@gryt/core 0.16.1 → 0.17.0

package/dist/mls/deliveryService.fake.js

@@ -155,7 +155,8 @@ export class FakeDeliveryService {
                 if (conversationId === undefined) {
                     const devices = this.devicesOf([me]).map((d) => {
                         const at = this.deviceAddedAt.get(d.deviceId);
-                        return at ? { ...d, createdAt: at, lastSeenAt: at } : d;
+                        const lastResort = [...this.keyPackages].reverse().find((k) => k.deviceId === d.deviceId && k.lastResort)?.data ?? null;
+                        return { ...d, ...(at ? { createdAt: at, lastSeenAt: at } : {}), lastResortKeyPackage: lastResort };
                     });
                     return { ok: true, devices };
                 }
@@ -263,6 +264,15 @@ export class FakeDeliveryService {
                 this.welcomes = this.welcomes.filter((w) => !(w.serverUserId === me && w.deviceId === deviceId && welcomeIds.includes(w.welcomeId)));
                 return { ok: true, deleted: before - this.welcomes.length };
             },
+            requestAdd: async ({ conversationId, deviceId }) => {
+                await tick();
+                if (!member(conversationId))
+                    return fail("not_found", "No such conversation.");
+                if (!this.isDevice(me, deviceId))
+                    return fail("unknown_device", "Publish KeyPackages from this device first.");
+                this.push(this.conversations.get(conversationId), (d) => d.handleAddRequest({ conversationId, serverUserId: me, deviceId }));
+                return { ok: true };
+            },
         };
         // socket.io-parser closes the connection on a packet with more than ten binary parts.
         const guarded = {};
@@ -295,8 +305,13 @@ export class FakeDeliveryService {
         return guarded;
     }
     checkParts(socket, event, value) {
-        const count = (v) => v instanceof Uint8Array ? 1 : Array.isArray(v) ? v.reduce((n, x) => n + count(x), 0)
-            : v && typeof v === "object" ? Object.values(v).reduce((n, x) => n + count(x), 0) : 0;
+        const count = (v) => {
+            if (v instanceof Uint8Array)
+                return 1;
+            if (v && typeof v === "object")
+                return Object.values(v).reduce((n, x) => n + count(x), 0);
+            return 0;
+        };
         const parts = count(value);
         this.stats.mostBinaryParts = Math.max(this.stats.mostBinaryParts, parts);
         if (parts > 10) {

package/dist/mls/dmDriver.js

@@ -9,6 +9,10 @@ const PUBLISH_BATCH = MAX_BINARY_PARTS - 1;
 /** The server's cap on files in one message. */
 const MAX_ATTACHMENT_IDS = 10;
 const WELCOME_WAIT_MS = 10_000;
+/** How often a device out of a group asks to be added, unless the person asks. */
+const ASK_AGAIN_MS = 60_000;
+/** A message can beat the Welcome that comes with it, so a missing group is only news after this. */
+const NOT_ADDED_GRACE_MS = 3_000;
 /** The same cap as a message that isn't MLS: after this a send fails and the text goes back. */
 const SEND_GIVE_UP_MS = 5 * 60_000;
 /** A send with no answer goes again after this, or sooner if the connection comes back. */
@@ -85,6 +89,7 @@ export function createMlsDmDriver(options) {
         };
     }
     const raw = options.transport;
+    const rawRequestAdd = raw.requestAdd?.bind(raw);
     const transport = {
         publishKeyPackages: stopOnRemoval((req) => raw.publishKeyPackages(req)),
         claimKeyPackages: stopOnRemoval((req) => raw.claimKeyPackages(req)),
@@ -96,6 +101,7 @@ export function createMlsDmDriver(options) {
         fetchLog: stopOnRemoval((req) => raw.fetchLog(req)),
         sync: stopOnRemoval((req) => raw.sync(req)),
         ackWelcomes: stopOnRemoval((req) => raw.ackWelcomes(req)),
+        ...(rawRequestAdd ? { requestAdd: stopOnRemoval(rawRequestAdd) } : {}),
     };
     const scope = asIdentityScope(options.scope);
     const trusts = new Map();
@@ -116,6 +122,11 @@ export function createMlsDmDriver(options) {
     const reconciled = new Set();
     const seen = new Set();
     const welcomeWaiters = new Map();
+    /** Conversations with a Welcome for this device that it couldn't join yet, most likely an unpinned member. */
+    const unjoinable = new Set();
+    const asked = new Map();
+    /** Groups this device was taken out of here. It doesn't ask its way back into those. */
+    const left = new Set();
     const flights = new Set();
     let waitingForServer = false;
     let stopped = false;
@@ -269,6 +280,7 @@ export function createMlsDmDriver(options) {
                     const r = await processMlsMessage(open.state, e.data);
                     if (r.kind === "handshake" && r.removed) {
                         await store.deleteGroup(open.rec.conversationId);
+                        left.add(open.rec.conversationId);
                         events.onGroupLost?.({ conversationId: open.rec.conversationId, reason: "removed" });
                         return false;
                     }
@@ -514,12 +526,38 @@ export function createMlsDmDriver(options) {
             welcomeWaiters.set(conversationId, [...(welcomeWaiters.get(conversationId) ?? []), done]);
         });
     }
+    /* Only a member can add a device, so one that's out asks the members' apps to. An old
+       server doesn't answer, which is why nothing waits on it. */
+    async function askToBeAdded(conversationId, force = false) {
+        events.onGroupLost?.({ conversationId, reason: "not_added" });
+        if (!transport.requestAdd || (!force && Date.now() - (asked.get(conversationId) ?? 0) < ASK_AGAIN_MS))
+            return;
+        asked.set(conversationId, Date.now());
+        const r = await transport.requestAdd({ conversationId, deviceId: (await ownDevice()).deviceId });
+        if (!r.ok)
+            throw refused("Asking to be added", r);
+    }
+    function notAddedLater(conversationId) {
+        setTimeout(() => {
+            if (stopped || left.has(conversationId) || unjoinable.has(conversationId))
+                return;
+            void store
+                .loadGroup(conversationId)
+                .then((rec) => (rec ? undefined : askToBeAdded(conversationId)))
+                .catch(() => undefined);
+        }, NOT_ADDED_GRACE_MS);
+    }
     async function ensureOpen(conversationId) {
         if ((await run(conversationId, () => openGroup(conversationId))) === "open")
             return;
         await takeWaitingWelcomes();
-        if (!(await store.loadGroup(conversationId)))
-            await waitForWelcome(conversationId);
+        if (await store.loadGroup(conversationId))
+            return;
+        if (unjoinable.has(conversationId)) {
+            throw new MlsDriverError("peer_unverified", "This device was added, and a member's key isn't pinned here to join with.");
+        }
+        void askToBeAdded(conversationId).catch(() => undefined);
+        await waitForWelcome(conversationId);
     }
     /** "joined", "not_ours" (ack it and forget it), or "retry" (keep it for next time). */
     async function joinFrom(w) {
@@ -569,12 +607,16 @@ export function createMlsDmDriver(options) {
             return "retry";
         const conversationId = w.conversationId;
         const { result, usedLastResort } = await run(conversationId, () => joinFrom(w));
-        if (result === "retry")
+        if (result === "retry") {
+            unjoinable.add(conversationId);
             return "retry";
+        }
         await transport.ackWelcomes({ deviceId: d.deviceId, welcomeIds: [w.welcomeId] });
         if (result !== "joined")
             return "done";
         reconciled.delete(conversationId);
+        unjoinable.delete(conversationId);
+        left.delete(conversationId);
         events.onJoined?.({ conversationId, groupId: w.groupId });
         for (const done of welcomeWaiters.get(conversationId) ?? [])
             done();
@@ -702,7 +744,13 @@ export function createMlsDmDriver(options) {
     async function handleMessage(entry) {
         await run(entry.conversationId, async () => {
             const open = await load(entry.conversationId);
-            if (!open || entry.seq <= open.rec.cursor)
+            if (!open) {
+                // A message for a group this device isn't in: without this it would show nothing.
+                if (entry.kind === "application" && entry.senderDeviceId !== (await ownDevice()).deviceId)
+                    notAddedLater(entry.conversationId);
+                return;
+            }
+            if (entry.seq <= open.rec.cursor)
                 return;
             if (entry.seq === open.rec.cursor + 1 && entry.groupId === open.rec.groupId)
                 await applyEntry(open, entry);
@@ -730,8 +778,24 @@ export function createMlsDmDriver(options) {
             });
         }
     }
-    /** Names from certificates under your own person key: this device's, then your leaves in each group. */
-    async function ownDeviceNames(d, wanted) {
+    /** Adds whatever is missing, as a send would. Who asked only says which group to look at. */
+    async function handleAddRequest(push) {
+        if (push.deviceId === (await ownDevice()).deviceId)
+            return;
+        await run(push.conversationId, async () => {
+            const open = await load(push.conversationId);
+            if (!open || !(await catchUp(open)))
+                return;
+            const peer = (await peopleIn(push.conversationId, open.state)).find((p) => !!p && p !== self);
+            if (!peer || (push.serverUserId !== self && push.serverUserId !== peer))
+                return;
+            await reconcile(open, peer, true);
+        });
+    }
+    /** Names from certificates under your own person key: this device's, your leaves in each group,
+        then the last-resort KeyPackage the server lists with each of your devices. */
+    async function ownDeviceNames(d, listed) {
+        const wanted = new Set(listed.map((x) => x.deviceId));
         const mine = readDeviceCertificate(d.certificate, scope);
         const names = new Map([[mine.deviceId, mine.deviceName]]);
         const unnamed = () => [...wanted].some((id) => !names.has(id));
@@ -751,6 +815,20 @@ export function createMlsDmDriver(options) {
                 }
             }
         }
+        // Checked here, not trusted: a package that doesn't verify, or isn't under your person key, names nothing.
+        for (const x of listed) {
+            if (names.has(x.deviceId) || !x.lastResortKeyPackage)
+                continue;
+            try {
+                const bytes = x.lastResortKeyPackage instanceof Uint8Array ? x.lastResortKeyPackage : new Uint8Array(x.lastResortKeyPackage);
+                const { certificate: c } = await readMlsKeyPackage(bytes, scope);
+                if (c.deviceId === x.deviceId && sameBytes(c.personPublicKey, mine.personPublicKey))
+                    names.set(x.deviceId, c.deviceName);
+            }
+            catch {
+                // Expired or malformed: the device stays unnamed rather than misnamed.
+            }
+        }
         return names;
     }
     async function ownDevices() {
@@ -759,7 +837,7 @@ export function createMlsDmDriver(options) {
             throw refused("Listing devices", r);
         const d = await ownDevice();
         const listed = r.devices.filter((x) => x.serverUserId === self);
-        const names = await ownDeviceNames(d, new Set(listed.map((x) => x.deviceId)));
+        const names = await ownDeviceNames(d, listed);
         return listed.map((x) => ({
             serverUserId: x.serverUserId,
             deviceId: x.deviceId,
@@ -905,6 +983,8 @@ export function createMlsDmDriver(options) {
         handleMessage,
         handleWelcome,
         handleDevicesChanged,
+        handleAddRequest,
+        requestAdd: (conversationId) => askToBeAdded(conversationId, true),
         ownDevices,
         async removeOwnDevice(deviceId) {
             const r = await transport.removeDevice({ deviceId });

package/dist/mls/interfaces.d.ts

@@ -17,6 +17,8 @@ export interface MlsDeviceRef {
 export interface MlsListedDevice extends MlsDeviceRef {
     createdAt?: string;
     lastSeenAt?: string;
+    /** On your own list: the device's last-resort KeyPackage, whose certificate names it (GRYT-1764). */
+    lastResortKeyPackage?: Uint8Array | ArrayBuffer | null;
 }
 /** The server's view of a group. `groupId` is lower-case hex. */
 export interface MlsGroupView {
@@ -138,6 +140,12 @@ export interface MlsTransport {
     }): Promise<MlsReply<{
         deleted: number;
     }>>;
+    /** This device isn't in that conversation's group: the server asks the members' apps to add it.
+        Optional, since a server from before GRYT-1858 doesn't take it. */
+    requestAdd?(req: {
+        conversationId: string;
+        deviceId: string;
+    }): Promise<MlsReply<object>>;
 }
 /** `server:info.mls`. Absent means the server can't do MLS. */
 export interface MlsServerCapability {
@@ -235,7 +243,7 @@ export interface MlsDmEvents {
     /** This device is out of the group: removed, or its state couldn't keep up. */
     onGroupLost?(info: {
         conversationId: string;
-        reason: "removed" | "out_of_sync" | "gap";
+        reason: "removed" | "out_of_sync" | "gap" | "not_added";
     }): void;
     onJoined?(info: {
         conversationId: string;
@@ -333,6 +341,14 @@ export interface MlsDmDriver {
     handleDevicesChanged(push: {
         serverUserId: string;
     }): Promise<void>;
+    /** `mls:add:requested`: a device of somebody in the conversation asked to be added. */
+    handleAddRequest(push: {
+        conversationId: string;
+        serverUserId: string;
+        deviceId: string;
+    }): Promise<void>;
+    /** Asks the other members' apps to add this device, as the driver does when it finds it's out. */
+    requestAdd(conversationId: string): Promise<void>;
     /** Oldest first, as the server lists them. */
     ownDevices(): Promise<MlsOwnDevice[]>;
     /** Your own devices only. Every group you share drops it on the next pass. */

package/dist/pairing/approver.js

@@ -54,6 +54,12 @@ export function createApproverPairing(options) {
         await closeQuietly();
     };
     const fail = (e) => (abort.signal.aborted ? undefined : end(reasonFor(e)));
+    // Only reached past "confirming", which claim() enters with all three set.
+    const confirmed = () => {
+        if (!current?.session || !device)
+            throw new Error("Nothing confirmed yet.");
+        return { ...current, session: current.session, device };
+    };
     async function claim(input) {
         let by;
         let scanned;
@@ -122,7 +128,7 @@ export function createApproverPairing(options) {
         const res = await fetch(`${issuer.replace(/\/+$/, "")}/gryt-pairing/approve`, {
             method: "POST",
             headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-            body: JSON.stringify({ user_code: userCode, binding: current.session.keycloakNonce }),
+            body: JSON.stringify({ user_code: userCode, binding: confirmed().session.keycloakNonce }),
         }).catch(() => {
             throw new PairingEnded("approve:network");
         });
@@ -143,7 +149,7 @@ export function createApproverPairing(options) {
             for (let tries = 0;; tries++) {
                 try {
                     added[host] = await driver.addOwnDevice(deviceId, {
-                        onProgress: ({ done, total }) => set({ phase: "adding", device: device, host, done, total }),
+                        onProgress: ({ done, total }) => set({ phase: "adding", device: confirmed().device, host, done, total }),
                     });
                     break;
                 }
@@ -168,7 +174,7 @@ export function createApproverPairing(options) {
         return snap;
     }
     function startHistory(archive) {
-        const { id, token, session } = current;
+        const { id, token, session } = confirmed();
         return createHistorySender({
             relay, id, token, archive, clock, signal: abort.signal,
             post: (message) => relay.post(id, token, { type: "sealed", body: sealJson(session, message) }),
@@ -176,19 +182,20 @@ export function createApproverPairing(options) {
         });
     }
     async function approve(envelope, accessToken) {
-        const { id, token, box, session } = current;
-        set({ phase: envelope.account ? "signing_in" : "waiting_ready", device: device });
+        const { id, token, box, session, device } = confirmed();
+        set({ phase: envelope.account ? "signing_in" : "waiting_ready", device });
         let sender = null;
         let snap = new Map();
+        let sealed = envelope;
         if (options.history) {
             // Recording starts before the positions are read, so nothing lands between the two unseen.
             tail.start();
             snap = await positions(envelope);
             sender = startHistory(options.history);
             const chunks = await sender.forEnvelope(Math.min(clock.now() + ENVELOPE_BUDGET_MS, deadline - 10_000));
-            envelope = { ...envelope, history: { key: sender.key, manifest: { v: 1, chunks } } };
+            sealed = { ...envelope, history: { key: sender.key, manifest: { v: 1, chunks } } };
         }
-        await relay.post(id, token, { type: "sealed", body: base64Url(session.seal(encodePairingEnvelope(envelope))) });
+        await relay.post(id, token, { type: "sealed", body: base64Url(session.seal(encodePairingEnvelope(sealed))) });
         if (envelope.account && accessToken) {
             const message = await box.next(abort.signal, clock.now() + approvalMs);
             if (!message)
@@ -196,27 +203,27 @@ export function createApproverPairing(options) {
             const userCode = String(openJson(session, message, "user_code").userCode ?? "");
             if (!(await approveExtension(envelope.account.issuer, userCode, accessToken))) {
                 const url = `${envelope.account.issuer.replace(/\/+$/, "")}/device?user_code=${encodeURIComponent(userCode)}`;
-                set({ phase: "browser", device: device, url });
+                set({ phase: "browser", device, url });
             }
         }
         if (state.phase === "signing_in")
-            set({ phase: "waiting_ready", device: device });
+            set({ phase: "waiting_ready", device });
         const ready = openJson(session, await box.next(abort.signal), "ready");
         const list = Array.isArray(ready.devices) ? ready.devices : [];
         const named = list.filter((d) => typeof d?.host === "string" && typeof d?.deviceId === "string");
         sender?.startPaging();
         const added = await addEverywhere(named);
         if (!sender) {
-            set({ phase: "done", device: device, added });
+            set({ phase: "done", device, added });
             session.close();
             return void (await closeQuietly());
         }
-        set({ phase: "sending", device: device, added });
+        set({ phase: "sending", device, added });
         await sender.send(tail.take(snap, added), false);
         await clock.sleep(options.lateWindowMs ?? HISTORY_LATE_WINDOW_MS, abort.signal);
         await sender.send(tail.take(snap, added), true);
         // N closes the session once it has every chunk; closing here would delete them.
-        set({ phase: "done", device: device, added });
+        set({ phase: "done", device, added });
         session.close();
     }
     return {

package/dist/pairing/channel.d.ts

@@ -8,7 +8,7 @@ export declare class PairingEnded extends Error {
 }
 export declare const systemClock: PairingClock;
 export declare function reasonFor(error: unknown): PairingEndReason;
-export declare function sealJson(session: PairingSession, value: Record<string, unknown>): string;
+export declare function sealJson(session: PairingSession, value: object): string;
 /** The next sealed message as JSON with a `t`, or a throw that ends the pairing as tampered. */
 export declare function openJson(session: PairingSession, message: RelayMessage | null, t?: string): Record<string, unknown>;
 /** The other side's messages in order, long-polling the relay. `next` gives null once `deadline` passes. */

package/dist/pairing/channel.js

@@ -66,8 +66,10 @@ export function mailbox(relay, id, token, clock) {
                     return null;
                 try {
                     for (const m of await relay.poll(id, token, after, Math.min(25, Math.ceil(left / 1000)), signal)) {
-                        if (m.seq > after)
-                            (queue.push(m), (after = m.seq));
+                        if (m.seq > after) {
+                            queue.push(m);
+                            after = m.seq;
+                        }
                     }
                     failures = 0;
                 }

package/dist/pairing/historySender.js

@@ -130,7 +130,7 @@ export function createHistorySender(options) {
             const listed = unlisted.splice(0, HISTORY_ENVELOPE_ENTRIES);
             progress.listed += listed.length;
             report();
-            return listed.map(({ n: _n, ...entry }) => entry);
+            return listed.map(({ n, ...entry }) => entry);
         },
         /** After N's "ready": list what's waiting, and keep listing as pages fill. */
         startPaging() {

package/dist/pairing/historySnapshot.js

@@ -2,7 +2,11 @@ const DAY_MS = 24 * 60 * 60 * 1000;
 export const dayOf = (sentAt) => Math.floor(sentAt / DAY_MS);
 /** Negative when `a` is newer: by time, then by message id, the same order the archive pages in. */
 export function newerFirst(a, b) {
-    return b.sentAt - a.sentAt || (a.messageId < b.messageId ? 1 : a.messageId > b.messageId ? -1 : 0);
+    if (a.sentAt !== b.sentAt)
+        return b.sentAt - a.sentAt;
+    if (a.messageId === b.messageId)
+        return 0;
+    return a.messageId < b.messageId ? 1 : -1;
 }
 /** A's archive one UTC day at a time, newest day first across every conversation and server. */
 export async function* archiveByDay(archive, pageSize = 500) {

package/dist/pairing/newDevice.js

@@ -90,8 +90,14 @@ export function createNewDevicePairing(options) {
             throw new PairingEnded(e instanceof Error && /newer version/.test(e.message) ? "newer_version" : "tampered");
         }
     }
+    // attempt() sets both before signIn, run's history step or linked can run.
+    const paired = () => {
+        if (!current?.session)
+            throw new Error("No pairing session yet.");
+        return { ...current, session: current.session };
+    };
     async function signIn(account, from) {
-        const { id, token, box, session } = current;
+        const { id, token, box, session } = paired();
         set({ phase: "signing_in", username: account.username, from });
         const verifier = base64Url(randomBytes(32));
         const auth = await oidc.deviceAuthorization({
@@ -151,7 +157,7 @@ export function createNewDevicePairing(options) {
             const tokens = envelope.account ? await signIn(envelope.account, envelope.from) : null;
             await storage.commit(envelope, tokens);
             if (envelope.history && options.history) {
-                const { id, token } = current;
+                const { id, token } = paired();
                 receiver = createHistoryReceiver({
                     relay, id, token, key: envelope.history.key, sink: options.history, clock, signal: abort.signal, onProgress: setHistory,
                 });
@@ -166,7 +172,7 @@ export function createNewDevicePairing(options) {
     }
     /** Reads A's history messages until every chunk is in, or A closing is the finish. */
     async function linked(from) {
-        const { box, session } = current;
+        const { box, session } = paired();
         const stop = new AbortController();
         const onAbort = () => stop.abort();
         abort.signal.addEventListener("abort", onAbort, { once: true });

package/dist/reports/report.d.ts

@@ -45,7 +45,10 @@ export interface Report {
     };
     /** The tail of the app's own log, where it keeps one. */
     logs?: string[];
-    extra?: Record<string, unknown>;
+    extra?: {
+        embeddedServer?: boolean;
+        embeddedServerVersion?: string;
+    };
 }
 /**
  * What an app knows about itself when somebody opens the form. Passed in rather than read

package/dist/reports/report.js

@@ -120,11 +120,7 @@ export function describeAttached(report) {
         ? `v${report.app.version}${report.app.build ? ` (${report.app.build})` : ""}`
         : undefined);
     add("Channel", report.app?.channel);
-    add("System", device?.platform && device?.osVersion
-        ? `${platformLabel(device.platform)} ${device.osVersion}`
-        : device?.platform
-            ? platformLabel(device.platform)
-            : undefined);
+    add("System", device?.platform ? [platformLabel(device.platform), device.osVersion].filter(Boolean).join(" ") : undefined);
     add("Simulator", device?.isEmulator ? "yes" : undefined);
     add("Electron", report.runtime?.electronVersion);
     add("Chrome", report.runtime?.chromeVersion);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gryt/core",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "description": "Gryt's shared application logic: one implementation of the things the desktop and mobile apps both do.",
   "license": "AGPL-3.0-only",
   "repository": {
@@ -24,16 +24,20 @@
     "dist"
   ],
   "scripts": {
-    "build": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && node scripts/add-esm-extensions.mjs",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test:comment-length": "node scripts/check-comment-length.mjs",
+    "build": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && node scripts/add-esm-extensions.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p scripts",
+    "lint": "eslint --flag unstable_native_nodejs_ts_config .",
+    "test:comment-length": "node scripts/check-comment-length.ts",
     "test": "node --test \"src/**/*.test.ts\"",
-    "check-surface": "node scripts/check-public-surface.mjs",
+    "check-surface": "node scripts/check-public-surface.ts",
     "prepublishOnly": "npm run build && npm run test && npm run check-surface"
   },
   "devDependencies": {
+    "@eslint/js": "^9.39.5",
     "@types/node": "^20.19.33",
-    "typescript": "^5.9.3"
+    "eslint": "^9.39.5",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.71.2"
   },
   "publishConfig": {
     "access": "public"