@steve02081504/fount-p2p 0.0.0

package/files/assemble.mjs

@@ -0,0 +1,220 @@
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+import { setImmediate } from 'node:timers'
+
+import { FEDERATION_CHUNK_MAX_BYTES } from '../core/constants.mjs'
+import {
+	encryptConvergentPlaintext,
+	encryptRandomPlaintext,
+	wrapContentKey,
+} from '../crypto/key.mjs'
+
+import { normalizeFileManifest, publicTransferKeyDescriptor } from './manifest.mjs'
+
+/** @type {Record<string, (plain: Buffer) => { contentHash: string, ciphertextHash: string, raw: Buffer, contentKey?: Buffer }>} */
+const ENCRYPTION_STRATEGIES = {
+	/**
+	 * @param {Buffer} plain 明文
+	 * @returns {{ contentHash: string, ciphertextHash: string, raw: Buffer }} 分块结果
+	 */
+	plain: (plain) => {
+		const contentHash = createHash('sha256').update(plain).digest('hex')
+		return { contentHash, ciphertextHash: contentHash, raw: plain }
+	},
+	/**
+	 * @param {Buffer} plain 明文
+	 * @returns {{ contentHash: string, ciphertextHash: string, raw: Buffer }} 分块结果
+	 */
+	convergent: (plain) => encryptConvergentPlaintext(plain),
+	/**
+	 * @param {Buffer} plain 明文
+	 * @returns {{ contentHash: string, ciphertextHash: string, raw: Buffer, contentKey: Buffer }} 分块结果
+	 */
+	random: (plain) => encryptRandomPlaintext(plain),
+}
+
+/**
+ * @typedef {import('./manifest.mjs').FileManifest} FileManifest
+ * @typedef {import('./manifest.mjs').CeMode} CeMode
+ */
+
+/**
+ * @param {CeMode} ceMode 模式
+ * @returns {(plain: Buffer) => { contentHash: string, ciphertextHash: string, raw: Buffer, contentKey?: Buffer }} 加密策略
+ */
+function encryptionStrategyFor(ceMode) {
+	const strategy = ENCRYPTION_STRATEGIES[ceMode]
+	if (!strategy) throw new Error(`unknown ceMode: ${ceMode}`)
+	return strategy
+}
+
+/**
+ * @param {Buffer | Uint8Array} plaintext 明文
+ * @param {CeMode} ceMode 模式
+ * @returns {{ contentHash: string, parts: Array<{ hash: string, size: number, raw: Buffer }>, contentKey?: Buffer }} 加密结果
+ */
+export function encryptPlaintextToParts(plaintext, ceMode = 'convergent') {
+	const plain = Buffer.from(plaintext)
+	const enc = encryptionStrategyFor(ceMode)(plain)
+	return {
+		contentHash: enc.contentHash,
+		parts: [{ hash: enc.ciphertextHash, size: enc.raw.length, raw: enc.raw }],
+		contentKey: enc.contentKey,
+	}
+}
+
+/**
+ * 将明文拆分为多块加密（大文件）。
+ * @param {Buffer | Uint8Array} plaintext 明文
+ * @param {CeMode} ceMode 模式
+ * @returns {{ contentHash: string, parts: Array<{ hash: string, size: number, raw: Buffer }>, contentKey?: Buffer }} 分块加密结果
+ */
+export function encryptPlaintextToMultiParts(plaintext, ceMode = 'convergent') {
+	const plain = Buffer.from(plaintext)
+	const contentHash = createHash('sha256').update(plain).digest('hex')
+	if (plain.length <= FEDERATION_CHUNK_MAX_BYTES)
+		return encryptPlaintextToParts(plain, ceMode)
+
+	/** @type {Array<{ hash: string, size: number, raw: Buffer }>} */
+	const parts = []
+	let contentKey = null
+	for (let offset = 0; offset < plain.length; offset += FEDERATION_CHUNK_MAX_BYTES) {
+		const slice = plain.subarray(offset, offset + FEDERATION_CHUNK_MAX_BYTES)
+		const enc = encryptionStrategyFor(ceMode)(slice)
+		if (ceMode === 'random') contentKey = enc.contentKey
+		parts.push({ hash: enc.ciphertextHash, size: enc.raw.length, raw: enc.raw })
+	}
+	return { contentHash, parts, contentKey: contentKey || undefined }
+}
+
+/**
+ * 异步多块加密，周期性让出事件循环。
+ * @param {Buffer | Uint8Array} plaintext 明文
+ * @param {CeMode} ceMode 模式
+ * @returns {Promise<{ contentHash: string, parts: Array<{ hash: string, size: number, raw: Buffer }>, contentKey?: Buffer }>} 分块加密结果
+ */
+export async function encryptPlaintextToMultiPartsAsync(plaintext, ceMode = 'convergent') {
+	const plain = Buffer.from(plaintext)
+	const contentHash = createHash('sha256').update(plain).digest('hex')
+	if (plain.length <= FEDERATION_CHUNK_MAX_BYTES)
+		return encryptPlaintextToParts(plain, ceMode)
+
+	/** @type {Array<{ hash: string, size: number, raw: Buffer }>} */
+	const parts = []
+	let contentKey = null
+	for (let offset = 0; offset < plain.length; offset += FEDERATION_CHUNK_MAX_BYTES) {
+		if (offset > 0) await new Promise(resolve => setImmediate(resolve))
+		const slice = plain.subarray(offset, offset + FEDERATION_CHUNK_MAX_BYTES)
+		const enc = encryptionStrategyFor(ceMode)(slice)
+		if (ceMode === 'random') contentKey = enc.contentKey
+		parts.push({ hash: enc.ciphertextHash, size: enc.raw.length, raw: enc.raw })
+	}
+	return { contentHash, parts, contentKey: contentKey || undefined }
+}
+
+/**
+ * @param {object} params 参数
+ * @param {string} params.ownerEntityHash 128 hex
+ * @param {string} params.logicalPath EVFS 路径
+ * @param {Buffer | Uint8Array} params.plaintext 明文
+ * @param {string} [params.name] 文件名
+ * @param {string} [params.mimeType] MIME
+ * @param {CeMode} [params.ceMode] 加密模式
+ * @param {import('./manifest.mjs').TransferKeyDescriptor} [params.transferKeyDescriptor] 传递密钥
+ * @param {object} [params.meta] 元数据
+ * @returns {FileManifest} manifest（未写盘）
+ */
+export function buildFileManifest(params) {
+	const {
+		ownerEntityHash,
+		logicalPath,
+		plaintext,
+		name,
+		mimeType = 'application/octet-stream',
+		ceMode = 'convergent',
+		transferKeyDescriptor,
+		meta,
+	} = params
+	const enc = encryptPlaintextToParts(plaintext, ceMode)
+	const manifest = normalizeFileManifest({
+		ownerEntityHash: ownerEntityHash.toLowerCase(),
+		logicalPath: logicalPath.replace(/^\/+/, ''),
+		name: name || logicalPath.split('/').pop() || 'file',
+		mimeType,
+		size: Buffer.from(plaintext).length,
+		contentHash: enc.contentHash,
+		ceMode,
+		parts: enc.parts.map(part => ({ hash: part.hash, size: part.size })),
+		transferKeyDescriptor: transferKeyDescriptor || publicTransferKeyDescriptor(),
+		meta,
+	})
+	if (!manifest) throw new Error('invalid manifest')
+	return manifest
+}
+
+/**
+ * 由已加密分块构建 manifest（vault / file-master-key-wrap 等需自定义 transferKeyDescriptor）。
+ * @param {object} params 与 buildFileManifest 相同字段（不含 plaintext 重加密）
+ * @param {{ contentHash: string, parts: Array<{ hash: string, size: number, raw?: Buffer }> }} enc 加密结果
+ * @returns {FileManifest} manifest
+ */
+export function buildFileManifestFromEnc(params, enc) {
+	const {
+		ownerEntityHash,
+		logicalPath,
+		plaintext,
+		name,
+		mimeType = 'application/octet-stream',
+		ceMode = 'convergent',
+		transferKeyDescriptor,
+		meta,
+	} = params
+	const manifest = normalizeFileManifest({
+		ownerEntityHash: ownerEntityHash.toLowerCase(),
+		logicalPath: logicalPath.replace(/^\/+/, ''),
+		name: name || logicalPath.split('/').pop() || 'file',
+		mimeType,
+		size: Buffer.from(plaintext).length,
+		contentHash: enc.contentHash,
+		ceMode,
+		parts: enc.parts.map(part => ({ hash: part.hash, size: part.size })),
+		transferKeyDescriptor: transferKeyDescriptor || publicTransferKeyDescriptor(),
+		meta,
+	})
+	if (!manifest) throw new Error('invalid manifest')
+	return manifest
+}
+
+/**
+ * @param {string} groupId 群 ID
+ * @param {Buffer} contentKey 随机 contentKey
+ * @param {Buffer | string} H 群/vault 秘密
+ * @param {string} fileId 文件 ID
+ * @param {number} keyGeneration 密钥代次
+ * @returns {import('./manifest.mjs').TransferKeyDescriptor} 传输密钥描述
+ */
+export function fileMasterKeyWrapDescriptor(groupId, fileId, contentKey, H, keyGeneration = 0) {
+	return {
+		type: 'file-master-key-wrap',
+		groupId,
+		fileId,
+		keyGeneration,
+		wrappedKey: wrapContentKey(contentKey, H, fileId),
+	}
+}
+
+/**
+ * @param {string} entityHash 所有者
+ * @param {string} fileId 文件 ID
+ * @param {Buffer} contentKey 随机密钥
+ * @param {Buffer | string} H vault H
+ * @returns {import('./manifest.mjs').TransferKeyDescriptor} 传输密钥描述
+ */
+export function vaultWrapDescriptor(entityHash, fileId, contentKey, H) {
+	return {
+		type: 'vault-wrap',
+		entityHash: entityHash.toLowerCase(),
+		fileId,
+		wrappedKey: wrapContentKey(contentKey, H, fileId),
+	}
+}

package/files/assemble_stream.mjs

@@ -0,0 +1,129 @@
+import { Buffer } from 'node:buffer'
+import { createHash } from 'node:crypto'
+import { Readable } from 'node:stream'
+
+import { FEDERATION_CHUNK_MAX_BYTES } from '../core/constants.mjs'
+import {
+	encryptConvergentPlaintext,
+	encryptRandomPlaintext,
+} from '../crypto/key.mjs'
+
+import { decryptPart } from './transfer_key.mjs'
+
+/**
+ * @typedef {import('./manifest.mjs').CeMode} CeMode
+ * @typedef {{ hash: string, size: number, raw: Buffer }} EncryptedPart
+ */
+
+/**
+ * 从可读流分块加密并流式落盘（每块经 onPart 回调）。
+ * @param {import('node:stream').Readable} readable 明文流
+ * @param {CeMode} [ceMode] 加密模式
+ * @param {(part: EncryptedPart) => Promise<void>} onPart 每块回调
+ * @param {number} [maxBytes] 最大字节
+ * @returns {Promise<{ contentHash: string, parts: Array<{ hash: string, size: number }>, contentKey?: Buffer }>} 分块结果
+ */
+export async function encryptReadableToParts(readable, ceMode = 'convergent', onPart, maxBytes = Infinity) {
+	const digest = createHash('sha256')
+	/** @type {Buffer[]} */
+	let pending = Buffer.alloc(0)
+	/** @type {Array<{ hash: string, size: number }>} */
+	const parts = []
+	let contentKey = null
+	let total = 0
+
+	/**
+	 * @param {Buffer} slice 明文块
+	 * @returns {Promise<void>}
+	 */
+	const flushSlice = async (slice) => {
+		digest.update(slice)
+		const enc = ceMode === 'random'
+			? encryptRandomPlaintext(slice)
+			: encryptConvergentPlaintext(slice)
+		if (ceMode === 'random') contentKey = enc.contentKey
+		const part = { hash: enc.ciphertextHash, size: enc.raw.length, raw: enc.raw }
+		parts.push({ hash: part.hash, size: part.size })
+		await onPart(part)
+	}
+
+	for await (const chunk of readable) {
+		const buf = Buffer.from(chunk)
+		total += buf.length
+		if (total > maxBytes)
+			throw new Error('plaintext exceeds max upload size')
+		pending = Buffer.concat([pending, buf])
+		while (pending.length >= FEDERATION_CHUNK_MAX_BYTES) {
+			const slice = pending.subarray(0, FEDERATION_CHUNK_MAX_BYTES)
+			pending = pending.subarray(FEDERATION_CHUNK_MAX_BYTES)
+			await flushSlice(slice)
+		}
+	}
+
+	if (pending.length)
+		await flushSlice(pending)
+
+	return {
+		contentHash: digest.digest('hex'),
+		parts,
+		contentKey: contentKey || undefined,
+	}
+}
+
+/**
+ * 将 manifest 各密文块解密后串联为可读流。
+ * @param {import('./manifest.mjs').FileManifest} manifest 清单
+ * @param {import('node:stream').Readable[]} partStreams 按序密文流
+ * @param {Buffer | null} contentKey 随机密钥
+ * @returns {Readable} 明文流
+ */
+export function createManifestPlaintextStream(manifest, partStreams, contentKey) {
+	let partIndex = 0
+	let currentStream = null
+	const digest = createHash('sha256')
+
+	return new Readable({
+		/**
+		 *
+		 */
+		async read() {
+			try {
+				while (true) {
+					if (!currentStream) {
+						if (partIndex >= partStreams.length) {
+							this.push(null)
+							return
+						}
+						currentStream = partStreams[partIndex++]
+					}
+					const chunk = currentStream.read()
+					if (chunk === null) {
+						currentStream = await new Promise((resolve, reject) => {
+							currentStream.once('end', () => resolve(null))
+							currentStream.once('error', reject)
+							currentStream.resume()
+						})
+						if (currentStream === null) {
+							currentStream = null
+							continue
+						}
+					}
+					if (chunk?.length) {
+						const plain = decryptPart(Buffer.from(chunk), manifest, contentKey)
+						if (!plain) {
+							this.destroy(new Error('decrypt failed'))
+							return
+						}
+						digest.update(plain)
+						if (!this.push(plain))
+							return
+						return
+					}
+				}
+			}
+			catch (error) {
+				this.destroy(error instanceof Error ? error : new Error(String(error)))
+			}
+		},
+	})
+}

package/files/chunk_fetch.mjs

@@ -0,0 +1,113 @@
+import { randomUUID } from 'node:crypto'
+
+import { u8ToB64 } from '../core/bytes_codec.mjs'
+import { FEDERATION_CHUNK_FETCH_FANOUT_K } from '../core/constants.mjs'
+import {
+	MAX_PENDING_CHUNK_FETCHES,
+	pendingChunkFetches,
+	registerChunkFetchWait,
+} from '../federation/chunk_fetch_pending.mjs'
+import { loadNetwork } from '../node/network.mjs'
+import { ensureLinkToNode, listLinks } from '../transport/link_registry.mjs'
+import { DEFAULT_TRUST_GRAPH_OWNER, requireTrustGraphProvider } from '../trust_graph/registry.mjs'
+
+import { verifiedChunkBytes } from './chunk_fetch_verify.mjs'
+import { fetchFederationChunk, resolveNodeHash } from './chunk_provider_registry.mjs'
+import { getChunk, hasChunk, putChunk } from './chunk_store.mjs'
+
+/**
+ * @typedef {{
+ *   username: string,
+ *   ciphertextHash: string,
+ *   ownerEntityHash?: string,
+ *   groupId?: string,
+ * }} FetchChunkContext
+ */
+
+/**
+ * @returns {string[]} 全局 CAS miss 时应尝试拨号/发送的 nodeHash 列表
+ */
+function chunkFetchPeerTargets() {
+	/** @type {Set<string>} */
+	const targets = new Set()
+	for (const { nodeHash } of listLinks())
+		if (nodeHash) targets.add(String(nodeHash).toLowerCase())
+	const net = loadNetwork()
+	for (const nodeHash of [...net.trustedPeers || [], ...net.explorePeers || []])
+		if (nodeHash) targets.add(String(nodeHash).toLowerCase())
+	for (const hint of net.hints || [])
+		if (hint?.nodeHash) targets.add(String(hint.nodeHash).toLowerCase())
+	return [...targets]
+}
+
+/**
+ * @param {FetchChunkContext} context 上下文
+ * @returns {Promise<Uint8Array | null>} 密文块
+ */
+export async function fetchChunk(context) {
+	const hash = String(context.ciphertextHash || '').trim().toLowerCase()
+	const username = context.username
+	if (!hash || !username) return null
+
+	if (await hasChunk(hash))
+		return new Uint8Array(await getChunk(hash))
+
+	if (context.groupId) {
+		const u8 = await fetchFederationChunk(username, context.groupId, hash)
+		const verified = verifiedChunkBytes(hash, u8)
+		if (verified) {
+			await putChunk(hash, verified)
+			return verified
+		}
+	}
+
+	if (pendingChunkFetches.size >= MAX_PENDING_CHUNK_FETCHES) return null
+
+	const requestId = randomUUID()
+	const { done } = registerChunkFetchWait(requestId, hash, 8000)
+	const { nodeHash } = await resolveNodeHash(username)
+	const payload = {
+		requestId,
+		nodeHash,
+		chunkHash: hash,
+		ownerEntityHash: context.ownerEntityHash,
+	}
+	const graph = await requireTrustGraphProvider(DEFAULT_TRUST_GRAPH_OWNER).buildMergedGraph(username)
+	const peerTargets = chunkFetchPeerTargets()
+	await Promise.all(peerTargets.map(nodeHash => ensureLinkToNode(nodeHash).catch(() => null)))
+	const tg = requireTrustGraphProvider(DEFAULT_TRUST_GRAPH_OWNER)
+	// 已直连 / follow hint peer 可能不在 trust-graph top-K（非成员 emoji CAS / Social 预览路径）。
+	for (const nodeHash of peerTargets)
+		void tg.sendToNode(username, nodeHash, 'fed_chunk_get', payload, graph)
+	await tg.fanoutToTopNodes(
+		username,
+		'fed_chunk_get',
+		payload,
+		FEDERATION_CHUNK_FETCH_FANOUT_K,
+	)
+	const result = await done
+	const verified = verifiedChunkBytes(hash, result)
+	if (verified) {
+		await putChunk(hash, verified)
+		return verified
+	}
+
+	return null
+}
+
+/**
+ * 若本机有 chunk 则响应 fed_chunk_get。
+ * @param {string} username 用户
+ * @param {object} payload 请求
+ * @param {(response: object, peerId: string) => void} sendResponse 发送
+ * @param {string} peerId 对端
+ * @returns {Promise<void>}
+ */
+export async function handleIncomingChunkGet(username, payload, sendResponse, peerId) {
+	const hash = String(payload?.chunkHash || '').trim().toLowerCase()
+	if (!hash) return
+	if (!await hasChunk(hash)) return
+	const chunkBytes = await getChunk(hash)
+	if (!chunkBytes?.length) return
+	sendResponse({ requestId: payload.requestId, dataB64: u8ToB64(chunkBytes) }, peerId)
+}

package/files/chunk_fetch_verify.mjs

@@ -0,0 +1,23 @@
+import { isHex64 } from '../core/hexIds.mjs'
+import { sha256Hex } from '../crypto/crypto.mjs'
+
+/**
+ * @param {string} chunkHash 期望的 64 hex 密文哈希
+ * @param {Uint8Array | Buffer | null | undefined} data 块字节
+ * @returns {boolean} 是否与 hash 一致
+ */
+export function chunkBytesMatchHash(chunkHash, data) {
+	const hash = String(chunkHash || '').trim().toLowerCase()
+	if (!isHex64(hash) || !data?.byteLength) return false
+	return sha256Hex(data) === hash
+}
+
+/**
+ * @param {string} chunkHash 期望哈希
+ * @param {Uint8Array | Buffer} data 块字节
+ * @returns {Uint8Array | null} 校验通过的数据；否则 null
+ */
+export function verifiedChunkBytes(chunkHash, data) {
+	if (!chunkBytesMatchHash(chunkHash, data)) return null
+	return data instanceof Uint8Array ? data : new Uint8Array(data)
+}

package/files/chunk_provider_registry.mjs

@@ -0,0 +1,70 @@
+/** @type {Map<string, (username: string, groupId: string, hash: string) => Promise<Uint8Array | null>>} */
+const federationFetchersByOwner = new Map()
+
+/** @type {Map<string, (username: string) => Promise<{ nodeHash: string }> | { nodeHash: string }>} */
+const nodeHashProvidersByOwner = new Map()
+
+/**
+ * @param {string} ownerId 注册方
+ * @param {(username: string, groupId: string, hash: string) => Promise<Uint8Array | null>} fetcher 联邦 chunk 拉取
+ * @returns {void}
+ */
+export function registerFederationChunkFetcher(ownerId, fetcher) {
+	federationFetchersByOwner.set(String(ownerId), fetcher)
+}
+
+/**
+ * @param {string} ownerId 注册方
+ * @param {(username: string) => Promise<{ nodeHash: string }> | { nodeHash: string }} provider nodeHash
+ * @returns {void}
+ */
+export function registerNodeHashProvider(ownerId, provider) {
+	nodeHashProvidersByOwner.set(String(ownerId), provider)
+}
+
+/**
+ * @param {string} ownerId 注册方
+ * @returns {void}
+ */
+export function unregisterChunkProviders(ownerId) {
+	const key = String(ownerId)
+	federationFetchersByOwner.delete(key)
+	nodeHashProvidersByOwner.delete(key)
+}
+
+/** @returns {void} */
+export function clearChunkProviderRegistry() {
+	federationFetchersByOwner.clear()
+	nodeHashProvidersByOwner.clear()
+}
+
+/**
+ * @param {string} username 用户
+ * @param {string} groupId 群 ID
+ * @param {string} hash chunk 哈希
+ * @returns {Promise<Uint8Array | null>} 密文块
+ */
+export async function fetchFederationChunk(username, groupId, hash) {
+	for (const fetcher of federationFetchersByOwner.values())
+		try {
+			const u8 = await fetcher(username, groupId, hash)
+			if (u8?.byteLength) return u8
+		}
+		catch { /* next */ }
+
+	return null
+}
+
+/**
+ * @param {string} username 副本用户名 登录名
+ * @returns {Promise<{ nodeHash: string }>} 节点标识
+ */
+export async function resolveNodeHash(username) {
+	for (const provider of nodeHashProvidersByOwner.values())
+		try {
+			return await provider(username)
+		}
+		catch { /* next */ }
+
+	return { nodeHash: 'local' }
+}

package/files/chunk_responder.mjs

@@ -0,0 +1,79 @@
+import { resolvePendingChunkFetch } from '../federation/chunk_fetch_pending.mjs'
+
+import { handleIncomingChunkGet } from './chunk_fetch.mjs'
+
+/**
+ * @param {string} username 副本用户名 用户名
+ * @param {object} data 入站 fed_chunk_get
+ * @param {string} peerId 对端 id
+ * @param {(resp: object, peerId: string) => void} sendChunkData 发送 fed_chunk_data
+ * @returns {Promise<void>}
+ */
+export async function handleFedChunkGetIngress(username, data, peerId, sendChunkData) {
+	await handleIncomingChunkGet(username, data, sendChunkData, peerId)
+}
+
+/**
+ * @param {object} data 入站 fed_chunk_data（含 requestId 时 resolve pending fetch）
+ * @returns {void}
+ */
+export function handleFedChunkDataIngress(data) {
+	resolvePendingChunkFetch(data)
+}
+
+/**
+ * node scope user-room wire：注册 fed_chunk_get / fed_chunk_data。
+ * @param {string} username 副本用户名 用户名
+ * @param {{ on: (name: string, handler: (payload: unknown, peerId: string) => void) => void, send: (name: string, payload: unknown, peerId: string | null) => void }} wire action 表
+ * @returns {void}
+ */
+export function attachNodeScopeFedChunkResponder(username, wire) {
+	wire.on('fed_chunk_get', (data, peerId) => {
+		void handleFedChunkGetIngress(username, data, peerId, (resp, pid) => {
+			try { wire.send('fed_chunk_data', resp, pid) }
+			catch { /* disconnected */ }
+		})
+	})
+	wire.on('fed_chunk_data', handleFedChunkDataIngress)
+}
+
+/**
+ * Trystero room：注册带 requestId 的 fed_chunk_get / fed_chunk_data（TrustGraph 全局 miss）。
+ * @param {string} username 用户
+ * @param {object} room Trystero room
+ * @param {{ enqueue: (prio: number, fn: () => void) => void }} [fedOut] 出站队列
+ * @param {(roomKey: string, action: string, rtcLimits: object) => boolean} [guardGet] RTC 负载守卫
+ * @param {object} [rtcLimits] RTC 限额
+ * @param {string} [roomKey] 房间键
+ * @returns {void}
+ */
+export function attachTrustGraphFedChunkResponder(username, room, fedOut, guardGet, rtcLimits = {}, roomKey = '') {
+	const [sendChunkData, getChunkData] = room.makeAction('fed_chunk_data')
+	const [, getChunkGet] = room.makeAction('fed_chunk_get')
+
+	getChunkGet((data, peerId) => {
+		if (guardGet && !guardGet(roomKey, 'fed_chunk_get', rtcLimits)) return
+		void (async () => {
+			if (!data || typeof data !== 'object') return
+			if (!String(data.requestId || '')) return
+			await handleFedChunkGetIngress(username, data, peerId, (resp, pid) => {
+				/**
+				 *
+				 */
+				const send = () => {
+					try { sendChunkData(resp, pid) }
+					catch (error) {
+						console.warn('federation: trust-graph chunk response failed', error)
+					}
+				}
+				if (fedOut) fedOut.enqueue(6, send)
+				else send()
+			})
+		})().catch(error => console.warn('federation: trust-graph chunk handler failed', error))
+	})
+
+	getChunkData(data => {
+		if (!data || typeof data !== 'object' || !data.requestId) return
+		handleFedChunkDataIngress(data)
+	})
+}