@peers-app/peers-sdk 0.27.4 → 0.27.5

package/dist/contracts/contract-transport.d.ts

@@ -63,7 +63,8 @@ export declare const CONTRACT_REQUEST_CHANNEL = "contractCall";
 export declare const CONTRACT_NOTIFY_CHANNEL = "contractNotify";
 /**
  * Wrap a duplex RPC emitter (e.g. a device {@link Connection}) as an
- * {@link IContractTransport}. `emit` delegates directly. `on` uses one adapter-owned
+ * {@link IContractTransport}. `emit` delegates directly and rejects with an `Error`
+ * carrying the remote message, whatever the emitter rejected with. `on` uses one adapter-owned
  * dispatcher per emitter/channel and returns an unsubscribe that removes only the caller's
  * handler from that dispatcher; it never uses a coarse `removeAllListeners`.
  *

package/dist/contracts/contract-transport.js

@@ -33,9 +33,24 @@ exports.CONTRACT_REQUEST_CHANNEL = "contractCall";
  */
 exports.CONTRACT_NOTIFY_CHANNEL = "contractNotify";
 const connectionDispatcherStates = new WeakMap();
+/**
+ * Turn a failed emit into an `Error`. A device connection rejects with the remote handler's
+ * `{ error, errorType }` envelope, or with a string when the call times out.
+ */
+function toError(error) {
+    if (error instanceof Error)
+        return error;
+    if (error &&
+        typeof error === "object" &&
+        typeof error.error === "string") {
+        return new Error(error.error);
+    }
+    return new Error(typeof error === "string" ? error : JSON.stringify(error));
+}
 /**
  * Wrap a duplex RPC emitter (e.g. a device {@link Connection}) as an
- * {@link IContractTransport}. `emit` delegates directly. `on` uses one adapter-owned
+ * {@link IContractTransport}. `emit` delegates directly and rejects with an `Error`
+ * carrying the remote message, whatever the emitter rejected with. `on` uses one adapter-owned
  * dispatcher per emitter/channel and returns an unsubscribe that removes only the caller's
  * handler from that dispatcher; it never uses a coarse `removeAllListeners`.
  *
@@ -53,7 +68,14 @@ const connectionDispatcherStates = new WeakMap();
  */
 function connectionContractTransport(emitter) {
     return {
-        emit: (channel, ...args) => emitter.emit(channel, ...args),
+        emit: async (channel, ...args) => {
+            try {
+                return await emitter.emit(channel, ...args);
+            }
+            catch (error) {
+                throw toError(error);
+            }
+        },
         on: (channel, handler) => {
             let channelStates = connectionDispatcherStates.get(emitter);
             if (!channelStates) {

package/dist/contracts/tool-catalog.js

@@ -179,13 +179,17 @@ function validateToolCatalogWrite(existing, candidate, recordId = candidate?.too
         !isMissingTargetQuarantine(existing) &&
         isMissingTargetQuarantine(candidate))
         throw new Error(`Quarantined tool identity: ${candidate.toolId}`);
-    // Quarantine preserves the original evidence byte-for-byte; it cannot retarget it.
+    // Quarantine preserves the original evidence byte-for-byte; it cannot retarget it. That
+    // includes an existing quarantine's reason: a peer's resolve patch whose `catalogReason`
+    // half arrives first must park, not erase the missing-target reason its other half needs.
     if (existing &&
         candidate.catalogState === "quarantined" &&
         existing.contractId === candidate.contractId &&
         existing.contractVersion === candidate.contractVersion &&
         existing.toolName === candidate.toolName &&
-        existing.catalogIdentity === candidate.catalogIdentity)
+        existing.catalogIdentity === candidate.catalogIdentity &&
+        (existing.catalogState !== "quarantined" ||
+            (existing.catalogReason ?? undefined) === (candidate.catalogReason ?? undefined)))
         return;
     // Changing quarantined identity evidence also requires an approved repair, even
     // when the candidate stays quarantined and would be resolved by reconciliation.

package/dist/device/binary-peer-connection-v2.d.ts

@@ -1,15 +1,15 @@
 /**
  * binary-peer-connection-v2.ts
  *
- * Unified binary transport layer that replaces both binary-peer-connection.ts
- * and streamed-socket.ts. Provides two cleanly separated modes:
+ * Binary transport layer under every device connection. Provides two cleanly
+ * separated modes:
  *
  * 1. **RPC mode** (emit/on): request/response interactions with automatic
  *    encoding (txEncode for objects, passthrough for Uint8Array) and transparent
  *    chunking for large payloads.
  *
  * 2. **Stream mode** (sendRawBytes/onRawBytes): continuous byte transfer for
- *    file syncing, database downloads, log streaming, etc. Each sendRawBytes
+ *    file syncing, log streaming, etc. Each sendRawBytes
  *    call = exactly one onRawBytes callback (atomic delivery after reassembly).
  *
  * Both modes share a single sendFrame() function that handles backpressure
@@ -61,19 +61,12 @@ export declare const DEFAULT_BINARY_PEER_RECEIVE_LIMITS: Readonly<BinaryPeerRece
 export interface WrapBinaryPeerOptions {
     /** Protocol identifier used for server address (e.g., 'wrtc' or 'ws') */
     protocol: "wrtc" | "ws";
-    /**
-     * Mark the transport as already secure (encrypted at transport layer).
-     * When true, sets secureLocal and secureRemote to skip the legacy per-message
-     * envelope against a legacy peer. Irrelevant once the frame cipher is armed.
-     * @deprecated Removed with the legacy path.
-     */
-    markTransportSecure?: boolean;
     /** Optional hard limits for untrusted inbound messages. */
     receiveLimits?: Partial<BinaryPeerReceiveLimits>;
 }
 /**
  * Creates an ISocket from a binary peer. This is the core v2 factory function.
- * Replaces both createBinaryPeerSocket (v1) and StreamedSocket.
+ * Used for every device connection.
  */
 export declare function createBinaryPeerSocket(connectionId: string, peer: IBinaryPeer, protocol?: string, receiveLimitOverrides?: Partial<BinaryPeerReceiveLimits>): ISocket;
 /**
@@ -82,10 +75,9 @@ export declare function createBinaryPeerSocket(connectionId: string, peer: IBina
  */
 export declare function wrapBinaryPeer(connectionId: string, peer: IBinaryPeer, localDevice: Device, initiator: boolean, options: WrapBinaryPeerOptions, getTrustLevel?: ITrustLevelFn): Connection;
 /**
- * Wraps a WebRTC peer into a Connection.
- * WebRTC is encrypted at the transport layer (DTLS-SRTP); the frame cipher is
- * armed on top of it by the handshake so no code path depends on transport
- * classification.
+ * Wraps a WebRTC peer into a Connection. WebRTC is encrypted at the transport
+ * layer (DTLS-SRTP); the handshake arms the frame cipher on top of it, as on
+ * every transport.
  */
 export declare function wrapWrtc(connectionId: string, peer: IWebRTCPeer, localDevice: Device, initiator: boolean, getTrustLevel?: ITrustLevelFn, receiveLimits?: Partial<BinaryPeerReceiveLimits>): Connection;
 export {};

package/dist/device/binary-peer-connection-v2.js

@@ -2,15 +2,15 @@
 /**
  * binary-peer-connection-v2.ts
  *
- * Unified binary transport layer that replaces both binary-peer-connection.ts
- * and streamed-socket.ts. Provides two cleanly separated modes:
+ * Binary transport layer under every device connection. Provides two cleanly
+ * separated modes:
  *
  * 1. **RPC mode** (emit/on): request/response interactions with automatic
  *    encoding (txEncode for objects, passthrough for Uint8Array) and transparent
  *    chunking for large payloads.
  *
  * 2. **Stream mode** (sendRawBytes/onRawBytes): continuous byte transfer for
- *    file syncing, database downloads, log streaming, etc. Each sendRawBytes
+ *    file syncing, log streaming, etc. Each sendRawBytes
  *    call = exactly one onRawBytes callback (atomic delivery after reassembly).
  *
  * Both modes share a single sendFrame() function that handles backpressure
@@ -240,7 +240,7 @@ function buildStreamCont(sidBytes, chunkData) {
 }
 /**
  * Creates an ISocket from a binary peer. This is the core v2 factory function.
- * Replaces both createBinaryPeerSocket (v1) and StreamedSocket.
+ * Used for every device connection.
  */
 function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receiveLimitOverrides = {}) {
     const handlers = {};
@@ -265,7 +265,7 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
     let sendSealer = null;
     let receiveOpener = null;
     // Bare sockets (no Connection) deliver plaintext streams; Connection turns
-    // this off and re-enables it only for a verified legacy peer.
+    // this off, so it receives only sealed stream frames.
     let plaintextStreamsAllowed = true;
     // Every inner frame must leave room for the cipher's 17 bytes so a sealed
     // frame never exceeds the transport limit (64 KB SCTP on WebRTC). Reserved
@@ -503,7 +503,7 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
                     else
                         responseMessage.result = result;
                     const encoded = encodeMessage(responseMessage);
-                    sendRPC(encoded, sendOptions);
+                    return sendRPC(encoded, sendOptions);
                 };
                 handler(message.args, callback);
             }
@@ -730,17 +730,8 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
                     break;
                 }
                 default: {
-                    // v1 backwards compatibility: if frame type isn't recognized but looks
-                    // like a v1 PROTOCOL_RPC (0x00) it's already handled above. For true
-                    // legacy format (no discriminator), try to decode as RPC.
-                    // This handles the transition period where v1 peers send raw RPC without
-                    // a frame type byte.
-                    if (bytes.length > receiveLimits.maxRpcMessageBytes) {
-                        closeForProtocolViolation("legacy RPC exceeds the message-size limit");
-                        return;
-                    }
-                    handleIncomingRPC(bytes);
-                    break;
+                    closeForProtocolViolation(`unknown frame type ${frameType}`);
+                    return;
                 }
             }
         }
@@ -762,7 +753,6 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
     const socket = {
         id: connectionId,
         connected: true,
-        handlesOwnEncoding: true,
         transportType,
         stats,
         armFrameCipher,
@@ -811,26 +801,20 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
  * This is the main implementation that handles all binary protocols.
  */
 function wrapBinaryPeer(connectionId, peer, localDevice, initiator, options, getTrustLevel) {
-    const { protocol, markTransportSecure, receiveLimits } = options;
+    const { protocol, receiveLimits } = options;
     const socket = createBinaryPeerSocket(connectionId, peer, protocol, receiveLimits);
     const serverAddress = `${protocol}://${connectionId}`;
     const localServerAddresses = initiator ? undefined : [serverAddress];
     if (process.env.NODE_ENV !== "test") {
         getTrustLevel ??= (0, get_trust_level_fn_1.getTrustLevelFn)(localDevice, serverAddress);
     }
-    const connection = new connection_1.Connection(socket, localDevice, localServerAddresses, getTrustLevel);
-    if (markTransportSecure) {
-        connection.secureLocal = true;
-        connection.secureRemote = true;
-    }
-    return connection;
+    return new connection_1.Connection(socket, localDevice, localServerAddresses, getTrustLevel);
 }
 /**
- * Wraps a WebRTC peer into a Connection.
- * WebRTC is encrypted at the transport layer (DTLS-SRTP); the frame cipher is
- * armed on top of it by the handshake so no code path depends on transport
- * classification.
+ * Wraps a WebRTC peer into a Connection. WebRTC is encrypted at the transport
+ * layer (DTLS-SRTP); the handshake arms the frame cipher on top of it, as on
+ * every transport.
  */
 function wrapWrtc(connectionId, peer, localDevice, initiator, getTrustLevel, receiveLimits) {
-    return wrapBinaryPeer(connectionId, peer, localDevice, initiator, { protocol: "wrtc", markTransportSecure: true, receiveLimits }, getTrustLevel);
+    return wrapBinaryPeer(connectionId, peer, localDevice, initiator, { protocol: "wrtc", receiveLimits }, getTrustLevel);
 }

package/dist/device/connection.d.ts

@@ -8,12 +8,10 @@ export type GetTrustLevel = (deviceInfo: IDeviceInfo, registerNew?: boolean) =>
  * Authenticated RPC connection between two Peers devices.
  *
  * The handshake (`doHandshake` on the client, `completeHandshake` on the
- * server) authenticates both identities with signed, boxed messages. When both
- * sockets support it, the handshake also agrees on per-connection frame-cipher
- * keys (`frame-cipher.ts`) and arms the socket, after which every frame on the
- * wire is sealed and the legacy per-message sign+box envelope is skipped.
- * Against a peer that does not advertise `frameCrypto` the connection falls
- * back to the legacy behaviour and logs a warning.
+ * server) authenticates both identities with signed, boxed messages and agrees
+ * on per-connection frame-cipher keys (`frame-cipher.ts`), then arms the
+ * socket: every frame after the handshake is sealed. A peer that does not
+ * offer frame encryption (a build before 0.25.7) is refused.
  */
 export declare class Connection {
     readonly localDevice: Device;
@@ -21,23 +19,9 @@ export declare class Connection {
     protected readonly getTrustLevel: GetTrustLevel;
     private _verified;
     private _remoteDeviceInfo;
-    /**
-     * @deprecated Legacy transport classification, only consulted when the frame
-     * cipher is not armed. Removed once legacy peers are no longer supported.
-     */
-    secureLocal: boolean;
-    /** @deprecated See {@link Connection.secureLocal}. */
-    secureRemote: boolean;
-    /**
-     * Legacy per-message encryption override. Ignored once the frame cipher is
-     * armed. `"dont-encrypt-traffic-after-handshake"` is honoured only under
-     * `NODE_ENV=test`.
-     * @deprecated Removed with the legacy path.
-     */
-    overrideEncryption?: "encrypt-traffic-regardless-of-protocol" | "dont-encrypt-traffic-after-handshake";
     /** Trust assigned to the remote identity once the handshake completes. */
     trustLevel: TrustLevel;
-    /** Server-side hook fired shortly after a successful handshake. */
+    /** Server-side hook fired shortly after the successful handshake reply has been sent. */
     onHandshakeComplete: ((deviceInfo: IDeviceInfo) => void) | undefined;
     /** RPC timeout for {@link Connection.emit}. */
     timeoutMs: number;
@@ -53,21 +37,13 @@ export declare class Connection {
     private pendingClientHandshake;
     /** Server side: keys to arm for sending right after the handshake response frame. */
     private pendingSendArm;
+    /** Bumped by every {@link Connection.reset}, so a handshake can tell it was cut short. */
+    private handshakeGeneration;
     constructor(socket: ISocket, localDevice: Device, localDeviceServerAddresses?: string[] | undefined, getTrustLevel?: GetTrustLevel);
     /** True once the remote identity has been authenticated by the handshake. */
     get verified(): boolean;
     /** True when every frame on this connection is sealed by the frame cipher. */
     get frameCipherArmed(): boolean;
-    /**
-     * Whether to apply the legacy per-message envelope (sign + box) to RPC payloads.
-     *
-     * Always false once the frame cipher is armed: the frame layer already gives
-     * confidentiality, integrity, and sender binding for every frame. Otherwise
-     * (legacy peer) the transport classification below applies:
-     * - skipped when both sides agreed the transport is secure (`secureLocal && secureRemote`)
-     * - applied on plain `ws` / `http`
-     */
-    get encryptTraffic(): boolean;
     /** Copy of the authenticated remote device identity (empty before the handshake). */
     get remoteDeviceInfo(): {
         publicKey: string;
@@ -79,8 +55,8 @@ export declare class Connection {
     };
     /** Socket ID shared by both ends; also the frame-cipher AAD and HKDF salt. */
     get connectionId(): string;
-    private get supportsFrameCrypto();
-    private warnLegacyPeer;
+    /** The socket's frame-cipher arming; throws when the transport can't encrypt frames. */
+    private requireFrameCipher;
     private readonly handleCompleteHandshakeRPC;
     /**
      * Get connection throughput stats with calculated rates.
@@ -105,10 +81,15 @@ export declare class Connection {
     exposeRPC<T extends Function>(fn: T): void;
     /** Calls a remote RPC handler and resolves with its result (rejects on error or timeout). */
     emit<T = any>(eventName: string, ...args: any): Promise<T>;
+    /**
+     * Sends one RPC. `onReply`, when given, runs synchronously while the reply frame is
+     * processed, before any later frame from the peer; its return value (or throw) settles
+     * the call.
+     */
+    private request;
     /**
      * Registers an RPC handler. Events other than the handshake set are rejected
-     * until the connection is verified; payloads use the legacy envelope only
-     * when {@link Connection.encryptTraffic} is true.
+     * until the connection is verified.
      */
     on(eventName: string, handler: Function): void;
     /** Removes RPC handlers for `eventName`, or all handlers when omitted. */
@@ -120,26 +101,36 @@ export declare class Connection {
      */
     reset(): void;
     /**
-     * Client side: builds the signed handshake (advertising frame-cipher support
-     * with a fresh ephemeral key when the socket can arm one) and boxes it to the
-     * remote device.
+     * Client side: builds the signed handshake (offering frame encryption with a
+     * fresh ephemeral key) and boxes it to the remote device.
      */
     initiateHandshake(serverAddress: string, remoteDeviceInfo?: IDeviceInfo): IDataBox;
     /**
      * Server side: verifies the client's handshake, resolves trust, and returns
-     * the (unsigned) response for the caller to sign and box. When the client
-     * offered `frameCrypto` and this socket can arm a cipher, derives the frame
+     * the (unsigned) response for the caller to sign and box. Derives the frame
      * keys, arms the receive direction immediately, and schedules the send
      * direction to arm right after the response frame (see
-     * {@link Connection.handleCompleteHandshakeRPC}).
+     * {@link Connection.handleCompleteHandshakeRPC}). A client that does not
+     * offer frame encryption is refused.
      */
     completeHandshake(boxedHandshake: IDataBox): Promise<IDeviceHandshake>;
     /**
      * Client side: runs the full handshake against `remoteAddress`. On success
-     * the remote identity is verified and, if both sockets support it, the
-     * frame cipher is armed in both directions before this resolves.
+     * the remote identity is verified and the frame cipher is armed in both
+     * directions before this resolves.
      */
     doHandshake(remoteAddress: string): Promise<IDeviceHandshake>;
+    /**
+     * Client side: checks the server's handshake reply, arms the frame cipher, and records the
+     * verified identity. Runs synchronously while the reply frame is processed, so a sealed
+     * frame read right after it finds the cipher armed and the connection verified.
+     */
+    private acceptHandshakeReply;
+    /**
+     * Throws when the connection was reset or closed after the handshake started: a handshake
+     * cut short must fail, not finish on a dead or reused connection.
+     */
+    private assertHandshakeCurrent;
     /**
      * Resets this side and asks the remote to do the same. The remote call is a courtesy: a
      * peer that is not a server has no `reset` handler, and a peer we just refused may already