@kubun/store-p2p 0.11.0 → 0.12.0

package/lib/api.js

@@ -1,593 +1,22 @@
-import { normalizeDID } from '@kokuin/token';
-// --- Factory function ---
+import { createAppLaneOps } from './ops/app-lane.js';
+import { createCircleOps } from './ops/circles.js';
+import { createControlOps } from './ops/control.js';
+import { createDelegationOps } from './ops/delegations.js';
+import { createDiscoveryOps } from './ops/discovery.js';
+import { createGroupOps } from './ops/groups.js';
+import { createHubOps } from './ops/hubs.js';
+import { createMLSOps } from './ops/mls.js';
+import { createSyncOps } from './ops/sync.js';
 export function createP2PStore(db, adapter) {
-    const api = {
-        // --- Group operations ---
-        async createGroup (group) {
-            await db.insertInto('kubun_p2p_groups').values({
-                id: group.id,
-                name: group.name,
-                description: group.description,
-                created_by: group.created_by,
-                hlc: group.hlc
-            }).execute();
-        },
-        async getGroup (id) {
-            return await db.selectFrom('kubun_p2p_groups').selectAll().where('id', '=', id).executeTakeFirst();
-        },
-        async updateGroup (id, update) {
-            const values = {};
-            if (update.name != null) values.name = update.name;
-            if (update.description != null) values.description = update.description;
-            if (update.hlc != null) values.hlc = update.hlc;
-            values.updated_at = adapter.encodeTimestamp(new Date());
-            await db.updateTable('kubun_p2p_groups').set(values).where('id', '=', id).execute();
-        },
-        async deleteGroup (id) {
-            await db.deleteFrom('kubun_p2p_groups').where('id', '=', id).execute();
-        },
-        async listGroups () {
-            return await db.selectFrom('kubun_p2p_groups').selectAll().execute();
-        },
-        async listGroupsOffsetPaged (params) {
-            const { limit, offset } = params;
-            let query = db.selectFrom('kubun_p2p_groups').selectAll().orderBy('name');
-            if (offset != null) {
-                query = query.offset(offset);
-            }
-            if (limit != null) {
-                query = query.limit(limit + 1);
-                const rows = await query.execute();
-                const hasMore = rows.length > limit;
-                return {
-                    entries: hasMore ? rows.slice(0, limit) : rows,
-                    hasMore
-                };
-            }
-            const rows = await query.execute();
-            return {
-                entries: rows,
-                hasMore: false
-            };
-        },
-        // --- Group member operations ---
-        async addGroupMember (member) {
-            // Re-adding a previously-removed member clears the tombstone and refreshes
-            // the row's HLC, so a member that left and rejoined is active again.
-            await db.insertInto('kubun_p2p_group_members').values({
-                group_id: member.group_id,
-                member_did: normalizeDID(member.member_did),
-                role: member.role,
-                hlc: member.hlc
-            }).onConflict((oc)=>oc.columns([
-                    'group_id',
-                    'member_did'
-                ]).doUpdateSet((eb)=>({
-                        role: eb.ref('excluded.role'),
-                        hlc: eb.ref('excluded.hlc'),
-                        removed_at_hlc: null,
-                        updated_at: adapter.encodeTimestamp(new Date())
-                    }))).execute();
-        },
-        async addGroupMembers (members) {
-            if (members.length === 0) {
-                return;
-            }
-            await db.insertInto('kubun_p2p_group_members').values(members.map((member)=>({
-                    group_id: member.group_id,
-                    member_did: normalizeDID(member.member_did),
-                    role: member.role,
-                    hlc: member.hlc
-                }))).onConflict((oc)=>oc.columns([
-                    'group_id',
-                    'member_did'
-                ]).doUpdateSet((eb)=>({
-                        role: eb.ref('excluded.role'),
-                        hlc: eb.ref('excluded.hlc'),
-                        removed_at_hlc: null,
-                        updated_at: adapter.encodeTimestamp(new Date())
-                    }))).execute();
-        },
-        // Earliest-wins LWW on `removed_at_hlc`: the update lands only when the row
-        // exists AND it is either not yet tombstoned or the incoming `hlc` precedes
-        // the stored removal HLC. A removal for a `(groupID, memberDID)` with no
-        // local row is ignored — there is no member to tombstone, and creating a
-        // row would leak a phantom member. The string `<` compare mirrors the SQL
-        // LWW used by the delegation-token paths: the serialized HLC form is
-        // lexicographically ordered, so SQL ordering matches HLC ordering.
-        async markMemberRemoved (groupID, memberDID, hlc) {
-            await db.updateTable('kubun_p2p_group_members').set({
-                removed_at_hlc: hlc,
-                updated_at: adapter.encodeTimestamp(new Date())
-            }).where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).where((eb)=>eb.or([
-                    eb('removed_at_hlc', 'is', null),
-                    eb('removed_at_hlc', '>', hlc)
-                ])).execute();
-        },
-        async getMemberRemoval (groupID, memberDID) {
-            const row = await db.selectFrom('kubun_p2p_group_members').select('removed_at_hlc').where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).executeTakeFirst();
-            return row == null ? undefined : {
-                removed_at_hlc: row.removed_at_hlc
-            };
-        },
-        async removeGroupMember (groupID, memberDID, hlc) {
-            await api.markMemberRemoved(groupID, memberDID, hlc);
-        },
-        async getGroupMember (groupID, memberDID) {
-            return await db.selectFrom('kubun_p2p_group_members').selectAll().where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).where('removed_at_hlc', 'is', null).executeTakeFirst();
-        },
-        async isGroupMember (groupID, memberDID) {
-            const row = await db.selectFrom('kubun_p2p_group_members').select('member_did').where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).where('removed_at_hlc', 'is', null).executeTakeFirst();
-            return row != null;
-        },
-        async isGroupMemberAtHLC (groupID, did, atHLC) {
-            let query = db.selectFrom('kubun_p2p_group_members').select('member_did').where('group_id', '=', groupID).where('member_did', '=', normalizeDID(did));
-            if (atHLC == null) {
-                query = query.where('removed_at_hlc', 'is', null);
-            } else {
-                query = query.where((eb)=>eb.or([
-                        eb('removed_at_hlc', 'is', null),
-                        eb('removed_at_hlc', '>', atHLC)
-                    ]));
-            }
-            const row = await query.limit(1).executeTakeFirst();
-            return row != null;
-        },
-        async isGroupAdmin (groupID, did, atHLC) {
-            let query = db.selectFrom('kubun_p2p_group_members').select('member_did').where('group_id', '=', groupID).where('member_did', '=', normalizeDID(did)).where('role', '=', 'admin');
-            if (atHLC == null) {
-                query = query.where('removed_at_hlc', 'is', null);
-            } else {
-                // Admit a write whose HLC strictly precedes the removal HLC; deny
-                // at-or-after. Complements `checkMembership`'s `removed_at_hlc <= hlc`
-                // denial so both agree on the remove-boundary instant.
-                query = query.where((eb)=>eb.or([
-                        eb('removed_at_hlc', 'is', null),
-                        eb('removed_at_hlc', '>', atHLC)
-                    ]));
-            }
-            const row = await query.limit(1).executeTakeFirst();
-            return row != null;
-        },
-        async setGroupMemberRole (groupID, memberDID, role) {
-            // Update-only by design: a missing row leaves the table untouched, so a
-            // role grant can never conjure a phantom member. hlc/removed_at_hlc are
-            // left alone to keep membership LWW and tombstones intact.
-            await db.updateTable('kubun_p2p_group_members').set({
-                role,
-                updated_at: adapter.encodeTimestamp(new Date())
-            }).where('group_id', '=', groupID).where('member_did', '=', normalizeDID(memberDID)).execute();
-        },
-        async isMemberOfAnyGroup (viewerDID, groupIDs) {
-            if (groupIDs.length === 0) return false;
-            const row = await db.selectFrom('kubun_p2p_group_members').select('group_id').where('member_did', '=', normalizeDID(viewerDID)).where('group_id', 'in', groupIDs).where('removed_at_hlc', 'is', null).limit(1).executeTakeFirst();
-            return row != null;
-        },
-        async listGroupMembers (groupID) {
-            return await db.selectFrom('kubun_p2p_group_members').selectAll().where('group_id', '=', groupID).where('removed_at_hlc', 'is', null).execute();
-        },
-        async getGroupsForMember (memberDID) {
-            return await db.selectFrom('kubun_p2p_group_members').innerJoin('kubun_p2p_groups', 'kubun_p2p_groups.id', 'kubun_p2p_group_members.group_id').selectAll('kubun_p2p_groups').where('kubun_p2p_group_members.member_did', '=', normalizeDID(memberDID)).where('kubun_p2p_group_members.removed_at_hlc', 'is', null).execute();
-        },
-        // Result Map is keyed by the normalized stored `member_did`; callers must
-        // normalize before looking up by key (existing callers iterate `.values()`).
-        async getGroupsForMembers (memberDIDs) {
-            const result = new Map();
-            if (memberDIDs.length === 0) return result;
-            const normalizedDIDs = memberDIDs.map(normalizeDID);
-            const rows = await db.selectFrom('kubun_p2p_group_members').innerJoin('kubun_p2p_groups', 'kubun_p2p_groups.id', 'kubun_p2p_group_members.group_id').select([
-                'kubun_p2p_group_members.member_did as member_did',
-                'kubun_p2p_groups.id as id',
-                'kubun_p2p_groups.name as name',
-                'kubun_p2p_groups.description as description',
-                'kubun_p2p_groups.created_by as created_by',
-                'kubun_p2p_groups.hlc as hlc',
-                'kubun_p2p_groups.created_at as created_at',
-                'kubun_p2p_groups.updated_at as updated_at'
-            ]).where('kubun_p2p_group_members.member_did', 'in', normalizedDIDs).where('kubun_p2p_group_members.removed_at_hlc', 'is', null).execute();
-            for (const row of rows){
-                const { member_did, ...group } = row;
-                const list = result.get(member_did);
-                if (list != null) {
-                    list.push(group);
-                } else {
-                    result.set(member_did, [
-                        group
-                    ]);
-                }
-            }
-            return result;
-        },
-        // --- Circle operations ---
-        async createCircle (circle) {
-            await db.insertInto('kubun_p2p_circles').values({
-                id: circle.id,
-                group_id: circle.group_id,
-                name: circle.name,
-                description: circle.description,
-                catalog_ids: adapter.encodeJSON(circle.catalog_ids),
-                hlc: circle.hlc
-            }).execute();
-        },
-        async getCircle (id, options) {
-            let query = db.selectFrom('kubun_p2p_circles').selectAll().where('id', '=', id);
-            if (!options?.includeRemoved) {
-                query = query.where('removed_at_hlc', 'is', null);
-            }
-            return await query.executeTakeFirst();
-        },
-        async getCircles (ids) {
-            const result = new Map();
-            if (ids.length === 0) return result;
-            const rows = await db.selectFrom('kubun_p2p_circles').selectAll().where('id', 'in', ids).execute();
-            for (const row of rows){
-                result.set(row.id, row);
-            }
-            return result;
-        },
-        async updateCircle (id, update) {
-            const values = {};
-            if (update.name != null) values.name = update.name;
-            if (update.description != null) values.description = update.description;
-            if (update.catalog_ids != null) {
-                values.catalog_ids = adapter.encodeJSON(update.catalog_ids);
-            }
-            if (update.hlc != null) {
-                values.hlc = update.hlc;
-                // A create/update that wins the apply-layer HLC check resurrects a
-                // tombstoned circle: clear the removal alongside the HLC refresh.
-                values.removed_at_hlc = null;
-            }
-            values.updated_at = adapter.encodeTimestamp(new Date());
-            await db.updateTable('kubun_p2p_circles').set(values).where('id', '=', id).execute();
-        },
-        async deleteCircle (id) {
-            await db.deleteFrom('kubun_p2p_circles').where('id', '=', id).execute();
-        },
-        // Earliest-wins LWW on `removed_at_hlc`: the update lands only when the row
-        // exists AND it is either not yet tombstoned or the incoming `hlc` precedes
-        // the stored removal HLC. A removal for a `circleID` with no local row is
-        // ignored — there is no circle to tombstone, and creating a row would leak
-        // a phantom circle.
-        async markCircleRemoved (circleID, hlc) {
-            await db.updateTable('kubun_p2p_circles').set({
-                removed_at_hlc: hlc,
-                updated_at: adapter.encodeTimestamp(new Date())
-            }).where('id', '=', circleID).where((eb)=>eb.or([
-                    eb('removed_at_hlc', 'is', null),
-                    eb('removed_at_hlc', '>', hlc)
-                ])).execute();
-        },
-        async listCirclesByGroup (groupID, options) {
-            let query = db.selectFrom('kubun_p2p_circles').selectAll().where('group_id', '=', groupID);
-            if (!options?.includeRemoved) {
-                query = query.where('removed_at_hlc', 'is', null);
-            }
-            return await query.execute();
-        },
-        async addCircleMember (member) {
-            // Re-adding a previously-removed member clears the tombstone and refreshes
-            // the row's HLC, so a member that left and rejoined is active again.
-            await db.insertInto('kubun_p2p_circle_members').values({
-                circle_id: member.circle_id,
-                member_did: normalizeDID(member.member_did),
-                role: member.role,
-                hlc: member.hlc
-            }).onConflict((oc)=>oc.columns([
-                    'circle_id',
-                    'member_did'
-                ]).doUpdateSet((eb)=>({
-                        role: eb.ref('excluded.role'),
-                        hlc: eb.ref('excluded.hlc'),
-                        removed_at_hlc: null,
-                        updated_at: adapter.encodeTimestamp(new Date())
-                    }))).execute();
-        },
-        // Earliest-wins LWW on `removed_at_hlc`, mirroring `markMemberRemoved`: the
-        // update lands only when the row exists AND it is either not yet tombstoned
-        // or the incoming `hlc` precedes the stored removal HLC. A removal for a
-        // `(circleID, memberDID)` with no local row is ignored — no phantom row is
-        // created.
-        async removeCircleMember (circleID, memberDID, hlc) {
-            await db.updateTable('kubun_p2p_circle_members').set({
-                removed_at_hlc: hlc,
-                updated_at: adapter.encodeTimestamp(new Date())
-            }).where('circle_id', '=', circleID).where('member_did', '=', normalizeDID(memberDID)).where((eb)=>eb.or([
-                    eb('removed_at_hlc', 'is', null),
-                    eb('removed_at_hlc', '>', hlc)
-                ])).execute();
-        },
-        async getCircleMember (circleID, memberDID) {
-            return await db.selectFrom('kubun_p2p_circle_members').selectAll().where('circle_id', '=', circleID).where('member_did', '=', normalizeDID(memberDID)).executeTakeFirst();
-        },
-        async listCircleMembers (circleID, options) {
-            let query = db.selectFrom('kubun_p2p_circle_members').selectAll().where('circle_id', '=', circleID);
-            if (!options?.includeRemoved) {
-                query = query.where('removed_at_hlc', 'is', null);
-            }
-            return await query.execute();
-        },
-        // Read-ACL / sync-scope source: a tombstoned circle or a tombstoned
-        // membership grants no read access, so gate both sides on `removed_at_hlc`.
-        async getCirclesForMember (memberDID) {
-            return await db.selectFrom('kubun_p2p_circle_members').innerJoin('kubun_p2p_circles', 'kubun_p2p_circles.id', 'kubun_p2p_circle_members.circle_id').selectAll('kubun_p2p_circles').where('kubun_p2p_circle_members.member_did', '=', normalizeDID(memberDID)).where('kubun_p2p_circle_members.removed_at_hlc', 'is', null).where('kubun_p2p_circles.removed_at_hlc', 'is', null).execute();
-        },
-        // Read-ACL / sync-scope source: a tombstoned circle or a tombstoned
-        // membership grants no read access, so gate both sides on `removed_at_hlc`.
-        async isMemberOfAnyCircle (memberDID, circleIDs) {
-            if (circleIDs.length === 0) return false;
-            const row = await db.selectFrom('kubun_p2p_circle_members').innerJoin('kubun_p2p_circles', 'kubun_p2p_circles.id', 'kubun_p2p_circle_members.circle_id').select('kubun_p2p_circle_members.circle_id').where('kubun_p2p_circle_members.member_did', '=', normalizeDID(memberDID)).where('kubun_p2p_circle_members.circle_id', 'in', circleIDs).where('kubun_p2p_circle_members.removed_at_hlc', 'is', null).where('kubun_p2p_circles.removed_at_hlc', 'is', null).limit(1).executeTakeFirst();
-            return row != null;
-        },
-        // Unconditional fold-authoritative upsert: every projected column is set
-        // from the supplied derived state, including `removed_at_hlc` (a value
-        // tombstones, null marks active). No HLC guard — the reproject already
-        // resolved the winner via the ledger fold, so the store write must not
-        // re-arbitrate.
-        async reconcileCircleProjection (params) {
-            await db.insertInto('kubun_p2p_circles').values({
-                id: params.id,
-                group_id: params.groupID,
-                name: params.name,
-                description: params.description,
-                catalog_ids: adapter.encodeJSON(params.catalogIDs),
-                hlc: params.hlc,
-                removed_at_hlc: params.removedAtHLC
-            }).onConflict((oc)=>oc.column('id').doUpdateSet((eb)=>({
-                        group_id: eb.ref('excluded.group_id'),
-                        name: eb.ref('excluded.name'),
-                        description: eb.ref('excluded.description'),
-                        catalog_ids: eb.ref('excluded.catalog_ids'),
-                        hlc: eb.ref('excluded.hlc'),
-                        removed_at_hlc: eb.ref('excluded.removed_at_hlc'),
-                        updated_at: adapter.encodeTimestamp(new Date())
-                    }))).execute();
-        },
-        async reconcileCircleMemberProjection (params) {
-            await db.insertInto('kubun_p2p_circle_members').values({
-                circle_id: params.circleID,
-                member_did: normalizeDID(params.memberDID),
-                role: params.role,
-                hlc: params.hlc,
-                removed_at_hlc: params.removedAtHLC
-            }).onConflict((oc)=>oc.columns([
-                    'circle_id',
-                    'member_did'
-                ]).doUpdateSet((eb)=>({
-                        role: eb.ref('excluded.role'),
-                        hlc: eb.ref('excluded.hlc'),
-                        removed_at_hlc: eb.ref('excluded.removed_at_hlc'),
-                        updated_at: adapter.encodeTimestamp(new Date())
-                    }))).execute();
-        },
-        // --- Group-delegation edge operations ---
-        async addGroupDelegation (edge) {
-            await db.insertInto('kubun_p2p_group_delegation').values({
-                group_id: edge.group_id,
-                jti: edge.jti
-            }).onConflict((oc)=>oc.column('jti').doNothing()).execute();
-        },
-        async getGroupIDByJTI (jti) {
-            const row = await db.selectFrom('kubun_p2p_group_delegation').select('group_id').where('jti', '=', jti).executeTakeFirst();
-            return row?.group_id ?? null;
-        },
-        async getGroupIDsByJTIs (jtis) {
-            if (jtis.length === 0) {
-                return new Map();
-            }
-            const rows = await db.selectFrom('kubun_p2p_group_delegation').select([
-                'jti',
-                'group_id'
-            ]).where('jti', 'in', jtis).execute();
-            return new Map(rows.map((row)=>[
-                    row.jti,
-                    row.group_id
-                ]));
-        },
-        // --- MLS state operations ---
-        async saveMLSState (state) {
-            await db.insertInto('kubun_p2p_group_mls_state').values({
-                group_id: state.group_id,
-                device_id: state.device_id,
-                mls_state: adapter.encodeBinary(state.mls_state),
-                credential: state.credential,
-                epoch: state.epoch,
-                root_capability: state.root_capability
-            }).onConflict((oc)=>oc.columns([
-                    'group_id',
-                    'device_id'
-                ]).doUpdateSet((eb)=>({
-                        mls_state: eb.ref('excluded.mls_state'),
-                        credential: eb.ref('excluded.credential'),
-                        epoch: eb.ref('excluded.epoch'),
-                        root_capability: eb.ref('excluded.root_capability'),
-                        updated_at: adapter.encodeTimestamp(new Date())
-                    }))// Monotonic-epoch guard: only overwrite when the incoming epoch is
-                // at least the stored one. The MLS epoch never moves backwards, so a
-                // write carrying a lower epoch is a stale handle re-persisting an
-                // already-superseded ratchet — apply it and we roll the ratchet back.
-                // When this predicate is false the existing row is left untouched
-                // with no error (a silent no-op); a fresh insert has no conflict and
-                // is unaffected. The bound is `<=`, not `<`: decrypting an
-                // application message advances the secret-tree generation WITHIN an
-                // epoch while `epoch` stays constant, so a legitimate same-epoch
-                // re-persist carries a changed `mls_state` blob at the same epoch and
-                // must still win — `<` would reject it and wedge decryption.
-                .where((eb)=>eb('kubun_p2p_group_mls_state.epoch', '<=', eb.ref('excluded.epoch')))).execute();
-        },
-        async getMLSState (groupID, deviceID) {
-            return await db.selectFrom('kubun_p2p_group_mls_state').selectAll().where('group_id', '=', groupID).where('device_id', '=', deviceID).executeTakeFirst();
-        },
-        async deleteMLSState (groupID, deviceID) {
-            await db.deleteFrom('kubun_p2p_group_mls_state').where('group_id', '=', groupID).where('device_id', '=', deviceID).execute();
-        },
-        async listMLSStates (groupID) {
-            return await db.selectFrom('kubun_p2p_group_mls_state').selectAll().where('group_id', '=', groupID).execute();
-        },
-        async deleteGroupMLSStates (groupID) {
-            await db.deleteFrom('kubun_p2p_group_mls_state').where('group_id', '=', groupID).execute();
-        },
-        // --- Sync peer operations ---
-        async addSyncPeer (peer) {
-            const allowedUsers = adapter.encodeJSON(peer.allowed_users);
-            const config = adapter.encodeJSON(peer.config);
-            await db.insertInto('kubun_p2p_sync_peers').values({
-                ...peer,
-                allowed_users: allowedUsers,
-                config
-            }).onConflict((oc)=>oc.column('peer_did').doUpdateSet({
-                    endpoint: peer.endpoint,
-                    mode: peer.mode,
-                    allowed_users: allowedUsers,
-                    priority: peer.priority,
-                    trust_level: peer.trust_level,
-                    config,
-                    updated_at: peer.updated_at
-                })).execute();
-        },
-        async getSyncPeer (peerDID) {
-            return await db.selectFrom('kubun_p2p_sync_peers').selectAll().where('peer_did', '=', peerDID).executeTakeFirst();
-        },
-        async listSyncPeers () {
-            return await db.selectFrom('kubun_p2p_sync_peers').selectAll().execute();
-        },
-        async updateSyncPeer (peerDID, update) {
-            const values = {};
-            if (update.endpoint != null) values.endpoint = update.endpoint;
-            if (update.mode != null) values.mode = update.mode;
-            if (update.allowed_users != null) values.allowed_users = adapter.encodeJSON(update.allowed_users);
-            if (update.priority != null) values.priority = update.priority;
-            if (update.trust_level != null) values.trust_level = update.trust_level;
-            if (update.config != null) values.config = adapter.encodeJSON(update.config);
-            values.updated_at = Date.now();
-            await db.updateTable('kubun_p2p_sync_peers').set(values).where('peer_did', '=', peerDID).execute();
-        },
-        async removeSyncPeer (peerDID) {
-            await db.deleteFrom('kubun_p2p_sync_peers').where('peer_did', '=', peerDID).execute();
-        },
-        // --- Broadcast log operations ---
-        async recordBroadcast (entry) {
-            const result = await db.insertInto('kubun_p2p_broadcast_log').values({
-                doc_id: entry.docID,
-                version: entry.version,
-                mls_group_id: entry.mlsGroupID
-            }).onConflict((oc)=>oc.columns([
-                    'doc_id',
-                    'version',
-                    'mls_group_id'
-                ]).doNothing()).executeTakeFirst();
-            return (result.numInsertedOrUpdatedRows ?? 0n) > 0n;
-        },
-        async hasBroadcast (entry) {
-            const row = await db.selectFrom('kubun_p2p_broadcast_log').select('doc_id').where('doc_id', '=', entry.docID).where('version', '=', entry.version).where('mls_group_id', '=', entry.mlsGroupID).limit(1).executeTakeFirst();
-            return row != null;
-        },
-        // --- Control ledger operations ---
-        async appendLedgerEntry (entry) {
-            const result = await db.insertInto('kubun_p2p_control_ledger').values({
-                group_id: entry.group_id,
-                entry_id: entry.entry_id,
-                type: entry.type,
-                subject: entry.subject,
-                value: adapter.encodeJSON(entry.value),
-                hlc: entry.hlc,
-                issuer_did: normalizeDID(entry.issuer_did),
-                signed_token: entry.signed_token
-            }).onConflict((oc)=>oc.column('entry_id').doNothing()).executeTakeFirst();
-            return (result.numInsertedOrUpdatedRows ?? 0n) > 0n;
-        },
-        async getLedgerEntries (groupID) {
-            return await db.selectFrom('kubun_p2p_control_ledger').selectAll().where('group_id', '=', groupID).orderBy('hlc').orderBy('entry_id').execute();
-        },
-        async getLedgerEntriesByType (groupID, type) {
-            return await db.selectFrom('kubun_p2p_control_ledger').selectAll().where('group_id', '=', groupID).where('type', '=', type).orderBy('hlc').orderBy('entry_id').execute();
-        },
-        // --- Projection state operations ---
-        async getProjectionWatermark (groupID, projection) {
-            const row = await db.selectFrom('kubun_p2p_projection_state').select('projected_through_hlc').where('group_id', '=', groupID).where('projection', '=', projection).executeTakeFirst();
-            return row?.projected_through_hlc ?? null;
-        },
-        // Overwrite-on-conflict: callers only ever advance the watermark, so there
-        // is no need for a SQL max/guard here.
-        async setProjectionWatermark (groupID, projection, hlc) {
-            await db.insertInto('kubun_p2p_projection_state').values({
-                group_id: groupID,
-                projection,
-                projected_through_hlc: hlc
-            }).onConflict((oc)=>oc.columns([
-                    'group_id',
-                    'projection'
-                ]).doUpdateSet((eb)=>({
-                        projected_through_hlc: eb.ref('excluded.projected_through_hlc'),
-                        updated_at: adapter.encodeTimestamp(new Date())
-                    }))).execute();
-        },
-        // --- Hub operations ---
-        async insertHub (hub) {
-            await db.insertInto('kubun_p2p_hubs').values({
-                id: hub.id,
-                label: hub.label,
-                url: hub.url,
-                server_did: hub.server_did
-            }).execute();
-        },
-        async getHub (id) {
-            return await db.selectFrom('kubun_p2p_hubs').selectAll().where('id', '=', id).executeTakeFirst();
-        },
-        async getHubByURL (url) {
-            return await db.selectFrom('kubun_p2p_hubs').selectAll().where('url', '=', url).executeTakeFirst();
-        },
-        async updateHub (id, update) {
-            const values = {};
-            if (update.label !== undefined) values.label = update.label;
-            if (update.url !== undefined) values.url = update.url;
-            if (update.server_did !== undefined) values.server_did = update.server_did;
-            values.updated_at = adapter.encodeTimestamp(new Date());
-            await db.updateTable('kubun_p2p_hubs').set(values).where('id', '=', id).execute();
-        },
-        async deleteHub (id) {
-            await db.deleteFrom('kubun_p2p_hubs').where('id', '=', id).execute();
-        },
-        async listHubs () {
-            return await db.selectFrom('kubun_p2p_hubs').selectAll().execute();
-        },
-        // --- Group-hub binding operations ---
-        async insertGroupHub (binding) {
-            const result = await db.insertInto('kubun_p2p_group_hubs').values({
-                group_id: binding.group_id,
-                hub_id: binding.hub_id
-            }).onConflict((oc)=>oc.columns([
-                    'group_id',
-                    'hub_id'
-                ]).doNothing()).executeTakeFirst();
-            return (result.numInsertedOrUpdatedRows ?? 0n) > 0n;
-        },
-        async deleteGroupHub (params) {
-            const result = await db.deleteFrom('kubun_p2p_group_hubs').where('group_id', '=', params.groupID).where('hub_id', '=', params.hubID).executeTakeFirst();
-            return (result.numDeletedRows ?? 0n) > 0n;
-        },
-        async listGroupIDsByHubID (hubID) {
-            const rows = await db.selectFrom('kubun_p2p_group_hubs').select('group_id').where('hub_id', '=', hubID).execute();
-            return rows.map((r)=>r.group_id);
-        },
-        async listHubsByGroupID (groupID) {
-            return await db.selectFrom('kubun_p2p_group_hubs').innerJoin('kubun_p2p_hubs', 'kubun_p2p_hubs.id', 'kubun_p2p_group_hubs.hub_id').selectAll('kubun_p2p_hubs').where('kubun_p2p_group_hubs.group_id', '=', groupID).execute();
-        },
-        async listGroupsByHubID (hubID) {
-            const rows = await db.selectFrom('kubun_p2p_group_hubs').innerJoin('kubun_p2p_groups', 'kubun_p2p_groups.id', 'kubun_p2p_group_hubs.group_id').select([
-                'kubun_p2p_groups.id as id',
-                'kubun_p2p_groups.name as name',
-                'kubun_p2p_groups.description as description',
-                'kubun_p2p_groups.created_by as created_by',
-                'kubun_p2p_groups.hlc as hlc',
-                'kubun_p2p_groups.created_at as created_at',
-                'kubun_p2p_groups.updated_at as updated_at'
-            ]).where('kubun_p2p_group_hubs.hub_id', '=', hubID).execute();
-            return rows;
-        },
-        async deleteGroupHubsByHubID (hubID) {
-            await db.deleteFrom('kubun_p2p_group_hubs').where('hub_id', '=', hubID).execute();
-        }
+    return {
+        ...createGroupOps(db, adapter),
+        ...createCircleOps(db, adapter),
+        ...createDelegationOps(db),
+        ...createMLSOps(db, adapter),
+        ...createSyncOps(db, adapter),
+        ...createControlOps(db, adapter),
+        ...createAppLaneOps(db, adapter),
+        ...createHubOps(db, adapter),
+        ...createDiscoveryOps(db, adapter)
     };
-    return api;
 }

package/lib/index.d.ts

@@ -1,8 +1,8 @@
 import type { StoreProvider } from '@kubun/db';
 import type { P2PStoreAPI } from './api.js';
-export type { P2PStoreAPI } from './api.js';
+export type { ControlRequestKind, ControlRequestOutcome, P2PStoreAPI, PutPendingJoinRequestParams, SetLocalPeerProfileParams, UpsertPeerAnnouncementParams, } from './api.js';
 export { createP2PStore } from './api.js';
 export { p2pStoreDefinition } from './definition.js';
 export declare const P2P_STORE: "p2p";
 export declare function getP2PStore(provider: StoreProvider): Promise<P2PStoreAPI>;
-export type { Circle, CircleMember, CircleMemberTable, CircleTable, ControlLedgerEntry, ControlLedgerTable, Group, GroupDelegation, GroupDelegationTable, GroupHub, GroupHubTable, GroupMember, GroupMemberTable, GroupMLSState, GroupMLSStateTable, GroupTable, Hub, HubTable, InsertCircle, InsertCircleMember, InsertControlLedgerEntry, InsertGroup, InsertGroupDelegation, InsertGroupHub, InsertGroupMember, InsertGroupMLSState, InsertHub, InsertProjectionState, InsertSyncCheckpoint, InsertSyncPeer, P2PStoreTables, PaginatedResult, PaginationParams, ProjectionState, ProjectionStateTable, SyncCheckpoint, SyncCheckpointTable, SyncPeer, SyncPeerTable, UpdateGroupMLSState, } from './tables.js';
+export type { AppCursor, AppCursorTable, Circle, CircleMember, CircleMemberTable, CircleTable, ControlRequest, ControlRequestTable, Group, GroupAnchor, GroupAnchorTable, GroupDelegation, GroupDelegationTable, GroupHub, GroupHubTable, GroupMember, GroupMemberTable, GroupMLSState, GroupMLSStateTable, GroupStatus, GroupTable, Hub, HubTable, InsertCircle, InsertCircleMember, InsertGroup, InsertGroupDelegation, InsertGroupHub, InsertGroupMember, InsertGroupMLSState, InsertHub, InsertSyncCheckpoint, InsertSyncPeer, LocalPeerProfile, LocalPeerProfileTable, P2PStoreTables, PaginatedResult, PaginationParams, PeerAnnouncement, PeerAnnouncementTable, PeerCapabilityRecord, PendingJoinRequestRow, PendingJoinRequestTable, SyncCheckpoint, SyncCheckpointTable, SyncPeer, SyncPeerTable, UpdateGroupMLSState, } from './tables.js';

package/lib/migrations.d.ts

@@ -1,3 +1,24 @@
 import type { MigrationContext } from '@kubun/db';
 import type { Migration } from 'kysely/migration';
+/**
+ * Partial unique index keeping one commit-hub designation per group. Named here
+ * because the store recognises a lost first-bind race by this name appearing in
+ * the driver's constraint-violation error.
+ */
+export declare const COMMIT_HUB_UNIQUE_INDEX = "uq_p2p_group_hubs_commit";
+/**
+ * A shipped migration is immutable: once a database has run it, editing it
+ * changes nothing on that database and silently diverges the schema from the
+ * code. Every schema change after a release goes in a NEW migration.
+ *
+ * That rule is suspended for this release, deliberately. The eight migrations
+ * this store had accumulated are folded into `0-init`, which is now the whole
+ * schema in one readable place. It is a BREAKING change — a database created
+ * before it will not pick the new shape up and must be recreated — and it costs
+ * nothing here only because the release already requires recreating local
+ * databases for unrelated reasons.
+ *
+ * Reinstate the rule the moment this ships: the next schema change is a new
+ * migration, and `0-init` is immutable again.
+ */
 export declare function getP2PMigrations(ctx: MigrationContext): Record<string, Migration>;