@kubun/plugin-p2p 0.10.1 → 0.12.0

package/lib/types.js

@@ -1 +1 @@
-export{};
+export { };

package/lib/util/handler-error.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Translates a thrown value into a `HandlerError` when it carries a registered
+ * `KubunErrorCode`, so `HandlerError.from` in `@enkaku/server` passes it through
+ * instead of flattening it to `EK01` / "Handler execution failed".
+ *
+ * Anything else is returned unchanged, and that default is the security
+ * property: an error with no registered code is internal, and its message may
+ * carry DIDs, paths, or SQL. Forwarding a refusal is safe only because the
+ * throw site attached a code the registry allows to leave the device.
+ */
+export declare function toHandlerError(cause: unknown): unknown;
+/**
+ * Applies {@link toHandlerError} to every handler in a procedure record, so the
+ * translation lives in one place rather than in each handler.
+ */
+export declare function wrapHandlers(handlers: Record<string, unknown>): Record<string, unknown>;

package/lib/util/handler-error.js

@@ -0,0 +1,64 @@
+import { HandlerError } from '@enkaku/server';
+import { isKubunErrorCode } from '@kubun/protocol';
+import { GraphQLError } from 'graphql';
+function isObject(value) {
+    return typeof value === 'object' && value != null && !Array.isArray(value);
+}
+/**
+ * Translates a thrown value into a `HandlerError` when it carries a registered
+ * `KubunErrorCode`, so `HandlerError.from` in `@enkaku/server` passes it through
+ * instead of flattening it to `EK01` / "Handler execution failed".
+ *
+ * Anything else is returned unchanged, and that default is the security
+ * property: an error with no registered code is internal, and its message may
+ * carry DIDs, paths, or SQL. Forwarding a refusal is safe only because the
+ * throw site attached a code the registry allows to leave the device.
+ */ export function toHandlerError(cause) {
+    if (cause instanceof HandlerError) {
+        return cause;
+    }
+    if (cause instanceof GraphQLError) {
+        const { code, ...data } = cause.extensions;
+        return isKubunErrorCode(code) ? new HandlerError({
+            code,
+            message: cause.message,
+            data,
+            cause
+        }) : cause;
+    }
+    if (isObject(cause) && isKubunErrorCode(cause.code)) {
+        const message = typeof cause.message === 'string' ? cause.message : undefined;
+        const data = isObject(cause.data) ? cause.data : {};
+        return new HandlerError({
+            code: cause.code,
+            message,
+            data,
+            cause
+        });
+    }
+    return cause;
+}
+/**
+ * Applies {@link toHandlerError} to every handler in a procedure record, so the
+ * translation lives in one place rather than in each handler.
+ */ export function wrapHandlers(handlers) {
+    return Object.fromEntries(Object.entries(handlers).map(([name, handler])=>{
+        if (typeof handler !== 'function') {
+            return [
+                name,
+                handler
+            ];
+        }
+        const wrapped = async (...args)=>{
+            try {
+                return await handler(...args);
+            } catch (cause) {
+                throw toHandlerError(cause);
+            }
+        };
+        return [
+            name,
+            wrapped
+        ];
+    }));
+}

package/lib/util/mutex.d.ts

@@ -1,4 +1,17 @@
+export type MutexRunOptions = {
+    /**
+     * Give up WAITING for the lock after this long. Bounds the wait only — the
+     * deadline is cleared when the callback is invoked, so a slow holder is never
+     * rejected out from under work that then completes.
+     *
+     * A backstop, not a policy. A waiter that gives up does NOT run its callback
+     * when its turn comes; it yields the slot so everything behind it proceeds.
+     */
+    acquireTimeoutMs?: number;
+    /** Builds the rejection, so the caller can name what it was waiting for. */
+    acquireTimeoutError?: () => Error;
+};
 export type Mutex = {
-    run<T>(fn: () => Promise<T>): Promise<T>;
+    run<T>(fn: () => Promise<T>, options?: MutexRunOptions): Promise<T>;
 };
 export declare function createMutex(): Mutex;

package/lib/util/mutex.js

@@ -1 +1,44 @@
-export function createMutex(){let e=Promise.resolve();return{run(t){let r=e.then(()=>t());return e=r.catch(()=>{}),r}}}
+/** A waiter that gave up before its turn. Read by nothing: its `run` already rejected. */ const EXPIRED = Symbol('mutex.expired');
+export function createMutex() {
+    let tail = Promise.resolve();
+    return {
+        run (fn, options) {
+            const timeoutMs = options?.acquireTimeoutMs;
+            let expired = false;
+            let timer;
+            // The race below is on the RESULT, never on the acquisition: racing the
+            // acquisition inserts microtask hops between a handle operation and
+            // everything ordered against it. `fn` stays one microtask off the
+            // previous holder.
+            const next = tail.then(async ()=>{
+                if (expired) {
+                    return EXPIRED;
+                }
+                // Safe to read a timer the executor below assigns: `new Promise` runs
+                // its executor synchronously, this callback is a microtask away.
+                if (timer != null) {
+                    clearTimeout(timer);
+                    timer = undefined;
+                }
+                return await fn();
+            });
+            tail = next.catch(()=>{});
+            if (timeoutMs == null) {
+                return next;
+            }
+            return new Promise((resolve, reject)=>{
+                timer = setTimeout(()=>{
+                    expired = true;
+                    reject(options?.acquireTimeoutError?.() ?? new Error(`lock not acquired in ${timeoutMs}ms`));
+                }, timeoutMs);
+                next.then((value)=>{
+                    clearTimeout(timer);
+                    resolve(value);
+                }, (error)=>{
+                    clearTimeout(timer);
+                    reject(error);
+                });
+            });
+        }
+    };
+}

package/lib/utils.js

@@ -1 +1,21 @@
-export function unref(e){e.unref?.()}export function sleep(e){return new Promise(n=>{unref(setTimeout(n,e))})}export function bytesEqual(e,n){if(e.length!==n.length)return!1;for(let t=0;t<e.length;t++)if(e[t]!==n[t])return!1;return!0}
+/** Node returns a Timeout object with `unref()`; browsers return a number. */ export function unref(timer) {
+    ;
+    timer.unref?.();
+}
+/** Resolve after `ms`, without keeping the process alive. */ export function sleep(ms) {
+    return new Promise((resolve)=>{
+        const timer = setTimeout(resolve, ms);
+        unref(timer);
+    });
+}
+export function bytesEqual(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    for(let i = 0; i < a.length; i++){
+        if (a[i] !== b[i]) {
+            return false;
+        }
+    }
+    return true;
+}

package/package.json

@@ -1,71 +1,82 @@
 {
   "name": "@kubun/plugin-p2p",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "license": "see LICENSE.md",
+  "sideEffects": false,
   "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
   "exports": {
     ".": "./lib/index.js"
   },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
   "files": [
     "lib/*",
     "LICENSE.md"
   ],
-  "sideEffects": false,
   "dependencies": {
-    "@enkaku/async": "^0.16.0",
-    "@enkaku/capability": "^0.16.0",
-    "@enkaku/client": "^0.16.0",
-    "@enkaku/codec": "^0.16.0",
-    "@enkaku/event": "^0.16.0",
-    "@enkaku/generator": "^0.16.0",
-    "@enkaku/group": "^0.16.2",
-    "@enkaku/http-client-transport": "^0.16.0",
-    "@enkaku/http-server-transport": "^0.16.0",
-    "@enkaku/hub-protocol": "^0.16.0",
-    "@enkaku/hub-tunnel": "^0.16.0",
-    "@enkaku/protocol": "^0.16.0",
-    "@enkaku/runtime": "^0.16.0",
-    "@enkaku/schema": "^0.16.0",
-    "@enkaku/server": "^0.16.0",
-    "@enkaku/stream": "^0.16.0",
-    "@enkaku/token": "^0.16.0",
-    "@enkaku/transport": "^0.16.0",
+    "@enkaku/client": "^0.20.0",
+    "@enkaku/http-fetch": "^0.20.0",
+    "@enkaku/http-serve": "^0.20.0",
+    "@enkaku/protocol": "^0.20.0",
+    "@enkaku/server": "^0.20.0",
+    "@enkaku/transport": "^0.20.0",
+    "@kokuin/capability": "^0.2.1",
+    "@kokuin/token": "^0.3.0",
+    "@kumiai/broadcast": "^0.5.0",
+    "@kumiai/hub-protocol": "^0.5.0",
+    "@kumiai/hub-server": "^0.5.0",
+    "@kumiai/hub-tunnel": "^0.5.0",
+    "@kumiai/mls": "^0.5.0",
+    "@kumiai/mls-rpc": "^0.5.0",
+    "@kumiai/rpc": "^0.5.0",
+    "@noble/ciphers": "^2.2.0",
     "@noble/hashes": "^2.2.0",
+    "@sozai/async": "^0.2.1",
+    "@sozai/codec": "^0.4.0",
+    "@sozai/event": "^0.1.3",
+    "@sozai/generator": "^0.2.0",
+    "@sozai/runtime": "^0.1.0",
+    "@sozai/schema": "^0.1.1",
+    "@sozai/stream": "^0.2.0",
     "graphql": "^16.14.2",
-    "kysely": "^0.29.2",
-    "@kubun/client": "^0.10.1",
-    "@kubun/db-adapter": "^0.10.0",
-    "@kubun/db": "^0.10.0",
-    "@kubun/engine": "^0.10.3",
-    "@kubun/store-graph": "^0.10.2",
-    "@kubun/store-p2p": "^0.10.1",
-    "@kubun/hlc": "^0.10.1",
-    "@kubun/graphql": "^0.10.1",
-    "@kubun/id": "^0.10.0",
-    "@kubun/mutation": "^0.10.1",
-    "@kubun/logger": "^0.10.0",
-    "@kubun/protocol": "^0.10.0"
+    "kysely": "^0.29.4",
+    "ts-mls": "2.0.0-rc.13",
+    "@kubun/db": "^0.12.0",
+    "@kubun/db-adapter": "^0.12.0",
+    "@kubun/engine": "^0.12.0",
+    "@kubun/graphql": "^0.12.0",
+    "@kubun/hlc": "^0.12.0",
+    "@kubun/http-util": "^0.12.0",
+    "@kubun/logger": "^0.12.0",
+    "@kubun/mutation": "^0.12.0",
+    "@kubun/plugin-http": "^0.12.0",
+    "@kubun/plugin-rpc": "^0.12.0",
+    "@kubun/protocol": "^0.12.0",
+    "@kubun/store-delegation": "^0.12.0",
+    "@kubun/id": "^0.12.0",
+    "@kubun/store-graph": "^0.12.0",
+    "@kubun/store-p2p": "^0.12.0"
   },
   "devDependencies": {
-    "@enkaku/hub-server": "^0.16.0",
+    "@kumiai/hub-conformance": "^0.5.0",
+    "@kumiai/rpc-conformance": "^0.5.0",
+    "@testcontainers/postgresql": "^12.1.0",
     "get-port": "^7.2.0",
-    "@kubun/db-better-sqlite": "^0.10.0",
-    "@kubun/hub": "^0.10.0",
-    "@kubun/plugin-connector": "^0.10.0",
-    "@kubun/db-node-sqlite": "^0.10.0",
-    "@kubun/plugin-http": "^0.10.0",
-    "@kubun/plugin-rpc": "^0.10.0",
-    "@kubun/test-utils": "^0.10.0"
+    "@kubun/db-node-sqlite": "^0.12.0",
+    "@kubun/client": "^0.12.0",
+    "@kubun/plugin-connector": "^0.12.0",
+    "@kubun/test-utils": "^0.12.0",
+    "@kubun/db-postgres": "^0.12.0",
+    "@kubun/hub": "^0.12.0",
+    "@kubun/db-better-sqlite": "^0.12.0"
   },
   "scripts": {
+    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "build:clean": "del lib",
-    "build:js": "swc src -d ./lib --config-file ../../swc.json --strip-leading-paths",
+    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
     "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
-    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
+    "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit -p tsconfig.test.json",
-    "test:unit": "vitest run",
-    "test": "pnpm run test:types && pnpm run test:unit"
+    "test:unit": "vitest run"
   }
 }

package/lib/groups/broadcast-service.d.ts

@@ -1,263 +0,0 @@
-import { EventEmitter } from '@enkaku/event';
-import { type GroupHandle, type MemberCredential } from '@enkaku/group';
-import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
-import { HLC } from '@kubun/hlc';
-import type { Logger } from '@kubun/logger';
-import type { GraphStoreAPI } from '@kubun/store-graph';
-import type { P2PStoreAPI } from '@kubun/store-p2p';
-import type { ForwardingConfig } from '../sync/forwarder.js';
-import type { StoreUnreadableMode } from '../types.js';
-import { type AffectedRow, type ApplyCatchupReplyResult, type GroupBroadcastMessage } from './broadcast.js';
-import type { P2PEventEmitter } from './events.js';
-import type { GroupHandleRegistry } from './group-handle-registry.js';
-/**
- * Thrown when a received broadcast fails to decrypt (MLS restore, decrypt,
- * or deserialize). Callers should typically ack-and-skip these, since the
- * message is unrecoverable and redelivery will not help.
- */
-export declare class DecryptError extends Error {
-    #private;
-    constructor(message: string, cause: unknown);
-    get cause(): unknown;
-}
-/**
- * Decode failure on a rejoin control frame. Distinct from {@link DecryptError}
- * so the receive path classifies it `control`, not `decrypt-failed` — a corrupt
- * frame is not evidence of epoch-staleness and must not drive the health
- * detector. Ack-and-skip: redelivery can't fix a malformed frame.
- */
-export declare class MalformedControlError extends Error {
-    #private;
-    constructor(message: string, cause: unknown);
-    get cause(): unknown;
-}
-/**
- * Thrown when a successfully decrypted broadcast fails to apply to the local
- * DB. Callers should typically NOT ack these, so the message can be
- * redelivered after the transient failure clears.
- */
-export declare class ApplyError extends Error {
-    #private;
-    constructor(message: string, cause: unknown);
-    get cause(): unknown;
-}
-/**
- * Thrown when a received MLS Commit targets a future epoch the local handle
- * has not reached yet (a gap in the in-order Commit stream). Callers should
- * NOT ack — the hub redelivers in `sequence_id` order, so the gap-filling
- * Commit arrives first and this one applies on a later delivery.
- */
-export declare class CommitOutOfOrderError extends Error {
-    #private;
-    constructor(messageEpoch: bigint, handleEpoch: bigint);
-    get messageEpoch(): bigint;
-    get handleEpoch(): bigint;
-}
-export type BroadcastEvent = {
-    groupID: string;
-    message: GroupBroadcastMessage;
-    applied: boolean;
-    /**
-     * Row affected by the broadcast. After-state for create / update,
-     * before-state for delete / remove. Undefined when `applied === false`.
-     */
-    affected?: AffectedRow;
-    /**
-     * Count of `mutation:apply` entries the local broadcast log already had.
-     * Only set on the `mutation:apply` branch; absent on control-plane
-     * variants.
-     */
-    duplicates?: number;
-};
-export type BroadcastServiceEvents = {
-    broadcast: BroadcastEvent;
-};
-export type SendBroadcastParams = {
-    groupID: string;
-    message: GroupBroadcastMessage;
-    /**
-     * Wire-send hook invoked with the MLS-encrypted payload INSIDE the
-     * registry's per-group lock. A throw here propagates out of `prepareSend`
-     * and the registry skips persist — so a failed send leaves the device's
-     * MLS state at its pre-encrypt epoch, preventing the wedge where local
-     * state outpaces recipients.
-     */
-    send: (encrypted: Uint8Array) => Promise<void>;
-};
-export type SendCommitParams = {
-    groupID: string;
-    /**
-     * Canonical MLS-encoded handshake Commit bytes (an encrypted
-     * `PrivateMessage`) produced by the committer's `GroupManager` call.
-     */
-    commitBytes: Uint8Array;
-    /** Wire-send hook; receives the `mls`-framed bytes. */
-    send: (framed: Uint8Array) => Promise<void>;
-};
-export type ReceiveBroadcastParams = {
-    groupID: string;
-    encrypted: Uint8Array;
-};
-export type ReceiveAppResult = {
-    kind: 'app';
-    message: GroupBroadcastMessage;
-    applied: boolean;
-    affected?: AffectedRow;
-    duplicates?: number;
-};
-/**
- * Result of processing a received MLS handshake Commit (`mls` wire frame).
- * `removed`/`added` are the membership deltas derived by diffing the group
- * roster before and after applying the Commit. `removed` DIDs are tombstoned
- * via `markMemberRemoved` so the apply-time membership check can reject their
- * post-removal writes.
- */
-export type ReceiveCommitResult = {
-    kind: 'mls';
-    epoch: bigint;
-    removed: Array<string>;
-    added: Array<string>;
-};
-/**
- * A received `rejoin-request`: a stale device asking current members for fresh
- * GroupInfo. Cleartext; does not touch the MLS handle.
- */
-export type ReceiveRejoinRequestResult = {
-    kind: 'rejoin-request';
-    requestID: string;
-};
-/**
- * A current member's `rejoin-groupinfo` reply carrying fresh GroupInfo. Consumed
- * by the requester's rejoin flow; also drives responder suppression on peers.
- */
-export type ReceiveRejoinGroupInfoResult = {
-    kind: 'rejoin-groupinfo';
-    requestID: string;
-    groupInfo: Uint8Array;
-};
-export type ReceiveBroadcastResult = ReceiveAppResult | ReceiveCommitResult | ReceiveRejoinRequestResult | ReceiveRejoinGroupInfoResult;
-export type SendRejoinRequestParams = {
-    requestID: string;
-    /** Wire-send hook; receives the `rejoinRequest`-framed cleartext bytes. */
-    send: (framed: Uint8Array) => Promise<void>;
-};
-export type SendRejoinGroupInfoParams = {
-    requestID: string;
-    groupInfo: Uint8Array;
-    /** Wire-send hook; receives the `rejoinGroupInfo`-framed cleartext bytes. */
-    send: (framed: Uint8Array) => Promise<void>;
-};
-/**
- * BroadcastService handles MLS encrypt/decrypt for group broadcasts
- * and applies received messages to the local DB.
- *
- * Encrypt and decrypt go through `GroupHandleRegistry.withHandle` so MLS
- * state mutations serialize through the per-group mutex with write-through
- * persist. The DB-apply step (`processBroadcast`) for receives runs OUTSIDE
- * the lock so a slow apply does not block subsequent encrypt/decrypt on the
- * same group.
- */
-export type BroadcastServiceParams = {
-    p2pStore: P2PStoreAPI;
-    graphStore: GraphStoreAPI;
-    /**
-     * Engine graph internals — required so `mutation:apply` broadcasts route
-     * through {@link GraphInternals.applyVerifiedMutation} with `origin: 'peer'`.
-     */
-    graph: GraphInternals;
-    /** Self DID for `mutation:apply` loopback detection. */
-    selfDID: string;
-    /** Single canonical access point for MLS `GroupHandle` instances. */
-    registry: GroupHandleRegistry;
-    /**
-     * Device-wide monotonic clock for stamping the `removed_at_hlc` of members
-     * dropped by a received MLS Commit (the receive side has no HLC otherwise).
-     * Required: production passes the engine's single instance so every write
-     * from this device advances one shared clock, preventing two same-millisecond
-     * writes from minting identical timestamps (the second would silently lose
-     * under last-writer-wins).
-     */
-    hlc: HLC;
-    /**
-     * Receiver storage mode for incoming `mutation:apply` entries. Defaults
-     * to `'persist'`. When `'drop'`, `defaultAccessLevel` must be supplied
-     * so the gate factory can resolve server-side default access rules.
-     */
-    storeUnreadable?: StoreUnreadableMode;
-    /** Server default access level — required when `storeUnreadable === 'drop'`. */
-    defaultAccessLevel?: DefaultAccessLevel;
-    /**
-     * Forwarding config. Threaded into `processBroadcast` per call.
-     * `false` / undefined → forwarding disabled (default).
-     */
-    forwarding?: ForwardingConfig;
-    /**
-     * Hub forwarding hook — required when `forwarding` is set. Called once per
-     * surviving candidate group on the receive path.
-     */
-    scheduleBroadcast?: (groupID: string, message: GroupBroadcastMessage) => void | Promise<void>;
-    /**
-     * Emitter forwarded to `processBroadcast` so `delegation:share` receives
-     * surface a `delegationTokenAdded` event to local subscribers.
-     */
-    emitter?: P2PEventEmitter;
-    logger?: Logger;
-};
-export declare class BroadcastService extends EventEmitter<BroadcastServiceEvents> {
-    #private;
-    constructor(params: BroadcastServiceParams);
-    /**
-     * Encrypt + send a broadcast for a group, then persist the advanced MLS state.
-     *
-     * Failure semantics: send happens inside the registry's per-group lock. A
-     * throw from `send` propagates out and the registry skips persist — so the
-     * device's MLS state stays at its pre-encrypt epoch and the next attempt
-     * re-derives a fresh handle from the prior generation. Wedge protection
-     * intact.
-     */
-    prepareSend(params: SendBroadcastParams): Promise<void>;
-    /**
-     * Send a pre-produced MLS handshake Commit to the group, tagged `mls` on the
-     * wire. The Commit is already a self-protected (encrypted `PrivateMessage`)
-     * framed message produced by the committer's `GroupManager` call — it is NOT
-     * re-encrypted through the application path, so this does not touch the
-     * handle. The committer's MLS state has already advanced + persisted; the
-     * hub's durable + ordered mailbox carries the Commit to existing members and
-     * replays it on reconnect.
-     */
-    prepareSendCommit(params: SendCommitParams): Promise<void>;
-    /**
-     * Export a fresh `MLSMessage(GroupInfo)` from the current handle. Read-only:
-     * takes the registry lock but does not advance or persist state.
-     */
-    exportGroupInfo(groupID: string): Promise<Uint8Array>;
-    readCredential(groupID: string): Promise<MemberCredential>;
-    /**
-     * Swap+persist the cached handle (under the per-group mutex), then reconcile
-     * the store roster. The swap is security-critical; a reconcile failure is
-     * logged and swallowed so it can't reject the rejoin after the handle is
-     * installed (which would skip `markRecovered` and wedge the monitor) — the
-     * next rejoin re-runs the idempotent reconcile.
-     */
-    replaceHandle(groupID: string, handle: GroupHandle): Promise<void>;
-    /** Send a `rejoin-request` (cleartext) to the group channel. */
-    prepareSendRejoinRequest(params: SendRejoinRequestParams): Promise<void>;
-    /** Send a `rejoin-groupinfo` reply (cleartext) to the group channel. */
-    prepareSendRejoinGroupInfo(params: SendRejoinGroupInfoParams): Promise<void>;
-    /**
-     * Process a received broadcast: MLS decrypt INSIDE the registry lock,
-     * then apply to the DB OUTSIDE the lock so a slow apply doesn't block
-     * subsequent encrypt/decrypt on the same group.
-     */
-    processReceived(params: ReceiveBroadcastParams): Promise<ReceiveBroadcastResult>;
-    /**
-     * Apply a `circle-catchup:reply` batch (circles + circle members, including
-     * tombstoned) row-by-row through the existing handlers. Lock-free: like
-     * `processReceived`'s post-decrypt apply, this runs OUTSIDE the registry's
-     * per-group lock — it touches no MLS handle, and each row apply is idempotent
-     * and order-independent, so a late or duplicate reply converges harmlessly.
-     */
-    applyCatchupReply(groupID: string, reply: Extract<GroupBroadcastMessage, {
-        type: 'circle-catchup:reply';
-    }>): Promise<ApplyCatchupReplyResult>;
-}

package/lib/groups/broadcast-service.js

@@ -1 +0,0 @@
-import{EventEmitter as r}from"@enkaku/event";import{exportGroupInfo as e,readMessageEpoch as t}from"@enkaku/group";import{HLC as a}from"@kubun/hlc";import{applyCatchupReply as o,processBroadcast as s}from"./broadcast.js";import{deserializeBroadcast as i,serializeBroadcast as c}from"./broadcast-codec.js";import{mlsDecryptFramed as n,mlsEncryptFramed as l}from"./mls-codec.js";import{decodeRejoinGroupInfo as d,decodeRejoinRequest as m,encodeRejoinGroupInfo as p,encodeRejoinRequest as h}from"./rejoin-codec.js";import{frameWire as u,unframeWire as w,WireKind as f}from"./wire-frame.js";export class DecryptError extends Error{#r;constructor(r,e){super(r),this.name="DecryptError",this.#r=e}get cause(){return this.#r}}export class MalformedControlError extends Error{#r;constructor(r,e){super(r),this.name="MalformedControlError",this.#r=e}get cause(){return this.#r}}export class ApplyError extends Error{#r;constructor(r,e){super(r),this.name="ApplyError",this.#r=e}get cause(){return this.#r}}export class CommitOutOfOrderError extends Error{#e;#t;constructor(r,e){super(`MLS commit epoch ${r} ahead of handle epoch ${e}`),this.name="CommitOutOfOrderError",this.#e=r,this.#t=e}get messageEpoch(){return this.#e}get handleEpoch(){return this.#t}}export class BroadcastService extends r{#a;#o;#s;constructor(r){super(),this.#s=r.hlc,this.#a={p2pStore:r.p2pStore,graphStore:r.graphStore,graph:r.graph,selfDID:r.selfDID,storeUnreadable:r.storeUnreadable,defaultAccessLevel:r.defaultAccessLevel,forwarding:r.forwarding,scheduleBroadcast:r.scheduleBroadcast,emitter:r.emitter,logger:r.logger},this.#o=r.registry}async prepareSend(r){let{groupID:e,message:t,send:a}=r,o=c(t);await this.#o.withHandle(e,async r=>{let{framed:e}=await l(r,o);await a(u(f.app,e))})}async prepareSendCommit(r){let{commitBytes:e,send:t}=r;await t(u(f.mls,e))}async exportGroupInfo(r){return await this.#o.withHandle(r,async r=>{let{groupInfo:t}=await e({group:r});return t})}async readCredential(r){return await this.#o.withHandle(r,async r=>r.credential)}async replaceHandle(r,e){await this.#o.replaceHandle(r,e);try{await this.#i(r,e)}catch(e){this.#a.logger?.warn("rejoin: store roster reconcile failed",{groupID:r,error:e})}}async #i(r,e){let{p2pStore:t}=this.#a,o=e.listMembers().map(r=>r.id),s=new Set(o),i=await t.listGroupMembers(r),c=new Set(i.map(r=>r.member_did)),n=a.serialize(this.#s.now());for(let e of i)s.has(e.member_did)||await t.markMemberRemoved(r,e.member_did,n);for(let e of o)c.has(e)||await t.addGroupMember({group_id:r,member_did:e,role:"member",hlc:n})}async prepareSendRejoinRequest(r){let{requestID:e,send:t}=r;await t(u(f.rejoinRequest,h({requestID:e})))}async prepareSendRejoinGroupInfo(r){let{requestID:e,groupInfo:t,send:a}=r;await a(u(f.rejoinGroupInfo,p({requestID:e,groupInfo:t})))}async processReceived(r){let e,t,a,o,{groupID:c,encrypted:l}=r;try{({kind:e,payload:t}=w(l))}catch(r){throw new DecryptError("Malformed group wire frame",r)}if(e===f.mls)return await this.#c(c,t);if(e===f.rejoinRequest)try{let{requestID:r}=m(t);return{kind:"rejoin-request",requestID:r}}catch(r){throw new MalformedControlError("Malformed rejoin-request frame",r)}if(e===f.rejoinGroupInfo)try{let{requestID:r,groupInfo:e}=d(t);return{kind:"rejoin-groupinfo",requestID:r,groupInfo:e}}catch(r){throw new MalformedControlError("Malformed rejoin-groupinfo frame",r)}try{a=await this.#o.withHandle(c,async r=>{let e=await n(r,t);return i(e)})}catch(r){throw new DecryptError("Failed to decrypt broadcast",r)}try{o=await s(this.#a,a,c)}catch(r){throw new ApplyError("Failed to apply broadcast",r)}let{applied:p,affected:h,duplicates:u}=o;return await this.emit("broadcast",{groupID:c,message:a,applied:p,affected:h,duplicates:u}),{kind:"app",message:a,applied:p,affected:h,duplicates:u}}async applyCatchupReply(r,e){return await o(this.#a,e,r)}async #c(r,e){return await this.#o.withHandle(r,async o=>{let s=t(e),i=o.epoch;if(null!=s&&s<i)return{kind:"mls",epoch:i,removed:[],added:[]};if(null!=s&&s>i)throw new CommitOutOfOrderError(s,i);let c=o.listMembers();try{await o.processMessage(e)}catch(r){throw new DecryptError("Failed to process MLS commit",r)}let n=o.listMembers(),l=new Set(c.map(r=>r.id)),d=new Set(n.map(r=>r.id)),m=c.filter(r=>!d.has(r.id)).map(r=>r.id),p=n.filter(r=>!l.has(r.id)).map(r=>r.id),h=a.serialize(this.#s.now()),{p2pStore:u}=this.#a;for(let e of m)await u.markMemberRemoved(r,e,h);for(let e of p)await u.addGroupMember({group_id:r,member_did:e,role:"member",hlc:h});return{kind:"mls",epoch:o.epoch,removed:m,added:p}})}}

package/lib/groups/rejoin-codec.d.ts

@@ -1,14 +0,0 @@
-/** A stale device's request for a fresh GroupInfo. Cleartext on the wire. */
-export type RejoinRequest = {
-    requestID: string;
-};
-/** A current member's reply carrying a framed `MLSMessage(GroupInfo)`. */
-export type RejoinGroupInfo = {
-    requestID: string;
-    /** Framed `MLSMessage(GroupInfo)` bytes. */
-    groupInfo: Uint8Array;
-};
-export declare function encodeRejoinRequest(request: RejoinRequest): Uint8Array;
-export declare function decodeRejoinRequest(bytes: Uint8Array): RejoinRequest;
-export declare function encodeRejoinGroupInfo(message: RejoinGroupInfo): Uint8Array;
-export declare function decodeRejoinGroupInfo(bytes: Uint8Array): RejoinGroupInfo;

package/lib/groups/rejoin-codec.js

@@ -1 +0,0 @@
-import{replacer as e,reviver as r}from"./mls-json.js";let o=new TextEncoder,n=new TextDecoder;export function encodeRejoinRequest(r){return o.encode(JSON.stringify(r,e))}export function decodeRejoinRequest(e){let o=JSON.parse(n.decode(e),r);if("string"!=typeof o?.requestID)throw Error("invalid rejoin-request: missing requestID");return{requestID:o.requestID}}export function encodeRejoinGroupInfo(r){return o.encode(JSON.stringify(r,e))}export function decodeRejoinGroupInfo(e){let o=JSON.parse(n.decode(e),r);if("string"!=typeof o?.requestID)throw Error("invalid rejoin-groupinfo: missing requestID");if(!(o.groupInfo instanceof Uint8Array))throw Error("invalid rejoin-groupinfo: missing groupInfo bytes");return{requestID:o.requestID,groupInfo:o.groupInfo}}

package/lib/groups/wire-frame.d.ts

@@ -1,34 +0,0 @@
-/**
- * Outer wire-frame discriminator for group hub payloads.
- *
- * The hub relay treats a group send payload as opaque bytes. Kubun prepends a
- * single `kind` byte so the receiver can route a payload to the right decoder
- * without trial-decryption:
- *
- * - `app` — an MLS-encrypted application broadcast (`GroupBroadcastMessage`),
- *   decoded via `handle.decrypt` + `deserializeBroadcast`.
- * - `mls` — a framed MLS handshake message (a Commit), fed straight to
- *   `handle.processMessage`. The handshake is self-protected (encrypted
- *   `PrivateMessage`), so it is NOT wrapped in the application-encryption path.
- *
- * The discriminator lives entirely in kubun's payload bytes; the hub protocol
- * is unchanged.
- */
-export declare const WireKind: {
-    readonly app: 0;
-    readonly mls: 1;
-    readonly rejoinRequest: 2;
-    readonly rejoinGroupInfo: 3;
-};
-export type WireKind = (typeof WireKind)[keyof typeof WireKind];
-/** Prepend the `kind` byte to a payload. */
-export declare function frameWire(kind: WireKind, payload: Uint8Array): Uint8Array;
-/**
- * Split a framed payload into its `kind` and the remaining payload bytes.
- * Throws on an empty frame or an unrecognized `kind` byte. The returned
- * payload is a view (`subarray`) over the input, not a copy.
- */
-export declare function unframeWire(framed: Uint8Array): {
-    kind: WireKind;
-    payload: Uint8Array;
-};

package/lib/groups/wire-frame.js

@@ -1 +0,0 @@
-export const WireKind={app:0,mls:1,rejoinRequest:2,rejoinGroupInfo:3};let r=new Set(Object.values(WireKind));export function frameWire(r,e){let n=new Uint8Array(e.length+1);return n[0]=r,n.set(e,1),n}export function unframeWire(e){if(0===e.length)throw Error("empty wire frame");let n=e[0];if(!r.has(n))throw Error(`unknown wire frame kind: ${n}`);return{kind:n,payload:e.subarray(1)}}