@cello-protocol/daemon 0.0.230 → 0.0.232

package/dist/channel-membership-store.js

@@ -0,0 +1,226 @@
+/**
+ * ⚠️ **THERE IS NO `channel_settings` TABLE, AND THERE MUST NOT BE ONE.** This store first created
+ * its own, duplicating four columns of 018's `channel_config`, and nothing in production ever wrote
+ * a row to it. Every membership read came back empty, so every join was refused
+ * `not_admin_of_channel` on a channel the daemon demonstrably administered, every eject threw
+ * `channel_unknown`, and no group key was ever minted — which meant the fetch key was absent and the
+ * relay served the queue to anyone.
+ *
+ * Two tables holding one fact, with the live path reading the empty one. Collapsed into
+ * `channel_config` while the database was still empty. If you are about to add a second table for a
+ * publisher's decisions about its own channel: that is this bug.
+ */
+import { CHANNEL_CONFIG_CREATE_SQL } from "./channel-config-store.js";
+export { CHANNEL_CONFIG_CREATE_SQL };
+export const CHANNEL_MEMBERS_CREATE_SQL = `
+  CREATE TABLE IF NOT EXISTS channel_members (
+    channel_pubkey     TEXT    NOT NULL,
+    subscriber_pubkey  TEXT    NOT NULL,
+    joined_at          INTEGER NOT NULL,
+    -- active | pending | ejected | refused. An ejected row is NEVER deleted — see the header.
+    status             TEXT    NOT NULL,
+    PRIMARY KEY (channel_pubkey, subscriber_pubkey)
+  );
+`;
+export class ChannelMembershipError extends Error {
+    code;
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.name = "ChannelMembershipError";
+        this.code = code;
+    }
+}
+export class ChannelMembershipStore {
+    #db;
+    #logger;
+    constructor(db, logger) {
+        this.#db = db;
+        this.#logger = logger;
+        this.#db.exec(CHANNEL_CONFIG_CREATE_SQL);
+        this.#db.exec(CHANNEL_MEMBERS_CREATE_SQL);
+    }
+    /** Create or update a channel's settings. Never touches `key_generation` — only an eject does. */
+    putSettings(channelHex, s, now = Date.now()) {
+        this.#db
+            .prepare(`INSERT INTO channel_config
+           (channel_pubkey, access, members_visible, guidance, retention_seconds, relays, admin_pubkey, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+         ON CONFLICT (channel_pubkey) DO UPDATE SET
+           access = excluded.access, members_visible = excluded.members_visible,
+           guidance = excluded.guidance, retention_seconds = excluded.retention_seconds,
+           relays = excluded.relays, admin_pubkey = excluded.admin_pubkey,
+           updated_at = excluded.updated_at`)
+            .run(channelHex.toLowerCase(), s.access, s.members_visible ? 1 : 0, s.guidance, s.retention_seconds, JSON.stringify(s.relays), s.admin_pubkey ?? "", now);
+    }
+    settings(channelHex) {
+        const row = this.#db
+            .prepare(`SELECT access, members_visible, guidance, retention_seconds, relays, key_generation, admin_pubkey
+           FROM channel_config WHERE channel_pubkey = ?`)
+            .get(channelHex.toLowerCase());
+        if (!row)
+            return null;
+        let relays = [];
+        try {
+            const parsed = JSON.parse(row.relays);
+            if (Array.isArray(parsed))
+                relays = parsed.filter((r) => typeof r === "string");
+        }
+        catch {
+            this.#logger.warn("channel.settings.relays_corrupt", { channel_pubkey: channelHex });
+        }
+        return {
+            access: row.access,
+            members_visible: Number(row.members_visible) === 1,
+            guidance: row.guidance,
+            retention_seconds: Number(row.retention_seconds),
+            relays,
+            key_generation: Number(row.key_generation),
+            admin_pubkey: row.admin_pubkey,
+        };
+    }
+    /**
+     * Record a member. `pending` is an invite-only request awaiting the admin agent's decision.
+     *
+     * ⚠️ A PENDING MEMBER RECEIVES NO KEY — `activeMembers` excludes them. Counting a request as a
+     * membership would auto-approve every stranger who asked, and invite-only admission is the admin's
+     * decision, never a heuristic.
+     */
+    admit(channelHex, subscriberHex, status, joinedAt) {
+        this.#db
+            .prepare(`INSERT INTO channel_members (channel_pubkey, subscriber_pubkey, joined_at, status)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT (channel_pubkey, subscriber_pubkey) DO UPDATE SET status = excluded.status`)
+            .run(channelHex.toLowerCase(), subscriberHex.toLowerCase(), joinedAt, status);
+        /**
+         * ⚠️ THE EVENT NAMES WHAT HAPPENED. This logged `channel.member.joined` for every status, so an
+         * operator grepping for who joined got pending requests and ejections back as joins — the log
+         * asserting something the row contradicts.
+         */
+        const event = status === "active" ? "channel.member.joined"
+            : status === "pending" ? "channel.join.pending"
+                : status === "ejected" ? "channel.member.ejected" : "channel.join.refused";
+        this.#logger.info(event, {
+            channel_pubkey: channelHex, subscriber_pubkey: subscriberHex, status,
+        });
+    }
+    /** Move a pending request to active. The admin agent's explicit decision, never automatic. */
+    approve(channelHex, subscriberHex) {
+        const changed = this.#db
+            .prepare(`UPDATE channel_members SET status = 'active'
+          WHERE channel_pubkey = ? AND subscriber_pubkey = ? AND status = 'pending'`)
+            .run(channelHex.toLowerCase(), subscriberHex.toLowerCase());
+        if (Number(changed.changes) === 0) {
+            throw new ChannelMembershipError("not_an_active_member", "no pending request for that subscriber");
+        }
+        this.#logger.info("channel.member.joined", {
+            channel_pubkey: channelHex, subscriber_pubkey: subscriberHex, status: "active",
+        });
+    }
+    /**
+     * Refuse a PENDING request. Conditional on `pending`, and that condition is the whole method.
+     *
+     * ⚠️ **REFUSING IS NOT EJECTING, AND IT MUST NOT BE ABLE TO ACT LIKE ONE.** An earlier version
+     * upserted `ejected` unconditionally, so an admin who typed a refusal against an existing MEMBER
+     * got `ok: true`, the row said ejected, and the member kept the current group key and fetch key
+     * and went on reading indefinitely. The table and reality disagreed with nothing to say so —
+     * against the order's own rule that an eject without a generation bump is not an eject.
+     *
+     * A refused request gets its own status, not `ejected`: they were never a member, and reusing the
+     * word would make the two indistinguishable in every later read.
+     */
+    refusePending(channelHex, subscriberHex) {
+        const changed = this.#db
+            .prepare(`UPDATE channel_members SET status = 'refused'
+          WHERE channel_pubkey = ? AND subscriber_pubkey = ? AND status = 'pending'`)
+            .run(channelHex.toLowerCase(), subscriberHex.toLowerCase());
+        if (Number(changed.changes) === 0) {
+            throw new ChannelMembershipError("not_a_pending_request", `${subscriberHex.slice(0, 16)} has no pending request on this channel. To remove an existing member, eject them — which re-keys the channel.`);
+        }
+        this.#logger.info("channel.join.refused", {
+            channel_pubkey: channelHex, subscriber_pubkey: subscriberHex, reason: "refused_by_admin",
+        });
+    }
+    statusOf(channelHex, subscriberHex) {
+        const row = this.#db
+            .prepare(`SELECT status FROM channel_members WHERE channel_pubkey = ? AND subscriber_pubkey = ?`)
+            .get(channelHex.toLowerCase(), subscriberHex.toLowerCase());
+        return row ? row.status : null;
+    }
+    /** Who a new key goes to. Pending and ejected are excluded, for different reasons — see above. */
+    activeMembers(channelHex) {
+        const rows = this.#db
+            .prepare(`SELECT subscriber_pubkey FROM channel_members
+          WHERE channel_pubkey = ? AND status = 'active' ORDER BY subscriber_pubkey ASC`)
+            .all(channelHex.toLowerCase());
+        return rows.map((r) => r.subscriber_pubkey);
+    }
+    /**
+     * Eject a member and advance the generation, atomically.
+     *
+     * Returns the new generation and the members it must be delivered to — the ejected one is simply
+     * not in that list, which is the entire mechanism.
+     *
+     * ⚠️ **AN OPEN CHANNEL CANNOT EJECT**, because the member would rejoin the moment they asked: the
+     * re-key would cost every other member a delivery and change nothing. A PUBLIC channel has no
+     * members at all. Both refuse BY NAME, because a generic failure leaves an admin retrying
+     * something that will never work.
+     *
+     * ⚠️ **EJECTING SOMEBODY WHO IS NOT AN ACTIVE MEMBER MUST NOT BUMP THE GENERATION.** Every bump
+     * re-keys every real member, and every re-key is a delivery that can fail — so a mistyped pubkey
+     * would cost the whole channel a key rotation for nothing.
+     */
+    eject(channelHex, subscriberHex) {
+        const channel = channelHex.toLowerCase();
+        const subscriber = subscriberHex.toLowerCase();
+        const settings = this.settings(channel);
+        if (!settings)
+            throw new ChannelMembershipError("channel_unknown", `no settings for ${channel.slice(0, 16)}`);
+        if (settings.access === "public") {
+            throw new ChannelMembershipError("eject_not_applicable_public_channel", "a public channel has no members: anyone may read it, so there is nobody to remove");
+        }
+        if (settings.access === "open") {
+            throw new ChannelMembershipError("eject_not_applicable_open_channel", "an open channel admits anyone who asks, so an ejected member would rejoin immediately");
+        }
+        this.#db.exec("BEGIN IMMEDIATE");
+        let generation;
+        let remaining;
+        try {
+            // Under the write lock, and conditional on `active`: the status check and the bump are one
+            // decision, so a concurrent eject of the same member cannot advance the generation twice.
+            const changed = this.#db
+                .prepare(`UPDATE channel_members SET status = 'ejected'
+            WHERE channel_pubkey = ? AND subscriber_pubkey = ? AND status = 'active'`)
+                .run(channel, subscriber);
+            if (Number(changed.changes) === 0) {
+                throw new ChannelMembershipError("not_an_active_member", `${subscriber.slice(0, 16)} is not an active member of this channel`);
+            }
+            this.#db
+                .prepare(`UPDATE channel_config SET key_generation = key_generation + 1 WHERE channel_pubkey = ?`)
+                .run(channel);
+            generation = Number(this.#db.prepare(`SELECT key_generation FROM channel_config WHERE channel_pubkey = ?`)
+                .get(channel).key_generation);
+            remaining = this.activeMembers(channel);
+            this.#db.exec("COMMIT");
+        }
+        catch (err) {
+            try {
+                this.#db.exec("ROLLBACK");
+            }
+            catch { /* the transaction is already gone */ }
+            throw err;
+        }
+        this.#logger.info("channel.member.ejected", {
+            channel_pubkey: channelHex, subscriber_pubkey: subscriberHex,
+            generation, member_count: remaining.length,
+        });
+        return { generation, remaining };
+    }
+    /** Mint the FIRST generation for a channel that has never issued a key. */
+    startGeneration(channelHex) {
+        this.#db
+            .prepare(`UPDATE channel_config SET key_generation = 1 WHERE channel_pubkey = ? AND key_generation = 0`)
+            .run(channelHex.toLowerCase());
+        return this.settings(channelHex)?.key_generation ?? 0;
+    }
+}
+//# sourceMappingURL=channel-membership-store.js.map

package/dist/channel-membership-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-membership-store.js","sourceRoot":"","sources":["../src/channel-membership-store.ts"],"names":[],"mappings":"AAyBA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,CAAC;AAErC,MAAM,CAAC,MAAM,0BAA0B,GAAG;;;;;;;;;CASzC,CAAC;AA8BF,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IACtC,IAAI,CAA6B;IAC1C,YAAY,IAAgC,EAAE,OAAe;QAC3D,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAYD,MAAM,OAAO,sBAAsB;IACxB,GAAG,CAAiB;IACpB,OAAO,CAAS;IAEzB,YAAY,EAAkB,EAAE,MAAc;QAC5C,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC;QACd,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC5C,CAAC;IAED,kGAAkG;IAClG,WAAW,CAAC,UAAkB,EAAE,CAA0C,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1F,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;;;;;;4CAOoC,CACrC;aACA,GAAG,CACF,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAC7D,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE,EAAE,GAAG,CACrF,CAAC;IACN,CAAC;IAED,QAAQ,CAAC,UAAkB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CACN;wDACgD,CACjD;aACA,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAA4B,CAAC;QAC5D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QAEtB,IAAI,MAAM,GAAa,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAY,CAAC;YACjD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO;YACL,MAAM,EAAE,GAAG,CAAC,MAAuB;YACnC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;YAClD,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAChD,MAAM;YACN,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;YAC1C,YAAY,EAAE,GAAG,CAAC,YAAY;SAC/B,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAkB,EAAE,aAAqB,EAAE,MAAoB,EAAE,QAAgB;QACrF,IAAI,CAAC,GAAG;aACL,OAAO,CACN;;gGAEwF,CACzF;aACA,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAChF;;;;WAIG;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,uBAAuB;YACzD,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB;gBAC7C,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC/E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE;YACvB,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM;SACrE,CAAC,CAAC;IACL,CAAC;IAED,8FAA8F;IAC9F,OAAO,CAAC,UAAkB,EAAE,aAAqB;QAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG;aACrB,OAAO,CACN;oFAC4E,CAC7E;aACA,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,sBAAsB,CAAC,sBAAsB,EAAE,wCAAwC,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE;YACzC,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ;SAC/E,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,aAAa,CAAC,UAAkB,EAAE,aAAqB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG;aACrB,OAAO,CACN;oFAC4E,CAC7E;aACA,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,sBAAsB,CAC9B,uBAAuB,EACvB,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gHAAgH,CAC9I,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE;YACxC,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB;SACzF,CAAC,CAAC;IACL,CAAC;IAED,QAAQ,CAAC,UAAkB,EAAE,aAAqB;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG;aACjB,OAAO,CAAC,uFAAuF,CAAC;aAChG,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,aAAa,CAAC,WAAW,EAAE,CAAmC,CAAC;QAChG,OAAO,GAAG,CAAC,CAAC,CAAE,GAAG,CAAC,MAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAED,kGAAkG;IAClG,aAAa,CAAC,UAAkB;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CACN;wFACgF,CACjF;aACA,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAyC,CAAC;QACzE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,UAAkB,EAAE,aAAqB;QAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC;QAE/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,iBAAiB,EAAE,mBAAmB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjC,MAAM,IAAI,sBAAsB,CAC9B,qCAAqC,EACrC,mFAAmF,CACpF,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,sBAAsB,CAC9B,mCAAmC,EACnC,uFAAuF,CACxF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,IAAI,UAAkB,CAAC;QACvB,IAAI,SAAmB,CAAC;QACxB,IAAI,CAAC;YACH,2FAA2F;YAC3F,0FAA0F;YAC1F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG;iBACrB,OAAO,CACN;qFAC2E,CAC5E;iBACA,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC5B,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,sBAAsB,CAC9B,sBAAsB,EACtB,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C,CACrE,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG;iBACL,OAAO,CAAC,wFAAwF,CAAC;iBACjG,GAAG,CAAC,OAAO,CAAC,CAAC;YAChB,UAAU,GAAG,MAAM,CAChB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,oEAAoE,CAAC;iBACpF,GAAG,CAAC,OAAO,CAAyC,CAAC,cAAc,CACvE,CAAC;YACF,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;YAClF,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE;YAC1C,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,aAAa;YAC5D,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,MAAM;SAC3C,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,2EAA2E;IAC3E,eAAe,CAAC,UAAkB;QAChC,IAAI,CAAC,GAAG;aACL,OAAO,CAAC,8FAA8F,CAAC;aACvG,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,cAAc,IAAI,CAAC,CAAC;IACxD,CAAC;CACF"}

package/dist/channel-membership-wiring.d.ts

@@ -0,0 +1,98 @@
+/**
+ * M16 019-MEMBERSHIP — the join exchange, the eject re-key, and the operator's channel verbs.
+ *
+ * The publishing half is wired next door in `channel-publish-wiring.ts`; this is membership. Both
+ * exist because a module registered into nothing is a feature that does not exist — the mistake 017
+ * shipped and 018 repeated on its other half.
+ *
+ * ⚠️ **THE JOIN FRAME HOOK IS SYNCHRONOUS AND THE HANDLING IS NOT.** `setOnChannelJoinFrame` must
+ * answer "is this mine" immediately, because the ingest path is deciding whether to write the frame
+ * into a transcript as something a person said. The decision is made by CLASSIFYING (a cheap decode)
+ * and the work is then queued, exactly as the document layer does. A rejected promise here must not
+ * take down the content path, so it is caught and logged.
+ */
+import type { Logger } from "./types.js";
+import type { DaemonDatabase } from "./sqlcipher-db.js";
+import type { KeyProvider } from "@cello-protocol/crypto";
+import { ChannelMembershipStore } from "./channel-membership-store.js";
+import { type AdminLookupOutcome } from "./channel-join-exchange.js";
+import { type ChannelAdminOutcome, type SignalingLike } from "./channel-admin-lookup.js";
+type Handler = (params: Record<string, unknown> | undefined, connectionId: string) => Promise<unknown>;
+export interface ChannelMembershipWiringDeps {
+    handlers: Map<string, Handler>;
+    logger: Logger;
+    getDb: () => DaemonDatabase;
+    /** Route a frame into an open session. The session layer owns delivery. */
+    sendInSession: (agentName: string, sessionId: string, content: Uint8Array) => Promise<void>;
+    /** Register the inbound hook. Separate from the document one — see that field's note. */
+    setOnChannelJoinFrame: (cb: (agentName: string, sessionId: string, content: Uint8Array, senderPubkey: string, correlationId?: string) => {
+        consumed: boolean;
+    }) => void;
+    /** Every agent this daemon loaded. A channel IS one of them — looked up by pubkey, never by name. */
+    loadedAgents: ReadonlyArray<{
+        name: string;
+        pubkey: string;
+        keyProvider: KeyProvider;
+    }>;
+    keyProviders: Map<string, KeyProvider>;
+    resolveAgentId: (agentName: string) => string;
+    resolveCurrentAgent: (connectionId: string, explicitAgent?: string) => string | null;
+    /** Open sessions for an agent, so a re-key can ride one this daemon already holds. */
+    activeSessionsFor: (agentName: string) => Array<{
+        sessionId: string;
+        counterpartyPubkeyHex: string;
+    }>;
+    /**
+     * M16 020-CHANADMIN: an agent's directory connection, by NAME (the daemon's own key for it), or
+     * null when it has none. The subscriber asks on ITS OWN authenticated stream — the directory
+     * answers a client that has proved its agent key, which is the difference between this frame and
+     * the relay's copy of it.
+     */
+    signalingFor: (agentName: string) => SignalingLike | null;
+}
+/**
+ * M16 020-CHANADMIN — where the subscriber's admin key comes from.
+ *
+ * The join exchange compares the agent that answered against this. It is deliberately the ONLY
+ * source: the session proves who the counterparty is and says nothing about their authority over a
+ * channel, so "whoever answered" is exactly the hole the check exists to close.
+ *
+ * Two sources, in order:
+ *  1. **This daemon's own settings**, when we publish the channel. No round trip, and no directory
+ *     outage in the path of a join to a channel running on this very machine.
+ *  2. **The directory**, for everything else. Before 020 there was no step 2 and this returned null
+ *     for every channel not published here — so nobody could join anybody else's channel, or their
+ *     own from a second device.
+ *
+ * ⚠️ **`null` MEANS REFUSE, AND EVERY UNKNOWN STILL ENDS HERE.** A directory that cannot be reached,
+ * one that faults, a pubkey that is not a channel, and a lookup that throws all answer `null`, which
+ * the exchange refuses as `admin_unresolved`. 020 removes a refusal that was firing on every
+ * channel; it must not weaken the one that remains.
+ */
+export declare function createProfileAdminPubkey(deps: {
+    members: ChannelMembershipStore;
+    lookup: (agentId: string, channelHex: string) => Promise<ChannelAdminOutcome>;
+    logger: Logger;
+}): (channelHex: string, agentId: string) => Promise<AdminLookupOutcome>;
+export interface ChannelMembershipWiring {
+    /**
+     * The channel's CURRENT fetch key, signed, or undefined when this daemon holds no group key for
+     * it. Handed to the publishing half so a re-key reaches the relays on the very next post — which
+     * is what makes an ejection lock the member out at the relay and not only at the ciphertext.
+     */
+    currentFetchKey: (channelHex: string) => Promise<{
+        pubkey: Uint8Array;
+        time_ms: number;
+        signature: Uint8Array;
+    } | undefined>;
+    /**
+     * M16 021-WAKE: the channel's ACTIVE members, which is who a post's doorbell is rung for. Pending
+     * and ejected rows are excluded by the store — waking a pending request would tell somebody who
+     * has not been admitted that a post exists, and waking an ejected member is the thing the
+     * ejection undid.
+     */
+    activeMembers: (channelHex: string) => string[];
+}
+export declare function wireChannelMembership(deps: ChannelMembershipWiringDeps): ChannelMembershipWiring;
+export {};
+//# sourceMappingURL=channel-membership-wiring.d.ts.map

package/dist/channel-membership-wiring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-membership-wiring.d.ts","sourceRoot":"","sources":["../src/channel-membership-wiring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAK1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,OAAO,EAC8C,KAAK,kBAAkB,EAC3E,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACqB,KAAK,mBAAmB,EAAE,KAAK,aAAa,EACvE,MAAM,2BAA2B,CAAC;AAGnC,KAAK,OAAO,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAEvG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,cAAc,CAAC;IAC5B,2EAA2E;IAC3E,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,yFAAyF;IACzF,qBAAqB,EAAE,CACrB,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,KACnI,IAAI,CAAC;IACV,qGAAqG;IACrG,YAAY,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,WAAW,CAAA;KAAE,CAAC,CAAC;IACxF,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvC,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,mBAAmB,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IACrF,sFAAsF;IACtF,iBAAiB,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtG;;;;;OAKG;IACH,YAAY,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,aAAa,GAAG,IAAI,CAAC;CAC3D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,sBAAsB,CAAC;IAChC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9E,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAyBvE;AA0BD,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,UAAU,CAAA;KAAE,GAAG,SAAS,CAAC,CAAC;IAC7H;;;;;OAKG;IACH,aAAa,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;CACjD;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,2BAA2B,GAAG,uBAAuB,CAsUhG"}