@cero-base/core 1.10.1 → 1.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/core",
-  "version": "1.10.1",
+  "version": "1.12.0",
   "description": "cero p2p primitives — identity, storage, network, database, blobs, rpc, pairing.",
   "type": "module",
   "sideEffects": false,
@@ -144,7 +144,7 @@
   },
   "dependencies": {
     "@hyperswarm/secret-stream": "^6.9.1",
-    "autobee": "2.0.0-rc.6",
+    "autobee": "2.0.0-rc.19",
     "autobee-encryption": "0.1.3",
     "b4a": "^1.8.1",
     "bare-crypto": "^1.15.3",
@@ -152,18 +152,18 @@
     "bare-path": "^3.1.1",
     "bip39-mnemonic": "^2.5.0",
     "blind-pairing": "^2.3.1",
-    "blind-peering": "^2.6.1",
-    "compact-encoding": "^3.3.0",
+    "blind-peering": "^2.6.3",
+    "compact-encoding": "^3.3.2",
     "corestore": "^7.12.0",
     "framed-stream": "^1.0.1",
-    "hrpc": "^4.3.0",
+    "hrpc": "^4.3.1",
     "hyperblobs": "^2.12.1",
-    "hypercore": "^11.35.1",
+    "hypercore": "^11.35.2",
     "hypercore-blob-server": "^1.15.0",
     "hypercore-crypto": "^3.7.0",
     "hypercore-id-encoding": "^1.3.0",
-    "hypercore-storage": "^3.2.0",
-    "hyperdb": "^6.8.0",
+    "hypercore-storage": "^3.2.1",
+    "hyperdb": "^6.9.0",
     "hyperdispatch": "^1.6.0",
     "hyperschema": "^1.22.0",
     "hyperswarm": "^4.17.0",
@@ -182,7 +182,7 @@
     "bare-fetch": "^3.2.0",
     "bare-process": "^4.5.1",
     "bare-url": "^2.5.2",
-    "blind-peer": "^3.13.2",
+    "blind-peer": "^3.13.3",
     "brittle": "^4.1.0",
     "typescript": "^5.9.3",
     "which-runtime": "^1.4.0"

package/src/database/bootstrap.js

@@ -1,13 +1,16 @@
-import b4a from 'b4a'
 import Hypercore from 'hypercore'
 import { Identity } from '../identity/index.js'
 import { CeroError } from '../lib/errors.js'
 import { toId, addWriterPayload } from '../lib/utils.js'
+import { wrap } from './envelope.js'
 
 /**
  * First-run device provisioning: mint a device writer keypair, persist it as a
  * writer, then swap the autobee's local core over to it. With `recovering`,
- * waits for the first peer-replicated append before swapping.
+ * the swap happens FIRST and admission rides an optimistic append — the
+ * backfilled genesis core is never appended to (autobee's contract: a writable
+ * core has exactly one author, ever; resuming a replicated core is unsupported
+ * and drops appends silently).
  *
  * @param {import('./index.js').Database} db
  * @param {{ name?: string | null, isMobile?: boolean, recovering?: boolean }} [opts]
@@ -22,87 +25,64 @@ export async function bootstrap(db, { name, isMobile, recovering = false, timeou
   const writerKey = Hypercore.key(manifest)
 
   if (recovering) {
-    await waitForFirstPeerAppend(db, timeout)
-    // reopen so the bee's writer state is built over the replicated genesis
-    // core — a writer opened before replication stamps ops at stale lengths
-    // and autobee silently drops them
-    await reopenBee(db)
-  }
-  if (recovering) {
-    // gate the swap on the admission actually applying: write() can resolve
-    // with the ops stalled in the drain (update() bumps heal that) or dropped
-    // outright when they were stamped behind a mid-replication core — each
-    // retry stamps past the collision, and the ops are idempotent
-    await admitWriter(db, writerKey, { name, isMobile }, timeout)
+    // swap before anything else: the genesis core then replicates as a REMOTE
+    // writer, so its backfilled ops apply through the normal download path
+    await swapWriter(db, keyPair, manifest)
+    await waitForBackfill(db, timeout)
+    await claimWriter(db, writerKey, timeout)
+    await saveDevice(db, writerKey, { name, isMobile })
   } else {
     await saveWriter(db, writerKey, { name, isMobile })
+    await swapWriter(db, keyPair, manifest)
   }
-  await swapWriter(db, keyPair, manifest)
 
   return { id: writerKey, writer: keyPair }
 }
 
-async function waitForFirstPeerAppend(db, timeout = 30000) {
-  if (!db.network?.swarm) return
-  if (db.bee.local.length === 0) await waitForLength(db, 1, timeout)
-  await db.bee.update()
-  // the first block may not be the whole core — writes stamped below the
-  // length the system already attributes to this writer are silently dropped
-  const info = await db.bee.system.get(db.bee.local.key).catch(() => null)
-  if (info && info.length > db.bee.local.length) await waitForLength(db, info.length, timeout)
-}
-
-function waitForLength(db, length, timeout) {
-  return new Promise((resolve, reject) => {
-    let done = false
-    const finish = (err) => {
-      if (done) return
-      done = true
-      clearTimeout(timer)
-      db.bee.local.off('append', onAppend)
-      db.off('close', onClose)
-      if (err) reject(err)
-      else resolve()
-    }
-    // timeout + close handling so a peer that never replicates can't hang the
-    // recovery forever, and the append listener is always removed.
-    const onAppend = () => db.bee.local.length >= length && finish()
-    const onClose = () => finish(CeroError.CLOSED('Database'))
-    const timer = setTimeout(
-      () => finish(CeroError.TIMED_OUT('recovery — no peer append')),
-      timeout
-    )
-    db.bee.local.on('append', onAppend)
-    db.on('close', onClose)
-  })
-}
-
-async function admitWriter(db, writerKey, opts, timeout) {
-  const deadline = Date.now() + timeout
-  const id = toId(writerKey)
-  while (true) {
-    await saveWriter(db, writerKey, opts)
-    if (await deviceApplied(db, id, Math.min(3000, deadline - Date.now()))) return
-    if (Date.now() >= deadline) throw CeroError.TIMED_OUT('recovery — writer not admitted')
-  }
-}
-
-async function deviceApplied(db, id, timeout) {
+// recovery has state to recover by definition — wait until replication has
+// delivered and applied it (the genesis device row is the first thing every
+// db writes), so a peer that never replicates fails loud instead of hanging
+async function waitForBackfill(db, timeout) {
   const deadline = Date.now() + timeout
   while (Date.now() < deadline) {
-    const { data } = await db.get('devices', id)
-    if (data) return true
+    if (db.closing || db.closed) throw CeroError.CLOSED('Database')
+    const { data } = await db.get('devices')
+    if (data.length > 0) return
     await db.bee.update()
-    await new Promise((resolve) => setTimeout(resolve, 25))
+    await new Promise((resolve) => setTimeout(resolve, 50))
   }
-  return false
+  throw CeroError.TIMED_OUT('recovery — no peer replicated')
 }
 
-async function reopenBee(db) {
-  if (db.network) db.network.detach(db.bee)
-  await db.bee.close()
-  db.bee = null
-  await db.openBee()
+// self-admission from the fresh core: the same master-signed add-writer op a
+// live device would write, appended optimistically so an unadmitted writer
+// can carry it — apply verifies the attestation and admits the core
+async function claimWriter(db, writerKey, timeout) {
+  const encoded = db.spec.dispatch.encode(`@${db.ns}/add-writer`, {
+    master: db.identity.publicKey,
+    writer: writerKey,
+    sig: db.identity.sign(addWriterPayload(db.key, writerKey, db.writerKey)),
+    ts: Date.now()
+  })
+  await db.bee.append(wrap(db.version, encoded), { optimistic: true })
+  await db.bee.update()
+  if (!db.bee.writable) await db.whenWritable({ timeout })
+}
+
+async function saveDevice(db, writerKey, { name, isMobile }) {
+  const ts = Date.now()
+  await db.write([
+    [
+      'set-device',
+      {
+        id: toId(writerKey),
+        name: name || null,
+        isMobile: isMobile === true,
+        createdAt: ts,
+        updatedAt: ts
+      }
+    ]
+  ])
 }
 
 async function saveWriter(db, writerKey, { name, isMobile }) {

package/src/database/dispatch.js

@@ -114,7 +114,11 @@ export function makeDispatcher(
     if (!isKey(op.master) || !isKey(op.writer) || !isSig(op.sig)) return
     if (!Identity.verify(op.master, addWriterPayload(ctx.dbKey, op.writer, ctx.key), op.sig)) return
     if (!(await isGenesis(ctx.view)) && !can(await getRole(ctx.view, op.master), INVITE)) return
-    await ctx.host.addWriter(op.writer, { isIndexer: op.isIndexer !== false })
+    // always an indexer, like claim-writer below. The op's optional isIndexer
+    // bool decodes to false when absent (nothing sets it), which silently made
+    // every device a weight-1 writer — autobee 2.0 gc's caught-up non-indexer
+    // sessions, and a gc'd writer misses later appends until a wakeup revives it
+    await ctx.host.addWriter(op.writer, { isIndexer: true })
     const ts = op.ts || 0
     await insert(ctx.view, 'devices', `@${ns}/devices`, {
       id: toId(op.writer),

package/src/database/encryption.js

@@ -230,54 +230,36 @@ export class EpochAutobee extends Autobee {
     await primeKeyring(this.keyring, this.local)
   }
 
-  // Upstream's drain body with one change: a writer whose next block sits at
-  // an epoch we haven't learned yet parks (stays pending, so every later
-  // bump re-examines it) instead of aborting the whole drain — the
-  // announcement carrying that epoch lives in another writer's core and
-  // applies on this or a later bump. The catch wraps the whole per-writer
-  // step so an UNKNOWN_EPOCH surfacing from batch processing parks too
-  // instead of crashing the bee.
+  // A writer whose next blocks sit at an epoch we haven't learned yet parks:
+  // its next() reports "nothing to offer" instead of throwing, so upstream's
+  // drain keeps selecting among the other writers — the announcement carrying
+  // the missing epoch lives in one of THEIR cores and unlocks the parked
+  // writer on a later bump (the scheduled retry pokes the drain). The outer
+  // catch backstops an UNKNOWN_EPOCH surfacing from batch processing itself.
   async _bumpPendingWriters() {
-    if (this._catchupMigratedNodes !== null) {
-      await this._bumpMigratedWriters()
-      this._catchupMigratedNodes = null
+    for (const w of this.writers.pending) this._parkOnUnknownEpoch(w)
+    try {
+      return await super._bumpPendingWriters()
+    } catch (err) {
+      if (err?.code !== 'UNKNOWN_EPOCH') throw err
+      this._scheduleEpochRetry()
+      return false
     }
+  }
 
-    let updated = false
-
-    const pending = this.writers.pending.slice()
-
-    for (let i = pending.length - 1; i >= 0; i--) {
-      const w = pending[i]
-
+  _parkOnUnknownEpoch(w) {
+    if (w._epochParking) return
+    w._epochParking = true
+    const next = w.next.bind(w)
+    w.next = async () => {
       try {
-        const batch = await w.next()
-        if (batch === null) continue
-
-        if (w.isAdded || (w.isRemoved && w.hasReferrals())) {
-          await this._processBatch(batch)
-          w.notify(batch)
-          updated = true
-          continue
-        }
-
-        if (this.optimistic && !w.isRemoved && batch[0].optimistic) {
-          if (!(await this._optimisticBatch(batch))) {
-            w.removePending()
-            continue
-          }
-          w.notify(batch)
-          updated = true
-          continue
-        }
+        return await next()
       } catch (err) {
         if (err?.code !== 'UNKNOWN_EPOCH') throw err
         this._scheduleEpochRetry()
-        continue
+        return null
       }
     }
-
-    return updated
   }
 
   // a parked writer produces no wake-up of its own — poke the bee until the

package/types/database/bootstrap.d.ts

@@ -1,7 +1,10 @@
 /**
  * First-run device provisioning: mint a device writer keypair, persist it as a
  * writer, then swap the autobee's local core over to it. With `recovering`,
- * waits for the first peer-replicated append before swapping.
+ * the swap happens FIRST and admission rides an optimistic append — the
+ * backfilled genesis core is never appended to (autobee's contract: a writable
+ * core has exactly one author, ever; resuming a replicated core is unsupported
+ * and drops appends silently).
  *
  * @param {import('./index.js').Database} db
  * @param {{ name?: string | null, isMobile?: boolean, recovering?: boolean }} [opts]

package/types/database/encryption.d.ts

@@ -11,13 +11,20 @@ export function blobEpochKey(entropy: Uint8Array): Uint8Array;
  * Wire codec for a rotation announcement's envelope list — one sealed box
  * per remaining member, addressed by member id.
  */
-export const wraps: any;
+export const wraps: c.Encoder<any[], {
+    id: string;
+    box: Uint8Array<ArrayBufferLike>;
+}[]>;
 /**
  * Wire codec for locally persisted / pairing-delivered epoch secrets.
  * `epoch` is the apply-order sequence; `stamp` is the content-addressed
  * uint32 written into block headers.
  */
-export const epochEntries: any;
+export const epochEntries: c.Encoder<any[], {
+    epoch: number;
+    stamp: number;
+    entropy: Uint8Array<ArrayBufferLike>;
+}[]>;
 /**
  * Per-database registry of rotation epochs. Stamp 0 is the base key era
  * (no entry needed — it derives from the upstream GENESIS_ENTROPY path).
@@ -83,8 +90,9 @@ export class EpochAutobee {
     _epochRetryDelay: number;
     _epochRetrySeen: number;
     _bootState(): Promise<void>;
-    _bumpPendingWriters(): Promise<boolean>;
-    _catchupMigratedNodes: any;
+    _bumpPendingWriters(): Promise<any>;
+    _parkOnUnknownEpoch(w: any): void;
     _scheduleEpochRetry(): void;
     _close(): Promise<any>;
 }
+import c from 'compact-encoding';

package/types/database/index.d.ts

@@ -56,7 +56,7 @@ export class Database extends ReadyResource {
         verb?: string;
     }>;
     version: any;
-    behind: any;
+    behind: number;
     routes: Record<string, Function>;
     namespace: string;
     encryptionKey: Uint8Array<ArrayBufferLike>;