@peers-app/peers-sdk 0.27.4 → 0.28.0

package/dist/data/orm/write-checks.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageApprovalTables = exports.WRITE_NOT_AUTHORIZED = void 0;
+exports.registerTableWriteCheck = registerTableWriteCheck;
+exports.getTableWriteCheck = getTableWriteCheck;
+exports.checkLocalSave = checkLocalSave;
+exports.signingStamp = signingStamp;
+exports.deletedSignedAt = deletedSignedAt;
+exports.writeNotAuthorized = writeNotAuthorized;
+/**
+ * Prefix of every refusal from a {@link TableWriteCheck}. Sync recovery parks a change refused
+ * with it, and checks it again only from local history, when the group's authority changes.
+ */
+exports.WRITE_NOT_AUTHORIZED = "Write not authorized";
+const writeChecks = new Map();
+/**
+ * Register the {@link TableWriteCheck} for a table name. One per table; a second registration
+ * replaces the first.
+ *
+ * @param tableName - Table the check guards.
+ * @param check - The rule.
+ */
+function registerTableWriteCheck(tableName, check) {
+    writeChecks.set(tableName, check);
+}
+/**
+ * The {@link TableWriteCheck} registered for a table, if any.
+ *
+ * @param tableName - Table name.
+ */
+function getTableWriteCheck(tableName) {
+    return writeChecks.get(tableName);
+}
+/**
+ * Run `check` on a local save to `table`, as the host runs it on every synced row, so a local
+ * write and a synced write are judged by the same code. Nothing is checked in the personal
+ * context: only the user's own devices write it.
+ *
+ * @param table - The table being saved to.
+ * @param row - The row about to be stored.
+ * @param check - The table's rule.
+ */
+async function checkLocalSave(table, row, check) {
+    if (!table.groupId)
+        return;
+    const { getUserContext } = await Promise.resolve().then(() => require("../../context/user-context-singleton"));
+    const recordId = row[table.primaryKeyName];
+    await check(await table.get(recordId), row, {
+        dataContext: (await getUserContext()).getDataContext(table.groupId),
+        recordId,
+    });
+}
+/**
+ * Tables whose approvals are bound to a context (`signedContextId`) and whose deletes are open,
+ * so a deleted row's signing time is retained ({@link deletedSignedAt}).
+ */
+exports.packageApprovalTables = new Set(["Packages", "PackageVersions"]);
+/**
+ * What a table's `signAndSave` (and a re-sign) puts under the signature: `signedAt`, now or
+ * just after the row on record when that was signed by a clock running ahead, so the new
+ * signature counts as the later one (and, for a package table, after the deleted row's
+ * retained stamp); for a package table also the context the approval is for.
+ *
+ * @param table - The table being signed for.
+ * @param row - The row being signed.
+ * @param current - A row already read from storage; membership repair may supply another id's row.
+ */
+async function signingStamp(table, row, current) {
+    const { tableName, groupId, primaryKeyName } = table;
+    const recordId = row[primaryKeyName];
+    current ??= await table.get(recordId);
+    const packageTable = exports.packageApprovalTables.has(tableName);
+    let floor = current?.signedAt ?? 0;
+    if (packageTable && groupId && !current) {
+        const { getUserContext } = await Promise.resolve().then(() => require("../../context/user-context-singleton"));
+        const dataContext = (await getUserContext()).getDataContext(groupId);
+        floor = await deletedSignedAt(tableName, { dataContext, recordId });
+    }
+    return {
+        signedAt: Math.max(Date.now(), floor + 1),
+        ...(packageTable ? { signedContextId: groupId } : {}),
+    };
+}
+/**
+ * Read a deleted authority row's last signing time, optionally retaining the stored row's
+ * stamp before deletion. Device-local personal storage survives deletion and log compaction.
+ * Only pass `existing` from storage, never an unverified incoming candidate.
+ */
+async function deletedSignedAt(tableName, context, existing) {
+    if (!context.dataContext.groupId)
+        return 0;
+    const { PersistentVars } = await Promise.resolve().then(() => require("../persistent-vars"));
+    const vars = PersistentVars(context.dataContext.userContext.userDataContext);
+    const name = `authorityOrder:${context.dataContext.groupId}:${tableName}:${context.recordId}`;
+    const remembered = await vars.findOne({ name, scope: "device" });
+    const floor = Math.max(remembered?.value?.value ?? 0, existing?.signedAt ?? 0);
+    if (floor > (remembered?.value?.value ?? 0)) {
+        await vars.save({
+            persistentVarId: remembered?.persistentVarId ?? "",
+            name,
+            scope: "device",
+            value: { value: floor },
+        });
+    }
+    return floor;
+}
+/**
+ * An error refusing a write, carrying the {@link WRITE_NOT_AUTHORIZED} prefix.
+ *
+ * @param tableName - Table the write was for.
+ * @param reason - Why, for logs and the sync recovery queue.
+ */
+function writeNotAuthorized(tableName, reason) {
+    return new Error(`${exports.WRITE_NOT_AUTHORIZED}: ${tableName}: ${reason}`);
+}

package/dist/data/package-table-identity.d.ts

@@ -1,3 +1,4 @@
+import type { ITableDefinitionRecord } from "./table-definitions-table";
 /**
  * Validate a guest-supplied isolated-table or field identifier before it can
  * reach ORM-generated SQL.
@@ -44,3 +45,8 @@ export declare function packageScopedTableName(packageId: string, logicalName: s
  * @throws When package or table identity is invalid.
  */
 export declare function packageScopedTableId(packageId: string, logicalName: string): string;
+/**
+ * Validate synced schema metadata before it can name a table, column, or index in SQL.
+ * A schema cannot impersonate a system table or supply SQL expressions as identifiers.
+ */
+export declare function validateTableDefinitionRecord(record: ITableDefinitionRecord): void;

package/dist/data/package-table-identity.js

@@ -4,6 +4,7 @@ exports.validateIsolatedSqlIdentifier = validateIsolatedSqlIdentifier;
 exports.validatePackageTableName = validatePackageTableName;
 exports.packageScopedTableName = packageScopedTableName;
 exports.packageScopedTableId = packageScopedTableId;
+exports.validateTableDefinitionRecord = validateTableDefinitionRecord;
 const utils_1 = require("../utils");
 const ISOLATED_SQL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
@@ -69,3 +70,53 @@ function packageScopedTableName(packageId, logicalName) {
 function packageScopedTableId(packageId, logicalName) {
     return (0, utils_1.deterministicTableId)(packageScopedTableName(packageId, logicalName));
 }
+/**
+ * Validate synced schema metadata before it can name a table, column, or index in SQL.
+ * A schema cannot impersonate a system table or supply SQL expressions as identifiers.
+ */
+function validateTableDefinitionRecord(record) {
+    const meta = record.metaData;
+    if (!meta ||
+        !(0, utils_1.isid)(record.tableId) ||
+        meta.tableId !== record.tableId ||
+        (meta.packageId !== undefined && !(0, utils_1.isid)(meta.packageId))) {
+        throw new Error("Invalid table definition identity");
+    }
+    validateIsolatedSqlIdentifier(meta.name, "Table name");
+    validateIsolatedSqlIdentifier(meta.primaryKeyName, "Primary key");
+    if (record.name !== (0, utils_1.getFullTableName)(meta))
+        throw new Error("Table definition name mismatch");
+    if (!Number.isSafeInteger(record.versionNumber) ||
+        record.versionNumber < 0 ||
+        record.versionNumber !== (meta.versionNumber ?? 0)) {
+        throw new Error("Invalid table definition version");
+    }
+    if (meta.localOnly !== undefined && typeof meta.localOnly !== "boolean") {
+        throw new Error("Invalid table localOnly policy");
+    }
+    if (!Array.isArray(meta.fields) || !meta.fields.length)
+        throw new Error("Missing table fields");
+    const names = new Set();
+    for (const field of meta.fields) {
+        validateIsolatedSqlIdentifier(field.name, "Column name");
+        if (names.has(field.name))
+            throw new Error("Duplicate table column");
+        names.add(field.name);
+    }
+    if (!names.has(meta.primaryKeyName))
+        throw new Error("Missing primary key column");
+    if (meta.indexes !== undefined && !Array.isArray(meta.indexes))
+        throw new Error("Invalid indexes");
+    for (const index of meta.indexes ?? []) {
+        if (!Array.isArray(index.fields) || !index.fields.length)
+            throw new Error("Missing index fields");
+        for (const field of index.fields) {
+            const name = typeof field === "string" ? field : field.name;
+            if (!names.has(name))
+                throw new Error("Index must name a declared column");
+            if (typeof field !== "string" && field.order !== "ASC" && field.order !== "DESC") {
+                throw new Error("Invalid index order");
+            }
+        }
+    }
+}

package/dist/data/package-version-resolver.d.ts

@@ -18,6 +18,8 @@ import { type PersistentVar } from "./persistent-vars";
 export interface IDevicePackagePrefs {
     /** Which PV this device currently runs */
     activePackageVersionId?: string;
+    /** Tag when this device explicitly selected the version; a later retag cannot opt it into dev. */
+    activePackageVersionTag?: string;
     /** Newer selected PV temporarily bypassed because this host could not run it. */
     compatibilityFallbackForPackageVersionId?: string;
     /** If true, never auto-update this package */
@@ -53,6 +55,19 @@ export declare function packagePrefsVar(packageId: string, dataContext?: DataCon
  *   omitted the var tracks the user's default group context.
  */
 export declare function updatePackagePrefs(packageId: string, prefs: Partial<IDevicePackagePrefs>, dataContext?: DataContext): Promise<void>;
+/**
+ * Check a selected version before evaluating any of its runtime, route or UI bundles.
+ * Group releases and shared selections must still have authorized signatures even when
+ * already on disk. Dev builds require an explicit device selection made while tagged dev.
+ *
+ * @param localDev - A host explicitly loading a local development checkout.
+ */
+export declare function assertPackageVersionRunnable(pkg: IPackage, pv: IPackageVersion, dataContext: DataContext, localDev?: boolean): Promise<void>;
+/**
+ * Verify fetched bundle bytes against the hash in the authorized version. Files rows may be
+ * changed by group members, so their own chunk hashes alone cannot authorize executable code.
+ */
+export declare function assertPackageBundleIntegrity(pv: IPackageVersion, kind: "package" | "routes" | "ui", contents: string | Uint8Array): void;
 /**
  * Effective device-local preferences for a package after merging the device's
  * raw prefs with the group-level `IPackage` defaults. Every field is resolved

package/dist/data/package-version-resolver.js

@@ -10,12 +10,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.packagePrefsVar = packagePrefsVar;
 exports.updatePackagePrefs = updatePackagePrefs;
+exports.assertPackageVersionRunnable = assertPackageVersionRunnable;
+exports.assertPackageBundleIntegrity = assertPackageBundleIntegrity;
 exports.getEffectivePackagePrefs = getEffectivePackagePrefs;
 exports.resolveDevicePackageVersion = resolveDevicePackageVersion;
 exports.hasDeviceFollowOverride = hasDeviceFollowOverride;
 exports.readStoredPackageLocalPath = readStoredPackageLocalPath;
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const assistants_1 = require("./assistants");
+const file_types_1 = require("./files/file.types");
 const group_member_roles_1 = require("./group-member-roles");
 const group_permissions_1 = require("./group-permissions");
 const package_versions_1 = require("./package-versions");
@@ -62,6 +65,13 @@ async function updatePackagePrefs(packageId, prefs, dataContext) {
         effectivePrefs = rest;
     }
     const next = { ...existing, ...effectivePrefs };
+    if ("activePackageVersionId" in effectivePrefs) {
+        const dc = dataContext ?? (await (0, user_context_singleton_1.getUserContext)()).defaultDataContext();
+        const selected = effectivePrefs.activePackageVersionId
+            ? await (0, package_versions_1.PackageVersions)(dc).get(effectivePrefs.activePackageVersionId)
+            : undefined;
+        next.activePackageVersionTag = selected?.versionTag;
+    }
     for (const key of Object.keys(next)) {
         if (next[key] === undefined) {
             delete next[key];
@@ -69,6 +79,47 @@ async function updatePackagePrefs(packageId, prefs, dataContext) {
     }
     pvar(next);
 }
+/**
+ * Check a selected version before evaluating any of its runtime, route or UI bundles.
+ * Group releases and shared selections must still have authorized signatures even when
+ * already on disk. Dev builds require an explicit device selection made while tagged dev.
+ *
+ * @param localDev - A host explicitly loading a local development checkout.
+ */
+async function assertPackageVersionRunnable(pkg, pv, dataContext, localDev = false) {
+    if (!dataContext.groupId)
+        return;
+    if (pv.packageId !== pkg.packageId)
+        throw new Error("Package version belongs to another package");
+    const { isPackageRowAdminSigned } = await Promise.resolve().then(() => require("./authority-write-checks"));
+    const { getTableWriteCheck } = await Promise.resolve().then(() => require("./orm/write-checks"));
+    await getTableWriteCheck("PackageVersions")?.(undefined, pv, {
+        dataContext,
+        recordId: pv.packageVersionId,
+    });
+    if (!localDev) {
+        const prefs = packagePrefsVar(pkg.packageId, dataContext);
+        await prefs.loadingPromise;
+        const deviceSelected = prefs()?.activePackageVersionId === pv.packageVersionId;
+        if (!deviceSelected && !(await isPackageRowAdminSigned(pkg, dataContext))) {
+            throw new Error("A group package selection needs an Admin's signature before it can run");
+        }
+        if (pv.versionTag === "dev" &&
+            (!deviceSelected || prefs()?.activePackageVersionTag !== "dev")) {
+            throw new Error("Activate this dev version on this device before running it");
+        }
+    }
+}
+/**
+ * Verify fetched bundle bytes against the hash in the authorized version. Files rows may be
+ * changed by group members, so their own chunk hashes alone cannot authorize executable code.
+ */
+function assertPackageBundleIntegrity(pv, kind, contents) {
+    const expected = pv[`${kind}BundleFileHash`];
+    if (!expected || (0, file_types_1.computeFileHash)(contents) !== expected) {
+        throw new Error(`Package ${kind} bundle hash does not match the authorized version`);
+    }
+}
 /**
  * Pure function: merge raw device prefs with the group-level `IPackage`
  * defaults to produce fully-resolved effective preferences. Used by the
@@ -221,7 +272,7 @@ async function resolveDevicePackageVersion(pkg, dataContext, opts) {
     const allVersions = await (0, package_versions_1.PackageVersions)(dataContext).list({ packageId: pkg.packageId });
     let bestPv = activePv;
     for (const candidate of allVersions) {
-        if (candidate.packageVersionId === effectiveActivePvId)
+        if (candidate.packageVersionId === effectiveActivePvId || candidate.versionTag === "dev")
             continue;
         const tagOk = (0, package_versions_1.doesTagMatch)(activePv?.versionTag, candidate.versionTag, followTags, undefined);
         if (!tagOk)
@@ -297,7 +348,10 @@ async function resolveDevicePackageVersion(pkg, dataContext, opts) {
                 const role = await (0, group_permissions_1.getUserRole)(groupId, userCtx.userId);
                 if (role >= group_member_roles_1.GroupMemberRole.Admin) {
                     const freshPkg = await (0, packages_1.Packages)(dataContext).get(pkg.packageId);
-                    if (freshPkg) {
+                    const { isPackageRowAdminSigned } = await Promise.resolve().then(() => require("./authority-write-checks"));
+                    // Loading can span a sync that deletes and re-adds this package. Advancing a release
+                    // must not endorse a Writer's replacement publisher key, URL or follow policy.
+                    if (freshPkg && (await isPackageRowAdminSigned(freshPkg, dataContext))) {
                         if (freshPkg.activePackageVersionId !== bestPv.packageVersionId) {
                             freshPkg.activePackageVersionId = bestPv.packageVersionId;
                             await (0, packages_1.Packages)(dataContext).signAndSave(freshPkg);
@@ -326,7 +380,8 @@ async function loadOlderCompatiblePackageVersion(pkg, dataContext, unavailableVe
     const versions = await (0, package_versions_1.PackageVersions)(dataContext).list({ packageId: pkg.packageId });
     const candidates = versions
         .filter((candidate) => {
-        if (candidate.packageVersionId === unavailableVersion.packageVersionId) {
+        if (candidate.packageVersionId === unavailableVersion.packageVersionId ||
+            candidate.versionTag === "dev") {
             return false;
         }
         if ((0, package_versions_1.isNewerVersion)(unavailableVersion.version, candidate.version)) {

package/dist/data/package-versions.d.ts

@@ -48,63 +48,69 @@ declare const schema: z.ZodObject<{
         by: string;
     }>, "many">>;
     signature: z.ZodString;
+    signedContextId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    signedAt: z.ZodOptional<z.ZodNumber>;
     createdBy: z.ZodEffects<z.ZodString, string, string>;
     createdAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     version: string;
     signature: string;
     packageId: string;
-    createdAt: string;
-    createdBy: string;
     packageVersionId: string;
     packageVersionHash: string;
     packageBundleFileId: string;
     packageBundleFileHash: string;
+    createdBy: string;
+    createdAt: string;
     history?: {
         at: string;
         action: string;
         signature: string;
         by: string;
     }[] | undefined;
+    signedAt?: number | undefined;
+    signedContextId?: string | undefined;
+    versionTag?: string | undefined;
+    routesBundleFileId?: string | undefined;
+    routesBundleFileHash?: string | undefined;
+    uiBundleFileId?: string | undefined;
+    uiBundleFileHash?: string | undefined;
     appNavs?: {
         name: string;
         iconClassName: string;
         navigationPath: string;
         displayName?: string | undefined;
     }[] | undefined;
-    versionTag?: string | undefined;
-    routesBundleFileId?: string | undefined;
-    routesBundleFileHash?: string | undefined;
-    uiBundleFileId?: string | undefined;
-    uiBundleFileHash?: string | undefined;
     packageAuthorSignature?: string | undefined;
 }, {
     version: string;
     signature: string;
     packageId: string;
-    createdAt: string;
-    createdBy: string;
     packageVersionId: string;
     packageVersionHash: string;
     packageBundleFileId: string;
     packageBundleFileHash: string;
+    createdBy: string;
+    createdAt: string;
     history?: {
         at: string;
         action: string;
         signature: string;
         by: string;
     }[] | undefined;
+    signedAt?: number | undefined;
+    signedContextId?: string | undefined;
+    versionTag?: string | undefined;
+    routesBundleFileId?: string | undefined;
+    routesBundleFileHash?: string | undefined;
+    uiBundleFileId?: string | undefined;
+    uiBundleFileHash?: string | undefined;
     appNavs?: {
         name: string;
         iconClassName: string;
         navigationPath: string;
         displayName?: string | undefined;
     }[] | undefined;
-    versionTag?: string | undefined;
-    routesBundleFileId?: string | undefined;
-    routesBundleFileHash?: string | undefined;
-    uiBundleFileId?: string | undefined;
-    uiBundleFileHash?: string | undefined;
     packageAuthorSignature?: string | undefined;
 }>;
 /** A signed package build and its bundle hashes, tag, and lifecycle history. */

package/dist/data/package-versions.js

@@ -45,11 +45,12 @@ const context_1 = require("../context");
 const keys_1 = require("../keys");
 const app_nav_1 = require("../types/app-nav");
 const zod_types_1 = require("../types/zod-types");
+const authority_write_checks_1 = require("./authority-write-checks");
 const decorators_1 = require("./orm/decorators");
 const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
-const package_version_permissions_1 = require("./package-version-permissions");
+const write_checks_1 = require("./orm/write-checks");
 const schema = zod_1.z.object({
     packageVersionId: zod_types_1.zodPeerId,
     packageId: zod_types_1.zodPeerId.describe("The package this version belongs to"),
@@ -81,6 +82,13 @@ const schema = zod_1.z.object({
         .optional()
         .describe("Audit trail of lifecycle events for this version"),
     signature: zod_1.z.string().describe("The signed hash of this data excluding the signature itself"),
+    signedContextId: zod_types_1.zodPeerId
+        .optional()
+        .describe("The context this version approval was signed for"),
+    signedAt: zod_1.z
+        .number()
+        .optional()
+        .describe("When the signer signed this row (ms since epoch), under the signature: a copy of an earlier row can't replace a later one"),
     createdBy: zod_types_1.zodPeerId.describe("The user who created this version"),
     createdAt: zod_1.z.string().describe("ISO timestamp of when this version was created"),
 });
@@ -115,14 +123,9 @@ let PackageVersionsTable = (() => {
             return this.save(packageVersion, opts);
         }
         async save(packageVersion, opts) {
-            if (PackageVersionsTable.isPassthrough) {
-                return super.save(packageVersion, opts);
-            }
-            if (!this.groupId) {
-                // users can do whatever they want to package versions in their personal space
-                return super.save(packageVersion, opts);
+            if (!PackageVersionsTable.isPassthrough) {
+                await (0, write_checks_1.checkLocalSave)(this, packageVersion, authority_write_checks_1.checkPackageVersion);
             }
-            await (0, package_version_permissions_1.verifyPackageVersionSignature)(packageVersion, this.groupId);
             return super.save(packageVersion, opts);
         }
         async signAndSave(packageVersion, opts) {
@@ -130,7 +133,10 @@ let PackageVersionsTable = (() => {
             if (!sign) {
                 throw new Error("Package version signing is not enabled. Call PackageVersionsTable.enablePackageVersionSigning(fn) to enable it.");
             }
-            packageVersion = await sign.call(PackageVersionsTable, packageVersion);
+            packageVersion = await sign.call(PackageVersionsTable, {
+                ...packageVersion,
+                ...(await (0, write_checks_1.signingStamp)(this, packageVersion)),
+            });
             return this.save(packageVersion, opts);
         }
         /** Registers the signer for all SDK copies in this JavaScript realm. Replaces any prior signer. */

package/dist/data/packages.d.ts

@@ -15,6 +15,8 @@ declare const schema: z.ZodObject<{
     updateUrl: z.ZodOptional<z.ZodString>;
     publishPublicKey: z.ZodString;
     signature: z.ZodString;
+    signedContextId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    signedAt: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     description: string;
@@ -23,6 +25,8 @@ declare const schema: z.ZodObject<{
     createdBy: string;
     publishPublicKey: string;
     disabled?: boolean | undefined;
+    signedAt?: number | undefined;
+    signedContextId?: string | undefined;
     remoteRepo?: string | undefined;
     activePackageVersionId?: string | undefined;
     versionFollowRange?: "pinned" | "patch" | "minor" | "latest" | undefined;
@@ -36,6 +40,8 @@ declare const schema: z.ZodObject<{
     createdBy: string;
     publishPublicKey: string;
     disabled?: boolean | undefined;
+    signedAt?: number | undefined;
+    signedContextId?: string | undefined;
     remoteRepo?: string | undefined;
     activePackageVersionId?: string | undefined;
     versionFollowRange?: "pinned" | "patch" | "minor" | "latest" | undefined;
@@ -53,7 +59,6 @@ export declare class PackagesTable extends Table<IPackage> {
     signAndSave(packageObj: IPackage, opts?: ISaveOptions): Promise<IPackage>;
     /** Registers the signer for all SDK copies in this JavaScript realm. Replaces any prior signer. */
     static enablePackageSigning(fn: (packageObj: IPackage) => IPackage): void;
-    delete(packageId: string): Promise<void>;
 }
 /** Returns the Packages table for the given context or the current default context. */
 export declare function Packages(dataContext?: DataContext): PackagesTable;

package/dist/data/packages.js

@@ -39,11 +39,12 @@ exports.Packages = Packages;
 const zod_1 = require("zod");
 const context_1 = require("../context");
 const zod_types_1 = require("../types/zod-types");
+const authority_write_checks_1 = require("./authority-write-checks");
 const decorators_1 = require("./orm/decorators");
 const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
-const package_permissions_1 = require("./package-permissions");
+const write_checks_1 = require("./orm/write-checks");
 const persistent_vars_1 = require("./persistent-vars");
 const schema = zod_1.z.object({
     packageId: zod_types_1.zodPeerId,
@@ -75,6 +76,13 @@ const schema = zod_1.z.object({
         .describe("Ed25519 public key (base64url) of the package publisher. " +
         "Set at package creation; used as TOFU anchor for verifying packageAuthorSignature on versions."),
     signature: zod_1.z.string().describe("The signed hash of this data excluding the signature itself"),
+    signedContextId: zod_types_1.zodPeerId
+        .optional()
+        .describe("The context this package approval was signed for"),
+    signedAt: zod_1.z
+        .number()
+        .optional()
+        .describe("When the signer signed this row (ms since epoch), under the signature: a copy of an earlier row can't replace a later one"),
 });
 const metaData = {
     name: "Packages",
@@ -106,14 +114,8 @@ let PackagesTable = (() => {
             return this.save(packageObj, opts);
         }
         async save(packageObj, opts) {
-            if (PackagesTable.isPassthrough) {
-                return super.save(packageObj, opts);
-            }
-            if (!this.groupId) {
-                // users can do whatever they want to packages in their personal space
-                return super.save(packageObj, opts);
-            }
-            await (0, package_permissions_1.verifyPackageSignature)(packageObj, this.groupId);
+            if (!PackagesTable.isPassthrough)
+                await (0, write_checks_1.checkLocalSave)(this, packageObj, authority_write_checks_1.checkPackageWrite);
             return super.save(packageObj, opts);
         }
         async signAndSave(packageObj, opts) {
@@ -121,23 +123,16 @@ let PackagesTable = (() => {
             if (!sign) {
                 throw new Error("Package signing is not enabled. Call PackagesTable.enablePackageSigning(fn) to enable it.");
             }
-            packageObj = await sign.call(PackagesTable, packageObj);
+            packageObj = await sign.call(PackagesTable, {
+                ...packageObj,
+                ...(await (0, write_checks_1.signingStamp)(this, packageObj)),
+            });
             return this.save(packageObj, opts);
         }
         /** Registers the signer for all SDK copies in this JavaScript realm. Replaces any prior signer. */
         static enablePackageSigning(fn) {
             signingGlobals[signingKey] = fn;
         }
-        async delete(packageId) {
-            // anyone (with write permissions) can delete packages since that isn't a security risk (unless something else is relying on a package to be present?)
-            return super.delete(packageId);
-            // const userContext = await getUserContext();
-            // const userContextPackages = Packages(userContext.userDataContext);
-            // if (userContextPackages === this) {
-            //   return super.delete(packageId);
-            // }
-            // throw new Error('Only deleting packages from the user context Packages table is allowed');
-        }
         constructor() {
             super(...arguments);
             __runInitializers(this, _instanceExtraInitializers);

package/dist/data/persistent-vars.js

@@ -373,54 +373,17 @@ function persistentVarFactory(name, opts) {
                     }
                     return userContext.userDataContext;
                 }
-                /**
-                 * Before storage was unified in the personal DB, a `groupDevice` /
-                 * `groupUser` var created with an explicit group `dataContext` was
-                 * written to that group's DB. Return that legacy location so an
-                 * existing value can be migrated forward, or `undefined` when there is
-                 * no distinct legacy location for this variable.
-                 */
-                function getLegacyStorageDataContext() {
-                    if (scope !== "groupDevice" && scope !== "groupUser") {
-                        return undefined;
-                    }
-                    const pinned = opts?.dataContext;
-                    if (!pinned || pinned.dataContextId === userContext.userDataContext.dataContextId) {
-                        return undefined;
-                    }
-                    return pinned;
-                }
                 function getVarNameInDb() {
                     const dc = opts?.dataContext || userContext.defaultDataContext();
                     return (0, persistent_var_identity_1.persistentVarStorageName)(name, scope, dc?.dataContextId);
                 }
-                /**
-                 * Copy a record left in a group DB by the pre-unification storage rule
-                 * into the personal DB. Secrets are skipped because their ciphertext is
-                 * bound to the group key and cannot be moved verbatim. The legacy row is
-                 * left in place: older builds on other devices may still read it, and
-                 * the personal copy is authoritative from here on.
-                 */
-                async function migrateLegacyRec(table, name) {
-                    const legacyContext = getLegacyStorageDataContext();
-                    if (!legacyContext) {
-                        return undefined;
-                    }
-                    const legacyRec = await PersistentVars(legacyContext).findOne({ name });
-                    if (!legacyRec || legacyRec.scope !== scope || legacyRec.isSecret) {
-                        return undefined;
-                    }
-                    const { persistentVarId: _legacyId, ...rest } = legacyRec;
-                    return table.save({ ...rest, persistentVarId: "" }, { weakInsert: true });
-                }
                 async function loadRecFromDb() {
                     const dc = getStorageDataContext();
                     const table = PersistentVars(dc);
                     const name = getVarNameInDb();
                     let dbRec = await table.findOne({ name });
-                    if (!dbRec) {
-                        dbRec = await migrateLegacyRec(table, name);
-                    }
+                    // Group rows are member-writable. They cannot bootstrap personal/device settings,
+                    // including explicit permission to run a package's dev version on this device.
                     // Preserve an existing secret unless the caller explicitly changes that setting.
                     if (dbRec?.isSecret !== undefined && opts.isSecret === undefined) {
                         isSecret = dbRec.isSecret;