@kubun/plugin-p2p 0.17.2 → 0.17.3

package/lib/context/peer.js

@@ -1389,14 +1389,14 @@ export function createPeerContext(ctx, deps) {
         },
         beginProvisioningExpectation: async (params)=>{
             const store = await getCredentialStore(deps.stores);
-            const attemptId = crypto.randomUUID();
+            const attemptID = params.attemptID ?? deps.runtime.getRandomID();
             await store.beginProvisioningAttempt({
                 ownerDID: normalizeDID(params.ownerDID),
                 grantorDID: normalizeDID(params.grantorDID),
-                attemptId
+                attemptID
             });
             return {
-                attemptId
+                attemptID
             };
         },
         recordProvisioningExpectation: async (params)=>{
@@ -1422,7 +1422,7 @@ export function createPeerContext(ctx, deps) {
                 return await txStore.recordProvisioningAttempt({
                     ownerDID: owner,
                     grantorDID: grantor,
-                    attemptId: params.attemptId,
+                    attemptID: params.attemptID,
                     epoch: params.epoch,
                     heldEpoch
                 });
@@ -1433,7 +1433,14 @@ export function createPeerContext(ctx, deps) {
             await store.abandonProvisioningAttempt({
                 ownerDID: normalizeDID(params.ownerDID),
                 grantorDID: normalizeDID(params.grantorDID),
-                attemptId: params.attemptId
+                attemptID: params.attemptID
+            });
+        },
+        abandonProvisioningExpectations: async (params)=>{
+            const store = await getCredentialStore(deps.stores);
+            await store.abandonProvisioningAttempts({
+                ownerDID: normalizeDID(params.ownerDID),
+                grantorDID: normalizeDID(params.grantorDID)
             });
         },
         provisioningHeldEpoch: async (params)=>{

package/lib/groups/credential-readiness.d.ts

@@ -7,10 +7,25 @@ import { type DelegatedWrappingCheckDeps } from './grantor-authority.js';
  * decrypt-materialization; `reason` explains a `false` verdict (absent on
  * `complete`).
  */
+export type CredentialProvisioningGrantorStatus = {
+    grantorDID: string;
+    /** Manifest at/above floor, proof verifies now, and every key materialized. */
+    satisfied: boolean;
+    /**
+     * The held delegation proof verifies right now. `false` only when the
+     * administer-chain check on a HELD manifest returns false (revoked/expired
+     * OR transiently unvalidatable). An un-pulled/below-floor manifest and a
+     * self-grantor leave it `true` — no held proof has failed.
+     */
+    authorityValid: boolean;
+    /** This grantor's keys not yet materialized here. */
+    missing: Array<string>;
+};
 export type CredentialProvisioningReadiness = {
     complete: boolean;
     missing: Array<string>;
     reason?: 'not-initiated' | 'pending' | 'incomplete';
+    grantors: Array<CredentialProvisioningGrantorStatus>;
 };
 /**
  * Whether one expected key is materialized on this device AT the manifest's

package/lib/groups/credential-readiness.js

@@ -76,7 +76,8 @@ import { checkAdministerChain } from './grantor-authority.js';
         return {
             complete: false,
             missing: [],
-            reason: 'pending'
+            reason: 'pending',
+            grantors: []
         };
     }
     // Rule 2: nothing has ever been asked for — never a vacuous complete.
@@ -84,7 +85,8 @@ import { checkAdministerChain } from './grantor-authority.js';
         return {
             complete: false,
             missing: [],
-            reason: 'not-initiated'
+            reason: 'not-initiated',
+            grantors: []
         };
     }
     const manifests = await store.listManifests({
@@ -96,13 +98,21 @@ import { checkAdministerChain } from './grantor-authority.js';
             manifest
         ]));
     const missing = [];
+    const grantors = [];
     let allSatisfied = true;
     for (const expectation of expectations){
         const grantor = normalizeDID(expectation.grantorDID);
         const manifest = byGrantor.get(grantor);
         // No held manifest at/above the floor: this expectation names no known
-        // target keys to report as `missing` — it is simply unsatisfied.
+        // target keys to report as `missing` — it is simply unsatisfied. No held
+        // proof has failed here, so `authorityValid` stays true.
         if (manifest == null || manifest.record.epoch < expectation.epochFloor) {
+            grantors.push({
+                grantorDID: grantor,
+                satisfied: false,
+                authorityValid: true,
+                missing: []
+            });
             allSatisfied = false;
             continue;
         }
@@ -114,9 +124,16 @@ import { checkAdministerChain } from './grantor-authority.js';
         });
         if (!authorized) {
             // Expired/revoked/unwired proof: fail-closed means unmet, not thrown.
+            grantors.push({
+                grantorDID: grantor,
+                satisfied: false,
+                authorityValid: false,
+                missing: []
+            });
             allSatisfied = false;
             continue;
         }
+        const grantorMissing = [];
         for (const key of manifest.record.keys){
             let materialized = false;
             try {
@@ -134,21 +151,32 @@ import { checkAdministerChain } from './grantor-authority.js';
                 materialized = false;
             }
             if (!materialized) {
-                missing.push(key.keyID);
-                allSatisfied = false;
+                grantorMissing.push(key.keyID);
             }
         }
+        if (grantorMissing.length > 0) {
+            missing.push(...grantorMissing);
+            allSatisfied = false;
+        }
+        grantors.push({
+            grantorDID: grantor,
+            satisfied: grantorMissing.length === 0,
+            authorityValid: true,
+            missing: grantorMissing
+        });
     }
     if (allSatisfied && missing.length === 0) {
         return {
             complete: true,
-            missing: []
+            missing: [],
+            grantors
         };
     }
     return {
         complete: false,
         missing,
-        reason: 'incomplete'
+        reason: 'incomplete',
+        grantors
     };
 }
 /**

package/lib/schema.js

@@ -680,6 +680,17 @@ type GrantDeviceCredentialsPayload {
   epoch: Int!
 }
 
+"""One grantor's provisioning verdict within a credentialProvisioningStatus."""
+type CredentialProvisioningGrantorStatus {
+  grantorDID: DID!
+  """Manifest at/above floor, proof verifies now, every key materialized."""
+  satisfied: Boolean!
+  """False only when a held manifest's administer chain fails now (revoked/expired or transiently unvalidatable); un-pulled or self-grantor stays true."""
+  authorityValid: Boolean!
+  """This grantor's keyIDs not yet materialized here."""
+  missing: [ID!]!
+}
+
 """
 Readiness of this device's credential provisioning for one owner. A key counts
 materialized only when its wrapping decrypt-verifies (or, for a zero-entry key,
@@ -695,14 +706,13 @@ type CredentialProvisioningStatus {
   (asked for, not yet fully materialized/proven). Absent when complete.
   """
   reason: String
+  """Per-grantor breakdown; empty on pending/not-initiated."""
+  grantors: [CredentialProvisioningGrantorStatus!]!
 }
 
 type BeginProvisioningExpectationPayload {
-  """
-  Freshly minted attempt id; pass it to recordProvisioningExpectation /
-  abandonProvisioningExpectation to close this attempt.
-  """
-  attemptId: ID!
+  """The effective attempt id (caller-supplied or minted); pass to record/abandon to close it."""
+  attemptID: ID!
 }
 
 enum RecordProvisioningExpectationStatus {
@@ -745,25 +755,32 @@ extend type Mutation {
   grantDeviceCredentials(groupID: ID!, recipientDID: DID!, ownerDID: DID!, minEpoch: Int): GrantDeviceCredentialsPayload!
   """
   Arm this device to converge a credential grant for ownerDID from grantorDID:
-  write the provisioning-expectation row that lets the credential-reconcile PULL
-  fetch that owner's buckets (a delegate-signed grant converges only via the
-  pull, never the live apply). Call before asking the grantor to grant, then
-  recordProvisioningExpectation once the grant returns its epoch. Mirrors the
-  credentialProvisioningStatus query's recipient-local surface.
+  write the provisioning-expectation row the credential-reconcile pull fetches
+  against. Call before asking the grantor to grant, then recordProvisioningExpectation
+  once the grant returns its epoch. Optional attemptID: persist it before calling
+  for crash-recovery; omit to mint server-side. Idempotent only within the
+  outstanding window (a replay after record/abandon re-pins 'pending').
   """
-  beginProvisioningExpectation(ownerDID: DID!, grantorDID: DID!): BeginProvisioningExpectationPayload!
+  beginProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptID: ID): BeginProvisioningExpectationPayload!
   """
   Bind the provisioning floor for an in-flight attempt to the epoch its grant was
   signed under. Returns RECORDED when the floor binds, or RETRY with the held
   epoch when a higher manifest already landed (re-grant with minEpoch, then record
   the new attempt).
   """
-  recordProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptId: ID!, epoch: Int!): RecordProvisioningExpectationPayload!
+  recordProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptID: ID!, epoch: Int!): RecordProvisioningExpectationPayload!
   """
-  Stop tracking one provisioning attempt. Removes only this attemptId; never binds
+  Stop tracking one provisioning attempt. Removes only this attemptID; never binds
   or lowers a floor. Returns true.
   """
-  abandonProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptId: ID!): Boolean!
+  abandonProvisioningExpectation(ownerDID: DID!, grantorDID: DID!, attemptID: ID!): Boolean!
+  """
+  Clear EVERY outstanding provisioning attempt for a (owner, grantor) scope —
+  the recovery path when an attempt id was lost. Never binds or lowers a floor.
+  Exclusive recovery: also cancels any other in-flight attempt, so ensure none
+  is live. Returns true.
+  """
+  abandonProvisioningExpectations(ownerDID: DID!, grantorDID: DID!): Boolean!
   joinPeerGroup(peerDID: ID!, groupID: ID!): JoinPeerGroupPayload!
   """
   Apply one circle's desired sync end state. A null argument leaves that dimension
@@ -1099,14 +1116,17 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                 beginProvisioningExpectation: async (_source, args, context)=>{
                     return await requireP2P(context).peer.beginProvisioningExpectation({
                         ownerDID: args.ownerDID,
-                        grantorDID: args.grantorDID
+                        grantorDID: args.grantorDID,
+                        ...args.attemptID == null ? {} : {
+                            attemptID: args.attemptID
+                        }
                     });
                 },
                 recordProvisioningExpectation: async (_source, args, context)=>{
                     const result = await requireP2P(context).peer.recordProvisioningExpectation({
                         ownerDID: args.ownerDID,
                         grantorDID: args.grantorDID,
-                        attemptId: args.attemptId,
+                        attemptID: args.attemptID,
                         epoch: args.epoch
                     });
                     return {
@@ -1118,7 +1138,14 @@ export function createP2PSchemaExtension(emitter, syncManager, logger = getKubun
                     await requireP2P(context).peer.abandonProvisioningExpectation({
                         ownerDID: args.ownerDID,
                         grantorDID: args.grantorDID,
-                        attemptId: args.attemptId
+                        attemptID: args.attemptID
+                    });
+                    return true;
+                },
+                abandonProvisioningExpectations: async (_source, args, context)=>{
+                    await requireP2P(context).peer.abandonProvisioningExpectations({
+                        ownerDID: args.ownerDID,
+                        grantorDID: args.grantorDID
                     });
                     return true;
                 },

package/lib/types.d.ts

@@ -639,6 +639,13 @@ export type CredentialProvisioningStatusParams = {
      */
     ownerDID: string;
 };
+export type CredentialProvisioningGrantorStatus = {
+    grantorDID: string;
+    satisfied: boolean;
+    /** Held proof verifies now; `false` only when a held manifest's proof fails. */
+    authorityValid: boolean;
+    missing: Array<string>;
+};
 export type CredentialProvisioningStatusData = {
     /** True iff every durable expectation is satisfied — `missing` is empty. */
     complete: boolean;
@@ -653,22 +660,41 @@ export type CredentialProvisioningStatusData = {
      * `'incomplete'` (recorded but not yet satisfied). Absent when `complete`.
      */
     reason?: 'not-initiated' | 'pending' | 'incomplete';
+    /**
+     * Per-grantor breakdown, populated on the post-checks path (empty on
+     * `pending`/`not-initiated`). Lets a driver tell an un-pulled manifest
+     * (`authorityValid:true`, keep pulling) from a held proof that fails to
+     * verify (`authorityValid:false`, back off and await a fresh grant).
+     */
+    grantors: Array<CredentialProvisioningGrantorStatus>;
 };
 export type BeginProvisioningExpectationParams = {
     /** The credential owner this expectation tracks provisioning for. */
     ownerDID: string;
     /** The grantor this device expects a manifest from. */
     grantorDID: string;
+    /**
+     * Optional caller-supplied attempt id. Supply and persist it BEFORE calling
+     * to make begin crash-recoverable — after a crash the caller still knows the
+     * id to abandon. Idempotent only within the outstanding window: a replay
+     * after record/abandon re-creates the attempt and re-pins `pending`. Omit to
+     * have the id minted server-side.
+     */
+    attemptID?: string;
 };
 export type BeginProvisioningExpectationData = {
-    /** Freshly minted attempt id; pass it to `recordProvisioningExpectation`/`abandonProvisioningExpectation`. */
-    attemptId: string;
+    /**
+     * The effective attempt id for this attempt: the caller-supplied
+     * `attemptID` when one was given, else a freshly minted one. Pass it to
+     * `recordProvisioningExpectation`/`abandonProvisioningExpectation`.
+     */
+    attemptID: string;
 };
 export type RecordProvisioningExpectationParams = {
     ownerDID: string;
     grantorDID: string;
     /** The id `beginProvisioningExpectation` minted for this attempt. */
-    attemptId: string;
+    attemptID: string;
     /** The epoch this attempt's grant call was allocated and signed under. */
     epoch: number;
 };
@@ -683,7 +709,11 @@ export type AbandonProvisioningExpectationParams = {
     ownerDID: string;
     grantorDID: string;
     /** The id to stop tracking. Removes ONLY this id; never binds or lowers a floor. */
-    attemptId: string;
+    attemptID: string;
+};
+export type AbandonProvisioningExpectationsParams = {
+    ownerDID: string;
+    grantorDID: string;
 };
 export type ProvisioningHeldEpochParams = {
     ownerDID: string;
@@ -867,7 +897,7 @@ export type PeerRequestContext = {
     credentialProvisioningStatus: (params: CredentialProvisioningStatusParams) => Promise<CredentialProvisioningStatusData>;
     /**
      * Begin tracking a provisioning attempt for `(ownerDID, grantorDID)`: mints
-     * an `attemptId` and forces `credentialProvisioningStatus` to `pending`
+     * an `attemptID` and forces `credentialProvisioningStatus` to `pending`
      * until recorded/abandoned. Call BEFORE asking the grantor to grant, to
      * close the epoch-allocation race window.
      */
@@ -878,14 +908,23 @@ export type PeerRequestContext = {
      * attempt's epoch still exceeds it, the floor advances (`'recorded'`);
      * otherwise a higher manifest already arrived and the attempt stays
      * outstanding (`'retry'`, `minEpoch`) — retry the grant and call again with
-     * the same `attemptId`.
+     * the same `attemptID`.
      */
     recordProvisioningExpectation: (params: RecordProvisioningExpectationParams) => Promise<RecordProvisioningExpectationData>;
     /**
      * Stop tracking a dead/abandoned provisioning attempt: removes only this
-     * `attemptId` from the outstanding set, never touches the epoch floor.
+     * `attemptID` from the outstanding set, never touches the epoch floor.
      */
     abandonProvisioningExpectation: (params: AbandonProvisioningExpectationParams) => Promise<void>;
+    /**
+     * Clear EVERY outstanding provisioning attempt for a (owner, grantor) scope
+     * without an id — the recovery path for an orphaned attempt whose id was
+     * lost. Never touches the epoch floor. Exclusive-recovery contract: also
+     * cancels any other live coordinator's attempt for the scope, so the caller
+     * must ensure none is in flight; when the id is known, prefer
+     * `abandonProvisioningExpectation`.
+     */
+    abandonProvisioningExpectations: (params: AbandonProvisioningExpectationsParams) => Promise<void>;
     /**
      * This device's currently-held epoch for `(ownerDID, grantorDID)` — max
      * epoch among held manifests from that grantor, or `0`. Feeds `minEpoch`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-p2p",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "license": "see LICENSE.md",
   "sideEffects": false,
   "type": "module",
@@ -27,7 +27,7 @@
     "@kubun/db": "^0.17.0",
     "@kubun/db-adapter": "^0.17.0",
     "@kubun/engine": "^0.17.0",
-    "@kubun/graphql": "^0.17.0",
+    "@kubun/graphql": "^0.17.1",
     "@kubun/hlc": "^0.17.0",
     "@kubun/http-util": "^0.17.0",
     "@kubun/id": "^0.17.0",
@@ -42,7 +42,7 @@
     "@kubun/protocol": "^0.17.0",
     "@kubun/store-blob": "^0.17.0",
     "@kubun/store-controller": "^0.17.0",
-    "@kubun/store-credential": "^0.17.0",
+    "@kubun/store-credential": "^0.17.1",
     "@kubun/store-delegation": "^0.17.0",
     "@kubun/store-graph": "^0.17.0",
     "@kubun/store-p2p": "^0.17.0",
@@ -62,7 +62,7 @@
     "@sozai/runtime": "^0.1.0",
     "@sozai/schema": "^0.1.2",
     "@sozai/stream": "^0.2.0",
-    "graphql": "^16.14.2",
+    "graphql": "^17.0.2",
     "kysely": "^0.29.5",
     "ts-mls": "2.0.0-rc.13"
   },