@peers-app/peers-sdk 0.27.5 → 0.28.1

package/dist/data/invites.d.ts

@@ -47,6 +47,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }>, "many">>;
+        anchorsSignature: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
@@ -55,6 +56,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
@@ -64,6 +66,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }>>;
     /** Device the counterpart used, when they told us; lets the network layer connect early. */
@@ -95,6 +98,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }>, "many">>;
+            anchorsSignature: z.ZodOptional<z.ZodString>;
         }, "strict", z.ZodTypeAny, {
             publicKey: string;
             userId: string;
@@ -103,6 +107,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         }, {
             publicKey: string;
@@ -112,6 +117,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         }>;
         expiresAt: z.ZodString;
@@ -155,6 +161,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -181,6 +188,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -253,6 +261,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -274,6 +283,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;
@@ -314,6 +324,7 @@ export declare const inviteSchema: z.ZodObject<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -335,6 +346,7 @@ export declare const inviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;
@@ -383,6 +395,7 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
                 type: "peers-services" | "https";
                 url: string;
             }[] | undefined;
+            anchorsSignature?: string | undefined;
             displayName?: string | undefined;
         };
         epoch: number;
@@ -404,6 +417,7 @@ export declare function Invites(dataContext?: DataContext): import("..").Table<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     } | undefined;
     counterpartDeviceId?: string | undefined;

package/dist/data/orm/index.d.ts

@@ -14,3 +14,4 @@ export * from "./table-container";
 export * from "./table-definitions.type";
 export * from "./table-dependencies";
 export * from "./types";
+export * from "./write-checks";

package/dist/data/orm/index.js

@@ -30,3 +30,4 @@ __exportStar(require("./table-container"), exports);
 __exportStar(require("./table-definitions.type"), exports);
 __exportStar(require("./table-dependencies"), exports);
 __exportStar(require("./types"), exports);
+__exportStar(require("./write-checks"), exports);

package/dist/data/orm/sql.data-source.d.ts

@@ -96,8 +96,8 @@ export declare class SQLDataSource<T extends {
      */
     bulkSave(records: T[]): Promise<T[]>;
 }
-/** Encode a JavaScript field for SQLite parameters or an escaped migration literal. */
-export declare function jsValueToSqlValue(value: any, escapeQuote?: boolean): any;
+/** Encode a JavaScript field for SQLite parameters. */
+export declare function jsValueToSqlValue(value: any): any;
 /** Restore a SQLite field according to its declared Peers type. */
 export declare function sqlValueToJsValue(value: any, fieldType: FieldType, isArray: boolean): any;
 /** Default value used when adding a required field to an existing table. */

package/dist/data/orm/sql.data-source.js

@@ -10,6 +10,16 @@ const tool_catalog_fields_1 = require("../tool-catalog-fields");
 const data_query_1 = require("./data-query");
 const data_query_sqlite_1 = require("./data-query.sqlite");
 const types_1 = require("./types");
+/**
+ * The SQLite name {@link SQLDataSource} gives one of a table's indexes.
+ *
+ * @param tableName - Full (physical) table name.
+ * @param index - One entry of `ITableMetaData.indexes`.
+ */
+function sqlIndexName(tableName, index) {
+    const fieldNames = index.fields.map((f) => `_${typeof f === "string" ? f : f.name}`).join("");
+    return `${tableName}_${fieldNames}_${(0, utils_1.simpleHash)(JSON.stringify(index))}`;
+}
 /** SQLite-backed table storage with additive schema migration and serialized initialization. */
 class SQLDataSource {
     db;
@@ -79,22 +89,12 @@ class SQLDataSource {
         // create indexes if they don't exist
         if (this.metaData.indexes) {
             for (const index of this.metaData.indexes) {
-                let fieldNames = "";
+                // Quoted: a field may be named like an SQL keyword (`order`, `group`).
                 const fields = index.fields
-                    .map((f) => {
-                    if (typeof f === "string") {
-                        fieldNames += `_${f}`;
-                        return f;
-                    }
-                    else {
-                        fieldNames += `_${f.name}`;
-                        return `${f.name} ${f.order}`;
-                    }
-                })
+                    .map((f) => (typeof f === "string" ? `"${f}"` : `"${f.name}" ${f.order}`))
                     .join(", ");
-                const hash = (0, utils_1.simpleHash)(JSON.stringify(index));
                 const unique = index.unique ? "UNIQUE" : "";
-                const indexName = `${this.tableName}_${fieldNames}_${hash}`;
+                const indexName = sqlIndexName(this.tableName, index);
                 indexNames.push(indexName);
                 const sql = `CREATE ${unique} INDEX IF NOT EXISTS "${indexName}" ON "${this.tableName}"(${fields});`;
                 try {
@@ -102,6 +102,9 @@ class SQLDataSource {
                 }
                 catch (e) {
                     console.error(`Error creating index "${indexName}" on table "${this.tableName}": ${String(e)}`);
+                    // A package must not accept writes without its declared uniqueness constraint.
+                    if (this.metaData.packageId && index.unique)
+                        throw e;
                 }
             }
         }
@@ -136,6 +139,7 @@ class SQLDataSource {
             // sql query to copy existing data and set new required fields to default values
             const defaults = this.initRecord();
             const fieldsInsert = this.metaData.fields.map((f) => `"${f.name}"`).join(", ");
+            const params = [];
             const fieldsSelect = this.metaData.fields
                 .map((f) => {
                 const existingField = existingTableDef.includes(`"${f.name}"`);
@@ -146,18 +150,19 @@ class SQLDataSource {
                 if (defaultValue === undefined) {
                     defaultValue = globalDefaultValues(f);
                 }
-                defaultValue = jsValueToSqlValue(defaultValue, true);
+                if (!f.optional)
+                    params.push(jsValueToSqlValue(defaultValue));
                 if (existingField && !f.optional) {
-                    return `CASE WHEN "${f.name}" IS NULL THEN '${defaultValue}' ELSE "${f.name}" END as "${f.name}"`;
+                    return `COALESCE("${f.name}", ?) as "${f.name}"`;
                 }
                 if (!existingField && !f.optional) {
-                    return `'${defaultValue}' as "${f.name}"`;
+                    return `? as "${f.name}"`;
                 }
                 return `NULL as "${f.name}"`;
             })
                 .join(", ");
             const insertSql = `INSERT INTO "${this.tableName}"(${fieldsInsert}) SELECT ${fieldsSelect} FROM "${tempTableName}"`;
-            await this.db.exec(insertSql, []);
+            await this.db.exec(insertSql, params);
             // drop old table
             const dropSql = `DROP TABLE IF EXISTS "${tempTableName}"`;
             await this.db.exec(dropSql, []);
@@ -536,8 +541,8 @@ class SQLDataSource {
     }
 }
 exports.SQLDataSource = SQLDataSource;
-/** Encode a JavaScript field for SQLite parameters or an escaped migration literal. */
-function jsValueToSqlValue(value, escapeQuote = false) {
+/** Encode a JavaScript field for SQLite parameters. */
+function jsValueToSqlValue(value) {
     if (value === undefined)
         return null;
     if (value instanceof Date) {
@@ -549,9 +554,6 @@ function jsValueToSqlValue(value, escapeQuote = false) {
     if (typeof value === "boolean") {
         return value ? 1 : 0;
     }
-    if (typeof value === "string" && escapeQuote) {
-        return value.replace(/'/g, "''");
-    }
     return value;
 }
 /** Restore a SQLite field according to its declared Peers type. */

package/dist/data/orm/table-container.js

@@ -4,6 +4,7 @@ exports.TableContainer = void 0;
 exports.checkVersionedUpdate = checkVersionedUpdate;
 const rpc_types_1 = require("../../rpc-types");
 const utils_1 = require("../../utils");
+const package_table_identity_1 = require("../package-table-identity");
 const table_1 = require("./table");
 const table_definitions_system_1 = require("./table-definitions.system");
 const types_1 = require("./types");
@@ -159,9 +160,12 @@ class TableContainer {
         this.savingDefinitions = true;
         const tableName = (0, utils_1.getFullTableName)(metaData);
         try {
-            // Lazy import to avoid circular dependency at module load time
-            const { TableDefinitions } = require("../table-definitions-table");
-            const tableDefsTable = TableDefinitions();
+            // Lazy import to avoid circular dependency at module load time; it registers the
+            // TableDefinitions system table. Use this container's own copy: a definition belongs to
+            // the data context the table lives in, not whichever group is active.
+            require("../table-definitions-table");
+            const definitions = table_definitions_system_1.systemTableDefinitions.TableDefinitions;
+            const tableDefsTable = this.getTable(definitions.metaData, definitions.schema);
             const record = {
                 tableId: metaData.tableId,
                 name: tableName,
@@ -266,7 +270,8 @@ class TableContainer {
         const record = await tableDefsTable.findOne({ name: tableName });
         if (!record || record.deleted)
             return null;
-        this.registerFromTableDefinitionRecord(record);
+        if (!this.registerFromTableDefinitionRecord(record))
+            return null;
         // Now instantiate via getTableByName which checks fallbackDefinitions
         return this.getTableByName(tableName);
     }
@@ -334,22 +339,25 @@ class TableContainer {
      * External code should not need to call this directly.
      */
     registerFromTableDefinitionRecord(record) {
-        const metaData = record.metaData;
-        if (!metaData?.tableId || !metaData?.name || !metaData?.fields) {
-            console.warn(`Invalid table definition record, skipping:`, record);
-            return;
+        try {
+            (0, package_table_identity_1.validateTableDefinitionRecord)(record);
         }
+        catch (error) {
+            console.warn("Refusing invalid synced table definition", error);
+            return false;
+        }
+        const metaData = record.metaData;
         const tableName = (0, utils_1.getFullTableName)(metaData);
         // Deleted tables should not be registered as fallbacks
         if (record.deleted) {
             delete this.fallbackDefinitions[tableName];
             delete this.fallbackInstances[tableName];
-            return;
+            return false;
         }
         // Don't overwrite a full (code-registered) definition -- that always takes precedence
         const fullDef = this.tableDefinitions[tableName] || table_definitions_system_1.systemTableDefinitions[tableName];
         if (fullDef) {
-            return; // full definition exists, no need for a fallback
+            return true; // full definition exists, no need for a fallback
         }
         const existing = this.fallbackDefinitions[tableName];
         if (existing) {
@@ -357,13 +365,14 @@ class TableContainer {
             const incomingVersion = record.versionNumber ?? 0;
             const result = checkVersionedUpdate(existingVersion, incomingVersion, existing.metaData, metaData);
             if (result === "skip") {
-                return;
+                return true;
             }
             // Remove old fallback instance so it gets re-created with the new schema
             delete this.fallbackInstances[tableName];
         }
         const schema = (0, types_1.fieldsToSchema)(metaData.fields);
         this.fallbackDefinitions[tableName] = { metaData, schema };
+        return true;
     }
     /**
      * This ensures all tables have been new'ed up and then returns the entire list of them.

package/dist/data/orm/write-checks.d.ts

@@ -0,0 +1,89 @@
+import type { DataContext } from "../../context/data-context";
+import type { Table } from "./table";
+/**
+ * Prefix of every refusal from a {@link TableWriteCheck}. Sync recovery parks a change refused
+ * with it, and checks it again only from local history, when the group's authority changes.
+ */
+export declare const WRITE_NOT_AUTHORIZED = "Write not authorized";
+/** Where a checked write lands. */
+export interface ITableWriteCheckContext {
+    /** The context the row belongs to. */
+    dataContext: DataContext;
+    /** The row's primary key, also given for a delete. */
+    recordId: string;
+    /** Checked snapshots retained by the same atomic recovery transaction. */
+    retainedRows?: readonly unknown[];
+    /** Records removed by the same atomic recovery transaction. */
+    deletedRecordIds?: readonly string[];
+}
+/**
+ * A rule a row must meet before it's written, run by the host on every synced change (sync
+ * writes rows without going through the table class). Throw an error from
+ * {@link writeNotAuthorized} to refuse it.
+ *
+ * @param existing - The row as stored now, if any.
+ * @param candidate - The row about to be stored, or undefined for a delete.
+ */
+export type TableWriteCheck<T = any> = (existing: T | undefined, candidate: T | undefined, context: ITableWriteCheckContext) => Promise<void> | void;
+/**
+ * Register the {@link TableWriteCheck} for a table name. One per table; a second registration
+ * replaces the first.
+ *
+ * @param tableName - Table the check guards.
+ * @param check - The rule.
+ */
+export declare function registerTableWriteCheck<T>(tableName: string, check: TableWriteCheck<T>): void;
+/**
+ * The {@link TableWriteCheck} registered for a table, if any.
+ *
+ * @param tableName - Table name.
+ */
+export declare function getTableWriteCheck(tableName: string): TableWriteCheck | undefined;
+/**
+ * Run `check` on a local save to `table`, as the host runs it on every synced row, so a local
+ * write and a synced write are judged by the same code. Nothing is checked in the personal
+ * context: only the user's own devices write it.
+ *
+ * @param table - The table being saved to.
+ * @param row - The row about to be stored.
+ * @param check - The table's rule.
+ */
+export declare function checkLocalSave<T extends {
+    [key: string]: any;
+}>(table: Table<T>, row: T, check: TableWriteCheck<T>): Promise<void>;
+/**
+ * Tables whose approvals are bound to a context (`signedContextId`) and whose deletes are open,
+ * so a deleted row's signing time is retained ({@link deletedSignedAt}).
+ */
+export declare const packageApprovalTables: ReadonlySet<string>;
+/**
+ * What a table's `signAndSave` (and a re-sign) puts under the signature: `signedAt`, now or
+ * just after the row on record when that was signed by a clock running ahead, so the new
+ * signature counts as the later one (and, for a package table, after the deleted row's
+ * retained stamp); for a package table also the context the approval is for.
+ *
+ * @param table - The table being signed for.
+ * @param row - The row being signed.
+ * @param current - A row already read from storage; membership repair may supply another id's row.
+ */
+export declare function signingStamp<T extends Record<string, any>>(table: Table<T>, row: T, current?: {
+    signedAt?: number;
+}): Promise<{
+    signedAt: number;
+    signedContextId?: string;
+}>;
+/**
+ * Read a deleted authority row's last signing time, optionally retaining the stored row's
+ * stamp before deletion. Device-local personal storage survives deletion and log compaction.
+ * Only pass `existing` from storage, never an unverified incoming candidate.
+ */
+export declare function deletedSignedAt(tableName: string, context: ITableWriteCheckContext, existing?: {
+    signedAt?: number;
+}): Promise<number>;
+/**
+ * An error refusing a write, carrying the {@link WRITE_NOT_AUTHORIZED} prefix.
+ *
+ * @param tableName - Table the write was for.
+ * @param reason - Why, for logs and the sync recovery queue.
+ */
+export declare function writeNotAuthorized(tableName: string, reason: string): Error;

package/dist/data/orm/write-checks.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.packageApprovalTables = exports.WRITE_NOT_AUTHORIZED = void 0;
+exports.registerTableWriteCheck = registerTableWriteCheck;
+exports.getTableWriteCheck = getTableWriteCheck;
+exports.checkLocalSave = checkLocalSave;
+exports.signingStamp = signingStamp;
+exports.deletedSignedAt = deletedSignedAt;
+exports.writeNotAuthorized = writeNotAuthorized;
+/**
+ * Prefix of every refusal from a {@link TableWriteCheck}. Sync recovery parks a change refused
+ * with it, and checks it again only from local history, when the group's authority changes.
+ */
+exports.WRITE_NOT_AUTHORIZED = "Write not authorized";
+const writeChecks = new Map();
+/**
+ * Register the {@link TableWriteCheck} for a table name. One per table; a second registration
+ * replaces the first.
+ *
+ * @param tableName - Table the check guards.
+ * @param check - The rule.
+ */
+function registerTableWriteCheck(tableName, check) {
+    writeChecks.set(tableName, check);
+}
+/**
+ * The {@link TableWriteCheck} registered for a table, if any.
+ *
+ * @param tableName - Table name.
+ */
+function getTableWriteCheck(tableName) {
+    return writeChecks.get(tableName);
+}
+/**
+ * Run `check` on a local save to `table`, as the host runs it on every synced row, so a local
+ * write and a synced write are judged by the same code. Nothing is checked in the personal
+ * context: only the user's own devices write it.
+ *
+ * @param table - The table being saved to.
+ * @param row - The row about to be stored.
+ * @param check - The table's rule.
+ */
+async function checkLocalSave(table, row, check) {
+    if (!table.groupId)
+        return;
+    const { getUserContext } = await Promise.resolve().then(() => require("../../context/user-context-singleton"));
+    const recordId = row[table.primaryKeyName];
+    await check(await table.get(recordId), row, {
+        dataContext: (await getUserContext()).getDataContext(table.groupId),
+        recordId,
+    });
+}
+/**
+ * Tables whose approvals are bound to a context (`signedContextId`) and whose deletes are open,
+ * so a deleted row's signing time is retained ({@link deletedSignedAt}).
+ */
+exports.packageApprovalTables = new Set(["Packages", "PackageVersions"]);
+/**
+ * What a table's `signAndSave` (and a re-sign) puts under the signature: `signedAt`, now or
+ * just after the row on record when that was signed by a clock running ahead, so the new
+ * signature counts as the later one (and, for a package table, after the deleted row's
+ * retained stamp); for a package table also the context the approval is for.
+ *
+ * @param table - The table being signed for.
+ * @param row - The row being signed.
+ * @param current - A row already read from storage; membership repair may supply another id's row.
+ */
+async function signingStamp(table, row, current) {
+    const { tableName, groupId, primaryKeyName } = table;
+    const recordId = row[primaryKeyName];
+    current ??= await table.get(recordId);
+    const packageTable = exports.packageApprovalTables.has(tableName);
+    let floor = current?.signedAt ?? 0;
+    if (packageTable && groupId && !current) {
+        const { getUserContext } = await Promise.resolve().then(() => require("../../context/user-context-singleton"));
+        const dataContext = (await getUserContext()).getDataContext(groupId);
+        floor = await deletedSignedAt(tableName, { dataContext, recordId });
+    }
+    return {
+        signedAt: Math.max(Date.now(), floor + 1),
+        ...(packageTable ? { signedContextId: groupId } : {}),
+    };
+}
+/**
+ * Read a deleted authority row's last signing time, optionally retaining the stored row's
+ * stamp before deletion. Device-local personal storage survives deletion and log compaction.
+ * Only pass `existing` from storage, never an unverified incoming candidate.
+ */
+async function deletedSignedAt(tableName, context, existing) {
+    if (!context.dataContext.groupId)
+        return 0;
+    const { PersistentVars } = await Promise.resolve().then(() => require("../persistent-vars"));
+    const vars = PersistentVars(context.dataContext.userContext.userDataContext);
+    const name = `authorityOrder:${context.dataContext.groupId}:${tableName}:${context.recordId}`;
+    const remembered = await vars.findOne({ name, scope: "device" });
+    const floor = Math.max(remembered?.value?.value ?? 0, existing?.signedAt ?? 0);
+    if (floor > (remembered?.value?.value ?? 0)) {
+        await vars.save({
+            persistentVarId: remembered?.persistentVarId ?? "",
+            name,
+            scope: "device",
+            value: { value: floor },
+        });
+    }
+    return floor;
+}
+/**
+ * An error refusing a write, carrying the {@link WRITE_NOT_AUTHORIZED} prefix.
+ *
+ * @param tableName - Table the write was for.
+ * @param reason - Why, for logs and the sync recovery queue.
+ */
+function writeNotAuthorized(tableName, reason) {
+    return new Error(`${exports.WRITE_NOT_AUTHORIZED}: ${tableName}: ${reason}`);
+}

package/dist/data/package-table-identity.d.ts

@@ -1,3 +1,4 @@
+import type { ITableDefinitionRecord } from "./table-definitions-table";
 /**
  * Validate a guest-supplied isolated-table or field identifier before it can
  * reach ORM-generated SQL.
@@ -12,6 +13,21 @@
  * @throws When the identifier is empty or contains SQL syntax.
  */
 export declare function validateIsolatedSqlIdentifier(identifier: string, label?: string): string;
+/**
+ * Validate a table's index declarations: each lists at least one of the table's fields, in
+ * order, by name or as `{ name, order }` with `"ASC"` or `"DESC"`.
+ *
+ * @param indexes - The declared indexes, if any.
+ * @param fieldNames - The table's field names.
+ * @param label - Where the indexes come from, for errors.
+ * @param allowUnique - Whether an index may be unique. A package may make one unique only on a
+ *   local-only table: on a synced table two devices can each write a row the other's unique
+ *   index refuses, and package tables have no conflict resolver. A stored definition may have
+ *   one anyway (an old-style package's).
+ * @throws When an index is malformed, names a field the table lacks, or is unique when not
+ *   allowed.
+ */
+export declare function validateTableIndexes(indexes: unknown, fieldNames: ReadonlySet<string>, label: string, allowUnique?: boolean): void;
 /**
  * Validate a package-local table name.
  *
@@ -44,3 +60,8 @@ export declare function packageScopedTableName(packageId: string, logicalName: s
  * @throws When package or table identity is invalid.
  */
 export declare function packageScopedTableId(packageId: string, logicalName: string): string;
+/**
+ * Validate synced schema metadata before it can name a table, column, or index in SQL.
+ * A schema cannot impersonate a system table or supply SQL expressions as identifiers.
+ */
+export declare function validateTableDefinitionRecord(record: ITableDefinitionRecord): void;

package/dist/data/package-table-identity.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateIsolatedSqlIdentifier = validateIsolatedSqlIdentifier;
+exports.validateTableIndexes = validateTableIndexes;
 exports.validatePackageTableName = validatePackageTableName;
 exports.packageScopedTableName = packageScopedTableName;
 exports.packageScopedTableId = packageScopedTableId;
+exports.validateTableDefinitionRecord = validateTableDefinitionRecord;
 const utils_1 = require("../utils");
 const ISOLATED_SQL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /**
@@ -28,6 +30,53 @@ function validateIsolatedSqlIdentifier(identifier, label = "Isolated SQL identif
     }
     return identifier;
 }
+/**
+ * Validate a table's index declarations: each lists at least one of the table's fields, in
+ * order, by name or as `{ name, order }` with `"ASC"` or `"DESC"`.
+ *
+ * @param indexes - The declared indexes, if any.
+ * @param fieldNames - The table's field names.
+ * @param label - Where the indexes come from, for errors.
+ * @param allowUnique - Whether an index may be unique. A package may make one unique only on a
+ *   local-only table: on a synced table two devices can each write a row the other's unique
+ *   index refuses, and package tables have no conflict resolver. A stored definition may have
+ *   one anyway (an old-style package's).
+ * @throws When an index is malformed, names a field the table lacks, or is unique when not
+ *   allowed.
+ */
+function validateTableIndexes(indexes, fieldNames, label, allowUnique = false) {
+    if (indexes === undefined)
+        return;
+    if (!Array.isArray(indexes))
+        throw new Error(`${label} must be an array`);
+    for (const [position, index] of indexes.entries()) {
+        const at = `${label}[${position}]`;
+        const { fields, unique } = (index ?? {});
+        if (!index ||
+            typeof index !== "object" ||
+            Object.keys(index).some((key) => key !== "fields" && key !== "unique") ||
+            !Array.isArray(fields) ||
+            fields.length === 0) {
+            throw new Error(`${at} must be { fields: [...] } with at least one field`);
+        }
+        if (unique !== undefined && (unique !== true || !allowUnique)) {
+            throw new Error(`${at} can be unique only on a local-only table`);
+        }
+        for (const field of fields) {
+            const name = typeof field === "string"
+                ? field
+                : field &&
+                    typeof field === "object" &&
+                    Object.keys(field).every((key) => key === "name" || key === "order") &&
+                    (field.order === "ASC" || field.order === "DESC")
+                    ? field.name
+                    : undefined;
+            if (typeof name !== "string" || !fieldNames.has(name)) {
+                throw new Error(`${at} names a field the table doesn't have`);
+            }
+        }
+    }
+}
 /**
  * Validate a package-local table name.
  *
@@ -69,3 +118,41 @@ function packageScopedTableName(packageId, logicalName) {
 function packageScopedTableId(packageId, logicalName) {
     return (0, utils_1.deterministicTableId)(packageScopedTableName(packageId, logicalName));
 }
+/**
+ * Validate synced schema metadata before it can name a table, column, or index in SQL.
+ * A schema cannot impersonate a system table or supply SQL expressions as identifiers.
+ */
+function validateTableDefinitionRecord(record) {
+    const meta = record.metaData;
+    if (!meta ||
+        !(0, utils_1.isid)(record.tableId) ||
+        meta.tableId !== record.tableId ||
+        (meta.packageId !== undefined && !(0, utils_1.isid)(meta.packageId))) {
+        throw new Error("Invalid table definition identity");
+    }
+    validateIsolatedSqlIdentifier(meta.name, "Table name");
+    validateIsolatedSqlIdentifier(meta.primaryKeyName, "Primary key");
+    if (record.name !== (0, utils_1.getFullTableName)(meta))
+        throw new Error("Table definition name mismatch");
+    if (!Number.isSafeInteger(record.versionNumber) ||
+        record.versionNumber < 0 ||
+        record.versionNumber !== (meta.versionNumber ?? 0)) {
+        throw new Error("Invalid table definition version");
+    }
+    if (meta.localOnly !== undefined && typeof meta.localOnly !== "boolean") {
+        throw new Error("Invalid table localOnly policy");
+    }
+    if (!Array.isArray(meta.fields) || !meta.fields.length)
+        throw new Error("Missing table fields");
+    const names = new Set();
+    for (const field of meta.fields) {
+        validateIsolatedSqlIdentifier(field.name, "Column name");
+        if (names.has(field.name))
+            throw new Error("Duplicate table column");
+        names.add(field.name);
+    }
+    if (!names.has(meta.primaryKeyName))
+        throw new Error("Missing primary key column");
+    // Only what reaches SQL here: an old-style package may keep a unique index on a synced table.
+    validateTableIndexes(meta.indexes, names, "Table indexes", true);
+}