@kubun/store-p2p 0.10.1 → 0.11.0

package/lib/api.d.ts

@@ -1,7 +1,6 @@
 import type { Adapter } from '@kubun/db-adapter';
-import { type Logger } from '@kubun/logger';
 import type { Kysely } from 'kysely';
-import type { Circle, CircleMember, DelegationToken, Group, GroupMember, GroupMLSState, HeldRevocation, Hub, InsertCircle, InsertCircleMember, InsertDelegationToken, InsertGroup, InsertGroupHub, InsertGroupMember, InsertGroupMLSState, InsertHub, InsertRevokedCapability, InsertSyncPeer, P2PStoreTables, PaginatedResult, PaginationParams, RevokedCapability, SyncPeer } from './tables.js';
+import type { Circle, CircleMember, ControlLedgerEntry, Group, GroupMember, GroupMLSState, Hub, InsertCircle, InsertCircleMember, InsertControlLedgerEntry, InsertGroup, InsertGroupDelegation, InsertGroupHub, InsertGroupMember, InsertGroupMLSState, InsertHub, InsertSyncPeer, P2PStoreTables, PaginatedResult, PaginationParams, SyncPeer } from './tables.js';
 export type P2PStoreAPI = {
     createGroup(group: InsertGroup): Promise<void>;
     getGroup(id: string): Promise<Group | undefined>;
@@ -10,6 +9,13 @@ export type P2PStoreAPI = {
     listGroups(): Promise<Array<Group>>;
     listGroupsOffsetPaged(params: PaginationParams): Promise<PaginatedResult<Group>>;
     addGroupMember(member: InsertGroupMember): Promise<void>;
+    /**
+     * Add (or revive) several members in a single multi-row insert. Same
+     * re-add-clears-tombstone semantics as {@link addGroupMember}, applied to every
+     * row. A single statement keeps the whole batch atomic and avoids issuing one
+     * round-trip per member on a single-connection adapter. A no-op for an empty list.
+     */
+    addGroupMembers(members: Array<InsertGroupMember>): Promise<void>;
     /**
      * Soft-delete a member by tombstoning the row with `hlc`. Delegates to
      * `markMemberRemoved`: earliest-wins LWW, ignore-if-absent. The row stays in
@@ -36,6 +42,34 @@ export type P2PStoreAPI = {
     } | undefined>;
     getGroupMember(groupID: string, memberDID: string): Promise<GroupMember | undefined>;
     isGroupMember(groupID: string, memberDID: string): Promise<boolean>;
+    /**
+     * Whether `did` was a member of `groupID` at the given HLC, ignoring role.
+     * Mirrors {@link isGroupAdmin}'s removal-boundary semantics without the
+     * `role = 'admin'` filter: with no `atHLC`, tombstoned rows are excluded
+     * (`removed_at_hlc IS NULL`); with `atHLC`, a member removed at HLC `R` still
+     * counts iff `atHLC < R`. Conjoined with ledger admin authority so an
+     * MLS-removed member loses admin regardless of the ledger.
+     */
+    isGroupMemberAtHLC(groupID: string, did: string, atHLC?: string): Promise<boolean>;
+    /**
+     * Whether `did` holds an active `admin` role in `groupID`. With no `atHLC`,
+     * tombstoned rows are ignored (`removed_at_hlc IS NULL`) — the apply-time
+     * admin check. With `atHLC`, an admin removed at HLC `R` still counts iff the
+     * supplied HLC strictly precedes `R` (`atHLC < R`): a write claiming a moment
+     * before the removal is admitted, one at or after it is denied. This mirrors
+     * the membership boundary in `checkMembership` (which denies at
+     * `removed_at_hlc <= mutationHLC`), so the two checks agree on the
+     * remove-boundary instant.
+     */
+    isGroupAdmin(groupID: string, did: string, atHLC?: string): Promise<boolean>;
+    /**
+     * Overlay the role column for an existing member. Update-only: a grant for a
+     * DID with no membership row is a no-op, since membership is MLS-native and a
+     * non-member can hold no role. Never touches `hlc` or `removed_at_hlc`, so it
+     * neither churns membership LWW nor resurrects a tombstone — it is purely the
+     * projection target for the admin-roster fold.
+     */
+    setGroupMemberRole(groupID: string, memberDID: string, role: string): Promise<void>;
     isMemberOfAnyGroup(viewerDID: string, groupIDs: Array<string>): Promise<boolean>;
     listGroupMembers(groupID: string): Promise<Array<GroupMember>>;
     getGroupsForMember(memberDID: string): Promise<Array<Group>>;
@@ -104,123 +138,58 @@ export type P2PStoreAPI = {
     getCirclesForMember(memberDID: string): Promise<Array<Circle>>;
     isMemberOfAnyCircle(memberDID: string, circleIDs: Array<string>): Promise<boolean>;
     /**
-     * Store a delegation token. A re-minted grant covering the same
-     * `(grantor, audience, resource)` replaces the existing row when its `hlc`
-     * is causally newer; an older or equal `hlc` is ignored. Held rows
-     * (`audience` is self) and issued rows (`grantor` is self) are distinct keys
-     * and never collide.
-     *
-     * Returns `true` when the stored row is new or materially different from
-     * the prior row (insert, or LWW upsert that changed any of `jti`, `token`,
-     * `act`, `exp`, `group_id`). Returns `false` when the call was a no-op:
-     * either the incoming `hlc` lost LWW against an existing row, or the LWW
-     * upsert won but every content field matched the prior row (identical
-     * re-broadcast). Used by emission gates to suppress duplicate
-     * `delegationTokenAdded` events on idempotent re-stores.
-     */
-    addDelegationToken(token: InsertDelegationToken): Promise<boolean>;
-    getDelegationTokens(params: {
-        grantor: string;
-        audience: string;
-    }): Promise<Array<DelegationToken>>;
-    /**
-     * Return the tokens held by `audience` that are still valid at `atTime`
-     * (`exp > atTime`). `atTime` is a Unix epoch in seconds, matching the
-     * `exp` column. Expired tokens and tokens addressed to other audiences are
-     * excluded.
-     */
-    getHeldTokens(params: {
-        audience: string;
-        atTime: number;
-    }): Promise<Array<DelegationToken>>;
-    listIssuedTokens(grantor: string): Promise<Array<DelegationToken>>;
-    /**
-     * Look up a delegation token by its `jti`. `jti` is not part of the schema's
-     * composite PK `(grantor, audience, resource)`, so the column is non-unique
-     * at the SQL level; in practice every `grantWriteCapability` call mints a
-     * fresh random `jti`, so collisions across distinct `(grantor, audience,
-     * resource)` tuples do not occur. Returns the first matching row, or `null`
-     * when no row exists for the given `jti`.
-     */
-    getDelegationTokenByJti(jti: string): Promise<DelegationToken | null>;
-    /**
-     * Store a revocation record keyed by the revoked capability's `jti`. LWW on
-     * `hlc` — a re-broadcast with an older or equal `hlc` is ignored. Returns
-     * `true` when the row is new, or when LWW won and any content field
-     * (`revoker_did`, `revoked_iat`, `revocation_token`, `verified_at`,
-     * `cap_exp`, `group_id`) materially changed. Returns `false` on a no-op
-     * (lost LWW, or won LWW with byte-identical content). Used by emission
-     * gates to suppress duplicate downstream events on idempotent re-stores.
-     *
-     * `verified_at` is `null` while the revoker-vs-cap-issuer cross-check is
-     * pending; verification flips it via `markRevocationVerified`.
-     */
-    addRevocation(input: InsertRevokedCapability): Promise<boolean>;
-    getRevocation(jti: string): Promise<RevokedCapability | null>;
-    /**
-     * Hot-path check used at mutation-apply time. Returns `true` only when a
-     * row exists for `jti` AND it has been verified against the cap's issuer
-     * (`verified_at IS NOT NULL`). Pending (unverified) revocations do not
-     * gate writes; the gate fails open for light clients that do not
-     * replicate the revocations table.
-     */
-    isRevoked(jti: string): Promise<boolean>;
-    /**
-     * Return verified revocations that target capabilities held by `audience`.
-     * INNER JOIN against `kubun_p2p_delegation_tokens` on `jti` — verified
-     * revocations whose cap row is missing locally are excluded, and
-     * `audience`/`grantor` are sourced from the cap row. Pending revocations
-     * (`verified_at IS NULL`) are not surfaced. No `atTime` filter: verified
-     * revocations remain visible to the audience until lifecycle GC removes
-     * them, even after the underlying cap has expired.
-     */
-    getHeldRevocations(params: {
-        audience: string;
-    }): Promise<Array<HeldRevocation>>;
-    /**
-     * Flip a pending revocation to verified. Idempotent: returns `true` only
-     * when a previously-pending row was updated; returns `false` when the row
-     * is missing or already verified.
-     */
-    markRevocationVerified(jti: string, params: {
-        cap_exp: number;
-        verified_at?: number;
-    }): Promise<boolean>;
-    getPendingRevocationByJti(jti: string): Promise<RevokedCapability | null>;
-    /**
-     * Delete a pending revocation row (`verified_at IS NULL`) for the given
-     * `jti`. Verified rows are preserved — a verified revocation is binding and
-     * must not be removed by this method (use `purgeExpiredRevocations` for
-     * lifecycle cleanup). Returns `true` when a pending row was deleted, `false`
-     * otherwise (no row, or row already verified).
-     *
-     * Used by the cap-arrival cross-check: when a held cap arrives whose issuer
-     * does not match a pre-existing pending revocation's `revoker_did`, the
-     * pending row is treated as a forged broadcast and dropped.
-     */
-    deletePendingRevocation(jti: string): Promise<boolean>;
-    /**
-     * Delete verified revocation rows whose underlying capability expired more
-     * than `graceSeconds` ago (`cap_exp + graceSeconds < now`). Rows with a
-     * NULL `cap_exp` and pending (unverified) rows are preserved — they have
-     * no expiry to compare against. Returns the number of rows deleted.
-     */
-    purgeExpiredRevocations(params: {
-        graceSeconds: number;
-    }): Promise<number>;
-    /**
-     * Delete pending revocation rows (`verified_at IS NULL`) whose `created_at`
-     * is older than `maxAgeSeconds`. Verified rows are preserved regardless of
-     * their `created_at` age. Returns the number of rows deleted.
-     *
-     * A negative `maxAgeSeconds` pushes the threshold into the future and will
-     * delete every pending row regardless of age — intended only for test
-     * scaffolding (avoids needing raw-SQL `UPDATE` to backdate `created_at`).
-     * Do not pass negative values from production code paths.
-     */
-    purgeDeadPendingRevocations(params: {
-        maxAgeSeconds: number;
-    }): Promise<number>;
+     * Fold-authoritative circle projection write: unconditionally set the row for
+     * `id` to the supplied derived state. Distinct from the LWW writers —
+     * `createCircle` (insert-only), `updateCircle` (update-only, clears the
+     * tombstone) and `markCircleRemoved` (earliest-wins LWW). A reproject derives
+     * `hlc` from the winning active entry and `removedAtHLC` from the winning
+     * tombstone (or null when active), then overwrites every projected column so
+     * the row equals exactly what the ledger fold decides regardless of prior
+     * contents. A removed circle keeps a tombstone row (`removed_at_hlc` set), not
+     * a hard delete, so `includeRemoved` reads and the read-ACL joins keep working.
+     */
+    reconcileCircleProjection(params: {
+        id: string;
+        groupID: string;
+        name: string;
+        description: string;
+        catalogIDs: Array<string>;
+        hlc: string;
+        removedAtHLC: string | null;
+    }): Promise<void>;
+    /**
+     * Fold-authoritative circle-member projection write, the member-row analogue
+     * of {@link reconcileCircleProjection}: unconditionally upsert the
+     * `(circleID, memberDID)` row to the derived `(role, hlc, removedAtHLC)` state.
+     * A removed member keeps a tombstone row so the read-ACL joins still gate on
+     * the marker.
+     */
+    reconcileCircleMemberProjection(params: {
+        circleID: string;
+        memberDID: string;
+        role: string;
+        hlc: string;
+        removedAtHLC: string | null;
+    }): Promise<void>;
+    /**
+     * Record the group a delegation `jti` was granted in. Idempotent on `jti`
+     * (the primary key): a re-record for a `jti` already present is a no-op. The
+     * delegation token itself lives in the core delegation store; this edge only
+     * carries the group association the p2p layer needs.
+     */
+    addGroupDelegation(edge: InsertGroupDelegation): Promise<void>;
+    /**
+     * Resolve the group a delegation `jti` was granted in, or `null` when no edge
+     * exists. Used to target revoke broadcasts and to enrich revocation listings
+     * with their originating group.
+     */
+    getGroupIDByJTI(jti: string): Promise<string | null>;
+    /**
+     * Batch variant of {@link getGroupIDByJTI}: resolve the group each `jti` was
+     * granted in, returning a `Map` keyed by `jti`. A `jti` with no edge is absent
+     * from the map. Used to enrich revocation listings without an N+1 lookup.
+     */
+    getGroupIDsByJTIs(jtis: Array<string>): Promise<Map<string, string>>;
     saveMLSState(state: InsertGroupMLSState): Promise<void>;
     getMLSState(groupID: string, deviceID: string): Promise<GroupMLSState | undefined>;
     deleteMLSState(groupID: string, deviceID: string): Promise<void>;
@@ -241,6 +210,31 @@ export type P2PStoreAPI = {
         version: string;
         mlsGroupID: string;
     }): Promise<boolean>;
+    /**
+     * Append a verified ledger entry. Idempotent on `entry_id` (the token
+     * digest): a re-delivered entry is a no-op. `issuer_did` is normalized on
+     * write. Returns `true` when a new row was inserted, `false` on a duplicate.
+     */
+    appendLedgerEntry(entry: InsertControlLedgerEntry): Promise<boolean>;
+    /** All ledger entries for a group, ordered by `(hlc, entry_id)`. */
+    getLedgerEntries(groupID: string): Promise<Array<ControlLedgerEntry>>;
+    /** Ledger entries for a group filtered by `type`, ordered by `(hlc, entry_id)`. */
+    getLedgerEntriesByType(groupID: string, type: string): Promise<Array<ControlLedgerEntry>>;
+    /**
+     * The HLC through which `projection` has been folded for `groupID`, or `null`
+     * when no projection has run yet. A caller treats an entry whose HLC is `>`
+     * this value as in-order (apply incrementally); `<=` or `null` means the
+     * cached projection is no longer a correct fold-through-this-entry and must be
+     * rebuilt from the whole ledger.
+     */
+    getProjectionWatermark(groupID: string, projection: string): Promise<string | null>;
+    /**
+     * Set the `(groupID, projection)` watermark to `hlc`. Overwrite-on-conflict:
+     * the row is unconditionally replaced. Callers must only advance the watermark
+     * — the incremental path passes a value strictly newer than the current one,
+     * and the reproject path passes the true max over the folded ledger.
+     */
+    setProjectionWatermark(groupID: string, projection: string, hlc: string): Promise<void>;
     insertHub(hub: InsertHub): Promise<void>;
     getHub(id: string): Promise<Hub | undefined>;
     getHubByURL(url: string): Promise<Hub | undefined>;
@@ -257,4 +251,4 @@ export type P2PStoreAPI = {
     listGroupsByHubID(hubID: string): Promise<Array<Group>>;
     deleteGroupHubsByHubID(hubID: string): Promise<void>;
 };
-export declare function createP2PStore(db: Kysely<P2PStoreTables>, adapter: Adapter, logger?: Logger): P2PStoreAPI;
+export declare function createP2PStore(db: Kysely<P2PStoreTables>, adapter: Adapter): P2PStoreAPI;

package/lib/api.js

@@ -1 +1,593 @@
-import{getKubunLogger as e}from"@kubun/logger";export function createP2PStore(r,t,u=e("store-p2p")){let i={async createGroup(e){await r.insertInto("kubun_p2p_groups").values({id:e.id,name:e.name,description:e.description,created_by:e.created_by,hlc:e.hlc}).execute()},getGroup:async e=>await r.selectFrom("kubun_p2p_groups").selectAll().where("id","=",e).executeTakeFirst(),async updateGroup(e,u){let i={};null!=u.name&&(i.name=u.name),null!=u.description&&(i.description=u.description),null!=u.hlc&&(i.hlc=u.hlc),i.updated_at=t.encodeTimestamp(new Date),await r.updateTable("kubun_p2p_groups").set(i).where("id","=",e).execute()},async deleteGroup(e){await r.deleteFrom("kubun_p2p_groups").where("id","=",e).execute()},listGroups:async()=>await r.selectFrom("kubun_p2p_groups").selectAll().execute(),async listGroupsOffsetPaged(e){let{limit:t,offset:u}=e,i=r.selectFrom("kubun_p2p_groups").selectAll().orderBy("name");if(null!=u&&(i=i.offset(u)),null!=t){i=i.limit(t+1);let e=await i.execute(),r=e.length>t;return{entries:r?e.slice(0,t):e,hasMore:r}}return{entries:await i.execute(),hasMore:!1}},async addGroupMember(e){await r.insertInto("kubun_p2p_group_members").values({group_id:e.group_id,member_did:e.member_did,role:e.role,hlc:e.hlc}).onConflict(e=>e.columns(["group_id","member_did"]).doUpdateSet(e=>({role:e.ref("excluded.role"),hlc:e.ref("excluded.hlc"),removed_at_hlc:null,updated_at:t.encodeTimestamp(new Date)}))).execute()},async markMemberRemoved(e,u,i){await r.updateTable("kubun_p2p_group_members").set({removed_at_hlc:i,updated_at:t.encodeTimestamp(new Date)}).where("group_id","=",e).where("member_did","=",u).where(e=>e.or([e("removed_at_hlc","is",null),e("removed_at_hlc",">",i)])).execute()},async getMemberRemoval(e,t){let u=await r.selectFrom("kubun_p2p_group_members").select("removed_at_hlc").where("group_id","=",e).where("member_did","=",t).executeTakeFirst();return null==u?void 0:{removed_at_hlc:u.removed_at_hlc}},async removeGroupMember(e,r,t){await i.markMemberRemoved(e,r,t)},getGroupMember:async(e,t)=>await r.selectFrom("kubun_p2p_group_members").selectAll().where("group_id","=",e).where("member_did","=",t).where("removed_at_hlc","is",null).executeTakeFirst(),isGroupMember:async(e,t)=>null!=await r.selectFrom("kubun_p2p_group_members").select("member_did").where("group_id","=",e).where("member_did","=",t).where("removed_at_hlc","is",null).executeTakeFirst(),isMemberOfAnyGroup:async(e,t)=>0!==t.length&&null!=await r.selectFrom("kubun_p2p_group_members").select("group_id").where("member_did","=",e).where("group_id","in",t).where("removed_at_hlc","is",null).limit(1).executeTakeFirst(),listGroupMembers:async e=>await r.selectFrom("kubun_p2p_group_members").selectAll().where("group_id","=",e).where("removed_at_hlc","is",null).execute(),getGroupsForMember:async e=>await r.selectFrom("kubun_p2p_group_members").innerJoin("kubun_p2p_groups","kubun_p2p_groups.id","kubun_p2p_group_members.group_id").selectAll("kubun_p2p_groups").where("kubun_p2p_group_members.member_did","=",e).where("kubun_p2p_group_members.removed_at_hlc","is",null).execute(),async getGroupsForMembers(e){let t=new Map;if(0===e.length)return t;for(let u of(await r.selectFrom("kubun_p2p_group_members").innerJoin("kubun_p2p_groups","kubun_p2p_groups.id","kubun_p2p_group_members.group_id").select(["kubun_p2p_group_members.member_did as member_did","kubun_p2p_groups.id as id","kubun_p2p_groups.name as name","kubun_p2p_groups.description as description","kubun_p2p_groups.created_by as created_by","kubun_p2p_groups.hlc as hlc","kubun_p2p_groups.created_at as created_at","kubun_p2p_groups.updated_at as updated_at"]).where("kubun_p2p_group_members.member_did","in",e).where("kubun_p2p_group_members.removed_at_hlc","is",null).execute())){let{member_did:e,...r}=u,i=t.get(e);null!=i?i.push(r):t.set(e,[r])}return t},async createCircle(e){await r.insertInto("kubun_p2p_circles").values({id:e.id,group_id:e.group_id,name:e.name,description:e.description,catalog_ids:t.encodeJSON(e.catalog_ids),hlc:e.hlc}).execute()},async getCircle(e,t){let u=r.selectFrom("kubun_p2p_circles").selectAll().where("id","=",e);return t?.includeRemoved||(u=u.where("removed_at_hlc","is",null)),await u.executeTakeFirst()},async getCircles(e){let t=new Map;if(0===e.length)return t;for(let u of(await r.selectFrom("kubun_p2p_circles").selectAll().where("id","in",e).execute()))t.set(u.id,u);return t},async updateCircle(e,u){let i={};null!=u.name&&(i.name=u.name),null!=u.description&&(i.description=u.description),null!=u.catalog_ids&&(i.catalog_ids=t.encodeJSON(u.catalog_ids)),null!=u.hlc&&(i.hlc=u.hlc,i.removed_at_hlc=null),i.updated_at=t.encodeTimestamp(new Date),await r.updateTable("kubun_p2p_circles").set(i).where("id","=",e).execute()},async deleteCircle(e){await r.deleteFrom("kubun_p2p_circles").where("id","=",e).execute()},async markCircleRemoved(e,u){await r.updateTable("kubun_p2p_circles").set({removed_at_hlc:u,updated_at:t.encodeTimestamp(new Date)}).where("id","=",e).where(e=>e.or([e("removed_at_hlc","is",null),e("removed_at_hlc",">",u)])).execute()},async listCirclesByGroup(e,t){let u=r.selectFrom("kubun_p2p_circles").selectAll().where("group_id","=",e);return t?.includeRemoved||(u=u.where("removed_at_hlc","is",null)),await u.execute()},async addCircleMember(e){await r.insertInto("kubun_p2p_circle_members").values({circle_id:e.circle_id,member_did:e.member_did,role:e.role,hlc:e.hlc}).onConflict(e=>e.columns(["circle_id","member_did"]).doUpdateSet(e=>({role:e.ref("excluded.role"),hlc:e.ref("excluded.hlc"),removed_at_hlc:null,updated_at:t.encodeTimestamp(new Date)}))).execute()},async removeCircleMember(e,u,i){await r.updateTable("kubun_p2p_circle_members").set({removed_at_hlc:i,updated_at:t.encodeTimestamp(new Date)}).where("circle_id","=",e).where("member_did","=",u).where(e=>e.or([e("removed_at_hlc","is",null),e("removed_at_hlc",">",i)])).execute()},getCircleMember:async(e,t)=>await r.selectFrom("kubun_p2p_circle_members").selectAll().where("circle_id","=",e).where("member_did","=",t).executeTakeFirst(),async listCircleMembers(e,t){let u=r.selectFrom("kubun_p2p_circle_members").selectAll().where("circle_id","=",e);return t?.includeRemoved||(u=u.where("removed_at_hlc","is",null)),await u.execute()},getCirclesForMember:async e=>await r.selectFrom("kubun_p2p_circle_members").innerJoin("kubun_p2p_circles","kubun_p2p_circles.id","kubun_p2p_circle_members.circle_id").selectAll("kubun_p2p_circles").where("kubun_p2p_circle_members.member_did","=",e).where("kubun_p2p_circle_members.removed_at_hlc","is",null).where("kubun_p2p_circles.removed_at_hlc","is",null).execute(),isMemberOfAnyCircle:async(e,t)=>0!==t.length&&null!=await r.selectFrom("kubun_p2p_circle_members").innerJoin("kubun_p2p_circles","kubun_p2p_circles.id","kubun_p2p_circle_members.circle_id").select("kubun_p2p_circle_members.circle_id").where("kubun_p2p_circle_members.member_did","=",e).where("kubun_p2p_circle_members.circle_id","in",t).where("kubun_p2p_circle_members.removed_at_hlc","is",null).where("kubun_p2p_circles.removed_at_hlc","is",null).limit(1).executeTakeFirst(),async addDelegationToken(e){let a,_=await r.selectFrom("kubun_p2p_delegation_tokens").select(["jti","token","act","exp","group_id","hlc"]).where("grantor","=",e.grantor).where("audience","=",e.audience).where("resource","=",e.resource).executeTakeFirst();if(await r.insertInto("kubun_p2p_delegation_tokens").values({jti:e.jti,grantor:e.grantor,audience:e.audience,token:e.token,resource:e.resource,act:e.act,exp:e.exp,group_id:e.group_id,hlc:e.hlc}).onConflict(e=>e.columns(["grantor","audience","resource"]).doUpdateSet(e=>({jti:e.ref("excluded.jti"),token:e.ref("excluded.token"),act:e.ref("excluded.act"),exp:e.ref("excluded.exp"),group_id:e.ref("excluded.group_id"),hlc:e.ref("excluded.hlc"),updated_at:t.encodeTimestamp(new Date)})).where(e=>e("excluded.hlc",">",e.ref("kubun_p2p_delegation_tokens.hlc")))).execute(),a=null==_||!(e.hlc<=_.hlc)&&(_.jti!==e.jti||_.token!==e.token||_.act!==e.act||_.exp!==e.exp||_.group_id!==e.group_id),.01>Math.random())try{await i.purgeExpiredRevocations({graceSeconds:2592e3}),await i.purgeDeadPendingRevocations({maxAgeSeconds:604800})}catch(e){u.warn("revocation GC sweep failed during addDelegationToken: {error}",{error:e})}return a},getDelegationTokens:async e=>await r.selectFrom("kubun_p2p_delegation_tokens").selectAll().where("grantor","=",e.grantor).where("audience","=",e.audience).execute(),getHeldTokens:async e=>await r.selectFrom("kubun_p2p_delegation_tokens").leftJoin("kubun_p2p_revoked_capabilities","kubun_p2p_revoked_capabilities.jti","kubun_p2p_delegation_tokens.jti").selectAll("kubun_p2p_delegation_tokens").where("audience","=",e.audience).where("exp",">",e.atTime).where(e=>e.or([e("kubun_p2p_revoked_capabilities.jti","is",null),e("kubun_p2p_revoked_capabilities.verified_at","is",null)])).execute(),listIssuedTokens:async e=>await r.selectFrom("kubun_p2p_delegation_tokens").selectAll().where("grantor","=",e).execute(),getDelegationTokenByJti:async e=>await r.selectFrom("kubun_p2p_delegation_tokens").selectAll().where("jti","=",e).executeTakeFirst()??null,async addRevocation(e){let u=await r.selectFrom("kubun_p2p_revoked_capabilities").select(["revoker_did","revoked_iat","revocation_token","verified_at","cap_exp","group_id","hlc"]).where("jti","=",e.jti).executeTakeFirst();if(await r.insertInto("kubun_p2p_revoked_capabilities").values({jti:e.jti,revoker_did:e.revoker_did,revoked_iat:e.revoked_iat,revocation_token:e.revocation_token,verified_at:e.verified_at??null,cap_exp:e.cap_exp??null,group_id:e.group_id,hlc:e.hlc}).onConflict(e=>e.column("jti").doUpdateSet(e=>({revoker_did:e.ref("excluded.revoker_did"),revoked_iat:e.ref("excluded.revoked_iat"),revocation_token:e.ref("excluded.revocation_token"),verified_at:e.ref("excluded.verified_at"),cap_exp:e.ref("excluded.cap_exp"),group_id:e.ref("excluded.group_id"),hlc:e.ref("excluded.hlc"),updated_at:t.encodeTimestamp(new Date)})).where(e=>e("excluded.hlc",">",e.ref("kubun_p2p_revoked_capabilities.hlc")))).execute(),null==u)return!0;if(e.hlc<=u.hlc)return!1;let i=e.verified_at??null,a=e.cap_exp??null;return u.revoker_did!==e.revoker_did||u.revoked_iat!==e.revoked_iat||u.revocation_token!==e.revocation_token||u.verified_at!==i||u.cap_exp!==a||u.group_id!==e.group_id},getRevocation:async e=>await r.selectFrom("kubun_p2p_revoked_capabilities").selectAll().where("jti","=",e).executeTakeFirst()??null,isRevoked:async e=>null!=await r.selectFrom("kubun_p2p_revoked_capabilities").select("jti").where("jti","=",e).where("verified_at","is not",null).limit(1).executeTakeFirst(),getHeldRevocations:async e=>(await r.selectFrom("kubun_p2p_revoked_capabilities").innerJoin("kubun_p2p_delegation_tokens","kubun_p2p_delegation_tokens.jti","kubun_p2p_revoked_capabilities.jti").select(["kubun_p2p_revoked_capabilities.jti as jti","kubun_p2p_delegation_tokens.grantor as grantor","kubun_p2p_delegation_tokens.audience as audience","kubun_p2p_revoked_capabilities.revoker_did as revoker_did","kubun_p2p_revoked_capabilities.revoked_iat as revoked_iat","kubun_p2p_revoked_capabilities.verified_at as verified_at","kubun_p2p_revoked_capabilities.cap_exp as cap_exp","kubun_p2p_revoked_capabilities.group_id as group_id"]).where("kubun_p2p_revoked_capabilities.verified_at","is not",null).where("kubun_p2p_delegation_tokens.audience","=",e.audience).execute()).map(e=>({jti:e.jti,grantor:e.grantor,audience:e.audience,revoker_did:e.revoker_did,revoked_iat:e.revoked_iat,verified_at:e.verified_at,cap_exp:e.cap_exp,group_id:e.group_id})),async markRevocationVerified(e,u){let i=u.verified_at??Math.floor(Date.now()/1e3);return((await r.updateTable("kubun_p2p_revoked_capabilities").set({verified_at:i,cap_exp:u.cap_exp,updated_at:t.encodeTimestamp(new Date)}).where("jti","=",e).where("verified_at","is",null).executeTakeFirst()).numUpdatedRows??0n)>0n},getPendingRevocationByJti:async e=>await r.selectFrom("kubun_p2p_revoked_capabilities").selectAll().where("jti","=",e).where("verified_at","is",null).executeTakeFirst()??null,deletePendingRevocation:async e=>((await r.deleteFrom("kubun_p2p_revoked_capabilities").where("jti","=",e).where("verified_at","is",null).executeTakeFirst()).numDeletedRows??0n)>0n,async purgeExpiredRevocations(e){let t=Math.floor(Date.now()/1e3)-e.graceSeconds;return Number((await r.deleteFrom("kubun_p2p_revoked_capabilities").where("verified_at","is not",null).where("cap_exp","is not",null).where("cap_exp","<",t).executeTakeFirst()).numDeletedRows??0n)},async purgeDeadPendingRevocations(e){let u=t.encodeTimestamp(new Date(Date.now()-1e3*e.maxAgeSeconds));return Number((await r.deleteFrom("kubun_p2p_revoked_capabilities").where("verified_at","is",null).where("created_at","<",u).executeTakeFirst()).numDeletedRows??0n)},async saveMLSState(e){await r.insertInto("kubun_p2p_group_mls_state").values({group_id:e.group_id,device_id:e.device_id,mls_state:t.encodeBinary(e.mls_state),credential:e.credential,epoch:e.epoch,root_capability:e.root_capability}).onConflict(e=>e.columns(["group_id","device_id"]).doUpdateSet(e=>({mls_state:e.ref("excluded.mls_state"),credential:e.ref("excluded.credential"),epoch:e.ref("excluded.epoch"),root_capability:e.ref("excluded.root_capability"),updated_at:t.encodeTimestamp(new Date)}))).execute()},getMLSState:async(e,t)=>await r.selectFrom("kubun_p2p_group_mls_state").selectAll().where("group_id","=",e).where("device_id","=",t).executeTakeFirst(),async deleteMLSState(e,t){await r.deleteFrom("kubun_p2p_group_mls_state").where("group_id","=",e).where("device_id","=",t).execute()},listMLSStates:async e=>await r.selectFrom("kubun_p2p_group_mls_state").selectAll().where("group_id","=",e).execute(),async deleteGroupMLSStates(e){await r.deleteFrom("kubun_p2p_group_mls_state").where("group_id","=",e).execute()},async addSyncPeer(e){let u=t.encodeJSON(e.allowed_users),i=t.encodeJSON(e.config);await r.insertInto("kubun_p2p_sync_peers").values({...e,allowed_users:u,config:i}).onConflict(r=>r.column("peer_did").doUpdateSet({endpoint:e.endpoint,mode:e.mode,allowed_users:u,priority:e.priority,trust_level:e.trust_level,config:i,updated_at:e.updated_at})).execute()},getSyncPeer:async e=>await r.selectFrom("kubun_p2p_sync_peers").selectAll().where("peer_did","=",e).executeTakeFirst(),listSyncPeers:async()=>await r.selectFrom("kubun_p2p_sync_peers").selectAll().execute(),async updateSyncPeer(e,u){let i={};null!=u.endpoint&&(i.endpoint=u.endpoint),null!=u.mode&&(i.mode=u.mode),null!=u.allowed_users&&(i.allowed_users=t.encodeJSON(u.allowed_users)),null!=u.priority&&(i.priority=u.priority),null!=u.trust_level&&(i.trust_level=u.trust_level),null!=u.config&&(i.config=t.encodeJSON(u.config)),i.updated_at=Date.now(),await r.updateTable("kubun_p2p_sync_peers").set(i).where("peer_did","=",e).execute()},async removeSyncPeer(e){await r.deleteFrom("kubun_p2p_sync_peers").where("peer_did","=",e).execute()},recordBroadcast:async e=>((await r.insertInto("kubun_p2p_broadcast_log").values({doc_id:e.docID,version:e.version,mls_group_id:e.mlsGroupID}).onConflict(e=>e.columns(["doc_id","version","mls_group_id"]).doNothing()).executeTakeFirst()).numInsertedOrUpdatedRows??0n)>0n,hasBroadcast:async e=>null!=await r.selectFrom("kubun_p2p_broadcast_log").select("doc_id").where("doc_id","=",e.docID).where("version","=",e.version).where("mls_group_id","=",e.mlsGroupID).limit(1).executeTakeFirst(),async insertHub(e){await r.insertInto("kubun_p2p_hubs").values({id:e.id,label:e.label,url:e.url,server_did:e.server_did}).execute()},getHub:async e=>await r.selectFrom("kubun_p2p_hubs").selectAll().where("id","=",e).executeTakeFirst(),getHubByURL:async e=>await r.selectFrom("kubun_p2p_hubs").selectAll().where("url","=",e).executeTakeFirst(),async updateHub(e,u){let i={};void 0!==u.label&&(i.label=u.label),void 0!==u.url&&(i.url=u.url),void 0!==u.server_did&&(i.server_did=u.server_did),i.updated_at=t.encodeTimestamp(new Date),await r.updateTable("kubun_p2p_hubs").set(i).where("id","=",e).execute()},async deleteHub(e){await r.deleteFrom("kubun_p2p_hubs").where("id","=",e).execute()},listHubs:async()=>await r.selectFrom("kubun_p2p_hubs").selectAll().execute(),insertGroupHub:async e=>((await r.insertInto("kubun_p2p_group_hubs").values({group_id:e.group_id,hub_id:e.hub_id}).onConflict(e=>e.columns(["group_id","hub_id"]).doNothing()).executeTakeFirst()).numInsertedOrUpdatedRows??0n)>0n,deleteGroupHub:async e=>((await r.deleteFrom("kubun_p2p_group_hubs").where("group_id","=",e.groupID).where("hub_id","=",e.hubID).executeTakeFirst()).numDeletedRows??0n)>0n,listGroupIDsByHubID:async e=>(await r.selectFrom("kubun_p2p_group_hubs").select("group_id").where("hub_id","=",e).execute()).map(e=>e.group_id),listHubsByGroupID:async e=>await r.selectFrom("kubun_p2p_group_hubs").innerJoin("kubun_p2p_hubs","kubun_p2p_hubs.id","kubun_p2p_group_hubs.hub_id").selectAll("kubun_p2p_hubs").where("kubun_p2p_group_hubs.group_id","=",e).execute(),listGroupsByHubID:async e=>await r.selectFrom("kubun_p2p_group_hubs").innerJoin("kubun_p2p_groups","kubun_p2p_groups.id","kubun_p2p_group_hubs.group_id").select(["kubun_p2p_groups.id as id","kubun_p2p_groups.name as name","kubun_p2p_groups.description as description","kubun_p2p_groups.created_by as created_by","kubun_p2p_groups.hlc as hlc","kubun_p2p_groups.created_at as created_at","kubun_p2p_groups.updated_at as updated_at"]).where("kubun_p2p_group_hubs.hub_id","=",e).execute(),async deleteGroupHubsByHubID(e){await r.deleteFrom("kubun_p2p_group_hubs").where("hub_id","=",e).execute()}};return i}
+import { normalizeDID } from '@kokuin/token';
+// --- Factory function ---
+export function createP2PStore(db, adapter) {
+    const api = {
+        // --- Group operations ---
+        async createGroup (group) {
+            await db.insertInto('kubun_p2p_groups').values({
+                id: group.id,
+                name: group.name,
+                description: group.description,
+                created_by: group.created_by,
+                hlc: group.hlc
+            }).execute();
+        },
+        async getGroup (id) {
+            return await db.selectFrom('kubun_p2p_groups').selectAll().where('id', '=', id).executeTakeFirst();
+        },
+        async updateGroup (id, update) {
+            const values = {};
+            if (update.name != null) values.name = update.name;
+            if (update.description != null) values.description = update.description;
+            if (update.hlc != null) values.hlc = update.hlc;
+            values.updated_at = adapter.encodeTimestamp(new Date());
+            await db.updateTable('kubun_p2p_groups').set(values).where('id', '=', id).execute();
+        },
+        async deleteGroup (id) {
+            await db.deleteFrom('kubun_p2p_groups').where('id', '=', id).execute();
+        },
+        async listGroups () {
+            return await db.selectFrom('kubun_p2p_groups').selectAll().execute();
+        },
+        async listGroupsOffsetPaged (params) {
+            const { limit, offset } = params;
+            let query = db.selectFrom('kubun_p2p_groups').selectAll().orderBy('name');
+            if (offset != null) {
+                query = query.offset(offset);
+            }
+            if (limit != null) {
+                query = query.limit(limit + 1);
+                const rows = await query.execute();
+                const hasMore = rows.length > limit;
+                return {
+                    entries: hasMore ? rows.slice(0, limit) : rows,
+                    hasMore
+                };
+            }
+            const rows = await query.execute();
+            return {
+                entries: rows,
+                hasMore: false
+            };
+        },
+        // --- Group member operations ---
+        async addGroupMember (member) {
+            // Re-adding a previously-removed member clears the tombstone and refreshes
+            // the row's HLC, so a member that left and rejoined is active again.
+            await db.insertInto('kubun_p2p_group_members').values({
+                group_id: member.group_id,
+                member_did: normalizeDID(member.member_did),
+                role: member.role,
+                hlc: member.hlc
+            }).onConflict((oc)=>oc.columns([
+                    'group_id',
+                    'member_did'
+                ]).doUpdateSet((eb)=>({
+                        role: eb.ref('excluded.role'),
+                        hlc: eb.ref('excluded.hlc'),
+                        removed_at_hlc: null,
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    }))).execute();
+        },
+        async addGroupMembers (members) {
+            if (members.length === 0) {
+                return;
+            }
+            await db.insertInto('kubun_p2p_group_members').values(members.map((member)=>({
+                    group_id: member.group_id,
+                    member_did: normalizeDID(member.member_did),
+                    role: member.role,
+                    hlc: member.hlc
+                }))).onConflict((oc)=>oc.columns([
+                    'group_id',
+                    'member_did'
+                ]).doUpdateSet((eb)=>({
+                        role: eb.ref('excluded.role'),
+                        hlc: eb.ref('excluded.hlc'),
+                        removed_at_hlc: null,
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    }))).execute();
+        },
+        // Earliest-wins LWW on `removed_at_hlc`: the update lands only when the row
+        // exists AND it is either not yet tombstoned or the incoming `hlc` precedes
+        // the stored removal HLC. A removal for a `(groupID, memberDID)` with no
+        // local row is ignored — there is no member to tombstone, and creating a
+        // row would leak a phantom member. The string `<` compare mirrors the SQL
+        // LWW used by the delegation-token paths: the serialized HLC form is
+        // lexicographically ordered, so SQL ordering matches HLC ordering.
+        async markMemberRemoved (groupID, memberDID, hlc) {
+            await db.updateTable('kubun_p2p_group_members').set({
+                removed_at_hlc: hlc,
+                updated_at: adapter.encodeTimestamp(new Date())
+            }).where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).where((eb)=>eb.or([
+                    eb('removed_at_hlc', 'is', null),
+                    eb('removed_at_hlc', '>', hlc)
+                ])).execute();
+        },
+        async getMemberRemoval (groupID, memberDID) {
+            const row = await db.selectFrom('kubun_p2p_group_members').select('removed_at_hlc').where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).executeTakeFirst();
+            return row == null ? undefined : {
+                removed_at_hlc: row.removed_at_hlc
+            };
+        },
+        async removeGroupMember (groupID, memberDID, hlc) {
+            await api.markMemberRemoved(groupID, memberDID, hlc);
+        },
+        async getGroupMember (groupID, memberDID) {
+            return await db.selectFrom('kubun_p2p_group_members').selectAll().where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).where('removed_at_hlc', 'is', null).executeTakeFirst();
+        },
+        async isGroupMember (groupID, memberDID) {
+            const row = await db.selectFrom('kubun_p2p_group_members').select('member_did').where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).where('removed_at_hlc', 'is', null).executeTakeFirst();
+            return row != null;
+        },
+        async isGroupMemberAtHLC (groupID, did, atHLC) {
+            let query = db.selectFrom('kubun_p2p_group_members').select('member_did').where('group_id', '=', groupID).where('member_did', '=', normalizeDID(did));
+            if (atHLC == null) {
+                query = query.where('removed_at_hlc', 'is', null);
+            } else {
+                query = query.where((eb)=>eb.or([
+                        eb('removed_at_hlc', 'is', null),
+                        eb('removed_at_hlc', '>', atHLC)
+                    ]));
+            }
+            const row = await query.limit(1).executeTakeFirst();
+            return row != null;
+        },
+        async isGroupAdmin (groupID, did, atHLC) {
+            let query = db.selectFrom('kubun_p2p_group_members').select('member_did').where('group_id', '=', groupID).where('member_did', '=', normalizeDID(did)).where('role', '=', 'admin');
+            if (atHLC == null) {
+                query = query.where('removed_at_hlc', 'is', null);
+            } else {
+                // Admit a write whose HLC strictly precedes the removal HLC; deny
+                // at-or-after. Complements `checkMembership`'s `removed_at_hlc <= hlc`
+                // denial so both agree on the remove-boundary instant.
+                query = query.where((eb)=>eb.or([
+                        eb('removed_at_hlc', 'is', null),
+                        eb('removed_at_hlc', '>', atHLC)
+                    ]));
+            }
+            const row = await query.limit(1).executeTakeFirst();
+            return row != null;
+        },
+        async setGroupMemberRole (groupID, memberDID, role) {
+            // Update-only by design: a missing row leaves the table untouched, so a
+            // role grant can never conjure a phantom member. hlc/removed_at_hlc are
+            // left alone to keep membership LWW and tombstones intact.
+            await db.updateTable('kubun_p2p_group_members').set({
+                role,
+                updated_at: adapter.encodeTimestamp(new Date())
+            }).where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).execute();
+        },
+        async isMemberOfAnyGroup (viewerDID, groupIDs) {
+            if (groupIDs.length === 0) return false;
+            const row = await db.selectFrom('kubun_p2p_group_members').select('group_id').where('member_did', '=', normalizeDID(viewerDID)).where('group_id', 'in', groupIDs).where('removed_at_hlc', 'is', null).limit(1).executeTakeFirst();
+            return row != null;
+        },
+        async listGroupMembers (groupID) {
+            return await db.selectFrom('kubun_p2p_group_members').selectAll().where('group_id', '=', groupID).where('removed_at_hlc', 'is', null).execute();
+        },
+        async getGroupsForMember (memberDID) {
+            return await db.selectFrom('kubun_p2p_group_members').innerJoin('kubun_p2p_groups', 'kubun_p2p_groups.id', 'kubun_p2p_group_members.group_id').selectAll('kubun_p2p_groups').where('kubun_p2p_group_members.member_did', '=', normalizeDID(memberDID)).where('kubun_p2p_group_members.removed_at_hlc', 'is', null).execute();
+        },
+        // Result Map is keyed by the normalized stored `member_did`; callers must
+        // normalize before looking up by key (existing callers iterate `.values()`).
+        async getGroupsForMembers (memberDIDs) {
+            const result = new Map();
+            if (memberDIDs.length === 0) return result;
+            const normalizedDIDs = memberDIDs.map(normalizeDID);
+            const rows = await db.selectFrom('kubun_p2p_group_members').innerJoin('kubun_p2p_groups', 'kubun_p2p_groups.id', 'kubun_p2p_group_members.group_id').select([
+                'kubun_p2p_group_members.member_did as member_did',
+                'kubun_p2p_groups.id as id',
+                'kubun_p2p_groups.name as name',
+                'kubun_p2p_groups.description as description',
+                'kubun_p2p_groups.created_by as created_by',
+                'kubun_p2p_groups.hlc as hlc',
+                'kubun_p2p_groups.created_at as created_at',
+                'kubun_p2p_groups.updated_at as updated_at'
+            ]).where('kubun_p2p_group_members.member_did', 'in', normalizedDIDs).where('kubun_p2p_group_members.removed_at_hlc', 'is', null).execute();
+            for (const row of rows){
+                const { member_did, ...group } = row;
+                const list = result.get(member_did);
+                if (list != null) {
+                    list.push(group);
+                } else {
+                    result.set(member_did, [
+                        group
+                    ]);
+                }
+            }
+            return result;
+        },
+        // --- Circle operations ---
+        async createCircle (circle) {
+            await db.insertInto('kubun_p2p_circles').values({
+                id: circle.id,
+                group_id: circle.group_id,
+                name: circle.name,
+                description: circle.description,
+                catalog_ids: adapter.encodeJSON(circle.catalog_ids),
+                hlc: circle.hlc
+            }).execute();
+        },
+        async getCircle (id, options) {
+            let query = db.selectFrom('kubun_p2p_circles').selectAll().where('id', '=', id);
+            if (!options?.includeRemoved) {
+                query = query.where('removed_at_hlc', 'is', null);
+            }
+            return await query.executeTakeFirst();
+        },
+        async getCircles (ids) {
+            const result = new Map();
+            if (ids.length === 0) return result;
+            const rows = await db.selectFrom('kubun_p2p_circles').selectAll().where('id', 'in', ids).execute();
+            for (const row of rows){
+                result.set(row.id, row);
+            }
+            return result;
+        },
+        async updateCircle (id, update) {
+            const values = {};
+            if (update.name != null) values.name = update.name;
+            if (update.description != null) values.description = update.description;
+            if (update.catalog_ids != null) {
+                values.catalog_ids = adapter.encodeJSON(update.catalog_ids);
+            }
+            if (update.hlc != null) {
+                values.hlc = update.hlc;
+                // A create/update that wins the apply-layer HLC check resurrects a
+                // tombstoned circle: clear the removal alongside the HLC refresh.
+                values.removed_at_hlc = null;
+            }
+            values.updated_at = adapter.encodeTimestamp(new Date());
+            await db.updateTable('kubun_p2p_circles').set(values).where('id', '=', id).execute();
+        },
+        async deleteCircle (id) {
+            await db.deleteFrom('kubun_p2p_circles').where('id', '=', id).execute();
+        },
+        // Earliest-wins LWW on `removed_at_hlc`: the update lands only when the row
+        // exists AND it is either not yet tombstoned or the incoming `hlc` precedes
+        // the stored removal HLC. A removal for a `circleID` with no local row is
+        // ignored — there is no circle to tombstone, and creating a row would leak
+        // a phantom circle.
+        async markCircleRemoved (circleID, hlc) {
+            await db.updateTable('kubun_p2p_circles').set({
+                removed_at_hlc: hlc,
+                updated_at: adapter.encodeTimestamp(new Date())
+            }).where('id', '=', circleID).where((eb)=>eb.or([
+                    eb('removed_at_hlc', 'is', null),
+                    eb('removed_at_hlc', '>', hlc)
+                ])).execute();
+        },
+        async listCirclesByGroup (groupID, options) {
+            let query = db.selectFrom('kubun_p2p_circles').selectAll().where('group_id', '=', groupID);
+            if (!options?.includeRemoved) {
+                query = query.where('removed_at_hlc', 'is', null);
+            }
+            return await query.execute();
+        },
+        async addCircleMember (member) {
+            // Re-adding a previously-removed member clears the tombstone and refreshes
+            // the row's HLC, so a member that left and rejoined is active again.
+            await db.insertInto('kubun_p2p_circle_members').values({
+                circle_id: member.circle_id,
+                member_did: normalizeDID(member.member_did),
+                role: member.role,
+                hlc: member.hlc
+            }).onConflict((oc)=>oc.columns([
+                    'circle_id',
+                    'member_did'
+                ]).doUpdateSet((eb)=>({
+                        role: eb.ref('excluded.role'),
+                        hlc: eb.ref('excluded.hlc'),
+                        removed_at_hlc: null,
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    }))).execute();
+        },
+        // Earliest-wins LWW on `removed_at_hlc`, mirroring `markMemberRemoved`: the
+        // update lands only when the row exists AND it is either not yet tombstoned
+        // or the incoming `hlc` precedes the stored removal HLC. A removal for a
+        // `(circleID, memberDID)` with no local row is ignored — no phantom row is
+        // created.
+        async removeCircleMember (circleID, memberDID, hlc) {
+            await db.updateTable('kubun_p2p_circle_members').set({
+                removed_at_hlc: hlc,
+                updated_at: adapter.encodeTimestamp(new Date())
+            }).where('circle_id', '=', circleID).where('member_did', '=', normalizeDID(memberDID)).where((eb)=>eb.or([
+                    eb('removed_at_hlc', 'is', null),
+                    eb('removed_at_hlc', '>', hlc)
+                ])).execute();
+        },
+        async getCircleMember (circleID, memberDID) {
+            return await db.selectFrom('kubun_p2p_circle_members').selectAll().where('circle_id', '=', circleID).where('member_did', '=', normalizeDID(memberDID)).executeTakeFirst();
+        },
+        async listCircleMembers (circleID, options) {
+            let query = db.selectFrom('kubun_p2p_circle_members').selectAll().where('circle_id', '=', circleID);
+            if (!options?.includeRemoved) {
+                query = query.where('removed_at_hlc', 'is', null);
+            }
+            return await query.execute();
+        },
+        // Read-ACL / sync-scope source: a tombstoned circle or a tombstoned
+        // membership grants no read access, so gate both sides on `removed_at_hlc`.
+        async getCirclesForMember (memberDID) {
+            return await db.selectFrom('kubun_p2p_circle_members').innerJoin('kubun_p2p_circles', 'kubun_p2p_circles.id', 'kubun_p2p_circle_members.circle_id').selectAll('kubun_p2p_circles').where('kubun_p2p_circle_members.member_did', '=', normalizeDID(memberDID)).where('kubun_p2p_circle_members.removed_at_hlc', 'is', null).where('kubun_p2p_circles.removed_at_hlc', 'is', null).execute();
+        },
+        // Read-ACL / sync-scope source: a tombstoned circle or a tombstoned
+        // membership grants no read access, so gate both sides on `removed_at_hlc`.
+        async isMemberOfAnyCircle (memberDID, circleIDs) {
+            if (circleIDs.length === 0) return false;
+            const row = await db.selectFrom('kubun_p2p_circle_members').innerJoin('kubun_p2p_circles', 'kubun_p2p_circles.id', 'kubun_p2p_circle_members.circle_id').select('kubun_p2p_circle_members.circle_id').where('kubun_p2p_circle_members.member_did', '=', normalizeDID(memberDID)).where('kubun_p2p_circle_members.circle_id', 'in', circleIDs).where('kubun_p2p_circle_members.removed_at_hlc', 'is', null).where('kubun_p2p_circles.removed_at_hlc', 'is', null).limit(1).executeTakeFirst();
+            return row != null;
+        },
+        // Unconditional fold-authoritative upsert: every projected column is set
+        // from the supplied derived state, including `removed_at_hlc` (a value
+        // tombstones, null marks active). No HLC guard — the reproject already
+        // resolved the winner via the ledger fold, so the store write must not
+        // re-arbitrate.
+        async reconcileCircleProjection (params) {
+            await db.insertInto('kubun_p2p_circles').values({
+                id: params.id,
+                group_id: params.groupID,
+                name: params.name,
+                description: params.description,
+                catalog_ids: adapter.encodeJSON(params.catalogIDs),
+                hlc: params.hlc,
+                removed_at_hlc: params.removedAtHLC
+            }).onConflict((oc)=>oc.column('id').doUpdateSet((eb)=>({
+                        group_id: eb.ref('excluded.group_id'),
+                        name: eb.ref('excluded.name'),
+                        description: eb.ref('excluded.description'),
+                        catalog_ids: eb.ref('excluded.catalog_ids'),
+                        hlc: eb.ref('excluded.hlc'),
+                        removed_at_hlc: eb.ref('excluded.removed_at_hlc'),
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    }))).execute();
+        },
+        async reconcileCircleMemberProjection (params) {
+            await db.insertInto('kubun_p2p_circle_members').values({
+                circle_id: params.circleID,
+                member_did: normalizeDID(params.memberDID),
+                role: params.role,
+                hlc: params.hlc,
+                removed_at_hlc: params.removedAtHLC
+            }).onConflict((oc)=>oc.columns([
+                    'circle_id',
+                    'member_did'
+                ]).doUpdateSet((eb)=>({
+                        role: eb.ref('excluded.role'),
+                        hlc: eb.ref('excluded.hlc'),
+                        removed_at_hlc: eb.ref('excluded.removed_at_hlc'),
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    }))).execute();
+        },
+        // --- Group-delegation edge operations ---
+        async addGroupDelegation (edge) {
+            await db.insertInto('kubun_p2p_group_delegation').values({
+                group_id: edge.group_id,
+                jti: edge.jti
+            }).onConflict((oc)=>oc.column('jti').doNothing()).execute();
+        },
+        async getGroupIDByJTI (jti) {
+            const row = await db.selectFrom('kubun_p2p_group_delegation').select('group_id').where('jti', '=', jti).executeTakeFirst();
+            return row?.group_id ?? null;
+        },
+        async getGroupIDsByJTIs (jtis) {
+            if (jtis.length === 0) {
+                return new Map();
+            }
+            const rows = await db.selectFrom('kubun_p2p_group_delegation').select([
+                'jti',
+                'group_id'
+            ]).where('jti', 'in', jtis).execute();
+            return new Map(rows.map((row)=>[
+                    row.jti,
+                    row.group_id
+                ]));
+        },
+        // --- MLS state operations ---
+        async saveMLSState (state) {
+            await db.insertInto('kubun_p2p_group_mls_state').values({
+                group_id: state.group_id,
+                device_id: state.device_id,
+                mls_state: adapter.encodeBinary(state.mls_state),
+                credential: state.credential,
+                epoch: state.epoch,
+                root_capability: state.root_capability
+            }).onConflict((oc)=>oc.columns([
+                    'group_id',
+                    'device_id'
+                ]).doUpdateSet((eb)=>({
+                        mls_state: eb.ref('excluded.mls_state'),
+                        credential: eb.ref('excluded.credential'),
+                        epoch: eb.ref('excluded.epoch'),
+                        root_capability: eb.ref('excluded.root_capability'),
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    }))// Monotonic-epoch guard: only overwrite when the incoming epoch is
+                // at least the stored one. The MLS epoch never moves backwards, so a
+                // write carrying a lower epoch is a stale handle re-persisting an
+                // already-superseded ratchet — apply it and we roll the ratchet back.
+                // When this predicate is false the existing row is left untouched
+                // with no error (a silent no-op); a fresh insert has no conflict and
+                // is unaffected. The bound is `<=`, not `<`: decrypting an
+                // application message advances the secret-tree generation WITHIN an
+                // epoch while `epoch` stays constant, so a legitimate same-epoch
+                // re-persist carries a changed `mls_state` blob at the same epoch and
+                // must still win — `<` would reject it and wedge decryption.
+                .where((eb)=>eb('kubun_p2p_group_mls_state.epoch', '<=', eb.ref('excluded.epoch')))).execute();
+        },
+        async getMLSState (groupID, deviceID) {
+            return await db.selectFrom('kubun_p2p_group_mls_state').selectAll().where('group_id', '=', groupID).where('device_id', '=', deviceID).executeTakeFirst();
+        },
+        async deleteMLSState (groupID, deviceID) {
+            await db.deleteFrom('kubun_p2p_group_mls_state').where('group_id', '=', groupID).where('device_id', '=', deviceID).execute();
+        },
+        async listMLSStates (groupID) {
+            return await db.selectFrom('kubun_p2p_group_mls_state').selectAll().where('group_id', '=', groupID).execute();
+        },
+        async deleteGroupMLSStates (groupID) {
+            await db.deleteFrom('kubun_p2p_group_mls_state').where('group_id', '=', groupID).execute();
+        },
+        // --- Sync peer operations ---
+        async addSyncPeer (peer) {
+            const allowedUsers = adapter.encodeJSON(peer.allowed_users);
+            const config = adapter.encodeJSON(peer.config);
+            await db.insertInto('kubun_p2p_sync_peers').values({
+                ...peer,
+                allowed_users: allowedUsers,
+                config
+            }).onConflict((oc)=>oc.column('peer_did').doUpdateSet({
+                    endpoint: peer.endpoint,
+                    mode: peer.mode,
+                    allowed_users: allowedUsers,
+                    priority: peer.priority,
+                    trust_level: peer.trust_level,
+                    config,
+                    updated_at: peer.updated_at
+                })).execute();
+        },
+        async getSyncPeer (peerDID) {
+            return await db.selectFrom('kubun_p2p_sync_peers').selectAll().where('peer_did', '=', peerDID).executeTakeFirst();
+        },
+        async listSyncPeers () {
+            return await db.selectFrom('kubun_p2p_sync_peers').selectAll().execute();
+        },
+        async updateSyncPeer (peerDID, update) {
+            const values = {};
+            if (update.endpoint != null) values.endpoint = update.endpoint;
+            if (update.mode != null) values.mode = update.mode;
+            if (update.allowed_users != null) values.allowed_users = adapter.encodeJSON(update.allowed_users);
+            if (update.priority != null) values.priority = update.priority;
+            if (update.trust_level != null) values.trust_level = update.trust_level;
+            if (update.config != null) values.config = adapter.encodeJSON(update.config);
+            values.updated_at = Date.now();
+            await db.updateTable('kubun_p2p_sync_peers').set(values).where('peer_did', '=', peerDID).execute();
+        },
+        async removeSyncPeer (peerDID) {
+            await db.deleteFrom('kubun_p2p_sync_peers').where('peer_did', '=', peerDID).execute();
+        },
+        // --- Broadcast log operations ---
+        async recordBroadcast (entry) {
+            const result = await db.insertInto('kubun_p2p_broadcast_log').values({
+                doc_id: entry.docID,
+                version: entry.version,
+                mls_group_id: entry.mlsGroupID
+            }).onConflict((oc)=>oc.columns([
+                    'doc_id',
+                    'version',
+                    'mls_group_id'
+                ]).doNothing()).executeTakeFirst();
+            return (result.numInsertedOrUpdatedRows ?? 0n) > 0n;
+        },
+        async hasBroadcast (entry) {
+            const row = await db.selectFrom('kubun_p2p_broadcast_log').select('doc_id').where('doc_id', '=', entry.docID).where('version', '=', entry.version).where('mls_group_id', '=', entry.mlsGroupID).limit(1).executeTakeFirst();
+            return row != null;
+        },
+        // --- Control ledger operations ---
+        async appendLedgerEntry (entry) {
+            const result = await db.insertInto('kubun_p2p_control_ledger').values({
+                group_id: entry.group_id,
+                entry_id: entry.entry_id,
+                type: entry.type,
+                subject: entry.subject,
+                value: adapter.encodeJSON(entry.value),
+                hlc: entry.hlc,
+                issuer_did: normalizeDID(entry.issuer_did),
+                signed_token: entry.signed_token
+            }).onConflict((oc)=>oc.column('entry_id').doNothing()).executeTakeFirst();
+            return (result.numInsertedOrUpdatedRows ?? 0n) > 0n;
+        },
+        async getLedgerEntries (groupID) {
+            return await db.selectFrom('kubun_p2p_control_ledger').selectAll().where('group_id', '=', groupID).orderBy('hlc').orderBy('entry_id').execute();
+        },
+        async getLedgerEntriesByType (groupID, type) {
+            return await db.selectFrom('kubun_p2p_control_ledger').selectAll().where('group_id', '=', groupID).where('type', '=', type).orderBy('hlc').orderBy('entry_id').execute();
+        },
+        // --- Projection state operations ---
+        async getProjectionWatermark (groupID, projection) {
+            const row = await db.selectFrom('kubun_p2p_projection_state').select('projected_through_hlc').where('group_id', '=', groupID).where('projection', '=', projection).executeTakeFirst();
+            return row?.projected_through_hlc ?? null;
+        },
+        // Overwrite-on-conflict: callers only ever advance the watermark, so there
+        // is no need for a SQL max/guard here.
+        async setProjectionWatermark (groupID, projection, hlc) {
+            await db.insertInto('kubun_p2p_projection_state').values({
+                group_id: groupID,
+                projection,
+                projected_through_hlc: hlc
+            }).onConflict((oc)=>oc.columns([
+                    'group_id',
+                    'projection'
+                ]).doUpdateSet((eb)=>({
+                        projected_through_hlc: eb.ref('excluded.projected_through_hlc'),
+                        updated_at: adapter.encodeTimestamp(new Date())
+                    }))).execute();
+        },
+        // --- Hub operations ---
+        async insertHub (hub) {
+            await db.insertInto('kubun_p2p_hubs').values({
+                id: hub.id,
+                label: hub.label,
+                url: hub.url,
+                server_did: hub.server_did
+            }).execute();
+        },
+        async getHub (id) {
+            return await db.selectFrom('kubun_p2p_hubs').selectAll().where('id', '=', id).executeTakeFirst();
+        },
+        async getHubByURL (url) {
+            return await db.selectFrom('kubun_p2p_hubs').selectAll().where('url', '=', url).executeTakeFirst();
+        },
+        async updateHub (id, update) {
+            const values = {};
+            if (update.label !== undefined) values.label = update.label;
+            if (update.url !== undefined) values.url = update.url;
+            if (update.server_did !== undefined) values.server_did = update.server_did;
+            values.updated_at = adapter.encodeTimestamp(new Date());
+            await db.updateTable('kubun_p2p_hubs').set(values).where('id', '=', id).execute();
+        },
+        async deleteHub (id) {
+            await db.deleteFrom('kubun_p2p_hubs').where('id', '=', id).execute();
+        },
+        async listHubs () {
+            return await db.selectFrom('kubun_p2p_hubs').selectAll().execute();
+        },
+        // --- Group-hub binding operations ---
+        async insertGroupHub (binding) {
+            const result = await db.insertInto('kubun_p2p_group_hubs').values({
+                group_id: binding.group_id,
+                hub_id: binding.hub_id
+            }).onConflict((oc)=>oc.columns([
+                    'group_id',
+                    'hub_id'
+                ]).doNothing()).executeTakeFirst();
+            return (result.numInsertedOrUpdatedRows ?? 0n) > 0n;
+        },
+        async deleteGroupHub (params) {
+            const result = await db.deleteFrom('kubun_p2p_group_hubs').where('group_id', '=', params.groupID).where('hub_id', '=', params.hubID).executeTakeFirst();
+            return (result.numDeletedRows ?? 0n) > 0n;
+        },
+        async listGroupIDsByHubID (hubID) {
+            const rows = await db.selectFrom('kubun_p2p_group_hubs').select('group_id').where('hub_id', '=', hubID).execute();
+            return rows.map((r)=>r.group_id);
+        },
+        async listHubsByGroupID (groupID) {
+            return await db.selectFrom('kubun_p2p_group_hubs').innerJoin('kubun_p2p_hubs', 'kubun_p2p_hubs.id', 'kubun_p2p_group_hubs.hub_id').selectAll('kubun_p2p_hubs').where('kubun_p2p_group_hubs.group_id', '=', groupID).execute();
+        },
+        async listGroupsByHubID (hubID) {
+            const rows = await db.selectFrom('kubun_p2p_group_hubs').innerJoin('kubun_p2p_groups', 'kubun_p2p_groups.id', 'kubun_p2p_group_hubs.group_id').select([
+                'kubun_p2p_groups.id as id',
+                'kubun_p2p_groups.name as name',
+                'kubun_p2p_groups.description as description',
+                'kubun_p2p_groups.created_by as created_by',
+                'kubun_p2p_groups.hlc as hlc',
+                'kubun_p2p_groups.created_at as created_at',
+                'kubun_p2p_groups.updated_at as updated_at'
+            ]).where('kubun_p2p_group_hubs.hub_id', '=', hubID).execute();
+            return rows;
+        },
+        async deleteGroupHubsByHubID (hubID) {
+            await db.deleteFrom('kubun_p2p_group_hubs').where('hub_id', '=', hubID).execute();
+        }
+    };
+    return api;
+}

package/lib/definition.js

@@ -1 +1,7 @@
-import{createP2PStore as i}from"./api.js";import{getP2PMigrations as o}from"./migrations.js";export const p2pStoreDefinition={name:"p2p",migrations:o,createAPI:i};
+import { createP2PStore } from './api.js';
+import { getP2PMigrations } from './migrations.js';
+export const p2pStoreDefinition = {
+    name: 'p2p',
+    migrations: getP2PMigrations,
+    createAPI: createP2PStore
+};

package/lib/index.d.ts

@@ -3,7 +3,6 @@ import type { P2PStoreAPI } from './api.js';
 export type { P2PStoreAPI } from './api.js';
 export { createP2PStore } from './api.js';
 export { p2pStoreDefinition } from './definition.js';
-export { createP2PRevocationBackend } from './revocation-backend.js';
 export declare const P2P_STORE: "p2p";
 export declare function getP2PStore(provider: StoreProvider): Promise<P2PStoreAPI>;
-export type { Circle, CircleMember, CircleMemberTable, CircleTable, DelegationToken, DelegationTokenTable, Group, GroupHub, GroupHubTable, GroupMember, GroupMemberTable, GroupMLSState, GroupMLSStateTable, GroupTable, HeldRevocation, Hub, HubTable, InsertCircle, InsertCircleMember, InsertDelegationToken, InsertGroup, InsertGroupHub, InsertGroupMember, InsertGroupMLSState, InsertHub, InsertSyncCheckpoint, InsertSyncPeer, P2PStoreTables, PaginatedResult, PaginationParams, SyncCheckpoint, SyncCheckpointTable, SyncPeer, SyncPeerTable, UpdateGroupMLSState, } from './tables.js';
+export type { Circle, CircleMember, CircleMemberTable, CircleTable, ControlLedgerEntry, ControlLedgerTable, Group, GroupDelegation, GroupDelegationTable, GroupHub, GroupHubTable, GroupMember, GroupMemberTable, GroupMLSState, GroupMLSStateTable, GroupTable, Hub, HubTable, InsertCircle, InsertCircleMember, InsertControlLedgerEntry, InsertGroup, InsertGroupDelegation, InsertGroupHub, InsertGroupMember, InsertGroupMLSState, InsertHub, InsertProjectionState, InsertSyncCheckpoint, InsertSyncPeer, P2PStoreTables, PaginatedResult, PaginationParams, ProjectionState, ProjectionStateTable, SyncCheckpoint, SyncCheckpointTable, SyncPeer, SyncPeerTable, UpdateGroupMLSState, } from './tables.js';

package/lib/index.js

@@ -1 +1,6 @@
-export{createP2PStore}from"./api.js";export{p2pStoreDefinition}from"./definition.js";export{createP2PRevocationBackend}from"./revocation-backend.js";export const P2P_STORE="p2p";export function getP2PStore(e){return e.getStore("p2p")}
+export { createP2PStore } from './api.js';
+export { p2pStoreDefinition } from './definition.js';
+export const P2P_STORE = 'p2p';
+export function getP2PStore(provider) {
+    return provider.getStore(P2P_STORE);
+}

package/lib/migrations.js

@@ -1 +1,105 @@
-export function getP2PMigrations(e){let t=e.types,a=e.functions.now;return{"0-init":{async up(e){await e.schema.createTable("kubun_p2p_groups").ifNotExists().addColumn("id",t.text,e=>e.notNull().primaryKey()).addColumn("name",t.text,e=>e.notNull()).addColumn("description",t.text,e=>e.notNull().defaultTo("")).addColumn("created_by",t.text,e=>e.notNull()).addColumn("hlc",t.text,e=>e.notNull()).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addColumn("updated_at",t.timestamp).execute(),await e.schema.createTable("kubun_p2p_group_members").ifNotExists().addColumn("group_id",t.text,e=>e.notNull()).addColumn("member_did",t.text,e=>e.notNull()).addColumn("role",t.text,e=>e.notNull().defaultTo("member")).addColumn("hlc",t.text,e=>e.notNull()).addColumn("removed_at_hlc",t.text).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addColumn("updated_at",t.timestamp).addPrimaryKeyConstraint("pk_p2p_group_members",["group_id","member_did"]).execute(),await e.schema.createIndex("idx_p2p_group_members_did").ifNotExists().on("kubun_p2p_group_members").column("member_did").execute(),await e.schema.createTable("kubun_p2p_circles").ifNotExists().addColumn("id",t.text,e=>e.notNull().primaryKey()).addColumn("group_id",t.text,e=>e.notNull()).addColumn("name",t.text,e=>e.notNull()).addColumn("description",t.text,e=>e.notNull().defaultTo("")).addColumn("catalog_ids",t.json,e=>e.notNull().defaultTo("[]")).addColumn("hlc",t.text,e=>e.notNull()).addColumn("removed_at_hlc",t.text).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addColumn("updated_at",t.timestamp).execute(),await e.schema.createIndex("idx_p2p_circles_group").ifNotExists().on("kubun_p2p_circles").column("group_id").execute(),await e.schema.createTable("kubun_p2p_circle_members").ifNotExists().addColumn("circle_id",t.text,e=>e.notNull()).addColumn("member_did",t.text,e=>e.notNull()).addColumn("role",t.text,e=>e.notNull().defaultTo("member")).addColumn("hlc",t.text,e=>e.notNull()).addColumn("removed_at_hlc",t.text).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addColumn("updated_at",t.timestamp).addPrimaryKeyConstraint("pk_p2p_circle_members",["circle_id","member_did"]).execute(),await e.schema.createIndex("idx_p2p_circle_members_did").ifNotExists().on("kubun_p2p_circle_members").column("member_did").execute(),await e.schema.createTable("kubun_p2p_delegation_tokens").ifNotExists().addColumn("jti",t.text,e=>e.notNull()).addColumn("grantor",t.text,e=>e.notNull()).addColumn("audience",t.text,e=>e.notNull()).addColumn("token",t.text,e=>e.notNull()).addColumn("resource",t.text,e=>e.notNull()).addColumn("act",t.text,e=>e.notNull()).addColumn("exp","integer",e=>e.notNull()).addColumn("group_id",t.text,e=>e.notNull()).addColumn("hlc",t.text,e=>e.notNull()).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addColumn("updated_at",t.timestamp).addPrimaryKeyConstraint("pk_p2p_delegation_tokens",["grantor","audience","resource"]).execute(),await e.schema.createIndex("idx_p2p_delegation_tokens_grantor_audience").ifNotExists().on("kubun_p2p_delegation_tokens").columns(["grantor","audience"]).execute(),await e.schema.createIndex("idx_p2p_delegation_tokens_audience_exp").ifNotExists().on("kubun_p2p_delegation_tokens").columns(["audience","exp"]).execute(),await e.schema.createIndex("idx_p2p_delegation_tokens_jti").ifNotExists().on("kubun_p2p_delegation_tokens").column("jti").execute(),await e.schema.createTable("kubun_p2p_revoked_capabilities").ifNotExists().addColumn("jti",t.text,e=>e.notNull().primaryKey()).addColumn("revoker_did",t.text,e=>e.notNull()).addColumn("revoked_iat","integer",e=>e.notNull()).addColumn("revocation_token",t.text,e=>e.notNull()).addColumn("verified_at","integer").addColumn("cap_exp","integer").addColumn("group_id",t.text,e=>e.notNull()).addColumn("hlc",t.text,e=>e.notNull()).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addColumn("updated_at",t.timestamp).execute(),await e.schema.createIndex("idx_p2p_revoked_capabilities_verified_cap_exp").ifNotExists().on("kubun_p2p_revoked_capabilities").columns(["verified_at","cap_exp"]).execute(),await e.schema.createTable("kubun_p2p_group_mls_state").ifNotExists().addColumn("group_id",t.text,e=>e.notNull()).addColumn("device_id",t.text,e=>e.notNull()).addColumn("mls_state",t.binary,e=>e.notNull()).addColumn("credential",t.text,e=>e.notNull()).addColumn("epoch","integer",e=>e.notNull()).addColumn("root_capability",t.text,e=>e.notNull().defaultTo("")).addColumn("updated_at",t.timestamp,e=>e.defaultTo(a).notNull()).addPrimaryKeyConstraint("pk_p2p_group_mls_state",["group_id","device_id"]).execute(),await e.schema.createTable("kubun_p2p_sync_peers").ifNotExists().addColumn("id",t.text,e=>e.notNull().primaryKey()).addColumn("peer_did",t.text,e=>e.notNull().unique()).addColumn("endpoint",t.text,e=>e.notNull()).addColumn("mode",t.text,e=>e.notNull()).addColumn("allowed_users",t.json,e=>e.notNull()).addColumn("priority",t.text,e=>e.notNull().defaultTo("0")).addColumn("trust_level",t.text,e=>e.notNull()).addColumn("config",t.json,e=>e.notNull()).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addColumn("updated_at",t.timestamp,e=>e.defaultTo(a).notNull()).execute(),await e.schema.createTable("kubun_p2p_sync_checkpoints").ifNotExists().addColumn("id",t.text,e=>e.notNull().primaryKey()).addColumn("peer_did",t.text,e=>e.notNull()).addColumn("scope",t.text,e=>e.notNull()).addColumn("checkpoint_hlc",t.text,e=>e.notNull()).addColumn("updated_at",t.timestamp,e=>e.defaultTo(a).notNull()).execute(),await e.schema.createTable("kubun_p2p_broadcast_log").ifNotExists().addColumn("doc_id",t.text,e=>e.notNull()).addColumn("version",t.text,e=>e.notNull()).addColumn("mls_group_id",t.text,e=>e.notNull()).addColumn("broadcast_at",t.timestamp,e=>e.defaultTo(a).notNull()).addPrimaryKeyConstraint("pk_p2p_broadcast_log",["doc_id","version","mls_group_id"]).execute(),await e.schema.createIndex("idx_p2p_broadcast_log_doc").ifNotExists().on("kubun_p2p_broadcast_log").column("doc_id").execute(),await e.schema.createTable("kubun_p2p_hubs").ifNotExists().addColumn("id",t.text,e=>e.notNull().primaryKey()).addColumn("label",t.text).addColumn("url",t.text,e=>e.notNull().unique()).addColumn("server_did",t.text).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addColumn("updated_at",t.timestamp).execute(),await e.schema.createTable("kubun_p2p_group_hubs").ifNotExists().addColumn("group_id",t.text,e=>e.notNull()).addColumn("hub_id",t.text,e=>e.notNull()).addColumn("created_at",t.timestamp,e=>e.defaultTo(a).notNull()).addPrimaryKeyConstraint("pk_p2p_group_hubs",["group_id","hub_id"]).execute(),await e.schema.createIndex("idx_p2p_group_hubs_hub").ifNotExists().on("kubun_p2p_group_hubs").column("hub_id").execute()},async down(e){await e.schema.dropTable("kubun_p2p_group_hubs").ifExists().execute(),await e.schema.dropTable("kubun_p2p_hubs").ifExists().execute(),await e.schema.dropTable("kubun_p2p_broadcast_log").ifExists().execute(),await e.schema.dropTable("kubun_p2p_sync_checkpoints").ifExists().execute(),await e.schema.dropTable("kubun_p2p_sync_peers").ifExists().execute(),await e.schema.dropTable("kubun_p2p_group_mls_state").ifExists().execute(),await e.schema.dropTable("kubun_p2p_revoked_capabilities").ifExists().execute(),await e.schema.dropTable("kubun_p2p_delegation_tokens").ifExists().execute(),await e.schema.dropTable("kubun_p2p_circle_members").ifExists().execute(),await e.schema.dropTable("kubun_p2p_circles").ifExists().execute(),await e.schema.dropTable("kubun_p2p_group_members").ifExists().execute(),await e.schema.dropTable("kubun_p2p_groups").ifExists().execute()}}}}
+export function getP2PMigrations(ctx) {
+    const t = ctx.types;
+    const now = ctx.functions.now;
+    const init = {
+        async up (db) {
+            // Groups
+            await db.schema.createTable('kubun_p2p_groups').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('name', t.text, (col)=>col.notNull()).addColumn('description', t.text, (col)=>col.notNull().defaultTo('')).addColumn('created_by', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).execute();
+            // Group members
+            await db.schema.createTable('kubun_p2p_group_members').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('member_did', t.text, (col)=>col.notNull()).addColumn('role', t.text, (col)=>col.notNull().defaultTo('member'))// LWW version key for the row, set on insert and refreshed on re-add.
+            .addColumn('hlc', t.text, (col)=>col.notNull())// HLC at which this peer learned the member was removed from the MLS
+            // group. NULL means the member is active; a non-null value tombstones
+            // the row so read-ACL / sync-scope queries exclude it while the
+            // apply-time check can still compare against the removal HLC.
+            .addColumn('removed_at_hlc', t.text).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).addPrimaryKeyConstraint('pk_p2p_group_members', [
+                'group_id',
+                'member_did'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_group_members_did').ifNotExists().on('kubun_p2p_group_members').column('member_did').execute();
+            // Circles
+            await db.schema.createTable('kubun_p2p_circles').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('name', t.text, (col)=>col.notNull()).addColumn('description', t.text, (col)=>col.notNull().defaultTo('')).addColumn('catalog_ids', t.json, (col)=>col.notNull().defaultTo('[]')).addColumn('hlc', t.text, (col)=>col.notNull())// NULL means the circle is active; a non-null value tombstones the row
+            // so reads exclude it while the removal HLC stays comparable.
+            .addColumn('removed_at_hlc', t.text).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).execute();
+            await db.schema.createIndex('idx_p2p_circles_group').ifNotExists().on('kubun_p2p_circles').column('group_id').execute();
+            // Circle members
+            await db.schema.createTable('kubun_p2p_circle_members').ifNotExists().addColumn('circle_id', t.text, (col)=>col.notNull()).addColumn('member_did', t.text, (col)=>col.notNull()).addColumn('role', t.text, (col)=>col.notNull().defaultTo('member')).addColumn('hlc', t.text, (col)=>col.notNull())// NULL means the circle member is active; a non-null value tombstones
+            // the row so reads exclude it while the removal HLC stays comparable.
+            .addColumn('removed_at_hlc', t.text).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).addPrimaryKeyConstraint('pk_p2p_circle_members', [
+                'circle_id',
+                'member_did'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_circle_members_did').ifNotExists().on('kubun_p2p_circle_members').column('member_did').execute();
+            // Group-delegation edge. The delegation token and revocation rows live in
+            // the core delegation store (group-agnostic); this thin edge records the
+            // one group a delegation `jti` was granted in, so the p2p layer can still
+            // resolve a cap's group for revoke-broadcast targeting and listing
+            // enrichment. One group per `jti`, so `jti` is the primary key.
+            await db.schema.createTable('kubun_p2p_group_delegation').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('jti', t.text, (col)=>col.notNull().primaryKey()).execute();
+            // Group MLS state
+            await db.schema.createTable('kubun_p2p_group_mls_state').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('device_id', t.text, (col)=>col.notNull()).addColumn('mls_state', t.binary, (col)=>col.notNull()).addColumn('credential', t.text, (col)=>col.notNull()).addColumn('epoch', 'integer', (col)=>col.notNull()).addColumn('root_capability', t.text, (col)=>col.notNull().defaultTo('')).addColumn('updated_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_p2p_group_mls_state', [
+                'group_id',
+                'device_id'
+            ]).execute();
+            // Sync peers
+            await db.schema.createTable('kubun_p2p_sync_peers').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('peer_did', t.text, (col)=>col.notNull().unique()).addColumn('endpoint', t.text, (col)=>col.notNull()).addColumn('mode', t.text, (col)=>col.notNull()).addColumn('allowed_users', t.json, (col)=>col.notNull()).addColumn('priority', t.text, (col)=>col.notNull().defaultTo('0')).addColumn('trust_level', t.text, (col)=>col.notNull()).addColumn('config', t.json, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).execute();
+            // Sync checkpoints
+            await db.schema.createTable('kubun_p2p_sync_checkpoints').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('peer_did', t.text, (col)=>col.notNull()).addColumn('scope', t.text, (col)=>col.notNull()).addColumn('checkpoint_hlc', t.text, (col)=>col.notNull()).addColumn('updated_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).execute();
+            // Broadcast log
+            await db.schema.createTable('kubun_p2p_broadcast_log').ifNotExists().addColumn('doc_id', t.text, (col)=>col.notNull()).addColumn('version', t.text, (col)=>col.notNull()).addColumn('mls_group_id', t.text, (col)=>col.notNull()).addColumn('broadcast_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_p2p_broadcast_log', [
+                'doc_id',
+                'version',
+                'mls_group_id'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_broadcast_log_doc').ifNotExists().on('kubun_p2p_broadcast_log').column('doc_id').execute();
+            // Hubs (device-local, never synced — no hlc column)
+            await db.schema.createTable('kubun_p2p_hubs').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('label', t.text).addColumn('url', t.text, (col)=>col.notNull().unique()).addColumn('server_did', t.text).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).execute();
+            // Group hubs (join table, device-local — no hlc column)
+            await db.schema.createTable('kubun_p2p_group_hubs').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('hub_id', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_p2p_group_hubs', [
+                'group_id',
+                'hub_id'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_group_hubs_hub').ifNotExists().on('kubun_p2p_group_hubs').column('hub_id').execute();
+            // Control ledger: append-only signed-claim log. `entry_id` (content
+            // digest of `signed_token`) is the primary key, so a re-delivered entry
+            // is a no-op insert. Rows are read ordered by `(hlc, entry_id)` for a
+            // deterministic reducer fold; index that pair scoped to the group.
+            await db.schema.createTable('kubun_p2p_control_ledger').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('entry_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('type', t.text, (col)=>col.notNull()).addColumn('subject', t.text, (col)=>col.notNull()).addColumn('value', t.json, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('issuer_did', t.text, (col)=>col.notNull()).addColumn('signed_token', t.text, (col)=>col.notNull()).addColumn('received_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).execute();
+            await db.schema.createIndex('idx_p2p_control_ledger_group_order').ifNotExists().on('kubun_p2p_control_ledger').columns([
+                'group_id',
+                'hlc',
+                'entry_id'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_control_ledger_group_type').ifNotExists().on('kubun_p2p_control_ledger').columns([
+                'group_id',
+                'type'
+            ]).execute();
+            // Projection watermark: how far a given `(group, projection)` fold has
+            // been materialized. An in-order entry (hlc > watermark) applies
+            // incrementally and advances this; an out-of-order or absent watermark
+            // triggers a full reproject. The projection is disposable — this row only
+            // optimizes away re-folding the whole ledger per receive.
+            await db.schema.createTable('kubun_p2p_projection_state').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('projection', t.text, (col)=>col.notNull()).addColumn('projected_through_hlc', t.text, (col)=>col.notNull()).addColumn('updated_at', t.timestamp).addPrimaryKeyConstraint('pk_p2p_projection_state', [
+                'group_id',
+                'projection'
+            ]).execute();
+        },
+        async down (db) {
+            await db.schema.dropTable('kubun_p2p_projection_state').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_control_ledger').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_group_hubs').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_hubs').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_broadcast_log').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_sync_checkpoints').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_sync_peers').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_group_mls_state').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_group_delegation').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_circle_members').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_circles').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_group_members').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_groups').ifExists().execute();
+        }
+    };
+    return {
+        '0-init': init
+    };
+}

package/lib/tables.d.ts

@@ -50,45 +50,12 @@ export type CircleMemberTable = {
 };
 export type CircleMember = Selectable<CircleMemberTable>;
 export type InsertCircleMember = Insertable<CircleMemberTable>;
-export type DelegationTokenTable = {
-    jti: string;
-    grantor: string;
-    audience: string;
-    token: string;
-    resource: string;
-    act: string;
-    exp: number;
+export type GroupDelegationTable = {
     group_id: string;
-    hlc: string;
-    created_at: CreatedAtColumn;
-    updated_at: UpdatedAtColumn;
-};
-export type DelegationToken = Selectable<DelegationTokenTable>;
-export type InsertDelegationToken = Insertable<DelegationTokenTable>;
-export type RevokedCapabilityTable = {
-    jti: string;
-    revoker_did: string;
-    revoked_iat: number;
-    revocation_token: string;
-    verified_at: number | null;
-    cap_exp: number | null;
-    group_id: string;
-    hlc: string;
-    created_at: CreatedAtColumn;
-    updated_at: UpdatedAtColumn;
-};
-export type RevokedCapability = Selectable<RevokedCapabilityTable>;
-export type InsertRevokedCapability = Insertable<RevokedCapabilityTable>;
-export type HeldRevocation = {
     jti: string;
-    grantor: string;
-    audience: string;
-    revoker_did: string;
-    revoked_iat: number;
-    verified_at: number;
-    cap_exp: number | null;
-    group_id: string;
 };
+export type GroupDelegation = Selectable<GroupDelegationTable>;
+export type InsertGroupDelegation = Insertable<GroupDelegationTable>;
 export type GroupMLSStateTable = {
     group_id: string;
     device_id: string;
@@ -134,6 +101,27 @@ export type BroadcastLogTable = {
 };
 export type BroadcastLogEntry = Selectable<BroadcastLogTable>;
 export type InsertBroadcastLogEntry = Insertable<BroadcastLogTable>;
+export type ControlLedgerTable = {
+    group_id: string;
+    entry_id: string;
+    type: string;
+    subject: string;
+    value: JSONValueColumn<unknown>;
+    hlc: string;
+    issuer_did: string;
+    signed_token: string;
+    received_at: CreatedAtColumn;
+};
+export type ControlLedgerEntry = Selectable<ControlLedgerTable>;
+export type InsertControlLedgerEntry = Insertable<ControlLedgerTable>;
+export type ProjectionStateTable = {
+    group_id: string;
+    projection: string;
+    projected_through_hlc: string;
+    updated_at: UpdatedAtColumn;
+};
+export type ProjectionState = Selectable<ProjectionStateTable>;
+export type InsertProjectionState = Insertable<ProjectionStateTable>;
 export type HubTable = {
     id: string;
     label: string | null;
@@ -164,12 +152,13 @@ export type P2PStoreTables = {
     kubun_p2p_group_members: GroupMemberTable;
     kubun_p2p_circles: CircleTable;
     kubun_p2p_circle_members: CircleMemberTable;
-    kubun_p2p_delegation_tokens: DelegationTokenTable;
-    kubun_p2p_revoked_capabilities: RevokedCapabilityTable;
+    kubun_p2p_group_delegation: GroupDelegationTable;
     kubun_p2p_group_mls_state: GroupMLSStateTable;
     kubun_p2p_sync_peers: SyncPeerTable;
     kubun_p2p_sync_checkpoints: SyncCheckpointTable;
     kubun_p2p_broadcast_log: BroadcastLogTable;
+    kubun_p2p_control_ledger: ControlLedgerTable;
+    kubun_p2p_projection_state: ProjectionStateTable;
     kubun_p2p_hubs: HubTable;
     kubun_p2p_group_hubs: GroupHubTable;
 };

package/lib/tables.js

@@ -1 +1,2 @@
-export{};
+// --- Aggregate P2PStoreTables type ---
+export { };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/store-p2p",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "license": "see LICENSE.md",
   "keywords": [],
   "type": "module",
@@ -15,21 +15,22 @@
   ],
   "sideEffects": false,
   "dependencies": {
-    "@enkaku/capability": "^0.16.0",
+    "@kokuin/capability": "^0.1.0",
+    "@kokuin/token": "^0.1.1",
     "kysely": "^0.29.2",
-    "@kubun/db-adapter": "^0.10.0",
-    "@kubun/db": "^0.10.0",
-    "@kubun/logger": "^0.10.0"
+    "@kubun/db": "^0.11.0",
+    "@kubun/logger": "^0.11.0",
+    "@kubun/db-adapter": "^0.11.0"
   },
   "devDependencies": {
-    "@testcontainers/postgresql": "^12.0.1",
-    "@kubun/db-postgres": "^0.10.0",
-    "@kubun/hlc": "^0.10.1",
-    "@kubun/db-better-sqlite": "^0.10.0"
+    "@testcontainers/postgresql": "^12.0.4",
+    "@kubun/db-better-sqlite": "^0.11.0",
+    "@kubun/db-postgres": "^0.11.0",
+    "@kubun/hlc": "^0.11.0"
   },
   "scripts": {
     "build:clean": "del lib",
-    "build:js": "swc src -d ./lib --config-file ../../swc.json --strip-leading-paths",
+    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
     "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
     "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
     "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",

package/lib/revocation-backend.d.ts

@@ -1,3 +0,0 @@
-import type { RevocationBackend } from '@enkaku/capability';
-import type { P2PStoreAPI } from './api.js';
-export declare function createP2PRevocationBackend(api: P2PStoreAPI): RevocationBackend;

package/lib/revocation-backend.js

@@ -1 +0,0 @@
-export function createP2PRevocationBackend(e){return{async add(e){},isRevoked:async a=>await e.isRevoked(a)}}