@kubun/server 0.5.0 → 0.6.0

package/lib/data/graphql.d.ts

@@ -1,5 +1,6 @@
 import type { KubunDB } from '@kubun/db';
 import { type Context } from '@kubun/graphql';
+import { type MutationOperations } from '@kubun/mutation';
 import type { DocumentNode } from '@kubun/protocol';
 import { type ExecutionArgs, type GraphQLSchema, type OperationTypeNode } from 'graphql';
 import type { AccessChecker } from './access-control.js';
@@ -7,6 +8,7 @@ export type ExecutionContext = {
     db: KubunDB;
     viewerDID: string;
     mutatedDocuments?: Record<string, DocumentNode>;
+    mutationOperations?: MutationOperations<DocumentNode>;
     accessChecker?: AccessChecker;
 };
 export declare function createContext(ctx: ExecutionContext): Context;

package/lib/data/graphql.js

@@ -1 +1 @@
-import{createReadContext as e}from"@kubun/graphql";import{Kind as t,parse as n}from"graphql";import{removeDocumentAccessOverride as c,removeModelAccessDefaults as o,setDocumentAccessOverride as a,setModelAccessDefaults as r}from"./mutations.js";export function createContext(t){function n(e){return t.mutatedDocuments?.[e.path.key]}return{...e({db:t.db,viewerDID:t.viewerDID,accessChecker:t.accessChecker}),executeCreateMutation:async(e,t,c)=>n(c),executeSetMutation:async(e,t,c,o)=>n(o),executeUpdateMutation:async(e,t)=>n(t),async executeRemoveMutation(e,t){},executeSetModelAccessDefaults:async(e,n,c,o)=>await r({ownerDID:t.viewerDID,modelID:e,permissionType:n,accessLevel:c,allowedDIDs:o},t.db),async executeRemoveModelAccessDefaults(e,n){await o({ownerDID:t.viewerDID,modelID:e,permissionTypes:n},t.db)},executeSetDocumentAccessOverride:async(e,n,c,o)=>await a({documentID:e,permissionType:n,accessLevel:c,allowedDIDs:o},t.db),async executeRemoveDocumentAccessOverride(e,n){await c({documentID:e,permissionTypes:n},t.db)}}}export function getExecutionArgs(e){let c=n(e.text),o=c.definitions[0];if(null==o)throw Error("Missing GraphQL document definition");if(o.kind!==t.OPERATION_DEFINITION||o.operation!==e.type)throw Error(`Invalid GraphQL document definition: expected ${e.type} operation`);return{document:c,schema:e.schema,variableValues:e.variables,contextValue:createContext(e.context)}}
+import{createReadContext as e}from"@kubun/graphql";import{convertPatchInput as t}from"@kubun/mutation";import{Kind as a,parse as n}from"graphql";import{removeDocumentAccessOverride as o,removeModelAccessDefaults as c,setDocumentAccessOverride as i,setModelAccessDefaults as r}from"./mutations.js";export function createContext(a){let n=e({db:a.db,viewerDID:a.viewerDID,accessChecker:a.accessChecker}),u={executeSetModelAccessDefaults:async(e,t,n,o)=>await r({ownerDID:a.viewerDID,modelID:e,permissionType:t,accessLevel:n,allowedDIDs:o},a.db),async executeRemoveModelAccessDefaults(e,t){await c({ownerDID:a.viewerDID,modelID:e,permissionTypes:t},a.db)},executeSetDocumentAccessOverride:async(e,t,n,o)=>await i({documentID:e,permissionType:t,accessLevel:n,allowedDIDs:o},a.db),async executeRemoveDocumentAccessOverride(e,t){await o({documentID:e,permissionTypes:t},a.db)}};if(null!=a.mutationOperations){let e=a.mutationOperations;return{...n,executeCreateMutation:async(t,a)=>await e.createDocument(t,a),executeSetMutation:async(t,a,n)=>await e.setDocument(t,a,n),executeUpdateMutation:async a=>await e.updateDocument(a.id,t(a.patch)),async executeRemoveMutation(t){await e.removeDocument(t)},...u}}function s(e){return a.mutatedDocuments?.[e.path.key]}return{...n,executeCreateMutation:async(e,t,a)=>s(a),executeSetMutation:async(e,t,a,n)=>s(n),executeUpdateMutation:async(e,t)=>s(t),async executeRemoveMutation(e,t){},...u}}export function getExecutionArgs(e){let t=n(e.text),o=t.definitions[0];if(null==o)throw Error("Missing GraphQL document definition");if(o.kind!==a.OPERATION_DEFINITION||o.operation!==e.type)throw Error(`Invalid GraphQL document definition: expected ${e.type} operation`);return{document:t,schema:e.schema,variableValues:e.variables,contextValue:createContext(e.context)}}

package/lib/data/mutation-capture.d.ts

@@ -1,7 +1,9 @@
 import type { KubunDB } from '@kubun/db';
+export declare function computeMutationHash(jwt: string): string;
 export declare function captureMutation(params: {
     db: KubunDB;
     documentID: string;
     mutationPayload: string;
     authorDID: string;
-}): Promise<void>;
+    hlc: string;
+}): Promise<string>;

package/lib/data/mutation-capture.js

@@ -1 +1 @@
-import{sql as e}from"kysely";import{storeMutationLog as t}from"./mutation-log.js";export async function captureMutation(u){let{db:n,documentID:r,mutationPayload:m,authorDID:o}=u,i=await n.getDB(),a=await i.selectFrom("kubun_document_mutation_log").select("sequence_number").where("document_id","=",r).orderBy(e`CAST(sequence_number AS INTEGER)`,"desc").limit(1).executeTakeFirst(),c=a?String(Number(a.sequence_number)+1):"1";await t(n,{documentID:r,sequenceNumber:c,mutationJWT:m,authorDID:o})}
+import{DocumentID as t}from"@kubun/id";import{blake3 as o}from"@noble/hashes/blake3.js";let n=new TextEncoder;export function computeMutationHash(t){return Array.from(o(n.encode(t))).map(t=>t.toString(16).padStart(2,"0")).join("")}export async function captureMutation(o){let{db:n,documentID:r,mutationPayload:a,authorDID:e,hlc:i}=o,u=computeMutationHash(a),m=t.fromString(r).model.toString();return await n.insertMutationLogEntry({mutation_hash:u,model_id:m,document_id:r,author_did:e,hlc:i,mutation_jwt:a,status:"applied"}),u}

package/lib/data/mutations.js

@@ -1 +1 @@
-import{asType as e,createValidator as t}from"@enkaku/schema";import{verifyToken as o}from"@enkaku/token";import{DocumentID as a}from"@kubun/id";import{applyMutation as s}from"@kubun/mutation";import{documentMutation as r}from"@kubun/protocol";import{validateDIDs as l}from"./access-control.js";import{captureMutation as n}from"./mutation-capture.js";let i=t(r);export async function applyMutation(t,a){let r=e(i,(await o(a)).payload),l=await s(t,r);return await n({db:t.db,documentID:l.id,mutationPayload:a,authorDID:r.iss}),l}export async function setModelAccessDefaults(e,t){let{ownerDID:o,modelID:a,permissionType:s,accessLevel:r,allowedDIDs:n}=e;if(n&&n.length>0&&l(n),!({read:["only_owner","anyone","allowed_dids"],write:["only_owner","allowed_dids"]})[s].includes(r))throw Error(`Invalid access level "${r}" for permission type "${s}"`);await t.setUserModelAccessDefault({ownerDID:o,modelID:a,permissionType:s,accessLevel:r,allowedDIDs:n});let i=await t.getUserModelAccessDefault(o,a,"read"),c=await t.getUserModelAccessDefault(o,a,"write"),d={};return i&&(d.read={level:i.level,allowedDIDs:i.allowedDIDs??[]}),c&&(d.write={level:c.level,allowedDIDs:c.allowedDIDs??[]}),{ownerDID:o,modelId:a,permissions:d}}export async function removeModelAccessDefaults(e,t){let{ownerDID:o,modelID:a,permissionTypes:s}=e;await t.removeUserModelAccessDefaults(o,a,s)}export async function setDocumentAccessOverride(e,t){let{documentID:o,permissionType:s,accessLevel:r,allowedDIDs:n}=e;n&&n.length>0&&l(n);let i=a.fromString(o),c=await t.getDocument(i);if(!c)throw Error(`Document not found: ${o}`);let d={...c.data?.accessPermissions||{},[s]:{level:r,allowedDIDs:n}};return await t.saveDocument({id:i,data:{...c.data,accessPermissions:d},state:null,existing:c})}export async function removeDocumentAccessOverride(e,t){let{documentID:o,permissionTypes:s}=e,r=a.fromString(o),l=await t.getDocument(r);if(!l)return;let n={...l.data?.accessPermissions||{}};for(let e of s)delete n[e];await t.saveDocument({id:r,data:{...l.data,accessPermissions:Object.keys(n).length>0?n:void 0},state:null,existing:l})}
+import{asType as e,createValidator as t}from"@enkaku/schema";import{verifyToken as o}from"@enkaku/token";import{DocumentID as a}from"@kubun/id";import{applyMutation as s,HLC as r}from"@kubun/mutation";import{documentMutation as l}from"@kubun/protocol";import{validateDIDs as n}from"./access-control.js";import{captureMutation as i}from"./mutation-capture.js";let c=t(l),d=new r({nodeID:"server"});export async function applyMutation(t,a){null==t.hlc&&(t.hlc=d),null==t.maxDriftMS&&(t.maxDriftMS=6e4);let r=e(c,(await o(a)).payload),l=await s(t,r);return await i({db:t.db,documentID:l.id,mutationPayload:a,authorDID:r.iss,hlc:r.hlc}),l}export async function setModelAccessDefaults(e,t){let{ownerDID:o,modelID:a,permissionType:s,accessLevel:r,allowedDIDs:l}=e;if(l&&l.length>0&&n(l),!({read:["only_owner","anyone","allowed_dids"],write:["only_owner","allowed_dids"]})[s].includes(r))throw Error(`Invalid access level "${r}" for permission type "${s}"`);await t.setUserModelAccessDefault({ownerDID:o,modelID:a,permissionType:s,accessLevel:r,allowedDIDs:l});let i=await t.getUserModelAccessDefault(o,a,"read"),c=await t.getUserModelAccessDefault(o,a,"write"),d={};return i&&(d.read={level:i.level,allowedDIDs:i.allowedDIDs??[]}),c&&(d.write={level:c.level,allowedDIDs:c.allowedDIDs??[]}),{ownerDID:o,modelId:a,permissions:d}}export async function removeModelAccessDefaults(e,t){let{ownerDID:o,modelID:a,permissionTypes:s}=e;await t.removeUserModelAccessDefaults(o,a,s)}export async function setDocumentAccessOverride(e,t){let{documentID:o,permissionType:s,accessLevel:r,allowedDIDs:l}=e;l&&l.length>0&&n(l);let i=a.fromString(o),c=await t.getDocument(i);if(!c)throw Error(`Document not found: ${o}`);let d={...c.data?.accessPermissions||{},[s]:{level:r,allowedDIDs:l}};return await t.saveDocument({id:i,data:{...c.data,accessPermissions:d},existing:c})}export async function removeDocumentAccessOverride(e,t){let{documentID:o,permissionTypes:s}=e,r=a.fromString(o),l=await t.getDocument(r);if(!l)return;let n={...l.data?.accessPermissions||{}};for(let e of s)delete n[e];await t.saveDocument({id:r,data:{...l.data,accessPermissions:Object.keys(n).length>0?n:void 0},existing:l})}

package/lib/handlers/graph.js

@@ -1 +1 @@
-import{fromB64 as a,toB64 as e}from"@enkaku/codec";import{consume as r}from"@enkaku/generator";import{createSchema as t}from"@kubun/graphql";import{AttachmentID as i}from"@kubun/id";import{GraphModel as o}from"@kubun/protocol";import{execute as n,OperationTypeNode as s,subscribe as l}from"graphql";import{createAccessChecker as c}from"../data/access-control.js";import{getExecutionArgs as d}from"../data/graphql.js";import{applyMutation as m}from"../data/mutations.js";function p(a){return{data:a.data,errors:a.errors?.map(a=>a.toJSON()),extensions:a.extensions}}export function createHandlers(u){let{db:f,logger:h,serverAccessConfig:g}=u,y={};function b(a){return a?.fieldsMeta?Object.entries(a.fieldsMeta).filter(([a,e])=>!0===e.searchable).map(([a])=>a):[]}async function w(a,e,r){let t;h.info("starting backfill for model {modelID} in graph {graphID}",{modelID:e,graphID:a});let i=0,o=!0;for(;o;){let a=await f.queryDocuments({modelIDs:[e],first:100,after:t});for(let t of a.entries)t.document.data&&(await f.updateSearchEntry(e,t.document.id,t.document.data,r),i++);o=a.hasMore,t=a.entries.at(-1)?.cursor}h.info("backfill completed for model {modelID}: {total} documents indexed",{modelID:e,total:String(i)})}f.events.on("document:saved",async a=>{let e=a.document;for(let[a,r]of Object.entries(y)){let a=r[e.model];if(a&&a.length>0)try{null===e.data?await f.removeSearchEntry(e.model,e.id):await f.updateSearchEntry(e.model,e.id,e.data,a)}catch(a){h.error("failed to update search index for document {id}: {err}",{id:e.id,err:String(a)})}}});let x={};async function v(a){return null==x[a]&&(x[a]=f.getGraph(a).then(e=>{if(null==e)throw h.warn("graph {id} not found",{id:a}),delete x[a],Error(`Graph not found: ${a}`);if(h.debug("cached model for graph {id}",{id:a}),e.search){let r={};for(let[a,t]of Object.entries(e.search))r[a]=t.fields??b(e.record[a]);y[a]=r}return{record:e.record,aliases:e.aliases}})),await x[a]}let S={};async function O(a){return null==S[a]&&(S[a]=v(a).then(e=>{let r=t(e);return h.debug("cached schema for graph {id}",{id:a}),r}).catch(e=>{throw delete S[a],e})),await S[a]}async function j(a){return p(await n(d(a)))}return{"graph/deploy":async a=>{let e=o.fromClusters({clusters:a.param.clusters}),r=a.param.search,t=await f.createGraph({id:a.param.id,name:a.param.name,record:e.record,search:r});if(h.info("deployed graph {id}",{id:t}),r){for(let[a,i]of Object.entries(r)){let r=i.fields??b(e.record[a]);r.length>0&&(await f.createSearchIndex(a,r),h.info("created search index for model {modelID}",{modelID:a}),w(t,a,r).catch(e=>{h.error("backfill failed for model {modelID}: {err}",{modelID:a,err:String(e)})}))}let a={};for(let[t,i]of Object.entries(r))a[t]=i.fields??b(e.record[t]);y[t]=a}return delete x[t],delete S[t],{id:t,...e.toJSON(),search:r}},"graph/list":async()=>({graphs:(await f.listGraphs()).map(a=>({id:a.id,name:a.name}))}),"graph/load":async a=>await v(a.param.id),"graph/mutate":async r=>{let t=Object.entries(r.param.attachments??{}).map(([r,t])=>({id:e(i.fromString(r).digest),data:a(t)}));0!==t.length&&await f.addAttachments(t);let o={},n={};await Promise.all(Object.entries(r.param.mutations).map(async([a,e])=>{o[a]=await m({db:f,validators:n},e)}));let l=r.message.payload,d=l.sub||l.iss,p=c(d,l.cap?Array.isArray(l.cap)?l.cap:[l.cap]:void 0,f,g);return await j({schema:await O(r.param.id),type:s.MUTATION,text:r.param.text,variables:r.param.variables??{},context:{db:f,mutatedDocuments:o,viewerDID:d,accessChecker:p}})},"graph/query":async a=>{let e=a.message.payload,r=e.sub||e.iss,t=c(r,e.cap?Array.isArray(e.cap)?e.cap:[e.cap]:void 0,f,g);return await j({schema:await O(a.param.id),type:s.QUERY,text:a.param.text,variables:a.param.variables??{},context:{db:f,viewerDID:r,accessChecker:t}})},"graph/subscribe":async a=>{let e=a.message.payload,t=e.sub||e.iss,i=c(t,e.cap?Array.isArray(e.cap)?e.cap:[e.cap]:void 0,f,g),o=d({schema:await O(a.param.id),type:s.SUBSCRIPTION,text:a.param.text,variables:a.param.variables??{},context:{db:f,viewerDID:t,accessChecker:i}}),n=await l(o);if(a.signal.aborted)return null;if("errors"in n)return p(n);let m=a.writable.getWriter();try{await r(n,async a=>{await m.write(p(a))},a.signal)}catch(a){if("Close"!==a)throw a}finally{await m.close()}return null}}}
+import{fromB64 as a,toB64 as e}from"@enkaku/codec";import{consume as t}from"@enkaku/generator";import{stringifyToken as r}from"@enkaku/token";import{createSchema as i}from"@kubun/graphql";import{AttachmentID as o}from"@kubun/id";import{applyChangeMutation as n,applySetMutation as s,createMutationOperations as l,HLC as c}from"@kubun/mutation";import{GraphModel as d}from"@kubun/protocol";import{execute as m,OperationTypeNode as u,subscribe as p}from"graphql";import{createAccessChecker as f}from"../data/access-control.js";import{getExecutionArgs as h}from"../data/graphql.js";import{captureMutation as y}from"../data/mutation-capture.js";import{applyMutation as w}from"../data/mutations.js";function g(a){let e={data:a.data};return null!=a.errors&&(e.errors=a.errors.map(a=>a.toJSON())),null!=a.extensions&&(e.extensions=a.extensions),e}export function createHandlers(b){let{db:x,logger:v,serverAccessConfig:k,signingIdentity:D}=b,I=new c({nodeID:"server"}),S={};function O(a){return a?.fieldsMeta?Object.entries(a.fieldsMeta).filter(([a,e])=>!0===e.searchable).map(([a])=>a):[]}async function j(a,e,t){let r;v.info("starting backfill for model {modelID} in graph {graphID}",{modelID:e,graphID:a});let i=0,o=!0;for(;o;){let a=await x.queryDocuments({modelIDs:[e],first:100,after:r});for(let r of a.entries)r.document.data&&(await x.updateSearchEntry(e,r.document.id,r.document.data,t),i++);o=a.hasMore,r=a.entries.at(-1)?.cursor}v.info("backfill completed for model {modelID}: {total} documents indexed",{modelID:e,total:String(i)})}x.events.on("document:saved",async a=>{let e=a.document;for(let[a,t]of Object.entries(S)){let a=t[e.model];if(a&&a.length>0)try{null===e.data?await x.removeSearchEntry(e.model,e.id):await x.updateSearchEntry(e.model,e.id,e.data,a)}catch(a){v.error("failed to update search index for document {id}: {err}",{id:e.id,err:String(a)})}}});let A={};async function E(a){return null==A[a]&&(A[a]=x.getGraph(a).then(e=>{if(null==e)throw v.warn("graph {id} not found",{id:a}),delete A[a],Error(`Graph not found: ${a}`);if(v.debug("cached model for graph {id}",{id:a}),e.search){let t={};for(let[a,r]of Object.entries(e.search))t[a]=r.fields??O(e.record[a]);S[a]=t}return{record:e.record,aliases:e.aliases}})),await A[a]}let M={};async function T(a){return null==M[a]&&(M[a]=E(a).then(e=>{let t=i(e);return v.debug("cached schema for graph {id}",{id:a}),t}).catch(e=>{throw delete M[a],e})),await M[a]}async function q(a){let e=await m(h(a));return v.trace("executed GraphQL query {text} with variables {variables}, result: {result}",{text:a.text,variables:a.variables,result:e}),g(e)}return{"graph/deploy":async a=>{let e=d.fromClusters({clusters:a.param.clusters}),t=a.param.search,r=await x.createGraph({id:a.param.id,name:a.param.name,record:e.record,search:t});if(v.info("deployed graph {id}",{id:r}),t){for(let[a,i]of Object.entries(t)){let t=i.fields??O(e.record[a]);t.length>0&&(await x.createSearchIndex(a,t),v.info("created search index for model {modelID}",{modelID:a}),j(r,a,t).catch(e=>{v.error("backfill failed for model {modelID}: {err}",{modelID:a,err:String(e)})}))}let a={};for(let[r,i]of Object.entries(t))a[r]=i.fields??O(e.record[r]);S[r]=a}return delete A[r],delete M[r],{id:r,...e.toJSON(),search:t}},"graph/list":async()=>({graphs:(await x.listGraphs()).map(a=>({id:a.id,name:a.name}))}),"graph/load":async a=>await E(a.param.id),"graph/mutate":async t=>{let i=Object.entries(t.param.attachments??{}).map(([t,r])=>({id:e(o.fromString(t).digest),data:a(r)}));0!==i.length&&await x.addAttachments(i);let c=t.message.payload,d=c.sub||c.iss,m=f(d,c.cap?Array.isArray(c.cap)?c.cap:[c.cap]:void 0,x,k);if(null==t.param.mutations){if(null==D)throw Error("Delegated mutations are not enabled on this server");if(d!==D.id)throw Error("Delegated mutations are only allowed for the server identity");let a={db:x,validators:{}},e=l({issuer:D.id,hlc:I,async processSetMutation(e){let t=r(await D.signToken(e)),i=await s(a,e);return await y({db:x,documentID:i.id,mutationPayload:t,authorDID:e.iss,hlc:e.hlc}),i},async processChangeMutation(e){let t=r(await D.signToken(e)),i=await n(a,e);return await y({db:x,documentID:i.id,mutationPayload:t,authorDID:e.iss,hlc:e.hlc}),i}});return await q({schema:await T(t.param.id),type:u.MUTATION,text:t.param.text,variables:t.param.variables??{},context:{db:x,mutationOperations:e,viewerDID:d,accessChecker:m}})}let p={},h={};return await Promise.all(Object.entries(t.param.mutations).map(async([a,e])=>{p[a]=await w({db:x,validators:h},e)})),await q({schema:await T(t.param.id),type:u.MUTATION,text:t.param.text,variables:t.param.variables??{},context:{db:x,mutatedDocuments:p,viewerDID:d,accessChecker:m}})},"graph/query":async a=>{let e=a.message.payload,t=e.sub||e.iss,r=f(t,e.cap?Array.isArray(e.cap)?e.cap:[e.cap]:void 0,x,k);return await q({schema:await T(a.param.id),type:u.QUERY,text:a.param.text,variables:a.param.variables??{},context:{db:x,viewerDID:t,accessChecker:r}})},"graph/subscribe":async a=>{let e=a.message.payload,r=e.sub||e.iss,i=f(r,e.cap?Array.isArray(e.cap)?e.cap:[e.cap]:void 0,x,k),o=h({schema:await T(a.param.id),type:u.SUBSCRIPTION,text:a.param.text,variables:a.param.variables??{},context:{db:x,viewerDID:r,accessChecker:i}}),n=await p(o);if(a.signal.aborted)return null;if("errors"in n)return g(n);let s=a.writable.getWriter();try{await t(n,async a=>{await s.write(g(a))},a.signal)}catch(a){if("Close"!==a)throw a}finally{await s.close()}return null}}}

package/lib/handlers/index.js

@@ -1 +1 @@
-import{createHandlers as r}from"./document.js";import{createHandlers as e}from"./graph.js";import{createHandlers as a}from"./sync.js";export function createHandlers(s){return{...r(s),...e(s),...a(s)}}
+import{createHandlers as r}from"./graph.js";import{createHandlers as e}from"./sync.js";export function createHandlers(a){return{...r(a),...e(a)}}

package/lib/handlers/sync.js

@@ -1 +1 @@
-import{checkCapability as e}from"@enkaku/capability";import{toB64 as t}from"@enkaku/codec";import{DocumentID as r}from"@kubun/id";import{blake3 as n}from"@noble/hashes/blake3.js";import{getMutationLog as o}from"../data/mutation-log.js";async function a(t,r,n){if(!n||0===n.length)return!1;let o=["*","urn:kubun:user:*",`urn:kubun:user:${r}`],a="document/read";for(let s of o)try{return await e({act:a,res:s},{iss:t,sub:r,cap:n}),!0}catch{}for(let s of n)for(let n of o)try{return await e({act:a,res:n},{iss:t,sub:r,cap:s}),!0}catch{}return!1}export function createHandlers(e){let{db:s,logger:c}=e;return{"sync/discovery":async e=>{let{userIDs:t,delegationTokens:r}=e.param,i=e.message.payload,u=i.sub||i.iss;c.debug("sync/discovery requested",{userIDs:t,viewerDID:u});let l=[];for(let e of t){let t=u===e,i=!t&&await a(u,e,r);if(!t&&!i){c.debug("sync/discovery: no access for user",{userID:e,viewerDID:u,hasDelegation:i});continue}for(let r of(c.debug("sync/discovery: access granted",{userID:e,viewerDID:u,isOwner:t,hasDelegation:i}),await s.listDocumentModelIDs()))try{for(let t of(await s.queryDocumentsByOwner(r,e))){let e=t.id,a=t.model??r,c=await s.getDocumentState(e),i=c?Array.from(n(c)).map(e=>e.toString(16).padStart(2,"0")).join("").slice(0,16):"",u=await o(s,e,0),m=u.length>0?u[u.length-1]:null,d=m?.timestamp??Date.now();l.push({documentID:e,modelID:a,lastMutationTimestamp:d,checkpointHash:i,sequenceNumber:m?.sequence_number??"0",priority:d})}}catch(e){c.debug("sync/discovery: skipping model table",{modelID:r,error:e})}}return l.sort((e,t)=>t.priority-e.priority),c.info("sync/discovery completed",{documentCount:l.length}),{documents:l}},"sync/stream":async e=>{let{documentIDs:n,delegationTokens:i}=e.param,u=e.message.payload,l=u.sub||u.iss;c.info("sync/stream started",{documentIDs:n,viewerDID:l});let m=0,d=0,y=e.writable.getWriter();try{for(let e of n){let n=await s.getDocumentState(e);if(!n){c.debug("sync/stream: document state not found",{documentID:e});continue}let u=r.fromString(e),f=await s.getDocument(u);if(!f){c.debug("sync/stream: document not found",{documentID:e});continue}let p=l===f.owner,w=!p&&await a(l,f.owner,i);if(!p&&!w){c.debug("sync/stream: access denied for document",{documentID:e,viewerDID:l,owner:f.owner}),await y.write({type:"skipped",documentID:e,reason:"access_denied"}),d++;continue}let g=await o(s,e,0);g.length>0&&g.length<=10?await y.write({type:"document",documentID:e,syncMode:"incremental",mutationJWTs:g.map(e=>e.mutation_jwt)}):await y.write({type:"document",documentID:e,syncMode:"full",fullState:t(n)}),m++}await y.write({type:"complete"})}catch(e){throw c.error("sync/stream error",{error:e}),e}finally{await y.close()}return c.info("sync/stream completed",{syncedDocuments:m,skippedDocuments:d}),{success:!0,syncedDocuments:m}},"sync/checkpoint":async e=>{let{peerServerID:t,checkpointData:r}=e.param;c.debug("sync/checkpoint storing",{peerServerID:t,userID:r.userID});let n=await s.storeSyncCheckpoint(t,r);return n?c.info("sync/checkpoint stored",{peerServerID:t,userID:r.userID}):c.error("sync/checkpoint failed to store"),{success:n}}}}
+import{checkCapability as e}from"@enkaku/capability";import{buildMerkleTree as t,findDivergentBuckets as r,getTimeBuckets as n}from"../sync/merkle-tree.js";async function s(t,r,n){if(!n||0===n.length)return!1;let s=["*","urn:kubun:user:*",`urn:kubun:user:${r}`],a="document/read";for(let c of s)try{return await e({act:a,res:c},{iss:t,sub:r,cap:n}),!0}catch{}for(let c of n)for(let n of s)try{return await e({act:a,res:n},{iss:t,sub:r,cap:c}),!0}catch{}return!1}export function createHandlers(e){let{db:a,logger:c}=e;return{"sync/negotiate":async e=>{let{scopes:t,delegationTokens:r}=e.param,n=e.message.payload,a=n.sub||n.iss;c.debug("sync/negotiate requested",{scopes:t,viewerDID:a});let o=[];for(let e of t){let t=a===e.ownerDID,n=!t&&await s(a,e.ownerDID,r);t||n?o.push(e):c.debug("sync/negotiate: scope rejected",{scope:e,viewerDID:a})}return c.info("sync/negotiate completed",{requested:t.length,accepted:o.length}),{acceptedScopes:o,excludedDocumentIDs:[]}},"sync/merkle-sync":async e=>{let{scopes:s,excludedDocumentIDs:o,tree:i}=e.param,u=e.writable.getWriter();c.info("sync/merkle-sync started",{scopes:s,excludedDocumentIDs:o});let l=0,y=0;try{let e=await a.getDocumentIDsForScope(s,o);if(0===e.length)return await u.write({type:"complete",divergentBuckets:0,totalMutations:0}),{success:!0,divergentBuckets:0,mutationsSent:0};let m=await a.getMutationLogForDocuments(e),g=t(m),d={root:i.root??"",buckets:i},p=r(g,d);if(l=p.length,0===p.length)return c.info("sync/merkle-sync: no divergent buckets, already in sync"),await u.write({type:"complete",divergentBuckets:0,totalMutations:0}),{success:!0,divergentBuckets:0,mutationsSent:0};let f=new Set(p),w=m.filter(e=>{let{minute:t}=n(e.hlc);return f.has(t)});for(let e=0;e<w.length;e+=1e3){let t=w.slice(e,e+1e3);await u.write({type:"mutations",mutationJWTs:t.map(e=>e.mutation_jwt)}),y+=t.length}await u.write({type:"complete",divergentBuckets:l,totalMutations:y})}catch(e){throw c.error("sync/merkle-sync error",{error:e}),e}finally{try{await u.close()}catch{}}return c.info("sync/merkle-sync completed",{divergentBuckets:l,mutationsSent:y}),{success:!0,divergentBuckets:l,mutationsSent:y}}}}

package/lib/handlers/types.d.ts

@@ -1,3 +1,4 @@
+import type { SigningIdentity } from '@enkaku/token';
 import type { KubunDB } from '@kubun/db';
 import type { Logger } from '@kubun/logger';
 import type { ServerAccessConfig } from '../data/access-control.js';
@@ -5,4 +6,5 @@ export type CreateHandlersParams = {
     db: KubunDB;
     logger: Logger;
     serverAccessConfig: ServerAccessConfig;
+    signingIdentity?: SigningIdentity;
 };

package/lib/server.d.ts

@@ -1,15 +1,17 @@
 import { type Server } from '@enkaku/server';
-import type { Identity } from '@enkaku/token';
+import { type Identity } from '@enkaku/token';
 import { type ClientParams, KubunClient } from '@kubun/client';
 import { type DBParams, KubunDB } from '@kubun/db';
 import { type Logger } from '@kubun/logger';
-import type { Protocol, ServerTransport } from '@kubun/protocol';
+import type { ClientTransport, Protocol, ServerTransport } from '@kubun/protocol';
 import { SyncManager } from './sync/sync-manager.js';
 export type ServerParams = {
     access?: Record<string, boolean | Array<string>>;
     db: KubunDB | DBParams;
     identity: Identity;
+    getRandomID?: () => string;
     logger?: Logger;
+    allowDelegatedMutations?: boolean;
     defaultAccessLevel?: {
         read?: 'only_owner' | 'anyone' | 'allowed_dids';
         write?: 'only_owner' | 'allowed_dids';
@@ -28,5 +30,6 @@ export declare class KubunServer {
     };
     get sync(): SyncManager;
     createClient(params: CreateClientParams): KubunClient;
+    serveDirectly(signal?: AbortSignal): [ClientTransport, Server<Protocol>];
     serve(transport: ServerTransport, signal?: AbortSignal): Server<Protocol>;
 }

package/lib/server.js

@@ -1 +1 @@
-import{serve as e}from"@enkaku/server";import{DirectTransports as t}from"@enkaku/transport";import{KubunClient as s}from"@kubun/client";import{KubunDB as r}from"@kubun/db";import{getKubunLogger as i}from"@kubun/logger";import{createHandlers as n}from"./handlers/index.js";import{SyncManager as l}from"./sync/sync-manager.js";export class KubunServer{#e;#t;#s;#r;#i;#n;#l;constructor(e){let{access:t,db:s,identity:c}=e,o=e.logger??i("server",{serverID:c.id});this.#e=t??{},this.#t=s instanceof r?s:new r(s),this.#r=c,this.#i=o,this.#n={read:e.defaultAccessLevel?.read??"only_owner",write:e.defaultAccessLevel?.write??"only_owner"},this.#s=n({db:this.#t,logger:o,serverAccessConfig:{defaultAccessLevel:this.#n}}),this.#l=new l({db:this.#t,identity:this.#r,logger:this.#i})}get db(){return this.#t}get defaultAccessLevel(){return this.#n}get sync(){return this.#l}createClient(e){let{signal:r,...i}=e,n=new t({signal:r});return this.serve(n.server,r),new s({logger:e.logger??this.#i.getChild("client").with({clientID:e.getRandomID?.()??crypto.randomUUID()}),serverID:this.#r.id,transport:n.client,...i})}serve(t,s){return e({access:this.#e,handlers:this.#s,identity:this.#r,logger:this.#i,signal:s,transport:t})}}
+import{serve as e}from"@enkaku/server";import{isSigningIdentity as t}from"@enkaku/token";import{DirectTransports as r}from"@enkaku/transport";import{KubunClient as s}from"@kubun/client";import{KubunDB as i}from"@kubun/db";import{getKubunLogger as n}from"@kubun/logger";import{createHandlers as o}from"./handlers/index.js";import{SyncManager as l}from"./sync/sync-manager.js";export class KubunServer{#e;#t;#r;#s;#i;#n;#o;#l;constructor(e){let r,{access:s,db:d,identity:a}=e,c=e.logger??n("server",{serverID:a.id});if(this.#e=s??{},this.#t=d instanceof i?d:new i(d),this.#r=e.getRandomID??(()=>globalThis.crypto.randomUUID()),this.#i=a,this.#n=c,this.#o={read:e.defaultAccessLevel?.read??"only_owner",write:e.defaultAccessLevel?.write??"only_owner"},e.allowDelegatedMutations){if(!t(a))throw Error("allowDelegatedMutations requires a SigningIdentity");r=a}this.#s=o({db:this.#t,logger:c,serverAccessConfig:{defaultAccessLevel:this.#o},signingIdentity:r}),this.#l=new l({db:this.#t,identity:this.#i,logger:this.#n})}get db(){return this.#t}get defaultAccessLevel(){return this.#o}get sync(){return this.#l}createClient(e){let{signal:t,...r}=e,[i]=this.serveDirectly(t),n=e.getRandomID??this.#r,o=e.logger??this.#n.getChild("client").with({clientID:n()});return new s({getRandomID:n,logger:o,serverID:this.#i.id,transport:i,...r})}serveDirectly(e){let t=new r({signal:e}),s=this.serve(t.server,e);return[t.client,s]}serve(t,r){return e({access:this.#e,getRandomID:this.#r,handlers:this.#s,identity:this.#i,logger:this.#n,signal:r,transport:t})}}

package/lib/sync/merkle-apply.d.ts

@@ -0,0 +1,12 @@
+import type { KubunDB } from '@kubun/db';
+export type ApplySyncMutationsParams = {
+    db: KubunDB;
+    mutationJWTs: Array<string>;
+};
+export type ApplySyncMutationsResult = {
+    applied: number;
+    rejected: number;
+    pending: number;
+    skipped: number;
+};
+export declare function applySyncMutations(params: ApplySyncMutationsParams): Promise<ApplySyncMutationsResult>;

package/lib/sync/merkle-apply.js

@@ -0,0 +1 @@
+import{asType as t,createValidator as a}from"@enkaku/schema";import{verifyToken as i}from"@enkaku/token";import{DocumentID as o}from"@kubun/id";import{applyMutation as n}from"@kubun/mutation";import{documentMutation as u}from"@kubun/protocol";import{computeMutationHash as e}from"../data/mutation-capture.js";let r=a(u);export async function applySyncMutations(a){let{db:u,mutationJWTs:m}=a,s=0,d=0,c=0,l=0,h={db:u,validators:{}};for(let a of m){let m,p=e(a);if(await u.hasMutationHash(p)){l++;continue}try{let o=await i(a);m=t(r,o.payload)}catch{d++;continue}let _=m.sub,f=o.fromString(_).model.toString(),w=o.fromString(_);if(null==await u.getDocument(w)&&"change"===m.typ){await u.insertMutationLogEntry({mutation_hash:p,model_id:f,document_id:_,author_did:m.iss,hlc:m.hlc,mutation_jwt:a,status:"pending"}),c++;continue}try{if(await n(h,m),await u.insertMutationLogEntry({mutation_hash:p,model_id:f,document_id:_,author_did:m.iss,hlc:m.hlc,mutation_jwt:a,status:"applied"}),s++,"set"===m.typ)for(let a of(await u.getPendingMutations(_)))try{let o=await i(a.mutation_jwt),e=t(r,o.payload);await n(h,e),await u.updateMutationStatus(a.mutation_hash,"applied"),s++}catch{await u.updateMutationStatus(a.mutation_hash,"rejected"),d++}}catch{await u.insertMutationLogEntry({mutation_hash:p,model_id:f,document_id:_,author_did:m.iss,hlc:m.hlc,mutation_jwt:a,status:"rejected"}),d++}}return{applied:s,rejected:d,pending:c,skipped:l}}

package/lib/sync/merkle-tree.d.ts

@@ -0,0 +1,13 @@
+import type { MutationLogEntry } from '@kubun/db';
+export type MerkleTree = {
+    root: string;
+    buckets: Record<string, string>;
+};
+export declare function getTimeBuckets(hlc: string): {
+    year: string;
+    month: string;
+    day: string;
+    minute: string;
+};
+export declare function buildMerkleTree(entries: Array<MutationLogEntry>): MerkleTree;
+export declare function findDivergentBuckets(local: MerkleTree, remote: MerkleTree): Array<string>;

package/lib/sync/merkle-tree.js

@@ -0,0 +1 @@
+import{blake3 as t}from"@noble/hashes/blake3.js";let e=[4,7,10,16],o=new TextEncoder;export function getTimeBuckets(t){return{year:t.slice(0,4),month:t.slice(0,7),day:t.slice(0,10),minute:t.slice(0,16)}}function r(e){return Array.from(t(o.encode(e))).map(t=>t.toString(16).padStart(2,"0")).join("")}export function buildMerkleTree(t){if(0===t.length)return{root:"",buckets:{}};let e=new Map;for(let o of t){let{minute:t}=getTimeBuckets(o.hlc),r=e.get(t);null==r&&(r=[],e.set(t,r)),r.push(o)}let o={};for(let[t,n]of e){let e=[...n].sort((t,e)=>t.mutation_hash<e.mutation_hash?-1:+(t.mutation_hash>e.mutation_hash)).map(t=>t.mutation_hash).join("\n");o[t]=r(e)}for(let t of[10,7,4]){let e=10===t?16:7===t?10:7,n=new Map;for(let r of Object.keys(o)){if(r.length!==e)continue;let o=r.slice(0,t),s=n.get(o);null==s&&(s=[],n.set(o,s)),s.push(r)}for(let[t,e]of n){let n=e.sort().map(t=>`${t}\0${o[t]}`).join("\n");o[t]=r(n)}}let n=r(Object.keys(o).filter(t=>4===t.length).sort().map(t=>`${t}\0${o[t]}`).join("\n"));return o.root=n,{root:n,buckets:o}}export function findDivergentBuckets(t,o){if(t.root===o.root)return[];if(""===t.root)return Object.keys(o.buckets).filter(t=>16===t.length).sort();if(""===o.root)return Object.keys(t.buckets).filter(t=>16===t.length).sort();let r=[],n=new Set([...Object.keys(t.buckets),...Object.keys(o.buckets)]);return!function s(l,i){let u=e[i];for(let c of[...n].filter(t=>t.length===u&&(""===l||t.startsWith(l))).sort())t.buckets[c]!==o.buckets[c]&&(i===e.length-1?r.push(c):s(c,i+1))}("",0),r.sort()}

package/lib/sync/sync-client.d.ts

@@ -7,33 +7,17 @@ export type SyncClientParams = {
     logger: Logger;
     serverResolver?: (serverID: string) => KubunServer | undefined;
 };
-export type SyncStreamMessage = {
-    type?: string;
-    documentID?: string;
-    syncMode?: string;
-    mutationJWTs?: Array<string>;
-    fullState?: string;
-    reason?: string;
-};
-export type DiscoveryDocument = {
-    documentID: string;
+export type SyncScope = {
     modelID: string;
-    lastMutationTimestamp: number;
-    checkpointHash: string;
-    sequenceNumber: string;
-    priority: number;
-};
-export type DiscoveryResult = {
-    documents: Array<DiscoveryDocument>;
+    ownerDID: string;
 };
-export type SyncCheckpointData = {
-    userID: string;
-    lastSyncTimestamp: number;
-    documentCheckpoints: Record<string, {
-        lastKnownHash: string;
-        lastSyncedSequence: number;
-    }>;
-    vectorClock: Record<string, number>;
+export type MerkleSyncMessage = {
+    type: 'mutations';
+    mutationJWTs: Array<string>;
+} | {
+    type: 'complete';
+    divergentBuckets?: number;
+    totalMutations?: number;
 };
 /**
  * Client for connecting to peer servers for sync operations.
@@ -49,18 +33,22 @@ export declare class SyncClient {
      */
     connect(endpoint: string): Promise<KubunClient>;
     /**
-     * Perform sync discovery to get document manifest from peer.
-     * Documents are returned sorted by priority (most recently modified first).
+     * Negotiate sync scopes with peer.
      */
-    discovery(client: KubunClient, userIDs: Array<string>, delegationTokens?: Array<string>): Promise<DiscoveryResult>;
-    /**
-     * Request documents via sync/stream and collect all messages.
-     */
-    streamDocuments(client: KubunClient, documentIDs: Array<string>, delegationTokens?: Array<string>): Promise<Array<SyncStreamMessage>>;
+    negotiate(client: KubunClient, scopes: Array<SyncScope>, delegationTokens?: Array<string>): Promise<{
+        acceptedScopes: Array<SyncScope>;
+        excludedDocumentIDs: Array<string>;
+    }>;
     /**
-     * Store a sync checkpoint on the peer server.
+     * Perform Merkle tree-based sync with peer.
+     * Sends local tree, receives divergent mutation JWTs.
      */
-    storeCheckpoint(client: KubunClient, peerServerID: string, checkpointData: SyncCheckpointData): Promise<{
-        success: boolean;
+    merkleSync(client: KubunClient, params: {
+        scopes: Array<SyncScope>;
+        excludedDocumentIDs: Array<string>;
+        tree: Record<string, string>;
+    }): Promise<{
+        mutationJWTs: Array<string>;
+        divergentBuckets: number;
     }>;
 }

package/lib/sync/sync-client.js

@@ -1 +1 @@
-import{createArraySink as e}from"@enkaku/stream";import{DirectTransports as r}from"@enkaku/transport";import{KubunClient as t}from"@kubun/client";export class SyncClient{#e;#r;#t;constructor(e){this.#e=e.identity,this.#r=e.logger,this.#t=e.serverResolver}async connect(e){if(e.startsWith("direct://"))return this.#n(e);throw Error(`HTTP transport not yet implemented: ${e}`)}#n(e){let n=e.replace("direct://","");if(!this.#t)throw Error("Server resolver not configured for direct transport");let s=this.#t(n);if(!s)throw Error(`Server not found: ${n}`);let i=new r;return s.serve(i.server),new t({identity:this.#e,logger:this.#r.getChild("sync-client"),serverID:n,transport:i.client})}async discovery(e,r,t=[]){return e.client.request("sync/discovery",{param:{userIDs:r,delegationTokens:t}})}async streamDocuments(r,t,n=[]){let[s,i]=e(),o=r.client.createStream("sync/stream",{param:{documentIDs:t,delegationTokens:n}});return o.readable.pipeTo(s),await o,i}async storeCheckpoint(e,r,t){return e.client.request("sync/checkpoint",{param:{peerServerID:r,checkpointData:t}})}}
+import{createArraySink as e}from"@enkaku/stream";import{DirectTransports as t}from"@enkaku/transport";import{KubunClient as r}from"@kubun/client";export class SyncClient{#e;#t;#r;constructor(e){this.#e=e.identity,this.#t=e.logger,this.#r=e.serverResolver}async connect(e){if(e.startsWith("direct://"))return this.#n(e);throw Error(`HTTP transport not yet implemented: ${e}`)}#n(e){let n=e.replace("direct://","");if(!this.#r)throw Error("Server resolver not configured for direct transport");let o=this.#r(n);if(!o)throw Error(`Server not found: ${n}`);let i=new t;return o.serve(i.server),new r({identity:this.#e,logger:this.#t.getChild("sync-client"),serverID:n,transport:i.client})}async negotiate(e,t,r=[]){return e.client.request("sync/negotiate",{param:{scopes:t,delegationTokens:r}})}async merkleSync(t,r){let[n,o]=e(),i=t.client.createStream("sync/merkle-sync",{param:{scopes:r.scopes,excludedDocumentIDs:r.excludedDocumentIDs,tree:r.tree}});i.readable.pipeTo(n),await i;let s=await o,c=[],l=0;for(let e of s)"mutations"===e.type&&"mutationJWTs"in e?c.push(...e.mutationJWTs):"complete"===e.type&&(l=("divergentBuckets"in e?e.divergentBuckets:0)??0);return{mutationJWTs:c,divergentBuckets:l}}}

package/lib/sync/sync-manager.d.ts

@@ -3,10 +3,7 @@ import type { KubunDB } from '@kubun/db';
 import type { Logger } from '@kubun/logger';
 import type { KubunServer } from '../server.js';
 import { type PeerConfig, type PeerConfigWithID } from './peer-registry.js';
-export type SyncOptions = {
-    userIDs?: Array<string>;
-    documentIDs?: Array<string>;
-};
+import { type SyncScope } from './sync-client.js';
 export type SyncSessionInfo = {
     peerID: string;
     startTime: number;
@@ -49,8 +46,10 @@ export declare class SyncManager {
     updatePeerConfig(peerDID: string, updates: Partial<PeerConfig>): Promise<void>;
     listPeers(): Promise<Array<PeerConfigWithID>>;
     getPeer(peerDID: string): Promise<PeerConfigWithID | undefined>;
-    syncWithPeer(peerDID: string, options?: SyncOptions): Promise<{
+    merkleSyncWithPeer(peerDID: string, scopes: Array<SyncScope>, delegationTokens?: Array<string>): Promise<{
         sessionID: string;
+        divergentBuckets: number;
+        messagesReceived: number;
     }>;
     getStatus(peerDID?: string): SyncStatus;
     onSyncEvent(callback: (event: SyncEvent) => void): () => void;

package/lib/sync/sync-manager.js

@@ -1 +1 @@
-import{EventEmitter as e}from"@enkaku/event";import{isSigningIdentity as t}from"@enkaku/token";import{mergeFullState as r}from"./crdt-merge.js";import{replayMutations as n}from"./mutation-replay.js";import{PeerRegistry as s}from"./peer-registry.js";import{SyncClient as o}from"./sync-client.js";export class SyncManager{#e;#t;#r;#n=new e;#s=new Map;#o=new Map;#i;#m;constructor(e){this.#e=e.db,this.#i=e.identity,this.#t=e.logger,this.#r=new s(e.db)}setIdentity(e){this.#i=e}setServerResolver(e){this.#m=e}async addPeer(e){await this.#r.addPeer(e),this.#t.info("Peer added",{peerDID:e.peerDID})}async removePeer(e){await this.#r.removePeer(e),this.#t.info("Peer removed",{peerDID:e})}async updatePeerConfig(e,t){await this.#r.updatePeer(e,t),this.#t.info("Peer updated",{peerDID:e})}async listPeers(){return this.#r.listPeers()}async getPeer(e){return this.#r.getPeer(e)}async syncWithPeer(e,r){this.#t.info("Starting sync with peer",{peerDID:e,options:r});let n=await this.#r.getPeer(e);if(!n)throw Error(`Peer ${e} not found`);let s=`sync-${e}-${Date.now()}`,i={peerID:e,startTime:Date.now(),documentsAttempted:0,documentsCompleted:0};this.#s.set(s,i),this.#a({type:"started",peerID:e,timestamp:Date.now()});try{let m=this.#i;if(t(m)){let t=new o({identity:m,logger:this.#t,serverResolver:this.#m});this.#t.info("Connecting to peer",{endpoint:n.endpoint});let s=await t.connect(n.endpoint),a=r?.documentIDs??[];if(0===a.length&&r?.userIDs&&r.userIDs.length>0&&(this.#t.info("Discovering documents for users",{userIDs:r.userIDs}),a=(await t.discovery(s,r.userIDs)).documents.map(e=>e.documentID),this.#t.info("Discovered documents",{count:a.length})),0===a.length)this.#t.info("No documents to sync");else{for(let r of(i.documentsAttempted=a.length,this.#t.info("Requesting documents via stream",{count:a.length}),await t.streamDocuments(s,a)))if("document"===r.type&&r.documentID)try{await this.#c(r),i.documentsCompleted++,this.#a({type:"document:complete",peerID:e,documentID:r.documentID,timestamp:Date.now()})}catch(t){this.#t.error("Failed to apply document sync",{documentID:r.documentID,error:t}),this.#a({type:"document:failed",peerID:e,documentID:r.documentID,timestamp:Date.now(),error:t instanceof Error?t.message:String(t)})}else"skipped"===r.type&&r.documentID&&(this.#t.debug("Document skipped by peer",{documentID:r.documentID,reason:r.reason}),this.#a({type:"document:skipped",peerID:e,documentID:r.documentID,timestamp:Date.now(),reason:r.reason}));this.#t.info("Sync complete",{attempted:i.documentsAttempted,completed:i.documentsCompleted})}}else this.#t.warn("Sync session initiated without identity signer (skipping actual sync)",{sessionID:s,peerDID:e,endpoint:n.endpoint,options:r});this.#o.set(e,Date.now()),this.#a({type:"completed",peerID:e,timestamp:Date.now()})}catch(t){throw this.#t.error("Sync failed",{peerDID:e,error:t}),this.#a({type:"error",peerID:e,timestamp:Date.now(),error:t instanceof Error?t.message:String(t)}),t}finally{this.#s.delete(s)}return{sessionID:s}}async #c(e){if(!e.documentID)throw Error("Document ID is required");if("incremental"===e.syncMode&&e.mutationJWTs){this.#t.debug("Applying incremental sync",{documentID:e.documentID,mutationCount:e.mutationJWTs.length});let t=await n({db:this.#e,logger:this.#t,mutationJWTs:e.mutationJWTs,skipCapture:!1}),r=t.filter(e=>!e.success);r.length>0&&this.#t.warn("Some mutations failed to replay",{documentID:e.documentID,total:t.length,failed:r.length,errors:r.map(e=>e.error)}),this.#t.info("Replayed incremental mutations",{documentID:e.documentID,total:t.length,succeeded:t.length-r.length})}else if("full"===e.syncMode&&e.fullState){this.#t.debug("Applying full sync",{documentID:e.documentID});let t=await r({db:this.#e,logger:this.#t,documentID:e.documentID,fullState:e.fullState});if(!t.success)throw Error(t.error||"Failed to merge full state");this.#t.info("Applied full state sync",{documentID:e.documentID,merged:t.merged})}else throw Error(`Unknown sync mode: ${e.syncMode}`)}getStatus(e){let t=Array.from(this.#s.values()).filter(t=>!e||t.peerID===e).map(e=>({peerID:e.peerID,startTime:e.startTime,documentsAttempted:e.documentsAttempted,documentsCompleted:e.documentsCompleted})),r={};for(let[t,n]of this.#o.entries())e&&t!==e||(r[t]=n);return{activeSessions:t,lastSyncByPeer:r}}onSyncEvent(e){return this.#n.on("sync",e)}#a(e){this.#n.emit("sync",e).catch(e=>{this.#t.error("Error in sync event listener",{error:e})})}}
+import{EventEmitter as e}from"@enkaku/event";import{isSigningIdentity as t}from"@enkaku/token";import{applySyncMutations as r}from"./merkle-apply.js";import{buildMerkleTree as s}from"./merkle-tree.js";import{PeerRegistry as i}from"./peer-registry.js";import{SyncClient as n}from"./sync-client.js";export class SyncManager{#e;#t;#r;#s=new e;#i=new Map;#n=new Map;#o;#a;constructor(e){this.#e=e.db,this.#o=e.identity,this.#t=e.logger,this.#r=new i(e.db)}setIdentity(e){this.#o=e}setServerResolver(e){this.#a=e}async addPeer(e){await this.#r.addPeer(e),this.#t.info("Peer added",{peerDID:e.peerDID})}async removePeer(e){await this.#r.removePeer(e),this.#t.info("Peer removed",{peerDID:e})}async updatePeerConfig(e,t){await this.#r.updatePeer(e,t),this.#t.info("Peer updated",{peerDID:e})}async listPeers(){return this.#r.listPeers()}async getPeer(e){return this.#r.getPeer(e)}async merkleSyncWithPeer(e,i,o=[]){this.#t.info("Starting Merkle sync with peer",{peerDID:e,scopes:i});let a=await this.#r.getPeer(e);if(!a)throw Error(`Peer ${e} not found`);let l=`merkle-sync-${e}-${Date.now()}`,g={peerID:e,startTime:Date.now(),documentsAttempted:0,documentsCompleted:0};this.#i.set(l,g),this.#l({type:"started",peerID:e,timestamp:Date.now()});try{let c=this.#o;if(!t(c))throw Error("Signing identity required for Merkle sync");let m=new n({identity:c,logger:this.#t,serverResolver:this.#a}),p=await m.connect(a.endpoint);this.#t.info("Negotiating sync scopes",{scopes:i});let{acceptedScopes:d,excludedDocumentIDs:y}=await m.negotiate(p,i,o);if(0===d.length)return this.#t.info("No scopes accepted by peer"),this.#n.set(e,Date.now()),this.#l({type:"completed",peerID:e,timestamp:Date.now()}),this.#i.delete(l),{sessionID:l,divergentBuckets:0,messagesReceived:0};this.#t.info("Building local Merkle tree",{acceptedScopes:d});let h=await this.#e.getDocumentIDsForScope(d,y),u=await this.#e.getMutationLogForDocuments(h),v=s(u);this.#t.info("Requesting Merkle sync from peer",{localTreeBuckets:Object.keys(v.buckets).length});let f=await m.merkleSync(p,{scopes:d,excludedDocumentIDs:y,tree:v.buckets});return f.mutationJWTs.length>0&&(this.#t.info("Applying sync mutations",{mutations:f.mutationJWTs.length}),g.documentsCompleted=(await r({db:this.#e,mutationJWTs:f.mutationJWTs})).applied),this.#n.set(e,Date.now()),this.#l({type:"completed",peerID:e,timestamp:Date.now()}),this.#t.info("Merkle sync completed",{divergentBuckets:f.divergentBuckets,mutationsReceived:f.mutationJWTs.length}),{sessionID:l,divergentBuckets:f.divergentBuckets,messagesReceived:f.mutationJWTs.length}}catch(t){throw this.#t.error("Merkle sync failed",{peerDID:e,error:t}),this.#l({type:"error",peerID:e,timestamp:Date.now(),error:t instanceof Error?t.message:String(t)}),t}finally{this.#i.delete(l)}}getStatus(e){let t=Array.from(this.#i.values()).filter(t=>!e||t.peerID===e).map(e=>({peerID:e.peerID,startTime:e.startTime,documentsAttempted:e.documentsAttempted,documentsCompleted:e.documentsCompleted})),r={};for(let[t,s]of this.#n.entries())e&&t!==e||(r[t]=s);return{activeSessions:t,lastSyncByPeer:r}}onSyncEvent(e){return this.#s.on("sync",e)}#l(e){this.#s.emit("sync",e).catch(e=>{this.#t.error("Error in sync event listener",{error:e})})}}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/server",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "license": "see LICENSE.md",
   "keywords": [],
   "type": "module",
@@ -21,25 +21,26 @@
     "@enkaku/event": "^0.13.0",
     "@enkaku/generator": "^0.13.0",
     "@enkaku/schema": "^0.13.0",
-    "@enkaku/server": "^0.13.0",
+    "@enkaku/server": "^0.13.1",
     "@enkaku/token": "0.13.0",
     "@enkaku/transport": "0.13.1",
+    "@noble/hashes": "^2.0.1",
     "graphql": "^16.12.0",
-    "@kubun/db": "^0.5.0",
-    "@kubun/graphql": "^0.5.0",
-    "@kubun/mutation": "^0.5.0",
-    "@kubun/client": "^0.5.0",
-    "@kubun/protocol": "^0.5.0",
-    "@kubun/logger": "^0.5.0",
-    "@kubun/id": "^0.5.0"
+    "@kubun/client": "^0.6.0",
+    "@kubun/db": "^0.6.0",
+    "@kubun/protocol": "^0.6.0",
+    "@kubun/mutation": "^0.6.0",
+    "@kubun/logger": "^0.6.0",
+    "@kubun/graphql": "^0.6.0",
+    "@kubun/id": "^0.6.0"
   },
   "devDependencies": {
     "@databases/pg-test": "^3.1.2",
     "@enkaku/stream": "^0.13.0",
-    "@kubun/db-sqlite": "^0.5.0",
-    "@kubun/db-postgres": "^0.5.0",
-    "@kubun/test-utils": "^0.5.0",
-    "@kubun/scalars": "^0.5.0"
+    "@kubun/db-postgres": "^0.6.0",
+    "@kubun/scalars": "^0.6.0",
+    "@kubun/test-utils": "^0.6.0",
+    "@kubun/db-better-sqlite": "^0.6.0"
   },
   "scripts": {
     "build:clean": "del lib",

package/lib/data/mutation-log.d.ts

@@ -1,17 +0,0 @@
-import type { DocumentMutationLog, KubunDB } from '@kubun/db';
-export type MutationLogEntry = {
-    documentID: string;
-    sequenceNumber: string;
-    mutationJWT: string;
-    authorDID: string;
-};
-/**
- * Stores a mutation log entry and maintains ring buffer of last 10 mutations per document
- */
-export declare function storeMutationLog(db: KubunDB, entry: MutationLogEntry): Promise<void>;
-/** @deprecated Use DocumentMutationLog from @kubun/db instead */
-export type MutationLogRecord = DocumentMutationLog;
-/**
- * Retrieves mutation log entries for a document starting from a given sequence number
- */
-export declare function getMutationLog(db: KubunDB, documentID: string, fromSequence: number): Promise<Array<DocumentMutationLog>>;

package/lib/data/mutation-log.js

@@ -1 +0,0 @@
-export async function storeMutationLog(t,o){await t.storeMutationLog(o)}export async function getMutationLog(t,o,n){return t.getMutationLog(o,n)}

package/lib/handlers/document.d.ts

@@ -1,4 +0,0 @@
-import type { ProcedureHandlers } from '@enkaku/server';
-import type { DocumentProtocol } from '@kubun/protocol';
-import type { CreateHandlersParams } from './types.js';
-export declare function createHandlers(handlersParams: CreateHandlersParams): ProcedureHandlers<DocumentProtocol>;

package/lib/handlers/document.js

@@ -1 +0,0 @@
-import{toB64 as e}from"@enkaku/codec";export function createHandlers(t){let{db:n}=t;return{"document/sync":async t=>{let r=Object.keys(t.param.documents),a=await n.getDocumentStates(r);return{states:r.reduce((n,r)=>{let c=a[r];return null==c?n[r]=null:(t.param.documents[r],n[r]=e(c)),n},{})}}}}

package/lib/sync/crdt-merge.d.ts

@@ -1,26 +0,0 @@
-import type { KubunDB } from '@kubun/db';
-import type { Logger } from '@kubun/logger';
-export type CRDTMergeResult = {
-    documentID: string;
-    success: boolean;
-    merged: boolean;
-    error?: string;
-};
-export type MergeFullStateParams = {
-    db: KubunDB;
-    logger: Logger;
-    documentID: string;
-    fullState: string;
-};
-/**
- * Merge an Automerge state received from a peer with the local document state.
- *
- * This handles the "full sync" mode where we receive a complete Automerge document
- * and need to merge it with our local state using CRDT semantics.
- */
-export declare function mergeFullState(params: MergeFullStateParams): Promise<CRDTMergeResult>;
-/**
- * Check if full sync merge is possible for a document.
- * Full sync requires the document to already exist locally.
- */
-export declare function canMergeFullState(db: KubunDB, documentID: string): Promise<boolean>;

package/lib/sync/crdt-merge.js

@@ -1 +0,0 @@
-import{automergeWasmBase64 as e}from"@automerge/automerge/automerge.wasm.base64";import*as t from"@automerge/automerge/slim";import{lazy as r}from"@enkaku/async";import{fromB64 as a}from"@enkaku/codec";import{asType as n,createValidator as o}from"@enkaku/schema";import{DocumentID as m}from"@kubun/id";let s=r(()=>t.initializeBase64Wasm(e)),l={};async function i(e,t){return null==l[t]&&(l[t]=e.getDocumentModel(t).then(e=>o({...e.schema,$id:t}))),l[t]}export async function mergeFullState(e){let{db:r,logger:o,documentID:l,fullState:u}=e;try{await s;let e=a(u),c=t.load(e),g=m.fromString(l),d=g.model.toString(),[f,p,y]=await Promise.all([r.getDocument(g),r.getDocumentState(l),i(r,d)]);if(null===f)return o.warn("Cannot apply full sync to non-existent document",{documentID:l}),{documentID:l,success:!1,merged:!1,error:"Document does not exist locally. Use incremental sync with create mutation."};let h=p?t.load(p):t.from(f.data||{}),S=t.merge(h,c),k=n(y,JSON.parse(JSON.stringify(S)));return await r.saveDocument({id:g,existing:f,data:k,state:t.save(S)}),o.info("Merged full state for document",{documentID:l,localHeads:t.getHeads(h).length,receivedHeads:t.getHeads(c).length,mergedHeads:t.getHeads(S).length}),{documentID:l,success:!0,merged:!0}}catch(t){let e=t instanceof Error?t.message:String(t);return o.error("Failed to merge full state",{documentID:l,error:e}),{documentID:l,success:!1,merged:!1,error:e}}}export async function canMergeFullState(e,t){try{let r=m.fromString(t),a=await e.getDocument(r);return null!==a}catch{return!1}}

package/lib/sync/mutation-replay.d.ts

@@ -1,31 +0,0 @@
-import type { KubunDB } from '@kubun/db';
-import type { Logger } from '@kubun/logger';
-import type { DocumentNode } from '@kubun/protocol';
-export type MutationReplayResult = {
-    documentID: string;
-    success: boolean;
-    error?: string;
-};
-export type ReplayMutationsParams = {
-    db: KubunDB;
-    logger: Logger;
-    mutationJWTs: string[];
-    /** Skip capturing mutations in local log (useful for avoiding duplicate captures) */
-    skipCapture?: boolean;
-};
-/**
- * Replay mutation JWTs received from a peer server.
- * This applies each mutation sequentially and captures them in the local mutation log
- * for onward synchronization with other peers.
- */
-export declare function replayMutations(params: ReplayMutationsParams): Promise<MutationReplayResult[]>;
-/**
- * Replay a single mutation JWT.
- * Returns the resulting document or throws on error.
- */
-export declare function replaySingleMutation(params: {
-    db: KubunDB;
-    logger: Logger;
-    mutationJWT: string;
-    skipCapture?: boolean;
-}): Promise<DocumentNode>;

package/lib/sync/mutation-replay.js

@@ -1 +0,0 @@
-import{asType as t,createValidator as a}from"@enkaku/schema";import{verifyToken as o}from"@enkaku/token";import{applyMutation as e}from"@kubun/mutation";import{documentMutation as r}from"@kubun/protocol";import{captureMutation as i}from"../data/mutation-capture.js";let u=a(r);export async function replayMutations(a){let{db:r,logger:n,mutationJWTs:s,skipCapture:c=!1}=a,d=[],m={db:r,validators:{},accessChecker:void 0};for(let a of s)try{let s=await o(a),p=t(u,s.payload),l=await e(m,p);c||await i({db:r,documentID:l.id,mutationPayload:a,authorDID:p.iss}),d.push({documentID:l.id,success:!0}),n.debug("Replayed mutation",{documentID:l.id,type:p.typ,author:p.iss})}catch(a){let t=a instanceof Error?a.message:String(a);n.error("Failed to replay mutation",{error:t}),d.push({documentID:"unknown",success:!1,error:t})}return d}export async function replaySingleMutation(a){let{db:r,logger:n,mutationJWT:s,skipCapture:c=!1}=a,d=t(u,(await o(s)).payload),m=await e({db:r,validators:{},accessChecker:void 0},d);return c||await i({db:r,documentID:m.id,mutationPayload:s,authorDID:d.iss}),n.debug("Replayed single mutation",{documentID:m.id,type:d.typ,author:d.iss}),m}