@kubun/plugin-p2p 0.14.0 → 0.15.0

package/lib/schema.js

@@ -581,6 +581,12 @@ extend type Query {
   one group. The store is per-device.
   """
   controlRequests(groupID: ID): [ControlRequest!]!
+  """
+  Prove this device holds the complete credential set the owner's manifests
+  promised it: the union of every per-grantor manifest's keys, minus those that
+  actually decrypt-verify here. An empty missing list means the pull is complete.
+  """
+  credentialProvisioningStatus(ownerDID: DID!): CredentialProvisioningStatus!
 }
 
 enum GroupHealthCondition {
@@ -644,6 +650,48 @@ type ControlRequest implements Node {
   settledAt: DateTimeISO
 }
 
+"""
+One key's outcome from a grantDeviceCredentials batch: what happened when this
+device tried to hand one of the owner's active credential keys to the recipient
+device. Never an error thrown out of the batch — every key reports its own fate.
+"""
+type CredentialGrantOutcome {
+  keyID: ID!
+  """
+  The key's version after this call, or null when nothing was granted
+  (not-held / error outcomes carry no version).
+  """
+  version: Int
+  outcome: String!
+  """Present on not-held and error; the caught error's message."""
+  reason: String
+}
+
+type GrantDeviceCredentialsPayload {
+  results: [CredentialGrantOutcome!]!
+  """A grantor-signed manifest claiming exactly the granted/refreshed keys above."""
+  manifest: String!
+  """The provisioning epoch this manifest was allocated under."""
+  epoch: Int!
+}
+
+"""
+Readiness of this device's credential provisioning for one owner. A key counts
+materialized only when its wrapping decrypt-verifies (or, for a zero-entry key,
+merely opens) — presence and a valid signature alone never suffice.
+"""
+type CredentialProvisioningStatus {
+  complete: Boolean!
+  """The expected keyIDs not yet materialized on this device."""
+  missing: [ID!]!
+  """
+  Why complete is false: not-initiated (no expectation on record yet),
+  pending (an attempt is in flight, its floor not yet bound), or incomplete
+  (asked for, not yet fully materialized/proven). Absent when complete.
+  """
+  reason: String
+}
+
 extend type Mutation {
   connectPeer(url: String!): ConnectPeerPayload!
   sharePeerGroup(peerDID: ID!, groupID: ID, name: String, send: ShareInput, receive: ShareReceiveInput): SharePeerGroupPayload!
@@ -654,7 +702,15 @@ extend type Mutation {
   DID comes from the request's KeyPackage credential; a disagreeing did field, or a
   DID already on the roster, is refused.
   """
-  admitJoinRequest(groupID: ID!, joinRequest: String!, send: ShareInput, receive: ShareReceiveInput): AdmitJoinRequestPayload!
+  admitJoinRequest(groupID: ID!, joinRequest: String!, grants: [String!], send: ShareInput, receive: ShareReceiveInput): AdmitJoinRequestPayload!
+  """
+  Grant a device recipientDID this device's active credential keys for ownerDID,
+  resolving the recipient from the group's MLS roster. Returns every key's
+  outcome plus a grantor-signed manifest the recipient checks its store against.
+  minEpoch floors the allocated epoch at the recipient's held epoch, so a
+  reprovision attempt always supersedes a manifest it already holds. Defaults to 0.
+  """
+  grantDeviceCredentials(groupID: ID!, recipientDID: DID!, ownerDID: DID!, minEpoch: Int): GrantDeviceCredentialsPayload!
   joinPeerGroup(peerDID: ID!, groupID: ID!): JoinPeerGroupPayload!
   """
   Apply one circle's desired sync end state. A null argument leaves that dimension
@@ -880,6 +936,11 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                     const requests = await requireP2P(context).group.listControlRequests(args.groupID);
                     return requests.map(toControlRequestSDL);
                 },
+                credentialProvisioningStatus: async (_source, args, context)=>{
+                    return await requireP2P(context).peer.credentialProvisioningStatus({
+                        ownerDID: args.ownerDID
+                    });
+                },
                 ownDelegationTokens: async (_source, args, context)=>{
                     const viewerDID = context.getViewer();
                     if (viewerDID == null || context.p2p == null) {
@@ -948,6 +1009,7 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                     return await requireP2P(context).peer.admitJoinRequest({
                         groupID: args.groupID,
                         joinRequest: args.joinRequest,
+                        grants: args.grants ?? undefined,
                         sendModels: send?.models ?? null,
                         receiveActivate: receive?.activate ?? false,
                         // Same owner-signed executor `sharePeerGroup` binds, so the rows this
@@ -966,6 +1028,21 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                         }
                     });
                 },
+                grantDeviceCredentials: async (_source, args, context)=>{
+                    const { results, manifest, epoch } = await requireP2P(context).peer.grantDeviceCredentials({
+                        groupID: args.groupID,
+                        recipientDID: args.recipientDID,
+                        ownerDID: args.ownerDID,
+                        ...args.minEpoch == null ? {} : {
+                            minEpoch: args.minEpoch
+                        }
+                    });
+                    return {
+                        results,
+                        manifest,
+                        epoch
+                    };
+                },
                 joinPeerGroup: async (_source, args, context)=>{
                     return await requireP2P(context).peer.joinPeerGroup({
                         peerDID: args.peerDID,

package/lib/sync/handlers.js

@@ -283,14 +283,33 @@ export { checkSyncDelegation };
                     ...toWireOp(op),
                     subjectID: op.subject_id
                 }));
+            // Durable PULL repair, independent of live broadcast: manifests addressed
+            // to the authenticated `callerDID`, never an owner-supplied recipient,
+            // so a manifest never leaks to a device other than the one it names.
+            let manifests;
+            if (ctx.param.owners != null && ctx.param.owners.length > 0) {
+                // Independent per-owner lookups — query concurrently, preserve owner order.
+                const perOwner = await Promise.all(ctx.param.owners.map((owner)=>store.listManifests({
+                        ownerDID: owner,
+                        recipientDID: callerDID
+                    })));
+                manifests = perOwner.flatMap((rows)=>rows.map((row)=>({
+                            manifest: row.token,
+                            delegationTokens: row.delegationTokens
+                        })));
+            }
             logger.debug('sync/reconcile-credentials served', {
                 callerDID,
                 bundles: bundles.length,
-                tombstones: tombstones.length
+                tombstones: tombstones.length,
+                manifests: manifests?.length ?? 0
             });
             return {
                 bundles,
-                tombstones
+                tombstones,
+                ...manifests != null && {
+                    manifests
+                }
             };
         }
     });

package/lib/sync/held-delegations.d.ts

@@ -0,0 +1,14 @@
+import type { StoreProvider } from '@kubun/db';
+/**
+ * The device's own held read delegations for a set of scope owners, as the JWT
+ * strings an outbound catch-up rides in `delegationTokens`.
+ *
+ * Each token is a capability the owner (grantor) issued to this device
+ * (audience); presenting it lets the peer's `checkSyncDelegation` arm of
+ * `authorizeScope` authorize a pull of that owner's documents — e.g. a paired
+ * device reading a controller's documents via the pairing-time delegation.
+ *
+ * Keyed `grantor: ownerDID, audience: selfDID` (the direction the gate checks).
+ * Owners equal to `selfDID` are skipped; results are de-duplicated.
+ */
+export declare function resolveHeldDelegationTokens(stores: StoreProvider, selfDID: string, owners: Iterable<string>): Promise<Array<string>>;

package/lib/sync/held-delegations.js

@@ -0,0 +1,34 @@
+import { DELEGATION_STORE, getDelegationStore } from '@kubun/store-delegation';
+/**
+ * The device's own held read delegations for a set of scope owners, as the JWT
+ * strings an outbound catch-up rides in `delegationTokens`.
+ *
+ * Each token is a capability the owner (grantor) issued to this device
+ * (audience); presenting it lets the peer's `checkSyncDelegation` arm of
+ * `authorizeScope` authorize a pull of that owner's documents — e.g. a paired
+ * device reading a controller's documents via the pairing-time delegation.
+ *
+ * Keyed `grantor: ownerDID, audience: selfDID` (the direction the gate checks).
+ * Owners equal to `selfDID` are skipped; results are de-duplicated.
+ */ export async function resolveHeldDelegationTokens(stores, selfDID, owners) {
+    const distinctOwners = new Set();
+    for (const owner of owners){
+        if (owner !== selfDID) {
+            distinctOwners.add(owner);
+        }
+    }
+    if (distinctOwners.size === 0 || !stores.hasStore(DELEGATION_STORE)) {
+        return [];
+    }
+    const delegationStore = await getDelegationStore(stores);
+    // Independent per-owner lookups — query concurrently; the Set dedups regardless of order.
+    const perOwner = await Promise.all([
+        ...distinctOwners
+    ].map((ownerDID)=>delegationStore.getDelegationTokens({
+            grantor: ownerDID,
+            audience: selfDID
+        })));
+    return [
+        ...new Set(perOwner.flat().map((row)=>row.token))
+    ];
+}

package/lib/sync/hub-tunnel-service-listener.d.ts

@@ -0,0 +1,75 @@
+import type { ServerTransportOf } from '@enkaku/protocol';
+import type { Server } from '@enkaku/server';
+import type { Logger } from '@kubun/logger';
+import type { ServiceConfig, ServiceProtocol } from '@kubun/plugin-service-api';
+import { type MailboxHub } from '@kumiai/hub-tunnel';
+import type { Runtime } from '@sozai/runtime';
+import type { GroupHandleRegistry } from '../groups/group-handle-registry.js';
+/**
+ * Mirrors `ServiceServerPluginAPI['serve']` (`@kubun/plugin-service-server`)
+ * without importing it, so this listener has no direct dependency on that
+ * plugin. `serve()` applies provider discovery, handler/access-rule merge,
+ * handler-authorization wrapping, and controller-DID verification that a bare
+ * `new Server` would not.
+ */
+export type ServeService = (params: {
+    transport: ServerTransportOf<ServiceProtocol>;
+    services: Record<string, ServiceConfig>;
+    requireAuth?: false;
+}) => Server<ServiceProtocol>;
+/**
+ * The injected {@link ServeService} was called before the `service-server`
+ * plugin API had resolved. Transient — the listener retries on its normal backoff.
+ */
+export declare class ServiceServeNotReadyError extends Error {
+    constructor(message: string);
+}
+/**
+ * The injected {@link ServeService} failed for a reason a retry cannot change
+ * (plugin absent, unknown/colliding service name). Terminal — the listener
+ * stops answering for this peer instead of spinning on backoff.
+ */
+export declare class ServiceServeUnavailableError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export type HubTunnelServiceListenerParams = {
+    /**
+     * Shared multi-subscriber device hub. Every listener on a device receives on
+     * the same topic, so the hub is fronted by a per-peer view that drops other
+     * peers' frames before they reach the cipher.
+     */
+    hub: MailboxHub;
+    registry: GroupHandleRegistry;
+    groupID: string;
+    localDID: string;
+    peerDID: string;
+    /**
+     * Platform primitives, including the per-session id generator. Threaded in
+     * from the caller since this package runs on React Native and browser too,
+     * not just node.
+     */
+    runtime: Runtime;
+    /** Injected `plugin-service-server` `serve()` — see {@link ServeService}. */
+    serve: ServeService;
+    /** Which services to serve, forwarded verbatim to {@link serve} on every spawn. */
+    services: Record<string, ServiceConfig>;
+    idleTimeoutMs?: number;
+    logger?: Logger;
+};
+/**
+ * Answer side of the service tunnel — the same directed hub-tunnel machinery as
+ * `HubTunnelSyncListener`, on a distinct lane so a service session never
+ * collides with a sync session's topics or ratchet generation.
+ *
+ * Unlike the sync listener, this does not build a bare `Server`: it hands the
+ * spawned transport to the injected {@link ServeService} callback so
+ * provider discovery, handler wrapping, and controller-DID verification apply.
+ */
+export declare class HubTunnelServiceListener {
+    #private;
+    constructor(params: HubTunnelServiceListenerParams);
+    start(): void;
+    stop(): Promise<void>;
+}

package/lib/sync/hub-tunnel-service-listener.js

@@ -0,0 +1,289 @@
+import { createEncryptedHubTunnelTransport } from '@kumiai/hub-tunnel';
+import { APP_TOPIC_LABEL } from '@kumiai/rpc';
+import { createGroupCrypto } from '../groups/group-crypto.js';
+import { MLSEncryptor } from '../groups/mls-encryptor.js';
+import { createPeerScopedHubView } from '../hub/peer-scoped-hub-view.js';
+import { SERVICE_TUNNEL_PROTOCOL, tunnelTopic } from './tunnel-topics.js';
+/**
+ * The injected {@link ServeService} was called before the `service-server`
+ * plugin API had resolved. Transient — the listener retries on its normal backoff.
+ */ export class ServiceServeNotReadyError extends Error {
+    constructor(message){
+        super(message);
+        this.name = 'ServiceServeNotReadyError';
+    }
+}
+/**
+ * The injected {@link ServeService} failed for a reason a retry cannot change
+ * (plugin absent, unknown/colliding service name). Terminal — the listener
+ * stops answering for this peer instead of spinning on backoff.
+ */ export class ServiceServeUnavailableError extends Error {
+    constructor(message, options){
+        super(message, options);
+        this.name = 'ServiceServeUnavailableError';
+    }
+}
+/**
+ * Answer side of the service tunnel — the same directed hub-tunnel machinery as
+ * `HubTunnelSyncListener`, on a distinct lane so a service session never
+ * collides with a sync session's topics or ratchet generation.
+ *
+ * Unlike the sync listener, this does not build a bare `Server`: it hands the
+ * spawned transport to the injected {@link ServeService} callback so
+ * provider discovery, handler wrapping, and controller-DID verification apply.
+ */ export class HubTunnelServiceListener {
+    #hub;
+    #registry;
+    #groupID;
+    #localDID;
+    #peerDID;
+    #runtime;
+    #serve;
+    #services;
+    #idleTimeoutMs;
+    #logger;
+    #started = false;
+    #stopped = false;
+    /** Consecutive failed spawns, for the re-arm backoff. Reset by a success. */ #respawnAttempt = 0;
+    #respawnTimer;
+    #current;
+    // Single MLSEncryptor reused across spawns. Ordering across overlapping
+    // spawns (old transport's last decrypt vs. new spawn's first encrypt) is
+    // covered by the GroupHandleRegistry's per-group mutex.
+    #encryptor;
+    // Per-peer view over the device hub, built once and shared by every spawn: it
+    // holds the inbox subscription for the listener's whole life, so respawns
+    // neither re-arm nor release a topic other listeners are draining.
+    #peerHub;
+    constructor(params){
+        this.#hub = params.hub;
+        this.#registry = params.registry;
+        this.#groupID = params.groupID;
+        this.#localDID = params.localDID;
+        this.#peerDID = params.peerDID;
+        this.#runtime = params.runtime;
+        this.#serve = params.serve;
+        this.#services = params.services;
+        this.#idleTimeoutMs = params.idleTimeoutMs;
+        this.#logger = params.logger;
+    }
+    start() {
+        if (this.#started || this.#stopped) return;
+        this.#started = true;
+        this.#encryptor = new MLSEncryptor({
+            registry: this.#registry,
+            groupID: this.#groupID
+        });
+        this.#peerHub = createPeerScopedHubView({
+            hub: this.#hub,
+            peerDID: this.#peerDID
+        });
+        this.#spawnGuarded();
+    }
+    /**
+   * Spawn, and survive a spawn that throws. `#spawn` can reject (e.g.
+   * `exportSecret` when the group handle is unavailable); left bare that would
+   * be both an unhandled rejection and a listener that never answers again,
+   * since the only other respawn trigger — the transport's `disposed` event —
+   * can't fire for a session that was never built.
+   */ #spawnGuarded() {
+        void this.#spawn().then(()=>{
+            this.#respawnAttempt = 0;
+        }).catch((error)=>{
+            // Terminal serve() failure (plugin absent, unknown/colliding service):
+            // stop rather than respawn forever. `stop()` marks `#stopped`, so the
+            // scheduled-respawn path becomes a no-op; the dialing side idles out and
+            // falls back exactly as it does for a peer that never answers.
+            if (error instanceof ServiceServeUnavailableError) {
+                this.#logger?.error('hub tunnel service listener stopping: serve() failed permanently; the service lane will not answer for this peer', {
+                    lane: 'service',
+                    groupID: this.#groupID,
+                    peerDID: this.#peerDID,
+                    error
+                });
+                void this.stop();
+                return;
+            }
+            this.#logger?.warn('hub tunnel service listener spawn failed', {
+                lane: 'service',
+                groupID: this.#groupID,
+                peerDID: this.#peerDID,
+                attempt: this.#respawnAttempt,
+                error
+            });
+            this.#scheduleRespawn();
+        });
+    }
+    #scheduleRespawn() {
+        if (this.#stopped || this.#respawnTimer != null) return;
+        // Bounded: a handle that is unavailable because the group was left never
+        // becomes available, and this must not spin on it.
+        const delay = Math.min(30_000, 250 * 2 ** Math.min(this.#respawnAttempt++, 7));
+        const timer = setTimeout(()=>{
+            this.#respawnTimer = undefined;
+            if (this.#stopped) return;
+            this.#spawnGuarded();
+        }, delay);
+        timer.unref?.();
+        this.#respawnTimer = timer;
+    }
+    async stop() {
+        if (this.#stopped) return;
+        this.#stopped = true;
+        if (this.#respawnTimer != null) {
+            clearTimeout(this.#respawnTimer);
+            this.#respawnTimer = undefined;
+        }
+        const current = this.#current;
+        this.#current = undefined;
+        if (current != null) {
+            try {
+                await current.transport.dispose();
+            } catch  {
+            // ignore — best-effort teardown
+            }
+            try {
+                await current.server.dispose();
+            } catch  {
+            // ignore — best-effort teardown
+            }
+        }
+        this.#encryptor = undefined;
+        this.#peerHub = undefined;
+    }
+    async #spawn() {
+        if (this.#stopped) return;
+        const encryptor = this.#encryptor;
+        const peerHub = this.#peerHub;
+        if (encryptor == null || peerHub == null) {
+            throw new Error('HubTunnelServiceListener: not initialized; call start() first');
+        }
+        // Epoch-bound, role-scoped topics for this spawn, on the SERVICE lane — a
+        // distinct protocol label so a service session never shares a ratchet
+        // generation with a sync session. The server listens on this device's
+        // RESPONDER topic and replies on the peer's DIALER topic — the mirror of
+        // the dialing side, and disjoint from it. Topics rotate with the MLS
+        // epoch, so each spawn re-derives them; MLS decrypt inside the registry
+        // lock remains the authoritative membership/forward-secrecy gate.
+        // Seed epoch is unread here: this port never classifies commit frames.
+        const crypto = createGroupCrypto({
+            registry: this.#registry,
+            groupID: this.#groupID,
+            initialEpoch: 0,
+            runtime: this.#runtime
+        });
+        const secret = await crypto.exportSecret(APP_TOPIC_LABEL);
+        const epoch = crypto.epoch();
+        const sendTopicID = tunnelTopic(secret, epoch, 'dialer', this.#peerDID, SERVICE_TUNNEL_PROTOCOL);
+        const receiveTopicID = tunnelTopic(secret, epoch, 'responder', this.#localDID, SERVICE_TUNNEL_PROTOCOL);
+        // A stop() that landed while we awaited the handle must abort the spawn.
+        if (this.#stopped) return;
+        // No sessionID: a responder locks to whatever session dials it, so the id
+        // is not known until the first frame. `role` is what separates this
+        // listener's log lines from the dialer's on the same device at a glance.
+        const sessionLogger = this.#logger?.with({
+            role: 'listener',
+            lane: 'service',
+            groupID: this.#groupID,
+            peerDID: this.#peerDID,
+            epoch,
+            receiveTopicID
+        });
+        sessionLogger?.debug('tunnel session opening');
+        let transportRef;
+        const transport = createEncryptedHubTunnelTransport({
+            hub: peerHub,
+            encryptor,
+            groupID: this.#groupID,
+            sessionID: {
+                auto: true
+            },
+            localDID: this.#localDID,
+            sendTopicID,
+            receiveTopicID,
+            idleTimeoutMs: this.#idleTimeoutMs,
+            onSessionEnd: ()=>{
+                // Peer signaled end-of-session. Dispose the transport deterministically
+                // so the `disposed` event fires and the spawn loop re-arms for the
+                // next session arriving on the shared device drain.
+                void transportRef?.dispose().catch(()=>{
+                // ignore — best-effort
+                });
+            }
+        });
+        transportRef = transport;
+        // Hand the transport to the injected `serve()` rather than building a bare
+        // `Server` — the delta from the sync listener.
+        //
+        // `serve()` can throw synchronously (plugin API not yet resolved, or
+        // genuinely absent). By this point `transport` already exists and has
+        // already subscribed the hub, with no `disposed` handler attached yet to
+        // re-arm anything — left undisposed here, a throw would leak one
+        // orphaned, still-subscribed transport per retry. Dispose before
+        // rethrowing so every failed attempt cleans up after itself.
+        let server;
+        try {
+            server = this.#serve({
+                transport,
+                services: this.#services
+            });
+        } catch (error) {
+            await transport.dispose().catch(()=>{
+            // ignore — best-effort teardown
+            });
+            // Preserve transient/terminal classification for #spawnGuarded: a
+            // not-ready or already-terminal error rethrows as-is; any other throw is
+            // a permanent misconfiguration, wrapped terminal so the listener stops.
+            if (error instanceof ServiceServeNotReadyError || error instanceof ServiceServeUnavailableError) {
+                throw error;
+            }
+            throw new ServiceServeUnavailableError('service tunnel serve() failed permanently', {
+                cause: error
+            });
+        }
+        const session = {
+            transport,
+            server
+        };
+        this.#current = session;
+        // Defence in depth: no `await` sits between the `#stopped` check above and
+        // this assignment today, but re-checking after the assignment means a
+        // `stop()` landing in a future await window still gets torn down —
+        // whichever side runs second does the teardown.
+        if (this.#stopped) {
+            this.#current = undefined;
+            try {
+                await transport.dispose();
+            } catch  {
+            // ignore — best-effort teardown
+            }
+            try {
+                await server.dispose();
+            } catch  {
+            // ignore — best-effort teardown
+            }
+            return;
+        }
+        // `disposed` may fire more than once for a single session (disposing the
+        // server can re-enter the transport's dispose). Collapse to exactly one
+        // teardown + respawn so one session leaves exactly one successor.
+        let handled = false;
+        transport.events.on('disposed', ()=>{
+            if (handled) return;
+            handled = true;
+            sessionLogger?.debug('tunnel session closed');
+            if (this.#current === session) {
+                this.#current = undefined;
+            }
+            // Server stays around until its handlers drain; explicit cleanup here so
+            // long-running sessions don't leak server instances.
+            void server.dispose().catch(()=>{
+            // ignore
+            });
+            // Nothing re-arms the inbox here — this fires even after stop(), but the
+            // per-peer view never releases the topic, so a departing transport's
+            // teardown can't empty it. Respawn re-derives topics for the next session.
+            this.#spawnGuarded();
+        });
+    }
+}

package/lib/sync/hub-tunnel-service-provider.d.ts

@@ -0,0 +1,46 @@
+import type { ClientTransportOf } from '@enkaku/protocol';
+import type { Logger } from '@kubun/logger';
+import type { ServiceProtocol } from '@kubun/plugin-service-api';
+import type { Runtime } from '@sozai/runtime';
+import type { GroupHandleRegistry } from '../groups/group-handle-registry.js';
+import type { DeviceHub } from '../hub/hub-like.js';
+export type HubTunnelServiceProviderParams = {
+    /**
+     * Shared multi-subscriber device hub (from `createHubLike`). Each session
+     * attaches its own sink to this device-wide drain, narrowed to the peer it
+     * dialled, and filters to `receiveTopicID`; lifecycle events ride
+     * `hub.events`.
+     */
+    hub: DeviceHub;
+    registry: GroupHandleRegistry;
+    groupID: string;
+    localDID: string;
+    peerDID: string;
+    /**
+     * Platform primitives, including the per-session id generator. Threaded in
+     * from the caller since this package runs on React Native and browser too,
+     * not just node.
+     */
+    runtime: Runtime;
+    idleTimeoutMs?: number;
+    logger?: Logger;
+};
+/**
+ * Dial side of the SERVICE tunnel — the same directed hub-tunnel machinery as
+ * {@link HubTunnelSyncProvider}, riding a distinct lane so a service session to
+ * a peer never collides with a sync session's topics or ratchet generation.
+ */
+export declare class HubTunnelServiceProvider {
+    #private;
+    constructor(params: HubTunnelServiceProviderParams);
+    /**
+     * Build a fresh client transport for one tunnel service session.
+     *
+     * Topics are group- and role-scoped, derived from the current MLS epoch
+     * secret on the service lane: outbound frames publish to the peer's
+     * responder topic, and the transport subscribes to this device's own dialer
+     * topic. Topics rotate with the epoch, so callers create a new transport per
+     * session.
+     */
+    createServiceTransport(signal?: AbortSignal): Promise<ClientTransportOf<ServiceProtocol>>;
+}