@peers-app/peers-sdk 0.27.4 → 0.28.0

package/dist/data/group-resign.d.ts

@@ -0,0 +1,38 @@
+import type { DataContext } from "../context/data-context";
+/** What {@link resignGroupAuthority} did, per table. */
+export interface IResignGroupAuthorityResult {
+    /** Rows re-signed. */
+    resigned: Record<"Groups" | "GroupMembers" | "Packages" | "PackageVersions", number>;
+    /** Rows left as they were because their table refused this user's signature, with why. */
+    refused: {
+        table: string;
+        recordId: string;
+        error: string;
+    }[];
+}
+/** Which rows {@link resignGroupAuthority} re-signs. */
+export interface IResignGroupAuthorityOptions {
+    /** Only rows validly signed with this public key (a key the user just rotated away from). */
+    signedByKey?: string;
+    /**
+     * Sign with this secret key instead of the tables' registered signer. Key rotation passes the
+     * new key, since the running host still signs with the old one until it restarts. Host code
+     * only; never accepted from a client.
+     */
+    secretKey?: string;
+}
+/**
+ * Re-sign the rows that carry a group's authority (the group row, memberships, packages and
+ * package versions) with this device's current key, so they count under the group's verified
+ * authority again: after the hard cutover that started checking synced rows, and after a key
+ * rotation (`signedByKey`), since roles are traced through signatures by current keys.
+ *
+ * Each row goes through its table's `signAndSave`, so its table's rules still apply: the founder
+ * can re-sign everything; an Admin only what an Admin may sign. Rows a table refuses are left
+ * as they were and reported. Re-signing vouches for each row as it is now, so only run it on a
+ * group whose current rows you trust.
+ *
+ * @param dataContext - The group's context (not the personal context).
+ * @param opts - Limit to rows signed by one key.
+ */
+export declare function resignGroupAuthority(dataContext: DataContext, opts?: IResignGroupAuthorityOptions): Promise<IResignGroupAuthorityResult>;

package/dist/data/group-resign.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resignGroupAuthority = resignGroupAuthority;
+const keys_1 = require("../keys");
+const write_checks_1 = require("./orm/write-checks");
+/**
+ * Re-sign the rows that carry a group's authority (the group row, memberships, packages and
+ * package versions) with this device's current key, so they count under the group's verified
+ * authority again: after the hard cutover that started checking synced rows, and after a key
+ * rotation (`signedByKey`), since roles are traced through signatures by current keys.
+ *
+ * Each row goes through its table's `signAndSave`, so its table's rules still apply: the founder
+ * can re-sign everything; an Admin only what an Admin may sign. Rows a table refuses are left
+ * as they were and reported. Re-signing vouches for each row as it is now, so only run it on a
+ * group whose current rows you trust.
+ *
+ * @param dataContext - The group's context (not the personal context).
+ * @param opts - Limit to rows signed by one key.
+ */
+async function resignGroupAuthority(dataContext, opts = {}) {
+    const groupId = dataContext.groupId;
+    if (!groupId) {
+        throw new Error("resignGroupAuthority needs a group context");
+    }
+    const { Groups } = await Promise.resolve().then(() => require("./groups"));
+    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+    const { Packages } = await Promise.resolve().then(() => require("./packages"));
+    const { PackageVersions } = await Promise.resolve().then(() => require("./package-versions"));
+    const result = {
+        resigned: { Groups: 0, GroupMembers: 0, Packages: 0, PackageVersions: 0 },
+        refused: [],
+    };
+    const snapshot = { saveAsSnapshot: true, restoreIfDeleted: true };
+    // Through each table's own save, so its rules still apply to the new signature.
+    const resign = async (table, rows, prepare = (row) => row) => {
+        const tableName = table.tableName;
+        // Only rows that key really signed: a row can name any key in its signature field.
+        for (const row of rows.filter((row) => !opts.signedByKey || (0, keys_1.signedByKey)(row) === opts.signedByKey)) {
+            try {
+                if (opts.secretKey) {
+                    const stamp = await (0, write_checks_1.signingStamp)(table, row, row);
+                    await table.save((0, keys_1.addSignatureToObject)({ ...row, ...stamp }, opts.secretKey), snapshot);
+                }
+                else {
+                    await table.signAndSave(prepare(row), snapshot);
+                }
+                result.resigned[tableName]++;
+            }
+            catch (error) {
+                result.refused.push({
+                    table: tableName,
+                    recordId: row[table.primaryKeyName],
+                    error: String(error),
+                });
+            }
+        }
+    };
+    const groups = Groups(dataContext);
+    const group = await groups.get(groupId);
+    await resign(groups, group ? [group] : []);
+    const members = GroupMembers(dataContext);
+    await resign(members, await members.list({ groupId }), 
+    // A rotation re-signs the grant as it is; otherwise bind it to the member's key as this
+    // device knows it (a grant from before keys were named, or to a key since replaced).
+    ({ publicKey: _named, ...rest }) => rest);
+    const packages = Packages(dataContext);
+    await resign(packages, await packages.list());
+    const versions = PackageVersions(dataContext);
+    await resign(versions, await versions.list());
+    return result;
+}

package/dist/data/groups.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import type { DataContext } from "../context/data-context";
 import { GroupMemberRole } from "./group-member-roles";
+import type { IResignGroupAuthorityOptions, IResignGroupAuthorityResult } from "./group-resign";
 import type { ISaveOptions } from "./orm/data-query";
 import { Table } from "./orm/table";
 /** Schema for a signed group record, including membership policy and group public keys. */
@@ -13,6 +14,7 @@ export declare const groupSchema: z.ZodObject<{
     disabled: z.ZodOptional<z.ZodBoolean>;
     founderUserId: z.ZodEffects<z.ZodString, string, string>;
     signature: z.ZodString;
+    signedAt: z.ZodOptional<z.ZodNumber>;
     publicKey: z.ZodString;
     publicBoxKey: z.ZodString;
 }, "strip", z.ZodTypeAny, {
@@ -25,6 +27,7 @@ export declare const groupSchema: z.ZodObject<{
     founderUserId: string;
     disabled?: boolean | undefined;
     iconClassName?: string | undefined;
+    signedAt?: number | undefined;
     publicRole?: GroupMemberRole | undefined;
 }, {
     name: string;
@@ -36,6 +39,7 @@ export declare const groupSchema: z.ZodObject<{
     founderUserId: string;
     disabled?: boolean | undefined;
     iconClassName?: string | undefined;
+    signedAt?: number | undefined;
     publicRole?: GroupMemberRole | undefined;
 }>;
 /** A signed group record shared between personal and group contexts. */
@@ -47,6 +51,13 @@ export declare class GroupsTable extends Table<IGroup> {
     static isPassthrough: boolean;
     save(group: IGroup, opts?: ISaveOptions): Promise<IGroup>;
     signAndSave(group: IGroup, opts?: ISaveOptions): Promise<IGroup>;
+    /**
+     * Re-sign this group's authority rows (group row, memberships, packages, package versions)
+     * with this device's key. See {@link resignGroupAuthority}. Only on a group context's table.
+     *
+     * @param opts - Limit to rows signed by one key.
+     */
+    resignAuthority(opts?: IResignGroupAuthorityOptions): Promise<IResignGroupAuthorityResult>;
     delete(groupId: string): Promise<void>;
     /** Registers the signer for all SDK copies in this JavaScript realm. Replaces any prior signer. */
     static enableGroupSigning(fn: (group: IGroup) => IGroup): void;

package/dist/data/groups.js

@@ -39,12 +39,13 @@ exports.Groups = Groups;
 const zod_1 = require("zod");
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const zod_types_1 = require("../types/zod-types");
+const authority_write_checks_1 = require("./authority-write-checks");
 const group_member_roles_1 = require("./group-member-roles");
-const group_permissions_1 = require("./group-permissions");
 const decorators_1 = require("./orm/decorators");
 const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
+const write_checks_1 = require("./orm/write-checks");
 /** Schema for a signed group record, including membership policy and group public keys. */
 exports.groupSchema = zod_1.z.object({
     groupId: zod_types_1.zodPeerId,
@@ -61,6 +62,10 @@ exports.groupSchema = zod_1.z.object({
     disabled: zod_1.z.boolean().optional().describe("Whether the group is currently disabled"),
     founderUserId: zod_types_1.zodPeerId.describe("The user ID of the group founder"),
     signature: zod_1.z.string().describe("The signed hash of this data excluding the signature itself"),
+    signedAt: zod_1.z
+        .number()
+        .optional()
+        .describe("When the signer signed this row (ms since epoch), under the signature: a copy of an earlier row can't replace a later one"),
     publicKey: zod_1.z
         .string()
         .describe("The public key of the group used to verify a data has come from a group member with write permissions or higher"),
@@ -86,26 +91,20 @@ let GroupsTable = (() => {
     let _classSuper = table_1.Table;
     let _instanceExtraInitializers = [];
     let _signAndSave_decorators;
+    let _resignAuthority_decorators;
     return class GroupsTable extends _classSuper {
         static {
             const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
             _signAndSave_decorators = [(0, decorators_1.ProxyClientTableMethodCalls)()];
+            _resignAuthority_decorators = [(0, decorators_1.ProxyClientTableMethodCalls)()];
             __esDecorate(this, null, _signAndSave_decorators, { kind: "method", name: "signAndSave", static: false, private: false, access: { has: obj => "signAndSave" in obj, get: obj => obj.signAndSave }, metadata: _metadata }, null, _instanceExtraInitializers);
+            __esDecorate(this, null, _resignAuthority_decorators, { kind: "method", name: "resignAuthority", static: false, private: false, access: { has: obj => "resignAuthority" in obj, get: obj => obj.resignAuthority }, metadata: _metadata }, null, _instanceExtraInitializers);
             if (_metadata) Object.defineProperty(this, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
         }
         static isPassthrough = false;
         async save(group, opts) {
-            if (GroupsTable.isPassthrough) {
-                return super.save(group, opts);
-            }
-            const userContext = await (0, user_context_singleton_1.getUserContext)();
-            const userContextGroups = Groups(userContext.userDataContext);
-            if (userContextGroups === this) {
-                // users can do whatever they want to groups in their personal space
-                return super.save(group, opts);
-            }
-            const oldGroup = await this.get(group.groupId);
-            await (0, group_permissions_1.verifyGroupSignature)(group, oldGroup);
+            if (!GroupsTable.isPassthrough)
+                await (0, write_checks_1.checkLocalSave)(this, group, authority_write_checks_1.checkGroup);
             return super.save(group, opts);
         }
         async signAndSave(group, opts) {
@@ -113,9 +112,28 @@ let GroupsTable = (() => {
             if (!sign) {
                 throw new Error("Group signing must be enabled to sign and save groups. Call GroupsTable.enableGroupSigning(fn) to enable it.");
             }
-            group = sign.call(GroupsTable, group);
+            group = sign.call(GroupsTable, {
+                ...group,
+                ...(await (0, write_checks_1.signingStamp)(this, group)),
+            });
             return this.save(group, opts);
         }
+        /**
+         * Re-sign this group's authority rows (group row, memberships, packages, package versions)
+         * with this device's key. See {@link resignGroupAuthority}. Only on a group context's table.
+         *
+         * @param opts - Limit to rows signed by one key.
+         */
+        async resignAuthority(opts) {
+            const { resignGroupAuthority } = await Promise.resolve().then(() => require("./group-resign"));
+            if (!this.groupId) {
+                throw new Error("Re-sign a group from its own context, not the personal context");
+            }
+            // Signs with the registered signer only: a client never supplies a key.
+            return resignGroupAuthority((await (0, user_context_singleton_1.getUserContext)()).getDataContext(this.groupId), {
+                signedByKey: opts?.signedByKey,
+            });
+        }
         async delete(groupId) {
             const userContext = await (0, user_context_singleton_1.getUserContext)();
             const userContextGroups = Groups(userContext.userDataContext);

package/dist/data/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./access-level";
 export * from "./assistants";
+export * from "./authority-write-checks";
 export * from "./change-tracking";
 export * from "./channels";
 export * from "./create-group";
@@ -7,9 +8,11 @@ export * from "./device-sync-info";
 export * from "./devices";
 export * from "./embeddings";
 export * from "./files";
+export * from "./group-authority";
 export * from "./group-member-roles";
 export * from "./group-members";
 export * from "./group-permissions";
+export * from "./group-resign";
 export * from "./group-secret";
 export * from "./group-share";
 export * from "./groups";

package/dist/data/index.js

@@ -16,6 +16,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./access-level"), exports);
 __exportStar(require("./assistants"), exports);
+__exportStar(require("./authority-write-checks"), exports);
 __exportStar(require("./change-tracking"), exports);
 __exportStar(require("./channels"), exports);
 __exportStar(require("./create-group"), exports);
@@ -23,9 +24,11 @@ __exportStar(require("./device-sync-info"), exports);
 __exportStar(require("./devices"), exports);
 __exportStar(require("./embeddings"), exports);
 __exportStar(require("./files"), exports);
+__exportStar(require("./group-authority"), exports);
 __exportStar(require("./group-member-roles"), exports);
 __exportStar(require("./group-members"), exports);
 __exportStar(require("./group-permissions"), exports);
+__exportStar(require("./group-resign"), exports);
 __exportStar(require("./group-secret"), exports);
 __exportStar(require("./group-share"), exports);
 __exportStar(require("./groups"), exports);

package/dist/data/invites.d.ts

@@ -47,6 +47,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }>, "many">>;
+        anchorsSignature: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
@@ -55,6 +56,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
@@ -64,6 +66,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }>>;
     /** Device the counterpart used, when they told us; lets the network layer connect early. */
@@ -95,6 +98,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }>, "many">>;
+            anchorsSignature: z.ZodOptional<z.ZodString>;
         }, "strict", z.ZodTypeAny, {
             publicKey: string;
             userId: string;
@@ -103,6 +107,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         }, {
             publicKey: string;
@@ -112,6 +117,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         }>;
         expiresAt: z.ZodString;
@@ -155,6 +161,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -181,6 +188,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -253,6 +261,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -274,6 +283,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;
@@ -314,6 +324,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -335,6 +346,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;
@@ -383,6 +395,7 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -404,6 +417,7 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;

package/dist/data/orm/index.d.ts

@@ -14,3 +14,4 @@ export * from "./table-container";
 export * from "./table-definitions.type";
 export * from "./table-dependencies";
 export * from "./types";
+export * from "./write-checks";

package/dist/data/orm/index.js

@@ -30,3 +30,4 @@ __exportStar(require("./table-container"), exports);
 __exportStar(require("./table-definitions.type"), exports);
 __exportStar(require("./table-dependencies"), exports);
 __exportStar(require("./types"), exports);
+__exportStar(require("./write-checks"), exports);

package/dist/data/orm/sql.data-source.d.ts

@@ -96,8 +96,8 @@ export declare class SQLDataSource<T extends {
      */
     bulkSave(records: T[]): Promise<T[]>;
 }
-/** Encode a JavaScript field for SQLite parameters or an escaped migration literal. */
-export declare function jsValueToSqlValue(value: any, escapeQuote?: boolean): any;
+/** Encode a JavaScript field for SQLite parameters. */
+export declare function jsValueToSqlValue(value: any): any;
 /** Restore a SQLite field according to its declared Peers type. */
 export declare function sqlValueToJsValue(value: any, fieldType: FieldType, isArray: boolean): any;
 /** Default value used when adding a required field to an existing table. */

package/dist/data/orm/sql.data-source.js

@@ -136,6 +136,7 @@ class SQLDataSource {
             // sql query to copy existing data and set new required fields to default values
             const defaults = this.initRecord();
             const fieldsInsert = this.metaData.fields.map((f) => `"${f.name}"`).join(", ");
+            const params = [];
             const fieldsSelect = this.metaData.fields
                 .map((f) => {
                 const existingField = existingTableDef.includes(`"${f.name}"`);
@@ -146,18 +147,19 @@ class SQLDataSource {
                 if (defaultValue === undefined) {
                     defaultValue = globalDefaultValues(f);
                 }
-                defaultValue = jsValueToSqlValue(defaultValue, true);
+                if (!f.optional)
+                    params.push(jsValueToSqlValue(defaultValue));
                 if (existingField && !f.optional) {
-                    return `CASE WHEN "${f.name}" IS NULL THEN '${defaultValue}' ELSE "${f.name}" END as "${f.name}"`;
+                    return `COALESCE("${f.name}", ?) as "${f.name}"`;
                 }
                 if (!existingField && !f.optional) {
-                    return `'${defaultValue}' as "${f.name}"`;
+                    return `? as "${f.name}"`;
                 }
                 return `NULL as "${f.name}"`;
             })
                 .join(", ");
             const insertSql = `INSERT INTO "${this.tableName}"(${fieldsInsert}) SELECT ${fieldsSelect} FROM "${tempTableName}"`;
-            await this.db.exec(insertSql, []);
+            await this.db.exec(insertSql, params);
             // drop old table
             const dropSql = `DROP TABLE IF EXISTS "${tempTableName}"`;
             await this.db.exec(dropSql, []);
@@ -536,8 +538,8 @@ class SQLDataSource {
     }
 }
 exports.SQLDataSource = SQLDataSource;
-/** Encode a JavaScript field for SQLite parameters or an escaped migration literal. */
-function jsValueToSqlValue(value, escapeQuote = false) {
+/** Encode a JavaScript field for SQLite parameters. */
+function jsValueToSqlValue(value) {
     if (value === undefined)
         return null;
     if (value instanceof Date) {
@@ -549,9 +551,6 @@ function jsValueToSqlValue(value, escapeQuote = false) {
     if (typeof value === "boolean") {
         return value ? 1 : 0;
     }
-    if (typeof value === "string" && escapeQuote) {
-        return value.replace(/'/g, "''");
-    }
     return value;
 }
 /** Restore a SQLite field according to its declared Peers type. */

package/dist/data/orm/table-container.js

@@ -4,6 +4,7 @@ exports.TableContainer = void 0;
 exports.checkVersionedUpdate = checkVersionedUpdate;
 const rpc_types_1 = require("../../rpc-types");
 const utils_1 = require("../../utils");
+const package_table_identity_1 = require("../package-table-identity");
 const table_1 = require("./table");
 const table_definitions_system_1 = require("./table-definitions.system");
 const types_1 = require("./types");
@@ -266,7 +267,8 @@ class TableContainer {
         const record = await tableDefsTable.findOne({ name: tableName });
         if (!record || record.deleted)
             return null;
-        this.registerFromTableDefinitionRecord(record);
+        if (!this.registerFromTableDefinitionRecord(record))
+            return null;
         // Now instantiate via getTableByName which checks fallbackDefinitions
         return this.getTableByName(tableName);
     }
@@ -334,22 +336,25 @@ class TableContainer {
      * External code should not need to call this directly.
      */
     registerFromTableDefinitionRecord(record) {
-        const metaData = record.metaData;
-        if (!metaData?.tableId || !metaData?.name || !metaData?.fields) {
-            console.warn(`Invalid table definition record, skipping:`, record);
-            return;
+        try {
+            (0, package_table_identity_1.validateTableDefinitionRecord)(record);
         }
+        catch (error) {
+            console.warn("Refusing invalid synced table definition", error);
+            return false;
+        }
+        const metaData = record.metaData;
         const tableName = (0, utils_1.getFullTableName)(metaData);
         // Deleted tables should not be registered as fallbacks
         if (record.deleted) {
             delete this.fallbackDefinitions[tableName];
             delete this.fallbackInstances[tableName];
-            return;
+            return false;
         }
         // Don't overwrite a full (code-registered) definition -- that always takes precedence
         const fullDef = this.tableDefinitions[tableName] || table_definitions_system_1.systemTableDefinitions[tableName];
         if (fullDef) {
-            return; // full definition exists, no need for a fallback
+            return true; // full definition exists, no need for a fallback
         }
         const existing = this.fallbackDefinitions[tableName];
         if (existing) {
@@ -357,13 +362,14 @@ class TableContainer {
             const incomingVersion = record.versionNumber ?? 0;
             const result = checkVersionedUpdate(existingVersion, incomingVersion, existing.metaData, metaData);
             if (result === "skip") {
-                return;
+                return true;
             }
             // Remove old fallback instance so it gets re-created with the new schema
             delete this.fallbackInstances[tableName];
         }
         const schema = (0, types_1.fieldsToSchema)(metaData.fields);
         this.fallbackDefinitions[tableName] = { metaData, schema };
+        return true;
     }
     /**
      * This ensures all tables have been new'ed up and then returns the entire list of them.

package/dist/data/orm/write-checks.d.ts

@@ -0,0 +1,89 @@
+import type { DataContext } from "../../context/data-context";
+import type { Table } from "./table";
+/**
+ * Prefix of every refusal from a {@link TableWriteCheck}. Sync recovery parks a change refused
+ * with it, and checks it again only from local history, when the group's authority changes.
+ */
+export declare const WRITE_NOT_AUTHORIZED = "Write not authorized";
+/** Where a checked write lands. */
+export interface ITableWriteCheckContext {
+    /** The context the row belongs to. */
+    dataContext: DataContext;
+    /** The row's primary key, also given for a delete. */
+    recordId: string;
+    /** Checked snapshots retained by the same atomic recovery transaction. */
+    retainedRows?: readonly unknown[];
+    /** Records removed by the same atomic recovery transaction. */
+    deletedRecordIds?: readonly string[];
+}
+/**
+ * A rule a row must meet before it's written, run by the host on every synced change (sync
+ * writes rows without going through the table class). Throw an error from
+ * {@link writeNotAuthorized} to refuse it.
+ *
+ * @param existing - The row as stored now, if any.
+ * @param candidate - The row about to be stored, or undefined for a delete.
+ */
+export type TableWriteCheck<T = any> = (existing: T | undefined, candidate: T | undefined, context: ITableWriteCheckContext) => Promise<void> | void;
+/**
+ * Register the {@link TableWriteCheck} for a table name. One per table; a second registration
+ * replaces the first.
+ *
+ * @param tableName - Table the check guards.
+ * @param check - The rule.
+ */
+export declare function registerTableWriteCheck<T>(tableName: string, check: TableWriteCheck<T>): void;
+/**
+ * The {@link TableWriteCheck} registered for a table, if any.
+ *
+ * @param tableName - Table name.
+ */
+export declare function getTableWriteCheck(tableName: string): TableWriteCheck | undefined;
+/**
+ * Run `check` on a local save to `table`, as the host runs it on every synced row, so a local
+ * write and a synced write are judged by the same code. Nothing is checked in the personal
+ * context: only the user's own devices write it.
+ *
+ * @param table - The table being saved to.
+ * @param row - The row about to be stored.
+ * @param check - The table's rule.
+ */
+export declare function checkLocalSave<T extends {
+    [key: string]: any;
+}>(table: Table<T>, row: T, check: TableWriteCheck<T>): Promise<void>;
+/**
+ * Tables whose approvals are bound to a context (`signedContextId`) and whose deletes are open,
+ * so a deleted row's signing time is retained ({@link deletedSignedAt}).
+ */
+export declare const packageApprovalTables: ReadonlySet<string>;
+/**
+ * What a table's `signAndSave` (and a re-sign) puts under the signature: `signedAt`, now or
+ * just after the row on record when that was signed by a clock running ahead, so the new
+ * signature counts as the later one (and, for a package table, after the deleted row's
+ * retained stamp); for a package table also the context the approval is for.
+ *
+ * @param table - The table being signed for.
+ * @param row - The row being signed.
+ * @param current - A row already read from storage; membership repair may supply another id's row.
+ */
+export declare function signingStamp<T extends Record<string, any>>(table: Table<T>, row: T, current?: {
+    signedAt?: number;
+}): Promise<{
+    signedAt: number;
+    signedContextId?: string;
+}>;
+/**
+ * Read a deleted authority row's last signing time, optionally retaining the stored row's
+ * stamp before deletion. Device-local personal storage survives deletion and log compaction.
+ * Only pass `existing` from storage, never an unverified incoming candidate.
+ */
+export declare function deletedSignedAt(tableName: string, context: ITableWriteCheckContext, existing?: {
+    signedAt?: number;
+}): Promise<number>;
+/**
+ * An error refusing a write, carrying the {@link WRITE_NOT_AUTHORIZED} prefix.
+ *
+ * @param tableName - Table the write was for.
+ * @param reason - Why, for logs and the sync recovery queue.
+ */
+export declare function writeNotAuthorized(tableName: string, reason: string): Error;