@kubun/plugin-p2p 0.14.0 → 0.15.1

package/lib/groups/group-peer-manager.js

@@ -6,6 +6,8 @@ import { createGroupPeer, RecoveryRequiredError } from '@kumiai/rpc';
 import { createHubLike } from '../hub/hub-like.js';
 import { createLoopbackLogHub } from '../hub/loopback-log-hub.js';
 import { createHubServerDIDResolver } from '../hub/server-did.js';
+import { HubTunnelServiceProvider } from '../sync/hub-tunnel-service-provider.js';
+import { createServiceTunnelListeners } from '../sync/service-tunnel-listeners.js';
 import { createTunnelListeners } from '../sync/tunnel-listeners.js';
 import { applyAccessDefaultSetToken } from './access-default-apply.js';
 import { createAnchorStore } from './anchor-store.js';
@@ -15,6 +17,7 @@ import { reprojectGroupSettings } from './circle-projection.js';
 import { adoptCommitJournalBlob, readJournalRequestID, settleLostControlRequest } from './commit-adoption.js';
 import { createCommitJournal } from './commit-journal.js';
 import { settleControlRequest } from './control-request.js';
+import { createCredentialWrappingDeps } from './credential-wrapping-deps.js';
 import { createGroupCrypto } from './group-crypto.js';
 import { buildGroupHandlers } from './group-handlers.js';
 import { createGroupMLS } from './group-mls.js';
@@ -112,6 +115,14 @@ const peerKey = (groupID, hubURL)=>`${groupID}|${hubURL}`;
                 auth: message.auth
             });
             return;
+        case 'credential:key-manifest':
+            // Both fields ride verbatim -- the token digests its own fields, so
+            // reshaping would break signature verification.
+            await peer.protocol('control').dispatch('control/credentialKeyManifest', {
+                manifest: message.manifest,
+                delegationTokens: message.delegationTokens
+            });
+            return;
         default:
             {
                 // Exhaustiveness gate. A broadcast type with no case here used to fall off
@@ -466,12 +477,19 @@ export function createGroupPeerManager(params) {
         // `hasStore` because `getStore` on an unregistered name throws, and a device
         // with no credential plugin must still bind its peers.
         const credentialStore = params.stores.hasStore(CREDENTIAL_STORE) ? await getCredentialStore(params.stores) : undefined;
+        // Delegate-wrapping admission deps, sourced from the engine's controller
+        // resolver. Absent seam → empty deps → fail-closed delegated wrapping.
+        const credentialWrappingDeps = await createCredentialWrappingDeps(params.stores, params.controllerResolverFor);
         return {
             p2pStore,
             delegationStore,
             ...credentialStore != null ? {
                 credentialStore
             } : {},
+            ...credentialWrappingDeps.controllerResolver != null && credentialWrappingDeps.revocationChecker != null ? {
+                credentialControllerResolver: credentialWrappingDeps.controllerResolver,
+                credentialRevocationChecker: credentialWrappingDeps.revocationChecker
+            } : {},
             graphStore: params.graphStore,
             graph: params.graph,
             selfDID: params.localDID,
@@ -811,6 +829,9 @@ export function createGroupPeerManager(params) {
     // Declared ahead of the presence it is triggered from, and assigned below once
     // the hub lookup it needs exists.
     let tunnelListeners;
+    // Same shape, service lane — see the assignment below. Reconciled on every
+    // trigger `tunnelListeners` is, and disposed alongside it in `stop`.
+    let serviceTunnelListeners;
     const presence = createPeerPresence({
         stores: params.stores,
         localDID: params.localDID,
@@ -821,6 +842,7 @@ export function createGroupPeerManager(params) {
         onProfileSet: ()=>{
             for (const groupID of joined){
                 void tunnelListeners?.reconcile(groupID);
+                void serviceTunnelListeners?.reconcile(groupID);
             }
         },
         getGroupEpoch: (groupID)=>params.registry.groupEpoch(groupID) ?? undefined,
@@ -891,6 +913,31 @@ export function createGroupPeerManager(params) {
         localDID: params.localDID,
         runtime: tunnelRuntime,
         syncHandlers: params.syncHandlers,
+        ...params.cache != null ? {
+            cache: params.cache
+        } : {},
+        tunnelHub: (groupID)=>{
+            const hubURL = bindings.get(groupID)?.values().next().value;
+            return hubURL == null ? undefined : getHubLike(hubURL);
+        },
+        ...logger != null ? {
+            logger
+        } : {},
+        ...params.tunnelIdleTimeoutMs != null ? {
+            idleTimeoutMs: params.tunnelIdleTimeoutMs
+        } : {}
+    });
+    serviceTunnelListeners = params.serviceServe == null || params.services == null || tunnelRuntime == null ? undefined : createServiceTunnelListeners({
+        stores: params.stores,
+        registry: params.registry,
+        identity: params.identity,
+        localDID: params.localDID,
+        runtime: tunnelRuntime,
+        serve: params.serviceServe,
+        services: params.services,
+        ...params.cache != null ? {
+            cache: params.cache
+        } : {},
         tunnelHub: (groupID)=>{
             const hubURL = bindings.get(groupID)?.values().next().value;
             return hubURL == null ? undefined : getHubLike(hubURL);
@@ -918,6 +965,7 @@ export function createGroupPeerManager(params) {
     triggerUnsubscribes.push(params.registry.onEpochChanged((groupID)=>{
         presence.scheduleAnnounce(groupID, 'epoch-changed');
         void tunnelListeners?.reconcile(groupID);
+        void serviceTunnelListeners?.reconcile(groupID);
     }));
     const addGroup = async (groupID)=>{
         joined.add(groupID);
@@ -940,6 +988,7 @@ export function createGroupPeerManager(params) {
         });
         // After the peers, so the binding the listeners read exists.
         await tunnelListeners?.reconcile(groupID);
+        await serviceTunnelListeners?.reconcile(groupID);
     };
     /** Groups with a catch-up round already open, so the triggers cannot stack. */ const policyCatchupInFlight = new Set();
     /** Groups already asked once on connect — see {@link schedulePolicyCatchup}. */ const policyCatchupAsked = new Set();
@@ -1074,6 +1123,7 @@ export function createGroupPeerManager(params) {
         async removeGroup (groupID) {
             joined.delete(groupID);
             await tunnelListeners?.removeGroup(groupID);
+            await serviceTunnelListeners?.removeGroup(groupID);
             const groupSet = bindings.get(groupID);
             const urls = groupSet != null ? [
                 ...groupSet
@@ -1085,6 +1135,7 @@ export function createGroupPeerManager(params) {
         },
         async reconcileTunnelListeners (groupID) {
             await tunnelListeners?.reconcile(groupID);
+            await serviceTunnelListeners?.reconcile(groupID);
         },
         async addBinding (groupID, hubURL) {
             if (!joined.has(groupID)) {
@@ -1105,12 +1156,14 @@ export function createGroupPeerManager(params) {
             // A group with no hub could not be dialled at all, so this is where its
             // members become answerable.
             await tunnelListeners?.reconcile(groupID);
+            await serviceTunnelListeners?.reconcile(groupID);
         },
         async removeBinding (groupID, hubURL) {
             await disposePeer(groupID, hubURL);
             // The listeners hold the drain of whichever hub is bound; the one they were
             // built on may be the one that just left.
             await tunnelListeners?.reconcile(groupID);
+            await serviceTunnelListeners?.reconcile(groupID);
         },
         broadcast: broadcastToPeers,
         async selectCommitPeer (groupID) {
@@ -1331,6 +1384,29 @@ export function createGroupPeerManager(params) {
             const hubURL = bindings.get(groupID)?.values().next().value;
             return hubURL == null ? undefined : getHubLike(hubURL);
         },
+        async serviceTransportTo (groupID, peerDID) {
+            const hub = this.tunnelHub(groupID);
+            // `tunnelRuntime` mirrors `params.runtime`, which is optional here (a test
+            // harness may build a manager without one) — a caller with no runtime has
+            // no id generator to hand the transport, so there is no session to build.
+            if (hub == null || tunnelRuntime == null) {
+                return undefined;
+            }
+            return new HubTunnelServiceProvider({
+                hub,
+                registry: params.registry,
+                groupID,
+                localDID: params.localDID,
+                peerDID,
+                runtime: tunnelRuntime,
+                ...params.tunnelIdleTimeoutMs != null ? {
+                    idleTimeoutMs: params.tunnelIdleTimeoutMs
+                } : {},
+                ...logger != null ? {
+                    logger: logger.getChild('service-tunnel-session')
+                } : {}
+            });
+        },
         async retryHubs () {
             const live = [
                 ...hubLikes.values()
@@ -1348,6 +1424,7 @@ export function createGroupPeerManager(params) {
             // Before the hubs go: each listener holds a subscription on one of them,
             // and its spawn loop re-arms until it is told to stop.
             await tunnelListeners?.dispose();
+            await serviceTunnelListeners?.dispose();
             for (const off of triggerUnsubscribes.splice(0)){
                 try {
                     off();

package/lib/groups/group-protocols.d.ts

@@ -310,6 +310,29 @@ export declare const controlProtocol: {
             readonly additionalProperties: false;
         };
     };
+    readonly 'control/credentialKeyManifest': {
+        readonly type: "event";
+        readonly retain: "log";
+        readonly description: "A grantor's advisory record of the key set it granted a recipient (the readiness union). `manifest` is the grantor's signed token; `delegationTokens` proves its administer chain over the owner. Group-wide because the receiver keys the row on the manifest's own owner/recipient/grantor. The manifest authorizes nothing — the receiver's gate keeps a bogus one out of the store.";
+        readonly data: {
+            readonly type: "object";
+            readonly properties: {
+                readonly manifest: {
+                    readonly type: "string";
+                    readonly description: "The grantor's signed manifest token; its issuer is the authoritative grantor.";
+                };
+                readonly delegationTokens: {
+                    readonly type: "array";
+                    readonly items: {
+                        readonly type: "string";
+                    };
+                    readonly description: "The grantor's administer-chain delegation tokens, closest-to-grantor first. Empty when the grantor is the owner.";
+                };
+            };
+            readonly required: readonly ["manifest", "delegationTokens"];
+            readonly additionalProperties: false;
+        };
+    };
     readonly 'control/groupLeaveRequest': {
         readonly type: "event";
         readonly retain: "ephemeral";
@@ -494,6 +517,7 @@ export type DelegationRevokeData = FromSchema<(typeof controlProtocol)['control/
 export type AccessDefaultSetData = FromSchema<(typeof controlProtocol)['control/accessDefaultSet']['data']>;
 export type AccessDefaultRemoveData = FromSchema<(typeof controlProtocol)['control/accessDefaultRemove']['data']>;
 export type CredentialKeyGrantData = FromSchema<(typeof controlProtocol)['control/credentialKeyGrant']['data']>;
+export type CredentialKeyManifestData = FromSchema<(typeof controlProtocol)['control/credentialKeyManifest']['data']>;
 export type GroupLeaveRequestData = FromSchema<(typeof controlProtocol)['control/groupLeaveRequest']['data']>;
 export type MutationApplyData = FromSchema<(typeof syncProtocol)['sync/mutationApply']['data']>;
 export type PeerAnnounceData = FromSchema<(typeof peerProtocol)['peer/announce']['data']>;
@@ -806,6 +830,29 @@ export declare const groupProtocols: {
                 readonly additionalProperties: false;
             };
         };
+        readonly 'control/credentialKeyManifest': {
+            readonly type: "event";
+            readonly retain: "log";
+            readonly description: "A grantor's advisory record of the key set it granted a recipient (the readiness union). `manifest` is the grantor's signed token; `delegationTokens` proves its administer chain over the owner. Group-wide because the receiver keys the row on the manifest's own owner/recipient/grantor. The manifest authorizes nothing — the receiver's gate keeps a bogus one out of the store.";
+            readonly data: {
+                readonly type: "object";
+                readonly properties: {
+                    readonly manifest: {
+                        readonly type: "string";
+                        readonly description: "The grantor's signed manifest token; its issuer is the authoritative grantor.";
+                    };
+                    readonly delegationTokens: {
+                        readonly type: "array";
+                        readonly items: {
+                            readonly type: "string";
+                        };
+                        readonly description: "The grantor's administer-chain delegation tokens, closest-to-grantor first. Empty when the grantor is the owner.";
+                    };
+                };
+                readonly required: readonly ["manifest", "delegationTokens"];
+                readonly additionalProperties: false;
+            };
+        };
         readonly 'control/groupLeaveRequest': {
             readonly type: "event";
             readonly retain: "ephemeral";

package/lib/groups/group-protocols.js

@@ -395,6 +395,34 @@ import { defineGroupProtocol } from '@kumiai/rpc';
             additionalProperties: false
         }
     },
+    'control/credentialKeyManifest': {
+        type: 'event',
+        // Retained like the grant: an offline recipient must still find this on
+        // the epoch's app topic later, so it costs one log frame.
+        retain: 'log',
+        description: "A grantor's advisory record of the key set it granted a recipient (the readiness union). `manifest` is the grantor's signed token; `delegationTokens` proves its administer chain over the owner. Group-wide because the receiver keys the row on the manifest's own owner/recipient/grantor. The manifest authorizes nothing — the receiver's gate keeps a bogus one out of the store.",
+        data: {
+            type: 'object',
+            properties: {
+                manifest: {
+                    type: 'string',
+                    description: "The grantor's signed manifest token; its issuer is the authoritative grantor."
+                },
+                delegationTokens: {
+                    type: 'array',
+                    items: {
+                        type: 'string'
+                    },
+                    description: "The grantor's administer-chain delegation tokens, closest-to-grantor first. Empty when the grantor is the owner."
+                }
+            },
+            required: [
+                'manifest',
+                'delegationTokens'
+            ],
+            additionalProperties: false
+        }
+    },
     'control/groupLeaveRequest': {
         type: 'event',
         retain: 'ephemeral',

package/lib/hub/http-client.js

@@ -9,7 +9,12 @@ export function createHTTPHubClient(params) {
         return new Client({
             transport,
             identity: params.identity,
-            serverID: opts?.serverID ?? params.serverID
+            serverID: opts?.serverID ?? params.serverID,
+            // The hub is a blind relay: no MLS roster, and a `Server` whose DID cache
+            // cannot be relied on across this client's reconnect churn. Embed the long
+            // form on every hub-facing token so a `did:peer:4` device's short-form
+            // `iss` self-resolves at the hub instead of throwing `Unknown DID`.
+            embedLongForm: true
         });
     };
 }

package/lib/hub/hub-like.js

@@ -1,5 +1,6 @@
 import { RequestError } from '@enkaku/client';
 import { ErrorCodes } from '@enkaku/protocol';
+import { normalizeDID } from '@kokuin/token';
 import { hubErrorFromCode, RetentionExceededError } from '@kumiai/hub-protocol';
 import { fromB64, toB64 } from '@sozai/codec';
 import { EventEmitter } from '@sozai/event';
@@ -79,14 +80,16 @@ function rethrowHubError(error) {
     #senderDID;
     #topicID;
     constructor(options){
-        this.#senderDID = options?.senderDID;
+        // Canonicalize the scope so a peer:4 sender attested by its long form (an
+        // embed-long-form hub client) still matches its short-form route DID.
+        this.#senderDID = options?.senderDID == null ? undefined : normalizeDID(options.senderDID);
         this.#topicID = options?.topicID;
     }
     push(message) {
         if (this.#stopped) {
             return;
         }
-        if (this.#senderDID != null && message.senderDID !== this.#senderDID) {
+        if (this.#senderDID != null && normalizeDID(message.senderDID) !== this.#senderDID) {
             return;
         }
         if (this.#topicID != null && message.topicID !== this.#topicID) {

package/lib/hub/peer-scoped-hub-view.d.ts

@@ -25,6 +25,12 @@ export type PeerScopedHubViewParams = {
  * MLS-authenticated identity. That is enough: the filter routes, MLS still
  * authorizes, and a hostile hub could only hide frames it can already drop.
  *
+ * Both sides are normalized before the match: a `did:peer:4` publisher whose hub
+ * client embeds the long form is attested by its long form, while `peerDID` is
+ * the roster's short form — a raw `===` would drop every such frame, and its
+ * request would vanish with no error (the exact failure this filter is meant to
+ * prevent for the OTHER peer's frames).
+ *
  * **`unsubscribe` is dropped.** The responder topic belongs to the (group,
  * epoch), not to a session: every listener on the device shares it, one per
  * co-member, and each respawns independently — so a departing transport must not

package/lib/hub/peer-scoped-hub-view.js

@@ -1,3 +1,4 @@
+import { normalizeDID } from '@kokuin/token';
 /**
  * A view over one device's hub that surfaces only the frames one peer sent.
  *
@@ -18,6 +19,12 @@
  * MLS-authenticated identity. That is enough: the filter routes, MLS still
  * authorizes, and a hostile hub could only hide frames it can already drop.
  *
+ * Both sides are normalized before the match: a `did:peer:4` publisher whose hub
+ * client embeds the long form is attested by its long form, while `peerDID` is
+ * the roster's short form — a raw `===` would drop every such frame, and its
+ * request would vanish with no error (the exact failure this filter is meant to
+ * prevent for the OTHER peer's frames).
+ *
  * **`unsubscribe` is dropped.** The responder topic belongs to the (group,
  * epoch), not to a session: every listener on the device shares it, one per
  * co-member, and each respawns independently — so a departing transport must not
@@ -26,6 +33,9 @@
  * therefore issued once per topic and held for the life of the view.
  */ export function createPeerScopedHubView({ hub, peerDID }) {
     const armed = new Set();
+    // Match on the canonical form so a peer:4 sender attested by its long form
+    // (an embed-long-form hub client) still routes to its short-form roster entry.
+    const scopedDID = normalizeDID(peerDID);
     const view = {
         publish: (params)=>hub.publish(params),
         subscribe: async (subscriberDID, topicID, options)=>{
@@ -58,7 +68,7 @@
                                 done: true
                             };
                         }
-                        if (result.value.senderDID === peerDID) {
+                        if (normalizeDID(result.value.senderDID) === scopedDID) {
                             return result;
                         }
                     }

package/lib/hub/wiring.d.ts

@@ -1,18 +1,22 @@
+import type { ClientTransportOf } from '@enkaku/protocol';
 import type { ProcedureHandlers } from '@enkaku/server';
-import type { OwnIdentity } from '@kokuin/token';
+import type { DIDCache, OwnIdentity } from '@kokuin/token';
 import type { KubunDB } from '@kubun/db';
 import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
 import type { HLC } from '@kubun/hlc';
 import type { Logger } from '@kubun/logger';
+import type { ServiceConfig, ServiceProtocol } from '@kubun/plugin-service-api';
 import type { LaneResult, PendingCommit } from '@kumiai/rpc';
 import type { Runtime } from '@sozai/runtime';
 import type { GroupBroadcastMessage } from '../groups/broadcast-message.js';
+import type { ControllerResolverFor } from '../groups/credential-wrapping-deps.js';
 import type { P2PEventEmitter } from '../groups/events.js';
 import type { GroupHandleRegistry } from '../groups/group-handle-registry.js';
 import type { BuildLedgerRedrive } from '../groups/group-peer-manager.js';
 import type { PeerPresence } from '../groups/peer-presence.js';
 import type { SyncProtocol } from '../protocol.js';
 import type { ForwardingConfig } from '../sync/forwarder.js';
+import type { ServeService } from '../sync/hub-tunnel-service-listener.js';
 import type { SyncTransportProvider } from '../sync/sync-client.js';
 import type { LedgerCatchupOptions, LedgerCatchupSummary, RejoinResult, StoreUnreadableMode } from '../types.js';
 import type { CreateHubClient } from './http-client.js';
@@ -65,6 +69,12 @@ export type HubWiring = {
      * carries is authorized per document at the far end exactly as an HTTP one is.
      */
     syncTransportTo: (groupID: string, peerDID: string) => Promise<SyncTransportProvider | undefined>;
+    /**
+     * Build the transport for one directed SERVICE-lane session to a co-member,
+     * relayed by the group's hub — the mirror of {@link syncTransportTo} on the
+     * service lane. `undefined` when the group has no hub bound.
+     */
+    serviceTransportTo: (groupID: string, peerDID: string) => Promise<ClientTransportOf<ServiceProtocol> | undefined>;
     dispose: () => Promise<void>;
 };
 export type SetupHubRelayParams = {
@@ -113,6 +123,12 @@ export type SetupHubRelayParams = {
      * stamp is bounded there the same way the graph lane bounds a mutation's.
      */
     maxDriftMS: number;
+    /**
+     * The engine's `did:kokuin:` controller-resolver seam, forwarded to the apply
+     * path so a delegate-signed `credential:key-grant` wrapping can be authorized.
+     * Omitted, the delegated wrapping stays fail-closed.
+     */
+    controllerResolverFor?: ControllerResolverFor;
     /**
      * Reconnect-backoff overrides forwarded to every hub adapter. Test-only; when
      * omitted the adapter runs on its production defaults.
@@ -130,5 +146,19 @@ export type SetupHubRelayParams = {
      * answers none.
      */
     syncHandlers?: ProcedureHandlers<SyncProtocol>;
+    /**
+     * Injected `plugin-service-server` `serve()`, for answering an inbound
+     * service-lane tunnel session — see {@link ServeService}. Paired with
+     * `services`: both present is what serves the lane.
+     */
+    serviceServe?: ServeService;
+    /** Which services to serve on an inbound service-lane session. */
+    services?: Record<string, ServiceConfig>;
+    /**
+     * Shared, plugin-lifetime DID cache forwarded to the group peer manager's
+     * tunnel listeners so a co-member's short-form `did:peer:4` issuer resolves on
+     * a spawned session's Server.
+     */
+    cache?: DIDCache;
 };
 export declare function setupHubRelay(params: SetupHubRelayParams): HubWiring;

package/lib/hub/wiring.js

@@ -10,7 +10,7 @@ import { HubTunnelSyncProvider } from '../sync/hub-tunnel-sync-provider.js';
  * once per candidate before reporting `no-route`.
  */ const DEFAULT_TUNNEL_IDLE_TIMEOUT_MS = 30_000;
 export function setupHubRelay(params) {
-    const { identity, runtime, db, graph, emitter, createHubClient, registry, buildLedgerRedrive, logger, storeUnreadable, defaultAccessLevel, forwarding, hlc, maxDriftMS, hubReconnectBackoff, tunnelIdleTimeoutMs } = params;
+    const { identity, runtime, db, graph, emitter, createHubClient, registry, buildLedgerRedrive, logger, storeUnreadable, defaultAccessLevel, forwarding, hlc, maxDriftMS, controllerResolverFor, hubReconnectBackoff, tunnelIdleTimeoutMs } = params;
     const unsubscribes = [];
     // Late-bound `ready` resolving to the live manager. The fire-and-forget
     // schedulers chain off it so a caller can enqueue work before boot completes;
@@ -68,6 +68,10 @@ export function setupHubRelay(params) {
             logger: logger.getChild('tunnel-session')
         });
     };
+    const serviceTransportTo = async (groupID, peerDID)=>{
+        const provider = await (await ready).serviceTransportTo(groupID, peerDID);
+        return provider == null ? undefined : await provider.createServiceTransport();
+    };
     ready = (async ()=>{
         const [p2pStore, graphStore] = await Promise.all([
             db.getStore('p2p'),
@@ -90,6 +94,9 @@ export function setupHubRelay(params) {
             storeUnreadable,
             defaultAccessLevel,
             forwarding,
+            ...controllerResolverFor != null ? {
+                controllerResolverFor
+            } : {},
             // The manager's own fan-out, reached through the same late-bound `ready`
             // every other scheduler chains off — a forward is one more broadcast, so
             // it takes the path a locally-authored one already takes.
@@ -102,6 +109,17 @@ export function setupHubRelay(params) {
             ...params.syncHandlers != null ? {
                 syncHandlers: params.syncHandlers
             } : {},
+            // The service lane's answering half; both present is what serves it,
+            // either absent and no service listeners stand up.
+            ...params.serviceServe != null ? {
+                serviceServe: params.serviceServe
+            } : {},
+            ...params.services != null ? {
+                services: params.services
+            } : {},
+            ...params.cache != null ? {
+                cache: params.cache
+            } : {},
             tunnelIdleTimeoutMs: tunnelIdleTimeoutMs ?? DEFAULT_TUNNEL_IDLE_TIMEOUT_MS
         });
         unsubscribes.push(emitter.on('groupJoined', (group)=>manager.addGroup(group.id).catch((error)=>{
@@ -170,6 +188,7 @@ export function setupHubRelay(params) {
         presence,
         retryHubs,
         syncTransportTo,
+        serviceTransportTo,
         dispose: async ()=>{
             for (const off of unsubscribes){
                 try {

package/lib/index.d.ts

@@ -1,4 +1,5 @@
 import type { DefaultAccessLevel, KubunPlugin, PluginFactoryParams } from '@kubun/engine';
+import type { ServiceConfig } from '@kubun/plugin-service-api';
 import { type CreateHubClient } from './hub/http-client.js';
 import { type BroadcastBatchConfig } from './sync/broadcast-queue.js';
 import { type PushSyncConfig } from './sync/broadcast-sender.js';
@@ -172,5 +173,18 @@ export type P2PPluginOptions = {
      * which a headless test would otherwise have to wait out per offline peer.
      */
     tunnelIdleTimeoutMs?: number;
+    /**
+     * Serve service-lane sessions over the hub tunnel, on a distinct protocol
+     * from sync so ratchet generation is never shared. Requires the
+     * `service-server` plugin; `serviceTransportTo` still resolves for dialing
+     * out even when this device serves nothing.
+     * - `true` / `{}` — serve `{ 'controller-log': true }`.
+     * - `{ services }` — serve exactly this config (falls back to
+     *   `{ 'controller-log': true }` when `services` is omitted).
+     * - absent / `false` (default) — no service-lane listener.
+     */
+    serviceTunnel?: boolean | {
+        services?: Record<string, ServiceConfig>;
+    };
 };
 export declare function createP2PPlugin(options?: P2PPluginOptions): (params: PluginFactoryParams) => KubunPlugin;