@peers-app/peers-sdk 0.23.14 → 0.25.0

package/dist/data/invites.d.ts

@@ -0,0 +1,350 @@
+import { z } from "zod";
+import type { DataContext } from "../context/data-context";
+import { GroupMemberRole } from "./group-member-roles";
+/** Lifecycle of an invite row. */
+export declare const inviteStatusSchema: z.ZodEnum<["pending", "accepted", "declined", "expired", "revoked"]>;
+/** Lifecycle of an invite row. */
+export type InviteStatus = z.infer<typeof inviteStatusSchema>;
+/**
+ * How the invite was issued:
+ * - `direct`: a known contact was invited to a group (3a); the payload is the approval.
+ * - `approve`: group link whose join requests the inviter approves (3b).
+ * - `open`: group link any Admin+ member auto-approves (3c).
+ * - `profile`: the reusable contact QR on the Account screen.
+ * - `contact`: a one-off contact token.
+ */
+export declare const inviteModeSchema: z.ZodEnum<["direct", "approve", "open", "profile", "contact"]>;
+/** How the invite was issued. */
+export type InviteMode = z.infer<typeof inviteModeSchema>;
+/** Outbound delivery progress; `queued` rows are retried when connectivity changes. */
+export declare const inviteDeliveryStateSchema: z.ZodEnum<["queued", "sent"]>;
+/**
+ * One pending or historical invite, synced across the user's devices.
+ *
+ * Boxed payloads are encrypted to the user's box key, which every one of their devices
+ * holds, so storing them in this personal-context table is safe. Rows move to a terminal
+ * status rather than being deleted; terminal rows older than 30 days are purged.
+ */
+export declare const inviteSchema: z.ZodObject<{
+    inviteId: z.ZodEffects<z.ZodString, string, string>;
+    direction: z.ZodEnum<["in", "out"]>;
+    type: z.ZodEnum<["contact", "group"]>;
+    status: z.ZodDefault<z.ZodEnum<["pending", "accepted", "declined", "expired", "revoked"]>>;
+    mode: z.ZodEnum<["direct", "approve", "open", "profile", "contact"]>;
+    /** The other party, once known (unknown for outstanding link invites). */
+    counterpart: z.ZodOptional<z.ZodObject<{
+        userId: z.ZodEffects<z.ZodString, string, string>;
+        publicKey: z.ZodString;
+        publicBoxKey: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        displayName?: string | undefined;
+    }, {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        displayName?: string | undefined;
+    }>>;
+    /** Device the counterpart used, when they told us; lets the network layer connect early. */
+    counterpartDeviceId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    /**
+     * Correlates replies with this row: the token nonce for link invites, a fresh nonce for
+     * direct invites.
+     */
+    nonce: z.ZodOptional<z.ZodString>;
+    groupId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    groupName: z.ZodOptional<z.ZodString>;
+    role: z.ZodOptional<z.ZodNativeEnum<typeof GroupMemberRole>>;
+    /** The signed token: what I issued (out) or what I received/used (in). */
+    token: z.ZodOptional<z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        type: z.ZodEnum<["contact", "group"]>;
+        inviter: z.ZodObject<{
+            userId: z.ZodEffects<z.ZodString, string, string>;
+            publicKey: z.ZodString;
+            publicBoxKey: z.ZodString;
+            displayName: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            publicKey: string;
+            publicBoxKey: string;
+            userId: string;
+            displayName?: string | undefined;
+        }, {
+            publicKey: string;
+            publicBoxKey: string;
+            userId: string;
+            displayName?: string | undefined;
+        }>;
+        expiresAt: z.ZodString;
+        nonce: z.ZodString;
+        epoch: z.ZodNumber;
+        uses: z.ZodUnion<[z.ZodLiteral<1>, z.ZodLiteral<"unlimited">]>;
+        group: z.ZodOptional<z.ZodObject<{
+            groupId: z.ZodEffects<z.ZodString, string, string>;
+            name: z.ZodString;
+            publicKey: z.ZodString;
+            publicBoxKey: z.ZodString;
+            role: z.ZodNativeEnum<typeof GroupMemberRole>;
+            mode: z.ZodEnum<["approve", "open"]>;
+        }, "strict", z.ZodTypeAny, {
+            name: string;
+            role: GroupMemberRole;
+            publicKey: string;
+            groupId: string;
+            publicBoxKey: string;
+            mode: "open" | "approve";
+        }, {
+            name: string;
+            role: GroupMemberRole;
+            publicKey: string;
+            groupId: string;
+            publicBoxKey: string;
+            mode: "open" | "approve";
+        }>>;
+        signature: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        type: "group" | "contact";
+        nonce: string;
+        signature: string;
+        expiresAt: string;
+        v: 1;
+        inviter: {
+            publicKey: string;
+            publicBoxKey: string;
+            userId: string;
+            displayName?: string | undefined;
+        };
+        epoch: number;
+        uses: 1 | "unlimited";
+        group?: {
+            name: string;
+            role: GroupMemberRole;
+            publicKey: string;
+            groupId: string;
+            publicBoxKey: string;
+            mode: "open" | "approve";
+        } | undefined;
+    }, {
+        type: "group" | "contact";
+        nonce: string;
+        signature: string;
+        expiresAt: string;
+        v: 1;
+        inviter: {
+            publicKey: string;
+            publicBoxKey: string;
+            userId: string;
+            displayName?: string | undefined;
+        };
+        epoch: number;
+        uses: 1 | "unlimited";
+        group?: {
+            name: string;
+            role: GroupMemberRole;
+            publicKey: string;
+            groupId: string;
+            publicBoxKey: string;
+            mode: "open" | "approve";
+        } | undefined;
+    }>>;
+    /**
+     * For `in` direct invites: the GroupApproval boxed to my own user box key. For rows whose
+     * `deliveryState` is `queued`: the outbound box (already sealed to `recipientUserId`).
+     */
+    payload: z.ZodOptional<z.ZodObject<{
+        contents: z.ZodString;
+        nonce: z.ZodString;
+        fromPublicKey: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        nonce: string;
+        contents: string;
+        fromPublicKey: string;
+    }, {
+        nonce: string;
+        contents: string;
+        fromPublicKey: string;
+    }>>;
+    /** Inviter's epoch at issue time. */
+    epoch: z.ZodNumber;
+    /** For `in` rows spawned by one of my reusable `out` tokens. */
+    parentInviteId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    deliveryState: z.ZodOptional<z.ZodEnum<["queued", "sent"]>>;
+    /** Outbound recipient for `direct` invites and replies that are still queued. */
+    recipientUserId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    createdAt: z.ZodDefault<z.ZodDate>;
+    expiresAt: z.ZodDate;
+    resolvedAt: z.ZodOptional<z.ZodDate>;
+    note: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type: "group" | "contact";
+    direction: "in" | "out";
+    status: "pending" | "expired" | "accepted" | "declined" | "revoked";
+    expiresAt: Date;
+    createdAt: Date;
+    mode: "direct" | "open" | "approve" | "contact" | "profile";
+    epoch: number;
+    inviteId: string;
+    role?: GroupMemberRole | undefined;
+    nonce?: string | undefined;
+    groupId?: string | undefined;
+    counterpart?: {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        displayName?: string | undefined;
+    } | undefined;
+    counterpartDeviceId?: string | undefined;
+    groupName?: string | undefined;
+    token?: {
+        type: "group" | "contact";
+        nonce: string;
+        signature: string;
+        expiresAt: string;
+        v: 1;
+        inviter: {
+            publicKey: string;
+            publicBoxKey: string;
+            userId: string;
+            displayName?: string | undefined;
+        };
+        epoch: number;
+        uses: 1 | "unlimited";
+        group?: {
+            name: string;
+            role: GroupMemberRole;
+            publicKey: string;
+            groupId: string;
+            publicBoxKey: string;
+            mode: "open" | "approve";
+        } | undefined;
+    } | undefined;
+    payload?: {
+        nonce: string;
+        contents: string;
+        fromPublicKey: string;
+    } | undefined;
+    parentInviteId?: string | undefined;
+    deliveryState?: "queued" | "sent" | undefined;
+    recipientUserId?: string | undefined;
+    resolvedAt?: Date | undefined;
+    note?: string | undefined;
+}, {
+    type: "group" | "contact";
+    direction: "in" | "out";
+    expiresAt: Date;
+    mode: "direct" | "open" | "approve" | "contact" | "profile";
+    epoch: number;
+    inviteId: string;
+    role?: GroupMemberRole | undefined;
+    nonce?: string | undefined;
+    status?: "pending" | "expired" | "accepted" | "declined" | "revoked" | undefined;
+    groupId?: string | undefined;
+    createdAt?: Date | undefined;
+    counterpart?: {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        displayName?: string | undefined;
+    } | undefined;
+    counterpartDeviceId?: string | undefined;
+    groupName?: string | undefined;
+    token?: {
+        type: "group" | "contact";
+        nonce: string;
+        signature: string;
+        expiresAt: string;
+        v: 1;
+        inviter: {
+            publicKey: string;
+            publicBoxKey: string;
+            userId: string;
+            displayName?: string | undefined;
+        };
+        epoch: number;
+        uses: 1 | "unlimited";
+        group?: {
+            name: string;
+            role: GroupMemberRole;
+            publicKey: string;
+            groupId: string;
+            publicBoxKey: string;
+            mode: "open" | "approve";
+        } | undefined;
+    } | undefined;
+    payload?: {
+        nonce: string;
+        contents: string;
+        fromPublicKey: string;
+    } | undefined;
+    parentInviteId?: string | undefined;
+    deliveryState?: "queued" | "sent" | undefined;
+    recipientUserId?: string | undefined;
+    resolvedAt?: Date | undefined;
+    note?: string | undefined;
+}>;
+/** One pending or historical invite. */
+export type IInvite = z.infer<typeof inviteSchema>;
+/**
+ * Accessor for the personal-context {@link Invites} table.
+ *
+ * @param dataContext - Optional data context; defaults to the current singleton.
+ */
+export declare function Invites(dataContext?: DataContext): import("..").Table<{
+    type: "group" | "contact";
+    direction: "in" | "out";
+    status: "pending" | "expired" | "accepted" | "declined" | "revoked";
+    expiresAt: Date;
+    createdAt: Date;
+    mode: "direct" | "open" | "approve" | "contact" | "profile";
+    epoch: number;
+    inviteId: string;
+    role?: GroupMemberRole | undefined;
+    nonce?: string | undefined;
+    groupId?: string | undefined;
+    counterpart?: {
+        publicKey: string;
+        publicBoxKey: string;
+        userId: string;
+        displayName?: string | undefined;
+    } | undefined;
+    counterpartDeviceId?: string | undefined;
+    groupName?: string | undefined;
+    token?: {
+        type: "group" | "contact";
+        nonce: string;
+        signature: string;
+        expiresAt: string;
+        v: 1;
+        inviter: {
+            publicKey: string;
+            publicBoxKey: string;
+            userId: string;
+            displayName?: string | undefined;
+        };
+        epoch: number;
+        uses: 1 | "unlimited";
+        group?: {
+            name: string;
+            role: GroupMemberRole;
+            publicKey: string;
+            groupId: string;
+            publicBoxKey: string;
+            mode: "open" | "approve";
+        } | undefined;
+    } | undefined;
+    payload?: {
+        nonce: string;
+        contents: string;
+        fromPublicKey: string;
+    } | undefined;
+    parentInviteId?: string | undefined;
+    deliveryState?: "queued" | "sent" | undefined;
+    recipientUserId?: string | undefined;
+    resolvedAt?: Date | undefined;
+    note?: string | undefined;
+}>;
+/** Age after which terminal rows are purged. */
+export declare const INVITE_HISTORY_RETENTION_MS: number;

package/dist/data/invites.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INVITE_HISTORY_RETENTION_MS = exports.inviteSchema = exports.inviteDeliveryStateSchema = exports.inviteModeSchema = exports.inviteStatusSchema = void 0;
+exports.Invites = Invites;
+const zod_1 = require("zod");
+const user_context_singleton_1 = require("../context/user-context-singleton");
+const data_box_schema_1 = require("../invites/data-box-schema");
+const invite_token_1 = require("../invites/invite-token");
+const zod_types_1 = require("../types/zod-types");
+const group_member_roles_1 = require("./group-member-roles");
+const table_definitions_system_1 = require("./orm/table-definitions.system");
+const types_1 = require("./orm/types");
+/** Lifecycle of an invite row. */
+exports.inviteStatusSchema = zod_1.z.enum(["pending", "accepted", "declined", "expired", "revoked"]);
+/**
+ * How the invite was issued:
+ * - `direct`: a known contact was invited to a group (3a); the payload is the approval.
+ * - `approve`: group link whose join requests the inviter approves (3b).
+ * - `open`: group link any Admin+ member auto-approves (3c).
+ * - `profile`: the reusable contact QR on the Account screen.
+ * - `contact`: a one-off contact token.
+ */
+exports.inviteModeSchema = zod_1.z.enum(["direct", "approve", "open", "profile", "contact"]);
+/** Outbound delivery progress; `queued` rows are retried when connectivity changes. */
+exports.inviteDeliveryStateSchema = zod_1.z.enum(["queued", "sent"]);
+/**
+ * One pending or historical invite, synced across the user's devices.
+ *
+ * Boxed payloads are encrypted to the user's box key, which every one of their devices
+ * holds, so storing them in this personal-context table is safe. Rows move to a terminal
+ * status rather than being deleted; terminal rows older than 30 days are purged.
+ */
+exports.inviteSchema = zod_1.z.object({
+    inviteId: zod_types_1.zodPeerId,
+    direction: zod_1.z.enum(["in", "out"]).describe("Whether I issued (out) or received (in) this item"),
+    type: zod_1.z.enum(["contact", "group"]),
+    status: exports.inviteStatusSchema.default("pending"),
+    mode: exports.inviteModeSchema,
+    /** The other party, once known (unknown for outstanding link invites). */
+    counterpart: invite_token_1.inviteIdentitySchema.optional(),
+    /** Device the counterpart used, when they told us; lets the network layer connect early. */
+    counterpartDeviceId: zod_types_1.zodPeerId.optional(),
+    /**
+     * Correlates replies with this row: the token nonce for link invites, a fresh nonce for
+     * direct invites.
+     */
+    nonce: zod_1.z
+        .string()
+        .regex(/^[A-Za-z0-9_-]+$/)
+        .length(22)
+        .optional(),
+    groupId: zod_types_1.zodPeerId.optional(),
+    groupName: zod_1.z.string().optional(),
+    role: zod_1.z.nativeEnum(group_member_roles_1.GroupMemberRole).optional().describe("Granted role for group invites"),
+    /** The signed token: what I issued (out) or what I received/used (in). */
+    token: invite_token_1.peersInviteSchema.optional(),
+    /**
+     * For `in` direct invites: the GroupApproval boxed to my own user box key. For rows whose
+     * `deliveryState` is `queued`: the outbound box (already sealed to `recipientUserId`).
+     */
+    payload: data_box_schema_1.dataBoxSchema.optional(),
+    /** Inviter's epoch at issue time. */
+    epoch: zod_1.z.number().int().min(0),
+    /** For `in` rows spawned by one of my reusable `out` tokens. */
+    parentInviteId: zod_types_1.zodPeerId.optional(),
+    deliveryState: exports.inviteDeliveryStateSchema.optional(),
+    /** Outbound recipient for `direct` invites and replies that are still queued. */
+    recipientUserId: zod_types_1.zodPeerId.optional(),
+    createdAt: zod_1.z.date().default(() => new Date()),
+    expiresAt: zod_1.z.date(),
+    resolvedAt: zod_1.z.date().optional(),
+    note: zod_1.z.string().max(500).optional().describe("Sanitized status text for the UI"),
+});
+const metaData = {
+    name: "Invites",
+    description: "Pending and historical contact and group invites, synced across my devices.",
+    primaryKeyName: "inviteId",
+    fields: (0, types_1.schemaToFields)(exports.inviteSchema),
+    iconClassName: "bi bi-envelope-paper",
+    indexes: [
+        { fields: ["status"] },
+        { fields: ["direction"] },
+        { fields: ["groupId"] },
+        { fields: ["parentInviteId"] },
+        { fields: ["nonce"] },
+        { fields: ["deliveryState"] },
+    ],
+};
+(0, table_definitions_system_1.registerSystemTableDefinition)(metaData, exports.inviteSchema);
+/**
+ * Accessor for the personal-context {@link Invites} table.
+ *
+ * @param dataContext - Optional data context; defaults to the current singleton.
+ */
+function Invites(dataContext) {
+    return (0, user_context_singleton_1.getTableContainer)(dataContext).getTable(metaData, exports.inviteSchema);
+}
+/** Age after which terminal rows are purged. */
+exports.INVITE_HISTORY_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;

package/dist/data/orm/data-query.d.ts

@@ -2,6 +2,7 @@ export interface ISaveOptions {
     restoreIfDeleted?: boolean;
     saveAsSnapshot?: boolean;
     weakInsert?: boolean;
+    insertOnly?: boolean;
 }
 export interface IDataSource<T extends {
     [key: string]: any;

package/dist/data/orm/sql.data-source.d.ts

@@ -1,7 +1,7 @@
 import type { z } from "zod";
 import type { Emitter } from "../../events";
 import type { FieldType, IField } from "../../types/field-type";
-import { type DataFilter, type ICursorIterable, type IDataQueryParams, type IDataSource } from "./data-query";
+import { type DataFilter, type ICursorIterable, type IDataQueryParams, type IDataSource, type ISaveOptions } from "./data-query";
 import type { ISqlDb } from "./sql-db";
 import type { IDataChangedEvent } from "./subscribable.data-source";
 import { type ITableMetaData } from "./types";
@@ -27,7 +27,8 @@ export declare class SQLDataSource<T extends {
     findOne(filter?: DataFilter<T>, opts?: {
         enforceUnique?: boolean;
     }): Promise<T | undefined>;
-    save(record: T): Promise<T>;
+    /** Insert or update by primary key. Honors `insertOnly` (leave an existing row untouched). */
+    save(record: T, opts?: ISaveOptions): Promise<T>;
     sqlRecordToJsRecord(record: any): T;
     insert(record: T): Promise<T>;
     update(record: T): Promise<T>;

package/dist/data/orm/sql.data-source.js

@@ -208,7 +208,8 @@ class SQLDataSource {
         }
         return records[0];
     }
-    async save(record) {
+    /** Insert or update by primary key. Honors `insertOnly` (leave an existing row untouched). */
+    async save(record, opts) {
         await this.initTable();
         let newRecord = true;
         const primaryKey = record[this.metaData.primaryKeyName];
@@ -221,9 +222,10 @@ class SQLDataSource {
         if (newRecord) {
             return await this.insert(record);
         }
-        else {
-            return await this.update(record);
+        if (opts?.insertOnly) {
+            return (await this.get(primaryKey));
         }
+        return await this.update(record);
     }
     sqlRecordToJsRecord(record) {
         if (record) {

package/dist/data/orm/subscribable.data-source.d.ts

@@ -1,5 +1,5 @@
 import { Emitter, type Event } from "../../events";
-import { type DataFilter, type ICursorIterable, type IDataQueryParams, type IDataSource } from "./data-query";
+import { type DataFilter, type ICursorIterable, type IDataQueryParams, type IDataSource, type ISaveOptions } from "./data-query";
 export interface IDataChangedEvent<T> {
     dataObject: T;
     op: "insert" | "update" | "delete";
@@ -18,7 +18,8 @@ export declare class SubscribableDataSource<T extends {
     list(filter?: DataFilter<T>, opts?: IDataQueryParams<T>): Promise<T[]>;
     count(filter?: DataFilter<T>): Promise<number>;
     cursor(filter?: DataFilter<T>, opts?: IDataQueryParams<T>): ICursorIterable<T>;
-    save(record: T): Promise<T>;
+    /** Insert or update by primary key. Honors `insertOnly` (leave an existing row untouched). */
+    save(record: T, opts?: ISaveOptions): Promise<T>;
     insert(record: T): Promise<T>;
     update(record: T): Promise<T>;
     delete(idOrRecord: string | T): Promise<void>;

package/dist/data/orm/subscribable.data-source.js

@@ -33,21 +33,17 @@ class SubscribableDataSource {
     cursor(filter = {}, opts = {}) {
         return (0, data_query_1.dataSourceCursor)(this.dataSource || this, filter, opts);
     }
-    async save(record) {
-        let newRecord = true;
+    /** Insert or update by primary key. Honors `insertOnly` (leave an existing row untouched). */
+    async save(record, opts) {
         const primaryKey = record[this.primaryKeyName];
-        if (primaryKey) {
-            const existingRecord = await this.dataSource.get(primaryKey);
-            if (existingRecord) {
-                newRecord = false;
-            }
-        }
-        if (newRecord) {
+        const existingRecord = primaryKey ? await this.dataSource.get(primaryKey) : undefined;
+        if (!existingRecord) {
             return await this.insert(record);
         }
-        else {
-            return await this.update(record);
+        if (opts?.insertOnly) {
+            return existingRecord;
         }
+        return await this.update(record);
     }
     async insert(record) {
         record = await this.dataSource.insert(record);

package/dist/data/users.d.ts

@@ -27,6 +27,17 @@ export type IUser = z.infer<typeof userSchema>;
 /** User table with owner-signature enforcement outside the personal context. */
 export declare class UsersTable extends Table<IUser> {
     static isPassthrough: boolean;
+    /**
+     * Save a user row. Outside the personal context the write must carry a valid owner
+     * signature (or be an unsigned stub where nothing signed exists yet).
+     *
+     * An unsigned `weakInsert` is a discovery placeholder (connection handshake, invite
+     * identity, join approval). It is written `insertOnly`: seed the row when the table has
+     * nothing for that user, otherwise leave whatever is stored alone. Checking here and then
+     * writing is not enough — the owner's signed row (via sync or `syncMyUserToGroup`) can land
+     * between the two, and a plain update would replace it with an unsigned snapshot carrying a
+     * fresh timestamp that then wins last-write-wins on every device.
+     */
     save(user: IUser, opts?: ISaveOptions): Promise<IUser>;
     signAndSave(user: IUser, opts?: ISaveOptions): Promise<IUser>;
     private static addSignatureToUser;

package/dist/data/users.js

@@ -79,9 +79,23 @@ let UsersTable = (() => {
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
         static isPassthrough = false;
+        /**
+         * Save a user row. Outside the personal context the write must carry a valid owner
+         * signature (or be an unsigned stub where nothing signed exists yet).
+         *
+         * An unsigned `weakInsert` is a discovery placeholder (connection handshake, invite
+         * identity, join approval). It is written `insertOnly`: seed the row when the table has
+         * nothing for that user, otherwise leave whatever is stored alone. Checking here and then
+         * writing is not enough — the owner's signed row (via sync or `syncMyUserToGroup`) can land
+         * between the two, and a plain update would replace it with an unsigned snapshot carrying a
+         * fresh timestamp that then wins last-write-wins on every device.
+         */
         async save(user, opts) {
             opts = opts || {};
             opts = { saveAsSnapshot: true, ...opts };
+            if (opts.weakInsert && !user.signature) {
+                opts = { ...opts, insertOnly: true };
+            }
             if (UsersTable.isPassthrough) {
                 return super.save(user, opts);
             }
@@ -93,6 +107,9 @@ let UsersTable = (() => {
             }
             // Get the old user record if it exists
             const oldUser = await this.get(user.userId);
+            if (opts.insertOnly && oldUser) {
+                return oldUser;
+            }
             await (0, user_permissions_1.verifyUserSignature)(user, oldUser);
             return super.save(user, opts);
         }

package/dist/device/device-election.d.ts

@@ -18,11 +18,31 @@ export interface ISortConnectionsArgs {
     unconnectedDeviceIds: Set<string>;
     connections: ISortableConnection[];
 }
+/** A direct connection annotated with the shared groups it serves, as seen by the shedding logic. */
+export interface IShedCandidateConnection extends IDeviceConnection {
+    /** Data-context ids this connection is a member of on both sides. */
+    groups: string[];
+    /**
+     * How many other devices the remote is known to be connected to (from its last network
+     * snapshot). `undefined` when the remote's topology is not known yet. A device whose only
+     * known route into the mesh is this connection has `0` alternatives.
+     */
+    alternativeRoutes?: number;
+}
+/** Inputs for {@link getLeastPreferredConnection}. */
 export interface IGetLeastPreferredConnectionArgs {
-    connections: (IDeviceConnection & {
-        groups: string[];
-    })[];
+    connections: IShedCandidateConnection[];
     preferredDeviceIds: string[];
     preferredByDeviceIds: string[];
 }
+/**
+ * Choose the connection to drop when this device is at its connection cap.
+ *
+ * Preference order: connections that are neither preferred by us nor prefer us, then
+ * connections we do not depend on, then connections that do not depend on us, then anything.
+ * Within the chosen tier, a remote whose only known route into the mesh is this connection is
+ * never shed while some other candidate is known to have alternative routes; shedding it would
+ * isolate it and it would only redial us and force another shed. Remaining ties go to the
+ * connection serving the fewest groups, then to the worst latency x error rate.
+ */
 export declare function getLeastPreferredConnection({ connections, preferredDeviceIds, preferredByDeviceIds, }: IGetLeastPreferredConnectionArgs): IDeviceConnection | undefined;

package/dist/device/device-election.js

@@ -104,6 +104,16 @@ function sortConnections({ myDeviceId, connections, unconnectedDeviceIds }) {
     });
     return connections;
 }
+/**
+ * Choose the connection to drop when this device is at its connection cap.
+ *
+ * Preference order: connections that are neither preferred by us nor prefer us, then
+ * connections we do not depend on, then connections that do not depend on us, then anything.
+ * Within the chosen tier, a remote whose only known route into the mesh is this connection is
+ * never shed while some other candidate is known to have alternative routes; shedding it would
+ * isolate it and it would only redial us and force another shed. Remaining ties go to the
+ * connection serving the fewest groups, then to the worst latency x error rate.
+ */
 function getLeastPreferredConnection({ connections, preferredDeviceIds, preferredByDeviceIds, }) {
     // first consider connections that are not critical to me and I'm not critical to them
     let candidates = connections.filter((c) => !(preferredByDeviceIds.includes(c.deviceId) || preferredDeviceIds.includes(c.deviceId)));
@@ -119,6 +129,11 @@ function getLeastPreferredConnection({ connections, preferredDeviceIds, preferre
         // if none, then just consider all connections
         candidates = [...connections];
     }
+    // never strand a device: if anyone here is known to have another way into the mesh, leave
+    // the candidates whose only known route is through us alone
+    if (candidates.some((c) => (c.alternativeRoutes ?? 0) > 0)) {
+        candidates = candidates.filter((c) => c.alternativeRoutes !== 0);
+    }
     // start with random order to avoid biasing the selection to newer connections
     candidates = (0, lodash_1.shuffle)(candidates);
     // sort by latency * error rate (smaller is better)