@kubun/plugin-p2p 0.9.0 → 0.10.1

package/lib/groups/group-health-monitor.d.ts

@@ -0,0 +1,45 @@
+import type { GroupHealthCondition, GroupHealthSnapshot, GroupHealthState } from '../types.js';
+import type { P2PEventEmitter } from './events.js';
+export type GroupHealthMonitorParams = {
+    emitter: P2PEventEmitter;
+    /** Tuning for the `epoch-stale` condition. Defaults to a threshold of 3. */
+    epochStale?: {
+        threshold?: number;
+    };
+    /** Clock for `lastTransitionAt` stamps. Defaults to `Date.now`. */
+    now?: () => number;
+};
+/**
+ * Per-group health state machine. Counts/latches failure signals per
+ * `(groupID, condition)` and emits `groupHealthChanged` on transitions.
+ * Crypto- and persistence-free: callers classify failures before signalling.
+ *
+ * State is in-memory per-process — a restart re-derives it from the next signal.
+ * Transitions are synchronous (no `await`), so calls cannot interleave; signals
+ * arriving while a rejoin is in flight (`recovering`) are ignored — the recovery
+ * owns the group until it resolves.
+ */
+export declare class GroupHealthMonitor {
+    #private;
+    constructor(params: GroupHealthMonitorParams);
+    /**
+     * Record a failure observation for a condition. Below the condition's
+     * threshold this only increments the counter; on reaching it the group
+     * transitions to `degraded` (emitted once, then latched). Ignored while the
+     * group is `recovering` (the rejoin owns it) or already `degraded`/failed.
+     */
+    signal(groupID: string, condition: GroupHealthCondition): void;
+    /**
+     * Clear a condition to healthy and re-arm (counter reset), driven by the
+     * success path. Silent: only recovery (via the mark* methods) is surfaced.
+     */
+    reset(groupID: string, condition: GroupHealthCondition): void;
+    markRecovering(groupID: string): void;
+    /** Emit the transient `recovered` event, then settle the phase to `healthy`. */
+    markRecovered(groupID: string): void;
+    /** Leave the group `recovery-failed` until a later success resets it. */
+    markRecoveryFailed(groupID: string): void;
+    /** Aggregate state: the first non-healthy condition phase, else `healthy`. */
+    getState(groupID: string): GroupHealthState;
+    getHealth(groupID: string): GroupHealthSnapshot;
+}

package/lib/groups/group-health-monitor.js

@@ -0,0 +1 @@
+export class GroupHealthMonitor{#e;#t;#s;#h=new Map;#a=new Map;constructor(e){this.#e=e.emitter,this.#t=e.epochStale?.threshold??3,this.#s=e.now??Date.now}signal(e,t){let s=this.#r(e,t);"healthy"===s.phase&&(s.count+=1,s.count>=this.#i(t)&&(s.phase="degraded",this.#o(e),this.#l(e,t,"degraded")))}reset(e,t){let s=this.#r(e,t);s.count=0,"healthy"!==s.phase&&(s.phase="healthy",this.#o(e))}markRecovering(e){this.#r(e,"epoch-stale").phase="recovering",this.#o(e),this.#l(e,"epoch-stale","recovering")}markRecovered(e){let t=this.#r(e,"epoch-stale");t.count=0,t.phase="healthy",this.#o(e),this.#l(e,"epoch-stale","recovered")}markRecoveryFailed(e){this.#r(e,"epoch-stale").phase="recovery-failed",this.#o(e),this.#l(e,"epoch-stale","recovery-failed")}getState(e){let t=this.#h.get(e);if(null==t)return"healthy";for(let e of t.values())if("healthy"!==e.phase)return e.phase;return"healthy"}getHealth(e){return{state:this.getState(e),lastTransitionAt:this.#a.get(e)??null}}#o(e){this.#a.set(e,this.#s())}#i(e){return"epoch-stale"===e?this.#t:1/0}#r(e,t){let s=this.#h.get(e);null==s&&(s=new Map,this.#h.set(e,s));let h=s.get(t);return null==h&&(h={phase:"healthy",count:0},s.set(t,h)),h}#l(e,t,s){this.#e.emit("groupHealthChanged",{groupID:e,condition:t,state:s})}}

package/lib/groups/invite-payload.d.ts

@@ -19,6 +19,22 @@ export type InvitePayload = {
     invite: Invite;
     welcomeMessage: unknown;
     ratchetTree: unknown;
+    /**
+     * Optional initial write-grant capability tokens (stringified JWTs) the
+     * inviter wants the joiner to hold immediately, before it starts receiving
+     * group broadcasts. Travels alongside the MLS invite as plain app-level data
+     * and is applied after the join completes — tokens addressed to the joiner
+     * are stored, others ignored.
+     */
+    grants?: Array<string>;
+    /**
+     * Optional initial signed-revocation tokens the inviter wants the joiner to
+     * apply immediately, before it starts receiving group broadcasts. Pending
+     * revocations (cap not yet known by the inviter) do NOT travel — only
+     * verified ones — though the receiving joiner re-cross-checks them anyway
+     * against any caps it already holds.
+     */
+    revocations?: Array<string>;
 };
 export declare function encodeJoinRequest(payload: JoinRequestPayload): string;
 export declare function decodeJoinRequest(encoded: string): JoinRequestPayload;

package/lib/groups/join-utils.d.ts

@@ -1,9 +1,11 @@
 import type { StoreProvider } from '@kubun/db';
+import type { HLC } from '@kubun/hlc';
+import type { Logger } from '@kubun/logger';
 import type { GroupData } from '../types.js';
-import type { GroupEventEmitter } from './events.js';
+import type { P2PEventEmitter } from './events.js';
 export type FinalizeJoinedGroupParams = {
     stores: StoreProvider;
-    emitter: GroupEventEmitter;
+    emitter: P2PEventEmitter;
     invite: {
         groupID: string;
     };
@@ -11,3 +13,67 @@ export type FinalizeJoinedGroupParams = {
 export declare function finalizeJoinedGroup(params: FinalizeJoinedGroupParams): Promise<{
     group: GroupData | null;
 }>;
+export type ApplyInviteGrantsParams = {
+    stores: StoreProvider;
+    /** DID of the joining device — only grants addressed to it are stored. */
+    selfDID: string;
+    /** Group the joined invite belongs to. */
+    groupID: string;
+    /** Stringified capability JWTs carried by the invite. */
+    grants?: Array<string>;
+    /** Joiner's HLC, used to stamp each stored held row. */
+    hlc: HLC;
+    /**
+     * Optional emitter notified after each held row is written. Lets the joiner's
+     * `ownDelegationTokenAdded` subscription surface invite-bootstrap grants
+     * without waiting for a subsequent broadcast.
+     */
+    emitter?: P2PEventEmitter;
+    logger?: Logger;
+};
+/**
+ * Apply invite-bootstrap grants after a join completes. Each token is verified
+ * and, when addressed to the joining device, stored as a held row so the
+ * engine's auto-attach can use it on the very first mutation — before any group
+ * broadcast arrives.
+ *
+ * No grantor HLC travels in the invite (it carries plain tokens, not the
+ * grantor's issued rows), so the joiner stamps a fresh HLC of its own at apply
+ * time. This is consistent with how every other join-time row the joiner
+ * materializes is locally stamped.
+ *
+ * Returns the number of grants that resulted in a stored held row.
+ */
+export declare function applyInviteGrants(params: ApplyInviteGrantsParams): Promise<number>;
+export type ApplyInviteRevocationsParams = {
+    stores: StoreProvider;
+    /** Group the joined invite belongs to. */
+    groupID: string;
+    /** Signed revocation JWTs carried by the invite. */
+    revocations?: Array<string>;
+    /** Joiner's HLC, used to stamp each stored revocation row. */
+    hlc: HLC;
+    /**
+     * DID of the joining device. Forwarded to `storeReceivedRevocation` for
+     * symmetry; revocation storage is identity-agnostic but the helper accepts
+     * the param.
+     */
+    selfDID: string;
+    /** Optional emitter forwarded to `storeReceivedRevocation`. */
+    emitter?: P2PEventEmitter;
+    logger?: Logger;
+};
+/**
+ * Apply invite-bootstrap revocations after a join completes. Each token is
+ * verified and stored — cap-known locally with matching `iss` yields a
+ * verified row, cap-unknown yields a pending row that the joiner will
+ * cross-check when the cap later arrives.
+ *
+ * The inviter's caller is responsible for filtering to verified revocations
+ * only; pending revocations do not travel via the invite envelope. The joiner
+ * stamps a fresh HLC since the inviter's HLC for these rows is not in the
+ * payload.
+ *
+ * Returns the number of revocations that resulted in a stored row.
+ */
+export declare function applyInviteRevocations(params: ApplyInviteRevocationsParams): Promise<number>;

package/lib/groups/join-utils.js

@@ -1 +1 @@
-import{getP2PStore as e}from"@kubun/store-p2p";import{toISO as t}from"../context/types.js";export async function finalizeJoinedGroup(r){let{stores:i,emitter:o,invite:n}=r,a=await e(i),p=await a.getGroup(n.groupID),u=null!=p?{id:p.id,name:p.name,description:p.description,createdBy:p.created_by,createdAt:t(p.created_at)}:null;return null!=u&&await o.emit("groupJoined",u),{group:u}}
+import{HLC as e}from"@kubun/hlc";import{getP2PStore as t}from"@kubun/store-p2p";import{toISO as r}from"../context/types.js";import{storeReceivedGrant as n}from"./store-received-grant.js";import{storeReceivedRevocation as i}from"./store-received-revocation.js";export async function finalizeJoinedGroup(e){let{stores:n,emitter:i,invite:o}=e,a=await t(n),l=await a.getGroup(o.groupID),p=null!=l?{id:l.id,name:l.name,description:l.description,createdBy:l.created_by,createdAt:r(l.created_at)}:null;return null!=p&&await i.emit("groupJoined",p),{group:p}}export async function applyInviteGrants(r){let{stores:i,selfDID:o,groupID:a,grants:l,hlc:p,emitter:u,logger:c}=r;if(null==l||0===l.length)return 0;let s=await t(i);return(await Promise.all(l.map(t=>n({p2pStore:s,token:t,groupID:a,hlc:e.serialize(p.now()),selfDID:o,...null!=u?{emitter:u}:{},...null!=c?{logger:c}:{}})))).reduce((e,t)=>e+ +!!t,0)}export async function applyInviteRevocations(r){let{stores:n,groupID:o,revocations:a,hlc:l,selfDID:p,emitter:u,logger:c}=r;if(null==a||0===a.length)return 0;let s=await t(n);return(await Promise.all(a.map(t=>i({p2pStore:s,token:t,groupID:o,hlc:e.serialize(l.now()),selfDID:p,...null!=u?{emitter:u}:{},...null!=c?{logger:c}:{}})))).reduce((e,t)=>e+ +!!t,0)}

package/lib/groups/manager.d.ts

@@ -1,6 +1,7 @@
 import { type GroupPermission, type Invite, type KeyPackageBundle } from '@enkaku/group';
 import type { Identity, OwnIdentity } from '@enkaku/token';
 import type { StoreProvider } from '@kubun/db';
+import { HLC } from '@kubun/hlc';
 import type { GroupBroadcastMessage } from './broadcast.js';
 import type { GroupHandleRegistry } from './group-handle-registry.js';
 import type { SuggestedHub } from './invite-payload.js';
@@ -13,6 +14,14 @@ export type GroupManagerParams = {
      * the registry's per-group mutex with write-through persist.
      */
     registry: GroupHandleRegistry;
+    /**
+     * Device-wide monotonic clock for stamping group/circle/member metadata.
+     * Required: production passes the engine's single instance so every write
+     * from this device — graph mutations and group metadata alike — advances one
+     * shared clock, preventing two same-millisecond writes from minting identical
+     * timestamps (the second would silently lose under last-writer-wins).
+     */
+    hlc: HLC;
 };
 export type CreateGroupParams = {
     stores: StoreProvider;
@@ -46,8 +55,10 @@ export type InviteToGroupParams = {
 };
 export type InviteToGroupResult = {
     invite: Invite;
-    welcomeMessage: unknown;
-    commitMessage: unknown;
+    /** Framed MLSMessage(Welcome) bytes for the invitee (`@enkaku/group@0.16.1`). */
+    welcomeMessage: Uint8Array;
+    /** Framed MLSMessage(Commit) bytes to fan out to existing members. */
+    commitMessage: Uint8Array;
     /**
      * Ratchet tree from the post-commit handle. Required by `joinGroup`
      * callers that build an invite payload — they no longer hold a
@@ -76,7 +87,7 @@ export type RemoveMemberParams = {
     memberDID: string;
 };
 export type RemoveMemberResult = {
-    commitMessage: unknown;
+    commitMessage: Uint8Array;
 };
 export type RemoveGroupMemberParams = {
     stores: StoreProvider;
@@ -84,7 +95,7 @@ export type RemoveGroupMemberParams = {
     memberDID: string;
 };
 export type RemoveGroupMemberResult = {
-    commitMessage: unknown;
+    commitMessage: Uint8Array;
 };
 export type LeaveGroupParams = {
     stores: StoreProvider;

package/lib/groups/manager.js

@@ -1 +1 @@
-import{commitInvite as e,createGroup as r,createInvite as t,processWelcome as i,removeMember as a}from"@enkaku/group";import{HLC as o}from"@kubun/hlc";import{getGraphStore as s}from"@kubun/store-graph";import{getP2PStore as c}from"@kubun/store-p2p";import{bindHubToGroup as l,upsertHub as n}from"../hub/manager.js";export class GroupManager{#e;#r;#t;#i;constructor(e){this.#e=e.identity.id,this.#r=e.getRandomID,this.#t=new o({nodeID:e.identity.id}),this.#i=e.registry}async createGroup(e){let t=this.#r(),{group:i}=await r(e.identity,t),a=e.hubs??[];return await e.stores.withTransaction(async r=>{let s=await c(r);for(let c of(await s.createGroup({id:t,name:e.name,description:e.description??"",created_by:e.createdBy??e.identity.id,hlc:o.serialize(this.#t.now())}),await this.#i.seed({groupID:t,handle:i,stores:r}),await s.addGroupMember({group_id:t,member_did:e.identity.id,role:"admin"}),a)){let e=await n({stores:r,url:c.url,serverDID:c.serverDID??null});await l({stores:r,hubID:e.id,groupID:t})}}),{groupID:t}}async updateGroup(e){let r=o.serialize(this.#t.now()),t=await c(e.stores);return await t.updateGroup(e.groupID,{name:e.update.name,description:e.update.description,hlc:r}),{broadcast:{type:"group:update",groupID:e.groupID,update:{...e.update,hlc:r}}}}async inviteToGroup(r){let i=await this.#i.withHandleReplacing(r.groupID,async i=>{let{invite:a}=await t({group:i,identity:r.identity,recipientDID:r.recipientDID,permission:r.permission}),{commitMessage:o,welcomeMessage:s,newGroup:c}=await e(i,r.recipientKeyPackage);return{result:{invite:a,commitMessage:o,welcomeMessage:s,ratchetTree:c.state.ratchetTree},updated:c}},{stores:r.stores}),a=await c(r.stores);return await a.addGroupMember({group_id:r.groupID,member_did:r.recipientDID,role:"admin"===r.permission?"admin":"member"}),i}async joinGroup(e){let{group:r}=await i({identity:e.identity,invite:e.invite,welcome:e.welcomeMessage,keyPackageBundle:e.keyPackageBundle,ratchetTree:e.ratchetTree}),t=e.hubs??[];await e.stores.withTransaction(async i=>{await this.#i.seed({groupID:e.groupID,handle:r,stores:i});let a=await c(i);for(let r of(null==await a.getGroup(e.groupID)&&await a.createGroup({id:e.groupID,name:e.groupName,description:"",created_by:e.identity.id,hlc:o.serialize(this.#t.now())}),await a.addGroupMember({group_id:e.groupID,member_did:e.identity.id,role:"member"}),t)){let t=await n({stores:i,url:r.url,serverDID:r.serverDID??null});await l({stores:i,hubID:t.id,groupID:e.groupID})}})}async removeMember(e){let{commitMessage:r}=await this.#i.withHandleReplacing(e.groupID,async r=>{let{commitMessage:t,newGroup:i}=await a(r,e.leafIndex);return{result:{commitMessage:t},updated:i}},{stores:e.stores}),t=await c(e.stores);return await t.removeGroupMember(e.groupID,e.memberDID),{commitMessage:r}}async removeGroupMember(e){let{commitMessage:r}=await this.#i.withHandleReplacing(e.groupID,async r=>{let t=r.findMemberLeafIndex(e.memberDID);if(null==t)throw Error(`Member ${e.memberDID} not found in MLS group`);let{commitMessage:i,newGroup:o}=await a(r,t);return{result:{commitMessage:i},updated:o}},{stores:e.stores}),t=await c(e.stores);return await t.removeGroupMember(e.groupID,e.memberDID),{commitMessage:r}}async leaveGroup(e){let r=await c(e.stores);await r.deleteMLSState(e.groupID,this.#e),await r.removeGroupMember(e.groupID,e.identity.id),this.#i.invalidate(e.groupID)}async loadGroup(e,r){let t=await c(e),i=await t.getMLSState(r,this.#e);if(null!=i)return{epoch:i.epoch,credential:i.credential}}async createCircle(e){let r=this.#r(),t=o.serialize(this.#t.now()),i=e.catalogIDs??[],a=await c(e.stores);return await a.createCircle({id:r,group_id:e.groupID,name:e.name,description:e.description??"",catalog_ids:i,hlc:t}),{circleID:r,broadcast:{type:"circle:create",circle:{id:r,groupID:e.groupID,name:e.name,description:e.description??"",catalogIDs:i,hlc:t}}}}async updateCircle(e){let r=o.serialize(this.#t.now()),t=[],i=await c(e.stores);if(null!=e.update.catalogIDs){let r=await i.getCircle(e.circleID),a=new Set(null!=r?r.catalog_ids:[]),o=e.update.catalogIDs.filter(e=>!a.has(e)),c=await s(e.stores);for(let e of(await Promise.all(o.map(e=>c.getCatalog(e)))))null!=e&&t.push({type:"catalog:create",catalog:{id:e.id,ownerDID:e.owner_did,name:e.name,description:e.description,filterCriteria:e.filter_criteria,hlc:e.hlc}})}await i.updateCircle(e.circleID,{name:e.update.name,description:e.update.description,catalog_ids:e.update.catalogIDs,hlc:r});let a={type:"circle:update",circleID:e.circleID,update:{...e.update,hlc:r}};return{broadcast:a,broadcasts:[a,...t]}}async deleteCircle(e){let r=o.serialize(this.#t.now()),t=await c(e.stores);return await t.deleteCircle(e.circleID),{broadcast:{type:"circle:delete",circleID:e.circleID,hlc:r}}}async addCircleMember(e){let r=await c(e.stores);if(!await r.isGroupMember(e.groupID,e.memberDID))throw Error(`${e.memberDID} is not a member of group ${e.groupID}`);let t=o.serialize(this.#t.now());return await r.addCircleMember({circle_id:e.circleID,member_did:e.memberDID,role:e.role,hlc:t}),{broadcast:{type:"member:add",member:{circleID:e.circleID,memberDID:e.memberDID,role:e.role,hlc:t}}}}async removeCircleMember(e){let r=o.serialize(this.#t.now()),t=await c(e.stores);return await t.removeCircleMember(e.circleID,e.memberDID),{broadcast:{type:"member:remove",circleID:e.circleID,memberDID:e.memberDID,hlc:r}}}}
+import{commitInvite as e,createGroup as r,createInvite as t,processWelcome as i,removeMember as a}from"@enkaku/group";import{HLC as o}from"@kubun/hlc";import{getGraphStore as s}from"@kubun/store-graph";import{getP2PStore as l}from"@kubun/store-p2p";import{bindHubToGroup as c,upsertHub as n}from"../hub/manager.js";export class GroupManager{#e;#r;#t;#i;constructor(e){this.#e=e.identity.id,this.#r=e.getRandomID,this.#t=e.hlc,this.#i=e.registry}async createGroup(e){let t=this.#r(),{group:i}=await r(e.identity,t),a=e.hubs??[];return await e.stores.withTransaction(async r=>{let s=await l(r);for(let l of(await s.createGroup({id:t,name:e.name,description:e.description??"",created_by:e.createdBy??e.identity.id,hlc:o.serialize(this.#t.now())}),await this.#i.seed({groupID:t,handle:i,stores:r}),await s.addGroupMember({group_id:t,member_did:e.identity.id,role:"admin",hlc:o.serialize(this.#t.now())}),a)){let e=await n({stores:r,url:l.url,serverDID:l.serverDID??null});await c({stores:r,hubID:e.id,groupID:t})}}),{groupID:t}}async updateGroup(e){let r=o.serialize(this.#t.now()),t=await l(e.stores);return await t.updateGroup(e.groupID,{name:e.update.name,description:e.update.description,hlc:r}),{broadcast:{type:"group:update",groupID:e.groupID,update:{...e.update,hlc:r}}}}async inviteToGroup(r){let i=await this.#i.withHandleReplacing(r.groupID,async i=>{let{invite:a}=await t({group:i,identity:r.identity,recipientDID:r.recipientDID,permission:r.permission}),{commitMessage:o,welcomeMessage:s,newGroup:l}=await e(i,r.recipientKeyPackage);return{result:{invite:a,commitMessage:o,welcomeMessage:s,ratchetTree:l.state.ratchetTree},updated:l}},{stores:r.stores}),a=await l(r.stores);return await a.addGroupMember({group_id:r.groupID,member_did:r.recipientDID,role:"admin"===r.permission?"admin":"member",hlc:o.serialize(this.#t.now())}),i}async joinGroup(e){let{group:r}=await i({identity:e.identity,invite:e.invite,welcome:e.welcomeMessage,keyPackageBundle:e.keyPackageBundle,ratchetTree:e.ratchetTree}),t=e.hubs??[];await e.stores.withTransaction(async i=>{await this.#i.seed({groupID:e.groupID,handle:r,stores:i});let a=await l(i);for(let r of(null==await a.getGroup(e.groupID)&&await a.createGroup({id:e.groupID,name:e.groupName,description:"",created_by:e.identity.id,hlc:o.serialize(this.#t.now())}),await a.addGroupMember({group_id:e.groupID,member_did:e.identity.id,role:"member",hlc:o.serialize(this.#t.now())}),t)){let t=await n({stores:i,url:r.url,serverDID:r.serverDID??null});await c({stores:i,hubID:t.id,groupID:e.groupID})}})}async removeMember(e){let{commitMessage:r}=await this.#i.withHandleReplacing(e.groupID,async r=>{let{commitMessage:t,newGroup:i}=await a(r,e.leafIndex);return{result:{commitMessage:t},updated:i}},{stores:e.stores}),t=await l(e.stores);return await t.removeGroupMember(e.groupID,e.memberDID,o.serialize(this.#t.now())),{commitMessage:r}}async removeGroupMember(e){let{commitMessage:r}=await this.#i.withHandleReplacing(e.groupID,async r=>{let t=r.findMemberLeafIndex(e.memberDID);if(null==t)throw Error(`Member ${e.memberDID} not found in MLS group`);let{commitMessage:i,newGroup:o}=await a(r,t);return{result:{commitMessage:i},updated:o}},{stores:e.stores}),t=await l(e.stores);return await t.removeGroupMember(e.groupID,e.memberDID,o.serialize(this.#t.now())),{commitMessage:r}}async leaveGroup(e){let r=await l(e.stores);await r.deleteMLSState(e.groupID,this.#e),await r.removeGroupMember(e.groupID,e.identity.id,o.serialize(this.#t.now())),e.stores.onCommit(()=>this.#i.invalidate(e.groupID))}async loadGroup(e,r){let t=await l(e),i=await t.getMLSState(r,this.#e);if(null!=i)return{epoch:i.epoch,credential:i.credential}}async createCircle(e){let r=this.#r(),t=o.serialize(this.#t.now()),i=e.catalogIDs??[],a=await l(e.stores);return await a.createCircle({id:r,group_id:e.groupID,name:e.name,description:e.description??"",catalog_ids:i,hlc:t}),{circleID:r,broadcast:{type:"circle:create",circle:{id:r,groupID:e.groupID,name:e.name,description:e.description??"",catalogIDs:i,hlc:t}}}}async updateCircle(e){let r=o.serialize(this.#t.now()),t=[],i=await l(e.stores);if(null!=e.update.catalogIDs){let r=await i.getCircle(e.circleID),a=new Set(null!=r?r.catalog_ids:[]),o=e.update.catalogIDs.filter(e=>!a.has(e)),l=await s(e.stores);for(let e of(await Promise.all(o.map(e=>l.getCatalog(e)))))null!=e&&t.push({type:"catalog:create",catalog:{id:e.id,ownerDID:e.owner_did,name:e.name,description:e.description,filterCriteria:e.filter_criteria,hlc:e.hlc}})}await i.updateCircle(e.circleID,{name:e.update.name,description:e.update.description,catalog_ids:e.update.catalogIDs,hlc:r});let a={type:"circle:update",circleID:e.circleID,update:{...e.update,hlc:r}};return{broadcast:a,broadcasts:[a,...t]}}async deleteCircle(e){let r=o.serialize(this.#t.now()),t=await l(e.stores);return await t.markCircleRemoved(e.circleID,r),{broadcast:{type:"circle:delete",circleID:e.circleID,hlc:r}}}async addCircleMember(e){let r=await l(e.stores);if(!await r.isGroupMember(e.groupID,e.memberDID))throw Error(`${e.memberDID} is not a member of group ${e.groupID}`);let t=o.serialize(this.#t.now());return await r.addCircleMember({circle_id:e.circleID,member_did:e.memberDID,role:e.role,hlc:t}),{broadcast:{type:"member:add",member:{circleID:e.circleID,memberDID:e.memberDID,role:e.role,hlc:t}}}}async removeCircleMember(e){let r=o.serialize(this.#t.now()),t=await l(e.stores);return await t.removeCircleMember(e.circleID,e.memberDID,r),{broadcast:{type:"member:remove",circleID:e.circleID,memberDID:e.memberDID,hlc:r}}}}

package/lib/groups/rejoin-codec.d.ts

@@ -0,0 +1,14 @@
+/** A stale device's request for a fresh GroupInfo. Cleartext on the wire. */
+export type RejoinRequest = {
+    requestID: string;
+};
+/** A current member's reply carrying a framed `MLSMessage(GroupInfo)`. */
+export type RejoinGroupInfo = {
+    requestID: string;
+    /** Framed `MLSMessage(GroupInfo)` bytes. */
+    groupInfo: Uint8Array;
+};
+export declare function encodeRejoinRequest(request: RejoinRequest): Uint8Array;
+export declare function decodeRejoinRequest(bytes: Uint8Array): RejoinRequest;
+export declare function encodeRejoinGroupInfo(message: RejoinGroupInfo): Uint8Array;
+export declare function decodeRejoinGroupInfo(bytes: Uint8Array): RejoinGroupInfo;

package/lib/groups/rejoin-codec.js

@@ -0,0 +1 @@
+import{replacer as e,reviver as r}from"./mls-json.js";let o=new TextEncoder,n=new TextDecoder;export function encodeRejoinRequest(r){return o.encode(JSON.stringify(r,e))}export function decodeRejoinRequest(e){let o=JSON.parse(n.decode(e),r);if("string"!=typeof o?.requestID)throw Error("invalid rejoin-request: missing requestID");return{requestID:o.requestID}}export function encodeRejoinGroupInfo(r){return o.encode(JSON.stringify(r,e))}export function decodeRejoinGroupInfo(e){let o=JSON.parse(n.decode(e),r);if("string"!=typeof o?.requestID)throw Error("invalid rejoin-groupinfo: missing requestID");if(!(o.groupInfo instanceof Uint8Array))throw Error("invalid rejoin-groupinfo: missing groupInfo bytes");return{requestID:o.requestID,groupInfo:o.groupInfo}}

package/lib/groups/store-received-grant.d.ts

@@ -0,0 +1,47 @@
+import type { Logger } from '@kubun/logger';
+import type { P2PStoreAPI } from '@kubun/store-p2p';
+import type { P2PEventEmitter } from './events.js';
+export type StoreReceivedGrantParams = {
+    /** P2P store the held row is written to. */
+    p2pStore: P2PStoreAPI;
+    /** Stringified capability JWT carrying the `document/write` grant. */
+    token: string;
+    /** Group the grant belongs to. */
+    groupID: string;
+    /**
+     * HLC stamped on the held row. For broadcast-delivered grants this mirrors
+     * the grantor-side issued row; for invite-delivered grants the joiner stamps
+     * its own HLC at apply time (no grantor HLC travels in the invite).
+     */
+    hlc: string;
+    /**
+     * DID of the receiving device. The grant is only stored when the token's
+     * audience (`aud`) matches this DID — co-members relay the same grant but
+     * ignore tokens addressed to someone else.
+     */
+    selfDID: string;
+    /**
+     * Optional emitter notified after a held row is successfully written.
+     * Consumers (e.g. the `ownDelegationTokenAdded` subscription) use this to
+     * surface freshly-arrived tokens to local subscribers.
+     */
+    emitter?: P2PEventEmitter;
+    /** Optional logger — warns on verification failure or missing claims. */
+    logger?: Logger;
+};
+/**
+ * Verify a received capability grant and, when it is addressed to this device,
+ * store it as a held row so the engine's auto-attach can reuse it on later
+ * mutations.
+ *
+ * Returns `true` when the held row was inserted or materially changed (LWW
+ * upsert with a newer hlc and at least one differing content field). Returns
+ * `false` when no row change occurred — verification failure, audience
+ * mismatch, missing required claims, LWW lost against an existing row, or an
+ * idempotent re-broadcast with identical content. Never throws on a forged or
+ * malformed token — it is skipped like an unverifiable broadcast entry.
+ *
+ * Shared by the `delegation:share` broadcast path and the invite-bootstrap
+ * path so both apply identical verify + audience + null-guard + coercion logic.
+ */
+export declare function storeReceivedGrant(params: StoreReceivedGrantParams): Promise<boolean>;

package/lib/groups/store-received-grant.js

@@ -0,0 +1 @@
+import{verifyToken as e}from"@enkaku/token";export async function storeReceivedGrant(i){let t,{p2pStore:a,token:n,groupID:r,hlc:o,selfDID:d,emitter:p,logger:s}=i;try{t=(await e(n)).payload}catch(e){return s?.warn("received grant token verification failed, skipping",{groupID:r,error:e}),!1}if(t.aud!==d)return!1;if(null==t.jti||null==t.exp)return s?.warn("received grant token missing jti/exp, skipping",{groupID:r}),!1;let u="string"==typeof t.res?t.res:JSON.stringify(t.res),c="string"==typeof t.act?t.act:JSON.stringify(t.act),g=await a.addDelegationToken({jti:t.jti,grantor:t.sub,audience:t.aud,token:n,resource:u,act:c,exp:t.exp,group_id:r,hlc:o});if(g){let e=await a.getPendingRevocationByJti(t.jti);if(null!=e)if(e.revoker_did===t.sub){let i=Math.floor(Date.now()/1e3);await a.markRevocationVerified(t.jti,{cap_exp:t.exp,verified_at:i})&&null!=p&&await p.emit("delegationTokenRevoked",{jti:t.jti,grantor:t.sub,audience:t.aud,revokerDID:e.revoker_did,revokedAt:e.revoked_iat,verifiedAt:i,capExp:t.exp,groupID:r})}else s?.warn("pending revocation iss does not match arriving cap, dropping",{jti:t.jti,pendingIss:e.revoker_did,capGrantor:t.sub,groupID:r}),await a.deletePendingRevocation(t.jti)}return g&&null!=p&&await p.emit("delegationTokenAdded",{jwt:n,jti:t.jti,grantor:t.sub,audience:t.aud,resource:u,exp:t.exp}),g}

package/lib/groups/store-received-revocation.d.ts

@@ -0,0 +1,46 @@
+import type { Logger } from '@kubun/logger';
+import type { P2PStoreAPI } from '@kubun/store-p2p';
+import type { P2PEventEmitter } from './events.js';
+export type StoreReceivedRevocationParams = {
+    /** P2P store the revocation row is written to. */
+    p2pStore: P2PStoreAPI;
+    /** Stringified signed revocation JWT carrying `{ jti, iss, rev, iat }`. */
+    token: string;
+    /** Group the revocation belongs to. */
+    groupID: string;
+    /** HLC stamped on the revocation row for LWW arbitration. */
+    hlc: string;
+    /**
+     * DID of the receiving device. Currently unused — revocations are
+     * audience-agnostic at store time — but accepted for symmetry with
+     * `storeReceivedGrant` and to keep call sites uniform.
+     */
+    selfDID?: string;
+    /**
+     * Optional emitter passed through for symmetry with `storeReceivedGrant`.
+     * This helper does not emit; downstream subscription wiring lives elsewhere.
+     */
+    emitter?: P2PEventEmitter;
+    /** Optional logger — debug on verification failure or malformed payload, warn on iss/grantor mismatch. */
+    logger?: Logger;
+};
+/**
+ * Verify a received revocation token and write its row to the P2P store.
+ *
+ * Verified-on-arrival: when the referenced capability is already known
+ * locally and the revocation's `iss` matches that capability's `grantor`,
+ * the row is stored with `verified_at` populated so the hot-path
+ * `isRevoked` gate fires immediately. When the capability is unknown
+ * locally, the row is stored as pending (`verified_at` null) until a later
+ * `delegation:share` triggers a cross-check that flips it via
+ * `markRevocationVerified`. A signature-verified token whose `iss` does
+ * not match a known capability's `grantor` is rejected outright — a forged
+ * revocation must not pollute the local store.
+ *
+ * Returns `true` when the row was inserted or materially changed (LWW
+ * upsert). Returns `false` on verification failure, non-revocation
+ * payload, iss/grantor mismatch, or a lost/idempotent LWW upsert. Never
+ * throws on a forged or malformed token — it is skipped like an
+ * unverifiable broadcast entry.
+ */
+export declare function storeReceivedRevocation(params: StoreReceivedRevocationParams): Promise<boolean>;

package/lib/groups/store-received-revocation.js

@@ -0,0 +1 @@
+import{verifyToken as e}from"@enkaku/token";export async function storeReceivedRevocation(o){let r,{p2pStore:t,token:n,groupID:i,hlc:a,emitter:c,logger:d}=o;try{r=(await e(n)).payload}catch(e){return d?.debug("received revocation token verification failed, skipping",{groupID:i,error:e}),!1}if(!0!==r.rev)return d?.debug("received revocation token is not a revocation record, skipping",{groupID:i}),!1;let{jti:l,iss:v,iat:k}=r,u=await t.getDelegationTokenByJti(l),g=null,p=null;if(null!=u){if(u.grantor!==v)return d?.warn("received revocation iss does not match known capability grantor, skipping",{groupID:i,jti:l,iss:v,grantor:u.grantor}),!1;g=Math.floor(Date.now()/1e3),p=u.exp}let f=await t.addRevocation({jti:l,revoker_did:v,revoked_iat:k,revocation_token:n,verified_at:g,cap_exp:p,group_id:i,hlc:a});return f&&null!=g&&null!=u&&null!=c&&await c.emit("delegationTokenRevoked",{jti:l,grantor:u.grantor,audience:u.audience,revokerDID:v,revokedAt:k,verifiedAt:g,capExp:p,groupID:i}),f}

package/lib/groups/wire-frame.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Outer wire-frame discriminator for group hub payloads.
+ *
+ * The hub relay treats a group send payload as opaque bytes. Kubun prepends a
+ * single `kind` byte so the receiver can route a payload to the right decoder
+ * without trial-decryption:
+ *
+ * - `app` — an MLS-encrypted application broadcast (`GroupBroadcastMessage`),
+ *   decoded via `handle.decrypt` + `deserializeBroadcast`.
+ * - `mls` — a framed MLS handshake message (a Commit), fed straight to
+ *   `handle.processMessage`. The handshake is self-protected (encrypted
+ *   `PrivateMessage`), so it is NOT wrapped in the application-encryption path.
+ *
+ * The discriminator lives entirely in kubun's payload bytes; the hub protocol
+ * is unchanged.
+ */
+export declare const WireKind: {
+    readonly app: 0;
+    readonly mls: 1;
+    readonly rejoinRequest: 2;
+    readonly rejoinGroupInfo: 3;
+};
+export type WireKind = (typeof WireKind)[keyof typeof WireKind];
+/** Prepend the `kind` byte to a payload. */
+export declare function frameWire(kind: WireKind, payload: Uint8Array): Uint8Array;
+/**
+ * Split a framed payload into its `kind` and the remaining payload bytes.
+ * Throws on an empty frame or an unrecognized `kind` byte. The returned
+ * payload is a view (`subarray`) over the input, not a copy.
+ */
+export declare function unframeWire(framed: Uint8Array): {
+    kind: WireKind;
+    payload: Uint8Array;
+};

package/lib/groups/wire-frame.js

@@ -0,0 +1 @@
+export const WireKind={app:0,mls:1,rejoinRequest:2,rejoinGroupInfo:3};let r=new Set(Object.values(WireKind));export function frameWire(r,e){let n=new Uint8Array(e.length+1);return n[0]=r,n.set(e,1),n}export function unframeWire(e){if(0===e.length)throw Error("empty wire frame");let n=e[0];if(!r.has(n))throw Error(`unknown wire frame kind: ${n}`);return{kind:n,payload:e.subarray(1)}}

package/lib/hub/circle-catchup-requester.d.ts

@@ -0,0 +1,58 @@
+import type { Logger } from '@kubun/logger';
+import type { GroupBroadcastMessage } from '../groups/broadcast.js';
+/** The reply payload a current member sends back, correlated by `requestID`. */
+type CatchupReply = Extract<GroupBroadcastMessage, {
+    type: 'circle-catchup:reply';
+}>;
+export type CircleCatchupRequesterParams = {
+    groupID: string;
+    /** Fresh correlation id per request (incl. retries). */
+    genRequestID: () => string;
+    /** Broadcast a `circle-catchup:request` on the group channel. */
+    sendRequest: (requestID: string) => Promise<void>;
+    /**
+     * Apply a received reply batch row-by-row (idempotent, order-independent).
+     * Mirrors `applyCatchupReply` bound to the local store/engine context.
+     */
+    applyReply: (reply: CatchupReply) => Promise<void>;
+    requestTimeoutMs?: number;
+    maxAttempts?: number;
+    backoffMs?: (attempt: number) => number;
+    logger?: Logger;
+};
+/**
+ * Drives a rejoining device's circle/member catch-up for one group: broadcast a
+ * `circle-catchup:request`, await the first matching `circle-catchup:reply`
+ * (correlated by `requestID`) within a timeout, apply it, done. On timeout,
+ * retry with a capped full-jitter backoff up to `maxAttempts`.
+ *
+ * Mirrors the rejoin manager's request/await/retry shape, minus any MLS
+ * join/confirm — there is no Commit to broadcast and no head to confirm against,
+ * because `applyReply` is idempotent and order-independent: one good reply
+ * lands the snapshot, and a duplicate or late reply is a harmless no-op.
+ *
+ * Exhaustion is NON-FATAL: a device that never hears back simply keeps the
+ * state it has; it resolves without throwing.
+ */
+export declare class CircleCatchupRequester {
+    #private;
+    constructor(params: CircleCatchupRequesterParams);
+    get inFlight(): boolean;
+    /**
+     * Route a received `circle-catchup:reply`: resolve the matching in-flight
+     * waiter. Unknown `requestID`s (peers' requests, stale or duplicate replies
+     * for an already-resolved attempt) are ignored — harmless.
+     */
+    onCatchupReply(requestID: string, reply: CatchupReply): void;
+    /**
+     * Run the catch-up flow. Idempotent: a concurrent call while one is in flight
+     * shares the existing run's promise rather than starting a second.
+     */
+    run(): Promise<void>;
+    /**
+     * Stop a running catch-up and release timers. Idempotent; the loop checks
+     * `#disposed` between attempts, pending waiters resolve `null`. On channel close.
+     */
+    dispose(): void;
+}
+export {};

package/lib/hub/circle-catchup-requester.js

@@ -0,0 +1 @@
+import{sleep as e,unref as t}from"../utils.js";export class CircleCatchupRequester{#e;#t;#s;#i;#r;#l;#a;#u;#n=new Map;#o=null;#h=!1;constructor(e){this.#e=e.groupID,this.#t=e.genRequestID,this.#s=e.sendRequest,this.#i=e.applyReply,this.#r=e.requestTimeoutMs??5e3,this.#l=e.maxAttempts??8,this.#a=e.backoffMs??s,this.#u=e.logger}get inFlight(){return null!=this.#o}onCatchupReply(e,t){let s=this.#n.get(e);null!=s&&(this.#n.delete(e),s.resolve(t))}run(){if(null!=this.#o)return this.#o;let e=this.#p().finally(()=>{this.#o=null});return this.#o=e,e}async #p(){for(let t=0;t<this.#l&&!this.#h;t++){if(t>0&&(await e(this.#a(t)),this.#h))return;let s=await this.#c(this.#r);if(null!=s)try{await this.#i(s);return}catch(e){this.#u?.warn("circle catch-up: applying reply failed",{groupID:this.#e,error:e})}}this.#h||this.#u?.warn("circle catch-up: no usable reply, giving up",{groupID:this.#e,attempts:this.#l})}async #c(e){let t=this.#t(),s=this.#g(t,e);try{await this.#s(t)}catch(e){return this.#m(t),this.#u?.warn("circle catch-up: request send failed",{groupID:this.#e,error:e}),null}return s}#g(e,s){return new Promise(i=>{let r=setTimeout(()=>{this.#n.delete(e),i(null)},s);t(r),this.#n.set(e,{resolve:e=>{clearTimeout(r),i(e)},cancel:()=>{clearTimeout(r),i(null)}})})}#m(e){let t=this.#n.get(e);null!=t&&(this.#n.delete(e),t.cancel())}dispose(){for(let e of(this.#h=!0,this.#n.values()))e.cancel();this.#n.clear()}}function s(e){return Math.floor(Math.random()*Math.min(500*2**(e-1),5e3))}

package/lib/hub/circle-catchup-responder.d.ts

@@ -0,0 +1,50 @@
+import type { Logger } from '@kubun/logger';
+import type { Circle, CircleMember } from '@kubun/store-p2p';
+import type { CircleMemberSnapshot, CircleSnapshot } from '../groups/broadcast.js';
+/**
+ * Reads the group's circles + circle members from the store. Mirrors the
+ * `listCirclesByGroup` / `listCircleMembers` store API, both returning
+ * tombstoned rows when `includeRemoved` is set so the snapshot can carry
+ * removed entries.
+ */
+export type CircleCatchupStoreReader = {
+    listCirclesByGroup: (groupID: string, options?: {
+        includeRemoved?: boolean;
+    }) => Promise<Array<Circle>>;
+    listCircleMembers: (circleID: string, options?: {
+        includeRemoved?: boolean;
+    }) => Promise<Array<CircleMember>>;
+};
+export type CircleCatchupResponderParams = {
+    groupID: string;
+    /** Reads the group's circle + circle-member rows (including tombstoned). */
+    store: CircleCatchupStoreReader;
+    /** Broadcast a `circle-catchup:reply` to the group channel. */
+    sendCatchupReply: (requestID: string, circles: Array<CircleSnapshot>, circleMembers: Array<CircleMemberSnapshot>) => Promise<void>;
+    /** Jitter delay (ms) before replying. Defaults to a random 0..250ms. */
+    nextJitterMs?: () => number;
+    /** How long a `requestID` stays suppressed after being answered. */
+    suppressTTLMs?: number;
+    logger?: Logger;
+};
+/**
+ * Answers `circle-catchup:request`s with one batched snapshot of the group's
+ * circle + circle-member rows (including tombstoned, each carrying its authored
+ * HLC). Every current member could reply, so jitter (random pre-reply delay) +
+ * suppression (cancel on seeing a peer's reply for the same `requestID`)
+ * collapse the storm to ~1 reply. Keyed on `requestID` (fresh per attempt);
+ * suppression entries TTL out to bound memory.
+ *
+ * Mirrors the rejoin responder's storm-collapse shape; suppression collapses
+ * only duplicates of one `requestID`, so distinct `requestID`s still draw one
+ * reply each.
+ */
+export declare class CircleCatchupResponder {
+    #private;
+    constructor(params: CircleCatchupResponderParams);
+    /** Handle an inbound `circle-catchup:request`: schedule a jittered, suppressible reply. */
+    onCatchupRequest(requestID: string): void;
+    /** Handle an observed `circle-catchup:reply` (own or peer's): suppress this request. */
+    onCatchupReplySeen(requestID: string): void;
+    dispose(): void;
+}

package/lib/hub/circle-catchup-responder.js

@@ -0,0 +1 @@
+import{unref as e}from"../utils.js";function s(e){return{id:e.id,groupID:e.group_id,name:e.name,description:e.description,catalogIDs:e.catalog_ids,hlc:e.hlc,removedAtHLC:e.removed_at_hlc??null}}export class CircleCatchupResponder{#e;#s;#t;#r;#i;#p;#o=new Map;#l=new Map;constructor(e){this.#e=e.groupID,this.#s=e.store,this.#t=e.sendCatchupReply,this.#r=e.nextJitterMs??(()=>Math.floor(250*Math.random())),this.#i=e.suppressTTLMs??5e3,this.#p=e.logger}onCatchupRequest(s){if(this.#l.has(s)||this.#o.has(s))return;let t=setTimeout(()=>{this.#o.delete(s),this.#h(s)},this.#r());e(t),this.#o.set(s,t)}onCatchupReplySeen(e){let s=this.#o.get(e);null!=s&&(clearTimeout(s),this.#o.delete(e)),this.#n(e)}dispose(){for(let e of this.#o.values())clearTimeout(e);for(let e of(this.#o.clear(),this.#l.values()))clearTimeout(e);this.#l.clear()}async #h(e){if(!this.#l.has(e)){this.#n(e);try{let{circles:s,circleMembers:t}=await this.#u();await this.#t(e,s,t)}catch(s){this.#p?.warn("circle catch-up responder failed to reply",{groupID:this.#e,requestID:e,error:s})}}}async #u(){let e=await this.#s.listCirclesByGroup(this.#e,{includeRemoved:!0}),t=e.map(s),r=[];for(let s of e)for(let e of(await this.#s.listCircleMembers(s.id,{includeRemoved:!0})))r.push({circleID:e.circle_id,memberDID:e.member_did,role:e.role,hlc:e.hlc,removedAtHLC:e.removed_at_hlc??null});return{circles:t,circleMembers:r}}#n(s){let t=this.#l.get(s);null!=t&&clearTimeout(t);let r=setTimeout(()=>{this.#l.delete(s)},this.#i);e(r),this.#l.set(s,r)}}

package/lib/hub/epoch-stale-detector.d.ts

@@ -0,0 +1,18 @@
+import type { GroupHealthMonitor } from '../groups/group-health-monitor.js';
+import type { ReceiveOutcome } from './receive-handler.js';
+export type EpochStaleDetectorParams = {
+    groupID: string;
+    monitor: GroupHealthMonitor;
+};
+/**
+ * Maps a group's receive outcomes to `epoch-stale` signals (one per group):
+ * `applied` → reset; `decrypt-failed` → signal; `commit-out-of-order` → signal
+ * only on a REPEAT `sequenceID` (first sighting is normal replay; a repeat means
+ * the gap-filling Commit was GC'd at the hub and never arrives); else no signal.
+ * The seen-set grows only while stuck and clears on the next `applied`.
+ */
+export declare class EpochStaleDetector {
+    #private;
+    constructor(params: EpochStaleDetectorParams);
+    onReceiveOutcome(outcome: ReceiveOutcome, sequenceID: string): void;
+}

package/lib/hub/epoch-stale-detector.js

@@ -0,0 +1 @@
+export class EpochStaleDetector{#e;#t;#r=new Set;constructor(e){this.#e=e.groupID,this.#t=e.monitor}onReceiveOutcome(e,t){switch(e){case"applied":this.#r.clear(),this.#t.reset(this.#e,"epoch-stale");return;case"decrypt-failed":this.#t.signal(this.#e,"epoch-stale");return;case"commit-out-of-order":this.#r.has(t)?this.#t.signal(this.#e,"epoch-stale"):this.#r.add(t);return;default:return}}}

package/lib/hub/errors.d.ts

@@ -1,7 +1,8 @@
 export declare class ReconnectingError extends Error {
-    readonly hubURL: string;
-    readonly attempt: number;
+    #private;
     constructor(hubURL: string, attempt: number);
+    get hubURL(): string;
+    get attempt(): number;
 }
 /**
  * Thrown by `DIDObservingTransport.read()` when the first observed `payload.iss`
@@ -17,12 +18,13 @@ export declare class ReconnectingError extends Error {
  * message is delivered, when a row was already pinned at connect time.
  */
 export declare class HubServerDIDMismatchError extends Error {
-    readonly hubURL: string;
-    readonly expectedServerDID: string;
-    readonly observedServerDID: string;
+    #private;
     constructor(params: {
         hubURL: string;
         expectedServerDID: string;
         observedServerDID: string;
     });
+    get hubURL(): string;
+    get expectedServerDID(): string;
+    get observedServerDID(): string;
 }

package/lib/hub/errors.js

@@ -1 +1 @@
-export class ReconnectingError extends Error{hubURL;attempt;constructor(e,r){super(`broadcast wait timed out: hub ${e} reconnecting (attempt ${r})`),this.name="ReconnectingError",this.hubURL=e,this.attempt=r}}export class HubServerDIDMismatchError extends Error{hubURL;expectedServerDID;observedServerDID;constructor(e){super(`hub at ${e.hubURL} signed responses with ${e.observedServerDID}; pinned to ${e.expectedServerDID}`),this.name="HubServerDIDMismatchError",this.hubURL=e.hubURL,this.expectedServerDID=e.expectedServerDID,this.observedServerDID=e.observedServerDID}}
+export class ReconnectingError extends Error{#e;#r;constructor(e,r){super(`broadcast wait timed out: hub ${e} reconnecting (attempt ${r})`),this.name="ReconnectingError",this.#e=e,this.#r=r}get hubURL(){return this.#e}get attempt(){return this.#r}}export class HubServerDIDMismatchError extends Error{#e;#t;#s;constructor(e){super(`hub at ${e.hubURL} signed responses with ${e.observedServerDID}; pinned to ${e.expectedServerDID}`),this.name="HubServerDIDMismatchError",this.#e=e.hubURL,this.#t=e.expectedServerDID,this.#s=e.observedServerDID}get hubURL(){return this.#e}get expectedServerDID(){return this.#t}get observedServerDID(){return this.#s}}

package/lib/hub/forward-remote-broadcast.d.ts

@@ -1,9 +1,9 @@
 import type { Logger } from '@kubun/logger';
 import type { BroadcastEvent } from '../groups/broadcast-service.js';
-import type { GroupEventEmitter } from '../groups/events.js';
+import type { P2PEventEmitter } from '../groups/events.js';
 /**
  * Map a `BroadcastEvent` from `BroadcastService` into the matching
- * `GroupEventEmitter` event.
+ * `P2PEventEmitter` event.
  *
  * - Events with `applied === false` are ignored (no state change).
  * - `catalog:*` messages are currently a no-op. Catalog send-side broadcasts
@@ -12,4 +12,4 @@ import type { GroupEventEmitter } from '../groups/events.js';
  *   captures at the appropriate moment (after-state for create / update,
  *   before-state for delete / remove).
  */
-export declare function forwardRemoteBroadcast(emitter: GroupEventEmitter, event: BroadcastEvent, logger?: Logger): Promise<void>;
+export declare function forwardRemoteBroadcast(emitter: P2PEventEmitter, event: BroadcastEvent, logger?: Logger): Promise<void>;

package/lib/hub/forward-remote-broadcast.js

@@ -1 +1 @@
-import{toISO as e}from"../context/types.js";export async function forwardRemoteBroadcast(r,t,a){if(!t.applied)return;let{message:i,affected:c}=t;if(null==c)return void a?.warn("remote broadcast applied but affected row missing",{type:i.type});switch(i.type){case"circle:create":{if("circle"!==c.kind)return;let{row:t}=c;await r.emit("circleCreated",{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at)});return}case"circle:update":{if("circle"!==c.kind)return;let{row:t}=c,a=null!=i.update.catalogIDs?"circleCatalogsChanged":"circleDataChanged";await r.emit(a,{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at),circleID:t.id});return}case"circle:delete":{if("circle"!==c.kind)return;let{row:t}=c;await r.emit("circleDeleted",{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at)});return}case"member:add":{if("member"!==c.kind)return;let{row:t}=c;await r.emit("circleMemberAdded",{circleID:t.circle_id,memberDID:t.member_did,role:t.role,createdAt:e(t.created_at)});return}case"member:remove":{if("member"!==c.kind)return;let{row:t}=c;await r.emit("circleMemberRemoved",{circleID:t.circle_id,memberDID:t.member_did,role:t.role,createdAt:e(t.created_at)});return}case"group:update":{if("group"!==c.kind)return;let{row:t}=c;await r.emit("groupDataChanged",{id:t.id,name:t.name,description:t.description,createdBy:t.created_by,createdAt:e(t.created_at),groupID:t.id});return}case"catalog:create":case"catalog:update":case"catalog:delete":return void a?.debug("catalog broadcast ignored (not yet wired)",{type:i.type})}}
+import{toISO as e}from"../context/types.js";export async function forwardRemoteBroadcast(r,t,a){if(!t.applied)return;let{message:i,affected:c}=t;if("delegation:share"!==i.type){if(null==c)return void a?.warn("remote broadcast applied but affected row missing",{type:i.type});switch(i.type){case"circle:create":{if("circle"!==c.kind)return;let{row:t}=c;await r.emit("circleCreated",{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at)});return}case"circle:update":{if("circle"!==c.kind)return;let{row:t}=c,a=null!=i.update.catalogIDs?"circleCatalogsChanged":"circleDataChanged";await r.emit(a,{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at),circleID:t.id});return}case"circle:delete":{if("circle"!==c.kind)return;let{row:t}=c;await r.emit("circleDeleted",{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at)});return}case"member:add":{if("member"!==c.kind)return;let{row:t}=c;await r.emit("circleMemberAdded",{circleID:t.circle_id,memberDID:t.member_did,role:t.role,createdAt:e(t.created_at)});return}case"member:remove":{if("member"!==c.kind)return;let{row:t}=c;await r.emit("circleMemberRemoved",{circleID:t.circle_id,memberDID:t.member_did,role:t.role,createdAt:e(t.created_at)});return}case"group:update":{if("group"!==c.kind)return;let{row:t}=c;await r.emit("groupDataChanged",{id:t.id,name:t.name,description:t.description,createdBy:t.created_by,createdAt:e(t.created_at),groupID:t.id});return}case"catalog:create":case"catalog:update":case"catalog:delete":return void a?.debug("catalog broadcast ignored (not yet wired)",{type:i.type})}}}