@kubun/plugin-p2p 0.15.1 → 0.16.1

package/lib/groups/group-protocols.js

@@ -1,3 +1,4 @@
+import { COMMAND_REFUSAL_REASONS } from '@kubun/plugin-workflow-api';
 import { defineGroupProtocol } from '@kumiai/rpc';
 /**
  * App-lane group-rpc protocols carried over a group's rotating broadcast topics.
@@ -42,10 +43,10 @@ import { defineGroupProtocol } from '@kumiai/rpc';
     },
     'control/policyCatchup': {
         type: 'request',
-        // Nothing kept: the reply is a snapshot of what each responder's rules are
-        // right now, and one that outlived its window would be answering for a
-        // policy that may since have been rewritten. The durable half of this lane
-        // is `control/accessDefaultSet`, which this repairs rather than replaces.
+        // Nothing kept: the reply is a snapshot of each responder's current rules,
+        // and one that outlived its window would answer for a policy that may since
+        // have been rewritten. The durable half of this lane is
+        // `control/accessDefaultSet`, which this repairs rather than replaces.
         retain: 'ephemeral',
         description: 'Ask current members to restate their OWN model access-defaults, for a member whose read position fell below the hub retention floor and can no longer read the frames that carried them. Gathered: each member replies with signed tokens for its own rules; the requester verifies every token and applies it under the same sender-bound LWW rules as a live frame.',
         param: {
@@ -251,13 +252,12 @@ import { defineGroupProtocol } from '@kumiai/rpc';
     },
     'control/credentialKeyGrant': {
         type: 'event',
-        // Retained, and this is the load-bearing half of the design. A grant is an
-        // explicit one-shot push with no background replication and no catch-up
-        // procedure behind it: ephemeral, a recipient that was offline at grant time
-        // silently never gets access, and the only repair is a human granting again.
-        // Retention is what the app lane actually delivers — a device away across a
-        // roster change still reads the epoch's app topic on its way past it — and it
-        // costs one log frame, since the depth bound counts frames and not bytes.
+        // Retained, and the load-bearing half of the design. A grant is a one-shot
+        // push with no background replication or catch-up behind it: ephemeral, a
+        // recipient offline at grant time silently never gets access, and the only
+        // repair is a human granting again. Retention is what actually delivers to a
+        // device away across a roster change, and costs one log frame (the depth
+        // bound counts frames, not bytes).
         retain: 'log',
         description: "Hand one co-member what it needs to open a credential key: the key's public record, the single wrapping addressed to that member, and every entry ciphertext at that version. Group-wide because confidentiality is content-level; only the addressed DID applies it. `auth` signs identifiers and content digests, and the receiver recomputes both from this frame.",
         data: {
@@ -612,6 +612,258 @@ export const peerProtocol = defineGroupProtocol({
         result: peerAnnouncementBody
     }
 });
+/**
+ * One instance's public status, mirroring `InstanceStatus` from
+ * `@kubun/plugin-workflow-api`. Hand-declared as a schema (not derived) because
+ * the protocol layer takes no runtime dependency on the workflow plugin — the
+ * live shape arrives at the handler through `engine.getAPI('workflow')`. `status`
+ * is a bare string here: the wire only carries the value, and the API's narrower
+ * union is re-applied where the handler reads it.
+ */ const workflowInstanceStatus = {
+    type: 'object',
+    properties: {
+        instanceID: {
+            type: 'string'
+        },
+        name: {
+            type: 'string'
+        },
+        queue: {
+            type: 'string'
+        },
+        status: {
+            type: 'string'
+        },
+        attempts: {
+            type: 'number'
+        },
+        lastError: {
+            type: [
+                'string',
+                'null'
+            ]
+        },
+        createdAt: {
+            type: 'number'
+        },
+        updatedAt: {
+            type: 'number'
+        }
+    },
+    required: [
+        'instanceID',
+        'name',
+        'queue',
+        'status',
+        'attempts',
+        'lastError',
+        'createdAt',
+        'updatedAt'
+    ],
+    additionalProperties: false
+};
+/**
+ * A directed command's typed result, as a discriminated union carried as DATA.
+ * Enkaku collapses every handler THROW to one generic `HANDLER_ERROR`, so a
+ * business refusal cannot travel as a thrown reason — success returns the
+ * resulting `InstanceStatus`, refusal returns a machine reason a caller helper
+ * reconstitutes into a typed local throw. Only genuine infra faults still throw
+ * (→ generic error).
+ *
+ * The two branches are declared as their own consts and spread into each
+ * procedure's `result: { anyOf: [...] }` inline: a shared `as const` schema
+ * assigned whole to `result` is a frozen readonly tuple the protocol definer's
+ * `const` generic rejects, but the same consts nested under an inline `anyOf`
+ * infer cleanly.
+ */ const workflowCommandOk = {
+    type: 'object',
+    properties: {
+        ok: {
+            type: 'boolean',
+            const: true
+        },
+        status: workflowInstanceStatus
+    },
+    required: [
+        'ok',
+        'status'
+    ],
+    additionalProperties: false
+};
+// The wire refusal enum derives from the single COMMAND_REFUSAL_REASONS list in
+// @kubun/plugin-workflow-api (`not_commandable` + the engine's own
+// RETRY_REFUSAL_REASONS), so it cannot drift from the caller-facing contract type
+// that aliases the same list.
+const workflowCommandRefusal = {
+    type: 'object',
+    properties: {
+        ok: {
+            type: 'boolean',
+            const: false
+        },
+        reason: {
+            type: 'string',
+            enum: [
+                ...COMMAND_REFUSAL_REASONS
+            ]
+        }
+    },
+    required: [
+        'ok',
+        'reason'
+    ],
+    additionalProperties: false
+};
+/**
+ * Workflow plane: remote observation of a device's durable workflow instances.
+ * Mounted only when this device runs the workflow plugin (see the manager's
+ * conditional composition) — absent it, no `workflow` topic exists and a gather
+ * on this lane routes to nothing.
+ *
+ * ATTRIBUTION IS THE LANE'S, NOT THE BODY'S, as on the peer plane: the reply is a
+ * bare `InstanceStatus[]` and the gather envelope supplies the responder's
+ * authenticated `senderDID`, so the body names no device.
+ */ export const workflowProtocol = defineGroupProtocol({
+    'workflow/discover': {
+        type: 'request',
+        // Liveness: a reply is what this device is running right now, and one that
+        // outlived its window would answer for state that may since have changed.
+        retain: 'ephemeral',
+        description: 'Ask co-members which of their workflow instances are remotely observable. Gathered: each device replies with only its own remote.observe instances.',
+        param: {
+            type: 'object',
+            properties: {},
+            additionalProperties: false
+        },
+        result: {
+            type: 'array',
+            items: workflowInstanceStatus
+        }
+    },
+    'workflow/list': {
+        type: 'request',
+        // Directed enumeration: reached via `.to(peer)`, not gather. Same liveness as
+        // discover — a reply is what the peer runs right now.
+        retain: 'ephemeral',
+        description: 'Ask one peer (directed) for its remotely-observable workflow instances. The peer replies with only its own remote.observe instances.',
+        param: {
+            type: 'object',
+            properties: {},
+            additionalProperties: false
+        },
+        result: {
+            type: 'array',
+            items: workflowInstanceStatus
+        }
+    },
+    'workflow/status': {
+        type: 'request',
+        retain: 'ephemeral',
+        description: 'Ask one peer (directed) for one instance status by id. A non-observable instance is refused identically to an unknown one, so the reply never reveals that a hidden instance exists.',
+        param: {
+            type: 'object',
+            properties: {
+                instanceID: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'instanceID'
+            ],
+            additionalProperties: false
+        },
+        result: workflowInstanceStatus
+    },
+    'workflow/enqueue': {
+        type: 'request',
+        retain: 'ephemeral',
+        description: 'Ask one peer (directed) to enqueue a named workflow. Directed addressing means exactly one device runs it — no double-execution. A workflow that did not opt into remote command is refused with `not_commandable`; success returns the new instance status.',
+        param: {
+            type: 'object',
+            properties: {
+                name: {
+                    type: 'string'
+                },
+                // Arbitrary workflow input, opaque at this boundary.
+                params: {},
+                opts: {
+                    type: 'object',
+                    properties: {
+                        queue: {
+                            type: 'string'
+                        },
+                        priority: {
+                            type: 'number'
+                        },
+                        idempotencyKey: {
+                            type: 'string'
+                        },
+                        singletonKey: {
+                            type: 'string'
+                        }
+                    },
+                    additionalProperties: false
+                }
+            },
+            required: [
+                'name'
+            ],
+            additionalProperties: false
+        },
+        result: {
+            anyOf: [
+                workflowCommandOk,
+                workflowCommandRefusal
+            ]
+        }
+    },
+    'workflow/cancel': {
+        type: 'request',
+        retain: 'ephemeral',
+        description: 'Ask one peer (directed) to cancel one instance by id. A non-commandable instance is refused identically to an unknown one (`not_found`), so the reply never reveals that a hidden instance exists.',
+        param: {
+            type: 'object',
+            properties: {
+                instanceID: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'instanceID'
+            ],
+            additionalProperties: false
+        },
+        result: {
+            anyOf: [
+                workflowCommandOk,
+                workflowCommandRefusal
+            ]
+        }
+    },
+    'workflow/retry': {
+        type: 'request',
+        retain: 'ephemeral',
+        description: "Ask one peer (directed) to re-arm one failed instance by id. A non-commandable instance is refused identically to an unknown one (`not_found`); the engine's own retry refusals (`not_failed`/`no_next_action`/`singleton`) map through verbatim.",
+        param: {
+            type: 'object',
+            properties: {
+                instanceID: {
+                    type: 'string'
+                }
+            },
+            required: [
+                'instanceID'
+            ],
+            additionalProperties: false
+        },
+        result: {
+            anyOf: [
+                workflowCommandOk,
+                workflowCommandRefusal
+            ]
+        }
+    }
+});
 /**
  * The app-lane protocols, keyed for `createGroupPeer({ protocols })`. Each key
  * names its own topic, so adding one moves no existing lane.
@@ -620,3 +872,19 @@ export const peerProtocol = defineGroupProtocol({
     sync: syncProtocol,
     peer: peerProtocol
 };
+/**
+ * The group protocols with the `workflow` lane conditionally mounted. A FRESH
+ * object each call — the shared static {@link groupProtocols} is never mutated.
+ * When `hasWorkflow` is false the base map is returned unchanged, so no
+ * `workflow` key exists and a gather on that lane routes to nothing.
+ *
+ * The workflow lane is an extra runtime key served by `createGroupPeer`
+ * (`Object.entries(protocols)`), but callers stay typed at the base shape: the
+ * manager never statically routes `workflow`, and the peer it holds keeps its
+ * base type. The paired handler is composed by `composeGroupHandlers`.
+ */ export function composeGroupProtocols(hasWorkflow) {
+    return hasWorkflow ? {
+        ...groupProtocols,
+        workflow: workflowProtocol
+    } : groupProtocols;
+}

package/lib/groups/mls-codec.d.ts

@@ -1,28 +1,34 @@
 import type { GroupHandle } from '@kumiai/mls';
 /**
  * Encrypt an application message for the group. `@kumiai/mls` returns framed MLS
- * wire bytes, so kubun puts those on the wire directly — no JSON envelope of its
- * own, and no retired secret material crossing the boundary.
+ * wire bytes, put on the wire directly — no JSON envelope, no retired secret
+ * material crossing the boundary.
+ *
+ * `aad` becomes the frame's MLS `authenticated_data`: bound into the AEAD but
+ * carried in the clear, so the reader authenticates it before opening. The
+ * directed lane passes the send topicID here so a frame sealed for one topic
+ * cannot be replayed onto another. Absent (broadcast's fixed topic) it defaults
+ * to empty.
  */
-export declare function mlsEncryptFramed(handle: GroupHandle, plaintext: Uint8Array): Promise<Uint8Array>;
+export declare function mlsEncryptFramed(handle: GroupHandle, plaintext: Uint8Array, aad?: Uint8Array): Promise<Uint8Array>;
 /**
  * Decrypt a received application message and recover WHO SENT IT.
  *
- * `handle.decrypt` rather than `processMessage`, which returns an application
- * message's plaintext with no sender. The sender is AUTHENTICATED, not claimed:
- * the leaf index rides sender-data encrypted under the epoch's sender-data
- * secret, and the body opens only under the ratchet key derived at that leaf, so
- * a frame naming a leaf it was not sealed at does not open at all.
+ * `handle.decrypt` rather than `processMessage`, which yields plaintext with no
+ * sender. The sender is AUTHENTICATED, not claimed: the leaf index rides
+ * sender-data encrypted under the epoch's sender-data secret, and the body opens
+ * only under the ratchet key derived at that leaf, so a frame naming a leaf it
+ * was not sealed at does not open at all.
  *
  * A missing sender is an ERROR, never a filled-in blank. Upstream types
  * `senderDID` optional because the authenticated leaf may hold no parsable
  * credential — "I cannot name the author", never "there is no author". Any
- * placeholder (empty string, a transport-claimed DID) would hand callers an
- * unauthenticated value wearing an authenticated one's type, so the open fails
- * instead. Callers already treat a throw here as ordinary control flow:
- * `decrypt` throws for every epoch but its own.
+ * placeholder would hand callers an unauthenticated value wearing an
+ * authenticated one's type, so the open fails instead. Callers already treat a
+ * throw here as ordinary control flow: `decrypt` throws for every epoch but its
+ * own.
  */
-export declare function mlsDecryptFramed(handle: GroupHandle, framed: Uint8Array): Promise<{
+export declare function mlsDecryptFramed(handle: GroupHandle, framed: Uint8Array, expectedAAD?: Uint8Array): Promise<{
     payload: Uint8Array;
     senderDID: string;
 }>;

package/lib/groups/mls-codec.js

@@ -1,28 +1,41 @@
 /**
  * Encrypt an application message for the group. `@kumiai/mls` returns framed MLS
- * wire bytes, so kubun puts those on the wire directly — no JSON envelope of its
- * own, and no retired secret material crossing the boundary.
- */ export async function mlsEncryptFramed(handle, plaintext) {
-    return await handle.encrypt(plaintext);
+ * wire bytes, put on the wire directly — no JSON envelope, no retired secret
+ * material crossing the boundary.
+ *
+ * `aad` becomes the frame's MLS `authenticated_data`: bound into the AEAD but
+ * carried in the clear, so the reader authenticates it before opening. The
+ * directed lane passes the send topicID here so a frame sealed for one topic
+ * cannot be replayed onto another. Absent (broadcast's fixed topic) it defaults
+ * to empty.
+ */ export async function mlsEncryptFramed(handle, plaintext, aad) {
+    return await handle.encrypt(plaintext, {
+        aad
+    });
 }
 /**
  * Decrypt a received application message and recover WHO SENT IT.
  *
- * `handle.decrypt` rather than `processMessage`, which returns an application
- * message's plaintext with no sender. The sender is AUTHENTICATED, not claimed:
- * the leaf index rides sender-data encrypted under the epoch's sender-data
- * secret, and the body opens only under the ratchet key derived at that leaf, so
- * a frame naming a leaf it was not sealed at does not open at all.
+ * `handle.decrypt` rather than `processMessage`, which yields plaintext with no
+ * sender. The sender is AUTHENTICATED, not claimed: the leaf index rides
+ * sender-data encrypted under the epoch's sender-data secret, and the body opens
+ * only under the ratchet key derived at that leaf, so a frame naming a leaf it
+ * was not sealed at does not open at all.
  *
  * A missing sender is an ERROR, never a filled-in blank. Upstream types
  * `senderDID` optional because the authenticated leaf may hold no parsable
  * credential — "I cannot name the author", never "there is no author". Any
- * placeholder (empty string, a transport-claimed DID) would hand callers an
- * unauthenticated value wearing an authenticated one's type, so the open fails
- * instead. Callers already treat a throw here as ordinary control flow:
- * `decrypt` throws for every epoch but its own.
- */ export async function mlsDecryptFramed(handle, framed) {
-    const { payload, senderDID } = await handle.decrypt(framed);
+ * placeholder would hand callers an unauthenticated value wearing an
+ * authenticated one's type, so the open fails instead. Callers already treat a
+ * throw here as ordinary control flow: `decrypt` throws for every epoch but its
+ * own.
+ */ export async function mlsDecryptFramed(handle, framed, expectedAAD) {
+    // `expectedAAD` is compared against the frame's cleartext authenticated_data
+    // PRE-open, so a wrong-topic frame is refused without spending a ratchet
+    // generation — same rejection path as any frame this handle cannot open.
+    const { payload, senderDID } = await handle.decrypt(framed, {
+        expectedAAD
+    });
     if (senderDID == null) {
         throw new Error('MLS application message opened at a leaf with no nameable sender');
     }

package/lib/groups/peer-presence.d.ts

@@ -15,6 +15,12 @@ export type PeerPresenceParams = {
     localDID: string;
     /** Device-wide clock. Every announcement is stamped from it and never by a caller. */
     hlc: HLC;
+    /**
+     * The engine's identity gate. An announce is a self-started mint, so it awaits
+     * this before stamping — a settled no-op once the engine is verified. Absent
+     * for a by-hand test whose clock has no gate to wait on.
+     */
+    ready?: () => Promise<void>;
     /** The epoch stamped onto this device's own row, as the apply path stamps a received one. */
     getGroupEpoch: (groupID: string) => number | undefined;
     /** Fan one broadcast out across every live peer of the group. */

package/lib/groups/peer-presence.js

@@ -84,6 +84,11 @@ export function createPeerPresence(params) {
         };
     };
     const announceProfile = async (groupID, profile)=>{
+        // An announce is a self-started mint (an epoch advance or hub lifecycle
+        // event drives it, off the request path), so it awaits the engine's identity
+        // gate before the stamp below. Placed before any store read, so no group lock
+        // or transaction is held across the wait.
+        await params.ready?.();
         // Stamped once for both the frame and the local row, and never taken from the
         // caller: the anchor decides which of two announcements from this device wins
         // on every receiver, so it has to come from the device's one clock — and the

package/lib/hub/hub-like.js

@@ -386,16 +386,18 @@ function rethrowHubError(error) {
             this.#logger?.debug('hub-like open reached no hub', {
                 topics: topics.length
             });
-            throw first.reason ?? new Error('hub did not answer any subscribe');
+            throw first?.reason ?? new Error('hub did not answer any subscribe');
         }
         this.#proven = true;
         const failed = [];
-        for(let i = 0; i < results.length; i++){
-            const result = results[i];
+        for (const [i, result] of results.entries()){
             if (result.status !== 'rejected') {
                 continue;
             }
             const topicID = topics[i];
+            if (topicID == null) {
+                continue;
+            }
             const error = asHubError(result.reason);
             this.#logger?.warn('hub-like re-subscribe failed', {
                 topicID,
@@ -444,10 +446,9 @@ function rethrowHubError(error) {
                     }
                 })));
             const stillFailing = [];
-            for(let i = 0; i < results.length; i++){
-                const result = results[i];
+            for (const [i, result] of results.entries()){
                 const topicID = pending[i];
-                if (result.status !== 'rejected') {
+                if (topicID == null || result.status !== 'rejected') {
                     continue;
                 }
                 if (isPermanentSubscribeFailure(asHubError(result.reason))) {

package/lib/hub/loopback-log-hub.js

@@ -51,7 +51,10 @@ import { createMemoryStore } from '@kumiai/hub-server';
             set.add(subscriberDID);
         },
         async unsubscribe (subscriberDID, topicID) {
-            await store.unsubscribe(subscriberDID, topicID);
+            await store.unsubscribe({
+                subscriberDID,
+                topicID
+            });
             topicSubscribers.get(topicID)?.delete(subscriberDID);
         },
         receive (subscriberDID) {

package/lib/hub/wiring.d.ts

@@ -5,6 +5,7 @@ import type { KubunDB } from '@kubun/db';
 import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
 import type { HLC } from '@kubun/hlc';
 import type { Logger } from '@kubun/logger';
+import type { WorkflowDiscoverOptions, WorkflowDiscoverReply } from '@kubun/plugin-p2p-api';
 import type { ServiceConfig, ServiceProtocol } from '@kubun/plugin-service-api';
 import type { LaneResult, PendingCommit } from '@kumiai/rpc';
 import type { Runtime } from '@sozai/runtime';
@@ -12,7 +13,8 @@ import type { GroupBroadcastMessage } from '../groups/broadcast-message.js';
 import type { ControllerResolverFor } from '../groups/credential-wrapping-deps.js';
 import type { P2PEventEmitter } from '../groups/events.js';
 import type { GroupHandleRegistry } from '../groups/group-handle-registry.js';
-import type { BuildLedgerRedrive } from '../groups/group-peer-manager.js';
+import type { WorkflowCommandAPI } from '../groups/group-handlers.js';
+import type { BuildLedgerRedrive, WorkflowRequestMethod } from '../groups/group-peer-manager.js';
 import type { PeerPresence } from '../groups/peer-presence.js';
 import type { SyncProtocol } from '../protocol.js';
 import type { ForwardingConfig } from '../sync/forwarder.js';
@@ -32,11 +34,10 @@ export type HubWiring = {
     broadcastNow: (groupID: string, message: GroupBroadcastMessage) => Promise<void>;
     /**
      * Drive a commit through the group's canonical commit hub and await its
-     * outcome. Wired to
-     * `GroupPeerManager.commit`. The lane builds against the live handle,
-     * publishes to the commit log, and adopts the advance only on acceptance. A
-     * group with no hub bound commits against its in-process loopback log, so this
-     * rejects only when the group has no lane at all.
+     * outcome. Wired to `GroupPeerManager.commit`: builds against the live handle,
+     * publishes to the commit log, adopts the advance only on acceptance. A group
+     * with no hub bound commits against its in-process loopback log, so this rejects
+     * only when the group has no lane at all.
      */
     commitToGroup: (groupID: string, build: () => Promise<PendingCommit>) => Promise<LaneResult>;
     /**
@@ -60,6 +61,12 @@ export type HubWiring = {
     presence: () => Promise<PeerPresence>;
     /** See {@link GroupPeerManager.retryHubs}. */
     retryHubs: () => Promise<boolean>;
+    /** See {@link GroupPeerManager.discoverWorkflows}. */
+    discoverWorkflows: (groupID: string, options?: WorkflowDiscoverOptions) => Promise<Array<WorkflowDiscoverReply>>;
+    /** See {@link GroupPeerManager.requestWorkflow}. */
+    requestWorkflow: (groupID: string, targetDID: string, method: WorkflowRequestMethod, param?: Record<string, unknown>) => Promise<unknown>;
+    /** See {@link GroupPeerManager.reauthorize}. Awaits the live manager, then re-drives refused subscribes. */
+    reauthorize: (groupID: string) => Promise<void>;
     /**
      * Build the transport for one directed sync session to a co-member, relayed by
      * the group's hub. `undefined` when the group has no hub bound — there is no
@@ -118,6 +125,22 @@ export type SetupHubRelayParams = {
      * engine's single instance so roster writes share the device's one clock.
      */
     hlc: HLC;
+    /**
+     * The engine's identity gate, forwarded to the presence coordinator so a
+     * self-started announce awaits verification before it mints under `hlc`.
+     * Optional: a suite that builds the relay by hand omits it and the announce
+     * mints immediately (its by-hand HLC has no gate to wait on).
+     */
+    ready?: () => Promise<void>;
+    /**
+     * Resolve the device's workflow API when the workflow plugin is loaded,
+     * forwarded to the group peer manager so it mounts the `workflow` namespace on
+     * each hub peer. A thunk, not the resolved value: this is called during the
+     * synchronous plugin-factory body, before the plugin defines its own
+     * `getWorkflowAPI` — invoking the thunk is deferred to peer creation, well
+     * after the factory returns, so the reference is live by then.
+     */
+    getWorkflowAPI?: () => Promise<WorkflowCommandAPI | undefined>;
     /**
      * The engine's future-drift bound, forwarded to the apply path so a peer's
      * stamp is bounded there the same way the graph lane bounds a mutation's.

package/lib/hub/wiring.js

@@ -44,6 +44,12 @@ export function setupHubRelay(params) {
     };
     const presence = async ()=>(await ready).presence;
     const retryHubs = async ()=>await (await ready).retryHubs();
+    const discoverWorkflows = async (groupID, options)=>await (await ready).discoverWorkflows(groupID, options);
+    const requestWorkflow = async (groupID, targetDID, method, param)=>await (await ready).requestWorkflow(groupID, targetDID, method, param);
+    const reauthorize = async (groupID)=>{
+        ;
+        (await ready).reauthorize(groupID);
+    };
     const syncTransportTo = async (groupID, peerDID)=>{
         const hub = (await ready).tunnelHub(groupID);
         if (hub == null) {
@@ -85,6 +91,12 @@ export function setupHubRelay(params) {
             graphStore,
             graph,
             hlc,
+            ...params.ready != null ? {
+                ready: params.ready
+            } : {},
+            ...params.getWorkflowAPI != null ? {
+                getWorkflowAPI: params.getWorkflowAPI
+            } : {},
             maxDriftMS,
             localDID: identity.id,
             identity,
@@ -187,6 +199,9 @@ export function setupHubRelay(params) {
         requestLedgerCatchup,
         presence,
         retryHubs,
+        discoverWorkflows,
+        requestWorkflow,
+        reauthorize,
         syncTransportTo,
         serviceTransportTo,
         dispose: async ()=>{