@kubun/plugin-connector 0.13.1 → 0.14.0

package/lib/action.d.ts

@@ -1,4 +1,5 @@
-import type { CredentialProvider, EntityRecord, WriteAttachment } from '@kubun/connector';
+import type { EntityRecord, WriteAttachment } from '@kubun/connector';
+import type { CredentialProvider } from '@kubun/credential-types';
 import type { StoreProvider } from '@kubun/db';
 import type { Logger } from '@kubun/logger';
 import type { ConnectorRegistry } from './registry.js';

package/lib/api.d.ts

@@ -1,8 +1,8 @@
-import { type MethodRegistry } from '@kokuin/token';
-import { type CredentialManager } from '@kubun/credential';
 import type { StoreProvider } from '@kubun/db';
 import type { Logger } from '@kubun/logger';
 import { type PendingAuthRecord } from '@kubun/store-connector';
+export type { CreateCredentialAPIParams, CredentialAPI } from '@kubun/credential';
+export { createCredentialAPI } from '@kubun/credential';
 export type SyncStateData = {
     connectorName: string;
     ownerDID: string;
@@ -28,70 +28,18 @@ export type SetSyncStateParams = {
  * two `owner_did` columns are equality keys, so an un-normalized one files the
  * same account under two rows: a credential invisible under one spelling and
  * un-revokable under the other, and a sync lease held twice at once.
- *
- * `ownerWrappableDID` is NOT normalized — see {@link createConnectorAPI}.
  */
 export type ConnectorAPI = {
     getSyncState: (connectorName: string, ownerDID: string) => Promise<SyncStateData | null>;
     setSyncState: (connectorName: string, ownerDID: string, state: SetSyncStateParams) => Promise<SyncStateData>;
     deleteSyncState: (connectorName: string, ownerDID: string) => Promise<void>;
     listSyncStates: (connectorName: string) => Promise<Array<SyncStateData>>;
-    getCredential: (providerName: string, ownerDID: string) => Promise<string | null>;
-    getCredentialProvenance: (providerName: string, ownerDID: string) => Promise<{
-        updatedAt: string | null;
-        writerDID: string | null;
-    } | null>;
-    /**
-     * Re-encrypt an existing credential. Refuses when none exists, because
-     * creating one is a different decision — see `createCredential`.
-     */
-    setCredential: (providerName: string, ownerDID: string, credential: string) => Promise<void>;
-    /**
-     * Mint the key, its two wrappings and the entry, and record the pointer.
-     *
-     * Split from `setCredential` so the headless refresh path cannot mint a key.
-     * A minted key fixes who will ever be able to read it, and a refresh running
-     * with no owner in hand would mint one wrapped to the server alone — locking
-     * the account owner out of their own credential with nothing failing.
-     */
-    createCredential: (params: {
-        providerName: string;
-        ownerDID: string;
-        ownerWrappableDID: string;
-        controllerWrappableDID?: string;
-        credential: string;
-    }) => Promise<void>;
-    deleteCredential: (providerName: string, ownerDID: string) => Promise<void>;
     createPendingAuth: (record: PendingAuthRecord) => Promise<void>;
     consumePendingAuth: (state: string) => Promise<PendingAuthRecord | null>;
     deleteExpiredPendingAuth: (cutoffMs: number) => Promise<void>;
-    /**
-     * The controller resolvers for this API's (request-scoped) transaction
-     * provider — the exact `methods` the credential mint passes to `createKey`.
-     * Exposed so the OAuth pre-flight can ask `canWrapTo` with the same resolver
-     * the mint uses, rather than failing closed on a `did:kokuin:` owner whose
-     * agreement key is resolvable only through the controller resolver.
-     */
-    getControllerMethods: () => MethodRegistry;
 };
 export type CreateConnectorAPIParams = {
     stores: StoreProvider;
     logger: Logger;
-    /**
-     * Takes the `StoreProvider` rather than a manager, because during a mutation
-     * that provider is the transaction and a manager built over the base one
-     * would read outside it.
-     */
-    getCredentialManager: (stores: StoreProvider) => Promise<CredentialManager>;
-    /** The engine's own DID, in a form that can be encrypted to. */
-    serverWrappableDID: string;
-    /**
-     * Resolvers for wrapping recipients that carry no key material of their own
-     * (`did:kokuin:`), scoped to the request's transaction provider so a resolve
-     * reads the mutation's tx, never a second connection. A self-contained
-     * recipient resolves with an empty registry, so callers with no controller
-     * recipient in play still pass `() => []`.
-     */
-    getControllerMethods: (stores: StoreProvider) => MethodRegistry;
 };
 export declare function createConnectorAPI(params: CreateConnectorAPIParams): ConnectorAPI;

package/lib/api.js

@@ -1,10 +1,8 @@
 import { normalizeDID } from '@kokuin/token';
-import { CredentialSupersededBranch } from '@kubun/credential';
 import { getConnectorStore } from '@kubun/store-connector';
-import { fromUTF, toUTF } from '@sozai/codec';
+export { createCredentialAPI } from '@kubun/credential';
 export function createConnectorAPI(params) {
     const getStore = ()=>getConnectorStore(params.stores);
-    const getCredentials = ()=>params.getCredentialManager(params.stores);
     return {
         async getSyncState (connectorName, ownerDID) {
             const store = await getStore();
@@ -68,116 +66,6 @@ export function createConnectorAPI(params) {
                     leaseExpiresAt: entry.leaseExpiresAt ?? null
                 }));
         },
-        async getCredential (providerName, ownerDID) {
-            const store = await getStore();
-            const entryID = await store.getCredentialEntryID(providerName, normalizeDID(ownerDID));
-            if (entryID == null) return null;
-            try {
-                return toUTF(await (await getCredentials()).readEntry(entryID));
-            } catch (error) {
-                if (error instanceof CredentialSupersededBranch) {
-                    params.logger.warn('Credential entry {entryID} for provider {providerName} belongs to a superseded branch', {
-                        providerName,
-                        entryID
-                    });
-                    return null;
-                }
-                throw error;
-            }
-        },
-        async getCredentialProvenance (providerName, ownerDID) {
-            // Reflects the current pointer, not the winning branch — no superseded-branch guard
-            // (it never decrypts). Callers must gate on getCredential() != null so a loser-branch
-            // pointer's provenance is never surfaced.
-            const store = await getStore();
-            const entryID = await store.getCredentialEntryID(providerName, normalizeDID(ownerDID));
-            if (entryID == null) return null;
-            return (await getCredentials()).getEntryProvenance(entryID);
-        },
-        async setCredential (providerName, ownerDID, credential) {
-            const store = await getStore();
-            const entryID = await store.getCredentialEntryID(providerName, normalizeDID(ownerDID));
-            if (entryID == null) {
-                throw new Error(`No connector credential to update for provider "${providerName}"; create it through the authorization flow`);
-            }
-            // Opens the key through the server's own wrapping and rewrites the entry
-            // under it. No key is minted and no wrapping is touched, so a refresh
-            // cannot change who can read the credential.
-            await (await getCredentials()).updateEntry(entryID, fromUTF(credential));
-        },
-        async createCredential (input) {
-            const { providerName, ownerDID, ownerWrappableDID, credential } = input;
-            const store = await getStore();
-            const credentials = await getCredentials();
-            // Wrapping to a DID needs only that DID's published key, so an engine that
-            // cannot decrypt would mint this key perfectly and then be unable to read
-            // it — a failure that surfaces at the first headless sync, far from here.
-            // This is where `cipher == null` used to fail closed, and it still does.
-            if (!credentials.availableFactors().includes('did')) {
-                throw new Error(`Cannot create a connector credential for "${providerName}": this engine's identity cannot decrypt, so it could never read back what it stored`);
-            }
-            // Two wrappings from the first write, not one plus a later grant: the
-            // server has to read this to run sync, and the owner has to be able to
-            // rotate and revoke it. Owner is authority, a different question from who
-            // can decrypt: when a controller is supplied it is the owner, so a device
-            // revoke goes through the controller's capability chain rather than the
-            // device self-authorizing; absent one the device owns its own key.
-            //
-            // The two spellings below are deliberately different questions about the
-            // same identity, and NOT interchangeable: `owner_did` is an equality key
-            // and so is normalized, while a recipient is encrypted to and must keep
-            // its wrappable form. Normalizing a `did:peer:4` recipient hands the short
-            // form to `deriveSharedSecret`, which resolves no document and no
-            // agreement key — do not fold these together.
-            const wrappings = [
-                [
-                    {
-                        kind: 'did',
-                        recipientDID: ownerWrappableDID
-                    }
-                ],
-                [
-                    {
-                        kind: 'did',
-                        recipientDID: params.serverWrappableDID
-                    }
-                ]
-            ];
-            // A recovery recipient (e.g. a controller / seed-holder), so the credential
-            // survives device loss. Opt-in: absent when the caller supplied none. Kept
-            // in its wrappable form for the same reason as the two above — it is
-            // encrypted to, not compared against.
-            if (input.controllerWrappableDID != null) {
-                wrappings.push([
-                    {
-                        kind: 'did',
-                        recipientDID: input.controllerWrappableDID
-                    }
-                ]);
-            }
-            // The controller owns the key when supplied (its canonical DID equals the
-            // normalized wrappable form); the account pointer below stays keyed on the
-            // device — ownership and account scoping are separate concerns.
-            const keyOwnerDID = input.controllerWrappableDID != null ? normalizeDID(input.controllerWrappableDID) : normalizeDID(ownerDID);
-            const keyID = await credentials.createKey({
-                ownerDID: keyOwnerDID,
-                wrappings,
-                methods: params.getControllerMethods(params.stores)
-            });
-            const entryID = await credentials.putEntry(keyID, fromUTF(credential));
-            await store.setCredentialEntryID(providerName, normalizeDID(ownerDID), entryID);
-        },
-        async deleteCredential (providerName, ownerDID) {
-            const store = await getStore();
-            const owner = normalizeDID(ownerDID);
-            const entryID = await store.getCredentialEntryID(providerName, owner);
-            await store.deleteCredentialEntryID(providerName, owner);
-            if (entryID != null) {
-                // The pointer and the entry go together. Leaving the entry would keep
-                // the token readable by anyone who kept its id after a disconnect.
-                await (await getCredentials()).deleteEntry(entryID);
-            }
-        },
         async createPendingAuth (record) {
             const store = await getStore();
             await store.createPendingAuth(record);
@@ -189,9 +77,6 @@ export function createConnectorAPI(params) {
         async deleteExpiredPendingAuth (cutoffMs) {
             const store = await getStore();
             await store.deleteExpiredPendingAuth(cutoffMs);
-        },
-        getControllerMethods () {
-            return params.getControllerMethods(params.stores);
         }
     };
 }

package/lib/credential.d.ts

@@ -1,22 +1,2 @@
-import type { Credential, CredentialProvider, OAuthProviderDefinition } from '@kubun/connector';
-import type { Runtime } from '@sozai/runtime';
-import type { ConnectorAPI } from './api.js';
-export type DBCredentialProviderParams = {
-    api: ConnectorAPI;
-    runtime: Runtime;
-    providers: Array<OAuthProviderDefinition>;
-    bufferSeconds?: number;
-};
-export declare class DBCredentialProvider implements CredentialProvider {
-    #private;
-    constructor(params: DBCredentialProviderParams);
-    get(providerName: string, ownerDID: string): Promise<Credential | null>;
-    set(params: {
-        providerName: string;
-        ownerDID: string;
-        credential: Credential;
-        ownerWrappableDID?: string;
-        controllerWrappableDID?: string;
-    }): Promise<void>;
-    delete(providerName: string, ownerDID: string): Promise<void>;
-}
+export type { DBCredentialProviderParams } from '@kubun/credential';
+export { DBCredentialProvider } from '@kubun/credential';

package/lib/credential.js

@@ -1,129 +1,4 @@
-const DEFAULT_BUFFER_SECONDS = 300;
-function serializeCredential(credential) {
-    const serialized = {
-        accessToken: credential.accessToken,
-        scopes: credential.scopes
-    };
-    if (credential.refreshToken != null) {
-        serialized.refreshToken = credential.refreshToken;
-    }
-    if (credential.expiresAt != null) {
-        serialized.expiresAt = credential.expiresAt.toISOString();
-    }
-    if (credential.accountLabel != null) {
-        serialized.accountLabel = credential.accountLabel;
-    }
-    if (credential.metadata != null) {
-        serialized.metadata = credential.metadata;
-    }
-    return JSON.stringify(serialized);
-}
-function deserializeCredential(raw) {
-    // ParseJSONResultsPlugin may have already parsed the JSON string
-    const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;
-    const credential = {
-        accessToken: parsed.accessToken,
-        scopes: parsed.scopes
-    };
-    if (parsed.refreshToken != null) {
-        credential.refreshToken = parsed.refreshToken;
-    }
-    if (parsed.expiresAt != null) {
-        credential.expiresAt = new Date(parsed.expiresAt);
-    }
-    if (parsed.accountLabel != null) {
-        credential.accountLabel = parsed.accountLabel;
-    }
-    if (parsed.metadata != null) {
-        credential.metadata = parsed.metadata;
-    }
-    return credential;
-}
-export class DBCredentialProvider {
-    #api;
-    #runtime;
-    #providers;
-    #bufferMs;
-    constructor(params){
-        this.#api = params.api;
-        this.#runtime = params.runtime;
-        this.#providers = params.providers;
-        this.#bufferMs = (params.bufferSeconds ?? DEFAULT_BUFFER_SECONDS) * 1000;
-    }
-    async get(providerName, ownerDID) {
-        const raw = await this.#api.getCredential(providerName, ownerDID);
-        if (raw == null) return null;
-        const credential = deserializeCredential(raw);
-        if (this.#isExpiringSoon(credential) && credential.refreshToken != null) {
-            const refreshed = await this.#refresh(providerName, ownerDID, credential, credential.refreshToken);
-            return refreshed ?? credential;
-        }
-        return credential;
-    }
-    async set(params) {
-        const { providerName, ownerDID, credential, ownerWrappableDID, controllerWrappableDID } = params;
-        const serialized = serializeCredential(credential);
-        // Update when one exists, mint only when it does not. Dispatching on
-        // presence rather than on the caller keeps the refresh path unable to mint
-        // even when it does hold a wrappable DID.
-        if (await this.#api.getCredential(providerName, ownerDID) != null) {
-            await this.#api.setCredential(providerName, ownerDID, serialized);
-            return;
-        }
-        if (ownerWrappableDID == null) {
-            throw new Error(`Cannot create a connector credential for "${providerName}" without the owner's wrappable DID`);
-        }
-        await this.#api.createCredential({
-            providerName,
-            ownerDID,
-            ownerWrappableDID,
-            controllerWrappableDID,
-            credential: serialized
-        });
-    }
-    async delete(providerName, ownerDID) {
-        await this.#api.deleteCredential(providerName, ownerDID);
-    }
-    #isExpiringSoon(credential) {
-        if (credential.expiresAt == null) return false;
-        return credential.expiresAt.getTime() - Date.now() < this.#bufferMs;
-    }
-    async #refresh(providerName, ownerDID, credential, refreshToken) {
-        const provider = this.#providers.find((p)=>p.name === providerName);
-        if (provider == null || provider.clientID == null || provider.clientSecret == null) {
-            return null;
-        }
-        try {
-            const response = await this.#runtime.fetch(provider.tokenEndpoint, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded'
-                },
-                body: new URLSearchParams({
-                    grant_type: 'refresh_token',
-                    refresh_token: refreshToken,
-                    client_id: provider.clientID,
-                    client_secret: provider.clientSecret
-                })
-            });
-            if (!response.ok) return null;
-            const tokenData = await response.json();
-            const refreshed = {
-                accessToken: tokenData.access_token,
-                refreshToken: tokenData.refresh_token ?? credential.refreshToken,
-                expiresAt: tokenData.expires_in != null ? new Date(Date.now() + tokenData.expires_in * 1000) : undefined,
-                scopes: tokenData.scope?.split(' ') ?? credential.scopes,
-                accountLabel: credential.accountLabel,
-                metadata: credential.metadata
-            };
-            await this.set({
-                providerName,
-                ownerDID,
-                credential: refreshed
-            });
-            return refreshed;
-        } catch  {
-            return null;
-        }
-    }
-}
+// The DB-backed credential provider moved to @kubun/credential; re-exported here
+// so existing importers of `../src/credential.js` and the package index keep
+// resolving it.
+export { DBCredentialProvider } from '@kubun/credential';

package/lib/index.d.ts

@@ -1,6 +1,8 @@
-import type { ConnectorDefinition, OAuthProviderDefinition, SyncBoundary } from '@kubun/connector';
+import type { ConnectorDefinition, SyncBoundary } from '@kubun/connector';
+import type { OAuthProviderDefinition } from '@kubun/credential-types';
 import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
-import { type ConnectorAPI, type SetSyncStateParams, type SyncStateData } from './api.js';
+import type { AdaptivePolicy } from '@kubun/plugin-workflow-api';
+import { type ConnectorAPI, type CredentialAPI, type SetSyncStateParams, type SyncStateData } from './api.js';
 import { DBCredentialProvider, type DBCredentialProviderParams } from './credential.js';
 export { type ExecuteActionDeps, type ExecuteActionParams, type ExecuteActionResult, executeAction, } from './action.js';
 export { type ConnectorActivatedEvent, type ConnectorDeactivatedEvent, ConnectorManager, type ConnectorManagerEvents, type ConnectorManagerParams, } from './manager.js';
@@ -13,13 +15,14 @@ export { type OrchestrateSyncParams, type OrchestrateSyncResult, orchestrateSync
 export { EntityProcessor, type EntityProcessorParams, type MutateDocuments, type ProcessBatchResult, type SignedDocumentWriter, } from './sync/processor.js';
 export { DBSyncStateStore } from './sync/state.js';
 export { CONNECTOR_SYNC_CONCURRENCY, CONNECTOR_SYNC_WORKFLOW, type ConnectorSyncWorkflowDefinition, type ConnectorSyncWorkflowParams, createConnectorSyncWorkflow, } from './sync/workflow.js';
-export type { ConnectorAPI, SetSyncStateParams, SyncStateData };
+export type { ConnectorAPI, CredentialAPI, SetSyncStateParams, SyncStateData };
 export { DBCredentialProvider, type DBCredentialProviderParams };
 export type ConnectorPluginOptions = {
     connectors: Array<ConnectorDefinition>;
     providers?: Array<OAuthProviderDefinition>;
     defaults?: {
         boundary?: SyncBoundary;
+        periodicSyncPolicy?: AdaptivePolicy;
     };
 };
 export declare function createConnectorPlugin(options: ConnectorPluginOptions): (params: PluginFactoryParams) => KubunPlugin;

package/lib/index.js

@@ -3,7 +3,7 @@ import { createCredentialManager } from '@kubun/credential';
 import { connectorStoreDefinition } from '@kubun/store-connector';
 import { credentialStoreDefinition, getCredentialStore } from '@kubun/store-credential';
 import { executeAction } from './action.js';
-import { createConnectorAPI } from './api.js';
+import { createConnectorAPI, createCredentialAPI } from './api.js';
 import { DBCredentialProvider } from './credential.js';
 import { ConnectorManager } from './manager.js';
 import { OAuthService } from './oauth.js';
@@ -26,13 +26,60 @@ export { EntityProcessor } from './sync/processor.js';
 export { DBSyncStateStore } from './sync/state.js';
 export { CONNECTOR_SYNC_CONCURRENCY, CONNECTOR_SYNC_WORKFLOW, createConnectorSyncWorkflow } from './sync/workflow.js';
 export { DBCredentialProvider };
+// 5m after a productive run; idle 15m→6h, error 1m→1h, offline 30s→15m.
+const DEFAULT_PERIODIC_SYNC_POLICY = {
+    changed: 300000,
+    idle: {
+        base: 900000,
+        max: 21600000
+    },
+    error: {
+        base: 60000,
+        max: 3600000
+    },
+    offline: {
+        base: 30000,
+        max: 900000
+    }
+};
+// Present the standalone local stack as the unified surface: the credential
+// provider for get/set/delete, its credential API for provenance. Service mode
+// gets provenance as one more procedure, so both modes read it off one object.
+function withProvenance(provider, api) {
+    return {
+        get: (providerName, ownerDID)=>provider.get(providerName, ownerDID),
+        set: (setParams)=>provider.set(setParams),
+        delete: (providerName, ownerDID)=>provider.delete(providerName, ownerDID),
+        getCredentialProvenance: (providerName, ownerDID)=>api.getCredentialProvenance(providerName, ownerDID)
+    };
+}
 // ---- Connector state resolution ----
-async function resolveConnectorState(connectorAPI, registry, credentialProvider, viewerDID, connectorName) {
+// Map a workflow instance status to the connector display status. A run in
+// progress reads SYNCING, a failed terminal ERROR; every other terminal
+// (completed/cancelled) is IDLE.
+function displayStatusFor(status) {
+    if (status === 'pending' || status === 'running') return 'SYNCING';
+    if (status === 'failed') return 'ERROR';
+    return 'IDLE';
+}
+async function resolveConnectorState({ connectorAPI, registry, credentialProvider, getWorkflowAPI, viewerDID, connectorName }) {
     const connector = registry.get(connectorName);
     if (connector == null) {
         throw new Error(`Connector "${connectorName}" not found`);
     }
     const syncState = await connectorAPI.getSyncState(connectorName, viewerDID);
+    // The durable, lease-fenced truth: the workflow instance status. Preferred over
+    // the hand-written syncState.status row, which a zombie handler can transiently
+    // regress after crash-recovery. Falls back to that row only with no workflow
+    // plugin (local-only sync) or no instance yet.
+    let workflowStatus = null;
+    const workflowAPI = await getWorkflowAPI();
+    if (workflowAPI != null) {
+        const instance = await workflowAPI.getCurrentInstance(CONNECTOR_SYNC_WORKFLOW, `${connectorName}:${viewerDID}`);
+        if (instance != null) {
+            workflowStatus = displayStatusFor(instance.status);
+        }
+    }
     let authenticated = false;
     let hasWriteAccess = false;
     let authExpiresAt = null;
@@ -42,7 +89,7 @@ async function resolveConnectorState(connectorAPI, registry, credentialProvider,
         const credential = await credentialProvider.get(connector.auth.provider, viewerDID);
         if (credential != null) {
             authenticated = true;
-            const provenance = await connectorAPI.getCredentialProvenance(connector.auth.provider, viewerDID);
+            const provenance = await credentialProvider.getCredentialProvenance(connector.auth.provider, viewerDID);
             credentialUpdatedAt = provenance?.updatedAt ?? null;
             credentialWriterDID = provenance?.writerDID ?? null;
             if (credential.expiresAt != null) {
@@ -59,7 +106,7 @@ async function resolveConnectorState(connectorAPI, registry, credentialProvider,
     if (syncState == null) {
         return {
             name: connectorName,
-            status: 'IDLE',
+            status: workflowStatus ?? 'IDLE',
             authenticated,
             hasWriteAccess,
             authExpiresAt,
@@ -72,7 +119,7 @@ async function resolveConnectorState(connectorAPI, registry, credentialProvider,
     }
     return {
         name: connectorName,
-        status: syncState.status === 'idle' ? 'IDLE' : syncState.status === 'syncing' ? 'SYNCING' : 'ERROR',
+        status: workflowStatus ?? (syncState.status === 'idle' ? 'IDLE' : syncState.status === 'syncing' ? 'SYNCING' : 'ERROR'),
         authenticated,
         hasWriteAccess,
         authExpiresAt,
@@ -123,39 +170,98 @@ export function createConnectorPlugin(options) {
         // One manager per StoreProvider: the request-scoped provider is the
         // mutation's transaction, and a manager built over the base provider would
         // read outside it. The key cache is per-manager, which is the same scope the
-        // content key should have.
-        const managers = new WeakMap();
-        function getCredentialManager(stores) {
-            let manager = managers.get(stores);
-            if (manager == null) {
-                manager = getCredentialStore(stores).then((store)=>createCredentialManager({
-                        store,
-                        identity,
-                        runtime: params.runtime,
-                        hlc: params.hlc
-                    }));
-                managers.set(stores, manager);
-            }
-            return manager;
-        }
+        // content key should have. Parameterised by the signing identity and HLC so a
+        // manager over an external credential graph stamps with that graph's writer,
+        // not the engine's.
+        const credentialManagerFor = (mgrIdentity, mgrHLC)=>{
+            const managers = new WeakMap();
+            return (stores)=>{
+                let manager = managers.get(stores);
+                if (manager == null) {
+                    manager = getCredentialStore(stores).then((store)=>createCredentialManager({
+                            store,
+                            identity: mgrIdentity,
+                            runtime: params.runtime,
+                            hlc: mgrHLC
+                        }));
+                    managers.set(stores, manager);
+                }
+                return manager;
+            };
+        };
+        // The engine-scoped builder: still the manager for the engine's own request
+        // transaction on the no-backend path.
+        const getCredentialManager = credentialManagerFor(identity, params.hlc);
         // Controller resolvers for `did:kokuin:` wrapping recipients, scoped to the
-        // request's transaction provider so a resolve reads the mutation's tx rather
-        // than a second connection.
+        // resolved provider so a resolve reads that provider's controller store
+        // rather than a second connection.
         const getControllerMethods = (stores)=>[
                 params.controllerResolverFor(stores)
             ];
+        // Mode is decided by provider presence, resolved once. A registered
+        // `credential-provider` (service mode) routes every credential op through the
+        // remote credential service; its absence (standalone) builds the local stack
+        // over the engine's own db, exactly as before. The registry gate closes after
+        // construction, so this promise settles lazily — memoized by capture.
+        const credentialServiceProviderPromise = params.engine.getProvider('credential-provider');
+        // The standalone credential stack over the engine's own db, built lazily and
+        // once — only ever touched when no service provider is registered. `stores`
+        // defaults to params.db for the background (workflow/orchestrate) paths, which
+        // run outside any request transaction. A request path passes its own tx.
+        let standaloneStack;
+        const getStandaloneStack = (stores = params.db)=>{
+            // The background stack is cached on params.db; a per-request tx builds a
+            // fresh stack so its reads and writes join that transaction.
+            if (stores === params.db && standaloneStack != null) return standaloneStack;
+            const api = createCredentialAPI({
+                stores,
+                logger,
+                getCredentialManager,
+                serverWrappableDID,
+                getControllerMethods
+            });
+            const stack = {
+                api,
+                provider: new DBCredentialProvider({
+                    api,
+                    runtime: params.runtime,
+                    providers
+                })
+            };
+            if (stores === params.db) standaloneStack = stack;
+            return stack;
+        };
+        // Resolve the unified credential surface for a given store provider. Service
+        // mode reuses the registry provider as-is (plugin-scoped, not the request tx);
+        // standalone wraps the local stack, exposing provenance off its credential API.
+        const resolveCredentialSurface = async (stores)=>{
+            const serviceProvider = await credentialServiceProviderPromise;
+            if (serviceProvider != null) {
+                return {
+                    provider: serviceProvider
+                };
+            }
+            const { api, provider } = getStandaloneStack(stores);
+            return {
+                provider: withProvenance(provider, api)
+            };
+        };
         const connectorAPI = createConnectorAPI({
             stores: params.db,
-            logger,
-            getCredentialManager,
-            serverWrappableDID,
-            getControllerMethods
-        });
-        const credentialProvider = new DBCredentialProvider({
-            api: connectorAPI,
-            runtime: params.runtime,
-            providers
+            logger
         });
+        // The plugin-scope credential surface for the background paths (workflow,
+        // fallback orchestrate, OAuth callback fallback). It switches on mode per call
+        // so a service provider registered after construction is still honoured.
+        const backgroundCredentialProvider = {
+            get: async (providerName, ownerDID)=>(await resolveCredentialSurface(params.db)).provider.get(providerName, ownerDID),
+            set: async (setParams)=>{
+                await (await resolveCredentialSurface(params.db)).provider.set(setParams);
+            },
+            delete: async (providerName, ownerDID)=>{
+                await (await resolveCredentialSurface(params.db)).provider.delete(providerName, ownerDID);
+            }
+        };
         const stateStore = new DBSyncStateStore({
             api: connectorAPI
         });
@@ -168,7 +274,7 @@ export function createConnectorPlugin(options) {
             runtime: params.runtime,
             providers,
             registry,
-            credentialProvider,
+            credentialProvider: backgroundCredentialProvider,
             connectorAPI
         });
         // The primary sync path: enqueue a durable `connector-sync` workflow whose
@@ -176,7 +282,7 @@ export function createConnectorPlugin(options) {
         // registered lazily the first time the workflow API resolves.
         const connectorSyncWorkflow = createConnectorSyncWorkflow({
             registry,
-            credentialProvider,
+            credentialProvider: backgroundCredentialProvider,
             stateStore,
             syncEventEmitter: manager,
             stores: params.db,
@@ -209,28 +315,60 @@ export function createConnectorPlugin(options) {
             api: connectorAPI,
             createContextFactory: ()=>{
                 return (ctx, stores)=>{
-                    // Per-request connector API and credential provider backed by the
-                    // request's StoreProvider (transactional during mutations).
+                    // Per-request connector API backed by the request's StoreProvider
+                    // (transactional during mutations). Sync-state stays Space-local, so
+                    // this always rebuilds over the request tx.
                     const requestAPI = createConnectorAPI({
                         stores,
-                        logger,
-                        getCredentialManager,
-                        serverWrappableDID,
-                        getControllerMethods
-                    });
-                    const requestCredentialProvider = new DBCredentialProvider({
-                        api: requestAPI,
-                        runtime: params.runtime,
-                        providers
+                        logger
                     });
+                    // Resolve the request's credential surface once. Service mode reuses the
+                    // registry provider (not the request tx); standalone rebuilds the local
+                    // stack over the request's transactional provider.
+                    let surfacePromise;
+                    const getSurface = ()=>{
+                        if (surfacePromise == null) surfacePromise = resolveCredentialSurface(stores);
+                        return surfacePromise;
+                    };
+                    // A base provider that defers to the resolved surface, so synchronous
+                    // consumers (write-grants, executeAction) get one object while the
+                    // mode resolves lazily behind it.
+                    const requestProvider = {
+                        get: async (providerName, ownerDID)=>(await getSurface()).provider.get(providerName, ownerDID),
+                        set: async (setParams)=>{
+                            await (await getSurface()).provider.set(setParams);
+                        },
+                        delete: async (providerName, ownerDID)=>{
+                            await (await getSurface()).provider.delete(providerName, ownerDID);
+                        },
+                        getCredentialProvenance: async (providerName, ownerDID)=>(await getSurface()).provider.getCredentialProvenance(providerName, ownerDID)
+                    };
                     return {
-                        getState: (name)=>resolveConnectorState(requestAPI, registry, requestCredentialProvider, ctx.viewerDID, name),
+                        getState: (name)=>resolveConnectorState({
+                                connectorAPI: requestAPI,
+                                registry,
+                                credentialProvider: requestProvider,
+                                getWorkflowAPI,
+                                viewerDID: ctx.viewerDID,
+                                connectorName: name
+                            }),
                         getStates: ()=>{
                             const names = registry.list();
-                            return Promise.all(names.map((name)=>resolveConnectorState(requestAPI, registry, requestCredentialProvider, ctx.viewerDID, name)));
+                            return Promise.all(names.map((name)=>resolveConnectorState({
+                                    connectorAPI: requestAPI,
+                                    registry,
+                                    credentialProvider: requestProvider,
+                                    getWorkflowAPI,
+                                    viewerDID: ctx.viewerDID,
+                                    connectorName: name
+                                })));
                         },
-                        startAuth: (args)=>oauthService.startAuth(args, ctx.viewerDID, requestAPI),
-                        completeAuth: (args)=>oauthService.completeAuth(args, requestCredentialProvider, requestAPI),
+                        // The owner pre-flight resolves against the engine's OWN controller
+                        // methods, bound to the request tx (`stores`), in both modes. Using
+                        // `params.db` here would open a second connection inside the
+                        // startConnectorAuth mutation tx and deadlock single-connection SQLite.
+                        startAuth: async (args)=>oauthService.startAuth(args, ctx.viewerDID, requestAPI, getControllerMethods(stores)),
+                        completeAuth: (args)=>oauthService.completeAuth(args, requestProvider, requestAPI),
                         triggerSync: async (args)=>{
                             if (!registry.has(args.connector)) {
                                 return {
@@ -264,7 +402,7 @@ export function createConnectorPlugin(options) {
                                         registry,
                                         syncEventEmitter: manager,
                                         stateStore,
-                                        credentialProvider,
+                                        credentialProvider: backgroundCredentialProvider,
                                         ownerDID,
                                         stores: params.db,
                                         boundary: options.defaults?.boundary,
@@ -280,6 +418,45 @@ export function createConnectorPlugin(options) {
                             };
                         },
                         subscribeToSyncEvents: (connector)=>subscribeToConnectorSyncEvents(manager.syncEvents, connector),
+                        // Recurring-sync control. Viewer-at-enable: the schedule is registered
+                        // under a viewer and its subject is `${connector}:${ownerDID}` —
+                        // identical to the manual sync singletonKey, so scheduled and manual
+                        // runs interlock. Scheduled fires later write with no viewer, via the
+                        // engine-signed mutateDocuments path the workflow already uses.
+                        enablePeriodicSync: async (connector, policyOverride)=>{
+                            const workflowAPI = await getWorkflowAPI();
+                            if (workflowAPI == null) {
+                                throw new Error('workflow plugin required for periodic sync');
+                            }
+                            const ownerDID = ctx.viewerDID;
+                            const subjectKey = `${connector}:${ownerDID}`;
+                            const policy = policyOverride ?? options.defaults?.periodicSyncPolicy ?? DEFAULT_PERIODIC_SYNC_POLICY;
+                            const { id } = await workflowAPI.scheduleAdaptive(CONNECTOR_SYNC_WORKFLOW, {
+                                connectorName: connector,
+                                ownerDID,
+                                full: false
+                            }, {
+                                policy,
+                                subjectKey
+                            });
+                            return workflowAPI.getPeriodicSync(id);
+                        },
+                        disablePeriodicSync: async (connector)=>{
+                            const workflowAPI = await getWorkflowAPI();
+                            if (workflowAPI == null) {
+                                throw new Error('workflow plugin required for periodic sync');
+                            }
+                            const subjectKey = `${connector}:${ctx.viewerDID}`;
+                            return workflowAPI.setPeriodicSyncEnabled(`${CONNECTOR_SYNC_WORKFLOW}:${subjectKey}`, false);
+                        },
+                        getPeriodicSync: async (connector)=>{
+                            const workflowAPI = await getWorkflowAPI();
+                            if (workflowAPI == null) {
+                                throw new Error('workflow plugin required for periodic sync');
+                            }
+                            const subjectKey = `${connector}:${ctx.viewerDID}`;
+                            return workflowAPI.getPeriodicSync(`${CONNECTOR_SYNC_WORKFLOW}:${subjectKey}`);
+                        },
                         executeAction: async (args, writeDocument)=>{
                             try {
                                 // Bind the blob write to THIS request's transactional provider so
@@ -295,7 +472,7 @@ export function createConnectorPlugin(options) {
                                 }, {
                                     stores,
                                     registry,
-                                    credentialProvider: requestCredentialProvider,
+                                    credentialProvider: requestProvider,
                                     ownerDID: ctx.viewerDID,
                                     logger,
                                     writeDocument,
@@ -327,7 +504,7 @@ export function createConnectorPlugin(options) {
                             serverDID,
                             viewerDID: ctx.viewerDID,
                             stores,
-                            credentialProvider: requestCredentialProvider,
+                            credentialProvider: requestProvider,
                             hlc: params.hlc
                         })
                     };

package/lib/oauth.d.ts

@@ -1,6 +1,7 @@
-import type { CredentialProvider, OAuthProviderDefinition } from '@kubun/connector';
+import type { MethodRegistry } from '@kokuin/token';
+import type { CredentialProvider, OAuthProviderDefinition } from '@kubun/credential-types';
 import type { Runtime } from '@sozai/runtime';
-import type { ConnectorAPI } from './api.js';
+import type { ConnectorAPI, CredentialAPI } from './api.js';
 import type { ConnectorRegistry } from './registry.js';
 import type { CompleteConnectorAuthInput, CompleteConnectorAuthOutput, StartConnectorAuthInput, StartConnectorAuthOutput } from './schema.js';
 export type OAuthServiceParams = {
@@ -9,10 +10,11 @@ export type OAuthServiceParams = {
     registry: ConnectorRegistry;
     credentialProvider: CredentialProvider;
     connectorAPI: ConnectorAPI;
+    credentialAPI?: CredentialAPI;
 };
 export declare class OAuthService {
     #private;
     constructor(params: OAuthServiceParams);
-    startAuth(args: StartConnectorAuthInput, ownerDID: string, connectorAPI?: ConnectorAPI): Promise<StartConnectorAuthOutput>;
+    startAuth(args: StartConnectorAuthInput, ownerDID: string, connectorAPI?: ConnectorAPI, preflightMethods?: MethodRegistry): Promise<StartConnectorAuthOutput>;
     completeAuth(args: CompleteConnectorAuthInput, credentialProvider?: CredentialProvider, connectorAPI?: ConnectorAPI): Promise<CompleteConnectorAuthOutput>;
 }

package/lib/oauth.js

@@ -14,14 +14,18 @@ export class OAuthService {
     #providers;
     #registry;
     #connectorAPI;
+    #preflightMethods;
     constructor(params){
         this.#credentialProvider = params.credentialProvider;
         this.#runtime = params.runtime;
         this.#providers = params.providers;
         this.#registry = params.registry;
         this.#connectorAPI = params.connectorAPI;
+        this.#preflightMethods = params.credentialAPI?.getControllerMethods();
     }
-    async startAuth(args, ownerDID, connectorAPI) {
+    async startAuth(args, ownerDID, connectorAPI, // The controller methods the owner pre-flight resolves against; `undefined`
+    // falls back to the constructor-captured methods (the direct unit tests).
+    preflightMethods) {
         // Prefer the request-scoped API so the pending-auth write joins the mutation
         // transaction; the base API would deadlock a single-connection SQLite tx.
         const api = connectorAPI ?? this.#connectorAPI;
@@ -45,7 +49,8 @@ export class OAuthService {
         // `did:kokuin:` owner's agreement key resolves only through the controller
         // resolver, and asking without it would fail closed and block a flow the
         // mint would have completed.
-        if (!await canWrapTo(ownerWrappableDID, api.getControllerMethods())) {
+        const methods = preflightMethods ?? this.#preflightMethods;
+        if (methods != null && !await canWrapTo(ownerWrappableDID, methods)) {
             throw new Error(`Cannot start OAuth for "${args.provider}": nothing can be encrypted to "${ownerWrappableDID}", so the credential's owner could never read it. Pass \`viewerWrappableDID\` — for a did:peer:4 viewer that is the long form, which carries the agreement key.`);
         }
         // Carried to the mint like the owner's wrappable DID; it becomes a

package/lib/schema.d.ts

@@ -1,5 +1,6 @@
 import type { ConnectorSyncEventPayload } from '@kubun/connector';
 import type { SchemaExtension } from '@kubun/engine';
+import type { AdaptivePolicy } from '@kubun/plugin-workflow-api';
 import type { EventEmitter } from '@sozai/event';
 import type { ConnectorRegistry } from './registry.js';
 import type { SignedDocumentWriter } from './sync/processor.js';
@@ -164,6 +165,9 @@ export type ConnectorQueryContext = {
         provider: string;
     }) => Promise<boolean>;
     connectorWriteGrants?: () => Promise<Array<ConnectorWriteGrant>>;
+    enablePeriodicSync?: (connector: string, policyOverride?: AdaptivePolicy) => Promise<unknown>;
+    disablePeriodicSync?: (connector: string) => Promise<unknown | null>;
+    getPeriodicSync?: (connector: string) => Promise<unknown | null>;
 };
 declare module '@kubun/graphql' {
     interface PluginContextMap {
@@ -172,6 +176,7 @@ declare module '@kubun/graphql' {
 }
 export type ConnectorExtensionConfig = {
     connectors?: Array<string>;
+    periodicSync?: boolean;
 };
 export declare function createConnectorSchemaExtension(params: {
     registry?: ConnectorRegistry;

package/lib/schema.js

@@ -177,6 +177,22 @@ extend type Subscription {
   connectorSyncEvents(connector: String): ConnectorSyncEvent!
 }
 `);
+    // Recurring-sync control. Gated because it references `PeriodicSync`, which is
+    // defined by the co-deployed workflow plugin — referencing it on a connector-only
+    // graph would fail schema build with an unknown type.
+    const periodicSyncEnabled = params.config.periodicSync === true;
+    if (periodicSyncEnabled) {
+        sdlParts.push(`
+extend type Query {
+  connectorPeriodicSync(connector: String!): PeriodicSync
+}
+
+extend type Mutation {
+  enableConnectorPeriodicSync(connector: String!, policy: JSON): PeriodicSync!
+  disableConnectorPeriodicSync(connector: String!): PeriodicSync
+}
+`);
+    }
     // Dynamic per-model action types and mutations from registered connectors
     const dynamicMutationLines = [];
     if (registry != null) {
@@ -284,6 +300,32 @@ input ConnectorUpdate${modelName}Input {
             return conn.disconnectProvider(args);
         }
     };
+    // Resolvers for the gated recurring-sync fields. Attached only when the SDL
+    // above declared them, since the resolver-attach step rejects a resolver with
+    // no matching field. The ownerDID is the viewer, captured by the context factory.
+    if (periodicSyncEnabled) {
+        queryFields.connectorPeriodicSync = (_source, args, context)=>{
+            const conn = requireConnector(context);
+            if (conn.getPeriodicSync == null) {
+                throw new Error('connector.getPeriodicSync is not available in this context');
+            }
+            return conn.getPeriodicSync(args.connector);
+        };
+        mutationFields.enableConnectorPeriodicSync = (_source, args, context)=>{
+            const conn = requireConnector(context);
+            if (conn.enablePeriodicSync == null) {
+                throw new Error('connector.enablePeriodicSync is not available in this context');
+            }
+            return conn.enablePeriodicSync(args.connector, args.policy);
+        };
+        mutationFields.disableConnectorPeriodicSync = (_source, args, context)=>{
+            const conn = requireConnector(context);
+            if (conn.disablePeriodicSync == null) {
+                throw new Error('connector.disablePeriodicSync is not available in this context');
+            }
+            return conn.disablePeriodicSync(args.connector);
+        };
+    }
     // Dynamic per-model action resolvers
     if (registry != null) {
         for (const connector of registry.getAll()){
@@ -360,6 +402,17 @@ input ConnectorUpdate${modelName}Input {
     };
     return {
         sdl,
+        // These write to the workflow store, not the graph, and must return the
+        // resulting projection synchronously. Running them inside `mutateGraph`'s
+        // write transaction would hold the shared single-connection DB across the
+        // workflow-store write and deadlock (as `syncConnector` defers its enqueue to
+        // `onCommit` for the same reason).
+        ...periodicSyncEnabled ? {
+            nonTransactionalMutationFields: [
+                'enableConnectorPeriodicSync',
+                'disableConnectorPeriodicSync'
+            ]
+        } : {},
         resolvers: {
             queryFields,
             mutationFields,

package/lib/sync/orchestrate.d.ts

@@ -1,4 +1,5 @@
-import type { ConnectorSyncEventPayload, CredentialProvider, SyncBoundary, SyncStateStore } from '@kubun/connector';
+import type { ConnectorSyncEventPayload, SyncBoundary, SyncStateStore } from '@kubun/connector';
+import type { CredentialProvider } from '@kubun/credential-types';
 import type { StoreProvider } from '@kubun/db';
 import type { Logger } from '@kubun/logger';
 import type { ConnectorRegistry } from '../registry.js';

package/lib/sync/workflow.d.ts

@@ -1,6 +1,8 @@
-import type { CredentialProvider, SyncBoundary, SyncStateStore } from '@kubun/connector';
+import type { SyncBoundary, SyncStateStore } from '@kubun/connector';
+import type { CredentialProvider } from '@kubun/credential-types';
 import type { StoreProvider } from '@kubun/db';
 import type { Logger } from '@kubun/logger';
+import type { WorkflowOutcome } from '@kubun/plugin-workflow-api';
 import type { ConnectorRegistry } from '../registry.js';
 import type { SyncEventEmitter } from './orchestrate.js';
 import { type MutateDocuments } from './processor.js';
@@ -22,6 +24,7 @@ type HandlerResult = {
 } | {
     status: 'end';
     state: Record<string, unknown>;
+    outcome?: WorkflowOutcome;
 };
 type ConnectorSyncHandler = (ctx: HandlerContext) => Promise<HandlerResult>;
 export type ConnectorSyncWorkflowDefinition = {

package/lib/sync/workflow.js

@@ -45,11 +45,30 @@ import { MAX_LOGGED_ERRORS } from './processor.js';
             }
             const providerName = connector.auth.provider !== 'device' ? connector.auth.provider : null;
             const credential = providerName ? await credentialProvider.get(providerName, ownerDID) : null;
-            if (providerName != null && credential == null) {
-                throw new Error(`Missing credential for connector "${connectorName}"`);
-            }
-            if (connector.serverProvider == null) {
-                throw new Error(`Connector "${connectorName}" has no server provider`);
+            // A missing credential or absent server provider is "can't sync right now",
+            // not a failure: end offline (leaving prior sync state untouched) so the
+            // adaptive scheduler backs off on the offline branch rather than the error
+            // one. A genuine mid-sync throw below still terminates failed (⇒ error).
+            if (providerName != null && credential == null || connector.serverProvider == null) {
+                const offlineState = {
+                    connectorName,
+                    ownerDID,
+                    full,
+                    phase: 'initial',
+                    checkpoint: null,
+                    baseEntityCount: 0,
+                    totalProcessed: 0,
+                    totalFailed: 0,
+                    batchNumber: 0,
+                    startTime: Date.now(),
+                    lastSyncedAt: new Date().toISOString(),
+                    failedSample: []
+                };
+                return {
+                    status: 'end',
+                    state: offlineState,
+                    outcome: 'offline'
+                };
             }
             const existing = await stateStore.get(connectorName, ownerDID);
             const isIncremental = !full && existing?.checkpoint != null;
@@ -216,9 +235,13 @@ import { MAX_LOGGED_ERRORS } from './processor.js';
                     failedSample: state.failedSample
                 } : {}
             });
+            // Productive iff this run applied at least one entity; the per-run counter
+            // starts at 0 in `start` and accrues in `batch`.
+            const outcome = state.totalProcessed > 0 ? 'changed' : 'idle';
             return {
                 status: 'end',
-                state
+                state,
+                outcome
             };
         } catch (err) {
             await reportError(state.connectorName, state.ownerDID, state.checkpoint, state.lastSyncedAt, state.baseEntityCount + state.totalProcessed, err);

package/lib/write-grants.d.ts

@@ -1,4 +1,4 @@
-import type { CredentialProvider } from '@kubun/connector';
+import type { CredentialProvider } from '@kubun/credential-types';
 import { HLC } from '@kubun/hlc';
 import { getDelegationStore } from '@kubun/store-delegation';
 import type { ConnectorRegistry } from './registry.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-connector",
-  "version": "0.13.1",
+  "version": "0.14.0",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -17,6 +17,23 @@
     "@kokuin/capability": "^0.3.0",
     "@kokuin/jwe": "^0.1.0",
     "@kokuin/token": "^0.5.0",
+    "@kubun/connector": "^0.14.0",
+    "@kubun/credential": "^0.14.0",
+    "@kubun/credential-types": "^0.14.0",
+    "@kubun/db": "^0.14.0",
+    "@kubun/engine": "^0.14.0",
+    "@kubun/graphql": "^0.14.0",
+    "@kubun/hlc": "^0.14.0",
+    "@kubun/id": "^0.14.0",
+    "@kubun/logger": "^0.14.0",
+    "@kubun/plugin-blob-api": "^0.14.0",
+    "@kubun/plugin-workflow-api": "^0.14.0",
+    "@kubun/protocol": "^0.14.0",
+    "@kubun/service-credential-api": "^0.14.0",
+    "@kubun/store-connector": "^0.14.0",
+    "@kubun/store-credential": "^0.14.0",
+    "@kubun/store-delegation": "^0.14.0",
+    "@kubun/store-graph": "^0.14.0",
     "@noble/hashes": "^2.3.0",
     "@sozai/async": "^0.2.1",
     "@sozai/codec": "^0.4.0",
@@ -25,35 +42,28 @@
     "@sozai/runtime": "^0.1.0",
     "graphql": "^16.14.2",
     "graphql-scalars": "^2.0.0",
-    "kysely": "^0.29.5",
-    "@kubun/connector": "^0.13.1",
-    "@kubun/hlc": "^0.13.0",
-    "@kubun/db": "^0.13.0",
-    "@kubun/engine": "^0.13.1",
-    "@kubun/logger": "^0.13.0",
-    "@kubun/graphql": "^0.13.1",
-    "@kubun/credential": "^0.13.0",
-    "@kubun/store-connector": "^0.13.0",
-    "@kubun/store-credential": "^0.13.0",
-    "@kubun/id": "^0.13.0",
-    "@kubun/store-graph": "^0.13.2",
-    "@kubun/store-delegation": "^0.13.0",
-    "@kubun/protocol": "^0.13.1"
+    "kysely": "^0.29.5"
   },
   "devDependencies": {
+    "@enkaku/protocol": "^0.21.0",
+    "@enkaku/transport": "^0.21.0",
     "@kokuin/controller": "^0.1.0",
+    "@kubun/blob-backend": "^0.14.0",
+    "@kubun/connector-google-mail": "^0.14.0",
+    "@kubun/db-postgres": "^0.14.0",
+    "@kubun/models": "^0.14.0",
+    "@kubun/plugin-blob": "^0.14.0",
+    "@kubun/plugin-credential": "^0.14.0",
+    "@kubun/plugin-service-client": "^0.14.0",
+    "@kubun/plugin-service-server": "^0.14.0",
+    "@kubun/plugin-workflow": "^0.14.0",
+    "@kubun/service-controller-log-api": "^0.14.0",
+    "@kubun/store-blob": "^0.14.0",
+    "@kubun/store-controller": "^0.14.0",
+    "@kubun/store-workflow": "^0.14.0",
+    "@kubun/test-utils": "^0.13.0",
     "@testcontainers/postgresql": "^12.1.0",
-    "get-port": "^7.2.0",
-    "@kubun/blob-backend": "^0.13.0",
-    "@kubun/db-postgres": "^0.13.0",
-    "@kubun/connector-google-mail": "^0.13.0",
-    "@kubun/models": "^0.13.0",
-    "@kubun/plugin-blob": "^0.13.0",
-    "@kubun/plugin-workflow": "^0.13.0",
-    "@kubun/store-controller": "^0.13.0",
-    "@kubun/store-blob": "^0.13.0",
-    "@kubun/store-workflow": "^0.13.0",
-    "@kubun/test-utils": "^0.13.0"
+    "get-port": "^7.2.0"
   },
   "publishConfig": {
     "access": "public"