@kubun/plugin-p2p 0.10.0 → 0.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-p2p",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "license": "see LICENSE.md",
   "type": "module",
   "main": "lib/index.js",
@@ -14,54 +14,61 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@enkaku/async": "^0.16.0",
-    "@enkaku/capability": "^0.16.0",
-    "@enkaku/client": "^0.16.0",
-    "@enkaku/codec": "^0.16.0",
-    "@enkaku/event": "^0.16.0",
-    "@enkaku/generator": "^0.16.0",
-    "@enkaku/group": "^0.16.1",
-    "@enkaku/http-client-transport": "^0.16.0",
-    "@enkaku/http-server-transport": "^0.16.0",
-    "@enkaku/hub-protocol": "^0.16.0",
-    "@enkaku/hub-tunnel": "^0.16.0",
-    "@enkaku/protocol": "^0.16.0",
-    "@enkaku/runtime": "^0.16.0",
-    "@enkaku/schema": "^0.16.0",
-    "@enkaku/server": "^0.16.0",
-    "@enkaku/stream": "^0.16.0",
-    "@enkaku/token": "^0.16.0",
-    "@enkaku/transport": "^0.16.0",
+    "@sozai/async": "^0.1.0",
+    "@kumiai/broadcast": "^0.1.0",
+    "@kokuin/capability": "^0.1.0",
+    "@enkaku/client": "^0.18.1",
+    "@sozai/codec": "^0.1.0",
+    "@sozai/event": "^0.1.0",
+    "@sozai/generator": "^0.1.0",
+    "@kumiai/mls": "^0.1.0",
+    "@kumiai/rpc": "^0.1.0",
+    "@enkaku/http-fetch": "^0.18.1",
+    "@enkaku/http-serve": "^0.18.1",
+    "@kumiai/hub-protocol": "^0.1.0",
+    "@kumiai/hub-tunnel": "^0.1.0",
+    "@enkaku/protocol": "^0.18.1",
+    "@sozai/runtime": "^0.1.0",
+    "@sozai/schema": "^0.1.0",
+    "@enkaku/server": "^0.18.1",
+    "@sozai/stream": "^0.1.0",
+    "@kokuin/token": "^0.1.1",
+    "@enkaku/transport": "^0.18.1",
     "@noble/hashes": "^2.2.0",
-    "graphql": "^16.13.2",
+    "graphql": "^16.14.2",
     "kysely": "^0.29.2",
-    "@kubun/client": "^0.10.0",
-    "@kubun/db": "^0.10.0",
-    "@kubun/store-graph": "^0.10.0",
-    "@kubun/graphql": "^0.10.0",
-    "@kubun/db-adapter": "^0.10.0",
-    "@kubun/hlc": "^0.10.0",
-    "@kubun/id": "^0.10.0",
-    "@kubun/engine": "^0.10.0",
-    "@kubun/store-p2p": "^0.10.0",
-    "@kubun/mutation": "^0.10.0",
-    "@kubun/logger": "^0.10.0",
-    "@kubun/protocol": "^0.10.0"
+    "ts-mls": "2.0.0-rc.13",
+    "@kubun/db": "^0.11.0",
+    "@kubun/db-adapter": "^0.11.0",
+    "@kubun/graphql": "^0.11.0",
+    "@kubun/hlc": "^0.11.0",
+    "@kubun/engine": "^0.11.0",
+    "@kubun/http-util": "^0.11.0",
+    "@kubun/logger": "^0.11.0",
+    "@kubun/client": "^0.11.0",
+    "@kubun/id": "^0.11.0",
+    "@kubun/mutation": "^0.11.0",
+    "@kubun/store-graph": "^0.11.0",
+    "@kubun/protocol": "^0.11.0",
+    "@kubun/store-delegation": "^0.11.0",
+    "@kubun/store-p2p": "^0.11.0"
   },
   "devDependencies": {
-    "@enkaku/hub-server": "^0.16.0",
+    "@kumiai/hub-server": "^0.1.0",
+    "@testcontainers/postgresql": "^12.0.4",
     "get-port": "^7.2.0",
-    "@kubun/db-better-sqlite": "^0.10.0",
-    "@kubun/plugin-connector": "^0.10.0",
-    "@kubun/hub": "^0.10.0",
-    "@kubun/db-node-sqlite": "^0.10.0",
-    "@kubun/plugin-http": "^0.10.0",
-    "@kubun/plugin-rpc": "^0.10.0",
-    "@kubun/test-utils": "^0.10.0"
+    "@kubun/db-better-sqlite": "^0.11.0",
+    "@kubun/db-node-sqlite": "^0.11.0",
+    "@kubun/plugin-connector": "^0.11.0",
+    "@kubun/db-postgres": "^0.11.0",
+    "@kubun/plugin-rpc": "^0.11.0",
+    "@kubun/plugin-http": "^0.11.0",
+    "@kubun/hub": "^0.11.0",
+    "@kubun/test-utils": "^0.11.0"
   },
   "scripts": {
     "build:clean": "del lib",
-    "build:js": "swc src -d ./lib --config-file ../../swc.json --strip-leading-paths",
+    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
     "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
     "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "test:types": "tsc --noEmit -p tsconfig.test.json",

package/lib/groups/broadcast-service.d.ts

@@ -1,189 +0,0 @@
-import { EventEmitter } from '@enkaku/event';
-import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
-import { HLC } from '@kubun/hlc';
-import type { Logger } from '@kubun/logger';
-import type { GraphStoreAPI } from '@kubun/store-graph';
-import type { P2PStoreAPI } from '@kubun/store-p2p';
-import type { ForwardingConfig } from '../sync/forwarder.js';
-import type { StoreUnreadableMode } from '../types.js';
-import { type AffectedRow, type GroupBroadcastMessage } from './broadcast.js';
-import type { P2PEventEmitter } from './events.js';
-import type { GroupHandleRegistry } from './group-handle-registry.js';
-/**
- * Thrown when a received broadcast fails to decrypt (MLS restore, decrypt,
- * or deserialize). Callers should typically ack-and-skip these, since the
- * message is unrecoverable and redelivery will not help.
- */
-export declare class DecryptError extends Error {
-    readonly cause: unknown;
-    constructor(message: string, cause: unknown);
-}
-/**
- * Thrown when a successfully decrypted broadcast fails to apply to the local
- * DB. Callers should typically NOT ack these, so the message can be
- * redelivered after the transient failure clears.
- */
-export declare class ApplyError extends Error {
-    readonly cause: unknown;
-    constructor(message: string, cause: unknown);
-}
-/**
- * Thrown when a received MLS Commit targets a future epoch the local handle
- * has not reached yet (a gap in the in-order Commit stream). Callers should
- * NOT ack — the hub redelivers in `sequence_id` order, so the gap-filling
- * Commit arrives first and this one applies on a later delivery.
- */
-export declare class CommitOutOfOrderError extends Error {
-    readonly messageEpoch: bigint;
-    readonly handleEpoch: bigint;
-    constructor(messageEpoch: bigint, handleEpoch: bigint);
-}
-export type BroadcastEvent = {
-    groupID: string;
-    message: GroupBroadcastMessage;
-    applied: boolean;
-    /**
-     * Row affected by the broadcast. After-state for create / update,
-     * before-state for delete / remove. Undefined when `applied === false`.
-     */
-    affected?: AffectedRow;
-    /**
-     * Count of `mutation:apply` entries the local broadcast log already had.
-     * Only set on the `mutation:apply` branch; absent on control-plane
-     * variants.
-     */
-    duplicates?: number;
-};
-export type BroadcastServiceEvents = {
-    broadcast: BroadcastEvent;
-};
-export type SendBroadcastParams = {
-    groupID: string;
-    message: GroupBroadcastMessage;
-    /**
-     * Wire-send hook invoked with the MLS-encrypted payload INSIDE the
-     * registry's per-group lock. A throw here propagates out of `prepareSend`
-     * and the registry skips persist — so a failed send leaves the device's
-     * MLS state at its pre-encrypt epoch, preventing the wedge where local
-     * state outpaces recipients.
-     */
-    send: (encrypted: Uint8Array) => Promise<void>;
-};
-export type SendCommitParams = {
-    groupID: string;
-    /**
-     * Canonical MLS-encoded handshake Commit bytes (an encrypted
-     * `PrivateMessage`) produced by the committer's `GroupManager` call.
-     */
-    commitBytes: Uint8Array;
-    /** Wire-send hook; receives the `mls`-framed bytes. */
-    send: (framed: Uint8Array) => Promise<void>;
-};
-export type ReceiveBroadcastParams = {
-    groupID: string;
-    encrypted: Uint8Array;
-};
-export type ReceiveAppResult = {
-    kind: 'app';
-    message: GroupBroadcastMessage;
-    applied: boolean;
-    affected?: AffectedRow;
-    duplicates?: number;
-};
-/**
- * Result of processing a received MLS handshake Commit (`mls` wire frame).
- * `removed`/`added` are the membership deltas derived by diffing the group
- * roster before and after applying the Commit. `removed` DIDs are tombstoned
- * via `markMemberRemoved` so the apply-time membership check can reject their
- * post-removal writes.
- */
-export type ReceiveCommitResult = {
-    kind: 'mls';
-    epoch: bigint;
-    removed: Array<string>;
-    added: Array<string>;
-};
-export type ReceiveBroadcastResult = ReceiveAppResult | ReceiveCommitResult;
-/**
- * BroadcastService handles MLS encrypt/decrypt for group broadcasts
- * and applies received messages to the local DB.
- *
- * Encrypt and decrypt go through `GroupHandleRegistry.withHandle` so MLS
- * state mutations serialize through the per-group mutex with write-through
- * persist. The DB-apply step (`processBroadcast`) for receives runs OUTSIDE
- * the lock so a slow apply does not block subsequent encrypt/decrypt on the
- * same group.
- */
-export type BroadcastServiceParams = {
-    p2pStore: P2PStoreAPI;
-    graphStore: GraphStoreAPI;
-    /**
-     * Engine graph internals — required so `mutation:apply` broadcasts route
-     * through {@link GraphInternals.applyVerifiedMutation} with `origin: 'peer'`.
-     */
-    graph: GraphInternals;
-    /** Self DID for `mutation:apply` loopback detection. */
-    selfDID: string;
-    /** Single canonical access point for MLS `GroupHandle` instances. */
-    registry: GroupHandleRegistry;
-    /**
-     * Local HLC clock for stamping the `removed_at_hlc` of members dropped by a
-     * received MLS Commit (the receive side has no HLC otherwise). Defaults to a
-     * fresh clock keyed on `selfDID` when omitted.
-     */
-    hlc?: HLC;
-    /**
-     * Receiver storage mode for incoming `mutation:apply` entries. Defaults
-     * to `'persist'`. When `'drop'`, `defaultAccessLevel` must be supplied
-     * so the gate factory can resolve server-side default access rules.
-     */
-    storeUnreadable?: StoreUnreadableMode;
-    /** Server default access level — required when `storeUnreadable === 'drop'`. */
-    defaultAccessLevel?: DefaultAccessLevel;
-    /**
-     * Forwarding config. Threaded into `processBroadcast` per call.
-     * `false` / undefined → forwarding disabled (default).
-     */
-    forwarding?: ForwardingConfig;
-    /**
-     * Hub forwarding hook — required when `forwarding` is set. Called once per
-     * surviving candidate group on the receive path.
-     */
-    scheduleBroadcast?: (groupID: string, message: GroupBroadcastMessage) => void | Promise<void>;
-    /**
-     * Emitter forwarded to `processBroadcast` so `delegation:share` receives
-     * surface a `delegationTokenAdded` event to local subscribers.
-     */
-    emitter?: P2PEventEmitter;
-    logger?: Logger;
-};
-export declare class BroadcastService extends EventEmitter<BroadcastServiceEvents> {
-    #private;
-    constructor(params: BroadcastServiceParams);
-    /**
-     * Encrypt + send a broadcast for a group, then persist the advanced MLS state.
-     *
-     * Failure semantics: send happens inside the registry's per-group lock. A
-     * throw from `send` propagates out and the registry skips persist — so the
-     * device's MLS state stays at its pre-encrypt epoch and the next attempt
-     * re-derives a fresh handle from the prior generation. Wedge protection
-     * intact.
-     */
-    prepareSend(params: SendBroadcastParams): Promise<void>;
-    /**
-     * Send a pre-produced MLS handshake Commit to the group, tagged `mls` on the
-     * wire. The Commit is already a self-protected (encrypted `PrivateMessage`)
-     * framed message produced by the committer's `GroupManager` call — it is NOT
-     * re-encrypted through the application path, so this does not touch the
-     * handle. The committer's MLS state has already advanced + persisted; the
-     * hub's durable + ordered mailbox carries the Commit to existing members and
-     * replays it on reconnect.
-     */
-    prepareSendCommit(params: SendCommitParams): Promise<void>;
-    /**
-     * Process a received broadcast: MLS decrypt INSIDE the registry lock,
-     * then apply to the DB OUTSIDE the lock so a slow apply doesn't block
-     * subsequent encrypt/decrypt on the same group.
-     */
-    processReceived(params: ReceiveBroadcastParams): Promise<ReceiveBroadcastResult>;
-}

package/lib/groups/broadcast-service.js

@@ -1 +0,0 @@
-import{EventEmitter as r}from"@enkaku/event";import{readMessageEpoch as e}from"@enkaku/group";import{HLC as t}from"@kubun/hlc";import{processBroadcast as a}from"./broadcast.js";import{deserializeBroadcast as o,serializeBroadcast as s}from"./broadcast-codec.js";import{mlsDecryptFramed as i,mlsEncryptFramed as c}from"./mls-codec.js";import{frameWire as p,unframeWire as m,WireKind as d}from"./wire-frame.js";export class DecryptError extends Error{cause;constructor(r,e){super(r),this.name="DecryptError",this.cause=e}}export class ApplyError extends Error{cause;constructor(r,e){super(r),this.name="ApplyError",this.cause=e}}export class CommitOutOfOrderError extends Error{messageEpoch;handleEpoch;constructor(r,e){super(`MLS commit epoch ${r} ahead of handle epoch ${e}`),this.name="CommitOutOfOrderError",this.messageEpoch=r,this.handleEpoch=e}}export class BroadcastService extends r{#r;#e;#t;constructor(r){super(),this.#t=r.hlc??new t({nodeID:r.selfDID}),this.#r={p2pStore:r.p2pStore,graphStore:r.graphStore,graph:r.graph,selfDID:r.selfDID,storeUnreadable:r.storeUnreadable,defaultAccessLevel:r.defaultAccessLevel,forwarding:r.forwarding,scheduleBroadcast:r.scheduleBroadcast,emitter:r.emitter,logger:r.logger},this.#e=r.registry}async prepareSend(r){let{groupID:e,message:t,send:a}=r,o=s(t);await this.#e.withHandle(e,async r=>{let{framed:e}=await c(r,o);await a(p(d.app,e))})}async prepareSendCommit(r){let{commitBytes:e,send:t}=r;await t(p(d.mls,e))}async processReceived(r){let e,t,s,c,{groupID:p,encrypted:l}=r;try{({kind:e,payload:t}=m(l))}catch(r){throw new DecryptError("Malformed group wire frame",r)}if(e===d.mls)return await this.#a(p,t);try{s=await this.#e.withHandle(p,async r=>{let e=await i(r,t);return o(e)})}catch(r){throw new DecryptError("Failed to decrypt broadcast",r)}try{c=await a(this.#r,s,p)}catch(r){throw new ApplyError("Failed to apply broadcast",r)}let{applied:h,affected:n,duplicates:u}=c;return await this.emit("broadcast",{groupID:p,message:s,applied:h,affected:n,duplicates:u}),{kind:"app",message:s,applied:h,affected:n,duplicates:u}}async #a(r,a){return await this.#e.withHandle(r,async o=>{let s=e(a),i=o.epoch;if(null!=s&&s<i)return{kind:"mls",epoch:i,removed:[],added:[]};if(null!=s&&s>i)throw new CommitOutOfOrderError(s,i);let c=o.listMembers();try{await o.processMessage(a)}catch(r){throw new DecryptError("Failed to process MLS commit",r)}let p=o.listMembers(),m=new Set(c.map(r=>r.id)),d=new Set(p.map(r=>r.id)),l=c.filter(r=>!d.has(r.id)).map(r=>r.id),h=p.filter(r=>!m.has(r.id)).map(r=>r.id),n=t.serialize(this.#t.now()),{p2pStore:u}=this.#r;for(let e of l)await u.markMemberRemoved(r,e,n);for(let e of h)await u.addGroupMember({group_id:r,member_did:e,role:"member",hlc:n});return{kind:"mls",epoch:o.epoch,removed:l,added:h}})}}

package/lib/groups/wire-frame.d.ts

@@ -1,32 +0,0 @@
-/**
- * Outer wire-frame discriminator for group hub payloads.
- *
- * The hub relay treats a group send payload as opaque bytes. Kubun prepends a
- * single `kind` byte so the receiver can route a payload to the right decoder
- * without trial-decryption:
- *
- * - `app` — an MLS-encrypted application broadcast (`GroupBroadcastMessage`),
- *   decoded via `handle.decrypt` + `deserializeBroadcast`.
- * - `mls` — a framed MLS handshake message (a Commit), fed straight to
- *   `handle.processMessage`. The handshake is self-protected (encrypted
- *   `PrivateMessage`), so it is NOT wrapped in the application-encryption path.
- *
- * The discriminator lives entirely in kubun's payload bytes; the hub protocol
- * is unchanged.
- */
-export declare const WireKind: {
-    readonly app: 0;
-    readonly mls: 1;
-};
-export type WireKind = (typeof WireKind)[keyof typeof WireKind];
-/** Prepend the `kind` byte to a payload. */
-export declare function frameWire(kind: WireKind, payload: Uint8Array): Uint8Array;
-/**
- * Split a framed payload into its `kind` and the remaining payload bytes.
- * Throws on an empty frame or an unrecognized `kind` byte. The returned
- * payload is a view (`subarray`) over the input, not a copy.
- */
-export declare function unframeWire(framed: Uint8Array): {
-    kind: WireKind;
-    payload: Uint8Array;
-};

package/lib/groups/wire-frame.js

@@ -1 +0,0 @@
-export const WireKind={app:0,mls:1};export function frameWire(r,e){let n=new Uint8Array(e.length+1);return n[0]=r,n.set(e,1),n}export function unframeWire(r){if(0===r.length)throw Error("empty wire frame");let e=r[0];if(e!==WireKind.app&&e!==WireKind.mls)throw Error(`unknown wire frame kind: ${e}`);return{kind:e,payload:r.subarray(1)}}

package/lib/hub/connection-pool.d.ts

@@ -1,43 +0,0 @@
-import type { Client } from '@enkaku/client';
-import type { HubProtocol } from '@enkaku/hub-protocol';
-import type { Logger } from '@kubun/logger';
-import type { CreateHubClient } from './relay-manager.js';
-export type HubClientRef = {
-    client: Client<HubProtocol>;
-    refID: string;
-};
-/**
- * Fired once per freshly-spawned hub client when its first signed response
- * arrives. The pool binds the hub URL into the call site; consumers (hub
- * manager `captureServerDID`) use the URL to look up the local hub row and
- * apply the conflict matrix. Errors are caught and logged — capture never
- * blocks message forwarding, even on `HubServerDIDConflictError`.
- */
-export type OnServerDIDObserved = (params: {
-    hubURL: string;
-    serverDID: string;
-}) => void | Promise<void>;
-/**
- * Resolves the locally-pinned `server_did` for a hub URL at spawn time. When
- * the hub row for this URL exists and has `server_did` set, the pool passes
- * it as `expectedServerDID` to the client factory so the wrapper enforces
- * the pin. Returning `null` falls back to TOFU.
- *
- * Resolution happens fresh on every spawn so `updateHub({ serverDID: null })`
- * re-arms TOFU automatically: the next disposed/evicted client triggers a
- * fresh resolve.
- */
-export type ResolvePinnedServerDID = (hubURL: string) => Promise<string | null>;
-export type HubConnectionPoolParams = {
-    createHubClient: CreateHubClient;
-    logger?: Logger;
-    onServerDIDObserved?: OnServerDIDObserved;
-    resolvePinnedDID?: ResolvePinnedServerDID;
-};
-export declare class HubConnectionPool {
-    #private;
-    constructor(params: HubConnectionPoolParams);
-    acquire(hubURL: string): Promise<HubClientRef>;
-    release(hubURL: string, refID: string): Promise<void>;
-    disposeAll(): Promise<void>;
-}

package/lib/hub/connection-pool.js

@@ -1 +0,0 @@
-export class HubConnectionPool{#e;#t;#i;#r;#s=new Map;#n=0;constructor(e){this.#e=e.createHubClient,this.#t=e.logger,this.#i=e.onServerDIDObserved,this.#r=e.resolvePinnedDID}async acquire(e){let t=this.#s.get(e);if(null!=t&&null!=t.disposing&&(await t.disposing,this.#s.get(e)===t&&this.#s.delete(e),t=void 0),null==t){let i,r=this.#i;if(null!=this.#r)try{let t=await this.#r(e);null!=t&&(i=t)}catch(t){this.#t?.warn("failed to resolve pinned server DID, falling back to TOFU",{hubURL:e,error:t})}let s=await this.#e(e,{onServerDID:null==r?void 0:async t=>{try{await r({hubURL:e,serverDID:t})}catch(i){this.#t?.warn("hub server DID capture failed",{hubURL:e,serverDID:t,error:i})}},expectedServerDID:i,onMismatch:null==i?void 0:e=>{this.#t?.warn("hub server DID mismatch — pinning enforcement triggered",{hubURL:e.hubURL,expectedServerDID:e.expectedServerDID,observedServerDID:e.observedServerDID})}}),n={client:s,refs:new Set};t=n,this.#s.set(e,n),s.disposed.then(()=>{this.#s.get(e)===n&&(this.#t?.debug("hub client disposed externally, evicting pool entry",{hubURL:e,outstandingRefs:[...n.refs]}),this.#s.delete(e))}).catch(()=>{})}let i=String(++this.#n);return t.refs.add(i),{client:t.client,refID:i}}async release(e,t){let i=this.#s.get(e);if(null==i)return void this.#t?.debug("HubConnectionPool.release: unknown hubURL",{hubURL:e,refID:t});if(!i.refs.has(t))return void this.#t?.debug("HubConnectionPool.release: unknown refID",{hubURL:e,refID:t});if(i.refs.delete(t),i.refs.size>0)return;let r=i.client.dispose();i.disposing=r;try{await r}finally{this.#s.get(e)===i&&this.#s.delete(e)}}async disposeAll(){let e=Array.from(this.#s.entries());await Promise.all(e.map(async([e,t])=>{t.refs.size>0&&this.#t?.warn("Disposing hub client with outstanding refs",{hubURL:e,refs:Array.from(t.refs)}),await t.client.dispose()})),this.#s.clear()}}

package/lib/hub/forward-remote-broadcast.d.ts

@@ -1,15 +0,0 @@
-import type { Logger } from '@kubun/logger';
-import type { BroadcastEvent } from '../groups/broadcast-service.js';
-import type { P2PEventEmitter } from '../groups/events.js';
-/**
- * Map a `BroadcastEvent` from `BroadcastService` into the matching
- * `P2PEventEmitter` event.
- *
- * - Events with `applied === false` are ignored (no state change).
- * - `catalog:*` messages are currently a no-op. Catalog send-side broadcasts
- *   and event propagation are deferred to a future task (see design spec).
- * - Payloads are built from `event.affected.row`, which `processBroadcast`
- *   captures at the appropriate moment (after-state for create / update,
- *   before-state for delete / remove).
- */
-export declare function forwardRemoteBroadcast(emitter: P2PEventEmitter, event: BroadcastEvent, logger?: Logger): Promise<void>;

package/lib/hub/forward-remote-broadcast.js

@@ -1 +0,0 @@
-import{toISO as e}from"../context/types.js";export async function forwardRemoteBroadcast(r,t,a){if(!t.applied)return;let{message:i,affected:c}=t;if("delegation:share"!==i.type){if(null==c)return void a?.warn("remote broadcast applied but affected row missing",{type:i.type});switch(i.type){case"circle:create":{if("circle"!==c.kind)return;let{row:t}=c;await r.emit("circleCreated",{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at)});return}case"circle:update":{if("circle"!==c.kind)return;let{row:t}=c,a=null!=i.update.catalogIDs?"circleCatalogsChanged":"circleDataChanged";await r.emit(a,{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at),circleID:t.id});return}case"circle:delete":{if("circle"!==c.kind)return;let{row:t}=c;await r.emit("circleDeleted",{id:t.id,groupID:t.group_id,name:t.name,description:t.description,createdAt:e(t.created_at)});return}case"member:add":{if("member"!==c.kind)return;let{row:t}=c;await r.emit("circleMemberAdded",{circleID:t.circle_id,memberDID:t.member_did,role:t.role,createdAt:e(t.created_at)});return}case"member:remove":{if("member"!==c.kind)return;let{row:t}=c;await r.emit("circleMemberRemoved",{circleID:t.circle_id,memberDID:t.member_did,role:t.role,createdAt:e(t.created_at)});return}case"group:update":{if("group"!==c.kind)return;let{row:t}=c;await r.emit("groupDataChanged",{id:t.id,name:t.name,description:t.description,createdBy:t.created_by,createdAt:e(t.created_at),groupID:t.id});return}case"catalog:create":case"catalog:update":case"catalog:delete":return void a?.debug("catalog broadcast ignored (not yet wired)",{type:i.type})}}}

package/lib/hub/group-channel.d.ts

@@ -1,67 +0,0 @@
-import { Disposer } from '@enkaku/async';
-import type { Logger } from '@kubun/logger';
-import type { P2PStoreAPI } from '@kubun/store-p2p';
-import type { GroupBroadcastMessage } from '../groups/broadcast.js';
-import type { BroadcastService } from '../groups/broadcast-service.js';
-import type { HubConnection } from './hub-connection.js';
-export type AckBatchParams = {
-    flushMs: number;
-    flushMax: number;
-    send: (ids: Array<string>) => Promise<void>;
-    logger?: Logger;
-};
-export declare class AckBatch {
-    #private;
-    constructor(params: AckBatchParams);
-    add(id: string): void;
-    /**
-     * Drain the pending id set and send it via the configured sender. Never
-     * rejects: send errors are logged and the ids are dropped silently (the hub
-     * will redeliver unacknowledged messages, so the next receive will produce a
-     * fresh ack).
-     */
-    flush(): Promise<void>;
-    dispose(): void;
-}
-export declare function computeBackoff(attempt: number, base: number, max: number, jitter: number): number;
-export declare function abortableSleep(ms: number, signal: AbortSignal): Promise<void>;
-export type GroupChannelParams = {
-    groupID: string;
-    deviceID: string;
-    hubConnection: HubConnection;
-    broadcastService: BroadcastService;
-    p2pStore: P2PStoreAPI;
-    logger?: Logger;
-};
-/**
- * Per-group handle: thin wrapper around a shared `HubConnection`.
- *
- * `open()` subscribes to the connection (issuing `hub/group/join` once),
- * `close()` unsubscribes (drains the per-group mutex then issues
- * `hub/group/leave`), and `broadcast()` runs the MLS encrypt+send pipeline
- * inside `HubConnection.runInGroup()` so the per-group mutex serializes send
- * and receive on the same MLS state.
- *
- * All transport state (refID, ack batching, receive loop, reconnect/backoff)
- * lives on `HubConnection` and is shared across every channel for that
- * `hubURL`. A peer with N groups uses ONE `hub/receive` stream per
- * `(deviceDID, hubURL)` rather than N — this preserves the hub-server's
- * single-writer-per-DID invariant for bridge peers.
- */
-export declare class GroupChannel extends Disposer {
-    #private;
-    constructor(params: GroupChannelParams);
-    open(): Promise<void>;
-    close(): Promise<void>;
-    broadcast(message: GroupBroadcastMessage, opts?: {
-        timeoutMs?: number;
-    }): Promise<void>;
-    /**
-     * Fan out a pre-produced MLS handshake Commit to the group's existing
-     * members. Mirrors {@link broadcast} but routes through `handleSendCommit`
-     * (no application encryption — the Commit is already self-protected).
-     */
-    sendCommit(commitBytes: Uint8Array, opts?: {
-        timeoutMs?: number;
-    }): Promise<void>;
-}

package/lib/hub/group-channel.js

@@ -1 +0,0 @@
-import{Disposer as e}from"@enkaku/async";import{handleReceivedMessage as t}from"./receive-handler.js";import{handleSendBroadcast as r,handleSendCommit as i}from"./send-handler.js";export class AckBatch{#e;#t;#r;#i;#s=new Set;#o=null;constructor(e){this.#e=e.flushMs,this.#t=e.flushMax,this.#r=e.send,this.#i=e.logger}add(e){let t=0===this.#s.size;if(this.#s.add(e),this.#s.size>=this.#t){null!==this.#o&&(clearTimeout(this.#o),this.#o=null),this.flush();return}t&&null===this.#o&&(this.#o=setTimeout(()=>{this.#o=null,this.flush()},this.#e))}async flush(){if(null!==this.#o&&(clearTimeout(this.#o),this.#o=null),0===this.#s.size)return;let e=Array.from(this.#s);this.#s.clear();try{await this.#r(e)}catch(t){this.#i?.error("ack batch send failed",{error:t,count:e.length})}}dispose(){null!==this.#o&&(clearTimeout(this.#o),this.#o=null),this.#s.clear()}}export function computeBackoff(e,t,r,i){let s=Math.min(t*2**e*(1+i*(2*Math.random()-1)),r);return s<0?0:s}export function abortableSleep(e,t){return new Promise((r,i)=>{if(t.aborted)return void i(t.reason??Error("aborted"));let s=setTimeout(()=>{t.removeEventListener("abort",o),r()},e),o=()=>{clearTimeout(s),t.removeEventListener("abort",o),i(t.reason??Error("aborted"))};t.addEventListener("abort",o)})}export class GroupChannel extends e{#n;#h;#a;#u;#c;#i;#d=!1;constructor(e){super({dispose:async()=>{await this.#l()}}),this.#n=e.groupID,this.#h=e.deviceID,this.#a=e.hubConnection,this.#u=e.broadcastService,this.#c=e.p2pStore,this.#i=e.logger}async open(){if(this.#d)throw Error("GroupChannel already opened");let e=await this.#c.getMLSState(this.#n,this.#h);if(null==e)throw Error(`MLS state missing for group ${this.#n}; cannot join hub group`);await this.#a.subscribe(this.#n,e.credential,e=>this.#p(e)),this.#d=!0}#p(e){return t({groupID:this.#n,message:e,broadcastService:this.#u,logger:this.#i})}async close(){this.#d&&await this.dispose()}async #l(){if(this.#d){try{await this.#a.unsubscribe(this.#n)}catch(e){this.#i?.warn("hub-connection unsubscribe failed during close",{groupID:this.#n,error:e})}this.#d=!1}}broadcast(e,t){return this.#d?this.#a.runInGroup(this.#n,async()=>{if(!this.#d)throw Error(`GroupChannel for ${this.#n} is not ready for broadcast`);await r({groupID:this.#n,message:e,broadcastService:this.#u,send:(e,r)=>this.#a.broadcast(e,r,{timeoutMs:t?.timeoutMs}),logger:this.#i})},{timeoutMs:t?.timeoutMs}):Promise.reject(Error(`GroupChannel for ${this.#n} is not ready for broadcast`))}sendCommit(e,t){return this.#d?this.#a.runInGroup(this.#n,async()=>{if(!this.#d)throw Error(`GroupChannel for ${this.#n} is not ready for sendCommit`);await i({groupID:this.#n,commitBytes:e,broadcastService:this.#u,send:(e,r)=>this.#a.broadcast(e,r,{timeoutMs:t?.timeoutMs}),logger:this.#i})},{timeoutMs:t?.timeoutMs}):Promise.reject(Error(`GroupChannel for ${this.#n} is not ready for sendCommit`))}}

package/lib/hub/hub-connection.d.ts

@@ -1,96 +0,0 @@
-import { Disposer } from '@enkaku/async';
-import { EventEmitter } from '@enkaku/event';
-import type { StoredMessage } from '@enkaku/hub-protocol';
-import type { Logger } from '@kubun/logger';
-import type { HubConnectionPool } from './connection-pool.js';
-import type { ReceivedHubMessage } from './receive-handler.js';
-export type TunnelMessageStream = AsyncIterable<StoredMessage> & {
-    return(): void;
-};
-export type TunnelMessageStreamParams = {
-    peerDID: string;
-};
-export type SubscriptionHandler = (message: ReceivedHubMessage) => Promise<{
-    ack: boolean;
-}>;
-export type ConnectionLifecycleEvent = {
-    type: 'connected';
-} | {
-    type: 'disconnected';
-    reason?: string;
-} | {
-    type: 'error';
-    error: unknown;
-} | {
-    type: 'reconnecting';
-    attempt: number;
-    delayMs: number;
-};
-type HubConnectionEvents = {
-    lifecycle: ConnectionLifecycleEvent;
-};
-export type HubConnectionParams = {
-    hubURL: string;
-    deviceID: string;
-    pool: HubConnectionPool;
-    logger?: Logger;
-    ackFlushMs?: number;
-    ackFlushMax?: number;
-    backoffBaseMs?: number;
-    backoffMaxMs?: number;
-    backoffJitter?: number;
-};
-export declare class HubConnection extends Disposer {
-    #private;
-    constructor(params: HubConnectionParams);
-    get events(): EventEmitter<HubConnectionEvents>;
-    open(): Promise<void>;
-    subscribe(groupID: string, credential: string, handler: SubscriptionHandler): Promise<void>;
-    unsubscribe(groupID: string): Promise<void>;
-    broadcast(groupID: string, encryptedPayload: string, opts?: {
-        timeoutMs?: number;
-    }): Promise<void>;
-    /**
-     * Send an opaque tunnel-style message to explicit recipients via
-     * `hub/send`. No `groupID` is attached at the hub level — recipients
-     * receive the message on the tunnel-routing path (see
-     * {@link tunnelMessageStream}). Used by hub-mediated document sync.
-     */
-    send(params: {
-        recipients: Array<string>;
-        payload: Uint8Array;
-        timeoutMs?: number;
-    }): Promise<{
-        sequenceID: string;
-    }>;
-    /**
-     * Run `fn` inside the same per-group mutex used by receive `#dispatch`. This
-     * lets callers (e.g. `GroupChannel.broadcast`) serialize MLS-state-mutating
-     * pipelines with incoming-message handling on the same group, avoiding races
-     * between concurrent send-encrypt and receive-decrypt against shared MLS
-     * group state.
-     *
-     * The gate-await ensures the subscription map is settled before lookup —
-     * i.e. mid-reconnect callers wait for the subscription to be (re)registered
-     * rather than throwing.
-     */
-    runInGroup<T>(groupID: string, fn: () => Promise<T>, opts?: {
-        timeoutMs?: number;
-    }): Promise<T>;
-    /**
-     * Register a per-peer tunnel inbox and return a disposable async iterable
-     * of {@link StoredMessage} values received from that peer over the tunnel
-     * (i.e. direct hub messages with no `groupID`).
-     *
-     * Used by the hub-mediated document sync server adapter (see Q3 of the
-     * hub-mediated document sync plan). The hub's receive-side dispatcher
-     * keys tunnel routing on `senderDID` because hub-level messages cannot
-     * reveal the in-frame `sessionID` (the body is encrypted). P2P pairs
-     * `peerDID` and `sessionID` at session creation, so peer-keying is
-     * sufficient. Concurrent tunnel sessions to the same peer are not
-     * supported and are the caller's responsibility to avoid.
-     */
-    tunnelMessageStream({ peerDID }: TunnelMessageStreamParams): TunnelMessageStream;
-    close(): Promise<void>;
-}
-export {};

package/lib/hub/hub-connection.js

@@ -1 +0,0 @@
-import{Disposer as e}from"@enkaku/async";import{fromB64 as t,toB64 as s}from"@enkaku/codec";import{EventEmitter as n}from"@enkaku/event";import{createMutex as i}from"../util/mutex.js";import{ReconnectingError as r}from"./errors.js";import{AckBatch as o,abortableSleep as h,computeBackoff as a}from"./group-channel.js";import{TunnelInbox as c}from"./tunnel-inbox.js";import{waitForGate as l}from"./wait-for-gate.js";let u=Symbol("disposed");export class HubConnection extends e{#e;#t;#s;#n;#i;#r;#o;#h;#a;#c=null;#l=null;#u=null;#b=null;#p=null;#d=new Map;#f=!1;#g=0;#m=null;#y=new Map;#w;constructor(e){super({dispose:async()=>{await this.#L()}}),this.#e=e.hubURL,this.#t=e.deviceID,this.#s=e.pool,this.#n=e.logger,this.#i=e.ackFlushMs??500,this.#r=e.ackFlushMax??10,this.#o=e.backoffBaseMs??1e3,this.#h=e.backoffMaxMs??6e4,this.#a=e.backoffJitter??.25,this.#w=new n}get events(){return this.#w}async #I(e){try{await this.#w.emit("lifecycle",e)}catch(t){this.#n?.warn("hub-connection lifecycle subscriber threw",{hubURL:this.#e,type:e.type,error:t})}}async open(){if(this.#f)throw Error("HubConnection already opened");try{await this.#k(),this.#f=!0,await this.#I({type:"connected"})}catch(e){if(null!=this.#l){try{await this.#s.release(this.#e,this.#l)}catch(e){this.#n?.debug("hub-connection pool release after open failure failed",{hubURL:this.#e,error:e})}this.#l=null}throw this.#c=null,e}}async #k(){if(null!=this.#l){let e=this.#l;this.#l=null,this.#c=null;try{await this.#s.release(this.#e,e)}catch(e){this.#n?.debug("hub-connection pool release before reconnect failed",{hubURL:this.#e,error:e})}}let{client:e,refID:t}=await this.#s.acquire(this.#e);this.#c=e,this.#l=t;let s=e.createChannel("hub/receive",{param:{},signal:this.signal});this.#u=s,s.catch(()=>{}),this.#b=new o({flushMs:this.#i,flushMax:this.#r,send:async e=>{await s.send({ack:e})},logger:this.#n}),this.#p=this.#R(e).catch(e=>{this.#n?.debug("hub-connection receive task tail error",{hubURL:this.#e,error:e})});let n=[...this.#d.entries()];if(n.length>0){let t=await Promise.allSettled(n.map(async([t,s])=>{await e.request("hub/group/join",{param:{groupID:t,credential:s.credential}})}));for(let e=0;e<t.length;e++){let s=t[e];if("rejected"===s.status){let t=n[e][0];this.#n?.warn("hub-connection rejoin failed",{hubURL:this.#e,groupID:t,error:s.reason})}}}}async subscribe(e,t,s){if(await l(this.#m,void 0),!this.#f||null==this.#c)throw Error("HubConnection not open");if(this.#d.has(e))throw Error(`already subscribed to group ${e}`);await this.#c.request("hub/group/join",{param:{groupID:e,credential:t}}),this.#d.set(e,{credential:t,handler:s,mutex:i()})}async unsubscribe(e){await l(this.#m,void 0);let t=this.#c;if(!this.#f||null==t)throw Error("HubConnection not open");let s=this.#d.get(e);if(null==s)throw Error(`not subscribed to group ${e}`);await s.mutex.run(async()=>{}),await t.request("hub/group/leave",{param:{groupID:e}}),this.#d.delete(e)}async broadcast(e,t,s){if(await l(this.#m,s?.timeoutMs,()=>new r(this.#e,this.#g)),!this.#f||null==this.#c)throw Error("HubConnection not open");await this.#c.request("hub/group/send",{param:{groupID:e,payload:t}})}async send(e){if(await l(this.#m,e.timeoutMs,()=>new r(this.#e,this.#g)),!this.#f||null==this.#c)throw Error("HubConnection not open");return{sequenceID:(await this.#c.request("hub/send",{param:{recipients:e.recipients,payload:s(e.payload)}})).sequenceID}}async runInGroup(e,t,s){if(await l(this.#m,s?.timeoutMs,()=>new r(this.#e,this.#g)),!this.#f)throw Error("HubConnection not open");let n=this.#d.get(e);if(null==n)throw Error(`not subscribed to group ${e}`);return n.mutex.run(t)}tunnelMessageStream({peerDID:e}){if(this.#y.has(e))throw Error("tunnelMessageStream: peerDID already registered");let t=new c,s={inbox:t};this.#y.set(e,s);let n=!1;return{[Symbol.asyncIterator]:()=>t.iterator(),return:()=>{n||(n=!0,this.#y.get(e)===s&&this.#y.delete(e),t.close())}}}async #R(e){let t=this.#u;if(null==t)return;let s=t.readable.getReader(),n=null;try{for(;!this.signal.aborted;){let t=s.read(),n=e.disposed.then(()=>u),i=await Promise.race([t,n]);if("symbol"==typeof i){this.#n?.debug("hub-connection receive loop observed hub client disposal",{hubURL:this.#e});break}let{done:r,value:o}=i;if(r)break;this.#D(o),this.#g=0}}catch(e){n=e,this.#n?.warn("hub-connection receive loop error",{hubURL:this.#e,error:e})}finally{try{s.releaseLock()}catch{}}if(!this.signal.aborted){let e=n instanceof Error&&n.message?n.message:"receive loop ended";await this.#I({type:"disconnected",reason:e}),this.#U()}}#U(){this.#p=this.#M().catch(e=>{this.#n?.debug("hub-connection reconnect task tail error",{hubURL:this.#e,error:e})})}async #M(){let e=()=>{};this.#m=new Promise(t=>{e=t});try{for(;!this.signal.aborted;){let e=a(this.#g++,this.#o,this.#h,this.#a);this.#n?.debug("hub-connection reconnect scheduled",{hubURL:this.#e,delay:e,attempt:this.#g});try{await h(e,this.signal)}catch{return}await this.#I({type:"reconnecting",attempt:this.#g,delayMs:e});try{this.#b?.dispose(),this.#b=null,this.#u=null,await this.#k(),this.#g=0,await this.#I({type:"connected"});return}catch(e){this.#n?.warn("hub-connection reconnect attempt failed",{hubURL:this.#e,attempt:this.#g,error:e}),await this.#I({type:"error",error:e})}}}finally{this.#m=null,e()}}#D(e){if(null==e.groupID){let s=this.#y.get(e.senderDID);if(null!=s){let n={sequenceID:e.sequenceID,senderDID:e.senderDID,payload:t(e.payload)};s.inbox.push(n),this.#b?.add(e.sequenceID);return}this.#n?.debug("direct message received, no handler",{hubURL:this.#e,sequenceID:e.sequenceID}),this.#b?.add(e.sequenceID);return}let s=this.#d.get(e.groupID);null==s?this.#n?.debug("message for unsubscribed group",{hubURL:this.#e,groupID:e.groupID,sequenceID:e.sequenceID}):s.mutex.run(()=>s.handler(e)).then(t=>{t.ack&&this.#b?.add(e.sequenceID)}).catch(t=>{this.#n?.warn("hub-connection subscription handler error",{hubURL:this.#e,groupID:e.groupID,sequenceID:e.sequenceID,error:t})})}async close(){this.#f&&await this.dispose()}async #L(){if(!this.#f)return;let e=this.#b;if(this.#b=null,null!=e){try{await e.flush()}catch(e){this.#n?.debug("hub-connection ack flush during close failed",{hubURL:this.#e,error:e})}e.dispose()}try{this.#u?.close()}catch{}try{await this.#p}catch{}let t=[...this.#d.values()].map(e=>e.mutex.run(async()=>{}).catch(()=>{}));if(await Promise.allSettled(t),null!=this.#l){try{await this.#s.release(this.#e,this.#l)}catch(e){this.#n?.debug("hub-connection pool release during close failed",{hubURL:this.#e,error:e})}this.#l=null}for(let e of(this.#c=null,this.#u=null,this.#p=null,this.#d.clear(),this.#y.values()))e.inbox.close();this.#y.clear(),this.#f=!1}}

package/lib/hub/receive-handler.d.ts

@@ -1,33 +0,0 @@
-import type { Logger } from '@kubun/logger';
-import { type BroadcastService } from '../groups/broadcast-service.js';
-/**
- * Shape of a message pushed by `hub/receive`. Matches `@enkaku/hub-protocol`
- * server-to-client push payload.
- */
-export type ReceivedHubMessage = {
-    sequenceID: string;
-    senderDID: string;
-    groupID?: string;
-    /** base64-encoded encrypted MLS application message */
-    payload: string;
-};
-export type HandleReceivedMessageParams = {
-    groupID: string;
-    message: ReceivedHubMessage;
-    broadcastService: BroadcastService;
-    logger?: Logger;
-};
-export type HandleReceivedMessageResult = {
-    ack: boolean;
-};
-/**
- * Apply a single hub-received message for a group.
- *
- * Returns `{ ack: true }` when the message has been processed to a state where
- * redelivery serves no purpose (applied successfully, or decrypt failed with
- * no recovery path). Returns `{ ack: false }` when the hub should redeliver
- * (transient apply failure or unexpected error). Skips with `{ ack: false }`
- * on groupID mismatch so the message stays queued for whichever recipient it
- * was intended for.
- */
-export declare function handleReceivedMessage(params: HandleReceivedMessageParams): Promise<HandleReceivedMessageResult>;

package/lib/hub/receive-handler.js

@@ -1 +0,0 @@
-import{fromB64 as e}from"@enkaku/codec";import{ApplyError as r,CommitOutOfOrderError as c,DecryptError as s}from"../groups/broadcast-service.js";export async function handleReceivedMessage(a){let{groupID:n,message:o,broadcastService:i,logger:t}=a;if(o.groupID!==n)return t?.debug("hub message groupID mismatch, skipping",{groupID:n,messageGroupID:o.groupID,sequenceID:o.sequenceID}),{ack:!1};let u=e(o.payload);try{await i.processReceived({groupID:n,encrypted:u})}catch(e){if(e instanceof s)return t?.debug("decrypt failed, acking and skipping",{groupID:n,sequenceID:o.sequenceID,error:e}),{ack:!0};if(e instanceof c)return t?.debug("mls commit out of order, will redeliver after gap fills",{groupID:n,sequenceID:o.sequenceID,messageEpoch:e.messageEpoch.toString(),handleEpoch:e.handleEpoch.toString()}),{ack:!1};if(e instanceof r)return t?.error("broadcast apply failed, will redeliver",{groupID:n,sequenceID:o.sequenceID,error:e}),{ack:!1};return t?.error("unexpected error processing hub message",{groupID:n,sequenceID:o.sequenceID,error:e}),{ack:!1}}return{ack:!0}}