@kubun/plugin-p2p 0.17.0 → 0.17.2

package/lib/context/group.js

@@ -14,7 +14,8 @@ import { decodeFullJoinRequest, decodeInvitePayload, decodeJoinRequest, encodeIn
 import { resolveJoinRequestDID } from '../groups/join-request-identity.js';
 import { applyInviteControlState, applyInviteGrants, applyInviteRevocations, collectInviteSeeds, finalizeJoinedGroup } from '../groups/join-utils.js';
 import { signLedgerEntry } from '../groups/ledger.js';
-import { GROUP_CONTROL_DENIED, LAST_GROUP_ADMIN, requireGroupAdmin } from './require-admin.js';
+import { roleFromRoster } from '../groups/roster-projection.js';
+import { assertRosterAdmin, GROUP_CONTROL_DENIED, LAST_GROUP_ADMIN, notGroupAdminError, requireGroupAdmin } from './require-admin.js';
 import { checkPeerAccess, toCircleData, toISO } from './types.js';
 /** Project a stored catalog row into the GraphQL `PeerCatalog` shape. */ function toCatalogData(row) {
     return {
@@ -257,6 +258,36 @@ export function createGroupContext(ctx, deps) {
                 action
             });
         },
+        // The self-authority gate the resolver runs ahead of its rollback wrapper for
+        // the control-mint ops (remove, set role), reading the FOLDED ROSTER instead
+        // of the projected `role` column. The actor is often a freshly promoted admin
+        // whose projection flaps admin->member under a concurrent invite-accept
+        // mirror; gating on the column would refuse them their own op the instant the
+        // mirror lags. The in-handler gate reads the roster the same way, so the two
+        // gates agree. See `assertRosterAdmin`.
+        requireAdminByRoster: async (groupID, action)=>{
+            const store = await getP2PStore();
+            const selfDID = deps.identity.id;
+            // Membership is checked from the store FIRST, before the handle is loaded.
+            // For an unknown or locally departed group `readHandle` throws a plain "no
+            // MLS state" error, which would escape as a bare message and strip the
+            // KB14/NOT_GROUP_ADMIN pair a client matches on — and a caller with no
+            // membership row is no admin regardless of what any roster says. Refusing
+            // here keeps the coded reason and never touches a handle that isn't there.
+            if (await store.getGroupMember(groupID, selfDID) == null) {
+                throw notGroupAdminError(groupID, action);
+            }
+            const roster = await deps.registry.readHandle(groupID, (handle)=>handle.roster, {
+                stores: deps.stores
+            });
+            await assertRosterAdmin({
+                store,
+                roster,
+                groupID,
+                did: selfDID,
+                action
+            });
+        },
         requireCircleAdmin: async (circleID, action)=>{
             const store = await getP2PStore();
             // Tombstoned circles count: deleting an already-deleted circle is a no-op
@@ -293,7 +324,16 @@ export function createGroupContext(ctx, deps) {
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
             // connection blocks forever on the outer write lock (single-connection SQLite).
-            const anchor = await deps.registry.readHandle(groupID, async (handle)=>readGroupAnchor(handle), {
+            // Read the anchor AND the target's authoritative role from the same handle
+            // hold. The target's admin status must come from the folded roster — the
+            // same authority the commit policy enforces — not the projected `role`
+            // column, which can transiently flap under concurrent catch-up and would
+            // make a genuine demotion settle a silent no-op.
+            const { anchor, targetRole, roster } = await deps.registry.readHandle(groupID, async (handle)=>({
+                    anchor: readGroupAnchor(handle),
+                    targetRole: roleFromRoster(handle.roster, memberDID),
+                    roster: handle.roster
+                }), {
                 stores: deps.stores
             });
             if (anchor == null) {
@@ -306,8 +346,15 @@ export function createGroupContext(ctx, deps) {
             // here lets the caller fail loudly instead of silently emitting a no-op.
             // The GraphQL resolver runs this same gate before its rollback wrapper so
             // the refusal keeps its code; repeating it here covers direct callers.
-            await requireGroupAdmin({
+            //
+            // Read from the FOLDED ROSTER, not the projected `role` column: this is the
+            // freshly promoted admin's own authority, and the column flaps admin->member
+            // under a concurrent invite-accept mirror, which would refuse them their own
+            // control op the instant the mirror lags. The roster moves only on an
+            // enacted commit, so it never carries that flap.
+            await assertRosterAdmin({
                 store,
+                roster,
                 groupID,
                 did: selfDID,
                 action: 'set member roles'
@@ -318,7 +365,7 @@ export function createGroupContext(ctx, deps) {
                     throw new Error('cannot grant admin to a non-member');
                 }
             } else {
-                if (!await store.isGroupAdmin(groupID, memberDID)) {
+                if (targetRole !== 'admin') {
                     // Demoting a DID that is not currently an admin is a no-op; don't mint
                     // a dead ledger entry + broadcast for it. The caller still gets a real,
                     // resolvable request — one that is already settled, because the state
@@ -337,14 +384,15 @@ export function createGroupContext(ctx, deps) {
                 // `rejected` settle the caller has to wait for, and a group with no admin
                 // can never grant, revoke or remove again, so this is fail-closed.
                 //
-                // The survivor set comes from the same projected rows the authority check
-                // above reads, exactly as `requestRemoveMember` counts its own: a grant
-                // reaches the ledger when it is signed but the projection only when its
-                // commit is enacted, so counting ledger admins would let the only admin
-                // who can still act be demoted in favour of one who cannot yet.
-                const members = await store.listGroupMembers(groupID);
-                const survivors = members.filter((member)=>member.role === 'admin' && normalizeDID(member.member_did) !== normalizeDID(memberDID));
-                if (survivors.length === 0) {
+                // The survivor set comes from the folded roster read above — the same
+                // authority the commit policy enforces — not the projected `role` column.
+                // The column flaps admin->member under a concurrent invite-accept mirror,
+                // so counting it can miss a co-admin whose projection has lagged and
+                // spuriously refuse a demotion the roster plainly allows. The roster holds
+                // only enacted admins, so it never over-counts a signed-but-unlanded grant
+                // either. The target is admin in this branch, so it counts here; a count of
+                // one means it is the sole admin and no survivor remains.
+                if (adminCount(roster) <= 1) {
                     throw new GraphQLError('cannot demote: this is the only admin — promote another member first', {
                         extensions: {
                             code: GROUP_CONTROL_DENIED,
@@ -1070,7 +1118,10 @@ export function createGroupContext(ctx, deps) {
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
             // connection blocks forever on the outer write lock (single-connection SQLite).
-            const anchor = await deps.registry.readHandle(groupID, async (handle)=>readGroupAnchor(handle), {
+            const { anchor, roster } = await deps.registry.readHandle(groupID, async (handle)=>({
+                    anchor: readGroupAnchor(handle),
+                    roster: handle.roster
+                }), {
                 stores: deps.stores
             });
             if (anchor == null) {
@@ -1084,31 +1135,35 @@ export function createGroupContext(ctx, deps) {
             // full-transaction rollback and forwards the message to the caller. The
             // resolver runs the same gate ahead of that wrap so the refusal keeps its
             // code; repeating it here covers direct callers.
-            await requireGroupAdmin({
+            //
+            // Read from the FOLDED ROSTER, not the projected `role` column: a freshly
+            // promoted co-admin evicting a peer is exactly the actor whose projection
+            // flaps admin->member under a concurrent invite-accept mirror, which would
+            // refuse them their own eviction the instant the mirror lags.
+            await assertRosterAdmin({
                 store,
+                roster,
                 groupID,
                 did: selfDID,
                 action: 'remove a member'
             });
-            // Resolve whether the removed DID is an admin from the roster as it stands
-            // NOW: this is the only point at which they are still a member, and the
-            // answer decides whether the commit must carry a demotion at all.
-            const removedIsAdmin = await store.isGroupAdmin(groupID, memberDID);
+            // Resolve whether the removed DID is an admin from the FOLDED ROSTER as it
+            // stands now — the same authority the commit policy enforces, not the
+            // projected `role` column. The column flaps admin->member under a concurrent
+            // invite-accept mirror; reading it here could report the removed sole admin
+            // as a plain member and skip the last-admin guard entirely, letting the
+            // group be left with no admin at all.
+            const removedIsAdmin = roleFromRoster(roster, memberDID) === 'admin';
             // Refuse to remove the last admin: check what survives once the removed DID
             // is dropped. A group with no admins can never grant, revoke, or remove
             // again, so this is fail-closed.
             //
-            // The survivor set is read from the same projected rows the authority check
-            // reads, never from the ledger. A grant reaches the ledger the moment it is
-            // signed but reaches the projection only when its commit is enacted, so the
-            // ledger holds admins who cannot yet act. Counting those as survivors would
-            // permit removing the only admin who can — and if the pending grant's commit
-            // never lands, the group is left with no effective admin at all.
+            // Counted from the roster for the same reason: it holds only enacted admins,
+            // so it never counts a signed-but-unlanded grant as a survivor, and never
+            // misses a co-admin whose projection has flapped. The removed DID is admin
+            // here, so it counts; a count of one means it is the sole admin.
             if (removedIsAdmin) {
-                const members = await store.listGroupMembers(groupID);
-                const removedDID = normalizeDID(memberDID);
-                const survivors = members.filter((member)=>member.role === 'admin' && normalizeDID(member.member_did) !== removedDID);
-                if (survivors.length === 0) {
+                if (adminCount(roster) <= 1) {
                     // The same refusal `leave` and `requestSetMemberRole` raise, carrying
                     // the same pair: one rule, three paths, and an app matching on the
                     // code has to reach it from all three.
@@ -1121,30 +1176,6 @@ export function createGroupContext(ctx, deps) {
                     });
                 }
             }
-            // Revoke the ex-admin's control authority on the commit that evicts them.
-            // Only admins fold authoritatively, so only an admin needs revoking — a
-            // non-admin removal carries no ledger entry at all.
-            //
-            // Minted BEFORE the removal so it can ride that very commit: a receiver
-            // refuses a Remove whose target is still an admin in the roster the commit's
-            // entries fold to, so an admin can only be evicted by a commit that also
-            // demotes them.
-            //
-            // The token is NOT appended here. On the lane the accepted commit's
-            // `onAccepted` is its writer, and only that path knows the group took this
-            // attempt: a row written here would survive a lane that never lands,
-            // demoting the target in THIS device's admin-roster fold while every
-            // co-member still folds them as an admin.
-            let revokeToken = null;
-            if (removedIsAdmin) {
-                revokeToken = await signLedgerEntry(deps.identity, {
-                    type: ADMIN_ROLE_ENTRY_TYPE,
-                    subject: memberDID,
-                    value: 'member',
-                    groupID,
-                    ord: hlc
-                });
-            }
             // The request is enqueued before the lane is armed so a crash can never
             // leave a commit driving toward a request that does not exist.
             const requestID = deps.runtime.getRandomID();
@@ -1158,12 +1189,17 @@ export function createGroupContext(ctx, deps) {
                     enqueuedAt
                 });
             });
-            // The commit is the ONLY delivery of the demotion: the token rides the
-            // commit's own frame as a sealed body, so every co-member resolves it,
+            // The commit is the ONLY delivery of the demotion: the build mints the
+            // ex-admin's demotion against the folded roster per attempt and rides it on
+            // the commit's own frame as a sealed body, so every co-member resolves it,
             // folds it and emits from that frame. A separate `ledger:entry` broadcast
             // would race the commit and hand co-members a demotion the group has not
             // yet accepted, so none is sent.
             //
+            // Whether the target is an admin is NOT decided here: the request-time
+            // projection flaps under a concurrent invite-accept mirror, so the mint is
+            // taken inside the build against the authoritative folded roster.
+            //
             // The tombstone and the announcement move with it: they happen in the
             // lane's `onAccepted`, so nothing here observes a removal the group never
             // took. Driving is deferred to the outermost commit — awaiting the lane
@@ -1172,13 +1208,9 @@ export function createGroupContext(ctx, deps) {
             const build = deps.groupManager.buildRemoveCommit({
                 groupID,
                 memberDID,
+                identity: deps.identity,
                 hlc,
-                requestID,
-                ...revokeToken != null ? {
-                    ledgerEntries: [
-                        revokeToken
-                    ]
-                } : {}
+                requestID
             });
             deps.stores.onCommit(()=>{
                 void deps.commitToGroup(groupID, build).catch((error)=>{

package/lib/context/require-admin.d.ts

@@ -1,4 +1,6 @@
 import type { P2PStoreAPI } from '@kubun/store-p2p';
+import type { RosterState } from '@kumiai/mls';
+import { GraphQLError } from 'graphql';
 /**
  * `extensions.code` carried by every group-authority refusal, on the local
  * GraphQL path and on the wire alike. The specific refusal travels beside it as
@@ -54,4 +56,41 @@ export type RequireGroupAdminParams = {
  * silently discarded write into a loud, catchable failure — a stale gate is a
  * stale button, never a hole.
  */
+/**
+ * The one refusal every admin gate raises, so a client matches the same
+ * `code`/`reason` pair whichever gate declined it — and whichever layer catches
+ * it: the resolver runs a gate ahead of the rollback wrapper precisely because
+ * this coded error must survive it. A gate that instead let a lower-level throw
+ * (e.g. a missing MLS handle) escape would strip the pair to a bare message.
+ */
+export declare function notGroupAdminError(groupID: string, action: string): GraphQLError;
 export declare function requireGroupAdmin(params: RequireGroupAdminParams): Promise<void>;
+export type AssertRosterAdminParams = {
+    store: P2PStoreAPI;
+    /** The folded roster the commit policy enforces — `handle.roster`. */
+    roster: RosterState;
+    groupID: string;
+    /** The DID whose authority is being checked — the caller, not the target. */
+    did: string;
+    /** Phrase completing "only a group admin can ..." in the refusal message. */
+    action: string;
+};
+/**
+ * Like `requireGroupAdmin`, but the admin half of the check reads the FOLDED
+ * ROSTER instead of the projected `role` column.
+ *
+ * The projected column flaps admin->member under a concurrent invite-accept
+ * mirror overwrite, so a freshly promoted admin can be refused its own control
+ * op the instant the mirror lags — a spurious, fail-closed NOT_GROUP_ADMIN.
+ * The roster is the authority the commit policy itself enforces and moves only
+ * on an enacted commit, so it never carries that transient flap.
+ *
+ * The membership half is unchanged and still reads the row: the flap moves the
+ * role column, never the row's existence, so a lagged projection cannot hide a
+ * member. Reading the roster ALONE would drop this half — the roster is
+ * DID-keyed and can hold a role for a DID with no MLS leaf — so a DID with no
+ * (or a tombstoned) membership row is refused even when the roster names it an
+ * admin. Callers pass their own DID, which always holds a leaf when they hold
+ * the handle, so this half only ever fires on a misuse.
+ */
+export declare function assertRosterAdmin(params: AssertRosterAdminParams): Promise<void>;

package/lib/context/require-admin.js

@@ -1,4 +1,5 @@
 import { GraphQLError } from 'graphql';
+import { roleFromRoster } from '../groups/roster-projection.js';
 /**
  * `extensions.code` carried by every group-authority refusal, on the local
  * GraphQL path and on the wire alike. The specific refusal travels beside it as
@@ -42,12 +43,14 @@ import { GraphQLError } from 'graphql';
  * fold, which drops a non-admin's entry regardless. Refusing here turns a
  * silently discarded write into a loud, catchable failure — a stale gate is a
  * stale button, never a hole.
- */ export async function requireGroupAdmin(params) {
-    const { store, groupID, did, action } = params;
-    if (await store.isGroupAdmin(groupID, did)) {
-        return;
-    }
-    throw new GraphQLError(`not authorized: only a group admin can ${action}`, {
+ */ /**
+ * The one refusal every admin gate raises, so a client matches the same
+ * `code`/`reason` pair whichever gate declined it — and whichever layer catches
+ * it: the resolver runs a gate ahead of the rollback wrapper precisely because
+ * this coded error must survive it. A gate that instead let a lower-level throw
+ * (e.g. a missing MLS handle) escape would strip the pair to a bare message.
+ */ export function notGroupAdminError(groupID, action) {
+    return new GraphQLError(`not authorized: only a group admin can ${action}`, {
         extensions: {
             code: GROUP_CONTROL_DENIED,
             reason: NOT_GROUP_ADMIN,
@@ -55,3 +58,35 @@ import { GraphQLError } from 'graphql';
         }
     });
 }
+export async function requireGroupAdmin(params) {
+    const { store, groupID, did, action } = params;
+    if (await store.isGroupAdmin(groupID, did)) {
+        return;
+    }
+    throw notGroupAdminError(groupID, action);
+}
+/**
+ * Like `requireGroupAdmin`, but the admin half of the check reads the FOLDED
+ * ROSTER instead of the projected `role` column.
+ *
+ * The projected column flaps admin->member under a concurrent invite-accept
+ * mirror overwrite, so a freshly promoted admin can be refused its own control
+ * op the instant the mirror lags — a spurious, fail-closed NOT_GROUP_ADMIN.
+ * The roster is the authority the commit policy itself enforces and moves only
+ * on an enacted commit, so it never carries that transient flap.
+ *
+ * The membership half is unchanged and still reads the row: the flap moves the
+ * role column, never the row's existence, so a lagged projection cannot hide a
+ * member. Reading the roster ALONE would drop this half — the roster is
+ * DID-keyed and can hold a role for a DID with no MLS leaf — so a DID with no
+ * (or a tombstoned) membership row is refused even when the roster names it an
+ * admin. Callers pass their own DID, which always holds a leaf when they hold
+ * the handle, so this half only ever fires on a misuse.
+ */ export async function assertRosterAdmin(params) {
+    const { store, roster, groupID, did, action } = params;
+    const member = await store.getGroupMember(groupID, did);
+    if (member != null && roleFromRoster(roster, did) === 'admin') {
+        return;
+    }
+    throw notGroupAdminError(groupID, action);
+}

package/lib/groups/manager.d.ts

@@ -188,9 +188,17 @@ export type BuildRemoveCommitParams = {
     groupID: string;
     memberDID: string;
     /**
-     * Signed control-ledger tokens this removal enacts. Removing an admin means
-     * riding their demotion entry on the same commit: a receiver refuses a Remove
-     * whose target is still an admin in the roster the commit folds to.
+     * The identity that signs the demotion entry riding this removal. Removing an
+     * admin means demoting them on the same commit, and the demotion is minted
+     * INSIDE the per-attempt build against the folded roster — never at request
+     * time against the projected role column, which flaps under a concurrent
+     * invite-accept mirror and would mint no demotion for an admin the fold still
+     * names, leaving the receiver to refuse the eviction.
+     */
+    identity: OwnIdentity;
+    /**
+     * Extra signed control-ledger tokens this removal must also enact, beyond the
+     * admin demotion the build mints for itself. Empty for a plain eviction.
      */
     ledgerEntries?: Array<string>;
     /**

package/lib/groups/manager.js

@@ -5,6 +5,7 @@ import { commitInvite, commitLedgerEntries, controlCapabilities, createGroup, cr
 import { toB64 } from '@sozai/codec';
 import { toISO } from '../context/types.js';
 import { bindHubToGroup, upsertHub } from '../hub/manager.js';
+import { ADMIN_ROLE_ENTRY_TYPE } from './admin-roster.js';
 import { reprojectGroupSettings } from './circle-projection.js';
 import { GROUP_SETTINGS_ENTRY_TYPE } from './circle-reducers.js';
 import { serializeCommitJournalBlob } from './commit-adoption.js';
@@ -29,6 +30,22 @@ import { mirrorRosterRoles, roleFromRoster } from './roster-projection.js';
  * left alone: the commit attempt fails a few lines later with the library's own
  * precise reason.
  */ async function assertRemovalDemotes(handle, memberDID, tokens) {
+    if (await roleAfterFolding(handle, memberDID, tokens) === 'admin') {
+        throw new Error(`Cannot remove ${memberDID}: still an admin in the roster this commit folds to. A demotion entry must ride the same commit.`);
+    }
+}
+/**
+ * The role `memberDID` holds in the roster this commit would fold to: the
+ * handle's current roster with `tokens` applied. `undefined` when the fold
+ * rejects outright — the commit attempt then fails a few lines later with the
+ * library's own precise reason, so this check leaves it alone.
+ *
+ * Both the demotion mint in {@link GroupManager.buildRemoveCommit} and
+ * {@link assertRemovalDemotes} key on this: the mint rides a demotion when it
+ * returns `'admin'`, and the assert then confirms the completed token set clears
+ * it. A caller that already supplied the demotion drives it to non-admin here, so
+ * no second demotion is minted.
+ */ async function roleAfterFolding(handle, memberDID, tokens) {
     const inputs = [];
     for (const token of tokens){
         const verified = await verifyLedgerEntry(token);
@@ -42,11 +59,9 @@ import { mirrorRosterRoles, roleFromRoster } from './roster-projection.js';
     }
     const folded = foldEnvelope(handle.roster, handle.registry, inputs, handle.groupID);
     if (!folded.ok) {
-        return;
-    }
-    if (folded.roster.roles.get(normalizeDID(memberDID)) === 'admin') {
-        throw new Error(`Cannot remove ${memberDID}: still an admin in the roster this commit folds to. A demotion entry must ride the same commit.`);
+        return undefined;
     }
+    return folded.roster.roles.get(normalizeDID(memberDID));
 }
 export class GroupManager {
     #deviceID;
@@ -668,12 +683,33 @@ export class GroupManager {
    * the intent lives in the MLS Remove proposal, which does not survive the
    * process.
    */ buildRemoveCommit(params) {
-        const tokens = params.ledgerEntries ?? [];
         return ()=>this.#registry.readHandle(params.groupID, async (handle)=>{
                 const leafIndex = handle.findMemberLeafIndex(params.memberDID);
                 if (leafIndex == null) {
                     throw new Error(`Member ${params.memberDID} not found in MLS group`);
                 }
+                // Fresh copy per attempt: a rebase re-runs this closure, and the demotion
+                // it mints below is stamped against THIS attempt's folded roster.
+                const tokens = [
+                    ...params.ledgerEntries ?? []
+                ];
+                // Mint the admin demotion here, keyed on the FOLDED roster — the only
+                // authority on who holds admin. The request-time projection flaps under a
+                // concurrent invite-accept mirror, so a decision taken there would ship no
+                // demotion for an admin the fold still names and the receiver would refuse
+                // the eviction. `hlc` orders the demotion with the tombstone riding the
+                // same commit. A caller that already supplied the demotion in
+                // `ledgerEntries` drives the folded role to non-admin, so none is added
+                // twice.
+                if (await roleAfterFolding(handle, params.memberDID, tokens) === 'admin') {
+                    tokens.push(await signLedgerEntry(params.identity, {
+                        type: ADMIN_ROLE_ENTRY_TYPE,
+                        subject: params.memberDID,
+                        value: 'member',
+                        groupID: params.groupID,
+                        ord: params.hlc
+                    }));
+                }
                 await assertRemovalDemotes(handle, params.memberDID, tokens);
                 const { commitMessage, newGroup } = await removeMember(handle, leafIndex, tokens);
                 return {

package/lib/schema.js

@@ -114,6 +114,11 @@ const CONTROL_REQUEST_KIND_TO_SDL = {
     invite: 'INVITE',
     remove: 'REMOVE'
 };
+// Internal lowercase record-provisioning outcome -> SDL enum name.
+const RECORD_PROVISIONING_STATUS_TO_SDL = {
+    recorded: 'RECORDED',
+    retry: 'RETRY'
+};
 /** Project a control request into its SDL shape, mapping both enums to uppercase. */ function toControlRequestSDL(request) {
     return {
         ...request,
@@ -692,6 +697,33 @@ type CredentialProvisioningStatus {
   reason: String
 }
 
+type BeginProvisioningExpectationPayload {
+  """
+  Freshly minted attempt id; pass it to recordProvisioningExpectation /
+  abandonProvisioningExpectation to close this attempt.
+  """
+  attemptId: ID!
+}
+
+enum RecordProvisioningExpectationStatus {
+  """The attempt's epoch bound the provisioning floor for this owner/grantor."""
+  RECORDED
+  """
+  A higher manifest already landed; the floor was not lowered. Re-run the grant
+  with minEpoch, then record the new attempt.
+  """
+  RETRY
+}
+
+type RecordProvisioningExpectationPayload {
+  status: RecordProvisioningExpectationStatus!
+  """
+  Present only on RETRY: the recipient's now-held epoch. Re-run the grant with
+  this as the new minEpoch.
+  """
+  minEpoch: Int
+}
+
 extend type Mutation {
   connectPeer(url: String!): ConnectPeerPayload!
   sharePeerGroup(peerDID: ID!, groupID: ID, name: String, send: ShareInput, receive: ShareReceiveInput): SharePeerGroupPayload!
@@ -711,6 +743,27 @@ extend type Mutation {
   reprovision attempt always supersedes a manifest it already holds. Defaults to 0.
   """
   grantDeviceCredentials(groupID: ID!, recipientDID: DID!, ownerDID: DID!, minEpoch: Int): GrantDeviceCredentialsPayload!
+  """
+  Arm this device to converge a credential grant for ownerDID from grantorDID:
+  write the provisioning-expectation row that lets the credential-reconcile PULL
+  fetch that owner's buckets (a delegate-signed grant converges only via the
+  pull, never the live apply). Call before asking the grantor to grant, then
+  recordProvisioningExpectation once the grant returns its epoch. Mirrors the
+  credentialProvisioningStatus query's recipient-local surface.
+  """
+  beginProvisioningExpectation(ownerDID: DID!, grantorDID: DID!): BeginProvisioningExpectationPayload!
+  """
+  Bind the provisioning floor for an in-flight attempt to the epoch its grant was
+  signed under. Returns RECORDED when the floor binds, or RETRY with the held
+  epoch when a higher manifest already landed (re-grant with minEpoch, then record
+  the new attempt).
+  """
+  recordProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptId: ID!, epoch: Int!): RecordProvisioningExpectationPayload!
+  """
+  Stop tracking one provisioning attempt. Removes only this attemptId; never binds
+  or lowers a floor. Returns true.
+  """
+  abandonProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptId: ID!): Boolean!
   joinPeerGroup(peerDID: ID!, groupID: ID!): JoinPeerGroupPayload!
   """
   Apply one circle's desired sync end state. A null argument leaves that dimension
@@ -1043,6 +1096,32 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                         epoch
                     };
                 },
+                beginProvisioningExpectation: async (_source, args, context)=>{
+                    return await requireP2P(context).peer.beginProvisioningExpectation({
+                        ownerDID: args.ownerDID,
+                        grantorDID: args.grantorDID
+                    });
+                },
+                recordProvisioningExpectation: async (_source, args, context)=>{
+                    const result = await requireP2P(context).peer.recordProvisioningExpectation({
+                        ownerDID: args.ownerDID,
+                        grantorDID: args.grantorDID,
+                        attemptId: args.attemptId,
+                        epoch: args.epoch
+                    });
+                    return {
+                        status: RECORD_PROVISIONING_STATUS_TO_SDL[result.status],
+                        minEpoch: result.status === 'retry' ? result.minEpoch : null
+                    };
+                },
+                abandonProvisioningExpectation: async (_source, args, context)=>{
+                    await requireP2P(context).peer.abandonProvisioningExpectation({
+                        ownerDID: args.ownerDID,
+                        grantorDID: args.grantorDID,
+                        attemptId: args.attemptId
+                    });
+                    return true;
+                },
                 joinPeerGroup: async (_source, args, context)=>{
                     return await requireP2P(context).peer.joinPeerGroup({
                         peerDID: args.peerDID,
@@ -1173,7 +1252,7 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                     // must roll it back: a queued request no lane settles is `pending` forever.
                     // Returns `pending`, not awaited: the commit lane runs on the outermost
                     // commit, after this transaction closes.
-                    return await gatedTransaction('requestRemoveGroupMember', ()=>requireP2P(context).group.requireAdmin(input.groupID, 'remove a member'), async ()=>{
+                    return await gatedTransaction('requestRemoveGroupMember', ()=>requireP2P(context).group.requireAdminByRoster(input.groupID, 'remove a member'), async ()=>{
                         const request = await requireP2P(context).group.requestRemoveMember(input);
                         return {
                             request: toControlRequestSDL(request)
@@ -1187,7 +1266,7 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                     // Returns `pending`, not awaited: the commit lane runs on the outermost
                     // commit, after this transaction closes.
                     //
-                    return await gatedTransaction('requestSetMemberRole', ()=>requireP2P(context).group.requireAdmin(input.groupID, 'set member roles'), async ()=>{
+                    return await gatedTransaction('requestSetMemberRole', ()=>requireP2P(context).group.requireAdminByRoster(input.groupID, 'set member roles'), async ()=>{
                         const request = await requireP2P(context).group.requestSetMemberRole(input);
                         return {
                             request: toControlRequestSDL(request)

package/lib/types.d.ts

@@ -198,6 +198,15 @@ export type GroupRequestContext = {
      * re-raises and strips extensions — that ordering is what keeps the code visible.
      */
     requireAdmin: (groupID: string, action: string) => Promise<void>;
+    /**
+     * `requireAdmin` for the control-mint ops (remove a member, set a member role),
+     * reading admin authority from the FOLDED ROSTER instead of the projected
+     * `role` column. The column flaps admin->member under a concurrent invite-accept
+     * mirror, so a freshly promoted admin would be spuriously refused NOT_GROUP_ADMIN
+     * on its own op; the roster carries no such flap. Same code/reason as
+     * `requireAdmin`, so a caller matching on the pair is unaffected.
+     */
+    requireAdminByRoster: (groupID: string, action: string) => Promise<void>;
     /**
      * `requireAdmin` for an operation that only knows a circle: resolves the
      * circle's group and gates on that.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-p2p",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -72,9 +72,9 @@
     "@kubun/db-better-sqlite": "^0.17.0",
     "@kubun/db-node-sqlite": "^0.17.0",
     "@kubun/db-postgres": "^0.17.0",
-    "@kubun/hub": "^0.17.0",
+    "@kubun/hub": "^0.17.3",
     "@kubun/plugin-blob": "^0.17.0",
-    "@kubun/plugin-connector": "^0.17.0",
+    "@kubun/plugin-connector": "^0.17.1",
     "@kubun/plugin-service-server": "^0.17.0",
     "@kubun/plugin-workflow": "^0.17.0",
     "@kubun/service-graph-api": "^0.17.0",