@kubun/plugin-p2p 0.8.3 → 0.10.0

package/lib/hub/relay-manager.js

@@ -1 +1 @@
-import{HubConnectionPool as e}from"./connection-pool.js";import{GroupChannel as a}from"./group-channel.js";export class HubRelayManager{#e;#a;#t;#s;#r;#o;#i;#l;#c;#h;#u;#p=new Map;constructor(t){this.#e=t.p2pStore,this.#a=t.broadcastService,this.#t=t.deviceID,this.#r=t.logger,this.#o=t.ackFlushMs??500,this.#i=t.ackFlushMax??10,this.#l=t.backoffBaseMs??1e3,this.#c=t.backoffMaxMs??6e4,this.#h=t.backoffJitter??.25,this.#s=new e({createHubClient:t.createHubClient,logger:t.logger}),this.#u=t.createGroupChannel??(e=>new a(e))}async start(e){(await Promise.allSettled(e.map(e=>this.addGroup(e)))).forEach((a,t)=>{"rejected"===a.status&&this.#r?.error("addGroup failed during start",{groupID:e[t],error:a.reason})})}async addGroup(e){if(this.#p.has(e))return void this.#r?.debug("group already added",{groupID:e});let a=await this.#e.getGroup(e);if(null==a)throw Error(`Group ${e} not found`);let t=a.hub_urls;if(null==t||0===t.length)return void this.#r?.warn("group has no hub URLs, skipping",{groupID:e});t.length>1&&this.#r?.warn("multi-hub not yet supported, using first",{groupID:e,hubURLs:t});let s=this.#u({groupID:e,hubURL:t[0],deviceID:this.#t,pool:this.#s,broadcastService:this.#a,p2pStore:this.#e,logger:this.#r,ackFlushMs:this.#o,ackFlushMax:this.#i,backoffBaseMs:this.#l,backoffMaxMs:this.#c,backoffJitter:this.#h});await s.open(),this.#p.set(e,s)}async removeGroup(e){let a=this.#p.get(e);null!=a&&(this.#p.delete(e),await a.close())}async broadcast(e,a){let t=this.#p.get(e);if(null==t)throw Error(`Group ${e} is not active in HubRelayManager`);await t.broadcast(a)}async stop(){let e=[...this.#p.values()];this.#p.clear(),(await Promise.allSettled(e.map(e=>e.close()))).forEach(e=>{"rejected"===e.status&&this.#r?.warn("GroupChannel close failed",{error:e.reason})}),await this.#s.disposeAll()}}
+import{EventEmitter as e}from"@enkaku/event";import{HubConnectionPool as t}from"./connection-pool.js";import{GroupChannel as s}from"./group-channel.js";import{HubConnection as r}from"./hub-connection.js";export class HubRelayManager{#e;#t;#s;#r;#o;#a;#i;#n;#l;#c;#u;#h;#p;#g=new Map;#d=new Map;#b=new Map;#f=new Map;relayEvents;constructor(o){this.#e=o.p2pStore,this.#t=o.broadcastService,this.#s=o.deviceID,this.#o=o.logger,this.#a=o.ackFlushMs??500,this.#i=o.ackFlushMax??10,this.#n=o.backoffBaseMs??1e3,this.#l=o.backoffMaxMs??6e4,this.#c=o.backoffJitter??.25,this.#u=o.broadcastTimeoutMs;let a=o.p2pStore;this.#r=new t({createHubClient:o.createHubClient,logger:o.logger,onServerDIDObserved:o.onServerDIDObserved,resolvePinnedDID:async e=>{let t=await a.getHubByURL(e);return t?.server_did??null}}),this.#h=o.createGroupChannel??(e=>new s(e)),this.#p=o.createHubConnection??(e=>new r(e)),this.relayEvents=new e}async #M(e){let t=this.#g.get(e);if(null!=t)return t;let s=this.#p({hubURL:e,deviceID:this.#s,pool:this.#r,logger:this.#o,ackFlushMs:this.#a,ackFlushMax:this.#i,backoffBaseMs:this.#n,backoffMaxMs:this.#l,backoffJitter:this.#c});try{await s.open()}catch(e){try{await s.dispose()}catch{}throw e}let r=s.events.on("lifecycle",async t=>{let s=Object.freeze([...this.#b.entries()].filter(([,t])=>t===e).map(([e])=>e));await this.relayEvents.emit("relay",{...t,hubURL:e,groupIDs:s})});return this.#f.set(e,r),this.#g.set(e,s),s}async start(e){(await Promise.allSettled(e.map(e=>this.addGroup(e)))).forEach((t,s)=>{"rejected"===t.status&&this.#o?.error("addGroup failed during start",{groupID:e[s],error:t.reason})})}async addGroup(e){if(this.#d.has(e))return void this.#o?.debug("group already added",{groupID:e});if(null==await this.#e.getGroup(e))throw Error(`Group ${e} not found`);let t=await this.#e.listHubsByGroupID(e);0===t.length?this.#o?.warn("group has no hub bindings, skipping",{groupID:e}):(t.length>1&&this.#o?.warn("multi-hub not yet supported, using first",{groupID:e,hubURLs:t.map(e=>e.url)}),await this.#m(e,t[0].url))}async #m(e,t){let s=await this.#M(t),r=this.#h({groupID:e,deviceID:this.#s,hubConnection:s,broadcastService:this.#t,p2pStore:this.#e,logger:this.#o});await r.open(),this.#d.set(e,r),this.#b.set(e,t)}async addBinding(e,t){let s=this.#b.get(e);null!=s?s===t?this.#o?.debug("binding already active",{groupID:e,hubURL:t}):this.#o?.warn("multi-hub not yet supported, ignoring extra binding",{groupID:e,activeHubURL:s,newHubURL:t}):await this.#m(e,t)}async removeBinding(e,t){this.#b.get(e)!==t?this.#o?.debug("binding not active, ignoring removal",{groupID:e,hubURL:t}):await this.removeGroup(e)}async removeGroup(e){let t=this.#d.get(e);null!=t&&(await t.close(),this.#d.delete(e),this.#b.delete(e))}async broadcast(e,t,s){let r=this.#d.get(e);if(null==r)throw Error(`Group ${e} is not active in HubRelayManager`);let o=s?.timeoutMs??this.#u;await r.broadcast(t,{timeoutMs:o})}async sendCommit(e,t,s){let r=this.#d.get(e);if(null==r)throw Error(`Group ${e} is not active in HubRelayManager`);let o=s?.timeoutMs??this.#u;await r.sendCommit(t,{timeoutMs:o})}async stop(){for(let e of this.#f.values())e();this.#f.clear();let e=[...this.#d.values()];this.#d.clear(),this.#b.clear(),(await Promise.allSettled(e.map(e=>e.close()))).forEach(e=>{"rejected"===e.status&&this.#o?.warn("GroupChannel close failed",{error:e.reason})});let t=[...this.#g.values()];this.#g.clear(),(await Promise.allSettled(t.map(e=>e.close()))).forEach(e=>{"rejected"===e.status&&this.#o?.warn("HubConnection close failed",{error:e.reason})}),await this.#r.disposeAll()}}

package/lib/hub/send-handler.d.ts

@@ -1,28 +1,40 @@
-import type { Client } from '@enkaku/client';
-import type { HubProtocol } from '@enkaku/hub-protocol';
 import type { Logger } from '@kubun/logger';
-import type { P2PStoreAPI } from '@kubun/store-p2p';
 import type { GroupBroadcastMessage } from '../groups/broadcast.js';
 import type { BroadcastService } from '../groups/broadcast-service.js';
 export type HandleSendBroadcastParams = {
     groupID: string;
-    deviceID: string;
     message: GroupBroadcastMessage;
-    p2pStore: P2PStoreAPI;
     broadcastService: BroadcastService;
-    hubClient: Client<HubProtocol>;
+    /**
+     * Wire-send callback. Receives the groupID and the base64-encoded encrypted
+     * MLS application message, and is expected to fan it out via the underlying
+     * hub transport (e.g. `HubConnection.broadcast`). Decoupling from the hub
+     * client lets callers serialize the send through a per-group mutex shared
+     * with the receive path.
+     */
+    send: (groupID: string, payloadB64: string) => Promise<void>;
     logger?: Logger;
 };
 /**
- * Encrypt + send a broadcast for a group, then persist the advanced MLS state.
- *
- * Failure semantics:
- * - Missing MLS state for (group, device) → throw, caller cannot broadcast.
- * - `prepareSend` failure → throw, no save (epoch unchanged on disk).
- * - `hub/group/send` failure → throw, do NOT save advanced MLS state.
- *   Prevents an MLS epoch wedge where local state outpaces recipients.
- * - `saveMLSState` failure → throw. State has advanced in memory; on next call
- *   the load-from-disk path will re-derive a fresh handle from the prior epoch
- *   and re-encrypt. (Wedge protection only applies pre-save by design.)
+ * Encrypt + send a broadcast for a group. MLS state persistence is handled
+ * by the registry inside `BroadcastService.prepareSend`. Wedge protection
+ * (failed send → no advance of persisted state) is preserved because send
+ * runs INSIDE the registry's per-group lock and a throw skips persist.
  */
 export declare function handleSendBroadcast(params: HandleSendBroadcastParams): Promise<void>;
+export type HandleSendCommitParams = {
+    groupID: string;
+    /** Framed MLSMessage(Commit) bytes from the committer's `GroupManager` call. */
+    commitBytes: Uint8Array;
+    broadcastService: BroadcastService;
+    /** Same wire-send callback as {@link HandleSendBroadcastParams.send}. */
+    send: (groupID: string, payloadB64: string) => Promise<void>;
+    logger?: Logger;
+};
+/**
+ * Fan out a pre-produced MLS handshake Commit to a group's existing members.
+ * Unlike {@link handleSendBroadcast} this does not encrypt — the Commit is
+ * already a self-protected `PrivateMessage`; `prepareSendCommit` just tags it
+ * `mls` on the wire.
+ */
+export declare function handleSendCommit(params: HandleSendCommitParams): Promise<void>;

package/lib/hub/send-handler.js

@@ -1 +1 @@
-import{toB64 as a}from"@enkaku/codec";import{fromMLSStateRow as r,toMLSStateInsert as t}from"../groups/mls-state.js";export async function handleSendBroadcast(e){let{groupID:o,deviceID:s,message:n,p2pStore:i,broadcastService:p,hubClient:d,logger:u}=e,c=await i.getMLSState(o,s);if(null==c)throw Error(`MLS state missing for group ${o}; cannot broadcast`);let l=r(c),{encrypted:m,updatedGroupState:S}=await p.prepareSend({groupID:o,message:n,groupState:l});try{await d.request("hub/group/send",{param:{groupID:o,payload:a(m)}})}catch(a){throw u?.error("hub/group/send failed",{groupID:o,error:a}),a}await i.saveMLSState(t(S,o,s))}
+import{toB64 as r}from"@enkaku/codec";export async function handleSendBroadcast(e){let{groupID:o,message:t,broadcastService:a,send:n,logger:d}=e;try{await a.prepareSend({groupID:o,message:t,send:e=>n(o,r(e))})}catch(r){throw d?.error("hub/group/send failed",{groupID:o,error:r}),r}}export async function handleSendCommit(e){let{groupID:o,commitBytes:t,broadcastService:a,send:n,logger:d}=e;try{await a.prepareSendCommit({groupID:o,commitBytes:t,send:e=>n(o,r(e))})}catch(r){throw d?.error("hub/group/send (mls commit) failed",{groupID:o,error:r}),r}}

package/lib/hub/tunnel-inbox.d.ts

@@ -0,0 +1,20 @@
+import type { StoredMessage } from '@enkaku/hub-protocol';
+/**
+ * FIFO queue used by `HubConnection.tunnelMessageStream` to deliver synthetic /
+ * forwarded `StoredMessage` values to tunnel transports. Callers `push` messages;
+ * each consumer drains via an `AsyncIterator` returned from
+ * {@link TunnelInbox.iterator}. Disposal is idempotent: once `close` runs,
+ * subsequent pushes are dropped and pending iteration resolves to `done`.
+ *
+ * Multiple sequential iterators are supported (one consumer at a time, but
+ * iterators may be created and returned across the inbox's lifetime). Each
+ * iterator tracks its own pending waiter so `iterator.return()` drains only
+ * that iterator's waiter — leaving queued messages and other consumers'
+ * waiters intact for future iterators.
+ */
+export declare class TunnelInbox {
+    #private;
+    push(message: StoredMessage): void;
+    close(): void;
+    iterator(onReturn?: () => void): AsyncIterator<StoredMessage>;
+}

package/lib/hub/tunnel-inbox.js

@@ -0,0 +1 @@
+export class TunnelInbox{#e=[];#s=[];#t=!1;push(e){if(this.#t)return;let s=this.#s.shift();null!=s?s.resolve({value:e,done:!1}):this.#e.push(e)}close(){if(!this.#t)for(this.#t=!0;this.#s.length>0;){let e=this.#s.shift();e?.resolve({value:void 0,done:!0})}}iterator(e){let s=!1,t=new Set,i=()=>{if(!s){for(let e of(s=!0,t)){let s=this.#s.indexOf(e);s>=0&&this.#s.splice(s,1),e.resolve({value:void 0,done:!0})}t.clear(),e?.()}};return{next:()=>{let e;return s?Promise.resolve({value:void 0,done:!0}):this.#e.length>0?Promise.resolve({value:this.#e.shift(),done:!1}):this.#t?(i(),Promise.resolve({value:void 0,done:!0})):new Promise(s=>{e={resolve:s},t.add(e),this.#s.push(e)}).then(s=>(null!=e&&t.delete(e),!0===s.done&&i(),s))},return:()=>(i(),Promise.resolve({value:void 0,done:!0}))}}}

package/lib/hub/wait-for-gate.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Wait for a reconnect gate (or similar boolean-style gate) to clear, with an
+ * optional timeout. If `gate` is null the call returns immediately without
+ * allocating any timer or signal — this is the hot path while the connection
+ * is healthy. If `timeoutMs` is undefined we simply await the gate without
+ * arming a timer (callers with no timeout can also omit `onTimeout` to skip
+ * the closure allocation). Both set: race the gate against
+ * `AbortSignal.timeout`; the first to settle wins.
+ *
+ * `onTimeout` is invoked lazily — only when the timeout actually fires — so
+ * callers can capture mutable state (e.g. current reconnect attempt) at the
+ * moment of failure rather than at call time.
+ */
+export declare function waitForGate(gate: Promise<void> | null, timeoutMs: number | undefined, onTimeout?: () => Error): Promise<void>;

package/lib/hub/wait-for-gate.js

@@ -0,0 +1 @@
+export async function waitForGate(e,t,r){if(null==e)return;if(null==t)return void await e;if(null==r)throw Error("waitForGate: onTimeout required when timeoutMs is set");let i=AbortSignal.timeout(t),n=null,o=new Promise((e,t)=>{i.aborted?t(r()):(n=()=>{t(r())},i.addEventListener("abort",n,{once:!0}))});try{await Promise.race([e,o])}finally{null!=n&&i.removeEventListener("abort",n)}}

package/lib/hub/wiring.d.ts

@@ -0,0 +1,85 @@
+import type { OwnIdentity } from '@enkaku/token';
+import type { KubunDB } from '@kubun/db';
+import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
+import type { Logger } from '@kubun/logger';
+import type { GroupBroadcastMessage } from '../groups/broadcast.js';
+import { type BroadcastEvent } from '../groups/broadcast-service.js';
+import type { P2PEventEmitter } from '../groups/events.js';
+import type { GroupHandleRegistry } from '../groups/group-handle-registry.js';
+import type { ForwardingConfig } from '../sync/forwarder.js';
+import type { StoreUnreadableMode } from '../types.js';
+import type { OnServerDIDObserved } from './connection-pool.js';
+import type { GroupChannel, GroupChannelParams } from './group-channel.js';
+import type { HubConnection, HubConnectionParams } from './hub-connection.js';
+import { type CreateHubClient } from './relay-manager.js';
+export type HubWiring = {
+    ready: Promise<void>;
+    scheduleBroadcast: (groupID: string, message: GroupBroadcastMessage) => void;
+    /**
+     * Awaitable broadcast — resolves only after the message is encrypted + sent.
+     * Use when ordering matters relative to a subsequent local op (e.g. a
+     * leave-request that must be encrypted with the still-live MLS handle before
+     * `leaveGroup` tears it down). Rejects on send failure.
+     */
+    broadcastNow: (groupID: string, message: GroupBroadcastMessage) => Promise<void>;
+    /**
+     * Fire-and-forget fan-out of a pre-produced MLS handshake Commit to a
+     * group's existing members. Wired to `HubRelayManager.sendCommit`.
+     */
+    scheduleSendCommit: (groupID: string, commitBytes: Uint8Array) => void;
+    dispose: () => Promise<void>;
+};
+export type SetupHubRelayParams = {
+    identity: OwnIdentity;
+    db: KubunDB;
+    /**
+     * Engine graph internals — threaded through to `BroadcastService` so the
+     * `mutation:apply` broadcast variant can route peer-authored mutations
+     * through the engine with `origin: 'peer'`.
+     */
+    graph: GraphInternals;
+    emitter: P2PEventEmitter;
+    createHubClient: CreateHubClient;
+    onRemoteBroadcast: (event: BroadcastEvent) => void;
+    /**
+     * Single canonical access point for MLS `GroupHandle` instances. Threaded
+     * into `BroadcastService` so encrypt/decrypt go through the per-group
+     * mutex once Phase 3 lands. Currently stored but unused.
+     */
+    registry: GroupHandleRegistry;
+    logger: Logger;
+    /**
+     * Optional testing seam forwarded to `HubRelayManager`. Production code
+     * leaves this unset so the manager uses its default `GroupChannel`
+     * constructor.
+     */
+    createGroupChannel?: (params: GroupChannelParams) => GroupChannel;
+    /**
+     * Optional testing seam forwarded to `HubRelayManager`. Production code
+     * leaves this unset so the manager uses its default `HubConnection`
+     * constructor.
+     */
+    createHubConnection?: (params: HubConnectionParams) => HubConnection;
+    /**
+     * Receive-side storage mode. Forwarded to `BroadcastService` →
+     * `processBroadcast`. Defaults to `'persist'` when omitted.
+     */
+    storeUnreadable?: StoreUnreadableMode;
+    /** Server default access level — required when `storeUnreadable === 'drop'`. */
+    defaultAccessLevel?: DefaultAccessLevel;
+    /**
+     * Forwarding config. Threaded through to `BroadcastService` →
+     * `processBroadcast` along with the hub's own `scheduleBroadcast` hook.
+     * Default `false` disables the receive-time forwarding pipeline.
+     */
+    forwarding?: ForwardingConfig;
+    /**
+     * Forwarded to `HubRelayManager` → `HubConnectionPool`. Fired with the
+     * observed `serverDID` after the first signed response from a freshly-spawned
+     * client. Lets callers route capture into `captureServerDID` for TOFU
+     * pinning; omitting it skips capture entirely.
+     */
+    onServerDIDObserved?: OnServerDIDObserved;
+};
+export declare function setupHubRelay(params: SetupHubRelayParams): HubWiring;
+export declare const DISABLED_HUB: HubWiring;

package/lib/hub/wiring.js

@@ -0,0 +1 @@
+import{HLC as e}from"@kubun/hlc";import{BroadcastService as r}from"../groups/broadcast-service.js";import{HubRelayManager as o}from"./relay-manager.js";export function setupHubRelay(a){let t,{identity:d,db:i,graph:n,emitter:s,createHubClient:c,onRemoteBroadcast:u,registry:p,logger:h,createGroupChannel:l,createHubConnection:m,storeUnreadable:g,defaultAccessLevel:f,forwarding:b,onServerDIDObserved:y}=a,w=[],D=(e,r)=>{t.then(o=>o.broadcast(e,r).catch(r=>{h.error("broadcast failed",{groupID:e,error:r})}),()=>{})},v=async(e,r)=>{let o=await t;await o.broadcast(e,r)};return(t=(async()=>{let[a,t]=await Promise.all([i.getStore("p2p"),i.getStore("graph")]),v=new r({p2pStore:a,graphStore:t,graph:n,selfDID:d.id,registry:p,hlc:new e({nodeID:d.id}),storeUnreadable:g,defaultAccessLevel:f,forwarding:b,scheduleBroadcast:D,emitter:s,logger:h}),B=new o({p2pStore:a,broadcastService:v,deviceID:d.id,createHubClient:c,logger:h,createGroupChannel:l,createHubConnection:m,onServerDIDObserved:y});w.push(v.on("broadcast",u)),w.push(s.on("groupJoined",e=>B.addGroup(e.id).catch(r=>{h.error("addGroup failed",{groupID:e.id,error:r})}))),w.push(s.on("groupLeft",e=>B.removeGroup(e.groupID).catch(r=>{h.error("removeGroup failed",{groupID:e.groupID,error:r})}))),w.push(s.on("hubBound",({groupID:e,hubURL:r})=>B.addBinding(e,r).catch(o=>{h.error("addBinding failed",{groupID:e,hubURL:r,error:o})}))),w.push(s.on("hubUnbound",({groupID:e,hubURL:r})=>B.removeBinding(e,r).catch(o=>{h.error("removeBinding failed",{groupID:e,hubURL:r,error:o})})));let I=await a.listGroups();return await B.start(I.map(e=>e.id)),B})()).catch(e=>{h.error("hub relay setup failed",{error:e})}),{ready:t.then(()=>void 0),scheduleBroadcast:D,broadcastNow:v,scheduleSendCommit:(e,r)=>{t.then(o=>o.sendCommit(e,r).catch(r=>{h.error("sendCommit failed",{groupID:e,error:r})}),()=>{})},dispose:async()=>{for(let e of w)try{e()}catch{}w.length=0;try{let e=await t;await e.stop()}catch{}}}}export const DISABLED_HUB={ready:Promise.resolve(),scheduleBroadcast:()=>{},broadcastNow:async()=>{},scheduleSendCommit:()=>{},dispose:async()=>{}};

package/lib/index.d.ts

@@ -1,26 +1,121 @@
-import type { KubunPlugin, PluginFactoryParams } from '@kubun/engine';
+import type { DefaultAccessLevel, KubunPlugin, PluginFactoryParams } from '@kubun/engine';
+import type { CreateHubClient } from './hub/relay-manager.js';
+import { type BroadcastBatchConfig } from './sync/broadcast-queue.js';
+import { type PushSyncConfig } from './sync/broadcast-sender.js';
+import type { ForwardingConfig } from './sync/forwarder.js';
+import type { StoreUnreadableMode } from './types.js';
 export type { ContextDeps, PendingJoinRequest } from './context/types.js';
-export { type GroupBroadcastMessage, type ProcessBroadcastParams, processBroadcast, } from './groups/broadcast.js';
+export { type AffectedRow, type GroupBroadcastMessage, type MutationApplyEntry, type ProcessBroadcastParams, type ProcessBroadcastResult, processBroadcast, } from './groups/broadcast.js';
 export { deserializeBroadcast, serializeBroadcast } from './groups/broadcast-codec.js';
-export { ApplyError, type BroadcastEvent, BroadcastService, type BroadcastServiceEvents, type BroadcastServiceParams, DecryptError, type ReceiveBroadcastParams, type ReceiveBroadcastResult, type SendBroadcastParams, type SendBroadcastResult, } from './groups/broadcast-service.js';
-export { createFilteredGenerator, createGroupEventEmitter, type GroupEventEmitter, type GroupEventMap, } from './groups/events.js';
-export { decodeFullJoinRequest, decodeInvitePayload, decodeJoinRequest, encodeFullJoinRequest, encodeInvitePayload, encodeJoinRequest, type FullJoinRequestPayload, type InvitePayload, type JoinRequestPayload, } from './groups/invite-payload.js';
+export { ApplyError, type BroadcastEvent, BroadcastService, type BroadcastServiceEvents, type BroadcastServiceParams, DecryptError, type ReceiveBroadcastParams, type ReceiveBroadcastResult, type SendBroadcastParams, } from './groups/broadcast-service.js';
+export { createFilteredGenerator, createP2PEventEmitter, type P2PEventEmitter, type P2PEventMap, } from './groups/events.js';
+export { GroupHandleRegistry, type GroupHandleRegistryParams, type SeedParams, } from './groups/group-handle-registry.js';
+export { decodeFullJoinRequest, decodeInvitePayload, decodeJoinRequest, encodeFullJoinRequest, encodeInvitePayload, encodeJoinRequest, type FullJoinRequestPayload, type InvitePayload, type JoinRequestPayload, type SuggestedHub, } from './groups/invite-payload.js';
 export { type AddCircleMemberParams, type AddCircleMemberResult, type CreateCircleParams, type CreateCircleResult, type CreateGroupParams, type CreateGroupResult, type DeleteCircleParams, type DeleteCircleResult, GroupManager, type GroupManagerParams, type InviteToGroupParams, type InviteToGroupResult, type JoinGroupParams, type JoinGroupResult, type LeaveGroupParams, type LeaveGroupResult, type RemoveCircleMemberParams, type RemoveCircleMemberResult, type RemoveGroupMemberParams, type RemoveGroupMemberResult, type RemoveMemberParams, type RemoveMemberResult, type UpdateCircleParams, type UpdateCircleResult, type UpdateGroupParams, type UpdateGroupResult, } from './groups/manager.js';
+export { MLSEncryptor, type MLSEncryptorParams } from './groups/mls-encryptor.js';
 export { type MLSGroupHandle, restoreMLSGroupHandle } from './groups/mls-group-handle.js';
 export { replacer as mlsJSONReplacer, reviver as mlsJSONReviver } from './groups/mls-json.js';
 export { deserializeMLSGroupState, type MLSGroupState, type SerializedMLSGroupState, serializeMLSGroupState, } from './groups/mls-state.js';
 export type { SyncClientMessage, SyncProtocol, SyncServerMessage } from './protocol.js';
 export { createP2PSchemaExtension } from './schema.js';
+export { type BroadcastBatchConfig, type BroadcastQueue, type BroadcastQueueParams, createBroadcastQueue, DEFAULT_BROADCAST_BATCH_CONFIG, } from './sync/broadcast-queue.js';
+export { type BroadcastSenderParams, DEFAULT_PUSH_SYNC_CONFIG, type PushSyncConfig, wireBroadcastSender, } from './sync/broadcast-sender.js';
 export { type CatalogSyncScope, resolveCatalogSyncScopes } from './sync/catalog-scope.js';
+export { type EvaluateAndForwardParams, type EvaluateAndForwardResult, evaluateAndForward, type ForwardContext, type ForwardFilter, type ForwardingConfig, } from './sync/forwarder.js';
 export { checkSyncDelegation, negotiateDirection } from './sync/handlers.js';
+export { HubTunnelSyncListener, type HubTunnelSyncListenerParams, } from './sync/hub-tunnel-sync-listener.js';
+export { HubTunnelSyncProvider, type HubTunnelSyncProviderParams, } from './sync/hub-tunnel-sync-provider.js';
 export { type PeerConfig, type PeerConfigWithID, PeerRegistry } from './sync/peer-registry.js';
 export { SyncClient, type SyncClientParams, type SyncScope, type SyncTransportProvider, } from './sync/sync-client.js';
 export { type SyncEvent, SyncManager, type SyncManagerParams, type SyncSessionInfo, type SyncStatus, } from './sync/sync-manager.js';
+export type { OnServerDIDObserved } from './hub/connection-pool.js';
+export { DIDObservingTransport, type DIDObservingTransportParams, type ServerDIDObserver, } from './hub/did-observing-transport.js';
+export { ReconnectingError } from './hub/errors.js';
 export type { GroupChannel, GroupChannelParams } from './hub/group-channel.js';
-export { type CreateGroupChannel, type CreateHubClient, HubRelayManager, type HubRelayManagerParams, } from './hub/relay-manager.js';
-export type { CatalogData, CircleData, CircleMemberData, DeleteCatalogData, DeleteCircleData, GroupData, GroupMemberData, GroupRequestContext, InviteToGroupData, JoinGroupData, LeaveGroupData, P2PContext, P2PJoinRequestContext, RemoveCircleMemberData, RemoveGroupMemberData, SyncPluginAPI, SyncRequestContext, SyncSessionResult, UpdateCircleInput, UpdateGroupInput, } from './types.js';
+export { type CreateHTTPHubClientParams, createHTTPHubClient } from './hub/http-client.js';
+export type { ConnectionLifecycleEvent } from './hub/hub-connection.js';
+export { type BindHubToGroupParams, bindHubToGroup, type CaptureServerDIDParams, type CreateHubParams, captureServerDID, createHub, type DeleteHubParams, type DeleteHubResult, deleteHub, type GetHubParams, getHub, type Hub, HubServerDIDConflictError, type ListGroupsByHubParams, type ListHubsByGroupParams, type ListHubsParams, listGroupsByHub, listHubs, listHubsByGroup, type UnbindHubFromGroupParams, type UpdateHubParams, type UpsertHubParams, unbindHubFromGroup, updateHub, upsertHub, } from './hub/manager.js';
+export { type CreateGroupChannel, type CreateHubClient, type CreateHubClientOptions, type CreateHubConnection, HubRelayManager, type HubRelayManagerParams, type RelayEvent, } from './hub/relay-manager.js';
+export { DISABLED_HUB, type HubWiring, type SetupHubRelayParams, setupHubRelay, } from './hub/wiring.js';
+export type { CatalogData, CircleData, CircleMemberData, DeleteCatalogData, DeleteCircleData, GroupData, GroupMemberData, GroupRequestContext, InviteToGroupData, JoinGroupData, LeaveGroupData, P2PContext, P2PJoinRequestContext, RemoveCircleMemberData, RemoveGroupMemberData, StoreUnreadableMode, SyncPluginAPI, SyncRequestContext, SyncSessionResult, UpdateCircleInput, UpdateGroupInput, } from './types.js';
+export type ReceiveConfig = {
+    /**
+     * Receiver storage mode for incoming peer mutations.
+     * - `'persist'` (default) — store every doc that passes catalog/group
+     *   checks. Access enforced at query time; unreadable docs remain in DB
+     *   but filtered.
+     * - `'drop'` — apply read-access check at receive time using the local
+     *   peer's own DID as viewer. Mutations the local peer cannot read are
+     *   not persisted.
+     */
+    storeUnreadable: StoreUnreadableMode;
+};
+/**
+ * Default receive config. Under `'persist'` no gate is built and no extra
+ * DB lookups occur during receive.
+ */
+export declare const DEFAULT_RECEIVE_CONFIG: ReceiveConfig;
 export type P2PPluginOptions = {
     autoAcceptPeers?: Array<string>;
     http?: boolean | string;
+    /**
+     * Enable hub-mediated group broadcasts.
+     * - `true` / `{}` — build a default HTTP hub client factory from
+     *   `params.identity` + `params.runtime.fetch`.
+     * - `{ createHubClient }` — caller supplies a custom factory.
+     * - absent / `false` — hub relay disabled; all broadcast call-sites are
+     *   no-ops.
+     */
+    hub?: boolean | {
+        createHubClient?: CreateHubClient;
+    };
+    /**
+     * Batch broadcast queue config. Sender-side mutation:apply broadcasts are
+     * accumulated per target MLS group and flushed when window/count/byte
+     * thresholds trip. Defaults from {@link DEFAULT_BROADCAST_BATCH_CONFIG}.
+     * Set `enabled: false` to bypass the queue and emit one broadcast per
+     * mutation per scope.
+     */
+    batch?: Partial<BroadcastBatchConfig>;
+    /**
+     * Push-sync config. Gates the local `engine:mutation:authored` subscriber
+     * that drives `mutation:apply` broadcasts.
+     * - When `enabled: false` (default), no `mutation:apply` broadcasts are
+     *   emitted from this peer when local mutations land — even if `hub` is
+     *   configured. Merkle-pull continues to work, and the receive path
+     *   (incoming `mutation:apply` broadcasts) is unaffected.
+     * - When `enabled: true`, locally-authored mutations fan out per-scope
+     *   through the hub.
+     *
+     * Defaults from {@link DEFAULT_PUSH_SYNC_CONFIG}.
+     */
+    pushSync?: Partial<PushSyncConfig>;
+    /**
+     * Receive-side storage config. Controls whether peer mutations the local
+     * peer cannot read are persisted to the local DB or dropped at receive
+     * time. Defaults to {@link DEFAULT_RECEIVE_CONFIG} (persist).
+     */
+    receive?: Partial<ReceiveConfig>;
+    /**
+     * Server default access level used by the receive-time access gate when
+     * `receive.storeUnreadable === 'drop'` and no document or per-user-model
+     * default rule is declared. Defaults to `{ read: 'only_owner', write:
+     * 'only_owner' }` (no fan-out for undeclared models). Ignored under
+     * `'persist'`.
+     */
+    defaultAccessLevel?: DefaultAccessLevel;
+    /**
+     * Forwarding config. Controls per-peer N+1 re-broadcast.
+     * - `false` (default) — incoming `mutation:apply` broadcasts are NOT
+     *   re-broadcast.
+     * - `true` — re-broadcast each applied entry to every other MLS group the
+     *   local peer belongs to whose access + catalog gates pass.
+     * - {@link ForwardFilter} — same as `true`, plus per-candidate filter
+     *   callback that further narrows. Filter receives a {@link ForwardContext}.
+     *
+     * Push-sync config (`pushSync.enabled`) is orthogonal — forwarding fires
+     * regardless of whether locally-authored mutations are broadcast.
+     */
+    forwarding?: ForwardingConfig;
 };
 export declare function createP2PPlugin(options?: P2PPluginOptions): (params: PluginFactoryParams) => KubunPlugin;

package/lib/index.js

@@ -1 +1 @@
-import{ServerTransport as e}from"@enkaku/http-server-transport";import{Server as r}from"@enkaku/server";import{DirectTransports as t}from"@enkaku/transport";import{HLC as o}from"@kubun/hlc";import{p2pStoreDefinition as s}from"@kubun/store-p2p";import{createGroupContext as n}from"./context/group.js";import{createJoinContext as a}from"./context/join.js";import{createSyncContext as i}from"./context/sync.js";import{createGroupEventEmitter as p}from"./groups/events.js";import{GroupManager as c}from"./groups/manager.js";import{createP2PSchemaExtension as m}from"./schema.js";import{createSyncHandlers as g}from"./sync/handlers.js";import{SyncManager as d}from"./sync/sync-manager.js";export{processBroadcast}from"./groups/broadcast.js";export{deserializeBroadcast,serializeBroadcast}from"./groups/broadcast-codec.js";export{ApplyError,BroadcastService,DecryptError}from"./groups/broadcast-service.js";export{createFilteredGenerator,createGroupEventEmitter}from"./groups/events.js";export{decodeFullJoinRequest,decodeInvitePayload,decodeJoinRequest,encodeFullJoinRequest,encodeInvitePayload,encodeJoinRequest}from"./groups/invite-payload.js";export{GroupManager}from"./groups/manager.js";export{restoreMLSGroupHandle}from"./groups/mls-group-handle.js";export{replacer as mlsJSONReplacer,reviver as mlsJSONReviver}from"./groups/mls-json.js";export{deserializeMLSGroupState,serializeMLSGroupState}from"./groups/mls-state.js";export{createP2PSchemaExtension}from"./schema.js";export{resolveCatalogSyncScopes}from"./sync/catalog-scope.js";export{checkSyncDelegation,negotiateDirection}from"./sync/handlers.js";export{PeerRegistry}from"./sync/peer-registry.js";export{SyncClient}from"./sync/sync-client.js";export{SyncManager}from"./sync/sync-manager.js";export{HubRelayManager}from"./hub/relay-manager.js";export function createP2PPlugin(l){return u=>{let y,f;u.db.register(s);let j=u.db.adapter,h=u.identity,v=new o({nodeID:h.id}),x=new c({identity:h,getRandomID:u.runtime.getRandomID}),P=p(),S=new d({deployClusters:async e=>{let r=Object.values(e);await u.engine.deployGraph({clusters:r})},runtime:u.runtime,identity:u.identity,logger:u.getLogger("sync")}),b=g({db:u.db,logger:u.getLogger("sync-handlers"),peerRegistry:S.peerRegistry}),R=new Map,w=[],k={addPeer:e=>S.addPeer({config:e,stores:u.db}),removePeer:e=>S.removePeer({peerDID:e,stores:u.db}),listPeers:()=>S.listPeers({stores:u.db}),syncWithPeer:e=>S.merkleSyncWithPeer({...e,stores:u.db}),getStatus:e=>S.getStatus({peerDID:e,stores:u.db}),onSyncEvent:e=>S.onSyncEvent(e),createSyncTransport:function(e){let o=new t({signal:e}),s=new r({accessControl:!1,getRandomID:u.runtime.getRandomID,handlers:b,logger:u.getLogger("sync-server"),transports:[o.server],signal:e});return w.push(s),o.client}};if(l?.http){let t="string"==typeof l.http?l.http.replace(/^\//,""):"sync";k.syncReady=(async()=>{let o=await u.engine.getAPI("http");await o.listening,y=new e({allowedOrigin:["*"]}),f=new r({accessControl:!1,getRandomID:u.runtime.getRandomID,handlers:b,logger:u.getLogger("sync-http-server"),transports:[y]}),w.push(f),o.registerProtocol(t,y.fetch.bind(y))})()}return{name:"p2p",schemaExtension:e=>m(P),api:k,createContextFactory:()=>(e,r)=>{let t={identity:h,groupManager:x,syncManager:S,stores:r,adapter:j,hlc:v,emitter:P,pendingJoinRequests:R,runtime:u.runtime,autoAcceptPeers:l?.autoAcceptPeers};return{group:n(e,t),sync:i(e,t),join:a(e,t)}},dispose:async()=>{for(let e of w)await e.dispose();await y?.dispose(),await S.dispose()}}}}
+import{ServerTransport as e}from"@enkaku/http-server-transport";import{Server as r}from"@enkaku/server";import{isFullIdentity as t}from"@enkaku/token";import{DirectTransports as o}from"@enkaku/transport";import{HLC as s}from"@kubun/hlc";import{p2pStoreDefinition as n}from"@kubun/store-p2p";import{createDelegationContext as a}from"./context/delegation.js";import{createGroupContext as i}from"./context/group.js";import{createHubContext as c}from"./context/hub.js";import{createJoinContext as p}from"./context/join.js";import{createSyncContext as d}from"./context/sync.js";import{createP2PEventEmitter as u}from"./groups/events.js";import{GroupHandleRegistry as l}from"./groups/group-handle-registry.js";import{GroupManager as g}from"./groups/manager.js";import{forwardRemoteBroadcast as m}from"./hub/forward-remote-broadcast.js";import{createHTTPHubClient as b}from"./hub/http-client.js";import{captureServerDID as y}from"./hub/manager.js";import{DISABLED_HUB as f,setupHubRelay as h}from"./hub/wiring.js";import{createP2PSchemaExtension as j}from"./schema.js";import{createBroadcastQueue as v,DEFAULT_BROADCAST_BATCH_CONFIG as x}from"./sync/broadcast-queue.js";import{DEFAULT_PUSH_SYNC_CONFIG as S,wireBroadcastSender as w}from"./sync/broadcast-sender.js";import{createSyncHandlers as D}from"./sync/handlers.js";import{SyncManager as P}from"./sync/sync-manager.js";export{processBroadcast}from"./groups/broadcast.js";export{deserializeBroadcast,serializeBroadcast}from"./groups/broadcast-codec.js";export{ApplyError,BroadcastService,DecryptError}from"./groups/broadcast-service.js";export{createFilteredGenerator,createP2PEventEmitter}from"./groups/events.js";export{GroupHandleRegistry}from"./groups/group-handle-registry.js";export{decodeFullJoinRequest,decodeInvitePayload,decodeJoinRequest,encodeFullJoinRequest,encodeInvitePayload,encodeJoinRequest}from"./groups/invite-payload.js";export{GroupManager}from"./groups/manager.js";export{MLSEncryptor}from"./groups/mls-encryptor.js";export{restoreMLSGroupHandle}from"./groups/mls-group-handle.js";export{replacer as mlsJSONReplacer,reviver as mlsJSONReviver}from"./groups/mls-json.js";export{deserializeMLSGroupState,serializeMLSGroupState}from"./groups/mls-state.js";export{createP2PSchemaExtension}from"./schema.js";export{createBroadcastQueue,DEFAULT_BROADCAST_BATCH_CONFIG}from"./sync/broadcast-queue.js";export{DEFAULT_PUSH_SYNC_CONFIG,wireBroadcastSender}from"./sync/broadcast-sender.js";export{resolveCatalogSyncScopes}from"./sync/catalog-scope.js";export{evaluateAndForward}from"./sync/forwarder.js";export{checkSyncDelegation,negotiateDirection}from"./sync/handlers.js";export{HubTunnelSyncListener}from"./sync/hub-tunnel-sync-listener.js";export{HubTunnelSyncProvider}from"./sync/hub-tunnel-sync-provider.js";export{PeerRegistry}from"./sync/peer-registry.js";export{SyncClient}from"./sync/sync-client.js";export{SyncManager}from"./sync/sync-manager.js";export{DIDObservingTransport}from"./hub/did-observing-transport.js";export{ReconnectingError}from"./hub/errors.js";export{createHTTPHubClient}from"./hub/http-client.js";export{bindHubToGroup,captureServerDID,createHub,deleteHub,getHub,HubServerDIDConflictError,listGroupsByHub,listHubs,listHubsByGroup,unbindHubFromGroup,updateHub,upsertHub}from"./hub/manager.js";export{HubRelayManager}from"./hub/relay-manager.js";export{DISABLED_HUB,setupHubRelay}from"./hub/wiring.js";export const DEFAULT_RECEIVE_CONFIG={storeUnreadable:"persist"};export function createP2PPlugin(I){return R=>{var E;let H,L,B,C;R.db.register(n);let G=R.db.adapter;if(!(t(E=R.identity)&&"privateKey"in E))throw Error("createP2PPlugin requires an OwnIdentity (full identity with privateKey) — received a narrower Identity");let A=R.identity,F=new s({nodeID:A.id}),k={...DEFAULT_RECEIVE_CONFIG,...I?.receive},T=I?.defaultAccessLevel??{read:"only_owner",write:"only_owner"},U=new l({stores:R.db,deviceID:A.id,logger:R.getLogger("group-handle-registry")}),_=new g({identity:A,getRandomID:R.runtime.getRandomID,registry:U}),O=u(),q=new P({deployClusters:async e=>{let r=Object.values(e);await R.engine.deployGraph({clusters:r})},graph:R.graph,runtime:R.runtime,identity:R.identity,logger:R.getLogger("sync"),storeUnreadable:k.storeUnreadable,defaultAccessLevel:T}),N=D({db:R.db,graph:R.graph,logger:R.getLogger("sync-handlers"),peerRegistry:q.peerRegistry,selfDID:A.id,storeUnreadable:k.storeUnreadable,defaultAccessLevel:T}),M=new Map,J=[],z=R.getLogger("hub-relay"),K=f,V={...S,...I?.pushSync};if(I?.hub){let e="object"==typeof I.hub&&null!=I.hub.createHubClient?I.hub.createHubClient:b({identity:A,fetch:R.runtime.fetch});K=h({identity:A,db:R.db,graph:R.graph,emitter:O,createHubClient:e,registry:U,onRemoteBroadcast:e=>{m(O,e,z).catch(e=>{z.error("forwardRemoteBroadcast failed",{error:e})})},logger:z,storeUnreadable:k.storeUnreadable,defaultAccessLevel:T,forwarding:I.forwarding,onServerDIDObserved:({hubURL:e,serverDID:r})=>y({stores:R.db,hubURL:e,serverDID:r}).then(()=>void 0)}),V.enabled&&(L=v({config:{...x,...I.batch},scheduleBroadcast:K.scheduleBroadcast,logger:R.getLogger("broadcast-queue")}),H=w({db:R.db,eventBus:R.eventBus,selfDID:A.id,queue:L,logger:R.getLogger("broadcast-sender")}))}let W={hubReady:K.ready,addPeer:e=>q.addPeer({config:e,stores:R.db}),removePeer:e=>q.removePeer({peerDID:e,stores:R.db}),listPeers:()=>q.listPeers({stores:R.db}),syncWithPeer:e=>q.merkleSyncWithPeer({...e,stores:R.db}),getStatus:e=>q.getStatus({peerDID:e,stores:R.db}),onSyncEvent:e=>q.onSyncEvent(e),createSyncTransport:function(e){let t=new o({signal:e}),s=new r({getRandomID:R.runtime.getRandomID,handlers:N,logger:R.getLogger("sync-server"),transports:[t.server],signal:e});return J.push(s),t.client}};if(I?.http){let t="string"==typeof I.http?I.http.replace(/^\//,""):"sync";W.syncReady=(async()=>{let o=await R.engine.getAPI("http");await o.listening,B=new e({allowedOrigin:["*"]}),C=new r({getRandomID:R.runtime.getRandomID,handlers:N,logger:R.getLogger("sync-http-server"),transports:[B]}),J.push(C),o.registerProtocol(t,B.fetch.bind(B))})()}return{name:"p2p",schemaExtension:e=>j(O),api:W,createContextFactory:()=>(e,r)=>{let t={identity:A,groupManager:_,registry:U,syncManager:q,stores:r,adapter:G,hlc:F,emitter:O,pendingJoinRequests:M,runtime:R.runtime,autoAcceptPeers:I?.autoAcceptPeers,scheduleBroadcast:K.scheduleBroadcast,broadcastNow:K.broadcastNow,scheduleSendCommit:K.scheduleSendCommit,logger:R.getLogger("context")};return{group:i(e,t),sync:d(e,t),join:p(e,t),hub:c(e,t),delegation:a(e,t)}},dispose:async()=>{if(null!=H)try{H()}catch{}if(null!=L)try{L.dispose()}catch{}let e=(async()=>{for(let e of J)await e.dispose();null!=B&&await B.dispose()})(),r=R.getLogger("dispose"),t=await Promise.allSettled([e,q.dispose(),K.dispose()]),o=["sync-http","sync-manager","hub"];t.forEach((e,t)=>{"rejected"===e.status&&r.error("dispose branch failed",{branch:o[t],error:e.reason})})}}}}

package/lib/schema.d.ts

@@ -1,3 +1,3 @@
 import type { SchemaExtension } from '@kubun/engine';
-import { type GroupEventEmitter } from './groups/events.js';
-export declare function createP2PSchemaExtension(emitter: GroupEventEmitter): SchemaExtension;
+import { type P2PEventEmitter } from './groups/events.js';
+export declare function createP2PSchemaExtension(emitter: P2PEventEmitter): SchemaExtension;

package/lib/schema.js

@@ -1,17 +1,17 @@
-import{createFilteredGenerator as e}from"./groups/events.js";function r(e){if(null==e.p2p)throw Error("p2p plugin is not wired into this context");return e.p2p}let t=`
+import{createFilteredGenerator as e}from"./groups/events.js";function r(e){if(null==e.p2p)throw Error("p2p plugin is not wired into this context");return e.p2p}async function*t(){}let o=`
 type PeerGroup {
   id: ID!
   name: String!
   description: String
-  createdBy: String!
-  createdAt: String!
+  createdBy: DID!
+  createdAt: DateTimeISO!
 }
 
 type PeerGroupMember {
   groupID: ID!
-  memberDID: String!
+  memberDID: DID!
   role: String!
-  createdAt: String!
+  createdAt: DateTimeISO!
 }
 
 type PeerCircle {
@@ -19,28 +19,43 @@ type PeerCircle {
   groupID: ID!
   name: String!
   description: String
-  createdAt: String!
+  createdAt: DateTimeISO!
 }
 
 type PeerCircleMember {
   circleID: ID!
-  memberDID: String!
+  memberDID: DID!
   role: String!
-  createdAt: String!
+  createdAt: DateTimeISO!
 }
 
 type PeerCatalog {
   id: ID!
-  ownerDID: String!
+  ownerDID: DID!
   name: String!
   description: String
   filterCriteria: String!
-  createdAt: String!
+  createdAt: DateTimeISO!
+}
+
+type PeerHub {
+  id: ID!
+  label: String
+  url: URL!
+  serverDID: DID
+  createdAt: DateTimeISO!
+  updatedAt: DateTimeISO
+}
+
+input SuggestedHubInput {
+  url: URL!
+  serverDID: DID
 }
 
 input CreateGroupInput {
   name: String!
   description: String
+  hubs: [SuggestedHubInput!]
 }
 
 type CreateGroupPayload {
@@ -110,13 +125,13 @@ type DeleteCirclePayload {
 
 type RemoveCircleMemberPayload {
   circleID: ID!
-  memberDID: String!
+  memberDID: DID!
 }
 
 type SyncPeer {
   id: String!
-  peerDID: String!
-  endpoint: String!
+  peerDID: DID!
+  endpoint: URL!
   mode: String!
   priority: String!
   trustLevel: String!
@@ -140,35 +155,110 @@ type RemoveSyncPeerPayload {
   success: Boolean!
 }
 
+input CreateHubInput {
+  url: URL!
+  label: String
+  serverDID: DID
+}
+
+input UpdateHubInput {
+  id: ID!
+  url: URL
+  label: String
+  serverDID: DID
+}
+
+type DeleteHubPayload {
+  success: Boolean!
+  boundGroupIDs: [ID!]!
+}
+
+type DelegationToken {
+  jwt: String!
+  jti: String!
+  grantor: ID!
+  audience: ID!
+  resource: String!
+  exp: Int!
+}
+
+input DelegationTokenCovers {
+  modelID: ID
+  docID: ID
+}
+
+"""
+A verified revocation of a delegation token addressed to the viewer.
+Only surfaces while the underlying held capability still exists locally;
+revocations whose cap was deleted or never arrived are excluded by the
+audience-derivation join.
+"""
+type RevokedDelegationToken {
+  jti: ID!
+  grantor: ID!
+  audience: ID!
+  revokerDID: DID!
+  "Issuer's revocation-record timestamp (iat), Unix epoch seconds."
+  revokedAt: Int!
+  """
+  Wall-clock time the revocation became binding, Unix epoch seconds. For
+  self-issued revocations this equals revokedAt (verified at mint time);
+  for received revocations it is the receiver's clock at the moment the
+  cap-vs-revoker cross-check succeeded.
+  """
+  verifiedAt: Int!
+  capExp: Int
+  groupID: ID!
+}
+
 extend type Query {
   groups: [PeerGroup!]!
   group(id: ID!): PeerGroup
   groupMembers(groupID: ID!): [PeerGroupMember!]!
   circles(groupID: ID!): [PeerCircle!]!
+  hubs: [PeerHub!]!
+  hub(id: ID!): PeerHub
   syncPeers: [SyncPeer!]!
   syncStatus: SyncStatus!
+  ownDelegationTokens(grantor: ID, covers: DelegationTokenCovers): [DelegationToken!]!
+  ownRevokedDelegationTokens(grantor: ID): [RevokedDelegationToken!]!
 }
 
 extend type Mutation {
   createGroup(input: CreateGroupInput!): CreateGroupPayload!
-  addGroupMember(groupID: ID!, memberDID: String!, role: String!): PeerGroupMember!
+  addGroupMember(groupID: ID!, memberDID: DID!, role: String!): PeerGroupMember!
   createCircle(groupID: ID!, name: String!, description: String): PeerCircle!
-  addCircleMember(circleID: ID!, memberDID: String!, role: String!): PeerCircleMember!
+  addCircleMember(circleID: ID!, memberDID: DID!, role: String!): PeerCircleMember!
   createCatalog(name: String!, description: String, filterCriteria: String!): PeerCatalog!
-  inviteToGroup(groupID: ID!, joinRequest: String!): InviteToGroupPayload!
+  inviteToGroup(groupID: ID!, joinRequest: String!, grants: [String!], revocations: [String!]): InviteToGroupPayload!
   joinGroup(invitePayload: String!, joinRequestPayload: String!): JoinGroupPayload!
   prepareJoinRequest: PrepareJoinRequestPayload!
   completeJoin(invitePayload: String!): CompleteJoinPayload!
   leaveGroup(groupID: ID!): LeaveGroupPayload!
-  removeGroupMember(groupID: ID!, memberDID: String!): RemoveGroupMemberPayload!
+  removeGroupMember(groupID: ID!, memberDID: DID!): RemoveGroupMemberPayload!
   updateCatalog(input: UpdateCatalogInput!): PeerCatalog!
   updateGroup(input: UpdateGroupInput!): UpdateGroupPayload!
   updateCircle(input: UpdateCircleInput!): UpdateCirclePayload!
   deleteCatalog(catalogID: ID!): DeleteCatalogPayload!
   deleteCircle(circleID: ID!): DeleteCirclePayload!
-  removeCircleMember(circleID: ID!, memberDID: String!): RemoveCircleMemberPayload!
-  addSyncPeer(peerDID: String!, endpoint: String!, mode: String, priority: String, trustLevel: String): Boolean!
-  removeSyncPeer(peerDID: String!): RemoveSyncPeerPayload!
+  removeCircleMember(circleID: ID!, memberDID: DID!): RemoveCircleMemberPayload!
+  grantWriteCapability(to: DID!, res: String!, groupID: ID!, expiresIn: Int): String!
+  revokeCapability(jti: ID!): Boolean!
+  addSyncPeer(peerDID: DID!, endpoint: URL!, mode: String, priority: String, trustLevel: String): Boolean!
+  removeSyncPeer(peerDID: DID!): RemoveSyncPeerPayload!
+  createHub(input: CreateHubInput!): PeerHub!
+  updateHub(input: UpdateHubInput!): PeerHub!
+  deleteHub(id: ID!, force: Boolean): DeleteHubPayload!
+  bindHubToGroup(hubID: ID!, groupID: ID!): Boolean!
+  unbindHubFromGroup(hubID: ID!, groupID: ID!): Boolean!
+}
+
+extend type PeerGroup {
+  hubs: [PeerHub!]!
+}
+
+extend type PeerHub {
+  groups: [PeerGroup!]!
 }
 
 extend type Subscription {
@@ -183,5 +273,7 @@ extend type Subscription {
   circleMemberAdded(circleID: ID!): PeerCircleMember!
   circleMemberRemoved(circleID: ID!): PeerCircleMember!
   circleCatalogsChanged(circleID: ID!): PeerCircle!
+  ownDelegationTokenAdded: DelegationToken!
+  ownDelegationTokenRevoked: RevokedDelegationToken!
 }
-`;export function createP2PSchemaExtension(i){return{sdl:t,resolvers:{queryFields:{groups:async(e,t,i)=>await r(i).group.list(),group:async(e,t,i)=>await r(i).group.get(t.id),groupMembers:async(e,t,i)=>await r(i).group.listMembers(t.groupID),circles:async(e,t,i)=>await r(i).group.listCircles(t.groupID),syncPeers:async(e,t,i)=>await r(i).sync.listPeers(),syncStatus:(e,t,i)=>{let o=r(i).sync.getStatus();return{...o,lastSyncByPeer:JSON.stringify(o.lastSyncByPeer)}}},mutationFields:{createGroup:async(e,t,i)=>{let o=t.input;return{group:await r(i).group.create(o)}},addGroupMember:async(e,t,i)=>await r(i).group.addMember(t.groupID,t.memberDID,t.role),createCircle:async(e,t,i)=>await r(i).group.createCircle({groupID:t.groupID,name:t.name,description:t.description}),addCircleMember:async(e,t,i)=>await r(i).group.addCircleMember(t.circleID,t.memberDID,t.role),createCatalog:async(e,t,i)=>await r(i).group.createCatalog({name:t.name,description:t.description,filterCriteria:t.filterCriteria}),inviteToGroup:async(e,t,i)=>await r(i).group.invite(t.groupID,t.joinRequest),joinGroup:async(e,t,i)=>await r(i).group.join(t.invitePayload,t.joinRequestPayload),prepareJoinRequest:async(e,t,i)=>await r(i).join.prepareRequest(),completeJoin:async(e,t,i)=>await r(i).join.complete(t.invitePayload),leaveGroup:async(e,t,i)=>await r(i).group.leave(t.groupID),removeGroupMember:async(e,t,i)=>await r(i).group.removeMember(t.groupID,t.memberDID),updateCatalog:async(e,t,i)=>{let o=t.input;return await r(i).group.updateCatalog(o)},updateGroup:async(e,t,i)=>{let o=t.input;return{group:await r(i).group.update(o)}},updateCircle:async(e,t,i)=>{let o=t.input;return{circle:await r(i).group.updateCircle(o)}},deleteCatalog:async(e,t,i)=>await r(i).group.deleteCatalog(t.catalogID),deleteCircle:async(e,t,i)=>await r(i).group.deleteCircle(t.circleID),removeCircleMember:async(e,t,i)=>await r(i).group.removeCircleMember(t.circleID,t.memberDID),addSyncPeer:async(e,t,i)=>(await r(i).sync.addPeer({peerDID:t.peerDID,endpoint:t.endpoint,mode:t.mode??"on-demand",allowedUsers:{all:!0},priority:t.priority??"0",trustLevel:t.trustLevel??"trusted"}),!0),removeSyncPeer:async(e,t,i)=>(await r(i).sync.removePeer(t.peerDID),{success:!0})},subscriptionFields:{groupJoined:{resolve:e=>e,subscribe:()=>e(i,"groupJoined")},groupLeft:{resolve:e=>e,subscribe:()=>e(i,"groupLeft")},groupDataChanged:{resolve:e=>e,subscribe:(r,t)=>e(i,"groupDataChanged",e=>e.groupID===t.groupID)},groupMemberJoined:{resolve:e=>e,subscribe:(r,t)=>e(i,"groupMemberJoined",e=>e.groupID===t.groupID)},groupMemberLeft:{resolve:e=>e,subscribe:(r,t)=>e(i,"groupMemberLeft",e=>e.groupID===t.groupID)},circleCreated:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleCreated",e=>e.groupID===t.groupID)},circleDeleted:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleDeleted",e=>e.groupID===t.groupID)},circleDataChanged:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleDataChanged",e=>e.circleID===t.circleID)},circleMemberAdded:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleMemberAdded",e=>e.circleID===t.circleID)},circleMemberRemoved:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleMemberRemoved",e=>e.circleID===t.circleID)},circleCatalogsChanged:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleCatalogsChanged",e=>e.circleID===t.circleID)}}}}}
+`;export function createP2PSchemaExtension(i){return{sdl:o,resolvers:{queryFields:{groups:async(e,t,o)=>await r(o).group.list(),group:async(e,t,o)=>await r(o).group.get(t.id),groupMembers:async(e,t,o)=>await r(o).group.listMembers(t.groupID),circles:async(e,t,o)=>await r(o).group.listCircles(t.groupID),hubs:async(e,t,o)=>await r(o).hub.list(),hub:async(e,t,o)=>await r(o).hub.get(t.id),syncPeers:async(e,t,o)=>await r(o).sync.listPeers(),syncStatus:(e,t,o)=>{let i=r(o).sync.getStatus();return{...i,lastSyncByPeer:JSON.stringify(i.lastSyncByPeer)}},ownDelegationTokens:async(e,r,t)=>{let o=t.getViewer();if(null==o||null==t.p2p)return[];let i=r.grantor??null,a=r.covers??null;return await t.p2p.delegation.listOwnTokens({viewerDID:o,grantor:i,covers:a})},ownRevokedDelegationTokens:async(e,r,t)=>{let o=t.getViewer();if(null==o||null==t.p2p)return[];let i=r.grantor??null;return await t.p2p.delegation.listOwnRevokedTokens({viewerDID:o,grantor:i})}},mutationFields:{createGroup:async(e,t,o)=>{let i=t.input;return{group:await r(o).group.create(i)}},addGroupMember:async(e,t,o)=>await r(o).group.addMember(t.groupID,t.memberDID,t.role),createCircle:async(e,t,o)=>await r(o).group.createCircle({groupID:t.groupID,name:t.name,description:t.description}),addCircleMember:async(e,t,o)=>await r(o).group.addCircleMember(t.circleID,t.memberDID,t.role),createCatalog:async(e,t,o)=>await r(o).group.createCatalog({name:t.name,description:t.description,filterCriteria:t.filterCriteria}),inviteToGroup:async(e,t,o)=>await r(o).group.invite(t.groupID,t.joinRequest,t.grants,t.revocations),joinGroup:async(e,t,o)=>await r(o).group.join(t.invitePayload,t.joinRequestPayload),prepareJoinRequest:async(e,t,o)=>await r(o).join.prepareRequest(),completeJoin:async(e,t,o)=>await r(o).join.complete(t.invitePayload),leaveGroup:async(e,t,o)=>await r(o).group.leave(t.groupID),removeGroupMember:async(e,t,o)=>await r(o).group.removeMember(t.groupID,t.memberDID),updateCatalog:async(e,t,o)=>{let i=t.input;return await r(o).group.updateCatalog(i)},updateGroup:async(e,t,o)=>{let i=t.input;return{group:await r(o).group.update(i)}},updateCircle:async(e,t,o)=>{let i=t.input;return{circle:await r(o).group.updateCircle(i)}},deleteCatalog:async(e,t,o)=>await r(o).group.deleteCatalog(t.catalogID),deleteCircle:async(e,t,o)=>await r(o).group.deleteCircle(t.circleID),removeCircleMember:async(e,t,o)=>await r(o).group.removeCircleMember(t.circleID,t.memberDID),grantWriteCapability:async(e,t,o)=>await r(o).group.grantWriteCapability({to:t.to,res:t.res,groupID:t.groupID,expiresIn:t.expiresIn}),revokeCapability:async(e,t,o)=>await r(o).group.revokeCapability({jti:t.jti}),addSyncPeer:async(e,t,o)=>(await r(o).sync.addPeer({peerDID:t.peerDID,endpoint:t.endpoint,mode:t.mode??"on-demand",allowedUsers:{all:!0},priority:t.priority??"0",trustLevel:t.trustLevel??"trusted"}),!0),removeSyncPeer:async(e,t,o)=>(await r(o).sync.removePeer(t.peerDID),{success:!0}),createHub:async(e,t,o)=>{let i=t.input;return await r(o).hub.create(i)},updateHub:async(e,t,o)=>{let i=t.input;return await r(o).hub.update(i)},deleteHub:async(e,t,o)=>await r(o).hub.delete(t.id,t.force??!1),bindHubToGroup:async(e,t,o)=>await r(o).hub.bind({hubID:t.hubID,groupID:t.groupID}),unbindHubFromGroup:async(e,t,o)=>await r(o).hub.unbind({hubID:t.hubID,groupID:t.groupID})},typeFields:{PeerGroup:{hubs:async(e,t,o)=>await r(o).hub.listByGroup(e.id)},PeerHub:{groups:async(e,t,o)=>await r(o).hub.listGroups(e.id)}},subscriptionFields:{groupJoined:{resolve:e=>e,subscribe:()=>e(i,"groupJoined")},groupLeft:{resolve:e=>e,subscribe:()=>e(i,"groupLeft")},groupDataChanged:{resolve:e=>e,subscribe:(r,t)=>e(i,"groupDataChanged",e=>e.groupID===t.groupID)},groupMemberJoined:{resolve:e=>e,subscribe:(r,t)=>e(i,"groupMemberJoined",e=>e.groupID===t.groupID)},groupMemberLeft:{resolve:e=>e,subscribe:(r,t)=>e(i,"groupMemberLeft",e=>e.groupID===t.groupID)},circleCreated:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleCreated",e=>e.groupID===t.groupID)},circleDeleted:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleDeleted",e=>e.groupID===t.groupID)},circleDataChanged:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleDataChanged",e=>e.circleID===t.circleID)},circleMemberAdded:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleMemberAdded",e=>e.circleID===t.circleID)},circleMemberRemoved:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleMemberRemoved",e=>e.circleID===t.circleID)},circleCatalogsChanged:{resolve:e=>e,subscribe:(r,t)=>e(i,"circleCatalogsChanged",e=>e.circleID===t.circleID)},ownDelegationTokenAdded:{resolve:e=>e,subscribe:(r,o,a)=>{let n=a.getViewer();return null==n?t():e(i,"delegationTokenAdded",e=>e.audience===n)}},ownDelegationTokenRevoked:{resolve:e=>e,subscribe:(r,o,a)=>{let n=a.getViewer();return null==n?t():e(i,"delegationTokenRevoked",e=>e.audience===n)}}}}}}