                ],
+            },
+            {
+                name: "passkeyRegisterStart",
+                usageDescription: "Start binding a passkey. The current key must sign. Returns WebAuthn options.",
+                inputFields: [field("origin", field_type_1.FieldType.string, "Page origin the passkey is created on.")],
+                outputFields: [field("options", field_type_1.FieldType.object, "navigator.credentials.create options.")],
+            },
+            {
+                name: "passkeyRegisterFinish",
+                usageDescription: "Store a passkey after the browser creates it.",
+                inputFields: [field("response", field_type_1.FieldType.object, "The browser's registration response.")],
+                outputFields: [field("status", field_type_1.FieldType.string, "registered.")],
+            },
+            {
+                name: "passkeyAuthStart",
+                usageDescription: "Start a passkey sign-in that can publish a key. Pass userId when signed out.",
+                inputFields: [
+                    field("origin", field_type_1.FieldType.string, "Page origin the passkey is used on."),
+                    field("userId", field_type_1.FieldType.id, "User to recover when no one is signed in.", {
+                        optional: true,
+                    }),
+                ],
+                outputFields: [field("options", field_type_1.FieldType.object, "navigator.credentials.get options.")],
+            },
+            {
+                name: "passkeyAuthFinish",
+                usageDescription: "Open an anchor-write session after the browser returns a passkey assertion.",
+                inputFields: [
+                    field("response", field_type_1.FieldType.object, "The browser's authentication response."),
+                    field("userId", field_type_1.FieldType.id, "User to recover when no one is signed in.", {
+                        optional: true,
+                    }),
+                ],
+                outputFields: [
+                    field("expiresIn", field_type_1.FieldType.number, "Seconds the session can publish a key."),
+                ],
+            },
         ],
         observables: [
             {

package/dist/contracts/system/index.d.ts

@@ -9,7 +9,7 @@ import "./logs-contract";
 import "./network-contracts";
 import "./tool-access-control-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./device-operations-contract";
-export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentitySessionInfo, } from "./identity-contract";
+export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentityKeyInfo, type IIdentityRegistryKey, type IIdentityRotateKeyInput, type IIdentityRotateKeyResult, type IIdentitySessionInfo, } from "./identity-contract";
 export { getInvitesContractDefinition, type IAcceptInviteResult, type ICreatedInvite, type IInvitePreview, type IInvitesConsumer, INVITES_CONTRACT_VERSION, } from "./invites-contract";
 export { getLogsContractDefinition, type ILogsConsumer, LOGS_CONTRACT_VERSION, resolveLogsContract, } from "./logs-contract";
 export * from "./network-contracts";

package/dist/data/assistants.d.ts

@@ -31,16 +31,16 @@ export declare const assistantSchema: z.ZodObject<{
     toolsToInclude: string;
     toolInclusionStrategy: ToolInclusionStrategy;
     description?: string | undefined;
-    packageId?: string | undefined;
     updatedAt?: Date | undefined;
+    packageId?: string | undefined;
 }, {
     name: string;
     assistantId: string;
     description?: string | undefined;
+    updatedAt?: Date | undefined;
     packageId?: string | undefined;
     accessLevel?: number | undefined;
     createdAt?: Date | undefined;
-    updatedAt?: Date | undefined;
     assistantRunnerToolId?: string | undefined;
     assistantRunnerConfig?: z.objectInputType<{}, z.ZodAny, "strip"> | undefined;
     toolsToInclude?: string | undefined;
@@ -65,8 +65,8 @@ export declare function Assistants(dataContext?: DataContext): import("..").Tabl
     toolsToInclude: string;
     toolInclusionStrategy: ToolInclusionStrategy;
     description?: string | undefined;
-    packageId?: string | undefined;
     updatedAt?: Date | undefined;
+    packageId?: string | undefined;
 }>;
 /**
  * Per-user primary assistant preference for the current group.
@@ -96,8 +96,8 @@ export declare const getPrimaryAssistant: (dataContext?: DataContext) => Promise
     toolsToInclude: string;
     toolInclusionStrategy: ToolInclusionStrategy;
     description?: string | undefined;
-    packageId?: string | undefined;
     updatedAt?: Date | undefined;
+    packageId?: string | undefined;
 }>;
 /**
  * Return Assistant ids mentioned in markdown (`<@assistant:name:id>`).

package/dist/data/devices.d.ts

@@ -46,16 +46,16 @@ export declare const deviceInfoSchema: z.ZodObject<{
     deviceName: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     publicKey: string;
-    publicBoxKey: string;
     userId: string;
     deviceId: string;
+    publicBoxKey: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
 }, {
     publicKey: string;
-    publicBoxKey: string;
     userId: string;
     deviceId: string;
+    publicBoxKey: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
 }>;
@@ -107,13 +107,57 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
         version: 1;
         ephemeralBoxKey: string;
     }>>;
+    /** Present when this device, holding the key on record, objects to a recovery. */
+    keyContest: z.ZodOptional<z.ZodObject<{
+        contents: z.ZodObject<{
+            purpose: z.ZodLiteral<"peers-key-contest">;
+            userId: z.ZodEffects<z.ZodString, string, string>;
+            publicKey: z.ZodString;
+            pendingKey: z.ZodString;
+            at: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            at: string;
+            publicKey: string;
+            purpose: "peers-key-contest";
+            userId: string;
+            pendingKey: string;
+        }, {
+            at: string;
+            publicKey: string;
+            purpose: "peers-key-contest";
+            userId: string;
+            pendingKey: string;
+        }>;
+        signature: z.ZodString;
+        publicKey: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        publicKey: string;
+        signature: string;
+        contents: {
+            at: string;
+            publicKey: string;
+            purpose: "peers-key-contest";
+            userId: string;
+            pendingKey: string;
+        };
+    }, {
+        publicKey: string;
+        signature: string;
+        contents: {
+            at: string;
+            publicKey: string;
+            purpose: "peers-key-contest";
+            userId: string;
+            pendingKey: string;
+        };
+    }>>;
 }, "strip", z.ZodTypeAny, {
     timestamp: number;
     publicKey: string;
-    publicBoxKey: string;
     userId: string;
     connectionId: string;
     deviceId: string;
+    publicBoxKey: string;
     serverAddress: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
@@ -121,13 +165,24 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
         version: 1;
         ephemeralBoxKey: string;
     } | undefined;
+    keyContest?: {
+        publicKey: string;
+        signature: string;
+        contents: {
+            at: string;
+            publicKey: string;
+            purpose: "peers-key-contest";
+            userId: string;
+            pendingKey: string;
+        };
+    } | undefined;
 }, {
     timestamp: number;
     publicKey: string;
-    publicBoxKey: string;
     userId: string;
     connectionId: string;
     deviceId: string;
+    publicBoxKey: string;
     serverAddress: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
@@ -135,6 +190,17 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
         version: 1;
         ephemeralBoxKey: string;
     } | undefined;
+    keyContest?: {
+        publicKey: string;
+        signature: string;
+        contents: {
+            at: string;
+            publicKey: string;
+            purpose: "peers-key-contest";
+            userId: string;
+            pendingKey: string;
+        };
+    } | undefined;
 }>;
 /** Signed device information bound to one connection handshake. */
 export type IDeviceHandshake = z.infer<typeof deviceHandshakeSchema>;

package/dist/data/devices.js

@@ -5,6 +5,7 @@ exports.Devices = Devices;
 const zod_1 = require("zod");
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const socket_type_1 = require("../device/socket.type");
+const key_contest_1 = require("../identity/key-contest");
 const zod_types_1 = require("../types/zod-types");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
@@ -53,6 +54,8 @@ exports.deviceHandshakeSchema = exports.deviceInfoSchema.extend({
     serverAddress: zod_1.z.string(),
     timestamp: zod_1.z.number(),
     frameCrypto: exports.handshakeFrameCryptoSchema.optional(),
+    /** Present when this device, holding the key on record, objects to a recovery. */
+    keyContest: key_contest_1.keyContestSignedSchema.optional(),
 });
 const metaData = {
     name: "Devices",

package/dist/data/group-members.d.ts

@@ -13,15 +13,15 @@ export declare const groupMemberSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     role: GroupMemberRole;
     signature: string;
-    groupId: string;
     userId: string;
+    groupId: string;
     groupMemberId: string;
     deleted?: boolean | undefined;
 }, {
     role: GroupMemberRole;
     signature: string;
-    groupId: string;
     userId: string;
+    groupId: string;
     groupMemberId: string;
     deleted?: boolean | undefined;
 }>;

package/dist/data/groups.d.ts

@@ -19,9 +19,9 @@ export declare const groupSchema: z.ZodObject<{
     description: string;
     publicKey: string;
     signature: string;
+    publicBoxKey: string;
     groupId: string;
     founderUserId: string;
-    publicBoxKey: string;
     disabled?: boolean | undefined;
     iconClassName?: string | undefined;
     publicRole?: GroupMemberRole | undefined;
@@ -30,9 +30,9 @@ export declare const groupSchema: z.ZodObject<{
     description: string;
     publicKey: string;
     signature: string;
+    publicBoxKey: string;
     groupId: string;
     founderUserId: string;
-    publicBoxKey: string;
     disabled?: boolean | undefined;
     iconClassName?: string | undefined;
     publicRole?: GroupMemberRole | undefined;