@cero-base/core 1.13.0 → 1.14.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/core",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "cero p2p primitives — identity, storage, network, database, blobs, rpc, pairing.",
   "type": "module",
   "sideEffects": false,
@@ -41,10 +41,6 @@
       "types": "./types/network/index.d.ts",
       "default": "./src/network/index.js"
     },
-    "./network/transports/dht": {
-      "types": "./types/network/transports/dht.d.ts",
-      "default": "./src/network/transports/dht.js"
-    },
     "./database": {
       "types": "./types/database/index.d.ts",
       "default": "./src/database/index.js"
@@ -140,7 +136,7 @@
   },
   "dependencies": {
     "@hyperswarm/secret-stream": "^6.9.1",
-    "autobee": "2.0.0-rc.19",
+    "autobee": "2.0.0-rc.21",
     "autobee-encryption": "0.1.3",
     "b4a": "^1.8.1",
     "bare-crypto": "^1.15.3",

package/src/database/bootstrap.js

@@ -110,9 +110,13 @@ async function saveWriter(db, writerKey, { name, isMobile }) {
   ])
 }
 
+// Writer rotation by reboot: close the bee and boot again with the device
+// keyPair — autobee's fully-supported path (a fresh boot re-drains the log
+// and rebuilds its own state, no upstream userData is touched). setLocal is
+// not usable here: appends made through the base right after a live rotation
+// queue without ever flushing (keet pre-writes the first op raw instead,
+// which needs autobee's private oplog encoding).
 async function swapWriter(db, keyPair, manifest) {
-  const head = await db.bee.local.getUserData('autobee/head')
-  const enc = await db.bee.local.getUserData('autobee/encryption')
   const epochs = await db.bee.local.getUserData('cero/epochs')
 
   if (db.network) db.network.detach(db.bee)
@@ -121,8 +125,6 @@ async function swapWriter(db, keyPair, manifest) {
 
   const deviceCore = db.store.namespace(db.namespace).get({ keyPair, manifest })
   await deviceCore.ready()
-  if (head) await deviceCore.setUserData('autobee/head', head)
-  if (enc) await deviceCore.setUserData('autobee/encryption', enc)
   if (epochs) await deviceCore.setUserData('cero/epochs', epochs)
   await deviceCore.close()
 

package/src/database/changes.js

@@ -1,18 +1,14 @@
 import { Readable } from 'streamx'
 import b4a from 'b4a'
 
-// the pinned hyperbee2 snapshot inside a hyperdb snapshot — internals reach
-// (pear-sdk does the same); kept in one helper so an upstream rename is a
-// one-line fix
-const beeOf = (snap) => snap.engineSnapshot.snapshot
-
 /**
  * Pull-driven delta stream over a collection: batches of `{ prev, next }`
- * pairs diffed between per-stream snapshot cursors. Update ticks only mark
- * the stream dirty — the diff runs when the reader demands, so backpressure
- * folds bursts into one bigger batch and nothing is ever dropped. The first
- * batch, and any batch after the view is swapped or fast-forwarded to a new
- * core, carries the full matching state as inserts with `reset: true`.
+ * pairs diffed between per-stream head cursors (`db.diff(col, { from })`).
+ * Update ticks only mark the stream dirty — the diff runs when the reader
+ * demands, so backpressure folds bursts into one bigger batch and nothing is
+ * ever dropped. The first batch, and any batch after the view is swapped or
+ * fast-forwarded to a new core, carries the full matching state as inserts
+ * with `reset: true`.
  *
  * @param {import('./index.js').Database} db
  * @param {string} name    Ref name (scopes the update ticks).
@@ -39,9 +35,6 @@ export function makeChanges(db, name, col, matches) {
     },
     predestroy() {
       if (off) off()
-    },
-    destroy(cb) {
-      release().then(() => cb(null), cb)
     }
   })
 
@@ -69,51 +62,32 @@ export function makeChanges(db, name, col, matches) {
   }
 
   const diff = async () => {
-    const snap = db.view.snapshot()
+    const view = db.view
+    // snapshot() and engine.head() are synchronous — captured back to back
+    // they describe the same state, so the cursor is exactly-once
+    const snap = view.snapshot()
+    const head = view.engine.head()
     try {
-      const fresh =
-        !cursor ||
-        cursorView !== db.view ||
-        !b4a.equals(beeOf(cursor).core.key, beeOf(snap).core.key)
-      const batch = fresh ? await initial(snap) : await delta(snap)
-      if (cursor) await cursor.close()
-      cursor = snap
-      cursorView = db.view
-      return batch
-    } catch (err) {
+      const fresh = !cursor || cursorView !== view || !head || !b4a.equals(cursor.key, head.key)
+      const changes = []
+      if (fresh) {
+        for (const next of await snap.find(col, {}).toArray()) {
+          if (matches(next)) changes.push({ prev: null, next })
+        }
+      } else {
+        for await (const { left, right } of snap.diff(col, { from: cursor })) {
+          const prev = left && matches(left) ? left : null
+          const next = right && matches(right) ? right : null
+          if (prev || next) changes.push({ prev, next })
+        }
+      }
+      cursor = head
+      cursorView = view
+      if (fresh) return { changes, reset: true }
+      return changes.length ? { changes, reset: false } : null
+    } finally {
       await snap.close().catch(() => {})
-      throw err
-    }
-  }
-
-  const initial = async (snap) => {
-    const changes = []
-    for (const next of await snap.find(col, {}).toArray()) {
-      if (matches(next)) changes.push({ prev: null, next })
     }
-    return { changes, reset: true }
-  }
-
-  const delta = async (snap) => {
-    const collection = db.view.definition.resolveCollection(col)
-    const range = collection.encodeKeyRange({})
-    const changes = []
-    for await (const { left, right } of beeOf(cursor).createDiffStream(beeOf(snap), range)) {
-      const prev = left ? collection.reconstruct(db.view.versions, left.key, left.value) : null
-      const next = right ? collection.reconstruct(db.view.versions, right.key, right.value) : null
-      const from = prev && matches(prev) ? prev : null
-      const to = next && matches(next) ? next : null
-      if (!from && !to) continue
-      changes.push({ prev: from, next: to })
-    }
-    return changes.length ? { changes, reset: false } : null
-  }
-
-  const release = async () => {
-    if (!cursor) return
-    const held = cursor
-    cursor = null
-    await held.close().catch(() => {})
   }
 
   return stream

package/src/database/encryption.js

@@ -43,24 +43,23 @@ AutobeeEncryption.prototype.getKeys = async function (id, ctx) {
   if (!id) return baseGetKeys.call(this, id, ctx)
 
   const keyring = this.auto?.keyring
-  if (!keyring) throw CeroError.UNKNOWN_EPOCH(id)
-
-  let entropy = keyring.entropy(id)
-  if (!entropy && !keyring.primed && this.auto.local) {
-    // first epoch miss of a session may happen inside autobee's own boot
-    // (reading back this device's post-rotation state) — prime lazily from
-    // the local core's userData, once
-    keyring.primed = true
-    await primeKeyring(keyring, this.auto.local)
-    entropy = keyring.entropy(id)
+  const entropy = keyring && keyring.entropy(id)
+  if (!entropy) {
+    // record which core stalled and arm the retry — a writer autobee freezes
+    // over this throw detaches silently, and only a wakeup() re-adds it
+    if (ctx?.key && this.auto?._epochStalled) {
+      this.auto._epochStalled.add(b4a.toString(ctx.key, 'hex'))
+      this.auto._scheduleEpochRetry()
+    }
+    throw CeroError.UNKNOWN_EPOCH(id)
   }
-  if (!entropy) throw CeroError.UNKNOWN_EPOCH(id)
 
   const block = this.blockKey(entropy, ctx)
   return { id, block, hash: crypto.hash([NS_HASH_KEY, block]) }
 }
 
-async function primeKeyring(keyring, local) {
+/** Prime a keyring from a local core's persisted epoch stash. */
+export async function loadEpochs(keyring, local) {
   const saved = await local.getUserData('cero/epochs').catch(() => null)
   if (!saved) return
   try {
@@ -140,7 +139,6 @@ export class Keyring {
     this.seq = 0
     /** bumped on every add/remove — cheap change detection for retries */
     this.version = 0
-    this.primed = false
   }
 
   /** @returns {Array<{ epoch: number, stamp: number, entropy: Uint8Array }>} ascending by seq */
@@ -216,28 +214,17 @@ export class EpochAutobee extends Autobee {
   constructor(store, key, handlers = {}) {
     super(store, key, handlers)
     this.keyring = handlers.keyring || null
+    this._epochStalled = new Set()
     this._epochRetry = null
     this._epochRetryDelay = 1000
     this._epochRetrySeen = 0
   }
 
-  // Prime the keyring from local userData as soon as boot resolves the local
-  // core (in-boot epoch misses are covered by the provider's lazy prime).
-  async _bootState() {
-    await super._bootState()
-    if (!this.keyring || this.keyring.primed || !this.local) return
-    this.keyring.primed = true
-    await primeKeyring(this.keyring, this.local)
-  }
-
-  // A writer whose next blocks sit at an epoch we haven't learned yet parks:
-  // its next() reports "nothing to offer" instead of throwing, so upstream's
-  // drain keeps selecting among the other writers — the announcement carrying
-  // the missing epoch lives in one of THEIR cores and unlocks the parked
-  // writer on a later bump (the scheduled retry pokes the drain). The outer
-  // catch backstops an UNKNOWN_EPOCH surfacing from batch processing itself.
+  // An UNKNOWN_EPOCH surfacing from the drain (a system read at an epoch we
+  // haven't learned yet) parks the whole pass — the scheduled retry wakes the
+  // stalled cores once the announcement lands. Oplog blocks at unknown epochs
+  // never reach here: autobee's own reader freezes that writer.
   async _bumpPendingWriters() {
-    for (const w of this.writers.pending) this._parkOnUnknownEpoch(w)
     try {
       return await super._bumpPendingWriters()
     } catch (err) {
@@ -247,25 +234,22 @@ export class EpochAutobee extends Autobee {
     }
   }
 
-  _parkOnUnknownEpoch(w) {
-    if (w._epochParking) return
-    w._epochParking = true
-    const next = w.next.bind(w)
-    w.next = async () => {
-      try {
-        return await next()
-      } catch (err) {
-        if (err?.code !== 'UNKNOWN_EPOCH') throw err
-        this._scheduleEpochRetry()
-        return null
-      }
+  // hints read the system bee outside upstream's guarded drain — an escaping
+  // UNKNOWN_EPOCH would close the bee; park and retry like everything else
+  async _applyWakeupHints() {
+    try {
+      return await super._applyWakeupHints()
+    } catch (err) {
+      if (err?.code !== 'UNKNOWN_EPOCH') throw err
+      this._scheduleEpochRetry()
+      return new Map()
     }
   }
 
-  // a parked writer produces no wake-up of its own — poke the bee until the
-  // pending announcement applies and the parked blocks decrypt. Exponential
-  // backoff (reset when the keyring advances) so a removed member, who will
-  // never learn the epoch, settles into a slow idle poll instead of a hot loop
+  // a stalled core produces no wake-up of its own — and a writer autobee froze
+  // over one only comes back through wakeup(), update() never re-adds it.
+  // Exponential backoff (reset when the keyring advances) so a removed member,
+  // who will never learn the epoch, settles into a slow idle poll
   _scheduleEpochRetry() {
     if (this._epochRetry || this.closing) return
     const version = this.keyring ? this.keyring.version : 0
@@ -275,7 +259,12 @@ export class EpochAutobee extends Autobee {
     }
     this._epochRetry = setTimeout(() => {
       this._epochRetry = null
-      if (!this.closing) this.update().catch(noop)
+      if (this.closing) return
+      for (const hex of this._epochStalled) {
+        this.wakeup({ key: b4a.from(hex, 'hex'), length: 0 }).catch(noop)
+      }
+      this._epochStalled.clear()
+      this.update().catch(noop)
     }, this._epochRetryDelay)
     this._epochRetryDelay = Math.min(this._epochRetryDelay * 2, 60000)
   }

package/src/database/index.js

@@ -6,7 +6,16 @@ import ReadyResource from 'ready-resource'
 import safetyCatch from 'safety-catch'
 import b4a from 'b4a'
 
-import { NAMESPACE, SINGLE, COLLECTION, ACTION, ACTIVE, PASSIVE, REMOVE } from '../lib/constants.js'
+import {
+  NAMESPACE,
+  SINGLE,
+  COLLECTION,
+  ACTION,
+  ACTIVE,
+  PASSIVE,
+  REMOVE,
+  QUERY_RESERVED
+} from '../lib/constants.js'
 import {
   genId,
   toId,
@@ -14,10 +23,11 @@ import {
   can,
   subscribe,
   addWriterPayload,
-  claimWriterPayload
+  claimWriterPayload,
+  searchHit
 } from '../lib/utils.js'
 import { wrap, unwrap } from './envelope.js'
-import { EpochAutobee, Keyring, wraps, epochEntries } from './encryption.js'
+import { EpochAutobee, Keyring, wraps, epochEntries, loadEpochs } from './encryption.js'
 import { Identity } from '../identity/index.js'
 import { CeroError } from '../lib/errors.js'
 import { bootstrap } from './bootstrap.js'
@@ -133,6 +143,20 @@ export class Database extends ReadyResource {
 
   /** Open the underlying autobee, wire dispatcher + apply, attach to network. */
   async openBee() {
+    // prime the keyring from the local core's epoch stash BEFORE boot — the
+    // bee's own boot reads post-rotation state through the epoch provider
+    const local = this.store.namespace(this.namespace).get({
+      keyPair: this.keyPair,
+      manifest: {
+        version: this.store.manifestVersion,
+        signers: [{ publicKey: this.keyPair.publicKey }]
+      },
+      active: false
+    })
+    await local.ready()
+    await loadEpochs(this.keyring, local)
+    await local.close()
+
     this.dispatcher = makeDispatcher(
       this.spec,
       this.ns,
@@ -676,7 +700,7 @@ export class Database extends ReadyResource {
     try {
       const rows = await this.view.find(`@${this.ns}/epochs`, {}).toArray()
       for (const row of rows) {
-        if (this.keyring.entropy(row.epoch)) continue
+        if (this.keyring.entropy(row.stamp)) continue
         await this._onEpoch(row)
       }
     } catch {
@@ -735,31 +759,33 @@ export class Database extends ReadyResource {
   }
 
   /**
-   * Batch every write performed inside `fn` into a single autobee append.
-   * Nested calls reuse the outer queue.
+   * Batch every write made through the transaction handle passed to `fn`
+   * into a single autobee append. The handle is this database with its own
+   * write queue — same surface (`put`/`set`/`del`/`call`), but writes buffer
+   * until `fn` returns, and are discarded if it throws. Writes made on the
+   * database itself meanwhile append normally: an unrelated concurrent write
+   * can never be swallowed into (and rolled back with) a transaction.
+   * Nested `tx()` on the handle joins the same batch.
    *
    * @template T
-   * @param {() => Promise<T> | T} fn
+   * @param {(tx: Database) => Promise<T> | T} fn
    * @returns {Promise<T>}
    */
   async tx(fn) {
-    // Nested tx() (called while an outer tx's fn is running) joins the outer queue.
-    if (this.txQueue) return fn()
-    // Outer transactions serialize — the run is deferred onto a chain so two
-    // concurrent tx() calls each get their own queue instead of the second
-    // buffering into the first's (and being dropped if the first rolls back).
+    // The old form batched ambiently — writes on the database itself would
+    // silently lose atomicity now, so refuse a fn that ignores the handle.
+    if (typeof fn !== 'function' || fn.length < 1) {
+      throw CeroError.INVALID('tx(fn) — fn must accept the transaction handle: tx((tx) => ...)')
+    }
+    // Nested tx() (called on a transaction handle) joins the same batch.
+    if (this.txQueue) return fn(this)
+    // Outer transactions serialize so their appends land in call order.
     const run = async () => {
-      const queue = []
-      this.txQueue = queue
-      try {
-        const result = await fn()
-        this.txQueue = null
-        if (queue.length) await this.write(queue)
-        return result
-      } catch (err) {
-        this.txQueue = null
-        throw err
-      }
+      const batch = Object.create(this)
+      batch.txQueue = []
+      const result = await fn(batch)
+      if (batch.txQueue.length) await this.write(batch.txQueue)
+      return result
     }
     const prev = this._txChain || Promise.resolve()
     // chain past prev's outcome so one failure doesn't wedge later transactions
@@ -1139,7 +1165,7 @@ export class Database extends ReadyResource {
   matchIndex(name, query) {
     const indexes = this.refs[name]?.indexes
     if (!indexes || !query) return null
-    const fields = Object.keys(query).filter((k) => !INDEX_RESERVED.has(k))
+    const fields = Object.keys(query).filter((k) => !QUERY_RESERVED.has(k))
     if (fields.length === 0) return null
     for (const [idx, idxFields] of Object.entries(indexes)) {
       if (idxFields.length === fields.length && idxFields.every((f) => fields.includes(f))) {
@@ -1182,17 +1208,6 @@ export class Database extends ReadyResource {
   }
 }
 
-const INDEX_RESERVED = new Set([
-  'gt',
-  'gte',
-  'lt',
-  'lte',
-  'limit',
-  'reverse',
-  'search',
-  'fields',
-  'total'
-])
 // Fields the write path stamps itself — always allowed even if not user-declared.
 const SYSTEM_FIELDS = new Set(['id', 'memberId', 'index', 'createdAt', 'updatedAt'])
 
@@ -1232,7 +1247,7 @@ function paginate(rows, query) {
   // index is an optimization, not a correctness gate — so an unindexed field, or
   // one passed alongside search/range, still filters instead of silently dropping.
   for (const key of Object.keys(query)) {
-    if (INDEX_RESERVED.has(key)) continue
+    if (QUERY_RESERVED.has(key)) continue
     out = out.filter((r) => valueEq(r[key], query[key]))
   }
   if (query.gt !== undefined) out = out.filter((r) => r.id > query.gt)
@@ -1244,22 +1259,3 @@ function paginate(rows, query) {
   if (query.limit !== undefined) out = out.slice(0, query.limit)
   return out
 }
-
-// Lowercase, fold diacritics ('jose' → 'José'), drop whitespace.
-const fold = (s) =>
-  s
-    .normalize('NFD')
-    .replace(/\p{Diacritic}/gu, '')
-    .toLowerCase()
-    .replace(/\s/g, '')
-
-// keet's message-search style: every term must be a substring of `fields` (or
-// every string field). 'smith' → 'John Smith', 'jo sm' → both must appear.
-function searchHit(row, term, fields) {
-  const terms = String(term).split(/\s+/).map(fold).filter(Boolean)
-  // default to all fields except memberId — a framework-stamped random z32 whose value would
-  // otherwise produce spurious, non-deterministic search hits (user-set id/code stay searchable)
-  const keys = fields && fields.length ? fields : Object.keys(row).filter((k) => k !== 'memberId')
-  const hay = keys.map((k) => (typeof row[k] === 'string' ? fold(row[k]) : '')).join(' ')
-  return terms.every((t) => hay.includes(t))
-}

package/src/lib/constants.js

@@ -40,6 +40,20 @@ export const RANK = { [OWNER]: 3, [ADMIN]: 2, [MEMBER]: 1, [READER]: 0 }
 // Identity / hypercore namespace
 export const NAMESPACE = 'cero'
 
+// Query-grammar keys — everything else in a query object is an equality field.
+// One set shared by both backends (Database and Storage) so they cannot drift.
+export const QUERY_RESERVED = new Set([
+  'gt',
+  'gte',
+  'lt',
+  'lte',
+  'limit',
+  'reverse',
+  'search',
+  'fields',
+  'total'
+])
+
 // Internal counter collection (assigns monotonic `index` to every row in every collection)
 export const COUNTERS = 'counters'
 // Internal key-rotation epoch collection (rotation announcements with sealed envelopes)

package/src/lib/utils.js

@@ -115,3 +115,22 @@ export function subscribe({ get, watch }) {
   push()
   return stream
 }
+
+// Lowercase, fold diacritics ('jose' → 'José'), drop whitespace.
+const fold = (s) =>
+  s
+    .normalize('NFD')
+    .replace(/\p{Diacritic}/gu, '')
+    .toLowerCase()
+    .replace(/\s/g, '')
+
+// keet's message-search style: every term must be a substring of `fields` (or
+// every string field). 'smith' → 'John Smith', 'jo sm' → both must appear.
+export function searchHit(row, term, fields) {
+  const terms = String(term).split(/\s+/).map(fold).filter(Boolean)
+  // default to all fields except memberId — a framework-stamped random z32 whose value would
+  // otherwise produce spurious, non-deterministic search hits (user-set id/code stay searchable)
+  const keys = fields && fields.length ? fields : Object.keys(row).filter((k) => k !== 'memberId')
+  const hay = keys.map((k) => (typeof row[k] === 'string' ? fold(row[k]) : '')).join(' ')
+  return terms.every((t) => hay.includes(t))
+}

package/src/network/index.js

@@ -1,18 +1,22 @@
 import NoiseSecretStream from '@hyperswarm/secret-stream'
+import Autobee from 'autobee'
 import BlindPairing from 'blind-pairing'
 import BlindPeering from 'blind-peering'
 import ProtomuxWakeup from 'protomux-wakeup'
 import ReadyResource from 'ready-resource'
 import safetyCatch from 'safety-catch'
 import { decode as decodeKey } from 'hypercore-id-encoding'
+import { hash } from 'hypercore-crypto'
+import Hyperswarm from 'hyperswarm'
 import b4a from 'b4a'
 
 import { ACTIVE, PASSIVE } from '../lib/constants.js'
 import { CeroError } from '../lib/errors.js'
 import { Discovery } from './discovery.js'
-import { DHTTransport, channelTopic } from './transports/dht.js'
 
-export { channelTopic }
+export function channelTopic(topic, channel) {
+  return channel ? hash([topic, b4a.from(channel)]) : topic
+}
 
 /**
  * @typedef {object} NetworkOpts
@@ -43,7 +47,7 @@ export class Network extends ReadyResource {
     this.store = store || null
     this.mirrors = (mirrors || []).map((k) => (typeof k === 'string' ? decodeKey(k) : k))
 
-    this._dht = null
+    this._swarm = null
     this.wakeup = new ProtomuxWakeup()
 
     this._replicateables = new Set()
@@ -55,7 +59,7 @@ export class Network extends ReadyResource {
 
   /** @returns {any} The underlying hyperswarm, or null before ready / after close. */
   get swarm() {
-    return this._dht ? this._dht.swarm : null
+    return this._swarm
   }
 
   /**
@@ -108,6 +112,7 @@ export class Network extends ReadyResource {
    * @returns {Promise<any>}
    */
   async blind() {
+    if (this.closing || this.closed) throw CeroError.CLOSED('Network')
     if (!this._blind) {
       const blind = new BlindPairing(this.swarm)
       this._blind = blind.ready().then(() => {
@@ -156,17 +161,15 @@ export class Network extends ReadyResource {
   }
 
   async _open() {
-    this._dht = new DHTTransport({
-      identity: this.identity,
-      bootstrap: this.bootstrap,
-      firewall: this.firewall,
-      relayThrough: this.relayThrough,
-      channel: this.channel
-    })
+    const opts = {}
+    if (this.identity) {
+      opts.keyPair = { publicKey: this.identity.publicKey, secretKey: this.identity.secretKey }
+    }
+    if (this.bootstrap) opts.bootstrap = this.bootstrap
+    if (this.firewall) opts.firewall = this.firewall
+    if (this.relayThrough) opts.relayThrough = this.relayThrough
 
-    // DHTTransport owns the swarm's lifecycle; Network subscribes to its events
-    // because the handlers touch Network state (wakeup, replicateables, emit).
-    const swarm = this._dht.swarm
+    const swarm = (this._swarm = new Hyperswarm(opts))
     swarm.on('connection', (stream, info) => {
       if (this.closing || this.closed) {
         stream.destroy()
@@ -176,12 +179,10 @@ export class Network extends ReadyResource {
       for (const r of this._replicateables) replicateInto(r, stream)
       this.emit('connection', stream, info)
     })
-    swarm.on('peer-add', (peer) => this.emit('peer-add', peer))
-    swarm.on('peer-remove', (peer) => this.emit('peer-remove', peer))
 
     if (this.store && this.mirrors.length) {
       this._blindPeering = new BlindPeering(swarm.dht, this.store, {
-        keys: this.mirrors,
+        blindPeers: this.mirrors.map((key) => ({ key })),
         wakeup: this.wakeup,
         pick: 2
       })
@@ -194,8 +195,9 @@ export class Network extends ReadyResource {
    * @param {{ timeout?: number }} [opts]
    * @returns {Promise<void>}
    */
-  async flush(opts) {
-    await this._dht?.flush(opts)
+  async flush({ timeout = 500 } = {}) {
+    if (!this._swarm) return
+    await Promise.race([this._swarm.flush(), new Promise((r) => setTimeout(r, timeout))])
   }
 
   /**
@@ -206,7 +208,11 @@ export class Network extends ReadyResource {
   async suspend() {
     if (this.closing || this.closed) return
     await this._blindPeering?.suspend()
-    await this._dht?.suspend()
+    try {
+      await this._swarm?.suspend()
+    } catch (err) {
+      safetyCatch(err)
+    }
   }
 
   /**
@@ -216,7 +222,11 @@ export class Network extends ReadyResource {
    */
   async resume() {
     if (this.closing || this.closed) return
-    await this._dht?.resume()
+    try {
+      await this._swarm?.resume()
+    } catch (err) {
+      safetyCatch(err)
+    }
     await this._blindPeering?.resume()
   }
 
@@ -256,13 +266,14 @@ export class Network extends ReadyResource {
       this._blind = null
     }
 
-    if (this._dht) {
+    if (this._swarm) {
       try {
-        await this._dht.destroy()
+        await this.flush()
+        await this._swarm.destroy()
       } catch (err) {
         safetyCatch(err)
       }
-      this._dht = null
+      this._swarm = null
     }
 
     if (this.wakeup) {
@@ -289,10 +300,10 @@ export class Network extends ReadyResource {
     if (!this.swarm) throw CeroError.NOT_READY('Network', 'network')
     if (!isTopic(topic)) throw CeroError.INVALID('topic must be a 32-byte buffer')
 
-    const session =
-      mode === ACTIVE
-        ? this.swarm.join(topic, { client: true, server: true })
-        : this.swarm.join(topic, { client: false, server: true })
+    const session = this.swarm.join(channelTopic(topic, this.channel), {
+      client: mode === ACTIVE,
+      server: true
+    })
 
     const discovery = new Discovery(this, session, mode)
     this._discoveries.add(discovery)
@@ -313,7 +324,7 @@ export class Network extends ReadyResource {
     // mirror the core so it stays available when its writers are offline —
     // autobees announce their whole writer set, plain cores (blobs) just themselves
     if (this._blindPeering) {
-      if (core.wakeupCapability) this._blindPeering.addAutobaseBackground(core)
+      if (Autobee.isAutobee(core)) this._blindPeering.addAutobaseBackground(core)
       else this._blindPeering.addCoreBackground(core)
     }
   }

package/src/pairing/index.js

@@ -6,6 +6,7 @@ import c from 'compact-encoding'
 import { discoveryKey, keyPair, sign } from 'hypercore-crypto'
 
 import { Invite } from './invite.js'
+import { channelTopic } from '../network/index.js'
 import { getEncoding } from '../lib/spec/index.js'
 import { CeroError } from '../lib/errors.js'
 
@@ -103,7 +104,8 @@ export class Pairing extends ReadyResource {
     // identity throw 'Active member already exist'
     if (this.host) {
       this._member = this._blind.addMember({
-        discoveryKey: discoveryKey(this.topic),
+        // channel-scoped; the candidate hashes identically (no channel → identity)
+        discoveryKey: channelTopic(discoveryKey(this.topic), this.network.channel),
         onadd: (req) => this._onCandidate(req).catch(this._onerror)
       })
     }
@@ -486,6 +488,8 @@ class Candidate {
         this._candidate = this.pairing._blind.addCandidate({
           invite: this.invite.blind,
           userData: this.userData,
+          // must hash exactly like the member side — see Pairing._open
+          discoveryKey: channelTopic(this.invite.discoveryKey, this.pairing.network.channel),
           onadd: (result) => this._done(result)
         })
         this._candidate.request.on('rejected', (err) => this._fail(fromBlindError(err)))
@@ -560,7 +564,9 @@ function decodeUserData(buf, encoding) {
 }
 
 function fromBlindError(err) {
-  if (!err || !err.code) return CeroError.DENIED(err?.message || null)
+  // code-less rejections are protocol failures (undecodable reply, key
+  // mismatch, bad signature) — never a host decision, don't report DENIED
+  if (!err || !err.code) return CeroError.NETWORK_ERROR(err?.message || 'pairing failed')
   switch (err.code) {
     case 'INVITE_EXPIRED':
       return CeroError.EXPIRED(err.message)

package/src/rpc/peer.js

@@ -25,8 +25,11 @@ export class RPCPeer extends ReadyResource {
     this.ipc = ipc
     this.spec = spec
     this.framed = new FramedStream(ipc)
-    this.framed.pause()
     this.rpc = new spec.rpc(this.framed)
+    // pause AFTER hrpc attaches its 'data' listener — streamx re-resumes a
+    // paused stream the moment a listener attaches, so pausing first holds
+    // nothing and early frames would dispatch before the codec is bound
+    this.framed.pause()
   }
 
   async _open() {

package/src/storage/index.js

@@ -5,11 +5,19 @@ import Corestore from 'corestore'
 import HyperDB from 'hyperdb'
 import ReadyResource from 'ready-resource'
 
-import { ROCKS, BEE, SINGLE, COLLECTION } from '../lib/constants.js'
-import { genId, subscribe } from '../lib/utils.js'
+import { ROCKS, BEE, SINGLE, COLLECTION, QUERY_RESERVED } from '../lib/constants.js'
+import { genId, subscribe, searchHit } from '../lib/utils.js'
 import { CeroError } from '../lib/errors.js'
 
-const RANGE_OPS = new Set(['gt', 'gte', 'lt', 'lte', 'reverse', 'limit'])
+// The subset of the query grammar hyperdb itself honors (pushed down);
+// the rest of QUERY_RESERVED is applied in memory here.
+const RANGE_OPS = ['gt', 'gte', 'lt', 'lte', 'reverse', 'limit']
+
+const pick = (query, keys) => {
+  const out = {}
+  if (query) for (const k of keys) if (query[k] !== undefined) out[k] = query[k]
+  return out
+}
 
 /**
  * @typedef {object} StorageOpts
@@ -204,17 +212,18 @@ export class Storage extends ReadyResource {
       return { data: (await this.db.get(col, { id: query })) ?? null }
     }
 
-    // hyperdb only honors range/limit operators — equality fields must be
-    // filtered here or they are silently ignored and every row comes back
-    const eq = Object.keys(query || {}).filter((k) => !RANGE_OPS.has(k))
-    if (eq.length) {
+    // hyperdb only honors range/limit operators — equality fields and search
+    // must be applied here or they are silently ignored and every row comes back
+    const eq = Object.keys(query || {}).filter((k) => !QUERY_RESERVED.has(k))
+    if (eq.length || query?.search) {
       const rows = await this.db.find(col, {}).toArray()
-      const matched = rows.filter((r) => eq.every((k) => r[k] === query[k]))
+      let matched = rows.filter((r) => eq.every((k) => r[k] === query[k]))
+      if (query.search) matched = matched.filter((r) => searchHit(r, query.search, query.fields))
       const data = query.limit != null ? matched.slice(0, query.limit) : matched
       return { data, total: matched.length, size: data.length }
     }
 
-    const data = await this.db.find(col, query || {}).toArray()
+    const data = await this.db.find(col, pick(query, RANGE_OPS)).toArray()
     // a limit caps `data`, so `total` needs a full count; with no query
     // `data` is already everything — skip the second scan.
     const filtered = query && Object.keys(query).length > 0
@@ -233,9 +242,11 @@ export class Storage extends ReadyResource {
     this._guard()
     const ref = this._ref(name)
     const col = this._col(ref)
-    const eq = Object.keys(query || {}).filter((k) => !RANGE_OPS.has(k))
-    const rows = await this.db.find(col, eq.length ? {} : query || {}).toArray()
-    const matched = eq.length ? rows.filter((r) => eq.every((k) => r[k] === query[k])) : rows
+    const eq = Object.keys(query || {}).filter((k) => !QUERY_RESERVED.has(k))
+    const filtered = eq.length || query?.search
+    const rows = await this.db.find(col, filtered ? {} : pick(query, RANGE_OPS)).toArray()
+    let matched = filtered ? rows.filter((r) => eq.every((k) => r[k] === query[k])) : rows
+    if (query?.search) matched = matched.filter((r) => searchHit(r, query.search, query.fields))
     return { data: matched.length }
   }
 

package/types/database/changes.d.ts

@@ -1,10 +1,11 @@
 /**
  * Pull-driven delta stream over a collection: batches of `{ prev, next }`
- * pairs diffed between per-stream snapshot cursors. Update ticks only mark
- * the stream dirty — the diff runs when the reader demands, so backpressure
- * folds bursts into one bigger batch and nothing is ever dropped. The first
- * batch, and any batch after the view is swapped or fast-forwarded to a new
- * core, carries the full matching state as inserts with `reset: true`.
+ * pairs diffed between per-stream head cursors (`db.diff(col, { from })`).
+ * Update ticks only mark the stream dirty — the diff runs when the reader
+ * demands, so backpressure folds bursts into one bigger batch and nothing is
+ * ever dropped. The first batch, and any batch after the view is swapped or
+ * fast-forwarded to a new core, carries the full matching state as inserts
+ * with `reset: true`.
  *
  * @param {import('./index.js').Database} db
  * @param {string} name    Ref name (scopes the update ticks).

package/types/database/encryption.d.ts

@@ -7,6 +7,8 @@
  * @returns {Uint8Array}
  */
 export function blobEpochKey(entropy: Uint8Array): Uint8Array;
+/** Prime a keyring from a local core's persisted epoch stash. */
+export function loadEpochs(keyring: any, local: any): Promise<void>;
 /**
  * Wire codec for a rotation announcement's envelope list — one sealed box
  * per remaining member, addressed by member id.
@@ -46,7 +48,6 @@ export class Keyring {
     seq: number;
     /** bumped on every add/remove — cheap change detection for retries */
     version: number;
-    primed: boolean;
     /** @returns {Array<{ epoch: number, stamp: number, entropy: Uint8Array }>} ascending by seq */
     all(): Array<{
         epoch: number;
@@ -86,12 +87,12 @@ export class EpochEncryption {
 export class EpochAutobee {
     constructor(store: any, key: any, handlers?: {});
     keyring: any;
+    _epochStalled: Set<any>;
     _epochRetry: any;
     _epochRetryDelay: number;
     _epochRetrySeen: number;
-    _bootState(): Promise<void>;
     _bumpPendingWriters(): Promise<any>;
-    _parkOnUnknownEpoch(w: any): void;
+    _applyWakeupHints(): Promise<any>;
     _scheduleEpochRetry(): void;
     _close(): Promise<any>;
 }

package/types/database/index.d.ts

@@ -90,7 +90,7 @@ export class Database extends ReadyResource {
     onApplyHooks: Set<any>;
     _applySeq: number;
     _touched: Set<any>;
-    txQueue: any[];
+    txQueue: any;
     _discovery: import("../network/discovery.js").Discovery;
     /** Open the underlying autobee, wire dispatcher + apply, attach to network. */
     openBee(): Promise<void>;
@@ -258,14 +258,19 @@ export class Database extends ReadyResource {
      */
     _healEpochs(): Promise<void>;
     /**
-     * Batch every write performed inside `fn` into a single autobee append.
-     * Nested calls reuse the outer queue.
+     * Batch every write made through the transaction handle passed to `fn`
+     * into a single autobee append. The handle is this database with its own
+     * write queue — same surface (`put`/`set`/`del`/`call`), but writes buffer
+     * until `fn` returns, and are discarded if it throws. Writes made on the
+     * database itself meanwhile append normally: an unrelated concurrent write
+     * can never be swallowed into (and rolled back with) a transaction.
+     * Nested `tx()` on the handle joins the same batch.
      *
      * @template T
-     * @param {() => Promise<T> | T} fn
+     * @param {(tx: Database) => Promise<T> | T} fn
      * @returns {Promise<T>}
      */
-    tx<T>(fn: () => Promise<T> | T): Promise<T>;
+    tx<T>(fn: (tx: Database) => Promise<T> | T): Promise<T>;
     _txChain: any;
     /**
      * Encode and append dispatch ops. Buffers into the active `tx` queue if one

package/types/lib/constants.d.ts

@@ -33,5 +33,6 @@ export namespace RANK {
     export { reader_1 as reader };
 }
 export const NAMESPACE: "cero";
+export const QUERY_RESERVED: Set<string>;
 export const COUNTERS: "counters";
 export const EPOCHS: "epochs";

package/types/lib/utils.d.ts

@@ -27,6 +27,7 @@ export function subscribe<T>({ get, watch }: {
     get: () => Promise<T> | T;
     watch: (fn: () => void) => (() => void) | void;
 }): import("streamx").Readable<T>;
+export function searchHit(row: any, term: any, fields: any): boolean;
 /**
  * z32-encode a 32-byte key into a canonical string id.
  *

package/types/network/index.d.ts

@@ -1,4 +1,4 @@
-export { channelTopic };
+export function channelTopic(topic: any, channel: any): any;
 /**
  * @typedef {object} NetworkOpts
  * @property {import('../identity/index.js').Identity} [identity]  Long-lived keypair used as the swarm identity.
@@ -28,7 +28,7 @@ export class Network extends ReadyResource {
     channel: string;
     store: any;
     mirrors: any[];
-    _dht: DHTTransport;
+    _swarm: any;
     wakeup: any;
     _replicateables: Set<any>;
     _discoveries: Set<any>;
@@ -82,7 +82,7 @@ export class Network extends ReadyResource {
      * @param {{ timeout?: number }} [opts]
      * @returns {Promise<void>}
      */
-    flush(opts?: {
+    flush({ timeout }?: {
         timeout?: number;
     }): Promise<void>;
     /**
@@ -168,7 +168,5 @@ export type NetworkOpts = {
 export type Replicable = {
     replicate: (stream: any) => any;
 };
-import { channelTopic } from './transports/dht.js';
 import ReadyResource from 'ready-resource';
-import { DHTTransport } from './transports/dht.js';
 import { Discovery } from './discovery.js';

package/src/network/transports/dht.js

@@ -1,110 +0,0 @@
-import Hyperswarm from 'hyperswarm'
-import b4a from 'b4a'
-import { hash } from 'hypercore-crypto'
-import safetyCatch from 'safety-catch'
-
-/**
- * @typedef {object} DHTTransportOpts
- * @property {import('../../identity/index.js').Identity} [identity]  Long-lived keypair used as the swarm identity.
- * @property {Array<{ host: string, port: number }>} [bootstrap]      Custom DHT bootstrap nodes.
- * @property {(remotePublicKey: Uint8Array, payload: any) => boolean} [firewall]  Incoming-connection filter.
- * @property {Uint8Array[]} [relayThrough]                            Relay public keys to tunnel through.
- * @property {string} [channel]                                       Optional network-isolation label; only same-channel peers meet.
- */
-
-/**
- * The internet transport: a Hyperswarm that finds peers over the DHT. Owns the
- * swarm's whole lifecycle — construction (identity keyPair, bootstrap, firewall,
- * relay), the channel-topic join/leave wrapping, flush, suspend/resume, and
- * teardown. {@link Network} subscribes to `this.swarm`'s connection/peer events
- * and drives topic joins; the swarm-specific wiring lives here.
- */
-export class DHTTransport {
-  /** @param {DHTTransportOpts} [opts] */
-  constructor({ identity, bootstrap, firewall, relayThrough, channel } = {}) {
-    const opts = {}
-    if (identity) opts.keyPair = { publicKey: identity.publicKey, secretKey: identity.secretKey }
-    if (bootstrap) opts.bootstrap = bootstrap
-    if (firewall) opts.firewall = firewall
-    if (relayThrough) opts.relayThrough = relayThrough
-
-    this.swarm = new Hyperswarm(opts)
-
-    if (channel) {
-      const join = this.swarm.join.bind(this.swarm)
-      const leave = this.swarm.leave.bind(this.swarm)
-      this.swarm.join = (topic, opts) => join(channelTopic(topic, channel), opts)
-      this.swarm.leave = (topic) => leave(channelTopic(topic, channel))
-    }
-  }
-
-  /** @returns {boolean} */
-  get suspended() {
-    return this.swarm?.suspended === true
-  }
-
-  /**
-   * Wait for pending DHT announces and lookups to settle, bounded by timeout.
-   *
-   * @param {{ timeout?: number }} [opts]
-   * @returns {Promise<void>}
-   */
-  async flush({ timeout = 500 } = {}) {
-    if (!this.swarm) return
-    await Promise.race([this.swarm.flush(), new Promise((r) => setTimeout(r, timeout))])
-  }
-
-  /**
-   * Pause the swarm — keeps state, drops sockets. Idempotent.
-   *
-   * @returns {Promise<void>}
-   */
-  async suspend() {
-    if (!this.swarm || this.swarm.suspended) return
-    try {
-      await this.swarm.suspend()
-    } catch (err) {
-      safetyCatch(err)
-    }
-  }
-
-  /**
-   * Resume a suspended swarm. Idempotent.
-   *
-   * @returns {Promise<void>}
-   */
-  async resume() {
-    if (!this.swarm || !this.swarm.suspended) return
-    try {
-      await this.swarm.resume()
-    } catch (err) {
-      safetyCatch(err)
-    }
-  }
-
-  /**
-   * Flush pending discovery, then tear down the swarm. Idempotent.
-   *
-   * @returns {Promise<void>}
-   */
-  async destroy() {
-    if (!this.swarm) return
-    try {
-      await this.flush()
-    } catch (err) {
-      safetyCatch(err)
-    }
-    try {
-      await this.swarm.destroy()
-    } catch (err) {
-      safetyCatch(err)
-    }
-    this.swarm = null
-  }
-}
-
-// A channel re-namespaces every swarm topic so only same-channel peers meet.
-// No channel → identity (unchanged, back-compat).
-export function channelTopic(topic, channel) {
-  return channel ? hash([topic, b4a.from(channel)]) : topic
-}

package/types/network/transports/dht.d.ts

@@ -1,75 +0,0 @@
-export function channelTopic(topic: any, channel: any): any;
-/**
- * @typedef {object} DHTTransportOpts
- * @property {import('../../identity/index.js').Identity} [identity]  Long-lived keypair used as the swarm identity.
- * @property {Array<{ host: string, port: number }>} [bootstrap]      Custom DHT bootstrap nodes.
- * @property {(remotePublicKey: Uint8Array, payload: any) => boolean} [firewall]  Incoming-connection filter.
- * @property {Uint8Array[]} [relayThrough]                            Relay public keys to tunnel through.
- * @property {string} [channel]                                       Optional network-isolation label; only same-channel peers meet.
- */
-/**
- * The internet transport: a Hyperswarm that finds peers over the DHT. Owns the
- * swarm's whole lifecycle — construction (identity keyPair, bootstrap, firewall,
- * relay), the channel-topic join/leave wrapping, flush, suspend/resume, and
- * teardown. {@link Network} subscribes to `this.swarm`'s connection/peer events
- * and drives topic joins; the swarm-specific wiring lives here.
- */
-export class DHTTransport {
-    /** @param {DHTTransportOpts} [opts] */
-    constructor({ identity, bootstrap, firewall, relayThrough, channel }?: DHTTransportOpts);
-    swarm: any;
-    /** @returns {boolean} */
-    get suspended(): boolean;
-    /**
-     * Wait for pending DHT announces and lookups to settle, bounded by timeout.
-     *
-     * @param {{ timeout?: number }} [opts]
-     * @returns {Promise<void>}
-     */
-    flush({ timeout }?: {
-        timeout?: number;
-    }): Promise<void>;
-    /**
-     * Pause the swarm — keeps state, drops sockets. Idempotent.
-     *
-     * @returns {Promise<void>}
-     */
-    suspend(): Promise<void>;
-    /**
-     * Resume a suspended swarm. Idempotent.
-     *
-     * @returns {Promise<void>}
-     */
-    resume(): Promise<void>;
-    /**
-     * Flush pending discovery, then tear down the swarm. Idempotent.
-     *
-     * @returns {Promise<void>}
-     */
-    destroy(): Promise<void>;
-}
-export type DHTTransportOpts = {
-    /**
-     * Long-lived keypair used as the swarm identity.
-     */
-    identity?: import("../../identity/index.js").Identity;
-    /**
-     * Custom DHT bootstrap nodes.
-     */
-    bootstrap?: Array<{
-        host: string;
-        port: number;
-    }>;
-    /**
-     * Incoming-connection filter.
-     */
-    firewall?: (remotePublicKey: Uint8Array, payload: any) => boolean;
-    /**
-     * Relay public keys to tunnel through.
-     */
-    relayThrough?: Uint8Array[];
-    /**
-     * Optional network-isolation label; only same-channel peers meet.
-     */
-    channel?: string;
-};