@cero-base/cero 1.14.1 → 1.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/cero",
-  "version": "1.14.1",
+  "version": "1.15.1",
   "description": "The ideal p2p API — everything is a handle, handles contain refs, refs contain rows.",
   "type": "module",
   "sideEffects": false,
@@ -95,13 +95,13 @@
     "test:node": "ls test/*.test.js | xargs -P1 -n1 brittle-node"
   },
   "dependencies": {
-    "@cero-base/core": "^1.14.1",
+    "@cero-base/core": "^1.15.1",
     "b4a": "^1.8.1",
     "bare-abort-controller": "^1.1.2",
     "bare-crypto": "^1.15.3",
     "bare-fs": "^4.8.1",
     "bare-path": "^3.1.1",
-    "ble-swarm": "^2.2.0",
+    "ble-swarm": "^2.3.0",
     "compact-encoding": "^3.3.2",
     "corestore": "^7.12.2",
     "hrpc": "^4.3.1",

package/src/handle/index.js

@@ -732,12 +732,14 @@ export class Handle extends ReadyResource {
   async _pair(invite, type, { routes, timeout } = {}, target = null) {
     const deadline = timeout || TIMEOUT
 
-    // Idempotent: if the invite targets a handle we already have AND we are
-    // still a member of it, return it — without pairing, so there's no
-    // waiting on a peer to confirm. If our member row is gone (we were
-    // removed), the stored writer is revoked and the old session can never
-    // become writable again — holding a fresh invite is exactly the
-    // re-admission path, so fall through to a real pairing instead.
+    // Idempotent: if the invite targets a handle we already have AND our
+    // stored writer is still admitted, return it — without pairing, so
+    // there's no waiting on a peer to confirm. A removed writer's core is
+    // frozen: the old session can never become writable again, and reusing
+    // its keypair would only get it re-removed. Holding a fresh invite is
+    // exactly the re-admission path, so fall through to a real pairing —
+    // which mints a fresh keypair the host admits. Our member row can outlive
+    // our writer (one revoked device), so the device row is the real test.
     if (target) {
       const { data: joined } = await this.store.get('handles')
       const existing = joined.find(
@@ -746,7 +748,8 @@ export class Handle extends ReadyResource {
       if (existing) {
         const known = await this._load(type, existing.id)
         const { data: me } = await known.store.get('members', this.identity.id)
-        if (me) return known
+        const { data: device } = await known.store.get('devices', toId(known.store.writerKey))
+        if (me && device) return known
         await known.close().catch(safetyCatch)
       }
     }

package/src/index.js

@@ -64,6 +64,7 @@ export { t, schema } from './lib/spec.js'
  * @property {string | null} [name]                    Friendly device name persisted on the identity claim.
  * @property {boolean} [isMobile]                      Marks this device as mobile.
  * @property {Array<{ host: string, port: number }>} [bootstrap]  Custom DHT bootstrap nodes.
+ * @property {number[]} [backoffs]                     Swarm reconnect backoff tiers in ms (testing/tuning).
  * @property {string} [channel]                        Optional network-isolation label; only same-channel peers connect.
  * @property {Array<string | Uint8Array>} [mirrors]    Blind-peer public keys. Rooms and files are mirrored through them so peers sync even when never online at the same time. Mirrors hold only encrypted blocks — they never read your data.
  * @property {Uint8Array} [key]                        Pre-existing database key (skip bootstrap).
@@ -127,6 +128,7 @@ export async function cero(dir, spec, opts = {}) {
 
     network = new Network({
       bootstrap: opts.bootstrap,
+      backoffs: opts.backoffs,
       channel: opts.channel,
       store,
       mirrors: opts.mirrors
@@ -155,6 +157,21 @@ export async function cero(dir, spec, opts = {}) {
     })
     await me.ready()
 
+    // a supplied or stored identity may already have history elsewhere —
+    // authoring genesis twice forks the seed-derived writer core (a writable
+    // core has one author, ever). Give discovery a moment; any replicated
+    // history means the caller wanted { recovery: true }. Offline reuse is
+    // undetectable — this catches the reachable-peer case loudly.
+    if (!writer && !opts.key && !opts.recovery && !fresh) {
+      const until = Date.now() + 1500
+      while (Date.now() < until) {
+        if (network.connections.size > 0) await me.store.bee.update().catch(safetyCatch)
+        if (me.store.length > 0 || me.store.bee.local.length > 0) {
+          throw CeroError.CONFLICT('identity already has history — open with { recovery: true }')
+        }
+        await new Promise((r) => setTimeout(r, 100))
+      }
+    }
     if (!writer && me.store.length === 0 && (!opts.key || opts.recovery)) {
       const result = await me.bootstrap({
         name: opts.name || null,

package/types/index.d.ts

@@ -10,6 +10,7 @@
  * @property {string | null} [name]                    Friendly device name persisted on the identity claim.
  * @property {boolean} [isMobile]                      Marks this device as mobile.
  * @property {Array<{ host: string, port: number }>} [bootstrap]  Custom DHT bootstrap nodes.
+ * @property {number[]} [backoffs]                     Swarm reconnect backoff tiers in ms (testing/tuning).
  * @property {string} [channel]                        Optional network-isolation label; only same-channel peers connect.
  * @property {Array<string | Uint8Array>} [mirrors]    Blind-peer public keys. Rooms and files are mirrored through them so peers sync even when never online at the same time. Mirrors hold only encrypted blocks — they never read your data.
  * @property {Uint8Array} [key]                        Pre-existing database key (skip bootstrap).
@@ -99,6 +100,10 @@ export type CeroOpts = {
         host: string;
         port: number;
     }>;
+    /**
+     * Swarm reconnect backoff tiers in ms (testing/tuning).
+     */
+    backoffs?: number[];
     /**
      * Optional network-isolation label; only same-channel peers connect.
      */