@peers-app/peers-sdk 0.28.11 → 0.28.12

package/dist/contracts/contract-resolvers.js

@@ -211,6 +211,7 @@ async function isSelfTrustedContractCaller(userContext, remoteIdentity) {
 }
 const permissionDenied = (call, reason) => new Error(`Permission denied: ${call.member} '${call.name}'.${call.operation} on contract ${call.contractId}${reason ? ` (${reason})` : ""}`);
 const localOnlyContractIds = new Set([
+    system_ids_1.groupMembersContractId,
     system_ids_1.hostToolsContractId,
     system_ids_1.desktopToolsContractId,
     system_ids_1.contractCatalogContractId,

package/dist/contracts/index.d.ts

@@ -19,6 +19,7 @@ export * from "./system/app-updates-contract";
 export { CONTRACT_CATALOG_VERSION, contractCatalogProviderPackageId, getContractCatalogDefinition, type IContractCatalogConsumer, type IContractDefinitionWithPolicy, type IContractProviderInfo, type IContractToolPolicy, type IExposedContractInfo, type IExposedToolInfo, type IGetContractDefinitionInput, type IListContractProvidersInput, } from "./system/contract-catalog-contract";
 export * from "./system/desktop-tools-contract";
 export { DEVICE_OPERATIONS_CONTRACT_VERSION, DEVICE_OPERATIONS_MAX_QUERY_LENGTH, DEVICE_OPERATIONS_MAX_RESULT_BYTES, DEVICE_OPERATIONS_MAX_ROWS, DEVICE_OPERATIONS_MAX_TOOLS, type DeviceOperationCapability, deviceOperationsProviderPackageId, deviceOperationsToolIds, getDeviceOperationsContractDefinition, type IDeviceDatabaseQueryInput, type IDeviceDatabaseQueryResult, type IDeviceOperationStatus, type IDeviceToolListInput, type IDeviceToolLookupInput, type IDeviceToolLookupResult, type IDeviceToolRunInput, } from "./system/device-operations-contract";
+export * from "./system/group-members-contract";
 export * from "./system/host-shell-contract";
 export * from "./system/host-tools-contract";
 export { getHttpContractDefinition, HTTP_CONTRACT_VERSION, HTTP_DEFAULT_TIMEOUT_MS, HTTP_MAX_BODY_BYTES, HTTP_MAX_TIMEOUT_MS, httpProviderPackageId, type IHttpCancelInput, type IHttpConsumer, type IHttpCredentialInfo, type IHttpMultipartPart, type IHttpPolicyInfo, type IHttpRequestInput, type IHttpRequestResult, } from "./system/http-contract";

package/dist/contracts/index.js

@@ -103,6 +103,7 @@ Object.defineProperty(exports, "DEVICE_OPERATIONS_MAX_TOOLS", { enumerable: true
 Object.defineProperty(exports, "deviceOperationsProviderPackageId", { enumerable: true, get: function () { return device_operations_contract_1.deviceOperationsProviderPackageId; } });
 Object.defineProperty(exports, "deviceOperationsToolIds", { enumerable: true, get: function () { return device_operations_contract_1.deviceOperationsToolIds; } });
 Object.defineProperty(exports, "getDeviceOperationsContractDefinition", { enumerable: true, get: function () { return device_operations_contract_1.getDeviceOperationsContractDefinition; } });
+__exportStar(require("./system/group-members-contract"), exports);
 __exportStar(require("./system/host-shell-contract"), exports);
 __exportStar(require("./system/host-tools-contract"), exports);
 var http_contract_1 = require("./system/http-contract");

package/dist/contracts/system/group-members-contract.d.ts

@@ -0,0 +1,25 @@
+import type { IContractConsumerBase } from "../contract-proxy";
+import type { IContractDefinition } from "../types";
+/** Version of the local-only System Group Members contract. */
+export declare const GROUP_MEMBERS_CONTRACT_VERSION = 1;
+/** A current member with at least Reader access; names come from signed user profiles. */
+export interface IGroupMemberInfo {
+    userId: string;
+    name?: string;
+    role: string;
+    accessLevel: number;
+}
+/** Membership of the caller's data context. Personal contexts contain only their owner. */
+export interface IGroupMembersResult {
+    dataContextId: string;
+    personal: boolean;
+    members: IGroupMemberInfo[];
+}
+/** Package-safe, read-only membership consumer. No caller-supplied group id is accepted. */
+export interface IGroupMembersConsumer extends IContractConsumerBase {
+    tools: {
+        getMembers(): Promise<IGroupMembersResult>;
+    };
+}
+/** Return the System Group Members v1 declaration. Tool identities are derived by the catalog. */
+export declare function getGroupMembersContractDefinition(): IContractDefinition;

package/dist/contracts/system/group-members-contract.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GROUP_MEMBERS_CONTRACT_VERSION = void 0;
+exports.getGroupMembersContractDefinition = getGroupMembersContractDefinition;
+const system_ids_1 = require("../../system-ids");
+const field_type_1 = require("../../types/field-type");
+const system_contracts_1 = require("../system-contracts");
+/** Version of the local-only System Group Members contract. */
+exports.GROUP_MEMBERS_CONTRACT_VERSION = 1;
+/** Return the System Group Members v1 declaration. Tool identities are derived by the catalog. */
+function getGroupMembersContractDefinition() {
+    return {
+        contractId: system_ids_1.groupMembersContractId,
+        version: exports.GROUP_MEMBERS_CONTRACT_VERSION,
+        devTag: "dev",
+        name: "System Group Members",
+        description: "Current verified members of the caller's own data context.",
+        tables: [],
+        observables: [],
+        events: [],
+        tools: [
+            {
+                name: "getMembers",
+                usageDescription: "Read current members, including the founder and Readers, in this context.",
+                inputFields: [],
+                outputFields: [
+                    { name: "dataContextId", type: field_type_1.FieldType.id },
+                    { name: "personal", type: field_type_1.FieldType.boolean },
+                    {
+                        name: "members",
+                        type: field_type_1.FieldType.object,
+                        isArray: true,
+                        fields: [
+                            { name: "userId", type: field_type_1.FieldType.id },
+                            { name: "name", type: field_type_1.FieldType.string, optional: true },
+                            { name: "role", type: field_type_1.FieldType.string },
+                            { name: "accessLevel", type: field_type_1.FieldType.number },
+                        ],
+                    },
+                ],
+            },
+        ],
+    };
+}
+(0, system_contracts_1.registerSystemContract)({
+    providerPackageId: system_ids_1.peersSystemPackageId,
+    contractId: system_ids_1.groupMembersContractId,
+    version: exports.GROUP_MEMBERS_CONTRACT_VERSION,
+    getDefinition: getGroupMembersContractDefinition,
+});

package/dist/data/authority-write-checks.d.ts

@@ -1,8 +1,32 @@
 import type { IGroupMember } from "./group-members";
 import type { IGroup } from "./groups";
-import { type ITableWriteCheckContext } from "./orm/write-checks";
+import { type ISignedRow } from "./orm/signed-package-table";
+import type { ITableMetaData } from "./orm/types";
+import { type ITableWriteCheckContext, type TableWriteCheck } from "./orm/write-checks";
 import type { IPackageVersion } from "./package-versions";
 import type { IPackage } from "./packages";
+/**
+ * Check the signed stamp: package approvals belong to this context, and a replacement must
+ * not have been signed before the row on record. The
+ * tables' `signAndSave` puts `signedAt` under the signature, so a member can't restore a revoked
+ * grant, an earlier group setting or an earlier release selection by serving a copy of an older,
+ * validly signed row as a new change. Remember the stored stamp in device-local personal
+ * storage before it can be deleted: an unsigned package delete must not erase revocations.
+ * A row signed before the field existed counts as oldest.
+ *
+ * @param tableName - The table, for the refusal.
+ * @param existing - The row on record, if any.
+ * @param candidate - The row about to be stored, or undefined for a delete.
+ * @param context - Where the write lands.
+ */
+export declare function checkSignedOrder(tableName: string, existing: {
+    signedAt?: number;
+    signature?: string;
+} | undefined, candidate: {
+    signedAt?: number;
+    signature?: string;
+    signedContextId?: string;
+} | undefined, context: ITableWriteCheckContext): Promise<void>;
 /**
  * A membership must be signed by a member who counts as at least Admin, at least the role
  * granted, and at least the member's current role. Only the founder writes the founder's row.
@@ -40,3 +64,36 @@ export declare function isPackageRowAdminSigned(pkg: IPackage, dataContext: ITab
  * accepted from anyone, since every device installs the bundled release.
  */
 export declare function checkPackageVersion(existing: IPackageVersion | undefined, candidate: IPackageVersion | undefined, context: ITableWriteCheckContext): Promise<void>;
+/** A row of a signed package table: its owner in the `signedBy` field, plus the signature. */
+type SignedTableRow = Record<string, any> & ISignedRow;
+/**
+ * The write check for a package table declared with `signedBy`, keyed by its physical name
+ * (`<name>_<packageId>`). In a group, a row (synced or saved locally) is stored only when:
+ * - its id is the one derived from its owner, the user its `signedBy` field names, and its key
+ *   ({@link signedRowIdFor}), so no member can claim another member's row id, even on a device
+ *   that doesn't have that row yet;
+ * - its owner is a Writer or above whose key validly signed it, for this group and table;
+ * - it wasn't signed before the row on record ({@link checkSignedOrder}, so a replay of an older
+ *   signed row can't roll it back on a device that has the newer one).
+ *
+ * A delete carries no author, so a row is never deleted: a package marks it instead. Nothing is
+ * checked in the personal context, which only the user's own devices write.
+ *
+ * @param metaData - The table's metadata, with `signedBy` set.
+ */
+export declare function signedTableWriteCheck(metaData: ITableMetaData): TableWriteCheck<SignedTableRow>;
+/**
+ * The write check the host runs on every write to a table in a group context: the check
+ * registered under the table's physical name, or, for a signed package table, its
+ * {@link signedTableWriteCheck}, registered under that name on first use so the same check
+ * serves later lookups. The host calls this when it builds a table's data source, and the
+ * isolated table gateway when it registers a package's tables, so a signed table is checked
+ * whether its definition arrived with the package or through sync. Generated checks are reused
+ * only for the same primary key, owner field, key fields, and fields; unsigned metadata never
+ * inherits another group's check.
+ *
+ * @param metaData - The table's metadata.
+ * @returns The check, or undefined for a table without one.
+ */
+export declare function tableWriteCheckFor(metaData: ITableMetaData): TableWriteCheck | undefined;
+export {};

package/dist/data/authority-write-checks.js

@@ -1,19 +1,26 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSignedOrder = checkSignedOrder;
 exports.checkGroupMember = checkGroupMember;
 exports.checkGroup = checkGroup;
 exports.checkPackageWrite = checkPackageWrite;
 exports.isPackageRowAdminSigned = isPackageRowAdminSigned;
 exports.checkPackageVersion = checkPackageVersion;
+exports.signedTableWriteCheck = signedTableWriteCheck;
+exports.tableWriteCheckFor = tableWriteCheckFor;
 const lodash_1 = require("lodash");
+const keys_1 = require("../keys");
 const package_author_signing_1 = require("../package-installer/package-author-signing");
 const system_ids_1 = require("../system-ids");
+const utils_1 = require("../utils");
 const devices_1 = require("./devices");
 const group_authority_1 = require("./group-authority");
 const group_member_roles_1 = require("./group-member-roles");
+const signed_package_table_1 = require("./orm/signed-package-table");
 const write_checks_1 = require("./orm/write-checks");
 const package_table_identity_1 = require("./package-table-identity");
 const persistent_vars_1 = require("./persistent-vars");
+const signed_row_id_1 = require("./signed-row-id");
 const user_permissions_1 = require("./user-permissions");
 /**
  * Write checks for the rows that decide authority in a group: memberships, the group row, user
@@ -46,6 +53,11 @@ async function requireSigner(tableName, row, context) {
  * validly signed row as a new change. Remember the stored stamp in device-local personal
  * storage before it can be deleted: an unsigned package delete must not erase revocations.
  * A row signed before the field existed counts as oldest.
+ *
+ * @param tableName - The table, for the refusal.
+ * @param existing - The row on record, if any.
+ * @param candidate - The row about to be stored, or undefined for a delete.
+ * @param context - Where the write lands.
  */
 async function checkSignedOrder(tableName, existing, candidate, context) {
     if (candidate &&
@@ -312,13 +324,176 @@ async function checkDevice(existing, candidate, context) {
         throw (0, write_checks_1.writeNotAuthorized)("PersistentVars", "personal and device settings do not belong in a group");
     }
 });
-(0, write_checks_1.registerTableWriteCheck)("TableDefinitions", (_existing, candidate) => {
+(0, write_checks_1.registerTableWriteCheck)("TableDefinitions", async (existing, candidate, context) => {
+    const signedBy = (record) => record?.metaData?.signedBy;
+    const signedKey = (record) => record?.metaData?.signedKey;
+    // Keep the security declaration even after package unload/restart. A hard delete would
+    // allow a fresh unsigned definition; a soft delete disables fallback sync and loses history.
+    if (signedBy(existing) && (!candidate || candidate.deleted)) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", "a signed table's definition can't be deleted");
+    }
     if (!candidate)
         return;
+    if (signedBy(existing) && existing?.name !== candidate.name) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", "a signed table's identity can't change");
+    }
     try {
         (0, package_table_identity_1.validateTableDefinitionRecord)(candidate);
     }
     catch (error) {
         throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", String(error));
     }
+    // A member can't turn a signed table's checks off (or on) by serving a changed definition.
+    // Compare SQLite's case-insensitive physical identity too: an alternate definition id or
+    // casing must not open an unchecked source over the same storage. Even a signed alias is
+    // refused: its separate schema initialization could rebuild the real table before checks.
+    const { TableDefinitions } = await Promise.resolve().then(() => require("./table-definitions-table"));
+    const physicalName = candidate.name.toLowerCase();
+    const peers = (await TableDefinitions(context.dataContext).list()).filter((record) => record.name.toLowerCase() === physicalName);
+    for (const row of context.retainedRows ?? []) {
+        const record = row;
+        if (record?.name?.toLowerCase() === physicalName)
+            peers.push(record);
+    }
+    if (peers.some((record) => record.name !== candidate.name && (signedBy(record) || signedBy(candidate)))) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", "a signed table can't have a case alias");
+    }
+    if ([...(existing ? [existing] : []), ...peers].some((record) => signedBy(record) !== signedBy(candidate) && (signedBy(record) || signedBy(candidate)))) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", "a table is signed from its first version or never; signedBy can't change");
+    }
+    // Row ids are derived from the key fields, so changing them would orphan every row.
+    if ([...(existing ? [existing] : []), ...peers].some((record) => signedBy(record) && !(0, lodash_1.isEqual)(signedKey(record), signedKey(candidate)))) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", "a signed table's signedKey can't change");
+    }
+    // The derived ids live in the primary key column: another column would hold none of them.
+    const primaryKeyName = (record) => record?.metaData?.primaryKeyName;
+    if ([...(existing ? [existing] : []), ...peers].some((record) => signedBy(record) && primaryKeyName(record) !== primaryKeyName(candidate))) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", "a signed table's primary key can't change");
+    }
+    if (signedBy(candidate) && candidate.deleted) {
+        throw (0, write_checks_1.writeNotAuthorized)("TableDefinitions", "a signed table's definition can't be deleted");
+    }
 });
+// Generated checks can be replaced for a different context's declaration. Existing sources
+// keep their own closure, and unsigned tables never inherit a generated signed-table check.
+const signedCheckMetadata = new WeakMap();
+/**
+ * The write check for a package table declared with `signedBy`, keyed by its physical name
+ * (`<name>_<packageId>`). In a group, a row (synced or saved locally) is stored only when:
+ * - its id is the one derived from its owner, the user its `signedBy` field names, and its key
+ *   ({@link signedRowIdFor}), so no member can claim another member's row id, even on a device
+ *   that doesn't have that row yet;
+ * - its owner is a Writer or above whose key validly signed it, for this group and table;
+ * - it wasn't signed before the row on record ({@link checkSignedOrder}, so a replay of an older
+ *   signed row can't roll it back on a device that has the newer one).
+ *
+ * A delete carries no author, so a row is never deleted: a package marks it instead. Nothing is
+ * checked in the personal context, which only the user's own devices write.
+ *
+ * @param metaData - The table's metadata, with `signedBy` set.
+ */
+function signedTableWriteCheck(metaData) {
+    const tableName = (0, utils_1.getFullTableName)(metaData);
+    const ownerField = metaData.signedBy;
+    if (!ownerField)
+        throw new Error(`Table ${tableName} isn't a signed table`);
+    const identity = { name: metaData.name, signedBy: ownerField, signedKey: metaData.signedKey };
+    return async (existing, candidate, context) => {
+        if (!context.dataContext.groupId)
+            return;
+        if (!candidate) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, "rows in a signed table aren't deleted");
+        }
+        const owner = candidate[ownerField];
+        if (typeof owner !== "string" || !(0, utils_1.isid)(owner)) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, `"${ownerField}" must name the row's owner`);
+        }
+        if (candidate[metaData.primaryKeyName] !== context.recordId) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, "the row's id isn't the record's");
+        }
+        // Ids are derived from the owner (checked below), so only a hash collision reaches this.
+        if (existing && existing[ownerField] !== owner) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, "the row on record belongs to another member");
+        }
+        if (!Number.isSafeInteger(candidate.signedAt)) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, "the row has no signing time");
+        }
+        if (candidate.signedContextId !== context.dataContext.groupId ||
+            candidate.signedTableId !== (0, package_table_identity_1.packageScopedTableId)(metaData.packageId, metaData.name)) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, "signature is for another context or table");
+        }
+        await checkSignedOrder(tableName, existing, candidate, context);
+        let stored;
+        let matchesStoredForm;
+        try {
+            stored = (0, signed_package_table_1.signedPackageRowForStorage)(metaData, candidate, undefined, existing);
+            matchesStoredForm = (0, keys_1.canonicalJSONString)(stored) === (0, keys_1.canonicalJSONString)(candidate);
+        }
+        catch (error) {
+            // Schema, serialization, and canonicalisation failures are all authorization refusals.
+            // A cyclic extra field can fail even after projection succeeds. Sync must still retain
+            // the owner's last authorized version when such a forgery is served after it.
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, `the row doesn't fit the table: ${String(error)}`);
+        }
+        if (!matchesStoredForm) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, "the signed row differs from its stored form");
+        }
+        // Bound to its owner: another member's row under this id would have to name this owner,
+        // and only this owner's key signs that.
+        let ownersId;
+        try {
+            if (metaData.signedKey && stored.signedIdSeed !== undefined) {
+                throw new Error("a row with key fields has no id seed");
+            }
+            ownersId = (0, signed_row_id_1.signedRowIdFor)(identity, stored, stored.signedIdSeed);
+        }
+        catch (error) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, `the row's id can't be checked: ${String(error)}`);
+        }
+        if (stored[metaData.primaryKeyName] !== ownersId) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, "the row's id isn't derived from its owner and key");
+        }
+        const { signer, signerRole } = await requireSigner(tableName, stored, context);
+        if (signer !== owner) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, `signed by ${signer}, not by its owner ${owner}`);
+        }
+        // Members write through their devices only as Writers; a Reader's row relayed by a
+        // Writer's device is refused too.
+        if (signerRole < group_member_roles_1.GroupMemberRole.Writer) {
+            throw (0, write_checks_1.writeNotAuthorized)(tableName, `${owner} isn't a Writer in the group`);
+        }
+    };
+}
+/**
+ * The write check the host runs on every write to a table in a group context: the check
+ * registered under the table's physical name, or, for a signed package table, its
+ * {@link signedTableWriteCheck}, registered under that name on first use so the same check
+ * serves later lookups. The host calls this when it builds a table's data source, and the
+ * isolated table gateway when it registers a package's tables, so a signed table is checked
+ * whether its definition arrived with the package or through sync. Generated checks are reused
+ * only for the same primary key, owner field, key fields, and fields; unsigned metadata never
+ * inherits another group's check.
+ *
+ * @param metaData - The table's metadata.
+ * @returns The check, or undefined for a table without one.
+ */
+function tableWriteCheckFor(metaData) {
+    const tableName = (0, utils_1.getFullTableName)(metaData);
+    const registered = (0, write_checks_1.getTableWriteCheck)(tableName);
+    if (registered && !signedCheckMetadata.has(registered))
+        return registered;
+    if (!metaData.signedBy)
+        return undefined;
+    const previous = registered && signedCheckMetadata.get(registered);
+    if (previous &&
+        previous.primaryKeyName === metaData.primaryKeyName &&
+        previous.signedBy === metaData.signedBy &&
+        (0, lodash_1.isEqual)(previous.signedKey, metaData.signedKey) &&
+        (0, lodash_1.isEqual)(previous.fields, metaData.fields)) {
+        return registered;
+    }
+    const check = signedTableWriteCheck(metaData);
+    signedCheckMetadata.set(check, metaData);
+    (0, write_checks_1.registerTableWriteCheck)(tableName, check);
+    return check;
+}

package/dist/data/group-resign.d.ts

@@ -36,3 +36,33 @@ export interface IResignGroupAuthorityOptions {
  * @param opts - Limit to rows signed by one key.
  */
 export declare function resignGroupAuthority(dataContext: DataContext, opts?: IResignGroupAuthorityOptions): Promise<IResignGroupAuthorityResult>;
+/** What {@link resignSignedPackageRows} did. */
+export interface IResignSignedPackageRowsResult {
+    /** Rows re-signed, by the table's physical name (`<name>_<packageId>`). */
+    resigned: Record<string, number>;
+    /** Rows left as they were, with why; no `recordId` when the whole table couldn't be opened. */
+    refused: {
+        table: string;
+        recordId?: string;
+        error: string;
+    }[];
+}
+/**
+ * Re-sign this user's rows in a group's signed package tables (`defineTable({ signedBy })`)
+ * that `signedByKey` signed, with `secretKey`. Key rotation calls it with the retired key and
+ * the new one: every device verifies a signed row against its owner's current key, so rows
+ * signed only by a retired key would stop verifying on devices that don't have them yet.
+ *
+ * Each row is signed again unchanged, at a new signing time, through its table's own save
+ * ({@link SignedPackageTable.resign}), so the group's write check judges the new signature.
+ * Tables come from the group's stored definitions, so a package that isn't loaded is covered.
+ * Rows a table refuses are left as they were and reported.
+ *
+ * @param dataContext - The group's context (not the personal context, where nothing is checked).
+ * @param opts.signedByKey - The retired public key: only rows it validly signed are re-signed.
+ * @param opts.secretKey - The new secret key.
+ */
+export declare function resignSignedPackageRows(dataContext: DataContext, opts: {
+    signedByKey: string;
+    secretKey: string;
+}): Promise<IResignSignedPackageRowsResult>;

package/dist/data/group-resign.js

@@ -1,8 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resignGroupAuthority = resignGroupAuthority;
+exports.resignSignedPackageRows = resignSignedPackageRows;
 const keys_1 = require("../keys");
+const signed_package_table_1 = require("./orm/signed-package-table");
 const write_checks_1 = require("./orm/write-checks");
+const package_table_identity_1 = require("./package-table-identity");
 /**
  * Re-sign the rows that carry a group's authority (the group row, memberships, packages and
  * package versions) with this device's current key, so they count under the group's verified
@@ -72,3 +75,74 @@ async function resignGroupAuthority(dataContext, opts = {}) {
     await resign(versions, await versions.list());
     return result;
 }
+/**
+ * Re-sign this user's rows in a group's signed package tables (`defineTable({ signedBy })`)
+ * that `signedByKey` signed, with `secretKey`. Key rotation calls it with the retired key and
+ * the new one: every device verifies a signed row against its owner's current key, so rows
+ * signed only by a retired key would stop verifying on devices that don't have them yet.
+ *
+ * Each row is signed again unchanged, at a new signing time, through its table's own save
+ * ({@link SignedPackageTable.resign}), so the group's write check judges the new signature.
+ * Tables come from the group's stored definitions, so a package that isn't loaded is covered.
+ * Rows a table refuses are left as they were and reported.
+ *
+ * @param dataContext - The group's context (not the personal context, where nothing is checked).
+ * @param opts.signedByKey - The retired public key: only rows it validly signed are re-signed.
+ * @param opts.secretKey - The new secret key.
+ */
+async function resignSignedPackageRows(dataContext, opts) {
+    if (!dataContext.groupId) {
+        throw new Error("resignSignedPackageRows needs a group context");
+    }
+    const { TableDefinitions } = await Promise.resolve().then(() => require("./table-definitions-table"));
+    const userId = dataContext.userContext.userId;
+    const result = { resigned: {}, refused: [] };
+    const definitions = (await TableDefinitions(dataContext).list()).filter((record) => !record.deleted && record.metaData?.signedBy);
+    for (const definition of definitions) {
+        const { name } = definition;
+        let table;
+        let rows;
+        try {
+            table = await openTable(dataContext, definition);
+            if (!(table instanceof signed_package_table_1.SignedPackageTable)) {
+                throw new Error("not a signed table on this device");
+            }
+            rows = await table.list({ [table.ownerField]: userId });
+        }
+        catch (error) {
+            result.refused.push({ table: name, error: String(error) });
+            continue;
+        }
+        // Only rows that key really signed: a row can name any key in its signature field.
+        for (const row of rows.filter((row) => (0, keys_1.signedByKey)(row) === opts.signedByKey)) {
+            try {
+                await signed_package_table_1.SignedPackageTable.resign(table, row, opts.secretKey);
+                result.resigned[name] = (result.resigned[name] ?? 0) + 1;
+            }
+            catch (error) {
+                result.refused.push({
+                    table: name,
+                    recordId: row[table.primaryKeyName],
+                    error: String(error),
+                });
+            }
+        }
+    }
+    return result;
+}
+/**
+ * The table this device stores the definition's rows through: the loaded package's, else the
+ * fallback over the stored definition. Always the live binding, even when a newer definition is
+ * stored: its rows are stored in its form (an older table refuses rows with newer columns), and
+ * a second source over the newer definition would rebuild the SQL table under the live one and
+ * write outside the mutation queue sync uses.
+ */
+async function openTable(dataContext, definition) {
+    (0, package_table_identity_1.validateTableDefinitionRecord)(definition);
+    try {
+        return dataContext.tableContainer.getTableByName(definition.name);
+    }
+    catch {
+        return dataContext.tableContainer.getFallbackTable(definition.name);
+    }
+}

package/dist/data/index.d.ts

@@ -27,6 +27,7 @@ export * from "./packages.utils";
 export * from "./peer-types";
 export * from "./peers-services-registration.pvar";
 export * from "./persistent-vars";
+export * from "./signed-row-id";
 export * from "./sync-recovery-queue";
 export * from "./table-definitions-table";
 export * from "./tool-access";

package/dist/data/index.js

@@ -43,6 +43,7 @@ __exportStar(require("./packages.utils"), exports);
 __exportStar(require("./peer-types"), exports);
 __exportStar(require("./peers-services-registration.pvar"), exports);
 __exportStar(require("./persistent-vars"), exports);
+__exportStar(require("./signed-row-id"), exports);
 __exportStar(require("./sync-recovery-queue"), exports);
 __exportStar(require("./table-definitions-table"), exports);
 __exportStar(require("./tool-access"), exports);

package/dist/data/orm/index.d.ts

@@ -6,6 +6,7 @@ export * from "./doc";
 export * from "./event-registry";
 export * from "./factory";
 export * from "./multi-cursors";
+export * from "./signed-package-table";
 export * from "./sql.data-source";
 export * from "./sql-db";
 export * from "./subscribable.data-source";

package/dist/data/orm/index.js

@@ -22,6 +22,7 @@ __exportStar(require("./doc"), exports);
 __exportStar(require("./event-registry"), exports);
 __exportStar(require("./factory"), exports);
 __exportStar(require("./multi-cursors"), exports);
+__exportStar(require("./signed-package-table"), exports);
 __exportStar(require("./sql.data-source"), exports);
 __exportStar(require("./sql-db"), exports);
 __exportStar(require("./subscribable.data-source"), exports);