@kubun/plugin-p2p 0.11.0 → 0.12.1

package/lib/context/hub.js

@@ -31,7 +31,8 @@ export function createHubContext(_ctx, deps) {
                 stores: deps.stores,
                 url: input.url,
                 label: input.label,
-                serverDID: input.serverDID
+                serverDID: input.serverDID,
+                runtime: deps.runtime
             });
             return toHubData(hub);
         },

package/lib/context/join.js

@@ -1,7 +1,7 @@
-import { createKeyPackageBundle } from '@kumiai/mls';
-import { groupAnchorCapabilities } from '../groups/group-anchor.js';
-import { decodeInvitePayload, encodeJoinRequest } from '../groups/invite-payload.js';
-import { applyInviteGrants, applyInviteRevocations, finalizeJoinedGroup } from '../groups/join-utils.js';
+import { getP2PStore } from '@kubun/store-p2p';
+import { controlCapabilities, createKeyPackageBundle, readGroupAnchor } from '@kumiai/mls';
+import { decodeFullJoinRequest, decodeInvitePayload, encodeFullJoinRequest, encodeJoinRequest } from '../groups/invite-payload.js';
+import { applyInviteControlState, applyInviteGrants, applyInviteRevocations, finalizeJoinedGroup } from '../groups/join-utils.js';
 import { checkPeerAccess } from './types.js';
 export function createJoinContext(ctx, deps) {
     return {
@@ -11,12 +11,21 @@ export function createJoinContext(ctx, deps) {
             // The invitee leaf must advertise the anchor extension capability or
             // commitInvite rejects the added leaf when joining an anchored group.
             const bundle = await createKeyPackageBundle(ownIdentity, {
-                capabilities: groupAnchorCapabilities()
+                capabilities: controlCapabilities()
             });
-            deps.pendingJoinRequests.set(ctx.viewerDID, {
-                publicPackage: bundle.publicPackage,
-                privatePackage: bundle.privatePackage,
-                did: ownIdentity.id
+            // Persisted, not stashed in memory: the offline exchange spans a human
+            // round-trip, so the answering call is routinely a different process —
+            // always so for a CLI device, where the two halves are two commands.
+            const p2pStore = await getP2PStore(deps.stores);
+            await p2pStore.putPendingJoinRequest({
+                did: ctx.viewerDID,
+                // The same encoding the connected join path hands between devices — a
+                // key package carries BigInts and binary that plain JSON drops.
+                payload: encodeFullJoinRequest({
+                    did: ownIdentity.id,
+                    publicPackage: bundle.publicPackage,
+                    privatePackage: bundle.privatePackage
+                })
             });
             const encoded = encodeJoinRequest({
                 did: ownIdentity.id,
@@ -28,15 +37,20 @@ export function createJoinContext(ctx, deps) {
         },
         complete: async (invitePayloadStr)=>{
             checkPeerAccess(ctx.viewerDID, deps.identity.id, deps.autoAcceptPeers);
-            const stored = deps.pendingJoinRequests.get(ctx.viewerDID);
+            const p2pStore = await getP2PStore(deps.stores);
+            const stored = await p2pStore.getPendingJoinRequest(ctx.viewerDID);
             if (stored == null) {
-                throw new Error('No pending join request found — call prepareJoinRequest first');
+                // Naming the way out matters: "no pending join request" reads to an
+                // operator as "the payload you were handed is bad", and they go asking
+                // for a new invite against key material that was never the problem.
+                throw new Error('The invite payload is fine, but this device has no join request awaiting it — create a new join request and ask to be invited again.');
             }
             const ownIdentity = deps.identity;
             const invite = decodeInvitePayload(invitePayloadStr);
+            const pending = decodeFullJoinRequest(stored.payload);
             const keyPackageBundle = {
-                publicPackage: stored.publicPackage,
-                privatePackage: stored.privatePackage,
+                publicPackage: pending.publicPackage,
+                privatePackage: pending.privatePackage,
                 ownerDID: ownIdentity.id
             };
             await deps.groupManager.joinGroup({
@@ -68,12 +82,33 @@ export function createJoinContext(ctx, deps) {
                 emitter: deps.emitter,
                 logger: deps.logger
             });
+            // Fold the invite-carried control state (ledger, access-defaults,
+            // catalogs) so the joiner projects circles/members at join — the same
+            // seeding `joinGroup` performs. The MLS handle now exists, so the genesis
+            // anchor is readable; the anchor is read through `deps.stores` so the
+            // registry shares its connection (a separate connection deadlocks
+            // single-connection SQLite).
+            await applyInviteControlState({
+                stores: deps.stores,
+                groupID: invite.groupID,
+                accessDefaults: invite.accessDefaults,
+                catalogs: invite.catalogs,
+                hlc: deps.hlc,
+                getGroupAnchor: (gid)=>deps.registry.readHandle(gid, (handle)=>readGroupAnchor(handle), {
+                        stores: deps.stores
+                    }),
+                getGroupLedger: (gid)=>deps.registry.readHandle(gid, (handle)=>handle.ledger, {
+                        stores: deps.stores
+                    }),
+                logger: deps.logger
+            });
             const result = await finalizeJoinedGroup({
                 stores: deps.stores,
                 emitter: deps.emitter,
-                invite
+                invite,
+                logger: deps.logger
             });
-            deps.pendingJoinRequests.delete(ctx.viewerDID);
+            await p2pStore.deletePendingJoinRequest(ctx.viewerDID);
             return result;
         }
     };

package/lib/context/peer.d.ts

@@ -0,0 +1,92 @@
+import type { ExecutionContext } from '@kubun/engine';
+import type { InviteAccessDefault } from '../groups/invite-payload.js';
+import type { GroupRequestContext, PeerRequestContext, SharePeerGroupData } from '../types.js';
+import type { ContextDeps } from './types.js';
+/**
+ * The inviter leg of the inbound dance, run on behalf of a verified caller by
+ * the `group/invite` peer handler. It designates NO circle itself: the joiner
+ * lands only in circles the inviter ALREADY designated — a `sharePeerGroup`
+ * pre-add, or an explicit `requestAddCircleMember` — which `collectInviteSeeds`
+ * snapshots from the ledger. Both of those land through an enacted commit, so
+ * by the time a designation is snapshottable here it is already durable. The
+ * invite runs as THIS device's own identity; the caller only supplies the group
+ * and its KeyPackage.
+ */
+export declare function serveGroupInvite(deps: ContextDeps, params: {
+    callerDID: string;
+    groupID: string;
+    joinRequest: string;
+}): Promise<{
+    invitePayload: string;
+}>;
+/**
+ * Apply the access-default rows a verified caller pushed for itself, run by the
+ * `group/push-control` peer handler. The source is UNTRUSTED, so the rows apply
+ * sender-bound — a row is kept only when its owner equals the authenticated
+ * caller, on top of the owner-equals-token-issuer check
+ * `applyAccessDefaultSetFrame` already enforces. A caller therefore cannot
+ * inject another owner's sharing policy.
+ *
+ * The caller must additionally be a member of the named group per THIS device's
+ * own membership view. The other remote ledger-ingest path rides the group's hub
+ * topic, whose MLS derivation is an implicit membership perimeter; this
+ * procedure is reachable by any accepted peer, so the perimeter is restated
+ * here. Fail-closed: an unknown group reads as no membership.
+ */
+export declare function servePushControl(deps: ContextDeps, params: {
+    callerDID: string;
+    groupID: string;
+    accessDefaults: Array<InviteAccessDefault>;
+}): Promise<{
+    accessDefaultsApplied: number;
+}>;
+export type DesignatePeerAccessParams = {
+    /**
+     * The request/settle facade, supplied rather than built here so a caller that
+     * mints an invite afterwards drives it through the same one.
+     */
+    groupCtx: GroupRequestContext;
+    /**
+     * The designating admin: admitted to the share circle beside the peer, and the
+     * owner whose read defaults are classified.
+     */
+    selfDID: string;
+    peerDID: string;
+    /** Share an existing group, or create a new one with this name. */
+    target: {
+        groupID: string;
+    } | {
+        name: string;
+    };
+    /**
+     * The calling mutation's name and the action its admin gate refuses by, so a
+     * failure inside a shared step names the operation the caller actually
+     * invoked. Without it every caller's errors would answer to whichever one
+     * happened to be written first.
+     */
+    operation: {
+        name: string;
+        adminAction: string;
+    };
+    /** The user's exact model selection, or `null` for no send leg. */
+    sendModels: Array<string> | null;
+    receiveActivate: boolean;
+    /** See {@link SharePeerGroupParams.setReadDefaultForCircle}. */
+    setReadDefaultForCircle: (modelID: string, circleID: string) => Promise<void>;
+};
+/**
+ * Designate one peer's access to one group: resolve or create the group, fold
+ * the commit-hub designation, find or create the share circle, admit both DIDs,
+ * and write the catalog + read defaults the share's scope rests on.
+ *
+ * Local state only — no peer connection is read or written. Whatever follows a
+ * designation (the MLS dance, registering the sync peer) belongs to the caller,
+ * so admitting a peer without a live connection reuses this rather than copying
+ * it: an invite payload snapshots exactly what these steps wrote, so a second
+ * copy of the seeding order drifts into a joiner landing in no circle, silently.
+ *
+ * The steps are ORDER-dependent — each reads what an earlier one wrote — so the
+ * sequence below is the contract, not an arrangement.
+ */
+export declare function designatePeerAccess(deps: ContextDeps, params: DesignatePeerAccessParams): Promise<SharePeerGroupData>;
+export declare function createPeerContext(ctx: ExecutionContext, deps: ContextDeps): PeerRequestContext;