@peers-app/peers-sdk 0.25.14 → 0.25.16

package/dist/data/invites.d.ts

@@ -37,15 +37,33 @@ export declare const inviteSchema: z.ZodObject<{
         publicKey: z.ZodString;
         publicBoxKey: z.ZodString;
         displayName: z.ZodOptional<z.ZodString>;
+        anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<["peers-services", "https"]>;
+            url: z.ZodString;
+        }, "strip", z.ZodTypeAny, {
+            type: "peers-services" | "https";
+            url: string;
+        }, {
+            type: "peers-services" | "https";
+            url: string;
+        }>, "many">>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     }>>;
     /** Device the counterpart used, when they told us; lets the network layer connect early. */
@@ -67,15 +85,33 @@ export declare const inviteSchema: z.ZodObject<{
             publicKey: z.ZodString;
             publicBoxKey: z.ZodString;
             displayName: z.ZodOptional<z.ZodString>;
+            anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<["peers-services", "https"]>;
+                url: z.ZodString;
+            }, "strip", z.ZodTypeAny, {
+                type: "peers-services" | "https";
+                url: string;
+            }, {
+                type: "peers-services" | "https";
+                url: string;
+            }>, "many">>;
         }, "strict", z.ZodTypeAny, {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
+            publicBoxKey: string;
+            anchors?: {
+                type: "peers-services" | "https";
+                url: string;
+            }[] | undefined;
             displayName?: string | undefined;
         }, {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
+            publicBoxKey: string;
+            anchors?: {
+                type: "peers-services" | "https";
+                url: string;
+            }[] | undefined;
             displayName?: string | undefined;
         }>;
         expiresAt: z.ZodString;
@@ -93,15 +129,15 @@ export declare const inviteSchema: z.ZodObject<{
             name: string;
             role: GroupMemberRole;
             publicKey: string;
-            groupId: string;
             publicBoxKey: string;
+            groupId: string;
             mode: "open" | "approve";
         }, {
             name: string;
             role: GroupMemberRole;
             publicKey: string;
-            groupId: string;
             publicBoxKey: string;
+            groupId: string;
             mode: "open" | "approve";
         }>>;
         signature: z.ZodString;
@@ -113,8 +149,12 @@ export declare const inviteSchema: z.ZodObject<{
         v: 1;
         inviter: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
+            publicBoxKey: string;
+            anchors?: {
+                type: "peers-services" | "https";
+                url: string;
+            }[] | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -123,8 +163,8 @@ export declare const inviteSchema: z.ZodObject<{
             name: string;
             role: GroupMemberRole;
             publicKey: string;
-            groupId: string;
             publicBoxKey: string;
+            groupId: string;
             mode: "open" | "approve";
         } | undefined;
     }, {
@@ -135,8 +175,12 @@ export declare const inviteSchema: z.ZodObject<{
         v: 1;
         inviter: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
+            publicBoxKey: string;
+            anchors?: {
+                type: "peers-services" | "https";
+                url: string;
+            }[] | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -145,8 +189,8 @@ export declare const inviteSchema: z.ZodObject<{
             name: string;
             role: GroupMemberRole;
             publicKey: string;
-            groupId: string;
             publicBoxKey: string;
+            groupId: string;
             mode: "open" | "approve";
         } | undefined;
     }>>;
@@ -181,10 +225,10 @@ export declare const inviteSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     type: "group" | "device" | "contact";
     direction: "in" | "out";
-    status: "pending" | "expired" | "accepted" | "declined" | "revoked";
+    status: "pending" | "expired" | "accepted" | "revoked" | "declined";
     createdAt: Date;
     expiresAt: Date;
-    mode: "direct" | "open" | "approve" | "contact" | "profile";
+    mode: "direct" | "open" | "profile" | "approve" | "contact";
     epoch: number;
     inviteId: string;
     role?: GroupMemberRole | undefined;
@@ -203,8 +247,12 @@ export declare const inviteSchema: z.ZodObject<{
         v: 1;
         inviter: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
+            publicBoxKey: string;
+            anchors?: {
+                type: "peers-services" | "https";
+                url: string;
+            }[] | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -213,15 +261,19 @@ export declare const inviteSchema: z.ZodObject<{
             name: string;
             role: GroupMemberRole;
             publicKey: string;
-            groupId: string;
             publicBoxKey: string;
+            groupId: string;
             mode: "open" | "approve";
         } | undefined;
     } | undefined;
     counterpart?: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;
@@ -235,12 +287,12 @@ export declare const inviteSchema: z.ZodObject<{
     type: "group" | "device" | "contact";
     direction: "in" | "out";
     expiresAt: Date;
-    mode: "direct" | "open" | "approve" | "contact" | "profile";
+    mode: "direct" | "open" | "profile" | "approve" | "contact";
     epoch: number;
     inviteId: string;
     role?: GroupMemberRole | undefined;
     nonce?: string | undefined;
-    status?: "pending" | "expired" | "accepted" | "declined" | "revoked" | undefined;
+    status?: "pending" | "expired" | "accepted" | "revoked" | "declined" | undefined;
     groupId?: string | undefined;
     createdAt?: Date | undefined;
     payload?: {
@@ -256,8 +308,12 @@ export declare const inviteSchema: z.ZodObject<{
         v: 1;
         inviter: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
+            publicBoxKey: string;
+            anchors?: {
+                type: "peers-services" | "https";
+                url: string;
+            }[] | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -266,15 +322,19 @@ export declare const inviteSchema: z.ZodObject<{
             name: string;
             role: GroupMemberRole;
             publicKey: string;
-            groupId: string;
             publicBoxKey: string;
+            groupId: string;
             mode: "open" | "approve";
         } | undefined;
     } | undefined;
     counterpart?: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;
@@ -295,10 +355,10 @@ export type IInvite = z.infer<typeof inviteSchema>;
 export declare function Invites(dataContext?: DataContext): import("..").Table<{
     type: "group" | "device" | "contact";
     direction: "in" | "out";
-    status: "pending" | "expired" | "accepted" | "declined" | "revoked";
+    status: "pending" | "expired" | "accepted" | "revoked" | "declined";
     createdAt: Date;
     expiresAt: Date;
-    mode: "direct" | "open" | "approve" | "contact" | "profile";
+    mode: "direct" | "open" | "profile" | "approve" | "contact";
     epoch: number;
     inviteId: string;
     role?: GroupMemberRole | undefined;
@@ -317,8 +377,12 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
         v: 1;
         inviter: {
             publicKey: string;
-            publicBoxKey: string;
             userId: string;
+            publicBoxKey: string;
+            anchors?: {
+                type: "peers-services" | "https";
+                url: string;
+            }[] | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -327,15 +391,19 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
             name: string;
             role: GroupMemberRole;
             publicKey: string;
-            groupId: string;
             publicBoxKey: string;
+            groupId: string;
             mode: "open" | "approve";
         } | undefined;
     } | undefined;
     counterpart?: {
         publicKey: string;
-        publicBoxKey: string;
         userId: string;
+        publicBoxKey: string;
+        anchors?: {
+            type: "peers-services" | "https";
+            url: string;
+        }[] | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;

package/dist/data/persistent-vars.d.ts

@@ -63,6 +63,14 @@ export declare class PersistentVarsTable extends Table<IPersistentVar> {
     update(persistentVar: IPersistentVar): Promise<IPersistentVar>;
     /** Save a variable, assigning its deterministic ID and encrypting new secret plaintext. */
     save(persistentVar: IPersistentVar, opts?: ISaveOptions): Promise<IPersistentVar>;
+    /**
+     * Replace a secret variable's stored ciphertext as-is, without passing it through
+     * `rpcServerCalls.encryptData` again. Used by key rotation, which re-wraps every personal
+     * secret from the old user key to the new one and has already produced the new ciphertext.
+     *
+     * @throws When the variable is not marked `isSecret`
+     */
+    replaceEncryptedValue(persistentVar: IPersistentVar, encryptedValue: string): Promise<IPersistentVar>;
     /**
      * Replace a legacy random record ID without re-encrypting its already-stored value.
      *

package/dist/data/persistent-vars.js

@@ -109,11 +109,14 @@ function persistentVarIdentityWinner(left, right) {
 let PersistentVarsTable = (() => {
     let _classSuper = table_1.Table;
     let _instanceExtraInitializers = [];
+    let _replaceEncryptedValue_decorators;
     let _migrateLegacyId_decorators;
     return class PersistentVarsTable extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            _replaceEncryptedValue_decorators = [(0, decorators_1.ProxyClientTableMethodCalls)()];
             _migrateLegacyId_decorators = [(0, decorators_1.ProxyClientTableMethodCalls)()];
+            __esDecorate(this, null, _replaceEncryptedValue_decorators, { kind: "method", name: "replaceEncryptedValue", static: false, private: false, access: { has: obj => "replaceEncryptedValue" in obj, get: obj => obj.replaceEncryptedValue }, metadata: _metadata }, null, _instanceExtraInitializers);
             __esDecorate(this, null, _migrateLegacyId_decorators, { kind: "method", name: "migrateLegacyId", static: false, private: false, access: { has: obj => "migrateLegacyId" in obj, get: obj => obj.migrateLegacyId }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
@@ -145,6 +148,19 @@ let PersistentVarsTable = (() => {
             opts = { saveAsSnapshot: true, ...opts };
             return super.save(persistentVar, opts);
         }
+        /**
+         * Replace a secret variable's stored ciphertext as-is, without passing it through
+         * `rpcServerCalls.encryptData` again. Used by key rotation, which re-wraps every personal
+         * secret from the old user key to the new one and has already produced the new ciphertext.
+         *
+         * @throws When the variable is not marked `isSecret`
+         */
+        async replaceEncryptedValue(persistentVar, encryptedValue) {
+            if (!persistentVar.isSecret) {
+                throw new Error(`Persistent variable ${persistentVar.name} is not a secret`);
+            }
+            return super.save({ ...persistentVar, value: { value: encryptedValue }, modifiedAt: Date.now() }, { saveAsSnapshot: true });
+        }
         /**
          * Replace a legacy random record ID without re-encrypting its already-stored value.
          *

package/dist/data/tool-access-approvals.d.ts

@@ -46,9 +46,9 @@ export declare const toolAccessApprovalSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     nonce: string;
     status: ToolAccessApprovalStatus;
-    scope: ToolAccessApprovalScope;
     userId: string;
     toolId: string;
+    scope: ToolAccessApprovalScope;
     dataContextId: string;
     createdAt: Date;
     expiresAt: Date;
@@ -102,9 +102,9 @@ export type IToolAccessApproval = z.infer<typeof toolAccessApprovalSchema>;
 export declare function ToolAccessApprovals(dataContext?: DataContext): import("..").Table<{
     nonce: string;
     status: ToolAccessApprovalStatus;
-    scope: ToolAccessApprovalScope;
     userId: string;
     toolId: string;
+    scope: ToolAccessApprovalScope;
     dataContextId: string;
     createdAt: Date;
     expiresAt: Date;

package/dist/data/user-permissions.d.ts

@@ -1,15 +1,23 @@
 import type { IUser } from "./users";
 /**
- * Signs a user object with the provided secret key
+ * Signs a user object with the provided secret key. The `anchors` list is kept on the row
+ * but is not covered by the signature; see {@link verifyUserSignature}.
  * @param user The user object to sign
  * @param secretKey The secret key to sign with
  * @returns IUser The signed user object
  */
 export declare function signUserObject(user: IUser, secretKey: string): IUser;
 /**
- * Verifies that a user update signature is valid, throws on invalid signature
+ * Verifies that a user update signature is valid, throws on invalid signature.
+ * The `anchors` list is not part of what is verified.
  * @param user The user record to verify
  * @param oldUser The existing user record (if any)
  * @throws Error if signature is invalid or unauthorized
  */
 export declare function verifyUserSignature(user: IUser, oldUser?: IUser): void;
+/**
+ * Checks that `user` is signed by its own `publicKey`, ignoring any key already on record.
+ * Used after the anchors have confirmed a key change: the row still has to be the new key's.
+ * @throws Error if the signature is missing, invalid, or by another key
+ */
+export declare function verifyUserSignedBySelf(user: IUser): void;

package/dist/data/user-permissions.js

@@ -2,18 +2,34 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signUserObject = signUserObject;
 exports.verifyUserSignature = verifyUserSignature;
+exports.verifyUserSignedBySelf = verifyUserSignedBySelf;
 const keys_1 = require("../keys");
 /**
- * Signs a user object with the provided secret key
+ * The part of a `Users` row the owner signs: everything but `anchors`.
+ *
+ * The anchor list on record is decided by the anchors themselves (the on-record rule), not
+ * by whoever wrote the row. A peer that confirms a key change stores the row with the list
+ * on record, and a peer on an older release stores the row without the field at all. Both
+ * must still verify, so the list is carried beside the signature rather than under it.
+ */
+function signedPart(user) {
+    const { anchors: _anchors, ...rest } = user;
+    return rest;
+}
+/**
+ * Signs a user object with the provided secret key. The `anchors` list is kept on the row
+ * but is not covered by the signature; see {@link verifyUserSignature}.
  * @param user The user object to sign
  * @param secretKey The secret key to sign with
  * @returns IUser The signed user object
  */
 function signUserObject(user, secretKey) {
-    return (0, keys_1.addSignatureToObject)(user, secretKey);
+    const signed = (0, keys_1.addSignatureToObject)(signedPart(user), secretKey);
+    return user.anchors ? { ...signed, anchors: user.anchors } : signed;
 }
 /**
- * Verifies that a user update signature is valid, throws on invalid signature
+ * Verifies that a user update signature is valid, throws on invalid signature.
+ * The `anchors` list is not part of what is verified.
  * @param user The user record to verify
  * @param oldUser The existing user record (if any)
  * @throws Error if signature is invalid or unauthorized
@@ -26,7 +42,7 @@ function verifyUserSignature(user, oldUser) {
         }
         return;
     }
-    (0, keys_1.verifyObjectSignature)(user);
+    (0, keys_1.verifyObjectSignature)(signedPart(user));
     const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(user) ?? "";
     // New user: signature must match their own public key
     if (!oldUser) {
@@ -44,3 +60,18 @@ function verifyUserSignature(user, oldUser) {
         throw new Error("Public key changes are not currently supported");
     }
 }
+/**
+ * Checks that `user` is signed by its own `publicKey`, ignoring any key already on record.
+ * Used after the anchors have confirmed a key change: the row still has to be the new key's.
+ * @throws Error if the signature is missing, invalid, or by another key
+ */
+function verifyUserSignedBySelf(user) {
+    if (!user.signature) {
+        throw new Error("A confirmed key change still has to be signed by the new key");
+    }
+    (0, keys_1.verifyObjectSignature)(signedPart(user));
+    const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(user) ?? "";
+    if (signerPublicKey !== user.publicKey) {
+        throw new Error("User signature must be signed with their own public key");
+    }
+}

package/dist/data/user-permissions.test.js

@@ -201,6 +201,32 @@ describe("User Permissions Logic", () => {
             expect(() => (0, user_permissions_1.verifyUserSignature)(signedIncoming, existingStub)).not.toThrow();
         });
     });
+    describe("verifyUserSignature - anchors are not part of the claim", () => {
+        // The anchor list on record is decided by the anchors, not by the row's author. A peer
+        // stores a confirmed row with the list on record, and a peer on an older release stores
+        // the row without the field at all. Both must still verify.
+        const anchorA = { type: "https", url: "https://a.example/peers-identity.json" };
+        const anchorB = { type: "https", url: "https://b.example/peers-identity.json" };
+        it("verifies a signed row after its anchor list is replaced or removed", () => {
+            const signed = (0, user_permissions_1.signUserObject)({ ...testUser, anchors: [anchorA] }, userKeys.secretKey);
+            expect(() => (0, user_permissions_1.verifyUserSignature)({ ...signed, anchors: [anchorB] })).not.toThrow();
+            const { anchors: _dropped, ...withoutAnchors } = signed;
+            expect(() => (0, user_permissions_1.verifyUserSignature)(withoutAnchors)).not.toThrow();
+        });
+        it("verifies a row signed without anchors after a list is added", () => {
+            const signed = (0, user_permissions_1.signUserObject)(testUser, userKeys.secretKey);
+            expect(() => (0, user_permissions_1.verifyUserSignature)({ ...signed, anchors: [anchorA] })).not.toThrow();
+        });
+        it("still rejects a change to any other field", () => {
+            const signed = (0, user_permissions_1.signUserObject)({ ...testUser, anchors: [anchorA] }, userKeys.secretKey);
+            expect(() => (0, user_permissions_1.verifyUserSignature)({ ...signed, name: "Someone else" })).toThrow();
+            expect(() => (0, user_permissions_1.verifyUserSignature)({ ...signed, publicBoxKey: otherUserKeys.publicBoxKey })).toThrow();
+        });
+        it("does not leave the anchors off the signed row", () => {
+            const signed = (0, user_permissions_1.signUserObject)({ ...testUser, anchors: [anchorA] }, userKeys.secretKey);
+            expect(signed.anchors).toEqual([anchorA]);
+        });
+    });
     describe("edge cases and error handling", () => {
         it("should handle undefined user gracefully", () => {
             // @ts-expect-error - Testing edge case

package/dist/data/users.d.ts

@@ -8,28 +8,72 @@ export declare const userSchema: z.ZodObject<{
     name: z.ZodString;
     publicKey: z.ZodString;
     publicBoxKey: z.ZodString;
+    anchors: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<["peers-services", "https"]>;
+        url: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        type: "peers-services" | "https";
+        url: string;
+    }, {
+        type: "peers-services" | "https";
+        url: string;
+    }>, "many">>;
     signature: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     publicKey: string;
-    publicBoxKey: string;
     userId: string;
+    publicBoxKey: string;
     signature?: string | undefined;
+    anchors?: {
+        type: "peers-services" | "https";
+        url: string;
+    }[] | undefined;
 }, {
     name: string;
     publicKey: string;
-    publicBoxKey: string;
     userId: string;
+    publicBoxKey: string;
     signature?: string | undefined;
+    anchors?: {
+        type: "peers-services" | "https";
+        url: string;
+    }[] | undefined;
 }>;
 /** A signed user profile shared across personal and group contexts. */
 export type IUser = z.infer<typeof userSchema>;
+/**
+ * Writes a key the resolver already confirmed. Bypasses the contact-row guard,
+ * which would otherwise call the resolver again.
+ */
+export declare function writeResolvedUserKey(dataContext: DataContext, user: IUser): Promise<IUser>;
+/** Outcome of a {@link UserRowChangeGuard}. See `resolveUserRowChange` in the identity module. */
+export type UserRowChangeVerdict = {
+    action: "apply";
+    row: IUser;
+} | {
+    action: "defer";
+    reason: string;
+} | {
+    action: "refuse";
+    reason: string;
+};
+/**
+ * Consulted by {@link UsersTable.save} when another user's row already exists in the table.
+ * Decides whether a different key or anchor list may be stored, against the anchors on
+ * record. `apply` carries the row to store, whose `anchors` may have been replaced by the
+ * list on record.
+ */
+export type UserRowChangeGuard = (personalContext: DataContext, incoming: IUser, existing: IUser) => Promise<UserRowChangeVerdict>;
+/** Installs the identity check used by {@link UsersTable.save}. The identity module sets this. */
+export declare function setUserRowChangeGuard(guard: UserRowChangeGuard | undefined): void;
 /** User table with owner-signature enforcement outside the personal context. */
 export declare class UsersTable extends Table<IUser> {
     static isPassthrough: boolean;
     /**
-     * Save a user row. Outside the personal context the write must carry a valid owner
-     * signature (or be an unsigned stub where nothing signed exists yet).
+     * Save a user row. A contact row, in the personal table or a group, must carry a
+     * valid owner signature (or be an unsigned stub where nothing signed exists yet).
+     * The owner's own personal row is unrestricted.
      *
      * An unsigned `weakInsert` is a discovery placeholder (connection handshake, invite
      * identity, join approval). It is written `insertOnly`: seed the row when the table has

package/dist/data/users.js

@@ -35,10 +35,14 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UsersTable = exports.userSchema = void 0;
+exports.writeResolvedUserKey = writeResolvedUserKey;
+exports.setUserRowChangeGuard = setUserRowChangeGuard;
 exports.Users = Users;
 exports.getMe = getMe;
 const zod_1 = require("zod");
 const user_context_singleton_1 = require("../context/user-context-singleton");
+const anchor_document_1 = require("../identity/anchor-document");
+const anchor_resolution_1 = require("../identity/anchor-resolution");
 const zod_types_1 = require("../types/zod-types");
 const devices_1 = require("./devices");
 const decorators_1 = require("./orm/decorators");
@@ -54,6 +58,10 @@ exports.userSchema = zod_1.z.object({
     publicBoxKey: zod_1.z
         .string()
         .describe("The public key to use to encrypt data that only this user can decrypt"),
+    anchors: zod_1.z
+        .array(anchor_document_1.anchorRefSchema)
+        .optional()
+        .describe("Anchors on record for this user. A peer that already has a list updates it from those anchors, not from a row that arrives with a new key. Not covered by the row's signature"),
     signature: zod_1.z
         .string()
         .optional()
@@ -66,6 +74,34 @@ const metaData = {
     fields: (0, types_1.schemaToFields)(exports.userSchema),
     indexes: [{ fields: ["name"] }, { fields: ["publicKey"] }, { fields: ["publicBoxKey"] }],
 };
+/**
+ * Marks a save performed by the resolver after anchors confirmed a key.
+ * A symbol so a proxied client cannot set it: JSON drops symbols, and a
+ * remote save of a contact row still has to pass the anchor check.
+ */
+const IDENTITY_RESOLUTION = Symbol("identityResolution");
+function isResolutionWrite(opts) {
+    return Boolean(opts && opts[IDENTITY_RESOLUTION]);
+}
+/**
+ * Writes a key the resolver already confirmed. Bypasses the contact-row guard,
+ * which would otherwise call the resolver again.
+ */
+async function writeResolvedUserKey(dataContext, user) {
+    return Users(dataContext).save(user, {
+        saveAsSnapshot: true,
+        [IDENTITY_RESOLUTION]: true,
+    });
+}
+/** Until the identity module installs its guard, any key or anchor change is refused. */
+const refuseIdentityChanges = async (_personalContext, incoming, existing) => incoming.publicKey !== existing.publicKey || !(0, anchor_resolution_1.sameAnchorList)(existing.anchors, incoming.anchors)
+    ? { action: "refuse", reason: "Identity changes need the identity module" }
+    : { action: "apply", row: incoming };
+let userRowChangeGuard = refuseIdentityChanges;
+/** Installs the identity check used by {@link UsersTable.save}. The identity module sets this. */
+function setUserRowChangeGuard(guard) {
+    userRowChangeGuard = guard ?? refuseIdentityChanges;
+}
 /** User table with owner-signature enforcement outside the personal context. */
 let UsersTable = (() => {
     let _classSuper = table_1.Table;
@@ -80,8 +116,9 @@ let UsersTable = (() => {
         }
         static isPassthrough = false;
         /**
-         * Save a user row. Outside the personal context the write must carry a valid owner
-         * signature (or be an unsigned stub where nothing signed exists yet).
+         * Save a user row. A contact row, in the personal table or a group, must carry a
+         * valid owner signature (or be an unsigned stub where nothing signed exists yet).
+         * The owner's own personal row is unrestricted.
          *
          * An unsigned `weakInsert` is a discovery placeholder (connection handshake, invite
          * identity, join approval). It is written `insertOnly`: seed the row when the table has
@@ -101,8 +138,12 @@ let UsersTable = (() => {
             }
             const userContext = await (0, user_context_singleton_1.getUserContext)();
             const userContextUserTable = Users(userContext.userDataContext);
-            if (this === userContextUserTable) {
-                // user is allowed to make any changes they want to their own user table
+            if (isResolutionWrite(opts)) {
+                return super.save(user, opts);
+            }
+            if (this === userContextUserTable && user.userId === userContext.userId) {
+                // The owner can change their own row. A contact's row in this same table
+                // is the on-record key and anchor list, so it goes through the checks below.
                 return super.save(user, opts);
             }
             // Get the old user record if it exists
@@ -110,8 +151,23 @@ let UsersTable = (() => {
             if (opts.insertOnly && oldUser) {
                 return oldUser;
             }
+            if (!oldUser) {
+                await (0, user_permissions_1.verifyUserSignature)(user, oldUser);
+                return super.save(user, opts);
+            }
+            // A different key or anchor list is judged against the anchors on record. A direct
+            // save cannot wait for an answer, so "not yet" is refused the same as "no".
+            const verdict = await userRowChangeGuard(userContext.userDataContext, user, oldUser);
+            if (verdict.action !== "apply") {
+                throw new Error(verdict.reason);
+            }
+            if (user.publicKey !== oldUser.publicKey) {
+                // The anchors confirmed the new key; the row still has to be signed by it.
+                (0, user_permissions_1.verifyUserSignedBySelf)(user);
+                return super.save(verdict.row, opts);
+            }
             await (0, user_permissions_1.verifyUserSignature)(user, oldUser);
-            return super.save(user, opts);
+            return super.save(verdict.row, opts);
         }
         async signAndSave(user, opts) {
             if (!UsersTable.addSignatureToUser) {