@kubun/plugin-p2p 0.10.1 → 0.11.0

package/lib/groups/broadcast-service.d.ts

@@ -1,263 +0,0 @@
-import { EventEmitter } from '@enkaku/event';
-import { type GroupHandle, type MemberCredential } from '@enkaku/group';
-import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
-import { HLC } from '@kubun/hlc';
-import type { Logger } from '@kubun/logger';
-import type { GraphStoreAPI } from '@kubun/store-graph';
-import type { P2PStoreAPI } from '@kubun/store-p2p';
-import type { ForwardingConfig } from '../sync/forwarder.js';
-import type { StoreUnreadableMode } from '../types.js';
-import { type AffectedRow, type ApplyCatchupReplyResult, type GroupBroadcastMessage } from './broadcast.js';
-import type { P2PEventEmitter } from './events.js';
-import type { GroupHandleRegistry } from './group-handle-registry.js';
-/**
- * Thrown when a received broadcast fails to decrypt (MLS restore, decrypt,
- * or deserialize). Callers should typically ack-and-skip these, since the
- * message is unrecoverable and redelivery will not help.
- */
-export declare class DecryptError extends Error {
-    #private;
-    constructor(message: string, cause: unknown);
-    get cause(): unknown;
-}
-/**
- * Decode failure on a rejoin control frame. Distinct from {@link DecryptError}
- * so the receive path classifies it `control`, not `decrypt-failed` — a corrupt
- * frame is not evidence of epoch-staleness and must not drive the health
- * detector. Ack-and-skip: redelivery can't fix a malformed frame.
- */
-export declare class MalformedControlError extends Error {
-    #private;
-    constructor(message: string, cause: unknown);
-    get cause(): unknown;
-}
-/**
- * Thrown when a successfully decrypted broadcast fails to apply to the local
- * DB. Callers should typically NOT ack these, so the message can be
- * redelivered after the transient failure clears.
- */
-export declare class ApplyError extends Error {
-    #private;
-    constructor(message: string, cause: unknown);
-    get cause(): unknown;
-}
-/**
- * Thrown when a received MLS Commit targets a future epoch the local handle
- * has not reached yet (a gap in the in-order Commit stream). Callers should
- * NOT ack — the hub redelivers in `sequence_id` order, so the gap-filling
- * Commit arrives first and this one applies on a later delivery.
- */
-export declare class CommitOutOfOrderError extends Error {
-    #private;
-    constructor(messageEpoch: bigint, handleEpoch: bigint);
-    get messageEpoch(): bigint;
-    get handleEpoch(): bigint;
-}
-export type BroadcastEvent = {
-    groupID: string;
-    message: GroupBroadcastMessage;
-    applied: boolean;
-    /**
-     * Row affected by the broadcast. After-state for create / update,
-     * before-state for delete / remove. Undefined when `applied === false`.
-     */
-    affected?: AffectedRow;
-    /**
-     * Count of `mutation:apply` entries the local broadcast log already had.
-     * Only set on the `mutation:apply` branch; absent on control-plane
-     * variants.
-     */
-    duplicates?: number;
-};
-export type BroadcastServiceEvents = {
-    broadcast: BroadcastEvent;
-};
-export type SendBroadcastParams = {
-    groupID: string;
-    message: GroupBroadcastMessage;
-    /**
-     * Wire-send hook invoked with the MLS-encrypted payload INSIDE the
-     * registry's per-group lock. A throw here propagates out of `prepareSend`
-     * and the registry skips persist — so a failed send leaves the device's
-     * MLS state at its pre-encrypt epoch, preventing the wedge where local
-     * state outpaces recipients.
-     */
-    send: (encrypted: Uint8Array) => Promise<void>;
-};
-export type SendCommitParams = {
-    groupID: string;
-    /**
-     * Canonical MLS-encoded handshake Commit bytes (an encrypted
-     * `PrivateMessage`) produced by the committer's `GroupManager` call.
-     */
-    commitBytes: Uint8Array;
-    /** Wire-send hook; receives the `mls`-framed bytes. */
-    send: (framed: Uint8Array) => Promise<void>;
-};
-export type ReceiveBroadcastParams = {
-    groupID: string;
-    encrypted: Uint8Array;
-};
-export type ReceiveAppResult = {
-    kind: 'app';
-    message: GroupBroadcastMessage;
-    applied: boolean;
-    affected?: AffectedRow;
-    duplicates?: number;
-};
-/**
- * Result of processing a received MLS handshake Commit (`mls` wire frame).
- * `removed`/`added` are the membership deltas derived by diffing the group
- * roster before and after applying the Commit. `removed` DIDs are tombstoned
- * via `markMemberRemoved` so the apply-time membership check can reject their
- * post-removal writes.
- */
-export type ReceiveCommitResult = {
-    kind: 'mls';
-    epoch: bigint;
-    removed: Array<string>;
-    added: Array<string>;
-};
-/**
- * A received `rejoin-request`: a stale device asking current members for fresh
- * GroupInfo. Cleartext; does not touch the MLS handle.
- */
-export type ReceiveRejoinRequestResult = {
-    kind: 'rejoin-request';
-    requestID: string;
-};
-/**
- * A current member's `rejoin-groupinfo` reply carrying fresh GroupInfo. Consumed
- * by the requester's rejoin flow; also drives responder suppression on peers.
- */
-export type ReceiveRejoinGroupInfoResult = {
-    kind: 'rejoin-groupinfo';
-    requestID: string;
-    groupInfo: Uint8Array;
-};
-export type ReceiveBroadcastResult = ReceiveAppResult | ReceiveCommitResult | ReceiveRejoinRequestResult | ReceiveRejoinGroupInfoResult;
-export type SendRejoinRequestParams = {
-    requestID: string;
-    /** Wire-send hook; receives the `rejoinRequest`-framed cleartext bytes. */
-    send: (framed: Uint8Array) => Promise<void>;
-};
-export type SendRejoinGroupInfoParams = {
-    requestID: string;
-    groupInfo: Uint8Array;
-    /** Wire-send hook; receives the `rejoinGroupInfo`-framed cleartext bytes. */
-    send: (framed: Uint8Array) => Promise<void>;
-};
-/**
- * BroadcastService handles MLS encrypt/decrypt for group broadcasts
- * and applies received messages to the local DB.
- *
- * Encrypt and decrypt go through `GroupHandleRegistry.withHandle` so MLS
- * state mutations serialize through the per-group mutex with write-through
- * persist. The DB-apply step (`processBroadcast`) for receives runs OUTSIDE
- * the lock so a slow apply does not block subsequent encrypt/decrypt on the
- * same group.
- */
-export type BroadcastServiceParams = {
-    p2pStore: P2PStoreAPI;
-    graphStore: GraphStoreAPI;
-    /**
-     * Engine graph internals — required so `mutation:apply` broadcasts route
-     * through {@link GraphInternals.applyVerifiedMutation} with `origin: 'peer'`.
-     */
-    graph: GraphInternals;
-    /** Self DID for `mutation:apply` loopback detection. */
-    selfDID: string;
-    /** Single canonical access point for MLS `GroupHandle` instances. */
-    registry: GroupHandleRegistry;
-    /**
-     * Device-wide monotonic clock for stamping the `removed_at_hlc` of members
-     * dropped by a received MLS Commit (the receive side has no HLC otherwise).
-     * Required: production passes the engine's single instance so every write
-     * from this device advances one shared clock, preventing two same-millisecond
-     * writes from minting identical timestamps (the second would silently lose
-     * under last-writer-wins).
-     */
-    hlc: HLC;
-    /**
-     * Receiver storage mode for incoming `mutation:apply` entries. Defaults
-     * to `'persist'`. When `'drop'`, `defaultAccessLevel` must be supplied
-     * so the gate factory can resolve server-side default access rules.
-     */
-    storeUnreadable?: StoreUnreadableMode;
-    /** Server default access level — required when `storeUnreadable === 'drop'`. */
-    defaultAccessLevel?: DefaultAccessLevel;
-    /**
-     * Forwarding config. Threaded into `processBroadcast` per call.
-     * `false` / undefined → forwarding disabled (default).
-     */
-    forwarding?: ForwardingConfig;
-    /**
-     * Hub forwarding hook — required when `forwarding` is set. Called once per
-     * surviving candidate group on the receive path.
-     */
-    scheduleBroadcast?: (groupID: string, message: GroupBroadcastMessage) => void | Promise<void>;
-    /**
-     * Emitter forwarded to `processBroadcast` so `delegation:share` receives
-     * surface a `delegationTokenAdded` event to local subscribers.
-     */
-    emitter?: P2PEventEmitter;
-    logger?: Logger;
-};
-export declare class BroadcastService extends EventEmitter<BroadcastServiceEvents> {
-    #private;
-    constructor(params: BroadcastServiceParams);
-    /**
-     * Encrypt + send a broadcast for a group, then persist the advanced MLS state.
-     *
-     * Failure semantics: send happens inside the registry's per-group lock. A
-     * throw from `send` propagates out and the registry skips persist — so the
-     * device's MLS state stays at its pre-encrypt epoch and the next attempt
-     * re-derives a fresh handle from the prior generation. Wedge protection
-     * intact.
-     */
-    prepareSend(params: SendBroadcastParams): Promise<void>;
-    /**
-     * Send a pre-produced MLS handshake Commit to the group, tagged `mls` on the
-     * wire. The Commit is already a self-protected (encrypted `PrivateMessage`)
-     * framed message produced by the committer's `GroupManager` call — it is NOT
-     * re-encrypted through the application path, so this does not touch the
-     * handle. The committer's MLS state has already advanced + persisted; the
-     * hub's durable + ordered mailbox carries the Commit to existing members and
-     * replays it on reconnect.
-     */
-    prepareSendCommit(params: SendCommitParams): Promise<void>;
-    /**
-     * Export a fresh `MLSMessage(GroupInfo)` from the current handle. Read-only:
-     * takes the registry lock but does not advance or persist state.
-     */
-    exportGroupInfo(groupID: string): Promise<Uint8Array>;
-    readCredential(groupID: string): Promise<MemberCredential>;
-    /**
-     * Swap+persist the cached handle (under the per-group mutex), then reconcile
-     * the store roster. The swap is security-critical; a reconcile failure is
-     * logged and swallowed so it can't reject the rejoin after the handle is
-     * installed (which would skip `markRecovered` and wedge the monitor) — the
-     * next rejoin re-runs the idempotent reconcile.
-     */
-    replaceHandle(groupID: string, handle: GroupHandle): Promise<void>;
-    /** Send a `rejoin-request` (cleartext) to the group channel. */
-    prepareSendRejoinRequest(params: SendRejoinRequestParams): Promise<void>;
-    /** Send a `rejoin-groupinfo` reply (cleartext) to the group channel. */
-    prepareSendRejoinGroupInfo(params: SendRejoinGroupInfoParams): Promise<void>;
-    /**
-     * Process a received broadcast: MLS decrypt INSIDE the registry lock,
-     * then apply to the DB OUTSIDE the lock so a slow apply doesn't block
-     * subsequent encrypt/decrypt on the same group.
-     */
-    processReceived(params: ReceiveBroadcastParams): Promise<ReceiveBroadcastResult>;
-    /**
-     * Apply a `circle-catchup:reply` batch (circles + circle members, including
-     * tombstoned) row-by-row through the existing handlers. Lock-free: like
-     * `processReceived`'s post-decrypt apply, this runs OUTSIDE the registry's
-     * per-group lock — it touches no MLS handle, and each row apply is idempotent
-     * and order-independent, so a late or duplicate reply converges harmlessly.
-     */
-    applyCatchupReply(groupID: string, reply: Extract<GroupBroadcastMessage, {
-        type: 'circle-catchup:reply';
-    }>): Promise<ApplyCatchupReplyResult>;
-}

package/lib/groups/broadcast-service.js

@@ -1 +0,0 @@
-import{EventEmitter as r}from"@enkaku/event";import{exportGroupInfo as e,readMessageEpoch as t}from"@enkaku/group";import{HLC as a}from"@kubun/hlc";import{applyCatchupReply as o,processBroadcast as s}from"./broadcast.js";import{deserializeBroadcast as i,serializeBroadcast as c}from"./broadcast-codec.js";import{mlsDecryptFramed as n,mlsEncryptFramed as l}from"./mls-codec.js";import{decodeRejoinGroupInfo as d,decodeRejoinRequest as m,encodeRejoinGroupInfo as p,encodeRejoinRequest as h}from"./rejoin-codec.js";import{frameWire as u,unframeWire as w,WireKind as f}from"./wire-frame.js";export class DecryptError extends Error{#r;constructor(r,e){super(r),this.name="DecryptError",this.#r=e}get cause(){return this.#r}}export class MalformedControlError extends Error{#r;constructor(r,e){super(r),this.name="MalformedControlError",this.#r=e}get cause(){return this.#r}}export class ApplyError extends Error{#r;constructor(r,e){super(r),this.name="ApplyError",this.#r=e}get cause(){return this.#r}}export class CommitOutOfOrderError extends Error{#e;#t;constructor(r,e){super(`MLS commit epoch ${r} ahead of handle epoch ${e}`),this.name="CommitOutOfOrderError",this.#e=r,this.#t=e}get messageEpoch(){return this.#e}get handleEpoch(){return this.#t}}export class BroadcastService extends r{#a;#o;#s;constructor(r){super(),this.#s=r.hlc,this.#a={p2pStore:r.p2pStore,graphStore:r.graphStore,graph:r.graph,selfDID:r.selfDID,storeUnreadable:r.storeUnreadable,defaultAccessLevel:r.defaultAccessLevel,forwarding:r.forwarding,scheduleBroadcast:r.scheduleBroadcast,emitter:r.emitter,logger:r.logger},this.#o=r.registry}async prepareSend(r){let{groupID:e,message:t,send:a}=r,o=c(t);await this.#o.withHandle(e,async r=>{let{framed:e}=await l(r,o);await a(u(f.app,e))})}async prepareSendCommit(r){let{commitBytes:e,send:t}=r;await t(u(f.mls,e))}async exportGroupInfo(r){return await this.#o.withHandle(r,async r=>{let{groupInfo:t}=await e({group:r});return t})}async readCredential(r){return await this.#o.withHandle(r,async r=>r.credential)}async replaceHandle(r,e){await this.#o.replaceHandle(r,e);try{await this.#i(r,e)}catch(e){this.#a.logger?.warn("rejoin: store roster reconcile failed",{groupID:r,error:e})}}async #i(r,e){let{p2pStore:t}=this.#a,o=e.listMembers().map(r=>r.id),s=new Set(o),i=await t.listGroupMembers(r),c=new Set(i.map(r=>r.member_did)),n=a.serialize(this.#s.now());for(let e of i)s.has(e.member_did)||await t.markMemberRemoved(r,e.member_did,n);for(let e of o)c.has(e)||await t.addGroupMember({group_id:r,member_did:e,role:"member",hlc:n})}async prepareSendRejoinRequest(r){let{requestID:e,send:t}=r;await t(u(f.rejoinRequest,h({requestID:e})))}async prepareSendRejoinGroupInfo(r){let{requestID:e,groupInfo:t,send:a}=r;await a(u(f.rejoinGroupInfo,p({requestID:e,groupInfo:t})))}async processReceived(r){let e,t,a,o,{groupID:c,encrypted:l}=r;try{({kind:e,payload:t}=w(l))}catch(r){throw new DecryptError("Malformed group wire frame",r)}if(e===f.mls)return await this.#c(c,t);if(e===f.rejoinRequest)try{let{requestID:r}=m(t);return{kind:"rejoin-request",requestID:r}}catch(r){throw new MalformedControlError("Malformed rejoin-request frame",r)}if(e===f.rejoinGroupInfo)try{let{requestID:r,groupInfo:e}=d(t);return{kind:"rejoin-groupinfo",requestID:r,groupInfo:e}}catch(r){throw new MalformedControlError("Malformed rejoin-groupinfo frame",r)}try{a=await this.#o.withHandle(c,async r=>{let e=await n(r,t);return i(e)})}catch(r){throw new DecryptError("Failed to decrypt broadcast",r)}try{o=await s(this.#a,a,c)}catch(r){throw new ApplyError("Failed to apply broadcast",r)}let{applied:p,affected:h,duplicates:u}=o;return await this.emit("broadcast",{groupID:c,message:a,applied:p,affected:h,duplicates:u}),{kind:"app",message:a,applied:p,affected:h,duplicates:u}}async applyCatchupReply(r,e){return await o(this.#a,e,r)}async #c(r,e){return await this.#o.withHandle(r,async o=>{let s=t(e),i=o.epoch;if(null!=s&&s<i)return{kind:"mls",epoch:i,removed:[],added:[]};if(null!=s&&s>i)throw new CommitOutOfOrderError(s,i);let c=o.listMembers();try{await o.processMessage(e)}catch(r){throw new DecryptError("Failed to process MLS commit",r)}let n=o.listMembers(),l=new Set(c.map(r=>r.id)),d=new Set(n.map(r=>r.id)),m=c.filter(r=>!d.has(r.id)).map(r=>r.id),p=n.filter(r=>!l.has(r.id)).map(r=>r.id),h=a.serialize(this.#s.now()),{p2pStore:u}=this.#a;for(let e of m)await u.markMemberRemoved(r,e,h);for(let e of p)await u.addGroupMember({group_id:r,member_did:e,role:"member",hlc:h});return{kind:"mls",epoch:o.epoch,removed:m,added:p}})}}

package/lib/groups/rejoin-codec.d.ts

@@ -1,14 +0,0 @@
-/** A stale device's request for a fresh GroupInfo. Cleartext on the wire. */
-export type RejoinRequest = {
-    requestID: string;
-};
-/** A current member's reply carrying a framed `MLSMessage(GroupInfo)`. */
-export type RejoinGroupInfo = {
-    requestID: string;
-    /** Framed `MLSMessage(GroupInfo)` bytes. */
-    groupInfo: Uint8Array;
-};
-export declare function encodeRejoinRequest(request: RejoinRequest): Uint8Array;
-export declare function decodeRejoinRequest(bytes: Uint8Array): RejoinRequest;
-export declare function encodeRejoinGroupInfo(message: RejoinGroupInfo): Uint8Array;
-export declare function decodeRejoinGroupInfo(bytes: Uint8Array): RejoinGroupInfo;

package/lib/groups/rejoin-codec.js

@@ -1 +0,0 @@
-import{replacer as e,reviver as r}from"./mls-json.js";let o=new TextEncoder,n=new TextDecoder;export function encodeRejoinRequest(r){return o.encode(JSON.stringify(r,e))}export function decodeRejoinRequest(e){let o=JSON.parse(n.decode(e),r);if("string"!=typeof o?.requestID)throw Error("invalid rejoin-request: missing requestID");return{requestID:o.requestID}}export function encodeRejoinGroupInfo(r){return o.encode(JSON.stringify(r,e))}export function decodeRejoinGroupInfo(e){let o=JSON.parse(n.decode(e),r);if("string"!=typeof o?.requestID)throw Error("invalid rejoin-groupinfo: missing requestID");if(!(o.groupInfo instanceof Uint8Array))throw Error("invalid rejoin-groupinfo: missing groupInfo bytes");return{requestID:o.requestID,groupInfo:o.groupInfo}}

package/lib/groups/wire-frame.d.ts

@@ -1,34 +0,0 @@
-/**
- * Outer wire-frame discriminator for group hub payloads.
- *
- * The hub relay treats a group send payload as opaque bytes. Kubun prepends a
- * single `kind` byte so the receiver can route a payload to the right decoder
- * without trial-decryption:
- *
- * - `app` — an MLS-encrypted application broadcast (`GroupBroadcastMessage`),
- *   decoded via `handle.decrypt` + `deserializeBroadcast`.
- * - `mls` — a framed MLS handshake message (a Commit), fed straight to
- *   `handle.processMessage`. The handshake is self-protected (encrypted
- *   `PrivateMessage`), so it is NOT wrapped in the application-encryption path.
- *
- * The discriminator lives entirely in kubun's payload bytes; the hub protocol
- * is unchanged.
- */
-export declare const WireKind: {
-    readonly app: 0;
-    readonly mls: 1;
-    readonly rejoinRequest: 2;
-    readonly rejoinGroupInfo: 3;
-};
-export type WireKind = (typeof WireKind)[keyof typeof WireKind];
-/** Prepend the `kind` byte to a payload. */
-export declare function frameWire(kind: WireKind, payload: Uint8Array): Uint8Array;
-/**
- * Split a framed payload into its `kind` and the remaining payload bytes.
- * Throws on an empty frame or an unrecognized `kind` byte. The returned
- * payload is a view (`subarray`) over the input, not a copy.
- */
-export declare function unframeWire(framed: Uint8Array): {
-    kind: WireKind;
-    payload: Uint8Array;
-};

package/lib/groups/wire-frame.js

@@ -1 +0,0 @@
-export const WireKind={app:0,mls:1,rejoinRequest:2,rejoinGroupInfo:3};let r=new Set(Object.values(WireKind));export function frameWire(r,e){let n=new Uint8Array(e.length+1);return n[0]=r,n.set(e,1),n}export function unframeWire(e){if(0===e.length)throw Error("empty wire frame");let n=e[0];if(!r.has(n))throw Error(`unknown wire frame kind: ${n}`);return{kind:n,payload:e.subarray(1)}}

package/lib/hub/circle-catchup-requester.d.ts

@@ -1,58 +0,0 @@
-import type { Logger } from '@kubun/logger';
-import type { GroupBroadcastMessage } from '../groups/broadcast.js';
-/** The reply payload a current member sends back, correlated by `requestID`. */
-type CatchupReply = Extract<GroupBroadcastMessage, {
-    type: 'circle-catchup:reply';
-}>;
-export type CircleCatchupRequesterParams = {
-    groupID: string;
-    /** Fresh correlation id per request (incl. retries). */
-    genRequestID: () => string;
-    /** Broadcast a `circle-catchup:request` on the group channel. */
-    sendRequest: (requestID: string) => Promise<void>;
-    /**
-     * Apply a received reply batch row-by-row (idempotent, order-independent).
-     * Mirrors `applyCatchupReply` bound to the local store/engine context.
-     */
-    applyReply: (reply: CatchupReply) => Promise<void>;
-    requestTimeoutMs?: number;
-    maxAttempts?: number;
-    backoffMs?: (attempt: number) => number;
-    logger?: Logger;
-};
-/**
- * Drives a rejoining device's circle/member catch-up for one group: broadcast a
- * `circle-catchup:request`, await the first matching `circle-catchup:reply`
- * (correlated by `requestID`) within a timeout, apply it, done. On timeout,
- * retry with a capped full-jitter backoff up to `maxAttempts`.
- *
- * Mirrors the rejoin manager's request/await/retry shape, minus any MLS
- * join/confirm — there is no Commit to broadcast and no head to confirm against,
- * because `applyReply` is idempotent and order-independent: one good reply
- * lands the snapshot, and a duplicate or late reply is a harmless no-op.
- *
- * Exhaustion is NON-FATAL: a device that never hears back simply keeps the
- * state it has; it resolves without throwing.
- */
-export declare class CircleCatchupRequester {
-    #private;
-    constructor(params: CircleCatchupRequesterParams);
-    get inFlight(): boolean;
-    /**
-     * Route a received `circle-catchup:reply`: resolve the matching in-flight
-     * waiter. Unknown `requestID`s (peers' requests, stale or duplicate replies
-     * for an already-resolved attempt) are ignored — harmless.
-     */
-    onCatchupReply(requestID: string, reply: CatchupReply): void;
-    /**
-     * Run the catch-up flow. Idempotent: a concurrent call while one is in flight
-     * shares the existing run's promise rather than starting a second.
-     */
-    run(): Promise<void>;
-    /**
-     * Stop a running catch-up and release timers. Idempotent; the loop checks
-     * `#disposed` between attempts, pending waiters resolve `null`. On channel close.
-     */
-    dispose(): void;
-}
-export {};

package/lib/hub/circle-catchup-requester.js

@@ -1 +0,0 @@
-import{sleep as e,unref as t}from"../utils.js";export class CircleCatchupRequester{#e;#t;#s;#i;#r;#l;#a;#u;#n=new Map;#o=null;#h=!1;constructor(e){this.#e=e.groupID,this.#t=e.genRequestID,this.#s=e.sendRequest,this.#i=e.applyReply,this.#r=e.requestTimeoutMs??5e3,this.#l=e.maxAttempts??8,this.#a=e.backoffMs??s,this.#u=e.logger}get inFlight(){return null!=this.#o}onCatchupReply(e,t){let s=this.#n.get(e);null!=s&&(this.#n.delete(e),s.resolve(t))}run(){if(null!=this.#o)return this.#o;let e=this.#p().finally(()=>{this.#o=null});return this.#o=e,e}async #p(){for(let t=0;t<this.#l&&!this.#h;t++){if(t>0&&(await e(this.#a(t)),this.#h))return;let s=await this.#c(this.#r);if(null!=s)try{await this.#i(s);return}catch(e){this.#u?.warn("circle catch-up: applying reply failed",{groupID:this.#e,error:e})}}this.#h||this.#u?.warn("circle catch-up: no usable reply, giving up",{groupID:this.#e,attempts:this.#l})}async #c(e){let t=this.#t(),s=this.#g(t,e);try{await this.#s(t)}catch(e){return this.#m(t),this.#u?.warn("circle catch-up: request send failed",{groupID:this.#e,error:e}),null}return s}#g(e,s){return new Promise(i=>{let r=setTimeout(()=>{this.#n.delete(e),i(null)},s);t(r),this.#n.set(e,{resolve:e=>{clearTimeout(r),i(e)},cancel:()=>{clearTimeout(r),i(null)}})})}#m(e){let t=this.#n.get(e);null!=t&&(this.#n.delete(e),t.cancel())}dispose(){for(let e of(this.#h=!0,this.#n.values()))e.cancel();this.#n.clear()}}function s(e){return Math.floor(Math.random()*Math.min(500*2**(e-1),5e3))}

package/lib/hub/circle-catchup-responder.d.ts

@@ -1,50 +0,0 @@
-import type { Logger } from '@kubun/logger';
-import type { Circle, CircleMember } from '@kubun/store-p2p';
-import type { CircleMemberSnapshot, CircleSnapshot } from '../groups/broadcast.js';
-/**
- * Reads the group's circles + circle members from the store. Mirrors the
- * `listCirclesByGroup` / `listCircleMembers` store API, both returning
- * tombstoned rows when `includeRemoved` is set so the snapshot can carry
- * removed entries.
- */
-export type CircleCatchupStoreReader = {
-    listCirclesByGroup: (groupID: string, options?: {
-        includeRemoved?: boolean;
-    }) => Promise<Array<Circle>>;
-    listCircleMembers: (circleID: string, options?: {
-        includeRemoved?: boolean;
-    }) => Promise<Array<CircleMember>>;
-};
-export type CircleCatchupResponderParams = {
-    groupID: string;
-    /** Reads the group's circle + circle-member rows (including tombstoned). */
-    store: CircleCatchupStoreReader;
-    /** Broadcast a `circle-catchup:reply` to the group channel. */
-    sendCatchupReply: (requestID: string, circles: Array<CircleSnapshot>, circleMembers: Array<CircleMemberSnapshot>) => Promise<void>;
-    /** Jitter delay (ms) before replying. Defaults to a random 0..250ms. */
-    nextJitterMs?: () => number;
-    /** How long a `requestID` stays suppressed after being answered. */
-    suppressTTLMs?: number;
-    logger?: Logger;
-};
-/**
- * Answers `circle-catchup:request`s with one batched snapshot of the group's
- * circle + circle-member rows (including tombstoned, each carrying its authored
- * HLC). Every current member could reply, so jitter (random pre-reply delay) +
- * suppression (cancel on seeing a peer's reply for the same `requestID`)
- * collapse the storm to ~1 reply. Keyed on `requestID` (fresh per attempt);
- * suppression entries TTL out to bound memory.
- *
- * Mirrors the rejoin responder's storm-collapse shape; suppression collapses
- * only duplicates of one `requestID`, so distinct `requestID`s still draw one
- * reply each.
- */
-export declare class CircleCatchupResponder {
-    #private;
-    constructor(params: CircleCatchupResponderParams);
-    /** Handle an inbound `circle-catchup:request`: schedule a jittered, suppressible reply. */
-    onCatchupRequest(requestID: string): void;
-    /** Handle an observed `circle-catchup:reply` (own or peer's): suppress this request. */
-    onCatchupReplySeen(requestID: string): void;
-    dispose(): void;
-}

package/lib/hub/circle-catchup-responder.js

@@ -1 +0,0 @@
-import{unref as e}from"../utils.js";function s(e){return{id:e.id,groupID:e.group_id,name:e.name,description:e.description,catalogIDs:e.catalog_ids,hlc:e.hlc,removedAtHLC:e.removed_at_hlc??null}}export class CircleCatchupResponder{#e;#s;#t;#r;#i;#p;#o=new Map;#l=new Map;constructor(e){this.#e=e.groupID,this.#s=e.store,this.#t=e.sendCatchupReply,this.#r=e.nextJitterMs??(()=>Math.floor(250*Math.random())),this.#i=e.suppressTTLMs??5e3,this.#p=e.logger}onCatchupRequest(s){if(this.#l.has(s)||this.#o.has(s))return;let t=setTimeout(()=>{this.#o.delete(s),this.#h(s)},this.#r());e(t),this.#o.set(s,t)}onCatchupReplySeen(e){let s=this.#o.get(e);null!=s&&(clearTimeout(s),this.#o.delete(e)),this.#n(e)}dispose(){for(let e of this.#o.values())clearTimeout(e);for(let e of(this.#o.clear(),this.#l.values()))clearTimeout(e);this.#l.clear()}async #h(e){if(!this.#l.has(e)){this.#n(e);try{let{circles:s,circleMembers:t}=await this.#u();await this.#t(e,s,t)}catch(s){this.#p?.warn("circle catch-up responder failed to reply",{groupID:this.#e,requestID:e,error:s})}}}async #u(){let e=await this.#s.listCirclesByGroup(this.#e,{includeRemoved:!0}),t=e.map(s),r=[];for(let s of e)for(let e of(await this.#s.listCircleMembers(s.id,{includeRemoved:!0})))r.push({circleID:e.circle_id,memberDID:e.member_did,role:e.role,hlc:e.hlc,removedAtHLC:e.removed_at_hlc??null});return{circles:t,circleMembers:r}}#n(s){let t=this.#l.get(s);null!=t&&clearTimeout(t);let r=setTimeout(()=>{this.#l.delete(s)},this.#i);e(r),this.#l.set(s,r)}}

package/lib/hub/connection-pool.d.ts

@@ -1,43 +0,0 @@
-import type { Client } from '@enkaku/client';
-import type { HubProtocol } from '@enkaku/hub-protocol';
-import type { Logger } from '@kubun/logger';
-import type { CreateHubClient } from './relay-manager.js';
-export type HubClientRef = {
-    client: Client<HubProtocol>;
-    refID: string;
-};
-/**
- * Fired once per freshly-spawned hub client when its first signed response
- * arrives. The pool binds the hub URL into the call site; consumers (hub
- * manager `captureServerDID`) use the URL to look up the local hub row and
- * apply the conflict matrix. Errors are caught and logged — capture never
- * blocks message forwarding, even on `HubServerDIDConflictError`.
- */
-export type OnServerDIDObserved = (params: {
-    hubURL: string;
-    serverDID: string;
-}) => void | Promise<void>;
-/**
- * Resolves the locally-pinned `server_did` for a hub URL at spawn time. When
- * the hub row for this URL exists and has `server_did` set, the pool passes
- * it as `expectedServerDID` to the client factory so the wrapper enforces
- * the pin. Returning `null` falls back to TOFU.
- *
- * Resolution happens fresh on every spawn so `updateHub({ serverDID: null })`
- * re-arms TOFU automatically: the next disposed/evicted client triggers a
- * fresh resolve.
- */
-export type ResolvePinnedServerDID = (hubURL: string) => Promise<string | null>;
-export type HubConnectionPoolParams = {
-    createHubClient: CreateHubClient;
-    logger?: Logger;
-    onServerDIDObserved?: OnServerDIDObserved;
-    resolvePinnedDID?: ResolvePinnedServerDID;
-};
-export declare class HubConnectionPool {
-    #private;
-    constructor(params: HubConnectionPoolParams);
-    acquire(hubURL: string): Promise<HubClientRef>;
-    release(hubURL: string, refID: string): Promise<void>;
-    disposeAll(): Promise<void>;
-}

package/lib/hub/connection-pool.js

@@ -1 +0,0 @@
-export class HubConnectionPool{#e;#t;#i;#r;#s=new Map;#n=0;constructor(e){this.#e=e.createHubClient,this.#t=e.logger,this.#i=e.onServerDIDObserved,this.#r=e.resolvePinnedDID}async acquire(e){let t=this.#s.get(e);if(null!=t&&null!=t.disposing&&(await t.disposing,this.#s.get(e)===t&&this.#s.delete(e),t=void 0),null==t){let i,r=this.#i;if(null!=this.#r)try{let t=await this.#r(e);null!=t&&(i=t)}catch(t){this.#t?.warn("failed to resolve pinned server DID, falling back to TOFU",{hubURL:e,error:t})}let s=await this.#e(e,{onServerDID:null==r?void 0:async t=>{try{await r({hubURL:e,serverDID:t})}catch(i){this.#t?.warn("hub server DID capture failed",{hubURL:e,serverDID:t,error:i})}},expectedServerDID:i,onMismatch:null==i?void 0:e=>{this.#t?.warn("hub server DID mismatch — pinning enforcement triggered",{hubURL:e.hubURL,expectedServerDID:e.expectedServerDID,observedServerDID:e.observedServerDID})}}),n={client:s,refs:new Set};t=n,this.#s.set(e,n),s.disposed.then(()=>{this.#s.get(e)===n&&(this.#t?.debug("hub client disposed externally, evicting pool entry",{hubURL:e,outstandingRefs:[...n.refs]}),this.#s.delete(e))}).catch(()=>{})}let i=String(++this.#n);return t.refs.add(i),{client:t.client,refID:i}}async release(e,t){let i=this.#s.get(e);if(null==i)return void this.#t?.debug("HubConnectionPool.release: unknown hubURL",{hubURL:e,refID:t});if(!i.refs.has(t))return void this.#t?.debug("HubConnectionPool.release: unknown refID",{hubURL:e,refID:t});if(i.refs.delete(t),i.refs.size>0)return;let r=i.client.dispose();i.disposing=r;try{await r}finally{this.#s.get(e)===i&&this.#s.delete(e)}}async disposeAll(){let e=Array.from(this.#s.entries());await Promise.all(e.map(async([e,t])=>{t.refs.size>0&&this.#t?.warn("Disposing hub client with outstanding refs",{hubURL:e,refs:Array.from(t.refs)}),await t.client.dispose()})),this.#s.clear()}}

package/lib/hub/epoch-stale-detector.d.ts

@@ -1,18 +0,0 @@
-import type { GroupHealthMonitor } from '../groups/group-health-monitor.js';
-import type { ReceiveOutcome } from './receive-handler.js';
-export type EpochStaleDetectorParams = {
-    groupID: string;
-    monitor: GroupHealthMonitor;
-};
-/**
- * Maps a group's receive outcomes to `epoch-stale` signals (one per group):
- * `applied` → reset; `decrypt-failed` → signal; `commit-out-of-order` → signal
- * only on a REPEAT `sequenceID` (first sighting is normal replay; a repeat means
- * the gap-filling Commit was GC'd at the hub and never arrives); else no signal.
- * The seen-set grows only while stuck and clears on the next `applied`.
- */
-export declare class EpochStaleDetector {
-    #private;
-    constructor(params: EpochStaleDetectorParams);
-    onReceiveOutcome(outcome: ReceiveOutcome, sequenceID: string): void;
-}

package/lib/hub/epoch-stale-detector.js

@@ -1 +0,0 @@
-export class EpochStaleDetector{#e;#t;#r=new Set;constructor(e){this.#e=e.groupID,this.#t=e.monitor}onReceiveOutcome(e,t){switch(e){case"applied":this.#r.clear(),this.#t.reset(this.#e,"epoch-stale");return;case"decrypt-failed":this.#t.signal(this.#e,"epoch-stale");return;case"commit-out-of-order":this.#r.has(t)?this.#t.signal(this.#e,"epoch-stale"):this.#r.add(t);return;default:return}}}

package/lib/hub/forward-remote-broadcast.d.ts

@@ -1,15 +0,0 @@
-import type { Logger } from '@kubun/logger';
-import type { BroadcastEvent } from '../groups/broadcast-service.js';
-import type { P2PEventEmitter } from '../groups/events.js';
-/**
- * Map a `BroadcastEvent` from `BroadcastService` into the matching
- * `P2PEventEmitter` event.
- *
- * - Events with `applied === false` are ignored (no state change).
- * - `catalog:*` messages are currently a no-op. Catalog send-side broadcasts
- *   and event propagation are deferred to a future task (see design spec).
- * - Payloads are built from `event.affected.row`, which `processBroadcast`
- *   captures at the appropriate moment (after-state for create / update,
- *   before-state for delete / remove).
- */
-export declare function forwardRemoteBroadcast(emitter: P2PEventEmitter, event: BroadcastEvent, logger?: Logger): Promise<void>;

package/lib/hub/forward-remote-broadcast.js

@@ -1 +0,0 @@
-import{toISO as e}from"../context/types.js";export async function forwardRemoteBroadcast(r,t,a){if(!t.applied)return;let{message:i,affected:c}=t;if("delegation:share"!==i.type){if(null==c)return void a?.warn("remote broadcast applied but affected row missing",{type:i.type});switch(i.type){case"circle:create":{if("circle"!==c.kind)return;let{row:t}=c;await r.emit("circleCreated",{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at)});return}case"circle:update":{if("circle"!==c.kind)return;let{row:t}=c,a=null!=i.update.catalogIDs?"circleCatalogsChanged":"circleDataChanged";await r.emit(a,{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at),circleID:t.id});return}case"circle:delete":{if("circle"!==c.kind)return;let{row:t}=c;await r.emit("circleDeleted",{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at)});return}case"member:add":{if("member"!==c.kind)return;let{row:t}=c;await r.emit("circleMemberAdded",{circleID:t.circle_id,memberDID:t.member_did,role:t.role,createdAt:e(t.created_at)});return}case"member:remove":{if("member"!==c.kind)return;let{row:t}=c;await r.emit("circleMemberRemoved",{circleID:t.circle_id,memberDID:t.member_did,role:t.role,createdAt:e(t.created_at)});return}case"group:update":{if("group"!==c.kind)return;let{row:t}=c;await r.emit("groupDataChanged",{id:t.id,name:t.name,description:t.description,createdBy:t.created_by,createdAt:e(t.created_at),groupID:t.id});return}case"catalog:create":case"catalog:update":case"catalog:delete":return void a?.debug("catalog broadcast ignored (not yet wired)",{type:i.type})}}}

package/lib/hub/group-channel.d.ts

@@ -1,89 +0,0 @@
-import { Disposer } from '@enkaku/async';
-import type { OwnIdentity } from '@enkaku/token';
-import type { Logger } from '@kubun/logger';
-import type { P2PStoreAPI } from '@kubun/store-p2p';
-import type { GroupBroadcastMessage } from '../groups/broadcast.js';
-import type { BroadcastService } from '../groups/broadcast-service.js';
-import type { GroupHealthMonitor } from '../groups/group-health-monitor.js';
-import type { RejoinResult } from '../types.js';
-import type { HubConnection } from './hub-connection.js';
-import { RejoinManager } from './rejoin-manager.js';
-export type AckBatchParams = {
-    flushMs: number;
-    flushMax: number;
-    send: (ids: Array<string>) => Promise<void>;
-    logger?: Logger;
-};
-export declare class AckBatch {
-    #private;
-    constructor(params: AckBatchParams);
-    add(id: string): void;
-    /**
-     * Drain the pending id set and send it via the configured sender. Never
-     * rejects: send errors are logged and the ids are dropped silently (the hub
-     * will redeliver unacknowledged messages, so the next receive will produce a
-     * fresh ack).
-     */
-    flush(): Promise<void>;
-    dispose(): void;
-}
-export declare function computeBackoff(attempt: number, base: number, max: number, jitter: number): number;
-export declare function abortableSleep(ms: number, signal: AbortSignal): Promise<void>;
-export type GroupChannelParams = {
-    groupID: string;
-    deviceID: string;
-    hubConnection: HubConnection;
-    broadcastService: BroadcastService;
-    p2pStore: P2PStoreAPI;
-    logger?: Logger;
-    /** When provided, receive outcomes feed epoch-stale health detection and the
-     *  rejoin flow becomes available (both need the shared health monitor). */
-    monitor?: GroupHealthMonitor;
-    /** Device identity — required by `joinGroupExternal` in the rejoin flow. */
-    identity?: OwnIdentity;
-    /** Fresh correlation ids for rejoin requests. */
-    getRandomID?: () => string;
-    /**
-     * Pre-built rejoin manager, overriding the one this channel would construct
-     * from `monitor`/`identity`/`getRandomID`. Lets the rejoin orchestration be
-     * driven without standing up real MLS; production callers leave it unset.
-     */
-    rejoinManager?: RejoinManager;
-};
-/**
- * Per-group handle: thin wrapper around a shared `HubConnection`.
- *
- * `open()` subscribes to the connection (issuing `hub/group/join` once),
- * `close()` unsubscribes (drains the per-group mutex then issues
- * `hub/group/leave`), and `broadcast()` runs the MLS encrypt+send pipeline
- * inside `HubConnection.runInGroup()` so the per-group mutex serializes send
- * and receive on the same MLS state.
- *
- * All transport state (refID, ack batching, receive loop, reconnect/backoff)
- * lives on `HubConnection` and is shared across every channel for that
- * `hubURL`. A peer with N groups uses ONE `hub/receive` stream per
- * `(deviceDID, hubURL)` rather than N — this preserves the hub-server's
- * single-writer-per-DID invariant for bridge peers.
- */
-export declare class GroupChannel extends Disposer {
-    #private;
-    constructor(params: GroupChannelParams);
-    open(): Promise<void>;
-    /**
-     * Run stale-device recovery for this group. Available only when constructed
-     * with a health monitor + identity; returns `recovery-failed` otherwise.
-     */
-    rejoinGroup(): Promise<RejoinResult>;
-    close(): Promise<void>;
-    broadcast(message: GroupBroadcastMessage, opts?: {
-        timeoutMs?: number;
-    }): Promise<void>;
-    /**
-     * Fan out a pre-produced MLS handshake Commit to the group's existing
-     * members. Mirrors {@link broadcast} but routes through `handleSendCommit`
-     * (no application encryption — the Commit is already self-protected).
-     */
-    sendCommit(commitBytes: Uint8Array, opts?: {
-        timeoutMs?: number;
-    }): Promise<void>;
-}

package/lib/hub/group-channel.js

@@ -1 +0,0 @@
-import{Disposer as e}from"@enkaku/async";import{toB64 as r}from"@enkaku/codec";import{CircleCatchupRequester as t}from"./circle-catchup-requester.js";import{CircleCatchupResponder as o}from"./circle-catchup-responder.js";import{EpochStaleDetector as s}from"./epoch-stale-detector.js";import{handleReceivedMessage as i}from"./receive-handler.js";import{RejoinManager as n}from"./rejoin-manager.js";import{RejoinResponder as a}from"./rejoin-responder.js";import{handleSendBroadcast as u,handleSendCommit as h}from"./send-handler.js";export class AckBatch{#e;#r;#t;#o;#s=new Set;#i=null;constructor(e){this.#e=e.flushMs,this.#r=e.flushMax,this.#t=e.send,this.#o=e.logger}add(e){let r=0===this.#s.size;if(this.#s.add(e),this.#s.size>=this.#r){null!==this.#i&&(clearTimeout(this.#i),this.#i=null),this.flush();return}r&&null===this.#i&&(this.#i=setTimeout(()=>{this.#i=null,this.flush()},this.#e))}async flush(){if(null!==this.#i&&(clearTimeout(this.#i),this.#i=null),0===this.#s.size)return;let e=Array.from(this.#s);this.#s.clear();try{await this.#t(e)}catch(r){this.#o?.error("ack batch send failed",{error:r,count:e.length})}}dispose(){null!==this.#i&&(clearTimeout(this.#i),this.#i=null),this.#s.clear()}}export function computeBackoff(e,r,t,o){let s=Math.min(r*2**e*(1+o*(2*Math.random()-1)),t);return s<0?0:s}export function abortableSleep(e,r){return new Promise((t,o)=>{if(r.aborted)return void o(r.reason??Error("aborted"));let s=setTimeout(()=>{r.removeEventListener("abort",i),t()},e),i=()=>{clearTimeout(s),r.removeEventListener("abort",i),o(r.reason??Error("aborted"))};r.addEventListener("abort",i)})}export class GroupChannel extends e{#n;#a;#u;#h;#p;#o;#c;#d;#l;#g;#m;#I=!1;constructor(e){super({dispose:async()=>{await this.#f()}}),this.#n=e.groupID,this.#a=e.deviceID,this.#u=e.hubConnection,this.#h=e.broadcastService,this.#p=e.p2pStore,this.#o=e.logger,null!=e.monitor&&(this.#c=new s({groupID:e.groupID,monitor:e.monitor})),this.#d=new a({groupID:e.groupID,exportGroupInfo:()=>this.#h.exportGroupInfo(this.#n),sendGroupInfo:(e,r)=>this.#D(e,r),logger:e.logger}),null!=e.rejoinManager?this.#l=e.rejoinManager:null!=e.monitor&&null!=e.identity&&null!=e.getRandomID&&(this.#l=new n({groupID:e.groupID,identity:e.identity,readCredential:()=>this.#h.readCredential(this.#n),genRequestID:e.getRandomID,sendRequest:e=>this.#b(e),sendCommit:e=>this.sendCommit(e),replaceHandle:e=>this.#h.replaceHandle(this.#n,e),monitor:e.monitor,logger:e.logger})),this.#g=new o({groupID:e.groupID,store:this.#p,sendCatchupReply:(e,r,t)=>this.#y(e,r,t),logger:e.logger}),null!=e.getRandomID&&(this.#m=new t({groupID:e.groupID,genRequestID:e.getRandomID,sendRequest:e=>this.#R(e),applyReply:async e=>{await this.#u.runInGroup(this.#n,()=>this.#h.applyCatchupReply(this.#n,e))},logger:e.logger}))}async open(){if(this.#I)throw Error("GroupChannel already opened");let e=await this.#p.getMLSState(this.#n,this.#a);if(null==e)throw Error(`MLS state missing for group ${this.#n}; cannot join hub group`);await this.#u.subscribe(this.#n,e.credential,e=>this.#j(e)),this.#I=!0}async #j(e){let r=await i({groupID:this.#n,message:e,broadcastService:this.#h,logger:this.#o});this.#c?.onReceiveOutcome(r.outcome,r.sequenceID);let t=r.result;if(t?.kind==="rejoin-request")this.#d.onRejoinRequest(t.requestID);else if(t?.kind==="rejoin-groupinfo")this.#d.onRejoinGroupInfoSeen(t.requestID),this.#l?.onGroupInfo(t.requestID,t.groupInfo);else if(t?.kind==="app"){let e=t.message;"circle-catchup:request"===e.type?this.#g.onCatchupRequest(e.requestID):"circle-catchup:reply"===e.type&&(this.#g.onCatchupReplySeen(e.requestID),this.#m?.onCatchupReply(e.requestID,e))}return{ack:r.ack}}async rejoinGroup(){if(null==this.#l)return{status:"recovery-failed"};let e=await this.#l.rejoin();return"recovered"===e.status&&null!=this.#m&&this.#m.run().catch(e=>{this.#o?.warn("circle catch-up after rejoin failed",{groupID:this.#n,error:e})}),e}#b(e){return this.#I?this.#h.prepareSendRejoinRequest({requestID:e,send:e=>this.#u.broadcast(this.#n,r(e))}):Promise.reject(Error(`GroupChannel for ${this.#n} is not ready for rejoin request`))}#D(e,t){return this.#I?this.#h.prepareSendRejoinGroupInfo({requestID:e,groupInfo:t,send:e=>this.#u.broadcast(this.#n,r(e))}):Promise.reject(Error(`GroupChannel for ${this.#n} is not ready for rejoin reply`))}#R(e){return this.#I?this.#h.prepareSend({groupID:this.#n,message:{type:"circle-catchup:request",requestID:e},send:e=>this.#u.broadcast(this.#n,r(e))}):Promise.reject(Error(`GroupChannel for ${this.#n} is not ready for catch-up request`))}#y(e,t,o){return this.#I?this.#h.prepareSend({groupID:this.#n,message:{type:"circle-catchup:reply",requestID:e,circles:t,circleMembers:o},send:e=>this.#u.broadcast(this.#n,r(e))}):Promise.reject(Error(`GroupChannel for ${this.#n} is not ready for catch-up reply`))}async close(){this.#I&&await this.dispose()}async #f(){if(this.#d.dispose(),this.#l?.dispose(),this.#g.dispose(),this.#m?.dispose(),this.#I){try{await this.#u.unsubscribe(this.#n)}catch(e){this.#o?.warn("hub-connection unsubscribe failed during close",{groupID:this.#n,error:e})}this.#I=!1}}broadcast(e,r){return this.#I?this.#u.runInGroup(this.#n,async()=>{if(!this.#I)throw Error(`GroupChannel for ${this.#n} is not ready for broadcast`);await u({groupID:this.#n,message:e,broadcastService:this.#h,send:(e,t)=>this.#u.broadcast(e,t,{timeoutMs:r?.timeoutMs}),logger:this.#o})},{timeoutMs:r?.timeoutMs}):Promise.reject(Error(`GroupChannel for ${this.#n} is not ready for broadcast`))}sendCommit(e,r){return this.#I?this.#u.runInGroup(this.#n,async()=>{if(!this.#I)throw Error(`GroupChannel for ${this.#n} is not ready for sendCommit`);await h({groupID:this.#n,commitBytes:e,broadcastService:this.#h,send:(e,t)=>this.#u.broadcast(e,t,{timeoutMs:r?.timeoutMs}),logger:this.#o})},{timeoutMs:r?.timeoutMs}):Promise.reject(Error(`GroupChannel for ${this.#n} is not ready for sendCommit`))}}