@peers-app/peers-sdk 0.28.10 → 0.28.12

package/dist/define/table.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PackageTable = void 0;
 exports.defineTable = defineTable;
+const signed_row_id_1 = require("../data/signed-row-id");
 const isolated_runtime_1 = require("../package-loader/isolated-runtime");
+const field_type_1 = require("../types/field-type");
 const empty_fields_1 = require("./empty-fields");
 const table_handle_1 = require("./table-handle");
 /**
@@ -120,6 +122,102 @@ class PackageTable {
     }
 }
 exports.PackageTable = PackageTable;
+/** The columns Peers adds to a signed table; a schema can't declare them. */
+const SIGNED_TABLE_COLUMNS = [
+    "signature",
+    "signedAt",
+    "signedContextId",
+    "signedTableId",
+    "signedIdSeed",
+];
+/** The field types a signed table's key fields may have. */
+const SIGNED_KEY_TYPES = new Set([
+    field_type_1.FieldType.string,
+    field_type_1.FieldType.id,
+    field_type_1.FieldType.number,
+    field_type_1.FieldType.boolean,
+]);
+/**
+ * A schema field's Peers field type and whether a wrapper makes it optional, nullable, an
+ * array, or defaulted. `zodPeerId` marks its own def (a refinement) as an id field; walk the
+ * wrappers the manifest walks and take the mark from whichever level carries it.
+ */
+function schemaFieldKind(schema, name) {
+    let def = schema.shape[name]._def;
+    let wrapped = false;
+    let isArray = false;
+    let fieldType = def._fieldType;
+    const typeName = () => def.typeName;
+    while (def.innerType || def.schema || def.type) {
+        isArray ||= typeName() === "ZodArray";
+        wrapped ||= ["ZodOptional", "ZodNullable", "ZodArray", "ZodDefault"].includes(typeName());
+        def = (def.innerType ?? def.schema ?? def.type)._def;
+        fieldType ??= def._fieldType;
+    }
+    fieldType ??= {
+        ZodString: field_type_1.FieldType.string,
+        ZodEnum: field_type_1.FieldType.string,
+        ZodNumber: field_type_1.FieldType.number,
+        ZodBoolean: field_type_1.FieldType.boolean,
+    }[typeName()];
+    // A literal is typed by its value, as the manifest types it.
+    if (!fieldType && typeName() === "ZodLiteral") {
+        fieldType = { string: field_type_1.FieldType.string, number: field_type_1.FieldType.number, boolean: field_type_1.FieldType.boolean }[typeof def.value];
+    }
+    return { fieldType, wrapped, isArray };
+}
+/**
+ * Check a `signedBy` declaration without the manifest machinery (this entry stays small): the
+ * owner field and the primary key are required, single `zodPeerId` fields and differ; any
+ * `signedKey` fields are distinct, required scalars other than those two; the table isn't
+ * local-only; and the schema leaves the signature columns to Peers. The build checks the
+ * manifest again.
+ */
+function validateSignedByField(definition) {
+    const { name, signedBy, signedKey, schema, localOnly, primaryKeyName } = definition;
+    const label = `Table ${name}`;
+    if (typeof signedBy !== "string" || !(signedBy in schema.shape)) {
+        throw new Error(`${label}.signedBy names a field the table doesn't have: "${signedBy}"`);
+    }
+    const owner = schemaFieldKind(schema, signedBy);
+    if (owner.wrapped || owner.fieldType !== field_type_1.FieldType.id) {
+        throw new Error(`${label}.signedBy must name a required field of type id, a user id`);
+    }
+    if (localOnly) {
+        throw new Error(`${label}.signedBy can't be set on a local-only table: nothing syncs`);
+    }
+    if (primaryKeyName === signedBy) {
+        throw new Error(`${label}: a signed table's primary key can't be its owner field; use signedKey: [] for one row per owner`);
+    }
+    const primaryKey = schemaFieldKind(schema, primaryKeyName);
+    if (primaryKey.fieldType !== field_type_1.FieldType.id || primaryKey.isArray) {
+        throw new Error(`${label}: a signed table's primary key must be a zodPeerId`);
+    }
+    if (signedKey !== undefined) {
+        if (!Array.isArray(signedKey))
+            throw new Error(`${label}.signedKey must be a list of fields`);
+        const seen = new Set();
+        for (const field of signedKey) {
+            if (typeof field !== "string" || !(field in schema.shape)) {
+                throw new Error(`${label}.signedKey names a field the table doesn't have: "${field}"`);
+            }
+            if (seen.has(field))
+                throw new Error(`${label}.signedKey lists "${field}" twice`);
+            seen.add(field);
+            if (field === primaryKeyName || field === signedBy) {
+                throw new Error(`${label}.signedKey can't list "${field}": the owner and the id are already part of a row's identity`);
+            }
+            const kind = schemaFieldKind(schema, field);
+            if (kind.wrapped || !kind.fieldType || !SIGNED_KEY_TYPES.has(kind.fieldType)) {
+                throw new Error(`${label}.signedKey field "${field}" must be a required string, id, number, or boolean`);
+            }
+        }
+    }
+    const reserved = SIGNED_TABLE_COLUMNS.find((column) => column in schema.shape);
+    if (reserved) {
+        throw new Error(`${label} declares "${reserved}", which the host adds to a signed table itself`);
+    }
+}
 /**
  * Declare one of the package's tables from a zod schema.
  *
@@ -138,12 +236,32 @@ function defineTable(definition) {
     if (!(definition.primaryKeyName in definition.schema.shape)) {
         throw new Error(`Table ${definition.name} primary key "${definition.primaryKeyName}" is not in its schema`);
     }
+    if (definition.signedBy !== undefined) {
+        validateSignedByField(definition);
+    }
+    else if (definition.signedKey !== undefined) {
+        throw new Error(`Table ${definition.name}.signedKey needs signedBy`);
+    }
     const TableClass = definition.tableClass ?? PackageTable;
     if (typeof TableClass !== "function" ||
         !(TableClass.prototype instanceof PackageTable || TableClass === PackageTable)) {
         throw new Error(`Table ${definition.name} tableClass must extend PackageTable`);
     }
-    const frozen = Object.freeze({ ...definition });
+    const frozen = Object.freeze({
+        ...definition,
+        ...(definition.signedKey ? { signedKey: Object.freeze([...definition.signedKey]) } : {}),
+    });
     const table = (ctx) => new TableClass(ctx, frozen);
-    return Object.freeze(Object.assign(table, { kind: "table", definition: frozen }));
+    const rowId = (row) => {
+        const { name, signedBy, signedKey, schema } = frozen;
+        if (!signedBy || !signedKey) {
+            throw new Error(`Table ${name} has no signedKey, so its row ids come from Peers when rows are first saved`);
+        }
+        const identityRow = Object.fromEntries([signedBy, ...signedKey].map((field) => [
+            field,
+            schema.shape[field].parse(row[field], { path: [field] }),
+        ]));
+        return (0, signed_row_id_1.signedRowIdFor)({ name, signedBy, signedKey }, identityRow);
+    };
+    return Object.freeze(Object.assign(table, { kind: "table", definition: frozen, rowId }));
 }

package/dist/invites/invite-messages.d.ts

@@ -655,17 +655,6 @@ export declare const groupApprovalSchema: z.ZodObject<{
         signedAt?: number | undefined;
         publicRole?: import("../data").GroupMemberRole | undefined;
     };
-    kind: "group-approval";
-    membership: {
-        role: import("../data").GroupMemberRole;
-        signature: string;
-        userId: string;
-        groupId: string;
-        groupMemberId: string;
-        deleted?: boolean | undefined;
-        publicKey?: string | undefined;
-        signedAt?: number | undefined;
-    };
     seed: {
         users: {
             name: string;
@@ -703,6 +692,17 @@ export declare const groupApprovalSchema: z.ZodObject<{
             signedAt?: number | undefined;
         }[];
     };
+    kind: "group-approval";
+    membership: {
+        role: import("../data").GroupMemberRole;
+        signature: string;
+        userId: string;
+        groupId: string;
+        groupMemberId: string;
+        deleted?: boolean | undefined;
+        publicKey?: string | undefined;
+        signedAt?: number | undefined;
+    };
     approver: {
         publicKey: string;
         userId: string;
@@ -735,17 +735,6 @@ export declare const groupApprovalSchema: z.ZodObject<{
         signedAt?: number | undefined;
         publicRole?: import("../data").GroupMemberRole | undefined;
     };
-    kind: "group-approval";
-    membership: {
-        role: import("../data").GroupMemberRole;
-        signature: string;
-        userId: string;
-        groupId: string;
-        groupMemberId: string;
-        deleted?: boolean | undefined;
-        publicKey?: string | undefined;
-        signedAt?: number | undefined;
-    };
     seed: {
         users: {
             name: string;
@@ -783,6 +772,17 @@ export declare const groupApprovalSchema: z.ZodObject<{
             signedAt?: number | undefined;
         }[];
     };
+    kind: "group-approval";
+    membership: {
+        role: import("../data").GroupMemberRole;
+        signature: string;
+        userId: string;
+        groupId: string;
+        groupMemberId: string;
+        deleted?: boolean | undefined;
+        publicKey?: string | undefined;
+        signedAt?: number | undefined;
+    };
     approver: {
         publicKey: string;
         userId: string;
@@ -1607,17 +1607,6 @@ export declare const inviteMessageSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
         signedAt?: number | undefined;
         publicRole?: import("../data").GroupMemberRole | undefined;
     };
-    kind: "group-approval";
-    membership: {
-        role: import("../data").GroupMemberRole;
-        signature: string;
-        userId: string;
-        groupId: string;
-        groupMemberId: string;
-        deleted?: boolean | undefined;
-        publicKey?: string | undefined;
-        signedAt?: number | undefined;
-    };
     seed: {
         users: {
             name: string;
@@ -1655,6 +1644,17 @@ export declare const inviteMessageSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
             signedAt?: number | undefined;
         }[];
     };
+    kind: "group-approval";
+    membership: {
+        role: import("../data").GroupMemberRole;
+        signature: string;
+        userId: string;
+        groupId: string;
+        groupMemberId: string;
+        deleted?: boolean | undefined;
+        publicKey?: string | undefined;
+        signedAt?: number | undefined;
+    };
     approver: {
         publicKey: string;
         userId: string;
@@ -1687,17 +1687,6 @@ export declare const inviteMessageSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
         signedAt?: number | undefined;
         publicRole?: import("../data").GroupMemberRole | undefined;
     };
-    kind: "group-approval";
-    membership: {
-        role: import("../data").GroupMemberRole;
-        signature: string;
-        userId: string;
-        groupId: string;
-        groupMemberId: string;
-        deleted?: boolean | undefined;
-        publicKey?: string | undefined;
-        signedAt?: number | undefined;
-    };
     seed: {
         users: {
             name: string;
@@ -1735,6 +1724,17 @@ export declare const inviteMessageSchema: z.ZodDiscriminatedUnion<"kind", [z.Zod
             signedAt?: number | undefined;
         }[];
     };
+    kind: "group-approval";
+    membership: {
+        role: import("../data").GroupMemberRole;
+        signature: string;
+        userId: string;
+        groupId: string;
+        groupMemberId: string;
+        deleted?: boolean | undefined;
+        publicKey?: string | undefined;
+        signedAt?: number | undefined;
+    };
     approver: {
         publicKey: string;
         userId: string;

package/dist/package-loader/isolated-artifact.d.ts

@@ -113,6 +113,21 @@ export interface IIsolatedPackageTable {
      * table. Storage policy, like `localOnly`: changing them needs a higher `versionNumber`.
      */
     indexes?: IIsolatedTableIndex[];
+    /**
+     * The required `id` field holding each row's owner, a user id. The host derives each row's
+     * id from its owner (see `signedKey`), signs rows on save with the signed-in user's key, and
+     * adds the signature, signing time, table/context binding, and `signedIdSeed` columns. In a
+     * group it refuses a row that isn't validly signed by its owner, a Writer, under its derived
+     * id. Not on a local-only table. A table has it, and the same primary key, from its first
+     * version or never.
+     */
+    signedBy?: string;
+    /**
+     * With `signedBy`: the fields that, with the owner, name a row; each row's id is derived from
+     * its owner and these fields. Without it, from its owner and a host-chosen seed. A table has
+     * the same `signedKey` in every version.
+     */
+    signedKey?: string[];
 }
 /** One index of an isolated package table: field names in order, each ascending unless set. */
 export interface IIsolatedTableIndex {

package/dist/package-loader/isolated-artifact.js

@@ -281,7 +281,17 @@ function validatePackageTables(manifest, strict) {
         if (forbiddenIdentity) {
             throw new Error(`${tableLabel} must not declare ${forbiddenIdentity}`);
         }
-        assertOnlyKeys(table, ["name", "description", "primaryKeyName", "fields", "versionNumber", "localOnly", "indexes"], tableLabel);
+        assertOnlyKeys(table, [
+            "name",
+            "description",
+            "primaryKeyName",
+            "fields",
+            "versionNumber",
+            "localOnly",
+            "indexes",
+            "signedBy",
+            "signedKey",
+        ], tableLabel);
         if (typeof table.name !== "string" || table.name.trim() === "") {
             throw new Error(`${tableLabel}.name is required`);
         }
@@ -318,6 +328,7 @@ function validatePackageTables(manifest, strict) {
             table.versionNumber = 1;
         }
         (0, package_table_identity_1.validateTableIndexes)(table.indexes, new Set(table.fields.map((field) => field.name)), `${tableLabel}.indexes`, table.localOnly);
+        (0, package_table_identity_1.validateSignedTable)(table, tableLabel);
     }
 }
 function validateProvidedContract(contract, index, packageTables, strict) {

package/dist/package-loader/isolated-runtime.d.ts

@@ -207,6 +207,10 @@ export interface IIsolatedPackageTableDeclaration extends IIsolatedPackageTableR
     localOnly?: boolean;
     /** Indexes; see `IIsolatedPackageTable.indexes`. */
     indexes?: IIsolatedTableIndex[];
+    /** The field holding each row's owner; see `IIsolatedPackageTable.signedBy`. */
+    signedBy?: string;
+    /** The fields naming a row among its owner's; see `IIsolatedPackageTable.signedKey`. */
+    signedKey?: string[];
 }
 /**
  * Trusted host capability for isolated-package table persistence.

package/dist/package-loader/isolated-table-gateway.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createMemoryIsolatedPackageTableGateway = createMemoryIsolatedPackageTableGateway;
 exports.createIsolatedPackageTableGateway = createIsolatedPackageTableGateway;
+const lodash_1 = require("lodash");
+const authority_write_checks_1 = require("../data/authority-write-checks");
 const table_container_1 = require("../data/orm/table-container");
 const types_1 = require("../data/orm/types");
 const package_table_identity_1 = require("../data/package-table-identity");
@@ -44,12 +46,16 @@ function validateDeclaration(declaration) {
         throw new Error("Isolated table localOnly must be a boolean");
     }
     (0, package_table_identity_1.validateTableIndexes)(declaration.indexes, fieldNames, "Isolated table indexes", declaration.localOnly);
-    const { localOnly, ...rest } = declaration;
+    // A stored definition's fields already carry the host's signature columns.
+    (0, package_table_identity_1.validateSignedTable)(declaration, "Isolated table", { hostFields: true });
+    const { localOnly, signedBy, signedKey, ...rest } = declaration;
     return {
         ...rest,
         fields: declaration.fields.map((field) => ({ ...field })),
         versionNumber: versionNumber(declaration),
         ...(localOnly ? { localOnly: true } : {}),
+        ...(signedBy === undefined ? {} : { signedBy }),
+        ...(signedKey === undefined ? {} : { signedKey: [...signedKey] }),
     };
 }
 function toMetaData(rawDeclaration) {
@@ -60,11 +66,14 @@ function toMetaData(rawDeclaration) {
         name: declaration.tableName,
         description: declaration.description,
         primaryKeyName: declaration.primaryKeyName,
-        fields: declaration.fields,
+        // A signed table stores the host's signature columns beside the package's fields.
+        fields: declaration.signedBy ? (0, package_table_identity_1.withSignedTableFields)(declaration.fields) : declaration.fields,
         versionNumber: versionNumber(declaration),
         // Only when set: stored definitions hash their metadata, and older ones have no such keys.
         ...(declaration.localOnly ? { localOnly: true } : {}),
         ...(declaration.indexes?.length ? { indexes: declaration.indexes } : {}),
+        ...(declaration.signedBy === undefined ? {} : { signedBy: declaration.signedBy }),
+        ...(declaration.signedKey === undefined ? {} : { signedKey: declaration.signedKey }),
     };
 }
 function normalizedMetaData(metaData) {
@@ -92,6 +101,15 @@ function selectNewerDefinition(existing, incoming) {
     if (existingVersion === incomingVersion && !sameDefinition(existing, incoming)) {
         throw new Error(`Isolated table "${(0, package_table_identity_1.packageScopedTableName)(requiredPackageId(incoming), incoming.name)}" has different schemas at version ${incomingVersion}`);
     }
+    if (existing.signedBy !== incoming.signedBy) {
+        throw new Error(`Isolated table "${(0, package_table_identity_1.packageScopedTableName)(requiredPackageId(incoming), incoming.name)}" is signed from its first version or never; signedBy can't change`);
+    }
+    if (!(0, lodash_1.isEqual)(existing.signedKey, incoming.signedKey)) {
+        throw new Error(`Isolated table "${(0, package_table_identity_1.packageScopedTableName)(requiredPackageId(incoming), incoming.name)}" derives row ids from its signedKey, so signedKey can't change`);
+    }
+    if (existing.signedBy && existing.primaryKeyName !== incoming.primaryKeyName) {
+        throw new Error(`Isolated table "${(0, package_table_identity_1.packageScopedTableName)(requiredPackageId(incoming), incoming.name)}" keeps its derived row ids in its primary key, so the primary key can't change`);
+    }
     const decision = (0, table_container_1.checkVersionedUpdate)(existingVersion, incomingVersion, existing, incoming);
     if (decision === "update") {
         return incoming;
@@ -114,6 +132,8 @@ function declarationFromMetaData(metaData) {
         versionNumber: metaData.versionNumber,
         localOnly: metaData.localOnly,
         ...(metaData.indexes?.length ? { indexes: metaData.indexes } : {}),
+        ...(metaData.signedBy === undefined ? {} : { signedBy: metaData.signedBy }),
+        ...(metaData.signedKey === undefined ? {} : { signedKey: metaData.signedKey }),
     });
 }
 function metaDataFromStoredDefinition(record, incoming) {
@@ -136,6 +156,9 @@ function metaDataFromStoredDefinition(record, incoming) {
 }
 function registerDeclaration(declarations, byTableId, rawDeclaration) {
     const declaration = validateDeclaration(rawDeclaration);
+    // Package declarations leave the host columns out. Only internal reconstruction of a
+    // stored definition (declarationFromMetaData) may already include those columns.
+    (0, package_table_identity_1.validateSignedTable)(declaration, "Isolated table");
     const key = tableKey(declaration);
     const tableId = (0, package_table_identity_1.packageScopedTableId)(declaration.packageId, declaration.tableName);
     const existingKey = byTableId.get(tableId);
@@ -430,9 +453,11 @@ function createIsolatedPackageTableGateway(dataContext) {
                         if (plan.existingRecord) {
                             await definitionsTable.save(plan.existingRecord, { restoreIfDeleted: true });
                         }
-                        else {
+                        else if (!plan.activeMetaData.signedBy) {
                             await definitionsTable.delete(requiredTableId(plan.activeMetaData));
                         }
+                        // A signed declaration is permanent even if activation fails. Retaining an unused
+                        // definition is safe; deleting it would reopen the unsigned-definition bypass.
                     }
                     catch (rollbackError) {
                         failures.push(rollbackError);
@@ -445,6 +470,9 @@ function createIsolatedPackageTableGateway(dataContext) {
             }
             for (const definition of definitions) {
                 dataContext.tableContainer.registerTableDefinition(definition, { overwrite: true });
+                // A signed table's check is keyed by its physical name; register it with the table, so
+                // the host finds it when it builds the table's data source.
+                (0, authority_write_checks_1.tableWriteCheckFor)(definition.metaData);
             }
             declarations.clear();
             byTableId.clear();

package/dist/system-ids.d.ts

@@ -213,3 +213,5 @@ export declare const packagesContractId = "00mvdhk66tdqrj3hy0bacmj32";
  * Allocated once with newid() for System Host Shell v1.
  */
 export declare const hostShellContractId = "00mveexhw7ezjfghxomlo011g";
+/** Local-only System Group Members v1; allocated once with newid(). */
+export declare const groupMembersContractId = "00mvzfzkuf4djwjrsxq9cnaxt";

package/dist/system-ids.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.hostShellContractId = exports.packagesContractId = exports.desktopToolsContractId = exports.hostToolsContractId = exports.toolCatalogContractId = exports.schedulerToolIds = exports.schedulerContractId = exports.contractCatalogToolIds = exports.contractCatalogContractId = exports.httpToolIds = exports.httpContractId = exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.syncCheckContractId = exports.appUpdatesContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCoreRevokedPublishPublicKeys = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
+exports.groupMembersContractId = exports.hostShellContractId = exports.packagesContractId = exports.desktopToolsContractId = exports.hostToolsContractId = exports.toolCatalogContractId = exports.schedulerToolIds = exports.schedulerContractId = exports.contractCatalogToolIds = exports.contractCatalogContractId = exports.httpToolIds = exports.httpContractId = exports.localFoldersToolIds = exports.localFoldersContractId = exports.identityToolIds = exports.identityContractId = exports.invitesToolIds = exports.invitesContractId = exports.toolAccessControlToolIds = exports.toolAccessControlContractId = exports.syncCheckContractId = exports.appUpdatesContractId = exports.networkControlContractId = exports.networkDiagnosticsContractId = exports.deviceOperationsContractId = exports.logsContractId = exports.peersSystemPackageId = exports.peersCoreRevokedPublishPublicKeys = exports.peersCorePublishPublicKey = exports.peersCorePackageRepoUrl = exports.peersCorePackageId = exports.createGroupToolId = exports.queryDatabaseToolId = exports.runWorkflowToolId = exports.defaultSendMessageToolId = exports.defaultAssistantRunnerToolId = exports.adminAssistantId = exports.openCodeAssistantId = exports.defaultAssistantId = exports.peersRootUserId = void 0;
 /** Stable user ID that owns built-in Peers system records. */
 exports.peersRootUserId = "000peers0user000000000001";
 /** Default assistant used when no user-selected assistant is available. */
@@ -220,3 +220,5 @@ exports.packagesContractId = "00mvdhk66tdqrj3hy0bacmj32";
  * Allocated once with newid() for System Host Shell v1.
  */
 exports.hostShellContractId = "00mveexhw7ezjfghxomlo011g";
+/** Local-only System Group Members v1; allocated once with newid(). */
+exports.groupMembersContractId = "00mvzfzkuf4djwjrsxq9cnaxt";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@peers-app/peers-sdk",
-  "version": "0.28.10",
+  "version": "0.28.12",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/peers-app/peers-sdk.git"