@kubun/plugin-p2p 0.17.1 → 0.17.3

package/lib/context/group.js

@@ -14,7 +14,8 @@ import { decodeFullJoinRequest, decodeInvitePayload, decodeJoinRequest, encodeIn
 import { resolveJoinRequestDID } from '../groups/join-request-identity.js';
 import { applyInviteControlState, applyInviteGrants, applyInviteRevocations, collectInviteSeeds, finalizeJoinedGroup } from '../groups/join-utils.js';
 import { signLedgerEntry } from '../groups/ledger.js';
-import { GROUP_CONTROL_DENIED, LAST_GROUP_ADMIN, requireGroupAdmin } from './require-admin.js';
+import { roleFromRoster } from '../groups/roster-projection.js';
+import { assertRosterAdmin, GROUP_CONTROL_DENIED, LAST_GROUP_ADMIN, notGroupAdminError, requireGroupAdmin } from './require-admin.js';
 import { checkPeerAccess, toCircleData, toISO } from './types.js';
 /** Project a stored catalog row into the GraphQL `PeerCatalog` shape. */ function toCatalogData(row) {
     return {
@@ -257,6 +258,36 @@ export function createGroupContext(ctx, deps) {
                 action
             });
         },
+        // The self-authority gate the resolver runs ahead of its rollback wrapper for
+        // the control-mint ops (remove, set role), reading the FOLDED ROSTER instead
+        // of the projected `role` column. The actor is often a freshly promoted admin
+        // whose projection flaps admin->member under a concurrent invite-accept
+        // mirror; gating on the column would refuse them their own op the instant the
+        // mirror lags. The in-handler gate reads the roster the same way, so the two
+        // gates agree. See `assertRosterAdmin`.
+        requireAdminByRoster: async (groupID, action)=>{
+            const store = await getP2PStore();
+            const selfDID = deps.identity.id;
+            // Membership is checked from the store FIRST, before the handle is loaded.
+            // For an unknown or locally departed group `readHandle` throws a plain "no
+            // MLS state" error, which would escape as a bare message and strip the
+            // KB14/NOT_GROUP_ADMIN pair a client matches on — and a caller with no
+            // membership row is no admin regardless of what any roster says. Refusing
+            // here keeps the coded reason and never touches a handle that isn't there.
+            if (await store.getGroupMember(groupID, selfDID) == null) {
+                throw notGroupAdminError(groupID, action);
+            }
+            const roster = await deps.registry.readHandle(groupID, (handle)=>handle.roster, {
+                stores: deps.stores
+            });
+            await assertRosterAdmin({
+                store,
+                roster,
+                groupID,
+                did: selfDID,
+                action
+            });
+        },
         requireCircleAdmin: async (circleID, action)=>{
             const store = await getP2PStore();
             // Tombstoned circles count: deleting an already-deleted circle is a no-op
@@ -293,7 +324,16 @@ export function createGroupContext(ctx, deps) {
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
             // connection blocks forever on the outer write lock (single-connection SQLite).
-            const anchor = await deps.registry.readHandle(groupID, async (handle)=>readGroupAnchor(handle), {
+            // Read the anchor AND the target's authoritative role from the same handle
+            // hold. The target's admin status must come from the folded roster — the
+            // same authority the commit policy enforces — not the projected `role`
+            // column, which can transiently flap under concurrent catch-up and would
+            // make a genuine demotion settle a silent no-op.
+            const { anchor, targetRole, roster } = await deps.registry.readHandle(groupID, async (handle)=>({
+                    anchor: readGroupAnchor(handle),
+                    targetRole: roleFromRoster(handle.roster, memberDID),
+                    roster: handle.roster
+                }), {
                 stores: deps.stores
             });
             if (anchor == null) {
@@ -306,8 +346,15 @@ export function createGroupContext(ctx, deps) {
             // here lets the caller fail loudly instead of silently emitting a no-op.
             // The GraphQL resolver runs this same gate before its rollback wrapper so
             // the refusal keeps its code; repeating it here covers direct callers.
-            await requireGroupAdmin({
+            //
+            // Read from the FOLDED ROSTER, not the projected `role` column: this is the
+            // freshly promoted admin's own authority, and the column flaps admin->member
+            // under a concurrent invite-accept mirror, which would refuse them their own
+            // control op the instant the mirror lags. The roster moves only on an
+            // enacted commit, so it never carries that flap.
+            await assertRosterAdmin({
                 store,
+                roster,
                 groupID,
                 did: selfDID,
                 action: 'set member roles'
@@ -318,7 +365,7 @@ export function createGroupContext(ctx, deps) {
                     throw new Error('cannot grant admin to a non-member');
                 }
             } else {
-                if (!await store.isGroupAdmin(groupID, memberDID)) {
+                if (targetRole !== 'admin') {
                     // Demoting a DID that is not currently an admin is a no-op; don't mint
                     // a dead ledger entry + broadcast for it. The caller still gets a real,
                     // resolvable request — one that is already settled, because the state
@@ -337,14 +384,15 @@ export function createGroupContext(ctx, deps) {
                 // `rejected` settle the caller has to wait for, and a group with no admin
                 // can never grant, revoke or remove again, so this is fail-closed.
                 //
-                // The survivor set comes from the same projected rows the authority check
-                // above reads, exactly as `requestRemoveMember` counts its own: a grant
-                // reaches the ledger when it is signed but the projection only when its
-                // commit is enacted, so counting ledger admins would let the only admin
-                // who can still act be demoted in favour of one who cannot yet.
-                const members = await store.listGroupMembers(groupID);
-                const survivors = members.filter((member)=>member.role === 'admin' && normalizeDID(member.member_did) !== normalizeDID(memberDID));
-                if (survivors.length === 0) {
+                // The survivor set comes from the folded roster read above — the same
+                // authority the commit policy enforces — not the projected `role` column.
+                // The column flaps admin->member under a concurrent invite-accept mirror,
+                // so counting it can miss a co-admin whose projection has lagged and
+                // spuriously refuse a demotion the roster plainly allows. The roster holds
+                // only enacted admins, so it never over-counts a signed-but-unlanded grant
+                // either. The target is admin in this branch, so it counts here; a count of
+                // one means it is the sole admin and no survivor remains.
+                if (adminCount(roster) <= 1) {
                     throw new GraphQLError('cannot demote: this is the only admin — promote another member first', {
                         extensions: {
                             code: GROUP_CONTROL_DENIED,
@@ -1070,7 +1118,10 @@ export function createGroupContext(ctx, deps) {
             // `mutateGraph` this handler already runs inside that transaction, so the
             // registry's restore/persist must share its connection — a separate
             // connection blocks forever on the outer write lock (single-connection SQLite).
-            const anchor = await deps.registry.readHandle(groupID, async (handle)=>readGroupAnchor(handle), {
+            const { anchor, roster } = await deps.registry.readHandle(groupID, async (handle)=>({
+                    anchor: readGroupAnchor(handle),
+                    roster: handle.roster
+                }), {
                 stores: deps.stores
             });
             if (anchor == null) {
@@ -1084,31 +1135,35 @@ export function createGroupContext(ctx, deps) {
             // full-transaction rollback and forwards the message to the caller. The
             // resolver runs the same gate ahead of that wrap so the refusal keeps its
             // code; repeating it here covers direct callers.
-            await requireGroupAdmin({
+            //
+            // Read from the FOLDED ROSTER, not the projected `role` column: a freshly
+            // promoted co-admin evicting a peer is exactly the actor whose projection
+            // flaps admin->member under a concurrent invite-accept mirror, which would
+            // refuse them their own eviction the instant the mirror lags.
+            await assertRosterAdmin({
                 store,
+                roster,
                 groupID,
                 did: selfDID,
                 action: 'remove a member'
             });
-            // Resolve whether the removed DID is an admin from the roster as it stands
-            // NOW: this is the only point at which they are still a member, and the
-            // answer decides whether the commit must carry a demotion at all.
-            const removedIsAdmin = await store.isGroupAdmin(groupID, memberDID);
+            // Resolve whether the removed DID is an admin from the FOLDED ROSTER as it
+            // stands now — the same authority the commit policy enforces, not the
+            // projected `role` column. The column flaps admin->member under a concurrent
+            // invite-accept mirror; reading it here could report the removed sole admin
+            // as a plain member and skip the last-admin guard entirely, letting the
+            // group be left with no admin at all.
+            const removedIsAdmin = roleFromRoster(roster, memberDID) === 'admin';
             // Refuse to remove the last admin: check what survives once the removed DID
             // is dropped. A group with no admins can never grant, revoke, or remove
             // again, so this is fail-closed.
             //
-            // The survivor set is read from the same projected rows the authority check
-            // reads, never from the ledger. A grant reaches the ledger the moment it is
-            // signed but reaches the projection only when its commit is enacted, so the
-            // ledger holds admins who cannot yet act. Counting those as survivors would
-            // permit removing the only admin who can — and if the pending grant's commit
-            // never lands, the group is left with no effective admin at all.
+            // Counted from the roster for the same reason: it holds only enacted admins,
+            // so it never counts a signed-but-unlanded grant as a survivor, and never
+            // misses a co-admin whose projection has flapped. The removed DID is admin
+            // here, so it counts; a count of one means it is the sole admin.
             if (removedIsAdmin) {
-                const members = await store.listGroupMembers(groupID);
-                const removedDID = normalizeDID(memberDID);
-                const survivors = members.filter((member)=>member.role === 'admin' && normalizeDID(member.member_did) !== removedDID);
-                if (survivors.length === 0) {
+                if (adminCount(roster) <= 1) {
                     // The same refusal `leave` and `requestSetMemberRole` raise, carrying
                     // the same pair: one rule, three paths, and an app matching on the
                     // code has to reach it from all three.
@@ -1121,30 +1176,6 @@ export function createGroupContext(ctx, deps) {
                     });
                 }
             }
-            // Revoke the ex-admin's control authority on the commit that evicts them.
-            // Only admins fold authoritatively, so only an admin needs revoking — a
-            // non-admin removal carries no ledger entry at all.
-            //
-            // Minted BEFORE the removal so it can ride that very commit: a receiver
-            // refuses a Remove whose target is still an admin in the roster the commit's
-            // entries fold to, so an admin can only be evicted by a commit that also
-            // demotes them.
-            //
-            // The token is NOT appended here. On the lane the accepted commit's
-            // `onAccepted` is its writer, and only that path knows the group took this
-            // attempt: a row written here would survive a lane that never lands,
-            // demoting the target in THIS device's admin-roster fold while every
-            // co-member still folds them as an admin.
-            let revokeToken = null;
-            if (removedIsAdmin) {
-                revokeToken = await signLedgerEntry(deps.identity, {
-                    type: ADMIN_ROLE_ENTRY_TYPE,
-                    subject: memberDID,
-                    value: 'member',
-                    groupID,
-                    ord: hlc
-                });
-            }
             // The request is enqueued before the lane is armed so a crash can never
             // leave a commit driving toward a request that does not exist.
             const requestID = deps.runtime.getRandomID();
@@ -1158,12 +1189,17 @@ export function createGroupContext(ctx, deps) {
                     enqueuedAt
                 });
             });
-            // The commit is the ONLY delivery of the demotion: the token rides the
-            // commit's own frame as a sealed body, so every co-member resolves it,
+            // The commit is the ONLY delivery of the demotion: the build mints the
+            // ex-admin's demotion against the folded roster per attempt and rides it on
+            // the commit's own frame as a sealed body, so every co-member resolves it,
             // folds it and emits from that frame. A separate `ledger:entry` broadcast
             // would race the commit and hand co-members a demotion the group has not
             // yet accepted, so none is sent.
             //
+            // Whether the target is an admin is NOT decided here: the request-time
+            // projection flaps under a concurrent invite-accept mirror, so the mint is
+            // taken inside the build against the authoritative folded roster.
+            //
             // The tombstone and the announcement move with it: they happen in the
             // lane's `onAccepted`, so nothing here observes a removal the group never
             // took. Driving is deferred to the outermost commit — awaiting the lane
@@ -1172,13 +1208,9 @@ export function createGroupContext(ctx, deps) {
             const build = deps.groupManager.buildRemoveCommit({
                 groupID,
                 memberDID,
+                identity: deps.identity,
                 hlc,
-                requestID,
-                ...revokeToken != null ? {
-                    ledgerEntries: [
-                        revokeToken
-                    ]
-                } : {}
+                requestID
             });
             deps.stores.onCommit(()=>{
                 void deps.commitToGroup(groupID, build).catch((error)=>{

package/lib/context/peer.js

@@ -1389,14 +1389,14 @@ export function createPeerContext(ctx, deps) {
         },
         beginProvisioningExpectation: async (params)=>{
             const store = await getCredentialStore(deps.stores);
-            const attemptId = crypto.randomUUID();
+            const attemptID = params.attemptID ?? deps.runtime.getRandomID();
             await store.beginProvisioningAttempt({
                 ownerDID: normalizeDID(params.ownerDID),
                 grantorDID: normalizeDID(params.grantorDID),
-                attemptId
+                attemptID
             });
             return {
-                attemptId
+                attemptID
             };
         },
         recordProvisioningExpectation: async (params)=>{
@@ -1422,7 +1422,7 @@ export function createPeerContext(ctx, deps) {
                 return await txStore.recordProvisioningAttempt({
                     ownerDID: owner,
                     grantorDID: grantor,
-                    attemptId: params.attemptId,
+                    attemptID: params.attemptID,
                     epoch: params.epoch,
                     heldEpoch
                 });
@@ -1433,7 +1433,14 @@ export function createPeerContext(ctx, deps) {
             await store.abandonProvisioningAttempt({
                 ownerDID: normalizeDID(params.ownerDID),
                 grantorDID: normalizeDID(params.grantorDID),
-                attemptId: params.attemptId
+                attemptID: params.attemptID
+            });
+        },
+        abandonProvisioningExpectations: async (params)=>{
+            const store = await getCredentialStore(deps.stores);
+            await store.abandonProvisioningAttempts({
+                ownerDID: normalizeDID(params.ownerDID),
+                grantorDID: normalizeDID(params.grantorDID)
             });
         },
         provisioningHeldEpoch: async (params)=>{

package/lib/context/require-admin.d.ts

@@ -1,4 +1,6 @@
 import type { P2PStoreAPI } from '@kubun/store-p2p';
+import type { RosterState } from '@kumiai/mls';
+import { GraphQLError } from 'graphql';
 /**
  * `extensions.code` carried by every group-authority refusal, on the local
  * GraphQL path and on the wire alike. The specific refusal travels beside it as
@@ -54,4 +56,41 @@ export type RequireGroupAdminParams = {
  * silently discarded write into a loud, catchable failure — a stale gate is a
  * stale button, never a hole.
  */
+/**
+ * The one refusal every admin gate raises, so a client matches the same
+ * `code`/`reason` pair whichever gate declined it — and whichever layer catches
+ * it: the resolver runs a gate ahead of the rollback wrapper precisely because
+ * this coded error must survive it. A gate that instead let a lower-level throw
+ * (e.g. a missing MLS handle) escape would strip the pair to a bare message.
+ */
+export declare function notGroupAdminError(groupID: string, action: string): GraphQLError;
 export declare function requireGroupAdmin(params: RequireGroupAdminParams): Promise<void>;
+export type AssertRosterAdminParams = {
+    store: P2PStoreAPI;
+    /** The folded roster the commit policy enforces — `handle.roster`. */
+    roster: RosterState;
+    groupID: string;
+    /** The DID whose authority is being checked — the caller, not the target. */
+    did: string;
+    /** Phrase completing "only a group admin can ..." in the refusal message. */
+    action: string;
+};
+/**
+ * Like `requireGroupAdmin`, but the admin half of the check reads the FOLDED
+ * ROSTER instead of the projected `role` column.
+ *
+ * The projected column flaps admin->member under a concurrent invite-accept
+ * mirror overwrite, so a freshly promoted admin can be refused its own control
+ * op the instant the mirror lags — a spurious, fail-closed NOT_GROUP_ADMIN.
+ * The roster is the authority the commit policy itself enforces and moves only
+ * on an enacted commit, so it never carries that transient flap.
+ *
+ * The membership half is unchanged and still reads the row: the flap moves the
+ * role column, never the row's existence, so a lagged projection cannot hide a
+ * member. Reading the roster ALONE would drop this half — the roster is
+ * DID-keyed and can hold a role for a DID with no MLS leaf — so a DID with no
+ * (or a tombstoned) membership row is refused even when the roster names it an
+ * admin. Callers pass their own DID, which always holds a leaf when they hold
+ * the handle, so this half only ever fires on a misuse.
+ */
+export declare function assertRosterAdmin(params: AssertRosterAdminParams): Promise<void>;

package/lib/context/require-admin.js

@@ -1,4 +1,5 @@
 import { GraphQLError } from 'graphql';
+import { roleFromRoster } from '../groups/roster-projection.js';
 /**
  * `extensions.code` carried by every group-authority refusal, on the local
  * GraphQL path and on the wire alike. The specific refusal travels beside it as
@@ -42,12 +43,14 @@ import { GraphQLError } from 'graphql';
  * fold, which drops a non-admin's entry regardless. Refusing here turns a
  * silently discarded write into a loud, catchable failure — a stale gate is a
  * stale button, never a hole.
- */ export async function requireGroupAdmin(params) {
-    const { store, groupID, did, action } = params;
-    if (await store.isGroupAdmin(groupID, did)) {
-        return;
-    }
-    throw new GraphQLError(`not authorized: only a group admin can ${action}`, {
+ */ /**
+ * The one refusal every admin gate raises, so a client matches the same
+ * `code`/`reason` pair whichever gate declined it — and whichever layer catches
+ * it: the resolver runs a gate ahead of the rollback wrapper precisely because
+ * this coded error must survive it. A gate that instead let a lower-level throw
+ * (e.g. a missing MLS handle) escape would strip the pair to a bare message.
+ */ export function notGroupAdminError(groupID, action) {
+    return new GraphQLError(`not authorized: only a group admin can ${action}`, {
         extensions: {
             code: GROUP_CONTROL_DENIED,
             reason: NOT_GROUP_ADMIN,
@@ -55,3 +58,35 @@ import { GraphQLError } from 'graphql';
         }
     });
 }
+export async function requireGroupAdmin(params) {
+    const { store, groupID, did, action } = params;
+    if (await store.isGroupAdmin(groupID, did)) {
+        return;
+    }
+    throw notGroupAdminError(groupID, action);
+}
+/**
+ * Like `requireGroupAdmin`, but the admin half of the check reads the FOLDED
+ * ROSTER instead of the projected `role` column.
+ *
+ * The projected column flaps admin->member under a concurrent invite-accept
+ * mirror overwrite, so a freshly promoted admin can be refused its own control
+ * op the instant the mirror lags — a spurious, fail-closed NOT_GROUP_ADMIN.
+ * The roster is the authority the commit policy itself enforces and moves only
+ * on an enacted commit, so it never carries that transient flap.
+ *
+ * The membership half is unchanged and still reads the row: the flap moves the
+ * role column, never the row's existence, so a lagged projection cannot hide a
+ * member. Reading the roster ALONE would drop this half — the roster is
+ * DID-keyed and can hold a role for a DID with no MLS leaf — so a DID with no
+ * (or a tombstoned) membership row is refused even when the roster names it an
+ * admin. Callers pass their own DID, which always holds a leaf when they hold
+ * the handle, so this half only ever fires on a misuse.
+ */ export async function assertRosterAdmin(params) {
+    const { store, roster, groupID, did, action } = params;
+    const member = await store.getGroupMember(groupID, did);
+    if (member != null && roleFromRoster(roster, did) === 'admin') {
+        return;
+    }
+    throw notGroupAdminError(groupID, action);
+}

package/lib/groups/credential-readiness.d.ts

@@ -7,10 +7,25 @@ import { type DelegatedWrappingCheckDeps } from './grantor-authority.js';
  * decrypt-materialization; `reason` explains a `false` verdict (absent on
  * `complete`).
  */
+export type CredentialProvisioningGrantorStatus = {
+    grantorDID: string;
+    /** Manifest at/above floor, proof verifies now, and every key materialized. */
+    satisfied: boolean;
+    /**
+     * The held delegation proof verifies right now. `false` only when the
+     * administer-chain check on a HELD manifest returns false (revoked/expired
+     * OR transiently unvalidatable). An un-pulled/below-floor manifest and a
+     * self-grantor leave it `true` — no held proof has failed.
+     */
+    authorityValid: boolean;
+    /** This grantor's keys not yet materialized here. */
+    missing: Array<string>;
+};
 export type CredentialProvisioningReadiness = {
     complete: boolean;
     missing: Array<string>;
     reason?: 'not-initiated' | 'pending' | 'incomplete';
+    grantors: Array<CredentialProvisioningGrantorStatus>;
 };
 /**
  * Whether one expected key is materialized on this device AT the manifest's

package/lib/groups/credential-readiness.js

@@ -76,7 +76,8 @@ import { checkAdministerChain } from './grantor-authority.js';
         return {
             complete: false,
             missing: [],
-            reason: 'pending'
+            reason: 'pending',
+            grantors: []
         };
     }
     // Rule 2: nothing has ever been asked for — never a vacuous complete.
@@ -84,7 +85,8 @@ import { checkAdministerChain } from './grantor-authority.js';
         return {
             complete: false,
             missing: [],
-            reason: 'not-initiated'
+            reason: 'not-initiated',
+            grantors: []
         };
     }
     const manifests = await store.listManifests({
@@ -96,13 +98,21 @@ import { checkAdministerChain } from './grantor-authority.js';
             manifest
         ]));
     const missing = [];
+    const grantors = [];
     let allSatisfied = true;
     for (const expectation of expectations){
         const grantor = normalizeDID(expectation.grantorDID);
         const manifest = byGrantor.get(grantor);
         // No held manifest at/above the floor: this expectation names no known
-        // target keys to report as `missing` — it is simply unsatisfied.
+        // target keys to report as `missing` — it is simply unsatisfied. No held
+        // proof has failed here, so `authorityValid` stays true.
         if (manifest == null || manifest.record.epoch < expectation.epochFloor) {
+            grantors.push({
+                grantorDID: grantor,
+                satisfied: false,
+                authorityValid: true,
+                missing: []
+            });
             allSatisfied = false;
             continue;
         }
@@ -114,9 +124,16 @@ import { checkAdministerChain } from './grantor-authority.js';
         });
         if (!authorized) {
             // Expired/revoked/unwired proof: fail-closed means unmet, not thrown.
+            grantors.push({
+                grantorDID: grantor,
+                satisfied: false,
+                authorityValid: false,
+                missing: []
+            });
             allSatisfied = false;
             continue;
         }
+        const grantorMissing = [];
         for (const key of manifest.record.keys){
             let materialized = false;
             try {
@@ -134,21 +151,32 @@ import { checkAdministerChain } from './grantor-authority.js';
                 materialized = false;
             }
             if (!materialized) {
-                missing.push(key.keyID);
-                allSatisfied = false;
+                grantorMissing.push(key.keyID);
             }
         }
+        if (grantorMissing.length > 0) {
+            missing.push(...grantorMissing);
+            allSatisfied = false;
+        }
+        grantors.push({
+            grantorDID: grantor,
+            satisfied: grantorMissing.length === 0,
+            authorityValid: true,
+            missing: grantorMissing
+        });
     }
     if (allSatisfied && missing.length === 0) {
         return {
             complete: true,
-            missing: []
+            missing: [],
+            grantors
         };
     }
     return {
         complete: false,
         missing,
-        reason: 'incomplete'
+        reason: 'incomplete',
+        grantors
     };
 }
 /**

package/lib/groups/manager.d.ts

@@ -188,9 +188,17 @@ export type BuildRemoveCommitParams = {
     groupID: string;
     memberDID: string;
     /**
-     * Signed control-ledger tokens this removal enacts. Removing an admin means
-     * riding their demotion entry on the same commit: a receiver refuses a Remove
-     * whose target is still an admin in the roster the commit folds to.
+     * The identity that signs the demotion entry riding this removal. Removing an
+     * admin means demoting them on the same commit, and the demotion is minted
+     * INSIDE the per-attempt build against the folded roster — never at request
+     * time against the projected role column, which flaps under a concurrent
+     * invite-accept mirror and would mint no demotion for an admin the fold still
+     * names, leaving the receiver to refuse the eviction.
+     */
+    identity: OwnIdentity;
+    /**
+     * Extra signed control-ledger tokens this removal must also enact, beyond the
+     * admin demotion the build mints for itself. Empty for a plain eviction.
      */
     ledgerEntries?: Array<string>;
     /**

package/lib/groups/manager.js

@@ -5,6 +5,7 @@ import { commitInvite, commitLedgerEntries, controlCapabilities, createGroup, cr
 import { toB64 } from '@sozai/codec';
 import { toISO } from '../context/types.js';
 import { bindHubToGroup, upsertHub } from '../hub/manager.js';
+import { ADMIN_ROLE_ENTRY_TYPE } from './admin-roster.js';
 import { reprojectGroupSettings } from './circle-projection.js';
 import { GROUP_SETTINGS_ENTRY_TYPE } from './circle-reducers.js';
 import { serializeCommitJournalBlob } from './commit-adoption.js';
@@ -29,6 +30,22 @@ import { mirrorRosterRoles, roleFromRoster } from './roster-projection.js';
  * left alone: the commit attempt fails a few lines later with the library's own
  * precise reason.
  */ async function assertRemovalDemotes(handle, memberDID, tokens) {
+    if (await roleAfterFolding(handle, memberDID, tokens) === 'admin') {
+        throw new Error(`Cannot remove ${memberDID}: still an admin in the roster this commit folds to. A demotion entry must ride the same commit.`);
+    }
+}
+/**
+ * The role `memberDID` holds in the roster this commit would fold to: the
+ * handle's current roster with `tokens` applied. `undefined` when the fold
+ * rejects outright — the commit attempt then fails a few lines later with the
+ * library's own precise reason, so this check leaves it alone.
+ *
+ * Both the demotion mint in {@link GroupManager.buildRemoveCommit} and
+ * {@link assertRemovalDemotes} key on this: the mint rides a demotion when it
+ * returns `'admin'`, and the assert then confirms the completed token set clears
+ * it. A caller that already supplied the demotion drives it to non-admin here, so
+ * no second demotion is minted.
+ */ async function roleAfterFolding(handle, memberDID, tokens) {
     const inputs = [];
     for (const token of tokens){
         const verified = await verifyLedgerEntry(token);
@@ -42,11 +59,9 @@ import { mirrorRosterRoles, roleFromRoster } from './roster-projection.js';
     }
     const folded = foldEnvelope(handle.roster, handle.registry, inputs, handle.groupID);
     if (!folded.ok) {
-        return;
-    }
-    if (folded.roster.roles.get(normalizeDID(memberDID)) === 'admin') {
-        throw new Error(`Cannot remove ${memberDID}: still an admin in the roster this commit folds to. A demotion entry must ride the same commit.`);
+        return undefined;
     }
+    return folded.roster.roles.get(normalizeDID(memberDID));
 }
 export class GroupManager {
     #deviceID;
@@ -668,12 +683,33 @@ export class GroupManager {
    * the intent lives in the MLS Remove proposal, which does not survive the
    * process.
    */ buildRemoveCommit(params) {
-        const tokens = params.ledgerEntries ?? [];
         return ()=>this.#registry.readHandle(params.groupID, async (handle)=>{
                 const leafIndex = handle.findMemberLeafIndex(params.memberDID);
                 if (leafIndex == null) {
                     throw new Error(`Member ${params.memberDID} not found in MLS group`);
                 }
+                // Fresh copy per attempt: a rebase re-runs this closure, and the demotion
+                // it mints below is stamped against THIS attempt's folded roster.
+                const tokens = [
+                    ...params.ledgerEntries ?? []
+                ];
+                // Mint the admin demotion here, keyed on the FOLDED roster — the only
+                // authority on who holds admin. The request-time projection flaps under a
+                // concurrent invite-accept mirror, so a decision taken there would ship no
+                // demotion for an admin the fold still names and the receiver would refuse
+                // the eviction. `hlc` orders the demotion with the tombstone riding the
+                // same commit. A caller that already supplied the demotion in
+                // `ledgerEntries` drives the folded role to non-admin, so none is added
+                // twice.
+                if (await roleAfterFolding(handle, params.memberDID, tokens) === 'admin') {
+                    tokens.push(await signLedgerEntry(params.identity, {
+                        type: ADMIN_ROLE_ENTRY_TYPE,
+                        subject: params.memberDID,
+                        value: 'member',
+                        groupID: params.groupID,
+                        ord: params.hlc
+                    }));
+                }
                 await assertRemovalDemotes(handle, params.memberDID, tokens);
                 const { commitMessage, newGroup } = await removeMember(handle, leafIndex, tokens);
                 return {

package/lib/schema.js

@@ -680,6 +680,17 @@ type GrantDeviceCredentialsPayload {
   epoch: Int!
 }
 
+"""One grantor's provisioning verdict within a credentialProvisioningStatus."""
+type CredentialProvisioningGrantorStatus {
+  grantorDID: DID!
+  """Manifest at/above floor, proof verifies now, every key materialized."""
+  satisfied: Boolean!
+  """False only when a held manifest's administer chain fails now (revoked/expired or transiently unvalidatable); un-pulled or self-grantor stays true."""
+  authorityValid: Boolean!
+  """This grantor's keyIDs not yet materialized here."""
+  missing: [ID!]!
+}
+
 """
 Readiness of this device's credential provisioning for one owner. A key counts
 materialized only when its wrapping decrypt-verifies (or, for a zero-entry key,
@@ -695,14 +706,13 @@ type CredentialProvisioningStatus {
   (asked for, not yet fully materialized/proven). Absent when complete.
   """
   reason: String
+  """Per-grantor breakdown; empty on pending/not-initiated."""
+  grantors: [CredentialProvisioningGrantorStatus!]!
 }
 
 type BeginProvisioningExpectationPayload {
-  """
-  Freshly minted attempt id; pass it to recordProvisioningExpectation /
-  abandonProvisioningExpectation to close this attempt.
-  """
-  attemptId: ID!
+  """The effective attempt id (caller-supplied or minted); pass to record/abandon to close it."""
+  attemptID: ID!
 }
 
 enum RecordProvisioningExpectationStatus {
@@ -745,25 +755,32 @@ extend type Mutation {
   grantDeviceCredentials(groupID: ID!, recipientDID: DID!, ownerDID: DID!, minEpoch: Int): GrantDeviceCredentialsPayload!
   """
   Arm this device to converge a credential grant for ownerDID from grantorDID:
-  write the provisioning-expectation row that lets the credential-reconcile PULL
-  fetch that owner's buckets (a delegate-signed grant converges only via the
-  pull, never the live apply). Call before asking the grantor to grant, then
-  recordProvisioningExpectation once the grant returns its epoch. Mirrors the
-  credentialProvisioningStatus query's recipient-local surface.
+  write the provisioning-expectation row the credential-reconcile pull fetches
+  against. Call before asking the grantor to grant, then recordProvisioningExpectation
+  once the grant returns its epoch. Optional attemptID: persist it before calling
+  for crash-recovery; omit to mint server-side. Idempotent only within the
+  outstanding window (a replay after record/abandon re-pins 'pending').
   """
-  beginProvisioningExpectation(ownerDID: DID!, grantorDID: DID!): BeginProvisioningExpectationPayload!
+  beginProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptID: ID): BeginProvisioningExpectationPayload!
   """
   Bind the provisioning floor for an in-flight attempt to the epoch its grant was
   signed under. Returns RECORDED when the floor binds, or RETRY with the held
   epoch when a higher manifest already landed (re-grant with minEpoch, then record
   the new attempt).
   """
-  recordProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptId: ID!, epoch: Int!): RecordProvisioningExpectationPayload!
+  recordProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptID: ID!, epoch: Int!): RecordProvisioningExpectationPayload!
   """
-  Stop tracking one provisioning attempt. Removes only this attemptId; never binds
+  Stop tracking one provisioning attempt. Removes only this attemptID; never binds
   or lowers a floor. Returns true.
   """
-  abandonProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptId: ID!): Boolean!
+  abandonProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptID: ID!): Boolean!
+  """
+  Clear EVERY outstanding provisioning attempt for a (owner, grantor) scope —
+  the recovery path when an attempt id was lost. Never binds or lowers a floor.
+  Exclusive recovery: also cancels any other in-flight attempt, so ensure none
+  is live. Returns true.
+  """
+  abandonProvisioningExpectations(ownerDID: DID!, grantorDID: DID!): Boolean!
   joinPeerGroup(peerDID: ID!, groupID: ID!): JoinPeerGroupPayload!
   """
   Apply one circle's desired sync end state. A null argument leaves that dimension
@@ -1099,14 +1116,17 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                 beginProvisioningExpectation: async (_source, args, context)=>{
                     return await requireP2P(context).peer.beginProvisioningExpectation({
                         ownerDID: args.ownerDID,
-                        grantorDID: args.grantorDID
+                        grantorDID: args.grantorDID,
+                        ...args.attemptID == null ? {} : {
+                            attemptID: args.attemptID
+                        }
                     });
                 },
                 recordProvisioningExpectation: async (_source, args, context)=>{
                     const result = await requireP2P(context).peer.recordProvisioningExpectation({
                         ownerDID: args.ownerDID,
                         grantorDID: args.grantorDID,
-                        attemptId: args.attemptId,
+                        attemptID: args.attemptID,
                         epoch: args.epoch
                     });
                     return {
@@ -1118,7 +1138,14 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                     await requireP2P(context).peer.abandonProvisioningExpectation({
                         ownerDID: args.ownerDID,
                         grantorDID: args.grantorDID,
-                        attemptId: args.attemptId
+                        attemptID: args.attemptID
+                    });
+                    return true;
+                },
+                abandonProvisioningExpectations: async (_source, args, context)=>{
+                    await requireP2P(context).peer.abandonProvisioningExpectations({
+                        ownerDID: args.ownerDID,
+                        grantorDID: args.grantorDID
                     });
                     return true;
                 },
@@ -1252,7 +1279,7 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                     // must roll it back: a queued request no lane settles is `pending` forever.
                     // Returns `pending`, not awaited: the commit lane runs on the outermost
                     // commit, after this transaction closes.
-                    return await gatedTransaction('requestRemoveGroupMember', ()=>requireP2P(context).group.requireAdmin(input.groupID, 'remove a member'), async ()=>{
+                    return await gatedTransaction('requestRemoveGroupMember', ()=>requireP2P(context).group.requireAdminByRoster(input.groupID, 'remove a member'), async ()=>{
                         const request = await requireP2P(context).group.requestRemoveMember(input);
                         return {
                             request: toControlRequestSDL(request)
@@ -1266,7 +1293,7 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                     // Returns `pending`, not awaited: the commit lane runs on the outermost
                     // commit, after this transaction closes.
                     //
-                    return await gatedTransaction('requestSetMemberRole', ()=>requireP2P(context).group.requireAdmin(input.groupID, 'set member roles'), async ()=>{
+                    return await gatedTransaction('requestSetMemberRole', ()=>requireP2P(context).group.requireAdminByRoster(input.groupID, 'set member roles'), async ()=>{
                         const request = await requireP2P(context).group.requestSetMemberRole(input);
                         return {
                             request: toControlRequestSDL(request)

package/lib/types.d.ts

@@ -198,6 +198,15 @@ export type GroupRequestContext = {
      * re-raises and strips extensions — that ordering is what keeps the code visible.
      */
     requireAdmin: (groupID: string, action: string) => Promise<void>;
+    /**
+     * `requireAdmin` for the control-mint ops (remove a member, set a member role),
+     * reading admin authority from the FOLDED ROSTER instead of the projected
+     * `role` column. The column flaps admin->member under a concurrent invite-accept
+     * mirror, so a freshly promoted admin would be spuriously refused NOT_GROUP_ADMIN
+     * on its own op; the roster carries no such flap. Same code/reason as
+     * `requireAdmin`, so a caller matching on the pair is unaffected.
+     */
+    requireAdminByRoster: (groupID: string, action: string) => Promise<void>;
     /**
      * `requireAdmin` for an operation that only knows a circle: resolves the
      * circle's group and gates on that.
@@ -630,6 +639,13 @@ export type CredentialProvisioningStatusParams = {
      */
     ownerDID: string;
 };
+export type CredentialProvisioningGrantorStatus = {
+    grantorDID: string;
+    satisfied: boolean;
+    /** Held proof verifies now; `false` only when a held manifest's proof fails. */
+    authorityValid: boolean;
+    missing: Array<string>;
+};
 export type CredentialProvisioningStatusData = {
     /** True iff every durable expectation is satisfied — `missing` is empty. */
     complete: boolean;
@@ -644,22 +660,41 @@ export type CredentialProvisioningStatusData = {
      * `'incomplete'` (recorded but not yet satisfied). Absent when `complete`.
      */
     reason?: 'not-initiated' | 'pending' | 'incomplete';
+    /**
+     * Per-grantor breakdown, populated on the post-checks path (empty on
+     * `pending`/`not-initiated`). Lets a driver tell an un-pulled manifest
+     * (`authorityValid:true`, keep pulling) from a held proof that fails to
+     * verify (`authorityValid:false`, back off and await a fresh grant).
+     */
+    grantors: Array<CredentialProvisioningGrantorStatus>;
 };
 export type BeginProvisioningExpectationParams = {
     /** The credential owner this expectation tracks provisioning for. */
     ownerDID: string;
     /** The grantor this device expects a manifest from. */
     grantorDID: string;
+    /**
+     * Optional caller-supplied attempt id. Supply and persist it BEFORE calling
+     * to make begin crash-recoverable — after a crash the caller still knows the
+     * id to abandon. Idempotent only within the outstanding window: a replay
+     * after record/abandon re-creates the attempt and re-pins `pending`. Omit to
+     * have the id minted server-side.
+     */
+    attemptID?: string;
 };
 export type BeginProvisioningExpectationData = {
-    /** Freshly minted attempt id; pass it to `recordProvisioningExpectation`/`abandonProvisioningExpectation`. */
-    attemptId: string;
+    /**
+     * The effective attempt id for this attempt: the caller-supplied
+     * `attemptID` when one was given, else a freshly minted one. Pass it to
+     * `recordProvisioningExpectation`/`abandonProvisioningExpectation`.
+     */
+    attemptID: string;
 };
 export type RecordProvisioningExpectationParams = {
     ownerDID: string;
     grantorDID: string;
     /** The id `beginProvisioningExpectation` minted for this attempt. */
-    attemptId: string;
+    attemptID: string;
     /** The epoch this attempt's grant call was allocated and signed under. */
     epoch: number;
 };
@@ -674,7 +709,11 @@ export type AbandonProvisioningExpectationParams = {
     ownerDID: string;
     grantorDID: string;
     /** The id to stop tracking. Removes ONLY this id; never binds or lowers a floor. */
-    attemptId: string;
+    attemptID: string;
+};
+export type AbandonProvisioningExpectationsParams = {
+    ownerDID: string;
+    grantorDID: string;
 };
 export type ProvisioningHeldEpochParams = {
     ownerDID: string;
@@ -858,7 +897,7 @@ export type PeerRequestContext = {
     credentialProvisioningStatus: (params: CredentialProvisioningStatusParams) => Promise<CredentialProvisioningStatusData>;
     /**
      * Begin tracking a provisioning attempt for `(ownerDID, grantorDID)`: mints
-     * an `attemptId` and forces `credentialProvisioningStatus` to `pending`
+     * an `attemptID` and forces `credentialProvisioningStatus` to `pending`
      * until recorded/abandoned. Call BEFORE asking the grantor to grant, to
      * close the epoch-allocation race window.
      */
@@ -869,14 +908,23 @@ export type PeerRequestContext = {
      * attempt's epoch still exceeds it, the floor advances (`'recorded'`);
      * otherwise a higher manifest already arrived and the attempt stays
      * outstanding (`'retry'`, `minEpoch`) — retry the grant and call again with
-     * the same `attemptId`.
+     * the same `attemptID`.
      */
     recordProvisioningExpectation: (params: RecordProvisioningExpectationParams) => Promise<RecordProvisioningExpectationData>;
     /**
      * Stop tracking a dead/abandoned provisioning attempt: removes only this
-     * `attemptId` from the outstanding set, never touches the epoch floor.
+     * `attemptID` from the outstanding set, never touches the epoch floor.
      */
     abandonProvisioningExpectation: (params: AbandonProvisioningExpectationParams) => Promise<void>;
+    /**
+     * Clear EVERY outstanding provisioning attempt for a (owner, grantor) scope
+     * without an id — the recovery path for an orphaned attempt whose id was
+     * lost. Never touches the epoch floor. Exclusive-recovery contract: also
+     * cancels any other live coordinator's attempt for the scope, so the caller
+     * must ensure none is in flight; when the id is known, prefer
+     * `abandonProvisioningExpectation`.
+     */
+    abandonProvisioningExpectations: (params: AbandonProvisioningExpectationsParams) => Promise<void>;
     /**
      * This device's currently-held epoch for `(ownerDID, grantorDID)` — max
      * epoch among held manifests from that grantor, or `0`. Feeds `minEpoch`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-p2p",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -27,7 +27,7 @@
     "@kubun/db": "^0.17.0",
     "@kubun/db-adapter": "^0.17.0",
     "@kubun/engine": "^0.17.0",
-    "@kubun/graphql": "^0.17.0",
+    "@kubun/graphql": "^0.17.1",
     "@kubun/hlc": "^0.17.0",
     "@kubun/http-util": "^0.17.0",
     "@kubun/id": "^0.17.0",
@@ -42,7 +42,7 @@
     "@kubun/protocol": "^0.17.0",
     "@kubun/store-blob": "^0.17.0",
     "@kubun/store-controller": "^0.17.0",
-    "@kubun/store-credential": "^0.17.0",
+    "@kubun/store-credential": "^0.17.1",
     "@kubun/store-delegation": "^0.17.0",
     "@kubun/store-graph": "^0.17.0",
     "@kubun/store-p2p": "^0.17.0",
@@ -62,7 +62,7 @@
     "@sozai/runtime": "^0.1.0",
     "@sozai/schema": "^0.1.2",
     "@sozai/stream": "^0.2.0",
-    "graphql": "^16.14.2",
+    "graphql": "^17.0.2",
     "kysely": "^0.29.5",
     "ts-mls": "2.0.0-rc.13"
   },
@@ -72,7 +72,7 @@
     "@kubun/db-better-sqlite": "^0.17.0",
     "@kubun/db-node-sqlite": "^0.17.0",
     "@kubun/db-postgres": "^0.17.0",
-    "@kubun/hub": "^0.17.0",
+    "@kubun/hub": "^0.17.3",
     "@kubun/plugin-blob": "^0.17.0",
     "@kubun/plugin-connector": "^0.17.1",
     "@kubun/plugin-service-server": "^0.17.0",