@peers-app/peers-sdk 0.27.4 → 0.28.0

package/dist/data/sync-recovery-queue.d.ts

@@ -10,7 +10,7 @@ export declare const SYNC_RECOVERY_STUCK_ATTEMPTS = 5;
 /** How long a still-retrying entry must have been failing before it is stuck. */
 export declare const SYNC_RECOVERY_STUCK_AGE_MS: number;
 /** Why automatic recovery stopped asking peers for an entry. */
-export declare const syncRecoveryParkedReasons: readonly ["schema", "unique-conflict", "unresolvable"];
+export declare const syncRecoveryParkedReasons: readonly ["schema", "unique-conflict", "unresolvable", "authorization"];
 /** Why automatic recovery stopped asking peers for an entry. */
 export type SyncRecoveryParkedReason = (typeof syncRecoveryParkedReasons)[number];
 /** One recorded materialization failure for a synchronized record. */
@@ -50,7 +50,7 @@ export declare const syncRecoveryEntrySchema: z.ZodObject<{
     }>, "many">;
     /** Set when peer retry has stopped. Absent while the entry is still retrying. */
     parkedAt: z.ZodOptional<z.ZodNumber>;
-    parkedReason: z.ZodOptional<z.ZodEnum<["schema", "unique-conflict", "unresolvable"]>>;
+    parkedReason: z.ZodOptional<z.ZodEnum<["schema", "unique-conflict", "unresolvable", "authorization"]>>;
     /** Earliest time a retrying entry should ask peers again. */
     nextAttemptAt: z.ZodOptional<z.ZodNumber>;
     /**
@@ -71,7 +71,7 @@ export declare const syncRecoveryEntrySchema: z.ZodObject<{
         sourceDeviceId?: string | undefined;
     }[];
     parkedAt?: number | undefined;
-    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | undefined;
+    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | "authorization" | undefined;
     nextAttemptAt?: number | undefined;
     sweepCount?: number | undefined;
 }, {
@@ -87,7 +87,7 @@ export declare const syncRecoveryEntrySchema: z.ZodObject<{
         sourceDeviceId?: string | undefined;
     }[];
     parkedAt?: number | undefined;
-    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | undefined;
+    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | "authorization" | undefined;
     nextAttemptAt?: number | undefined;
     sweepCount?: number | undefined;
 }>;

package/dist/data/sync-recovery-queue.js

@@ -20,7 +20,13 @@ exports.SYNC_RECOVERY_STUCK_ATTEMPTS = 5;
 /** How long a still-retrying entry must have been failing before it is stuck. */
 exports.SYNC_RECOVERY_STUCK_AGE_MS = 10 * 60 * 1000;
 /** Why automatic recovery stopped asking peers for an entry. */
-exports.syncRecoveryParkedReasons = ["schema", "unique-conflict", "unresolvable"];
+exports.syncRecoveryParkedReasons = [
+    "schema",
+    "unique-conflict",
+    "unresolvable",
+    /** A write check refused the row; rechecked from local history when the group's authority changes. */
+    "authorization",
+];
 /** One recorded materialization failure for a synchronized record. */
 exports.syncRecoveryFailureSchema = zod_1.z.object({
     error: zod_1.z.string(),

package/dist/data/tool-access-approvals.d.ts

@@ -50,8 +50,8 @@ export declare const toolAccessApprovalSchema: z.ZodObject<{
     toolName: string;
     toolId: string;
     scope: ToolAccessApprovalScope;
-    dataContextId: string;
     createdAt: Date;
+    dataContextId: string;
     expiresAt: Date;
     toolAccessApprovalId: string;
     argsHash: string;
@@ -81,8 +81,8 @@ export declare const toolAccessApprovalSchema: z.ZodObject<{
     };
     status?: ToolAccessApprovalStatus | undefined;
     scope?: ToolAccessApprovalScope | undefined;
-    assistantId?: string | undefined;
     createdAt?: Date | undefined;
+    assistantId?: string | undefined;
     workflowRunId?: string | undefined;
     workflowLogId?: string | undefined;
     threadMessageId?: string | undefined;
@@ -106,8 +106,8 @@ export declare function ToolAccessApprovals(dataContext?: DataContext): import("
     toolName: string;
     toolId: string;
     scope: ToolAccessApprovalScope;
-    dataContextId: string;
     createdAt: Date;
+    dataContextId: string;
     expiresAt: Date;
     toolAccessApprovalId: string;
     argsHash: string;

package/dist/data/user-permissions.d.ts

@@ -1,12 +1,33 @@
 import type { IUser } from "./users";
 /**
- * Signs a user object with the provided secret key. The `anchors` list is kept on the row
- * but is not covered by the signature; see {@link verifyUserSignature}.
+ * Signs a user's profile and separately signs its initial anchor list. Later anchor changes
+ * are still authorized by the anchors on record; see {@link verifyUserSignature}.
  * @param user The user object to sign
  * @param secretKey The secret key to sign with
  * @returns IUser The signed user object
  */
 export declare function signUserObject(user: IUser, secretKey: string): IUser;
+/** Whether the profile owner authorized this exact initial anchor list, before any anchors exist. */
+export declare function hasSignedUserAnchors(user: IUser): boolean;
+/**
+ * Whether a Users row is signed by its own `publicKey` (its anchor list is not signed): the
+ * only rows a group's authority takes a member's key from.
+ *
+ * @param user - A Users row.
+ */
+export declare function isSelfSignedUser(user: IUser): boolean;
+/**
+ * Whether two profiles or authenticated devices name the same user and both of their keys.
+ * This compares identity only; callers still verify signatures or the transport separately.
+ */
+export declare function sameUserIdentity(a: Pick<IUser, "userId" | "publicKey" | "publicBoxKey">, b: Pick<IUser, "userId" | "publicKey" | "publicBoxKey">): boolean;
+/**
+ * `source`'s anchor list with the owner's signature over it, to spread onto a profile or an
+ * invite identity; nothing when `source` has no list.
+ *
+ * @param source - The row or identity the list is taken from.
+ */
+export declare function anchorFields(source: Pick<IUser, "anchors" | "anchorsSignature">): Pick<IUser, "anchors" | "anchorsSignature">;
 /**
  * Verifies that a user update signature is valid, throws on invalid signature.
  * The `anchors` list is not part of what is verified.
@@ -21,3 +42,13 @@ export declare function verifyUserSignature(user: IUser, oldUser?: IUser): void;
  * @throws Error if the signature is missing, invalid, or by another key
  */
 export declare function verifyUserSignedBySelf(user: IUser): void;
+/**
+ * Whether `user`'s current key is `earlierKey`, or was handed over from it: `earlierKey` is in
+ * `keySuccession` and each link from there on is signed by its key and names the next (the
+ * last names `publicKey`). A forged profile can't produce this, since only the holder of
+ * `earlierKey` can sign its handover. The list itself sits under the profile's own signature.
+ *
+ * @param user - A profile row whose own signature has been checked.
+ * @param earlierKey - The key a grant or record names.
+ */
+export declare function keySucceeds(user: IUser, earlierKey: string): boolean;

package/dist/data/user-permissions.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signUserObject = signUserObject;
+exports.hasSignedUserAnchors = hasSignedUserAnchors;
+exports.isSelfSignedUser = isSelfSignedUser;
+exports.sameUserIdentity = sameUserIdentity;
+exports.anchorFields = anchorFields;
 exports.verifyUserSignature = verifyUserSignature;
 exports.verifyUserSignedBySelf = verifyUserSignedBySelf;
+exports.keySucceeds = keySucceeds;
+const anchor_document_1 = require("../identity/anchor-document");
 const keys_1 = require("../keys");
 /**
- * The part of a `Users` row the owner signs: everything but `anchors`.
+ * The profile the owner signs: everything but the separately authorized anchor list.
  *
  * The anchor list on record is decided by the anchors themselves (the on-record rule), not
  * by whoever wrote the row. A peer that confirms a key change stores the row with the list
@@ -13,19 +19,68 @@ const keys_1 = require("../keys");
  * must still verify, so the list is carried beside the signature rather than under it.
  */
 function signedPart(user) {
-    const { anchors: _anchors, ...rest } = user;
+    const { anchors: _anchors, anchorsSignature: _anchorsSignature, ...rest } = user;
     return rest;
 }
 /**
- * Signs a user object with the provided secret key. The `anchors` list is kept on the row
- * but is not covered by the signature; see {@link verifyUserSignature}.
+ * Signs a user's profile and separately signs its initial anchor list. Later anchor changes
+ * are still authorized by the anchors on record; see {@link verifyUserSignature}.
  * @param user The user object to sign
  * @param secretKey The secret key to sign with
  * @returns IUser The signed user object
  */
 function signUserObject(user, secretKey) {
     const signed = (0, keys_1.addSignatureToObject)(signedPart(user), secretKey);
-    return user.anchors ? { ...signed, anchors: user.anchors } : signed;
+    return user.anchors
+        ? {
+            ...signed,
+            anchors: user.anchors,
+            anchorsSignature: (0, keys_1.addSignatureToObject)(anchorStatement(user), secretKey).signature,
+        }
+        : signed;
+}
+function anchorStatement(user) {
+    return {
+        purpose: "peers-user-anchors",
+        userId: user.userId,
+        publicKey: user.publicKey,
+        anchors: user.anchors ?? [],
+    };
+}
+/** Whether the profile owner authorized this exact initial anchor list, before any anchors exist. */
+function hasSignedUserAnchors(user) {
+    const statement = { ...anchorStatement(user), signature: user.anchorsSignature };
+    return !!user.publicKey && (0, keys_1.signedByKey)(statement) === user.publicKey;
+}
+/**
+ * Whether a Users row is signed by its own `publicKey` (its anchor list is not signed): the
+ * only rows a group's authority takes a member's key from.
+ *
+ * @param user - A Users row.
+ */
+function isSelfSignedUser(user) {
+    return !!user.publicKey && (0, keys_1.signedByKey)(signedPart(user)) === user.publicKey;
+}
+/**
+ * Whether two profiles or authenticated devices name the same user and both of their keys.
+ * This compares identity only; callers still verify signatures or the transport separately.
+ */
+function sameUserIdentity(a, b) {
+    return a.userId === b.userId && a.publicKey === b.publicKey && a.publicBoxKey === b.publicBoxKey;
+}
+/**
+ * `source`'s anchor list with the owner's signature over it, to spread onto a profile or an
+ * invite identity; nothing when `source` has no list.
+ *
+ * @param source - The row or identity the list is taken from.
+ */
+function anchorFields(source) {
+    if (!source.anchors?.length)
+        return {};
+    return {
+        anchors: source.anchors,
+        ...(source.anchorsSignature ? { anchorsSignature: source.anchorsSignature } : {}),
+    };
 }
 /**
  * Verifies that a user update signature is valid, throws on invalid signature.
@@ -69,9 +124,31 @@ function verifyUserSignedBySelf(user) {
     if (!user.signature) {
         throw new Error("A confirmed key change still has to be signed by the new key");
     }
-    (0, keys_1.verifyObjectSignature)(signedPart(user));
-    const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(user) ?? "";
-    if (signerPublicKey !== user.publicKey) {
-        throw new Error("User signature must be signed with their own public key");
-    }
+    verifyUserSignature(user);
+}
+/**
+ * Whether `user`'s current key is `earlierKey`, or was handed over from it: `earlierKey` is in
+ * `keySuccession` and each link from there on is signed by its key and names the next (the
+ * last names `publicKey`). A forged profile can't produce this, since only the holder of
+ * `earlierKey` can sign its handover. The list itself sits under the profile's own signature.
+ *
+ * @param user - A profile row whose own signature has been checked.
+ * @param earlierKey - The key a grant or record names.
+ */
+function keySucceeds(user, earlierKey) {
+    if (user.publicKey === earlierKey)
+        return true;
+    const links = user.keySuccession ?? [];
+    const start = links.findIndex((link) => link.publicKey === earlierKey);
+    if (start < 0)
+        return false;
+    return links.slice(start).every((link, i, rest) => (0, anchor_document_1.verifySuccession)({
+        userId: user.userId,
+        recordPublicKey: link.publicKey,
+        entry: {
+            publicKey: rest[i + 1]?.publicKey ?? user.publicKey,
+            issuedAt: link.issuedAt,
+            authorizedBy: { publicKey: link.publicKey, signature: link.signature },
+        },
+    }));
 }

package/dist/data/users.d.ts

@@ -1,7 +1,29 @@
 import { z } from "zod";
 import type { DataContext } from "../context/data-context";
+import type { UserRowChangeDecision } from "../identity/user-row-change";
 import type { ISaveOptions } from "./orm/data-query";
 import { Table } from "./orm/table";
+/** Most earlier keys a profile carries; a rotation past this drops the oldest. */
+export declare const MAX_KEY_SUCCESSION = 8;
+/**
+ * One earlier key and its handover: `signature` is that key's signature over the
+ * `peers-key-succession` statement naming the next key (see `signSuccession`).
+ */
+export declare const keySuccessionLinkSchema: z.ZodObject<{
+    publicKey: z.ZodString;
+    issuedAt: z.ZodString;
+    signature: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    publicKey: string;
+    signature: string;
+    issuedAt: string;
+}, {
+    publicKey: string;
+    signature: string;
+    issuedAt: string;
+}>;
+/** One earlier key and its signed handover to the next. */
+export type IKeySuccessionLink = z.infer<typeof keySuccessionLinkSchema>;
 /** Schema for a signed user profile. */
 export declare const userSchema: z.ZodObject<{
     userId: z.ZodEffects<z.ZodString, string, string>;
@@ -18,6 +40,20 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }>, "many">>;
+    anchorsSignature: z.ZodOptional<z.ZodString>;
+    keySuccession: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        publicKey: z.ZodString;
+        issuedAt: z.ZodString;
+        signature: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }, {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }>, "many">>;
     signature: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     name: string;
@@ -29,6 +65,12 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
+    keySuccession?: {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }[] | undefined;
 }, {
     name: string;
     publicKey: string;
@@ -39,6 +81,12 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
+    keySuccession?: {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }[] | undefined;
 }>;
 /** A signed user profile shared across personal and group contexts. */
 export type IUser = z.infer<typeof userSchema>;
@@ -47,24 +95,13 @@ export type IUser = z.infer<typeof userSchema>;
  * which would otherwise call the resolver again.
  */
 export declare function writeResolvedUserKey(dataContext: DataContext, user: IUser): Promise<IUser>;
-/** Outcome of a {@link UserRowChangeGuard}. See `resolveUserRowChange` in the identity module. */
-export type UserRowChangeVerdict = {
-    action: "apply";
-    row: IUser;
-} | {
-    action: "defer";
-    reason: string;
-} | {
-    action: "refuse";
-    reason: string;
-};
 /**
  * Consulted by {@link UsersTable.save} when another user's row already exists in the table.
  * Decides whether a different key or anchor list may be stored, against the anchors on
  * record. `apply` carries the row to store, whose `anchors` may have been replaced by the
  * list on record.
  */
-export type UserRowChangeGuard = (personalContext: DataContext, incoming: IUser, existing: IUser) => Promise<UserRowChangeVerdict>;
+export type UserRowChangeGuard = (personalContext: DataContext, incoming: IUser, existing: IUser) => Promise<UserRowChangeDecision>;
 /** Installs the identity check used by {@link UsersTable.save}. The identity module sets this. */
 export declare function setUserRowChangeGuard(guard: UserRowChangeGuard | undefined): void;
 /** User table with owner-signature enforcement outside the personal context. */

package/dist/data/users.js

@@ -34,7 +34,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     done = true;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UsersTable = exports.userSchema = void 0;
+exports.UsersTable = exports.userSchema = exports.keySuccessionLinkSchema = exports.MAX_KEY_SUCCESSION = void 0;
 exports.writeResolvedUserKey = writeResolvedUserKey;
 exports.setUserRowChangeGuard = setUserRowChangeGuard;
 exports.Users = Users;
@@ -50,6 +50,17 @@ const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
 const user_permissions_1 = require("./user-permissions");
+/** Most earlier keys a profile carries; a rotation past this drops the oldest. */
+exports.MAX_KEY_SUCCESSION = 8;
+/**
+ * One earlier key and its handover: `signature` is that key's signature over the
+ * `peers-key-succession` statement naming the next key (see `signSuccession`).
+ */
+exports.keySuccessionLinkSchema = zod_1.z.object({
+    publicKey: zod_1.z.string(),
+    issuedAt: zod_1.z.string(),
+    signature: zod_1.z.string(),
+});
 /** Schema for a signed user profile. */
 exports.userSchema = zod_1.z.object({
     userId: zod_types_1.zodPeerId,
@@ -62,6 +73,15 @@ exports.userSchema = zod_1.z.object({
         .array(anchor_document_1.anchorRefSchema)
         .optional()
         .describe("Anchors on record for this user. A peer that already has a list updates it from those anchors, not from a row that arrives with a new key. Not covered by the row's signature"),
+    anchorsSignature: zod_1.z
+        .string()
+        .optional()
+        .describe("Owner's signature authorizing the first anchor list"),
+    keySuccession: zod_1.z
+        .array(exports.keySuccessionLinkSchema)
+        .max(exports.MAX_KEY_SUCCESSION)
+        .optional()
+        .describe("This user's earlier signing keys, oldest first, each with its signature handing over to the next key (the last to publicKey). A group membership granted to an earlier key still counts for the current one"),
     signature: zod_1.z
         .string()
         .optional()

package/dist/data/workflows.d.ts

@@ -3,6 +3,7 @@ export declare function Workflows(dataContext?: DataContext): import("..").Table
     name: string;
     description: string;
     updatedAt: Date;
+    createdBy: string;
     createdAt: Date;
     workflowId: string;
     defaultAssistantId: string;
@@ -12,6 +13,5 @@ export declare function Workflows(dataContext?: DataContext): import("..").Table
         directCallToolId?: string | undefined;
         subWorkflowId?: string | undefined;
     }[];
-    createdBy: string;
     packageId?: string | undefined;
 }>;

package/dist/device/binary-peer-connection-v2.d.ts

@@ -1,15 +1,15 @@
 /**
  * binary-peer-connection-v2.ts
  *
- * Unified binary transport layer that replaces both binary-peer-connection.ts
- * and streamed-socket.ts. Provides two cleanly separated modes:
+ * Binary transport layer under every device connection. Provides two cleanly
+ * separated modes:
  *
  * 1. **RPC mode** (emit/on): request/response interactions with automatic
  *    encoding (txEncode for objects, passthrough for Uint8Array) and transparent
  *    chunking for large payloads.
  *
  * 2. **Stream mode** (sendRawBytes/onRawBytes): continuous byte transfer for
- *    file syncing, database downloads, log streaming, etc. Each sendRawBytes
+ *    file syncing, log streaming, etc. Each sendRawBytes
  *    call = exactly one onRawBytes callback (atomic delivery after reassembly).
  *
  * Both modes share a single sendFrame() function that handles backpressure
@@ -18,7 +18,7 @@
  * 3. **Frame cipher**: once `armFrameCipher` is called (by `Connection` after
  *    the handshake), every outbound frame is sealed as `FRAME_ENC` and every
  *    inbound frame must be sealed. See `frame-cipher.ts` and
- *    `working/transport-security.md`.
+ *    `working/done/transport-security.md`.
  */
 import { Connection } from "./connection";
 import type { Device } from "./device";
@@ -61,19 +61,12 @@ export declare const DEFAULT_BINARY_PEER_RECEIVE_LIMITS: Readonly<BinaryPeerRece
 export interface WrapBinaryPeerOptions {
     /** Protocol identifier used for server address (e.g., 'wrtc' or 'ws') */
     protocol: "wrtc" | "ws";
-    /**
-     * Mark the transport as already secure (encrypted at transport layer).
-     * When true, sets secureLocal and secureRemote to skip the legacy per-message
-     * envelope against a legacy peer. Irrelevant once the frame cipher is armed.
-     * @deprecated Removed with the legacy path.
-     */
-    markTransportSecure?: boolean;
     /** Optional hard limits for untrusted inbound messages. */
     receiveLimits?: Partial<BinaryPeerReceiveLimits>;
 }
 /**
  * Creates an ISocket from a binary peer. This is the core v2 factory function.
- * Replaces both createBinaryPeerSocket (v1) and StreamedSocket.
+ * Used for every device connection.
  */
 export declare function createBinaryPeerSocket(connectionId: string, peer: IBinaryPeer, protocol?: string, receiveLimitOverrides?: Partial<BinaryPeerReceiveLimits>): ISocket;
 /**
@@ -82,10 +75,9 @@ export declare function createBinaryPeerSocket(connectionId: string, peer: IBina
  */
 export declare function wrapBinaryPeer(connectionId: string, peer: IBinaryPeer, localDevice: Device, initiator: boolean, options: WrapBinaryPeerOptions, getTrustLevel?: ITrustLevelFn): Connection;
 /**
- * Wraps a WebRTC peer into a Connection.
- * WebRTC is encrypted at the transport layer (DTLS-SRTP); the frame cipher is
- * armed on top of it by the handshake so no code path depends on transport
- * classification.
+ * Wraps a WebRTC peer into a Connection. WebRTC is encrypted at the transport
+ * layer (DTLS-SRTP); the handshake arms the frame cipher on top of it, as on
+ * every transport.
  */
 export declare function wrapWrtc(connectionId: string, peer: IWebRTCPeer, localDevice: Device, initiator: boolean, getTrustLevel?: ITrustLevelFn, receiveLimits?: Partial<BinaryPeerReceiveLimits>): Connection;
 export {};

package/dist/device/binary-peer-connection-v2.js

@@ -2,15 +2,15 @@
 /**
  * binary-peer-connection-v2.ts
  *
- * Unified binary transport layer that replaces both binary-peer-connection.ts
- * and streamed-socket.ts. Provides two cleanly separated modes:
+ * Binary transport layer under every device connection. Provides two cleanly
+ * separated modes:
  *
  * 1. **RPC mode** (emit/on): request/response interactions with automatic
  *    encoding (txEncode for objects, passthrough for Uint8Array) and transparent
  *    chunking for large payloads.
  *
  * 2. **Stream mode** (sendRawBytes/onRawBytes): continuous byte transfer for
- *    file syncing, database downloads, log streaming, etc. Each sendRawBytes
+ *    file syncing, log streaming, etc. Each sendRawBytes
  *    call = exactly one onRawBytes callback (atomic delivery after reassembly).
  *
  * Both modes share a single sendFrame() function that handles backpressure
@@ -19,7 +19,7 @@
  * 3. **Frame cipher**: once `armFrameCipher` is called (by `Connection` after
  *    the handshake), every outbound frame is sealed as `FRAME_ENC` and every
  *    inbound frame must be sealed. See `frame-cipher.ts` and
- *    `working/transport-security.md`.
+ *    `working/done/transport-security.md`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_BINARY_PEER_RECEIVE_LIMITS = void 0;
@@ -240,7 +240,7 @@ function buildStreamCont(sidBytes, chunkData) {
 }
 /**
  * Creates an ISocket from a binary peer. This is the core v2 factory function.
- * Replaces both createBinaryPeerSocket (v1) and StreamedSocket.
+ * Used for every device connection.
  */
 function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receiveLimitOverrides = {}) {
     const handlers = {};
@@ -265,7 +265,7 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
     let sendSealer = null;
     let receiveOpener = null;
     // Bare sockets (no Connection) deliver plaintext streams; Connection turns
-    // this off and re-enables it only for a verified legacy peer.
+    // this off, so it receives only sealed stream frames.
     let plaintextStreamsAllowed = true;
     // Every inner frame must leave room for the cipher's 17 bytes so a sealed
     // frame never exceeds the transport limit (64 KB SCTP on WebRTC). Reserved
@@ -503,7 +503,7 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
                     else
                         responseMessage.result = result;
                     const encoded = encodeMessage(responseMessage);
-                    sendRPC(encoded, sendOptions);
+                    return sendRPC(encoded, sendOptions);
                 };
                 handler(message.args, callback);
             }
@@ -730,17 +730,8 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
                     break;
                 }
                 default: {
-                    // v1 backwards compatibility: if frame type isn't recognized but looks
-                    // like a v1 PROTOCOL_RPC (0x00) it's already handled above. For true
-                    // legacy format (no discriminator), try to decode as RPC.
-                    // This handles the transition period where v1 peers send raw RPC without
-                    // a frame type byte.
-                    if (bytes.length > receiveLimits.maxRpcMessageBytes) {
-                        closeForProtocolViolation("legacy RPC exceeds the message-size limit");
-                        return;
-                    }
-                    handleIncomingRPC(bytes);
-                    break;
+                    closeForProtocolViolation(`unknown frame type ${frameType}`);
+                    return;
                 }
             }
         }
@@ -762,7 +753,6 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
     const socket = {
         id: connectionId,
         connected: true,
-        handlesOwnEncoding: true,
         transportType,
         stats,
         armFrameCipher,
@@ -811,26 +801,20 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
  * This is the main implementation that handles all binary protocols.
  */
 function wrapBinaryPeer(connectionId, peer, localDevice, initiator, options, getTrustLevel) {
-    const { protocol, markTransportSecure, receiveLimits } = options;
+    const { protocol, receiveLimits } = options;
     const socket = createBinaryPeerSocket(connectionId, peer, protocol, receiveLimits);
     const serverAddress = `${protocol}://${connectionId}`;
     const localServerAddresses = initiator ? undefined : [serverAddress];
     if (process.env.NODE_ENV !== "test") {
         getTrustLevel ??= (0, get_trust_level_fn_1.getTrustLevelFn)(localDevice, serverAddress);
     }
-    const connection = new connection_1.Connection(socket, localDevice, localServerAddresses, getTrustLevel);
-    if (markTransportSecure) {
-        connection.secureLocal = true;
-        connection.secureRemote = true;
-    }
-    return connection;
+    return new connection_1.Connection(socket, localDevice, localServerAddresses, getTrustLevel);
 }
 /**
- * Wraps a WebRTC peer into a Connection.
- * WebRTC is encrypted at the transport layer (DTLS-SRTP); the frame cipher is
- * armed on top of it by the handshake so no code path depends on transport
- * classification.
+ * Wraps a WebRTC peer into a Connection. WebRTC is encrypted at the transport
+ * layer (DTLS-SRTP); the handshake arms the frame cipher on top of it, as on
+ * every transport.
  */
 function wrapWrtc(connectionId, peer, localDevice, initiator, getTrustLevel, receiveLimits) {
-    return wrapBinaryPeer(connectionId, peer, localDevice, initiator, { protocol: "wrtc", markTransportSecure: true, receiveLimits }, getTrustLevel);
+    return wrapBinaryPeer(connectionId, peer, localDevice, initiator, { protocol: "wrtc", receiveLimits }, getTrustLevel);
 }