@kubun/plugin-p2p 0.14.0 → 0.15.0

package/lib/context/peer.js

@@ -1,7 +1,9 @@
 import { Client } from '@enkaku/client';
 import { ClientTransport } from '@enkaku/http-fetch';
 import { normalizeDID } from '@kokuin/token';
-import { createDeviceAuthority } from '@kubun/credential';
+import { CredentialKeyLocked, CredentialUnopenable, createCredentialManager, createDeviceAuthority } from '@kubun/credential';
+import { HLC } from '@kubun/hlc';
+import { getCredentialStore } from '@kubun/store-credential';
 import { getGraphStore } from '@kubun/store-graph';
 import { getP2PStore } from '@kubun/store-p2p';
 import { readGroupAnchor } from '@kumiai/mls';
@@ -11,6 +13,10 @@ import { applyAccessDefaultSetFrame } from '../groups/access-default-apply.js';
 import { signAccessDefaultSet } from '../groups/access-default-token.js';
 import { foldGroupSettings } from '../groups/circle-projection.js';
 import { awaitControlRequestSettled } from '../groups/control-request.js';
+import { grantCredentialKeyToMember } from '../groups/credential-grant.js';
+import { signCredentialManifest } from '../groups/credential-manifest-token.js';
+import { computeCredentialProvisioningStatus } from '../groups/credential-readiness.js';
+import { createCredentialWrappingDeps } from '../groups/credential-wrapping-deps.js';
 import { resolveJoinRequestDID } from '../groups/join-request-identity.js';
 import { SyncAccessDeniedError } from '../sync/errors.js';
 import { createGroupContext } from './group.js';
@@ -802,7 +808,7 @@ export function createPeerContext(ctx, deps) {
             return designated;
         },
         admitJoinRequest: async (params)=>{
-            const { groupID, joinRequest, sendModels, receiveActivate } = params;
+            const { groupID, joinRequest, grants, sendModels, receiveActivate } = params;
             // Resolve the joiner BEFORE anything is written. A designation minted for a
             // DID the invite then refuses would leave a share circle and a catalog
             // behind for a member that never joins.
@@ -852,7 +858,10 @@ export function createPeerContext(ctx, deps) {
             // snapshots exactly what the designation above wrote.
             const inviteResult = await groupCtx.requestInvite({
                 groupID: designated.group.id,
-                joinRequest
+                joinRequest,
+                ...grants != null && grants.length > 0 ? {
+                    grants
+                } : {}
             });
             if (inviteResult.invitePayload == null) {
                 // The Add commit is still parked, so there is no Welcome to hand back.
@@ -1216,6 +1225,244 @@ export function createPeerContext(ctx, deps) {
                 states.push(await circleSyncState(circle, ownDefaults, catalogs.load));
             }
             return states;
+        },
+        grantDeviceCredentials: async (params)=>{
+            const { groupID, recipientDID } = params;
+            // `recipientDID` stays RAW for the per-key grant loop's roster lookup
+            // (`findMemberLongForm` needs the caller's original form); the manifest
+            // sequence/claim use `normalizedRecipient`/`normalizedGrantorDID` to match
+            // `putManifest`'s normalized (owner, recipient, grantor) triple.
+            const owner = normalizeDID(params.ownerDID);
+            const normalizedRecipient = normalizeDID(recipientDID);
+            const normalizedGrantorDID = normalizeDID(ctx.viewerDID);
+            const store = await getCredentialStore(deps.stores);
+            // Key grants and the manifest persist must land atomically, or the
+            // grantor's own PULL-origin copy could disagree with what it wrote.
+            // `store.transaction` is nest-safe: rides the caller's mutation tx
+            // inline when `deps.stores` is already transactional, else opens its
+            // own. All writes below go through `txStore`, not the outer `store`.
+            const { results, manifest, epoch } = await store.transaction(async (txStore)=>{
+                // Bound to `txStore` so its writes ride the same transaction as the
+                // manifest persist below.
+                const credentials = createCredentialManager({
+                    store: txStore,
+                    identity: deps.identity,
+                    hlc: deps.hlc,
+                    runtime: deps.runtime
+                });
+                // Allocated before the loop: the epoch names a provisioning attempt,
+                // not a count of keys granted.
+                const epoch = await txStore.nextProvisioningEpoch({
+                    ownerDID: owner,
+                    recipientDID: normalizedRecipient,
+                    grantorDID: normalizedGrantorDID,
+                    minEpoch: params.minEpoch ?? 0
+                });
+                // Only active keys: a batch grant hands over what the owner
+                // currently uses, not retired history.
+                const keys = (await txStore.listKeys(owner)).filter((key)=>key.state === 'active');
+                const results = [];
+                for (const key of keys){
+                    try {
+                        const granted = await grantCredentialKeyToMember({
+                            registry: deps.registry,
+                            credentials,
+                            identity: deps.identity,
+                            store: txStore,
+                            groupID,
+                            keyID: key.key_id,
+                            recipientDID,
+                            scheduleBroadcast: deps.scheduleBroadcast,
+                            stores: deps.stores,
+                            authority: ctx.credentialAuthority,
+                            ownerDID: owner,
+                            grantorDID: ctx.viewerDID,
+                            delegationTokens: ctx.delegationTokens
+                        });
+                        results.push({
+                            keyID: key.key_id,
+                            version: granted.version,
+                            outcome: granted.outcome
+                        });
+                    } catch (error) {
+                        // Per-key failure is captured as its own outcome, not thrown, so
+                        // one key's trouble doesn't stall the rest of the batch.
+                        // `CredentialUnopenable`/`CredentialKeyLocked` (no wrapping held /
+                        // needs a secret this non-interactive call can't supply) map to
+                        // `not-held`; anything else (roster miss, store fault) is `error`.
+                        if (error instanceof CredentialUnopenable || error instanceof CredentialKeyLocked) {
+                            results.push({
+                                keyID: key.key_id,
+                                version: null,
+                                outcome: 'not-held',
+                                reason: error.message
+                            });
+                        } else {
+                            const reason = error instanceof Error ? error.message : String(error);
+                            results.push({
+                                keyID: key.key_id,
+                                version: null,
+                                outcome: 'error',
+                                reason
+                            });
+                        }
+                    }
+                }
+                // Manifest names the structural target (every active key this grantor
+                // can distribute), not the per-key outcomes above — a partially
+                // failed batch still produces a manifest a later retry can reconcile
+                // against.
+                const targetKeys = await txStore.listDistributableKeys({
+                    ownerDID: owner,
+                    grantorDID: normalizedGrantorDID
+                });
+                // Shares the same per-(owner,recipient,grantor) counter as
+                // `mintGrantorAuthorityIfDelegated`, so both draw from one monotonic
+                // source.
+                const sequence = await txStore.nextGrantorSequence({
+                    ownerDID: owner,
+                    recipientDID: normalizedRecipient,
+                    grantorDID: normalizedGrantorDID
+                });
+                const manifest = await signCredentialManifest(deps.identity, {
+                    ownerDID: owner,
+                    recipientDID: normalizedRecipient,
+                    epoch,
+                    sequence,
+                    keys: targetKeys,
+                    issuedAt: HLC.serialize(deps.hlc.now())
+                });
+                // Persist the grantor's own copy — the PULL origin a status check or
+                // re-broadcast reads back from, independent of the live send below.
+                await txStore.putManifest({
+                    ownerDID: owner,
+                    recipientDID: normalizedRecipient,
+                    grantorDID: normalizedGrantorDID,
+                    epoch,
+                    sequence,
+                    keys: targetKeys
+                }, manifest, ctx.delegationTokens ?? []);
+                return {
+                    results,
+                    manifest,
+                    epoch
+                };
+            });
+            // Scheduled on commit, over the same broadcast lane the per-key grants
+            // use, so the recipient's readiness query has an expected set to check
+            // against. `delegationTokens` rides beside the manifest for the
+            // receiver's present-time chain check (empty when grantor is owner).
+            const manifestFrame = {
+                type: 'credential:key-manifest',
+                manifest,
+                delegationTokens: ctx.delegationTokens ?? []
+            };
+            deps.stores.onCommit(()=>deps.scheduleBroadcast(groupID, manifestFrame));
+            return {
+                results,
+                manifest,
+                epoch
+            };
+        },
+        credentialProvisioningStatus: async (params)=>{
+            const self = normalizeDID(ctx.viewerDID);
+            const owner = normalizeDID(params.ownerDID);
+            const store = await getCredentialStore(deps.stores);
+            const credentials = createCredentialManager({
+                store,
+                identity: deps.identity,
+                hlc: deps.hlc,
+                runtime: deps.runtime
+            });
+            // Same seam `context/sync.ts`'s `applyReconcile` uses for delegated-wrapping
+            // admission deps, so readiness agrees with the live apply path. Fail-closed:
+            // an absent `controllerResolverFor` yields empty deps, so a delegated
+            // manifest's proof never revalidates.
+            const wrappingDeps = await createCredentialWrappingDeps(deps.stores, deps.controllerResolverFor);
+            return await computeCredentialProvisioningStatus({
+                store,
+                credentials,
+                selfDID: self,
+                ownerDID: owner,
+                deps: wrappingDeps
+            });
+        },
+        beginProvisioningExpectation: async (params)=>{
+            const store = await getCredentialStore(deps.stores);
+            const attemptId = crypto.randomUUID();
+            await store.beginProvisioningAttempt({
+                ownerDID: normalizeDID(params.ownerDID),
+                grantorDID: normalizeDID(params.grantorDID),
+                attemptId
+            });
+            return {
+                attemptId
+            };
+        },
+        recordProvisioningExpectation: async (params)=>{
+            const store = await getCredentialStore(deps.stores);
+            const owner = normalizeDID(params.ownerDID);
+            const grantor = normalizeDID(params.grantorDID);
+            const self = normalizeDID(ctx.viewerDID);
+            // Held-epoch read and attempt record run in one transaction, with the
+            // manifest row locked first, so a concurrent manifest apply can't slip
+            // between them on any adapter (not just single-writer SQLite).
+            return await store.transaction(async (txStore)=>{
+                await txStore.lockManifestRow({
+                    ownerDID: owner,
+                    recipientDID: self,
+                    grantorDID: grantor
+                });
+                const heldEpoch = await provisioningHeldEpochFor({
+                    store: txStore,
+                    ownerDID: owner,
+                    selfDID: self,
+                    grantorDID: grantor
+                });
+                return await txStore.recordProvisioningAttempt({
+                    ownerDID: owner,
+                    grantorDID: grantor,
+                    attemptId: params.attemptId,
+                    epoch: params.epoch,
+                    heldEpoch
+                });
+            });
+        },
+        abandonProvisioningExpectation: async (params)=>{
+            const store = await getCredentialStore(deps.stores);
+            await store.abandonProvisioningAttempt({
+                ownerDID: normalizeDID(params.ownerDID),
+                grantorDID: normalizeDID(params.grantorDID),
+                attemptId: params.attemptId
+            });
+        },
+        provisioningHeldEpoch: async (params)=>{
+            const store = await getCredentialStore(deps.stores);
+            return await provisioningHeldEpochFor({
+                store,
+                ownerDID: normalizeDID(params.ownerDID),
+                selfDID: normalizeDID(ctx.viewerDID),
+                grantorDID: normalizeDID(params.grantorDID)
+            });
         }
     };
 }
+/**
+ * This device's currently-held epoch for `(ownerDID, self, grantorDID)`: the
+ * max epoch among its held manifests from that grantor, or `0` when none.
+ * Shared by `recordProvisioningExpectation` and `provisioningHeldEpoch` so
+ * both compute it identically.
+ */ async function provisioningHeldEpochFor(params) {
+    const { store, ownerDID, selfDID, grantorDID } = params;
+    const manifests = await store.listManifests({
+        ownerDID,
+        recipientDID: selfDID
+    });
+    let heldEpoch = 0;
+    for (const { record } of manifests){
+        if (normalizeDID(record.grantorDID) === grantorDID && record.epoch > heldEpoch) {
+            heldEpoch = record.epoch;
+        }
+    }
+    return heldEpoch;
+}

package/lib/context/sync.js

@@ -1,9 +1,14 @@
+import { normalizeDID } from '@kokuin/token';
+import { createCredentialManager } from '@kubun/credential';
 import { CREDENTIAL_STORE, getCredentialStore } from '@kubun/store-credential';
 import { getGraphStore } from '@kubun/store-graph';
 import { getP2PStore } from '@kubun/store-p2p';
 import { applyCredentialReconcile } from '../groups/credential-apply.js';
+import { unmetCredentialOwners } from '../groups/credential-readiness.js';
+import { createCredentialWrappingDeps } from '../groups/credential-wrapping-deps.js';
 import { answersCredentialSync, rankSyncPeers } from '../groups/peer-selection.js';
 import { resolveCatalogSyncScopes } from '../sync/catalog-scope.js';
+import { resolveHeldDelegationTokens } from '../sync/held-delegations.js';
 const NO_OP = {
     messagesReceived: 0,
     messagesSent: 0,
@@ -96,36 +101,112 @@ export function createSyncContext(_ctx, deps) {
         return await (await getCredentialStore(deps.stores)).listHeldSubjects();
     };
     /**
+   * Owner DIDs to pull a fresh durable manifest for — the durable-repair
+   * trigger, independent of `scopes`, so a device with no active document
+   * catalog can still reconcile a provisioning expectation a live broadcast
+   * never delivered.
+   *
+   * Candidates are `store.listProvisioningExpectationOwners()` (every owner
+   * with an expectation row anywhere) union `ownerCandidates` (self, scope
+   * owners), each filtered to those with an actual expectation row before
+   * being handed to {@link unmetCredentialOwners}.
+   */ const unmetCredentialOwnersFor = async (ownerCandidates)=>{
+        if (!deps.stores.hasStore(CREDENTIAL_STORE)) {
+            return [];
+        }
+        const store = await getCredentialStore(deps.stores);
+        const allCandidates = [
+            ...await store.listProvisioningExpectationOwners(),
+            ...ownerCandidates
+        ];
+        const seen = new Set();
+        const uniqueOwners = [];
+        for (const candidate of allCandidates){
+            const owner = normalizeDID(candidate);
+            if (!seen.has(owner)) {
+                seen.add(owner);
+                uniqueOwners.push(owner);
+            }
+        }
+        // Independent per-owner reads — query concurrently once deduped.
+        const counts = await Promise.all(uniqueOwners.map((owner)=>store.listProvisioningExpectations({
+                ownerDID: owner
+            })));
+        const withExpectation = uniqueOwners.filter((_owner, index)=>counts[index].length > 0);
+        if (withExpectation.length === 0) {
+            return [];
+        }
+        const credentials = createCredentialManager({
+            store,
+            identity: deps.identity,
+            hlc: deps.hlc,
+            runtime: deps.runtime
+        });
+        const wrappingDeps = await createCredentialWrappingDeps(deps.stores, deps.controllerResolverFor);
+        return await unmetCredentialOwners({
+            store,
+            credentials,
+            selfDID: deps.identity.id,
+            ownerDIDs: withExpectation,
+            deps: wrappingDeps
+        });
+    };
+    /**
    * Materialise the credential catch-up the doc session pulled back. Independent
-   * of the doc lane: a failure here never fails the catch-up, so it is logged and
-   * swallowed. The server's scoping is not trusted — `applyCredentialReconcile`
+   * of the doc lane: a failure here is logged and swallowed (returns `undefined`,
+   * never throws). The server's scoping is not trusted — `applyCredentialReconcile`
    * re-verifies every row.
+   *
+   * The returned count is observability only — the manifest-vs-store readiness
+   * query is the completeness authority, not this.
    */ const applyReconcile = async (peerDID, reconcile)=>{
         if (reconcile == null) {
-            return;
+            return undefined;
         }
         try {
-            const store = await getCredentialStore(deps.stores);
-            const result = await applyCredentialReconcile({
-                store,
-                selfDID: deps.identity.id,
-                bundles: reconcile.bundles,
-                tombstones: reconcile.tombstones,
-                hlc: deps.hlc,
-                ...deps.maxDriftMS == null ? {} : {
-                    maxDriftMS: deps.maxDriftMS
-                },
-                logger: deps.logger
+            // Everything below shares one `withTransaction` scope (store writes AND
+            // the controller/delegation-store reads `createCredentialWrappingDeps`
+            // needs). Building `wrappingDeps` over the top-level `deps.stores`
+            // while `applyCredentialReconcile` opens its own write transaction on
+            // the same-connection credential store would deadlock: the write tx's
+            // callback would await a second, non-transactional handle on the same
+            // connection it already holds. Routing everything through the same
+            // nesting-safe `tx` avoids that — one connection, one owner.
+            const result = await deps.stores.withTransaction(async (tx)=>{
+                const store = await getCredentialStore(tx);
+                // Fail-closed: an absent controller-resolver seam yields empty deps,
+                // so a delegate-signed wrapping in the catch-up stays unadmitted.
+                const wrappingDeps = await createCredentialWrappingDeps(tx, deps.controllerResolverFor);
+                return await applyCredentialReconcile({
+                    store,
+                    selfDID: deps.identity.id,
+                    bundles: reconcile.bundles,
+                    tombstones: reconcile.tombstones,
+                    // Owners-driven PULL repair payload, applied before bundles/tombstones
+                    // so readiness never transiently under-declares. Omitted (not `[]`)
+                    // when the piggyback-only lane never requested owners.
+                    ...reconcile.manifests == null ? {} : {
+                        manifests: reconcile.manifests
+                    },
+                    hlc: deps.hlc,
+                    ...deps.maxDriftMS == null ? {} : {
+                        maxDriftMS: deps.maxDriftMS
+                    },
+                    logger: deps.logger,
+                    deps: wrappingDeps
+                });
             });
             deps.logger.debug('credential reconcile piggybacked on catch-up', {
                 peerDID,
                 ...result
             });
+            return result;
         } catch (error) {
             deps.logger.warn('credential reconcile apply failed; doc catch-up unaffected', {
                 peerDID,
                 error
             });
+            return undefined;
         }
     };
     // Bidirectional: each device pushes the docs it owns (its own owner-scope
@@ -134,10 +215,17 @@ export function createSyncContext(_ctx, deps) {
     // persisted, so this works on the first call after a restart.
     const runCatchUp = async (groupID, peerDID)=>{
         const { scopes, knownModelIDs } = await resolveActiveScopes(deps.stores);
-        // No active catalog (or none resolvable to a concrete owner) → the opt-in
-        // resting state. A clean all-zero no-op, never an error and never a peer
-        // round-trip.
-        if (scopes.length === 0) {
+        // The DURABLE REPAIR trigger: an owner this device has an outstanding
+        // provisioning expectation for still needs a session even with zero
+        // document scopes — LIVE broadcast is not the only path.
+        const credentialOwners = await unmetCredentialOwnersFor([
+            deps.identity.id,
+            ...scopes.map((scope)=>scope.ownerDID)
+        ]);
+        // No active catalog (or none resolvable to a concrete owner) AND no unmet
+        // credential expectation → the opt-in resting state. A clean all-zero
+        // no-op, never an error and never a peer round-trip.
+        if (scopes.length === 0 && credentialOwners.length === 0) {
             return NO_OP;
         }
         const announcement = await resolveAnnouncement(groupID, peerDID);
@@ -146,6 +234,10 @@ export function createSyncContext(_ctx, deps) {
         // lane must reuse the doc session, since a second dial to the same peer hangs
         // on a responder still locked to the first.
         const held = await credentialHeld(announcement);
+        // This device's own held read delegations for the owners it's about to pull —
+        // without these, `checkSyncDelegation` can never fire and a cross-DID
+        // `only_owner` document is reachable only via a circle grant.
+        const delegationTokens = await resolveHeldDelegationTokens(deps.stores, deps.identity.id, scopes.map((scope)=>scope.ownerDID));
         const result = await deps.syncManager.merkleSyncWithPeer({
             peerDID,
             scopes,
@@ -157,17 +249,26 @@ export function createSyncContext(_ctx, deps) {
             },
             ...held == null ? {} : {
                 reconcileCredentialsHeld: held
+            },
+            ...credentialOwners.length === 0 ? {} : {
+                reconcileCredentialOwners: credentialOwners
+            },
+            ...delegationTokens.length === 0 ? {} : {
+                delegationTokens
             }
         });
-        // Materialise whatever the session pulled back. Independent of the doc lane:
-        // its failure is swallowed inside `applyReconcile`.
-        if (held != null) {
-            await applyReconcile(peerDID, result.credentialReconcile);
-        }
+        // Materialise whatever the session pulled back (failure swallowed inside
+        // `applyReconcile`). Attempted whenever either lane could have populated
+        // `result.credentialReconcile` — `held` or `credentialOwners` — not just
+        // the first, or a credential-only reply would go unread.
+        const credentialReconcileApplied = held == null && credentialOwners.length === 0 ? undefined : await applyReconcile(peerDID, result.credentialReconcile);
         return {
             messagesReceived: result.messagesReceived,
             messagesSent: result.messagesSent,
-            divergentBuckets: result.divergentBuckets
+            divergentBuckets: result.divergentBuckets,
+            ...credentialReconcileApplied == null ? {} : {
+                credentialReconcileApplied
+            }
         };
     };
     return {
@@ -234,7 +335,15 @@ export function createSyncContext(_ctx, deps) {
         },
         catchUpWithBestPeer: async (groupID)=>{
             const { scopes } = await resolveActiveScopes(deps.stores);
-            if (scopes.length === 0) {
+            // The autonomous counterpart of `runCatchUp`'s own DURABLE REPAIR check:
+            // an unmet credential expectation must let periodic/automatic catch-up
+            // proceed too, not only an explicit `syncPeer` call — otherwise a device
+            // that never opens the app to name a peer never self-heals.
+            const credentialOwners = scopes.length === 0 ? await unmetCredentialOwnersFor([
+                deps.identity.id,
+                ...scopes.map((scope)=>scope.ownerDID)
+            ]) : [];
+            if (scopes.length === 0 && credentialOwners.length === 0) {
                 return {
                     peerDID: null,
                     outcome: 'no-scopes',

package/lib/context/types.d.ts

@@ -7,6 +7,7 @@ import type { Circle } from '@kubun/store-p2p';
 import type { LaneResult, PendingCommit } from '@kumiai/rpc';
 import type { Runtime } from '@sozai/runtime';
 import type { GroupBroadcastMessage } from '../groups/broadcast-message.js';
+import type { ControllerResolverFor } from '../groups/credential-wrapping-deps.js';
 import type { P2PEventEmitter } from '../groups/events.js';
 import type { GroupHandleRegistry } from '../groups/group-handle-registry.js';
 import type { GroupHealthMonitor } from '../groups/group-health-monitor.js';
@@ -40,6 +41,12 @@ export type ContextDeps = {
      * adoption a join performs uses the configured value rather than the default.
      */
     maxDriftMS?: number;
+    /**
+     * The engine's `did:kokuin:` controller-resolver seam, used by the credential
+     * reconcile-apply lane to source the delegate-wrapping admission deps. Optional:
+     * absent, a delegate-signed wrapping pulled on catch-up stays fail-closed.
+     */
+    controllerResolverFor?: ControllerResolverFor;
     emitter: P2PEventEmitter;
     runtime: Runtime;
     autoAcceptPeers?: Array<string>;

package/lib/groups/broadcast-message.d.ts

@@ -74,6 +74,12 @@ export type CredentialKeyBundle = {
     keyBranches: Array<string>;
     wrapping: CredentialKeyGrantWrapping;
     entries: Array<CredentialKeyGrantEntry>;
+    /**
+     * The persisted grantor-authority envelope, when the granter delegated the
+     * wrap. A string token, carried as-is (not base64url — it's not a byte
+     * value). Absent for an owner-signed grant.
+     */
+    grantorAuthority?: string;
 };
 export type GroupBroadcastMessage = {
     type: 'catalog:create';
@@ -214,12 +220,35 @@ export type GroupBroadcastMessage = {
     keyBranches: Array<string>;
     wrapping: CredentialKeyGrantWrapping;
     entries: Array<CredentialKeyGrantEntry>;
+    /** See {@link CredentialKeyBundle.grantorAuthority}. */
+    grantorAuthority?: string;
     /**
      * Signs identifiers and digests, not the ciphertext — see
      * {@link CredentialKeyGrantClaim}. The receiver recomputes both digests
      * from the plaintext frame before writing anything.
      */
     auth: ControlAuth;
+} | {
+    /**
+     * A grantor's advisory record of the key set it granted a recipient — the
+     * projection a recipient checks its own store against. ADVISORY: it
+     * authorizes nothing (a recipient decrypt-verifies its own keys); the
+     * receiver's gate only keeps a bogus manifest out of the store, admitting
+     * one only when the grantor holds a present-time `credential/administer`
+     * chain over the owner.
+     *
+     * Group-wide like `credential:key-grant`: the receiver keys the stored
+     * row on the manifest's own `(owner, recipient, grantor)`.
+     */
+    type: 'credential:key-manifest';
+    /** The grantor's signed manifest token — its issuer is the authoritative grantor. */
+    manifest: string;
+    /**
+     * The grantor's delegation tokens proving its `credential/administer`
+     * chain, closest-to-grantor first. Empty when the grantor IS the owner
+     * (self-issued).
+     */
+    delegationTokens: Array<string>;
 } | {
     /**
      * A device advertises itself to its co-members. Everything here except

package/lib/groups/broadcast.d.ts

@@ -1,4 +1,5 @@
-import type { OwnIdentity } from '@kokuin/token';
+import type { VerifyTokenHook } from '@kokuin/capability';
+import type { DIDMethodResolver, OwnIdentity } from '@kokuin/token';
 import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
 import type { HLC } from '@kubun/hlc';
 import type { Logger } from '@kubun/logger';
@@ -66,6 +67,15 @@ export type ProcessBroadcastParams = {
      * than migrating a store nothing else on the device uses.
      */
     credentialStore?: CredentialStoreAPI;
+    /**
+     * Controller resolver + revocation checker for a delegate-signed
+     * `credential:key-grant` wrapping, forwarded to
+     * {@link applyCredentialKeyGrantFrame} as its admission `deps`. Consumed
+     * together: a device that cannot source both (a light client) leaves a
+     * delegated wrapping fail-closed.
+     */
+    credentialControllerResolver?: DIDMethodResolver;
+    credentialRevocationChecker?: VerifyTokenHook;
     /**
      * The engine's future-drift bound, applied to a `credential:key-grant`'s
      * stamps. Optional: absence falls back to {@link DEFAULT_MAX_DRIFT_MS}, the