hyper-proto-peer / test / membrane-projection.test.js

// Phase D slice 1 (option A): the swarm's shared __commit__ log + records project into a
// FirehoseSequencer + RepoStore that the KEYLESS membrane (atproto-bridge) consumes UNCHANGED.
// Proven deterministically (network:false): sign on the swarm → project → the firehose #commit
// verifies against the DID signing key, and getRepoFromCommit (the exact membrane read path)
// assembles a CAR whose records + data root match the swarm head.

import '../lib/bare-globals.js'
import test from 'brittle'
import crypto from 'hypercore-crypto'
import fs from 'bare-fs'
import b4a from 'b4a'
import { StateBaseV3 } from 'atproto-room/lib/state-base.js'
import { SwarmDevice } from '../lib/swarm-device.js'
import { makeAttest, makeVerifyAttest, attestDeviceChain, deviceKeetKeyPair, rootIdentityPublicKey } from 'atproto-room/lib/membership.js'
import { projectRepo, projectFirehose } from 'atproto-room/lib/serve-membrane.js'
import { openCorestore } from 'atproto-store/lib/corestore.js'
import { RepoStore } from 'atproto-store/lib/repo-store.js'
import { FirehoseSequencer } from 'atproto-store/lib/sequencer.js'
import { decodeCommitFrame } from 'atproto-store/lib/firehose.js'
import { getRepoFromCommit } from 'atproto-store/lib/read-view.js'
import { readCar, loadCommit, listRecords } from 'atproto-repo/lib/repo.js'
import { verifyCommit } from 'atproto-repo/lib/commit.js'
import { deriveAtprotoKey } from 'atproto-identity'
import { decodeDidKey } from 'atproto-identity/lib/did-key.js'

const ROOT = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
const DEVA = 'legal winner thank year wave sausage worth useful legal winner thank yellow'
const DID = 'did:plc:swarmmembrane22222222222'
const POST = 'app.bsky.feed.post'
const signKey = deriveAtprotoKey(ROOT)
const { pubkey } = decodeDidKey(signKey.didKey)
const tmp = () => { const d = '/tmp/hpp-mem-' + Math.floor(Math.random() * 1e9); fs.mkdirSync(d, { recursive: true }); return d }

test('membrane projection: swarm firehose + repo → a verified CAR via the exact membrane read path', async (t) => {
  const rootPub = await rootIdentityPublicKey(ROOT)
  const dev = await deviceKeetKeyPair(DEVA); const proof = await attestDeviceChain({ rootMnemonic: ROOT, devicePublicKey: dev.publicKey })
  const members = [{ key: b4a.toString(dev.publicKey, 'hex'), role: 1 }]
  const A = new StateBaseV3(tmp(), crypto.randomBytes(32), {
    roomSeed: crypto.randomBytes(32), encryptionKey: crypto.randomBytes(32), network: false,
    selfKey: dev.publicKey, attest: makeAttest(dev, proof), verifyAttest: makeVerifyAttest(rootPub),
    getMembers: async () => members
  })
  await A.ready(); await A.projectMembers(members)
  const device = new SwarmDevice(A, { did: DID, privateKey: signKey.privateKey, self: b4a.toString(dev.publicKey, 'hex'), firehose: true })
  t.teardown(async () => { try { await A.close() } catch {} })

  await device.putRecord(POST, '3aaa', { $type: POST, text: 'one', createdAt: '2026-07-04T00:00:00.000Z' })
  await device.putRecord(POST, '3bbb', { $type: POST, text: 'two', createdAt: '2026-07-04T00:00:01.000Z' })
  await device.claimLease()
  const head = await device.sign()
  t.ok(head && head.commitCid, 'the swarm device signed a commit + wrote a firehose entry')

  // project the shared __commit__ log + records into membrane-consumable Hypercores
  const store = openCorestore(tmp())
  const repo = await new RepoStore(store, { name: 'membrane-repo' }).ready()
  const seq = await new FirehoseSequencer(store.get({ name: 'membrane-firehose' })).ready()
  await projectRepo(device, repo)
  await projectFirehose(device, seq)
  t.is(seq.length, 1, 'one #commit frame projected into the firehose')

  // exactly the membrane's read path (atproto-bridge PeerFront): decode the frame -> signed commit
  const { body } = decodeCommitFrame(await seq.core.get(seq.length - 1))
  const signedCommit = loadCommit(await readCar(body.blocks)).value
  t.ok(verifyCommit(signedCommit, pubkey), 'the firehose #commit verifies against the DID signing key (keyless)')

  // getRepoFromCommit assembles the CAR from the store's records + the firehose commit
  const { carBytes, dataCid } = await getRepoFromCommit(repo, signedCommit)
  const car = await readCar(carBytes)
  const keys = listRecords(car).map((r) => r.key).sort()
  t.alike(keys, ['app.bsky.feed.post/3aaa', 'app.bsky.feed.post/3bbb'], 'assembled repo CAR has both records')
  t.ok(dataCid.equals(head.dataCid), 'CAR data root == the swarm head data root')
})