@peers-app/peers-sdk 0.27.5 → 0.28.1

package/dist/invites/invite-token.d.ts

@@ -35,6 +35,8 @@ export declare const inviteIdentitySchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }>, "many">>;
+    /** The owner's signature over that first anchor list (see `signUserObject`). */
+    anchorsSignature: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     publicKey: string;
     userId: string;
@@ -43,6 +45,7 @@ export declare const inviteIdentitySchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
     displayName?: string | undefined;
 }, {
     publicKey: string;
@@ -52,6 +55,7 @@ export declare const inviteIdentitySchema: z.ZodObject<{
         type: "peers-services" | "https";
         url: string;
     }[] | undefined;
+    anchorsSignature?: string | undefined;
     displayName?: string | undefined;
 }>;
 /** Public identity of a party to an invite. */
@@ -110,6 +114,8 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }>, "many">>;
+        /** The owner's signature over that first anchor list (see `signUserObject`). */
+        anchorsSignature: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
@@ -118,6 +124,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
@@ -127,6 +134,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }>;
     /** ISO 8601 instant after which the token is invalid. */
@@ -171,6 +179,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -196,6 +205,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -221,6 +231,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -246,6 +257,7 @@ export declare const peersInviteContentsSchema: z.ZodEffects<z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -284,6 +296,8 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }>, "many">>;
+        /** The owner's signature over that first anchor list (see `signUserObject`). */
+        anchorsSignature: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         publicKey: string;
         userId: string;
@@ -292,6 +306,7 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }, {
         publicKey: string;
@@ -301,6 +316,7 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     }>;
     expiresAt: z.ZodString;
@@ -344,6 +360,7 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;
@@ -370,6 +387,7 @@ export declare const peersInviteSchema: z.ZodObject<{
             type: "peers-services" | "https";
             url: string;
         }[] | undefined;
+        anchorsSignature?: string | undefined;
         displayName?: string | undefined;
     };
     epoch: number;

package/dist/invites/invite-token.js

@@ -44,6 +44,8 @@ exports.inviteIdentitySchema = zod_1.z
      * keeps it; this is only the bootstrap that arrives with the invitation.
      */
     anchors: zod_1.z.array(anchor_document_1.anchorRefSchema).max(8).optional(),
+    /** The owner's signature over that first anchor list (see `signUserObject`). */
+    anchorsSignature: zod_1.z.string().max(200).optional(),
 })
     .strict();
 /** How joiners are admitted by a group token. */

package/dist/keys.d.ts

@@ -138,6 +138,13 @@ export declare function addSignatureToObject<T extends Record<string, any>>(obj:
 export declare function verifyObjectSignature<T extends IMaybeSignature>(objectWithSignature: T): void;
 /** True if {@link verifyObjectSignature} would succeed. */
 export declare function isObjectSignatureValid<T extends IMaybeSignature>(objectWithSignature: T): boolean;
+/**
+ * The key that validly signed `row` ({@link addSignatureToObject}'s `publicKey:signature`), or
+ * `undefined` when the row is unsigned or its signature doesn't verify. Memoized.
+ *
+ * @param row - A row with an optional `signature`.
+ */
+export declare function signedByKey(row: IMaybeSignature): string | undefined;
 /**
  * Parses the Ed25519 public key prefix from a `publicKey:signature` field, or `undefined` if malformed.
  */

package/dist/keys.js

@@ -27,6 +27,7 @@ exports.decryptData = decryptData;
 exports.addSignatureToObject = addSignatureToObject;
 exports.verifyObjectSignature = verifyObjectSignature;
 exports.isObjectSignatureValid = isObjectSignatureValid;
+exports.signedByKey = signedByKey;
 exports.getPublicKeyFromObjectSignature = getPublicKeyFromObjectSignature;
 const sha2_1 = require("@noble/hashes/sha2");
 const buffer_1 = require("buffer");
@@ -391,6 +392,32 @@ function isObjectSignatureValid(objectWithSignature) {
     }
     return true;
 }
+/**
+ * Signature checks already made, by the hash of the signed row (signature included). A group's
+ * authority is rebuilt after any change to its rows and re-checks every one, and an Ed25519
+ * check costs milliseconds, so without this a rebuild would take seconds in a large group.
+ */
+const signatureChecks = new Map();
+const SIGNATURE_CHECKS_MAX = 10_000;
+/**
+ * The key that validly signed `row` ({@link addSignatureToObject}'s `publicKey:signature`), or
+ * `undefined` when the row is unsigned or its signature doesn't verify. Memoized.
+ *
+ * @param row - A row with an optional `signature`.
+ */
+function signedByKey(row) {
+    if (!row.signature)
+        return undefined;
+    const key = hashValue(canonicalJSONString(row));
+    let valid = signatureChecks.get(key);
+    if (valid === undefined) {
+        valid = isObjectSignatureValid(row);
+        if (signatureChecks.size >= SIGNATURE_CHECKS_MAX)
+            signatureChecks.clear();
+        signatureChecks.set(key, valid);
+    }
+    return valid ? getPublicKeyFromObjectSignature(row) : undefined;
+}
 /**
  * Parses the Ed25519 public key prefix from a `publicKey:signature` field, or `undefined` if malformed.
  */

package/dist/package-installer/package-installer.d.ts

@@ -10,7 +10,7 @@ import type { IInstallOpts, IInstallResult, IPackageInfo, IPackageInstallerDeps
  * triggers the package loader and device version resolution.
  *
  * When the bundle hash matches the existing PackageVersion, no files or PV are
- * rewritten. The Packages row still gets a missing `activePackageVersionId`
+ * rewritten. An Admin's Packages row still gets a missing `activePackageVersionId`
  * (and description), and when the id was missing the version is activated on
  * this device unless `skipResolve`.
  */

package/dist/package-installer/package-installer.js

@@ -8,6 +8,8 @@ exports.getPackageInfo = getPackageInfo;
 exports.getPackageLocalPath = getPackageLocalPath;
 const file_types_1 = require("../data/files/file.types");
 const files_1 = require("../data/files/files");
+const group_member_roles_1 = require("../data/group-member-roles");
+const group_permissions_1 = require("../data/group-permissions");
 const package_version_resolver_1 = require("../data/package-version-resolver");
 const package_versions_1 = require("../data/package-versions");
 const packages_1 = require("../data/packages");
@@ -23,7 +25,7 @@ const package_author_signer_1 = require("./package-author-signer");
  * triggers the package loader and device version resolution.
  *
  * When the bundle hash matches the existing PackageVersion, no files or PV are
- * rewritten. The Packages row still gets a missing `activePackageVersionId`
+ * rewritten. An Admin's Packages row still gets a missing `activePackageVersionId`
  * (and description), and when the id was missing the version is activated on
  * this device unless `skipResolve`.
  */
@@ -127,7 +129,8 @@ async function installPackageFromBundles(dataContext, deps, packageId, opts) {
  * this device.
  *
  * Updates the description when it differs, and sets `activePackageVersionId`
- * when it is empty (first install, or reimport after the row was deleted).
+ * when it is empty and the current user may select for the group (first install, or
+ * reimport after the row was deleted). Writers activate dev builds on their own device.
  * Unless `skipResolve`, writes device prefs and force-resolves the version.
  * With `resolveOnlyWhenActivated`, the device step runs only when this call
  * filled an empty `activePackageVersionId`.
@@ -143,7 +146,9 @@ async function activateInstalledPackageVersion(dataContext, packageId, packageVe
         needsSave = true;
     }
     const activated = !pkg.activePackageVersionId;
-    if (activated) {
+    const canSelectForGroup = !dataContext.groupId ||
+        (await (0, group_permissions_1.getUserRole)(dataContext.groupId, dataContext.userContext.userId, dataContext.userContext)) >= group_member_roles_1.GroupMemberRole.Admin;
+    if (activated && canSelectForGroup) {
         pkg.activePackageVersionId = packageVersion.packageVersionId;
         needsSave = true;
     }

package/dist/package-installer/package-propagation.d.ts

@@ -22,8 +22,10 @@ export declare function propagatePvOnChanged(userContext?: UserContext): Promise
  * any that are missing from admin groups. Useful for manual repair.
  */
 export declare function discoverAndPropagateVersions(userContext: UserContext): Promise<IPropagationResult[]>;
+/** Whether automatic follow policy selected a group release. */
 export interface IActivationResult {
     activated: boolean;
     activePackageVersionId?: string;
 }
+/** Select the best publisher-signed release under an Admin-approved package's follow policy. */
 export declare function activateBestEligibleVersion(dataContext: DataContext, pkg: IPackage): Promise<IActivationResult>;

package/dist/package-installer/package-propagation.js

@@ -4,6 +4,7 @@ exports.propagatePvOnChanged = propagatePvOnChanged;
 exports.discoverAndPropagateVersions = discoverAndPropagateVersions;
 exports.activateBestEligibleVersion = activateBestEligibleVersion;
 const context_1 = require("../context");
+const authority_write_checks_1 = require("../data/authority-write-checks");
 const files_1 = require("../data/files/files");
 const group_member_roles_1 = require("../data/group-member-roles");
 const group_permissions_1 = require("../data/group-permissions");
@@ -113,12 +114,12 @@ async function propagatePvToAdminGroups(userContext, sourceContext, pv) {
  */
 async function installPvInGroupNoActivate(source, dest, pv) {
     const pkg = await (0, packages_1.Packages)(dest).get(pv.packageId);
-    if (!pkg || pkg.disabled)
+    if (!pkg || pkg.disabled || !(await (0, authority_write_checks_1.isPackageRowAdminSigned)(pkg, dest)))
         return false;
     const existingPv = await (0, package_versions_1.PackageVersions)(dest).get(pv.packageVersionId);
     if (existingPv)
         return false;
-    if (!(await verifyOrEstablishTofu(source, dest, pkg, pv)))
+    if (!(await verifyPinnedPublisher(dest, pkg, pv)))
         return false;
     const files = await copyBundleFiles(source, pv);
     if (!files)
@@ -143,7 +144,8 @@ async function installPvInGroup(source, dest, pv, retryCnt = 0) {
         await (0, utils_1.sleep)(delayMs);
     }
     const pkg = await (0, packages_1.Packages)(dest).get(pv.packageId);
-    if (!pkg || pkg.disabled)
+    // Copying signs the release with this device's key: only into a package an Admin added.
+    if (!pkg || pkg.disabled || !(await (0, authority_write_checks_1.isPackageRowAdminSigned)(pkg, dest)))
         return undefined;
     const existingPv = await (0, package_versions_1.PackageVersions)(dest).get(pv.packageVersionId);
     if (existingPv) {
@@ -153,10 +155,8 @@ async function installPvInGroup(source, dest, pv, retryCnt = 0) {
             ? makeResult(dest, pv, activation.activePackageVersionId === pv.packageVersionId)
             : undefined;
     }
-    // TOFU verification
-    if (!(await verifyOrEstablishTofu(source, dest, pkg, pv))) {
-        return await retryOrFail(source, dest, pv, retryCnt, "TOFU");
-    }
+    if (!(await verifyPinnedPublisher(dest, pkg, pv)))
+        return undefined;
     // Copy bundle files
     const files = await copyBundleFiles(source, pv);
     if (!files) {
@@ -184,45 +184,19 @@ async function retryOrFail(source, dest, pv, retryCnt, reason) {
     console.error(`[propagation] ${reason} for ${pv.packageVersionId}, giving up`);
     return undefined;
 }
-// --- TOFU ---
 /**
- * Returns true if signature verification passes. Establishes TOFU key
- * from source if target has no publishPublicKey yet. Returns false on
- * transient failures (missing source key).
+ * Another context can supply bytes, never a new trust root. The destination must already
+ * pin the publisher (or use the host's peers-core anchor) before this device endorses a release.
  */
-async function verifyOrEstablishTofu(sourceContext, targetContext, targetPkg, pv) {
+async function verifyPinnedPublisher(targetContext, targetPkg, pv) {
     // peers-core pinned to a revoked key: move the pin to the host's current key first so a
     // version signed by the replacement key can be accepted.
     const repinned = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(targetContext, targetPkg);
     if (repinned !== targetPkg) {
         targetPkg.publishPublicKey = repinned.publishPublicKey;
     }
-    if (targetPkg.publishPublicKey) {
-        if (!(0, package_author_signing_1.verifyPackageAuthorSignature)(pv, targetPkg.publishPublicKey).valid) {
-            console.error(`[propagation] Invalid signature for ${pv.packageVersionId}`);
-            return false;
-        }
-        return true;
-    }
-    // TOFU: get key from source
-    const sourcePkg = await (0, packages_1.Packages)(sourceContext).get(targetPkg.packageId);
-    if (!sourcePkg?.publishPublicKey)
-        return false;
-    // Never adopt a revoked key as a trust anchor, however it reached the source group.
-    if ((0, package_author_signing_1.isRevokedPublisherKey)(sourcePkg.publishPublicKey)) {
-        console.error(`[propagation] Refusing revoked publisher key for ${targetPkg.packageId} from ${sourceContext.dataContextId}`);
-        return false;
-    }
-    if (!(0, package_author_signing_1.verifyPackageAuthorSignature)(pv, sourcePkg.publishPublicKey).valid) {
-        console.error(`[propagation] Invalid signature for ${pv.packageVersionId} (TOFU)`);
-        return false;
-    }
-    await (0, packages_1.Packages)(targetContext).signAndSave({
-        ...targetPkg,
-        publishPublicKey: sourcePkg.publishPublicKey,
-    });
-    targetPkg.publishPublicKey = sourcePkg.publishPublicKey;
-    return true;
+    return (!!targetPkg.publishPublicKey &&
+        (0, package_author_signing_1.verifyPackageAuthorSignature)(pv, targetPkg.publishPublicKey).valid);
 }
 /**
  * Loads and verifies all bundle file records from source. Returns null if
@@ -272,7 +246,15 @@ async function saveFileAndIndexTree(sourceFiles, destFiles, file, copiedIds) {
     }
     await destFiles.saveFileRecord(file);
 }
+/** Select the best publisher-signed release under an Admin-approved package's follow policy. */
 async function activateBestEligibleVersion(dataContext, pkg) {
+    // Callers may have copied files or waited for an activation lock since reading the row.
+    // Always decide from current, approved settings before signing a group selection.
+    const current = await (0, packages_1.Packages)(dataContext).get(pkg.packageId);
+    if (!current || current.disabled || !(await (0, authority_write_checks_1.isPackageRowAdminSigned)(current, dataContext))) {
+        return { activated: false };
+    }
+    pkg = current;
     const range = pkg.versionFollowRange ?? "pinned";
     if (range === "pinned")
         return { activated: false };

package/dist/package-installer/package-remote-checker.js

@@ -10,6 +10,7 @@ exports.checkPackageRemoteForNewVersion = checkPackageRemoteForNewVersion;
 exports.checkAndInstallPackageRemoteVersion = checkAndInstallPackageRemoteVersion;
 exports.installRemotePackageVersion = installRemotePackageVersion;
 exports.clearRemoteCheckCache = clearRemoteCheckCache;
+const authority_write_checks_1 = require("../data/authority-write-checks");
 const file_types_1 = require("../data/files/file.types");
 const package_version_resolver_1 = require("../data/package-version-resolver");
 const package_versions_1 = require("../data/package-versions");
@@ -45,12 +46,18 @@ function checkPackageRemoteForNewVersion(packageId, updateUrl, tag, http) {
  * group does not already have the remote PackageVersion.
  */
 async function checkAndInstallPackageRemoteVersion(dataContext, pkg, tag, http) {
-    const updateUrl = pkg.updateUrl;
-    if (!updateUrl || pkg.disabled)
+    let current = await (0, packages_1.Packages)(dataContext).get(pkg.packageId);
+    if (!current || current.disabled)
         return null;
     // A peers-core row pinned to a revoked publisher key would reject every new release; move
     // it to the host's current anchor before looking at the remote.
-    await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(dataContext, pkg);
+    current = await (0, peers_core_trust_anchor_1.repinPeersCoreIfRevoked)(dataContext, current);
+    // The release would be signed with this device's key: only for a package an Admin added.
+    if (!(await (0, authority_write_checks_1.isPackageRowAdminSigned)(current, dataContext)))
+        return null;
+    const updateUrl = current.updateUrl;
+    if (!updateUrl)
+        return null;
     const result = await checkPackageRemoteForNewVersion(pkg.packageId, updateUrl, tag, http);
     if (!result)
         return null;
@@ -139,6 +146,11 @@ async function installRemotePackageVersion(dataContext, result) {
     if (!pkg) {
         throw new Error(`Cannot install remote package version: package ${packageId} is not installed`);
     }
+    // The fetch may have outlived a delete/reinsert of the package. Never sign a release or
+    // establish a publisher pin on behalf of a newly added, unapproved row.
+    if (!(await (0, authority_write_checks_1.isPackageRowAdminSigned)(pkg, dataContext))) {
+        throw new Error("Cannot install remote package version: package settings need an Admin signature");
+    }
     if (!unpacked.payload.publicKey) {
         throw new Error("Cannot install remote package version: payload publicKey is missing");
     }

package/dist/package-loader/isolated-artifact.d.ts

@@ -125,6 +125,20 @@ export interface IIsolatedPackageTable {
      * of a contract's table shape.
      */
     localOnly?: boolean;
+    /**
+     * Indexes for the fields queries filter or sort by, each in order. Unique only on a local-only
+     * table. Storage policy, like `localOnly`: changing them needs a higher `versionNumber`.
+     */
+    indexes?: IIsolatedTableIndex[];
+}
+/** One index of an isolated package table: field names in order, each ascending unless set. */
+export interface IIsolatedTableIndex {
+    fields: (string | {
+        name: string;
+        order: "ASC" | "DESC";
+    })[];
+    /** No two rows share these values. Local-only tables only. */
+    unique?: true;
 }
 /** Name-only reference that exposes one package table through a contract. */
 export interface IIsolatedContractTableRef {

package/dist/package-loader/isolated-artifact.js

@@ -19,6 +19,7 @@ exports.findPackageTable = findPackageTable;
 exports.toConsumedContracts = toConsumedContracts;
 const contract_definition_schema_1 = require("../contracts/contract-definition-schema");
 const access_level_1 = require("../data/access-level");
+const package_table_identity_1 = require("../data/package-table-identity");
 const persistent_var_identity_1 = require("../data/persistent-var-identity");
 const field_type_1 = require("../types/field-type");
 const utils_1 = require("../utils");
@@ -300,7 +301,7 @@ function validatePackageTables(manifest, strict) {
         if (forbiddenIdentity) {
             throw new Error(`${tableLabel} must not declare ${forbiddenIdentity}`);
         }
-        assertOnlyKeys(table, ["name", "description", "primaryKeyName", "fields", "versionNumber", "localOnly"], tableLabel);
+        assertOnlyKeys(table, ["name", "description", "primaryKeyName", "fields", "versionNumber", "localOnly", "indexes"], tableLabel);
         if (typeof table.name !== "string" || table.name.trim() === "") {
             throw new Error(`${tableLabel}.name is required`);
         }
@@ -336,6 +337,7 @@ function validatePackageTables(manifest, strict) {
         else {
             table.versionNumber = 1;
         }
+        (0, package_table_identity_1.validateTableIndexes)(table.indexes, new Set(table.fields.map((field) => field.name)), `${tableLabel}.indexes`, table.localOnly);
     }
 }
 function validateProvidedContract(contract, index, packageTables, guestApi, strict) {
@@ -783,8 +785,6 @@ function validateIsolatedPackageArtifact(artifact, options = {}) {
         "tables",
         "network",
         "appNavs",
-        // Voice Skill v1's retired action aliases: an older manifest may carry them; ignored.
-        "actionAliases",
         "executionMode",
         "guestApi",
     ], "manifest");

package/dist/package-loader/isolated-runtime.d.ts

@@ -4,7 +4,7 @@ import type { IContractCall, IContractProviderEndpoint } from "../contracts/cont
 import type { ContractRegistry } from "../contracts/registry";
 import type { PersistentVarScope } from "../data/persistent-vars";
 import type { IField } from "../types/field-type";
-import type { IIsolatedContractToolRef, IIsolatedInstalledPackage, IIsolatedInstallResult, IIsolatedPackageArtifact } from "./isolated-artifact";
+import type { IIsolatedContractToolRef, IIsolatedInstalledPackage, IIsolatedInstallResult, IIsolatedPackageArtifact, IIsolatedTableIndex } from "./isolated-artifact";
 import type { IPackageWorkerHealth } from "./package-runtime-state";
 /** Standard table methods exposed through isolated contract-table references. */
 export declare const ISOLATED_CONTRACT_TABLE_OPERATIONS: readonly ["get", "list", "count", "findOne", "save", "insert", "update", "delete"];
@@ -165,6 +165,8 @@ export interface IIsolatedPackageTableDeclaration extends IIsolatedPackageTableR
     versionNumber?: number;
     /** Rows stay on the writing device; see `IIsolatedPackageTable.localOnly`. */
     localOnly?: boolean;
+    /** Indexes; see `IIsolatedPackageTable.indexes`. */
+    indexes?: IIsolatedTableIndex[];
 }
 /**
  * Trusted host capability for isolated-package table persistence.

package/dist/package-loader/isolated-table-gateway.js

@@ -43,6 +43,7 @@ function validateDeclaration(declaration) {
     if (declaration.localOnly !== undefined && typeof declaration.localOnly !== "boolean") {
         throw new Error("Isolated table localOnly must be a boolean");
     }
+    (0, package_table_identity_1.validateTableIndexes)(declaration.indexes, fieldNames, "Isolated table indexes", declaration.localOnly);
     const { localOnly, ...rest } = declaration;
     return {
         ...rest,
@@ -61,8 +62,9 @@ function toMetaData(rawDeclaration) {
         primaryKeyName: declaration.primaryKeyName,
         fields: declaration.fields,
         versionNumber: versionNumber(declaration),
-        // Only when set: stored definitions hash their metadata, and older ones have no such key.
+        // Only when set: stored definitions hash their metadata, and older ones have no such keys.
         ...(declaration.localOnly ? { localOnly: true } : {}),
+        ...(declaration.indexes?.length ? { indexes: declaration.indexes } : {}),
     };
 }
 function normalizedMetaData(metaData) {
@@ -111,6 +113,7 @@ function declarationFromMetaData(metaData) {
         fields: metaData.fields,
         versionNumber: metaData.versionNumber,
         localOnly: metaData.localOnly,
+        ...(metaData.indexes?.length ? { indexes: metaData.indexes } : {}),
     });
 }
 function metaDataFromStoredDefinition(record, incoming) {

package/dist/package-loader/package-loader.js

@@ -751,9 +751,15 @@ class PackageLoader {
                 /* no version record */
             }
         }
+        if (packageVersion) {
+            await (0, package_version_resolver_1.assertPackageVersionRunnable)(pkg, packageVersion, this.dataContext, !!opts?.localPath);
+        }
         if (bundleFileId) {
             const bundleBuffer = await (0, files_1.Files)(this.dataContext).getFileContents(bundleFileId);
             if (bundleBuffer) {
+                if (this.dataContext.groupId && packageVersion) {
+                    (0, package_version_resolver_1.assertPackageBundleIntegrity)(packageVersion, "package", bundleBuffer);
+                }
                 bundleCode = Buffer.from(bundleBuffer).toString("utf8");
             }
             else if (warn) {

package/dist/peer-id.d.ts

@@ -1,5 +1,24 @@
 /** Builds a random string of base-36 characters with unbiased distribution (tweetnacl-backed). */
 export declare function cryptoRandomString(length: number): string;
+/**
+ * A 25-character peer id derived from `input`: `prefix`, then base-36 characters of its SHA-512
+ * hash. The same input always gives the same id. Each kind of derived id has its own prefix, so
+ * kinds can't collide.
+ *
+ * @param prefix - Fixed leading characters naming the kind of id.
+ * @param input - What the id is derived from.
+ */
+export declare function deterministicPeerId(prefix: string, input: string): string;
+/**
+ * A peer id derived from `key`, the same on every device. Rows different devices save under the
+ * same key are then one row, which sync merges as ordinary updates: how a synced table keeps one
+ * row per key, where a unique index can't (two devices could each save a row the other's index
+ * refuses). Start the key with what it identifies (`` `store:${name}` ``) so ids for different
+ * things can't collide.
+ *
+ * @param key - What the row stands for.
+ */
+export declare function idFromKey(key: string): string;
 /**
  * Creates a new 25-character peer id: base-36 time prefix (10 chars) + random suffix (15 chars).
  * Sort order correlates with creation time. Use {@link isid} to validate user-provided values.

package/dist/peer-id.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_ID = exports.MIN_ID = void 0;
 exports.cryptoRandomString = cryptoRandomString;
+exports.deterministicPeerId = deterministicPeerId;
+exports.idFromKey = idFromKey;
 exports.newid = newid;
 exports.isid = isid;
 exports.idTime = idTime;
@@ -35,6 +37,45 @@ function cryptoRandomString(length) {
     }
     return s.substring(0, length);
 }
+/**
+ * Converts a byte array to a base-36 string of the requested length, using unbiased modular reduction.
+ * Bytes >= 252 are skipped to avoid bias (same technique as {@link cryptoRandomString}).
+ */
+function bytesToBase36(bytes, length) {
+    let s = "";
+    for (let i = 0; i < bytes.length && s.length < length; i++) {
+        const n = bytes[i];
+        if (n >= 252)
+            continue;
+        s += (n % 36).toString(36);
+    }
+    return s.substring(0, length);
+}
+/**
+ * A 25-character peer id derived from `input`: `prefix`, then base-36 characters of its SHA-512
+ * hash. The same input always gives the same id. Each kind of derived id has its own prefix, so
+ * kinds can't collide.
+ *
+ * @param prefix - Fixed leading characters naming the kind of id.
+ * @param input - What the id is derived from.
+ */
+function deterministicPeerId(prefix, input) {
+    const hashSuffixLength = 25 - prefix.length;
+    const hash = nacl.hash(new TextEncoder().encode(input));
+    return prefix + bytesToBase36(hash, hashSuffixLength);
+}
+/**
+ * A peer id derived from `key`, the same on every device. Rows different devices save under the
+ * same key are then one row, which sync merges as ordinary updates: how a synced table keeps one
+ * row per key, where a unique index can't (two devices could each save a row the other's index
+ * refuses). Start the key with what it identifies (`` `store:${name}` ``) so ids for different
+ * things can't collide.
+ *
+ * @param key - What the row stands for.
+ */
+function idFromKey(key) {
+    return deterministicPeerId("000key00", key);
+}
 /**
  * Creates a new 25-character peer id: base-36 time prefix (10 chars) + random suffix (15 chars).
  * Sort order correlates with creation time. Use {@link isid} to validate user-provided values.

package/dist/types/peer-device.d.ts

@@ -7,6 +7,8 @@ export interface IPeerDevice {
     deviceId: string;
     /** User identity that owns this device. */
     userId: string;
+    /** Signing key the device authenticated with, for a remote device: roles are checked against it. */
+    publicKey?: string;
     /** Role used when this device participates in a shared group. */
     role: GroupMemberRole;
     /** Lists change records available from this device. */

package/dist/types/workflow.d.ts

@@ -45,6 +45,7 @@ export declare const workflowSchema: z.ZodObject<{
     name: string;
     description: string;
     updatedAt: Date;
+    createdBy: string;
     createdAt: Date;
     workflowId: string;
     defaultAssistantId: string;
@@ -54,14 +55,13 @@ export declare const workflowSchema: z.ZodObject<{
         directCallToolId?: string | undefined;
         subWorkflowId?: string | undefined;
     }[];
-    createdBy: string;
     packageId?: string | undefined;
 }, {
     name: string;
     description: string;
+    createdBy: string;
     workflowId: string;
     defaultAssistantId: string;
-    createdBy: string;
     updatedAt?: Date | undefined;
     packageId?: string | undefined;
     createdAt?: Date | undefined;