@kubun/plugin-p2p 0.12.0 → 0.13.0

package/lib/groups/broadcast.d.ts

@@ -1,159 +1,18 @@
 import type { OwnIdentity } from '@kokuin/token';
 import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
-import { HLC } from '@kubun/hlc';
+import type { HLC } from '@kubun/hlc';
 import type { Logger } from '@kubun/logger';
-import type { CatalogRecord } from '@kubun/protocol';
+import type { CredentialStoreAPI } from '@kubun/store-credential';
 import type { DelegationStoreAPI } from '@kubun/store-delegation';
 import type { GraphStoreAPI } from '@kubun/store-graph';
 import type { P2PStoreAPI } from '@kubun/store-p2p';
-import type { GroupAnchor, LedgerLogEntry, RosterState } from '@kumiai/mls';
+import type { GroupAnchor, LedgerLogEntry } from '@kumiai/mls';
 import { type ForwardingConfig } from '../sync/forwarder.js';
 import type { StoreUnreadableMode } from '../types.js';
-import { type AccessDefaultRule } from './access-default-token.js';
+import type { GroupBroadcastMessage } from './broadcast-message.js';
 import type { P2PEventEmitter } from './events.js';
-import type { PeerAvailability, PeerCapability } from './group-protocols.js';
-import { type AffectedRow, type LedgerIngestParams } from './ledger-ingest.js';
-export type MutationApplyEntry = {
-    mutationJWT: string;
-    docID: string;
-    /** HLC string identifying this mutation's version. */
-    version: string;
-    modelID: string;
-};
-/**
- * Optional signed token over a control operation. Its issuer (`iss`) is the
- * authenticated author; receivers verify it and authorize that author as a
- * group admin, dropping the operation when the token is absent or invalid. The
- * signed payload is the whole message minus this field, so the signature covers
- * every operation field, not just the author.
- */
-type ControlAuth = string;
-export type GroupBroadcastMessage = {
-    type: 'catalog:create';
-    catalog: CatalogRecord;
-    auth?: ControlAuth;
-} | {
-    type: 'catalog:update';
-    catalogID: string;
-    update: {
-        name?: string;
-        description?: string;
-        filterCriteria?: CatalogRecord['filterCriteria'];
-        hlc: string;
-    };
-    auth?: ControlAuth;
-} | {
-    type: 'catalog:delete';
-    catalogID: string;
-    hlc: string;
-    auth?: ControlAuth;
-} | {
-    /**
-     * A member states its own model access-default so co-members can evaluate
-     * the owner's documents. `auth` is a signed token whose issuer is the
-     * owner; the receiver derives every authoritative field from that verified
-     * token and applies the rule ONLY when `ownerDID` equals the issuer (a
-     * member states its own policy, never another's). LWW by `hlc`.
-     */
-    type: 'access-default:set';
-    modelID: string;
-    permissionType: 'read' | 'write';
-    rule: {
-        level: string;
-        allowedDIDs: Array<string> | null;
-        allowedCircles: Array<string> | null;
-        allowedGroups: Array<string> | null;
-    };
-    ownerDID: string;
-    hlc: string;
-    auth: ControlAuth;
-} | {
-    /**
-     * A member removes its own model access-default(s). Same sender-bound and
-     * LWW rules as `access-default:set`: applied only when `ownerDID` equals
-     * the verified `auth` issuer and the removal `hlc` is newer than the
-     * stored rule's.
-     */
-    type: 'access-default:remove';
-    modelID: string;
-    permissionTypes: Array<'read' | 'write'>;
-    ownerDID: string;
-    hlc: string;
-    auth: ControlAuth;
-} | {
-    /**
-     * Distributes a minted `document/write` capability token to group
-     * co-members. The recipient verifies the token's signature and stores a
-     * held row only when the token's audience (`aud`) is the receiving
-     * device, so the engine's auto-attach can reuse it on later mutations.
-     */
-    type: 'delegation:share';
-    /** Stringified capability JWT carrying the `document/write` grant. */
-    token: string;
-    /** Group whose broadcast channel carries this grant. */
-    groupID: string;
-    /** HLC stamped by the grantor; mirrors the grantor-side issued row. */
-    hlc: string;
-} | {
-    /**
-     * Distributes a signed revocation record for a previously minted
-     * `document/write` capability. The recipient verifies the token's
-     * signature and stores the revocation; verification against the
-     * referenced cap's `iss` flips `verified_at` once the cap is known.
-     * Revocation is binary and reactive — once verified locally, any
-     * subsequent mutation under the revoked `jti` is denied regardless
-     * of `mutation.atTime`.
-     */
-    type: 'delegation:revoke';
-    /** Stringified signed revocation JWT carrying `{ jti, iss, rev, iat }`. */
-    token: string;
-    /** Group whose broadcast channel carries this revocation. */
-    groupID: string;
-    /** HLC stamped by the revoker; mirrors the revoker-side stored row. */
-    hlc: string;
-} | {
-    /**
-     * A member announces a voluntary leave. MLS forbids self-removal, so this
-     * is an advisory notification (not an authoritative removal): receivers
-     * surface a `groupLeaveRequested` event for an admin to act on by issuing
-     * a real `removeMember`. Deliberately does NOT tombstone — a forged
-     * leave-request must not be able to evict an arbitrary member.
-     */
-    type: 'group:leaveRequest';
-    groupID: string;
-    memberDID: string;
-    hlc: string;
-} | {
-    type: 'mutation:apply';
-    entries: Array<MutationApplyEntry>;
-    /**
-     * DID of the peer this broadcast arrived FROM — used for loopback drop.
-     * For a forwarded mutation that is the forwarding peer, not the author, so
-     * it is never an authorization input: each entry carries its own signed
-     * `mutationJWT`, verified independently.
-     *
-     * `undefined` when the frame opened at a leaf that could not be named. The
-     * entries still apply — see the loopback guard.
-     */
-    senderPeerDID: string | undefined;
-} | {
-    /**
-     * A device advertises itself to its co-members. Everything here except
-     * `announcerDID` came off the wire; `announcerDID` did NOT — it is the
-     * MLS-authenticated sender the handler read from `message.payload.iss`,
-     * because the announce body carries no DID field at all.
-     *
-     * `undefined` when the frame opened at a leaf that could not be named, and
-     * the apply then writes nothing: a capability claim attributed to nobody is
-     * worse than no row.
-     */
-    type: 'peer:announce';
-    label: string;
-    availability: PeerAvailability;
-    capabilities: Array<PeerCapability>;
-    hlc: string;
-    announcerDID: string | undefined;
-};
+import type { ApplyLedgerEntriesParams } from './ledger-adopt.js';
+import type { AffectedRow } from './ledger-ingest.js';
 export type { AffectedRow, LedgerAffected } from './ledger-ingest.js';
 export type ProcessBroadcastResult = {
     applied: boolean;
@@ -200,6 +59,19 @@ export type ProcessBroadcastParams = {
      */
     delegationStore: DelegationStoreAPI;
     graphStore: GraphStoreAPI;
+    /**
+     * Credential store for `credential:key-grant`. Optional because the store is
+     * registered by `@kubun/plugin-credential`, not by this package: a device
+     * without that plugin has nowhere to put a grant and drops the frame rather
+     * than migrating a store nothing else on the device uses.
+     */
+    credentialStore?: CredentialStoreAPI;
+    /**
+     * The engine's future-drift bound, applied to a `credential:key-grant`'s
+     * stamps. Optional: absence falls back to {@link DEFAULT_MAX_DRIFT_MS}, the
+     * same number the engine defaults to, so it never means an absent bound.
+     */
+    maxDriftMS?: number;
     /**
      * Engine graph internals — required to apply `mutation:apply` entries via
      * {@link GraphInternals.applyVerifiedMutation} with `origin: 'peer'`, which
@@ -302,122 +174,3 @@ export type ProcessBroadcastParams = {
  * payload fidelity.
  */
 export declare function processBroadcast(params: ProcessBroadcastParams, message: GroupBroadcastMessage, groupID: string): Promise<ProcessBroadcastResult>;
-/**
- * Sender-bound, LWW apply of a signed `access-default:set` frame. Shared by the
- * live broadcast path and the invite-seeding path so both authenticate through
- * the same token verification. The authoritative fields come from the verified
- * token; the plaintext `ownerDID` is used only for the sender-bound equality
- * check. Returns whether a row was written.
- */
-export type AccessDefaultSetFrame = {
-    ownerDID: string;
-    modelID: string;
-    permissionType: 'read' | 'write';
-    rule: AccessDefaultRule;
-    hlc: string;
-    auth: string;
-};
-export type ApplyAccessDefaultSetFrameParams = {
-    graphStore: GraphStoreAPI;
-    frame: AccessDefaultSetFrame;
-    logger?: Logger;
-    /** Scopes the log lines to the group the frame arrived on, when it arrived on one. */
-    groupID?: string;
-};
-export declare function applyAccessDefaultSetFrame(params: ApplyAccessDefaultSetFrameParams): Promise<boolean>;
-/**
- * Apply one signed access-default set token, with no surrounding frame.
- *
- * What a catch-up reply carries: a token and nothing else, so there is no
- * plaintext mirror to cross-check and none is needed — the frame's mirror
- * fields exist for a receiver rebuilding what was signed, and the authoritative
- * values were always the claim's. Every other rule is the live path's: the owner
- * is the authenticated issuer, and the write happens only if strictly newer than
- * what is stored.
- */
-export declare function applyAccessDefaultSetToken(params: {
-    graphStore: GraphStoreAPI;
-    token: string;
-    logger?: Logger;
-    groupID: string;
-}): Promise<boolean>;
-/** Summary of a whole-ledger adoption. */
-type ApplyLedgerCatchupReplyResult = {
-    /** Size of the ledger that was adopted. */
-    applied: number;
-    /**
-     * Always `0` on this path, and structurally so: the install verifies the whole
-     * ledger against the authenticated head before folding a single entry, so a
-     * bad token rejects the batch rather than dropping an entry out of it. Carried
-     * because the catch-up summary reports it beside counts from paths that CAN
-     * drop per entry.
-     */
-    rejected: number;
-};
-/** Inputs the ledger-fold helpers need — a strict subset of the receive params. */
-export type ApplyLedgerEntriesParams = LedgerIngestParams & {
-    /**
-     * Run the projection rebuild atomically, given the store to write it through.
-     *
-     * A rebuild materializes several tables from one fold — circle rows, every
-     * circle's `open` flag, the group row, the commit-hub designation — and a crash
-     * between them leaves them disagreeing. A device with no flagged commit hub
-     * cannot commit at all, which reads as a hang rather than an error.
-     *
-     * A seam rather than a `StoreProvider` because the surrounding operations must
-     * NOT be in the same transaction: an install or a gather waits on the network,
-     * and a transaction spanning one holds kubun's single SQLite connection across
-     * it. So the caller decides what the transaction covers. Omitted, the rebuild
-     * runs on {@link LedgerIngestParams.p2pStore} unwrapped — correct when the
-     * caller already holds a transaction, and self-healing on the bootstrap paths,
-     * where the next reproject rebuilds from the same ledger anyway.
-     *
-     * Declared here rather than on {@link LedgerIngestParams} because only the
-     * batch folds below read it: `ingestVerifiedLedgerEntry` reprojects through
-     * `p2pStore` directly, so a caller passing this to the single-entry path would
-     * be promised an atomicity it does not get.
-     */
-    withProjectionTransaction?: (run: (store: P2PStoreAPI) => Promise<void>) => Promise<void>;
-};
-/**
- * Adopt the control state a handle already holds: merge the HLCs its entries
- * carry into this device's clock, then rebuild every projection from them.
- *
- * For a peer whose handle was filled by something other than a landed commit —
- * a joiner, whose Welcome folded the group's whole ledger and checked it against
- * the authenticated head before this device had any say. Those entries never
- * passed through the receive path, so nothing else has observed their clocks or
- * projected them.
- *
- * The merge keeps this device's later writes sorting after what the group did
- * before it arrived. It decides no authority — that reads the enacted position —
- * but the LWW comparisons that are not ledger folds (removal timestamps,
- * access-default rules) still depend on a clock that has seen the group's.
- */
-export declare function adoptHandleLedgerState(params: ApplyLedgerEntriesParams, groupID: string): Promise<void>;
-/** Inputs {@link bootstrapGroupLedger} needs on top of the ingest's. */
-export type BootstrapGroupLedgerParams = ApplyLedgerEntriesParams & {
-    /**
-     * Install a gathered WHOLE ledger into the group's handle, verified against
-     * the authenticated head before a single entry is folded, and answer with the
-     * roster the install left the handle holding. Throws when the list does not
-     * reproduce that head.
-     *
-     * The roster is returned rather than read back afterwards so it is the one the
-     * install itself produced, taken while the handle is still held: a second read
-     * could observe a handle another operation has since advanced.
-     */
-    installGroupLedger: (groupID: string, tokens: Array<string>) => Promise<RosterState>;
-};
-/**
- * Adopt a whole ledger gathered from one untrusted responder.
- *
- * Signatures do NOT cover omission or reordering — a responder can hand back
- * genuine tokens with a demotion missing — so the list is installed against the
- * authenticated head FIRST and rejected whole on mismatch, before anything is
- * projected. Roles are reconciled against the roster the install folded, not the
- * ledger, because nothing later revisits a stale `admin` row.
- *
- * Throws whatever the install throws — a rejected ledger changes nothing.
- */
-export declare function bootstrapGroupLedger(params: BootstrapGroupLedgerParams, tokens: Array<string>, groupID: string): Promise<ApplyLedgerCatchupReplyResult>;

package/lib/groups/broadcast.js

@@ -1,14 +1,12 @@
 import { normalizeDID } from '@kokuin/token';
-import { HLC } from '@kubun/hlc';
+import { DEFAULT_MAX_DRIFT_MS } from '@kubun/mutation';
 import { toISO } from '../context/types.js';
 import { evaluateAndForward, rethrowIfProgrammerError } from '../sync/forwarder.js';
 import { createReceiveAccessGate } from '../sync/receive-access-gate.js';
+import { applyAccessDefaultSetFrame } from './access-default-apply.js';
 import { verifyAccessDefault } from './access-default-token.js';
 import { verifyCatalog } from './catalog-token.js';
-import { reprojectCircleDefs, reprojectCircleMembers, reprojectGroupSettings } from './circle-projection.js';
-import { entryOrd } from './ledger.js';
-import { resolveGroupAnchor } from './ledger-ingest.js';
-import { mirrorRosterRoles } from './roster-projection.js';
+import { applyCredentialKeyGrantFrame } from './credential-apply.js';
 import { storeReceivedGrant } from './store-received-grant.js';
 import { storeReceivedRevocation } from './store-received-revocation.js';
 /**
@@ -221,6 +219,33 @@ import { storeReceivedRevocation } from './store-received-revocation.js';
                     applied: true
                 };
             }
+        case 'credential:key-grant':
+            {
+                if (params.credentialStore == null) {
+                    params.logger?.warn('credential:key-grant dropped: no credential store on this device', {
+                        groupID
+                    });
+                    return {
+                        applied: false
+                    };
+                }
+                const applied = await applyCredentialKeyGrantFrame({
+                    store: params.credentialStore,
+                    frame: message,
+                    selfDID: params.selfDID,
+                    maxDriftMS: params.maxDriftMS ?? DEFAULT_MAX_DRIFT_MS,
+                    ...params.hlc != null ? {
+                        hlc: params.hlc
+                    } : {},
+                    ...params.logger != null ? {
+                        logger: params.logger
+                    } : {},
+                    groupID
+                });
+                return {
+                    applied
+                };
+            }
         case 'delegation:share':
             {
                 // Co-members relay the same broadcast but only the addressed device
@@ -501,202 +526,3 @@ import { storeReceivedRevocation } from './store-received-revocation.js';
             };
     }
 }
-export async function applyAccessDefaultSetFrame(params) {
-    const { graphStore, frame, logger, groupID } = params;
-    // Authenticate via the signed token: a forged or unsigned token verifies to
-    // null and is dropped. Every authoritative field comes from the verified
-    // payload, never the surrounding plaintext frame.
-    const verified = await verifyAccessDefault(frame.auth);
-    if (verified == null || !isSetClaim(verified)) {
-        logger?.warn('access-default:set dropped: token verification failed', {
-            groupID
-        });
-        return false;
-    }
-    // Sender-bound: a member states only its OWN sharing policy. The row owner is
-    // the authenticated issuer; a frame claiming a foreign owner is dropped. The
-    // issuer is already normalized, so the plaintext owner must be too — an
-    // equivalent DID in another form is the same principal.
-    if (normalizeDID(frame.ownerDID) !== verified.issuer) {
-        logger?.warn('access-default:set dropped: owner is not the authenticated author', {
-            groupID
-        });
-        return false;
-    }
-    return await applyVerifiedAccessDefaultSet(graphStore, verified);
-}
-/**
- * Apply one signed access-default set token, with no surrounding frame.
- *
- * What a catch-up reply carries: a token and nothing else, so there is no
- * plaintext mirror to cross-check and none is needed — the frame's mirror
- * fields exist for a receiver rebuilding what was signed, and the authoritative
- * values were always the claim's. Every other rule is the live path's: the owner
- * is the authenticated issuer, and the write happens only if strictly newer than
- * what is stored.
- */ export async function applyAccessDefaultSetToken(params) {
-    const verified = await verifyAccessDefault(params.token);
-    if (verified == null || !isSetClaim(verified)) {
-        params.logger?.warn('access-default catch-up entry dropped: verification failed', {
-            groupID: params.groupID
-        });
-        return false;
-    }
-    return await applyVerifiedAccessDefaultSet(params.graphStore, verified);
-}
-/**
- * A verified access-default that states a rule rather than withdrawing one.
- * Written as a guard because the union discriminates on a NESTED field, which a
- * `verified.claim.op !== 'set'` check does not narrow the parent by.
- */ function isSetClaim(verified) {
-    return verified.claim.op === 'set';
-}
-async function applyVerifiedAccessDefaultSet(graphStore, verified) {
-    const claim = verified.claim;
-    // LWW: apply only when strictly newer than the stored rule's anchor. An
-    // unstamped stored rule (null hlc) is treated as oldest, so any stamped
-    // incoming rule wins.
-    const storedHLC = await graphStore.getUserModelAccessDefaultHLC(verified.issuer, claim.modelID, claim.permissionType);
-    if (storedHLC != null && claim.hlc <= storedHLC) {
-        return false;
-    }
-    await graphStore.setUserModelAccessDefault({
-        ownerDID: verified.issuer,
-        modelID: claim.modelID,
-        permissionType: claim.permissionType,
-        // Narrowed by `isRule` at verification, which refuses any level outside the
-        // three the read predicate is written for.
-        accessLevel: claim.rule.level,
-        allowedDIDs: claim.rule.allowedDIDs,
-        allowedCircles: claim.rule.allowedCircles,
-        allowedGroups: claim.rule.allowedGroups,
-        hlc: claim.hlc
-    });
-    return true;
-}
-/**
- * Adopt the control state a handle already holds: merge the HLCs its entries
- * carry into this device's clock, then rebuild every projection from them.
- *
- * For a peer whose handle was filled by something other than a landed commit —
- * a joiner, whose Welcome folded the group's whole ledger and checked it against
- * the authenticated head before this device had any say. Those entries never
- * passed through the receive path, so nothing else has observed their clocks or
- * projected them.
- *
- * The merge keeps this device's later writes sorting after what the group did
- * before it arrived. It decides no authority — that reads the enacted position —
- * but the LWW comparisons that are not ledger folds (removal timestamps,
- * access-default rules) still depend on a clock that has seen the group's.
- */ export async function adoptHandleLedgerState(params, groupID) {
-    const { hlc, logger } = params;
-    if (hlc != null && params.getGroupLedger != null) {
-        let ledger;
-        try {
-            ledger = await params.getGroupLedger(groupID);
-        } catch (error) {
-            // The reproject below reads the ledger through the same resolver and
-            // defers on its own when it cannot; losing the merge is not worth failing
-            // a join over.
-            logger?.warn('ledger clock merge skipped: ledger unreadable', {
-                groupID,
-                error
-            });
-            ledger = [];
-        }
-        for (const { verified } of ledger){
-            // An entry `@kumiai/mls` minted itself carries no `ord` — it orders by the
-            // epoch chain and never stamps kubun's clock. Nothing to merge.
-            const ord = entryOrd(verified.entry);
-            if (ord == null) {
-                continue;
-            }
-            try {
-                hlc.receive(HLC.parse(ord));
-            } catch (error) {
-                logger?.warn('ledger entry HLC merge failed', {
-                    groupID,
-                    hlc: ord,
-                    error
-                });
-            }
-        }
-    }
-    await reprojectControlProjections(params, groupID);
-}
-/**
- * Rebuild every control projection from the group's whole ledger.
- *
- * A batch may carry any mix of entry types, so all three rebuild unconditionally
- * rather than the caller working out which were touched; reprojecting a type the
- * batch didn't move is a no-op that re-confirms the current rows.
- */ async function reprojectControlProjections(params, groupID) {
-    const { p2pStore, logger } = params;
-    const resolution = await resolveGroupAnchor(params, groupID);
-    if (resolution.status !== 'anchored') {
-        logger?.debug('ledger batch applied; projection deferred', {
-            groupID,
-            reason: resolution.status === 'unknown' ? 'anchor unavailable' : 'no genesis anchor'
-        });
-        return;
-    }
-    const { anchor, ledger } = resolution;
-    // Sequential, and in this order: the circle rebuilds upsert each row's `open`
-    // from the circle fold, then the settings rebuild overwrites `open` from the
-    // authoritative open set. Running them concurrently, or settings first, lets
-    // the circle upsert win and delists nothing.
-    const rebuild = async (store)=>{
-        await reprojectCircleDefs({
-            store,
-            groupID,
-            anchor,
-            ledger,
-            logger
-        });
-        await reprojectCircleMembers({
-            store,
-            groupID,
-            anchor,
-            ledger,
-            logger
-        });
-        await reprojectGroupSettings({
-            store,
-            groupID,
-            anchor,
-            ledger,
-            logger
-        });
-    };
-    if (params.withProjectionTransaction != null) {
-        await params.withProjectionTransaction(rebuild);
-    } else {
-        await rebuild(p2pStore);
-    }
-}
-/**
- * Adopt a whole ledger gathered from one untrusted responder.
- *
- * Signatures do NOT cover omission or reordering — a responder can hand back
- * genuine tokens with a demotion missing — so the list is installed against the
- * authenticated head FIRST and rejected whole on mismatch, before anything is
- * projected. Roles are reconciled against the roster the install folded, not the
- * ledger, because nothing later revisits a stale `admin` row.
- *
- * Throws whatever the install throws — a rejected ledger changes nothing.
- */ export async function bootstrapGroupLedger(params, tokens, groupID) {
-    const roster = await params.installGroupLedger(groupID, tokens);
-    await reprojectControlProjections(params, groupID);
-    const members = await params.p2pStore.listGroupMembers(groupID);
-    await mirrorRosterRoles({
-        store: params.p2pStore,
-        groupID,
-        roster,
-        memberDIDs: members.map((member)=>member.member_did),
-        members
-    });
-    return {
-        applied: tokens.length,
-        rejected: 0
-    };
-}

package/lib/groups/credential-apply.d.ts

@@ -0,0 +1,82 @@
+import { HLC } from '@kubun/hlc';
+import type { Logger } from '@kubun/logger';
+import type { CredentialStoreAPI } from '@kubun/store-credential';
+import type { CredentialKeyBundle, GroupBroadcastMessage } from './broadcast-message.js';
+export type ApplyCredentialKeyGrantFrameParams = {
+    store: CredentialStoreAPI;
+    frame: Extract<GroupBroadcastMessage, {
+        type: 'credential:key-grant';
+    }>;
+    /** This device, for the "is this addressed to me?" question. */
+    selfDID: string;
+    /**
+     * Device-wide monotonic clock, advanced past every applied entry's stamp so a
+     * later local credential write out-orders what was just received. Optional:
+     * tests that only assert stored rows omit it.
+     */
+    hlc?: HLC;
+    /**
+     * How far into the future the granter's entry stamps may sit. The engine's
+     * bound, threaded here rather than configured separately: this lane writes the
+     * granter's stamp verbatim, so without it a peer could put an unreachable
+     * future into rows the device then floors its clock to.
+     */
+    maxDriftMS: number;
+    logger?: Logger;
+    groupID?: string;
+};
+/**
+ * Apply a signed `credential:key-grant`: the key's public record, the one
+ * wrapping addressed to this device, and every entry ciphertext at that version.
+ *
+ * Sender-binding here is DIRECTIONAL, unlike `access-default:set`'s. That rule
+ * ("the stored owner equals the verified issuer") presumes a row, and a grant is
+ * the first thing this device ever hears about the key:
+ *
+ * - key absent → MINT, with `owner_did` from the verified issuer. Accepting a
+ *   key means accepting its signer as the principal who may rotate and revoke it.
+ * - key present → REQUIRE the stored `owner_did` to equal the issuer. That is
+ *   what makes a re-sent frame a retry rather than a takeover: the original
+ *   granter updates, anyone else is refused.
+ *
+ * Returns whether anything was written.
+ */
+export declare function applyCredentialKeyGrantFrame(params: ApplyCredentialKeyGrantFrameParams): Promise<boolean>;
+/** A revoked subject's tombstone as the reconcile lane ships it. */
+export type CredentialReconcileTombstone = {
+    keyID: string;
+    authorDID: string;
+    hlc: string;
+    opJWT: string;
+    opHash: string;
+    subjectID: string;
+};
+export type ApplyCredentialReconcileParams = {
+    store: CredentialStoreAPI;
+    /** This device, for the per-wrapping addressed-to-me check. */
+    selfDID: string;
+    /** Catch-up bundles for keys this device is a recipient of and was missing. */
+    bundles: Array<CredentialKeyBundle>;
+    /** Tombstones for advertised held IDs the server reports revoked. */
+    tombstones: Array<CredentialReconcileTombstone>;
+    hlc?: HLC;
+    /** Future-drift bound on the granter's stamps. Defaults to {@link DEFAULT_MAX_DRIFT_MS}. */
+    maxDriftMS?: number;
+    logger?: Logger;
+};
+export type ApplyCredentialReconcileResult = {
+    /** Bundles that wrote rows. */
+    applied: number;
+    /** Tombstones that deleted a row. */
+    tombstoned: number;
+};
+/**
+ * Apply a credential reconcile response: materialise the catch-up bundles a
+ * recipient missed, then GC the rows a tombstone revokes.
+ *
+ * The server's scoping is NOT trusted. Every row re-verifies its op signature
+ * and every wrapping re-checks it is addressed to this device before a write,
+ * exactly as an unsolicited grant would — a reconcile is a batch of the same
+ * self-authenticating rows, pulled instead of pushed.
+ */
+export declare function applyCredentialReconcile(params: ApplyCredentialReconcileParams): Promise<ApplyCredentialReconcileResult>;