@kubun/plugin-p2p 0.10.0 → 0.11.0

package/lib/hub/manager.js

@@ -1 +1,198 @@
-import{getP2PStore as r}from"@kubun/store-p2p";export class HubServerDIDConflictError extends Error{hubID;url;existingServerDID;providedServerDID;constructor(r){super(`hub at ${r.url} is pinned to ${r.existingServerDID}; refusing to overwrite with ${r.providedServerDID}`),this.name="HubServerDIDConflictError",this.hubID=r.hubID,this.url=r.url,this.existingServerDID=r.existingServerDID,this.providedServerDID=r.providedServerDID}}function e(r){return{id:r.id,label:r.label,url:r.url,serverDID:r.server_did,createdAt:new Date(r.created_at),updatedAt:null==r.updated_at?null:new Date(r.updated_at)}}export async function createHub(t){let u=await r(t.stores),i=t.serverDID??null,a=await u.getHubByURL(t.url);if(null!=a){if(null!=a.server_did&&null!=i&&a.server_did!==i)throw new HubServerDIDConflictError({hubID:a.id,url:t.url,existingServerDID:a.server_did,providedServerDID:i});if(null==a.server_did&&null!=i){await u.updateHub(a.id,{server_did:i});let r=await u.getHub(a.id);if(null==r)throw Error("Failed to read hub after upgrade");return e(r)}return e(a)}let l=crypto.randomUUID();await u.insertHub({id:l,label:t.label??null,url:t.url,server_did:i});let n=await u.getHub(l);if(null==n)throw Error("Failed to read hub after insert");return e(n)}export async function upsertHub(r){return await createHub({stores:r.stores,url:r.url,serverDID:r.serverDID})}export async function updateHub(t){let u=await r(t.stores),i=await u.getHub(t.id);if(null==i)throw Error(`Hub ${t.id} not found`);if(null!=t.url&&t.url!==i.url){let r=await u.getHubByURL(t.url);if(null!=r&&r.id!==t.id)throw Error(`URL ${t.url} already in use by hub ${r.id}`)}let a={};void 0!==t.label&&(a.label=t.label),void 0!==t.url&&(a.url=t.url),void 0!==t.serverDID&&(a.server_did=t.serverDID),await u.updateHub(t.id,a);let l=await u.getHub(t.id);if(null==l)throw Error("Failed to read hub after update");return e(l)}export async function deleteHub(e){let t=await r(e.stores),u=await t.listGroupIDsByHubID(e.id);return u.length>0&&!e.force?{success:!1,boundGroupIDs:u}:(u.length>0&&await t.deleteGroupHubsByHubID(e.id),await t.deleteHub(e.id),{success:!0,boundGroupIDs:u})}export async function getHub(t){let u=await r(t.stores),i=await u.getHub(t.id);return null==i?null:e(i)}export async function listHubs(t){let u=await r(t.stores);return(await u.listHubs()).map(e)}export async function bindHubToGroup(e){let t=await r(e.stores);return await t.insertGroupHub({group_id:e.groupID,hub_id:e.hubID})}export async function unbindHubFromGroup(e){let t=await r(e.stores);return await t.deleteGroupHub({groupID:e.groupID,hubID:e.hubID})}export async function listHubsByGroup(t){let u=await r(t.stores);return(await u.listHubsByGroupID(t.groupID)).map(e)}export async function listGroupsByHub(e){let t=await r(e.stores);return await t.listGroupIDsByHubID(e.hubID)}export async function captureServerDID(e){let t=await r(e.stores),u=await t.getHubByURL(e.hubURL);if(null==u)return!1;if(null==u.server_did)return await t.updateHub(u.id,{server_did:e.serverDID}),!0;if(u.server_did===e.serverDID)return!1;throw new HubServerDIDConflictError({hubID:u.id,url:e.hubURL,existingServerDID:u.server_did,providedServerDID:e.serverDID})}
+import { getP2PStore } from '@kubun/store-p2p';
+export class HubServerDIDConflictError extends Error {
+    #hubID;
+    #url;
+    #existingServerDID;
+    #providedServerDID;
+    constructor(params){
+        super(`hub at ${params.url} is pinned to ${params.existingServerDID}; refusing to overwrite with ${params.providedServerDID}`);
+        this.name = 'HubServerDIDConflictError';
+        this.#hubID = params.hubID;
+        this.#url = params.url;
+        this.#existingServerDID = params.existingServerDID;
+        this.#providedServerDID = params.providedServerDID;
+    }
+    get hubID() {
+        return this.#hubID;
+    }
+    get url() {
+        return this.#url;
+    }
+    get existingServerDID() {
+        return this.#existingServerDID;
+    }
+    get providedServerDID() {
+        return this.#providedServerDID;
+    }
+}
+function rowToHub(row) {
+    return {
+        id: row.id,
+        label: row.label,
+        url: row.url,
+        serverDID: row.server_did,
+        createdAt: new Date(row.created_at),
+        updatedAt: row.updated_at == null ? null : new Date(row.updated_at)
+    };
+}
+export async function createHub(params) {
+    const store = await getP2PStore(params.stores);
+    const providedDID = params.serverDID ?? null;
+    const existing = await store.getHubByURL(params.url);
+    if (existing != null) {
+        if (existing.server_did != null && providedDID != null && existing.server_did !== providedDID) {
+            throw new HubServerDIDConflictError({
+                hubID: existing.id,
+                url: params.url,
+                existingServerDID: existing.server_did,
+                providedServerDID: providedDID
+            });
+        }
+        if (existing.server_did == null && providedDID != null) {
+            await store.updateHub(existing.id, {
+                server_did: providedDID
+            });
+            const updated = await store.getHub(existing.id);
+            if (updated == null) throw new Error('Failed to read hub after upgrade');
+            return rowToHub(updated);
+        }
+        return rowToHub(existing);
+    }
+    const id = crypto.randomUUID();
+    await store.insertHub({
+        id,
+        label: params.label ?? null,
+        url: params.url,
+        server_did: providedDID
+    });
+    const created = await store.getHub(id);
+    if (created == null) throw new Error('Failed to read hub after insert');
+    return rowToHub(created);
+}
+/**
+ * Idempotent register-or-pin entry-point. Applies the conflict matrix:
+ *
+ * - URL not registered → insert a fresh row with `serverDID` (or null) and
+ *   return it.
+ * - existing row, `server_did === null`, provided null → no-op.
+ * - existing row, `server_did === null`, provided DID-A → upgrade pin to
+ *   DID-A.
+ * - existing row, `server_did === DID-A`, provided null or matching DID-A →
+ *   no-op (no silent downgrade).
+ * - existing row, `server_did === DID-A`, provided DID-B → throws
+ *   `HubServerDIDConflictError`. Caller must explicit `updateHub` to change
+ *   a pinned DID.
+ *
+ * Unlike `createHub`, `upsertHub` takes no `label` — it is for atomic
+ * register+bind paths where the inviter only ships connectivity + pin.
+ */ export async function upsertHub(params) {
+    return await createHub({
+        stores: params.stores,
+        url: params.url,
+        serverDID: params.serverDID
+    });
+}
+export async function updateHub(params) {
+    const store = await getP2PStore(params.stores);
+    const existing = await store.getHub(params.id);
+    if (existing == null) {
+        throw new Error(`Hub ${params.id} not found`);
+    }
+    if (params.url != null && params.url !== existing.url) {
+        const collision = await store.getHubByURL(params.url);
+        if (collision != null && collision.id !== params.id) {
+            throw new Error(`URL ${params.url} already in use by hub ${collision.id}`);
+        }
+    }
+    const update = {};
+    if (params.label !== undefined) update.label = params.label;
+    if (params.url !== undefined) update.url = params.url;
+    if (params.serverDID !== undefined) update.server_did = params.serverDID;
+    await store.updateHub(params.id, update);
+    const updated = await store.getHub(params.id);
+    if (updated == null) throw new Error('Failed to read hub after update');
+    return rowToHub(updated);
+}
+export async function deleteHub(params) {
+    const store = await getP2PStore(params.stores);
+    const boundGroupIDs = await store.listGroupIDsByHubID(params.id);
+    if (boundGroupIDs.length > 0 && !params.force) {
+        return {
+            success: false,
+            boundGroupIDs
+        };
+    }
+    if (boundGroupIDs.length > 0) {
+        await store.deleteGroupHubsByHubID(params.id);
+    }
+    await store.deleteHub(params.id);
+    return {
+        success: true,
+        boundGroupIDs
+    };
+}
+export async function getHub(params) {
+    const store = await getP2PStore(params.stores);
+    const row = await store.getHub(params.id);
+    return row == null ? null : rowToHub(row);
+}
+export async function listHubs(params) {
+    const store = await getP2PStore(params.stores);
+    const rows = await store.listHubs();
+    return rows.map(rowToHub);
+}
+export async function bindHubToGroup(params) {
+    const store = await getP2PStore(params.stores);
+    return await store.insertGroupHub({
+        group_id: params.groupID,
+        hub_id: params.hubID
+    });
+}
+export async function unbindHubFromGroup(params) {
+    const store = await getP2PStore(params.stores);
+    return await store.deleteGroupHub({
+        groupID: params.groupID,
+        hubID: params.hubID
+    });
+}
+export async function listHubsByGroup(params) {
+    const store = await getP2PStore(params.stores);
+    const rows = await store.listHubsByGroupID(params.groupID);
+    return rows.map(rowToHub);
+}
+export async function listGroupsByHub(params) {
+    const store = await getP2PStore(params.stores);
+    return await store.listGroupIDsByHubID(params.hubID);
+}
+/**
+ * TOFU capture path. Looks up the local hub row by URL and applies the
+ * conflict matrix:
+ * - URL not registered → no-op, returns `false`.
+ * - existing `server_did` is null → upgrade to `serverDID`, returns `true`.
+ * - existing `server_did` matches `serverDID` → no-op, returns `false`.
+ * - existing `server_did` differs from `serverDID` → throws
+ *   `HubServerDIDConflictError`. Pinned-mismatch enforcement (hard-fail
+ *   before any message is delivered) lives in the transport wrapper and
+ *   surfaces `HubServerDIDMismatchError` to callers.
+ */ export async function captureServerDID(params) {
+    const store = await getP2PStore(params.stores);
+    const existing = await store.getHubByURL(params.hubURL);
+    if (existing == null) {
+        return false;
+    }
+    if (existing.server_did == null) {
+        await store.updateHub(existing.id, {
+            server_did: params.serverDID
+        });
+        return true;
+    }
+    if (existing.server_did === params.serverDID) {
+        return false;
+    }
+    throw new HubServerDIDConflictError({
+        hubID: existing.id,
+        url: params.hubURL,
+        existingServerDID: existing.server_did,
+        providedServerDID: params.serverDID
+    });
+}

package/lib/hub/wiring.d.ts

@@ -1,17 +1,14 @@
-import type { OwnIdentity } from '@enkaku/token';
+import type { OwnIdentity } from '@kokuin/token';
 import type { KubunDB } from '@kubun/db';
 import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
+import type { HLC } from '@kubun/hlc';
 import type { Logger } from '@kubun/logger';
 import type { GroupBroadcastMessage } from '../groups/broadcast.js';
-import { type BroadcastEvent } from '../groups/broadcast-service.js';
 import type { P2PEventEmitter } from '../groups/events.js';
 import type { GroupHandleRegistry } from '../groups/group-handle-registry.js';
-import type { ForwardingConfig } from '../sync/forwarder.js';
-import type { StoreUnreadableMode } from '../types.js';
-import type { OnServerDIDObserved } from './connection-pool.js';
-import type { GroupChannel, GroupChannelParams } from './group-channel.js';
-import type { HubConnection, HubConnectionParams } from './hub-connection.js';
-import { type CreateHubClient } from './relay-manager.js';
+import type { RejoinResult, StoreUnreadableMode } from '../types.js';
+import type { OnServerDIDObserved } from './did-observing-transport.js';
+import type { CreateHubClient } from './http-client.js';
 export type HubWiring = {
     ready: Promise<void>;
     scheduleBroadcast: (groupID: string, message: GroupBroadcastMessage) => void;
@@ -24,62 +21,52 @@ export type HubWiring = {
     broadcastNow: (groupID: string, message: GroupBroadcastMessage) => Promise<void>;
     /**
      * Fire-and-forget fan-out of a pre-produced MLS handshake Commit to a
-     * group's existing members. Wired to `HubRelayManager.sendCommit`.
+     * group's existing members. Wired to `GroupPeerManager.sendCommit`.
      */
     scheduleSendCommit: (groupID: string, commitBytes: Uint8Array) => void;
+    /**
+     * Run stale-device MLS epoch recovery for an active group. Wired to
+     * `GroupPeerManager.rejoinGroup`; deep recovery is deferred so this currently
+     * reports `recovery-failed`.
+     */
+    rejoinGroup: (groupID: string) => Promise<RejoinResult>;
     dispose: () => Promise<void>;
 };
 export type SetupHubRelayParams = {
     identity: OwnIdentity;
+    /** Fresh correlation ids for group-rpc. */
+    getRandomID: () => string;
     db: KubunDB;
     /**
-     * Engine graph internals — threaded through to `BroadcastService` so the
-     * `mutation:apply` broadcast variant can route peer-authored mutations
-     * through the engine with `origin: 'peer'`.
+     * Engine graph internals — threaded through to the per-group peer apply path
+     * so a `sync/mutationApply` frame routes peer-authored mutations through the
+     * engine with `origin: 'peer'`.
      */
     graph: GraphInternals;
     emitter: P2PEventEmitter;
     createHubClient: CreateHubClient;
-    onRemoteBroadcast: (event: BroadcastEvent) => void;
-    /**
-     * Single canonical access point for MLS `GroupHandle` instances. Threaded
-     * into `BroadcastService` so encrypt/decrypt go through the per-group
-     * mutex once Phase 3 lands. Currently stored but unused.
-     */
+    /** Single canonical access point for MLS `GroupHandle` instances. */
     registry: GroupHandleRegistry;
     logger: Logger;
     /**
-     * Optional testing seam forwarded to `HubRelayManager`. Production code
-     * leaves this unset so the manager uses its default `GroupChannel`
-     * constructor.
-     */
-    createGroupChannel?: (params: GroupChannelParams) => GroupChannel;
-    /**
-     * Optional testing seam forwarded to `HubRelayManager`. Production code
-     * leaves this unset so the manager uses its default `HubConnection`
-     * constructor.
-     */
-    createHubConnection?: (params: HubConnectionParams) => HubConnection;
-    /**
-     * Receive-side storage mode. Forwarded to `BroadcastService` →
-     * `processBroadcast`. Defaults to `'persist'` when omitted.
+     * Receive-side storage mode. Forwarded to the apply path. Defaults to
+     * `'persist'` when omitted.
      */
     storeUnreadable?: StoreUnreadableMode;
     /** Server default access level — required when `storeUnreadable === 'drop'`. */
     defaultAccessLevel?: DefaultAccessLevel;
     /**
-     * Forwarding config. Threaded through to `BroadcastService` →
-     * `processBroadcast` along with the hub's own `scheduleBroadcast` hook.
-     * Default `false` disables the receive-time forwarding pipeline.
+     * Fired with the observed `serverDID` after the first signed response from a
+     * freshly-spawned client, hub URL bound. Lets callers route capture into
+     * `captureServerDID` for TOFU pinning; omitting it skips capture.
      */
-    forwarding?: ForwardingConfig;
+    onServerDIDObserved?: OnServerDIDObserved;
     /**
-     * Forwarded to `HubRelayManager` → `HubConnectionPool`. Fired with the
-     * observed `serverDID` after the first signed response from a freshly-spawned
-     * client. Lets callers route capture into `captureServerDID` for TOFU
-     * pinning; omitting it skips capture entirely.
+     * Device-wide monotonic clock forwarded to the apply path for stamping
+     * `removed_at_hlc` on roster reconciliation. Required: production passes the
+     * engine's single instance so roster writes share the device's one clock.
      */
-    onServerDIDObserved?: OnServerDIDObserved;
+    hlc: HLC;
 };
 export declare function setupHubRelay(params: SetupHubRelayParams): HubWiring;
 export declare const DISABLED_HUB: HubWiring;

package/lib/hub/wiring.js

@@ -1 +1,132 @@
-import{HLC as e}from"@kubun/hlc";import{BroadcastService as r}from"../groups/broadcast-service.js";import{HubRelayManager as o}from"./relay-manager.js";export function setupHubRelay(a){let t,{identity:d,db:i,graph:n,emitter:s,createHubClient:c,onRemoteBroadcast:u,registry:p,logger:h,createGroupChannel:l,createHubConnection:m,storeUnreadable:g,defaultAccessLevel:f,forwarding:b,onServerDIDObserved:y}=a,w=[],D=(e,r)=>{t.then(o=>o.broadcast(e,r).catch(r=>{h.error("broadcast failed",{groupID:e,error:r})}),()=>{})},v=async(e,r)=>{let o=await t;await o.broadcast(e,r)};return(t=(async()=>{let[a,t]=await Promise.all([i.getStore("p2p"),i.getStore("graph")]),v=new r({p2pStore:a,graphStore:t,graph:n,selfDID:d.id,registry:p,hlc:new e({nodeID:d.id}),storeUnreadable:g,defaultAccessLevel:f,forwarding:b,scheduleBroadcast:D,emitter:s,logger:h}),B=new o({p2pStore:a,broadcastService:v,deviceID:d.id,createHubClient:c,logger:h,createGroupChannel:l,createHubConnection:m,onServerDIDObserved:y});w.push(v.on("broadcast",u)),w.push(s.on("groupJoined",e=>B.addGroup(e.id).catch(r=>{h.error("addGroup failed",{groupID:e.id,error:r})}))),w.push(s.on("groupLeft",e=>B.removeGroup(e.groupID).catch(r=>{h.error("removeGroup failed",{groupID:e.groupID,error:r})}))),w.push(s.on("hubBound",({groupID:e,hubURL:r})=>B.addBinding(e,r).catch(o=>{h.error("addBinding failed",{groupID:e,hubURL:r,error:o})}))),w.push(s.on("hubUnbound",({groupID:e,hubURL:r})=>B.removeBinding(e,r).catch(o=>{h.error("removeBinding failed",{groupID:e,hubURL:r,error:o})})));let I=await a.listGroups();return await B.start(I.map(e=>e.id)),B})()).catch(e=>{h.error("hub relay setup failed",{error:e})}),{ready:t.then(()=>void 0),scheduleBroadcast:D,broadcastNow:v,scheduleSendCommit:(e,r)=>{t.then(o=>o.sendCommit(e,r).catch(r=>{h.error("sendCommit failed",{groupID:e,error:r})}),()=>{})},dispose:async()=>{for(let e of w)try{e()}catch{}w.length=0;try{let e=await t;await e.stop()}catch{}}}}export const DISABLED_HUB={ready:Promise.resolve(),scheduleBroadcast:()=>{},broadcastNow:async()=>{},scheduleSendCommit:()=>{},dispose:async()=>{}};
+import { createGroupPeerManager } from '../groups/group-peer-manager.js';
+export function setupHubRelay(params) {
+    const { identity, getRandomID, db, graph, emitter, createHubClient, registry, logger, storeUnreadable, defaultAccessLevel, onServerDIDObserved, hlc } = params;
+    const unsubscribes = [];
+    // Late-bound `ready` resolving to the live manager. The fire-and-forget
+    // schedulers chain off it so a caller can enqueue work before boot completes;
+    // the awaitable variants simply await it.
+    let ready;
+    const scheduleBroadcast = (groupID, message)=>{
+        void ready.then((manager)=>manager.broadcast(groupID, message).catch((error)=>{
+                logger.error('broadcast failed', {
+                    groupID,
+                    error
+                });
+            }), ()=>{
+        // ready rejected; setup failure already logged below
+        });
+    };
+    const broadcastNow = async (groupID, message)=>{
+        const manager = await ready;
+        await manager.broadcast(groupID, message);
+    };
+    const scheduleSendCommit = (groupID, commitBytes)=>{
+        void ready.then((manager)=>manager.sendCommit(groupID, commitBytes).catch((error)=>{
+                logger.error('sendCommit failed', {
+                    groupID,
+                    error
+                });
+            }), ()=>{
+        // ready rejected; setup failure already logged below
+        });
+    };
+    const rejoinGroup = async (groupID)=>{
+        const manager = await ready;
+        return await manager.rejoinGroup(groupID);
+    };
+    ready = (async ()=>{
+        const [p2pStore, graphStore] = await Promise.all([
+            db.getStore('p2p'),
+            db.getStore('graph')
+        ]);
+        const manager = createGroupPeerManager({
+            createHubClient,
+            registry,
+            stores: db,
+            graphStore,
+            graph,
+            hlc,
+            localDID: identity.id,
+            emitter,
+            getRandomID,
+            logger,
+            storeUnreadable,
+            defaultAccessLevel,
+            onServerDIDObserved
+        });
+        unsubscribes.push(emitter.on('groupJoined', (group)=>manager.addGroup(group.id).catch((error)=>{
+                logger.error('addGroup failed', {
+                    groupID: group.id,
+                    error
+                });
+            })));
+        unsubscribes.push(emitter.on('groupLeft', (group)=>manager.removeGroup(group.groupID).catch((error)=>{
+                logger.error('removeGroup failed', {
+                    groupID: group.groupID,
+                    error
+                });
+            })));
+        unsubscribes.push(emitter.on('hubBound', ({ groupID, hubURL })=>manager.addBinding(groupID, hubURL).catch((error)=>{
+                logger.error('addBinding failed', {
+                    groupID,
+                    hubURL,
+                    error
+                });
+            })));
+        unsubscribes.push(emitter.on('hubUnbound', ({ groupID, hubURL })=>manager.removeBinding(groupID, hubURL).catch((error)=>{
+                logger.error('removeBinding failed', {
+                    groupID,
+                    hubURL,
+                    error
+                });
+            })));
+        const groups = await p2pStore.listGroups();
+        await manager.start(groups.map((g)=>g.id));
+        return manager;
+    })();
+    // Prevent an unhandled rejection if nobody awaits `ready` directly.
+    ready.catch((error)=>{
+        logger.error('hub relay setup failed', {
+            error
+        });
+    });
+    return {
+        // Handle rejection here too: the base `.catch` covers the root `ready`, not
+        // this derived chain, and callers of `.ready` don't always await it.
+        ready: ready.then(()=>undefined, (error)=>{
+            logger.error('hub relay setup failed', {
+                error
+            });
+        }),
+        scheduleBroadcast,
+        broadcastNow,
+        scheduleSendCommit,
+        rejoinGroup,
+        dispose: async ()=>{
+            for (const off of unsubscribes){
+                try {
+                    off();
+                } catch  {
+                // ignore
+                }
+            }
+            unsubscribes.length = 0;
+            try {
+                const manager = await ready;
+                await manager.stop();
+            } catch  {
+            // setup failed; nothing to stop
+            }
+        }
+    };
+}
+export const DISABLED_HUB = {
+    ready: Promise.resolve(),
+    scheduleBroadcast: ()=>{},
+    broadcastNow: async ()=>{},
+    scheduleSendCommit: ()=>{},
+    rejoinGroup: async ()=>({
+            status: 'recovery-failed'
+        }),
+    dispose: async ()=>{}
+};

package/lib/index.d.ts

@@ -1,17 +1,20 @@
 import type { DefaultAccessLevel, KubunPlugin, PluginFactoryParams } from '@kubun/engine';
-import type { CreateHubClient } from './hub/relay-manager.js';
+import { type CreateHubClient } from './hub/http-client.js';
 import { type BroadcastBatchConfig } from './sync/broadcast-queue.js';
 import { type PushSyncConfig } from './sync/broadcast-sender.js';
 import type { ForwardingConfig } from './sync/forwarder.js';
 import type { StoreUnreadableMode } from './types.js';
 export type { ContextDeps, PendingJoinRequest } from './context/types.js';
+export { ADMIN_ROLE_ENTRY_TYPE, ADMIN_ROSTER_PROJECTION, type AdminRoleValue, type AdminRosterState, adminRosterReducer, applyAdminEntryIncremental, foldAdminRoster, type ProjectAdminRosterParams, projectAdminRoster, projectAdminRosterFromStore, reprojectAdminRoster, } from './groups/admin-roster.js';
 export { type AffectedRow, type GroupBroadcastMessage, type MutationApplyEntry, type ProcessBroadcastParams, type ProcessBroadcastResult, processBroadcast, } from './groups/broadcast.js';
 export { deserializeBroadcast, serializeBroadcast } from './groups/broadcast-codec.js';
-export { ApplyError, type BroadcastEvent, BroadcastService, type BroadcastServiceEvents, type BroadcastServiceParams, DecryptError, type ReceiveBroadcastParams, type ReceiveBroadcastResult, type SendBroadcastParams, } from './groups/broadcast-service.js';
 export { createFilteredGenerator, createP2PEventEmitter, type P2PEventEmitter, type P2PEventMap, } from './groups/events.js';
+export { type GroupAnchor, groupAnchorCapabilities, readGroupAnchor, } from './groups/group-anchor.js';
 export { GroupHandleRegistry, type GroupHandleRegistryParams, type SeedParams, } from './groups/group-handle-registry.js';
 export { decodeFullJoinRequest, decodeInvitePayload, decodeJoinRequest, encodeFullJoinRequest, encodeInvitePayload, encodeJoinRequest, type FullJoinRequestPayload, type InvitePayload, type JoinRequestPayload, type SuggestedHub, } from './groups/invite-payload.js';
-export { type AddCircleMemberParams, type AddCircleMemberResult, type CreateCircleParams, type CreateCircleResult, type CreateGroupParams, type CreateGroupResult, type DeleteCircleParams, type DeleteCircleResult, GroupManager, type GroupManagerParams, type InviteToGroupParams, type InviteToGroupResult, type JoinGroupParams, type JoinGroupResult, type LeaveGroupParams, type LeaveGroupResult, type RemoveCircleMemberParams, type RemoveCircleMemberResult, type RemoveGroupMemberParams, type RemoveGroupMemberResult, type RemoveMemberParams, type RemoveMemberResult, type UpdateCircleParams, type UpdateCircleResult, type UpdateGroupParams, type UpdateGroupResult, } from './groups/manager.js';
+export { type LedgerEntry, ledgerEntryDigest, signLedgerEntry, type VerifiedLedgerEntry, verifyLedgerEntry, } from './groups/ledger-entry.js';
+export { type FoldInput, foldLedger, type LedgerReducer, } from './groups/ledger-fold.js';
+export { type CreateGroupParams, type CreateGroupResult, GroupManager, type GroupManagerParams, type InviteToGroupParams, type InviteToGroupResult, type JoinGroupParams, type JoinGroupResult, type LeaveGroupParams, type LeaveGroupResult, type RemoveGroupMemberParams, type RemoveGroupMemberResult, type RemoveMemberParams, type RemoveMemberResult, } from './groups/manager.js';
 export { MLSEncryptor, type MLSEncryptorParams } from './groups/mls-encryptor.js';
 export { type MLSGroupHandle, restoreMLSGroupHandle } from './groups/mls-group-handle.js';
 export { replacer as mlsJSONReplacer, reviver as mlsJSONReviver } from './groups/mls-json.js';
@@ -21,21 +24,17 @@ export { createP2PSchemaExtension } from './schema.js';
 export { type BroadcastBatchConfig, type BroadcastQueue, type BroadcastQueueParams, createBroadcastQueue, DEFAULT_BROADCAST_BATCH_CONFIG, } from './sync/broadcast-queue.js';
 export { type BroadcastSenderParams, DEFAULT_PUSH_SYNC_CONFIG, type PushSyncConfig, wireBroadcastSender, } from './sync/broadcast-sender.js';
 export { type CatalogSyncScope, resolveCatalogSyncScopes } from './sync/catalog-scope.js';
+export { SyncAccessDeniedError } from './sync/errors.js';
 export { type EvaluateAndForwardParams, type EvaluateAndForwardResult, evaluateAndForward, type ForwardContext, type ForwardFilter, type ForwardingConfig, } from './sync/forwarder.js';
-export { checkSyncDelegation, negotiateDirection } from './sync/handlers.js';
+export { checkSyncDelegation } from './sync/handlers.js';
 export { HubTunnelSyncListener, type HubTunnelSyncListenerParams, } from './sync/hub-tunnel-sync-listener.js';
 export { HubTunnelSyncProvider, type HubTunnelSyncProviderParams, } from './sync/hub-tunnel-sync-provider.js';
-export { type PeerConfig, type PeerConfigWithID, PeerRegistry } from './sync/peer-registry.js';
+export { negotiateDirection, type PeerConfig, type PeerConfigWithID, PeerRegistry, } from './sync/peer-registry.js';
 export { SyncClient, type SyncClientParams, type SyncScope, type SyncTransportProvider, } from './sync/sync-client.js';
 export { type SyncEvent, SyncManager, type SyncManagerParams, type SyncSessionInfo, type SyncStatus, } from './sync/sync-manager.js';
-export type { OnServerDIDObserved } from './hub/connection-pool.js';
-export { DIDObservingTransport, type DIDObservingTransportParams, type ServerDIDObserver, } from './hub/did-observing-transport.js';
-export { ReconnectingError } from './hub/errors.js';
-export type { GroupChannel, GroupChannelParams } from './hub/group-channel.js';
-export { type CreateHTTPHubClientParams, createHTTPHubClient } from './hub/http-client.js';
-export type { ConnectionLifecycleEvent } from './hub/hub-connection.js';
+export { DIDObservingTransport, type DIDObservingTransportParams, type OnServerDIDObserved, type ServerDIDObserver, } from './hub/did-observing-transport.js';
+export { type CreateHTTPHubClientParams, type CreateHubClient, type CreateHubClientOptions, createHTTPHubClient, } from './hub/http-client.js';
 export { type BindHubToGroupParams, bindHubToGroup, type CaptureServerDIDParams, type CreateHubParams, captureServerDID, createHub, type DeleteHubParams, type DeleteHubResult, deleteHub, type GetHubParams, getHub, type Hub, HubServerDIDConflictError, type ListGroupsByHubParams, type ListHubsByGroupParams, type ListHubsParams, listGroupsByHub, listHubs, listHubsByGroup, type UnbindHubFromGroupParams, type UpdateHubParams, type UpsertHubParams, unbindHubFromGroup, updateHub, upsertHub, } from './hub/manager.js';
-export { type CreateGroupChannel, type CreateHubClient, type CreateHubClientOptions, type CreateHubConnection, HubRelayManager, type HubRelayManagerParams, type RelayEvent, } from './hub/relay-manager.js';
 export { DISABLED_HUB, type HubWiring, type SetupHubRelayParams, setupHubRelay, } from './hub/wiring.js';
 export type { CatalogData, CircleData, CircleMemberData, DeleteCatalogData, DeleteCircleData, GroupData, GroupMemberData, GroupRequestContext, InviteToGroupData, JoinGroupData, LeaveGroupData, P2PContext, P2PJoinRequestContext, RemoveCircleMemberData, RemoveGroupMemberData, StoreUnreadableMode, SyncPluginAPI, SyncRequestContext, SyncSessionResult, UpdateCircleInput, UpdateGroupInput, } from './types.js';
 export type ReceiveConfig = {
@@ -57,7 +56,24 @@ export type ReceiveConfig = {
 export declare const DEFAULT_RECEIVE_CONFIG: ReceiveConfig;
 export type P2PPluginOptions = {
     autoAcceptPeers?: Array<string>;
-    http?: boolean | string;
+    /**
+     * Expose the sync protocol over the HTTP plugin transport.
+     * - `true` / `{}` — enable at the default protocol path `'sync'`. CORS
+     *   defaults to deny cross-origin browser requests.
+     * - `'name'` / `'/name'` — enable at the given protocol path.
+     * - `{ path?, allowedOrigin?, bodyLimit? }` — `path` is the protocol path
+     *   (default `'sync'`); `allowedOrigin` opts into cross-origin (default deny).
+     *   The sync server authenticates every request, so CORS is defense-in-depth
+     *   rather than the security boundary; non-browser clients are unaffected.
+     *   `bodyLimit` is the maximum request body size in bytes (default 1 MiB),
+     *   enforced by the transport.
+     * - absent / `false` — HTTP sync transport disabled.
+     */
+    http?: boolean | string | {
+        path?: string;
+        allowedOrigin?: string | Array<string>;
+        bodyLimit?: number;
+    };
     /**
      * Enable hub-mediated group broadcasts.
      * - `true` / `{}` — build a default HTTP hub client factory from