@kubun/plugin-p2p 0.9.0 → 0.10.0

package/lib/sync/handlers.d.ts

@@ -1,3 +1,4 @@
+import { type VerifyTokenHook } from '@enkaku/capability';
 import type { KubunDB } from '@kubun/db';
 import type { DefaultAccessLevel, GraphInternals } from '@kubun/engine';
 import type { Logger } from '@kubun/logger';
@@ -10,9 +11,12 @@ import type { PeerRegistry } from './peer-registry.js';
  * @param viewerDID - The DID of the requesting viewer
  * @param ownerDID - The DID of the document owner
  * @param delegationTokens - Array of delegation JWT tokens
+ * @param revocationChecker - Optional per-leaf-capability verification hook.
+ *   When set, capabilities whose `jti` has been revoked cause the check to
+ *   fail closed.
  * @returns true if any token grants read access
  */
-export declare function checkSyncDelegation(viewerDID: string, ownerDID: string, delegationTokens: Array<string>): Promise<boolean>;
+export declare function checkSyncDelegation(viewerDID: string, ownerDID: string, delegationTokens: Array<string>, revocationChecker?: VerifyTokenHook): Promise<boolean>;
 export type CreateSyncHandlersParams = {
     db: KubunDB;
     graph: GraphInternals;

package/lib/sync/handlers.js

@@ -1 +1 @@
-import{checkCapability as e}from"@enkaku/capability";import{getGraphStore as t}from"@kubun/store-graph";import{resolveCatalogSyncScopes as n}from"./catalog-scope.js";import{createMerkleSyncChannelHandler as r}from"./merkle-channel.js";export async function checkSyncDelegation(t,n,r){if(!r||0===r.length)return!1;let o=["*","urn:kubun:user:*",`urn:kubun:user:${n}`],l="document/read";for(let s of o)try{return await e({act:l,res:s},{iss:t,sub:n,cap:r}),!0}catch{}for(let s of r)for(let r of o)try{return await e({act:l,res:r},{iss:t,sub:n,cap:s}),!0}catch{}return!1}export function negotiateDirection(e,t){return"both"===t?e:"both"===e?t:e===t?e:t}export function createSyncHandlers(e){let{db:o,graph:l,logger:s,peerRegistry:a}=e,c=e.storeUnreadable??"persist";return{"sync/negotiate":async e=>{let r,{scopes:l,delegationTokens:c,catalogIDs:i,knownModelIDs:u,direction:f}=e.param,d=e.message.payload,g=d.sub||d.iss;s.debug("sync/negotiate requested",{scopes:l,catalogIDs:i,viewerDID:g});let D=[],p=await t(o);if(null!=i&&i.length>0){let e=await n(o,i,u);if(e.modelIDs.length>0)if(null!=e.owners)for(let t of e.modelIDs)for(let n of e.owners){let e=g===n,r=!e&&await checkSyncDelegation(g,n,c);(e||r)&&D.push({modelID:t,ownerDID:n})}else for(let t of e.modelIDs)for(let e of(await p.getDistinctOwnersForModel(t))){let n=g===e,r=!n&&await checkSyncDelegation(g,e,c);(n||r)&&D.push({modelID:t,ownerDID:e})}e.missingClusterIDs.length>0&&(r=await p.getClusters(e.missingClusterIDs))}if(null!=l)for(let e of l){let t=g===e.ownerDID,n=!t&&await checkSyncDelegation(g,e.ownerDID,c);t||n?D.push(e):s.debug("sync/negotiate: scope rejected",{scope:e,viewerDID:g})}let h=new Set,m=D.filter(e=>{let t=`${e.modelID}:${e.ownerDID}`;return!h.has(t)&&(h.add(t),!0)});s.info("sync/negotiate completed",{requested:(l?.length??0)+(i?.length??0),accepted:m.length,missingClusters:null!=r?Object.keys(r).length:0});let w=f??"pull",y=await a.getPeer({peerDID:g,stores:o}),b=y?.allowedDirection??"both",I=negotiateDirection(w,b);return I!==w&&s.info("sync/negotiate: direction downgraded",{requested:w,allowed:b,agreed:I}),{direction:I,acceptedScopes:m,excludedDocumentIDs:[],...null!=r&&{missingClusters:r}}},"sync/merkle-sync":r({db:o,graph:l,logger:s,selfDID:e.selfDID,storeUnreadable:c,defaultAccessLevel:e.defaultAccessLevel})}}
+import{checkCapability as e,createRevocationChecker as t}from"@enkaku/capability";import{getGraphStore as n}from"@kubun/store-graph";import{createP2PRevocationBackend as r,getP2PStore as o}from"@kubun/store-p2p";import{resolveCatalogSyncScopes as l}from"./catalog-scope.js";import{createMerkleSyncChannelHandler as a}from"./merkle-channel.js";export async function checkSyncDelegation(t,n,r,o){if(!r||0===r.length)return!1;let l=["*","urn:kubun:user:*",`urn:kubun:user:${n}`],a="document/read";for(let s of l)try{return await e({act:a,res:s},{iss:t,sub:n,cap:r},{verifyToken:o}),!0}catch{}for(let s of r)for(let r of l)try{return await e({act:a,res:r},{iss:t,sub:n,cap:s},{verifyToken:o}),!0}catch{}return!1}export function negotiateDirection(e,t){return"both"===t?e:"both"===e?t:e===t?e:t}export function createSyncHandlers(e){let{db:s,graph:i,logger:c,peerRegistry:u}=e,f=e.storeUnreadable??"persist",d=null;async function g(){return null==d&&(d=t(r(await o(s)))),d}return{"sync/negotiate":async e=>{let t,{scopes:r,delegationTokens:o,catalogIDs:a,knownModelIDs:i,direction:f}=e.param,d=e.message.payload,p=d.sub||d.iss;c.debug("sync/negotiate requested",{scopes:r,catalogIDs:a,viewerDID:p});let D=[],m=await n(s);if(null!=a&&a.length>0){let e=await l(s,a,i);if(e.modelIDs.length>0)if(null!=e.owners)for(let t of e.modelIDs)for(let n of e.owners){let e=p===n,r=!e&&await checkSyncDelegation(p,n,o,await g());(e||r)&&D.push({modelID:t,ownerDID:n})}else for(let t of e.modelIDs)for(let e of(await m.getDistinctOwnersForModel(t))){let n=p===e,r=!n&&await checkSyncDelegation(p,e,o,await g());(n||r)&&D.push({modelID:t,ownerDID:e})}e.missingClusterIDs.length>0&&(t=await m.getClusters(e.missingClusterIDs))}if(null!=r)for(let e of r){let t=p===e.ownerDID,n=!t&&await checkSyncDelegation(p,e.ownerDID,o,await g());t||n?D.push(e):c.debug("sync/negotiate: scope rejected",{scope:e,viewerDID:p})}let w=new Set,h=D.filter(e=>{let t=`${e.modelID}:${e.ownerDID}`;return!w.has(t)&&(w.add(t),!0)});c.info("sync/negotiate completed",{requested:(r?.length??0)+(a?.length??0),accepted:h.length,missingClusters:null!=t?Object.keys(t).length:0});let y=f??"pull",b=await u.getPeer({peerDID:p,stores:s}),k=b?.allowedDirection??"both",I=negotiateDirection(y,k);return I!==y&&c.info("sync/negotiate: direction downgraded",{requested:y,allowed:k,agreed:I}),{direction:I,acceptedScopes:h,excludedDocumentIDs:[],...null!=t&&{missingClusters:t}}},"sync/merkle-sync":a({db:s,graph:i,logger:c,selfDID:e.selfDID,storeUnreadable:f,defaultAccessLevel:e.defaultAccessLevel})}}

package/lib/sync/merkle-apply.js

@@ -1 +1 @@
-import{asType as t,createValidator as e}from"@enkaku/schema";import{verifyToken as a}from"@enkaku/token";import{computeMutationHash as i}from"@kubun/engine";import{DocumentID as o}from"@kubun/id";import{documentMutation as n}from"@kubun/protocol";import{getGraphStore as r}from"@kubun/store-graph";import{getP2PStore as u}from"@kubun/store-p2p";import{createReceiveAccessGate as s}from"./receive-access-gate.js";let l=e(n);export async function applySyncMutations(e){let n,{db:c,graph:p,mutationJWTs:d}=e,m=await r(c);if("drop"===(e.storeUnreadable??"persist")){if(null==e.selfDID)throw Error("applySyncMutations: 'storeUnreadable: drop' requires selfDID");let t=await u(c);n=s({selfDID:e.selfDID,db:{getUserModelAccessDefault:(t,e,a)=>m.getUserModelAccessDefault(t,e,a),isMemberOfAnyCircle:(e,a)=>t.isMemberOfAnyCircle(e,a),isMemberOfAnyGroup:(e,a)=>t.isMemberOfAnyGroup(e,a)},defaultAccessLevel:e.defaultAccessLevel??{read:"only_owner",write:"only_owner"}})}let f=0,h=0,y=0,w=0,g=0;for(let e of d){let r,u=i(e);if(await m.hasMutationHash(u)){w++;continue}try{let i=await a(e);r=t(l,i.payload)}catch{h++;continue}let s=r.sub,c=o.fromString(s).model.toString(),d=o.fromString(s);if(null==await m.getDocument(d)&&"change"===r.typ){await m.insertMutationLogEntry({mutation_hash:u,model_id:c,document_id:s,author_did:r.iss,hlc:r.hlc,mutation_jwt:e,status:"pending"}),y++;continue}try{if((await p.applyVerifiedMutation({token:e,origin:"peer",...null!=n?{accessGate:n}:{}})).dropped){g++;continue}if(f++,"set"===r.typ)for(let t of(await m.getPendingMutations(s)))try{if((await p.applyVerifiedMutation({token:t.mutation_jwt,origin:"peer",...null!=n?{accessGate:n}:{}})).dropped){await m.updateMutationStatus(t.mutation_hash,"rejected"),g++;continue}await m.updateMutationStatus(t.mutation_hash,"applied"),f++}catch{await m.updateMutationStatus(t.mutation_hash,"rejected"),h++}}catch{await m.insertMutationLogEntry({mutation_hash:u,model_id:c,document_id:s,author_did:r.iss,hlc:r.hlc,mutation_jwt:e,status:"rejected"}),h++}}return{applied:f,rejected:h,pending:y,skipped:w,dropped:g}}
+import{asType as t,createValidator as e}from"@enkaku/schema";import{verifyToken as a}from"@enkaku/token";import{computeMutationHash as i}from"@kubun/engine";import{DocumentID as o}from"@kubun/id";import{documentMutation as n}from"@kubun/protocol";import{getGraphStore as r}from"@kubun/store-graph";import{getP2PStore as u}from"@kubun/store-p2p";import{createReceiveAccessGate as s}from"./receive-access-gate.js";let l=e(n);export async function applySyncMutations(e){let n,{db:c,graph:d,mutationJWTs:p}=e,f=await r(c);if("drop"===(e.storeUnreadable??"persist")){if(null==e.selfDID)throw Error("applySyncMutations: 'storeUnreadable: drop' requires selfDID");let t=await u(c);n=s({selfDID:e.selfDID,db:{getUserModelAccessDefault:(t,e,a)=>f.getUserModelAccessDefault(t,e,a),isMemberOfAnyCircle:(e,a)=>t.isMemberOfAnyCircle(e,a),isMemberOfAnyGroup:(e,a)=>t.isMemberOfAnyGroup(e,a),getModelInterfaces:t=>f.getModelInterfaces(t)},defaultAccessLevel:e.defaultAccessLevel??{read:"only_owner",write:"only_owner"}})}let m=0,h=0,y=0,w=0,g=0;for(let e of p){let r,u=i(e);if(await f.hasMutationHash(u)){w++;continue}try{let i=await a(e);r=t(l,i.payload)}catch{h++;continue}let s=r.sub,c=o.fromString(s).model.toString(),p=o.fromString(s);if(null==await f.getDocument(p)&&"change"===r.typ){await f.insertMutationLogEntry({mutation_hash:u,model_id:c,document_id:s,author_did:r.iss,hlc:r.hlc,mutation_jwt:e,status:"pending"}),y++;continue}try{if((await d.applyVerifiedMutation({token:e,origin:"peer",...null!=n?{accessGate:n}:{}})).dropped){g++;continue}if(m++,"set"===r.typ)for(let t of(await f.getPendingMutations(s)))try{if((await d.applyVerifiedMutation({token:t.mutation_jwt,origin:"peer",...null!=n?{accessGate:n}:{}})).dropped){await f.updateMutationStatus(t.mutation_hash,"rejected"),g++;continue}await f.updateMutationStatus(t.mutation_hash,"applied"),m++}catch{await f.updateMutationStatus(t.mutation_hash,"rejected"),h++}}catch{await f.insertMutationLogEntry({mutation_hash:u,model_id:c,document_id:s,author_did:r.iss,hlc:r.hlc,mutation_jwt:e,status:"rejected"}),h++}}return{applied:m,rejected:h,pending:y,skipped:w,dropped:g}}

package/lib/types.d.ts

@@ -115,7 +115,15 @@ export type GroupRequestContext = {
         filterCriteria: string;
     }) => Promise<CatalogData>;
     listCatalogs: (ownerDID?: string) => Promise<Array<CatalogData>>;
-    invite: (groupID: string, joinRequest: string) => Promise<InviteToGroupData>;
+    /**
+     * Build an invite payload for a join request.
+     *
+     * `grants` are stringified write-capability JWTs the caller wants the joiner
+     * to hold immediately on join. `revocations` are signed revocation JWTs the
+     * caller wants the joiner to apply immediately — only verified ones travel;
+     * pending revocations (cap not yet known by the inviter) do not.
+     */
+    invite: (groupID: string, joinRequest: string, grants?: Array<string>, revocations?: Array<string>) => Promise<InviteToGroupData>;
     join: (invitePayload: string, joinRequestPayload: string) => Promise<JoinGroupData>;
     leave: (groupID: string) => Promise<LeaveGroupData>;
     removeMember: (groupID: string, memberDID: string) => Promise<RemoveGroupMemberData>;
@@ -129,6 +137,53 @@ export type GroupRequestContext = {
     deleteCatalog: (catalogID: string) => Promise<DeleteCatalogData>;
     deleteCircle: (circleID: string) => Promise<DeleteCircleData>;
     removeCircleMember: (circleID: string, memberDID: string) => Promise<RemoveCircleMemberData>;
+    /**
+     * Mint a `document/write` capability granting `to` write access on resources
+     * matching `res`. Token is stored grantor-side, broadcast to the group, and
+     * returned for direct delivery.
+     *
+     * `res` is a URN. Most-specific wins; broader URNs grant strictly more:
+     *   - `urn:kubun:document:<docID>` — single doc
+     *   - `urn:kubun:model:<modelID>` — every doc of that model owned by the grantor
+     *   - `urn:kubun:model:<interfaceID>` — every doc of every model implementing
+     *     the interface (footgun: a grant on a widely-implemented interface like
+     *     `Owned` or `Timestamped` becomes a near-wildcard)
+     *   - `urn:kubun:user:<DID>` — every doc owned by that DID (the grantor)
+     *   - `*` — every doc the grantor owns, present and future
+     *
+     * Prefer the narrowest URN that satisfies the use case. Broad grants combine
+     * with the long default `exp` (30 days) to expand the blast radius of a
+     * leaked or misdirected token.
+     */
+    grantWriteCapability: (params: {
+        to: string;
+        res: string;
+        groupID: string;
+        expiresIn?: number;
+    }) => Promise<string>;
+    /**
+     * Revoke a previously-granted `document/write` capability by its `jti`.
+     *
+     * Revocation is binary: once a peer learns of the revocation, every
+     * mutation that authenticates via this `jti` is denied. The check is
+     * reactive, not retroactive — mutations already applied locally stay
+     * applied; only future writes carrying the revoked `jti` are gated.
+     *
+     * Only the original capability issuer may revoke it. The resolver looks up
+     * the capability locally and rejects:
+     *   - `REVOCATION_CAP_UNKNOWN` when no row matches the `jti` on this peer
+     *     (multi-device-grantor case, where the issuing device is not the one
+     *     calling `revokeCapability`, is not yet supported).
+     *   - `REVOCATION_UNAUTHORIZED` when the viewer is not the capability's
+     *     issuer.
+     *
+     * Returns the boolean reported by the store: `true` when the revocation
+     * row was newly written (or materially changed), `false` on an idempotent
+     * no-op (already revoked at an equal or newer HLC).
+     */
+    revokeCapability: (params: {
+        jti: string;
+    }) => Promise<boolean>;
 };
 export type SyncRequestContext = {
     addPeer: (config: PeerConfig) => Promise<void>;
@@ -176,11 +231,47 @@ export type HubRequestContext = {
     listByGroup: (groupID: string) => Promise<Array<HubData>>;
     listGroups: (hubID: string) => Promise<Array<GroupData>>;
 };
+export type DelegationData = {
+    jwt: string;
+    jti: string;
+    grantor: string;
+    audience: string;
+    resource: string;
+    exp: number;
+};
+export type DelegationTokenCovers = {
+    modelID?: string | null;
+    docID?: string | null;
+};
+export type ListOwnDelegationTokensParams = {
+    viewerDID: string;
+    grantor?: string | null;
+    covers?: DelegationTokenCovers | null;
+};
+export type RevokedDelegationData = {
+    jti: string;
+    grantor: string;
+    audience: string;
+    revokerDID: string;
+    revokedAt: number;
+    verifiedAt: number;
+    capExp: number | null;
+    groupID: string;
+};
+export type ListOwnRevokedTokensParams = {
+    viewerDID: string;
+    grantor?: string | null;
+};
+export type DelegationRequestContext = {
+    listOwnTokens: (params: ListOwnDelegationTokensParams) => Promise<Array<DelegationData>>;
+    listOwnRevokedTokens: (params: ListOwnRevokedTokensParams) => Promise<Array<RevokedDelegationData>>;
+};
 export type P2PContext = {
     group: GroupRequestContext;
     sync: SyncRequestContext;
     join: P2PJoinRequestContext;
     hub: HubRequestContext;
+    delegation: DelegationRequestContext;
 };
 declare module '@kubun/graphql' {
     interface PluginContextMap {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/plugin-p2p",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "license": "see LICENSE.md",
   "type": "module",
   "main": "lib/index.js",
@@ -14,50 +14,50 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@enkaku/async": "^0.15.0",
-    "@enkaku/capability": "^0.15.0",
-    "@enkaku/client": "^0.15.1",
-    "@enkaku/codec": "^0.15.0",
-    "@enkaku/event": "^0.15.0",
-    "@enkaku/generator": "^0.15.0",
-    "@enkaku/group": "^0.15.0",
-    "@enkaku/http-client-transport": "^0.15.0",
-    "@enkaku/http-server-transport": "^0.15.0",
-    "@enkaku/hub-protocol": "^0.15.0",
-    "@enkaku/hub-tunnel": "^0.15.0",
-    "@enkaku/protocol": "^0.15.0",
-    "@enkaku/runtime": "^0.15.0",
-    "@enkaku/schema": "^0.15.0",
-    "@enkaku/server": "^0.15.0",
-    "@enkaku/stream": "^0.15.0",
-    "@enkaku/token": "^0.15.0",
-    "@enkaku/transport": "^0.15.0",
+    "@enkaku/async": "^0.16.0",
+    "@enkaku/capability": "^0.16.0",
+    "@enkaku/client": "^0.16.0",
+    "@enkaku/codec": "^0.16.0",
+    "@enkaku/event": "^0.16.0",
+    "@enkaku/generator": "^0.16.0",
+    "@enkaku/group": "^0.16.1",
+    "@enkaku/http-client-transport": "^0.16.0",
+    "@enkaku/http-server-transport": "^0.16.0",
+    "@enkaku/hub-protocol": "^0.16.0",
+    "@enkaku/hub-tunnel": "^0.16.0",
+    "@enkaku/protocol": "^0.16.0",
+    "@enkaku/runtime": "^0.16.0",
+    "@enkaku/schema": "^0.16.0",
+    "@enkaku/server": "^0.16.0",
+    "@enkaku/stream": "^0.16.0",
+    "@enkaku/token": "^0.16.0",
+    "@enkaku/transport": "^0.16.0",
     "@noble/hashes": "^2.2.0",
     "graphql": "^16.13.2",
-    "kysely": "^0.28.17",
-    "@kubun/client": "^0.9.0",
-    "@kubun/db": "^0.9.0",
-    "@kubun/db-adapter": "^0.9.0",
-    "@kubun/engine": "^0.9.0",
-    "@kubun/store-p2p": "^0.9.0",
-    "@kubun/store-graph": "^0.9.0",
-    "@kubun/graphql": "^0.9.0",
-    "@kubun/hlc": "^0.9.0",
-    "@kubun/id": "^0.9.0",
-    "@kubun/logger": "^0.9.0",
-    "@kubun/mutation": "^0.9.0",
-    "@kubun/protocol": "^0.9.0"
+    "kysely": "^0.29.2",
+    "@kubun/client": "^0.10.0",
+    "@kubun/db": "^0.10.0",
+    "@kubun/store-graph": "^0.10.0",
+    "@kubun/graphql": "^0.10.0",
+    "@kubun/db-adapter": "^0.10.0",
+    "@kubun/hlc": "^0.10.0",
+    "@kubun/id": "^0.10.0",
+    "@kubun/engine": "^0.10.0",
+    "@kubun/store-p2p": "^0.10.0",
+    "@kubun/mutation": "^0.10.0",
+    "@kubun/logger": "^0.10.0",
+    "@kubun/protocol": "^0.10.0"
   },
   "devDependencies": {
-    "@enkaku/hub-server": "^0.15.0",
+    "@enkaku/hub-server": "^0.16.0",
     "get-port": "^7.2.0",
-    "@kubun/db-node-sqlite": "^0.9.0",
-    "@kubun/db-better-sqlite": "^0.9.0",
-    "@kubun/hub": "^0.9.0",
-    "@kubun/plugin-connector": "^0.9.0",
-    "@kubun/plugin-http": "^0.9.0",
-    "@kubun/plugin-rpc": "^0.9.0",
-    "@kubun/test-utils": "^0.9.0"
+    "@kubun/db-better-sqlite": "^0.10.0",
+    "@kubun/plugin-connector": "^0.10.0",
+    "@kubun/hub": "^0.10.0",
+    "@kubun/db-node-sqlite": "^0.10.0",
+    "@kubun/plugin-http": "^0.10.0",
+    "@kubun/plugin-rpc": "^0.10.0",
+    "@kubun/test-utils": "^0.10.0"
   },
   "scripts": {
     "build:clean": "del lib",

package/lib/sync/catalog-match.d.ts

@@ -1,13 +0,0 @@
-import type { CatalogFilterCriteria, DocumentNode } from '@kubun/protocol';
-import type { P2PStoreAPI } from '@kubun/store-p2p';
-/**
- * Determine whether a document matches a catalog's filter criteria.
- *
- * Mirrors the semantics of {@link resolveCatalogSyncScopes} (which collects
- * broadly-applicable models + owner filters for sync): each catalog field is
- * AND'd, values within a field are OR'd, and the `circles` field expands to a
- * union of circle members and merges with the explicit `owners` filter.
- *
- * Returns `true` iff the document would be included by this catalog.
- */
-export declare function catalogMatchesDoc(criteria: CatalogFilterCriteria, doc: Pick<DocumentNode, 'model' | 'owner'>, p2pStore: P2PStoreAPI): Promise<boolean>;

package/lib/sync/catalog-match.js

@@ -1 +0,0 @@
-export async function catalogMatchesDoc(e,l,n){if(null!=e.models&&e.models.length>0&&!e.models.includes(l.model))return!1;let c=null!=e.owners&&e.owners.length>0,r=null!=e.circles&&e.circles.length>0;return!!(!c&&!r||c&&e.owners?.includes(l.owner)||r&&null!=e.circles&&await n.isMemberOfAnyCircle(l.owner,e.circles))}