@peers-app/peers-sdk 0.26.1 → 0.26.2

package/dist/contracts/__tests__/remote-contract-transport.test.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const system_ids_1 = require("../../system-ids");
 const index_1 = require("../index");
 const makeRequest = (overrides = {}) => ({
     contractId: "contract-a",
@@ -49,11 +50,49 @@ describe("remote contract endpoint", () => {
         await expect(endpoint.handleCall(toolCall, {})).rejects.toThrow("disposed");
         expect(emit).not.toHaveBeenCalled();
     });
+    it("refuses package callers for contracts whose providers refuse packages", async () => {
+        const { transport, emit } = makeTransport();
+        const packageContext = { callerPackageId: "package-a" };
+        expect(() => (0, index_1.createRemoteContractEndpoint)(makeRequest({ contractId: system_ids_1.appUpdatesContractId, context: packageContext }), () => transport)).toThrow("packages cannot call contract");
+        const operator = (0, index_1.createRemoteContractEndpoint)(makeRequest({ contractId: system_ids_1.appUpdatesContractId }), () => transport);
+        await expect(operator.handleCall({ ...toolCall, contractId: system_ids_1.appUpdatesContractId }, {})).resolves.toBe("pong");
+        const packageTool = (0, index_1.createRemoteContractEndpoint)(makeRequest({ context: packageContext }), () => transport);
+        await expect(packageTool.handleCall(toolCall, packageContext)).resolves.toBe("pong");
+        expect(emit).toHaveBeenCalledTimes(2);
+    });
     it("fails clearly when no transport factory is registered or the route is incomplete", () => {
         expect(() => (0, index_1.createRemoteContractEndpoint)(makeRequest())).toThrow("no remote contract transport is registered");
         expect(() => (0, index_1.createRemoteContractEndpoint)(makeRequest({ dataContextId: undefined }), () => makeTransport().transport)).toThrow("data context");
         expect(() => (0, index_1.createRemoteContractEndpoint)(makeRequest({ targetDeviceId: undefined }), () => makeTransport().transport)).toThrow("target device");
     });
+    it("refuses package runTool forwarding that could invoke App Updates indirectly", async () => {
+        const { transport, emit } = makeTransport();
+        const packageContext = { callerPackageId: "package-a" };
+        const endpoint = (0, index_1.createRemoteContractEndpoint)(makeRequest({ contractId: system_ids_1.deviceOperationsContractId, context: packageContext }), () => transport);
+        for (const toolName of ["checkForUpdates", "installUpdateAndRestart"]) {
+            const call = {
+                ...toolCall,
+                contractId: system_ids_1.deviceOperationsContractId,
+                name: "runTool",
+                args: [
+                    {
+                        toolIdOrName: (0, index_1.deriveToolCatalogId)({
+                            contractId: system_ids_1.appUpdatesContractId,
+                            version: index_1.APP_UPDATES_CONTRACT_VERSION,
+                            toolName,
+                        }),
+                    },
+                ],
+            };
+            await expect(endpoint.handleCall(call, packageContext)).rejects.toThrow("packages cannot call Device Operations runTool");
+        }
+        expect(emit).not.toHaveBeenCalled();
+        // Read-only tools on the same cached package endpoint still work.
+        await expect(endpoint.handleCall({ ...toolCall, contractId: system_ids_1.deviceOperationsContractId, name: "getDeviceStatus" }, packageContext)).resolves.toBe("pong");
+        const operator = (0, index_1.createRemoteContractEndpoint)(makeRequest({ contractId: system_ids_1.deviceOperationsContractId }), () => transport);
+        await expect(operator.handleCall({ ...toolCall, contractId: system_ids_1.deviceOperationsContractId, name: "runTool" }, {})).resolves.toBe("pong");
+        expect(emit).toHaveBeenCalledTimes(2);
+    });
 });
 describe("resolveRemoteTargetEndpoint", () => {
     it("returns undefined for local routes and for the local device itself", () => {

package/dist/contracts/__tests__/system-contracts.test.js

@@ -15,6 +15,7 @@ describe("system contract catalog", () => {
             .map((entry) => entry.contractId)
             .filter(Boolean);
         expect(ids).toEqual(expect.arrayContaining([
+            system_ids_1.appUpdatesContractId,
             system_ids_1.logsContractId,
             system_ids_1.deviceOperationsContractId,
             system_ids_1.identityContractId,

package/dist/contracts/index.d.ts

@@ -13,6 +13,7 @@ export { getHostContractTransport, type HostContractTransportListener, registerH
 export { PersistentContractRegistry } from "./persistent-registry";
 export { ContractRegistry, type IContractProviderRegistration } from "./registry";
 export { createRemoteContractEndpoint, getRemoteContractTransportFactory, type IRemoteContractHost, type IRemoteContractTarget, type RemoteContractTransportFactory, resolveRemoteTargetEndpoint, setRemoteContractTransportFactory, } from "./remote-contract-transport";
+export * from "./system/app-updates-contract";
 export { CONTRACT_CATALOG_VERSION, contractCatalogProviderPackageId, getContractCatalogDefinition, type IContractCatalogConsumer, type IContractProviderInfo, type IListContractProvidersInput, } from "./system/contract-catalog-contract";
 export * from "./system/desktop-tools-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./system/device-operations-contract";

package/dist/contracts/index.js

@@ -83,6 +83,7 @@ Object.defineProperty(exports, "createRemoteContractEndpoint", { enumerable: tru
 Object.defineProperty(exports, "getRemoteContractTransportFactory", { enumerable: true, get: function () { return remote_contract_transport_1.getRemoteContractTransportFactory; } });
 Object.defineProperty(exports, "resolveRemoteTargetEndpoint", { enumerable: true, get: function () { return remote_contract_transport_1.resolveRemoteTargetEndpoint; } });
 Object.defineProperty(exports, "setRemoteContractTransportFactory", { enumerable: true, get: function () { return remote_contract_transport_1.setRemoteContractTransportFactory; } });
+__exportStar(require("./system/app-updates-contract"), exports);
 var contract_catalog_contract_1 = require("./system/contract-catalog-contract");
 Object.defineProperty(exports, "CONTRACT_CATALOG_VERSION", { enumerable: true, get: function () { return contract_catalog_contract_1.CONTRACT_CATALOG_VERSION; } });
 Object.defineProperty(exports, "contractCatalogProviderPackageId", { enumerable: true, get: function () { return contract_catalog_contract_1.contractCatalogProviderPackageId; } });

package/dist/contracts/remote-contract-transport.d.ts

@@ -60,10 +60,13 @@ export declare function resolveRemoteTargetEndpoint(request: IContractProviderEn
  * *local* caller for the route. It strips {@link IContractCall.targetDeviceId} before
  * emitting so the receiving device sees an ordinary call addressed to itself and the
  * message is signed with this device's own identity. Only tool runs are forwarded; the
- * router rejects other members before reaching this endpoint.
+ * router rejects other members before reaching this endpoint. Package callers cannot
+ * reach contracts whose providers refuse packages, such as System App Updates, or the
+ * Device Operations `runTool` wrapper that could invoke them indirectly.
  *
  * @param request Authorized route whose `targetDeviceId` and `dataContextId` are set.
  * @param factory Transport factory; defaults to the process-wide registration.
- * @throws If no factory is available or the route lacks a target device or data context.
+ * @throws If no factory is available, the route lacks a target device or data context, or
+ *   a package targets a contract that refuses package callers.
  */
 export declare function createRemoteContractEndpoint(request: IContractProviderEndpointRequest, factory?: RemoteContractTransportFactory | undefined): IContractProviderEndpoint;

package/dist/contracts/remote-contract-transport.js

@@ -4,7 +4,14 @@ exports.setRemoteContractTransportFactory = setRemoteContractTransportFactory;
 exports.getRemoteContractTransportFactory = getRemoteContractTransportFactory;
 exports.resolveRemoteTargetEndpoint = resolveRemoteTargetEndpoint;
 exports.createRemoteContractEndpoint = createRemoteContractEndpoint;
+const system_ids_1 = require("../system-ids");
 const contract_transport_1 = require("./contract-transport");
+/**
+ * Contracts whose providers refuse package callers. A forwarded call reaches the target
+ * signed by this device alone, so the target cannot tell that a package made it; the
+ * forwarding host refuses instead.
+ */
+const packageRefusedRemoteContractIds = new Set([system_ids_1.appUpdatesContractId]);
 const factoriesByUserContext = new WeakMap();
 let defaultFactory;
 /**
@@ -58,17 +65,23 @@ function resolveRemoteTargetEndpoint(request, host) {
  * *local* caller for the route. It strips {@link IContractCall.targetDeviceId} before
  * emitting so the receiving device sees an ordinary call addressed to itself and the
  * message is signed with this device's own identity. Only tool runs are forwarded; the
- * router rejects other members before reaching this endpoint.
+ * router rejects other members before reaching this endpoint. Package callers cannot
+ * reach contracts whose providers refuse packages, such as System App Updates, or the
+ * Device Operations `runTool` wrapper that could invoke them indirectly.
  *
  * @param request Authorized route whose `targetDeviceId` and `dataContextId` are set.
  * @param factory Transport factory; defaults to the process-wide registration.
- * @throws If no factory is available or the route lacks a target device or data context.
+ * @throws If no factory is available, the route lacks a target device or data context, or
+ *   a package targets a contract that refuses package callers.
  */
 function createRemoteContractEndpoint(request, factory = getRemoteContractTransportFactory()) {
     const { targetDeviceId, dataContextId } = request;
     if (!targetDeviceId) {
         throw new Error("Remote contract endpoint requires a target device id");
     }
+    if (request.context?.callerPackageId && packageRefusedRemoteContractIds.has(request.contractId)) {
+        throw new Error(`Permission denied: packages cannot call contract ${request.contractId} on another device`);
+    }
     if (!dataContextId) {
         throw new Error("Remote contract endpoint requires an authorized data context id");
     }
@@ -85,6 +98,13 @@ function createRemoteContractEndpoint(request, factory = getRemoteContractTransp
             if (call.member !== "tool" || call.operation !== "run") {
                 return Promise.reject(new Error(`Contract ${call.member} '${call.name}'.${call.operation} cannot be forwarded to a remote device`));
             }
+            // runTool refuses packages locally, but the target cannot recover their identity
+            // after forwarding. Without this gate it could invoke App Updates on their behalf.
+            if (request.context.callerPackageId &&
+                request.contractId === system_ids_1.deviceOperationsContractId &&
+                call.name === "runTool") {
+                return Promise.reject(new Error("Permission denied: packages cannot call Device Operations runTool on another device"));
+            }
             const { targetDeviceId: _stripped, ...outbound } = call;
             return transport.emit(contract_transport_1.CONTRACT_REQUEST_CHANNEL, { ...outbound, dataContextId });
         },

package/dist/contracts/system/app-updates-contract.d.ts

@@ -0,0 +1,109 @@
+import type { Observable } from "../../observable";
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the built-in System App Updates contract. */
+export declare const APP_UPDATES_CONTRACT_VERSION = 1;
+/**
+ * Lifecycle of the host application's update check, download, and install.
+ *
+ * - `idle` — no check has completed since launch.
+ * - `checking` — the update feed is being read.
+ * - `up-to-date` — the feed has nothing newer than the running version.
+ * - `available` — a newer version exists and its download has not finished.
+ * - `downloading` — the newer version is downloading (see {@link IAppUpdateStatus.downloadPercent}).
+ * - `downloaded` — the newer version is ready to install.
+ * - `installing` — the app is shutting down to run the installer and relaunch.
+ * - `restarting` — the app is restarting without installing anything.
+ * - `error` — the last check, download, or install failed (see {@link IAppUpdateStatus.error}).
+ */
+export type AppUpdateState = "idle" | "checking" | "up-to-date" | "available" | "downloading" | "downloaded" | "installing" | "restarting" | "error";
+/** Snapshot of the host application's update state, as reported by the device that runs it. */
+export interface IAppUpdateStatus {
+    /** False when the host cannot update itself (for example an unpackaged development build). */
+    supported: boolean;
+    /** True when the host can restart itself on request (desktop apps, even unpackaged ones). */
+    canRestart: boolean;
+    /** Host operating system as reported by Node (`darwin`, `win32`, `linux`). */
+    platform: string;
+    /** Version of the running application. */
+    currentVersion: string;
+    /** Newest version the update feed reported, when a check has succeeded. */
+    latestVersion?: string;
+    /** Version whose installer has finished downloading in this session. */
+    downloadedVersion?: string;
+    /** Current lifecycle state. */
+    state: AppUpdateState;
+    /** Download progress from 0 to 100 while {@link state} is `downloading`. */
+    downloadPercent?: number;
+    /** Message from the last failed check, download, or install. */
+    error?: string;
+    /** Epoch milliseconds of the last completed feed check. */
+    lastCheckedAt?: number;
+    /** This device's "install updates when Peers restarts" setting. */
+    installOnRestart: boolean;
+    /**
+     * True when a downloaded update will install the next time the app quits. Usually mirrors
+     * {@link installOnRestart}; the quit itself re-reads the stored setting. On macOS it is also
+     * true once the system installer has accepted the update for an Update & restart that timed
+     * out, which cannot be undone.
+     */
+    installOnQuitArmed: boolean;
+    /** This device's "allow my other devices to update and restart this device" setting. */
+    remoteRestartAllowed: boolean;
+    /** True when installing prompts for an administrator password on this device (Linux `.deb`). */
+    installNeedsElevation?: boolean;
+}
+/**
+ * What `installUpdateAndRestart` started. The call returns as soon as the work is underway;
+ * read {@link IAppUpdateStatus} to follow it.
+ *
+ * - `installing` — a downloaded update is installing; the app will relaunch on the new version.
+ * - `downloading` — the update is still downloading; it installs and relaunches when done.
+ * - `checking` — no update was known; the device checks first, then installs or simply restarts.
+ * - `restarting` — the app is restarting without an update.
+ */
+export type AppUpdateInstallAction = "installing" | "downloading" | "checking" | "restarting";
+/** Result of `installUpdateAndRestart`. */
+export interface IAppUpdateInstallResult {
+    /** What the device started. */
+    action: AppUpdateInstallAction;
+    /** Status at the moment the work started. */
+    status: IAppUpdateStatus;
+}
+/** Input naming the device a relayed App Updates call targets. */
+export interface IAppUpdatesDeviceInput {
+    /** Another device of this user, or of a user who trusts this user as `Self`. */
+    deviceId: string;
+}
+/** Typed consumer proxy for System App Updates v1. */
+export interface IAppUpdatesConsumer extends IContractConsumerBase {
+    tools: {
+        /** Return this device's current update status. */
+        getUpdateStatus(): Promise<IAppUpdateStatus>;
+        /** Read the update feed now and return the resulting status. */
+        checkForUpdates(): Promise<IAppUpdateStatus>;
+        /** Install an available update and relaunch, or restart when there is nothing to install. */
+        installUpdateAndRestart(): Promise<IAppUpdateInstallResult>;
+        /** Relay `getUpdateStatus` to another device. Local callers only. */
+        getDeviceUpdateStatus(input: IAppUpdatesDeviceInput): Promise<IAppUpdateStatus>;
+        /** Relay `installUpdateAndRestart` to another device. Local callers only. */
+        installUpdateAndRestartOnDevice(input: IAppUpdatesDeviceInput): Promise<IAppUpdateInstallResult>;
+    };
+    observables: {
+        /** Live update status; available over the local host transport only. */
+        status: Observable<IAppUpdateStatus>;
+    };
+}
+/**
+ * Return the System App Updates contract shape.
+ *
+ * Tools carry no `remoteAccessLevel`, so only callers this device trusts as `Self` (the
+ * user's own devices and users explicitly granted Self) can reach them remotely. The
+ * provider additionally honours the device's own remote-restart switch.
+ *
+ * The `*Device*` tools let a local UI or CLI reach another device: the host calls the target
+ * over a direct connection (or, for the user's own devices, the mesh) and the target applies
+ * its own trust check and switch. They refuse remote callers, so a device never relays.
+ * Observables cross the local host transport only.
+ */
+export declare function getAppUpdatesContractDefinition(): IContractDefinition;

package/dist/contracts/system/app-updates-contract.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_UPDATES_CONTRACT_VERSION = void 0;
+exports.getAppUpdatesContractDefinition = getAppUpdatesContractDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the built-in System App Updates contract. */
+exports.APP_UPDATES_CONTRACT_VERSION = 1;
+const field = (name, type, description, opts = {}) => ({ name, type, description, ...opts });
+const statusFields = [
+    field("supported", field_type_1.FieldType.boolean, "Whether this host can update itself."),
+    field("canRestart", field_type_1.FieldType.boolean, "Whether this host can restart itself on request."),
+    field("platform", field_type_1.FieldType.string, "Host operating system."),
+    field("currentVersion", field_type_1.FieldType.string, "Version of the running application."),
+    field("latestVersion", field_type_1.FieldType.string, "Newest version the update feed reported.", {
+        optional: true,
+    }),
+    field("downloadedVersion", field_type_1.FieldType.string, "Version ready to install.", { optional: true }),
+    field("state", field_type_1.FieldType.string, "Update lifecycle state."),
+    field("downloadPercent", field_type_1.FieldType.number, "Download progress from 0 to 100.", {
+        optional: true,
+    }),
+    field("error", field_type_1.FieldType.string, "Last update failure message.", { optional: true }),
+    field("lastCheckedAt", field_type_1.FieldType.number, "Epoch ms of the last completed check.", {
+        optional: true,
+    }),
+    field("installOnRestart", field_type_1.FieldType.boolean, "Install updates when the app restarts."),
+    field("installOnQuitArmed", field_type_1.FieldType.boolean, "A downloaded update will install on quit."),
+    field("remoteRestartAllowed", field_type_1.FieldType.boolean, "Whether trusted devices may update and restart this device."),
+    field("installNeedsElevation", field_type_1.FieldType.boolean, "Installing prompts for a password.", {
+        optional: true,
+    }),
+];
+let definition;
+const installResultFields = [
+    field("action", field_type_1.FieldType.string, "installing, downloading, checking, or restarting."),
+    field("status", field_type_1.FieldType.object, "Update status when the work started."),
+];
+const deviceIdField = field("deviceId", field_type_1.FieldType.id, "Device to call: another of this user's devices, or one whose owner trusts this user as Self.");
+/**
+ * Return the System App Updates contract shape.
+ *
+ * Tools carry no `remoteAccessLevel`, so only callers this device trusts as `Self` (the
+ * user's own devices and users explicitly granted Self) can reach them remotely. The
+ * provider additionally honours the device's own remote-restart switch.
+ *
+ * The `*Device*` tools let a local UI or CLI reach another device: the host calls the target
+ * over a direct connection (or, for the user's own devices, the mesh) and the target applies
+ * its own trust check and switch. They refuse remote callers, so a device never relays.
+ * Observables cross the local host transport only.
+ */
+function getAppUpdatesContractDefinition() {
+    definition ??= {
+        contractId: system_ids_1.appUpdatesContractId,
+        version: exports.APP_UPDATES_CONTRACT_VERSION,
+        devTag: "dev",
+        name: "System App Updates",
+        description: "Desktop application update status, on-demand checks, and update-and-restart.",
+        tables: [],
+        tools: [
+            {
+                name: "getUpdateStatus",
+                usageDescription: "Return this device's application version and update status.",
+                inputFields: [],
+                outputFields: statusFields,
+            },
+            {
+                name: "checkForUpdates",
+                usageDescription: "Check the update feed now and return the resulting update status.",
+                inputFields: [],
+                outputFields: statusFields,
+            },
+            {
+                name: "installUpdateAndRestart",
+                usageDescription: "Install an available update and relaunch, or restart the app when there is nothing to install.",
+                inputFields: [],
+                outputFields: installResultFields,
+            },
+            {
+                name: "getDeviceUpdateStatus",
+                usageDescription: "Return another device's application version and update status.",
+                inputFields: [deviceIdField],
+                outputFields: statusFields,
+            },
+            {
+                name: "installUpdateAndRestartOnDevice",
+                usageDescription: "Ask another device to install its available update and relaunch, or restart when it has nothing to install.",
+                inputFields: [deviceIdField],
+                outputFields: installResultFields,
+            },
+        ],
+        observables: [
+            {
+                name: "status",
+                description: "Live application update status.",
+                valueType: field_type_1.FieldType.object,
+                writable: false,
+            },
+        ],
+        events: [],
+    };
+    return definition;
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: system_ids_1.peersSystemPackageId,
+    contractId: system_ids_1.appUpdatesContractId,
+    version: exports.APP_UPDATES_CONTRACT_VERSION,
+    getDefinition: getAppUpdatesContractDefinition,
+});

package/dist/contracts/system/index.d.ts

@@ -2,6 +2,7 @@
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
+import "./app-updates-contract";
 import "./contract-catalog-contract";
 import "./device-operations-contract";
 import "./http-contract";
@@ -11,6 +12,7 @@ import "./logs-contract";
 import "./network-contracts";
 import "./scheduler-contract";
 import "./tool-access-control-contract";
+export * from "./app-updates-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./device-operations-contract";
 export { getIdentityContractDefinition, IDENTITY_CONTRACT_VERSION, type IIdentityConsumer, type IIdentityKeyInfo, type IIdentityRegistryKey, type IIdentityRotateKeyInput, type IIdentityRotateKeyResult, type IIdentitySessionInfo, } from "./identity-contract";
 export { getInvitesContractDefinition, type IAcceptInviteResult, type ICreatedInvite, type IInvitePreview, type IInvitesConsumer, INVITES_CONTRACT_VERSION, } from "./invites-contract";

package/dist/contracts/system/index.js

@@ -19,6 +19,7 @@ exports.TOOL_ACCESS_CONTROL_CONTRACT_VERSION = exports.getToolAccessControlContr
  * Built-in system contracts. Importing this barrel runs each module's
  * {@link registerSystemContract} side effect so the catalog is populated.
  */
+require("./app-updates-contract");
 require("./contract-catalog-contract");
 require("./device-operations-contract");
 require("./http-contract");
@@ -28,6 +29,7 @@ require("./logs-contract");
 require("./network-contracts");
 require("./scheduler-contract");
 require("./tool-access-control-contract");
+__exportStar(require("./app-updates-contract"), exports);
 var device_operations_contract_1 = require("./device-operations-contract");
 Object.defineProperty(exports, "DEVICE_OPERATIONS_CONTRACT_VERSION", { enumerable: true, get: function () { return device_operations_contract_1.DEVICE_OPERATIONS_CONTRACT_VERSION; } });
 Object.defineProperty(exports, "DEVICE_OPERATIONS_MAX_QUERY_LENGTH", { enumerable: true, get: function () { return device_operations_contract_1.DEVICE_OPERATIONS_MAX_QUERY_LENGTH; } });

package/dist/data/index.d.ts

@@ -30,6 +30,7 @@ export * from "./tool-access";
 export * from "./tool-access-approvals";
 export * from "./tool-tests";
 export * from "./tools";
+export * from "./update-settings.pvar";
 export * from "./user-permissions";
 export * from "./user-trust-levels";
 export * from "./users";

package/dist/data/index.js

@@ -46,6 +46,7 @@ __exportStar(require("./tool-access"), exports);
 __exportStar(require("./tool-access-approvals"), exports);
 __exportStar(require("./tool-tests"), exports);
 __exportStar(require("./tools"), exports);
+__exportStar(require("./update-settings.pvar"), exports);
 __exportStar(require("./user-permissions"), exports);
 __exportStar(require("./user-trust-levels"), exports);
 __exportStar(require("./users"), exports);

package/dist/data/update-settings.pvar.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Device-scoped settings for desktop application updates. Each device keeps its own values;
+ * they never sync to the user's other devices, so another device cannot change them.
+ *
+ * Like the other `*.pvar` modules, this creates pvars at load, so the data barrel must
+ * evaluate it after `persistent-vars` has initialized; its name sorts it there.
+ */
+/**
+ * Install a downloaded application update automatically the next time Peers quits or
+ * restarts on this device.
+ *
+ * Defaults to true. When false, updates still download in the background but install only
+ * when someone chooses **Update & restart**.
+ *
+ * The desktop app reads this row by name each time it quits, rather than trusting the
+ * in-memory value, so keep the name stable.
+ */
+export declare const installAppUpdatesOnRestart: import("./persistent-vars").PersistentVar<boolean>;
+/**
+ * Allow callers this device trusts as `Self` (the user's other devices, and users explicitly
+ * granted Self trust) to run **Update & restart** on this device remotely.
+ *
+ * Defaults to true. This is a consent switch, not a security boundary: Self-trusted callers
+ * already have full remote access to this device's system contracts.
+ */
+export declare const allowRemoteAppUpdateRestart: import("./persistent-vars").PersistentVar<boolean>;

package/dist/data/update-settings.pvar.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Device-scoped settings for desktop application updates. Each device keeps its own values;
+ * they never sync to the user's other devices, so another device cannot change them.
+ *
+ * Like the other `*.pvar` modules, this creates pvars at load, so the data barrel must
+ * evaluate it after `persistent-vars` has initialized; its name sorts it there.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowRemoteAppUpdateRestart = exports.installAppUpdatesOnRestart = void 0;
+const persistent_vars_1 = require("./persistent-vars");
+/**
+ * Install a downloaded application update automatically the next time Peers quits or
+ * restarts on this device.
+ *
+ * Defaults to true. When false, updates still download in the background but install only
+ * when someone chooses **Update & restart**.
+ *
+ * The desktop app reads this row by name each time it quits, rather than trusting the
+ * in-memory value, so keep the name stable.
+ */
+exports.installAppUpdatesOnRestart = (0, persistent_vars_1.deviceVar)("installAppUpdatesOnRestart", {
+    defaultValue: true,
+});
+/**
+ * Allow callers this device trusts as `Self` (the user's other devices, and users explicitly
+ * granted Self trust) to run **Update & restart** on this device remotely.
+ *
+ * Defaults to true. This is a consent switch, not a security boundary: Self-trusted callers
+ * already have full remote access to this device's system contracts.
+ */
+exports.allowRemoteAppUpdateRestart = (0, persistent_vars_1.deviceVar)("allowRemoteAppUpdateRestart", {
+    defaultValue: true,
+});

package/dist/system-ids.d.ts

@@ -65,6 +65,12 @@ export declare const deviceOperationsContractId = "00mriijkhq94msfe9m2j6quwp";
 export declare const networkDiagnosticsContractId = "00ms1yb50w29oi116uwwrg7rl";
 /** Contract id for explicit local network and synchronization control operations. */
 export declare const networkControlContractId = "00ms1yb50yj9w5qbytl69qfht";
+/**
+ * Contract id for **System App Updates**: desktop host update status, on-demand checks, and
+ * update-and-restart. Remotely callable by Self-trusted devices; hosts without an updater
+ * provide status and relay tools, while Electron also implements local updates.
+ */
+export declare const appUpdatesContractId = "00mvczoafequsatpfjaj3r4g8";
 /**
  * Contract id for the local-only tool-access approval control surface.
  * Not available over device-to-device connections.

package/dist/system-ids.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.desktopToolsContractId = exports.hostToolsContractId = exports.toolCatalogContractId = exports.schedulerToolIds = exports.schedulerContractId = exports.contractCatalogToolIds = exports.contractCatalogContractId = exports.httpToolIds = exports.httpContractId = exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCoreRevokedPublishPublicKeys = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
+exports.desktopToolsContractId = exports.hostToolsContractId = exports.toolCatalogContractId = exports.schedulerToolIds = exports.schedulerContractId = exports.contractCatalogToolIds = exports.contractCatalogContractId = exports.httpToolIds = exports.httpContractId = exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.appUpdatesContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCoreRevokedPublishPublicKeys = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
 /** Stable user ID that owns built-in Peers system records. */
 exports.peersRootUserId = "000peers0user000000000001";
 /** Default assistant used when no user-selected assistant is available. */
@@ -72,6 +72,12 @@ exports.deviceOperationsContractId = "00mriijkhq94msfe9m2j6quwp";
 exports.networkDiagnosticsContractId = "00ms1yb50w29oi116uwwrg7rl";
 /** Contract id for explicit local network and synchronization control operations. */
 exports.networkControlContractId = "00ms1yb50yj9w5qbytl69qfht";
+/**
+ * Contract id for **System App Updates**: desktop host update status, on-demand checks, and
+ * update-and-restart. Remotely callable by Self-trusted devices; hosts without an updater
+ * provide status and relay tools, while Electron also implements local updates.
+ */
+exports.appUpdatesContractId = "00mvczoafequsatpfjaj3r4g8";
 /**
  * Contract id for the local-only tool-access approval control surface.
  * Not available over device-to-device connections.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.26.1",
+  "version": "0.26.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"