@peers-app/peers-sdk 0.27.5 → 0.28.0

package/dist/invites/invite-token.d.ts

@@ -35,6 +35,8 @@ export declare const inviteIdentitySchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }>, "many">>;
+    /** The owner's signature over that first anchor list (see `signUserObject`). */
+    anchorsSignature: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     publicKey: string;
     userId: string;
@@ -43,6 +45,7 @@ export declare const inviteIdentitySchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
     displayName?: string | undefined;
 }, {
     publicKey: string;
@@ -52,6 +55,7 @@ export declare const inviteIdentitySchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
     displayName?: string | undefined;
 }>;
 /** Public identity of a party to an invite. */
@@ -110,6 +114,8 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }>, "many">>;
+        /** The owner's signature over that first anchor list (see `signUserObject`). */
+        anchorsSignature: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
@@ -118,6 +124,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
@@ -127,6 +134,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }>;
     /** ISO 8601 instant after which the token is invalid. */
@@ -171,6 +179,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -196,6 +205,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -221,6 +231,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -246,6 +257,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -284,6 +296,8 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }>, "many">>;
+        /** The owner's signature over that first anchor list (see `signUserObject`). */
+        anchorsSignature: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
@@ -292,6 +306,7 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
@@ -301,6 +316,7 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }>;
     expiresAt: z.ZodString;
@@ -344,6 +360,7 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -370,6 +387,7 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;

package/dist/invites/invite-token.js

@@ -44,6 +44,8 @@ exports.inviteIdentitySchema = zod_1.z
      * keeps it; this is only the bootstrap that arrives with the invitation.
      */
     anchors: zod_1.z.array(anchor_document_1.anchorRefSchema).max(8).optional(),
+    /** The owner's signature over that first anchor list (see `signUserObject`). */
+    anchorsSignature: zod_1.z.string().max(200).optional(),
 })
     .strict();
 /** How joiners are admitted by a group token. */

package/dist/keys.d.ts

@@ -138,6 +138,13 @@ export declare function addSignatureToObject<T extends Record<string, any>>(obj:
 export declare function verifyObjectSignature<T extends IMaybeSignature>(objectWithSignature: T): void;
 /** True if {@link verifyObjectSignature} would succeed. */
 export declare function isObjectSignatureValid<T extends IMaybeSignature>(objectWithSignature: T): boolean;
+/**
+ * The key that validly signed `row` ({@link addSignatureToObject}'s `publicKey:signature`), or
+ * `undefined` when the row is unsigned or its signature doesn't verify. Memoized.
+ *
+ * @param row - A row with an optional `signature`.
+ */
+export declare function signedByKey(row: IMaybeSignature): string | undefined;
 /**
  * Parses the Ed25519 public key prefix from a `publicKey:signature` field, or `undefined` if malformed.
  */

package/dist/keys.js

@@ -27,6 +27,7 @@ exports.decryptData = decryptData;
 exports.addSignatureToObject = addSignatureToObject;
 exports.verifyObjectSignature = verifyObjectSignature;
 exports.isObjectSignatureValid = isObjectSignatureValid;
+exports.signedByKey = signedByKey;
 exports.getPublicKeyFromObjectSignature = getPublicKeyFromObjectSignature;
 const sha2_1 = require("@noble/hashes/sha2");
 const buffer_1 = require("buffer");
@@ -391,6 +392,32 @@ function isObjectSignatureValid(objectWithSignature) {
     }
     return true;
 }
+/**
+ * Signature checks already made, by the hash of the signed row (signature included). A group's
+ * authority is rebuilt after any change to its rows and re-checks every one, and an Ed25519
+ * check costs milliseconds, so without this a rebuild would take seconds in a large group.
+ */
+const signatureChecks = new Map();
+const SIGNATURE_CHECKS_MAX = 10_000;
+/**
+ * The key that validly signed `row` ({@link addSignatureToObject}'s `publicKey:signature`), or
+ * `undefined` when the row is unsigned or its signature doesn't verify. Memoized.
+ *
+ * @param row - A row with an optional `signature`.
+ */
+function signedByKey(row) {
+    if (!row.signature)
+        return undefined;
+    const key = hashValue(canonicalJSONString(row));
+    let valid = signatureChecks.get(key);
+    if (valid === undefined) {
+        valid = isObjectSignatureValid(row);
+        if (signatureChecks.size >= SIGNATURE_CHECKS_MAX)
+            signatureChecks.clear();
+        signatureChecks.set(key, valid);
+    }
+    return valid ? getPublicKeyFromObjectSignature(row) : undefined;
+}
 /**
  * Parses the Ed25519 public key prefix from a `publicKey:signature` field, or `undefined` if malformed.
  */

package/dist/package-installer/package-installer.d.ts

@@ -10,7 +10,7 @@ import type { IInstallOpts, IInstallResult, IPackageInfo, IPackageInstallerDeps
  * triggers the package loader and device version resolution.
  *
  * When the bundle hash matches the existing PackageVersion, no files or PV are
- * rewritten. The Packages row still gets a missing `activePackageVersionId`
+ * rewritten. An Admin's Packages row still gets a missing `activePackageVersionId`
  * (and description), and when the id was missing the version is activated on
  * this device unless `skipResolve`.
  */

package/dist/package-installer/package-installer.js

@@ -8,6 +8,8 @@ exports.getPackageInfo = getPackageInfo;
 exports.getPackageLocalPath = getPackageLocalPath;
 const file_types_1 = require("../data/files/file.types");
 const files_1 = require("../data/files/files");
+const group_member_roles_1 = require("../data/group-member-roles");
+const group_permissions_1 = require("../data/group-permissions");
 const package_version_resolver_1 = require("../data/package-version-resolver");
 const package_versions_1 = require("../data/package-versions");
 const packages_1 = require("../data/packages");
@@ -23,7 +25,7 @@ const package_author_signer_1 = require("./package-author-signer");
  * triggers the package loader and device version resolution.
  *
  * When the bundle hash matches the existing PackageVersion, no files or PV are
- * rewritten. The Packages row still gets a missing `activePackageVersionId`
+ * rewritten. An Admin's Packages row still gets a missing `activePackageVersionId`
  * (and description), and when the id was missing the version is activated on
  * this device unless `skipResolve`.
  */
@@ -127,7 +129,8 @@ async function installPackageFromBundles(dataContext, deps, packageId, opts) {
  * this device.
  *
  * Updates the description when it differs, and sets `activePackageVersionId`
- * when it is empty (first install, or reimport after the row was deleted).
+ * when it is empty and the current user may select for the group (first install, or
+ * reimport after the row was deleted). Writers activate dev builds on their own device.
  * Unless `skipResolve`, writes device prefs and force-resolves the version.
  * With `resolveOnlyWhenActivated`, the device step runs only when this call
  * filled an empty `activePackageVersionId`.
@@ -143,7 +146,9 @@ async function activateInstalledPackageVersion(dataContext, packageId, packageVe
         needsSave = true;
     }
     const activated = !pkg.activePackageVersionId;
-    if (activated) {
+    const canSelectForGroup = !dataContext.groupId ||
+        (await (0, group_permissions_1.getUserRole)(dataContext.groupId, dataContext.userContext.userId, dataContext.userContext)) >= group_member_roles_1.GroupMemberRole.Admin;
+    if (activated && canSelectForGroup) {
         pkg.activePackageVersionId = packageVersion.packageVersionId;
         needsSave = true;
     }

package/dist/package-installer/package-propagation.d.ts

@@ -22,8 +22,10 @@ export declare function propagatePvOnChanged(userContext?: UserContext): Promise
  * any that are missing from admin groups. Useful for manual repair.
  */
 export declare function discoverAndPropagateVersions(userContext: UserContext): Promise<IPropagationResult[]>;
+/** Whether automatic follow policy selected a group release. */
 export interface IActivationResult {
     activated: boolean;
     activePackageVersionId?: string;
 }
+/** Select the best publisher-signed release under an Admin-approved package's follow policy. */
 export declare function activateBestEligibleVersion(dataContext: DataContext, pkg: IPackage): Promise<IActivationResult>;

package/dist/package-installer/package-propagation.js

@@ -4,6 +4,7 @@ exports.propagatePvOnChanged = propagatePvOnChanged;
 exports.discoverAndPropagateVersions = discoverAndPropagateVersions;
 exports.activateBestEligibleVersion = activateBestEligibleVersion;
 const context_1 = require("../context");
+const authority_write_checks_1 = require("../data/authority-write-checks");
 const files_1 = require("../data/files/files");
 const group_member_roles_1 = require("../data/group-member-roles");
 const group_permissions_1 = require("../data/group-permissions");
@@ -113,12 +114,12 @@ async function propagatePvToAdminGroups(userContext, sourceContext, pv) {
  */
 async function installPvInGroupNoActivate(source, dest, pv) {
     const pkg = await (0, packages_1.Packages)(dest).get(pv.packageId);
-    if (!pkg || pkg.disabled)
+    if (!pkg || pkg.disabled || !(await (0, authority_write_checks_1.isPackageRowAdminSigned)(pkg, dest)))
         return false;
     const existingPv = await (0, package_versions_1.PackageVersions)(dest).get(pv.packageVersionId);
     if (existingPv)
         return false;
-    if (!(await verifyOrEstablishTofu(source, dest, pkg, pv)))
+    if (!(await verifyPinnedPublisher(dest, pkg, pv)))
         return false;
     const files = await copyBundleFiles(source, pv);
     if (!files)
@@ -143,7 +144,8 @@ async function installPvInGroup(source, dest, pv, retryCnt = 0) {
         await (0, utils_1.sleep)(delayMs);
     }
     const pkg = await (0, packages_1.Packages)(dest).get(pv.packageId);
-    if (!pkg || pkg.disabled)
+    // Copying signs the release with this device's key: only into a package an Admin added.
+    if (!pkg || pkg.disabled || !(await (0, authority_write_checks_1.isPackageRowAdminSigned)(pkg, dest)))
         return undefined;
     const existingPv = await (0, package_versions_1.PackageVersions)(dest).get(pv.packageVersionId);
     if (existingPv) {
@@ -153,10 +155,8 @@ async function installPvInGroup(source, dest, pv, retryCnt = 0) {
             ? makeResult(dest, pv, activation.activePackageVersionId === pv.packageVersionId)
             : undefined;
     }
-    // TOFU verification
-    if (!(await verifyOrEstablishTofu(source, dest, pkg, pv))) {
-        return await retryOrFail(source, dest, pv, retryCnt, "TOFU");
-    }
+    if (!(await verifyPinnedPublisher(dest, pkg, pv)))
+        return undefined;
     // Copy bundle files
     const files = await copyBundleFiles(source, pv);
     if (!files) {
@@ -184,45 +184,19 @@ async function retryOrFail(source, dest, pv, retryCnt, reason) {
     console.error(`[propagation] ${reason} for ${pv.packageVersionId}, giving up`);
     return undefined;
 }
-// --- TOFU ---
 /**
- * Returns true if signature verification passes. Establishes TOFU key
- * from source if target has no publishPublicKey yet. Returns false on
- * transient failures (missing source key).
+ * Another context can supply bytes, never a new trust root. The destination must already
+ * pin the publisher (or use the host's peers-core anchor) before this device endorses a release.
  */
-async function verifyOrEstablishTofu(sourceContext, targetContext, targetPkg, pv) {
+async function verifyPinnedPublisher(targetContext, targetPkg, pv) {
     // peers-core pinned to a revoked key: move the pin to the host's current key first so a
     // version signed by the replacement key can be accepted.
     const repinned = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(targetContext, targetPkg);
     if (repinned !== targetPkg) {
         targetPkg.publishPublicKey = repinned.publishPublicKey;
     }
-    if (targetPkg.publishPublicKey) {
-        if (!(0, package_author_signing_1.verifyPackageAuthorSignature)(pv, targetPkg.publishPublicKey).valid) {
-            console.error(`[propagation] Invalid signature for ${pv.packageVersionId}`);
-            return false;
-        }
-        return true;
-    }
-    // TOFU: get key from source
-    const sourcePkg = await (0, packages_1.Packages)(sourceContext).get(targetPkg.packageId);
-    if (!sourcePkg?.publishPublicKey)
-        return false;
-    // Never adopt a revoked key as a trust anchor, however it reached the source group.
-    if ((0, package_author_signing_1.isRevokedPublisherKey)(sourcePkg.publishPublicKey)) {
-        console.error(`[propagation] Refusing revoked publisher key for ${targetPkg.packageId} from ${sourceContext.dataContextId}`);
-        return false;
-    }
-    if (!(0, package_author_signing_1.verifyPackageAuthorSignature)(pv, sourcePkg.publishPublicKey).valid) {
-        console.error(`[propagation] Invalid signature for ${pv.packageVersionId} (TOFU)`);
-        return false;
-    }
-    await (0, packages_1.Packages)(targetContext).signAndSave({
-        ...targetPkg,
-        publishPublicKey: sourcePkg.publishPublicKey,
-    });
-    targetPkg.publishPublicKey = sourcePkg.publishPublicKey;
-    return true;
+    return (!!targetPkg.publishPublicKey &&
+        (0, package_author_signing_1.verifyPackageAuthorSignature)(pv, targetPkg.publishPublicKey).valid);
 }
 /**
  * Loads and verifies all bundle file records from source. Returns null if
@@ -272,7 +246,15 @@ async function saveFileAndIndexTree(sourceFiles, destFiles, file, copiedIds) {
     }
     await destFiles.saveFileRecord(file);
 }
+/** Select the best publisher-signed release under an Admin-approved package's follow policy. */
 async function activateBestEligibleVersion(dataContext, pkg) {
+    // Callers may have copied files or waited for an activation lock since reading the row.
+    // Always decide from current, approved settings before signing a group selection.
+    const current = await (0, packages_1.Packages)(dataContext).get(pkg.packageId);
+    if (!current || current.disabled || !(await (0, authority_write_checks_1.isPackageRowAdminSigned)(current, dataContext))) {
+        return { activated: false };
+    }
+    pkg = current;
     const range = pkg.versionFollowRange ?? "pinned";
     if (range === "pinned")
         return { activated: false };

package/dist/package-installer/package-remote-checker.js

@@ -10,6 +10,7 @@ exports.checkPackageRemoteForNewVersion = checkPackageRemoteForNewVersion;
 exports.checkAndInstallPackageRemoteVersion = checkAndInstallPackageRemoteVersion;
 exports.installRemotePackageVersion = installRemotePackageVersion;
 exports.clearRemoteCheckCache = clearRemoteCheckCache;
+const authority_write_checks_1 = require("../data/authority-write-checks");
 const file_types_1 = require("../data/files/file.types");
 const package_version_resolver_1 = require("../data/package-version-resolver");
 const package_versions_1 = require("../data/package-versions");
@@ -45,12 +46,18 @@ function checkPackageRemoteForNewVersion(packageId, updateUrl, tag, http) {
  * group does not already have the remote PackageVersion.
  */
 async function checkAndInstallPackageRemoteVersion(dataContext, pkg, tag, http) {
-    const updateUrl = pkg.updateUrl;
-    if (!updateUrl || pkg.disabled)
+    let current = await (0, packages_1.Packages)(dataContext).get(pkg.packageId);
+    if (!current || current.disabled)
         return null;
     // A peers-core row pinned to a revoked publisher key would reject every new release; move
     // it to the host's current anchor before looking at the remote.
-    await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(dataContext, pkg);
+    current = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(dataContext, current);
+    // The release would be signed with this device's key: only for a package an Admin added.
+    if (!(await (0, authority_write_checks_1.isPackageRowAdminSigned)(current, dataContext)))
+        return null;
+    const updateUrl = current.updateUrl;
+    if (!updateUrl)
+        return null;
     const result = await checkPackageRemoteForNewVersion(pkg.packageId, updateUrl, tag, http);
     if (!result)
         return null;
@@ -139,6 +146,11 @@ async function installRemotePackageVersion(dataContext, result) {
     if (!pkg) {
         throw new Error(`Cannot install remote package version: package ${packageId} is not installed`);
     }
+    // The fetch may have outlived a delete/reinsert of the package. Never sign a release or
+    // establish a publisher pin on behalf of a newly added, unapproved row.
+    if (!(await (0, authority_write_checks_1.isPackageRowAdminSigned)(pkg, dataContext))) {
+        throw new Error("Cannot install remote package version: package settings need an Admin signature");
+    }
     if (!unpacked.payload.publicKey) {
         throw new Error("Cannot install remote package version: payload publicKey is missing");
     }

package/dist/package-loader/isolated-artifact.js

@@ -783,8 +783,6 @@ function validateIsolatedPackageArtifact(artifact, options = {}) {
         "tables",
         "network",
         "appNavs",
-        // Voice Skill v1's retired action aliases: an older manifest may carry them; ignored.
-        "actionAliases",
         "executionMode",
         "guestApi",
     ], "manifest");

package/dist/package-loader/package-loader.js

@@ -751,9 +751,15 @@ class PackageLoader {
                 /* no version record */
             }
         }
+        if (packageVersion) {
+            await (0, package_version_resolver_1.assertPackageVersionRunnable)(pkg, packageVersion, this.dataContext, !!opts?.localPath);
+        }
         if (bundleFileId) {
             const bundleBuffer = await (0, files_1.Files)(this.dataContext).getFileContents(bundleFileId);
             if (bundleBuffer) {
+                if (this.dataContext.groupId && packageVersion) {
+                    (0, package_version_resolver_1.assertPackageBundleIntegrity)(packageVersion, "package", bundleBuffer);
+                }
                 bundleCode = Buffer.from(bundleBuffer).toString("utf8");
             }
             else if (warn) {

package/dist/types/peer-device.d.ts

@@ -7,6 +7,8 @@ export interface IPeerDevice {
     deviceId: string;
     /** User identity that owns this device. */
     userId: string;
+    /** Signing key the device authenticated with, for a remote device: roles are checked against it. */
+    publicKey?: string;
     /** Role used when this device participates in a shared group. */
     role: GroupMemberRole;
     /** Lists change records available from this device. */

package/dist/types/workflow.d.ts

@@ -45,6 +45,7 @@ export declare const workflowSchema: z.ZodObject<{
     name: string;
     description: string;
     updatedAt: Date;
+    createdBy: string;
     createdAt: Date;
     workflowId: string;
     defaultAssistantId: string;
@@ -54,14 +55,13 @@ export declare const workflowSchema: z.ZodObject<{
         directCallToolId?: string | undefined;
         subWorkflowId?: string | undefined;
     }[];
-    createdBy: string;
     packageId?: string | undefined;
 }, {
     name: string;
     description: string;
+    createdBy: string;
     workflowId: string;
     defaultAssistantId: string;
-    createdBy: string;
     updatedAt?: Date | undefined;
     packageId?: string | undefined;
     createdAt?: Date | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.27.5",
+  "version": "0.28.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"

package/dist/data/package-permissions.d.ts

@@ -1,14 +0,0 @@
-import type { IPackage } from "./packages";
-/**
- * Verifies that a package update signature is valid.
- *
- * Writers can create or update packages that have a dev active version.
- * Admins are required for packages with beta or stable active versions.
- *
- * @param packageObj The package record to verify
- * @param opts.isDevVersion When true, allows Writer role (for dev version operations)
- * @throws Error if signature is invalid or unauthorized
- */
-export declare function verifyPackageSignature(packageObj: IPackage, groupId: string, opts?: {
-    isDevVersion?: boolean;
-}): Promise<void>;

package/dist/data/package-permissions.js

@@ -1,26 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyPackageSignature = verifyPackageSignature;
-const keys_1 = require("../keys");
-const group_permissions_1 = require("./group-permissions");
-/**
- * Verifies that a package update signature is valid.
- *
- * Writers can create or update packages that have a dev active version.
- * Admins are required for packages with beta or stable active versions.
- *
- * @param packageObj The package record to verify
- * @param opts.isDevVersion When true, allows Writer role (for dev version operations)
- * @throws Error if signature is invalid or unauthorized
- */
-async function verifyPackageSignature(packageObj, groupId, opts) {
-    (0, keys_1.verifyObjectSignature)(packageObj);
-    const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(packageObj) ?? "";
-    const signerRole = await (0, group_permissions_1.getUserRoleFromPublicKey)(groupId, signerPublicKey);
-    const requiredRole = opts?.isDevVersion ? group_permissions_1.GroupMemberRole.Writer : group_permissions_1.GroupMemberRole.Admin;
-    if (signerRole < requiredRole) {
-        throw new Error(opts?.isDevVersion
-            ? "Only group writers or above can create or update dev packages"
-            : "Only group admins can create or update packages");
-    }
-}

package/dist/data/package-version-permissions.d.ts

@@ -1,14 +0,0 @@
-import { GroupMemberRole } from "./group-permissions";
-import type { IPackageVersion } from "./package-versions";
-/**
- * Verifies that a package version update signature is valid.
- *
- * Dev versions (`versionTag === "dev"`) require Writer role.
- * Beta and stable versions require Admin role.
- *
- * @param packageVersion The package version record to verify
- * @param groupId The group context to check roles against
- * @param signerRole Optional pre-resolved role (skips `getUserRoleFromPublicKey` lookup; useful in tests)
- * @throws Error if signature is invalid or unauthorized
- */
-export declare function verifyPackageVersionSignature(packageVersion: IPackageVersion, groupId: string, signerRole?: GroupMemberRole): Promise<void>;

package/dist/data/package-version-permissions.js

@@ -1,30 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyPackageVersionSignature = verifyPackageVersionSignature;
-const keys_1 = require("../keys");
-const group_permissions_1 = require("./group-permissions");
-/**
- * Verifies that a package version update signature is valid.
- *
- * Dev versions (`versionTag === "dev"`) require Writer role.
- * Beta and stable versions require Admin role.
- *
- * @param packageVersion The package version record to verify
- * @param groupId The group context to check roles against
- * @param signerRole Optional pre-resolved role (skips `getUserRoleFromPublicKey` lookup; useful in tests)
- * @throws Error if signature is invalid or unauthorized
- */
-async function verifyPackageVersionSignature(packageVersion, groupId, signerRole) {
-    (0, keys_1.verifyObjectSignature)(packageVersion);
-    if (signerRole === undefined) {
-        const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(packageVersion) ?? "";
-        signerRole = await (0, group_permissions_1.getUserRoleFromPublicKey)(groupId, signerPublicKey);
-    }
-    const isDevVersion = packageVersion.versionTag === "dev";
-    const requiredRole = isDevVersion ? group_permissions_1.GroupMemberRole.Writer : group_permissions_1.GroupMemberRole.Admin;
-    if (signerRole < requiredRole) {
-        throw new Error(isDevVersion
-            ? "Only group writers or above can create dev package versions"
-            : "Only group admins can create or update beta/stable package versions");
-    }
-}