@peers-app/peers-sdk 0.25.16 → 0.25.18

package/dist/contracts/__tests__/contract-proxy.test.js

@@ -435,7 +435,7 @@ describe("contract proxy — error handling", () => {
             tools: {
                 listGrants: {
                     tool: { toolId: (0, utils_1.newid)(), name: "listGrants", accessLevel: 0 },
-                    toolFn: async (host) => {
+                    toolFn: async (_input, host) => {
                         seen.push(host.callerPackageId ?? null);
                         return "ok";
                     },
@@ -452,6 +452,29 @@ describe("contract proxy — error handling", () => {
         }, { callerPackageId: "00pkg00000000000000000001" });
         expect(seen).toEqual(["00pkg00000000000000000001"]);
     });
+    it("rejects extra arguments that could shadow forwarded call context", async () => {
+        const toolFn = jest.fn(async (_input, host) => host.callerPackageId ?? null);
+        const provider = (0, contract_proxy_1.createContractProvider)({
+            contractId: CONTRACT_ID,
+            version: 1,
+            forwardCallContext: true,
+            tools: {
+                request: {
+                    tool: { toolId: (0, utils_1.newid)(), name: "request", accessLevel: 0 },
+                    toolFn,
+                },
+            },
+        });
+        await expect(provider({
+            contractId: CONTRACT_ID,
+            version: 1,
+            member: "tool",
+            name: "request",
+            operation: "run",
+            args: [{ url: "https://example.com" }, { callerPackageId: (0, utils_1.newid)() }],
+        }, { callerPackageId: (0, utils_1.newid)() })).rejects.toThrow(/single argument when host context is forwarded/);
+        expect(toolFn).not.toHaveBeenCalled();
+    });
     it.each([
         ["tool", "missingTool"],
         ["observable", "missingObservable"],

package/dist/contracts/__tests__/contract-resolvers.test.js

@@ -168,6 +168,9 @@ describe("Self-trusted contract caller authorization", () => {
         ["Tool Access Control", system_ids_1.toolAccessControlContractId],
         ["Identity", system_ids_1.identityContractId],
         ["Invites", system_ids_1.invitesContractId],
+        ["HTTP", system_ids_1.httpContractId],
+        ["Scheduler", system_ids_1.schedulerContractId],
+        ["Contract Catalog", system_ids_1.contractCatalogContractId],
     ])("rejects remote %s as local-only", async (_name, contractId) => {
         const { remoteIdentity, user } = makeIdentity();
         const records = new Map();

package/dist/contracts/contract-provider-router.d.ts

@@ -27,10 +27,17 @@ export interface IContractProviderEndpointRequest {
     /** Target contract version. */
     version: number;
     /**
-     * Provider selected by trusted host state. This value is never copied from
-     * an {@link IContractCall} or other guest payload.
+     * Provider selected by trusted host state after any requested provider has
+     * been checked against the registry.
      */
     providerPackageId?: string;
+    /**
+     * Provider named on the call by a local UI consumer.
+     *
+     * Set only when the router was created with `allowRequestedProvider`. Remote
+     * routers leave this unset.
+     */
+    requestedProviderPackageId?: string;
     /** Canonical data context returned by the authorization hook. */
     dataContextId?: string;
     /**
@@ -65,6 +72,13 @@ export interface IContractProviderRouterOptions {
      * provider-aware and automatically selects a new endpoint after a provider switch.
      */
     resolveProviderPackageId?: ContractProviderPackageResolver;
+    /**
+     * When true, a local caller may name `providerPackageId` on the call.
+     *
+     * The resolver must still reject ids that are not registered. Remote routers
+     * leave this false.
+     */
+    allowRequestedProvider?: boolean;
     /** Resolves an endpoint after authorization succeeds. */
     resolveEndpoint: ContractProviderEndpointResolver;
     /** Caller identity derived from the trusted underlying connection/session. */

package/dist/contracts/contract-provider-router.js

@@ -121,11 +121,15 @@ function createContractProviderRouter(transport, opts) {
                 ...call,
                 dataContextId: authorization.dataContextId,
             };
+            const requestedProviderPackageId = opts.allowRequestedProvider && !targetDeviceId && typeof call.providerPackageId === "string"
+                ? call.providerPackageId
+                : undefined;
             const endpointRequest = {
                 contractId: call.contractId,
                 version: call.version,
                 dataContextId: authorization.dataContextId,
                 targetDeviceId,
+                requestedProviderPackageId,
                 context,
                 notify,
             };

package/dist/contracts/contract-providers.table.d.ts

@@ -17,15 +17,15 @@ declare const schema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     version: number;
     contractId: string;
-    contractProviderId: string;
     providerPackageId: string;
+    contractProviderId: string;
     isActive: boolean;
     registeredAt: string;
 }, {
     version: number;
     contractId: string;
-    contractProviderId: string;
     providerPackageId: string;
+    contractProviderId: string;
     isActive: boolean;
     registeredAt: string;
 }>;

package/dist/contracts/contract-proxy.d.ts

@@ -62,6 +62,14 @@ export interface IContractCall {
      * under its own identity.
      */
     targetDeviceId?: string;
+    /**
+     * Provider to address when a contract has more than one.
+     *
+     * Honored by the local UI router after it checks the id is registered, and by
+     * the isolated runtime when the caller declared a consume of this contract.
+     * Remote device routers ignore it and keep the active provider.
+     */
+    providerPackageId?: string;
     /**
      * For any subscription call (a generic `event`, a table `dataChanged`, or an observable
      * value stream): the consumer-chosen id that ties a `"subscribe"` (and its later
@@ -256,9 +264,12 @@ export interface IContractToolContext {
  * @param transport  Bidirectional channel to the provider; requests go out on
  *   {@link CONTRACT_REQUEST_CHANNEL}, notifications arrive on {@link CONTRACT_NOTIFY_CHANNEL}.
  * @param opts.dataContextId  Optional data context to scope every call to.
+ * @param opts.providerPackageId  Optional provider to address. The local host
+ *   accepts it only when that package is registered for this contract version.
  */
 export declare function createContractConsumer(contract: IContractDefinition, transport: IContractTransport, opts?: {
     dataContextId?: string;
+    providerPackageId?: string;
 }): IContractConsumer;
 /**
  * Build the **remote** consumer side of a contract: a factory of tools-only consumers whose

package/dist/contracts/contract-proxy.js

@@ -73,12 +73,17 @@ exports.CONTRACT_CALL_RPC = contract_transport_1.CONTRACT_REQUEST_CHANNEL;
  * @param transport  Bidirectional channel to the provider; requests go out on
  *   {@link CONTRACT_REQUEST_CHANNEL}, notifications arrive on {@link CONTRACT_NOTIFY_CHANNEL}.
  * @param opts.dataContextId  Optional data context to scope every call to.
+ * @param opts.providerPackageId  Optional provider to address. The local host
+ *   accepts it only when that package is registered for this contract version.
  */
 function createContractConsumer(contract, transport, opts = {}) {
     const { contractId, version } = contract;
-    const { dataContextId } = opts;
+    const { dataContextId, providerPackageId } = opts;
     let disposed = false;
-    const emitRequest = (call) => transport.emit(contract_transport_1.CONTRACT_REQUEST_CHANNEL, call);
+    const emitRequest = (call) => transport.emit(contract_transport_1.CONTRACT_REQUEST_CHANNEL, {
+        ...call,
+        ...(providerPackageId ? { providerPackageId } : {}),
+    });
     const request = (call) => disposed
         ? Promise.reject(new Error(`Contract consumer ${contractId} v${version} is disposed`))
         : emitRequest(call);
@@ -535,13 +540,16 @@ function createContractProvider(resolution, opts = {}) {
                 }
                 await assertContractToolAccess(tool, call, context);
                 if (resolution.toolContext || resolution.forwardCallContext) {
+                    if (call.args.length > 1) {
+                        throw new Error("Permission denied: tool runs accept a single argument when host context is forwarded");
+                    }
                     const base = resolution.toolContext ?? {
                         dataContextId: context.dataContext?.dataContextId ?? "",
                         getVariable: async () => {
                             throw new Error("Persistent variables are not available to this contract tool");
                         },
                     };
-                    return tool.toolFn(...call.args, {
+                    return tool.toolFn(call.args[0], {
                         ...base,
                         callerPackageId: context.callerPackageId,
                     });

package/dist/contracts/contract-resolvers.js

@@ -147,9 +147,12 @@ async function isSelfTrustedContractCaller(userContext, remoteIdentity) {
 }
 const permissionDenied = (call, reason) => new Error(`Permission denied: ${call.member} '${call.name}'.${call.operation} on contract ${call.contractId}${reason ? ` (${reason})` : ""}`);
 const localOnlyContractIds = new Set([
+    system_ids_1.contractCatalogContractId,
+    system_ids_1.httpContractId,
     system_ids_1.identityContractId,
     system_ids_1.invitesContractId,
     system_ids_1.localFoldersContractId,
+    system_ids_1.schedulerContractId,
     system_ids_1.toolAccessControlContractId,
 ]);
 /**
@@ -322,6 +325,7 @@ function resolvesWithoutUser(contractId, version, peekUserContext) {
 function createLocalUserContextContractProviderRouter(transport, opts) {
     const { getUserContext, peekUserContext, allowedContractIds, resolveVariable } = opts;
     return (0, contract_provider_router_1.createContractProviderRouter)(transport, {
+        allowRequestedProvider: true,
         authorizeCall: async (call) => {
             if (allowedContractIds && !allowedContractIds.has(call.contractId)) {
                 throw new Error(`Permission denied: contract ${call.contractId} is not available locally`);
@@ -341,12 +345,19 @@ function createLocalUserContextContractProviderRouter(transport, opts) {
                 context,
             };
         },
-        resolveProviderPackageId: async ({ contractId, version, dataContextId }) => {
+        resolveProviderPackageId: async ({ contractId, version, dataContextId, requestedProviderPackageId, }) => {
             if (resolvesWithoutUser(contractId, version, peekUserContext)) {
                 return undefined;
             }
             const userContext = await getUserContext();
             const dataContext = getAuthorizedLocalDataContext(userContext, dataContextId);
+            if (requestedProviderPackageId) {
+                const registered = dataContext.packageLoader?.contractRegistry.getRegisteredProviderIds(contractId, version) ?? [];
+                if (!registered.includes(requestedProviderPackageId)) {
+                    throw new Error(`Package ${requestedProviderPackageId} is not a registered provider for ${contractId} v${version}`);
+                }
+                return requestedProviderPackageId;
+            }
             return getActiveProviderPackageId(dataContext, contractId, version);
         },
         resolveEndpoint: async (request) => {

package/dist/contracts/index.d.ts

@@ -12,12 +12,15 @@ export { getHostContractTransport, type HostContractTransportListener, registerH
 export { PersistentContractRegistry } from "./persistent-registry";
 export { ContractRegistry, type IContractProviderRegistration } from "./registry";
 export { createRemoteContractEndpoint, getRemoteContractTransportFactory, type IRemoteContractHost, type IRemoteContractTarget, type RemoteContractTransportFactory, resolveRemoteTargetEndpoint, setRemoteContractTransportFactory, } from "./remote-contract-transport";
+export { CONTRACT_CATALOG_VERSION, contractCatalogProviderPackageId, getContractCatalogDefinition, type IContractCatalogConsumer, type IContractProviderInfo, type IListContractProvidersInput, } from "./system/contract-catalog-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./system/device-operations-contract";
+export { getHttpContractDefinition, HTTP_CONTRACT_VERSION, HTTP_DEFAULT_TIMEOUT_MS, HTTP_MAX_BODY_BYTES, HTTP_MAX_TIMEOUT_MS, httpProviderPackageId, type IHttpCancelInput, type IHttpConsumer, type IHttpCredentialInfo, type IHttpMultipartPart, type IHttpPolicyInfo, type IHttpRequestInput, type IHttpRequestResult, } from "./system/http-contract";
 export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentityKeyInfo, type IIdentityRegistryKey, type IIdentityRotateKeyInput, type IIdentityRotateKeyResult, type IIdentitySessionInfo, } from "./system/identity-contract";
 export { getInvitesContractDefinition, type IAcceptInviteResult, type ICreatedInvite, type IInvitePreview, type IInvitesConsumer, INVITES_CONTRACT_VERSION, } from "./system/invites-contract";
 export { getLocalFoldersContractDefinition, type ILocalFolderAssembleInput, type ILocalFolderAssembleResult, type ILocalFolderChange, type ILocalFolderChangedEvent, type ILocalFolderEntry, type ILocalFolderFileBlocks, type ILocalFolderFileBlocksInput, type ILocalFolderGrantInfo, type ILocalFolderIndexInput, type ILocalFolderIndexResult, type ILocalFolderJobFinishedEvent, type ILocalFolderJobHandle, type ILocalFolderJobInfo, type ILocalFolderJobProgressEvent, type ILocalFolderListInput, type ILocalFolderManifestBlock, type ILocalFolderMoveInput, type ILocalFolderPathInput, type ILocalFolderPurgeTrashInput, type ILocalFolderReadRangeInput, type ILocalFolderReadRangeResult, type ILocalFolderRequestGrantInput, type ILocalFolderStatInput, LOCAL_FOLDERS_ASSEMBLE_STALL_MS, LOCAL_FOLDERS_CHUNK_AVG, LOCAL_FOLDERS_CHUNK_MAX, LOCAL_FOLDERS_CHUNK_MIN, LOCAL_FOLDERS_CONTRACT_VERSION, LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS, LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES, LOCAL_FOLDERS_HAVE_BATCH, LOCAL_FOLDERS_JOB_TTL_MS, LOCAL_FOLDERS_READ_RANGE_MAX, LOCAL_FOLDERS_RESERVED_DIR, type LocalFolderChangeKind, type LocalFolderEntryKind, type LocalFolderJobKind, type LocalFolderMode, localFoldersProviderPackageId, } from "./system/local-folders-contract";
 export { getLogsContractDefinition, type ILogsConsumer, LOGS_CONTRACT_VERSION, resolveLogsContract, } from "./system/logs-contract";
 export * from "./system/network-contracts";
+export { getSchedulerContractDefinition, type IScheduleInfo, type IScheduleInput, type ISchedulerConsumer, SCHEDULER_CONTRACT_VERSION, SCHEDULER_MAX_DELAY_MS, schedulerProviderPackageId, } from "./system/scheduler-contract";
 export { getToolAccessControlContractDefinition, type IToolAccessControlConsumer, TOOL_ACCESS_CONTROL_CONTRACT_VERSION, } from "./system/tool-access-control-contract";
 export { type ISystemContractRegistration, installSystemContracts, listSystemContracts, registerSystemContract, } from "./system-contracts";
 export type { IAlsoImplementsDeclaration, IConsumedContract, IConsumedContractHandle, IConsumedContractOptions, IContractDefinition, IContractEvent, IContractObservable, IContractTable, IContractTool, IPackageDefinitionResult, IRemoteContract, IRemoteContractConsumer, IRemoteContractHandle, IResolvedContract, IValidationError, IValidationResult, } from "./types";

package/dist/contracts/index.js

@@ -14,8 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEVICE_OPERATIONS_MAX_ROWS = exports.DEVICE_OPERATIONS_MAX_RESULT_BYTES = exports.DEVICE_OPERATIONS_MAX_QUERY_LENGTH = exports.DEVICE_OPERATIONS_CONTRACT_VERSION = exports.setRemoteContractTransportFactory = exports.resolveRemoteTargetEndpoint = exports.getRemoteContractTransportFactory = exports.createRemoteContractEndpoint = exports.ContractRegistry = exports.PersistentContractRegistry = exports.waitForHostContractTransport = exports.subscribeHostContractTransport = exports.registerHostContractTransport = exports.getHostContractTransport = exports.hostContractConsumer = exports.setSchemaToFieldsFn = exports.extractToolShape = exports.extractTableShape = exports.createLocalContractConsumer = exports.contractsSchema = exports.contractsMetaData = exports.ContractsTable = exports.Contracts = exports.inProcessTransportPair = exports.connectionContractTransport = exports.CONTRACT_REQUEST_CHANNEL = exports.CONTRACT_NOTIFY_CHANNEL = exports.verifyRemoteContractIdentity = exports.registerContractResolver = exports.isSelfTrustedContractCaller = exports.handleContractCall = exports.getContractResolver = exports.createUserContextContractProviderRouter = exports.createLocalUserContextContractProviderRouter = exports.authorizeRemoteContractCall = exports.sameUserContractPermissionCheck = exports.createRemoteContractConsumer = exports.createContractProviderSession = exports.createContractProviderEndpoint = exports.createContractProvider = exports.createContractConsumer = exports.CONTRACT_CALL_RPC = exports.contractProvidersSchema = exports.contractProvidersMetaData = exports.ContractProvidersTable = exports.ContractProviders = exports.createContractProviderRouter = exports.PackageBuilder = exports.definePackage = exports.ContractBuilder = void 0;
-exports.validateProviderSatisfiesContract = exports.validateImmutability = exports.validateAlsoImplements = exports.contractKey = exports.registerSystemContract = exports.listSystemContracts = exports.installSystemContracts = exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContractDefinition = exports.resolveLogsContract = exports.LOGS_CONTRACT_VERSION = exports.getLogsContractDefinition = exports.localFoldersProviderPackageId = exports.LOCAL_FOLDERS_RESERVED_DIR = exports.LOCAL_FOLDERS_READ_RANGE_MAX = exports.LOCAL_FOLDERS_JOB_TTL_MS = exports.LOCAL_FOLDERS_HAVE_BATCH = exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES = exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS = exports.LOCAL_FOLDERS_CONTRACT_VERSION = exports.LOCAL_FOLDERS_CHUNK_MIN = exports.LOCAL_FOLDERS_CHUNK_MAX = exports.LOCAL_FOLDERS_CHUNK_AVG = exports.LOCAL_FOLDERS_ASSEMBLE_STALL_MS = exports.getLocalFoldersContractDefinition = exports.INVITES_CONTRACT_VERSION = exports.getInvitesContractDefinition = exports.IDENTITY_CONTRACT_VERSION = exports.getIdentityContractDefinition = exports.getDeviceOperationsContractDefinition = exports.deviceOperationsToolIds = exports.deviceOperationsProviderPackageId = exports.DEVICE_OPERATIONS_MAX_TOOLS = void 0;
+exports.DEVICE_OPERATIONS_CONTRACT_VERSION = exports.getContractCatalogDefinition = exports.contractCatalogProviderPackageId = exports.CONTRACT_CATALOG_VERSION = exports.setRemoteContractTransportFactory = exports.resolveRemoteTargetEndpoint = exports.getRemoteContractTransportFactory = exports.createRemoteContractEndpoint = exports.ContractRegistry = exports.PersistentContractRegistry = exports.waitForHostContractTransport = exports.subscribeHostContractTransport = exports.registerHostContractTransport = exports.getHostContractTransport = exports.hostContractConsumer = exports.setSchemaToFieldsFn = exports.extractToolShape = exports.extractTableShape = exports.createLocalContractConsumer = exports.contractsSchema = exports.contractsMetaData = exports.ContractsTable = exports.Contracts = exports.inProcessTransportPair = exports.connectionContractTransport = exports.CONTRACT_REQUEST_CHANNEL = exports.CONTRACT_NOTIFY_CHANNEL = exports.verifyRemoteContractIdentity = exports.registerContractResolver = exports.isSelfTrustedContractCaller = exports.handleContractCall = exports.getContractResolver = exports.createUserContextContractProviderRouter = exports.createLocalUserContextContractProviderRouter = exports.authorizeRemoteContractCall = exports.sameUserContractPermissionCheck = exports.createRemoteContractConsumer = exports.createContractProviderSession = exports.createContractProviderEndpoint = exports.createContractProvider = exports.createContractConsumer = exports.CONTRACT_CALL_RPC = exports.contractProvidersSchema = exports.contractProvidersMetaData = exports.ContractProvidersTable = exports.ContractProviders = exports.createContractProviderRouter = exports.PackageBuilder = exports.definePackage = exports.ContractBuilder = void 0;
+exports.validateProviderSatisfiesContract = exports.validateImmutability = exports.validateAlsoImplements = exports.contractKey = exports.registerSystemContract = exports.listSystemContracts = exports.installSystemContracts = exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContractDefinition = exports.schedulerProviderPackageId = exports.SCHEDULER_MAX_DELAY_MS = exports.SCHEDULER_CONTRACT_VERSION = exports.getSchedulerContractDefinition = exports.resolveLogsContract = exports.LOGS_CONTRACT_VERSION = exports.getLogsContractDefinition = exports.localFoldersProviderPackageId = exports.LOCAL_FOLDERS_RESERVED_DIR = exports.LOCAL_FOLDERS_READ_RANGE_MAX = exports.LOCAL_FOLDERS_JOB_TTL_MS = exports.LOCAL_FOLDERS_HAVE_BATCH = exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BYTES = exports.LOCAL_FOLDERS_GETBLOCKS_MAX_BLOCKS = exports.LOCAL_FOLDERS_CONTRACT_VERSION = exports.LOCAL_FOLDERS_CHUNK_MIN = exports.LOCAL_FOLDERS_CHUNK_MAX = exports.LOCAL_FOLDERS_CHUNK_AVG = exports.LOCAL_FOLDERS_ASSEMBLE_STALL_MS = exports.getLocalFoldersContractDefinition = exports.INVITES_CONTRACT_VERSION = exports.getInvitesContractDefinition = exports.IDENTITY_CONTRACT_VERSION = exports.getIdentityContractDefinition = exports.httpProviderPackageId = exports.HTTP_MAX_TIMEOUT_MS = exports.HTTP_MAX_BODY_BYTES = exports.HTTP_DEFAULT_TIMEOUT_MS = exports.HTTP_CONTRACT_VERSION = exports.getHttpContractDefinition = exports.getDeviceOperationsContractDefinition = exports.deviceOperationsToolIds = exports.deviceOperationsProviderPackageId = exports.DEVICE_OPERATIONS_MAX_TOOLS = exports.DEVICE_OPERATIONS_MAX_ROWS = exports.DEVICE_OPERATIONS_MAX_RESULT_BYTES = exports.DEVICE_OPERATIONS_MAX_QUERY_LENGTH = void 0;
 var builder_1 = require("./builder");
 Object.defineProperty(exports, "ContractBuilder", { enumerable: true, get: function () { return builder_1.ContractBuilder; } });
 Object.defineProperty(exports, "definePackage", { enumerable: true, get: function () { return builder_1.definePackage; } });
@@ -76,6 +76,10 @@ Object.defineProperty(exports, "createRemoteContractEndpoint", { enumerable: tru
 Object.defineProperty(exports, "getRemoteContractTransportFactory", { enumerable: true, get: function () { return remote_contract_transport_1.getRemoteContractTransportFactory; } });
 Object.defineProperty(exports, "resolveRemoteTargetEndpoint", { enumerable: true, get: function () { return remote_contract_transport_1.resolveRemoteTargetEndpoint; } });
 Object.defineProperty(exports, "setRemoteContractTransportFactory", { enumerable: true, get: function () { return remote_contract_transport_1.setRemoteContractTransportFactory; } });
+var contract_catalog_contract_1 = require("./system/contract-catalog-contract");
+Object.defineProperty(exports, "CONTRACT_CATALOG_VERSION", { enumerable: true, get: function () { return contract_catalog_contract_1.CONTRACT_CATALOG_VERSION; } });
+Object.defineProperty(exports, "contractCatalogProviderPackageId", { enumerable: true, get: function () { return contract_catalog_contract_1.contractCatalogProviderPackageId; } });
+Object.defineProperty(exports, "getContractCatalogDefinition", { enumerable: true, get: function () { return contract_catalog_contract_1.getContractCatalogDefinition; } });
 var device_operations_contract_1 = require("./system/device-operations-contract");
 Object.defineProperty(exports, "DEVICE_OPERATIONS_CONTRACT_VERSION", { enumerable: true, get: function () { return device_operations_contract_1.DEVICE_OPERATIONS_CONTRACT_VERSION; } });
 Object.defineProperty(exports, "DEVICE_OPERATIONS_MAX_QUERY_LENGTH", { enumerable: true, get: function () { return device_operations_contract_1.DEVICE_OPERATIONS_MAX_QUERY_LENGTH; } });
@@ -85,6 +89,13 @@ Object.defineProperty(exports, "DEVICE_OPERATIONS_MAX_TOOLS", { enumerable: true
 Object.defineProperty(exports, "deviceOperationsProviderPackageId", { enumerable: true, get: function () { return device_operations_contract_1.deviceOperationsProviderPackageId; } });
 Object.defineProperty(exports, "deviceOperationsToolIds", { enumerable: true, get: function () { return device_operations_contract_1.deviceOperationsToolIds; } });
 Object.defineProperty(exports, "getDeviceOperationsContractDefinition", { enumerable: true, get: function () { return device_operations_contract_1.getDeviceOperationsContractDefinition; } });
+var http_contract_1 = require("./system/http-contract");
+Object.defineProperty(exports, "getHttpContractDefinition", { enumerable: true, get: function () { return http_contract_1.getHttpContractDefinition; } });
+Object.defineProperty(exports, "HTTP_CONTRACT_VERSION", { enumerable: true, get: function () { return http_contract_1.HTTP_CONTRACT_VERSION; } });
+Object.defineProperty(exports, "HTTP_DEFAULT_TIMEOUT_MS", { enumerable: true, get: function () { return http_contract_1.HTTP_DEFAULT_TIMEOUT_MS; } });
+Object.defineProperty(exports, "HTTP_MAX_BODY_BYTES", { enumerable: true, get: function () { return http_contract_1.HTTP_MAX_BODY_BYTES; } });
+Object.defineProperty(exports, "HTTP_MAX_TIMEOUT_MS", { enumerable: true, get: function () { return http_contract_1.HTTP_MAX_TIMEOUT_MS; } });
+Object.defineProperty(exports, "httpProviderPackageId", { enumerable: true, get: function () { return http_contract_1.httpProviderPackageId; } });
 var identity_contract_1 = require("./system/identity-contract");
 Object.defineProperty(exports, "getIdentityContractDefinition", { enumerable: true, get: function () { return identity_contract_1.getIdentityContractDefinition; } });
 Object.defineProperty(exports, "IDENTITY_CONTRACT_VERSION", { enumerable: true, get: function () { return identity_contract_1.IDENTITY_CONTRACT_VERSION; } });
@@ -110,6 +121,11 @@ Object.defineProperty(exports, "getLogsContractDefinition", { enumerable: true,
 Object.defineProperty(exports, "LOGS_CONTRACT_VERSION", { enumerable: true, get: function () { return logs_contract_1.LOGS_CONTRACT_VERSION; } });
 Object.defineProperty(exports, "resolveLogsContract", { enumerable: true, get: function () { return logs_contract_1.resolveLogsContract; } });
 __exportStar(require("./system/network-contracts"), exports);
+var scheduler_contract_1 = require("./system/scheduler-contract");
+Object.defineProperty(exports, "getSchedulerContractDefinition", { enumerable: true, get: function () { return scheduler_contract_1.getSchedulerContractDefinition; } });
+Object.defineProperty(exports, "SCHEDULER_CONTRACT_VERSION", { enumerable: true, get: function () { return scheduler_contract_1.SCHEDULER_CONTRACT_VERSION; } });
+Object.defineProperty(exports, "SCHEDULER_MAX_DELAY_MS", { enumerable: true, get: function () { return scheduler_contract_1.SCHEDULER_MAX_DELAY_MS; } });
+Object.defineProperty(exports, "schedulerProviderPackageId", { enumerable: true, get: function () { return scheduler_contract_1.schedulerProviderPackageId; } });
 var tool_access_control_contract_1 = require("./system/tool-access-control-contract");
 Object.defineProperty(exports, "getToolAccessControlContractDefinition", { enumerable: true, get: function () { return tool_access_control_contract_1.getToolAccessControlContractDefinition; } });
 Object.defineProperty(exports, "TOOL_ACCESS_CONTROL_CONTRACT_VERSION", { enumerable: true, get: function () { return tool_access_control_contract_1.TOOL_ACCESS_CONTROL_CONTRACT_VERSION; } });

package/dist/contracts/system/contract-catalog-contract.d.ts

@@ -0,0 +1,38 @@
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the built-in System Contract Catalog. */
+export declare const CONTRACT_CATALOG_VERSION = 1;
+/** Package id of the System Contract Catalog provider. */
+export declare const contractCatalogProviderPackageId = "000peers0system0000000001";
+/** One registered provider of a contract version. */
+export interface IContractProviderInfo {
+    packageId: string;
+    /** Display name from the Packages row, or the package id for the system provider. */
+    name: string;
+    /** True when this package is the active provider for the contract version. */
+    active: boolean;
+}
+/** Input for listing providers of one contract version. */
+export interface IListContractProvidersInput {
+    contractId: string;
+    version: number;
+}
+/**
+ * Consumer shape for the System Contract Catalog.
+ *
+ * Hub packages use this to discover every provider of a shared contract.
+ */
+export interface IContractCatalogConsumer extends IContractConsumerBase {
+    tools: {
+        listContractProviders(input: IListContractProvidersInput): Promise<{
+            providers: IContractProviderInfo[];
+        }>;
+    };
+}
+/**
+ * Return the local-only catalog contract that lists providers of another contract.
+ *
+ * The active provider remains the default for ordinary calls. This tool exists so a
+ * consumer can address every registered provider, not only the active one.
+ */
+export declare function getContractCatalogDefinition(): IContractDefinition;

package/dist/contracts/system/contract-catalog-contract.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.contractCatalogProviderPackageId = exports.CONTRACT_CATALOG_VERSION = void 0;
+exports.getContractCatalogDefinition = getContractCatalogDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the built-in System Contract Catalog. */
+exports.CONTRACT_CATALOG_VERSION = 1;
+/** Package id of the System Contract Catalog provider. */
+exports.contractCatalogProviderPackageId = system_ids_1.peersSystemPackageId;
+const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
+let definition;
+/**
+ * Return the local-only catalog contract that lists providers of another contract.
+ *
+ * The active provider remains the default for ordinary calls. This tool exists so a
+ * consumer can address every registered provider, not only the active one.
+ */
+function getContractCatalogDefinition() {
+    definition ??= {
+        contractId: system_ids_1.contractCatalogContractId,
+        version: exports.CONTRACT_CATALOG_VERSION,
+        devTag: "dev",
+        name: "System Contract Catalog",
+        description: "Lists the packages registered as providers of a contract version.",
+        tables: [],
+        tools: [
+            {
+                name: "listContractProviders",
+                usageDescription: "List every package registered for a contract version, including inactive ones.",
+                inputFields: [
+                    field("contractId", field_type_1.FieldType.id, "Contract to look up."),
+                    field("version", field_type_1.FieldType.number, "Contract version."),
+                ],
+                outputFields: [
+                    field("providers", field_type_1.FieldType.object, "Registered providers in registration order, with packageId, name, and active.", { isArray: true }),
+                ],
+            },
+        ],
+        observables: [],
+        events: [],
+    };
+    return definition;
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: exports.contractCatalogProviderPackageId,
+    contractId: system_ids_1.contractCatalogContractId,
+    version: exports.CONTRACT_CATALOG_VERSION,
+    getDefinition: getContractCatalogDefinition,
+});

package/dist/contracts/system/http-contract.d.ts

@@ -0,0 +1,80 @@
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the built-in System HTTP contract. */
+export declare const HTTP_CONTRACT_VERSION = 1;
+/** Default request deadline when the caller omits `timeoutMs`. */
+export declare const HTTP_DEFAULT_TIMEOUT_MS = 30000;
+/** Longest request deadline System HTTP will honor. */
+export declare const HTTP_MAX_TIMEOUT_MS = 120000;
+/** Largest request or response body, in decoded bytes. */
+export declare const HTTP_MAX_BODY_BYTES: number;
+/** Package id of the System HTTP provider. */
+export declare const httpProviderPackageId = "000peers0system0000000001";
+/** One multipart part. Use `text` for a form field or `bodyBase64` for bytes. */
+export interface IHttpMultipartPart {
+    name: string;
+    filename?: string;
+    contentType?: string;
+    /** UTF-8 form field. Used instead of `bodyBase64` when set. */
+    text?: string;
+    bodyBase64?: string;
+}
+/** Input for {@link IHttpConsumer tools.request}. */
+export interface IHttpRequestInput {
+    requestId: string;
+    method: string;
+    url: string;
+    headers?: Record<string, string>;
+    body?: string;
+    bodyBase64?: string;
+    multipart?: IHttpMultipartPart[];
+    credentialRef?: string;
+    responseType?: "json" | "text" | "base64";
+    timeoutMs?: number;
+}
+/** Result of one System HTTP request. Non-2xx responses are returned, not thrown. */
+export interface IHttpRequestResult {
+    status: number;
+    ok: boolean;
+    contentType: string;
+    body: unknown;
+}
+/** Input for cancelling an in-flight request owned by the calling package. */
+export interface IHttpCancelInput {
+    requestId: string;
+}
+/** One credential declaration safe to show in the admin UI. The secret value is omitted. */
+export interface IHttpCredentialInfo {
+    ref: string;
+    header: string;
+    secretVar: string;
+    scope: "user" | "device";
+}
+/** Network declaration for one package, as shown to the operator. */
+export interface IHttpPolicyInfo {
+    allowedHosts: string[];
+    credentials: IHttpCredentialInfo[];
+}
+/**
+ * Consumer shape for System HTTP.
+ *
+ * Isolated packages call `request` and `cancel`. The Packages screen calls `describePolicy`.
+ */
+export interface IHttpConsumer extends IContractConsumerBase {
+    tools: {
+        request(input: IHttpRequestInput): Promise<IHttpRequestResult>;
+        cancel(input: IHttpCancelInput): Promise<{
+            cancelled: boolean;
+        }>;
+        describePolicy(input: {
+            packageId: string;
+        }): Promise<IHttpPolicyInfo>;
+    };
+}
+/**
+ * Return the local-only System HTTP contract shape.
+ *
+ * The host performs `fetch`. Guests name an allowlisted URL and an optional
+ * credential ref; they never receive the secret or an open network.
+ */
+export declare function getHttpContractDefinition(): IContractDefinition;

package/dist/contracts/system/http-contract.js

@@ -0,0 +1,93 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.httpProviderPackageId = exports.HTTP_MAX_BODY_BYTES = exports.HTTP_MAX_TIMEOUT_MS = exports.HTTP_DEFAULT_TIMEOUT_MS = exports.HTTP_CONTRACT_VERSION = void 0;
+exports.getHttpContractDefinition = getHttpContractDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the built-in System HTTP contract. */
+exports.HTTP_CONTRACT_VERSION = 1;
+/** Default request deadline when the caller omits `timeoutMs`. */
+exports.HTTP_DEFAULT_TIMEOUT_MS = 30_000;
+/** Longest request deadline System HTTP will honor. */
+exports.HTTP_MAX_TIMEOUT_MS = 120_000;
+/** Largest request or response body, in decoded bytes. */
+exports.HTTP_MAX_BODY_BYTES = 8 * 1024 * 1024;
+/** Package id of the System HTTP provider. */
+exports.httpProviderPackageId = system_ids_1.peersSystemPackageId;
+const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
+let definition;
+/**
+ * Return the local-only System HTTP contract shape.
+ *
+ * The host performs `fetch`. Guests name an allowlisted URL and an optional
+ * credential ref; they never receive the secret or an open network.
+ */
+function getHttpContractDefinition() {
+    definition ??= {
+        contractId: system_ids_1.httpContractId,
+        version: exports.HTTP_CONTRACT_VERSION,
+        devTag: "dev",
+        name: "System HTTP",
+        description: "Host-mediated HTTPS for isolated packages. Hosts must be declared on the package, and credentials are injected by reference.",
+        tables: [],
+        tools: [
+            {
+                name: "request",
+                usageDescription: "Perform one HTTPS request to a host this package declared. Non-2xx responses are returned.",
+                inputFields: [
+                    field("requestId", field_type_1.FieldType.string, "Caller-chosen id used to cancel this request."),
+                    field("method", field_type_1.FieldType.string, "HTTP method: GET, POST, PUT, PATCH, DELETE, or HEAD."),
+                    field("url", field_type_1.FieldType.string, "Absolute https URL whose host is on this package's allowlist."),
+                    field("headers", field_type_1.FieldType.object, "Optional request headers. Credential headers are overwritten.", {
+                        optional: true,
+                    }),
+                    field("body", field_type_1.FieldType.string, "UTF-8 request body.", { optional: true }),
+                    field("bodyBase64", field_type_1.FieldType.string, "Base64 request body. Used instead of body when set.", {
+                        optional: true,
+                    }),
+                    field("multipart", field_type_1.FieldType.object, "Multipart parts with name and bodyBase64. Used instead of body when set.", { optional: true, isArray: true }),
+                    field("credentialRef", field_type_1.FieldType.string, "Credential ref from this package's network declaration.", { optional: true }),
+                    field("responseType", field_type_1.FieldType.string, 'How to decode the response: "json", "text", or "base64". Defaults to json.', { optional: true }),
+                    field("timeoutMs", field_type_1.FieldType.number, `Deadline in milliseconds. Defaults to ${exports.HTTP_DEFAULT_TIMEOUT_MS} and is capped at ${exports.HTTP_MAX_TIMEOUT_MS}.`, { optional: true }),
+                ],
+                outputFields: [
+                    field("status", field_type_1.FieldType.number, "HTTP status code."),
+                    field("ok", field_type_1.FieldType.boolean, "True when the status is 2xx."),
+                    field("contentType", field_type_1.FieldType.string, "Response Content-Type, or empty."),
+                    field("body", field_type_1.FieldType.any, "Decoded response body."),
+                ],
+            },
+            {
+                name: "cancel",
+                usageDescription: "Abort one in-flight request started by this package.",
+                inputFields: [field("requestId", field_type_1.FieldType.string, "Id passed to request.")],
+                outputFields: [
+                    field("cancelled", field_type_1.FieldType.boolean, "True when a matching request was aborted."),
+                ],
+            },
+            {
+                name: "describePolicy",
+                usageDescription: "Return the host allowlist and credential refs declared by a package. Secret values are omitted.",
+                inputFields: [
+                    field("packageId", field_type_1.FieldType.id, "Package whose network declaration to read."),
+                ],
+                outputFields: [
+                    field("allowedHosts", field_type_1.FieldType.string, "Hostnames the package may request.", {
+                        isArray: true,
+                    }),
+                    field("credentials", field_type_1.FieldType.object, "Credential refs, headers, and logical secret names. Values are not included.", { isArray: true }),
+                ],
+            },
+        ],
+        observables: [],
+        events: [],
+    };
+    return definition;
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: exports.httpProviderPackageId,
+    contractId: system_ids_1.httpContractId,
+    version: exports.HTTP_CONTRACT_VERSION,
+    getDefinition: getHttpContractDefinition,
+});

package/dist/contracts/system/index.d.ts

@@ -2,11 +2,14 @@
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
+import "./contract-catalog-contract";
 import "./device-operations-contract";
+import "./http-contract";
 import "./identity-contract";
 import "./invites-contract";
 import "./logs-contract";
 import "./network-contracts";
+import "./scheduler-contract";
 import "./tool-access-control-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./device-operations-contract";
 export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentityKeyInfo, type IIdentityRegistryKey, type IIdentityRotateKeyInput, type IIdentityRotateKeyResult, type IIdentitySessionInfo, } from "./identity-contract";

package/dist/contracts/system/index.js

@@ -19,11 +19,14 @@ exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContr
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
+require("./contract-catalog-contract");
 require("./device-operations-contract");
+require("./http-contract");
 require("./identity-contract");
 require("./invites-contract");
 require("./logs-contract");
 require("./network-contracts");
+require("./scheduler-contract");
 require("./tool-access-control-contract");
 var device_operations_contract_1 = require("./device-operations-contract");
 Object.defineProperty(exports, "DEVICE_OPERATIONS_CONTRACT_VERSION", { enumerable: true, get: function () { return device_operations_contract_1.DEVICE_OPERATIONS_CONTRACT_VERSION; } });