@cero-base/core 1.14.0 → 1.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/core",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "description": "cero p2p primitives — identity, storage, network, database, blobs, rpc, pairing.",
   "type": "module",
   "sideEffects": false,
@@ -136,17 +136,17 @@
   },
   "dependencies": {
     "@hyperswarm/secret-stream": "^6.9.1",
-    "autobee": "2.0.0-rc.21",
+    "autobee": "2.0.0-rc.26",
     "autobee-encryption": "0.1.3",
     "b4a": "^1.8.1",
     "bare-crypto": "^1.15.3",
-    "bare-fs": "^4.8.0",
+    "bare-fs": "^4.8.1",
     "bare-path": "^3.1.1",
     "bip39-mnemonic": "^2.5.0",
     "blind-pairing": "^2.3.1",
     "blind-peering": "^2.6.3",
     "compact-encoding": "^3.3.2",
-    "corestore": "^7.12.0",
+    "corestore": "^7.12.2",
     "framed-stream": "^1.0.1",
     "hrpc": "^4.3.1",
     "hyperblobs": "^2.12.1",
@@ -164,17 +164,17 @@
     "ready-resource": "^1.2.0",
     "safety-catch": "^1.0.3",
     "sodium-universal": "^5.0.1",
-    "streamx": "^2.28.0",
+    "streamx": "^2.28.1",
     "z32": "^1.1.0"
   },
   "devDependencies": {
     "@hyperswarm/testnet": "^3.1.4",
     "bare-abort-controller": "^1.1.2",
-    "bare-events": "^2.9.1",
+    "bare-events": "^2.9.2",
     "bare-fetch": "^3.2.0",
     "bare-process": "^4.5.1",
     "bare-url": "^2.5.2",
-    "blind-peer": "^3.13.3",
+    "blind-peer": "^3.14.0",
     "brittle": "^4.1.0",
     "typescript": "^5.9.3",
     "which-runtime": "^1.4.0"

package/src/database/index.js

@@ -129,7 +129,9 @@ export class Database extends ReadyResource {
       this._healTimer = null
     }
     if (this._discovery) {
-      await this._discovery.destroy()
+      // unannounce in the background — awaiting the DHT round-trip here
+      // blocks every close (and the writer-swap reboot) for seconds
+      this._discovery.destroy().catch(safetyCatch)
       this._discovery = null
     }
     if (this.bee) {
@@ -184,6 +186,26 @@ export class Database extends ReadyResource {
       optimistic: true,
       wakeup: wakeup || undefined,
       open: (b) => HyperDB.bee2(b, this.spec.database, { autoUpdate: true }),
+      // without this hook autobee trusts EVERY fast-forward candidate, so a
+      // removed device could serve a stale or forked head and we would boot
+      // onto it. A head is only worth following if its writer is still a
+      // device — decided against the reference view autobee hands us (its own
+      // state at the point of the decision), never the live view. Untrusted
+      // heads are then skipped outright: mostRecentTrusted stays unset because
+      // no cero row records another writer's oplog length to fall back to.
+      isTrusted: async (writer, view) => {
+        try {
+          if (await view.get(`@${this.ns}/devices`, { id: toId(writer) })) return true
+          // before any device record exists (a boot's genesis-era reference)
+          // only the genesis writer may vouch — its core IS the db key, and
+          // its signatures are unforgeable. Anyone else stays refused: an
+          // empty view is exactly the window an ex-member would target.
+          const any = await view.find(`@${this.ns}/devices`, { limit: 1 }).toArray()
+          return any.length === 0 && !!this.key && b4a.equals(writer, this.key)
+        } catch {
+          return false
+        }
+      },
       apply: async (nodes, view, host) => {
         // envelope handling lives here, once: unwrap every node and skip ops
         // from a newer app version (deterministic — they stay in the log), so
@@ -216,6 +238,12 @@ export class Database extends ReadyResource {
       }
     })
 
+    // swarm BEFORE boot when the key is known: replication is live while the
+    // bee opens, so the boot (and a future fast-forward boot) has peers to
+    // pull from instead of opening cold and waiting for discovery
+    const known = !!this.key
+    if (this.network && known) this._joinSwarm(bee, crypto.discoveryKey(this.key))
+
     await bee.ready()
     // assigned before the first update: apply-time hooks (_onEpoch's save,
     // _onFuture) dereference this.bee and must never see it null mid-drain
@@ -250,15 +278,19 @@ export class Database extends ReadyResource {
     // without a listener autobee escalates apply/view errors to a process crash
     bee.on('error', this._onerror)
 
-    if (this.network) {
-      this.network.attach(bee)
-      // a writer swap re-opens the bee — tear down the prior discovery session
-      // first so it isn't orphaned by the reassignment below
-      if (this._discovery) await this._discovery.destroy()
-      this._discovery = this.network.join(bee.discoveryKey, {
-        mode: this.passive ? PASSIVE : ACTIVE
-      })
-    }
+    // a fresh db has no key until boot mints it — join once it exists
+    if (this.network && !known) this._joinSwarm(bee, bee.discoveryKey)
+  }
+
+  // a writer swap re-opens the bee on the SAME topic — join first so the old
+  // session's destroy is a refcounted detach, not a DHT unannounce round-trip
+  _joinSwarm(bee, discoveryKey) {
+    this.network.attach(bee)
+    const prev = this._discovery
+    this._discovery = this.network.join(discoveryKey, {
+      mode: this.passive ? PASSIVE : ACTIVE
+    })
+    if (prev) prev.destroy().catch(safetyCatch)
   }
 
   /**

package/src/network/index.js

@@ -24,6 +24,7 @@ export function channelTopic(topic, channel) {
  * @property {Array<{ host: string, port: number }>} [bootstrap]    Custom DHT bootstrap nodes.
  * @property {(remotePublicKey: Uint8Array, payload: any) => boolean} [firewall]  Incoming-connection filter.
  * @property {Uint8Array[]} [relayThrough]                          Relay public keys to tunnel through.
+ * @property {number[]} [backoffs]                                  Reconnect backoff tiers in ms; the default escalates to ~10min, far too slow for local nets.
  * @property {string} [channel]                                     Optional network-isolation label; only same-channel peers meet.
  * @property {any} [store]                                          Corestore; required for mirrors (blind peers replicate its cores).
  * @property {Array<string | Uint8Array>} [mirrors]                Blind-peer public keys; each attached room/blob core is mirrored through them for offline sync.
@@ -37,12 +38,22 @@ export function channelTopic(topic, channel) {
  */
 export class Network extends ReadyResource {
   /** @param {NetworkOpts} [opts] */
-  constructor({ identity, bootstrap, firewall, relayThrough, channel, store, mirrors } = {}) {
+  constructor({
+    identity,
+    bootstrap,
+    firewall,
+    relayThrough,
+    backoffs,
+    channel,
+    store,
+    mirrors
+  } = {}) {
     super()
     this.identity = identity || null
     this.bootstrap = bootstrap || null
     this.firewall = firewall || null
     this.relayThrough = relayThrough || null
+    this.backoffs = backoffs || null
     this.channel = channel || null
     this.store = store || null
     this.mirrors = (mirrors || []).map((k) => (typeof k === 'string' ? decodeKey(k) : k))
@@ -168,6 +179,7 @@ export class Network extends ReadyResource {
     if (this.bootstrap) opts.bootstrap = this.bootstrap
     if (this.firewall) opts.firewall = this.firewall
     if (this.relayThrough) opts.relayThrough = this.relayThrough
+    if (this.backoffs) opts.backoffs = this.backoffs
 
     const swarm = (this._swarm = new Hyperswarm(opts))
     swarm.on('connection', (stream, info) => {
@@ -240,12 +252,24 @@ export class Network extends ReadyResource {
     }
     this._injected.clear()
 
-    for (const d of [...this._discoveries]) {
-      try {
-        await d.destroy()
-      } catch (err) {
-        safetyCatch(err)
-      }
+    // stop every discovery session NOW (timers die synchronously) but never
+    // await the DHT unannounce round-trips — the force destroy below skips
+    // upstream's own clear(), so un-destroyed sessions would leak live timers
+    for (const d of [...this._discoveries]) d.destroy().catch(safetyCatch)
+    this._discoveries.clear()
+
+    // the swarm dies FIRST, with force: every polite per-topic DHT unannounce
+    // (blind-pairing's included) becomes an instant no-op instead of a network
+    // round-trip — a vanished node ages out of the DHT regardless
+    const swarm = this._swarm
+    this._swarm = null
+    if (swarm) {
+      // even force destroy awaits a graceful server.close DHT round-trip
+      // upstream — cap the wait and let the teardown finish in the background
+      await Promise.race([
+        swarm.destroy({ force: true }).catch(safetyCatch),
+        new Promise((r) => setTimeout(r, 750))
+      ])
     }
 
     if (this._blindPeering) {
@@ -266,16 +290,6 @@ export class Network extends ReadyResource {
       this._blind = null
     }
 
-    if (this._swarm) {
-      try {
-        await this.flush()
-        await this._swarm.destroy()
-      } catch (err) {
-        safetyCatch(err)
-      }
-      this._swarm = null
-    }
-
     if (this.wakeup) {
       try {
         await this.wakeup.destroy()

package/types/database/index.d.ts

@@ -94,6 +94,7 @@ export class Database extends ReadyResource {
     _discovery: import("../network/discovery.js").Discovery;
     /** Open the underlying autobee, wire dispatcher + apply, attach to network. */
     openBee(): Promise<void>;
+    _joinSwarm(bee: any, discoveryKey: any): void;
     /**
      * Flip announce mode at runtime — passive stays reachable (server) but
      * stops actively looking (client). Cheap; use it to demote idle rooms.

package/types/network/index.d.ts

@@ -5,6 +5,7 @@ export function channelTopic(topic: any, channel: any): any;
  * @property {Array<{ host: string, port: number }>} [bootstrap]    Custom DHT bootstrap nodes.
  * @property {(remotePublicKey: Uint8Array, payload: any) => boolean} [firewall]  Incoming-connection filter.
  * @property {Uint8Array[]} [relayThrough]                          Relay public keys to tunnel through.
+ * @property {number[]} [backoffs]                                  Reconnect backoff tiers in ms; the default escalates to ~10min, far too slow for local nets.
  * @property {string} [channel]                                     Optional network-isolation label; only same-channel peers meet.
  * @property {any} [store]                                          Corestore; required for mirrors (blind peers replicate its cores).
  * @property {Array<string | Uint8Array>} [mirrors]                Blind-peer public keys; each attached room/blob core is mirrored through them for offline sync.
@@ -17,7 +18,7 @@ export function channelTopic(topic: any, channel: any): any;
  */
 export class Network extends ReadyResource {
     /** @param {NetworkOpts} [opts] */
-    constructor({ identity, bootstrap, firewall, relayThrough, channel, store, mirrors }?: NetworkOpts);
+    constructor({ identity, bootstrap, firewall, relayThrough, backoffs, channel, store, mirrors }?: NetworkOpts);
     identity: import("../index.js").Identity;
     bootstrap: {
         host: string;
@@ -25,6 +26,7 @@ export class Network extends ReadyResource {
     }[];
     firewall: (remotePublicKey: Uint8Array, payload: any) => boolean;
     relayThrough: Uint8Array<ArrayBufferLike>[];
+    backoffs: number[];
     channel: string;
     store: any;
     mirrors: any[];
@@ -152,6 +154,10 @@ export type NetworkOpts = {
      * Relay public keys to tunnel through.
      */
     relayThrough?: Uint8Array[];
+    /**
+     * Reconnect backoff tiers in ms; the default escalates to ~10min, far too slow for local nets.
+     */
+    backoffs?: number[];
     /**
      * Optional network-isolation label; only same-channel peers meet.
      */