@cero-base/cero 1.7.0 → 1.8.0

package/README.md

@@ -521,14 +521,14 @@ The same `spec/index.js` is imported on both sides. `@cero-base/cero/build` emit
 
 Everything the local API offers, plus lifecycle methods on returned handles:
 
-| Operator / method                                                                                                    | Works over RPC |
-| -------------------------------------------------------------------------------------------------------------------- | -------------- |
-| `cero.put` / `set` / `get` / `del` / `count` / `watch` / `call`                                                      | ✓              |
-| `cero.open(ref, …)` — create, join, load by id                                                                       | ✓              |
-| `room.invite({ role, expiresIn, multiUse })` — mint an invite (`multiUse: true` keeps it alive after the first join) | ✓              |
-| `room.revoke(invite)` — invalidate an outstanding invite; `true` if it existed                                       | ✓              |
-| `room.close()` — release the handle on the server                                                                    | ✓              |
-| `room.leave()` — remove yourself from the room and from your handles list                                            | ✓              |
+| Operator / method                                                                                              | Works over RPC |
+| -------------------------------------------------------------------------------------------------------------- | -------------- |
+| `cero.put` / `set` / `get` / `del` / `count` / `watch` / `call`                                                | ✓              |
+| `cero.open(ref, …)` — create, join, load by id                                                                 | ✓              |
+| `room.invite({ role, expiresIn, reuse })` — mint an invite (`reuse: true` keeps it alive after the first join) | ✓              |
+| `room.revoke(invite)` — invalidate an outstanding invite; `true` if it existed                                 | ✓              |
+| `room.close()` — release the handle on the server                                                              | ✓              |
+| `room.leave()` — remove yourself from the room and from your handles list                                      | ✓              |
 
 `cero.watch(ref)` returns a Readable on both sides; snapshots flow as a server-streamed RPC.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/cero",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "The ideal p2p API — everything is a handle, handles contain refs, refs contain rows.",
   "type": "module",
   "sideEffects": false,
@@ -89,27 +89,27 @@
     "build:types": "rm -rf types && tsc -p .",
     "pretest": "npm run build:test",
     "prepublishOnly": "npm run build:types",
-    "test": "npm run test:node",
+    "test": "npm run test:bare",
     "pretest:bare": "npm run build:test",
     "test:bare": "ls test/*.test.js | xargs -P1 -n1 brittle-bare test/bare.js",
     "test:node": "ls test/*.test.js | xargs -P1 -n1 brittle-node"
   },
   "dependencies": {
-    "@cero-base/core": "^1.7.0",
+    "@cero-base/core": "^1.8.0",
     "b4a": "^1.8.1",
     "bare-abort-controller": "^1.1.2",
     "bare-crypto": "^1.15.3",
     "bare-fs": "^4.7.4",
     "bare-path": "^3.1.1",
     "compact-encoding": "^3.3.0",
-    "corestore": "^7.11.1",
+    "corestore": "^7.12.0",
     "hrpc": "^4.3.0",
-    "hypercore": "^11.34.1",
+    "hypercore": "^11.35.1",
     "hypercore-crypto": "^3.7.0",
     "hypercore-storage": "^3.2.0",
-    "hyperdb": "^6.7.0",
+    "hyperdb": "^6.8.0",
     "hyperdispatch": "^1.6.0",
-    "hyperschema": "^1.21.0",
+    "hyperschema": "^1.22.0",
     "ready-resource": "^1.2.0",
     "safety-catch": "^1.0.3",
     "streamx": "^2.28.0",

package/src/build/schemas.js

@@ -138,7 +138,7 @@ export const rpc = {
     handle: required(string),
     role: string,
     expiresIn: uint,
-    multiUse: bool
+    reuse: bool
   },
   'req-revoke': {
     handle: required(string),

package/src/handle/index.js

@@ -14,6 +14,7 @@ import { Pairing } from '@cero-base/core/pairing'
 import { toId, grants, addWriterPayload } from '@cero-base/core/utils'
 import { CeroError } from '@cero-base/core/errors'
 import { Blobs } from '@cero-base/core/blobs'
+import { decodeId } from '@cero-base/core/blobs/codec'
 import { FileServer } from '@cero-base/core/blobs/server'
 
 import { NS, TIMEOUT } from '../lib/constants.js'
@@ -121,6 +122,7 @@ export class Handle extends ReadyResource {
     this._onerror = this._opts.onerror || safetyCatch
     this.children = parent ? null : new Set()
     this._loading = parent ? null : new Map()
+    this._joining = parent ? null : new Map()
     this._coreKeys = parent ? null : new Map()
     this._fileServer = null
     this._blobs = null
@@ -339,6 +341,50 @@ export class Handle extends ReadyResource {
     return blobs
   }
 
+  /**
+   * Remember the blob-core key a file id points at so the file server can
+   * open the core. Lives on the Handle (not the shared operators) because the
+   * epoch-key derivation pulls native crypto — the RPC client must stay
+   * bundleable without it.
+   *
+   * @param {string} id
+   * @param {number} [stamp]
+   */
+  _registerBlobCore(id, stamp) {
+    if (!id || !this.root?._coreKeys) return
+    try {
+      const { coreKey } = decodeId(id)
+      const hex = b4a.toString(coreKey, 'hex')
+      if (!this.root._coreKeys.has(hex)) {
+        // a file-field value carries no stamp — look it up from the files row
+        // (fire-and-forget: idempotent, resolution happens again per request)
+        if (stamp === undefined) {
+          this.store
+            .get('files', id)
+            .then(({ data }) => data && this._registerBlobCore(id, data.stamp || 0))
+            .catch(safetyCatch)
+          return
+        }
+        const key = this._blobCoreKey(stamp)
+        if (!key) return // unknown epoch — this device is not entitled to the core
+        this.root._coreKeys.set(hex, key)
+      }
+      // remember which handle read it, so close prunes the entry (re-registered
+      // on the next read if another handle still serves the same core)
+      if (this !== this.root) (this._blobKeys ??= new Set()).add(hex)
+    } catch {
+      // ignore invalid ids
+    }
+  }
+
+  // Base-era blob cores use the OWNING handle's key (not the root's — rooms
+  // have their own keys); rotated-era cores derive from the epoch entropy.
+  _blobCoreKey(stamp) {
+    if (!stamp) return this.store.encryptionKey
+    const entropy = this.store.keyring.entropy(stamp)
+    return entropy ? blobEpochKey(entropy) : null
+  }
+
   /** Canonical id — identity id for the root handle, store key for children. */
   get id() {
     if (!this.parent) return this.identity.id
@@ -585,7 +631,33 @@ export class Handle extends ReadyResource {
    * @param {JoinChildOpts} [opts]
    * @returns {Promise<Handle>}
    */
-  async _join(invite, type, { routes, timeout } = {}) {
+  async _join(invite, type, opts = {}) {
+    // Coalesce concurrent joins of the same room (a retry racing a pending
+    // join, a double tap): the pairing layer allows one candidate per invite,
+    // so the second attempt must attach to the in-flight join, not start
+    // another handshake.
+    const target = Pairing.inviteTopic(invite)
+    const key = target && `${type}/${b4a.toString(target, 'hex')}`
+    if (!key) return this._pair(invite, type, opts, target)
+    const pending = this._joining.get(key)
+    if (pending) return pending
+    const joining = this._pair(invite, type, opts, target)
+    this._joining.set(key, joining)
+    try {
+      return await joining
+    } finally {
+      this._joining.delete(key)
+    }
+  }
+
+  /**
+   * @param {string} invite
+   * @param {string} type
+   * @param {JoinChildOpts} [opts]
+   * @param {Uint8Array | null} [target]
+   * @returns {Promise<Handle>}
+   */
+  async _pair(invite, type, { routes, timeout } = {}, target = null) {
     const deadline = timeout || TIMEOUT
 
     // Idempotent: if the invite targets a handle we already have AND we are
@@ -594,7 +666,6 @@ export class Handle extends ReadyResource {
     // removed), the stored writer is revoked and the old session can never
     // become writable again — holding a fresh invite is exactly the
     // re-admission path, so fall through to a real pairing instead.
-    const target = Pairing.inviteTopic(invite)
     if (target) {
       const { data: joined } = await this.store.get('handles')
       const existing = joined.find(
@@ -767,7 +838,9 @@ export class Handle extends ReadyResource {
     if (!spec) throw CeroError.REQUIRED('spec')
 
     const writer = Identity.randomKeyPair()
-    const pair = new Pairing({ network: net, identity: id })
+    // join-only: no member listener, so concurrent joins never collide on the
+    // identity-derived default topic ('Active member already exist')
+    const pair = new Pairing({ network: net, identity: id, host: false })
     await pair.ready()
 
     let key, encryptionKey, additional

package/src/lib/operators.js

@@ -2,7 +2,6 @@ import { Readable } from 'streamx'
 import b4a from 'b4a'
 
 import { encodeId, decodeId } from '@cero-base/core/blobs/codec'
-import { blobEpochKey } from '@cero-base/core/database/encryption'
 import { CeroError } from '@cero-base/core/errors'
 import { onAbort } from './utils.js'
 
@@ -169,7 +168,7 @@ function resolveRow(ref, row) {
   if (ref.handle.rpc) return ref.handle._resolveRow(ref.name, ref.handle._refInfo(ref.name), row)
   const handle = ref.handle
   const resolve = (id, name, stamp) => {
-    registerBlobCore(handle, id, stamp)
+    handle._registerBlobCore(id, stamp)
     return resolveFile(handle, id, name)
   }
   if (ref.name === 'files') {
@@ -186,41 +185,6 @@ function resolveRow(ref, row) {
   return out
 }
 
-function registerBlobCore(handle, id, stamp) {
-  if (!id || !handle.root?._coreKeys) return
-  try {
-    const { coreKey } = decodeId(id)
-    const hex = b4a.toString(coreKey, 'hex')
-    if (!handle.root._coreKeys.has(hex)) {
-      // a file-field value carries no stamp — look it up from the files row
-      // (fire-and-forget: idempotent, resolution happens again per request)
-      if (stamp === undefined) {
-        handle.store
-          .get('files', id)
-          .then(({ data }) => data && registerBlobCore(handle, id, data.stamp || 0))
-          .catch(() => {})
-        return
-      }
-      const key = blobCoreKey(handle, stamp)
-      if (!key) return // unknown epoch — this device is not entitled to the core
-      handle.root._coreKeys.set(hex, key)
-    }
-    // remember which handle read it, so close prunes the entry (re-registered
-    // on the next read if another handle still serves the same core)
-    if (handle !== handle.root) (handle._blobKeys ??= new Set()).add(hex)
-  } catch {
-    // ignore invalid ids
-  }
-}
-
-// Base-era blob cores use the OWNING handle's key (not the root's — rooms have
-// their own keys); rotated-era cores derive from the epoch entropy.
-function blobCoreKey(handle, stamp) {
-  if (!stamp) return handle.store.encryptionKey
-  const entropy = handle.store.keyring.entropy(stamp)
-  return entropy ? blobEpochKey(entropy) : null
-}
-
 /**
  * Read from `ref`. For data refs, dispatches to the underlying store. For
  * `handle`-kind refs, lists existing child handles of that type from the

package/src/rpc/client.js

@@ -385,12 +385,12 @@ const operators = {
    * @param {{ role?: string }} [opts]
    * @returns {Promise<string>}
    */
-  async invite({ role, expiresIn, multiUse } = {}) {
+  async invite({ role, expiresIn, reuse } = {}) {
     const { invite } = await this.rpc.invite({
       handle: this.id,
       role: role || '',
       expiresIn: expiresIn || 0,
-      multiUse: multiUse === true
+      reuse: reuse === true
     })
     return invite
   },

package/src/rpc/server.js

@@ -267,12 +267,12 @@ export class Server extends RPCServer {
 
   /** Register invite/revoke/join RPC handlers. */
   _wirePairing() {
-    this.rpc.onInvite(async ({ handle, role, expiresIn, multiUse }) => {
+    this.rpc.onInvite(async ({ handle, role, expiresIn, reuse }) => {
       const h = this._resolve(handle)
       const invite = await h.invite({
         role: role || undefined,
         expiresIn: expiresIn || undefined,
-        multiUse: multiUse === true
+        reuse: reuse === true
       })
       return { invite }
     })

package/types/build/schemas.d.ts

@@ -129,7 +129,7 @@ export const rpc: {
         handle: import("@cero-base/core").Prim;
         role: import("@cero-base/core").Prim;
         expiresIn: import("@cero-base/core").Prim;
-        multiUse: import("@cero-base/core").Prim;
+        reuse: import("@cero-base/core").Prim;
     };
     'req-revoke': {
         handle: import("@cero-base/core").Prim;

package/types/handle/index.d.ts

@@ -91,6 +91,7 @@ export class Handle extends ReadyResource {
     _onerror: any;
     children: Set<any>;
     _loading: Map<any, any>;
+    _joining: Map<any, any>;
     _coreKeys: Map<any, any>;
     _fileServer: FileServer;
     _blobs: Blobs;
@@ -172,6 +173,17 @@ export class Handle extends ReadyResource {
     get blobs(): Blobs;
     _baseBlobs(): Blobs;
     _makeBlobs(name: any, encryptionKey: any, stamp: any): Blobs;
+    /**
+     * Remember the blob-core key a file id points at so the file server can
+     * open the core. Lives on the Handle (not the shared operators) because the
+     * epoch-key derivation pulls native crypto — the RPC client must stay
+     * bundleable without it.
+     *
+     * @param {string} id
+     * @param {number} [stamp]
+     */
+    _registerBlobCore(id: string, stamp?: number): void;
+    _blobCoreKey(stamp: any): Uint8Array<ArrayBufferLike>;
     /** Canonical id — identity id for the root handle, store key for children. */
     get id(): any;
     /** This device's id + name. `null` on child handles. */
@@ -266,7 +278,15 @@ export class Handle extends ReadyResource {
      * @param {JoinChildOpts} [opts]
      * @returns {Promise<Handle>}
      */
-    _join(invite: string, type: string, { routes, timeout }?: JoinChildOpts): Promise<Handle>;
+    _join(invite: string, type: string, opts?: JoinChildOpts): Promise<Handle>;
+    /**
+     * @param {string} invite
+     * @param {string} type
+     * @param {JoinChildOpts} [opts]
+     * @param {Uint8Array | null} [target]
+     * @returns {Promise<Handle>}
+     */
+    _pair(invite: string, type: string, { routes, timeout }?: JoinChildOpts, target?: Uint8Array | null): Promise<Handle>;
     /**
      * Get an open child by id, or re-open it. Concurrent calls for the same id
      * share one in-flight load, so the child is built — and `handle` emitted —