@peers-app/peers-sdk 0.27.4 → 0.28.0

package/dist/context/user-context.d.ts

@@ -1,7 +1,7 @@
 import { DataContext } from "../context/data-context";
 import { type IUser } from "../data";
 import type { DataSourceFactory, IDataChangedEvent, Table } from "../data/orm";
-import { type IPublicPrivateKeys } from "../keys";
+import type { IPublicPrivateKeys } from "../keys";
 import { type Observable } from "../observable";
 /** Coordinates personal and group data contexts for one signed-in user. */
 export declare class UserContext {
@@ -69,6 +69,12 @@ export declare class UserContext {
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
+        keySuccession?: {
+            publicKey: string;
+            signature: string;
+            issuedAt: string;
+        }[] | undefined;
     } | undefined>;
     /**
      * Sign and persist this user's identity, then copy it into every loaded

package/dist/context/user-context.js

@@ -6,7 +6,6 @@ const data_context_1 = require("../context/data-context");
 const data_1 = require("../data");
 const user_permissions_1 = require("../data/user-permissions");
 const events_1 = require("../events");
-const keys_1 = require("../keys");
 const observable_1 = require("../observable");
 const utils_1 = require("../utils");
 /** Coordinates personal and group data contexts for one signed-in user. */
@@ -278,16 +277,12 @@ class UserContext {
                 console.error("Group data context is missing group id. Something went wrong");
                 continue;
             }
-            const groupObject = await (0, data_1.Groups)(dataContext).get(dataContext.groupId);
+            // Copy the exact row the authority read verified, rather than a row read before an
+            // asynchronous rebuild that may have verified a different, subsequently synced row.
+            const { getGroupAuthority } = await Promise.resolve().then(() => require("../data/group-authority"));
+            const { group: groupObject } = await getGroupAuthority(this, dataContext.groupId);
             const myGroupObject = await (0, data_1.Groups)(this.userDataContext).get(dataContext.groupId);
             if (groupObject && !(0, lodash_1.isEqual)(groupObject, myGroupObject)) {
-                try {
-                    (0, keys_1.verifyObjectSignature)(groupObject);
-                }
-                catch (err) {
-                    console.error(`Error verifying group object from group ${dataContext.groupId}:`, err);
-                    continue;
-                }
                 await (0, data_1.Groups)(this.userDataContext).save(groupObject);
             }
         }

package/dist/contracts/contract-proxy.d.ts

@@ -428,6 +428,11 @@ export interface IContractCallContext {
     workflow?: IWorkflowRunContext;
     /** User id of the caller (e.g. the remote device's user), if known. */
     callerUserId?: string;
+    /**
+     * Signing key a remote caller authenticated with. Role lookups for `callerUserId` pass it, so a
+     * role counts only for the key it was granted to. Absent for same-device callers.
+     */
+    callerPublicKey?: string;
     /** User id of the local device executing the call. */
     localUserId?: string;
     /**

package/dist/contracts/contract-proxy.js

@@ -534,8 +534,8 @@ async function assertContractToolAccess(tool, call, context) {
     }
     const userLevel = userId
         ? context.dataContext
-            ? await (0, group_permissions_1.getUserAccessLevel)(context.dataContext, userId)
-            : (0, access_level_1.accessLevelFromGroupRole)(await (0, group_permissions_1.getUserRole)(call.dataContextId || context.localUserId || userId, userId))
+            ? await (0, group_permissions_1.getUserAccessLevel)(context.dataContext, userId, context.callerPublicKey)
+            : (0, access_level_1.accessLevelFromGroupRole)(await (0, group_permissions_1.getUserRole)(call.dataContextId || context.localUserId || userId, userId, undefined, context.callerPublicKey))
         : access_level_1.AccessLevel.None;
     return (0, action_dispatch_1.authorizeToolDispatch)({ ...context.authority, userId, userAccessLevel: userLevel }, required, mode, strict);
 }

package/dist/contracts/contract-resolvers.d.ts

@@ -71,8 +71,8 @@ export declare function registerContractResolver(contractId: string, version: nu
  */
 export declare function getContractResolver(contractId: string, version: number, providerPackageId?: string, dataContext?: DataContext): ContractResolver | undefined;
 /**
- * Verify that a connection- or message-authenticated remote identity matches a valid
- * self-signed Users record in the provider's personal or shared-group data.
+ * Verify that a connection- or message-authenticated remote identity matches the user's
+ * identity on record, preferring the personal context over shared-group data.
  *
  * Unsigned discovery stubs, malformed signatures, and key mismatches fail closed. This is
  * the identity half of remote authorization; trust and role decisions build on it.

package/dist/contracts/contract-resolvers.js

@@ -160,8 +160,8 @@ function getContractResolver(contractId, version, providerPackageId, dataContext
     return onlyScopedResolver;
 }
 /**
- * Verify that a connection- or message-authenticated remote identity matches a valid
- * self-signed Users record in the provider's personal or shared-group data.
+ * Verify that a connection- or message-authenticated remote identity matches the user's
+ * identity on record, preferring the personal context over shared-group data.
  *
  * Unsigned discovery stubs, malformed signatures, and key mismatches fail closed. This is
  * the identity half of remote authorization; trust and role decisions build on it.
@@ -173,19 +173,15 @@ async function verifyRemoteContractIdentity(userContext, remoteIdentity) {
     const identityContexts = [userContext.userDataContext, ...userContext.groupDataContexts.values()];
     for (const dataContext of identityContexts) {
         const user = await (0, users_1.Users)(dataContext).get(remoteIdentity.userId);
-        if (!user?.signature ||
-            user.userId !== remoteIdentity.userId ||
-            user.publicKey !== remoteIdentity.publicKey ||
-            user.publicBoxKey !== remoteIdentity.publicBoxKey) {
+        if (!user)
             continue;
-        }
-        try {
-            (0, user_permissions_1.verifyUserSignature)(user);
-            return true;
-        }
-        catch {
-            // A different context may contain the valid signed record.
-        }
+        // A member can supply a self-signed namesake in a group. It must never override an
+        // identity already pinned in personal contacts (especially the device owner's identity).
+        if (!(0, user_permissions_1.sameUserIdentity)(user, remoteIdentity))
+            return false;
+        if (!user.signature)
+            continue;
+        return (0, user_permissions_1.isSelfSignedUser)(user);
     }
     return false;
 }
@@ -269,6 +265,7 @@ async function authorizeRemoteContractCall(call, userContext, remoteIdentity) {
             dataContextId,
             context: {
                 callerUserId: remoteIdentity.userId,
+                callerPublicKey: remoteIdentity.publicKey,
                 localUserId: userContext.userId,
                 callerDeviceId: remoteIdentity.deviceId,
                 // Never create a context the caller names: only this device's own groups.
@@ -286,7 +283,7 @@ async function authorizeRemoteContractCall(call, userContext, remoteIdentity) {
     }
     const dataContext = userContext.getDataContext(dataContextId);
     await dataContext.packageLoader?.catalogReady;
-    const callerLevel = await (0, group_permissions_1.getUserAccessLevel)(dataContext, remoteIdentity.userId);
+    const callerLevel = await (0, group_permissions_1.getUserAccessLevel)(dataContext, remoteIdentity.userId, remoteIdentity.publicKey);
     // Policy belongs to the executing provider, not the latest registration of this shape.
     // Select after the async role lookup and retain the selection through endpoint resolution.
     const registry = dataContext.packageLoader?.contractRegistry;
@@ -323,6 +320,7 @@ async function authorizeRemoteContractCall(call, userContext, remoteIdentity) {
         providerPackageId: selected?.providerPackageId,
         context: {
             callerUserId: remoteIdentity.userId,
+            callerPublicKey: remoteIdentity.publicKey,
             localUserId: userContext.userId,
             callerDeviceId: remoteIdentity.deviceId,
             dataContext,
@@ -490,6 +488,7 @@ function createUserContextContractProviderRouter(transport, opts) {
     const { userContext, remoteIdentity } = opts;
     const context = {
         callerUserId: remoteIdentity.userId,
+        callerPublicKey: remoteIdentity.publicKey,
         localUserId: userContext.userId,
         callerDeviceId: remoteIdentity.deviceId,
         dataContext: userContext.userDataContext,

package/dist/contracts/contract-transport.d.ts

@@ -63,7 +63,8 @@ export declare const CONTRACT_REQUEST_CHANNEL = "contractCall";
 export declare const CONTRACT_NOTIFY_CHANNEL = "contractNotify";
 /**
  * Wrap a duplex RPC emitter (e.g. a device {@link Connection}) as an
- * {@link IContractTransport}. `emit` delegates directly. `on` uses one adapter-owned
+ * {@link IContractTransport}. `emit` delegates directly and rejects with an `Error`
+ * carrying the remote message, whatever the emitter rejected with. `on` uses one adapter-owned
  * dispatcher per emitter/channel and returns an unsubscribe that removes only the caller's
  * handler from that dispatcher; it never uses a coarse `removeAllListeners`.
  *

package/dist/contracts/contract-transport.js

@@ -33,9 +33,24 @@ exports.CONTRACT_REQUEST_CHANNEL = "contractCall";
  */
 exports.CONTRACT_NOTIFY_CHANNEL = "contractNotify";
 const connectionDispatcherStates = new WeakMap();
+/**
+ * Turn a failed emit into an `Error`. A device connection rejects with the remote handler's
+ * `{ error, errorType }` envelope, or with a string when the call times out.
+ */
+function toError(error) {
+    if (error instanceof Error)
+        return error;
+    if (error &&
+        typeof error === "object" &&
+        typeof error.error === "string") {
+        return new Error(error.error);
+    }
+    return new Error(typeof error === "string" ? error : JSON.stringify(error));
+}
 /**
  * Wrap a duplex RPC emitter (e.g. a device {@link Connection}) as an
- * {@link IContractTransport}. `emit` delegates directly. `on` uses one adapter-owned
+ * {@link IContractTransport}. `emit` delegates directly and rejects with an `Error`
+ * carrying the remote message, whatever the emitter rejected with. `on` uses one adapter-owned
  * dispatcher per emitter/channel and returns an unsubscribe that removes only the caller's
  * handler from that dispatcher; it never uses a coarse `removeAllListeners`.
  *
@@ -53,7 +68,14 @@ const connectionDispatcherStates = new WeakMap();
  */
 function connectionContractTransport(emitter) {
     return {
-        emit: (channel, ...args) => emitter.emit(channel, ...args),
+        emit: async (channel, ...args) => {
+            try {
+                return await emitter.emit(channel, ...args);
+            }
+            catch (error) {
+                throw toError(error);
+            }
+        },
         on: (channel, handler) => {
             let channelStates = connectionDispatcherStates.get(emitter);
             if (!channelStates) {

package/dist/contracts/system/network-contracts.d.ts

@@ -199,7 +199,7 @@ export interface INetworkSyncRecoveryEntry {
     attemptCount: number;
     latestError: string;
     status: "retrying" | "parked";
-    parkedReason?: "schema" | "unique-conflict" | "unresolvable";
+    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | "authorization";
     stuck: boolean;
     /** True when this device has a row that "Keep this device's version" can snapshot. */
     localRowExists: boolean;

package/dist/contracts/tool-catalog-service.js

@@ -172,7 +172,7 @@ async function projectToolCatalogAccess(dataContext, entry, callerContext) {
             ? runtime.getEffectiveToolLevel?.(entry.target, provider)
             : (0, tool_access_1.recordAccessLevel)((await liveResolver(dataContext, entry.target, provider)?.({ dataContext }))?.tools?.[entry.target.toolName]?.tool);
         if (accessLevel !== undefined) {
-            const callerAccessLevel = await (0, group_permissions_1.getUserAccessLevel)(dataContext, userId);
+            const callerAccessLevel = await (0, group_permissions_1.getUserAccessLevel)(dataContext, userId, callerContext.callerPublicKey);
             entry.access = {
                 accessLevel,
                 callerAccessLevel,

package/dist/contracts/tool-catalog.js

@@ -179,13 +179,17 @@ function validateToolCatalogWrite(existing, candidate, recordId = candidate?.too
         !isMissingTargetQuarantine(existing) &&
         isMissingTargetQuarantine(candidate))
         throw new Error(`Quarantined tool identity: ${candidate.toolId}`);
-    // Quarantine preserves the original evidence byte-for-byte; it cannot retarget it.
+    // Quarantine preserves the original evidence byte-for-byte; it cannot retarget it. That
+    // includes an existing quarantine's reason: a peer's resolve patch whose `catalogReason`
+    // half arrives first must park, not erase the missing-target reason its other half needs.
     if (existing &&
         candidate.catalogState === "quarantined" &&
         existing.contractId === candidate.contractId &&
         existing.contractVersion === candidate.contractVersion &&
         existing.toolName === candidate.toolName &&
-        existing.catalogIdentity === candidate.catalogIdentity)
+        existing.catalogIdentity === candidate.catalogIdentity &&
+        (existing.catalogState !== "quarantined" ||
+            (existing.catalogReason ?? undefined) === (candidate.catalogReason ?? undefined)))
         return;
     // Changing quarantined identity evidence also requires an approved repair, even
     // when the candidate stays quarantined and would be resolved by reconciliation.

package/dist/data/assistants.d.ts

@@ -22,8 +22,8 @@ export declare const assistantSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     accessLevel: number;
-    assistantId: string;
     createdAt: Date;
+    assistantId: string;
     assistantRunnerToolId: string;
     assistantRunnerConfig: {} & {
         [k: string]: any;
@@ -56,8 +56,8 @@ export type IAssistant = z.infer<typeof assistantSchema>;
 export declare function Assistants(dataContext?: DataContext): import("..").Table<{
     name: string;
     accessLevel: number;
-    assistantId: string;
     createdAt: Date;
+    assistantId: string;
     assistantRunnerToolId: string;
     assistantRunnerConfig: {} & {
         [k: string]: any;
@@ -87,8 +87,8 @@ export declare const groupPrimaryAssistantVar: import("./persistent-vars").Persi
 export declare const getPrimaryAssistant: (dataContext?: DataContext) => Promise<{
     name: string;
     accessLevel: number;
-    assistantId: string;
     createdAt: Date;
+    assistantId: string;
     assistantRunnerToolId: string;
     assistantRunnerConfig: {} & {
         [k: string]: any;

package/dist/data/authority-write-checks.d.ts

@@ -0,0 +1,42 @@
+import type { IGroupMember } from "./group-members";
+import type { IGroup } from "./groups";
+import { type ITableWriteCheckContext } from "./orm/write-checks";
+import type { IPackageVersion } from "./package-versions";
+import type { IPackage } from "./packages";
+/**
+ * A membership must be signed by a member who counts as at least Admin, at least the role
+ * granted, and at least the member's current role. Only the founder writes the founder's row.
+ * A membership is removed by a signed soft delete; a hard delete is allowed only for a
+ * duplicate row (the user has another membership row), as unique-conflict cleanup writes.
+ */
+export declare function checkGroupMember(existing: IGroupMember | undefined, candidate: IGroupMember | undefined, context: ITableWriteCheckContext): Promise<void>;
+/**
+ * The group row must be signed by the founder or an Admin who counts, and only the founder can
+ * name a different founder. Sync never deletes it.
+ */
+export declare function checkGroup(existing: IGroup | undefined, candidate: IGroup | undefined, context: ITableWriteCheckContext): Promise<void>;
+/**
+ * A Writer may add a package; changing an existing one beyond its name and description (the
+ * active version, follow policy, update URL, publisher key, repository, disabled) needs an
+ * Admin. Deletes stay open to any member, as the table allows locally.
+ */
+export declare function checkPackageWrite(existing: IPackage | undefined, candidate: IPackage | undefined, context: ITableWriteCheckContext): Promise<void>;
+/**
+ * Whether an Admin's device may act on a package row by itself: install releases from its
+ * `updateUrl`, copy releases signed by its publisher key in from other contexts, and select one
+ * by its follow policy. Each of those signs the result with the Admin's key, so the row must be
+ * one an Admin signed: a Writer may add a package row, or delete one and add it again, with any
+ * publisher key and update URL. A peers-core row instead qualifies only while it names the
+ * peers-core publisher key (or a revoked one, which is re-pinned to it before any release is
+ * checked), whoever signed it. Always true outside a group.
+ *
+ * @param pkg - The package row in `dataContext`.
+ * @param dataContext - The context the row belongs to.
+ */
+export declare function isPackageRowAdminSigned(pkg: IPackage, dataContext: ITableWriteCheckContext["dataContext"]): Promise<boolean>;
+/**
+ * A dev version needs a Writer's signature; any other tag needs an Admin's, so no member can
+ * choose the code other members' devices run. peers-core versions signed by its publisher are
+ * accepted from anyone, since every device installs the bundled release.
+ */
+export declare function checkPackageVersion(existing: IPackageVersion | undefined, candidate: IPackageVersion | undefined, context: ITableWriteCheckContext): Promise<void>;