@peers-app/peers-sdk 0.27.5 → 0.28.1

package/dist/context/user-context.d.ts

@@ -1,7 +1,7 @@
 import { DataContext } from "../context/data-context";
 import { type IUser } from "../data";
 import type { DataSourceFactory, IDataChangedEvent, Table } from "../data/orm";
-import { type IPublicPrivateKeys } from "../keys";
+import type { IPublicPrivateKeys } from "../keys";
 import { type Observable } from "../observable";
 /** Coordinates personal and group data contexts for one signed-in user. */
 export declare class UserContext {
@@ -69,6 +69,12 @@ export declare class UserContext {
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
+        keySuccession?: {
+            publicKey: string;
+            signature: string;
+            issuedAt: string;
+        }[] | undefined;
     } | undefined>;
     /**
      * Sign and persist this user's identity, then copy it into every loaded

package/dist/context/user-context.js

@@ -6,7 +6,6 @@ const data_context_1 = require("../context/data-context");
 const data_1 = require("../data");
 const user_permissions_1 = require("../data/user-permissions");
 const events_1 = require("../events");
-const keys_1 = require("../keys");
 const observable_1 = require("../observable");
 const utils_1 = require("../utils");
 /** Coordinates personal and group data contexts for one signed-in user. */
@@ -278,16 +277,12 @@ class UserContext {
                 console.error("Group data context is missing group id. Something went wrong");
                 continue;
             }
-            const groupObject = await (0, data_1.Groups)(dataContext).get(dataContext.groupId);
+            // Copy the exact row the authority read verified, rather than a row read before an
+            // asynchronous rebuild that may have verified a different, subsequently synced row.
+            const { getGroupAuthority } = await Promise.resolve().then(() => require("../data/group-authority"));
+            const { group: groupObject } = await getGroupAuthority(this, dataContext.groupId);
             const myGroupObject = await (0, data_1.Groups)(this.userDataContext).get(dataContext.groupId);
             if (groupObject && !(0, lodash_1.isEqual)(groupObject, myGroupObject)) {
-                try {
-                    (0, keys_1.verifyObjectSignature)(groupObject);
-                }
-                catch (err) {
-                    console.error(`Error verifying group object from group ${dataContext.groupId}:`, err);
-                    continue;
-                }
                 await (0, data_1.Groups)(this.userDataContext).save(groupObject);
             }
         }

package/dist/contracts/contract-proxy.d.ts

@@ -428,6 +428,11 @@ export interface IContractCallContext {
     workflow?: IWorkflowRunContext;
     /** User id of the caller (e.g. the remote device's user), if known. */
     callerUserId?: string;
+    /**
+     * Signing key a remote caller authenticated with. Role lookups for `callerUserId` pass it, so a
+     * role counts only for the key it was granted to. Absent for same-device callers.
+     */
+    callerPublicKey?: string;
     /** User id of the local device executing the call. */
     localUserId?: string;
     /**

package/dist/contracts/contract-proxy.js

@@ -534,8 +534,8 @@ async function assertContractToolAccess(tool, call, context) {
     }
     const userLevel = userId
         ? context.dataContext
-            ? await (0, group_permissions_1.getUserAccessLevel)(context.dataContext, userId)
-            : (0, access_level_1.accessLevelFromGroupRole)(await (0, group_permissions_1.getUserRole)(call.dataContextId || context.localUserId || userId, userId))
+            ? await (0, group_permissions_1.getUserAccessLevel)(context.dataContext, userId, context.callerPublicKey)
+            : (0, access_level_1.accessLevelFromGroupRole)(await (0, group_permissions_1.getUserRole)(call.dataContextId || context.localUserId || userId, userId, undefined, context.callerPublicKey))
         : access_level_1.AccessLevel.None;
     return (0, action_dispatch_1.authorizeToolDispatch)({ ...context.authority, userId, userAccessLevel: userLevel }, required, mode, strict);
 }

package/dist/contracts/contract-resolvers.d.ts

@@ -71,8 +71,8 @@ export declare function registerContractResolver(contractId: string, version: nu
  */
 export declare function getContractResolver(contractId: string, version: number, providerPackageId?: string, dataContext?: DataContext): ContractResolver | undefined;
 /**
- * Verify that a connection- or message-authenticated remote identity matches a valid
- * self-signed Users record in the provider's personal or shared-group data.
+ * Verify that a connection- or message-authenticated remote identity matches the user's
+ * identity on record, preferring the personal context over shared-group data.
  *
  * Unsigned discovery stubs, malformed signatures, and key mismatches fail closed. This is
  * the identity half of remote authorization; trust and role decisions build on it.

package/dist/contracts/contract-resolvers.js

@@ -160,8 +160,8 @@ function getContractResolver(contractId, version, providerPackageId, dataContext
     return onlyScopedResolver;
 }
 /**
- * Verify that a connection- or message-authenticated remote identity matches a valid
- * self-signed Users record in the provider's personal or shared-group data.
+ * Verify that a connection- or message-authenticated remote identity matches the user's
+ * identity on record, preferring the personal context over shared-group data.
  *
  * Unsigned discovery stubs, malformed signatures, and key mismatches fail closed. This is
  * the identity half of remote authorization; trust and role decisions build on it.
@@ -173,19 +173,15 @@ async function verifyRemoteContractIdentity(userContext, remoteIdentity) {
     const identityContexts = [userContext.userDataContext, ...userContext.groupDataContexts.values()];
     for (const dataContext of identityContexts) {
         const user = await (0, users_1.Users)(dataContext).get(remoteIdentity.userId);
-        if (!user?.signature ||
-            user.userId !== remoteIdentity.userId ||
-            user.publicKey !== remoteIdentity.publicKey ||
-            user.publicBoxKey !== remoteIdentity.publicBoxKey) {
+        if (!user)
             continue;
-        }
-        try {
-            (0, user_permissions_1.verifyUserSignature)(user);
-            return true;
-        }
-        catch {
-            // A different context may contain the valid signed record.
-        }
+        // A member can supply a self-signed namesake in a group. It must never override an
+        // identity already pinned in personal contacts (especially the device owner's identity).
+        if (!(0, user_permissions_1.sameUserIdentity)(user, remoteIdentity))
+            return false;
+        if (!user.signature)
+            continue;
+        return (0, user_permissions_1.isSelfSignedUser)(user);
     }
     return false;
 }
@@ -269,6 +265,7 @@ async function authorizeRemoteContractCall(call, userContext, remoteIdentity) {
             dataContextId,
             context: {
                 callerUserId: remoteIdentity.userId,
+                callerPublicKey: remoteIdentity.publicKey,
                 localUserId: userContext.userId,
                 callerDeviceId: remoteIdentity.deviceId,
                 // Never create a context the caller names: only this device's own groups.
@@ -286,7 +283,7 @@ async function authorizeRemoteContractCall(call, userContext, remoteIdentity) {
     }
     const dataContext = userContext.getDataContext(dataContextId);
     await dataContext.packageLoader?.catalogReady;
-    const callerLevel = await (0, group_permissions_1.getUserAccessLevel)(dataContext, remoteIdentity.userId);
+    const callerLevel = await (0, group_permissions_1.getUserAccessLevel)(dataContext, remoteIdentity.userId, remoteIdentity.publicKey);
     // Policy belongs to the executing provider, not the latest registration of this shape.
     // Select after the async role lookup and retain the selection through endpoint resolution.
     const registry = dataContext.packageLoader?.contractRegistry;
@@ -323,6 +320,7 @@ async function authorizeRemoteContractCall(call, userContext, remoteIdentity) {
         providerPackageId: selected?.providerPackageId,
         context: {
             callerUserId: remoteIdentity.userId,
+            callerPublicKey: remoteIdentity.publicKey,
             localUserId: userContext.userId,
             callerDeviceId: remoteIdentity.deviceId,
             dataContext,
@@ -490,6 +488,7 @@ function createUserContextContractProviderRouter(transport, opts) {
     const { userContext, remoteIdentity } = opts;
     const context = {
         callerUserId: remoteIdentity.userId,
+        callerPublicKey: remoteIdentity.publicKey,
         localUserId: userContext.userId,
         callerDeviceId: remoteIdentity.deviceId,
         dataContext: userContext.userDataContext,

package/dist/contracts/system/network-contracts.d.ts

@@ -199,7 +199,7 @@ export interface INetworkSyncRecoveryEntry {
     attemptCount: number;
     latestError: string;
     status: "retrying" | "parked";
-    parkedReason?: "schema" | "unique-conflict" | "unresolvable";
+    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | "authorization";
     stuck: boolean;
     /** True when this device has a row that "Keep this device's version" can snapshot. */
     localRowExists: boolean;

package/dist/contracts/tool-catalog-service.js

@@ -172,7 +172,7 @@ async function projectToolCatalogAccess(dataContext, entry, callerContext) {
             ? runtime.getEffectiveToolLevel?.(entry.target, provider)
             : (0, tool_access_1.recordAccessLevel)((await liveResolver(dataContext, entry.target, provider)?.({ dataContext }))?.tools?.[entry.target.toolName]?.tool);
         if (accessLevel !== undefined) {
-            const callerAccessLevel = await (0, group_permissions_1.getUserAccessLevel)(dataContext, userId);
+            const callerAccessLevel = await (0, group_permissions_1.getUserAccessLevel)(dataContext, userId, callerContext.callerPublicKey);
             entry.access = {
                 accessLevel,
                 callerAccessLevel,

package/dist/data/assistants.d.ts

@@ -22,8 +22,8 @@ export declare const assistantSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     name: string;
     accessLevel: number;
-    assistantId: string;
     createdAt: Date;
+    assistantId: string;
     assistantRunnerToolId: string;
     assistantRunnerConfig: {} & {
         [k: string]: any;
@@ -56,8 +56,8 @@ export type IAssistant = z.infer<typeof assistantSchema>;
 export declare function Assistants(dataContext?: DataContext): import("..").Table<{
     name: string;
     accessLevel: number;
-    assistantId: string;
     createdAt: Date;
+    assistantId: string;
     assistantRunnerToolId: string;
     assistantRunnerConfig: {} & {
         [k: string]: any;
@@ -87,8 +87,8 @@ export declare const groupPrimaryAssistantVar: import("./persistent-vars").Persi
 export declare const getPrimaryAssistant: (dataContext?: DataContext) => Promise<{
     name: string;
     accessLevel: number;
-    assistantId: string;
     createdAt: Date;
+    assistantId: string;
     assistantRunnerToolId: string;
     assistantRunnerConfig: {} & {
         [k: string]: any;

package/dist/data/authority-write-checks.d.ts

@@ -0,0 +1,42 @@
+import type { IGroupMember } from "./group-members";
+import type { IGroup } from "./groups";
+import { type ITableWriteCheckContext } from "./orm/write-checks";
+import type { IPackageVersion } from "./package-versions";
+import type { IPackage } from "./packages";
+/**
+ * A membership must be signed by a member who counts as at least Admin, at least the role
+ * granted, and at least the member's current role. Only the founder writes the founder's row.
+ * A membership is removed by a signed soft delete; a hard delete is allowed only for a
+ * duplicate row (the user has another membership row), as unique-conflict cleanup writes.
+ */
+export declare function checkGroupMember(existing: IGroupMember | undefined, candidate: IGroupMember | undefined, context: ITableWriteCheckContext): Promise<void>;
+/**
+ * The group row must be signed by the founder or an Admin who counts, and only the founder can
+ * name a different founder. Sync never deletes it.
+ */
+export declare function checkGroup(existing: IGroup | undefined, candidate: IGroup | undefined, context: ITableWriteCheckContext): Promise<void>;
+/**
+ * A Writer may add a package; changing an existing one beyond its name and description (the
+ * active version, follow policy, update URL, publisher key, repository, disabled) needs an
+ * Admin. Deletes stay open to any member, as the table allows locally.
+ */
+export declare function checkPackageWrite(existing: IPackage | undefined, candidate: IPackage | undefined, context: ITableWriteCheckContext): Promise<void>;
+/**
+ * Whether an Admin's device may act on a package row by itself: install releases from its
+ * `updateUrl`, copy releases signed by its publisher key in from other contexts, and select one
+ * by its follow policy. Each of those signs the result with the Admin's key, so the row must be
+ * one an Admin signed: a Writer may add a package row, or delete one and add it again, with any
+ * publisher key and update URL. A peers-core row instead qualifies only while it names the
+ * peers-core publisher key (or a revoked one, which is re-pinned to it before any release is
+ * checked), whoever signed it. Always true outside a group.
+ *
+ * @param pkg - The package row in `dataContext`.
+ * @param dataContext - The context the row belongs to.
+ */
+export declare function isPackageRowAdminSigned(pkg: IPackage, dataContext: ITableWriteCheckContext["dataContext"]): Promise<boolean>;
+/**
+ * A dev version needs a Writer's signature; any other tag needs an Admin's, so no member can
+ * choose the code other members' devices run. peers-core versions signed by its publisher are
+ * accepted from anyone, since every device installs the bundled release.
+ */
+export declare function checkPackageVersion(existing: IPackageVersion | undefined, candidate: IPackageVersion | undefined, context: ITableWriteCheckContext): Promise<void>;

package/dist/data/authority-write-checks.js

@@ -0,0 +1,324 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkGroupMember = checkGroupMember;
+exports.checkGroup = checkGroup;
+exports.checkPackageWrite = checkPackageWrite;
+exports.isPackageRowAdminSigned = isPackageRowAdminSigned;
+exports.checkPackageVersion = checkPackageVersion;
+const lodash_1 = require("lodash");
+const package_author_signing_1 = require("../package-installer/package-author-signing");
+const system_ids_1 = require("../system-ids");
+const devices_1 = require("./devices");
+const group_authority_1 = require("./group-authority");
+const group_member_roles_1 = require("./group-member-roles");
+const write_checks_1 = require("./orm/write-checks");
+const package_table_identity_1 = require("./package-table-identity");
+const persistent_vars_1 = require("./persistent-vars");
+const user_permissions_1 = require("./user-permissions");
+/**
+ * Write checks for the rows that decide authority in a group: memberships, the group row, user
+ * profiles (roles are traced through their keys), device ownership claims, packages and package
+ * versions. Sync writes rows without running the table classes' checks, so the host runs these
+ * on every synced change to a group context, and the table classes run the same checks on local
+ * saves. A refused change stays in history but its row isn't written. The personal context is
+ * left alone: only the user's own devices write it.
+ *
+ * Table names are literals here: the table modules import these checks, so importing their
+ * constants would make a cycle.
+ */
+/**
+ * The counted member who signed `row` and their role under the group's verified authority;
+ * refuses the write when nobody who counts signed it. Call only for a group context.
+ */
+async function requireSigner(tableName, row, context) {
+    const authority = await (0, group_authority_1.getGroupAuthority)(context.dataContext.userContext, context.dataContext.dataContextId);
+    const signer = (0, group_authority_1.groupSigner)(authority, row);
+    if (!signer) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "signature doesn't verify against a counted member's key");
+    }
+    return { authority, ...signer };
+}
+/**
+ * Check the signed stamp: package approvals belong to this context, and a replacement must
+ * not have been signed before the row on record. The
+ * tables' `signAndSave` puts `signedAt` under the signature, so a member can't restore a revoked
+ * grant, an earlier group setting or an earlier release selection by serving a copy of an older,
+ * validly signed row as a new change. Remember the stored stamp in device-local personal
+ * storage before it can be deleted: an unsigned package delete must not erase revocations.
+ * A row signed before the field existed counts as oldest.
+ */
+async function checkSignedOrder(tableName, existing, candidate, context) {
+    if (candidate &&
+        write_checks_1.packageApprovalTables.has(tableName) &&
+        candidate.signedContextId !== context.dataContext.groupId) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "signature is for another context or has no context");
+    }
+    if (candidate?.signedAt !== undefined && !Number.isSafeInteger(candidate.signedAt)) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "invalid signed timestamp");
+    }
+    const deletedFloor = write_checks_1.packageApprovalTables.has(tableName)
+        ? await (0, write_checks_1.deletedSignedAt)(tableName, context, candidate ? undefined : existing)
+        : 0;
+    const floor = Math.max(deletedFloor, existing?.signedAt ?? 0);
+    if (candidate &&
+        ((candidate.signedAt ?? 0) < floor ||
+            (deletedFloor > 0 && (candidate.signedAt ?? 0) <= deletedFloor))) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "signed before the row on record");
+    }
+    if (candidate?.signedAt !== undefined &&
+        candidate.signedAt === existing?.signedAt &&
+        candidate.signature !== existing.signature) {
+        throw (0, write_checks_1.writeNotAuthorized)(tableName, "conflicting signatures at the same signed timestamp");
+    }
+}
+/**
+ * A membership must be signed by a member who counts as at least Admin, at least the role
+ * granted, and at least the member's current role. Only the founder writes the founder's row.
+ * A membership is removed by a signed soft delete; a hard delete is allowed only for a
+ * duplicate row (the user has another membership row), as unique-conflict cleanup writes.
+ */
+async function checkGroupMember(existing, candidate, context) {
+    const groupId = context.dataContext.groupId;
+    if (!groupId)
+        return;
+    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+    if (!candidate) {
+        if (!existing)
+            return;
+        const rows = [
+            ...(await GroupMembers(context.dataContext).list({ userId: existing.userId })),
+            ...(context.retainedRows ?? []),
+        ].filter((row) => !context.deletedRecordIds?.includes(row.groupMemberId));
+        if (rows.some((row) => row.groupId === existing.groupId &&
+            row.userId === existing.userId &&
+            row.groupMemberId !== existing.groupMemberId))
+            return;
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", "memberships are removed by a signed delete");
+    }
+    if (candidate.groupId !== groupId || candidate.groupMemberId !== context.recordId) {
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", "the row names another group");
+    }
+    if (existing &&
+        (existing.userId !== candidate.userId || existing.groupId !== candidate.groupId)) {
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", "membership identity cannot change");
+    }
+    await checkSignedOrder("GroupMembers", existing, candidate, context);
+    const sameMember = await GroupMembers(context.dataContext).findOne({
+        groupId,
+        userId: candidate.userId,
+    });
+    if (sameMember && sameMember.groupMemberId !== candidate.groupMemberId) {
+        // Duplicate repair may change the primary key, but must retain the member's revocation.
+        await checkSignedOrder("GroupMembers", sameMember, candidate, context);
+    }
+    const { authority, signer, signerRole } = await requireSigner("GroupMembers", candidate, context);
+    if (candidate.userId === authority.founderUserId && signer !== authority.founderUserId) {
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", "only the founder writes the founder's row");
+    }
+    const currentRole = authority.roles.get(candidate.userId) ?? group_member_roles_1.GroupMemberRole.None;
+    if (signerRole < group_member_roles_1.GroupMemberRole.Admin ||
+        signerRole < candidate.role ||
+        signerRole < currentRole) {
+        throw (0, write_checks_1.writeNotAuthorized)("GroupMembers", `${signer} (${group_member_roles_1.GroupMemberRole[signerRole] ?? signerRole}) can't set this membership`);
+    }
+}
+/**
+ * The group row must be signed by the founder or an Admin who counts, and only the founder can
+ * name a different founder. Sync never deletes it.
+ */
+async function checkGroup(existing, candidate, context) {
+    const groupId = context.dataContext.groupId;
+    if (!groupId)
+        return;
+    if (!candidate) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", "the group row isn't deleted by sync");
+    }
+    if (candidate.groupId !== groupId || context.recordId !== groupId) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", "the row names another group");
+    }
+    await checkSignedOrder("Groups", existing, candidate, context);
+    // A counted signer implies a pinned founder: every key is traced back to one.
+    const { authority, signer, signerRole } = await requireSigner("Groups", candidate, context);
+    if (candidate.founderUserId !== authority.founderUserId && signer !== authority.founderUserId) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", "only the founder can name a new founder");
+    }
+    if (signerRole < group_member_roles_1.GroupMemberRole.Admin) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", `${signer} isn't an Admin`);
+    }
+    if ((candidate.publicRole ?? group_member_roles_1.GroupMemberRole.None) > signerRole) {
+        throw (0, write_checks_1.writeNotAuthorized)("Groups", "public role exceeds the signer's role");
+    }
+}
+/** Fields of a Packages row a Writer may change; everything else needs an Admin. */
+const writerPackageFields = new Set(["name", "description", "signature", "signedAt"]);
+/**
+ * A Writer may add a package; changing an existing one beyond its name and description (the
+ * active version, follow policy, update URL, publisher key, repository, disabled) needs an
+ * Admin. Deletes stay open to any member, as the table allows locally.
+ */
+async function checkPackageWrite(existing, candidate, context) {
+    if (!context.dataContext.groupId)
+        return;
+    await checkSignedOrder("Packages", existing, candidate, context);
+    if (!candidate)
+        return;
+    const { signerRole } = await requireSigner("Packages", candidate, context);
+    const needsAdmin = existing
+        ? [...new Set([...Object.keys(existing), ...Object.keys(candidate)])].some((field) => !writerPackageFields.has(field) &&
+            !(0, lodash_1.isEqual)(existing[field], candidate[field]))
+        : !!candidate.activePackageVersionId;
+    if (signerRole < (needsAdmin ? group_member_roles_1.GroupMemberRole.Admin : group_member_roles_1.GroupMemberRole.Writer)) {
+        throw (0, write_checks_1.writeNotAuthorized)("Packages", needsAdmin
+            ? "only an Admin can change a package's settings or select a version"
+            : "only a Writer can add a package");
+    }
+}
+/**
+ * Whether an Admin's device may act on a package row by itself: install releases from its
+ * `updateUrl`, copy releases signed by its publisher key in from other contexts, and select one
+ * by its follow policy. Each of those signs the result with the Admin's key, so the row must be
+ * one an Admin signed: a Writer may add a package row, or delete one and add it again, with any
+ * publisher key and update URL. A peers-core row instead qualifies only while it names the
+ * peers-core publisher key (or a revoked one, which is re-pinned to it before any release is
+ * checked), whoever signed it. Always true outside a group.
+ *
+ * @param pkg - The package row in `dataContext`.
+ * @param dataContext - The context the row belongs to.
+ */
+async function isPackageRowAdminSigned(pkg, dataContext) {
+    if (!dataContext.groupId)
+        return true;
+    if (pkg.packageId === system_ids_1.peersCorePackageId) {
+        return (!!system_ids_1.peersCorePublishPublicKey &&
+            (pkg.publishPublicKey === system_ids_1.peersCorePublishPublicKey ||
+                (0, package_author_signing_1.isRevokedPublisherKey)(pkg.publishPublicKey)));
+    }
+    if (pkg.signedContextId !== dataContext.groupId)
+        return false;
+    const authority = await (0, group_authority_1.getGroupAuthority)(dataContext.userContext, dataContext.groupId);
+    return ((0, group_authority_1.groupSigner)(authority, pkg)?.signerRole ?? group_member_roles_1.GroupMemberRole.None) >= group_member_roles_1.GroupMemberRole.Admin;
+}
+/**
+ * A dev version needs a Writer's signature; any other tag needs an Admin's, so no member can
+ * choose the code other members' devices run. peers-core versions signed by its publisher are
+ * accepted from anyone, since every device installs the bundled release.
+ */
+async function checkPackageVersion(existing, candidate, context) {
+    if (!context.dataContext.groupId)
+        return;
+    if (!candidate)
+        return checkSignedOrder("PackageVersions", existing, candidate, context);
+    const isDev = candidate.versionTag === "dev" && (!existing || existing.versionTag === "dev");
+    if (!isDev &&
+        candidate.packageId === system_ids_1.peersCorePackageId &&
+        (0, package_author_signing_1.verifyPackageAuthorSignature)(candidate, system_ids_1.peersCorePublishPublicKey).valid) {
+        return;
+    }
+    await checkSignedOrder("PackageVersions", existing, candidate, context);
+    const { signerRole } = await requireSigner("PackageVersions", candidate, context);
+    if (signerRole < (isDev ? group_member_roles_1.GroupMemberRole.Writer : group_member_roles_1.GroupMemberRole.Admin)) {
+        throw (0, write_checks_1.writeNotAuthorized)("PackageVersions", isDev ? "only a Writer can add a dev version" : "only an Admin can release a version");
+    }
+}
+/**
+ * A user's profile row is theirs: once a self-signed row is stored, a replacement must be
+ * self-signed too, and it isn't deleted. Roles are traced through these rows' keys, so a member
+ * who could overwrite another member's row could stop that member's grants from counting. The
+ * same rule `UsersTable.save` applies locally; a key change is still judged by the anchors on
+ * record when the row syncs.
+ */
+async function checkUser(existing, candidate, context) {
+    if (!context.dataContext.groupId)
+        return;
+    if (candidate && candidate.userId !== context.recordId) {
+        throw (0, write_checks_1.writeNotAuthorized)("Users", "the row names another user");
+    }
+    if (candidate?.signature && !(0, user_permissions_1.isSelfSignedUser)(candidate)) {
+        throw (0, write_checks_1.writeNotAuthorized)("Users", "the profile isn't signed by its own key");
+    }
+    if (candidate) {
+        // The same identity/anchor rule applies to direct writes and recovery snapshots, which
+        // do not pass through the sync-specific Users hook. A personal pin also governs first insert.
+        const { resolveUserRowChange } = await Promise.resolve().then(() => require("../identity/user-row-change"));
+        const decision = await resolveUserRowChange({
+            personalContext: context.dataContext.userContext.userDataContext,
+            existing,
+            incoming: candidate,
+        });
+        if (decision.action !== "apply")
+            throw (0, write_checks_1.writeNotAuthorized)("Users", decision.reason);
+        candidate.anchors = decision.row.anchors;
+        candidate.anchorsSignature = decision.row.anchorsSignature;
+        if (!candidate.anchors)
+            delete candidate.anchors;
+    }
+    if (!existing?.signature)
+        return;
+    if (!candidate) {
+        throw (0, write_checks_1.writeNotAuthorized)("Users", "a signed profile isn't deleted");
+    }
+    if (!candidate.signature) {
+        throw (0, write_checks_1.writeNotAuthorized)("Users", "an unsigned profile can't replace a signed one");
+    }
+}
+/**
+ * A device its owner signed for (`ownerSignature`, checked against the owner's verified key)
+ * stays theirs: it isn't deleted, and a replacement keeps the owner and a valid signature. Mesh
+ * routing encrypts to a device's owner, so a member who could claim another member's device id
+ * would receive what was meant for it. Verified owners stay pinned across key changes; a new
+ * claim waits for its owner's verified profile. An unsigned discovery row may be replaced.
+ */
+async function checkDevice(existing, candidate, context) {
+    const { dataContext, recordId } = context;
+    if (!dataContext.groupId)
+        return;
+    if (candidate && candidate.deviceId !== recordId) {
+        throw (0, write_checks_1.writeNotAuthorized)("Devices", "the row names another device");
+    }
+    const { users } = await (0, group_authority_1.getGroupAuthority)(dataContext.userContext, dataContext.groupId);
+    const signed = (row) => !!row && (0, devices_1.isDeviceOwnerSigned)(row, users.get(row.userId)?.publicKey);
+    const vars = (0, persistent_vars_1.PersistentVars)(dataContext.userContext.userDataContext);
+    const name = `deviceOwner:${dataContext.groupId}:${recordId}`;
+    const remembered = await vars.findOne({ name, scope: "device" });
+    const ownerId = remembered?.value.value ??
+        (signed(existing) ? existing?.userId : signed(candidate) ? candidate?.userId : undefined);
+    // Remember a verified owner before writing: profile rotation/recovery must not unpin an
+    // offline device. This is local evidence, retained through history replay and compaction.
+    if (ownerId && !remembered) {
+        await vars.save({ persistentVarId: "", name, scope: "device", value: { value: ownerId } });
+    }
+    if (ownerId && !candidate) {
+        throw (0, write_checks_1.writeNotAuthorized)("Devices", "a device its owner signed for isn't deleted");
+    }
+    if (ownerId && (candidate?.userId !== ownerId || !candidate?.ownerSignature)) {
+        throw (0, write_checks_1.writeNotAuthorized)("Devices", "a device its owner signed for stays theirs");
+    }
+    // An unchanged established claim survives a key change; renewing it requires the new key.
+    // A new signed claim waits for its owner's verified profile, so it is pinned on first save.
+    if (candidate?.ownerSignature &&
+        !(ownerId && candidate.ownerSignature === existing?.ownerSignature) &&
+        !signed(candidate)) {
+        throw (0, write_checks_1.writeNotAuthorized)("Devices", "the ownership claim doesn't verify");
+    }
+}
+(0, write_checks_1.registerTableWriteCheck)("Users", checkUser);
+(0, write_checks_1.registerTableWriteCheck)("Devices", checkDevice);
+(0, write_checks_1.registerTableWriteCheck)("GroupMembers", checkGroupMember);
+(0, write_checks_1.registerTableWriteCheck)("Groups", checkGroup);
+(0, write_checks_1.registerTableWriteCheck)("Packages", checkPackageWrite);
+(0, write_checks_1.registerTableWriteCheck)("PackageVersions", checkPackageVersion);
+(0, write_checks_1.registerTableWriteCheck)("PersistentVars", (_existing, candidate) => {
+    if (candidate && candidate.scope !== "group") {
+        throw (0, write_checks_1.writeNotAuthorized)("PersistentVars", "personal and device settings do not belong in a group");
+    }
+});
+(0, write_checks_1.registerTableWriteCheck)("TableDefinitions", (_existing, candidate) => {
+    if (!candidate)
+        return;
+    try {
+        (0, package_table_identity_1.validateTableDefinitionRecord)(candidate);
+    }
+    catch (error) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", String(error));
+    }
+});

package/dist/data/change-tracking.d.ts

@@ -26,10 +26,10 @@ export declare const changeRecordSchema: z.ZodObject<{
     supersededAt: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     path: string;
-    createdAt: number;
-    changeId: string;
     tableName: string;
+    createdAt: number;
     recordId: string;
+    changeId: string;
     op: "set" | "delete" | "patch-text";
     appliedAt: number;
     value?: any;
@@ -37,10 +37,10 @@ export declare const changeRecordSchema: z.ZodObject<{
     supersededAt?: number | undefined;
 }, {
     path: string;
-    createdAt: number;
-    changeId: string;
     tableName: string;
+    createdAt: number;
     recordId: string;
+    changeId: string;
     op: "set" | "delete" | "patch-text";
     appliedAt: number;
     value?: any;

package/dist/data/create-group.js

@@ -55,6 +55,7 @@ async function createGroup(userContext, input) {
         groupId,
         userId: me.userId,
         role: group_member_roles_1.GroupMemberRole.Founder,
+        publicKey: me.publicKey,
         signature: "",
     });
     return group;