@peers-app/peers-sdk 0.28.11 → 0.29.0

package/dist/define/table.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageTable = void 0;
 exports.defineTable = defineTable;
+const signed_row_id_1 = require("../data/signed-row-id");
 const isolated_runtime_1 = require("../package-loader/isolated-runtime");
+const field_type_1 = require("../types/field-type");
 const empty_fields_1 = require("./empty-fields");
 const table_handle_1 = require("./table-handle");
 /**
@@ -120,6 +122,102 @@ class PackageTable {
     }
 }
 exports.PackageTable = PackageTable;
+/** The columns Peers adds to a signed table; a schema can't declare them. */
+const SIGNED_TABLE_COLUMNS = [
+    "signature",
+    "signedAt",
+    "signedContextId",
+    "signedTableId",
+    "signedIdSeed",
+];
+/** The field types a signed table's key fields may have. */
+const SIGNED_KEY_TYPES = new Set([
+    field_type_1.FieldType.string,
+    field_type_1.FieldType.id,
+    field_type_1.FieldType.number,
+    field_type_1.FieldType.boolean,
+]);
+/**
+ * A schema field's Peers field type and whether a wrapper makes it optional, nullable, an
+ * array, or defaulted. `zodPeerId` marks its own def (a refinement) as an id field; walk the
+ * wrappers the manifest walks and take the mark from whichever level carries it.
+ */
+function schemaFieldKind(schema, name) {
+    let def = schema.shape[name]._def;
+    let wrapped = false;
+    let isArray = false;
+    let fieldType = def._fieldType;
+    const typeName = () => def.typeName;
+    while (def.innerType || def.schema || def.type) {
+        isArray ||= typeName() === "ZodArray";
+        wrapped ||= ["ZodOptional", "ZodNullable", "ZodArray", "ZodDefault"].includes(typeName());
+        def = (def.innerType ?? def.schema ?? def.type)._def;
+        fieldType ??= def._fieldType;
+    }
+    fieldType ??= {
+        ZodString: field_type_1.FieldType.string,
+        ZodEnum: field_type_1.FieldType.string,
+        ZodNumber: field_type_1.FieldType.number,
+        ZodBoolean: field_type_1.FieldType.boolean,
+    }[typeName()];
+    // A literal is typed by its value, as the manifest types it.
+    if (!fieldType && typeName() === "ZodLiteral") {
+        fieldType = { string: field_type_1.FieldType.string, number: field_type_1.FieldType.number, boolean: field_type_1.FieldType.boolean }[typeof def.value];
+    }
+    return { fieldType, wrapped, isArray };
+}
+/**
+ * Check a `signedBy` declaration without the manifest machinery (this entry stays small): the
+ * owner field and the primary key are required, single `zodPeerId` fields and differ; any
+ * `signedKey` fields are distinct, required scalars other than those two; the table isn't
+ * local-only; and the schema leaves the signature columns to Peers. The build checks the
+ * manifest again.
+ */
+function validateSignedByField(definition) {
+    const { name, signedBy, signedKey, schema, localOnly, primaryKeyName } = definition;
+    const label = `Table ${name}`;
+    if (typeof signedBy !== "string" || !(signedBy in schema.shape)) {
+        throw new Error(`${label}.signedBy names a field the table doesn't have: "${signedBy}"`);
+    }
+    const owner = schemaFieldKind(schema, signedBy);
+    if (owner.wrapped || owner.fieldType !== field_type_1.FieldType.id) {
+        throw new Error(`${label}.signedBy must name a required field of type id, a user id`);
+    }
+    if (localOnly) {
+        throw new Error(`${label}.signedBy can't be set on a local-only table: nothing syncs`);
+    }
+    if (primaryKeyName === signedBy) {
+        throw new Error(`${label}: a signed table's primary key can't be its owner field; use signedKey: [] for one row per owner`);
+    }
+    const primaryKey = schemaFieldKind(schema, primaryKeyName);
+    if (primaryKey.fieldType !== field_type_1.FieldType.id || primaryKey.isArray) {
+        throw new Error(`${label}: a signed table's primary key must be a zodPeerId`);
+    }
+    if (signedKey !== undefined) {
+        if (!Array.isArray(signedKey))
+            throw new Error(`${label}.signedKey must be a list of fields`);
+        const seen = new Set();
+        for (const field of signedKey) {
+            if (typeof field !== "string" || !(field in schema.shape)) {
+                throw new Error(`${label}.signedKey names a field the table doesn't have: "${field}"`);
+            }
+            if (seen.has(field))
+                throw new Error(`${label}.signedKey lists "${field}" twice`);
+            seen.add(field);
+            if (field === primaryKeyName || field === signedBy) {
+                throw new Error(`${label}.signedKey can't list "${field}": the owner and the id are already part of a row's identity`);
+            }
+            const kind = schemaFieldKind(schema, field);
+            if (kind.wrapped || !kind.fieldType || !SIGNED_KEY_TYPES.has(kind.fieldType)) {
+                throw new Error(`${label}.signedKey field "${field}" must be a required string, id, number, or boolean`);
+            }
+        }
+    }
+    const reserved = SIGNED_TABLE_COLUMNS.find((column) => column in schema.shape);
+    if (reserved) {
+        throw new Error(`${label} declares "${reserved}", which the host adds to a signed table itself`);
+    }
+}
 /**
  * Declare one of the package's tables from a zod schema.
  *
@@ -138,12 +236,32 @@ function defineTable(definition) {
     if (!(definition.primaryKeyName in definition.schema.shape)) {
         throw new Error(`Table ${definition.name} primary key "${definition.primaryKeyName}" is not in its schema`);
     }
+    if (definition.signedBy !== undefined) {
+        validateSignedByField(definition);
+    }
+    else if (definition.signedKey !== undefined) {
+        throw new Error(`Table ${definition.name}.signedKey needs signedBy`);
+    }
     const TableClass = definition.tableClass ?? PackageTable;
     if (typeof TableClass !== "function" ||
         !(TableClass.prototype instanceof PackageTable || TableClass === PackageTable)) {
         throw new Error(`Table ${definition.name} tableClass must extend PackageTable`);
     }
-    const frozen = Object.freeze({ ...definition });
+    const frozen = Object.freeze({
+        ...definition,
+        ...(definition.signedKey ? { signedKey: Object.freeze([...definition.signedKey]) } : {}),
+    });
     const table = (ctx) => new TableClass(ctx, frozen);
-    return Object.freeze(Object.assign(table, { kind: "table", definition: frozen }));
+    const rowId = (row) => {
+        const { name, signedBy, signedKey, schema } = frozen;
+        if (!signedBy || !signedKey) {
+            throw new Error(`Table ${name} has no signedKey, so its row ids come from Peers when rows are first saved`);
+        }
+        const identityRow = Object.fromEntries([signedBy, ...signedKey].map((field) => [
+            field,
+            schema.shape[field].parse(row[field], { path: [field] }),
+        ]));
+        return (0, signed_row_id_1.signedRowIdFor)({ name, signedBy, signedKey }, identityRow);
+    };
+    return Object.freeze(Object.assign(table, { kind: "table", definition: frozen, rowId }));
 }

package/dist/device/binary-peer-connection-v2.d.ts

@@ -5,8 +5,8 @@
  * separated modes:
  *
  * 1. **RPC mode** (emit/on): request/response interactions with automatic
- *    encoding (txEncode for objects, passthrough for Uint8Array) and transparent
- *    chunking for large payloads.
+ *    encoding (txEncode with bytes kept binary for objects, passthrough for a
+ *    top-level Uint8Array) and transparent chunking for large payloads.
  *
  * 2. **Stream mode** (sendRawBytes/onRawBytes): continuous byte transfer for
  *    file syncing, log streaming, etc. Each sendRawBytes

package/dist/device/binary-peer-connection-v2.js

@@ -6,8 +6,8 @@
  * separated modes:
  *
  * 1. **RPC mode** (emit/on): request/response interactions with automatic
- *    encoding (txEncode for objects, passthrough for Uint8Array) and transparent
- *    chunking for large payloads.
+ *    encoding (txEncode with bytes kept binary for objects, passthrough for a
+ *    top-level Uint8Array) and transparent chunking for large payloads.
  *
  * 2. **Stream mode** (sendRawBytes/onRawBytes): continuous byte transfer for
  *    file syncing, log streaming, etc. Each sendRawBytes
@@ -27,6 +27,7 @@ exports.createBinaryPeerSocket = createBinaryPeerSocket;
 exports.wrapBinaryPeer = wrapBinaryPeer;
 exports.wrapWrtc = wrapWrtc;
 const msgpack_1 = require("@msgpack/msgpack");
+const peer_device_1 = require("../types/peer-device");
 const utils_1 = require("../utils");
 const connection_1 = require("./connection");
 const frame_cipher_1 = require("./frame-cipher");
@@ -100,6 +101,8 @@ function decodeStreamId(bytes) {
     streamIdStringCache.set(key, cached);
     return cached;
 }
+/** RPC payloads carry bytes as msgpack binary, not base64 text. */
+const RPC_ENCODING = { binaryBytes: true };
 function encodeMessage(message) {
     let isUint8ArrayData = false;
     if (message.type === "call" && message.args instanceof Uint8Array) {
@@ -122,18 +125,18 @@ function encodeMessage(message) {
             dataBytes = message.args;
         }
         else {
-            dataBytes = (0, tx_encoding_1.txEncode)(message.args);
+            dataBytes = (0, tx_encoding_1.txEncode)(message.args, RPC_ENCODING);
         }
     }
     else if (message.type === "callback") {
         if (message.error !== undefined) {
-            dataBytes = (0, tx_encoding_1.txEncode)({ error: message.error });
+            dataBytes = (0, tx_encoding_1.txEncode)({ error: message.error }, RPC_ENCODING);
         }
         else if (isUint8ArrayData) {
             dataBytes = message.result;
         }
         else {
-            dataBytes = (0, tx_encoding_1.txEncode)({ result: message.result });
+            dataBytes = (0, tx_encoding_1.txEncode)({ result: message.result }, RPC_ENCODING);
         }
     }
     else {
@@ -244,7 +247,8 @@ function buildStreamCont(sidBytes, chunkData) {
  */
 function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receiveLimitOverrides = {}) {
     const handlers = {};
-    const callbacks = {};
+    /** Reply callbacks for this side's calls that are still waiting, by callback id. */
+    const callbacks = new Map();
     const rawBytesHandlers = {};
     let isClosed = false;
     const stats = (0, socket_type_1.createSocketStats)();
@@ -432,6 +436,26 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
         streamReassemblyBuffers.clear();
         inFlightReassemblyBytes = 0;
     }
+    /**
+     * Fail every call still waiting for a reply. The peer can no longer answer, so waiting would
+     * only hold each caller until its own timer fired; failing now lets it move on (a remote
+     * contract call's next attempt picks another route).
+     */
+    function rejectPendingCalls() {
+        const pending = [...callbacks.values()];
+        callbacks.clear();
+        // A transport may close synchronously from send(), inside emit().
+        queueMicrotask(() => {
+            for (const callback of pending) {
+                try {
+                    callback(new Error(peer_device_1.CONNECTION_CLOSED_MESSAGE));
+                }
+                catch (err) {
+                    console.error(`Error failing a pending ${protocol} call on close:`, err);
+                }
+            }
+        });
+    }
     function closeForProtocolViolation(reason) {
         if (isClosed) {
             return;
@@ -441,6 +465,7 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
         clearAllReassemblies();
         destroyFrameCipher();
         socket.connected = false;
+        rejectPendingCalls();
         peer.destroy();
     }
     function reserveReassembly(key, totalSize, maximumMessageBytes, onTimeout) {
@@ -469,9 +494,9 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
     function handleIncomingRPC(bytes) {
         const message = decodeMessage(bytes);
         if (message.type === "callback") {
-            const callback = callbacks[message.callbackId];
+            const callback = callbacks.get(message.callbackId);
             if (callback) {
-                delete callbacks[message.callbackId];
+                callbacks.delete(message.callbackId);
                 callback(message.error, message.result);
             }
             return;
@@ -739,16 +764,21 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
             console.error(`Error parsing ${protocol} frame:`, err);
         }
     });
-    // Handle closure. Cipher teardown waits until queued RPC replies have sealed;
-    // see {@link releaseCipherAfterTurn}.
-    peer.on("close", () => {
+    /**
+     * Handle closure, from the peer or from {@link ISocket.disconnect}. Calls waiting for a reply
+     * fail now. Cipher teardown waits until queued replies to the peer's calls have sealed; see
+     * {@link releaseCipherAfterTurn}.
+     */
+    function markClosed() {
         if (isClosed)
             return;
         isClosed = true;
         socket.connected = false;
         clearAllReassemblies();
+        rejectPendingCalls();
         releaseCipherAfterTurn();
-    });
+    }
+    peer.on("close", markClosed);
     // ─── ISocket Implementation ──────────────────────────────────────
     const socket = {
         id: connectionId,
@@ -763,10 +793,16 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
             plaintextStreamsAllowed = allowed;
         },
         emit(eventName, args, callback) {
+            if (isClosed) {
+                // Nothing can answer; fail on a later turn so the caller never sees a synchronous reply.
+                queueMicrotask(() => callback(new Error(peer_device_1.CONNECTION_CLOSED_MESSAGE)));
+                return;
+            }
             const callbackId = (0, utils_1.newid)();
-            callbacks[callbackId] = callback;
             const message = { type: "call", eventName, args, callbackId };
+            // Encoded first: a call that can't be encoded throws to its caller and leaves no callback.
             const encoded = encodeMessage(message);
+            callbacks.set(callbackId, callback);
             sendRPC(encoded);
         },
         on(eventName, handler) {
@@ -783,6 +819,8 @@ function createBinaryPeerSocket(connectionId, peer, protocol = "binary", receive
             }
         },
         disconnect() {
+            // The WebRTC peers don't report their own destroy() as a close.
+            markClosed();
             peer.destroy();
         },
         sendRawBytes: sendStreamData,

package/dist/device/tx-encoding.d.ts

@@ -1,2 +1,23 @@
-export declare function txEncode(data: unknown): Uint8Array;
+/** Options for {@link txEncode}. */
+export interface TxEncodeOptions {
+    /**
+     * Write `Uint8Array` and `Buffer` values as msgpack binary instead of {@link toJSON}'s base64
+     * strings. Device connections' RPC messages use it; a payload that is signed or boxed keeps the
+     * default, so its format is unchanged. {@link txDecode} reads both.
+     */
+    binaryBytes?: boolean;
+}
+/**
+ * Encodes `data` for a device connection or a box: {@link toJSON} (cycles, dates, bytes), msgpack,
+ * then gzip when that saves at least 20% (judged from a 64 KiB sample first for a large payload).
+ * The first byte is a flag: 0 plain, 1 gzip. With `binaryBytes`, bytes stay binary (see
+ * {@link TxEncodeOptions}).
+ */
+export declare function txEncode(data: unknown, options?: TxEncodeOptions): Uint8Array;
+/**
+ * Inverse of {@link txEncode}, with or without `binaryBytes`. Bytes that were written as binary
+ * come back as views into `data` (or into its inflated copy), so a caller that keeps a small piece
+ * of a large message for long should copy it.
+ * @throws If `data` is empty, has an unknown flag, or doesn't inflate or decode
+ */
 export declare function txDecode(data: Uint8Array): unknown;

package/dist/device/tx-encoding.js

@@ -4,6 +4,7 @@ exports.txEncode = txEncode;
 exports.txDecode = txDecode;
 const msgpack_1 = require("@msgpack/msgpack");
 const fflate_1 = require("fflate");
+const native_codecs_1 = require("../native-codecs");
 const serial_json_1 = require("../serial-json");
 // Minimum size before attempting compression (bytes)
 // Small payloads don't benefit much from compression
@@ -14,35 +15,70 @@ const MIN_COMPRESSION_RATIO = 0.8;
 // Compression level: 1 (fastest) to 9 (best compression)
 // Level 1 is ~5-10x faster than level 6 with reasonable compression
 const COMPRESSION_LEVEL = 1;
-function txEncode(data) {
-    const noCycles = (0, serial_json_1.toJSON)(data); // remove cycles and encode dates, etc.
-    // First encode to msgpack
-    const encoded = (0, msgpack_1.encode)(noCycles);
-    let body;
-    let flag;
-    if (encoded.length > COMPRESSION_THRESHOLD) {
-        // Try to compress - use fast compression level
-        const compressed = (0, fflate_1.compressSync)(encoded, { level: COMPRESSION_LEVEL });
-        // Only use compression if it actually helps significantly
-        if (compressed.length < encoded.length * MIN_COMPRESSION_RATIO) {
-            body = compressed;
-            flag = 1; // compressed
-        }
-        else {
-            // Compression didn't help much, skip it
-            body = encoded;
-            flag = 0; // not compressed
-        }
-    }
-    else {
-        body = encoded;
-        flag = 0; // not compressed
+/**
+ * A payload over twice this size is gzipped only when its first this-many bytes compress well, so
+ * bytes that are already compressed (Git packs, media, ciphertext) skip gzip at both ends.
+ */
+const COMPRESSION_SAMPLE_BYTES = 64 * 1024;
+/**
+ * msgpack extension type for a Node `Buffer` in a `binaryBytes` payload. Without it a `Buffer`
+ * would arrive as a plain `Uint8Array`, and {@link toJSON} encodes the two differently, so a
+ * signature over a received value that held a `Buffer` would no longer verify.
+ */
+const BUFFER_EXTENSION_TYPE = 1;
+const extensionCodec = new msgpack_1.ExtensionCodec();
+extensionCodec.register({
+    type: BUFFER_EXTENSION_TYPE,
+    encode: (value) => (Buffer.isBuffer(value) ? value : null),
+    decode: (data) => Buffer.from(data.buffer, data.byteOffset, data.byteLength),
+});
+function gzip(data) {
+    // Both produce gzip, which either side inflates.
+    return ((0, native_codecs_1.getNativeCodecs)()?.gzip(data, COMPRESSION_LEVEL) ??
+        (0, fflate_1.compressSync)(data, { level: COMPRESSION_LEVEL }));
+}
+/** True when gzip saves enough of `data` to be worth inflating at the other end. */
+function compressesWell(data, compressed) {
+    return compressed.length < data.length * MIN_COMPRESSION_RATIO;
+}
+/** `encoded` gzipped when that saves at least 20%, else `undefined`. */
+function compressIfWorthwhile(encoded) {
+    if (encoded.length <= COMPRESSION_THRESHOLD)
+        return undefined;
+    if (encoded.length > COMPRESSION_SAMPLE_BYTES * 2) {
+        const sample = encoded.subarray(0, COMPRESSION_SAMPLE_BYTES);
+        if (!compressesWell(sample, gzip(sample)))
+            return undefined;
     }
+    const compressed = gzip(encoded);
+    return compressesWell(encoded, compressed) ? compressed : undefined;
+}
+/**
+ * Encodes `data` for a device connection or a box: {@link toJSON} (cycles, dates, bytes), msgpack,
+ * then gzip when that saves at least 20% (judged from a 64 KiB sample first for a large payload).
+ * The first byte is a flag: 0 plain, 1 gzip. With `binaryBytes`, bytes stay binary (see
+ * {@link TxEncodeOptions}).
+ */
+function txEncode(data, options) {
+    // Remove cycles and encode dates, etc.
+    const tree = options?.binaryBytes ? (0, serial_json_1.toJSONKeepingBytes)(data) : (0, serial_json_1.toJSON)(data);
+    const encoded = (0, msgpack_1.encode)(tree, { extensionCodec });
+    const compressed = compressIfWorthwhile(encoded);
+    const body = compressed ?? encoded;
     const out = new Uint8Array(1 + body.length);
-    out[0] = flag;
+    out[0] = compressed ? 1 : 0;
     out.set(body, 1);
     return out;
 }
+function isGzip(data) {
+    return data.length > 2 && data[0] === 0x1f && data[1] === 0x8b;
+}
+/**
+ * Inverse of {@link txEncode}, with or without `binaryBytes`. Bytes that were written as binary
+ * come back as views into `data` (or into its inflated copy), so a caller that keeps a small piece
+ * of a large message for long should copy it.
+ * @throws If `data` is empty, has an unknown flag, or doesn't inflate or decode
+ */
 function txDecode(data) {
     if (data.length === 0) {
         throw new Error("Empty payload");
@@ -50,13 +86,14 @@ function txDecode(data) {
     const flag = data[0];
     let body = data.subarray(1);
     if (flag === 1) {
-        body = (0, fflate_1.decompressSync)(body);
+        const native = (0, native_codecs_1.getNativeCodecs)();
+        body = native && isGzip(body) ? native.gunzip(body) : (0, fflate_1.decompressSync)(body);
     }
     else if (flag !== 0) {
         // Optional: future versioning or legacy handling
         throw new Error(`Unknown tx flag: ${flag}`);
     }
-    const unpacked = (0, msgpack_1.decode)(body);
+    const unpacked = (0, msgpack_1.decode)(body, { extensionCodec });
     const restored = (0, serial_json_1.fromJSON)(unpacked); // restore cycles, dates, etc.
     return restored;
 }

package/dist/index.d.ts

@@ -33,6 +33,7 @@ export * from "./invites";
 export * from "./keys";
 export * from "./logging";
 export * from "./mentions";
+export * from "./native-codecs";
 export * from "./observable";
 export * from "./package-installer";
 export * from "./package-loader";

package/dist/index.js

@@ -55,6 +55,7 @@ __exportStar(require("./invites"), exports);
 __exportStar(require("./keys"), exports);
 __exportStar(require("./logging"), exports);
 __exportStar(require("./mentions"), exports);
+__exportStar(require("./native-codecs"), exports);
 __exportStar(require("./observable"), exports);
 __exportStar(require("./package-installer"), exports);
 __exportStar(require("./package-loader"), exports);

package/dist/invites/invite-messages.d.ts

@@ -655,17 +655,6 @@ export declare const groupApprovalSchema: z.ZodObject<{
         signedAt?: number | undefined;
         publicRole?: import("../data").GroupMemberRole | undefined;
     };
-    kind: "group-approval";
-    membership: {
-        role: import("../data").GroupMemberRole;
-        signature: string;
-        userId: string;
-        groupId: string;
-        groupMemberId: string;
-        deleted?: boolean | undefined;
-        publicKey?: string | undefined;
-        signedAt?: number | undefined;
-    };
     seed: {
         users: {
             name: string;
@@ -703,6 +692,17 @@ export declare const groupApprovalSchema: z.ZodObject<{
             signedAt?: number | undefined;
         }[];
     };
+    kind: "group-approval";
+    membership: {
+        role: import("../data").GroupMemberRole;
+        signature: string;
+        userId: string;
+        groupId: string;
+        groupMemberId: string;
+        deleted?: boolean | undefined;
+        publicKey?: string | undefined;
+        signedAt?: number | undefined;
+    };
     approver: {
         publicKey: string;
         userId: string;
@@ -735,17 +735,6 @@ export declare const groupApprovalSchema: z.ZodObject<{
         signedAt?: number | undefined;
         publicRole?: import("../data").GroupMemberRole | undefined;
     };
-    kind: "group-approval";
-    membership: {
-        role: import("../data").GroupMemberRole;
-        signature: string;
-        userId: string;
-        groupId: string;
-        groupMemberId: string;
-        deleted?: boolean | undefined;
-        publicKey?: string | undefined;
-        signedAt?: number | undefined;
-    };
     seed: {
         users: {
             name: string;
@@ -783,6 +772,17 @@ export declare const groupApprovalSchema: z.ZodObject<{
             signedAt?: number | undefined;
         }[];
     };
+    kind: "group-approval";
+    membership: {
+        role: import("../data").GroupMemberRole;
+        signature: string;
+        userId: string;
+        groupId: string;
+        groupMemberId: string;
+        deleted?: boolean | undefined;
+        publicKey?: string | undefined;
+        signedAt?: number | undefined;
+    };
     approver: {
         publicKey: string;
         userId: string;
@@ -1607,17 +1607,6 @@ export declare const inviteMessageSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
         signedAt?: number | undefined;
         publicRole?: import("../data").GroupMemberRole | undefined;
     };
-    kind: "group-approval";
-    membership: {
-        role: import("../data").GroupMemberRole;
-        signature: string;
-        userId: string;
-        groupId: string;
-        groupMemberId: string;
-        deleted?: boolean | undefined;
-        publicKey?: string | undefined;
-        signedAt?: number | undefined;
-    };
     seed: {
         users: {
             name: string;
@@ -1655,6 +1644,17 @@ export declare const inviteMessageSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
             signedAt?: number | undefined;
         }[];
     };
+    kind: "group-approval";
+    membership: {
+        role: import("../data").GroupMemberRole;
+        signature: string;
+        userId: string;
+        groupId: string;
+        groupMemberId: string;
+        deleted?: boolean | undefined;
+        publicKey?: string | undefined;
+        signedAt?: number | undefined;
+    };
     approver: {
         publicKey: string;
         userId: string;
@@ -1687,17 +1687,6 @@ export declare const inviteMessageSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
         signedAt?: number | undefined;
         publicRole?: import("../data").GroupMemberRole | undefined;
     };
-    kind: "group-approval";
-    membership: {
-        role: import("../data").GroupMemberRole;
-        signature: string;
-        userId: string;
-        groupId: string;
-        groupMemberId: string;
-        deleted?: boolean | undefined;
-        publicKey?: string | undefined;
-        signedAt?: number | undefined;
-    };
     seed: {
         users: {
             name: string;
@@ -1735,6 +1724,17 @@ export declare const inviteMessageSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
             signedAt?: number | undefined;
         }[];
     };
+    kind: "group-approval";
+    membership: {
+        role: import("../data").GroupMemberRole;
+        signature: string;
+        userId: string;
+        groupId: string;
+        groupMemberId: string;
+        deleted?: boolean | undefined;
+        publicKey?: string | undefined;
+        signedAt?: number | undefined;
+    };
     approver: {
         publicKey: string;
         userId: string;

package/dist/keys.d.ts

@@ -21,11 +21,16 @@ export declare function hashObject(obj: {
  * legacy insertion-order fallback that keeps pre-existing signatures valid.
  */
 export declare function canonicalJSONString(obj: any): string;
-/** Base64 with URL-safe alphabet and no `=` padding (used throughout keys and wire formats). */
+/**
+ * Base64 with URL-safe alphabet and no `=` padding (used throughout keys and wire formats).
+ * Uses `Buffer` (native in Node, the `buffer` package in browsers).
+ */
 export declare function encodeBase64(data: Uint8Array): string;
 /**
  * Inverse of {@link encodeBase64}; accepts standard or URL-safe base64 and repads as needed.
- * @throws TypeError if `data` is not a string
+ * Accepts exactly what `tweetnacl-util` did (whole groups of four, then at most two `=`), and
+ * returns a fresh `Uint8Array` that owns its buffer.
+ * @throws TypeError if `data` is not a string or not valid base64
  */
 export declare function decodeBase64(data: string): Uint8Array;
 /** Random token as base64url string (`size` raw bytes, default 32). */