@cero-base/core 1.10.1 → 1.11.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/core",
-  "version": "1.10.1",
+  "version": "1.11.0",
   "description": "cero p2p primitives — identity, storage, network, database, blobs, rpc, pairing.",
   "type": "module",
   "sideEffects": false,
@@ -144,7 +144,7 @@
   },
   "dependencies": {
     "@hyperswarm/secret-stream": "^6.9.1",
-    "autobee": "2.0.0-rc.6",
+    "autobee": "2.0.0-rc.14",
     "autobee-encryption": "0.1.3",
     "b4a": "^1.8.1",
     "bare-crypto": "^1.15.3",

package/src/database/bootstrap.js

@@ -1,13 +1,16 @@
-import b4a from 'b4a'
 import Hypercore from 'hypercore'
 import { Identity } from '../identity/index.js'
 import { CeroError } from '../lib/errors.js'
 import { toId, addWriterPayload } from '../lib/utils.js'
+import { wrap } from './envelope.js'
 
 /**
  * First-run device provisioning: mint a device writer keypair, persist it as a
  * writer, then swap the autobee's local core over to it. With `recovering`,
- * waits for the first peer-replicated append before swapping.
+ * the swap happens FIRST and admission rides an optimistic append — the
+ * backfilled genesis core is never appended to (autobee's contract: a writable
+ * core has exactly one author, ever; resuming a replicated core is unsupported
+ * and drops appends silently).
  *
  * @param {import('./index.js').Database} db
  * @param {{ name?: string | null, isMobile?: boolean, recovering?: boolean }} [opts]
@@ -22,87 +25,64 @@ export async function bootstrap(db, { name, isMobile, recovering = false, timeou
   const writerKey = Hypercore.key(manifest)
 
   if (recovering) {
-    await waitForFirstPeerAppend(db, timeout)
-    // reopen so the bee's writer state is built over the replicated genesis
-    // core — a writer opened before replication stamps ops at stale lengths
-    // and autobee silently drops them
-    await reopenBee(db)
-  }
-  if (recovering) {
-    // gate the swap on the admission actually applying: write() can resolve
-    // with the ops stalled in the drain (update() bumps heal that) or dropped
-    // outright when they were stamped behind a mid-replication core — each
-    // retry stamps past the collision, and the ops are idempotent
-    await admitWriter(db, writerKey, { name, isMobile }, timeout)
+    // swap before anything else: the genesis core then replicates as a REMOTE
+    // writer, so its backfilled ops apply through the normal download path
+    await swapWriter(db, keyPair, manifest)
+    await waitForBackfill(db, timeout)
+    await claimWriter(db, writerKey, timeout)
+    await saveDevice(db, writerKey, { name, isMobile })
   } else {
     await saveWriter(db, writerKey, { name, isMobile })
+    await swapWriter(db, keyPair, manifest)
   }
-  await swapWriter(db, keyPair, manifest)
 
   return { id: writerKey, writer: keyPair }
 }
 
-async function waitForFirstPeerAppend(db, timeout = 30000) {
-  if (!db.network?.swarm) return
-  if (db.bee.local.length === 0) await waitForLength(db, 1, timeout)
-  await db.bee.update()
-  // the first block may not be the whole core — writes stamped below the
-  // length the system already attributes to this writer are silently dropped
-  const info = await db.bee.system.get(db.bee.local.key).catch(() => null)
-  if (info && info.length > db.bee.local.length) await waitForLength(db, info.length, timeout)
-}
-
-function waitForLength(db, length, timeout) {
-  return new Promise((resolve, reject) => {
-    let done = false
-    const finish = (err) => {
-      if (done) return
-      done = true
-      clearTimeout(timer)
-      db.bee.local.off('append', onAppend)
-      db.off('close', onClose)
-      if (err) reject(err)
-      else resolve()
-    }
-    // timeout + close handling so a peer that never replicates can't hang the
-    // recovery forever, and the append listener is always removed.
-    const onAppend = () => db.bee.local.length >= length && finish()
-    const onClose = () => finish(CeroError.CLOSED('Database'))
-    const timer = setTimeout(
-      () => finish(CeroError.TIMED_OUT('recovery — no peer append')),
-      timeout
-    )
-    db.bee.local.on('append', onAppend)
-    db.on('close', onClose)
-  })
-}
-
-async function admitWriter(db, writerKey, opts, timeout) {
-  const deadline = Date.now() + timeout
-  const id = toId(writerKey)
-  while (true) {
-    await saveWriter(db, writerKey, opts)
-    if (await deviceApplied(db, id, Math.min(3000, deadline - Date.now()))) return
-    if (Date.now() >= deadline) throw CeroError.TIMED_OUT('recovery — writer not admitted')
-  }
-}
-
-async function deviceApplied(db, id, timeout) {
+// recovery has state to recover by definition — wait until replication has
+// delivered and applied it (the genesis device row is the first thing every
+// db writes), so a peer that never replicates fails loud instead of hanging
+async function waitForBackfill(db, timeout) {
   const deadline = Date.now() + timeout
   while (Date.now() < deadline) {
-    const { data } = await db.get('devices', id)
-    if (data) return true
+    if (db.closing || db.closed) throw CeroError.CLOSED('Database')
+    const { data } = await db.get('devices')
+    if (data.length > 0) return
     await db.bee.update()
-    await new Promise((resolve) => setTimeout(resolve, 25))
+    await new Promise((resolve) => setTimeout(resolve, 50))
   }
-  return false
+  throw CeroError.TIMED_OUT('recovery — no peer replicated')
 }
 
-async function reopenBee(db) {
-  if (db.network) db.network.detach(db.bee)
-  await db.bee.close()
-  db.bee = null
-  await db.openBee()
+// self-admission from the fresh core: the same master-signed add-writer op a
+// live device would write, appended optimistically so an unadmitted writer
+// can carry it — apply verifies the attestation and admits the core
+async function claimWriter(db, writerKey, timeout) {
+  const encoded = db.spec.dispatch.encode(`@${db.ns}/add-writer`, {
+    master: db.identity.publicKey,
+    writer: writerKey,
+    sig: db.identity.sign(addWriterPayload(db.key, writerKey, db.writerKey)),
+    ts: Date.now()
+  })
+  await db.bee.append(wrap(db.version, encoded), { optimistic: true })
+  await db.bee.update()
+  if (!db.bee.writable) await db.whenWritable({ timeout })
+}
+
+async function saveDevice(db, writerKey, { name, isMobile }) {
+  const ts = Date.now()
+  await db.write([
+    [
+      'set-device',
+      {
+        id: toId(writerKey),
+        name: name || null,
+        isMobile: isMobile === true,
+        createdAt: ts,
+        updatedAt: ts
+      }
+    ]
+  ])
 }
 
 async function saveWriter(db, writerKey, { name, isMobile }) {

package/types/database/bootstrap.d.ts

@@ -1,7 +1,10 @@
 /**
  * First-run device provisioning: mint a device writer keypair, persist it as a
  * writer, then swap the autobee's local core over to it. With `recovering`,
- * waits for the first peer-replicated append before swapping.
+ * the swap happens FIRST and admission rides an optimistic append — the
+ * backfilled genesis core is never appended to (autobee's contract: a writable
+ * core has exactly one author, ever; resuming a replicated core is unsupported
+ * and drops appends silently).
  *
  * @param {import('./index.js').Database} db
  * @param {{ name?: string | null, isMobile?: boolean, recovering?: boolean }} [opts]