@peers-app/peers-sdk 0.27.5 → 0.28.1

package/dist/data/package-version-resolver.d.ts

@@ -18,6 +18,8 @@ import { type PersistentVar } from "./persistent-vars";
 export interface IDevicePackagePrefs {
     /** Which PV this device currently runs */
     activePackageVersionId?: string;
+    /** Tag when this device explicitly selected the version; a later retag cannot opt it into dev. */
+    activePackageVersionTag?: string;
     /** Newer selected PV temporarily bypassed because this host could not run it. */
     compatibilityFallbackForPackageVersionId?: string;
     /** If true, never auto-update this package */
@@ -53,6 +55,19 @@ export declare function packagePrefsVar(packageId: string, dataContext?: DataCon
  *   omitted the var tracks the user's default group context.
  */
 export declare function updatePackagePrefs(packageId: string, prefs: Partial<IDevicePackagePrefs>, dataContext?: DataContext): Promise<void>;
+/**
+ * Check a selected version before evaluating any of its runtime, route or UI bundles.
+ * Group releases and shared selections must still have authorized signatures even when
+ * already on disk. Dev builds require an explicit device selection made while tagged dev.
+ *
+ * @param localDev - A host explicitly loading a local development checkout.
+ */
+export declare function assertPackageVersionRunnable(pkg: IPackage, pv: IPackageVersion, dataContext: DataContext, localDev?: boolean): Promise<void>;
+/**
+ * Verify fetched bundle bytes against the hash in the authorized version. Files rows may be
+ * changed by group members, so their own chunk hashes alone cannot authorize executable code.
+ */
+export declare function assertPackageBundleIntegrity(pv: IPackageVersion, kind: "package" | "routes" | "ui", contents: string | Uint8Array): void;
 /**
  * Effective device-local preferences for a package after merging the device's
  * raw prefs with the group-level `IPackage` defaults. Every field is resolved

package/dist/data/package-version-resolver.js

@@ -10,12 +10,16 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.packagePrefsVar = packagePrefsVar;
 exports.updatePackagePrefs = updatePackagePrefs;
+exports.assertPackageVersionRunnable = assertPackageVersionRunnable;
+exports.assertPackageBundleIntegrity = assertPackageBundleIntegrity;
 exports.getEffectivePackagePrefs = getEffectivePackagePrefs;
 exports.resolveDevicePackageVersion = resolveDevicePackageVersion;
 exports.hasDeviceFollowOverride = hasDeviceFollowOverride;
 exports.readStoredPackageLocalPath = readStoredPackageLocalPath;
 const user_context_singleton_1 = require("../context/user-context-singleton");
+const keys_1 = require("../keys");
 const assistants_1 = require("./assistants");
+const file_types_1 = require("./files/file.types");
 const group_member_roles_1 = require("./group-member-roles");
 const group_permissions_1 = require("./group-permissions");
 const package_versions_1 = require("./package-versions");
@@ -62,6 +66,13 @@ async function updatePackagePrefs(packageId, prefs, dataContext) {
         effectivePrefs = rest;
     }
     const next = { ...existing, ...effectivePrefs };
+    if ("activePackageVersionId" in effectivePrefs) {
+        const dc = dataContext ?? (await (0, user_context_singleton_1.getUserContext)()).defaultDataContext();
+        const selected = effectivePrefs.activePackageVersionId
+            ? await (0, package_versions_1.PackageVersions)(dc).get(effectivePrefs.activePackageVersionId)
+            : undefined;
+        next.activePackageVersionTag = selected?.versionTag;
+    }
     for (const key of Object.keys(next)) {
         if (next[key] === undefined) {
             delete next[key];
@@ -69,6 +80,58 @@ async function updatePackagePrefs(packageId, prefs, dataContext) {
     }
     pvar(next);
 }
+/**
+ * Check a selected version before evaluating any of its runtime, route or UI bundles.
+ * Group releases and shared selections must still have authorized signatures even when
+ * already on disk. Dev builds require an explicit device selection made while tagged dev.
+ *
+ * @param localDev - A host explicitly loading a local development checkout.
+ */
+async function assertPackageVersionRunnable(pkg, pv, dataContext, localDev = false) {
+    if (!dataContext.groupId)
+        return;
+    if (pv.packageId !== pkg.packageId)
+        throw new Error("Package version belongs to another package");
+    const { isPackageRowAdminSigned } = await Promise.resolve().then(() => require("./authority-write-checks"));
+    const { getTableWriteCheck } = await Promise.resolve().then(() => require("./orm/write-checks"));
+    await getTableWriteCheck("PackageVersions")?.(undefined, pv, {
+        dataContext,
+        recordId: pv.packageVersionId,
+    });
+    if (!localDev) {
+        const prefs = packagePrefsVar(pkg.packageId, dataContext);
+        await prefs.loadingPromise;
+        let selection = prefs();
+        const deviceSelected = selection?.activePackageVersionId === pv.packageVersionId;
+        if (selection && deviceSelected && !selection.activePackageVersionTag) {
+            // A selection saved before 0.28.0 has no tag. Record this version's tag once when this
+            // device's own user signed the version (their own build or release), so it keeps running;
+            // a version someone else retagged still needs a fresh activation.
+            const me = await dataContext.userContext.getMe();
+            if (me?.publicKey && (0, keys_1.signedByKey)(pv) === me.publicKey) {
+                selection = { ...selection, activePackageVersionTag: pv.versionTag };
+                prefs(selection);
+            }
+        }
+        if (!deviceSelected && !(await isPackageRowAdminSigned(pkg, dataContext))) {
+            throw new Error("A group package selection needs an Admin's signature before it can run");
+        }
+        if (pv.versionTag === "dev" &&
+            (!deviceSelected || selection?.activePackageVersionTag !== "dev")) {
+            throw new Error("Activate this dev version on this device before running it");
+        }
+    }
+}
+/**
+ * Verify fetched bundle bytes against the hash in the authorized version. Files rows may be
+ * changed by group members, so their own chunk hashes alone cannot authorize executable code.
+ */
+function assertPackageBundleIntegrity(pv, kind, contents) {
+    const expected = pv[`${kind}BundleFileHash`];
+    if (!expected || (0, file_types_1.computeFileHash)(contents) !== expected) {
+        throw new Error(`Package ${kind} bundle hash does not match the authorized version`);
+    }
+}
 /**
  * Pure function: merge raw device prefs with the group-level `IPackage`
  * defaults to produce fully-resolved effective preferences. Used by the
@@ -221,7 +284,7 @@ async function resolveDevicePackageVersion(pkg, dataContext, opts) {
     const allVersions = await (0, package_versions_1.PackageVersions)(dataContext).list({ packageId: pkg.packageId });
     let bestPv = activePv;
     for (const candidate of allVersions) {
-        if (candidate.packageVersionId === effectiveActivePvId)
+        if (candidate.packageVersionId === effectiveActivePvId || candidate.versionTag === "dev")
             continue;
         const tagOk = (0, package_versions_1.doesTagMatch)(activePv?.versionTag, candidate.versionTag, followTags, undefined);
         if (!tagOk)
@@ -297,7 +360,10 @@ async function resolveDevicePackageVersion(pkg, dataContext, opts) {
                 const role = await (0, group_permissions_1.getUserRole)(groupId, userCtx.userId);
                 if (role >= group_member_roles_1.GroupMemberRole.Admin) {
                     const freshPkg = await (0, packages_1.Packages)(dataContext).get(pkg.packageId);
-                    if (freshPkg) {
+                    const { isPackageRowAdminSigned } = await Promise.resolve().then(() => require("./authority-write-checks"));
+                    // Loading can span a sync that deletes and re-adds this package. Advancing a release
+                    // must not endorse a Writer's replacement publisher key, URL or follow policy.
+                    if (freshPkg && (await isPackageRowAdminSigned(freshPkg, dataContext))) {
                         if (freshPkg.activePackageVersionId !== bestPv.packageVersionId) {
                             freshPkg.activePackageVersionId = bestPv.packageVersionId;
                             await (0, packages_1.Packages)(dataContext).signAndSave(freshPkg);
@@ -326,7 +392,8 @@ async function loadOlderCompatiblePackageVersion(pkg, dataContext, unavailableVe
     const versions = await (0, package_versions_1.PackageVersions)(dataContext).list({ packageId: pkg.packageId });
     const candidates = versions
         .filter((candidate) => {
-        if (candidate.packageVersionId === unavailableVersion.packageVersionId) {
+        if (candidate.packageVersionId === unavailableVersion.packageVersionId ||
+            candidate.versionTag === "dev") {
             return false;
         }
         if ((0, package_versions_1.isNewerVersion)(unavailableVersion.version, candidate.version)) {

package/dist/data/package-versions.d.ts

@@ -48,63 +48,69 @@ declare const schema: z.ZodObject<{
         by: string;
     }>, "many">>;
     signature: z.ZodString;
+    signedContextId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    signedAt: z.ZodOptional<z.ZodNumber>;
     createdBy: z.ZodEffects<z.ZodString, string, string>;
     createdAt: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     version: string;
     signature: string;
     packageId: string;
-    createdAt: string;
-    createdBy: string;
     packageVersionId: string;
     packageVersionHash: string;
     packageBundleFileId: string;
     packageBundleFileHash: string;
+    createdBy: string;
+    createdAt: string;
     history?: {
         at: string;
         action: string;
         signature: string;
         by: string;
     }[] | undefined;
+    signedAt?: number | undefined;
+    signedContextId?: string | undefined;
+    versionTag?: string | undefined;
+    routesBundleFileId?: string | undefined;
+    routesBundleFileHash?: string | undefined;
+    uiBundleFileId?: string | undefined;
+    uiBundleFileHash?: string | undefined;
     appNavs?: {
         name: string;
         iconClassName: string;
         navigationPath: string;
         displayName?: string | undefined;
     }[] | undefined;
-    versionTag?: string | undefined;
-    routesBundleFileId?: string | undefined;
-    routesBundleFileHash?: string | undefined;
-    uiBundleFileId?: string | undefined;
-    uiBundleFileHash?: string | undefined;
     packageAuthorSignature?: string | undefined;
 }, {
     version: string;
     signature: string;
     packageId: string;
-    createdAt: string;
-    createdBy: string;
     packageVersionId: string;
     packageVersionHash: string;
     packageBundleFileId: string;
     packageBundleFileHash: string;
+    createdBy: string;
+    createdAt: string;
     history?: {
         at: string;
         action: string;
         signature: string;
         by: string;
     }[] | undefined;
+    signedAt?: number | undefined;
+    signedContextId?: string | undefined;
+    versionTag?: string | undefined;
+    routesBundleFileId?: string | undefined;
+    routesBundleFileHash?: string | undefined;
+    uiBundleFileId?: string | undefined;
+    uiBundleFileHash?: string | undefined;
     appNavs?: {
         name: string;
         iconClassName: string;
         navigationPath: string;
         displayName?: string | undefined;
     }[] | undefined;
-    versionTag?: string | undefined;
-    routesBundleFileId?: string | undefined;
-    routesBundleFileHash?: string | undefined;
-    uiBundleFileId?: string | undefined;
-    uiBundleFileHash?: string | undefined;
     packageAuthorSignature?: string | undefined;
 }>;
 /** A signed package build and its bundle hashes, tag, and lifecycle history. */

package/dist/data/package-versions.js

@@ -45,11 +45,12 @@ const context_1 = require("../context");
 const keys_1 = require("../keys");
 const app_nav_1 = require("../types/app-nav");
 const zod_types_1 = require("../types/zod-types");
+const authority_write_checks_1 = require("./authority-write-checks");
 const decorators_1 = require("./orm/decorators");
 const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
-const package_version_permissions_1 = require("./package-version-permissions");
+const write_checks_1 = require("./orm/write-checks");
 const schema = zod_1.z.object({
     packageVersionId: zod_types_1.zodPeerId,
     packageId: zod_types_1.zodPeerId.describe("The package this version belongs to"),
@@ -81,6 +82,13 @@ const schema = zod_1.z.object({
         .optional()
         .describe("Audit trail of lifecycle events for this version"),
     signature: zod_1.z.string().describe("The signed hash of this data excluding the signature itself"),
+    signedContextId: zod_types_1.zodPeerId
+        .optional()
+        .describe("The context this version approval was signed for"),
+    signedAt: zod_1.z
+        .number()
+        .optional()
+        .describe("When the signer signed this row (ms since epoch), under the signature: a copy of an earlier row can't replace a later one"),
     createdBy: zod_types_1.zodPeerId.describe("The user who created this version"),
     createdAt: zod_1.z.string().describe("ISO timestamp of when this version was created"),
 });
@@ -115,14 +123,9 @@ let PackageVersionsTable = (() => {
             return this.save(packageVersion, opts);
         }
         async save(packageVersion, opts) {
-            if (PackageVersionsTable.isPassthrough) {
-                return super.save(packageVersion, opts);
-            }
-            if (!this.groupId) {
-                // users can do whatever they want to package versions in their personal space
-                return super.save(packageVersion, opts);
+            if (!PackageVersionsTable.isPassthrough) {
+                await (0, write_checks_1.checkLocalSave)(this, packageVersion, authority_write_checks_1.checkPackageVersion);
             }
-            await (0, package_version_permissions_1.verifyPackageVersionSignature)(packageVersion, this.groupId);
             return super.save(packageVersion, opts);
         }
         async signAndSave(packageVersion, opts) {
@@ -130,7 +133,10 @@ let PackageVersionsTable = (() => {
             if (!sign) {
                 throw new Error("Package version signing is not enabled. Call PackageVersionsTable.enablePackageVersionSigning(fn) to enable it.");
             }
-            packageVersion = await sign.call(PackageVersionsTable, packageVersion);
+            packageVersion = await sign.call(PackageVersionsTable, {
+                ...packageVersion,
+                ...(await (0, write_checks_1.signingStamp)(this, packageVersion)),
+            });
             return this.save(packageVersion, opts);
         }
         /** Registers the signer for all SDK copies in this JavaScript realm. Replaces any prior signer. */

package/dist/data/packages.d.ts

@@ -15,6 +15,8 @@ declare const schema: z.ZodObject<{
     updateUrl: z.ZodOptional<z.ZodString>;
     publishPublicKey: z.ZodString;
     signature: z.ZodString;
+    signedContextId: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    signedAt: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     name: string;
     description: string;
@@ -23,6 +25,8 @@ declare const schema: z.ZodObject<{
     createdBy: string;
     publishPublicKey: string;
     disabled?: boolean | undefined;
+    signedAt?: number | undefined;
+    signedContextId?: string | undefined;
     remoteRepo?: string | undefined;
     activePackageVersionId?: string | undefined;
     versionFollowRange?: "pinned" | "patch" | "minor" | "latest" | undefined;
@@ -36,6 +40,8 @@ declare const schema: z.ZodObject<{
     createdBy: string;
     publishPublicKey: string;
     disabled?: boolean | undefined;
+    signedAt?: number | undefined;
+    signedContextId?: string | undefined;
     remoteRepo?: string | undefined;
     activePackageVersionId?: string | undefined;
     versionFollowRange?: "pinned" | "patch" | "minor" | "latest" | undefined;
@@ -53,7 +59,6 @@ export declare class PackagesTable extends Table<IPackage> {
     signAndSave(packageObj: IPackage, opts?: ISaveOptions): Promise<IPackage>;
     /** Registers the signer for all SDK copies in this JavaScript realm. Replaces any prior signer. */
     static enablePackageSigning(fn: (packageObj: IPackage) => IPackage): void;
-    delete(packageId: string): Promise<void>;
 }
 /** Returns the Packages table for the given context or the current default context. */
 export declare function Packages(dataContext?: DataContext): PackagesTable;

package/dist/data/packages.js

@@ -39,11 +39,12 @@ exports.Packages = Packages;
 const zod_1 = require("zod");
 const context_1 = require("../context");
 const zod_types_1 = require("../types/zod-types");
+const authority_write_checks_1 = require("./authority-write-checks");
 const decorators_1 = require("./orm/decorators");
 const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
-const package_permissions_1 = require("./package-permissions");
+const write_checks_1 = require("./orm/write-checks");
 const persistent_vars_1 = require("./persistent-vars");
 const schema = zod_1.z.object({
     packageId: zod_types_1.zodPeerId,
@@ -75,6 +76,13 @@ const schema = zod_1.z.object({
         .describe("Ed25519 public key (base64url) of the package publisher. " +
         "Set at package creation; used as TOFU anchor for verifying packageAuthorSignature on versions."),
     signature: zod_1.z.string().describe("The signed hash of this data excluding the signature itself"),
+    signedContextId: zod_types_1.zodPeerId
+        .optional()
+        .describe("The context this package approval was signed for"),
+    signedAt: zod_1.z
+        .number()
+        .optional()
+        .describe("When the signer signed this row (ms since epoch), under the signature: a copy of an earlier row can't replace a later one"),
 });
 const metaData = {
     name: "Packages",
@@ -106,14 +114,8 @@ let PackagesTable = (() => {
             return this.save(packageObj, opts);
         }
         async save(packageObj, opts) {
-            if (PackagesTable.isPassthrough) {
-                return super.save(packageObj, opts);
-            }
-            if (!this.groupId) {
-                // users can do whatever they want to packages in their personal space
-                return super.save(packageObj, opts);
-            }
-            await (0, package_permissions_1.verifyPackageSignature)(packageObj, this.groupId);
+            if (!PackagesTable.isPassthrough)
+                await (0, write_checks_1.checkLocalSave)(this, packageObj, authority_write_checks_1.checkPackageWrite);
             return super.save(packageObj, opts);
         }
         async signAndSave(packageObj, opts) {
@@ -121,23 +123,16 @@ let PackagesTable = (() => {
             if (!sign) {
                 throw new Error("Package signing is not enabled. Call PackagesTable.enablePackageSigning(fn) to enable it.");
             }
-            packageObj = await sign.call(PackagesTable, packageObj);
+            packageObj = await sign.call(PackagesTable, {
+                ...packageObj,
+                ...(await (0, write_checks_1.signingStamp)(this, packageObj)),
+            });
             return this.save(packageObj, opts);
         }
         /** Registers the signer for all SDK copies in this JavaScript realm. Replaces any prior signer. */
         static enablePackageSigning(fn) {
             signingGlobals[signingKey] = fn;
         }
-        async delete(packageId) {
-            // anyone (with write permissions) can delete packages since that isn't a security risk (unless something else is relying on a package to be present?)
-            return super.delete(packageId);
-            // const userContext = await getUserContext();
-            // const userContextPackages = Packages(userContext.userDataContext);
-            // if (userContextPackages === this) {
-            //   return super.delete(packageId);
-            // }
-            // throw new Error('Only deleting packages from the user context Packages table is allowed');
-        }
         constructor() {
             super(...arguments);
             __runInitializers(this, _instanceExtraInitializers);

package/dist/data/persistent-vars.js

@@ -373,54 +373,17 @@ function persistentVarFactory(name, opts) {
                     }
                     return userContext.userDataContext;
                 }
-                /**
-                 * Before storage was unified in the personal DB, a `groupDevice` /
-                 * `groupUser` var created with an explicit group `dataContext` was
-                 * written to that group's DB. Return that legacy location so an
-                 * existing value can be migrated forward, or `undefined` when there is
-                 * no distinct legacy location for this variable.
-                 */
-                function getLegacyStorageDataContext() {
-                    if (scope !== "groupDevice" && scope !== "groupUser") {
-                        return undefined;
-                    }
-                    const pinned = opts?.dataContext;
-                    if (!pinned || pinned.dataContextId === userContext.userDataContext.dataContextId) {
-                        return undefined;
-                    }
-                    return pinned;
-                }
                 function getVarNameInDb() {
                     const dc = opts?.dataContext || userContext.defaultDataContext();
                     return (0, persistent_var_identity_1.persistentVarStorageName)(name, scope, dc?.dataContextId);
                 }
-                /**
-                 * Copy a record left in a group DB by the pre-unification storage rule
-                 * into the personal DB. Secrets are skipped because their ciphertext is
-                 * bound to the group key and cannot be moved verbatim. The legacy row is
-                 * left in place: older builds on other devices may still read it, and
-                 * the personal copy is authoritative from here on.
-                 */
-                async function migrateLegacyRec(table, name) {
-                    const legacyContext = getLegacyStorageDataContext();
-                    if (!legacyContext) {
-                        return undefined;
-                    }
-                    const legacyRec = await PersistentVars(legacyContext).findOne({ name });
-                    if (!legacyRec || legacyRec.scope !== scope || legacyRec.isSecret) {
-                        return undefined;
-                    }
-                    const { persistentVarId: _legacyId, ...rest } = legacyRec;
-                    return table.save({ ...rest, persistentVarId: "" }, { weakInsert: true });
-                }
                 async function loadRecFromDb() {
                     const dc = getStorageDataContext();
                     const table = PersistentVars(dc);
                     const name = getVarNameInDb();
                     let dbRec = await table.findOne({ name });
-                    if (!dbRec) {
-                        dbRec = await migrateLegacyRec(table, name);
-                    }
+                    // Group rows are member-writable. They cannot bootstrap personal/device settings,
+                    // including explicit permission to run a package's dev version on this device.
                     // Preserve an existing secret unless the caller explicitly changes that setting.
                     if (dbRec?.isSecret !== undefined && opts.isSecret === undefined) {
                         isSecret = dbRec.isSecret;

package/dist/data/sync-recovery-queue.d.ts

@@ -10,7 +10,7 @@ export declare const SYNC_RECOVERY_STUCK_ATTEMPTS = 5;
 /** How long a still-retrying entry must have been failing before it is stuck. */
 export declare const SYNC_RECOVERY_STUCK_AGE_MS: number;
 /** Why automatic recovery stopped asking peers for an entry. */
-export declare const syncRecoveryParkedReasons: readonly ["schema", "unique-conflict", "unresolvable"];
+export declare const syncRecoveryParkedReasons: readonly ["schema", "unique-conflict", "unresolvable", "authorization"];
 /** Why automatic recovery stopped asking peers for an entry. */
 export type SyncRecoveryParkedReason = (typeof syncRecoveryParkedReasons)[number];
 /** One recorded materialization failure for a synchronized record. */
@@ -50,7 +50,7 @@ export declare const syncRecoveryEntrySchema: z.ZodObject<{
     }>, "many">;
     /** Set when peer retry has stopped. Absent while the entry is still retrying. */
     parkedAt: z.ZodOptional<z.ZodNumber>;
-    parkedReason: z.ZodOptional<z.ZodEnum<["schema", "unique-conflict", "unresolvable"]>>;
+    parkedReason: z.ZodOptional<z.ZodEnum<["schema", "unique-conflict", "unresolvable", "authorization"]>>;
     /** Earliest time a retrying entry should ask peers again. */
     nextAttemptAt: z.ZodOptional<z.ZodNumber>;
     /**
@@ -71,7 +71,7 @@ export declare const syncRecoveryEntrySchema: z.ZodObject<{
         sourceDeviceId?: string | undefined;
     }[];
     parkedAt?: number | undefined;
-    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | undefined;
+    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | "authorization" | undefined;
     nextAttemptAt?: number | undefined;
     sweepCount?: number | undefined;
 }, {
@@ -87,7 +87,7 @@ export declare const syncRecoveryEntrySchema: z.ZodObject<{
         sourceDeviceId?: string | undefined;
     }[];
     parkedAt?: number | undefined;
-    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | undefined;
+    parkedReason?: "schema" | "unique-conflict" | "unresolvable" | "authorization" | undefined;
     nextAttemptAt?: number | undefined;
     sweepCount?: number | undefined;
 }>;

package/dist/data/sync-recovery-queue.js

@@ -20,7 +20,13 @@ exports.SYNC_RECOVERY_STUCK_ATTEMPTS = 5;
 /** How long a still-retrying entry must have been failing before it is stuck. */
 exports.SYNC_RECOVERY_STUCK_AGE_MS = 10 * 60 * 1000;
 /** Why automatic recovery stopped asking peers for an entry. */
-exports.syncRecoveryParkedReasons = ["schema", "unique-conflict", "unresolvable"];
+exports.syncRecoveryParkedReasons = [
+    "schema",
+    "unique-conflict",
+    "unresolvable",
+    /** A write check refused the row; rechecked from local history when the group's authority changes. */
+    "authorization",
+];
 /** One recorded materialization failure for a synchronized record. */
 exports.syncRecoveryFailureSchema = zod_1.z.object({
     error: zod_1.z.string(),

package/dist/data/tool-access-approvals.d.ts

@@ -50,8 +50,8 @@ export declare const toolAccessApprovalSchema: z.ZodObject<{
     toolName: string;
     toolId: string;
     scope: ToolAccessApprovalScope;
-    dataContextId: string;
     createdAt: Date;
+    dataContextId: string;
     expiresAt: Date;
     toolAccessApprovalId: string;
     argsHash: string;
@@ -81,8 +81,8 @@ export declare const toolAccessApprovalSchema: z.ZodObject<{
     };
     status?: ToolAccessApprovalStatus | undefined;
     scope?: ToolAccessApprovalScope | undefined;
-    assistantId?: string | undefined;
     createdAt?: Date | undefined;
+    assistantId?: string | undefined;
     workflowRunId?: string | undefined;
     workflowLogId?: string | undefined;
     threadMessageId?: string | undefined;
@@ -106,8 +106,8 @@ export declare function ToolAccessApprovals(dataContext?: DataContext): import("
     toolName: string;
     toolId: string;
     scope: ToolAccessApprovalScope;
-    dataContextId: string;
     createdAt: Date;
+    dataContextId: string;
     expiresAt: Date;
     toolAccessApprovalId: string;
     argsHash: string;

package/dist/data/user-permissions.d.ts

@@ -1,12 +1,33 @@
 import type { IUser } from "./users";
 /**
- * Signs a user object with the provided secret key. The `anchors` list is kept on the row
- * but is not covered by the signature; see {@link verifyUserSignature}.
+ * Signs a user's profile and separately signs its initial anchor list. Later anchor changes
+ * are still authorized by the anchors on record; see {@link verifyUserSignature}.
  * @param user The user object to sign
  * @param secretKey The secret key to sign with
  * @returns IUser The signed user object
  */
 export declare function signUserObject(user: IUser, secretKey: string): IUser;
+/** Whether the profile owner authorized this exact initial anchor list, before any anchors exist. */
+export declare function hasSignedUserAnchors(user: IUser): boolean;
+/**
+ * Whether a Users row is signed by its own `publicKey` (its anchor list is not signed): the
+ * only rows a group's authority takes a member's key from.
+ *
+ * @param user - A Users row.
+ */
+export declare function isSelfSignedUser(user: IUser): boolean;
+/**
+ * Whether two profiles or authenticated devices name the same user and both of their keys.
+ * This compares identity only; callers still verify signatures or the transport separately.
+ */
+export declare function sameUserIdentity(a: Pick<IUser, "userId" | "publicKey" | "publicBoxKey">, b: Pick<IUser, "userId" | "publicKey" | "publicBoxKey">): boolean;
+/**
+ * `source`'s anchor list with the owner's signature over it, to spread onto a profile or an
+ * invite identity; nothing when `source` has no list.
+ *
+ * @param source - The row or identity the list is taken from.
+ */
+export declare function anchorFields(source: Pick<IUser, "anchors" | "anchorsSignature">): Pick<IUser, "anchors" | "anchorsSignature">;
 /**
  * Verifies that a user update signature is valid, throws on invalid signature.
  * The `anchors` list is not part of what is verified.
@@ -21,3 +42,13 @@ export declare function verifyUserSignature(user: IUser, oldUser?: IUser): void;
  * @throws Error if the signature is missing, invalid, or by another key
  */
 export declare function verifyUserSignedBySelf(user: IUser): void;
+/**
+ * Whether `user`'s current key is `earlierKey`, or was handed over from it: `earlierKey` is in
+ * `keySuccession` and each link from there on is signed by its key and names the next (the
+ * last names `publicKey`). A forged profile can't produce this, since only the holder of
+ * `earlierKey` can sign its handover. The list itself sits under the profile's own signature.
+ *
+ * @param user - A profile row whose own signature has been checked.
+ * @param earlierKey - The key a grant or record names.
+ */
+export declare function keySucceeds(user: IUser, earlierKey: string): boolean;