@kubun/plugin-p2p 0.12.1 → 0.13.0

package/lib/sync/broadcast-queue.d.ts

@@ -1,5 +1,5 @@
 import type { Logger } from '@kubun/logger';
-import type { GroupBroadcastMessage, MutationApplyEntry } from '../groups/broadcast.js';
+import type { GroupBroadcastMessage, MutationApplyEntry } from '../groups/broadcast-message.js';
 /**
  * Configuration for the per-target-group batch broadcast queue.
  *

package/lib/sync/forwarder.d.ts

@@ -3,7 +3,7 @@ import type { Logger } from '@kubun/logger';
 import type { DocumentNode } from '@kubun/protocol';
 import type { GraphStoreAPI } from '@kubun/store-graph';
 import type { P2PStoreAPI } from '@kubun/store-p2p';
-import type { GroupBroadcastMessage, MutationApplyEntry } from '../groups/broadcast.js';
+import type { GroupBroadcastMessage, MutationApplyEntry } from '../groups/broadcast-message.js';
 export declare function rethrowIfProgrammerError(error: unknown): void;
 /**
  * Context passed to a {@link ForwardFilter} for each candidate forwarding scope.

package/lib/sync/handlers.js

@@ -1,6 +1,9 @@
+import { CREDENTIAL_STORE, getCredentialStore } from '@kubun/store-credential';
 import { createDelegationRevocationChecker, getDelegationStore } from '@kubun/store-delegation';
 import { getGraphStore } from '@kubun/store-graph';
 import { getP2PStore } from '@kubun/store-p2p';
+import { verifiedCaller } from '../context/types.js';
+import { readCredentialKeyBundle } from '../groups/credential-grant.js';
 import { wrapHandlers } from '../util/handler-error.js';
 import { authorizeScope, checkSyncDelegation } from './authorize.js';
 import { resolveCatalogSyncScopes } from './catalog-scope.js';
@@ -8,6 +11,15 @@ import { SyncAccessDeniedError } from './errors.js';
 import { createMerkleSyncChannelHandler } from './merkle-channel.js';
 import { negotiateDirection } from './peer-registry.js';
 export { checkSyncDelegation };
+/** The stored op row as the reconcile lane ships it — the same leaf a grant carries. */ function toWireOp(row) {
+    return {
+        keyID: row.key_id,
+        authorDID: row.author_did,
+        hlc: row.hlc,
+        opJWT: row.op_jwt,
+        opHash: row.op_hash
+    };
+}
 // ---- Handler factory ----
 /**
  * Create sync protocol handlers served by plugin-p2p's own Enkaku server.
@@ -195,6 +207,91 @@ export { checkSyncDelegation };
             defaultAccessLevel: params.defaultAccessLevel,
             getRevocationChecker,
             getCircleReadGrant
-        })
+        }),
+        'sync/reconcile-credentials': async (ctx)=>{
+            const callerDID = verifiedCaller(ctx.message.payload);
+            // The credential store is registered by `@kubun/plugin-credential`, not by
+            // this plugin, so a device without it has nothing to serve and answers
+            // empty rather than throwing (`getStore` on an unregistered name throws).
+            if (!db.hasStore(CREDENTIAL_STORE)) {
+                return {
+                    bundles: [],
+                    tombstones: []
+                };
+            }
+            const store = await getCredentialStore(db);
+            const held = new Map(ctx.param.held.map((subject)=>[
+                    `${subject.subjectKind}\u0000${subject.subjectID}`,
+                    subject.opHash
+                ]));
+            // Catch-up in two parts, both recipient-scoped to the caller's live
+            // wrappings at the current key version. An UNHELD wrapping is a missed
+            // grant: ship the whole key bundle. A HELD wrapping means the grant landed,
+            // so ship the same bundle carrying only the current-version entries the
+            // caller has NOT advertised — an entry added to a key after the grant then
+            // reaches an existing recipient (there is no live entry lane). The wrapping
+            // is the gate on both paths; a co-recipient's wrapping never travels.
+            const scoped = await store.listOpsForRequester(callerDID);
+            const wrappingOps = scoped.filter((op)=>op.subject_kind === 'wrapping' && op.deleted === 0);
+            const bundles = [];
+            for (const wrappingOp of wrappingOps){
+                const wrapping = await store.getWrapping(wrappingOp.subject_id);
+                if (wrapping?.recipient_did == null) {
+                    continue;
+                }
+                const key = await store.getKey(wrappingOp.key_id);
+                // A superseded wrapping's key has moved on; the current-version wrapping
+                // is what a catch-up carries, and its own op routes here when unheld.
+                if (key == null || wrapping.key_version !== key.version) {
+                    continue;
+                }
+                const wrappingHeld = held.get(`wrapping\u0000${wrappingOp.subject_id}`) === wrappingOp.op_hash;
+                const keyOp = scoped.find((op)=>op.subject_kind === 'key' && op.subject_id === wrappingOp.key_id);
+                const keyHeld = keyOp != null && held.get(`key\u0000${wrappingOp.key_id}`) === keyOp.op_hash;
+                try {
+                    const bundle = await readCredentialKeyBundle(store, wrappingOp.key_id, wrapping.recipient_did);
+                    if (wrappingHeld && keyHeld) {
+                        // Held wrapping: the entry top-up. Only entries the caller lacks; a
+                        // held key with nothing new to send is skipped, not shipped empty.
+                        const missingEntries = bundle.entries.filter((entry)=>{
+                            const entryOp = scoped.find((op)=>op.subject_kind === 'entry' && op.subject_id === entry.entryID);
+                            return entryOp == null || held.get(`entry\u0000${entry.entryID}`) !== entryOp.op_hash;
+                        });
+                        if (missingEntries.length === 0) {
+                            continue;
+                        }
+                        bundles.push({
+                            ...bundle,
+                            entries: missingEntries
+                        });
+                    } else {
+                        bundles.push(bundle);
+                    }
+                } catch (error) {
+                    // A rotation between the scan and this read leaves a key momentarily
+                    // unreadable; skip it rather than fail the whole reconcile.
+                    logger.debug('sync/reconcile-credentials: key not readable, skipped', {
+                        keyID: wrappingOp.key_id,
+                        error
+                    });
+                }
+            }
+            // GC: a revoked wrapping's tombstone names no recipient once its row is
+            // gone, so it reaches the caller only when the caller advertises the id.
+            const allOps = await store.listOps();
+            const tombstones = allOps.filter((op)=>op.deleted === 1 && held.has(`${op.subject_kind}\u0000${op.subject_id}`)).map((op)=>({
+                    ...toWireOp(op),
+                    subjectID: op.subject_id
+                }));
+            logger.debug('sync/reconcile-credentials served', {
+                callerDID,
+                bundles: bundles.length,
+                tombstones: tombstones.length
+            });
+            return {
+                bundles,
+                tombstones
+            };
+        }
     });
 }

package/lib/sync/sync-manager.d.ts

@@ -3,7 +3,7 @@ import type { StoreProvider } from '@kubun/db';
 import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
 import type { Logger } from '@kubun/logger';
 import type { Runtime } from '@sozai/runtime';
-import type { SyncDirection } from '../protocol.js';
+import type { SyncDirection, SyncReconcileCredentialsParam, SyncReconcileCredentialsResult } from '../protocol.js';
 import type { StoreUnreadableMode } from '../types.js';
 import { type PeerConfig, type PeerConfigWithID, PeerRegistry } from './peer-registry.js';
 import { type SyncScope, type SyncServerResolver } from './sync-client.js';
@@ -56,6 +56,14 @@ export type MerkleSyncParams = {
      * grants it nothing.
      */
     endpoint?: string;
+    /**
+     * The caller's live credential subject ids, present when a credential catch-up
+     * piggybacks this doc sync. When set, a `sync/reconcile-credentials` request
+     * rides the SAME session after the peer answers negotiate, so no second tunnel
+     * is dialled. Its result comes back as `credentialReconcile`; a failure there
+     * is swallowed — the credential lane must never fail the doc sync.
+     */
+    reconcileCredentialsHeld?: SyncReconcileCredentialsParam['held'];
 };
 export declare class SyncManager {
     #private;
@@ -97,6 +105,7 @@ export declare class SyncManager {
         messagesReceived: number;
         messagesSent: number;
         missingClusters?: Record<string, unknown>;
+        credentialReconcile?: SyncReconcileCredentialsResult;
     }>;
     getStatus(params: {
         peerDID?: string;

package/lib/sync/sync-manager.js

@@ -126,6 +126,26 @@ export class SyncManager {
                 direction
             });
             const { acceptedScopes, excludedDocumentIDs, missingClusters, direction: agreedDirection } = await syncClient.negotiate(client, scopes, delegationTokens, knownModelIDs, direction);
+            // The peer answered, so the session is live: ride the credential catch-up
+            // on it now rather than dialling a second tunnel. A responder locks to one
+            // dialing session until it idles out, so a fresh dial to the same peer
+            // would hang — reuse is the only prompt path. A failure is swallowed: the
+            // doc sync must not fail for the credential lane.
+            let credentialReconcile;
+            if (params.reconcileCredentialsHeld != null) {
+                try {
+                    credentialReconcile = await client.request('sync/reconcile-credentials', {
+                        param: {
+                            held: params.reconcileCredentialsHeld
+                        }
+                    });
+                } catch (error) {
+                    this.#logger.warn('credential reconcile over sync session failed', {
+                        peerDID,
+                        error
+                    });
+                }
+            }
             if (acceptedScopes.length === 0) {
                 this.#logger.info('No scopes accepted by peer');
                 this.#lastSyncByPeer.set(peerDID, Date.now());
@@ -140,7 +160,8 @@ export class SyncManager {
                     divergentBuckets: 0,
                     messagesReceived: 0,
                     messagesSent: 0,
-                    missingClusters
+                    missingClusters,
+                    credentialReconcile
                 };
             }
             // Step 1b: Deploy missing clusters before building merkle tree
@@ -221,7 +242,8 @@ export class SyncManager {
                 divergentBuckets: syncResult.divergentBuckets,
                 messagesReceived: syncResult.mutationJWTs.length,
                 messagesSent: syncResult.mutationsSent,
-                missingClusters
+                missingClusters,
+                credentialReconcile
             };
         } catch (error) {
             // DEBUG, and re-thrown: this layer cannot know whether the failure is a

package/lib/types.d.ts

@@ -1,4 +1,5 @@
 import type { ClientTransportOf } from '@enkaku/protocol';
+import type { SignedEvent } from '@kokuin/controller';
 import type { AccessLevel } from '@kubun/store-graph';
 import type { ControlRequestKind, ControlRequestOutcome } from '@kubun/store-p2p';
 import type { PeerAvailability, PeerCapability } from './groups/group-protocols.js';
@@ -1019,4 +1020,21 @@ export type SyncPluginAPI = {
      * this held connection.
      */
     getPeerConnection(peerDID: string): PeerConnection | undefined;
+    /**
+     * Pull a remote blob's bytes from a connected peer that holds them, over the
+     * dedicated transfer lane (control plane + raw-HTTP data plane). A no-op if the
+     * bytes are already local; resumable across sessions. `delegationTokens` proves
+     * a cross-owner read; empty for the own-device case.
+     */
+    fetchAttachment(attachmentID: string, options?: {
+        delegationTokens?: Array<string>;
+    }): Promise<void>;
+    /**
+     * Pull a `did:kokuin:` controller's key-event log from a connected group peer
+     * that holds it, over `controller/get-log`. The engine calls this on a
+     * verify-time controller-store miss; the events self-authenticate, so the
+     * caller's resolver folds + verifies them. `undefined` when no connected peer
+     * answers with a non-empty log.
+     */
+    fetchControllerLog(did: string): Promise<Array<SignedEvent> | undefined>;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-p2p",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -18,17 +18,18 @@
     "@enkaku/http-fetch": "^0.21.0",
     "@enkaku/http-serve": "^0.21.0",
     "@enkaku/protocol": "^0.21.0",
-    "@enkaku/server": "^0.21.0",
+    "@enkaku/server": "^0.21.2",
     "@enkaku/transport": "^0.21.0",
-    "@kokuin/capability": "^0.2.2",
-    "@kokuin/token": "^0.4.0",
-    "@kumiai/broadcast": "^0.6.0",
-    "@kumiai/hub-protocol": "^0.6.0",
-    "@kumiai/hub-server": "^0.6.0",
-    "@kumiai/hub-tunnel": "^0.6.0",
-    "@kumiai/mls": "^0.6.0",
-    "@kumiai/mls-rpc": "^0.6.0",
-    "@kumiai/rpc": "^0.6.0",
+    "@kokuin/capability": "^0.3.0",
+    "@kokuin/controller": "^0.1.0",
+    "@kokuin/token": "^0.5.0",
+    "@kumiai/broadcast": "^0.7.0",
+    "@kumiai/hub-protocol": "^0.7.0",
+    "@kumiai/hub-server": "^0.7.0",
+    "@kumiai/hub-tunnel": "^0.7.0",
+    "@kumiai/mls": "^0.7.0",
+    "@kumiai/mls-rpc": "^0.7.0",
+    "@kumiai/rpc": "^0.7.0",
     "@noble/ciphers": "^2.3.0",
     "@noble/hashes": "^2.3.0",
     "@sozai/async": "^0.2.1",
@@ -41,34 +42,42 @@
     "graphql": "^16.14.2",
     "kysely": "^0.29.5",
     "ts-mls": "2.0.0-rc.13",
-    "@kubun/db": "^0.12.1",
+    "@kubun/db": "^0.13.0",
     "@kubun/db-adapter": "^0.13.0",
-    "@kubun/engine": "^0.12.1",
+    "@kubun/engine": "^0.13.0",
     "@kubun/graphql": "^0.13.0",
-    "@kubun/hlc": "^0.12.0",
-    "@kubun/http-util": "^0.12.0",
-    "@kubun/id": "^0.12.0",
-    "@kubun/logger": "^0.12.0",
-    "@kubun/mutation": "^0.12.1",
-    "@kubun/plugin-rpc": "^0.12.1",
-    "@kubun/plugin-http": "^0.12.1",
+    "@kubun/hlc": "^0.13.0",
+    "@kubun/http-util": "^0.13.0",
+    "@kubun/id": "^0.13.0",
+    "@kubun/logger": "^0.13.0",
+    "@kubun/plugin-http": "^0.13.0",
+    "@kubun/mutation": "^0.13.0",
+    "@kubun/plugin-rpc": "^0.13.0",
     "@kubun/protocol": "^0.13.0",
-    "@kubun/store-p2p": "^0.12.1",
-    "@kubun/store-delegation": "^0.12.1",
-    "@kubun/store-graph": "^0.13.0"
+    "@kubun/store-blob": "^0.13.0",
+    "@kubun/store-controller": "^0.13.0",
+    "@kubun/store-credential": "^0.13.0",
+    "@kubun/store-delegation": "^0.13.0",
+    "@kubun/store-graph": "^0.13.0",
+    "@kubun/store-p2p": "^0.13.0",
+    "@kubun/credential": "^0.13.0"
   },
   "devDependencies": {
-    "@kumiai/hub-conformance": "^0.6.0",
-    "@kumiai/rpc-conformance": "^0.6.0",
+    "@kumiai/hub-conformance": "^0.7.0",
+    "@kumiai/rpc-conformance": "^0.7.0",
     "@testcontainers/postgresql": "^12.1.0",
     "get-port": "^7.2.0",
-    "@kubun/client": "^0.12.1",
-    "@kubun/db-better-sqlite": "^0.12.1",
-    "@kubun/db-postgres": "^0.12.1",
-    "@kubun/hub": "^0.12.1",
-    "@kubun/test-utils": "^0.12.0",
-    "@kubun/plugin-connector": "^0.12.1",
-    "@kubun/db-node-sqlite": "^0.12.1"
+    "@kubun/blob-backend": "^0.13.0",
+    "@kubun/client": "^0.13.0",
+    "@kubun/db-node-sqlite": "^0.13.0",
+    "@kubun/db-postgres": "^0.13.0",
+    "@kubun/hub": "^0.13.0",
+    "@kubun/plugin-blob": "^0.13.0",
+    "@kubun/plugin-connector": "^0.13.0",
+    "@kubun/plugin-workflow": "^0.13.0",
+    "@kubun/test-utils": "^0.13.0",
+    "@kubun/store-workflow": "^0.13.0",
+    "@kubun/db-better-sqlite": "^0.13.0"
   },
   "publishConfig": {
     "access": "public"