@wireapp/core 46.46.6-beta.14.f6fd03fe6 → 46.46.6-beta.28.9d3034481

package/lib/messagingProtocols/mls/recovery/MlsRecoveryOrchestrator.js

@@ -0,0 +1,317 @@
+"use strict";
+/*
+ * Wire
+ * Copyright (C) 2025 Wire Swiss GmbH
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see http://www.gnu.org/licenses/.
+ *
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.minimalDefaultPolicies = exports.MlsRecoveryOrchestratorImpl = exports.OperationName = exports.RecoveryActionKind = void 0;
+const commons_1 = require("@wireapp/commons");
+/**
+ * Coordinates recovery actions for MLS operations.
+ *
+ * The orchestrator takes an arbitrary async "operation" (e.g. send, add users, handle welcome),
+ * executes it, and on failure maps the thrown error to a DomainMlsError via {@link MlsErrorMapper}.
+ * A recovery policy is then resolved and executed exactly-once per unique key, with optional
+ * re-run of the original operation after recovery.
+ *
+ * Key properties:
+ * - Single-flight: duplicate recoveries (same action+conversation+group+subconv) are deduplicated.
+ * - Per-operation policies: the same DomainMlsError can map to different actions depending on operation.
+ * - Non-invasive: the orchestrator has no MLS logic; it calls provided deps to perform actions.
+ */
+/**
+ * Concrete recovery actions the orchestrator can trigger.
+ */
+var RecoveryActionKind;
+(function (RecoveryActionKind) {
+    /**
+     * Issue an external-commit join for the conversation.
+     */
+    RecoveryActionKind["JoinViaExternalCommit"] = "JoinViaExternalCommit";
+    /**
+     * Fetch missing epoch state and reconcile.
+     */
+    RecoveryActionKind["RecoverFromEpochMismatch"] = "RecoverFromEpochMismatch";
+    /**
+     * Tear down local MLS state and re-create the group.
+     */
+    RecoveryActionKind["ResetAndReestablish"] = "ResetAndReestablish";
+    /**
+     * Add users reported as missing to get the group back in sync.
+     */
+    RecoveryActionKind["AddMissingUsers"] = "AddMissingUsers";
+    /**
+     * Remove local MLS artifacts for the group and retry welcome handling.
+     */
+    RecoveryActionKind["WipeAndReprocessWelcome"] = "WipeAndReprocessWelcome";
+    /**
+     * No matching policy found; treated as no-op and the original error is re-thrown.
+     */
+    RecoveryActionKind["Unknown"] = "Unknown";
+})(RecoveryActionKind || (exports.RecoveryActionKind = RecoveryActionKind = {}));
+var OperationName;
+(function (OperationName) {
+    OperationName["send"] = "send";
+    OperationName["addUsers"] = "addUsers";
+    OperationName["removeUsers"] = "removeUsers";
+    OperationName["joinExternalCommit"] = "joinExternalCommit";
+    OperationName["handleWelcome"] = "handleWelcome";
+    OperationName["handleMessageAdd"] = "handleMessageAdd";
+    OperationName["keyMaterialUpdate"] = "keyMaterialUpdate";
+})(OperationName || (exports.OperationName = OperationName = {}));
+function isRecoveryPolicy(entry) {
+    return 'action' in entry && typeof entry.action === 'string';
+}
+/**
+ * Default implementation with in-process deduplication keyed by action and context.
+ */
+class MlsRecoveryOrchestratorImpl {
+    mapper;
+    policies;
+    deps;
+    inProgressRecoveries;
+    logger;
+    constructor(mapper, policies, deps, inProgressRecoveries = new Set(), logger = commons_1.LogFactory.getLogger('@wireapp/core/MlsRecoveryOrchestrator')) {
+        this.mapper = mapper;
+        this.policies = policies;
+        this.deps = deps;
+        this.inProgressRecoveries = inProgressRecoveries;
+        this.logger = logger;
+    }
+    async execute({ context, callBack, retry = true }) {
+        try {
+            this.logger.info('Executing MLS operation with recovery orchestration', { context });
+            return await callBack();
+        }
+        catch (rawError) {
+            this.logger.info('Operation failed, invoking MLS recovery orchestrator', { rawError });
+            const normalizedError = this.mapper.map(rawError, {
+                qualifiedConversationId: context.qualifiedConversationId,
+                groupId: context.groupId,
+                subconvId: context.subconvId,
+            });
+            this.logger.info(`Mapped error to domain MLS error of type ${normalizedError.type}`, { normalizedError });
+            const policy = this.getPolicyFor(normalizedError, context);
+            this.logger.info(`Resolved recovery policy: action=${policy.action}`, { policy });
+            if (policy.action === 'Unknown' || !retry) {
+                this.logger.info('No recovery action configured or retry disabled, re-throwing original error');
+                throw rawError;
+            }
+            const key = this.getRecoveryKey(context, policy.action);
+            await this.performRecovery(context, normalizedError, policy, key);
+            await this.maybeDelay(policy.retryConfig);
+            if (policy.retryConfig.reRunOriginalOperation) {
+                this.logger.info(`Re-running original operation after recovery for key ${key}`);
+                return this.execute({ context, callBack, retry: false });
+            }
+        }
+    }
+    /** Resolve the effective policy for the mapped error and operation. Supports per-operation policies. */
+    getPolicyFor = (err, ctx) => {
+        const entry = this.policies[err.type];
+        if (!entry) {
+            return { action: RecoveryActionKind.Unknown, retryConfig: { maxAttempts: 0 } };
+        }
+        if (isRecoveryPolicy(entry)) {
+            return entry;
+        }
+        const perOperationPolicy = entry;
+        return perOperationPolicy[ctx.operationName] ?? { action: RecoveryActionKind.Unknown, retryConfig: { maxAttempts: 0 } };
+    };
+    /**
+     * Execute the concrete recovery action once per unique recovery key. Throws if required context is missing.
+     * For WipeAndReprocessWelcome, attempts to derive groupId from either the operation context or error context.
+     */
+    async performRecovery(context, err, policy, recoveryKey) {
+        const id = context.qualifiedConversationId;
+        if (!id) {
+            const errorMessage = `Missing conversationId for recovery action ${policy.action}`;
+            this.logger.error(errorMessage);
+            throw new Error(errorMessage);
+        }
+        switch (policy.action) {
+            case 'RecoverFromEpochMismatch': {
+                await this.runOnceWithKey(recoveryKey, () => this.deps.recoverFromEpochMismatch(id, context.subconvId));
+                break;
+            }
+            case 'JoinViaExternalCommit': {
+                await this.runOnceWithKey(recoveryKey, () => this.deps.joinViaExternalCommit(id));
+                break;
+            }
+            case 'ResetAndReestablish': {
+                await this.runOnceWithKey(recoveryKey, () => this.deps.resetAndReestablish(id));
+                break;
+            }
+            case 'AddMissingUsers': {
+                const groupId = context.groupId;
+                const missing = err.context?.missingUsers;
+                if (!missing || missing.length === 0) {
+                    throw new Error('No missing users reported in error context for AddMissingUsers');
+                }
+                if (!groupId) {
+                    throw new Error('Missing groupId for AddMissingUsers');
+                }
+                await this.runOnceWithKey(recoveryKey, () => this.deps.addMissingUsers(id, groupId, missing));
+                break;
+            }
+            case 'WipeAndReprocessWelcome': {
+                // We rely on either the operation context groupId (preferred) or any mapped error context
+                const groupId = context.groupId ?? err.context?.groupId;
+                if (!groupId) {
+                    this.logger.warn('Could not determine groupId for WipeAndReprocessWelcome; skipping wipe');
+                    break;
+                }
+                await this.runOnceWithKey(recoveryKey, () => this.deps.wipeMLSConversation(groupId));
+                break;
+            }
+            default:
+                this.logger.info(`No recovery action taken for action ${policy.action}`);
+                break;
+        }
+    }
+    /**
+     * Build a stable deduplication key from action and operation context.
+     */
+    getRecoveryKey(context, action) {
+        const conv = context.qualifiedConversationId?.id ?? 'unknownConv';
+        const group = context.groupId ?? 'unknownGroup';
+        const sub = context.subconvId ?? 'none';
+        const key = `${action}:${conv}:${group}:${String(sub)}`;
+        this.logger.info(`Generated recovery key: ${key} for action ${action} with context`, { context });
+        return key;
+    }
+    /**
+     * Ensure the provided async task runs at most once for the given key at a time.
+     */
+    runOnceWithKey = async (key, task) => {
+        if (this.inProgressRecoveries.has(key)) {
+            this.logger.info(`Recovery already in progress for key ${key}, skipping duplicate recovery`);
+            return;
+        }
+        this.logger.info(`Starting recovery for key ${key}`);
+        this.inProgressRecoveries.add(key);
+        try {
+            await task();
+        }
+        catch (error) {
+            this.logger.warn(`Recovery failed for key ${key}`, { error });
+            throw error;
+        }
+        finally {
+            this.logger.info(`Completed recovery for key ${key}`);
+            this.inProgressRecoveries.delete(key);
+        }
+    };
+    /** Optionally wait before re-invoking the original operation. */
+    async maybeDelay(retry) {
+        if (retry.delayMs) {
+            this.logger.info(`Waiting for ${retry.delayMs}ms before retrying original operation`);
+            await this.sleep(retry.delayMs);
+        }
+    }
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+}
+exports.MlsRecoveryOrchestratorImpl = MlsRecoveryOrchestratorImpl;
+/**
+ * Minimal default policies used by the initial integration. These can be extended over time.
+ *
+ * Highlights:
+ * - WrongEpoch: reconcile and retry for typed ops; do not re-run for join.
+ * - GroupNotEstablished: reset and re-establish; typed ops re-run once.
+ * - GroupOutOfSync: add missing users and retry for typed ops.
+ * - ConversationAlreadyExists (welcome): wipe local MLS state and re-run welcome once.
+ * - OrphanWelcome (welcome): attempt join via external commit; do not re-run.
+ */
+exports.minimalDefaultPolicies = {
+    WrongEpoch: {
+        // For join operations, recover from epoch mismatch; do not re-run original op
+        joinExternalCommit: {
+            action: RecoveryActionKind.RecoverFromEpochMismatch,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: false },
+        },
+        // For non-join operations, recover from epoch mismatch and retry original once
+        send: {
+            action: RecoveryActionKind.RecoverFromEpochMismatch,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+        },
+        addUsers: {
+            action: RecoveryActionKind.RecoverFromEpochMismatch,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+        },
+        removeUsers: {
+            action: RecoveryActionKind.RecoverFromEpochMismatch,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+        },
+        // For inbound message-add processing, fix epoch and allow normal flow to progress (no auto re-run)
+        handleMessageAdd: {
+            action: RecoveryActionKind.RecoverFromEpochMismatch,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+        },
+        keyMaterialUpdate: {
+            action: RecoveryActionKind.RecoverFromEpochMismatch,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: false },
+        },
+    },
+    // Use per-operation semantics so typed operations re-run once post-recovery
+    GroupNotEstablished: {
+        joinExternalCommit: {
+            action: RecoveryActionKind.ResetAndReestablish,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: false },
+        },
+        send: { action: RecoveryActionKind.ResetAndReestablish, retryConfig: { maxAttempts: 1, reRunOriginalOperation: true } },
+        addUsers: {
+            action: RecoveryActionKind.ResetAndReestablish,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+        },
+        removeUsers: {
+            action: RecoveryActionKind.ResetAndReestablish,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+        },
+        keyMaterialUpdate: {
+            action: RecoveryActionKind.ResetAndReestablish,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: false },
+        },
+    },
+    GroupOutOfSync: {
+        send: { action: RecoveryActionKind.AddMissingUsers, retryConfig: { maxAttempts: 1, reRunOriginalOperation: true } },
+        addUsers: { action: RecoveryActionKind.AddMissingUsers, retryConfig: { maxAttempts: 1, reRunOriginalOperation: true } },
+        removeUsers: {
+            action: RecoveryActionKind.AddMissingUsers,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+        },
+        keyMaterialUpdate: {
+            action: RecoveryActionKind.AddMissingUsers,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: false },
+        },
+    },
+    ConversationAlreadyExists: {
+        // For welcome handling, wipe local state; do not auto re-run the original callback
+        handleWelcome: {
+            action: RecoveryActionKind.WipeAndReprocessWelcome,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+        },
+    },
+    OrphanWelcome: {
+        // For orphan welcome, attempt an external commit join; no auto re-run
+        handleWelcome: {
+            action: RecoveryActionKind.JoinViaExternalCommit,
+            retryConfig: { maxAttempts: 1, reRunOriginalOperation: false },
+        },
+    },
+};

package/lib/messagingProtocols/mls/recovery/MlsRecoveryOrchestrator.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=MlsRecoveryOrchestrator.test.d.ts.map

package/lib/messagingProtocols/mls/recovery/MlsRecoveryOrchestrator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MlsRecoveryOrchestrator.test.d.ts","sourceRoot":"","sources":["../../../../src/messagingProtocols/mls/recovery/MlsRecoveryOrchestrator.test.ts"],"names":[],"mappings":""}

package/lib/messagingProtocols/mls/recovery/MlsRecoveryOrchestrator.test.js

@@ -0,0 +1,248 @@
+"use strict";
+/*
+ * Wire
+ * Copyright (C) 2025 Wire Swiss GmbH
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see http://www.gnu.org/licenses/.
+ *
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const conversation_1 = require("@wireapp/api-client/lib/conversation");
+const MlsRecoveryOrchestrator_1 = require("./MlsRecoveryOrchestrator");
+function qid(id = 'conv-1') {
+    return { id, domain: 'wire.test' };
+}
+function makeMapperReturning(err) {
+    return { map: jest.fn().mockReturnValue(err) };
+}
+describe('MlsRecoveryOrchestrator', () => {
+    const baseDeps = () => ({
+        joinViaExternalCommit: jest.fn().mockResolvedValue(undefined),
+        resetAndReestablish: jest.fn().mockResolvedValue(undefined),
+        recoverFromEpochMismatch: jest.fn().mockResolvedValue(undefined),
+        addMissingUsers: jest.fn().mockResolvedValue(undefined),
+        wipeMLSConversation: jest.fn().mockResolvedValue(undefined),
+    });
+    it('does nothing when callback succeeds', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'Unknown' });
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, MlsRecoveryOrchestrator_1.minimalDefaultPolicies, deps);
+        const cb = jest.fn().mockResolvedValue('ok');
+        const res = await orch.execute({
+            context: { operationName: MlsRecoveryOrchestrator_1.OperationName.send, qualifiedConversationId: qid() },
+            callBack: cb,
+        });
+        expect(res).toBe('ok');
+        expect(cb).toHaveBeenCalledTimes(1);
+        expect(deps.joinViaExternalCommit).not.toHaveBeenCalled();
+        expect(deps.wipeMLSConversation).not.toHaveBeenCalled();
+    });
+    it('retries original when policy requests reRunOriginalOperation (WrongEpoch/send)', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'WrongEpoch' });
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, MlsRecoveryOrchestrator_1.minimalDefaultPolicies, deps);
+        const cb = jest.fn().mockRejectedValueOnce(new Error('boom')).mockResolvedValueOnce('ok');
+        const res = await orch.execute({
+            context: {
+                operationName: MlsRecoveryOrchestrator_1.OperationName.send,
+                qualifiedConversationId: qid(),
+                subconvId: conversation_1.SUBCONVERSATION_ID.CONFERENCE,
+            },
+            callBack: cb,
+        });
+        expect(deps.recoverFromEpochMismatch).toHaveBeenCalledWith(qid(), conversation_1.SUBCONVERSATION_ID.CONFERENCE);
+        expect(cb).toHaveBeenCalledTimes(2);
+        expect(res).toBe('ok');
+    });
+    it('handles JoinViaExternalCommit without re-running original (OrphanWelcome/handleWelcome)', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'OrphanWelcome' });
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, MlsRecoveryOrchestrator_1.minimalDefaultPolicies, deps);
+        const cb = jest.fn().mockRejectedValue(new Error('orphan'));
+        const res = await orch.execute({
+            context: { operationName: MlsRecoveryOrchestrator_1.OperationName.handleWelcome, qualifiedConversationId: qid() },
+            callBack: cb,
+        });
+        expect(deps.joinViaExternalCommit).toHaveBeenCalledWith(qid());
+        expect(cb).toHaveBeenCalledTimes(1);
+        expect(res).toBeUndefined();
+    });
+    it('wipes group using context groupId when ConversationAlreadyExists and retries once', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'ConversationAlreadyExists' });
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, MlsRecoveryOrchestrator_1.minimalDefaultPolicies, deps);
+        const cb = jest.fn().mockRejectedValueOnce('exists').mockResolvedValueOnce(undefined);
+        await orch.execute({
+            context: {
+                operationName: MlsRecoveryOrchestrator_1.OperationName.handleWelcome,
+                qualifiedConversationId: qid(),
+                groupId: 'gid-from-context',
+            },
+            callBack: cb,
+        });
+        expect(deps.wipeMLSConversation).toHaveBeenCalledTimes(1);
+        expect(deps.wipeMLSConversation).toHaveBeenCalledWith('gid-from-context');
+        expect(cb).toHaveBeenCalledTimes(2);
+    });
+    it('wipes group using mapped error groupId when missing in context', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({
+            type: 'ConversationAlreadyExists',
+            context: { groupId: 'gid-from-error' },
+        });
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, MlsRecoveryOrchestrator_1.minimalDefaultPolicies, deps);
+        const cb = jest.fn().mockRejectedValueOnce('exists').mockResolvedValueOnce(undefined);
+        await orch.execute({
+            context: { operationName: MlsRecoveryOrchestrator_1.OperationName.handleWelcome, qualifiedConversationId: qid() },
+            callBack: cb,
+        });
+        expect(deps.wipeMLSConversation).toHaveBeenCalledWith('gid-from-error');
+        expect(cb).toHaveBeenCalledTimes(2);
+    });
+    it('throws if AddMissingUsers missing required inputs', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'GroupOutOfSync', context: { missingUsers: [] } });
+        const policies = {
+            GroupOutOfSync: {
+                action: MlsRecoveryOrchestrator_1.RecoveryActionKind.AddMissingUsers,
+                retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+            },
+        };
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, policies, deps);
+        const cb = jest.fn().mockRejectedValueOnce('oops');
+        await expect(orch.execute({
+            context: { operationName: MlsRecoveryOrchestrator_1.OperationName.send, qualifiedConversationId: qid(), groupId: 'gid' },
+            callBack: cb,
+        })).rejects.toThrow('No missing users reported in error context for AddMissingUsers');
+    });
+    it('calls AddMissingUsers with provided missing users and retries', async () => {
+        const deps = baseDeps();
+        const missing = [qid('u1'), qid('u2')];
+        const mapper = makeMapperReturning({ type: 'GroupOutOfSync', context: { missingUsers: missing } });
+        const policies = {
+            GroupOutOfSync: {
+                action: MlsRecoveryOrchestrator_1.RecoveryActionKind.AddMissingUsers,
+                retryConfig: { maxAttempts: 1, reRunOriginalOperation: true },
+            },
+        };
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, policies, deps);
+        const cb = jest.fn().mockRejectedValueOnce('oops').mockResolvedValueOnce('ok');
+        const res = await orch.execute({
+            context: { operationName: MlsRecoveryOrchestrator_1.OperationName.send, qualifiedConversationId: qid(), groupId: 'gid' },
+            callBack: cb,
+        });
+        expect(deps.addMissingUsers).toHaveBeenCalledWith(qid(), 'gid', missing);
+        expect(cb).toHaveBeenCalledTimes(2);
+        expect(res).toBe('ok');
+    });
+    it('rethrows when action is Unknown', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'ConversationAlreadyExists' });
+        const policies = {
+            ConversationAlreadyExists: { action: MlsRecoveryOrchestrator_1.RecoveryActionKind.Unknown, retryConfig: { maxAttempts: 0 } },
+        };
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, policies, deps);
+        const cb = jest.fn().mockRejectedValue(new Error('problem'));
+        await expect(orch.execute({
+            context: { operationName: MlsRecoveryOrchestrator_1.OperationName.handleWelcome, qualifiedConversationId: qid() },
+            callBack: cb,
+        })).rejects.toThrow('problem');
+    });
+    it('deduplicates concurrent recoveries for the same key', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'OrphanWelcome' });
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, MlsRecoveryOrchestrator_1.minimalDefaultPolicies, deps);
+        // Simulate slow recovery function to keep the window open
+        let resolveJoin = () => { };
+        const joinPromise = new Promise(resolve => {
+            resolveJoin = resolve;
+        });
+        deps.joinViaExternalCommit.mockImplementation(() => joinPromise);
+        const ctx = {
+            operationName: MlsRecoveryOrchestrator_1.OperationName.handleWelcome,
+            qualifiedConversationId: qid('same'),
+        };
+        const callBack = () => Promise.reject(new Error('orphan'));
+        const p1 = orch.execute({ context: ctx, callBack });
+        const p2 = orch.execute({ context: ctx, callBack });
+        // Let both catch handlers run and start recovery
+        await new Promise(r => setImmediate(r));
+        // Release the recovery
+        resolveJoin();
+        await Promise.all([p1, p2]);
+        expect(deps.joinViaExternalCommit).toHaveBeenCalledTimes(1);
+    });
+    it('waits delayMs before re-running original operation', async () => {
+        jest.useFakeTimers({ advanceTimers: true });
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'WrongEpoch' });
+        const policies = {
+            WrongEpoch: {
+                send: {
+                    action: 'RecoverFromEpochMismatch',
+                    retryConfig: { maxAttempts: 1, reRunOriginalOperation: true, delayMs: 50 },
+                },
+            },
+        };
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, policies, deps);
+        const cb = jest.fn().mockRejectedValueOnce(new Error('boom')).mockResolvedValueOnce('ok');
+        const runPromise = orch.execute({
+            context: {
+                operationName: MlsRecoveryOrchestrator_1.OperationName.send,
+                qualifiedConversationId: qid(),
+                subconvId: conversation_1.SUBCONVERSATION_ID.CONFERENCE,
+            },
+            callBack: cb,
+        });
+        // Flush any microtasks from initial rejection handling
+        await Promise.resolve();
+        expect(cb).toHaveBeenCalledTimes(1);
+        expect(deps.recoverFromEpochMismatch).toHaveBeenCalledWith(qid(), conversation_1.SUBCONVERSATION_ID.CONFERENCE);
+        // The rerun should not happen until timers advance
+        jest.advanceTimersByTime(49);
+        await Promise.resolve();
+        expect(cb).toHaveBeenCalledTimes(1);
+        // Advance past delay and await completion
+        jest.advanceTimersByTime(1);
+        // Drain queued timers and microtasks
+        await Promise.resolve();
+        const res = await runPromise;
+        expect(cb).toHaveBeenCalledTimes(2);
+        expect(res).toBe('ok');
+        jest.useRealTimers();
+    });
+    it('ResetAndReestablish re-runs original for add/remove operations', async () => {
+        const deps = baseDeps();
+        const mapper = makeMapperReturning({ type: 'GroupNotEstablished' });
+        const orch = new MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl(mapper, MlsRecoveryOrchestrator_1.minimalDefaultPolicies, deps);
+        // addUsers path
+        const cbAdd = jest.fn().mockRejectedValueOnce(new Error('broken')).mockResolvedValueOnce('ok-add');
+        const resAdd = await orch.execute({
+            context: { operationName: MlsRecoveryOrchestrator_1.OperationName.addUsers, qualifiedConversationId: qid() },
+            callBack: cbAdd,
+        });
+        expect(deps.resetAndReestablish).toHaveBeenCalledWith(qid());
+        expect(cbAdd).toHaveBeenCalledTimes(2);
+        expect(resAdd).toBe('ok-add');
+        // removeUsers path
+        const cbRemove = jest.fn().mockRejectedValueOnce(new Error('broken')).mockResolvedValueOnce('ok-remove');
+        const resRemove = await orch.execute({
+            context: { operationName: MlsRecoveryOrchestrator_1.OperationName.removeUsers, qualifiedConversationId: qid() },
+            callBack: cbRemove,
+        });
+        expect(deps.resetAndReestablish).toHaveBeenCalledWith(qid());
+        expect(cbRemove).toHaveBeenCalledTimes(2);
+        expect(resRemove).toBe('ok-remove');
+    });
+});

package/lib/messagingProtocols/mls/recovery/index.d.ts

@@ -0,0 +1,5 @@
+export type { DomainMlsError, DomainMlsErrorType, ErrorContextInput, ErrorHandler, MlsErrorMapper, } from './MlsErrorMapper';
+export { ChainedMlsErrorMapper, createDefaultMlsErrorMapper } from './MlsErrorMapper';
+export type { RecoveryActionKind, RetryPolicy, RecoveryPolicy, PolicyTable, OperationContext, MlsRecoveryOrchestrator, OrchestratorDeps, } from './MlsRecoveryOrchestrator';
+export { MlsRecoveryOrchestratorImpl, minimalDefaultPolicies, OperationName } from './MlsRecoveryOrchestrator';
+//# sourceMappingURL=index.d.ts.map

package/lib/messagingProtocols/mls/recovery/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/messagingProtocols/mls/recovery/index.ts"],"names":[],"mappings":"AAmBA,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,YAAY,EACZ,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAC,qBAAqB,EAAE,2BAA2B,EAAC,MAAM,kBAAkB,CAAC;AACpF,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAC,2BAA2B,EAAE,sBAAsB,EAAE,aAAa,EAAC,MAAM,2BAA2B,CAAC"}

package/lib/messagingProtocols/mls/recovery/index.js

@@ -0,0 +1,28 @@
+"use strict";
+/*
+ * Wire
+ * Copyright (C) 2025 Wire Swiss GmbH
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see http://www.gnu.org/licenses/.
+ *
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OperationName = exports.minimalDefaultPolicies = exports.MlsRecoveryOrchestratorImpl = exports.createDefaultMlsErrorMapper = exports.ChainedMlsErrorMapper = void 0;
+var MlsErrorMapper_1 = require("./MlsErrorMapper");
+Object.defineProperty(exports, "ChainedMlsErrorMapper", { enumerable: true, get: function () { return MlsErrorMapper_1.ChainedMlsErrorMapper; } });
+Object.defineProperty(exports, "createDefaultMlsErrorMapper", { enumerable: true, get: function () { return MlsErrorMapper_1.createDefaultMlsErrorMapper; } });
+var MlsRecoveryOrchestrator_1 = require("./MlsRecoveryOrchestrator");
+Object.defineProperty(exports, "MlsRecoveryOrchestratorImpl", { enumerable: true, get: function () { return MlsRecoveryOrchestrator_1.MlsRecoveryOrchestratorImpl; } });
+Object.defineProperty(exports, "minimalDefaultPolicies", { enumerable: true, get: function () { return MlsRecoveryOrchestrator_1.minimalDefaultPolicies; } });
+Object.defineProperty(exports, "OperationName", { enumerable: true, get: function () { return MlsRecoveryOrchestrator_1.OperationName; } });

package/lib/messagingProtocols/mls/types.d.ts

@@ -20,12 +20,4 @@ export type HandlePendingProposalsParams = {
     delayInMs: number;
     eventTime: string;
 } & CommonMLS;
-export interface CoreCryptoConfig {
-    /**
-     * path on the public server to the core crypto wasm file.
-     * This file will be downloaded lazily when corecrypto is needed.
-     * It, thus, needs to know where, on the server, the file can be found
-     */
-    wasmFilePath: string;
-}
 //# sourceMappingURL=types.d.ts.map

package/lib/messagingProtocols/mls/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/messagingProtocols/mls/types.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAC,WAAW,EAAC,MAAM,8BAA8B,CAAC;AAEzD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,yBAAyB,EAAE,CAAC,cAAc,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACzF;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,SAAS,CAAC;AAEd,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/messagingProtocols/mls/types.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAC,WAAW,EAAC,MAAM,8BAA8B,CAAC;AAEzD,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACpD,OAAO,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,yBAAyB,EAAE,CAAC,cAAc,EAAE,WAAW,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CACzF;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,SAAS,CAAC"}

package/lib/messagingProtocols/proteus/EventHandler/events/otrMessageAdd/otrMessageAdd.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otrMessageAdd.d.ts","sourceRoot":"","sources":["../../../../../../src/messagingProtocols/proteus/EventHandler/events/otrMessageAdd/otrMessageAdd.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAC,8BAA8B,EAAC,MAAM,+BAA+B,CAAC;AAK7E,OAAO,EAAC,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAC,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAEvD,UAAU,yBAAyB;IACjC,KAAK,EAAE,8BAA8B,CAAC;IACtC,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,eAAO,MAAM,mBAAmB,+BAG7B,yBAAyB,KAAG,OAAO,CAAC,mBAAmB,CA6BzD,CAAC"}
+{"version":3,"file":"otrMessageAdd.d.ts","sourceRoot":"","sources":["../../../../../../src/messagingProtocols/proteus/EventHandler/events/otrMessageAdd/otrMessageAdd.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAC,8BAA8B,EAAC,MAAM,+BAA+B,CAAC;AAQ7E,OAAO,EAAC,mBAAmB,EAAC,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAC,cAAc,EAAC,MAAM,yBAAyB,CAAC;AAEvD,UAAU,yBAAyB;IACjC,KAAK,EAAE,8BAA8B,CAAC;IACtC,cAAc,EAAE,cAAc,CAAC;CAChC;AAID,eAAO,MAAM,mBAAmB,+BAG7B,yBAAyB,KAAG,OAAO,CAAC,mBAAmB,CAgCzD,CAAC"}