@muhkoo/connect 0.10.4-alpha.0 → 0.10.6-alpha.0

package/dist/connect.d.ts

@@ -4146,6 +4146,12 @@ declare class Space {
         data: Uint8Array;
         stat: FileStat;
     }>;
+    /** Release a file's shards (ref--) when the owner deletes or unshares it. At
+     *  zero references a shard enters a retention window, then is GC'd. Idempotent-
+     *  ish: safe to call once per manifest the owner drops. */
+    releaseFile(manifest: FileManifest): Promise<void>;
+    /** Commit/release a manifest's shards with the accelerator (metering + refcount). */
+    private commitShards;
     private fileStorage;
     /** Wire the RAW_FRAME handler that drives fan-out events. */
     private wireFanout;
@@ -4379,6 +4385,10 @@ declare class SpaceNamespace {
     private spaceCache?;
     /** Spaces built this session, by id — used to route offline send replays. */
     private readonly openSpaces;
+    /** Unique id for THIS device/session — the P2P peer identity. A user's own
+     *  devices share a member id, so the mesh MUST distinguish them by this or a
+     *  device treats its siblings' signals as its own echo and never connects. */
+    private readonly deviceId;
     constructor(deps: SpaceNamespaceDeps);
     /**
      * Create a new space: generate its keypair (public key = id), register
@@ -5392,15 +5402,20 @@ declare class PeerExchange implements PeerBlockSource {
  * to Space membership. The sender (`from`) is server-stamped and can't be
  * spoofed; the payload is opaque to the server.
  *
- * Envelopes carry a `to` (a member id, or `"*"` for discovery) so the
- * accelerator can optionally unicast peer-pair signaling instead of broadcasting
- * (a small, backward-compatible `pub` enhancement); the client filters by `to`
- * regardless.
+ * Peers are identified by a unique **peer id** (per device/connection), carried
+ * in the envelope's `from`/`to` — NOT by the server-stamped member id. This is
+ * essential: one user's own devices share a member id, so the server's `from`
+ * can't tell them apart (and would make each treat the others' signals as its
+ * own echo). We therefore route entirely on the envelope peer ids and broadcast
+ * to the whole Space, filtering client-side. The server `from` still guarantees
+ * the sender is an authenticated Space member.
  */
 declare const P2P_SUBJECT = "__p2p__";
 type SignalKind = "hello" | "bye" | "offer" | "answer" | "ice";
 interface SignalEnvelope {
-    /** Target member id, or `"*"` to broadcast (discovery / departure). */
+    /** Sender's unique PEER id (per device/connection). */
+    from: string;
+    /** Target peer id, or `"*"` to broadcast (discovery / departure). */
     to: string;
     kind: SignalKind;
     data?: unknown;
@@ -5424,7 +5439,9 @@ declare class SpaceSignaler {
     broadcast(kind: SignalKind, data?: unknown): void;
     /**
      * Subscribe to inbound signals addressed to us (or broadcast). Skips our own
-     * echoes. Returns an unsubscribe function.
+     * echoes. Returns an unsubscribe function. Routing is entirely by the envelope
+     * peer id (`env.from`/`env.to`), so a user's own devices — which share the
+     * server-stamped `e.from` — are correctly distinguished.
      */
     onSignal(cb: (from: string, kind: SignalKind, data: unknown) => void): () => void;
 }

package/dist/server/index.js

@@ -2976,7 +2976,7 @@ function base64UrlDecode(s) {
  * expect (and isn't serving a stale cached bundle). Keep this in sync with
  * `package.json` `version`.
  */
-const VERSION = "0.10.4-alpha.0";
+const VERSION = "0.10.6-alpha.0";
 
 /**
  * `HttpClient` — the one place the unified {@link Client} talks to the
@@ -7330,12 +7330,46 @@ class Space {
     }
     // -- room-scoped files (no websocket needed) -------------------------------
     async putFile(file, metadata, opts = {}) {
-        return this.fileStorage(opts.backgroundUpload)
+        const result = await this.fileStorage(opts.backgroundUpload)
             .writeFileToShards({ data: file, metadata, onProgress: opts.onProgress });
+        // Declare this manifest's shards to the accelerator: attributes the stored
+        // bytes to the owning app (so storage is never unmetered) and reference-
+        // counts the shards for GC. Public shard hashes only — the per-chunk keys
+        // stay inside the manifest, which the caller keeps in a vault/Space.
+        await this.commitShards(result.manifest, "commit");
+        return result;
     }
     async getFile(manifest) {
         return this.fileStorage().readFileFromShards(manifest);
     }
+    /** Release a file's shards (ref--) when the owner deletes or unshares it. At
+     *  zero references a shard enters a retention window, then is GC'd. Idempotent-
+     *  ish: safe to call once per manifest the owner drops. */
+    async releaseFile(manifest) {
+        await this.commitShards(manifest, "release");
+    }
+    /** Commit/release a manifest's shards with the accelerator (metering + refcount). */
+    async commitShards(manifest, action) {
+        const hashes = manifest.chunks.flatMap((c) => c.shardHashes);
+        if (hashes.length === 0)
+            return;
+        const body = JSON.stringify({ hashes, bytes: manifest.size });
+        for (let attempt = 0; attempt < 3; attempt++) {
+            try {
+                const res = await this.deps.fetch(`${this.deps.httpBaseUrl}/api/storage/${action}`, {
+                    method: "POST", headers: { "Content-Type": "application/json" }, body,
+                });
+                if (res.ok)
+                    return;
+            }
+            catch { /* retry */ }
+            await new Promise((r) => setTimeout(r, 400 * (attempt + 1)));
+        }
+        // Best-effort: a missed commit leaves the shards to orphan-GC (still not
+        // durable-unmetered long-term); a missed release just delays GC. Reconciled
+        // by the platform sweep. Don't fail the caller's write on a metering hiccup.
+        console.warn(`[muhkoo] storage ${action} did not confirm for ${hashes.length} shard(s)`);
+    }
     fileStorage(backgroundUpload = false) {
         // Global, content-addressed shard store — same store `client.storage`
         // uses, so a file shared into a channel resolves from anywhere by
@@ -8470,10 +8504,13 @@ class PeerExchange {
  * to Space membership. The sender (`from`) is server-stamped and can't be
  * spoofed; the payload is opaque to the server.
  *
- * Envelopes carry a `to` (a member id, or `"*"` for discovery) so the
- * accelerator can optionally unicast peer-pair signaling instead of broadcasting
- * (a small, backward-compatible `pub` enhancement); the client filters by `to`
- * regardless.
+ * Peers are identified by a unique **peer id** (per device/connection), carried
+ * in the envelope's `from`/`to` — NOT by the server-stamped member id. This is
+ * essential: one user's own devices share a member id, so the server's `from`
+ * can't tell them apart (and would make each treat the others' signals as its
+ * own echo). We therefore route entirely on the envelope peer ids and broadcast
+ * to the whole Space, filtering client-side. The server `from` still guarantees
+ * the sender is an authenticated Space member.
  */
 const P2P_SUBJECT = "__p2p__";
 class SpaceSignaler {
@@ -8485,11 +8522,11 @@ class SpaceSignaler {
     }
     /** Send a signal to one peer (or `"*"`). */
     send(to, kind, data) {
-        const env = { to, kind, data };
-        // Ask the server to unicast for a directed target; broadcast for "*".
-        // `to` also stays in the envelope so a broadcast-only server still works
-        // (the client filters by it).
-        this.space.sendEphemeral(P2P_SUBJECT, env, to !== "*" ? to : undefined);
+        const env = { from: this.myId, to, kind, data };
+        // Always broadcast to the Space: the server can't unicast to a specific
+        // DEVICE (a user's devices share a member id), so we route client-side on
+        // the envelope peer id. Signaling frames are tiny.
+        this.space.sendEphemeral(P2P_SUBJECT, env);
     }
     /** Announce/withdraw P2P availability to all Space members. */
     broadcast(kind, data) {
@@ -8497,18 +8534,22 @@ class SpaceSignaler {
     }
     /**
      * Subscribe to inbound signals addressed to us (or broadcast). Skips our own
-     * echoes. Returns an unsubscribe function.
+     * echoes. Returns an unsubscribe function. Routing is entirely by the envelope
+     * peer id (`env.from`/`env.to`), so a user's own devices — which share the
+     * server-stamped `e.from` — are correctly distinguished.
      */
     onSignal(cb) {
         return this.space.onEphemeral((e) => {
-            if (e.subject !== P2P_SUBJECT || e.from === this.myId)
+            if (e.subject !== P2P_SUBJECT)
                 return;
             const env = e.data;
-            if (!env || typeof env.kind !== "string")
+            if (!env || typeof env.kind !== "string" || typeof env.from !== "string")
                 return;
+            if (env.from === this.myId)
+                return; // our own device's echo
             if (env.to !== this.myId && env.to !== "*")
                 return;
-            cb(e.from, env.kind, env.data);
+            cb(env.from, env.kind, env.data);
         });
     }
 }
@@ -9285,6 +9326,10 @@ class SpaceNamespace {
     spaceCache;
     /** Spaces built this session, by id — used to route offline send replays. */
     openSpaces = new Map();
+    /** Unique id for THIS device/session — the P2P peer identity. A user's own
+     *  devices share a member id, so the mesh MUST distinguish them by this or a
+     *  device treats its siblings' signals as its own echo and never connects. */
+    deviceId = `peer-${globalThis.crypto?.randomUUID?.() ?? Math.random().toString(36).slice(2) + Math.random().toString(36).slice(2)}`;
     constructor(deps) {
         this.deps = deps;
         if (deps.offline?.enabled) {
@@ -9483,7 +9528,7 @@ class SpaceNamespace {
         if (this.deps.p2p?.enabled && isP2pCapable()) {
             space.attachPeerNetwork(new PeerNetwork({
                 space,
-                myId: memberId,
+                myId: this.deviceId, // per-device peer id, NOT the shared member id
                 workerFactory: this.deps.p2p.workerFactory,
                 iceServers: this.deps.p2p.iceServers,
                 maxPeers: this.deps.p2p.maxPeers,