@peers-app/peers-sdk 0.26.0 → 0.26.2

package/dist/contracts/__tests__/remote-contract-transport.test.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const system_ids_1 = require("../../system-ids");
 const index_1 = require("../index");
 const makeRequest = (overrides = {}) => ({
     contractId: "contract-a",
@@ -49,11 +50,49 @@ describe("remote contract endpoint", () => {
         await expect(endpoint.handleCall(toolCall, {})).rejects.toThrow("disposed");
         expect(emit).not.toHaveBeenCalled();
     });
+    it("refuses package callers for contracts whose providers refuse packages", async () => {
+        const { transport, emit } = makeTransport();
+        const packageContext = { callerPackageId: "package-a" };
+        expect(() => (0, index_1.createRemoteContractEndpoint)(makeRequest({ contractId: system_ids_1.appUpdatesContractId, context: packageContext }), () => transport)).toThrow("packages cannot call contract");
+        const operator = (0, index_1.createRemoteContractEndpoint)(makeRequest({ contractId: system_ids_1.appUpdatesContractId }), () => transport);
+        await expect(operator.handleCall({ ...toolCall, contractId: system_ids_1.appUpdatesContractId }, {})).resolves.toBe("pong");
+        const packageTool = (0, index_1.createRemoteContractEndpoint)(makeRequest({ context: packageContext }), () => transport);
+        await expect(packageTool.handleCall(toolCall, packageContext)).resolves.toBe("pong");
+        expect(emit).toHaveBeenCalledTimes(2);
+    });
     it("fails clearly when no transport factory is registered or the route is incomplete", () => {
         expect(() => (0, index_1.createRemoteContractEndpoint)(makeRequest())).toThrow("no remote contract transport is registered");
         expect(() => (0, index_1.createRemoteContractEndpoint)(makeRequest({ dataContextId: undefined }), () => makeTransport().transport)).toThrow("data context");
         expect(() => (0, index_1.createRemoteContractEndpoint)(makeRequest({ targetDeviceId: undefined }), () => makeTransport().transport)).toThrow("target device");
     });
+    it("refuses package runTool forwarding that could invoke App Updates indirectly", async () => {
+        const { transport, emit } = makeTransport();
+        const packageContext = { callerPackageId: "package-a" };
+        const endpoint = (0, index_1.createRemoteContractEndpoint)(makeRequest({ contractId: system_ids_1.deviceOperationsContractId, context: packageContext }), () => transport);
+        for (const toolName of ["checkForUpdates", "installUpdateAndRestart"]) {
+            const call = {
+                ...toolCall,
+                contractId: system_ids_1.deviceOperationsContractId,
+                name: "runTool",
+                args: [
+                    {
+                        toolIdOrName: (0, index_1.deriveToolCatalogId)({
+                            contractId: system_ids_1.appUpdatesContractId,
+                            version: index_1.APP_UPDATES_CONTRACT_VERSION,
+                            toolName,
+                        }),
+                    },
+                ],
+            };
+            await expect(endpoint.handleCall(call, packageContext)).rejects.toThrow("packages cannot call Device Operations runTool");
+        }
+        expect(emit).not.toHaveBeenCalled();
+        // Read-only tools on the same cached package endpoint still work.
+        await expect(endpoint.handleCall({ ...toolCall, contractId: system_ids_1.deviceOperationsContractId, name: "getDeviceStatus" }, packageContext)).resolves.toBe("pong");
+        const operator = (0, index_1.createRemoteContractEndpoint)(makeRequest({ contractId: system_ids_1.deviceOperationsContractId }), () => transport);
+        await expect(operator.handleCall({ ...toolCall, contractId: system_ids_1.deviceOperationsContractId, name: "runTool" }, {})).resolves.toBe("pong");
+        expect(emit).toHaveBeenCalledTimes(2);
+    });
 });
 describe("resolveRemoteTargetEndpoint", () => {
     it("returns undefined for local routes and for the local device itself", () => {

package/dist/contracts/__tests__/system-contracts.test.js

@@ -15,6 +15,7 @@ describe("system contract catalog", () => {
             .map((entry) => entry.contractId)
             .filter(Boolean);
         expect(ids).toEqual(expect.arrayContaining([
+            system_ids_1.appUpdatesContractId,
             system_ids_1.logsContractId,
             system_ids_1.deviceOperationsContractId,
             system_ids_1.identityContractId,

package/dist/contracts/__tests__/tool-catalog.test.js

@@ -7,6 +7,7 @@ const field_type_1 = require("../../types/field-type");
 const zod_types_1 = require("../../types/zod-types");
 const utils_1 = require("../../utils");
 const registry_1 = require("../registry");
+const tool_catalog_contract_1 = require("../system/tool-catalog-contract");
 const systemContracts = require("../system-contracts");
 const tool_catalog_1 = require("../tool-catalog");
 const tool_catalog_identity_1 = require("../tool-catalog-identity");
@@ -570,6 +571,280 @@ test("untargeted deterministic IDs and quarantined rows cannot be claimed by a p
     expect(() => (0, tool_catalog_1.validateToolCatalogWrite)({ ...row, catalogState: "quarantined" }, { ...row, catalogState: "resolved" })).toThrow(/Quarantined/);
     await f.catalog.dispose();
 });
+describe("bare deterministic row repair", () => {
+    const target = { contractId, version: 1, toolName: "read" };
+    const toolId = (0, tool_catalog_identity_1.deriveToolCatalogId)(target);
+    const bare = {
+        toolId,
+        name: "read",
+        usageDescription: "stale",
+        code: "",
+        inputSchema: { type: tools_1.IOSchemaType.none, fields: [] },
+        outputSchema: { type: tools_1.IOSchemaType.none, fields: [] },
+        catalogState: "quarantined",
+        catalogReason: `Error: Missing tool catalog target: ${toolId}`,
+    };
+    const restored = {
+        ...bare,
+        contractId,
+        contractVersion: 1,
+        toolName: "read",
+        catalogIdentity: "deterministic",
+        catalogState: "resolved",
+        catalogReason: undefined,
+    };
+    test.each([undefined, "deterministic"].flatMap((catalogIdentity) => [undefined, "unresolved", "quarantined"].map((catalogState) => ({
+        catalogIdentity,
+        catalogState,
+    }))))("publication restores identity=$catalogIdentity state=$catalogState and preserves current policy", async (state) => {
+        const old = {
+            ...bare,
+            ...state,
+            packageId: (0, utils_1.newid)(),
+            codeRepository: "historical repository",
+            accessLevel: 70,
+            remoteAccessLevel: 60,
+            authorityPropagation: "cap",
+            isAssistantRunner: true,
+            detailedDescription: "saved details",
+            configSchema: { type: tools_1.IOSchemaType.none, fields: [] },
+        };
+        expect(() => (0, tool_catalog_1.validateToolCatalogWrite)(old, restored, toolId, true)).not.toThrow();
+        const f = fixture(new Map([[toolId, old]]));
+        const update = required(f.table.update.getMockImplementation());
+        f.table.update.mockImplementation(async (patch) => {
+            if (patch.toolId === toolId && patch.catalogState === "resolved") {
+                expect((0, tools_1.isToolCatalogPatch)(patch)).toBe(true);
+                expect(patch).toEqual({
+                    toolId,
+                    contractId,
+                    contractVersion: 1,
+                    toolName: "read",
+                    catalogIdentity: "deterministic",
+                    catalogState: "resolved",
+                    catalogReason: undefined,
+                });
+                f.rows.set(toolId, {
+                    ...required(f.rows.get(toolId)),
+                    accessLevel: 90,
+                    remoteAccessLevel: 80,
+                    authorityPropagation: "preserve",
+                });
+            }
+            return update(patch);
+        });
+        try {
+            await f.publish();
+            expect(f.rows.get(toolId)).toEqual({
+                ...old,
+                ...restored,
+                accessLevel: 90,
+                remoteAccessLevel: 80,
+                authorityPropagation: "preserve",
+            });
+            expect(f.registry.resolve(contractId, 1)?.name).toBe("Test");
+        }
+        finally {
+            await f.catalog.dispose();
+        }
+    });
+    test.each([
+        ["executable source", { code: "existing" }],
+        ["whitespace source", { code: " " }],
+        ["missing source", { code: undefined }],
+        ["another identity", { catalogIdentity: "legacy-alias" }],
+        ["invalid empty identity", { catalogIdentity: "" }],
+        ["different name", { name: "write" }],
+        ["different name case", { name: "Read" }],
+        ["matching stored target", { contractId, contractVersion: 1, toolName: "read" }],
+        ["conflicting stored target", { contractId, contractVersion: 1, toolName: "write" }],
+        ["partial contract ID", { contractId }],
+        ["partial version", { contractVersion: 1 }],
+        ["partial member name", { toolName: "read" }],
+    ])("rejects %s even for an explicit catalog patch", (_name, fields) => {
+        expect(() => (0, tool_catalog_1.validateToolCatalogWrite)({ ...bare, ...fields }, restored, toolId, true)).toThrow(/Quarantined/);
+        // Exercise the cannot-be-claimed branch without a quarantine early-out too.
+        // A matching established target is already a valid mapping in this case.
+        if (_name !== "matching stored target")
+            expect(() => (0, tool_catalog_1.validateToolCatalogWrite)({ ...bare, ...fields, catalogState: undefined }, restored, toolId, true)).toThrow();
+    });
+    test.each([
+        ["missing target", { contractId: undefined, contractVersion: undefined, toolName: undefined }],
+        ["partial target", { contractVersion: undefined }],
+        ["invalid target", { contractVersion: 0 }],
+        ["nonmatching deterministic ID", { contractVersion: 2 }],
+        ["different member", { toolName: "write" }],
+        // A repair must resolve in the same write; it cannot retarget quarantine evidence.
+        ["quarantined state", { catalogState: "quarantined" }],
+        ["unset state", { catalogState: undefined }],
+        ["unset identity kind", { catalogIdentity: undefined }],
+    ])("rejects a candidate with %s", (_name, fields) => {
+        expect(() => (0, tool_catalog_1.validateToolCatalogWrite)(bare, { ...restored, ...fields }, toolId, true)).toThrow();
+    });
+    test("ordinary saves and replay cannot clear quarantine, even with the canonical target", () => {
+        for (const candidate of [
+            restored,
+            { ...bare, catalogState: "resolved" },
+            { ...bare, catalogState: undefined, usageDescription: "metadata" },
+        ])
+            expect(() => (0, tool_catalog_1.validateToolCatalogWrite)(bare, candidate)).toThrow(/Quarantined/);
+        const metadata = (0, tool_catalog_1.retainToolCatalogFields)(bare, {
+            ...legacy(toolId),
+            code: "",
+            name: "read",
+            usageDescription: "older peer metadata",
+        });
+        expect(() => (0, tool_catalog_1.validateToolCatalogWrite)(bare, metadata)).not.toThrow();
+        expect(metadata.catalogState).toBe("quarantined");
+    });
+    test("repair requires exactly one selected ID even when the first ID matches", async () => {
+        const ids = jest
+            .spyOn(await Promise.resolve().then(() => require("../tool-catalog-migrations")), "toolCatalogIds")
+            .mockReturnValue([toolId, (0, utils_1.newid)()]);
+        try {
+            expect(() => (0, tool_catalog_1.validateToolCatalogWrite)(bare, restored, toolId, true)).toThrow(/Quarantined/);
+        }
+        finally {
+            ids.mockRestore();
+        }
+    });
+    test.each([
+        { contractId, version: 1, toolName: "new-task" },
+        { contractId: "00muxgugn6xvs8f2r80ru205t", version: 1, toolName: "invoke" },
+    ])("aliases suppress deterministic repair for $toolName", async (aliasedTarget) => {
+        const deterministicId = (0, tool_catalog_identity_1.deriveToolCatalogId)(aliasedTarget);
+        const aliases = (0, tool_catalog_migrations_1.toolCatalogIds)(aliasedTarget);
+        const old = { ...bare, toolId: deterministicId, name: aliasedTarget.toolName };
+        const candidate = {
+            ...restored,
+            toolId: deterministicId,
+            contractId: aliasedTarget.contractId,
+            toolName: aliasedTarget.toolName,
+        };
+        expect(() => (0, tool_catalog_1.validateToolCatalogWrite)(old, candidate, deterministicId, true)).toThrow();
+        for (const alias of aliases)
+            expect(() => (0, tool_catalog_1.validateToolCatalogWrite)({ ...old, toolId: alias }, { ...candidate, toolId: alias, catalogIdentity: "legacy-alias" }, alias, true)).toThrow(/Quarantined/);
+        const f = fixture(new Map([[deterministicId, old]]));
+        try {
+            await f.publish({
+                ...definition([aliasedTarget.toolName]),
+                contractId: aliasedTarget.contractId,
+            });
+            expect(f.rows.get(deterministicId)).toEqual(old);
+            for (const alias of aliases)
+                expect(f.rows.get(alias)?.catalogIdentity).toBe("legacy-alias");
+            expect(f.table.save.mock.calls.some(([row]) => row.toolId === deterministicId)).toBe(false);
+        }
+        finally {
+            await f.catalog.dispose();
+        }
+    });
+    test.each([
+        "collision",
+        "quarantine",
+    ])("a later %s prevents all repair writes in the batch", async (failure) => {
+        const f = fixture();
+        await f.catalog.ready();
+        const hash = failure === "collision"
+            ? jest.spyOn(nacl, "hash").mockReturnValue(new Uint8Array(64))
+            : undefined;
+        const firstId = (0, tool_catalog_identity_1.deriveToolCatalogId)(target);
+        const old = { ...bare, toolId: firstId };
+        f.rows.set(firstId, old);
+        if (failure === "quarantine") {
+            const secondId = (0, tool_catalog_identity_1.deriveToolCatalogId)({ ...target, toolName: "write" });
+            f.rows.set(secondId, {
+                ...restored,
+                toolId: secondId,
+                toolName: "write",
+                catalogState: "quarantined",
+            });
+        }
+        f.table.update.mockClear();
+        f.table.save.mockClear();
+        try {
+            await expect(f.publish(definition(["read", "write"]))).rejects.toThrow(/collision|Quarantined/);
+            expect(f.rows.get(firstId)).toEqual(old);
+            expect(f.table.update).not.toHaveBeenCalled();
+            expect(f.table.save).not.toHaveBeenCalled();
+            expect(f.registry.resolve(contractId, 1)).toBeUndefined();
+        }
+        finally {
+            hash?.mockRestore();
+            await f.catalog.dispose();
+        }
+    });
+});
+test.each([
+    false,
+    true,
+])("system readiness restores the startup listTools row (quarantined=%s)", async (quarantined) => {
+    const definition = (0, tool_catalog_contract_1.getToolCatalogContractDefinition)();
+    const toolId = (0, tool_catalog_identity_1.deriveToolCatalogId)({
+        contractId: definition.contractId,
+        version: definition.version,
+        toolName: "listTools",
+    });
+    expect(toolId).toBe("000tool0ggg5rilyp6kbxevip");
+    const bare = {
+        ...legacy(toolId),
+        name: "listTools",
+        code: "",
+        catalogState: quarantined ? "quarantined" : undefined,
+        catalogReason: quarantined ? `Error: Missing tool catalog target: ${toolId}` : undefined,
+    };
+    const f = fixture(new Map([[toolId, bare]]));
+    try {
+        await f.catalog.ready();
+        expect(f.rows.get(toolId)).toMatchObject({
+            contractId: definition.contractId,
+            contractVersion: definition.version,
+            toolName: "listTools",
+            catalogIdentity: "deterministic",
+            catalogState: "resolved",
+            code: "",
+            accessLevel: 70,
+        });
+        expect(f.rows.get(toolId)?.catalogReason).toBeUndefined();
+        expect(f.registry.getProviderPackageId(definition.contractId, definition.version)).toBeDefined();
+        const writes = f.table.update.mock.calls.length;
+        await f.catalog.ready();
+        expect(f.table.update).toHaveBeenCalledTimes(writes);
+    }
+    finally {
+        await f.catalog.dispose();
+    }
+});
+test.each([
+    ["executable source", { code: "existing" }],
+    ["a different name", { name: "list-tools" }],
+    ["another identity", { catalogIdentity: "legacy-alias" }],
+])("system readiness still aborts on a real listTools quarantine with %s", async (_name, fields) => {
+    const definition = (0, tool_catalog_contract_1.getToolCatalogContractDefinition)();
+    const toolId = (0, tool_catalog_identity_1.deriveToolCatalogId)({
+        contractId: definition.contractId,
+        version: definition.version,
+        toolName: "listTools",
+    });
+    const quarantined = {
+        ...legacy(toolId),
+        name: "listTools",
+        code: "",
+        ...fields,
+        catalogState: "quarantined",
+        catalogReason: `Error: Missing tool catalog target: ${toolId}`,
+    };
+    const f = fixture(new Map([[toolId, quarantined]]));
+    const publish = jest.spyOn(f.registry, "replaceBatch");
+    try {
+        await expect(f.catalog.ready()).rejects.toThrow(`Quarantined tool identity: ${toolId}`);
+        expect(f.rows.get(toolId)).toEqual(quarantined);
+        expect(publish).not.toHaveBeenCalled();
+    }
+    finally {
+        await f.catalog.dispose();
+    }
+});
 test("host removal waits for publication and disposal cancels queued activation", async () => {
     const f = fixture();
     const provider = (0, utils_1.newid)();

package/dist/contracts/index.d.ts

@@ -13,6 +13,7 @@ export { getHostContractTransport, type HostContractTransportListener, registerH
 export { PersistentContractRegistry } from "./persistent-registry";
 export { ContractRegistry, type IContractProviderRegistration } from "./registry";
 export { createRemoteContractEndpoint, getRemoteContractTransportFactory, type IRemoteContractHost, type IRemoteContractTarget, type RemoteContractTransportFactory, resolveRemoteTargetEndpoint, setRemoteContractTransportFactory, } from "./remote-contract-transport";
+export * from "./system/app-updates-contract";
 export { CONTRACT_CATALOG_VERSION, contractCatalogProviderPackageId, getContractCatalogDefinition, type IContractCatalogConsumer, type IContractProviderInfo, type IListContractProvidersInput, } from "./system/contract-catalog-contract";
 export * from "./system/desktop-tools-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./system/device-operations-contract";

package/dist/contracts/index.js

@@ -83,6 +83,7 @@ Object.defineProperty(exports, "createRemoteContractEndpoint", { enumerable: tru
 Object.defineProperty(exports, "getRemoteContractTransportFactory", { enumerable: true, get: function () { return remote_contract_transport_1.getRemoteContractTransportFactory; } });
 Object.defineProperty(exports, "resolveRemoteTargetEndpoint", { enumerable: true, get: function () { return remote_contract_transport_1.resolveRemoteTargetEndpoint; } });
 Object.defineProperty(exports, "setRemoteContractTransportFactory", { enumerable: true, get: function () { return remote_contract_transport_1.setRemoteContractTransportFactory; } });
+__exportStar(require("./system/app-updates-contract"), exports);
 var contract_catalog_contract_1 = require("./system/contract-catalog-contract");
 Object.defineProperty(exports, "CONTRACT_CATALOG_VERSION", { enumerable: true, get: function () { return contract_catalog_contract_1.CONTRACT_CATALOG_VERSION; } });
 Object.defineProperty(exports, "contractCatalogProviderPackageId", { enumerable: true, get: function () { return contract_catalog_contract_1.contractCatalogProviderPackageId; } });

package/dist/contracts/remote-contract-transport.d.ts

@@ -60,10 +60,13 @@ export declare function resolveRemoteTargetEndpoint(request: IContractProviderEn
  * *local* caller for the route. It strips {@link IContractCall.targetDeviceId} before
  * emitting so the receiving device sees an ordinary call addressed to itself and the
  * message is signed with this device's own identity. Only tool runs are forwarded; the
- * router rejects other members before reaching this endpoint.
+ * router rejects other members before reaching this endpoint. Package callers cannot
+ * reach contracts whose providers refuse packages, such as System App Updates, or the
+ * Device Operations `runTool` wrapper that could invoke them indirectly.
  *
  * @param request Authorized route whose `targetDeviceId` and `dataContextId` are set.
  * @param factory Transport factory; defaults to the process-wide registration.
- * @throws If no factory is available or the route lacks a target device or data context.
+ * @throws If no factory is available, the route lacks a target device or data context, or
+ *   a package targets a contract that refuses package callers.
  */
 export declare function createRemoteContractEndpoint(request: IContractProviderEndpointRequest, factory?: RemoteContractTransportFactory | undefined): IContractProviderEndpoint;

package/dist/contracts/remote-contract-transport.js

@@ -4,7 +4,14 @@ exports.setRemoteContractTransportFactory = setRemoteContractTransportFactory;
 exports.getRemoteContractTransportFactory = getRemoteContractTransportFactory;
 exports.resolveRemoteTargetEndpoint = resolveRemoteTargetEndpoint;
 exports.createRemoteContractEndpoint = createRemoteContractEndpoint;
+const system_ids_1 = require("../system-ids");
 const contract_transport_1 = require("./contract-transport");
+/**
+ * Contracts whose providers refuse package callers. A forwarded call reaches the target
+ * signed by this device alone, so the target cannot tell that a package made it; the
+ * forwarding host refuses instead.
+ */
+const packageRefusedRemoteContractIds = new Set([system_ids_1.appUpdatesContractId]);
 const factoriesByUserContext = new WeakMap();
 let defaultFactory;
 /**
@@ -58,17 +65,23 @@ function resolveRemoteTargetEndpoint(request, host) {
  * *local* caller for the route. It strips {@link IContractCall.targetDeviceId} before
  * emitting so the receiving device sees an ordinary call addressed to itself and the
  * message is signed with this device's own identity. Only tool runs are forwarded; the
- * router rejects other members before reaching this endpoint.
+ * router rejects other members before reaching this endpoint. Package callers cannot
+ * reach contracts whose providers refuse packages, such as System App Updates, or the
+ * Device Operations `runTool` wrapper that could invoke them indirectly.
  *
  * @param request Authorized route whose `targetDeviceId` and `dataContextId` are set.
  * @param factory Transport factory; defaults to the process-wide registration.
- * @throws If no factory is available or the route lacks a target device or data context.
+ * @throws If no factory is available, the route lacks a target device or data context, or
+ *   a package targets a contract that refuses package callers.
  */
 function createRemoteContractEndpoint(request, factory = getRemoteContractTransportFactory()) {
     const { targetDeviceId, dataContextId } = request;
     if (!targetDeviceId) {
         throw new Error("Remote contract endpoint requires a target device id");
     }
+    if (request.context?.callerPackageId && packageRefusedRemoteContractIds.has(request.contractId)) {
+        throw new Error(`Permission denied: packages cannot call contract ${request.contractId} on another device`);
+    }
     if (!dataContextId) {
         throw new Error("Remote contract endpoint requires an authorized data context id");
     }
@@ -85,6 +98,13 @@ function createRemoteContractEndpoint(request, factory = getRemoteContractTransp
             if (call.member !== "tool" || call.operation !== "run") {
                 return Promise.reject(new Error(`Contract ${call.member} '${call.name}'.${call.operation} cannot be forwarded to a remote device`));
             }
+            // runTool refuses packages locally, but the target cannot recover their identity
+            // after forwarding. Without this gate it could invoke App Updates on their behalf.
+            if (request.context.callerPackageId &&
+                request.contractId === system_ids_1.deviceOperationsContractId &&
+                call.name === "runTool") {
+                return Promise.reject(new Error("Permission denied: packages cannot call Device Operations runTool on another device"));
+            }
             const { targetDeviceId: _stripped, ...outbound } = call;
             return transport.emit(contract_transport_1.CONTRACT_REQUEST_CHANNEL, { ...outbound, dataContextId });
         },

package/dist/contracts/system/app-updates-contract.d.ts

@@ -0,0 +1,109 @@
+import type { Observable } from "../../observable";
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the built-in System App Updates contract. */
+export declare const APP_UPDATES_CONTRACT_VERSION = 1;
+/**
+ * Lifecycle of the host application's update check, download, and install.
+ *
+ * - `idle` — no check has completed since launch.
+ * - `checking` — the update feed is being read.
+ * - `up-to-date` — the feed has nothing newer than the running version.
+ * - `available` — a newer version exists and its download has not finished.
+ * - `downloading` — the newer version is downloading (see {@link IAppUpdateStatus.downloadPercent}).
+ * - `downloaded` — the newer version is ready to install.
+ * - `installing` — the app is shutting down to run the installer and relaunch.
+ * - `restarting` — the app is restarting without installing anything.
+ * - `error` — the last check, download, or install failed (see {@link IAppUpdateStatus.error}).
+ */
+export type AppUpdateState = "idle" | "checking" | "up-to-date" | "available" | "downloading" | "downloaded" | "installing" | "restarting" | "error";
+/** Snapshot of the host application's update state, as reported by the device that runs it. */
+export interface IAppUpdateStatus {
+    /** False when the host cannot update itself (for example an unpackaged development build). */
+    supported: boolean;
+    /** True when the host can restart itself on request (desktop apps, even unpackaged ones). */
+    canRestart: boolean;
+    /** Host operating system as reported by Node (`darwin`, `win32`, `linux`). */
+    platform: string;
+    /** Version of the running application. */
+    currentVersion: string;
+    /** Newest version the update feed reported, when a check has succeeded. */
+    latestVersion?: string;
+    /** Version whose installer has finished downloading in this session. */
+    downloadedVersion?: string;
+    /** Current lifecycle state. */
+    state: AppUpdateState;
+    /** Download progress from 0 to 100 while {@link state} is `downloading`. */
+    downloadPercent?: number;
+    /** Message from the last failed check, download, or install. */
+    error?: string;
+    /** Epoch milliseconds of the last completed feed check. */
+    lastCheckedAt?: number;
+    /** This device's "install updates when Peers restarts" setting. */
+    installOnRestart: boolean;
+    /**
+     * True when a downloaded update will install the next time the app quits. Usually mirrors
+     * {@link installOnRestart}; the quit itself re-reads the stored setting. On macOS it is also
+     * true once the system installer has accepted the update for an Update & restart that timed
+     * out, which cannot be undone.
+     */
+    installOnQuitArmed: boolean;
+    /** This device's "allow my other devices to update and restart this device" setting. */
+    remoteRestartAllowed: boolean;
+    /** True when installing prompts for an administrator password on this device (Linux `.deb`). */
+    installNeedsElevation?: boolean;
+}
+/**
+ * What `installUpdateAndRestart` started. The call returns as soon as the work is underway;
+ * read {@link IAppUpdateStatus} to follow it.
+ *
+ * - `installing` — a downloaded update is installing; the app will relaunch on the new version.
+ * - `downloading` — the update is still downloading; it installs and relaunches when done.
+ * - `checking` — no update was known; the device checks first, then installs or simply restarts.
+ * - `restarting` — the app is restarting without an update.
+ */
+export type AppUpdateInstallAction = "installing" | "downloading" | "checking" | "restarting";
+/** Result of `installUpdateAndRestart`. */
+export interface IAppUpdateInstallResult {
+    /** What the device started. */
+    action: AppUpdateInstallAction;
+    /** Status at the moment the work started. */
+    status: IAppUpdateStatus;
+}
+/** Input naming the device a relayed App Updates call targets. */
+export interface IAppUpdatesDeviceInput {
+    /** Another device of this user, or of a user who trusts this user as `Self`. */
+    deviceId: string;
+}
+/** Typed consumer proxy for System App Updates v1. */
+export interface IAppUpdatesConsumer extends IContractConsumerBase {
+    tools: {
+        /** Return this device's current update status. */
+        getUpdateStatus(): Promise<IAppUpdateStatus>;
+        /** Read the update feed now and return the resulting status. */
+        checkForUpdates(): Promise<IAppUpdateStatus>;
+        /** Install an available update and relaunch, or restart when there is nothing to install. */
+        installUpdateAndRestart(): Promise<IAppUpdateInstallResult>;
+        /** Relay `getUpdateStatus` to another device. Local callers only. */
+        getDeviceUpdateStatus(input: IAppUpdatesDeviceInput): Promise<IAppUpdateStatus>;
+        /** Relay `installUpdateAndRestart` to another device. Local callers only. */
+        installUpdateAndRestartOnDevice(input: IAppUpdatesDeviceInput): Promise<IAppUpdateInstallResult>;
+    };
+    observables: {
+        /** Live update status; available over the local host transport only. */
+        status: Observable<IAppUpdateStatus>;
+    };
+}
+/**
+ * Return the System App Updates contract shape.
+ *
+ * Tools carry no `remoteAccessLevel`, so only callers this device trusts as `Self` (the
+ * user's own devices and users explicitly granted Self) can reach them remotely. The
+ * provider additionally honours the device's own remote-restart switch.
+ *
+ * The `*Device*` tools let a local UI or CLI reach another device: the host calls the target
+ * over a direct connection (or, for the user's own devices, the mesh) and the target applies
+ * its own trust check and switch. They refuse remote callers, so a device never relays.
+ * Observables cross the local host transport only.
+ */
+export declare function getAppUpdatesContractDefinition(): IContractDefinition;

package/dist/contracts/system/app-updates-contract.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_UPDATES_CONTRACT_VERSION = void 0;
+exports.getAppUpdatesContractDefinition = getAppUpdatesContractDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the built-in System App Updates contract. */
+exports.APP_UPDATES_CONTRACT_VERSION = 1;
+const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
+const statusFields = [
+    field("supported", field_type_1.FieldType.boolean, "Whether this host can update itself."),
+    field("canRestart", field_type_1.FieldType.boolean, "Whether this host can restart itself on request."),
+    field("platform", field_type_1.FieldType.string, "Host operating system."),
+    field("currentVersion", field_type_1.FieldType.string, "Version of the running application."),
+    field("latestVersion", field_type_1.FieldType.string, "Newest version the update feed reported.", {
+        optional: true,
+    }),
+    field("downloadedVersion", field_type_1.FieldType.string, "Version ready to install.", { optional: true }),
+    field("state", field_type_1.FieldType.string, "Update lifecycle state."),
+    field("downloadPercent", field_type_1.FieldType.number, "Download progress from 0 to 100.", {
+        optional: true,
+    }),
+    field("error", field_type_1.FieldType.string, "Last update failure message.", { optional: true }),
+    field("lastCheckedAt", field_type_1.FieldType.number, "Epoch ms of the last completed check.", {
+        optional: true,
+    }),
+    field("installOnRestart", field_type_1.FieldType.boolean, "Install updates when the app restarts."),
+    field("installOnQuitArmed", field_type_1.FieldType.boolean, "A downloaded update will install on quit."),
+    field("remoteRestartAllowed", field_type_1.FieldType.boolean, "Whether trusted devices may update and restart this device."),
+    field("installNeedsElevation", field_type_1.FieldType.boolean, "Installing prompts for a password.", {
+        optional: true,
+    }),
+];
+let definition;
+const installResultFields = [
+    field("action", field_type_1.FieldType.string, "installing, downloading, checking, or restarting."),
+    field("status", field_type_1.FieldType.object, "Update status when the work started."),
+];
+const deviceIdField = field("deviceId", field_type_1.FieldType.id, "Device to call: another of this user's devices, or one whose owner trusts this user as Self.");
+/**
+ * Return the System App Updates contract shape.
+ *
+ * Tools carry no `remoteAccessLevel`, so only callers this device trusts as `Self` (the
+ * user's own devices and users explicitly granted Self) can reach them remotely. The
+ * provider additionally honours the device's own remote-restart switch.
+ *
+ * The `*Device*` tools let a local UI or CLI reach another device: the host calls the target
+ * over a direct connection (or, for the user's own devices, the mesh) and the target applies
+ * its own trust check and switch. They refuse remote callers, so a device never relays.
+ * Observables cross the local host transport only.
+ */
+function getAppUpdatesContractDefinition() {
+    definition ??= {
+        contractId: system_ids_1.appUpdatesContractId,
+        version: exports.APP_UPDATES_CONTRACT_VERSION,
+        devTag: "dev",
+        name: "System App Updates",
+        description: "Desktop application update status, on-demand checks, and update-and-restart.",
+        tables: [],
+        tools: [
+            {
+                name: "getUpdateStatus",
+                usageDescription: "Return this device's application version and update status.",
+                inputFields: [],
+                outputFields: statusFields,
+            },
+            {
+                name: "checkForUpdates",
+                usageDescription: "Check the update feed now and return the resulting update status.",
+                inputFields: [],
+                outputFields: statusFields,
+            },
+            {
+                name: "installUpdateAndRestart",
+                usageDescription: "Install an available update and relaunch, or restart the app when there is nothing to install.",
+                inputFields: [],
+                outputFields: installResultFields,
+            },
+            {
+                name: "getDeviceUpdateStatus",
+                usageDescription: "Return another device's application version and update status.",
+                inputFields: [deviceIdField],
+                outputFields: statusFields,
+            },
+            {
+                name: "installUpdateAndRestartOnDevice",
+                usageDescription: "Ask another device to install its available update and relaunch, or restart when it has nothing to install.",
+                inputFields: [deviceIdField],
+                outputFields: installResultFields,
+            },
+        ],
+        observables: [
+            {
+                name: "status",
+                description: "Live application update status.",
+                valueType: field_type_1.FieldType.object,
+                writable: false,
+            },
+        ],
+        events: [],
+    };
+    return definition;
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: system_ids_1.peersSystemPackageId,
+    contractId: system_ids_1.appUpdatesContractId,
+    version: exports.APP_UPDATES_CONTRACT_VERSION,
+    getDefinition: getAppUpdatesContractDefinition,
+});

package/dist/contracts/system/index.d.ts

@@ -2,6 +2,7 @@
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
+import "./app-updates-contract";
 import "./contract-catalog-contract";
 import "./device-operations-contract";
 import "./http-contract";
@@ -11,6 +12,7 @@ import "./logs-contract";
 import "./network-contracts";
 import "./scheduler-contract";
 import "./tool-access-control-contract";
+export * from "./app-updates-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./device-operations-contract";
 export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentityKeyInfo, type IIdentityRegistryKey, type IIdentityRotateKeyInput, type IIdentityRotateKeyResult, type IIdentitySessionInfo, } from "./identity-contract";
 export { getInvitesContractDefinition, type IAcceptInviteResult, type ICreatedInvite, type IInvitePreview, type IInvitesConsumer, INVITES_CONTRACT_VERSION, } from "./invites-contract";

package/dist/contracts/system/index.js

@@ -19,6 +19,7 @@ exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContr
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
+require("./app-updates-contract");
 require("./contract-catalog-contract");
 require("./device-operations-contract");
 require("./http-contract");
@@ -28,6 +29,7 @@ require("./logs-contract");
 require("./network-contracts");
 require("./scheduler-contract");
 require("./tool-access-control-contract");
+__exportStar(require("./app-updates-contract"), exports);
 var device_operations_contract_1 = require("./device-operations-contract");
 Object.defineProperty(exports, "DEVICE_OPERATIONS_CONTRACT_VERSION", { enumerable: true, get: function () { return device_operations_contract_1.DEVICE_OPERATIONS_CONTRACT_VERSION; } });
 Object.defineProperty(exports, "DEVICE_OPERATIONS_MAX_QUERY_LENGTH", { enumerable: true, get: function () { return device_operations_contract_1.DEVICE_OPERATIONS_MAX_QUERY_LENGTH; } });

package/dist/contracts/tool-catalog.d.ts

@@ -26,9 +26,14 @@ export declare function retainToolCatalogFields<T extends Partial<ITool>>(existi
  *
  * Catalog identities are permanent. Unresolved legacy rows are a holdover until their
  * tools move to contracts: they stay ordinary rows that local writers and older
- * runtimes may delete.
+ * runtimes may delete. A bare deterministic row with an empty executable and the
+ * member's own name may receive that member's canonical target; every other
+ * untargeted or quarantined identity stays rejected.
+ *
+ * @param catalogPatch - Only explicit local catalog patches may restore a bare
+ * deterministic row. Ordinary replacements and sync replay must leave it quarantined.
  */
-export declare function validateToolCatalogWrite(existing: Partial<ITool> | undefined, candidate: Partial<ITool> | undefined, recordId?: string | undefined): void;
+export declare function validateToolCatalogWrite(existing: Partial<ITool> | undefined, candidate: Partial<ITool> | undefined, recordId?: string | undefined, catalogPatch?: boolean): void;
 /**
  * Per-context runtime owner of permanent Tools identities. Construction is inert;
  * ready() explicitly initializes storage after UserContext construction completes.

package/dist/contracts/tool-catalog.js

@@ -62,6 +62,35 @@ function hasToolCatalogEvidence(row) {
         row.contractVersion !== undefined ||
         row.toolName !== undefined);
 }
+/**
+ * A catalog insert that lost its target columns, or was stored before those columns
+ * existed, still carries the member's deterministic ID, the member name and an empty
+ * executable. Publication may write the canonical target back, resolving the row in
+ * the same write; a repair cannot leave the target on a still-quarantined row. Any
+ * other bare `000tool0` row, including one that still holds executable source or a
+ * different name, stays unclaimable.
+ */
+function canRestoreBareDeterministicRow(existing, candidate) {
+    if (candidate.catalogState !== "resolved" || candidate.catalogIdentity !== "deterministic")
+        return false;
+    if (existing.code !== "")
+        return false;
+    if (existing.catalogIdentity !== undefined && existing.catalogIdentity !== "deterministic")
+        return false;
+    let target;
+    try {
+        if (toolCatalogTarget(existing))
+            return false;
+        target = toolCatalogTarget(candidate);
+    }
+    catch {
+        return false;
+    }
+    if (!target || !candidate.toolId || existing.name !== target.toolName)
+        return false;
+    const ids = (0, tool_catalog_migrations_1.toolCatalogIds)(target);
+    return ids.length === 1 && ids[0] === candidate.toolId && candidate.toolId.startsWith("000tool0");
+}
 /**
  * Shared pre-persistence identity guard for local writes and reconstructed sync rows.
  * Existing mappings cannot be retargeted, stripped or deleted. Rejected sync evidence
@@ -70,9 +99,14 @@ function hasToolCatalogEvidence(row) {
  *
  * Catalog identities are permanent. Unresolved legacy rows are a holdover until their
  * tools move to contracts: they stay ordinary rows that local writers and older
- * runtimes may delete.
+ * runtimes may delete. A bare deterministic row with an empty executable and the
+ * member's own name may receive that member's canonical target; every other
+ * untargeted or quarantined identity stays rejected.
+ *
+ * @param catalogPatch - Only explicit local catalog patches may restore a bare
+ * deterministic row. Ordinary replacements and sync replay must leave it quarantined.
  */
-function validateToolCatalogWrite(existing, candidate, recordId = candidate?.toolId ?? existing?.toolId) {
+function validateToolCatalogWrite(existing, candidate, recordId = candidate?.toolId ?? existing?.toolId, catalogPatch = false) {
     if (!candidate) {
         if ((recordId !== undefined && isReservedToolCatalogId(recordId)) ||
             (existing && hasToolCatalogEvidence(existing)))
@@ -83,7 +117,9 @@ function validateToolCatalogWrite(existing, candidate, recordId = candidate?.too
         !(0, tool_catalog_identity_1.isCatalogToolId)(candidate.toolId) ||
         (existing && existing.toolId !== candidate.toolId))
         throw new Error("Tool catalog primary key mismatch");
-    if (existing?.catalogState === "quarantined" && candidate.catalogState !== "quarantined")
+    if (existing?.catalogState === "quarantined" &&
+        candidate.catalogState !== "quarantined" &&
+        !(catalogPatch && canRestoreBareDeterministicRow(existing, candidate)))
         throw new Error(`Quarantined tool identity: ${candidate.toolId}`);
     // Quarantine preserves the original evidence byte-for-byte; it cannot retarget it.
     if (existing &&
@@ -99,7 +135,10 @@ function validateToolCatalogWrite(existing, candidate, recordId = candidate?.too
     if (previous && (!target || (0, tool_catalog_identity_1.toolCatalogTargetKey)(previous) !== (0, tool_catalog_identity_1.toolCatalogTargetKey)(target)))
         throw new Error(`Tool catalog identity cannot change: ${candidate.toolId}`);
     if (target) {
-        if (existing && !previous && !legacy)
+        if (existing &&
+            !previous &&
+            !legacy &&
+            !(catalogPatch && canRestoreBareDeterministicRow(existing, candidate)))
             throw new Error(`Unresolved tool identity cannot be claimed: ${candidate.toolId}`);
         if (!(0, tool_catalog_migrations_1.toolCatalogIds)(target).includes(candidate.toolId))
             throw new Error(`Unknown tool catalog mapping: ${candidate.toolId}`);
@@ -364,9 +403,10 @@ class ToolCatalog {
                         ...resolvedFields(target, toolId),
                     };
                     const stored = existing.get(toolId);
-                    if (stored?.catalogState === "quarantined")
+                    if (stored?.catalogState === "quarantined" &&
+                        !canRestoreBareDeterministicRow(stored, row))
                         throw new Error(`Quarantined tool identity: ${toolId}`);
-                    validateToolCatalogWrite(stored, row);
+                    validateToolCatalogWrite(stored, row, toolId, true);
                     candidates.set(toolId, row);
                 }
             }
@@ -374,6 +414,18 @@ class ToolCatalog {
         // Validate the entire batch before the first write. Catalog metadata never
         // overwrites provider-specific policy or another provider's descriptions.
         for (const row of candidates.values()) {
+            const previous = existing.get(row.toolId);
+            // Restore missing identity columns only after validating the entire batch.
+            // This marked patch leaves concurrent policy and historical fields intact.
+            if (previous && canRestoreBareDeterministicRow(previous, row)) {
+                const restored = await table.update((0, tools_1.toolCatalogPatch)({
+                    toolId: row.toolId,
+                    ...resolvedFields(toolCatalogTarget(row), row.toolId),
+                }));
+                validateToolCatalogWrite(row, restored);
+                if (restored.catalogState === "quarantined")
+                    throw new Error(`Quarantined tool identity: ${row.toolId}`);
+            }
             // Older runtimes allowed provider removal to leave tombstones. Only a
             // validated public target may restore one; insert-only still preserves any
             // row that arrived concurrently, and the returned mapping is checked below.

package/dist/data/index.d.ts

@@ -30,6 +30,7 @@ export * from "./tool-access";
 export * from "./tool-access-approvals";
 export * from "./tool-tests";
 export * from "./tools";
+export * from "./update-settings.pvar";
 export * from "./user-permissions";
 export * from "./user-trust-levels";
 export * from "./users";

package/dist/data/index.js

@@ -46,6 +46,7 @@ __exportStar(require("./tool-access"), exports);
 __exportStar(require("./tool-access-approvals"), exports);
 __exportStar(require("./tool-tests"), exports);
 __exportStar(require("./tools"), exports);
+__exportStar(require("./update-settings.pvar"), exports);
 __exportStar(require("./user-permissions"), exports);
 __exportStar(require("./user-trust-levels"), exports);
 __exportStar(require("./users"), exports);

package/dist/data/update-settings.pvar.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Device-scoped settings for desktop application updates. Each device keeps its own values;
+ * they never sync to the user's other devices, so another device cannot change them.
+ *
+ * Like the other `*.pvar` modules, this creates pvars at load, so the data barrel must
+ * evaluate it after `persistent-vars` has initialized; its name sorts it there.
+ */
+/**
+ * Install a downloaded application update automatically the next time Peers quits or
+ * restarts on this device.
+ *
+ * Defaults to true. When false, updates still download in the background but install only
+ * when someone chooses **Update & restart**.
+ *
+ * The desktop app reads this row by name each time it quits, rather than trusting the
+ * in-memory value, so keep the name stable.
+ */
+export declare const installAppUpdatesOnRestart: import("./persistent-vars").PersistentVar<boolean>;
+/**
+ * Allow callers this device trusts as `Self` (the user's other devices, and users explicitly
+ * granted Self trust) to run **Update & restart** on this device remotely.
+ *
+ * Defaults to true. This is a consent switch, not a security boundary: Self-trusted callers
+ * already have full remote access to this device's system contracts.
+ */
+export declare const allowRemoteAppUpdateRestart: import("./persistent-vars").PersistentVar<boolean>;

package/dist/data/update-settings.pvar.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Device-scoped settings for desktop application updates. Each device keeps its own values;
+ * they never sync to the user's other devices, so another device cannot change them.
+ *
+ * Like the other `*.pvar` modules, this creates pvars at load, so the data barrel must
+ * evaluate it after `persistent-vars` has initialized; its name sorts it there.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowRemoteAppUpdateRestart = exports.installAppUpdatesOnRestart = void 0;
+const persistent_vars_1 = require("./persistent-vars");
+/**
+ * Install a downloaded application update automatically the next time Peers quits or
+ * restarts on this device.
+ *
+ * Defaults to true. When false, updates still download in the background but install only
+ * when someone chooses **Update & restart**.
+ *
+ * The desktop app reads this row by name each time it quits, rather than trusting the
+ * in-memory value, so keep the name stable.
+ */
+exports.installAppUpdatesOnRestart = (0, persistent_vars_1.deviceVar)("installAppUpdatesOnRestart", {
+    defaultValue: true,
+});
+/**
+ * Allow callers this device trusts as `Self` (the user's other devices, and users explicitly
+ * granted Self trust) to run **Update & restart** on this device remotely.
+ *
+ * Defaults to true. This is a consent switch, not a security boundary: Self-trusted callers
+ * already have full remote access to this device's system contracts.
+ */
+exports.allowRemoteAppUpdateRestart = (0, persistent_vars_1.deviceVar)("allowRemoteAppUpdateRestart", {
+    defaultValue: true,
+});

package/dist/system-ids.d.ts

@@ -65,6 +65,12 @@ export declare const deviceOperationsContractId = "00mriijkhq94msfe9m2j6quwp";
 export declare const networkDiagnosticsContractId = "00ms1yb50w29oi116uwwrg7rl";
 /** Contract id for explicit local network and synchronization control operations. */
 export declare const networkControlContractId = "00ms1yb50yj9w5qbytl69qfht";
+/**
+ * Contract id for **System App Updates**: desktop host update status, on-demand checks, and
+ * update-and-restart. Remotely callable by Self-trusted devices; hosts without an updater
+ * provide status and relay tools, while Electron also implements local updates.
+ */
+export declare const appUpdatesContractId = "00mvczoafequsatpfjaj3r4g8";
 /**
  * Contract id for the local-only tool-access approval control surface.
  * Not available over device-to-device connections.

package/dist/system-ids.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.desktopToolsContractId = exports.hostToolsContractId = exports.toolCatalogContractId = exports.schedulerToolIds = exports.schedulerContractId = exports.contractCatalogToolIds = exports.contractCatalogContractId = exports.httpToolIds = exports.httpContractId = exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCoreRevokedPublishPublicKeys = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
+exports.desktopToolsContractId = exports.hostToolsContractId = exports.toolCatalogContractId = exports.schedulerToolIds = exports.schedulerContractId = exports.contractCatalogToolIds = exports.contractCatalogContractId = exports.httpToolIds = exports.httpContractId = exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.appUpdatesContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCoreRevokedPublishPublicKeys = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
 /** Stable user ID that owns built-in Peers system records. */
 exports.peersRootUserId = "000peers0user000000000001";
 /** Default assistant used when no user-selected assistant is available. */
@@ -72,6 +72,12 @@ exports.deviceOperationsContractId = "00mriijkhq94msfe9m2j6quwp";
 exports.networkDiagnosticsContractId = "00ms1yb50w29oi116uwwrg7rl";
 /** Contract id for explicit local network and synchronization control operations. */
 exports.networkControlContractId = "00ms1yb50yj9w5qbytl69qfht";
+/**
+ * Contract id for **System App Updates**: desktop host update status, on-demand checks, and
+ * update-and-restart. Remotely callable by Self-trusted devices; hosts without an updater
+ * provide status and relay tools, while Electron also implements local updates.
+ */
+exports.appUpdatesContractId = "00mvczoafequsatpfjaj3r4g8";
 /**
  * Contract id for the local-only tool-access approval control surface.
  * Not available over device-to-device connections.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.26.0",
+  "version": "0.26.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"