@peers-app/peers-sdk 0.27.5 → 0.28.0

package/dist/data/invites.d.ts

@@ -47,6 +47,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }>, "many">>;
+        anchorsSignature: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
@@ -55,6 +56,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
@@ -64,6 +66,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }>>;
     /** Device the counterpart used, when they told us; lets the network layer connect early. */
@@ -95,6 +98,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }>, "many">>;
+            anchorsSignature: z.ZodOptional<z.ZodString>;
         }, "strict", z.ZodTypeAny, {
             publicKey: string;
             userId: string;
@@ -103,6 +107,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         }, {
             publicKey: string;
@@ -112,6 +117,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         }>;
         expiresAt: z.ZodString;
@@ -155,6 +161,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -181,6 +188,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -253,6 +261,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -274,6 +283,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;
@@ -314,6 +324,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -335,6 +346,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;
@@ -383,6 +395,7 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -404,6 +417,7 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;

package/dist/data/orm/index.d.ts

@@ -14,3 +14,4 @@ export * from "./table-container";
 export * from "./table-definitions.type";
 export * from "./table-dependencies";
 export * from "./types";
+export * from "./write-checks";

package/dist/data/orm/index.js

@@ -30,3 +30,4 @@ __exportStar(require("./table-container"), exports);
 __exportStar(require("./table-definitions.type"), exports);
 __exportStar(require("./table-dependencies"), exports);
 __exportStar(require("./types"), exports);
+__exportStar(require("./write-checks"), exports);

package/dist/data/orm/sql.data-source.d.ts

@@ -96,8 +96,8 @@ export declare class SQLDataSource<T extends {
      */
     bulkSave(records: T[]): Promise<T[]>;
 }
-/** Encode a JavaScript field for SQLite parameters or an escaped migration literal. */
-export declare function jsValueToSqlValue(value: any, escapeQuote?: boolean): any;
+/** Encode a JavaScript field for SQLite parameters. */
+export declare function jsValueToSqlValue(value: any): any;
 /** Restore a SQLite field according to its declared Peers type. */
 export declare function sqlValueToJsValue(value: any, fieldType: FieldType, isArray: boolean): any;
 /** Default value used when adding a required field to an existing table. */

package/dist/data/orm/sql.data-source.js

@@ -136,6 +136,7 @@ class SQLDataSource {
             // sql query to copy existing data and set new required fields to default values
             const defaults = this.initRecord();
             const fieldsInsert = this.metaData.fields.map((f) => `"${f.name}"`).join(", ");
+            const params = [];
             const fieldsSelect = this.metaData.fields
                 .map((f) => {
                 const existingField = existingTableDef.includes(`"${f.name}"`);
@@ -146,18 +147,19 @@ class SQLDataSource {
                 if (defaultValue === undefined) {
                     defaultValue = globalDefaultValues(f);
                 }
-                defaultValue = jsValueToSqlValue(defaultValue, true);
+                if (!f.optional)
+                    params.push(jsValueToSqlValue(defaultValue));
                 if (existingField && !f.optional) {
-                    return `CASE WHEN "${f.name}" IS NULL THEN '${defaultValue}' ELSE "${f.name}" END as "${f.name}"`;
+                    return `COALESCE("${f.name}", ?) as "${f.name}"`;
                 }
                 if (!existingField && !f.optional) {
-                    return `'${defaultValue}' as "${f.name}"`;
+                    return `? as "${f.name}"`;
                 }
                 return `NULL as "${f.name}"`;
             })
                 .join(", ");
             const insertSql = `INSERT INTO "${this.tableName}"(${fieldsInsert}) SELECT ${fieldsSelect} FROM "${tempTableName}"`;
-            await this.db.exec(insertSql, []);
+            await this.db.exec(insertSql, params);
             // drop old table
             const dropSql = `DROP TABLE IF EXISTS "${tempTableName}"`;
             await this.db.exec(dropSql, []);
@@ -536,8 +538,8 @@ class SQLDataSource {
     }
 }
 exports.SQLDataSource = SQLDataSource;
-/** Encode a JavaScript field for SQLite parameters or an escaped migration literal. */
-function jsValueToSqlValue(value, escapeQuote = false) {
+/** Encode a JavaScript field for SQLite parameters. */
+function jsValueToSqlValue(value) {
     if (value === undefined)
         return null;
     if (value instanceof Date) {
@@ -549,9 +551,6 @@ function jsValueToSqlValue(value, escapeQuote = false) {
     if (typeof value === "boolean") {
         return value ? 1 : 0;
     }
-    if (typeof value === "string" && escapeQuote) {
-        return value.replace(/'/g, "''");
-    }
     return value;
 }
 /** Restore a SQLite field according to its declared Peers type. */

package/dist/data/orm/table-container.js

@@ -4,6 +4,7 @@ exports.TableContainer = void 0;
 exports.checkVersionedUpdate = checkVersionedUpdate;
 const rpc_types_1 = require("../../rpc-types");
 const utils_1 = require("../../utils");
+const package_table_identity_1 = require("../package-table-identity");
 const table_1 = require("./table");
 const table_definitions_system_1 = require("./table-definitions.system");
 const types_1 = require("./types");
@@ -266,7 +267,8 @@ class TableContainer {
         const record = await tableDefsTable.findOne({ name: tableName });
         if (!record || record.deleted)
             return null;
-        this.registerFromTableDefinitionRecord(record);
+        if (!this.registerFromTableDefinitionRecord(record))
+            return null;
         // Now instantiate via getTableByName which checks fallbackDefinitions
         return this.getTableByName(tableName);
     }
@@ -334,22 +336,25 @@ class TableContainer {
      * External code should not need to call this directly.
      */
     registerFromTableDefinitionRecord(record) {
-        const metaData = record.metaData;
-        if (!metaData?.tableId || !metaData?.name || !metaData?.fields) {
-            console.warn(`Invalid table definition record, skipping:`, record);
-            return;
+        try {
+            (0, package_table_identity_1.validateTableDefinitionRecord)(record);
         }
+        catch (error) {
+            console.warn("Refusing invalid synced table definition", error);
+            return false;
+        }
+        const metaData = record.metaData;
         const tableName = (0, utils_1.getFullTableName)(metaData);
         // Deleted tables should not be registered as fallbacks
         if (record.deleted) {
             delete this.fallbackDefinitions[tableName];
             delete this.fallbackInstances[tableName];
-            return;
+            return false;
         }
         // Don't overwrite a full (code-registered) definition -- that always takes precedence
         const fullDef = this.tableDefinitions[tableName] || table_definitions_system_1.systemTableDefinitions[tableName];
         if (fullDef) {
-            return; // full definition exists, no need for a fallback
+            return true; // full definition exists, no need for a fallback
         }
         const existing = this.fallbackDefinitions[tableName];
         if (existing) {
@@ -357,13 +362,14 @@ class TableContainer {
             const incomingVersion = record.versionNumber ?? 0;
             const result = checkVersionedUpdate(existingVersion, incomingVersion, existing.metaData, metaData);
             if (result === "skip") {
-                return;
+                return true;
             }
             // Remove old fallback instance so it gets re-created with the new schema
             delete this.fallbackInstances[tableName];
         }
         const schema = (0, types_1.fieldsToSchema)(metaData.fields);
         this.fallbackDefinitions[tableName] = { metaData, schema };
+        return true;
     }
     /**
      * This ensures all tables have been new'ed up and then returns the entire list of them.

package/dist/data/orm/write-checks.d.ts

@@ -0,0 +1,89 @@
+import type { DataContext } from "../../context/data-context";
+import type { Table } from "./table";
+/**
+ * Prefix of every refusal from a {@link TableWriteCheck}. Sync recovery parks a change refused
+ * with it, and checks it again only from local history, when the group's authority changes.
+ */
+export declare const WRITE_NOT_AUTHORIZED = "Write not authorized";
+/** Where a checked write lands. */
+export interface ITableWriteCheckContext {
+    /** The context the row belongs to. */
+    dataContext: DataContext;
+    /** The row's primary key, also given for a delete. */
+    recordId: string;
+    /** Checked snapshots retained by the same atomic recovery transaction. */
+    retainedRows?: readonly unknown[];
+    /** Records removed by the same atomic recovery transaction. */
+    deletedRecordIds?: readonly string[];
+}
+/**
+ * A rule a row must meet before it's written, run by the host on every synced change (sync
+ * writes rows without going through the table class). Throw an error from
+ * {@link writeNotAuthorized} to refuse it.
+ *
+ * @param existing - The row as stored now, if any.
+ * @param candidate - The row about to be stored, or undefined for a delete.
+ */
+export type TableWriteCheck<T = any> = (existing: T | undefined, candidate: T | undefined, context: ITableWriteCheckContext) => Promise<void> | void;
+/**
+ * Register the {@link TableWriteCheck} for a table name. One per table; a second registration
+ * replaces the first.
+ *
+ * @param tableName - Table the check guards.
+ * @param check - The rule.
+ */
+export declare function registerTableWriteCheck<T>(tableName: string, check: TableWriteCheck<T>): void;
+/**
+ * The {@link TableWriteCheck} registered for a table, if any.
+ *
+ * @param tableName - Table name.
+ */
+export declare function getTableWriteCheck(tableName: string): TableWriteCheck | undefined;
+/**
+ * Run `check` on a local save to `table`, as the host runs it on every synced row, so a local
+ * write and a synced write are judged by the same code. Nothing is checked in the personal
+ * context: only the user's own devices write it.
+ *
+ * @param table - The table being saved to.
+ * @param row - The row about to be stored.
+ * @param check - The table's rule.
+ */
+export declare function checkLocalSave<T extends {
+    [key: string]: any;
+}>(table: Table<T>, row: T, check: TableWriteCheck<T>): Promise<void>;
+/**
+ * Tables whose approvals are bound to a context (`signedContextId`) and whose deletes are open,
+ * so a deleted row's signing time is retained ({@link deletedSignedAt}).
+ */
+export declare const packageApprovalTables: ReadonlySet<string>;
+/**
+ * What a table's `signAndSave` (and a re-sign) puts under the signature: `signedAt`, now or
+ * just after the row on record when that was signed by a clock running ahead, so the new
+ * signature counts as the later one (and, for a package table, after the deleted row's
+ * retained stamp); for a package table also the context the approval is for.
+ *
+ * @param table - The table being signed for.
+ * @param row - The row being signed.
+ * @param current - A row already read from storage; membership repair may supply another id's row.
+ */
+export declare function signingStamp<T extends Record<string, any>>(table: Table<T>, row: T, current?: {
+    signedAt?: number;
+}): Promise<{
+    signedAt: number;
+    signedContextId?: string;
+}>;
+/**
+ * Read a deleted authority row's last signing time, optionally retaining the stored row's
+ * stamp before deletion. Device-local personal storage survives deletion and log compaction.
+ * Only pass `existing` from storage, never an unverified incoming candidate.
+ */
+export declare function deletedSignedAt(tableName: string, context: ITableWriteCheckContext, existing?: {
+    signedAt?: number;
+}): Promise<number>;
+/**
+ * An error refusing a write, carrying the {@link WRITE_NOT_AUTHORIZED} prefix.
+ *
+ * @param tableName - Table the write was for.
+ * @param reason - Why, for logs and the sync recovery queue.
+ */
+export declare function writeNotAuthorized(tableName: string, reason: string): Error;

package/dist/data/orm/write-checks.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageApprovalTables = exports.WRITE_NOT_AUTHORIZED = void 0;
+exports.registerTableWriteCheck = registerTableWriteCheck;
+exports.getTableWriteCheck = getTableWriteCheck;
+exports.checkLocalSave = checkLocalSave;
+exports.signingStamp = signingStamp;
+exports.deletedSignedAt = deletedSignedAt;
+exports.writeNotAuthorized = writeNotAuthorized;
+/**
+ * Prefix of every refusal from a {@link TableWriteCheck}. Sync recovery parks a change refused
+ * with it, and checks it again only from local history, when the group's authority changes.
+ */
+exports.WRITE_NOT_AUTHORIZED = "Write not authorized";
+const writeChecks = new Map();
+/**
+ * Register the {@link TableWriteCheck} for a table name. One per table; a second registration
+ * replaces the first.
+ *
+ * @param tableName - Table the check guards.
+ * @param check - The rule.
+ */
+function registerTableWriteCheck(tableName, check) {
+    writeChecks.set(tableName, check);
+}
+/**
+ * The {@link TableWriteCheck} registered for a table, if any.
+ *
+ * @param tableName - Table name.
+ */
+function getTableWriteCheck(tableName) {
+    return writeChecks.get(tableName);
+}
+/**
+ * Run `check` on a local save to `table`, as the host runs it on every synced row, so a local
+ * write and a synced write are judged by the same code. Nothing is checked in the personal
+ * context: only the user's own devices write it.
+ *
+ * @param table - The table being saved to.
+ * @param row - The row about to be stored.
+ * @param check - The table's rule.
+ */
+async function checkLocalSave(table, row, check) {
+    if (!table.groupId)
+        return;
+    const { getUserContext } = await Promise.resolve().then(() => require("../../context/user-context-singleton"));
+    const recordId = row[table.primaryKeyName];
+    await check(await table.get(recordId), row, {
+        dataContext: (await getUserContext()).getDataContext(table.groupId),
+        recordId,
+    });
+}
+/**
+ * Tables whose approvals are bound to a context (`signedContextId`) and whose deletes are open,
+ * so a deleted row's signing time is retained ({@link deletedSignedAt}).
+ */
+exports.packageApprovalTables = new Set(["Packages", "PackageVersions"]);
+/**
+ * What a table's `signAndSave` (and a re-sign) puts under the signature: `signedAt`, now or
+ * just after the row on record when that was signed by a clock running ahead, so the new
+ * signature counts as the later one (and, for a package table, after the deleted row's
+ * retained stamp); for a package table also the context the approval is for.
+ *
+ * @param table - The table being signed for.
+ * @param row - The row being signed.
+ * @param current - A row already read from storage; membership repair may supply another id's row.
+ */
+async function signingStamp(table, row, current) {
+    const { tableName, groupId, primaryKeyName } = table;
+    const recordId = row[primaryKeyName];
+    current ??= await table.get(recordId);
+    const packageTable = exports.packageApprovalTables.has(tableName);
+    let floor = current?.signedAt ?? 0;
+    if (packageTable && groupId && !current) {
+        const { getUserContext } = await Promise.resolve().then(() => require("../../context/user-context-singleton"));
+        const dataContext = (await getUserContext()).getDataContext(groupId);
+        floor = await deletedSignedAt(tableName, { dataContext, recordId });
+    }
+    return {
+        signedAt: Math.max(Date.now(), floor + 1),
+        ...(packageTable ? { signedContextId: groupId } : {}),
+    };
+}
+/**
+ * Read a deleted authority row's last signing time, optionally retaining the stored row's
+ * stamp before deletion. Device-local personal storage survives deletion and log compaction.
+ * Only pass `existing` from storage, never an unverified incoming candidate.
+ */
+async function deletedSignedAt(tableName, context, existing) {
+    if (!context.dataContext.groupId)
+        return 0;
+    const { PersistentVars } = await Promise.resolve().then(() => require("../persistent-vars"));
+    const vars = PersistentVars(context.dataContext.userContext.userDataContext);
+    const name = `authorityOrder:${context.dataContext.groupId}:${tableName}:${context.recordId}`;
+    const remembered = await vars.findOne({ name, scope: "device" });
+    const floor = Math.max(remembered?.value?.value ?? 0, existing?.signedAt ?? 0);
+    if (floor > (remembered?.value?.value ?? 0)) {
+        await vars.save({
+            persistentVarId: remembered?.persistentVarId ?? "",
+            name,
+            scope: "device",
+            value: { value: floor },
+        });
+    }
+    return floor;
+}
+/**
+ * An error refusing a write, carrying the {@link WRITE_NOT_AUTHORIZED} prefix.
+ *
+ * @param tableName - Table the write was for.
+ * @param reason - Why, for logs and the sync recovery queue.
+ */
+function writeNotAuthorized(tableName, reason) {
+    return new Error(`${exports.WRITE_NOT_AUTHORIZED}: ${tableName}: ${reason}`);
+}

package/dist/data/package-table-identity.d.ts

@@ -1,3 +1,4 @@
+import type { ITableDefinitionRecord } from "./table-definitions-table";
 /**
  * Validate a guest-supplied isolated-table or field identifier before it can
  * reach ORM-generated SQL.
@@ -44,3 +45,8 @@ export declare function packageScopedTableName(packageId: string, logicalName: s
  * @throws When package or table identity is invalid.
  */
 export declare function packageScopedTableId(packageId: string, logicalName: string): string;
+/**
+ * Validate synced schema metadata before it can name a table, column, or index in SQL.
+ * A schema cannot impersonate a system table or supply SQL expressions as identifiers.
+ */
+export declare function validateTableDefinitionRecord(record: ITableDefinitionRecord): void;

package/dist/data/package-table-identity.js

@@ -4,6 +4,7 @@ exports.validateIsolatedSqlIdentifier = validateIsolatedSqlIdentifier;
 exports.validatePackageTableName = validatePackageTableName;
 exports.packageScopedTableName = packageScopedTableName;
 exports.packageScopedTableId = packageScopedTableId;
+exports.validateTableDefinitionRecord = validateTableDefinitionRecord;
 const utils_1 = require("../utils");
 const ISOLATED_SQL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
@@ -69,3 +70,53 @@ function packageScopedTableName(packageId, logicalName) {
 function packageScopedTableId(packageId, logicalName) {
     return (0, utils_1.deterministicTableId)(packageScopedTableName(packageId, logicalName));
 }
+/**
+ * Validate synced schema metadata before it can name a table, column, or index in SQL.
+ * A schema cannot impersonate a system table or supply SQL expressions as identifiers.
+ */
+function validateTableDefinitionRecord(record) {
+    const meta = record.metaData;
+    if (!meta ||
+        !(0, utils_1.isid)(record.tableId) ||
+        meta.tableId !== record.tableId ||
+        (meta.packageId !== undefined && !(0, utils_1.isid)(meta.packageId))) {
+        throw new Error("Invalid table definition identity");
+    }
+    validateIsolatedSqlIdentifier(meta.name, "Table name");
+    validateIsolatedSqlIdentifier(meta.primaryKeyName, "Primary key");
+    if (record.name !== (0, utils_1.getFullTableName)(meta))
+        throw new Error("Table definition name mismatch");
+    if (!Number.isSafeInteger(record.versionNumber) ||
+        record.versionNumber < 0 ||
+        record.versionNumber !== (meta.versionNumber ?? 0)) {
+        throw new Error("Invalid table definition version");
+    }
+    if (meta.localOnly !== undefined && typeof meta.localOnly !== "boolean") {
+        throw new Error("Invalid table localOnly policy");
+    }
+    if (!Array.isArray(meta.fields) || !meta.fields.length)
+        throw new Error("Missing table fields");
+    const names = new Set();
+    for (const field of meta.fields) {
+        validateIsolatedSqlIdentifier(field.name, "Column name");
+        if (names.has(field.name))
+            throw new Error("Duplicate table column");
+        names.add(field.name);
+    }
+    if (!names.has(meta.primaryKeyName))
+        throw new Error("Missing primary key column");
+    if (meta.indexes !== undefined && !Array.isArray(meta.indexes))
+        throw new Error("Invalid indexes");
+    for (const index of meta.indexes ?? []) {
+        if (!Array.isArray(index.fields) || !index.fields.length)
+            throw new Error("Missing index fields");
+        for (const field of index.fields) {
+            const name = typeof field === "string" ? field : field.name;
+            if (!names.has(name))
+                throw new Error("Index must name a declared column");
+            if (typeof field !== "string" && field.order !== "ASC" && field.order !== "DESC") {
+                throw new Error("Invalid index order");
+            }
+        }
+    }
+}

package/dist/data/package-version-resolver.d.ts

@@ -18,6 +18,8 @@ import { type PersistentVar } from "./persistent-vars";
 export interface IDevicePackagePrefs {
     /** Which PV this device currently runs */
     activePackageVersionId?: string;
+    /** Tag when this device explicitly selected the version; a later retag cannot opt it into dev. */
+    activePackageVersionTag?: string;
     /** Newer selected PV temporarily bypassed because this host could not run it. */
     compatibilityFallbackForPackageVersionId?: string;
     /** If true, never auto-update this package */
@@ -53,6 +55,19 @@ export declare function packagePrefsVar(packageId: string, dataContext?: DataCon
  *   omitted the var tracks the user's default group context.
  */
 export declare function updatePackagePrefs(packageId: string, prefs: Partial<IDevicePackagePrefs>, dataContext?: DataContext): Promise<void>;
+/**
+ * Check a selected version before evaluating any of its runtime, route or UI bundles.
+ * Group releases and shared selections must still have authorized signatures even when
+ * already on disk. Dev builds require an explicit device selection made while tagged dev.
+ *
+ * @param localDev - A host explicitly loading a local development checkout.
+ */
+export declare function assertPackageVersionRunnable(pkg: IPackage, pv: IPackageVersion, dataContext: DataContext, localDev?: boolean): Promise<void>;
+/**
+ * Verify fetched bundle bytes against the hash in the authorized version. Files rows may be
+ * changed by group members, so their own chunk hashes alone cannot authorize executable code.
+ */
+export declare function assertPackageBundleIntegrity(pv: IPackageVersion, kind: "package" | "routes" | "ui", contents: string | Uint8Array): void;
 /**
  * Effective device-local preferences for a package after merging the device's
  * raw prefs with the group-level `IPackage` defaults. Every field is resolved