@kubun/store-p2p 0.17.0 → 0.18.0

package/lib/api.d.ts

@@ -1,28 +1,46 @@
 import type { Adapter } from '@kubun/db-adapter';
+import { type Runtime } from '@sozai/runtime';
 import type { Kysely } from 'kysely';
 import { type AppLaneOps } from './ops/app-lane.js';
+import { type AppOutboxOps } from './ops/app-outbox.js';
+import { type CatalogOfferOps } from './ops/catalog-offers.js';
+import { type CatalogRouteOps } from './ops/catalog-routes.js';
+import { type CatalogSyncOps } from './ops/catalog-sync.js';
 import { type CircleOps } from './ops/circles.js';
 import { type ControlOps } from './ops/control.js';
 import { type DelegationOps } from './ops/delegations.js';
 import { type DiscoveryOps } from './ops/discovery.js';
+import { type DocumentSweepOps } from './ops/document-sweep.js';
 import { type GroupOps } from './ops/groups.js';
 import { type HubOps } from './ops/hubs.js';
+import { type LogHandlerCompletionOps } from './ops/log-handler-completion.js';
 import { type MLSOps } from './ops/mls.js';
+import { type OwnAgentsOps } from './ops/own-agents.js';
 import { type SyncOps } from './ops/sync.js';
 import type { P2PStoreTables } from './tables.js';
-export type { AppLaneOps } from './ops/app-lane.js';
+export type { AppLaneOps, OpenedAppFrameExpectedVersion, OpenedAppFrameRecord, SaveOpenedAppFrameParams, } from './ops/app-lane.js';
+export type { AppOutboxOps } from './ops/app-outbox.js';
+export type { CatalogOffer, CatalogOfferOps } from './ops/catalog-offers.js';
+export type { CatalogRoute, CatalogRouteOps } from './ops/catalog-routes.js';
+export type { CatalogCursorBounds, CatalogCursorState, CatalogSyncOps, DocumentRepairAnswerKind, DocumentRepairRow, DueObservationRepairQuery, ObservationRepairPosition, ObservationRepairSchedule, RecordDocumentRepairParams, } from './ops/catalog-sync.js';
 export type { CircleOps } from './ops/circles.js';
 export type { CommitJournalEntryKind, ControlOps, ControlRequestKind, ControlRequestOutcome, } from './ops/control.js';
 export type { DelegationOps } from './ops/delegations.js';
 export type { DiscoveryOps, PutPendingJoinRequestParams, SetLocalPeerProfileParams, UpsertPeerAnnouncementParams, } from './ops/discovery.js';
-export type { GroupOps } from './ops/groups.js';
+export type { DocumentSweepOps } from './ops/document-sweep.js';
+export type { GetMemberRemovalsParams, GroupOps } from './ops/groups.js';
 export type { HubOps } from './ops/hubs.js';
-export type { MLSOps } from './ops/mls.js';
-export type { SyncOps } from './ops/sync.js';
+export type { BeginLogHandlerCompletionParams, LogHandlerCompletionKey, LogHandlerCompletionOps, } from './ops/log-handler-completion.js';
+export type { MLSOps, ReserveSenderGenerationsParams } from './ops/mls.js';
+export type { BindingEvidence, OwnAgentsGrant, OwnAgentsJoinCapability, OwnAgentsOps, OwnAgentsRecord, OwnAgentsRecordKey, } from './ops/own-agents.js';
+export type { PruneBroadcastLogParams, SyncOps } from './ops/sync.js';
 /**
  * The store's whole surface, one slice per domain. Each slice module owns its
  * tables and its own helpers; this intersection is the only coupling between
  * them, so a caller still sees one flat API.
  */
-export type P2PStoreAPI = GroupOps & CircleOps & DelegationOps & MLSOps & SyncOps & ControlOps & AppLaneOps & HubOps & DiscoveryOps;
-export declare function createP2PStore(db: Kysely<P2PStoreTables>, adapter: Adapter): P2PStoreAPI;
+export type P2PStoreAPI = GroupOps & CatalogOfferOps & CatalogRouteOps & CatalogSyncOps & CircleOps & DelegationOps & MLSOps & SyncOps & ControlOps & AppLaneOps & AppOutboxOps & LogHandlerCompletionOps & HubOps & DiscoveryOps & DocumentSweepOps & OwnAgentsOps;
+export type CreateP2PStoreOptions = {
+    getRandomValues?: Runtime['getRandomValues'];
+};
+export declare function createP2PStore(db: Kysely<P2PStoreTables>, adapter: Adapter, options?: CreateP2PStoreOptions): P2PStoreAPI;

package/lib/api.js

@@ -1,22 +1,37 @@
+import { createRuntime } from '@sozai/runtime';
 import { createAppLaneOps } from './ops/app-lane.js';
+import { createAppOutboxOps } from './ops/app-outbox.js';
+import { createCatalogOfferOps } from './ops/catalog-offers.js';
+import { createCatalogRouteOps } from './ops/catalog-routes.js';
+import { createCatalogSyncOps } from './ops/catalog-sync.js';
 import { createCircleOps } from './ops/circles.js';
 import { createControlOps } from './ops/control.js';
 import { createDelegationOps } from './ops/delegations.js';
 import { createDiscoveryOps } from './ops/discovery.js';
+import { createDocumentSweepOps } from './ops/document-sweep.js';
 import { createGroupOps } from './ops/groups.js';
 import { createHubOps } from './ops/hubs.js';
+import { createLogHandlerCompletionOps } from './ops/log-handler-completion.js';
 import { createMLSOps } from './ops/mls.js';
+import { createOwnAgentsOps } from './ops/own-agents.js';
 import { createSyncOps } from './ops/sync.js';
-export function createP2PStore(db, adapter) {
+export function createP2PStore(db, adapter, options = {}) {
     return {
         ...createGroupOps(db, adapter),
+        ...createOwnAgentsOps(db, adapter),
+        ...createCatalogOfferOps(db),
+        ...createCatalogRouteOps(db),
+        ...createCatalogSyncOps(db, adapter),
         ...createCircleOps(db, adapter),
         ...createDelegationOps(db),
         ...createMLSOps(db, adapter),
         ...createSyncOps(db, adapter),
         ...createControlOps(db, adapter),
         ...createAppLaneOps(db, adapter),
+        ...createAppOutboxOps(db, adapter, options.getRandomValues ?? createRuntime().getRandomValues),
         ...createHubOps(db, adapter),
-        ...createDiscoveryOps(db, adapter)
+        ...createLogHandlerCompletionOps(db),
+        ...createDiscoveryOps(db, adapter),
+        ...createDocumentSweepOps(db)
     };
 }

package/lib/definition.js

@@ -3,5 +3,5 @@ import { getP2PMigrations } from './migrations.js';
 export const p2pStoreDefinition = {
     name: 'p2p',
     migrations: getP2PMigrations,
-    createAPI: createP2PStore
+    createAPI: (db, adapter)=>createP2PStore(db, adapter)
 };

package/lib/hub-url.d.ts

@@ -0,0 +1 @@
+export declare function canonicalHubURL(url: string): string;

package/lib/hub-url.js

@@ -0,0 +1,3 @@
+export function canonicalHubURL(url) {
+    return new URL(url).toString();
+}

package/lib/index.d.ts

@@ -1,8 +1,14 @@
 import type { StoreProvider } from '@kubun/db';
 import type { P2PStoreAPI } from './api.js';
-export type { ControlRequestKind, ControlRequestOutcome, P2PStoreAPI, PutPendingJoinRequestParams, SetLocalPeerProfileParams, UpsertPeerAnnouncementParams, } from './api.js';
+export type { BeginLogHandlerCompletionParams, BindingEvidence, CatalogCursorBounds, CatalogCursorState, CatalogOffer, CatalogRoute, CatalogSyncOps, ControlRequestKind, ControlRequestOutcome, CreateP2PStoreOptions, DocumentRepairAnswerKind, DocumentRepairRow, DueObservationRepairQuery, GetMemberRemovalsParams, LogHandlerCompletionKey, LogHandlerCompletionOps, ObservationRepairPosition, ObservationRepairSchedule, OpenedAppFrameExpectedVersion, OpenedAppFrameRecord, OwnAgentsGrant, OwnAgentsJoinCapability, OwnAgentsOps, OwnAgentsRecord, OwnAgentsRecordKey, P2PStoreAPI, PruneBroadcastLogParams, PutPendingJoinRequestParams, RecordDocumentRepairParams, ReserveSenderGenerationsParams, SaveOpenedAppFrameParams, SetLocalPeerProfileParams, UpsertPeerAnnouncementParams, } from './api.js';
 export { createP2PStore } from './api.js';
 export { p2pStoreDefinition } from './definition.js';
+export { canonicalHubURL } from './hub-url.js';
+export { AppOutboxDecryptionError, type AppOutboxPortOptions, AppOutboxTransactionError, type ClearAppOutboxRowsOptions, PendingRevocationAdmissionError, UndeliveredRevocationsError, } from './ops/app-outbox.js';
+export { MAX_REPAIRS_PER_LISTER } from './ops/catalog-sync.js';
+export { BroadcastLogPruneParamsError } from './ops/sync.js';
+export { type ClassifyDocumentOwnerParams, classifyDocumentOwner, type DocumentOwnerClass, } from './owner-classification.js';
 export declare const P2P_STORE: "p2p";
 export declare function getP2PStore(provider: StoreProvider): Promise<P2PStoreAPI>;
-export type { AppCursor, AppCursorTable, Circle, CircleMember, CircleMemberTable, CircleTable, ControlRequest, ControlRequestTable, Group, GroupAnchor, GroupAnchorTable, GroupDelegation, GroupDelegationTable, GroupHub, GroupHubTable, GroupMember, GroupMemberTable, GroupMLSState, GroupMLSStateTable, GroupStatus, GroupTable, Hub, HubTable, InsertCircle, InsertCircleMember, InsertGroup, InsertGroupDelegation, InsertGroupHub, InsertGroupMember, InsertGroupMLSState, InsertHub, InsertSyncCheckpoint, InsertSyncPeer, LocalPeerProfile, LocalPeerProfileTable, P2PStoreTables, PaginatedResult, PaginationParams, PeerAnnouncement, PeerAnnouncementTable, PeerCapabilityRecord, PendingJoinRequestRow, PendingJoinRequestTable, SyncCheckpoint, SyncCheckpointTable, SyncPeer, SyncPeerTable, UpdateGroupMLSState, } from './tables.js';
+export { OwnAgentsGroupNotFoundError, OwnAgentsKindDowngradeError, OwnAgentsRecordError, OwnAgentsTransactionError, ownAgentsRecordLockKey, } from './ops/own-agents.js';
+export type { AppCursor, AppCursorTable, Circle, CircleMember, CircleMemberTable, CircleTable, CommitJournalEntry, ControlRequest, ControlRequestTable, Group, GroupAnchor, GroupAnchorTable, GroupDelegation, GroupDelegationTable, GroupHub, GroupHubTable, GroupKind, GroupLeaveRequest, GroupLeaveRequestTable, GroupMember, GroupMemberTable, GroupMLSState, GroupMLSStateTable, GroupStatus, GroupTable, Hub, HubTable, InsertCircle, InsertCircleMember, InsertGroup, InsertGroupDelegation, InsertGroupHub, InsertGroupMember, InsertGroupMLSState, InsertHub, InsertSyncCheckpoint, InsertSyncPeer, LocalPeerProfile, LocalPeerProfileTable, OwnAgentsGrantKind, OwnAgentsGrantTable, OwnAgentsJoinCapabilityTable, OwnAgentsRecordTable, P2PStoreTables, PaginatedResult, PaginationParams, PeerAnnouncement, PeerAnnouncementTable, PeerCapabilityRecord, PendingAppFrameRow, PendingAppFrameTable, PendingJoinRequestRow, PendingJoinRequestTable, SyncCheckpoint, SyncCheckpointTable, SyncPeer, SyncPeerTable, UpdateGroupMLSState, } from './tables.js';

package/lib/index.js

@@ -1,6 +1,12 @@
 export { createP2PStore } from './api.js';
 export { p2pStoreDefinition } from './definition.js';
+export { canonicalHubURL } from './hub-url.js';
+export { AppOutboxDecryptionError, AppOutboxTransactionError, PendingRevocationAdmissionError, UndeliveredRevocationsError } from './ops/app-outbox.js';
+export { MAX_REPAIRS_PER_LISTER } from './ops/catalog-sync.js';
+export { BroadcastLogPruneParamsError } from './ops/sync.js';
+export { classifyDocumentOwner } from './owner-classification.js';
 export const P2P_STORE = 'p2p';
 export function getP2PStore(provider) {
     return provider.getStore(P2P_STORE);
 }
+export { OwnAgentsGroupNotFoundError, OwnAgentsKindDowngradeError, OwnAgentsRecordError, OwnAgentsTransactionError, ownAgentsRecordLockKey } from './ops/own-agents.js';

package/lib/migrations.js

@@ -23,10 +23,35 @@ import { sql } from 'kysely';
     const now = ctx.functions.now;
     const init = {
         async up (db) {
+            await db.schema.createTable('kubun_p2p_access_default_revocations').ifNotExists().addColumn('controller_did', t.text, (col)=>col.notNull()).addColumn('device_did', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_access_default_revocations', [
+                'controller_did',
+                'device_did'
+            ]).execute();
+            // Every authenticated device binding this device has observed. Append-only:
+            // ownership is historical, so revocation, removal or MLS state loss never
+            // takes a row away.
+            await db.schema.createTable('kubun_p2p_binding_evidence').ifNotExists().addColumn('controller_did', t.text, (col)=>col.notNull()).addColumn('device_did', t.text, (col)=>col.notNull()).addColumn('first_seen_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_p2p_binding_evidence', [
+                'controller_did',
+                'device_did'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_binding_evidence_device').ifNotExists().on('kubun_p2p_binding_evidence').column('device_did').execute();
             // Groups
-            await db.schema.createTable('kubun_p2p_groups').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('name', t.text, (col)=>col.notNull()).addColumn('description', t.text, (col)=>col.notNull().defaultTo('')).addColumn('created_by', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull())// 'joined' | 'left' — see `GroupStatus`. A row is only written on a
-            // completed join or a local create, so the default is the joined state.
-            .addColumn('status', t.text, (col)=>col.notNull().defaultTo('joined')).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).execute();
+            await db.schema.createTable('kubun_p2p_groups').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('name', t.text, (col)=>col.notNull()).addColumn('description', t.text, (col)=>col.notNull().defaultTo('')).addColumn('created_by', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('kind', t.text, (col)=>col.notNull().defaultTo('standard'))// A completed join or local create starts joined; see `GroupStatus`.
+            .addColumn('status', t.text, (col)=>col.notNull().defaultTo('joined'))// Token of the last handle advance whose projections no reconcile has
+            // caught up with yet; NULL when they match the current handle.
+            .addColumn('projections_dirty', t.text)// Epoch the last successful reconcile caught the projections up to.
+            .addColumn('projections_epoch', 'integer').addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).execute();
+            await db.schema.createTable('kubun_p2p_own_agents_records').ifNotExists().addColumn('type', t.text, (col)=>col.notNull()).addColumn('owner', t.text, (col)=>col.notNull()).addColumn('id', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('op_jwt', t.text, (col)=>col.notNull()).addColumn('op_hash', t.text, (col)=>col.notNull()).addColumn('payload', t.binary).addColumn('payload_digest', t.text).addColumn('deleted', 'integer', (col)=>col.notNull()).addColumn('meta', t.json, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_p2p_own_agents_records', [
+                'type',
+                'owner',
+                'id',
+                'op_hash'
+            ]).execute();
+            await db.schema.createTable('kubun_p2p_own_agents_grants').ifNotExists().addColumn('controller_did', t.text, (col)=>col.notNull()).addColumn('kind', t.text, (col)=>col.notNull()).addColumn('token', t.text, (col)=>col.notNull()).addColumn('issued_at', t.bigint, (col)=>col.notNull()).addColumn('expires_at', t.bigint, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_own_agents_grants', [
+                'controller_did',
+                'kind'
+            ]).execute();
+            await db.schema.createTable('kubun_p2p_own_agents_join_capabilities').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('recipient_did', t.text, (col)=>col.notNull()).addColumn('capability_id', t.text, (col)=>col.notNull()).addColumn('token', t.text, (col)=>col.notNull()).addColumn('expires_at', t.bigint, (col)=>col.notNull()).addColumn('signer_did', t.text).addColumn('signer_leaf_key', t.binary).addColumn('signer_capability', t.text).addColumn('signer_prefix', t.json).execute();
             // Group members
             await db.schema.createTable('kubun_p2p_group_members').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('member_did', t.text, (col)=>col.notNull()).addColumn('role', t.text, (col)=>col.notNull().defaultTo('member'))// LWW version key for the row, set on insert and refreshed on re-add.
             .addColumn('hlc', t.text, (col)=>col.notNull())// HLC at which this peer learned the member was removed from the MLS
@@ -38,8 +63,76 @@ import { sql } from 'kysely';
                 'member_did'
             ]).execute();
             await db.schema.createIndex('idx_p2p_group_members_did').ifNotExists().on('kubun_p2p_group_members').column('member_did').execute();
+            await db.schema.createTable('kubun_p2p_catalog_offers').ifNotExists().addColumn('owner', t.text, (col)=>col.notNull()).addColumn('exposure_id', t.text, (col)=>col.notNull()).addColumn('catalog_id', t.text, (col)=>col.notNull()).addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('circle_id', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_catalog_offers', [
+                'owner',
+                'exposure_id'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_catalog_offers_group_circle').ifNotExists().on('kubun_p2p_catalog_offers').columns([
+                'group_id',
+                'circle_id'
+            ]).execute();
+            await db.schema.createTable('kubun_p2p_catalog_routes').ifNotExists().addColumn('owner', t.text, (col)=>col.notNull()).addColumn('catalog_id', t.text, (col)=>col.notNull()).addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('pull', 'integer', (col)=>col.notNull().defaultTo(0)).addColumn('push', 'integer', (col)=>col.notNull().defaultTo(0)).addPrimaryKeyConstraint('pk_p2p_catalog_routes', [
+                'owner',
+                'catalog_id',
+                'group_id'
+            ]).execute();
+            // Document-sync progress with one peer in one group: the last resolved
+            // document key, whether the current cycle's examined ranges were all clear,
+            // the hash of the accepted rule set without absolute bounds, and the
+            // absolute bounds in use until the cursor wraps.
+            await db.schema.createTable('kubun_p2p_catalog_cursors').ifNotExists().addColumn('peer_did', t.text, (col)=>col.notNull()).addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('rules_hash', t.text, (col)=>col.notNull()).addColumn('last_key', t.text)// The responder's sealed position for `last_key`; opaque here.
+            .addColumn('last_token', t.text).addColumn('cycle_clear', 'integer', (col)=>col.notNull().defaultTo(1)).addColumn('bounds', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_catalog_cursors', [
+                'peer_did',
+                'group_id'
+            ]).execute();
+            // A document whose difference with some peer is not resolved.
+            // `listed_by` is the first peer whose tree listed it, so it is a repair to
+            // retry; null when no peer listed it and the row only remembers answers.
+            // Rows expire from `created_at`, so none outlives its window whoever
+            // listed it.
+            await db.schema.createTable('kubun_p2p_document_repairs').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('document_id', t.text, (col)=>col.notNull()).addColumn('listed_by', t.text).addColumn('holdings_digest', t.text, (col)=>col.notNull()).addColumn('created_at', t.bigint, (col)=>col.notNull()).addColumn('attempted_at', t.bigint, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_document_repairs', [
+                'group_id',
+                'document_id'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_document_repairs_lister').ifNotExists().on('kubun_p2p_document_repairs').columns([
+                'group_id',
+                'listed_by',
+                'attempted_at'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_document_repairs_created').ifNotExists().on('kubun_p2p_document_repairs').columns([
+                'group_id',
+                'created_at'
+            ]).execute();
+            // A peer's last answer, "unavailable" or "refused", for a repair row's
+            // current holdings. A change of holdings removes the answers.
+            await db.schema.createTable('kubun_p2p_document_repair_answers').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('document_id', t.text, (col)=>col.notNull()).addColumn('peer_did', t.text, (col)=>col.notNull()).addColumn('answer', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_document_repair_answers', [
+                'group_id',
+                'document_id',
+                'peer_did'
+            ]).execute();
+            // When this device next asks peers for an observed document's value, for
+            // the obligation observed at `fetch_hlc`. The connector owns the
+            // obligation; a row leaves only when it resolves.
+            await db.schema.createTable('kubun_p2p_observation_repairs').ifNotExists().addColumn('document_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('fetch_hlc', t.text, (col)=>col.notNull()).addColumn('attempts', 'integer', (col)=>col.notNull()).addColumn('next_attempt_at', t.bigint, (col)=>col.notNull()).addColumn('tried_count', 'integer', (col)=>col.notNull()).execute();
+            await db.schema.createIndex('idx_p2p_observation_repairs_next').ifNotExists().on('kubun_p2p_observation_repairs').columns([
+                'next_attempt_at',
+                'document_id'
+            ]).execute();
+            // The peers already asked for an obligation that answered without it.
+            await db.schema.createTable('kubun_p2p_observation_repair_peers').ifNotExists().addColumn('document_id', t.text, (col)=>col.notNull()).addColumn('peer_did', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_observation_repair_peers', [
+                'document_id',
+                'peer_did'
+            ]).execute();
+            // Newest leave-request stamp surfaced per (group, member), so a replayed
+            // or duplicate request is not surfaced again. Separate from the membership
+            // row because it must outlive a removal: a re-added member's old requests
+            // stay spent.
+            await db.schema.createTable('kubun_p2p_group_leave_requests').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('member_did', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_group_leave_requests', [
+                'group_id',
+                'member_did'
+            ]).execute();
             // Circles
-            await db.schema.createTable('kubun_p2p_circles').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('name', t.text, (col)=>col.notNull()).addColumn('description', t.text, (col)=>col.notNull().defaultTo('')).addColumn('catalog_ids', t.json, (col)=>col.notNull().defaultTo('[]')).addColumn('hlc', t.text, (col)=>col.notNull())// Projection of the group's current `openCircleIDs`: 1 marks the circle
+            await db.schema.createTable('kubun_p2p_circles').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('name', t.text, (col)=>col.notNull()).addColumn('description', t.text, (col)=>col.notNull().defaultTo('')).addColumn('hlc', t.text, (col)=>col.notNull())// Projection of the group's current `openCircleIDs`: 1 marks the circle
             // open (every group member has implicit access), 0 closed. Integer 0/1
             // mirrors the catalog `active` flag, keeping the read-back value uniform
             // across SQLite and Postgres. A circle is closed until a settings fold
@@ -61,9 +154,19 @@ import { sql } from 'kysely';
             // one group a delegation `jti` was granted in, so the p2p layer can still
             // resolve a cap's group for revoke-broadcast targeting and listing
             // enrichment. One group per `jti`, so `jti` is the primary key.
-            await db.schema.createTable('kubun_p2p_group_delegation').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('jti', t.text, (col)=>col.notNull().primaryKey()).execute();
+            await db.schema.createTable('kubun_p2p_group_delegation').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('jti', t.text, (col)=>col.notNull().primaryKey()).addColumn('pending_grant_hlc', t.text).addColumn('pending_grant_digest', t.text).addColumn('pending_revocation_hlc', t.text).addColumn('pending_revocation_digest', t.text).execute();
+            await db.schema.createIndex('idx_p2p_group_delegation_pending_grant').ifNotExists().on('kubun_p2p_group_delegation').columns([
+                'group_id',
+                'pending_grant_hlc'
+            ]).execute();
+            await db.schema.createIndex('idx_p2p_group_delegation_pending_revocation').ifNotExists().on('kubun_p2p_group_delegation').columns([
+                'group_id',
+                'pending_revocation_hlc'
+            ]).execute();
             // Group MLS state
-            await db.schema.createTable('kubun_p2p_group_mls_state').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('device_id', t.text, (col)=>col.notNull()).addColumn('mls_state', t.binary, (col)=>col.notNull()).addColumn('credential', t.text, (col)=>col.notNull()).addColumn('epoch', 'integer', (col)=>col.notNull()).addColumn('ledger_entries', t.text, (col)=>col.notNull().defaultTo('[]')).addColumn('updated_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_p2p_group_mls_state', [
+            await db.schema.createTable('kubun_p2p_group_mls_state').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('device_id', t.text, (col)=>col.notNull()).addColumn('mls_state', t.binary, (col)=>col.notNull()).addColumn('credential', t.text, (col)=>col.notNull()).addColumn('epoch', 'integer', (col)=>col.notNull())// Orders in-place secret-tree mutations within one epoch.
+            .addColumn('state_version', 'integer', (col)=>col.notNull().defaultTo(0)).addColumn('is_deleted', 'integer', (col)=>col.notNull().defaultTo(0))// Highest sender generation reserved at this epoch; restore skips past it.
+            .addColumn('sender_generation_hwm', 'integer', (col)=>col.notNull().defaultTo(0)).addColumn('ledger_entries', t.text, (col)=>col.notNull().defaultTo('[]')).addColumn('updated_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_p2p_group_mls_state', [
                 'group_id',
                 'device_id'
             ]).execute();
@@ -86,6 +189,8 @@ import { sql } from 'kysely';
                 'mls_group_id'
             ]).execute();
             await db.schema.createIndex('idx_p2p_broadcast_log_doc').ifNotExists().on('kubun_p2p_broadcast_log').column('doc_id').execute();
+            // The broadcast log is pruned by age.
+            await db.schema.createIndex('idx_p2p_broadcast_log_broadcast_at').ifNotExists().on('kubun_p2p_broadcast_log').column('broadcast_at').execute();
             // Hubs (device-local, never synced — no hlc column)
             await db.schema.createTable('kubun_p2p_hubs').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('label', t.text).addColumn('url', t.text, (col)=>col.notNull().unique()).addColumn('server_did', t.text).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addColumn('updated_at', t.timestamp).execute();
             // Group hubs (join table, device-local — no hlc column). A group commits
@@ -113,7 +218,8 @@ import { sql } from 'kysely';
             // nullable because most requests produce nothing to hand back; it is
             // written on settle and deleted with the row on ack, so the retention of
             // whatever it holds is bounded by the request's own lifetime.
-            await db.schema.createTable('kubun_p2p_control_requests').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('kind', t.text, (col)=>col.notNull()).addColumn('status', t.text, (col)=>col.notNull().defaultTo('pending')).addColumn('error', t.text).addColumn('result', t.text).addColumn('enqueued_at', t.text, (col)=>col.notNull()).addColumn('settled_at', t.text).execute();
+            await db.schema.createTable('kubun_p2p_control_requests').ifNotExists().addColumn('id', t.text, (col)=>col.notNull().primaryKey()).addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('kind', t.text, (col)=>col.notNull()).addColumn('status', t.text, (col)=>col.notNull().defaultTo('pending')).addColumn('error', t.text).addColumn('result', t.text).addColumn('enqueued_at', t.text, (col)=>col.notNull()).addColumn('settled_at', t.text)// Epoch of the advance that settled the request committed.
+            .addColumn('settled_epoch', 'integer').execute();
             await db.schema.createIndex('idx_p2p_control_requests_group').ifNotExists().on('kubun_p2p_control_requests').columns([
                 'group_id',
                 'enqueued_at'
@@ -121,17 +227,35 @@ import { sql } from 'kysely';
             // CommitJournal store (backs the `@kumiai/rpc` CommitJournal port).
             // `group_id` is the primary key: a single slot per group, so a fresh `put`
             // upserts/replaces the whole row.
-            await db.schema.createTable('kubun_p2p_commit_journal').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('publish_id', t.text, (col)=>col.notNull()).addColumn('expected_head', t.text).addColumn('epoch', t.bigint, (col)=>col.notNull()).addColumn('accepted_as', t.text).addColumn('commit', t.binary, (col)=>col.notNull()).addColumn('bodies', t.json, (col)=>col.notNull()).addColumn('kind', t.text, (col)=>col.notNull()).addColumn('journal', t.binary, (col)=>col.notNull()).execute();
+            await db.schema.createTable('kubun_p2p_commit_journal').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('publish_id', t.text, (col)=>col.notNull()).addColumn('expected_head', t.text).addColumn('epoch', t.bigint, (col)=>col.notNull()).addColumn('accepted_as', t.text).addColumn('commit', t.binary, (col)=>col.notNull()).addColumn('bodies', t.json, (col)=>col.notNull()).addColumn('kind', t.text, (col)=>col.notNull()).addColumn('journal', t.binary, (col)=>col.notNull()).addColumn('holds_log_sends', 'integer', (col)=>col.notNull().defaultTo(0)).execute();
             // App-lane anchor + per-topic read positions (back the `@kumiai/rpc`
             // `AnchorStore` and `AppCursorStore` ports). The anchor table is a single
             // slot per group, so a rotation upserts and replaces the whole row;
             // cursors are keyed by (group, topic) so a deleted group takes its cursors
             // with it.
-            await db.schema.createTable('kubun_p2p_group_anchor').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('secret', t.binary, (col)=>col.notNull()).addColumn('epoch', t.bigint, (col)=>col.notNull()).execute();
+            await db.schema.createTable('kubun_p2p_group_anchor').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('secret', t.binary, (col)=>col.notNull()).addColumn('epoch', t.bigint, (col)=>col.notNull()).addColumn('pending', t.json).execute();
+            await db.schema.createTable('kubun_p2p_app_outbox_state').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull().primaryKey()).addColumn('key', t.binary).addColumn('commit_cursor', t.json).execute();
+            await db.schema.createTable('kubun_p2p_app_outbox').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('seq', t.bigint, (col)=>col.notNull()).addColumn('protocol', t.text, (col)=>col.notNull()).addColumn('prc', t.text, (col)=>col.notNull()).addColumn('data', t.binary, (col)=>col.notNull()).addColumn('iv', t.binary, (col)=>col.notNull()).addColumn('last_attempt', t.json).addPrimaryKeyConstraint('pk_p2p_app_outbox', [
+                'group_id',
+                'seq'
+            ]).execute();
             await db.schema.createTable('kubun_p2p_app_cursor').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('topic_id', t.text, (col)=>col.notNull()).addColumn('position', t.text, (col)=>col.notNull()).addPrimaryKeyConstraint('pk_p2p_app_cursor', [
                 'group_id',
                 'topic_id'
             ]).execute();
+            // Decrypted app frames awaiting application. The frame ID is stable across
+            // redelivery, so the first staged record wins until it is completed.
+            await db.schema.createTable('kubun_p2p_app_pending').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('device_id', t.text, (col)=>col.notNull()).addColumn('frame_id', t.text, (col)=>col.notNull()).addColumn('topic_id', t.text, (col)=>col.notNull()).addColumn('protocol', t.text, (col)=>col.notNull()).addColumn('segment', 'integer', (col)=>col.notNull()).addColumn('position', t.text, (col)=>col.notNull()).addColumn('payload', t.binary, (col)=>col.notNull()).addColumn('sender_did', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_p2p_app_pending', [
+                'group_id',
+                'device_id',
+                'frame_id'
+            ]).execute();
+            await db.schema.createTable('kubun_p2p_log_handler_completion').ifNotExists().addColumn('group_id', t.text, (col)=>col.notNull()).addColumn('procedure', t.text, (col)=>col.notNull()).addColumn('entity', t.text, (col)=>col.notNull()).addColumn('hlc', t.text, (col)=>col.notNull()).addColumn('notify', 'integer', (col)=>col.notNull().defaultTo(0)).addColumn('completed', 'integer', (col)=>col.notNull().defaultTo(0)).addPrimaryKeyConstraint('pk_p2p_log_handler_completion', [
+                'group_id',
+                'procedure',
+                'entity',
+                'hlc'
+            ]).execute();
             // The peer-discovery projection: one row per (group, peer) folded from
             // authenticated `peer/announce` frames. `peer_did` is the MLS-authenticated
             // announcer, which is why the primary key is (group, peer) and there is no
@@ -158,10 +282,26 @@ import { sql } from 'kysely';
             .addColumn('payload', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).execute();
         },
         async down (db) {
+            await db.schema.dropTable('kubun_p2p_access_default_revocations').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_binding_evidence').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_own_agents_join_capabilities').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_own_agents_grants').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_own_agents_records').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_observation_repair_peers').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_observation_repairs').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_document_repair_answers').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_document_repairs').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_catalog_cursors').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_catalog_routes').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_catalog_offers').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_pending_join_requests').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_local_peer_profile').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_peer_announcements').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_app_pending').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_log_handler_completion').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_app_cursor').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_app_outbox').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_app_outbox_state').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_group_anchor').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_commit_journal').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_control_requests').ifExists().execute();
@@ -175,6 +315,7 @@ import { sql } from 'kysely';
             await db.schema.dropTable('kubun_p2p_group_delegation').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_circle_members').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_circles').ifExists().execute();
+            await db.schema.dropTable('kubun_p2p_group_leave_requests').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_group_members').ifExists().execute();
             await db.schema.dropTable('kubun_p2p_groups').ifExists().execute();
         }

package/lib/ops/app-lane.d.ts

@@ -1,8 +1,37 @@
 import type { Adapter } from '@kubun/db-adapter';
+import { type AnchorSlot } from '@kumiai/rpc';
 import type { Kysely } from 'kysely';
-import type { AppCursor, GroupAnchor, P2PStoreTables } from '../tables.js';
-/** App-lane anchors and per-topic read cursors. */
+import type { AppCursor, GroupAnchor, InsertGroupMLSState, P2PStoreTables, PendingAppFrameRow } from '../tables.js';
+export type OpenedAppFrameExpectedVersion = {
+    epoch: number;
+    stateVersion: number;
+};
+export type OpenedAppFrameRecord = {
+    frameID: string;
+    topicID: string;
+    protocol: string;
+    segment: number;
+    position: string;
+    payload: Uint8Array;
+    senderDID: string;
+};
+export type SaveOpenedAppFrameParams = {
+    state: InsertGroupMLSState;
+    expected: OpenedAppFrameExpectedVersion;
+    record: OpenedAppFrameRecord;
+};
+/** App-lane anchors, read cursors, and pending opened frames. */
 export type AppLaneOps = {
+    /** Commit the MLS CAS and pending insert together. */
+    saveOpenedAppFrame(params: SaveOpenedAppFrameParams): Promise<boolean>;
+    listPendingAppFrames(groupID: string, deviceID: string): Promise<Array<PendingAppFrameRow>>;
+    completePendingAppFrame(groupID: string, deviceID: string, frameID: string): Promise<void>;
+    /**
+     * Erase one membership's app-lane state: this device's pending frames, the
+     * group's anchor and its read cursors. A later membership must start from no
+     * anchor, which the peer reads as first boot and seeds from its live handle.
+     */
+    deleteGroupAppLane(groupID: string, deviceID: string): Promise<void>;
     /**
      * Write the group's anchor slot, REPLACING whatever it held. Single slot per
      * group: the anchor moves as a pair (secret + the epoch it was exported at),
@@ -12,6 +41,7 @@ export type AppLaneOps = {
         groupID: string;
         secret: Uint8Array;
         epoch: number;
+        pending?: AnchorSlot['pending'];
     }): Promise<void>;
     /** The group's anchor, or `undefined` if the group has never stored one. */
     getGroupAnchor(groupID: string): Promise<GroupAnchor | undefined>;

package/lib/ops/app-lane.js

@@ -1,10 +1,62 @@
+import { sortPendingAppFrames } from '@kumiai/rpc';
+import { createMLSOps } from './mls.js';
 export function createAppLaneOps(db, adapter) {
     return {
+        async saveOpenedAppFrame ({ state, expected, record }) {
+            const save = async (tx)=>{
+                if (!await createMLSOps(tx, adapter).saveMLSState(state, expected)) return false;
+                await tx.insertInto('kubun_p2p_app_pending').values({
+                    group_id: state.group_id,
+                    device_id: state.device_id,
+                    frame_id: record.frameID,
+                    topic_id: record.topicID,
+                    protocol: record.protocol,
+                    segment: record.segment,
+                    position: record.position,
+                    payload: adapter.encodeBinary(record.payload),
+                    sender_did: record.senderDID
+                }).onConflict((oc)=>oc.columns([
+                        'group_id',
+                        'device_id',
+                        'frame_id'
+                    ]).doNothing()).execute();
+                return true;
+            };
+            return db.isTransaction ? await save(db) : await db.transaction().execute(save);
+        },
+        async listPendingAppFrames (groupID, deviceID) {
+            const rows = await db.selectFrom('kubun_p2p_app_pending').selectAll().where('group_id', '=', groupID).where('device_id', '=', deviceID).execute();
+            const sorted = sortPendingAppFrames(rows.map((row)=>({
+                    frame: {
+                        id: row.frame_id,
+                        topicID: row.topic_id,
+                        protocol: row.protocol,
+                        segment: row.segment,
+                        position: row.position
+                    },
+                    payload: row.payload,
+                    senderDID: row.sender_did,
+                    row
+                })));
+            return sorted.map(({ row })=>row);
+        },
+        async completePendingAppFrame (groupID, deviceID, frameID) {
+            await db.deleteFrom('kubun_p2p_app_pending').where('group_id', '=', groupID).where('device_id', '=', deviceID).where('frame_id', '=', frameID).execute();
+        },
+        async deleteGroupAppLane (groupID, deviceID) {
+            const remove = async (tx)=>{
+                await tx.deleteFrom('kubun_p2p_app_pending').where('group_id', '=', groupID).where('device_id', '=', deviceID).execute();
+                await tx.deleteFrom('kubun_p2p_group_anchor').where('group_id', '=', groupID).execute();
+                await tx.deleteFrom('kubun_p2p_app_cursor').where('group_id', '=', groupID).execute();
+            };
+            return db.isTransaction ? await remove(db) : await db.transaction().execute(remove);
+        },
         async putGroupAnchor (params) {
             const values = {
                 group_id: params.groupID,
                 secret: adapter.encodeBinary(params.secret),
-                epoch: params.epoch
+                epoch: params.epoch,
+                pending: params.pending == null ? null : adapter.encodeJSON(params.pending)
             };
             await db.insertInto('kubun_p2p_group_anchor')// Single slot per group: a rotation REPLACES both halves together. The
             // secret and the epoch it was exported at both feed topic derivation,
@@ -12,7 +64,8 @@ export function createAppLaneOps(db, adapter) {
             // a topic no member is on.
             .values(values).onConflict((oc)=>oc.column('group_id').doUpdateSet((eb)=>({
                         secret: eb.ref('excluded.secret'),
-                        epoch: eb.ref('excluded.epoch')
+                        epoch: eb.ref('excluded.epoch'),
+                        pending: eb.ref('excluded.pending')
                     }))).execute();
         },
         async getGroupAnchor (groupID) {

package/lib/ops/app-outbox.d.ts

@@ -0,0 +1,44 @@
+import type { Adapter } from '@kubun/db-adapter';
+import { type AppOutbox } from '@kumiai/rpc';
+import type { Runtime } from '@sozai/runtime';
+import type { Kysely } from 'kysely';
+import type { P2PStoreTables } from '../tables.js';
+export declare class AppOutboxDecryptionError extends Error {
+    name: string;
+}
+export declare class AppOutboxTransactionError extends Error {
+    name: string;
+}
+export declare class PendingRevocationAdmissionError extends Error {
+    name: string;
+}
+/** A voluntary leave would erase revocations the hub has not accepted yet. */
+export declare class UndeliveredRevocationsError extends Error {
+    name: string;
+}
+export type ClearAppOutboxRowsOptions = {
+    /** Refuse, before writing anything, while revocations remain undelivered. */
+    requireRevocationsDelivered?: boolean;
+};
+/** Port options matching the peer that owns the outbox. */
+export type AppOutboxPortOptions = {
+    /**
+     * The peer's entry limit. While a revocation is pending, entries other than
+     * revocations stop one short of it, keeping the last slot for revocations.
+     */
+    limit?: number;
+};
+export type AppOutboxOps = {
+    appOutboxFor(groupID: string, options?: AppOutboxPortOptions): AppOutbox;
+    clearAppOutbox(groupID: string): Promise<void>;
+    /**
+     * Whether the group still holds a revocation marker or a queued revocation entry
+     * the hub has not yet accepted.
+     */
+    hasUndeliveredRevocations(groupID: string): Promise<boolean>;
+};
+/** Coordinate status transitions with revocation admission and outbox erasure. */
+export declare function lockAppOutboxForErasure(db: Kysely<P2PStoreTables>, groupID: string, options?: ClearAppOutboxRowsOptions): Promise<void>;
+/** The caller's transaction also covers group leave or deletion. */
+export declare function clearAppOutboxRows(db: Kysely<P2PStoreTables>, groupID: string, options?: ClearAppOutboxRowsOptions): Promise<Array<number>>;
+export declare function createAppOutboxOps(db: Kysely<P2PStoreTables>, adapter: Adapter, getRandomValues: Runtime['getRandomValues']): AppOutboxOps;