@kubun/plugin-p2p 0.10.0 → 0.11.0

package/lib/sync/merkle-channel.js

@@ -1 +1,182 @@
-import{getGraphStore as e}from"@kubun/store-graph";import{applySyncMutations as t}from"./merkle-apply.js";import{buildMerkleTree as r,findDivergentBuckets as a,getTimeBuckets as l,SYNC_BATCH_SIZE as n}from"./merkle-tree.js";export function createMerkleSyncChannelHandler(i){let{db:s,graph:c,logger:o}=i,u=i.storeUnreadable??"persist";return async m=>{let{scopes:p,excludedDocumentIDs:y,tree:f,direction:w}=m.param,d=m.writable.getWriter();o.info("sync/merkle-sync channel started",{scopes:p,excludedDocumentIDs:y,direction:w});let k=0,h=0,g=0;try{let b=await e(s),v=await b.getDocumentIDsForScope(p,y),D=await b.getMutationLogForDocuments(v),W=r(D);await d.write({type:"tree",tree:W.buckets});let J={root:f.root??"",buckets:f},L=a(W,J);k=L.length;let S=async()=>{if("pull"===w||"both"===w){let e=new Set(L),t=D.filter(t=>{let{minute:r}=l(t.hlc);return e.has(r)});for(let e=0;e<t.length;e+=n){let r=t.slice(e,e+n);await d.write({type:"mutations",mutationJWTs:r.map(e=>e.mutation_jwt)}),h+=r.length}await d.write({type:"complete"})}else await d.write({type:"complete"})},T=async()=>{let e=[],t=m.readable.getReader();try{for(;;){let{done:r,value:a}=await t.read();if(r)break;if("mutations"===a.type&&null!=a.mutationJWTs)e.push(...a.mutationJWTs);else if("complete"===a.type)break}}finally{t.releaseLock()}return e},[,j]=await Promise.all([S(),T()]);if(j.length>0){let e=await t({db:s,graph:c,mutationJWTs:j,selfDID:i.selfDID,storeUnreadable:u,defaultAccessLevel:i.defaultAccessLevel});g=e.applied+e.pending,o.info("sync/merkle-sync: applied received mutations",{result:e})}}catch(e){return o.error("sync/merkle-sync channel error",{error:e}),{success:!1,divergentBuckets:0,mutationsSent:0,mutationsReceived:0}}finally{try{await d.close()}catch{}}return o.info("sync/merkle-sync channel completed",{divergentBuckets:k,mutationsSent:h,mutationsReceived:g}),{success:!0,divergentBuckets:k,mutationsSent:h,mutationsReceived:g}}}
+import { getGraphStore } from '@kubun/store-graph';
+import { authorizeScope } from './authorize.js';
+import { SyncAccessDeniedError } from './errors.js';
+import { applySyncMutations } from './merkle-apply.js';
+import { buildMerkleTree, findDivergentBuckets, getTimeBuckets, SYNC_BATCH_SIZE } from './merkle-tree.js';
+import { negotiateDirection } from './peer-registry.js';
+export function createMerkleSyncChannelHandler(params) {
+    const { db, graph, logger } = params;
+    const storeUnreadable = params.storeUnreadable ?? 'persist';
+    return async (ctx)=>{
+        const { scopes, excludedDocumentIDs, tree: remoteTree, direction } = ctx.param;
+        // Authorize before any store read. The viewer is the cryptographically
+        // verified signer (`iss`). A signed payload always carries `iss`; no
+        // legitimate kubun client sets `sub`, so a `sub` that differs from `iss`
+        // is a forgery attempt and is denied here. Every requested scope must then
+        // be authorized (owner or valid delegation); the first unauthorized scope
+        // fails the whole request with no partial filtering and no store read.
+        // The throw propagates to the caller as a rejected channel call.
+        // The payload is always present under requireAuth (identity is set on every
+        // sync Server), but guard defensively: a caller that reaches this handler
+        // without a verified signer must be denied, never treated as a viewer.
+        const payload = ctx.message?.payload;
+        if (payload?.iss == null) {
+            throw new SyncAccessDeniedError('unsigned', 'Sync access denied: missing verified signer');
+        }
+        if (payload.sub != null && payload.sub !== payload.iss) {
+            throw new SyncAccessDeniedError('forged-subject', 'Sync access denied: signed payload subject does not match issuer');
+        }
+        const viewerDID = payload.iss;
+        const revocationChecker = params.getRevocationChecker != null ? await params.getRevocationChecker() : undefined;
+        for (const scope of scopes){
+            const authorized = await authorizeScope({
+                viewerDID,
+                ownerDID: scope.ownerDID,
+                delegationTokens: ctx.param.delegationTokens ?? [],
+                revocationChecker
+            });
+            if (!authorized) {
+                throw new SyncAccessDeniedError('scope-denied', `Sync access denied: caller not authorized for scope ${scope.modelID}/${scope.ownerDID}`);
+            }
+        }
+        // Re-resolve the requested direction against the peer's policy. A client can
+        // reach merkle-sync without negotiating, so this is the fail-closed backstop:
+        // a direction the peer policy does not allow is denied here, not downgraded.
+        // Unknown peers have no policy and default to 'both', so they pass through.
+        // Note the policy is keyed on the verified signing DID: it only applies when
+        // the signer matches a registered peer DID, so direction restriction is not
+        // enforced for callers whose signing identity differs from any peer record
+        // (the scope gate above, not this knob, is the access-control boundary).
+        const requestedDirection = direction ?? 'pull';
+        const peer = await params.peerRegistry.getPeer({
+            peerDID: viewerDID,
+            stores: db
+        });
+        const agreedDirection = negotiateDirection(requestedDirection, peer?.allowedDirection ?? 'both');
+        if (agreedDirection !== requestedDirection) {
+            throw new SyncAccessDeniedError('direction-denied', `Sync access denied: direction ${requestedDirection} not permitted by peer policy`);
+        }
+        const writer = ctx.writable.getWriter();
+        logger.info('sync/merkle-sync channel started', {
+            scopes,
+            excludedDocumentIDs,
+            direction
+        });
+        let divergentBucketCount = 0;
+        let mutationsSent = 0;
+        let mutationsReceived = 0;
+        try {
+            const graphStore = await getGraphStore(db);
+            // Step 1: Get all document IDs for the agreed scope
+            const documentIDs = await graphStore.getDocumentIDsForScope(scopes, excludedDocumentIDs);
+            // Step 2: Get all mutation log entries for these documents
+            const localEntries = await graphStore.getMutationLogForDocuments(documentIDs);
+            // Step 3: Build local merkle tree
+            const localTree = buildMerkleTree(localEntries);
+            // Step 4: Send local tree to initiator
+            await writer.write({
+                type: 'tree',
+                tree: localTree.buckets
+            });
+            // Step 5: Find divergent buckets
+            const remoteMerkle = {
+                root: remoteTree.root ?? '',
+                buckets: remoteTree
+            };
+            const divergentBuckets = findDivergentBuckets(localTree, remoteMerkle);
+            divergentBucketCount = divergentBuckets.length;
+            // Step 6: Concurrent send and receive
+            const sendTask = async ()=>{
+                if (direction === 'pull' || direction === 'both') {
+                    // Filter local entries to those in divergent buckets
+                    const divergentSet = new Set(divergentBuckets);
+                    const entriesToSend = localEntries.filter((entry)=>{
+                        const { minute } = getTimeBuckets(entry.hlc);
+                        return divergentSet.has(minute);
+                    });
+                    // Send in batches
+                    for(let i = 0; i < entriesToSend.length; i += SYNC_BATCH_SIZE){
+                        const batch = entriesToSend.slice(i, i + SYNC_BATCH_SIZE);
+                        await writer.write({
+                            type: 'mutations',
+                            mutationJWTs: batch.map((e)=>e.mutation_jwt)
+                        });
+                        mutationsSent += batch.length;
+                    }
+                    await writer.write({
+                        type: 'complete'
+                    });
+                } else {
+                    // direction === 'push': no mutations to send, just signal complete
+                    await writer.write({
+                        type: 'complete'
+                    });
+                }
+            };
+            const receiveTask = async ()=>{
+                const collectedJWTs = [];
+                const reader = ctx.readable.getReader();
+                try {
+                    while(true){
+                        const { done, value } = await reader.read();
+                        if (done) break;
+                        if (value.type === 'mutations' && value.mutationJWTs != null) {
+                            collectedJWTs.push(...value.mutationJWTs);
+                        } else if (value.type === 'complete') {
+                            break;
+                        }
+                    }
+                } finally{
+                    reader.releaseLock();
+                }
+                return collectedJWTs;
+            };
+            const [, receivedJWTs] = await Promise.all([
+                sendTask(),
+                receiveTask()
+            ]);
+            // Apply received mutations
+            if (receivedJWTs.length > 0) {
+                const result = await applySyncMutations({
+                    db,
+                    graph,
+                    mutationJWTs: receivedJWTs,
+                    selfDID: params.selfDID,
+                    storeUnreadable,
+                    defaultAccessLevel: params.defaultAccessLevel
+                });
+                mutationsReceived = result.applied + result.pending;
+                logger.info('sync/merkle-sync: applied received mutations', {
+                    result
+                });
+            }
+        } catch (error) {
+            logger.error('sync/merkle-sync channel error', {
+                error
+            });
+            return {
+                success: false,
+                divergentBuckets: 0,
+                mutationsSent: 0,
+                mutationsReceived: 0
+            };
+        } finally{
+            try {
+                await writer.close();
+            } catch  {
+            // Writer may already be closed by Enkaku's handler wrapper
+            }
+        }
+        logger.info('sync/merkle-sync channel completed', {
+            divergentBuckets: divergentBucketCount,
+            mutationsSent,
+            mutationsReceived
+        });
+        return {
+            success: true,
+            divergentBuckets: divergentBucketCount,
+            mutationsSent,
+            mutationsReceived
+        };
+    };
+}

package/lib/sync/merkle-tree.js

@@ -1 +1,120 @@
-import{blake3 as t}from"@noble/hashes/blake3.js";export const SYNC_BATCH_SIZE=1e3;let e=[4,7,10,16],o=new TextEncoder;export function getTimeBuckets(t){return{year:t.slice(0,4),month:t.slice(0,7),day:t.slice(0,10),minute:t.slice(0,16)}}function r(e){return Array.from(t(o.encode(e))).map(t=>t.toString(16).padStart(2,"0")).join("")}export function buildMerkleTree(t){if(0===t.length)return{root:"",buckets:{}};let e=new Map;for(let o of t){let{minute:t}=getTimeBuckets(o.hlc),r=e.get(t);null==r&&(r=[],e.set(t,r)),r.push(o)}let o={};for(let[t,n]of e){let e=[...n].sort((t,e)=>t.mutation_hash<e.mutation_hash?-1:+(t.mutation_hash>e.mutation_hash)).map(t=>t.mutation_hash).join("\n");o[t]=r(e)}for(let t of[10,7,4]){let e=10===t?16:7===t?10:7,n=new Map;for(let r of Object.keys(o)){if(r.length!==e)continue;let o=r.slice(0,t),s=n.get(o);null==s&&(s=[],n.set(o,s)),s.push(r)}for(let[t,e]of n){let n=e.sort().map(t=>`${t}\0${o[t]}`).join("\n");o[t]=r(n)}}let n=r(Object.keys(o).filter(t=>4===t.length).sort().map(t=>`${t}\0${o[t]}`).join("\n"));return o.root=n,{root:n,buckets:o}}export function findDivergentBuckets(t,o){if(t.root===o.root)return[];if(""===t.root)return Object.keys(o.buckets).filter(t=>16===t.length).sort();if(""===o.root)return Object.keys(t.buckets).filter(t=>16===t.length).sort();let r=[],n=new Set([...Object.keys(t.buckets),...Object.keys(o.buckets)]);return!function s(l,i){let u=e[i];for(let c of[...n].filter(t=>t.length===u&&(""===l||t.startsWith(l))).sort())t.buckets[c]!==o.buckets[c]&&(i===e.length-1?r.push(c):s(c,i+1))}("",0),r.sort()}
+import { blake3 } from '@noble/hashes/blake3.js';
+/** Maximum number of mutation JWTs to send in a single channel message. */ export const SYNC_BATCH_SIZE = 1000;
+// Bucket key lengths: year=4, month=7, day=10, minute=16
+const BUCKET_LEVELS = [
+    4,
+    7,
+    10,
+    16
+];
+const MINUTE_KEY_LENGTH = 16;
+const encoder = new TextEncoder();
+export function getTimeBuckets(hlc) {
+    // HLC format: "2026-02-14T10:30:45.123Z:0001:nodeID"
+    return {
+        year: hlc.slice(0, 4),
+        month: hlc.slice(0, 7),
+        day: hlc.slice(0, 10),
+        minute: hlc.slice(0, 16)
+    };
+}
+function hashHex(input) {
+    const digest = blake3(encoder.encode(input));
+    return Array.from(digest).map((b)=>b.toString(16).padStart(2, '0')).join('');
+}
+export function buildMerkleTree(entries) {
+    if (entries.length === 0) {
+        return {
+            root: '',
+            buckets: {}
+        };
+    }
+    // Group entries by minute bucket
+    const minuteGroups = new Map();
+    for (const entry of entries){
+        const { minute } = getTimeBuckets(entry.hlc);
+        let group = minuteGroups.get(minute);
+        if (group == null) {
+            group = [];
+            minuteGroups.set(minute, group);
+        }
+        group.push(entry);
+    }
+    const buckets = {};
+    // Hash each minute bucket (leaf nodes)
+    for (const [minuteKey, bucketEntries] of minuteGroups){
+        const sorted = [
+            ...bucketEntries
+        ].sort((a, b)=>a.mutation_hash < b.mutation_hash ? -1 : a.mutation_hash > b.mutation_hash ? 1 : 0);
+        const content = sorted.map((e)=>e.mutation_hash).join('\n');
+        buckets[minuteKey] = hashHex(content);
+    }
+    // Build parent buckets bottom-up: day from minutes, month from days, year from months
+    const parentLevels = [
+        10,
+        7,
+        4
+    ]// day, month, year (key lengths)
+    ;
+    for (const parentLength of parentLevels){
+        const childLength = parentLength === 10 ? 16 : parentLength === 7 ? 10 : 7;
+        const groups = new Map();
+        for (const key of Object.keys(buckets)){
+            if (key.length !== childLength) continue;
+            const parentKey = key.slice(0, parentLength);
+            let group = groups.get(parentKey);
+            if (group == null) {
+                group = [];
+                groups.set(parentKey, group);
+            }
+            group.push(key);
+        }
+        for (const [parentKey, childKeys] of groups){
+            const sorted = childKeys.sort();
+            const content = sorted.map((k)=>`${k}\0${buckets[k]}`).join('\n');
+            buckets[parentKey] = hashHex(content);
+        }
+    }
+    // Build root hash from year buckets
+    const yearKeys = Object.keys(buckets).filter((k)=>k.length === 4).sort();
+    const rootContent = yearKeys.map((k)=>`${k}\0${buckets[k]}`).join('\n');
+    const root = hashHex(rootContent);
+    buckets.root = root;
+    return {
+        root,
+        buckets
+    };
+}
+export function findDivergentBuckets(local, remote) {
+    if (local.root === remote.root) return [];
+    // If either tree is empty, all of the other's minute buckets diverge
+    if (local.root === '') {
+        return Object.keys(remote.buckets).filter((k)=>k.length === MINUTE_KEY_LENGTH).sort();
+    }
+    if (remote.root === '') {
+        return Object.keys(local.buckets).filter((k)=>k.length === MINUTE_KEY_LENGTH).sort();
+    }
+    const divergent = [];
+    const allKeys = new Set([
+        ...Object.keys(local.buckets),
+        ...Object.keys(remote.buckets)
+    ]);
+    function walk(prefix, levelIndex) {
+        const keyLength = BUCKET_LEVELS[levelIndex];
+        const keysAtLevel = [
+            ...allKeys
+        ].filter((k)=>k.length === keyLength && (prefix === '' || k.startsWith(prefix))).sort();
+        for (const key of keysAtLevel){
+            if (local.buckets[key] === remote.buckets[key]) continue;
+            if (levelIndex === BUCKET_LEVELS.length - 1) {
+                // Leaf level (minute) — this bucket diverges
+                divergent.push(key);
+            } else {
+                // Drill into next level
+                walk(key, levelIndex + 1);
+            }
+        }
+    }
+    walk('', 0);
+    return divergent.sort();
+}

package/lib/sync/peer-registry.d.ts

@@ -1,6 +1,13 @@
-import type { Runtime } from '@enkaku/runtime';
 import type { StoreProvider } from '@kubun/db';
+import type { Runtime } from '@sozai/runtime';
 import type { SyncDirection } from '../protocol.js';
+/**
+ * Resolve the effective sync direction given what the initiator requested
+ * and what the responder's per-peer policy allows.
+ * If allowed is 'both' (or unset), the request passes through.
+ * Otherwise the responder's policy wins.
+ */
+export declare function negotiateDirection(requested: SyncDirection, allowed: SyncDirection): SyncDirection;
 export type PeerConfig = {
     peerDID: string;
     endpoint: string;

package/lib/sync/peer-registry.js

@@ -1 +1,107 @@
-import{getP2PStore as e}from"@kubun/store-p2p";function t(e){var t,r;let i="string"==typeof(t=e.config)?JSON.parse(t):t??{};return{id:e.id,peerDID:e.peer_did,endpoint:e.endpoint,mode:e.mode,allowedUsers:"string"==typeof(r=e.allowed_users)?JSON.parse(r):r,priority:e.priority,trustLevel:e.trust_level,allowedDirection:i.allowedDirection,createdAt:e.created_at,updatedAt:e.updated_at}}export class PeerRegistry{#e;constructor(e){this.#e=e.runtime}async addPeer(t){let r=await e(t.stores);await r.addSyncPeer({id:this.#e.getRandomID(),peer_did:t.config.peerDID,endpoint:t.config.endpoint,mode:t.config.mode,allowed_users:t.config.allowedUsers,priority:t.config.priority,trust_level:t.config.trustLevel,config:{allowedDirection:t.config.allowedDirection},created_at:Date.now(),updated_at:Date.now()})}async getPeer(r){let i=await e(r.stores),o=await i.getSyncPeer(r.peerDID);if(o)return t(o)}async listPeers(r){let i=await e(r.stores);return(await i.listSyncPeers()).map(e=>t(e))}async updatePeer(t){let r=await this.getPeer({peerDID:t.peerDID,stores:t.stores});if(!r)throw Error(`Peer ${t.peerDID} not found`);let i={...r,...t.updates},o=await e(t.stores);await o.updateSyncPeer(t.peerDID,{endpoint:i.endpoint,mode:i.mode,allowed_users:i.allowedUsers,priority:i.priority,trust_level:i.trustLevel,config:{allowedDirection:i.allowedDirection}})}async removePeer(t){let r=await e(t.stores);await r.removeSyncPeer(t.peerDID)}async isPeerAllowed(e){return void 0!==await this.getPeer({peerDID:e.peerDID,stores:e.stores})}}
+import { getP2PStore } from '@kubun/store-p2p';
+/**
+ * Resolve the effective sync direction given what the initiator requested
+ * and what the responder's per-peer policy allows.
+ * If allowed is 'both' (or unset), the request passes through.
+ * Otherwise the responder's policy wins.
+ */ export function negotiateDirection(requested, allowed) {
+    if (allowed === 'both') return requested;
+    if (requested === 'both') return allowed;
+    if (requested === allowed) return requested;
+    // Incompatible — responder policy wins
+    return allowed;
+}
+function parseAllowedUsers(value) {
+    if (typeof value === 'string') {
+        return JSON.parse(value);
+    }
+    return value;
+}
+function parseConfig(value) {
+    if (typeof value === 'string') {
+        return JSON.parse(value);
+    }
+    return value ?? {};
+}
+function rowToPeerConfig(row) {
+    const config = parseConfig(row.config);
+    return {
+        id: row.id,
+        peerDID: row.peer_did,
+        endpoint: row.endpoint,
+        mode: row.mode,
+        allowedUsers: parseAllowedUsers(row.allowed_users),
+        priority: row.priority,
+        trustLevel: row.trust_level,
+        allowedDirection: config.allowedDirection,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at
+    };
+}
+export class PeerRegistry {
+    #runtime;
+    constructor(params){
+        this.#runtime = params.runtime;
+    }
+    async addPeer(params) {
+        const store = await getP2PStore(params.stores);
+        await store.addSyncPeer({
+            id: this.#runtime.getRandomID(),
+            peer_did: params.config.peerDID,
+            endpoint: params.config.endpoint,
+            mode: params.config.mode,
+            allowed_users: params.config.allowedUsers,
+            priority: params.config.priority,
+            trust_level: params.config.trustLevel,
+            config: {
+                allowedDirection: params.config.allowedDirection
+            },
+            created_at: Date.now(),
+            updated_at: Date.now()
+        });
+    }
+    async getPeer(params) {
+        const store = await getP2PStore(params.stores);
+        const row = await store.getSyncPeer(params.peerDID);
+        if (!row) return undefined;
+        return rowToPeerConfig(row);
+    }
+    async listPeers(params) {
+        const store = await getP2PStore(params.stores);
+        const rows = await store.listSyncPeers();
+        return rows.map((row)=>rowToPeerConfig(row));
+    }
+    async updatePeer(params) {
+        const current = await this.getPeer({
+            peerDID: params.peerDID,
+            stores: params.stores
+        });
+        if (!current) throw new Error(`Peer ${params.peerDID} not found`);
+        const updated = {
+            ...current,
+            ...params.updates
+        };
+        const store = await getP2PStore(params.stores);
+        await store.updateSyncPeer(params.peerDID, {
+            endpoint: updated.endpoint,
+            mode: updated.mode,
+            allowed_users: updated.allowedUsers,
+            priority: updated.priority,
+            trust_level: updated.trustLevel,
+            config: {
+                allowedDirection: updated.allowedDirection
+            }
+        });
+    }
+    async removePeer(params) {
+        const store = await getP2PStore(params.stores);
+        await store.removeSyncPeer(params.peerDID);
+    }
+    async isPeerAllowed(params) {
+        const peer = await this.getPeer({
+            peerDID: params.peerDID,
+            stores: params.stores
+        });
+        return peer !== undefined;
+    }
+}

package/lib/sync/receive-access-gate.js

@@ -1 +1,24 @@
-import{createAccessChecker as e}from"@kubun/engine";export function createReceiveAccessGate(c){let t=e({viewerDID:c.selfDID,db:c.db,defaultAccessLevel:c.defaultAccessLevel});return e=>t(e,"read")}
+import { createAccessChecker } from '@kubun/engine';
+/**
+ * Build an {@link AccessGate} that returns `true` iff the local peer can
+ * read the post-state document under the resolved access rule.
+ *
+ * Used by the receive paths (`processBroadcast` mutation:apply branch and
+ * `applySyncMutations`) when `storeUnreadable: 'drop'` is configured. The
+ * gate is intentionally cheap to construct — the heavy work (rule
+ * resolution + membership lookups) happens lazily when the gate is invoked
+ * inside the engine's apply pipeline.
+ *
+ * Drop-mode access checks happen at receive time without delegation
+ * token context (the broadcast doesn't carry tokens). A peer who would
+ * gain read access only via a delegation token will have the doc
+ * dropped under `storeUnreadable: 'drop'`. Use `'persist'` if delegation
+ * chains must be honored at receive time.
+ */ export function createReceiveAccessGate(params) {
+    const checker = createAccessChecker({
+        viewerDID: params.selfDID,
+        db: params.db,
+        defaultAccessLevel: params.defaultAccessLevel
+    });
+    return (postState)=>checker(postState, 'read');
+}

package/lib/sync/scope-resolver.js

@@ -1 +1,41 @@
-export function computeBroadcastScopes(e){let{resolvedRule:r,senderGroupIDs:o}=e;switch(r.level){case"only_owner":return[];case"anyone":return Array.from(new Set(o));case"restricted":{let e=new Set;for(let t of o)(r.allowedGroupIDs.has(t)||r.allowedCircleParentGroupIDs.has(t)||r.allowedDIDGroupIDs.has(t))&&e.add(t);return Array.from(e)}default:{let e=r.level;throw Error(`Unknown access level: ${String(e)}`)}}}
+/**
+ * Compute the set of MLS group IDs to broadcast a document to,
+ * given its resolved access rule and the sender's group memberships.
+ *
+ * Pure, synchronous. The caller is responsible for:
+ * - Pre-resolving the access rule into a `ResolvedAccessRule` (all rule-side
+ *   lookups — circle parent groups and per-DID group memberships —
+ *   collapsed to MLS group ID sets).
+ * - Pre-filtering `senderGroupIDs` by catalog-match against the document.
+ *
+ * Per spec §3 "Sync routing" (sender side): a sender's own MLS group is a
+ * valid broadcast scope iff that group is the encryption perimeter for at
+ * least one allowed principal — either the group itself is in allowedGroups,
+ * or an allowed circle's parent group matches, or an allowed DID is a member
+ * of that group. The receiver applies the per-recipient access check on
+ * decrypt; the sender's own circle membership is irrelevant for routing.
+ */ export function computeBroadcastScopes(input) {
+    const { resolvedRule, senderGroupIDs } = input;
+    switch(resolvedRule.level){
+        case 'only_owner':
+            return [];
+        case 'anyone':
+            // Dedupe sender group IDs while preserving the input order.
+            return Array.from(new Set(senderGroupIDs));
+        case 'restricted':
+            {
+                const scopes = new Set();
+                for (const groupID of senderGroupIDs){
+                    if (resolvedRule.allowedGroupIDs.has(groupID) || resolvedRule.allowedCircleParentGroupIDs.has(groupID) || resolvedRule.allowedDIDGroupIDs.has(groupID)) {
+                        scopes.add(groupID);
+                    }
+                }
+                return Array.from(scopes);
+            }
+        default:
+            {
+                const _exhaustive = resolvedRule.level;
+                throw new Error(`Unknown access level: ${String(_exhaustive)}`);
+            }
+    }
+}

package/lib/sync/sync-client.d.ts

@@ -1,15 +1,15 @@
 import { Client } from '@enkaku/client';
 import type { ClientTransportOf } from '@enkaku/protocol';
-import type { Runtime } from '@enkaku/runtime';
-import type { SigningIdentity } from '@enkaku/token';
+import type { SigningIdentity } from '@kokuin/token';
 import type { Logger } from '@kubun/logger';
+import type { Runtime } from '@sozai/runtime';
 import type { SyncDirection, SyncProtocol } from '../protocol.js';
 /**
  * Provider for sync-specific transport to a peer's sync server.
  * The p2p plugin exposes this via `createSyncTransport()`.
  */
 export type SyncTransportProvider = {
-    createSyncTransport: (signal?: AbortSignal) => ClientTransportOf<SyncProtocol>;
+    createSyncTransport: (signal?: AbortSignal) => ClientTransportOf<SyncProtocol> | Promise<ClientTransportOf<SyncProtocol>>;
 };
 export type SyncClientParams = {
     runtime: Runtime;
@@ -62,6 +62,8 @@ export declare class SyncClient {
             hlc: string;
             mutation_jwt: string;
         }>;
+        /** Delegation JWTs authorizing the caller for non-owned scopes. */
+        delegationTokens?: Array<string>;
     }): Promise<{
         mutationJWTs: Array<string>;
         divergentBuckets: number;