@peers-app/peers-sdk 0.27.3 → 0.27.4

package/dist/identity/key-change.test.js

@@ -1,811 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const SQLiteDB = require("better-sqlite3");
-const user_context_1 = require("../context/user-context");
-const user_context_singleton_1 = require("../context/user-context-singleton");
-const contract_resolvers_1 = require("../contracts/contract-resolvers");
-const sql_data_source_1 = require("../data/orm/sql.data-source");
-const persistent_vars_1 = require("../data/persistent-vars");
-const user_permissions_1 = require("../data/user-permissions");
-const users_1 = require("../data/users");
-const keys_1 = require("../keys");
-const utils_1 = require("../utils");
-const anchor_document_1 = require("./anchor-document");
-const anchor_resolution_1 = require("./anchor-resolution");
-const key_change_1 = require("./key-change");
-const key_contest_1 = require("./key-contest");
-const key_resolutions_1 = require("./key-resolutions");
-// Installs the UsersTable guard the save tests below rely on.
-require("./user-row-change");
-class DBHarness {
-    _db = null;
-    get db() {
-        if (!this._db) {
-            this._db = new SQLiteDB(":memory:");
-            this._db.pragma("journal_mode = WAL");
-        }
-        return this._db;
-    }
-    async get(sql, params = []) {
-        return this.db.prepare(sql).get(params);
-    }
-    async all(sql, params = []) {
-        return this.db.prepare(sql).all(params);
-    }
-    async exec(sql, params = []) {
-        const result = this.db.prepare(sql).run(params);
-        return { changes: result.changes };
-    }
-    async close() {
-        this._db?.close();
-        this._db = null;
-    }
-}
-describe("evaluatePresentedKey", () => {
-    const userId = (0, utils_1.newid)();
-    const record = (0, keys_1.newKeys)();
-    const next = (0, keys_1.newKeys)();
-    const anchor = {
-        type: "https",
-        url: "https://example.com/.well-known/peers-identity.json",
-    };
-    let userContext;
-    const db = new DBHarness();
-    beforeAll(async () => {
-        const dataSourceFactory = (metaData, schema) => new sql_data_source_1.SQLDataSource(db, metaData, schema);
-        userContext = new user_context_1.UserContext(userId, dataSourceFactory, true);
-        await userContext.loadingPromise;
-        userContext.deviceId((0, utils_1.newid)());
-        (0, user_context_singleton_1.setUserContext)(userContext);
-        await (0, users_1.Users)(userContext.userDataContext).save({
-            userId,
-            name: "Alice",
-            publicKey: record.publicKey,
-            publicBoxKey: record.publicBoxKey,
-            anchors: [anchor],
-        });
-    });
-    afterAll(async () => {
-        userContext.dispose();
-        await db.close();
-        (0, anchor_resolution_1.setAnchorFetcher)(undefined);
-    });
-    afterEach(() => {
-        (0, anchor_resolution_1.setAnchorFetcher)(undefined);
-    });
-    function doc(publicKey, authorizedBy) {
-        return {
-            version: 1,
-            userId,
-            keys: [{ publicKey, issuedAt: "2026-10-03T18:00:00.000Z", authorizedBy }],
-            anchors: [anchor],
-            updatedAt: "2026-10-03T18:00:00.000Z",
-        };
-    }
-    it("switches the personal row when the anchor confirms a rotation, and reuses the cache", async () => {
-        const issuedAt = "2026-10-03T18:00:00.000Z";
-        const signed = (0, anchor_document_1.signSuccession)({ purpose: "peers-key-succession", userId, publicKey: next.publicKey, issuedAt }, record.secretKey);
-        const fetcher = jest.fn(async () => ({
-            outcome: "document",
-            document: doc(next.publicKey, { publicKey: signed.publicKey, signature: signed.signature }),
-            maxAgeSeconds: 60,
-        }));
-        (0, anchor_resolution_1.setAnchorFetcher)(fetcher);
-        const decision = await (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId,
-            presentedKey: next.publicKey,
-            presentedBoxKey: next.publicBoxKey,
-        });
-        expect(decision).toEqual({ accepted: true, state: "confirmed-rotation" });
-        const stored = await (0, users_1.Users)(userContext.userDataContext).get(userId);
-        expect(stored?.publicKey).toBe(next.publicKey);
-        expect(stored?.publicBoxKey).toBe(next.publicBoxKey);
-        expect((0, keys_1.derivePublicBoxKey)(next.publicKey)).toBe(next.publicBoxKey);
-        const again = await (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId,
-            presentedKey: next.publicKey,
-            presentedBoxKey: next.publicBoxKey,
-        });
-        expect(again.state).toBe("current");
-        expect(fetcher).toHaveBeenCalledTimes(1);
-        const cached = await (0, key_resolutions_1.KeyResolutions)(userContext.userDataContext).findOne({
-            userId,
-            presentedKey: next.publicKey,
-        });
-        expect(cached?.state).toBe("confirmed-rotation");
-        expect(cached?.firstSeenAt).toBeTruthy();
-    });
-    it("reports a confirmed rotation without replacing the row when adopt is false", async () => {
-        const held = (0, keys_1.newKeys)();
-        const issuedAt = "2026-10-03T18:00:00.000Z";
-        const signed = (0, anchor_document_1.signSuccession)({ purpose: "peers-key-succession", userId, publicKey: held.publicKey, issuedAt }, next.secretKey);
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: doc(held.publicKey, { publicKey: signed.publicKey, signature: signed.signature }),
-        }));
-        const decision = await (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId,
-            presentedKey: held.publicKey,
-            presentedBoxKey: held.publicBoxKey,
-            adopt: false,
-        });
-        expect(decision).toEqual({ accepted: true, state: "confirmed-rotation" });
-        const stored = await (0, users_1.Users)(userContext.userDataContext).get(userId);
-        expect(stored?.publicKey).toBe(next.publicKey);
-    });
-    it("keeps the key on record when an anchor vetoes", async () => {
-        const stranger = (0, keys_1.newKeys)();
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: doc(record.publicKey),
-        }));
-        const decision = await (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId,
-            presentedKey: stranger.publicKey,
-            presentedBoxKey: stranger.publicBoxKey,
-        });
-        expect(decision).toEqual({ accepted: false, state: "vetoed" });
-        const stored = await (0, users_1.Users)(userContext.userDataContext).get(userId);
-        expect(stored?.publicKey).toBe(next.publicKey);
-    });
-    it("leaves a recovery confirmed but not accepted", async () => {
-        const recovered = (0, keys_1.newKeys)();
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({ outcome: "document", document: doc(recovered.publicKey) }));
-        const decision = await (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId,
-            presentedKey: recovered.publicKey,
-            presentedBoxKey: recovered.publicBoxKey,
-        });
-        expect(decision).toEqual({ accepted: false, state: "recovery-pending" });
-        const cached = await (0, key_resolutions_1.KeyResolutions)(userContext.userDataContext).findOne({
-            userId,
-            presentedKey: recovered.publicKey,
-        });
-        expect(cached?.state).toBe("confirmed-recovery");
-        const stored = await (0, users_1.Users)(userContext.userDataContext).get(userId);
-        expect(stored?.publicKey).toBe(next.publicKey);
-    });
-    it("refuses a group row key change until anchors confirm it", async () => {
-        const group = userContext.getDataContext((0, utils_1.newid)());
-        const personal = await (0, users_1.Users)(userContext.userDataContext).get(userId);
-        if (!personal)
-            throw new Error("missing personal row");
-        await (0, users_1.Users)(group).save((0, user_permissions_1.signUserObject)({
-            userId,
-            name: personal.name,
-            publicKey: personal.publicKey,
-            publicBoxKey: personal.publicBoxKey,
-            anchors: personal.anchors,
-        }, next.secretKey));
-        const stranger = (0, keys_1.newKeys)();
-        await expect((0, users_1.Users)(group).save((0, user_permissions_1.signUserObject)({
-            userId,
-            name: personal.name,
-            publicKey: stranger.publicKey,
-            publicBoxKey: stranger.publicBoxKey,
-            anchors: [{ type: "https", url: "https://attacker.example/peers-identity.json" }],
-        }, stranger.secretKey))).rejects.toThrow(/not confirmed/);
-        const issuedAt = "2026-10-03T19:00:00.000Z";
-        const rotated = (0, keys_1.newKeys)();
-        const signed = (0, anchor_document_1.signSuccession)({ purpose: "peers-key-succession", userId, publicKey: rotated.publicKey, issuedAt }, next.secretKey);
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: {
-                version: 1,
-                userId,
-                keys: [
-                    {
-                        publicKey: rotated.publicKey,
-                        issuedAt,
-                        authorizedBy: { publicKey: signed.publicKey, signature: signed.signature },
-                    },
-                ],
-                anchors: [anchor],
-                updatedAt: issuedAt,
-            },
-        }));
-        const saved = await (0, users_1.Users)(group).save((0, user_permissions_1.signUserObject)({
-            userId,
-            name: "Alice",
-            publicKey: rotated.publicKey,
-            publicBoxKey: rotated.publicBoxKey,
-            anchors: [{ type: "https", url: "https://attacker.example/peers-identity.json" }],
-        }, rotated.secretKey));
-        expect(saved.publicKey).toBe(rotated.publicKey);
-        expect(saved.anchors).toEqual([anchor]);
-    });
-    it("refuses a contact key change and a replacement anchor list in the personal table", async () => {
-        const contactId = (0, utils_1.newid)();
-        const contactKeys = (0, keys_1.newKeys)();
-        await (0, users_1.Users)(userContext.userDataContext).save({
-            userId: contactId,
-            name: "Carol",
-            publicKey: contactKeys.publicKey,
-            publicBoxKey: contactKeys.publicBoxKey,
-            anchors: [anchor],
-        });
-        const thief = (0, keys_1.newKeys)();
-        await expect((0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({
-            userId: contactId,
-            name: "Carol",
-            publicKey: thief.publicKey,
-            publicBoxKey: thief.publicBoxKey,
-            anchors: [{ type: "https", url: "https://attacker.example/peers-identity.json" }],
-        }, thief.secretKey))).rejects.toThrow(/not confirmed/);
-        // Same key, replacement list, anchors on record have not answered: a direct save
-        // cannot wait, so it is refused.
-        const replacement = (0, user_permissions_1.signUserObject)({
-            userId: contactId,
-            name: "Carol",
-            publicKey: contactKeys.publicKey,
-            publicBoxKey: contactKeys.publicBoxKey,
-            anchors: [{ type: "https", url: "https://attacker.example/peers-identity.json" }],
-        }, contactKeys.secretKey);
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({ outcome: "abstain" }));
-        await expect((0, users_1.Users)(userContext.userDataContext).save(replacement)).rejects.toThrow(/not confirmed/);
-        // Once the anchor on record answers with a different list, the row is still the key on
-        // record's: the profile is stored and the list on record is kept.
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: {
-                version: 1,
-                userId: contactId,
-                keys: [{ publicKey: contactKeys.publicKey, issuedAt: "2026-10-03T18:00:00.000Z" }],
-                anchors: [anchor],
-                updatedAt: "2026-10-03T18:00:00.000Z",
-            },
-        }));
-        const saved = await (0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({ ...replacement, name: "Carol B" }, contactKeys.secretKey));
-        expect(saved.name).toBe("Carol B");
-        expect(saved.anchors).toEqual([anchor]);
-        const stored = await (0, users_1.Users)(userContext.userDataContext).get(contactId);
-        expect(stored?.publicKey).toBe(contactKeys.publicKey);
-        expect(stored?.anchors).toEqual([anchor]);
-        // The list on record is not what Carol signed, but the list is the anchors' decision, not
-        // part of her claim: her signature still verifies, so she can still call our contracts.
-        expect(() => (0, user_permissions_1.verifyUserSignature)(stored)).not.toThrow();
-        await expect((0, contract_resolvers_1.verifyRemoteContractIdentity)(userContext, {
-            userId: contactId,
-            deviceId: (0, utils_1.newid)(),
-            publicKey: contactKeys.publicKey,
-            publicBoxKey: contactKeys.publicBoxKey,
-        })).resolves.toBe(true);
-    });
-    it("lets a row with the same key supply the first anchor list when nothing is on record", async () => {
-        const contactId = (0, utils_1.newid)();
-        const keys = (0, keys_1.newKeys)();
-        await (0, users_1.Users)(userContext.userDataContext).save({
-            userId: contactId,
-            name: "Hal",
-            publicKey: keys.publicKey,
-            publicBoxKey: keys.publicBoxKey,
-        });
-        const saved = await (0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({
-            userId: contactId,
-            name: "Hal",
-            publicKey: keys.publicKey,
-            publicBoxKey: keys.publicBoxKey,
-            anchors: [anchor],
-        }, keys.secretKey));
-        expect(saved.anchors).toEqual([anchor]);
-        // From here on the list is on record and a replacement needs the anchors to publish it.
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({ outcome: "abstain" }));
-        await expect((0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({
-            userId: contactId,
-            name: "Hal",
-            publicKey: keys.publicKey,
-            publicBoxKey: keys.publicBoxKey,
-            anchors: [{ type: "https", url: "https://example.com/other.json" }],
-        }, keys.secretKey))).rejects.toThrow(/not confirmed/);
-    });
-    it("adopts an anchor list the anchors on record publish", async () => {
-        const contactId = (0, utils_1.newid)();
-        const keys = (0, keys_1.newKeys)();
-        const nextAnchors = [anchor, { type: "https", url: "https://example.com/extra.json" }];
-        const signedOnRecord = (0, user_permissions_1.signUserObject)({
-            userId: contactId,
-            name: "Gina",
-            publicKey: keys.publicKey,
-            publicBoxKey: keys.publicBoxKey,
-            anchors: [anchor],
-        }, keys.secretKey);
-        await (0, users_1.Users)(userContext.userDataContext).save(signedOnRecord);
-        // The list is confirmed on its own (a handshake, a group row): the signed personal row
-        // keeps its signature, since the list is not under it.
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: {
-                version: 1,
-                userId: contactId,
-                keys: [],
-                anchors: nextAnchors,
-                updatedAt: "2026-10-03T18:00:00.000Z",
-            },
-        }));
-        await expect((0, key_change_1.evaluatePresentedAnchors)({
-            dataContext: userContext.userDataContext,
-            userId: contactId,
-            recordAnchors: [anchor],
-            presentedAnchors: nextAnchors,
-        })).resolves.toBe("confirmed");
-        const adopted = await (0, users_1.Users)(userContext.userDataContext).get(contactId);
-        expect(adopted?.anchors).toEqual(nextAnchors);
-        expect(adopted?.signature).toBe(signedOnRecord.signature);
-        expect(() => (0, user_permissions_1.verifyUserSignature)(adopted)).not.toThrow();
-        await (0, users_1.writeResolvedUserKey)(userContext.userDataContext, {
-            ...signedOnRecord,
-            anchors: [anchor],
-        });
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: {
-                version: 1,
-                userId: contactId,
-                keys: [],
-                anchors: nextAnchors,
-                updatedAt: "2026-10-03T18:00:00.000Z",
-            },
-        }));
-        const saved = await (0, users_1.Users)(userContext.userDataContext).save((0, user_permissions_1.signUserObject)({
-            userId: contactId,
-            name: "Gina",
-            publicKey: keys.publicKey,
-            publicBoxKey: keys.publicBoxKey,
-            anchors: nextAnchors,
-        }, keys.secretKey));
-        expect(saved.anchors).toEqual(nextAnchors);
-    });
-    it("copies a confirmed anchor list onto a group row", async () => {
-        const contactId = (0, utils_1.newid)();
-        const keys = (0, keys_1.newKeys)();
-        const oldAnchors = [anchor];
-        const profile = {
-            userId: contactId,
-            name: "Fran",
-            publicKey: keys.publicKey,
-            publicBoxKey: keys.publicBoxKey,
-        };
-        await (0, users_1.Users)(userContext.userDataContext).save({ ...profile, anchors: oldAnchors });
-        const group = userContext.getDataContext((0, utils_1.newid)());
-        await (0, users_1.Users)(group).save((0, user_permissions_1.signUserObject)({ ...profile, anchors: oldAnchors }, keys.secretKey));
-        const nextAnchors = [
-            ...oldAnchors,
-            { type: "https", url: "https://example.com/extra.json" },
-        ];
-        await (0, users_1.writeResolvedUserKey)(userContext.userDataContext, { ...profile, anchors: nextAnchors });
-        const saved = await (0, users_1.Users)(group).save((0, user_permissions_1.signUserObject)({ ...profile, anchors: nextAnchors }, keys.secretKey));
-        expect(saved.anchors).toEqual(nextAnchors);
-    });
-    it("adopts a recovery when the delay has elapsed and holds a contested one", async () => {
-        const contactId = (0, utils_1.newid)();
-        const contactKeys = (0, keys_1.newKeys)();
-        const recovered = (0, keys_1.newKeys)();
-        await (0, users_1.Users)(userContext.userDataContext).save({
-            userId: contactId,
-            name: "Dana",
-            publicKey: contactKeys.publicKey,
-            publicBoxKey: contactKeys.publicBoxKey,
-            anchors: [anchor],
-        });
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: {
-                version: 1,
-                userId: contactId,
-                keys: [{ publicKey: recovered.publicKey, issuedAt: "2026-10-03T18:00:00.000Z" }],
-                anchors: [anchor],
-                updatedAt: "2026-10-03T18:00:00.000Z",
-            },
-        }));
-        process.env.PEERS_RECOVERY_DELAY_MS = "0";
-        try {
-            const decision = await (0, key_change_1.evaluatePresentedKey)({
-                dataContext: userContext.userDataContext,
-                userId: contactId,
-                presentedKey: recovered.publicKey,
-                presentedBoxKey: recovered.publicBoxKey,
-            });
-            expect(decision).toEqual({ accepted: true, state: "confirmed-recovery" });
-            const stored = await (0, users_1.Users)(userContext.userDataContext).get(contactId);
-            expect(stored?.publicKey).toBe(recovered.publicKey);
-        }
-        finally {
-            delete process.env.PEERS_RECOVERY_DELAY_MS;
-        }
-        const heldId = (0, utils_1.newid)();
-        const heldKeys = (0, keys_1.newKeys)();
-        const attack = (0, keys_1.newKeys)();
-        await (0, users_1.Users)(userContext.userDataContext).save({
-            userId: heldId,
-            name: "Eve",
-            publicKey: heldKeys.publicKey,
-            publicBoxKey: heldKeys.publicBoxKey,
-            anchors: [anchor],
-        });
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: {
-                version: 1,
-                userId: heldId,
-                keys: [{ publicKey: attack.publicKey, issuedAt: "2026-10-03T18:00:00.000Z" }],
-                anchors: [anchor],
-                updatedAt: "2026-10-03T18:00:00.000Z",
-            },
-        }));
-        (0, key_change_1.holdKeyContest)((0, key_contest_1.signKeyContest)({
-            purpose: "peers-key-contest",
-            userId: heldId,
-            publicKey: heldKeys.publicKey,
-            pendingKey: attack.publicKey,
-            at: new Date().toISOString(),
-        }, heldKeys.secretKey));
-        process.env.PEERS_RECOVERY_DELAY_MS = "0";
-        try {
-            const decision = await (0, key_change_1.evaluatePresentedKey)({
-                dataContext: userContext.userDataContext,
-                userId: heldId,
-                presentedKey: attack.publicKey,
-                presentedBoxKey: attack.publicBoxKey,
-            });
-            expect(decision).toEqual({ accepted: false, state: "recovery-pending" });
-            const stored = await (0, users_1.Users)(userContext.userDataContext).get(heldId);
-            expect(stored?.publicKey).toBe(heldKeys.publicKey);
-        }
-        finally {
-            delete process.env.PEERS_RECOVERY_DELAY_MS;
-        }
-    });
-    it("asks the anchor for contests once per cache window while a recovery waits", async () => {
-        // The recovering device handshakes often; each one re-evaluates the cached row and must
-        // not turn into a contest lookup at the anchor every time.
-        const waitingId = (0, utils_1.newid)();
-        const waitingKeys = (0, keys_1.newKeys)();
-        const recovered = (0, keys_1.newKeys)();
-        await (0, users_1.Users)(userContext.userDataContext).save({
-            userId: waitingId,
-            name: "Finn",
-            publicKey: waitingKeys.publicKey,
-            publicBoxKey: waitingKeys.publicBoxKey,
-            anchors: [anchor],
-        });
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({
-            outcome: "document",
-            document: {
-                version: 1,
-                userId: waitingId,
-                keys: [{ publicKey: recovered.publicKey, issuedAt: "2026-10-03T18:00:00.000Z" }],
-                anchors: [anchor],
-                updatedAt: "2026-10-03T18:00:00.000Z",
-            },
-        }));
-        const contests = jest.fn(async () => []);
-        (0, key_change_1.setContestFetcher)(contests);
-        try {
-            for (let i = 0; i < 3; i++) {
-                const decision = await (0, key_change_1.evaluatePresentedKey)({
-                    dataContext: userContext.userDataContext,
-                    userId: waitingId,
-                    presentedKey: recovered.publicKey,
-                    presentedBoxKey: recovered.publicBoxKey,
-                });
-                expect(decision).toEqual({ accepted: false, state: "recovery-pending" });
-            }
-            expect(contests).toHaveBeenCalledTimes(1);
-            // Once the delay is up it asks the anchor one more time before adopting, so a contest
-            // posted there during the wait is not missed.
-            contests.mockResolvedValueOnce([
-                (0, key_contest_1.signKeyContest)({
-                    purpose: "peers-key-contest",
-                    userId: waitingId,
-                    publicKey: waitingKeys.publicKey,
-                    pendingKey: recovered.publicKey,
-                    at: new Date().toISOString(),
-                }, waitingKeys.secretKey),
-            ]);
-            process.env.PEERS_RECOVERY_DELAY_MS = "0";
-            const due = await (0, key_change_1.evaluatePresentedKey)({
-                dataContext: userContext.userDataContext,
-                userId: waitingId,
-                presentedKey: recovered.publicKey,
-                presentedBoxKey: recovered.publicBoxKey,
-            });
-            expect(contests).toHaveBeenCalledTimes(2);
-            expect(due).toEqual({ accepted: false, state: "recovery-pending" });
-            const stored = await (0, users_1.Users)(userContext.userDataContext).get(waitingId);
-            expect(stored?.publicKey).toBe(waitingKeys.publicKey);
-        }
-        finally {
-            delete process.env.PEERS_RECOVERY_DELAY_MS;
-            (0, key_change_1.setContestFetcher)(undefined);
-        }
-    });
-    it("keeps the contest this device signed so a restart still carries it", async () => {
-        // Services holds a posted contest, but with services off the handshake is the only
-        // carrier, and a device that restarts must not fall silent.
-        const pendingKey = (0, keys_1.newKeys)().publicKey;
-        const signed = (0, key_contest_1.signKeyContest)({
-            purpose: "peers-key-contest",
-            userId,
-            publicKey: next.publicKey,
-            pendingKey,
-            at: new Date().toISOString(),
-        }, next.secretKey);
-        await (0, key_change_1.setLocalKeyContest)(signed);
-        expect((0, key_change_1.peekLocalKeyContest)()).toEqual(signed);
-        const stored = await (0, persistent_vars_1.PersistentVars)(userContext.userDataContext).findOne({
-            name: "identityLocalKeyContest",
-        });
-        expect(stored?.value.value).toEqual(signed);
-        await (0, key_change_1.setLocalKeyContest)(undefined);
-        expect((0, key_change_1.peekLocalKeyContest)()).toBeUndefined();
-    });
-    it("tells this device once that a due recovery rotated its key away", async () => {
-        const before = await (0, users_1.Users)(userContext.userDataContext).get(userId);
-        const recovered = (0, keys_1.newKeys)();
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({ outcome: "document", document: doc(recovered.publicKey) }));
-        const seen = [];
-        const subscription = key_change_1.identityRotatedAwayEvent.event.subscribe((payload) => {
-            seen.push(payload);
-        });
-        process.env.PEERS_RECOVERY_DELAY_MS = "0";
-        try {
-            const payload = await (0, key_change_1.detectIdentityRotatedAway)({ userId, publicKey: next.publicKey }, {
-                userId,
-                publicKey: recovered.publicKey,
-                publicBoxKey: recovered.publicBoxKey,
-            });
-            expect(payload).toMatchObject({
-                oldPublicKey: next.publicKey,
-                newPublicKey: recovered.publicKey,
-            });
-            expect(seen).toHaveLength(1);
-            // The device does not adopt the key on its own row; it has to be paired again.
-            const stored = await (0, users_1.Users)(userContext.userDataContext).get(userId);
-            expect(stored?.publicKey).toBe(before?.publicKey);
-        }
-        finally {
-            delete process.env.PEERS_RECOVERY_DELAY_MS;
-            subscription.unsubscribe();
-        }
-    });
-    /** A contact row with the given anchors, returning its ids and keys. */
-    async function contact(name) {
-        const contactId = (0, utils_1.newid)();
-        const keys = (0, keys_1.newKeys)();
-        await (0, users_1.Users)(userContext.userDataContext).save({
-            userId: contactId,
-            name,
-            publicKey: keys.publicKey,
-            publicBoxKey: keys.publicBoxKey,
-            anchors: [anchor],
-        });
-        return { contactId, keys };
-    }
-    function documentFor(contactId, publicKey, maxAgeSeconds) {
-        return {
-            outcome: "document",
-            document: {
-                version: 1,
-                userId: contactId,
-                keys: [{ publicKey, issuedAt: "2026-10-03T18:00:00.000Z" }],
-                anchors: [anchor],
-                updatedAt: "2026-10-03T18:00:00.000Z",
-            },
-            ...(maxAgeSeconds === undefined ? {} : { maxAgeSeconds }),
-        };
-    }
-    it("does not ask the anchors about a key whose box key is not its own", async () => {
-        // A handshake carries both keys. If they do not belong together nothing it says can be
-        // trusted, so the anchors are not consulted and nothing is cached about the key.
-        const { contactId, keys } = await contact("Gail");
-        const presented = (0, keys_1.newKeys)();
-        const fetcher = jest.fn(async () => documentFor(contactId, presented.publicKey));
-        (0, anchor_resolution_1.setAnchorFetcher)(fetcher);
-        const mismatch = await (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId: contactId,
-            presentedKey: presented.publicKey,
-            presentedBoxKey: (0, keys_1.newKeys)().publicBoxKey,
-        });
-        expect(mismatch).toEqual({ accepted: false, state: "box-mismatch" });
-        const sameKey = await (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId: contactId,
-            presentedKey: keys.publicKey,
-            presentedBoxKey: (0, keys_1.newKeys)().publicBoxKey,
-        });
-        expect(sameKey).toEqual({ accepted: false, state: "box-mismatch" });
-        expect(fetcher).not.toHaveBeenCalled();
-        expect(await (0, key_resolutions_1.KeyResolutions)(userContext.userDataContext).findOne({
-            userId: contactId,
-            presentedKey: presented.publicKey,
-        })).toBeFalsy();
-        expect((await (0, users_1.Users)(userContext.userDataContext).get(contactId))?.publicKey).toBe(keys.publicKey);
-    });
-    it("keeps a veto for the document's max-age, then asks the anchors again", async () => {
-        const { contactId, keys } = await contact("Hugo");
-        const presented = (0, keys_1.newKeys)();
-        const succession = (0, anchor_document_1.signSuccession)({
-            purpose: "peers-key-succession",
-            userId: contactId,
-            publicKey: presented.publicKey,
-            issuedAt: "2026-10-03T18:00:00.000Z",
-        }, keys.secretKey);
-        // The anchor still lists the old key with a 30 s max-age, so the new key is vetoed.
-        const fetcher = jest.fn(async () => documentFor(contactId, keys.publicKey, 30));
-        (0, anchor_resolution_1.setAnchorFetcher)(fetcher);
-        const evaluate = () => (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId: contactId,
-            presentedKey: presented.publicKey,
-            presentedBoxKey: presented.publicBoxKey,
-        });
-        expect(await evaluate()).toEqual({ accepted: false, state: "vetoed" });
-        expect(await evaluate()).toEqual({ accepted: false, state: "vetoed" });
-        expect(fetcher).toHaveBeenCalledTimes(1);
-        // The anchor now lists the new key with the old key's co-signature. Within the cache
-        // window the veto stands; once it expires the anchors are asked and the row switches.
-        fetcher.mockImplementation(async () => ({
-            outcome: "document",
-            document: {
-                version: 1,
-                userId: contactId,
-                keys: [
-                    {
-                        publicKey: presented.publicKey,
-                        issuedAt: "2026-10-03T18:00:00.000Z",
-                        authorizedBy: { publicKey: succession.publicKey, signature: succession.signature },
-                    },
-                ],
-                anchors: [anchor],
-                updatedAt: "2026-10-03T18:00:00.000Z",
-            },
-        }));
-        expect(await evaluate()).toEqual({ accepted: false, state: "vetoed" });
-        const realNow = Date.now;
-        jest.spyOn(Date, "now").mockImplementation(() => realNow() + 31_000);
-        try {
-            expect(await evaluate()).toEqual({ accepted: true, state: "confirmed-rotation" });
-        }
-        finally {
-            jest.restoreAllMocks();
-        }
-        expect(fetcher).toHaveBeenCalledTimes(2);
-        expect((await (0, users_1.Users)(userContext.userDataContext).get(contactId))?.publicKey).toBe(presented.publicKey);
-    });
-    it("leaves the row alone while no anchor answers, and does not treat silence as a veto", async () => {
-        const { contactId, keys } = await contact("Ida");
-        const presented = (0, keys_1.newKeys)();
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => ({ outcome: "abstain" }));
-        const decision = await (0, key_change_1.evaluatePresentedKey)({
-            dataContext: userContext.userDataContext,
-            userId: contactId,
-            presentedKey: presented.publicKey,
-            presentedBoxKey: presented.publicBoxKey,
-        });
-        expect(decision).toEqual({ accepted: false, state: "pending" });
-        expect((await (0, users_1.Users)(userContext.userDataContext).get(contactId))?.publicKey).toBe(keys.publicKey);
-        const cached = await (0, key_resolutions_1.KeyResolutions)(userContext.userDataContext).findOne({
-            userId: contactId,
-            presentedKey: presented.publicKey,
-        });
-        expect(cached?.state).toBe("pending");
-    });
-    it("ignores a contest that is not signed by the key on record", async () => {
-        const { contactId, keys } = await contact("Jude");
-        const recovered = (0, keys_1.newKeys)();
-        const stranger = (0, keys_1.newKeys)();
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => documentFor(contactId, recovered.publicKey));
-        (0, key_change_1.holdKeyContest)((0, key_contest_1.signKeyContest)({
-            purpose: "peers-key-contest",
-            userId: contactId,
-            publicKey: stranger.publicKey,
-            pendingKey: recovered.publicKey,
-            at: new Date().toISOString(),
-        }, stranger.secretKey));
-        // A contest from the right key but naming a different pending key does not count either.
-        (0, key_change_1.holdKeyContest)((0, key_contest_1.signKeyContest)({
-            purpose: "peers-key-contest",
-            userId: contactId,
-            publicKey: keys.publicKey,
-            pendingKey: (0, keys_1.newKeys)().publicKey,
-            at: new Date().toISOString(),
-        }, keys.secretKey));
-        process.env.PEERS_RECOVERY_DELAY_MS = "0";
-        try {
-            const decision = await (0, key_change_1.evaluatePresentedKey)({
-                dataContext: userContext.userDataContext,
-                userId: contactId,
-                presentedKey: recovered.publicKey,
-                presentedBoxKey: recovered.publicBoxKey,
-            });
-            expect(decision).toEqual({ accepted: true, state: "confirmed-recovery" });
-        }
-        finally {
-            delete process.env.PEERS_RECOVERY_DELAY_MS;
-        }
-    });
-    it("adopts a waiting recovery on its own when the delay runs out", async () => {
-        // Nobody has to handshake again: the timer set when the recovery was first seen does it.
-        const { contactId, keys } = await contact("Kai");
-        const recovered = (0, keys_1.newKeys)();
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => documentFor(contactId, recovered.publicKey));
-        process.env.PEERS_RECOVERY_DELAY_MS = "150";
-        try {
-            const decision = await (0, key_change_1.evaluatePresentedKey)({
-                dataContext: userContext.userDataContext,
-                userId: contactId,
-                presentedKey: recovered.publicKey,
-                presentedBoxKey: recovered.publicBoxKey,
-            });
-            expect(decision).toEqual({ accepted: false, state: "recovery-pending" });
-            expect((await (0, users_1.Users)(userContext.userDataContext).get(contactId))?.publicKey).toBe(keys.publicKey);
-            expect((0, key_change_1.identityRecoveryNoticesVar)()).toContainEqual(expect.objectContaining({ userId: contactId, pendingPublicKey: recovered.publicKey }));
-            await new Promise((resolve) => setTimeout(resolve, 400));
-            expect((await (0, users_1.Users)(userContext.userDataContext).get(contactId))?.publicKey).toBe(recovered.publicKey);
-            expect((0, key_change_1.identityRecoveryNoticesVar)()).not.toContainEqual(expect.objectContaining({ userId: contactId, pendingPublicKey: recovered.publicKey }));
-        }
-        finally {
-            delete process.env.PEERS_RECOVERY_DELAY_MS;
-        }
-    });
-    it("records a contest from the key on record and refuses one from anyone else", async () => {
-        const { contactId, keys } = await contact("Lena");
-        const recovered = (0, keys_1.newKeys)();
-        const stranger = (0, keys_1.newKeys)();
-        (0, anchor_resolution_1.setAnchorFetcher)(async () => documentFor(contactId, recovered.publicKey));
-        process.env.PEERS_RECOVERY_DELAY_MS = String(60 * 60 * 1000);
-        try {
-            await (0, key_change_1.evaluatePresentedKey)({
-                dataContext: userContext.userDataContext,
-                userId: contactId,
-                presentedKey: recovered.publicKey,
-                presentedBoxKey: recovered.publicBoxKey,
-            });
-            const statement = {
-                purpose: "peers-key-contest",
-                userId: contactId,
-                pendingKey: recovered.publicKey,
-                at: new Date().toISOString(),
-            };
-            expect(await (0, key_change_1.applyKeyContest)(userContext.userDataContext, (0, key_contest_1.signKeyContest)({ ...statement, publicKey: stranger.publicKey }, stranger.secretKey))).toBe(false);
-            let row = await (0, key_resolutions_1.KeyResolutions)(userContext.userDataContext).findOne({
-                userId: contactId,
-                presentedKey: recovered.publicKey,
-            });
-            expect(row?.contested).toBe(false);
-            expect(await (0, key_change_1.applyKeyContest)(userContext.userDataContext, (0, key_contest_1.signKeyContest)({ ...statement, publicKey: keys.publicKey }, keys.secretKey))).toBe(true);
-            row = await (0, key_resolutions_1.KeyResolutions)(userContext.userDataContext).findOne({
-                userId: contactId,
-                presentedKey: recovered.publicKey,
-            });
-            expect(row?.contested).toBe(true);
-            expect((0, key_change_1.identityRecoveryNoticesVar)()).toContainEqual(expect.objectContaining({ pendingPublicKey: recovered.publicKey, contested: true }));
-            // Even with the delay gone the contested recovery stays held...
-            process.env.PEERS_RECOVERY_DELAY_MS = "0";
-            const held = await (0, key_change_1.evaluatePresentedKey)({
-                dataContext: userContext.userDataContext,
-                userId: contactId,
-                presentedKey: recovered.publicKey,
-                presentedBoxKey: recovered.publicBoxKey,
-            });
-            expect(held).toEqual({ accepted: false, state: "recovery-pending" });
-            // ...until the person at this device accepts it.
-            await (0, key_change_1.acceptRecovery)(userContext.userDataContext, contactId, recovered.publicKey);
-            expect((await (0, users_1.Users)(userContext.userDataContext).get(contactId))?.publicKey).toBe(recovered.publicKey);
-            expect((0, key_change_1.identityRecoveryNoticesVar)()).not.toContainEqual(expect.objectContaining({ pendingPublicKey: recovered.publicKey }));
-        }
-        finally {
-            delete process.env.PEERS_RECOVERY_DELAY_MS;
-        }
-    });
-    it("refuses to accept a recovery that is not waiting", async () => {
-        const { contactId } = await contact("Mo");
-        await expect((0, key_change_1.acceptRecovery)(userContext.userDataContext, contactId, (0, keys_1.newKeys)().publicKey)).rejects.toThrow(/No recovery is waiting/);
-    });
-});