@peers-app/peers-sdk 0.27.5 → 0.28.1

package/dist/data/devices.d.ts

@@ -15,6 +15,7 @@ export declare const deviceSchema: z.ZodObject<{
     reportedName: z.ZodOptional<z.ZodString>;
     serverUrl: z.ZodOptional<z.ZodString>;
     trustLevel: z.ZodNativeEnum<typeof TrustLevel>;
+    ownerSignature: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     userId: string;
     deviceId: string;
@@ -24,6 +25,7 @@ export declare const deviceSchema: z.ZodObject<{
     name?: string | undefined;
     reportedName?: string | undefined;
     serverUrl?: string | undefined;
+    ownerSignature?: string | undefined;
 }, {
     userId: string;
     deviceId: string;
@@ -33,9 +35,29 @@ export declare const deviceSchema: z.ZodObject<{
     name?: string | undefined;
     reportedName?: string | undefined;
     serverUrl?: string | undefined;
+    ownerSignature?: string | undefined;
 }>;
 /** A context-scoped device record containing local state and owner-reported metadata. */
 export type IDevice = z.infer<typeof deviceSchema>;
+/**
+ * What a device's owner signs to claim it: the contents of `ownerSignature`. Each device signs
+ * its own claim with its user's key and writes it to its row in every group it belongs to.
+ *
+ * @param device - The device id and the user it belongs to.
+ */
+export declare function deviceOwnerStatement(device: Pick<IDevice, "deviceId" | "userId">): {
+    purpose: string;
+    deviceId: string;
+    userId: string;
+};
+/**
+ * Whether `device.ownerSignature` is `ownerPublicKey`'s signature over
+ * {@link deviceOwnerStatement}: the owner, not whoever wrote the row, says the device is theirs.
+ *
+ * @param device - A Devices row.
+ * @param ownerPublicKey - The signing key of `device.userId`, as this device knows it.
+ */
+export declare function isDeviceOwnerSigned(device: Pick<IDevice, "deviceId" | "userId" | "ownerSignature">, ownerPublicKey: string | undefined): boolean;
 /** Schema for the signed identity and bounded presentation hints exchanged by devices. */
 export declare const deviceInfoSchema: z.ZodObject<{
     userId: z.ZodEffects<z.ZodString, string, string>;
@@ -47,15 +69,15 @@ export declare const deviceInfoSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     publicKey: string;
     userId: string;
-    deviceId: string;
     publicBoxKey: string;
+    deviceId: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
 }, {
     publicKey: string;
     userId: string;
-    deviceId: string;
     publicBoxKey: string;
+    deviceId: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
 }>;
@@ -155,9 +177,9 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
     timestamp: number;
     publicKey: string;
     userId: string;
+    publicBoxKey: string;
     connectionId: string;
     deviceId: string;
-    publicBoxKey: string;
     serverAddress: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
@@ -180,9 +202,9 @@ export declare const deviceHandshakeSchema: z.ZodObject<{
     timestamp: number;
     publicKey: string;
     userId: string;
+    publicBoxKey: string;
     connectionId: string;
     deviceId: string;
-    publicBoxKey: string;
     serverAddress: string;
     userName?: string | undefined;
     deviceName?: string | undefined;
@@ -214,6 +236,7 @@ export declare function Devices(dataContext?: DataContext): import("..").Table<{
     name?: string | undefined;
     reportedName?: string | undefined;
     serverUrl?: string | undefined;
+    ownerSignature?: string | undefined;
 }>;
 /** Relay server URLs trusted by the active group. */
 export declare const trustedServers: import("./persistent-vars").PersistentVar<string[]>;

package/dist/data/devices.js

@@ -1,11 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.thisDeviceId = exports.trustedServers = exports.deviceHandshakeSchema = exports.handshakeFrameCryptoSchema = exports.deviceInfoSchema = exports.deviceSchema = exports.displayNameSchema = exports.DISPLAY_NAME_MAX_LENGTH = void 0;
+exports.deviceOwnerStatement = deviceOwnerStatement;
+exports.isDeviceOwnerSigned = isDeviceOwnerSigned;
 exports.Devices = Devices;
 const zod_1 = require("zod");
 const user_context_singleton_1 = require("../context/user-context-singleton");
 const socket_type_1 = require("../device/socket.type");
 const key_contest_1 = require("../identity/key-contest");
+const keys_1 = require("../keys");
 const zod_types_1 = require("../types/zod-types");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
@@ -24,7 +27,35 @@ exports.deviceSchema = zod_1.z.object({
     reportedName: exports.displayNameSchema.optional(),
     serverUrl: zod_1.z.string().optional(),
     trustLevel: zod_1.z.nativeEnum(socket_type_1.TrustLevel),
+    ownerSignature: zod_1.z
+        .string()
+        .optional()
+        .describe("The owner's signature claiming this device for userId (see deviceOwnerStatement). In a group, only a row with a valid one says who a device belongs to, and it stays theirs"),
 });
+/**
+ * What a device's owner signs to claim it: the contents of `ownerSignature`. Each device signs
+ * its own claim with its user's key and writes it to its row in every group it belongs to.
+ *
+ * @param device - The device id and the user it belongs to.
+ */
+function deviceOwnerStatement(device) {
+    return { purpose: "peers-device-owner", deviceId: device.deviceId, userId: device.userId };
+}
+/**
+ * Whether `device.ownerSignature` is `ownerPublicKey`'s signature over
+ * {@link deviceOwnerStatement}: the owner, not whoever wrote the row, says the device is theirs.
+ *
+ * @param device - A Devices row.
+ * @param ownerPublicKey - The signing key of `device.userId`, as this device knows it.
+ */
+function isDeviceOwnerSigned(device, ownerPublicKey) {
+    if (!device.ownerSignature || !ownerPublicKey)
+        return false;
+    return ((0, keys_1.signedByKey)({
+        ...deviceOwnerStatement(device),
+        signature: `${ownerPublicKey}:${device.ownerSignature}`,
+    }) === ownerPublicKey);
+}
 /** Schema for the signed identity and bounded presentation hints exchanged by devices. */
 exports.deviceInfoSchema = zod_1.z.object({
     userId: zod_types_1.zodPeerId,

package/dist/data/group-authority.d.ts

@@ -0,0 +1,111 @@
+import type { UserContext } from "../context/user-context";
+import { GroupMemberRole } from "./group-member-roles";
+import type { IGroupMember } from "./group-members";
+import type { IGroup } from "./groups";
+import type { IUser } from "./users";
+/**
+ * Who holds which role in a group, counting only rows whose signatures check out against the
+ * group's own chain of authority.
+ *
+ * Sync writes rows without running the tables' checks, and any member's device can serve a
+ * row, so a role or setting is believed only when its signer could have granted it. Built by
+ * {@link computeGroupAuthority}; read through {@link getGroupAuthority}.
+ */
+export interface IGroupAuthority {
+    groupId: string;
+    /** The founder: the root every role is traced back to. Undefined when nothing names one. */
+    founderUserId?: string;
+    /** Role anyone without a membership gets, from the group row when that row counts. */
+    publicRole: GroupMemberRole;
+    /** Role of each member whose membership counts. The founder is {@link GroupMemberRole.Founder}. */
+    roles: ReadonlyMap<string, GroupMemberRole>;
+    /**
+     * The signing key each counted role belongs to, by user id. A device presenting a member's
+     * user id with another key doesn't get the member's role (see {@link roleInGroupAuthority}).
+     * Absent for a founder without a verified profile row and for members with role None.
+     */
+    keys: ReadonlyMap<string, string>;
+    /** The group-context Groups row, when it counts (signed by the founder or a counted Admin). */
+    group?: IGroup;
+    /** Each user's verified profile row (personal rows first), by user id. */
+    users: ReadonlyMap<string, IUser>;
+}
+/** The rows {@link computeGroupAuthority} works from. */
+export interface IGroupAuthorityInput {
+    groupId: string;
+    /**
+     * The user's own copy of the group row (personal context), written when they created or
+     * joined the group. Only their own devices write it, so its founder is the root of trust.
+     */
+    pinnedGroup?: IGroup;
+    /** The group's row in the group context, which any member's device can serve. */
+    group?: IGroup;
+    /** Every GroupMembers row in the group context. */
+    members: readonly IGroupMember[];
+    /**
+     * Users rows that map signing keys to users, most trusted first: the first row pins the
+     * keys, and a matching self-signed row verifies them. Pass personal rows before group rows.
+     */
+    users: readonly IUser[];
+}
+/**
+ * Build a group's {@link IGroupAuthority} from its rows. Pure and deterministic: the same rows
+ * give the same roles on every device, whatever order they arrived in.
+ *
+ * - **Profiles:** `users` maps each user to the profile row that settles their keys: the first
+ *   row for a user pins the keys (an unsigned contact stub included) and a self-signed row with
+ *   the same keys verifies them.
+ * - **Founder:** from `pinnedGroup`. Without a personal pin no authority counts. A group row
+ *   naming a different founder counts only if the pinned founder signed it.
+ * - **Members:** starting from the founder, a membership counts when its signature is valid
+ *   and its signer already counts as at least Admin and at least the role granted. Repeated
+ *   until nothing changes, so a row can't justify itself or another row that justifies it.
+ *   Deleted rows don't count.
+ * - **Keys:** a role belongs to a key, not only a user id. The founder's key is their verified
+ *   profile row's. A membership names the member's key: it counts for that key, or for the
+ *   key the member's verified profile row has if that row shows the named key handing over to
+ *   it ({@link keySucceeds}). A profile row with any other key (a namesake a member forged on a
+ *   device that had never seen the real one) stops the grant counting rather than inheriting
+ *   it. Signatures count only by these keys.
+ * - **Group settings:** the group row's `publicRole` counts only when that row is signed by the
+ *   founder or a counted Admin; otherwise no public access is granted.
+ *
+ * @param input - The group's rows.
+ */
+export declare function computeGroupAuthority(input: IGroupAuthorityInput): IGroupAuthority;
+/**
+ * A user's role under `authority`: their counted membership, else the group's public role.
+ *
+ * Pass `publicKey` whenever the user is a remote caller: the role then counts only if it
+ * belongs to the key the caller authenticated with ({@link IGroupAuthority.keys}). Otherwise a
+ * device that proved a namesake's key somewhere else (another group's copy of a forged profile)
+ * would get the member's role here. A membership with role None applies whatever the key.
+ *
+ * @param authority - From {@link computeGroupAuthority} or {@link getGroupAuthority}.
+ * @param userId - User whose role is requested.
+ * @param publicKey - The signing key the caller authenticated with, when it is remote.
+ */
+export declare function roleInGroupAuthority(authority: IGroupAuthority, userId: string, publicKey?: string): GroupMemberRole;
+/**
+ * The counted member who signed `row` and their role: its signature verifies with the key
+ * their role belongs to under `authority`. Undefined for anyone else, whatever their profile says.
+ *
+ * @param authority - The group's verified authority.
+ * @param row - A signed row.
+ */
+export declare function groupSigner(authority: Pick<IGroupAuthority, "keys" | "roles">, row: {
+    signature?: string;
+}): {
+    signer: string;
+    signerRole: GroupMemberRole;
+} | undefined;
+/**
+ * The verified authority for `groupId`, cached per user context and rebuilt after any change
+ * to that group's Groups, GroupMembers or Users rows, or to the user's own Groups or Users rows.
+ *
+ * @param userContext - Context that owns the group.
+ * @param groupId - Group id (never the personal context).
+ */
+export declare function getGroupAuthority(userContext: UserContext, groupId: string): Promise<IGroupAuthority>;
+/** Drop cached authority for one group, or every group of `userContext`. */
+export declare function invalidateGroupAuthority(userContext: UserContext, groupId?: string): void;

package/dist/data/group-authority.js

@@ -0,0 +1,281 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeGroupAuthority = computeGroupAuthority;
+exports.roleInGroupAuthority = roleInGroupAuthority;
+exports.groupSigner = groupSigner;
+exports.getGroupAuthority = getGroupAuthority;
+exports.invalidateGroupAuthority = invalidateGroupAuthority;
+const keys_1 = require("../keys");
+const group_member_roles_1 = require("./group-member-roles");
+const user_permissions_1 = require("./user-permissions");
+/**
+ * Build a group's {@link IGroupAuthority} from its rows. Pure and deterministic: the same rows
+ * give the same roles on every device, whatever order they arrived in.
+ *
+ * - **Profiles:** `users` maps each user to the profile row that settles their keys: the first
+ *   row for a user pins the keys (an unsigned contact stub included) and a self-signed row with
+ *   the same keys verifies them.
+ * - **Founder:** from `pinnedGroup`. Without a personal pin no authority counts. A group row
+ *   naming a different founder counts only if the pinned founder signed it.
+ * - **Members:** starting from the founder, a membership counts when its signature is valid
+ *   and its signer already counts as at least Admin and at least the role granted. Repeated
+ *   until nothing changes, so a row can't justify itself or another row that justifies it.
+ *   Deleted rows don't count.
+ * - **Keys:** a role belongs to a key, not only a user id. The founder's key is their verified
+ *   profile row's. A membership names the member's key: it counts for that key, or for the
+ *   key the member's verified profile row has if that row shows the named key handing over to
+ *   it ({@link keySucceeds}). A profile row with any other key (a namesake a member forged on a
+ *   device that had never seen the real one) stops the grant counting rather than inheriting
+ *   it. Signatures count only by these keys.
+ * - **Group settings:** the group row's `publicRole` counts only when that row is signed by the
+ *   founder or a counted Admin; otherwise no public access is granted.
+ *
+ * @param input - The group's rows.
+ */
+function computeGroupAuthority(input) {
+    const { groupId, pinnedGroup, group } = input;
+    const users = verifiedUsers(input.users);
+    const keys = new Map();
+    const pinnedFounder = pinnedGroup?.groupId === groupId ? pinnedGroup.founderUserId : undefined;
+    const groupSigningKey = group && group.groupId === groupId ? (0, keys_1.signedByKey)(group) : undefined;
+    const signedByPinnedFounder = !!pinnedFounder && !!groupSigningKey && groupSigningKey === users.get(pinnedFounder)?.publicKey;
+    let founderUserId = pinnedFounder;
+    if (group && founderUserId && group.founderUserId !== founderUserId && signedByPinnedFounder) {
+        founderUserId = group.founderUserId;
+    }
+    const founderKey = founderUserId && users.get(founderUserId)?.publicKey;
+    if (founderUserId && founderKey)
+        keys.set(founderUserId, founderKey);
+    const roles = new Map();
+    if (founderUserId)
+        roles.set(founderUserId, group_member_roles_1.GroupMemberRole.Founder);
+    const pending = input.members
+        .filter((member) => member.groupId === groupId && !member.deleted)
+        .filter((member) => member.userId !== founderUserId)
+        .sort((a, b) => a.role - b.role ||
+        (a.groupMemberId < b.groupMemberId ? -1 : a.groupMemberId > b.groupMemberId ? 1 : 0));
+    const memberKey = (member) => {
+        if (!member.publicKey)
+            return undefined;
+        const profile = users.get(member.userId);
+        if (!profile)
+            return member.publicKey;
+        return (0, user_permissions_1.keySucceeds)(profile, member.publicKey) ? profile.publicKey : undefined;
+    };
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const member of pending) {
+            if (roles.has(member.userId))
+                continue;
+            const signerRole = groupSigner({ keys, roles }, member)?.signerRole;
+            if (signerRole === undefined ||
+                signerRole < group_member_roles_1.GroupMemberRole.Admin ||
+                signerRole < member.role) {
+                continue;
+            }
+            const key = memberKey(member);
+            if (member.role > group_member_roles_1.GroupMemberRole.None) {
+                if (!key)
+                    continue;
+                keys.set(member.userId, key);
+            }
+            roles.set(member.userId, member.role);
+            changed = true;
+        }
+    }
+    const groupSignerRole = group ? groupSigner({ keys, roles }, group)?.signerRole : undefined;
+    const groupRowAccepted = !!group &&
+        group.groupId === groupId &&
+        group.founderUserId === founderUserId &&
+        (signedByPinnedFounder ||
+            (groupSignerRole !== undefined &&
+                groupSignerRole >= group_member_roles_1.GroupMemberRole.Admin &&
+                groupSignerRole >= (group.publicRole ?? group_member_roles_1.GroupMemberRole.None)));
+    return {
+        groupId,
+        founderUserId,
+        publicRole: groupRowAccepted
+            ? (group.publicRole ?? group_member_roles_1.GroupMemberRole.None)
+            : group_member_roles_1.GroupMemberRole.None,
+        roles,
+        keys,
+        group: groupRowAccepted ? group : undefined,
+        users,
+    };
+}
+/**
+ * A user's role under `authority`: their counted membership, else the group's public role.
+ *
+ * Pass `publicKey` whenever the user is a remote caller: the role then counts only if it
+ * belongs to the key the caller authenticated with ({@link IGroupAuthority.keys}). Otherwise a
+ * device that proved a namesake's key somewhere else (another group's copy of a forged profile)
+ * would get the member's role here. A membership with role None applies whatever the key.
+ *
+ * @param authority - From {@link computeGroupAuthority} or {@link getGroupAuthority}.
+ * @param userId - User whose role is requested.
+ * @param publicKey - The signing key the caller authenticated with, when it is remote.
+ */
+function roleInGroupAuthority(authority, userId, publicKey) {
+    const role = authority.roles.get(userId);
+    if (role === undefined)
+        return authority.publicRole;
+    if (role > group_member_roles_1.GroupMemberRole.None &&
+        publicKey !== undefined &&
+        authority.keys.get(userId) !== publicKey) {
+        return authority.publicRole;
+    }
+    return role;
+}
+/**
+ * Each user's profile row that settles their keys, from self-signed Users rows. The first row
+ * for a user pins the keys, including an unsigned contact stub; a self-signed row with the same
+ * keys verifies them.
+ *
+ * @param users - Users rows, most trusted first.
+ */
+function verifiedUsers(users) {
+    const verified = new Map();
+    const pins = new Map();
+    for (const user of users) {
+        if (!user.publicKey)
+            continue;
+        const pin = pins.get(user.userId) ?? user;
+        pins.set(user.userId, pin);
+        if (!(0, user_permissions_1.sameUserIdentity)(user, pin))
+            continue;
+        if (verified.has(user.userId) || !(0, user_permissions_1.isSelfSignedUser)(user))
+            continue;
+        verified.set(user.userId, user);
+    }
+    return verified;
+}
+/**
+ * The counted member who signed `row` and their role: its signature verifies with the key
+ * their role belongs to under `authority`. Undefined for anyone else, whatever their profile says.
+ *
+ * @param authority - The group's verified authority.
+ * @param row - A signed row.
+ */
+function groupSigner(authority, row) {
+    const key = (0, keys_1.signedByKey)(row);
+    if (!key)
+        return undefined;
+    for (const [userId, memberKey] of authority.keys) {
+        if (memberKey === key) {
+            return { signer: userId, signerRole: authority.roles.get(userId) ?? group_member_roles_1.GroupMemberRole.None };
+        }
+    }
+    return undefined;
+}
+const caches = new WeakMap();
+const subscribed = new WeakMap();
+/**
+ * The verified authority for `groupId`, cached per user context and rebuilt after any change
+ * to that group's Groups, GroupMembers or Users rows, or to the user's own Groups or Users rows.
+ *
+ * @param userContext - Context that owns the group.
+ * @param groupId - Group id (never the personal context).
+ */
+async function getGroupAuthority(userContext, groupId) {
+    let byGroup = caches.get(userContext);
+    if (!byGroup) {
+        byGroup = new Map();
+        caches.set(userContext, byGroup);
+    }
+    let entry = byGroup.get(groupId);
+    if (!entry) {
+        entry = { generation: 0 };
+        byGroup.set(groupId, entry);
+    }
+    const dataContext = userContext.getDataContext(groupId);
+    if (entry.dataContext !== dataContext) {
+        invalidateGroupAuthority(userContext, groupId);
+        entry.dataContext = dataContext;
+    }
+    if (entry.loaded)
+        return entry.loaded;
+    if (entry.loading)
+        return entry.loading;
+    const cache = entry;
+    const generation = cache.generation;
+    const loading = (async () => {
+        await subscribeToAuthorityRows(userContext, groupId);
+        const loaded = await readGroupAuthority(userContext, groupId);
+        // Invalidation during the asynchronous reads also invalidates this caller's result.
+        if (cache.generation !== generation)
+            return getGroupAuthority(userContext, groupId);
+        cache.loaded = loaded;
+        return loaded;
+    })();
+    cache.loading = loading;
+    try {
+        return await loading;
+    }
+    finally {
+        if (cache.loading === loading)
+            cache.loading = undefined;
+    }
+}
+/** Drop cached authority for one group, or every group of `userContext`. */
+function invalidateGroupAuthority(userContext, groupId) {
+    const byGroup = caches.get(userContext);
+    if (!byGroup)
+        return;
+    const entries = groupId ? [byGroup.get(groupId)] : [...byGroup.values()];
+    for (const entry of entries) {
+        if (!entry)
+            continue;
+        entry.generation++;
+        entry.loaded = undefined;
+        entry.loading = undefined;
+    }
+}
+async function readGroupAuthority(userContext, groupId) {
+    const { Groups } = await Promise.resolve().then(() => require("./groups"));
+    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+    const { Users } = await Promise.resolve().then(() => require("./users"));
+    const groupContext = userContext.getDataContext(groupId);
+    const [pinnedGroup, group, members, personalUsers, groupUsers] = await Promise.all([
+        Groups(userContext.userDataContext).get(groupId),
+        Groups(groupContext).get(groupId),
+        GroupMembers(groupContext).list({ groupId }),
+        Users(userContext.userDataContext).list(),
+        Users(groupContext).list(),
+    ]);
+    return computeGroupAuthority({
+        groupId,
+        pinnedGroup,
+        group,
+        members,
+        users: [...personalUsers, ...groupUsers],
+    });
+}
+async function subscribeToAuthorityRows(userContext, groupId) {
+    let groups = subscribed.get(userContext);
+    if (!groups) {
+        groups = new Map();
+        subscribed.set(userContext, groups);
+    }
+    const { Groups } = await Promise.resolve().then(() => require("./groups"));
+    const { GroupMembers } = await Promise.resolve().then(() => require("./group-members"));
+    const { Users } = await Promise.resolve().then(() => require("./users"));
+    for (const [key, dataContext] of [
+        ["", userContext.userDataContext],
+        [groupId, userContext.getDataContext(groupId)],
+    ]) {
+        const previous = groups.get(key);
+        if (previous?.dataContext === dataContext)
+            continue;
+        for (const subscription of previous?.subscriptions ?? [])
+            subscription.unsubscribe();
+        const invalidate = () => invalidateGroupAuthority(userContext, key || undefined);
+        const tables = key
+            ? [Groups(dataContext), GroupMembers(dataContext), Users(dataContext)]
+            : [Groups(dataContext), Users(dataContext)];
+        groups.set(key, {
+            dataContext,
+            subscriptions: tables.map((table) => table.dataChanged.subscribe(invalidate)),
+        });
+    }
+}

package/dist/data/group-members.d.ts

@@ -9,7 +9,9 @@ export declare const groupMemberSchema: z.ZodObject<{
     groupId: z.ZodEffects<z.ZodString, string, string>;
     userId: z.ZodEffects<z.ZodString, string, string>;
     role: z.ZodNativeEnum<typeof GroupMemberRole>;
+    publicKey: z.ZodOptional<z.ZodString>;
     signature: z.ZodString;
+    signedAt: z.ZodOptional<z.ZodNumber>;
     deleted: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     role: GroupMemberRole;
@@ -18,6 +20,8 @@ export declare const groupMemberSchema: z.ZodObject<{
     groupId: string;
     groupMemberId: string;
     deleted?: boolean | undefined;
+    publicKey?: string | undefined;
+    signedAt?: number | undefined;
 }, {
     role: GroupMemberRole;
     signature: string;
@@ -25,6 +29,8 @@ export declare const groupMemberSchema: z.ZodObject<{
     groupId: string;
     groupMemberId: string;
     deleted?: boolean | undefined;
+    publicKey?: string | undefined;
+    signedAt?: number | undefined;
 }>;
 /** A signed association between a user and a group with an assigned role. */
 export type IGroupMember = z.infer<typeof groupMemberSchema>;
@@ -40,8 +46,8 @@ export declare class GroupMembersTable extends Table<IGroupMember> {
      * Settle two membership rows for the same user in the same group: devices that approved the
      * same join at once could each write one, under a different id.
      *
-     * Merged only when both rows grant the same access (role and deleted state), so nothing about
-     * the member's access changes. The id {@link deterministicGroupMemberId} gives wins if either
+     * Merged only when both rows grant the same access (role, key and deleted state), so nothing
+     * about the member's access changes. The id {@link deterministicGroupMemberId} gives wins if either
      * row has it, otherwise the lexicographically smaller id; the winner is kept as it is, signature
      * included. Rows that disagree stay queued for a person. A pure function of the two rows, so
      * every device keeps the same one.