@kubun/plugin-p2p 0.10.1 → 0.12.0

package/lib/groups/store-received-grant.js

@@ -1 +1,161 @@
-import{verifyToken as e}from"@enkaku/token";export async function storeReceivedGrant(i){let t,{p2pStore:a,token:n,groupID:r,hlc:o,selfDID:d,emitter:p,logger:s}=i;try{t=(await e(n)).payload}catch(e){return s?.warn("received grant token verification failed, skipping",{groupID:r,error:e}),!1}if(t.aud!==d)return!1;if(null==t.jti||null==t.exp)return s?.warn("received grant token missing jti/exp, skipping",{groupID:r}),!1;let u="string"==typeof t.res?t.res:JSON.stringify(t.res),c="string"==typeof t.act?t.act:JSON.stringify(t.act),g=await a.addDelegationToken({jti:t.jti,grantor:t.sub,audience:t.aud,token:n,resource:u,act:c,exp:t.exp,group_id:r,hlc:o});if(g){let e=await a.getPendingRevocationByJti(t.jti);if(null!=e)if(e.revoker_did===t.sub){let i=Math.floor(Date.now()/1e3);await a.markRevocationVerified(t.jti,{cap_exp:t.exp,verified_at:i})&&null!=p&&await p.emit("delegationTokenRevoked",{jti:t.jti,grantor:t.sub,audience:t.aud,revokerDID:e.revoker_did,revokedAt:e.revoked_iat,verifiedAt:i,capExp:t.exp,groupID:r})}else s?.warn("pending revocation iss does not match arriving cap, dropping",{jti:t.jti,pendingIss:e.revoker_did,capGrantor:t.sub,groupID:r}),await a.deletePendingRevocation(t.jti)}return g&&null!=p&&await p.emit("delegationTokenAdded",{jwt:n,jti:t.jti,grantor:t.sub,audience:t.aud,resource:u,exp:t.exp}),g}
+import { normalizeDID, verifyToken } from '@kokuin/token';
+import { MAX_CAP_TTL_SECONDS } from '@kubun/store-delegation';
+/**
+ * Verify a received capability grant and, when it is addressed to this device,
+ * store it as a held row so the engine's auto-attach can reuse it on later
+ * mutations.
+ *
+ * Returns `true` when the held row was inserted or materially changed (LWW
+ * upsert with a newer hlc and at least one differing content field). Returns
+ * `false` when no row change occurred — verification failure, a subject that
+ * is not the signer, audience mismatch, missing required claims, a lifetime
+ * above `MAX_CAP_TTL_SECONDS`, LWW lost against an existing row, or an
+ * idempotent re-broadcast with identical content. Never throws on a forged or
+ * malformed token — it is skipped like an unverifiable broadcast entry.
+ *
+ * Shared by the `delegation:share` broadcast path and the invite-bootstrap
+ * path so both apply identical verify + audience + null-guard + coercion logic.
+ */ export async function storeReceivedGrant(params) {
+    const { delegationStore, p2pStore, token, groupID, hlc, selfDID, emitter, logger } = params;
+    // Verify the token's signature before trusting any of its claims. A forged
+    // or tampered token throws here; skip it — no row stored, no throw.
+    let payload;
+    try {
+        const verified = await verifyToken(token);
+        payload = verified.payload;
+    } catch (error) {
+        logger?.warn('received grant token verification failed, skipping', {
+            groupID,
+            error
+        });
+        return false;
+    }
+    // Sender-bound: `sub` is the grantor the held row is filed under, and a
+    // signature only proves `iss`. Without this any co-member could file a row
+    // attributed to another peer — including one colliding with that peer's own
+    // `jti`, which is what makes the grantor-scoped revocation lookups
+    // unanswerable.
+    //
+    // The consequence is that **sub-delegation is not supported over this path**:
+    // a re-delegated grant, whose `sub` is the original grantor and whose `iss`
+    // is the re-delegator, is dropped here. Nothing mints one today
+    // (`grantWriteCapability` signs only for `identity.id`), but `checkCapability`
+    // does verify multi-hop chains, so enforcement would accept what this refuses
+    // to store. Supporting it means carrying and verifying the parent chain at
+    // this point, not relaxing the predicate — see
+    // `docs/agents/plans/backlog/sub-delegation-over-broadcast.md`.
+    if (normalizeDID(payload.sub) !== normalizeDID(payload.iss)) {
+        logger?.warn('received grant subject is not its signer, skipping', {
+            groupID
+        });
+        return false;
+    }
+    // Only store grants addressed to this device. Both sides are folded: a
+    // `did:peer:4` audience reaches us in long form on first contact and short
+    // form thereafter, and a raw compare would silently discard our own grant.
+    if (normalizeDID(payload.aud) !== normalizeDID(selfDID)) {
+        return false;
+    }
+    // `iat` joins the guard because the TTL bound below is unanswerable without
+    // it, and an unanswerable bound is the hole this check exists to close. Both
+    // producers (`grantWriteCapability`, `KubunClient.mintWriteGrant`) stamp it.
+    if (payload.jti == null || payload.exp == null || payload.iat == null) {
+        logger?.warn('received grant token missing jti/exp/iat, skipping', {
+            groupID
+        });
+        return false;
+    }
+    // A capability accepted here can be revoked, and a co-member retains that
+    // revocation only for `MAX_CAP_TTL_SECONDS` past the revocation's own `iat` —
+    // it holds no copy of the capability to read an expiry from. Accepting a
+    // longer-lived grant would let it outlive its revocation and start being
+    // honored again. Skipped like any other unusable broadcast, not thrown: the
+    // sender is not necessarily this device's resolver.
+    if (payload.exp - payload.iat > MAX_CAP_TTL_SECONDS) {
+        logger?.warn('received grant lifetime exceeds the maximum, skipping', {
+            groupID,
+            jti: payload.jti,
+            ttl: payload.exp - payload.iat,
+            max: MAX_CAP_TTL_SECONDS
+        });
+        return false;
+    }
+    const resource = typeof payload.res === 'string' ? payload.res : JSON.stringify(payload.res);
+    const act = typeof payload.act === 'string' ? payload.act : JSON.stringify(payload.act);
+    const changed = await delegationStore.addDelegationToken({
+        jti: payload.jti,
+        grantor: payload.sub,
+        audience: payload.aud,
+        token,
+        resource,
+        act,
+        exp: payload.exp,
+        hlc
+    });
+    // Record the group this grant belongs to on the p2p edge so the p2p layer can
+    // resolve the cap's group for revoke-broadcast targeting and listing
+    // enrichment. Keyed by `jti`; idempotent on re-broadcast.
+    await p2pStore.addGroupDelegation({
+        group_id: groupID,
+        jti: payload.jti
+    });
+    // Pending revocations are blind cross-checks: when the matching cap finally
+    // arrives we either promote the revocation to verified (issuer matches) or
+    // drop it as a forged broadcast (issuer mismatch). Settled before any
+    // `delegationTokenAdded` emission so subscribers see consistent ground
+    // truth from the revocation backend on the same tick.
+    if (changed) {
+        const pending = await delegationStore.getPendingRevocationByIssuer(payload.jti, payload.sub);
+        if (pending != null) {
+            // Pin the `verified_at` we send to subscribers to the same value the
+            // store writes; passing it explicitly avoids a millisecond-scale
+            // skew between the row and the emitted event under clock-tick
+            // boundaries.
+            const verifiedAt = Math.floor(Date.now() / 1000);
+            const flipped = await delegationStore.markRevocationVerified(payload.jti, payload.sub, {
+                cap_exp: payload.exp,
+                verified_at: verifiedAt
+            });
+            if (flipped && emitter != null) {
+                await emitter.emit('delegationTokenRevoked', {
+                    jti: payload.jti,
+                    grantor: payload.sub,
+                    audience: payload.aud,
+                    revokerDID: pending.revoker_did,
+                    revokedAt: pending.revoked_iat,
+                    verifiedAt,
+                    capExp: payload.exp,
+                    groupID
+                });
+            }
+        }
+        // A `jti` names a capability only within one grantor's namespace, and it
+        // travels to the whole group — so a pending row from another author is
+        // either a forgery or a claim about a different capability. Either way this
+        // grant cannot cross-check it and it can never bind here.
+        const dropped = await delegationStore.deletePendingRevocationsFromOtherIssuers(payload.jti, payload.sub);
+        if (dropped > 0) {
+            logger?.warn('dropped pending revocations not authored by the arriving cap’s issuer', {
+                jti: payload.jti,
+                dropped,
+                capGrantor: payload.sub,
+                groupID
+            });
+        }
+    }
+    // Emit only when the held row was actually inserted or materially changed.
+    // Idempotent re-broadcasts (LWW lost, or won with byte-identical content)
+    // are silent — subscribers should not see duplicates for a token they
+    // already received.
+    if (changed && emitter != null) {
+        await emitter.emit('delegationTokenAdded', {
+            jwt: token,
+            jti: payload.jti,
+            grantor: payload.sub,
+            audience: payload.aud,
+            resource,
+            exp: payload.exp
+        });
+    }
+    return changed;
+}

package/lib/groups/store-received-revocation.d.ts

@@ -1,9 +1,9 @@
 import type { Logger } from '@kubun/logger';
-import type { P2PStoreAPI } from '@kubun/store-p2p';
+import type { DelegationStoreAPI } from '@kubun/store-delegation';
 import type { P2PEventEmitter } from './events.js';
 export type StoreReceivedRevocationParams = {
-    /** P2P store the revocation row is written to. */
-    p2pStore: P2PStoreAPI;
+    /** Delegation store the revocation row is written to. */
+    delegationStore: DelegationStoreAPI;
     /** Stringified signed revocation JWT carrying `{ jti, iss, rev, iat }`. */
     token: string;
     /** Group the revocation belongs to. */
@@ -21,26 +21,29 @@ export type StoreReceivedRevocationParams = {
      * This helper does not emit; downstream subscription wiring lives elsewhere.
      */
     emitter?: P2PEventEmitter;
-    /** Optional logger — debug on verification failure or malformed payload, warn on iss/grantor mismatch. */
+    /** Optional logger — debug on verification failure or malformed payload. */
     logger?: Logger;
 };
 /**
  * Verify a received revocation token and write its row to the P2P store.
  *
- * Verified-on-arrival: when the referenced capability is already known
- * locally and the revocation's `iss` matches that capability's `grantor`,
- * the row is stored with `verified_at` populated so the hot-path
- * `isRevoked` gate fires immediately. When the capability is unknown
- * locally, the row is stored as pending (`verified_at` null) until a later
- * `delegation:share` triggers a cross-check that flips it via
- * `markRevocationVerified`. A signature-verified token whose `iss` does
- * not match a known capability's `grantor` is rejected outright — a forged
- * revocation must not pollute the local store.
+ * Verified-on-arrival: when this device already holds a capability the
+ * record's own `iss` granted under that `jti`, the row is stored with
+ * `verified_at` populated so the hot-path `isRevoked` gate fires
+ * immediately. Otherwise the row is stored as pending (`verified_at` null)
+ * until a later `delegation:share` from that same issuer triggers a
+ * cross-check that flips it via `markRevocationVerified`.
+ *
+ * Holding someone else's capability under the same `jti` is not evidence
+ * that this record is forged — a `jti` is namespaced by its grantor and any
+ * co-member can reuse one — so such a record is stored pending like any
+ * other unmatched one. It binds nothing: every enforcement read is scoped to
+ * the revoker, and `storeReceivedGrant` drops it when the issuer's own
+ * capability arrives.
  *
  * Returns `true` when the row was inserted or materially changed (LWW
  * upsert). Returns `false` on verification failure, non-revocation
- * payload, iss/grantor mismatch, or a lost/idempotent LWW upsert. Never
- * throws on a forged or malformed token — it is skipped like an
- * unverifiable broadcast entry.
+ * payload, or a lost/idempotent LWW upsert. Never throws on a forged or
+ * malformed token — it is skipped like an unverifiable broadcast entry.
  */
 export declare function storeReceivedRevocation(params: StoreReceivedRevocationParams): Promise<boolean>;

package/lib/groups/store-received-revocation.js

@@ -1 +1,83 @@
-import{verifyToken as e}from"@enkaku/token";export async function storeReceivedRevocation(o){let r,{p2pStore:t,token:n,groupID:i,hlc:a,emitter:c,logger:d}=o;try{r=(await e(n)).payload}catch(e){return d?.debug("received revocation token verification failed, skipping",{groupID:i,error:e}),!1}if(!0!==r.rev)return d?.debug("received revocation token is not a revocation record, skipping",{groupID:i}),!1;let{jti:l,iss:v,iat:k}=r,u=await t.getDelegationTokenByJti(l),g=null,p=null;if(null!=u){if(u.grantor!==v)return d?.warn("received revocation iss does not match known capability grantor, skipping",{groupID:i,jti:l,iss:v,grantor:u.grantor}),!1;g=Math.floor(Date.now()/1e3),p=u.exp}let f=await t.addRevocation({jti:l,revoker_did:v,revoked_iat:k,revocation_token:n,verified_at:g,cap_exp:p,group_id:i,hlc:a});return f&&null!=g&&null!=u&&null!=c&&await c.emit("delegationTokenRevoked",{jti:l,grantor:u.grantor,audience:u.audience,revokerDID:v,revokedAt:k,verifiedAt:g,capExp:p,groupID:i}),f}
+import { verifyToken } from '@kokuin/token';
+/**
+ * Verify a received revocation token and write its row to the P2P store.
+ *
+ * Verified-on-arrival: when this device already holds a capability the
+ * record's own `iss` granted under that `jti`, the row is stored with
+ * `verified_at` populated so the hot-path `isRevoked` gate fires
+ * immediately. Otherwise the row is stored as pending (`verified_at` null)
+ * until a later `delegation:share` from that same issuer triggers a
+ * cross-check that flips it via `markRevocationVerified`.
+ *
+ * Holding someone else's capability under the same `jti` is not evidence
+ * that this record is forged — a `jti` is namespaced by its grantor and any
+ * co-member can reuse one — so such a record is stored pending like any
+ * other unmatched one. It binds nothing: every enforcement read is scoped to
+ * the revoker, and `storeReceivedGrant` drops it when the issuer's own
+ * capability arrives.
+ *
+ * Returns `true` when the row was inserted or materially changed (LWW
+ * upsert). Returns `false` on verification failure, non-revocation
+ * payload, or a lost/idempotent LWW upsert. Never throws on a forged or
+ * malformed token — it is skipped like an unverifiable broadcast entry.
+ */ export async function storeReceivedRevocation(params) {
+    const { delegationStore, token, groupID, hlc, emitter, logger } = params;
+    let payload;
+    try {
+        const verified = await verifyToken(token);
+        payload = verified.payload;
+    } catch (error) {
+        logger?.debug('received revocation token verification failed, skipping', {
+            groupID,
+            error
+        });
+        return false;
+    }
+    if (payload.rev !== true) {
+        logger?.debug('received revocation token is not a revocation record, skipping', {
+            groupID
+        });
+        return false;
+    }
+    const { jti, iss, iat } = payload;
+    // Scoped to the record's own issuer. A co-member can mint a capability
+    // reusing a `jti` it saw broadcast, so asking for "the" capability named by a
+    // `jti` returns an arbitrary grantor's row — and the grantor's genuine
+    // revocation is the one with something to lose when the answer is wrong.
+    const cap = await delegationStore.getDelegationTokenByGrantorJTI({
+        jti,
+        grantor: iss
+    });
+    let verifiedAt = null;
+    let capExp = null;
+    if (cap != null) {
+        verifiedAt = Math.floor(Date.now() / 1000);
+        capExp = cap.exp;
+    }
+    const changed = await delegationStore.addRevocation({
+        jti,
+        revoker_did: iss,
+        revoked_iat: iat,
+        revocation_token: token,
+        verified_at: verifiedAt,
+        cap_exp: capExp,
+        hlc
+    });
+    // Only verified-on-arrival writes are binding to local subscribers — a
+    // pending row carries no enforcement weight until the deferred cross-check
+    // promotes it. The cross-check path (in `storeReceivedGrant`) emits there
+    // when it flips a row from pending to verified.
+    if (changed && verifiedAt != null && cap != null && emitter != null) {
+        await emitter.emit('delegationTokenRevoked', {
+            jti,
+            grantor: cap.grantor,
+            audience: cap.audience,
+            revokerDID: iss,
+            revokedAt: iat,
+            verifiedAt,
+            capExp,
+            groupID
+        });
+    }
+    return changed;
+}

package/lib/hub/ack-backoff.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from '@kubun/logger';
+export type AckBatchParams = {
+    flushMs: number;
+    flushMax: number;
+    send: (ids: Array<string>) => Promise<void>;
+    logger?: Logger;
+};
+export declare class AckBatch {
+    #private;
+    constructor(params: AckBatchParams);
+    add(id: string): void;
+    /**
+     * Drain the pending id set and send it via the configured sender. Never
+     * rejects: send errors are logged and the ids are dropped silently (the hub
+     * will redeliver unacknowledged messages, so the next receive will produce a
+     * fresh ack).
+     */
+    flush(): Promise<void>;
+    dispose(): void;
+}
+export declare function computeBackoff(attempt: number, base: number, max: number, jitter: number): number;
+export declare function abortableSleep(ms: number, signal: AbortSignal): Promise<void>;

package/lib/hub/ack-backoff.js

@@ -0,0 +1,88 @@
+export class AckBatch {
+    #flushMs;
+    #flushMax;
+    #send;
+    #logger;
+    #ids = new Set();
+    #timer = null;
+    constructor(params){
+        this.#flushMs = params.flushMs;
+        this.#flushMax = params.flushMax;
+        this.#send = params.send;
+        this.#logger = params.logger;
+    }
+    add(id) {
+        const wasEmpty = this.#ids.size === 0;
+        this.#ids.add(id);
+        if (this.#ids.size >= this.#flushMax) {
+            if (this.#timer !== null) {
+                clearTimeout(this.#timer);
+                this.#timer = null;
+            }
+            void this.flush();
+            return;
+        }
+        if (wasEmpty && this.#timer === null) {
+            this.#timer = setTimeout(()=>{
+                this.#timer = null;
+                void this.flush();
+            }, this.#flushMs);
+        }
+    }
+    /**
+   * Drain the pending id set and send it via the configured sender. Never
+   * rejects: send errors are logged and the ids are dropped silently (the hub
+   * will redeliver unacknowledged messages, so the next receive will produce a
+   * fresh ack).
+   */ async flush() {
+        if (this.#timer !== null) {
+            clearTimeout(this.#timer);
+            this.#timer = null;
+        }
+        if (this.#ids.size === 0) {
+            return;
+        }
+        const snapshot = Array.from(this.#ids);
+        this.#ids.clear();
+        try {
+            await this.#send(snapshot);
+        } catch (err) {
+            this.#logger?.error('ack batch send failed', {
+                error: err,
+                count: snapshot.length
+            });
+        }
+    }
+    dispose() {
+        if (this.#timer !== null) {
+            clearTimeout(this.#timer);
+            this.#timer = null;
+        }
+        this.#ids.clear();
+    }
+}
+// --- Backoff ---
+export function computeBackoff(attempt, base, max, jitter) {
+    const exponential = base * 2 ** attempt;
+    const jittered = exponential * (1 + jitter * (2 * Math.random() - 1));
+    const clamped = Math.min(jittered, max);
+    return clamped < 0 ? 0 : clamped;
+}
+export function abortableSleep(ms, signal) {
+    return new Promise((resolve, reject)=>{
+        if (signal.aborted) {
+            reject(signal.reason ?? new Error('aborted'));
+            return;
+        }
+        const timer = setTimeout(()=>{
+            signal.removeEventListener('abort', onAbort);
+            resolve();
+        }, ms);
+        const onAbort = ()=>{
+            clearTimeout(timer);
+            signal.removeEventListener('abort', onAbort);
+            reject(signal.reason ?? new Error('aborted'));
+        };
+        signal.addEventListener('abort', onAbort);
+    });
+}

package/lib/hub/http-client.d.ts

@@ -1,17 +1,25 @@
-import type { Identity } from '@enkaku/token';
-import { type ServerDIDObserver } from './did-observing-transport.js';
-import type { CreateHubClient } from './relay-manager.js';
+import { Client } from '@enkaku/client';
+import type { Identity } from '@kokuin/token';
+import type { HubProtocol } from '@kumiai/hub-protocol';
+export type CreateHubClientOptions = {
+    /**
+     * The hub's DID, resolved per (re)connect by the spawning caller — from the
+     * local hub row when it records one, otherwise from the hub's `/info`. Every
+     * token this client signs names it as the audience, and a hub always refuses a
+     * token that names nobody. Absent only when discovery failed: the connection
+     * is then attempted anyway and refused by the hub, which is what triggers the
+     * next discovery.
+     */
+    serverID?: string;
+};
+export type CreateHubClient = (hubURL: string, opts?: CreateHubClientOptions) => Promise<Client<HubProtocol>>;
 export type CreateHTTPHubClientParams = {
     identity: Identity;
     fetch?: typeof globalThis.fetch;
-    serverID?: string;
     /**
-     * Fired once per hub client when the first signed response from the server
-     * arrives carrying `payload.iss = serverDID`. Subsequent responses do NOT
-     * re-fire this hook, even if `iss` differs. Used by `HubConnectionPool` to
-     * drive TOFU pinning into the hub manager. Per-call `onServerDID` from
-     * `CreateHubClientOptions` overrides this factory-level default.
+     * Fallback audience for every client this factory builds, for a caller that
+     * knows the hub's DID up front. Per-call `serverID` wins when set.
      */
-    onServerDID?: ServerDIDObserver;
+    serverID?: string;
 };
 export declare function createHTTPHubClient(params: CreateHTTPHubClientParams): CreateHubClient;

package/lib/hub/http-client.js

@@ -1 +1,15 @@
-import{Client as e}from"@enkaku/client";import{ClientTransport as r}from"@enkaku/http-client-transport";import{DIDObservingTransport as t}from"./did-observing-transport.js";export function createHTTPHubClient(n){return async(o,i)=>{let l=new r({url:o,fetch:n.fetch}),u=i?.onServerDID??n.onServerDID,D=i?.expectedServerDID,c=i?.onMismatch;return new e({transport:null!=u||null!=D||null!=c?new t({inner:l,onServerDID:u??(()=>{}),expectedServerDID:D,hubURL:o,onMismatch:c}):l,identity:n.identity,serverID:n.serverID})}}
+import { Client } from '@enkaku/client';
+import { ClientTransport } from '@enkaku/http-fetch';
+export function createHTTPHubClient(params) {
+    return async (hubURL, opts)=>{
+        const transport = new ClientTransport({
+            url: hubURL,
+            fetch: params.fetch
+        });
+        return new Client({
+            transport,
+            identity: params.identity,
+            serverID: opts?.serverID ?? params.serverID
+        });
+    };
+}

package/lib/hub/hub-like.d.ts

@@ -0,0 +1,75 @@
+import { type Client } from '@enkaku/client';
+import type { Logger } from '@kubun/logger';
+import { type HubProtocol } from '@kumiai/hub-protocol';
+import type { HubReceiveSubscription, LogHub, MailboxHub } from '@kumiai/hub-tunnel';
+export type CreateHubLikeParams = {
+    /**
+     * Builds a fresh `Client<HubProtocol>` bound to one hub URL + device identity.
+     * Called once on the first connect and again on every reconnect. Injected
+     * rather than constructed here so the adapter is testable against a fake
+     * client without standing up HTTP. The signal is the adapter's own: a factory
+     * that reaches the network (hub discovery) must abandon it on dispose, or
+     * teardown waits out a request to a hub that is not answering.
+     */
+    createClient: (signal: AbortSignal) => Client<HubProtocol> | Promise<Client<HubProtocol>>;
+    /** Authenticated DID of this device — drains receive and stamps publishes. */
+    localDID: string;
+    /**
+     * Called when the hub refused a request with `ACCESS_DENIED`, awaited before
+     * the reconnect backoff so anything it corrects is in place for the next dial.
+     * That code conflates a refused audience with a refused caller, so which one it
+     * was is the handler's to work out, not the adapter's.
+     */
+    onAccessDenied?: () => Promise<void>;
+    logger?: Logger;
+    ackFlushMs?: number;
+    ackFlushMax?: number;
+    backoffBaseMs?: number;
+    backoffMaxMs?: number;
+    backoffJitter?: number;
+};
+/** What a subscriber may narrow its own drain to, beyond its DID. */
+export type DeviceHubReceiveOptions = {
+    /**
+     * Deliver only frames the hub attested as sent by this DID.
+     *
+     * The narrowing happens on the fan-out, before anything is queued and long
+     * before anything is decrypted, which is what a directed session needs: MLS
+     * consumes a per-sender ratchet generation on open, so a session that opens a
+     * frame belonging to another has DESTROYED it — the session it was for waits
+     * out its idle timeout with nothing raised anywhere.
+     */
+    senderDID?: string;
+    /**
+     * Deliver only frames published to this topic.
+     *
+     * The tunnel transport already asks for this (`hub.receive(localDID, {
+     * topicID: receiveTopicID })`), and until it was honoured here the request
+     * went nowhere. It has to be applied on the fan-out for the same reason
+     * `senderDID` does: the encrypting transport decrypts a frame before the
+     * topic demux one layer in ever sees it, so a sink handed another lane's
+     * frame has consumed a ratchet generation and destroyed it.
+     */
+    topicID?: string;
+};
+/**
+ * The device hub as this package uses it: a `MailboxHub` whose `receive` also
+ * takes {@link DeviceHubReceiveOptions}. Declared because the tunnel transport
+ * takes the narrower `MailboxHub`, so a caller that needs a filtered drain has
+ * to hold this type to ask for one.
+ */
+export type DeviceHub = MailboxHub & {
+    receive: (subscriberDID: string, options?: DeviceHubReceiveOptions) => HubReceiveSubscription;
+};
+/**
+ * The reconnecting adapter itself, as its owner holds it: a hub, plus the two
+ * things only whoever built the connection can do — retry it now, and close it.
+ * Kept off {@link DeviceHub} because that is the surface a tunnel session
+ * consumes, and a session has no connection of its own to retry.
+ */
+export type ReconnectingDeviceHub = LogHub & DeviceHub & {
+    /** Try the hub now rather than when the backoff says so. */
+    retryNow: () => Promise<boolean>;
+    dispose: () => Promise<void>;
+};
+export declare function createHubLike(params: CreateHubLikeParams): ReconnectingDeviceHub;