xmtp_proto: bump to xmtp/proto feature/external-invite

Bumps proto pin to ab83a2b on the feature/external-invite branch.

New types added by the regen:
- ExternalInvitePayload, EncryptedGroupInfoBlob (invite wire format).
- JoinPolicyV1 + JoinPolicyEntry (JOIN_POLICY well-known component).
- external_committer_permissions field on ComponentMetadata (per-component
  authorization for external committers).

Removes the previously-attempted allow_external_commit field on the
legacy PolicySet proto — that approach is superseded by JoinPolicy
+ external_committer_permissions, which are AppData-native and survive
the migration.

Author: tylerhawkes

crates/xmtp_mls_common/src/app_data/component_registry.rs

@@ -41,6 +41,7 @@ pub fn new_component_metadata(
     ComponentMetadata {
         permissions: Some(permissions),
         component_type: component_type as i32,
+        external_committer_permissions: None,
     }
 }
 
@@ -633,6 +634,7 @@ mod tests {
         // the negative case we're testing here.
         let meta = ComponentMetadata {
             permissions: None,
+            external_committer_permissions: None,
             component_type: ComponentType::Bytes as i32,
         };
         // Applies to ALL components, not just constrained ones.
@@ -828,6 +830,7 @@ mod tests {
         // The set() path catches this; from_bytes() must catch it too.
         let meta = ComponentMetadata {
             permissions: None,
+            external_committer_permissions: None,
             component_type: ComponentType::Bytes as i32,
         };
         let bytes = raw_bytes_with_entry(ComponentId::GROUP_NAME, meta.encode_to_vec());

crates/xmtp_proto/proto_version

@@ -1 +1 @@
-7b8260c3041389bf706fb665460adbbd520d2be7
+424fdd061d41bdd7e81185735329de414dfd8e4c

crates/xmtp_proto/src/gen/proto_descriptor.bin

@@ -186,6 +186,87 @@ impl WelcomeWrapperAlgorithm {
         }
     }
 }
+/// ExternalInvitePayload is the shareable invite blob for QR-code or link-based
+/// joining of an XMTP group via an MLS external commit. The application embeds
+/// the serialized bytes in whatever transport it prefers (hex, base64, raw QR,
+/// NFC, etc.) and stores the encrypted GroupInfo blob on an external service
+/// keyed by `group_id_hash`.
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct ExternalInvitePayload {
+    #[prost(uint32, tag = "1")]
+    pub version: u32,
+    /// Application-defined opaque bytes identifying the service location.
+    #[prost(bytes = "vec", tag = "2")]
+    pub service_pointer: ::prost::alloc::vec::Vec<u8>,
+    /// sha256(group_id); service lookup key for the encrypted blob.
+    #[prost(bytes = "vec", tag = "3")]
+    pub group_id_hash: ::prost::alloc::vec::Vec<u8>,
+    /// 32 bytes; ChaCha20Poly1305 key used to wrap the GroupInfo.
+    #[prost(bytes = "vec", tag = "4")]
+    pub symmetric_key: ::prost::alloc::vec::Vec<u8>,
+    /// Nanoseconds since UNIX epoch; 0 means no expiry.
+    #[prost(uint64, tag = "5")]
+    pub expires_at_ns: u64,
+    /// MLS ciphersuite identifier of the target group.
+    #[prost(uint32, tag = "6")]
+    pub ciphersuite: u32,
+}
+impl ::prost::Name for ExternalInvitePayload {
+    const NAME: &'static str = "ExternalInvitePayload";
+    const PACKAGE: &'static str = "xmtp.mls.message_contents";
+    fn full_name() -> ::prost::alloc::string::String {
+        "xmtp.mls.message_contents.ExternalInvitePayload".into()
+    }
+    fn type_url() -> ::prost::alloc::string::String {
+        "/xmtp.mls.message_contents.ExternalInvitePayload".into()
+    }
+}
+/// EncryptedGroupInfoBlob wraps a single GroupInfo TLS-serialized bytes under
+/// ChaCha20Poly1305 with a fresh nonce per re-encryption. Stored on the
+/// external service and replaced by joiners (with a fresh nonce) after each
+/// successful join.
+///
+/// `epoch` and `group_state_hash` are plaintext metadata used by the
+/// external service for ordering and fork detection. The service should
+/// accept an uploaded blob iff its `(epoch, group_state_hash)` is strictly
+/// newer than the currently-stored blob's — concurrent uploads at the same
+/// epoch with different state hashes signal a fork and should be rejected.
+/// The joiner verifies on download that the blob's `epoch` and
+/// `group_state_hash` match the decrypted GroupInfo before attempting to
+/// join — closes the "malicious service swapped ciphertext" gap.
+#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct EncryptedGroupInfoBlob {
+    #[prost(uint32, tag = "1")]
+    pub version: u32,
+    /// 12 bytes; ChaCha20Poly1305 nonce specific to this ciphertext.
+    #[prost(bytes = "vec", tag = "2")]
+    pub nonce: ::prost::alloc::vec::Vec<u8>,
+    /// wrap_payload_symmetric output: AEAD ciphertext over the serialized
+    /// MlsMessageOut(GroupInfo).
+    #[prost(bytes = "vec", tag = "3")]
+    pub ciphertext: ::prost::alloc::vec::Vec<u8>,
+    /// MLS group epoch of the wrapped GroupInfo. Plaintext; service uses
+    /// for monotonic-ordering. Joiner verifies against the decrypted
+    /// GroupInfo before joining.
+    #[prost(uint64, tag = "4")]
+    pub epoch: u64,
+    /// Tree-hash (or equivalent group-state digest) of the wrapped
+    /// GroupInfo. Plaintext; service uses alongside `epoch` for fork
+    /// detection. Joiner verifies against the decrypted GroupInfo before
+    /// joining.
+    #[prost(bytes = "vec", tag = "5")]
+    pub group_state_hash: ::prost::alloc::vec::Vec<u8>,
+}
+impl ::prost::Name for EncryptedGroupInfoBlob {
+    const NAME: &'static str = "EncryptedGroupInfoBlob";
+    const PACKAGE: &'static str = "xmtp.mls.message_contents";
+    fn full_name() -> ::prost::alloc::string::String {
+        "xmtp.mls.message_contents.EncryptedGroupInfoBlob".into()
+    }
+    fn type_url() -> ::prost::alloc::string::String {
+        "/xmtp.mls.message_contents.EncryptedGroupInfoBlob".into()
+    }
+}
 /// Message for group mutable metadata
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct GroupMutableMetadataV1 {
@@ -520,6 +601,66 @@ impl Compression {
         }
     }
 }
+/// v1 external-commit-policy payload.
+#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct ExternalCommitPolicyV1 {
+    /// Master switch for MLS External Commits adding new members.
+    /// Required for the QR-invite flow. Defaults to false; admins
+    /// (super-admin by default) opt in via
+    /// AppDataUpdate(EXTERNAL_COMMIT_POLICY).
+    #[prost(bool, tag = "1")]
+    pub allow_external_commit: bool,
+    /// Wall-clock auto-disable timestamp (ns since UNIX epoch).
+    /// 0 = no automatic expiry. After this timestamp the validator
+    /// rejects all external commits regardless of `allow_external_commit`.
+    /// Lets admins issue time-bounded invite campaigns without having to
+    /// come back and flip the bit manually.
+    #[prost(uint64, tag = "2")]
+    pub expires_at_ns: u64,
+    /// Maximum staleness of the GroupInfo referenced by an external
+    /// commit, in nanoseconds since GroupInfo export. 0 = no staleness
+    /// limit. External commits whose referenced GroupInfo was exported
+    /// more than `expire_in_ns` ago are rejected. Narrows the replay
+    /// window for stolen-blob attacks and forces re-export frequency.
+    #[prost(uint64, tag = "3")]
+    pub expire_in_ns: u64,
+}
+impl ::prost::Name for ExternalCommitPolicyV1 {
+    const NAME: &'static str = "ExternalCommitPolicyV1";
+    const PACKAGE: &'static str = "xmtp.mls.message_contents";
+    fn full_name() -> ::prost::alloc::string::String {
+        "xmtp.mls.message_contents.ExternalCommitPolicyV1".into()
+    }
+    fn type_url() -> ::prost::alloc::string::String {
+        "/xmtp.mls.message_contents.ExternalCommitPolicyV1".into()
+    }
+}
+/// Versioned envelope. New variants are added as new oneof variants;
+/// readers that don't recognize a variant treat the policy as default
+/// (all fields zero) per the standard unknown-variant tolerance rules.
+#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
+pub struct ExternalCommitPolicyEntry {
+    #[prost(oneof = "external_commit_policy_entry::Version", tags = "1")]
+    pub version: ::core::option::Option<external_commit_policy_entry::Version>,
+}
+/// Nested message and enum types in `ExternalCommitPolicyEntry`.
+pub mod external_commit_policy_entry {
+    #[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Oneof)]
+    pub enum Version {
+        #[prost(message, tag = "1")]
+        V1(super::ExternalCommitPolicyV1),
+    }
+}
+impl ::prost::Name for ExternalCommitPolicyEntry {
+    const NAME: &'static str = "ExternalCommitPolicyEntry";
+    const PACKAGE: &'static str = "xmtp.mls.message_contents";
+    fn full_name() -> ::prost::alloc::string::String {
+        "xmtp.mls.message_contents.ExternalCommitPolicyEntry".into()
+    }
+    fn type_url() -> ::prost::alloc::string::String {
+        "/xmtp.mls.message_contents.ExternalCommitPolicyEntry".into()
+    }
+}
 /// Message for group mutable metadata
 #[derive(Clone, PartialEq, ::prost::Message)]
 pub struct GroupMutablePermissionsV1 {
@@ -927,9 +1068,18 @@ pub struct ComponentMetadata {
     /// The data structure type of the component's value
     #[prost(enumeration = "ComponentType", tag = "1")]
     pub component_type: i32,
-    /// Permission policies for this component
+    /// Permission policies for this component, evaluated against regular
+    /// (member-issued) commits.
     #[prost(message, optional, tag = "2")]
     pub permissions: ::core::option::Option<ComponentPermissions>,
+    /// Permission policies for this component, evaluated against MLS External
+    /// Commits (RFC 9420 §12.4.3.2). Absent / unset is equivalent to all-Deny:
+    /// external committers cannot touch this component. Each component opts in
+    /// explicitly by setting this field. Combined with the JOIN_POLICY master
+    /// switch (`allow_external_commit`), this is the per-component declarative
+    /// authorization for external-commit-driven joins.
+    #[prost(message, optional, tag = "3")]
+    pub external_committer_permissions: ::core::option::Option<ComponentPermissions>,
 }
 impl ::prost::Name for ComponentMetadata {
     const NAME: &'static str = "ComponentMetadata";