@peers-app/peers-sdk 0.27.5 → 0.28.1

package/dist/data/user-permissions.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signUserObject = signUserObject;
+exports.hasSignedUserAnchors = hasSignedUserAnchors;
+exports.isSelfSignedUser = isSelfSignedUser;
+exports.sameUserIdentity = sameUserIdentity;
+exports.anchorFields = anchorFields;
 exports.verifyUserSignature = verifyUserSignature;
 exports.verifyUserSignedBySelf = verifyUserSignedBySelf;
+exports.keySucceeds = keySucceeds;
+const anchor_document_1 = require("../identity/anchor-document");
 const keys_1 = require("../keys");
 /**
- * The part of a `Users` row the owner signs: everything but `anchors`.
+ * The profile the owner signs: everything but the separately authorized anchor list.
  *
  * The anchor list on record is decided by the anchors themselves (the on-record rule), not
  * by whoever wrote the row. A peer that confirms a key change stores the row with the list
@@ -13,19 +19,68 @@ const keys_1 = require("../keys");
  * must still verify, so the list is carried beside the signature rather than under it.
  */
 function signedPart(user) {
-    const { anchors: _anchors, ...rest } = user;
+    const { anchors: _anchors, anchorsSignature: _anchorsSignature, ...rest } = user;
     return rest;
 }
 /**
- * Signs a user object with the provided secret key. The `anchors` list is kept on the row
- * but is not covered by the signature; see {@link verifyUserSignature}.
+ * Signs a user's profile and separately signs its initial anchor list. Later anchor changes
+ * are still authorized by the anchors on record; see {@link verifyUserSignature}.
  * @param user The user object to sign
  * @param secretKey The secret key to sign with
  * @returns IUser The signed user object
  */
 function signUserObject(user, secretKey) {
     const signed = (0, keys_1.addSignatureToObject)(signedPart(user), secretKey);
-    return user.anchors ? { ...signed, anchors: user.anchors } : signed;
+    return user.anchors
+        ? {
+            ...signed,
+            anchors: user.anchors,
+            anchorsSignature: (0, keys_1.addSignatureToObject)(anchorStatement(user), secretKey).signature,
+        }
+        : signed;
+}
+function anchorStatement(user) {
+    return {
+        purpose: "peers-user-anchors",
+        userId: user.userId,
+        publicKey: user.publicKey,
+        anchors: user.anchors ?? [],
+    };
+}
+/** Whether the profile owner authorized this exact initial anchor list, before any anchors exist. */
+function hasSignedUserAnchors(user) {
+    const statement = { ...anchorStatement(user), signature: user.anchorsSignature };
+    return !!user.publicKey && (0, keys_1.signedByKey)(statement) === user.publicKey;
+}
+/**
+ * Whether a Users row is signed by its own `publicKey` (its anchor list is not signed): the
+ * only rows a group's authority takes a member's key from.
+ *
+ * @param user - A Users row.
+ */
+function isSelfSignedUser(user) {
+    return !!user.publicKey && (0, keys_1.signedByKey)(signedPart(user)) === user.publicKey;
+}
+/**
+ * Whether two profiles or authenticated devices name the same user and both of their keys.
+ * This compares identity only; callers still verify signatures or the transport separately.
+ */
+function sameUserIdentity(a, b) {
+    return a.userId === b.userId && a.publicKey === b.publicKey && a.publicBoxKey === b.publicBoxKey;
+}
+/**
+ * `source`'s anchor list with the owner's signature over it, to spread onto a profile or an
+ * invite identity; nothing when `source` has no list.
+ *
+ * @param source - The row or identity the list is taken from.
+ */
+function anchorFields(source) {
+    if (!source.anchors?.length)
+        return {};
+    return {
+        anchors: source.anchors,
+        ...(source.anchorsSignature ? { anchorsSignature: source.anchorsSignature } : {}),
+    };
 }
 /**
  * Verifies that a user update signature is valid, throws on invalid signature.
@@ -69,9 +124,31 @@ function verifyUserSignedBySelf(user) {
     if (!user.signature) {
         throw new Error("A confirmed key change still has to be signed by the new key");
     }
-    (0, keys_1.verifyObjectSignature)(signedPart(user));
-    const signerPublicKey = (0, keys_1.getPublicKeyFromObjectSignature)(user) ?? "";
-    if (signerPublicKey !== user.publicKey) {
-        throw new Error("User signature must be signed with their own public key");
-    }
+    verifyUserSignature(user);
+}
+/**
+ * Whether `user`'s current key is `earlierKey`, or was handed over from it: `earlierKey` is in
+ * `keySuccession` and each link from there on is signed by its key and names the next (the
+ * last names `publicKey`). A forged profile can't produce this, since only the holder of
+ * `earlierKey` can sign its handover. The list itself sits under the profile's own signature.
+ *
+ * @param user - A profile row whose own signature has been checked.
+ * @param earlierKey - The key a grant or record names.
+ */
+function keySucceeds(user, earlierKey) {
+    if (user.publicKey === earlierKey)
+        return true;
+    const links = user.keySuccession ?? [];
+    const start = links.findIndex((link) => link.publicKey === earlierKey);
+    if (start < 0)
+        return false;
+    return links.slice(start).every((link, i, rest) => (0, anchor_document_1.verifySuccession)({
+        userId: user.userId,
+        recordPublicKey: link.publicKey,
+        entry: {
+            publicKey: rest[i + 1]?.publicKey ?? user.publicKey,
+            issuedAt: link.issuedAt,
+            authorizedBy: { publicKey: link.publicKey, signature: link.signature },
+        },
+    }));
 }

package/dist/data/users.d.ts

@@ -1,7 +1,29 @@
 import { z } from "zod";
 import type { DataContext } from "../context/data-context";
+import type { UserRowChangeDecision } from "../identity/user-row-change";
 import type { ISaveOptions } from "./orm/data-query";
 import { Table } from "./orm/table";
+/** Most earlier keys a profile carries; a rotation past this drops the oldest. */
+export declare const MAX_KEY_SUCCESSION = 8;
+/**
+ * One earlier key and its handover: `signature` is that key's signature over the
+ * `peers-key-succession` statement naming the next key (see `signSuccession`).
+ */
+export declare const keySuccessionLinkSchema: z.ZodObject<{
+    publicKey: z.ZodString;
+    issuedAt: z.ZodString;
+    signature: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    publicKey: string;
+    signature: string;
+    issuedAt: string;
+}, {
+    publicKey: string;
+    signature: string;
+    issuedAt: string;
+}>;
+/** One earlier key and its signed handover to the next. */
+export type IKeySuccessionLink = z.infer<typeof keySuccessionLinkSchema>;
 /** Schema for a signed user profile. */
 export declare const userSchema: z.ZodObject<{
     userId: z.ZodEffects<z.ZodString, string, string>;
@@ -18,6 +40,20 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }>, "many">>;
+    anchorsSignature: z.ZodOptional<z.ZodString>;
+    keySuccession: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        publicKey: z.ZodString;
+        issuedAt: z.ZodString;
+        signature: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }, {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }>, "many">>;
     signature: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     name: string;
@@ -29,6 +65,12 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
+    keySuccession?: {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }[] | undefined;
 }, {
     name: string;
     publicKey: string;
@@ -39,6 +81,12 @@ export declare const userSchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
+    keySuccession?: {
+        publicKey: string;
+        signature: string;
+        issuedAt: string;
+    }[] | undefined;
 }>;
 /** A signed user profile shared across personal and group contexts. */
 export type IUser = z.infer<typeof userSchema>;
@@ -47,24 +95,13 @@ export type IUser = z.infer<typeof userSchema>;
  * which would otherwise call the resolver again.
  */
 export declare function writeResolvedUserKey(dataContext: DataContext, user: IUser): Promise<IUser>;
-/** Outcome of a {@link UserRowChangeGuard}. See `resolveUserRowChange` in the identity module. */
-export type UserRowChangeVerdict = {
-    action: "apply";
-    row: IUser;
-} | {
-    action: "defer";
-    reason: string;
-} | {
-    action: "refuse";
-    reason: string;
-};
 /**
  * Consulted by {@link UsersTable.save} when another user's row already exists in the table.
  * Decides whether a different key or anchor list may be stored, against the anchors on
  * record. `apply` carries the row to store, whose `anchors` may have been replaced by the
  * list on record.
  */
-export type UserRowChangeGuard = (personalContext: DataContext, incoming: IUser, existing: IUser) => Promise<UserRowChangeVerdict>;
+export type UserRowChangeGuard = (personalContext: DataContext, incoming: IUser, existing: IUser) => Promise<UserRowChangeDecision>;
 /** Installs the identity check used by {@link UsersTable.save}. The identity module sets this. */
 export declare function setUserRowChangeGuard(guard: UserRowChangeGuard | undefined): void;
 /** User table with owner-signature enforcement outside the personal context. */

package/dist/data/users.js

@@ -34,7 +34,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     done = true;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UsersTable = exports.userSchema = void 0;
+exports.UsersTable = exports.userSchema = exports.keySuccessionLinkSchema = exports.MAX_KEY_SUCCESSION = void 0;
 exports.writeResolvedUserKey = writeResolvedUserKey;
 exports.setUserRowChangeGuard = setUserRowChangeGuard;
 exports.Users = Users;
@@ -50,6 +50,17 @@ const table_1 = require("./orm/table");
 const table_definitions_system_1 = require("./orm/table-definitions.system");
 const types_1 = require("./orm/types");
 const user_permissions_1 = require("./user-permissions");
+/** Most earlier keys a profile carries; a rotation past this drops the oldest. */
+exports.MAX_KEY_SUCCESSION = 8;
+/**
+ * One earlier key and its handover: `signature` is that key's signature over the
+ * `peers-key-succession` statement naming the next key (see `signSuccession`).
+ */
+exports.keySuccessionLinkSchema = zod_1.z.object({
+    publicKey: zod_1.z.string(),
+    issuedAt: zod_1.z.string(),
+    signature: zod_1.z.string(),
+});
 /** Schema for a signed user profile. */
 exports.userSchema = zod_1.z.object({
     userId: zod_types_1.zodPeerId,
@@ -62,6 +73,15 @@ exports.userSchema = zod_1.z.object({
         .array(anchor_document_1.anchorRefSchema)
         .optional()
         .describe("Anchors on record for this user. A peer that already has a list updates it from those anchors, not from a row that arrives with a new key. Not covered by the row's signature"),
+    anchorsSignature: zod_1.z
+        .string()
+        .optional()
+        .describe("Owner's signature authorizing the first anchor list"),
+    keySuccession: zod_1.z
+        .array(exports.keySuccessionLinkSchema)
+        .max(exports.MAX_KEY_SUCCESSION)
+        .optional()
+        .describe("This user's earlier signing keys, oldest first, each with its signature handing over to the next key (the last to publicKey). A group membership granted to an earlier key still counts for the current one"),
     signature: zod_1.z
         .string()
         .optional()

package/dist/data/workflows.d.ts

@@ -3,6 +3,7 @@ export declare function Workflows(dataContext?: DataContext): import("..").Table
     name: string;
     description: string;
     updatedAt: Date;
+    createdBy: string;
     createdAt: Date;
     workflowId: string;
     defaultAssistantId: string;
@@ -12,6 +13,5 @@ export declare function Workflows(dataContext?: DataContext): import("..").Table
         directCallToolId?: string | undefined;
         subWorkflowId?: string | undefined;
     }[];
-    createdBy: string;
     packageId?: string | undefined;
 }>;

package/dist/define/index.d.ts

@@ -11,7 +11,7 @@ export { AccessLevel } from "../data/access-level";
 export type { DataFilter, IDataQueryParams } from "../data/orm/data-query";
 export type { IDataChangedEvent } from "../data/orm/subscribable.data-source";
 export { type Observable, observable, type Subscription } from "../observable";
-export { isid, newid } from "../peer-id";
+export { idFromKey, isid, newid } from "../peer-id";
 export { FieldType, type IField } from "../types/field-type";
 export { zodPeerId } from "../types/zod-types";
 export * from "./context";

package/dist/define/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.writePackageVar = exports.userVar = exports.readPackageVar = exports.groupVar = exports.groupUserVar = exports.groupDeviceVar = exports.deviceVar = exports.isImplementedObservable = exports.defineObservable = exports.declareObservable = exports.generatedField = exports.defineEvent = exports.zodPeerId = exports.FieldType = exports.newid = exports.isid = exports.observable = exports.AccessLevel = exports.z = void 0;
+exports.writePackageVar = exports.userVar = exports.readPackageVar = exports.groupVar = exports.groupUserVar = exports.groupDeviceVar = exports.deviceVar = exports.isImplementedObservable = exports.defineObservable = exports.declareObservable = exports.generatedField = exports.defineEvent = exports.zodPeerId = exports.FieldType = exports.newid = exports.isid = exports.idFromKey = exports.observable = exports.AccessLevel = exports.z = void 0;
 /**
  * `@peers-app/peers-sdk/define`: declare an isolated package.
  *
@@ -30,6 +30,7 @@ Object.defineProperty(exports, "AccessLevel", { enumerable: true, get: function
 var observable_1 = require("../observable");
 Object.defineProperty(exports, "observable", { enumerable: true, get: function () { return observable_1.observable; } });
 var peer_id_1 = require("../peer-id");
+Object.defineProperty(exports, "idFromKey", { enumerable: true, get: function () { return peer_id_1.idFromKey; } });
 Object.defineProperty(exports, "isid", { enumerable: true, get: function () { return peer_id_1.isid; } });
 Object.defineProperty(exports, "newid", { enumerable: true, get: function () { return peer_id_1.newid; } });
 var field_type_1 = require("../types/field-type");

package/dist/define/manifest.js

@@ -501,7 +501,7 @@ function observableValueShape(name, schema) {
     return empty ? { ...shape, optional: true } : shape;
 }
 function tableManifest(table) {
-    const { name, description, primaryKeyName, schema, versionNumber, localOnly } = table.definition;
+    const { name, description, primaryKeyName, schema, versionNumber, localOnly, indexes } = table.definition;
     return {
         name,
         description,
@@ -509,6 +509,14 @@ function tableManifest(table) {
         fields: describing(`Table ${name}`, () => irFields(schema)),
         ...(versionNumber === undefined ? {} : { versionNumber }),
         ...(localOnly ? { localOnly: true } : {}),
+        ...(indexes?.length
+            ? {
+                indexes: indexes.map((index) => ({
+                    fields: index.fields.map((f) => typeof f === "string" ? f : { name: f.name, order: f.order }),
+                    ...(index.unique ? { unique: true } : {}),
+                })),
+            }
+            : {}),
     };
 }
 /** One contract's manifest entry, with name-only references to its tables. */

package/dist/define/table.d.ts

@@ -16,6 +16,12 @@ export interface IPackageTableDefinition<S extends z.AnyZodObject = z.AnyZodObje
     versionNumber?: number;
     /** Keep rows on this device only. They never sync. */
     localOnly?: boolean;
+    /**
+     * Indexes for the fields queries filter or sort by, each in order (a field name, or a name with
+     * `"ASC"` or `"DESC"`). A local-only table can also make one `unique`. Changing them is a
+     * schema change, so raise `versionNumber`.
+     */
+    indexes?: IPackageTableIndex<S>[];
     /**
      * The table's class, to override its methods: `Feeds(ctx)` returns one, and so does every
      * consumer call through a contract, so an override is always the logic in use. Defaults to
@@ -23,6 +29,15 @@ export interface IPackageTableDefinition<S extends z.AnyZodObject = z.AnyZodObje
      */
     tableClass?: PackageTableClass<S>;
 }
+/** One index of a {@link defineTable} table: its fields in order, each ascending unless set. */
+export interface IPackageTableIndex<S extends z.AnyZodObject = z.AnyZodObject> {
+    fields: (Extract<keyof z.infer<S>, string> | {
+        name: Extract<keyof z.infer<S>, string>;
+        order: "ASC" | "DESC";
+    })[];
+    /** No two rows share these values. Only on a `localOnly` table: synced rows can collide. */
+    unique?: true;
+}
 /** A class extending {@link PackageTable} for a table's schema. */
 export type PackageTableClass<S extends z.AnyZodObject = z.AnyZodObject> = new (ctx: IPackageContext, definition: Readonly<IPackageTableDefinition<S>>) => PackageTable<S>;
 /** One table's methods, bound to one handler call. */

package/dist/device/binary-peer-connection-v2.d.ts

@@ -18,7 +18,7 @@
  * 3. **Frame cipher**: once `armFrameCipher` is called (by `Connection` after
  *    the handshake), every outbound frame is sealed as `FRAME_ENC` and every
  *    inbound frame must be sealed. See `frame-cipher.ts` and
- *    `working/transport-security.md`.
+ *    `working/done/transport-security.md`.
  */
 import { Connection } from "./connection";
 import type { Device } from "./device";

package/dist/device/binary-peer-connection-v2.js

@@ -19,7 +19,7 @@
  * 3. **Frame cipher**: once `armFrameCipher` is called (by `Connection` after
  *    the handshake), every outbound frame is sealed as `FRAME_ENC` and every
  *    inbound frame must be sealed. See `frame-cipher.ts` and
- *    `working/transport-security.md`.
+ *    `working/done/transport-security.md`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_BINARY_PEER_RECEIVE_LIMITS = void 0;

package/dist/device/connection.d.ts

@@ -48,8 +48,8 @@ export declare class Connection {
     get remoteDeviceInfo(): {
         publicKey: string;
         userId: string;
-        deviceId: string;
         publicBoxKey: string;
+        deviceId: string;
         userName?: string | undefined;
         deviceName?: string | undefined;
     };

package/dist/device/frame-cipher.d.ts

@@ -23,7 +23,7 @@
  * mismatch. AAD is the UTF-8 `connectionId`, binding every frame to the
  * connection it was sealed for.
  *
- * Design: `working/transport-security.md`.
+ * Design: `working/done/transport-security.md`.
  */
 /** Frame type byte for a sealed frame. The only cleartext byte on the wire once armed. */
 export declare const FRAME_ENC = 32;

package/dist/device/frame-cipher.js

@@ -24,7 +24,7 @@
  * mismatch. AAD is the UTF-8 `connectionId`, binding every frame to the
  * connection it was sealed for.
  *
- * Design: `working/transport-security.md`.
+ * Design: `working/done/transport-security.md`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FrameOpener = exports.FrameSealer = exports.FRAME_CIPHER_KEY_BYTES = exports.FRAME_CIPHER_OVERHEAD = exports.FRAME_CIPHER_TAG_BYTES = exports.FRAME_ENC = void 0;

package/dist/device/get-trust-level-fn.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getTrustLevelFn = getTrustLevelFn;
 const context_1 = require("../context");
 const data_1 = require("../data");
+const user_permissions_1 = require("../data/user-permissions");
 const key_change_1 = require("../identity/key-change");
 const socket_type_1 = require("./socket.type");
 function applyReportedDeviceName(device, deviceInfo) {
@@ -32,9 +33,7 @@ function getTrustLevelFn(me, serverUrl) {
             return socket_type_1.TrustLevel.Untrusted;
         }
         // if this is my own device it is trusted
-        if (deviceInfo.userId === me.userId &&
-            deviceInfo.publicKey === me.publicKey &&
-            deviceInfo.publicBoxKey === me.publicBoxKey) {
+        if ((0, user_permissions_1.sameUserIdentity)(deviceInfo, me)) {
             // if (deviceInfo.deviceId === thisDeviceId()) {
             //   return TrustLevel.Untrusted;
             // }
@@ -96,9 +95,7 @@ function getTrustLevelFn(me, serverUrl) {
                 (device ? deviceInfo.userId !== device.userId : false))) {
             return socket_type_1.TrustLevel.Untrusted;
         }
-        if (effectiveUser &&
-            (deviceInfo.publicKey !== effectiveUser.publicKey ||
-                deviceInfo.publicBoxKey !== effectiveUser.publicBoxKey)) {
+        if (effectiveUser && !(0, user_permissions_1.sameUserIdentity)(deviceInfo, effectiveUser)) {
             // A different box key for the key on record is a mismatch. A different signing key is
             // accepted only when the anchors on record confirm a rotation.
             if (deviceInfo.publicKey === effectiveUser.publicKey) {