@peers-app/peers-sdk 0.27.2 → 0.27.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (260) hide show
  1. package/dist/contracts/contract-proxy.d.ts +7 -0
  2. package/dist/contracts/contract-proxy.js +19 -2
  3. package/dist/contracts/create-local-consumer.js +16 -1
  4. package/dist/contracts/index.d.ts +2 -0
  5. package/dist/contracts/index.js +2 -0
  6. package/dist/contracts/system/index.d.ts +2 -0
  7. package/dist/contracts/system/index.js +2 -0
  8. package/dist/contracts/system/invites-contract.js +2 -1
  9. package/dist/contracts/system/sync-check-contract.d.ts +97 -0
  10. package/dist/contracts/system/sync-check-contract.js +115 -0
  11. package/dist/contracts/tool-arguments.d.ts +15 -0
  12. package/dist/contracts/tool-arguments.js +41 -0
  13. package/dist/contracts/tool-catalog-service.js +2 -12
  14. package/dist/data/change-tracking.d.ts +40 -0
  15. package/dist/data/change-tracking.js +89 -0
  16. package/dist/data/orm/types.d.ts +24 -7
  17. package/dist/data/orm/types.js +97 -24
  18. package/dist/data/persistent-vars.d.ts +5 -0
  19. package/dist/data/persistent-vars.js +24 -6
  20. package/dist/define/manifest.js +6 -34
  21. package/dist/package-loader/package-loader.js +27 -22
  22. package/dist/system-ids.d.ts +5 -0
  23. package/dist/system-ids.js +6 -1
  24. package/package.json +4 -2
  25. package/dist/context/user-context-identity.test.d.ts +0 -1
  26. package/dist/context/user-context-identity.test.js +0 -220
  27. package/dist/contracts/__tests__/action-dispatch.test.d.ts +0 -1
  28. package/dist/contracts/__tests__/action-dispatch.test.js +0 -319
  29. package/dist/contracts/__tests__/also-implements.test.d.ts +0 -1
  30. package/dist/contracts/__tests__/also-implements.test.js +0 -110
  31. package/dist/contracts/__tests__/builder.test.d.ts +0 -1
  32. package/dist/contracts/__tests__/builder.test.js +0 -669
  33. package/dist/contracts/__tests__/contract-events.test.d.ts +0 -1
  34. package/dist/contracts/__tests__/contract-events.test.js +0 -199
  35. package/dist/contracts/__tests__/contract-observables.test.d.ts +0 -1
  36. package/dist/contracts/__tests__/contract-observables.test.js +0 -290
  37. package/dist/contracts/__tests__/contract-provider-router.test.d.ts +0 -1
  38. package/dist/contracts/__tests__/contract-provider-router.test.js +0 -315
  39. package/dist/contracts/__tests__/contract-proxy.test.d.ts +0 -1
  40. package/dist/contracts/__tests__/contract-proxy.test.js +0 -657
  41. package/dist/contracts/__tests__/contract-resolvers.test.d.ts +0 -1
  42. package/dist/contracts/__tests__/contract-resolvers.test.js +0 -758
  43. package/dist/contracts/__tests__/contract-subscription-lifecycle.test.d.ts +0 -1
  44. package/dist/contracts/__tests__/contract-subscription-lifecycle.test.js +0 -353
  45. package/dist/contracts/__tests__/contract-table-events.test.d.ts +0 -1
  46. package/dist/contracts/__tests__/contract-table-events.test.js +0 -209
  47. package/dist/contracts/__tests__/contract-transport.test.d.ts +0 -1
  48. package/dist/contracts/__tests__/contract-transport.test.js +0 -163
  49. package/dist/contracts/__tests__/extract.test.d.ts +0 -1
  50. package/dist/contracts/__tests__/extract.test.js +0 -145
  51. package/dist/contracts/__tests__/frozen-contracts.test.d.ts +0 -1
  52. package/dist/contracts/__tests__/frozen-contracts.test.js +0 -191
  53. package/dist/contracts/__tests__/generic-tool-dispatch.test.d.ts +0 -1
  54. package/dist/contracts/__tests__/generic-tool-dispatch.test.js +0 -130
  55. package/dist/contracts/__tests__/host-contract-client.test.d.ts +0 -1
  56. package/dist/contracts/__tests__/host-contract-client.test.js +0 -793
  57. package/dist/contracts/__tests__/host-contract-consumer.test.d.ts +0 -1
  58. package/dist/contracts/__tests__/host-contract-consumer.test.js +0 -163
  59. package/dist/contracts/__tests__/host-contract-transport.test.d.ts +0 -1
  60. package/dist/contracts/__tests__/host-contract-transport.test.js +0 -66
  61. package/dist/contracts/__tests__/integration.test.d.ts +0 -1
  62. package/dist/contracts/__tests__/integration.test.js +0 -348
  63. package/dist/contracts/__tests__/legacy-removal.test.d.ts +0 -1
  64. package/dist/contracts/__tests__/legacy-removal.test.js +0 -128
  65. package/dist/contracts/__tests__/persistent-registry.test.d.ts +0 -1
  66. package/dist/contracts/__tests__/persistent-registry.test.js +0 -109
  67. package/dist/contracts/__tests__/playground.test.d.ts +0 -1
  68. package/dist/contracts/__tests__/playground.test.js +0 -216
  69. package/dist/contracts/__tests__/registry.test.d.ts +0 -1
  70. package/dist/contracts/__tests__/registry.test.js +0 -238
  71. package/dist/contracts/__tests__/remote-contract-transport.test.d.ts +0 -1
  72. package/dist/contracts/__tests__/remote-contract-transport.test.js +0 -119
  73. package/dist/contracts/__tests__/system-contracts.test.d.ts +0 -1
  74. package/dist/contracts/__tests__/system-contracts.test.js +0 -247
  75. package/dist/contracts/__tests__/target-dispatch.d.ts +0 -11
  76. package/dist/contracts/__tests__/target-dispatch.js +0 -24
  77. package/dist/contracts/__tests__/tool-catalog-inventory.test.d.ts +0 -1
  78. package/dist/contracts/__tests__/tool-catalog-inventory.test.js +0 -44
  79. package/dist/contracts/__tests__/tool-catalog-service.test.d.ts +0 -1
  80. package/dist/contracts/__tests__/tool-catalog-service.test.js +0 -482
  81. package/dist/contracts/__tests__/tool-catalog.test.d.ts +0 -1
  82. package/dist/contracts/__tests__/tool-catalog.test.js +0 -1199
  83. package/dist/contracts/__tests__/validate.test.d.ts +0 -1
  84. package/dist/contracts/__tests__/validate.test.js +0 -991
  85. package/dist/contracts/__tests__/workflow-context.test.d.ts +0 -1
  86. package/dist/contracts/__tests__/workflow-context.test.js +0 -50
  87. package/dist/data/access-level.test.d.ts +0 -1
  88. package/dist/data/access-level.test.js +0 -53
  89. package/dist/data/change-tracking.test.d.ts +0 -1
  90. package/dist/data/change-tracking.test.js +0 -62
  91. package/dist/data/files/files.test.d.ts +0 -1
  92. package/dist/data/files/files.test.js +0 -770
  93. package/dist/data/group-members.test.d.ts +0 -1
  94. package/dist/data/group-members.test.js +0 -336
  95. package/dist/data/group-share.test.d.ts +0 -1
  96. package/dist/data/group-share.test.js +0 -110
  97. package/dist/data/groups.test.d.ts +0 -1
  98. package/dist/data/groups.test.js +0 -153
  99. package/dist/data/orm/cursor.test.d.ts +0 -1
  100. package/dist/data/orm/cursor.test.js +0 -314
  101. package/dist/data/orm/data-query.mongo.test.d.ts +0 -1
  102. package/dist/data/orm/data-query.mongo.test.js +0 -367
  103. package/dist/data/orm/data-query.sqlite.test.d.ts +0 -1
  104. package/dist/data/orm/data-query.sqlite.test.js +0 -365
  105. package/dist/data/orm/data-query.test.d.ts +0 -1
  106. package/dist/data/orm/data-query.test.js +0 -545
  107. package/dist/data/orm/dependency-injection.test.d.ts +0 -1
  108. package/dist/data/orm/dependency-injection.test.js +0 -171
  109. package/dist/data/orm/event-registry.test.d.ts +0 -1
  110. package/dist/data/orm/event-registry.test.js +0 -44
  111. package/dist/data/orm/multi-cursors.test.d.ts +0 -1
  112. package/dist/data/orm/multi-cursors.test.js +0 -463
  113. package/dist/data/orm/sql.data-source.test.d.ts +0 -1
  114. package/dist/data/orm/sql.data-source.test.js +0 -731
  115. package/dist/data/orm/table-container-events.test.d.ts +0 -1
  116. package/dist/data/orm/table-container-events.test.js +0 -101
  117. package/dist/data/orm/table-container.test.d.ts +0 -1
  118. package/dist/data/orm/table-container.test.js +0 -273
  119. package/dist/data/orm/table.event-source.test.d.ts +0 -1
  120. package/dist/data/orm/table.event-source.test.js +0 -331
  121. package/dist/data/orm/types.test.d.ts +0 -1
  122. package/dist/data/orm/types.test.js +0 -409
  123. package/dist/data/package-table-identity.test.d.ts +0 -1
  124. package/dist/data/package-table-identity.test.js +0 -46
  125. package/dist/data/package-version-permissions.test.d.ts +0 -1
  126. package/dist/data/package-version-permissions.test.js +0 -107
  127. package/dist/data/package-version-resolver.test.d.ts +0 -4
  128. package/dist/data/package-version-resolver.test.js +0 -543
  129. package/dist/data/package-versions.test.d.ts +0 -1
  130. package/dist/data/package-versions.test.js +0 -227
  131. package/dist/data/persistent-vars.conflict.test.d.ts +0 -1
  132. package/dist/data/persistent-vars.conflict.test.js +0 -126
  133. package/dist/data/persistent-vars.migration.test.d.ts +0 -1
  134. package/dist/data/persistent-vars.migration.test.js +0 -133
  135. package/dist/data/persistent-vars.package-scope.test.d.ts +0 -1
  136. package/dist/data/persistent-vars.package-scope.test.js +0 -27
  137. package/dist/data/sync-recovery-queue.test.d.ts +0 -1
  138. package/dist/data/sync-recovery-queue.test.js +0 -215
  139. package/dist/data/table-signing.test.d.ts +0 -1
  140. package/dist/data/table-signing.test.js +0 -118
  141. package/dist/data/tool-access.test.d.ts +0 -1
  142. package/dist/data/tool-access.test.js +0 -166
  143. package/dist/data/user-permissions.test.d.ts +0 -1
  144. package/dist/data/user-permissions.test.js +0 -305
  145. package/dist/data/user-trust-levels.test.d.ts +0 -1
  146. package/dist/data/user-trust-levels.test.js +0 -37
  147. package/dist/define/also-implements.test.d.ts +0 -1
  148. package/dist/define/also-implements.test.js +0 -123
  149. package/dist/define/declare-contract.test.d.ts +0 -1
  150. package/dist/define/declare-contract.test.js +0 -573
  151. package/dist/define/define.test.d.ts +0 -1
  152. package/dist/define/define.test.js +0 -1010
  153. package/dist/define/empty-fields.test.d.ts +0 -1
  154. package/dist/define/empty-fields.test.js +0 -55
  155. package/dist/define/events-observables.test.d.ts +0 -1
  156. package/dist/define/events-observables.test.js +0 -1013
  157. package/dist/define/serve-members.test.d.ts +0 -1
  158. package/dist/define/serve-members.test.js +0 -630
  159. package/dist/define/vars.test.d.ts +0 -1
  160. package/dist/define/vars.test.js +0 -39
  161. package/dist/device/binary-peer-connection-v2.test.d.ts +0 -1
  162. package/dist/device/binary-peer-connection-v2.test.js +0 -730
  163. package/dist/device/binary-peer-connection.test.d.ts +0 -1
  164. package/dist/device/binary-peer-connection.test.js +0 -184
  165. package/dist/device/connection.test.d.ts +0 -1
  166. package/dist/device/connection.test.js +0 -613
  167. package/dist/device/device-election.test.d.ts +0 -1
  168. package/dist/device/device-election.test.js +0 -516
  169. package/dist/device/device.test.d.ts +0 -1
  170. package/dist/device/device.test.js +0 -243
  171. package/dist/device/frame-cipher.test.d.ts +0 -1
  172. package/dist/device/frame-cipher.test.js +0 -219
  173. package/dist/device/get-trust-level-fn.test.d.ts +0 -1
  174. package/dist/device/get-trust-level-fn.test.js +0 -685
  175. package/dist/device/streamed-socket.test.d.ts +0 -1
  176. package/dist/device/streamed-socket.test.js +0 -216
  177. package/dist/device/tx-encoding.test.d.ts +0 -1
  178. package/dist/device/tx-encoding.test.js +0 -295
  179. package/dist/device-pairing/cpace.test.d.ts +0 -1
  180. package/dist/device-pairing/cpace.test.js +0 -116
  181. package/dist/device-pairing/device-pairing.test.d.ts +0 -1
  182. package/dist/device-pairing/device-pairing.test.js +0 -211
  183. package/dist/hlc.test.d.ts +0 -1
  184. package/dist/hlc.test.js +0 -45
  185. package/dist/host-credentials.test.d.ts +0 -1
  186. package/dist/host-credentials.test.js +0 -88
  187. package/dist/identity/account-email.test.d.ts +0 -1
  188. package/dist/identity/account-email.test.js +0 -59
  189. package/dist/identity/anchor-document.test.d.ts +0 -1
  190. package/dist/identity/anchor-document.test.js +0 -16
  191. package/dist/identity/anchor-resolution.test.d.ts +0 -1
  192. package/dist/identity/anchor-resolution.test.js +0 -130
  193. package/dist/identity/key-change.test.d.ts +0 -1
  194. package/dist/identity/key-change.test.js +0 -811
  195. package/dist/invites/group-approval.test.d.ts +0 -1
  196. package/dist/invites/group-approval.test.js +0 -223
  197. package/dist/invites/invite-token.test.d.ts +0 -1
  198. package/dist/invites/invite-token.test.js +0 -123
  199. package/dist/keys.test.d.ts +0 -1
  200. package/dist/keys.test.js +0 -336
  201. package/dist/logging/console-logger.test.d.ts +0 -1
  202. package/dist/logging/console-logger.test.js +0 -300
  203. package/dist/logging/console-logs.table.test.d.ts +0 -1
  204. package/dist/logging/console-logs.table.test.js +0 -156
  205. package/dist/observable.test.d.ts +0 -1
  206. package/dist/observable.test.js +0 -309
  207. package/dist/package-build/build-package.test.d.ts +0 -1
  208. package/dist/package-build/build-package.test.js +0 -204
  209. package/dist/package-build/contract-add.test.d.ts +0 -1
  210. package/dist/package-build/contract-add.test.js +0 -467
  211. package/dist/package-build/freeze-contracts.test.d.ts +0 -1
  212. package/dist/package-build/freeze-contracts.test.js +0 -355
  213. package/dist/package-installer/package-author-signing.test.d.ts +0 -1
  214. package/dist/package-installer/package-author-signing.test.js +0 -200
  215. package/dist/package-installer/package-cloner.test.d.ts +0 -1
  216. package/dist/package-installer/package-cloner.test.js +0 -278
  217. package/dist/package-installer/package-creator.test.d.ts +0 -1
  218. package/dist/package-installer/package-creator.test.js +0 -908
  219. package/dist/package-installer/package-dev-tools.test.d.ts +0 -1
  220. package/dist/package-installer/package-dev-tools.test.js +0 -64
  221. package/dist/package-installer/package-installer.test.d.ts +0 -1
  222. package/dist/package-installer/package-installer.test.js +0 -882
  223. package/dist/package-installer/package-propagation.test.d.ts +0 -1
  224. package/dist/package-installer/package-propagation.test.js +0 -1269
  225. package/dist/package-installer/package-publisher.test.d.ts +0 -1
  226. package/dist/package-installer/package-publisher.test.js +0 -153
  227. package/dist/package-installer/package-remote-checker.test.d.ts +0 -1
  228. package/dist/package-installer/package-remote-checker.test.js +0 -334
  229. package/dist/package-installer/package-seed-installer.test.d.ts +0 -1
  230. package/dist/package-installer/package-seed-installer.test.js +0 -123
  231. package/dist/package-installer/package-tarball.test.d.ts +0 -1
  232. package/dist/package-installer/package-tarball.test.js +0 -75
  233. package/dist/package-installer/peers-core-installer.test.d.ts +0 -1
  234. package/dist/package-installer/peers-core-installer.test.js +0 -49
  235. package/dist/package-installer/peers-core-trust-anchor.test.d.ts +0 -1
  236. package/dist/package-installer/peers-core-trust-anchor.test.js +0 -155
  237. package/dist/package-loader/contract-package-loader.test.d.ts +0 -1
  238. package/dist/package-loader/contract-package-loader.test.js +0 -274
  239. package/dist/package-loader/host-authority-loading.test.d.ts +0 -1
  240. package/dist/package-loader/host-authority-loading.test.js +0 -104
  241. package/dist/package-loader/host-dispatch-policy.test.d.ts +0 -1
  242. package/dist/package-loader/host-dispatch-policy.test.js +0 -56
  243. package/dist/package-loader/isolated-artifact.test.d.ts +0 -1
  244. package/dist/package-loader/isolated-artifact.test.js +0 -688
  245. package/dist/package-loader/isolated-persistent-var-gateway.test.d.ts +0 -1
  246. package/dist/package-loader/isolated-persistent-var-gateway.test.js +0 -56
  247. package/dist/package-loader/isolated-table-gateway.test.d.ts +0 -1
  248. package/dist/package-loader/isolated-table-gateway.test.js +0 -633
  249. package/dist/package-loader/package-loader.test.d.ts +0 -1
  250. package/dist/package-loader/package-loader.test.js +0 -1764
  251. package/dist/package-loader/resolve-consumed-contracts.test.d.ts +0 -1
  252. package/dist/package-loader/resolve-consumed-contracts.test.js +0 -166
  253. package/dist/serial-json.compat.test.d.ts +0 -1
  254. package/dist/serial-json.compat.test.js +0 -369
  255. package/dist/serial-json.test.d.ts +0 -1
  256. package/dist/serial-json.test.js +0 -401
  257. package/dist/testing/mock-host-contract.test.d.ts +0 -1
  258. package/dist/testing/mock-host-contract.test.js +0 -782
  259. package/dist/utils.test.d.ts +0 -1
  260. package/dist/utils.test.js +0 -232
@@ -1,220 +0,0 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- const SQLiteDB = require("better-sqlite3");
4
- const sql_data_source_1 = require("../data/orm/sql.data-source");
5
- const user_permissions_1 = require("../data/user-permissions");
6
- const users_1 = require("../data/users");
7
- const anchor_document_1 = require("../identity/anchor-document");
8
- const anchor_resolution_1 = require("../identity/anchor-resolution");
9
- const key_change_1 = require("../identity/key-change");
10
- const keys_1 = require("../keys");
11
- const utils_1 = require("../utils");
12
- const user_context_1 = require("./user-context");
13
- const user_context_singleton_1 = require("./user-context-singleton");
14
- // Installs the UsersTable guard.
15
- require("../identity/user-row-change");
16
- class DBHarness {
17
- _db = null;
18
- get db() {
19
- if (!this._db) {
20
- this._db = new SQLiteDB(":memory:");
21
- this._db.pragma("journal_mode = WAL");
22
- }
23
- return this._db;
24
- }
25
- async get(sql, params = []) {
26
- return this.db.prepare(sql).get(params);
27
- }
28
- async all(sql, params = []) {
29
- return this.db.prepare(sql).all(params);
30
- }
31
- async exec(sql, params = []) {
32
- const result = this.db.prepare(sql).run(params);
33
- return { changes: result.changes };
34
- }
35
- async close() {
36
- this._db?.close();
37
- this._db = null;
38
- }
39
- }
40
- describe("UserContext.syncUserAndGroupObjects and the profile row's key", () => {
41
- const anchor = {
42
- type: "https",
43
- url: "https://example.com/.well-known/peers-identity.json",
44
- };
45
- // The process-wide user context can be installed once, so one context serves every case;
46
- // each case starts by writing the profile row it needs (the owner's own row is unrestricted).
47
- const db = new DBHarness();
48
- const userId = (0, utils_1.newid)();
49
- let userContext;
50
- beforeAll(async () => {
51
- const dataSourceFactory = (metaData, schema) => new sql_data_source_1.SQLDataSource(db, metaData, schema);
52
- userContext = new user_context_1.UserContext(userId, dataSourceFactory, true);
53
- await userContext.loadingPromise;
54
- userContext.deviceId((0, utils_1.newid)());
55
- (0, user_context_singleton_1.setUserContext)(userContext);
56
- });
57
- afterEach(() => {
58
- (0, anchor_resolution_1.setAnchorFetcher)(undefined);
59
- });
60
- afterAll(async () => {
61
- userContext.dispose();
62
- await db.close();
63
- });
64
- function document(publicKey, authorizedBy) {
65
- return {
66
- outcome: "document",
67
- document: {
68
- version: 1,
69
- userId,
70
- keys: [{ publicKey, issuedAt: "2026-10-03T18:00:00.000Z", authorizedBy }],
71
- anchors: [anchor],
72
- updatedAt: "2026-10-03T18:00:00.000Z",
73
- },
74
- };
75
- }
76
- it("signs a fresh profile with the device key", async () => {
77
- const keys = (0, keys_1.newKeys)();
78
- await userContext.syncUserAndGroupObjects(userId, keys);
79
- const me = await (0, users_1.Users)(userContext.userDataContext).get(userId);
80
- expect(me?.publicKey).toBe(keys.publicKey);
81
- expect(() => (0, user_permissions_1.verifyUserSignature)(me)).not.toThrow();
82
- });
83
- it("re-signs a profile the anchors say this device's key succeeded", async () => {
84
- // A rotation stored the new secret and then stopped before re-signing the row, or an
85
- // operator replaced the secret in credentials.json after publishing the key. The anchors
86
- // list the device key with the old key's co-signature, so the row follows the device.
87
- const k1 = (0, keys_1.newKeys)();
88
- const k2 = (0, keys_1.newKeys)();
89
- await (0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({
90
- userId,
91
- name: "Alice",
92
- publicKey: k1.publicKey,
93
- publicBoxKey: k1.publicBoxKey,
94
- anchors: [anchor],
95
- }, k1.secretKey));
96
- const succession = (0, anchor_document_1.signSuccession)({
97
- purpose: "peers-key-succession",
98
- userId,
99
- publicKey: k2.publicKey,
100
- issuedAt: "2026-10-03T18:00:00.000Z",
101
- }, k1.secretKey);
102
- (0, anchor_resolution_1.setAnchorFetcher)(async () => document(k2.publicKey, { publicKey: succession.publicKey, signature: succession.signature }));
103
- await userContext.syncUserAndGroupObjects(userId, k2);
104
- const me = await (0, users_1.Users)(userContext.userDataContext).get(userId);
105
- expect(me?.publicKey).toBe(k2.publicKey);
106
- expect(me?.publicBoxKey).toBe(k2.publicBoxKey);
107
- expect(me?.name).toBe("Alice");
108
- expect(me?.anchors).toEqual([anchor]);
109
- expect(() => (0, user_permissions_1.verifyUserSignature)(me)).not.toThrow();
110
- });
111
- it("does not put the device key back over a row the anchors still confirm", async () => {
112
- // The row holds K2 and the anchors list only K2: this device's K1 was rotated away. The
113
- // row must not be re-signed with K1, or the device would publish a retired key.
114
- const k1 = (0, keys_1.newKeys)();
115
- const k2 = (0, keys_1.newKeys)();
116
- const row = (0, user_permissions_1.signUserObject)({
117
- userId,
118
- name: "Alice",
119
- publicKey: k2.publicKey,
120
- publicBoxKey: k2.publicBoxKey,
121
- anchors: [anchor],
122
- }, k2.secretKey);
123
- await (0, users_1.Users)(userContext.userDataContext).save(row);
124
- (0, anchor_resolution_1.setAnchorFetcher)(async () => document(k2.publicKey));
125
- await userContext.syncUserAndGroupObjects(userId, k1);
126
- const me = await (0, users_1.Users)(userContext.userDataContext).get(userId);
127
- expect(me?.publicKey).toBe(k2.publicKey);
128
- expect(me?.signature).toBe(row.signature);
129
- });
130
- it("leaves the row alone while the anchors have not answered", async () => {
131
- const k1 = (0, keys_1.newKeys)();
132
- const k2 = (0, keys_1.newKeys)();
133
- const row = (0, user_permissions_1.signUserObject)({
134
- userId,
135
- name: "Alice",
136
- publicKey: k1.publicKey,
137
- publicBoxKey: k1.publicBoxKey,
138
- anchors: [anchor],
139
- }, k1.secretKey);
140
- await (0, users_1.Users)(userContext.userDataContext).save(row);
141
- (0, anchor_resolution_1.setAnchorFetcher)(async () => ({ outcome: "abstain" }));
142
- await userContext.syncUserAndGroupObjects(userId, k2);
143
- const me = await (0, users_1.Users)(userContext.userDataContext).get(userId);
144
- expect(me?.publicKey).toBe(k1.publicKey);
145
- expect(me?.signature).toBe(row.signature);
146
- });
147
- describe("the rotated-away notice", () => {
148
- const noticeFor = (oldKey, newKey) => ({
149
- userId,
150
- oldPublicKey: oldKey,
151
- newPublicKey: newKey,
152
- detectedAt: "2026-10-03T18:00:00.000Z",
153
- });
154
- afterEach(async () => {
155
- await key_change_1.identityRotatedAwayVar.loadingPromise;
156
- (0, key_change_1.identityRotatedAwayVar)(null);
157
- });
158
- it("is cleared once this device holds the key the anchors confirmed", async () => {
159
- // The device was told its K1 was rotated away, then paired again onto the same
160
- // database and now holds K2. The banner must not outlive the problem.
161
- const k1 = (0, keys_1.newKeys)();
162
- const k2 = (0, keys_1.newKeys)();
163
- await (0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({
164
- userId,
165
- name: "Alice",
166
- publicKey: k2.publicKey,
167
- publicBoxKey: k2.publicBoxKey,
168
- anchors: [anchor],
169
- }, k2.secretKey));
170
- await key_change_1.identityRotatedAwayVar.loadingPromise;
171
- (0, key_change_1.identityRotatedAwayVar)(noticeFor(k1.publicKey, k2.publicKey));
172
- await userContext.syncUserAndGroupObjects(userId, k2);
173
- expect((0, key_change_1.identityRotatedAwayVar)()).toBeNull();
174
- });
175
- it("is cleared when the anchors confirm the key this device now holds", async () => {
176
- // Paired again after a further rotation: the notice names K2, the device holds K3, and
177
- // the row on disk is still K1 until the anchors answer.
178
- const k1 = (0, keys_1.newKeys)();
179
- const k2 = (0, keys_1.newKeys)();
180
- const k3 = (0, keys_1.newKeys)();
181
- await (0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({
182
- userId,
183
- name: "Alice",
184
- publicKey: k1.publicKey,
185
- publicBoxKey: k1.publicBoxKey,
186
- anchors: [anchor],
187
- }, k1.secretKey));
188
- const succession = (0, anchor_document_1.signSuccession)({
189
- purpose: "peers-key-succession",
190
- userId,
191
- publicKey: k3.publicKey,
192
- issuedAt: "2026-10-03T18:00:00.000Z",
193
- }, k1.secretKey);
194
- (0, anchor_resolution_1.setAnchorFetcher)(async () => document(k3.publicKey, {
195
- publicKey: succession.publicKey,
196
- signature: succession.signature,
197
- }));
198
- await key_change_1.identityRotatedAwayVar.loadingPromise;
199
- (0, key_change_1.identityRotatedAwayVar)(noticeFor(k1.publicKey, k2.publicKey));
200
- await userContext.syncUserAndGroupObjects(userId, k3);
201
- expect((0, key_change_1.identityRotatedAwayVar)()).toBeNull();
202
- });
203
- it("stays on a device that still holds the retired key", async () => {
204
- const k1 = (0, keys_1.newKeys)();
205
- const k2 = (0, keys_1.newKeys)();
206
- await (0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({
207
- userId,
208
- name: "Alice",
209
- publicKey: k1.publicKey,
210
- publicBoxKey: k1.publicBoxKey,
211
- anchors: [anchor],
212
- }, k1.secretKey));
213
- await key_change_1.identityRotatedAwayVar.loadingPromise;
214
- const notice = noticeFor(k1.publicKey, k2.publicKey);
215
- (0, key_change_1.identityRotatedAwayVar)(notice);
216
- await userContext.syncUserAndGroupObjects(userId, k1);
217
- expect((0, key_change_1.identityRotatedAwayVar)()).toEqual(notice);
218
- });
219
- });
220
- });
@@ -1 +0,0 @@
1
- export {};
@@ -1,319 +0,0 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- const group_member_roles_1 = require("../../data/group-member-roles");
4
- const utils_1 = require("../../utils");
5
- /** Voice Hub's contract, whose `voice-hub-run-action` declares preserve. */
6
- const VOICE_HUB_CONTRACT_ID = "00mskqamhdq1327mqehy58pps";
7
- /** The contract whose tools a test's entry tool dispatches to. */
8
- const TARGETS = (0, utils_1.newid)();
9
- const contract_provider_router_1 = require("../contract-provider-router");
10
- const contract_proxy_1 = require("../contract-proxy");
11
- const contract_transport_1 = require("../contract-transport");
12
- const target_dispatch_1 = require("./target-dispatch");
13
- function groupContext() {
14
- const userId = (0, utils_1.newid)();
15
- const groupId = (0, utils_1.newid)();
16
- const founderUserId = (0, utils_1.newid)();
17
- let role = group_member_roles_1.GroupMemberRole.Writer;
18
- const dataContext = {
19
- dataContextId: groupId,
20
- groupId,
21
- tableContainer: {
22
- getTable: (meta) => {
23
- if (meta.name === "Groups")
24
- return { get: async () => ({ groupId, founderUserId }) };
25
- if (meta.name === "GroupMembers")
26
- return { findOne: async () => ({ userId, role }) };
27
- throw new Error(`Unexpected table ${meta.name}`);
28
- },
29
- },
30
- };
31
- Object.assign(dataContext, {
32
- userContext: {
33
- userId,
34
- loadingPromise: Promise.resolve(),
35
- userDataContext: dataContext,
36
- getDataContext: () => dataContext,
37
- },
38
- });
39
- return {
40
- dataContext,
41
- userId,
42
- groupId,
43
- setRole: (value) => {
44
- role = value;
45
- },
46
- };
47
- }
48
- function tool(name, level, toolFn) {
49
- return {
50
- tool: {
51
- name,
52
- toolId: (0, utils_1.newid)(),
53
- usageDescription: name,
54
- accessLevel: level,
55
- code: "",
56
- inputSchema: { type: "simple", fields: [] },
57
- outputSchema: { type: "simple", fields: [] },
58
- },
59
- toolFn,
60
- };
61
- }
62
- /** A tool that runs the target `name` through `context.dispatchTool`. */
63
- function hop(name, level, target) {
64
- return tool(name, level, (_, context) => context.dispatchTool?.({ contractId: TARGETS, version: 1, toolName: target }, {}));
65
- }
66
- describe("strict delegated tool dispatch in a group", () => {
67
- it("leaves ordinary host-tool admission outside the action scope on its existing user-role path", async () => {
68
- const group = groupContext();
69
- const contractId = (0, utils_1.newid)();
70
- const effect = jest.fn(async () => "written");
71
- const dispatch = (0, contract_proxy_1.createContractProvider)({
72
- contractId,
73
- version: 1,
74
- tools: { write: tool("write", 40, effect) },
75
- });
76
- const call = {
77
- contractId,
78
- version: 1,
79
- member: "tool",
80
- name: "write",
81
- operation: "run",
82
- args: [{}],
83
- };
84
- const context = {
85
- callerUserId: group.userId,
86
- dataContext: group.dataContext,
87
- authority: {
88
- userId: group.userId,
89
- userAccessLevel: 40,
90
- assistantAccessLevel: 20,
91
- callingToolAccessLevel: 20,
92
- strictActionScope: false,
93
- },
94
- };
95
- await expect(dispatch(call, context)).resolves.toBe("written");
96
- group.setRole(group_member_roles_1.GroupMemberRole.Reader);
97
- await expect(dispatch(call, context)).rejects.toThrow("Reader (20)");
98
- expect(effect).toHaveBeenCalledTimes(1);
99
- });
100
- function setup(authority) {
101
- const group = groupContext();
102
- const writes = jest.fn(async () => ({ result: "milk" }));
103
- const targets = {
104
- list: tool("list", 20, async () => ({ result: [] })),
105
- add: tool("add", 40, writes),
106
- reader: hop("reader", 20, "add"),
107
- writer: hop("writer", 40, "history"),
108
- "writer-self": hop("writer-self", 40, "self"),
109
- history: tool("history", 80, writes),
110
- self: tool("self", undefined, writes),
111
- };
112
- const resolution = {
113
- contractId: VOICE_HUB_CONTRACT_ID,
114
- version: 1,
115
- forwardCallContext: true,
116
- tools: {
117
- invoke: tool("invoke", 20, (input, context) => context.dispatchTool?.({ contractId: TARGETS, version: 1, toolName: input.tool }, input.args ?? {})),
118
- },
119
- };
120
- Object.assign(resolution.tools.invoke.tool, { authorityPropagation: "preserve" });
121
- const context = {
122
- callerUserId: group.userId,
123
- localUserId: group.userId,
124
- dataContext: group.dataContext,
125
- authority,
126
- };
127
- const [client, server] = (0, contract_transport_1.inProcessTransportPair)();
128
- const session = (0, contract_proxy_1.createContractProviderSession)(resolution, server, {
129
- context,
130
- dispatchTool: (0, target_dispatch_1.targetDispatch)(TARGETS, targets),
131
- });
132
- const consumer = (0, contract_proxy_1.createContractConsumer)({
133
- contractId: VOICE_HUB_CONTRACT_ID,
134
- version: 1,
135
- name: "Hub",
136
- description: "",
137
- tables: [],
138
- observables: [],
139
- events: [],
140
- tools: [{ name: "invoke", usageDescription: "invoke", inputFields: [], outputFields: [] }],
141
- }, client, { dataContextId: group.groupId });
142
- return {
143
- ...group,
144
- writes,
145
- targets,
146
- context,
147
- consumer,
148
- dispose: () => {
149
- consumer.dispose();
150
- session.dispose();
151
- },
152
- };
153
- }
154
- it("allows direct Writer dispatch while a group Reader can only list, ignoring payload grants", async () => {
155
- const p = setup();
156
- try {
157
- await expect(p.consumer.tools.invoke({ tool: "add", args: { name: "milk" } })).resolves.toEqual({ result: "milk" });
158
- p.setRole(group_member_roles_1.GroupMemberRole.Reader);
159
- await expect(p.consumer.tools.invoke({ tool: "list" })).resolves.toEqual({
160
- result: [],
161
- });
162
- await expect(p.consumer.tools.invoke({
163
- tool: "add",
164
- args: {
165
- name: "milk",
166
- userId: p.userId,
167
- userAccessLevel: 100,
168
- assistantAccessLevel: 100,
169
- directUserInvocation: true,
170
- hostApprovedApprovalId: (0, utils_1.newid)(),
171
- },
172
- })).rejects.toThrow("Permission denied");
173
- expect(p.writes).toHaveBeenCalledTimes(1);
174
- }
175
- finally {
176
- p.dispose();
177
- }
178
- });
179
- it("caps Reader tools through invoke, and denies Owner and Self from Writer tools", async () => {
180
- const p = setup();
181
- try {
182
- await expect(p.consumer.tools.invoke({ tool: "reader" })).rejects.toThrow("Permission denied");
183
- await expect(p.consumer.tools.invoke({ tool: "writer" })).rejects.toThrow("Permission denied");
184
- await expect(p.consumer.tools.invoke({ tool: "self" })).rejects.toThrow("Permission denied");
185
- p.setRole(group_member_roles_1.GroupMemberRole.Owner);
186
- await expect(p.consumer.tools.invoke({ tool: "writer" })).rejects.toThrow("Permission denied");
187
- p.setRole(group_member_roles_1.GroupMemberRole.Founder);
188
- await expect(p.consumer.tools.invoke({ tool: "writer-self" })).rejects.toThrow("Permission denied");
189
- expect(p.writes).not.toHaveBeenCalled();
190
- }
191
- finally {
192
- p.dispose();
193
- }
194
- });
195
- it("rechecks role and live metadata on every call", async () => {
196
- const p = setup();
197
- try {
198
- p.setRole(group_member_roles_1.GroupMemberRole.Reader);
199
- await expect(p.consumer.tools.invoke({ tool: "add" })).rejects.toThrow("Permission denied");
200
- p.setRole(group_member_roles_1.GroupMemberRole.Writer);
201
- p.targets.add.tool.accessLevel = 80;
202
- await expect(p.consumer.tools.invoke({ tool: "add" })).rejects.toThrow("Permission denied");
203
- await expect(p.consumer.tools.invoke({ tool: "invented" })).rejects.toThrow("does not provide tool 'invented'");
204
- expect(p.writes).not.toHaveBeenCalled();
205
- }
206
- finally {
207
- p.dispose();
208
- }
209
- });
210
- it("retains a delegated Reader frame from a trusted caller and fails missing identity closed", async () => {
211
- const p = setup({ userAccessLevel: 40, assistantAccessLevel: 20, strictActionScope: true });
212
- try {
213
- await expect(p.consumer.tools.invoke({ tool: "add" })).rejects.toThrow("Permission denied");
214
- delete p.context.callerUserId;
215
- delete p.context.localUserId;
216
- await expect(p.consumer.tools.invoke({ tool: "list", args: { callerUserId: p.userId } })).rejects.toThrow("missing caller identity");
217
- expect(p.writes).not.toHaveBeenCalled();
218
- }
219
- finally {
220
- p.dispose();
221
- }
222
- });
223
- it("refuses remote forwarding rather than dropping a strict ceiling", async () => {
224
- const [client, server] = (0, contract_transport_1.inProcessTransportPair)();
225
- const resolveEndpoint = jest.fn();
226
- const router = (0, contract_provider_router_1.createContractProviderRouter)(server, {
227
- context: {
228
- authority: { userAccessLevel: 40, assistantAccessLevel: 20, strictActionScope: true },
229
- },
230
- authorizeCall: () => ({ context: {} }),
231
- resolveEndpoint,
232
- });
233
- try {
234
- await expect(client.emit(contract_transport_1.CONTRACT_REQUEST_CHANNEL, {
235
- contractId: (0, utils_1.newid)(),
236
- version: 1,
237
- member: "tool",
238
- name: "write",
239
- operation: "run",
240
- args: [],
241
- targetDeviceId: (0, utils_1.newid)(),
242
- })).rejects.toThrow("cannot target another device");
243
- expect(resolveEndpoint).not.toHaveBeenCalled();
244
- }
245
- finally {
246
- router.dispose();
247
- }
248
- });
249
- });
250
- describe("declared tool authority propagation", () => {
251
- it.each([
252
- [60, undefined, 20, true, 60, true],
253
- [60, 20, 20, true, 40, false],
254
- [60, undefined, 20, false, 40, false],
255
- [0, undefined, undefined, true, 0, true],
256
- [0, undefined, undefined, true, 20, false],
257
- [20, undefined, 40, true, 20, false],
258
- ])("generic host propagation U=%s A=%s entry=%s preserve=%s target=%s", async (userLevel, ceiling, entryLevel, preserve, targetLevel, allowed) => {
259
- const group = groupContext();
260
- group.setRole(userLevel);
261
- const effect = jest.fn(() => "executed");
262
- const router = hop("route", entryLevel, "target");
263
- if (preserve)
264
- Object.assign(router.tool, { authorityPropagation: "preserve" });
265
- const contractId = (0, utils_1.newid)();
266
- const dispatch = (0, contract_proxy_1.createContractProvider)({ contractId, version: 1, tools: { route: router }, forwardCallContext: true }, { dispatchTool: (0, target_dispatch_1.targetDispatch)(TARGETS, { target: tool("target", targetLevel, effect) }) });
267
- const result = dispatch({ contractId, version: 1, member: "tool", name: "route", operation: "run", args: [{}] }, {
268
- callerUserId: group.userId,
269
- dataContext: group.dataContext,
270
- authority: { userAccessLevel: userLevel, assistantAccessLevel: ceiling },
271
- });
272
- if (allowed)
273
- await expect(result).resolves.toBe("executed");
274
- else
275
- await expect(result).rejects.toThrow(/Permission denied/);
276
- expect(effect).toHaveBeenCalledTimes(allowed ? 1 : 0);
277
- });
278
- it("honors declared preserve on Voice Hub's voice-hub-run-action without raising an inherited ceiling", async () => {
279
- const contractId = VOICE_HUB_CONTRACT_ID;
280
- const version = 4;
281
- const name = "voice-hub-run-action";
282
- const group = groupContext();
283
- const effect = jest.fn(() => ({ writerTargetExecuted: true }));
284
- const resolution = {
285
- contractId,
286
- version,
287
- forwardCallContext: true,
288
- tools: { [name]: hop(name, 20, "write") },
289
- };
290
- const dispatchTool = (0, target_dispatch_1.targetDispatch)(TARGETS, { write: tool("write", 40, effect) });
291
- const call = {
292
- contractId,
293
- version,
294
- member: "tool",
295
- name,
296
- operation: "run",
297
- args: [{}],
298
- };
299
- const context = { callerUserId: group.userId, dataContext: group.dataContext };
300
- // An ordinary Reader wrapper caps a direct Writer at Reader inside the action scope.
301
- const capped = (0, contract_proxy_1.createContractProvider)(resolution, { dispatchTool });
302
- await expect(capped(call, context)).rejects.toThrow("Permission denied: strict delegation");
303
- expect(effect).not.toHaveBeenCalled();
304
- // The same wrapper declared preserve passes the Writer through to a Writer target.
305
- Object.assign(resolution.tools[name].tool, { authorityPropagation: "preserve" });
306
- const preserving = (0, contract_proxy_1.createContractProvider)(resolution, { dispatchTool });
307
- await expect(preserving(call, context)).resolves.toEqual({ writerTargetExecuted: true });
308
- // An inherited Reader frame from an upstream ordinary tool is never raised.
309
- await expect(preserving(call, {
310
- ...context,
311
- authority: {
312
- userAccessLevel: 40,
313
- assistantAccessLevel: 20,
314
- strictActionScope: true,
315
- },
316
- })).rejects.toThrow("Permission denied: strict delegation");
317
- expect(effect).toHaveBeenCalledTimes(1);
318
- });
319
- });
@@ -1 +0,0 @@
1
- export {};
@@ -1,110 +0,0 @@
1
- "use strict";
2
- Object.defineProperty(exports, "__esModule", { value: true });
3
- const field_type_1 = require("../../types/field-type");
4
- const utils_1 = require("../../utils");
5
- const registry_1 = require("../registry");
6
- const validate_1 = require("../validate");
7
- const contractId = (0, utils_1.newid)();
8
- /** Notes vN with one `add` tool taking `inputs`, returning `outputs`, and one `Notes` table. */
9
- function notes(version, { inputs = [], outputs = [], rows = [], } = {}, devTag) {
10
- return {
11
- contractId,
12
- version,
13
- ...(devTag ? { devTag } : {}),
14
- name: "Notes",
15
- description: "",
16
- tables: [
17
- {
18
- name: "Notes",
19
- description: "",
20
- primaryKeyName: "noteId",
21
- fields: [{ name: "noteId", type: field_type_1.FieldType.id }, ...rows],
22
- },
23
- ],
24
- tools: [{ name: "add", usageDescription: "Add.", inputFields: inputs, outputFields: outputs }],
25
- observables: [],
26
- events: [],
27
- };
28
- }
29
- const field = (name, optional = false) => ({
30
- name,
31
- type: field_type_1.FieldType.string,
32
- ...(optional ? { optional } : {}),
33
- });
34
- describe("alsoImplements compatibility, by what callers send and receive", () => {
35
- const satisfies = (implementation, target) => (0, validate_1.validateProviderSatisfiesContract)(implementation, target).valid;
36
- it("lets an input become optional, but not an optional one required", () => {
37
- expect(satisfies(notes(2, { inputs: [field("title", true)] }), notes(1, { inputs: [field("title")] }))).toBe(true);
38
- expect(satisfies(notes(2, { inputs: [field("title")] }), notes(1, { inputs: [field("title", true)] }))).toBe(false);
39
- });
40
- it("keeps a required output required, and a table field's optionality as it was", () => {
41
- expect(satisfies(notes(2, { outputs: [field("id", true)] }), notes(1, { outputs: [field("id")] }))).toBe(false);
42
- expect(satisfies(notes(2, { outputs: [field("id")] }), notes(1, { outputs: [field("id", true)] }))).toBe(true);
43
- expect(satisfies(notes(2, { rows: [field("title", true)] }), notes(1, { rows: [field("title")] }))).toBe(false);
44
- expect(satisfies(notes(2, { rows: [field("title")] }), notes(1, { rows: [field("title", true)] }))).toBe(false);
45
- });
46
- it("keeps a required event payload field required, while allowing optional ones to become required", () => {
47
- const event = (optional) => ({
48
- ...notes(1),
49
- events: [{ name: "added", description: "", payloadFields: [field("title", optional)] }],
50
- });
51
- expect(satisfies(event(true), event(false))).toBe(false);
52
- expect(satisfies(event(false), event(true))).toBe(true);
53
- });
54
- });
55
- describe("a carried alsoImplements definition", () => {
56
- const providerId = (0, utils_1.newid)();
57
- const v1 = notes(1, { inputs: [field("title")] });
58
- const v2 = notes(2, { inputs: [field("title"), field("tag", true)] });
59
- const alias = (definition = v1) => ({
60
- definition: v2,
61
- alsoImplements: [{ contractId, version: 1, definition }],
62
- });
63
- it("registers the target when the registry has none, and keeps one it already has", () => {
64
- const cold = new registry_1.ContractRegistry();
65
- expect(cold.registerBatch(providerId, [alias()]).valid).toBe(true);
66
- expect(cold.getDefinition(contractId, 1)).toEqual(v1);
67
- expect(cold.getProviderImplementation(contractId, 1, providerId)).toEqual({
68
- contractId,
69
- version: 2,
70
- });
71
- const warm = new registry_1.ContractRegistry();
72
- const devV1 = { ...v1, devTag: "dev" };
73
- warm.registerBatch((0, utils_1.newid)(), [{ definition: devV1 }]);
74
- warm.registerBatch(providerId, [alias()]);
75
- expect(warm.getDefinition(contractId, 1)).toEqual(devV1);
76
- });
77
- it("must match a frozen registered target, and be the version it declares", () => {
78
- const registry = new registry_1.ContractRegistry();
79
- registry.registerBatch((0, utils_1.newid)(), [{ definition: v1 }]);
80
- const changed = notes(1, { inputs: [field("title"), field("body", true)] });
81
- const refused = registry.registerBatch(providerId, [alias(changed)]);
82
- expect(refused.valid).toBe(false);
83
- expect(refused.errors[0].message).toContain("is frozen and cannot be modified");
84
- expect(registry.getProviderPackageId(contractId, 2)).toBeUndefined();
85
- const mislabeled = new registry_1.ContractRegistry().registerBatch(providerId, [
86
- alias(notes(3, { inputs: [field("title")] })),
87
- ]);
88
- expect(mislabeled.errors[0].message).toContain("alsoImplements carries a definition that isn't");
89
- });
90
- });
91
- test("legacy ranges retain explicitly provided handlers and alias the remaining versions", () => {
92
- const registry = new registry_1.ContractRegistry();
93
- const providerId = (0, utils_1.newid)();
94
- expect(registry.register((0, utils_1.newid)(), notes(2)).valid).toBe(true);
95
- expect(registry.registerBatch(providerId, [
96
- { definition: notes(1) },
97
- {
98
- definition: notes(3),
99
- alsoImplements: [{ contractId, version: { from: 1, to: 2 } }],
100
- },
101
- ]).valid).toBe(true);
102
- expect(registry.getProviderImplementation(contractId, 1, providerId)).toEqual({
103
- contractId,
104
- version: 1,
105
- });
106
- expect(registry.getProviderImplementation(contractId, 2, providerId)).toEqual({
107
- contractId,
108
- version: 3,
109
- });
110
- });
@@ -1 +0,0 @@
1
- export {};