@cero-base/core 1.14.1 → 1.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/core",
-  "version": "1.14.1",
+  "version": "1.15.1",
   "description": "cero p2p primitives — identity, storage, network, database, blobs, rpc, pairing.",
   "type": "module",
   "sideEffects": false,
@@ -136,7 +136,7 @@
   },
   "dependencies": {
     "@hyperswarm/secret-stream": "^6.9.1",
-    "autobee": "2.0.0-rc.25",
+    "autobee": "2.0.0-rc.26",
     "autobee-encryption": "0.1.3",
     "b4a": "^1.8.1",
     "bare-crypto": "^1.15.3",

package/src/database/index.js

@@ -186,6 +186,29 @@ export class Database extends ReadyResource {
       optimistic: true,
       wakeup: wakeup || undefined,
       open: (b) => HyperDB.bee2(b, this.spec.database, { autoUpdate: true }),
+      // without this hook autobee trusts EVERY fast-forward candidate, so a
+      // removed device could serve a stale or forked head and we would boot
+      // onto it. A head is only worth following if its writer is still a
+      // device — decided against the reference view autobee hands us (its own
+      // state at the point of the decision), never the live view. Untrusted
+      // heads are then skipped outright: mostRecentTrusted stays unset because
+      // no cero row records another writer's oplog length to fall back to.
+      isTrusted: async (writer, view) => {
+        try {
+          const row = await bounded(view.get(`@${this.ns}/devices`, { id: toId(writer) }))
+          if (!row) return false
+          if (row.v) return true
+          // only where the view PROVABLY holds no device yet (a boot's
+          // genesis-era reference) may the genesis writer vouch — its core IS
+          // the db key, and its signatures are unforgeable. Everyone else
+          // stays refused: an empty view is the window an ex-member targets.
+          const any = await bounded(view.find(`@${this.ns}/devices`, { limit: 1 }).toArray())
+          if (!any) return false
+          return any.v.length === 0 && !!this.key && b4a.equals(writer, this.key)
+        } catch {
+          return false
+        }
+      },
       apply: async (nodes, view, host) => {
         // envelope handling lives here, once: unwrap every node and skip ops
         // from a newer app version (deterministic — they stay in the log), so
@@ -218,6 +241,12 @@ export class Database extends ReadyResource {
       }
     })
 
+    // swarm BEFORE boot when the key is known: replication is live while the
+    // bee opens, so the boot (and a future fast-forward boot) has peers to
+    // pull from instead of opening cold and waiting for discovery
+    const known = !!this.key
+    if (this.network && known) this._joinSwarm(bee, crypto.discoveryKey(this.key))
+
     await bee.ready()
     // assigned before the first update: apply-time hooks (_onEpoch's save,
     // _onFuture) dereference this.bee and must never see it null mid-drain
@@ -252,17 +281,19 @@ export class Database extends ReadyResource {
     // without a listener autobee escalates apply/view errors to a process crash
     bee.on('error', this._onerror)
 
-    if (this.network) {
-      this.network.attach(bee)
-      // a writer swap re-opens the bee on the SAME topic — join first so the
-      // old session's destroy is a refcounted detach, not a DHT unannounce
-      // round-trip (which blocked the swap for seconds)
-      const prev = this._discovery
-      this._discovery = this.network.join(bee.discoveryKey, {
-        mode: this.passive ? PASSIVE : ACTIVE
-      })
-      if (prev) await prev.destroy()
-    }
+    // a fresh db has no key until boot mints it — join once it exists
+    if (this.network && !known) this._joinSwarm(bee, bee.discoveryKey)
+  }
+
+  // a writer swap re-opens the bee on the SAME topic — join first so the old
+  // session's destroy is a refcounted detach, not a DHT unannounce round-trip
+  _joinSwarm(bee, discoveryKey) {
+    this.network.attach(bee)
+    const prev = this._discovery
+    this._discovery = this.network.join(discoveryKey, {
+      mode: this.passive ? PASSIVE : ACTIVE
+    })
+    if (prev) prev.destroy().catch(safetyCatch)
   }
 
   /**
@@ -1212,6 +1243,17 @@ export class Database extends ReadyResource {
   }
 }
 
+// A trust decision reads a historic checkout view, whose blocks may not be
+// servable yet — an unbounded read there wedges autobee's drain forever. The
+// value is wrapped so a timeout (null) is never mistaken for what the read
+// would have returned; undecidable in time means "not trusted", and the
+// caller retries.
+const bounded = (promise, ms = 2000) =>
+  Promise.race([
+    promise.then((v) => ({ v })),
+    new Promise((resolve) => setTimeout(() => resolve(null), ms))
+  ])
+
 // Fields the write path stamps itself — always allowed even if not user-declared.
 const SYSTEM_FIELDS = new Set(['id', 'memberId', 'index', 'createdAt', 'updatedAt'])
 

package/src/network/index.js

@@ -24,6 +24,7 @@ export function channelTopic(topic, channel) {
  * @property {Array<{ host: string, port: number }>} [bootstrap]    Custom DHT bootstrap nodes.
  * @property {(remotePublicKey: Uint8Array, payload: any) => boolean} [firewall]  Incoming-connection filter.
  * @property {Uint8Array[]} [relayThrough]                          Relay public keys to tunnel through.
+ * @property {number[]} [backoffs]                                  Reconnect backoff tiers in ms; the default escalates to ~10min, far too slow for local nets.
  * @property {string} [channel]                                     Optional network-isolation label; only same-channel peers meet.
  * @property {any} [store]                                          Corestore; required for mirrors (blind peers replicate its cores).
  * @property {Array<string | Uint8Array>} [mirrors]                Blind-peer public keys; each attached room/blob core is mirrored through them for offline sync.
@@ -37,12 +38,22 @@ export function channelTopic(topic, channel) {
  */
 export class Network extends ReadyResource {
   /** @param {NetworkOpts} [opts] */
-  constructor({ identity, bootstrap, firewall, relayThrough, channel, store, mirrors } = {}) {
+  constructor({
+    identity,
+    bootstrap,
+    firewall,
+    relayThrough,
+    backoffs,
+    channel,
+    store,
+    mirrors
+  } = {}) {
     super()
     this.identity = identity || null
     this.bootstrap = bootstrap || null
     this.firewall = firewall || null
     this.relayThrough = relayThrough || null
+    this.backoffs = backoffs || null
     this.channel = channel || null
     this.store = store || null
     this.mirrors = (mirrors || []).map((k) => (typeof k === 'string' ? decodeKey(k) : k))
@@ -168,6 +179,7 @@ export class Network extends ReadyResource {
     if (this.bootstrap) opts.bootstrap = this.bootstrap
     if (this.firewall) opts.firewall = this.firewall
     if (this.relayThrough) opts.relayThrough = this.relayThrough
+    if (this.backoffs) opts.backoffs = this.backoffs
 
     const swarm = (this._swarm = new Hyperswarm(opts))
     swarm.on('connection', (stream, info) => {

package/types/database/index.d.ts

@@ -94,6 +94,7 @@ export class Database extends ReadyResource {
     _discovery: import("../network/discovery.js").Discovery;
     /** Open the underlying autobee, wire dispatcher + apply, attach to network. */
     openBee(): Promise<void>;
+    _joinSwarm(bee: any, discoveryKey: any): void;
     /**
      * Flip announce mode at runtime — passive stays reachable (server) but
      * stops actively looking (client). Cheap; use it to demote idle rooms.

package/types/network/index.d.ts

@@ -5,6 +5,7 @@ export function channelTopic(topic: any, channel: any): any;
  * @property {Array<{ host: string, port: number }>} [bootstrap]    Custom DHT bootstrap nodes.
  * @property {(remotePublicKey: Uint8Array, payload: any) => boolean} [firewall]  Incoming-connection filter.
  * @property {Uint8Array[]} [relayThrough]                          Relay public keys to tunnel through.
+ * @property {number[]} [backoffs]                                  Reconnect backoff tiers in ms; the default escalates to ~10min, far too slow for local nets.
  * @property {string} [channel]                                     Optional network-isolation label; only same-channel peers meet.
  * @property {any} [store]                                          Corestore; required for mirrors (blind peers replicate its cores).
  * @property {Array<string | Uint8Array>} [mirrors]                Blind-peer public keys; each attached room/blob core is mirrored through them for offline sync.
@@ -17,7 +18,7 @@ export function channelTopic(topic: any, channel: any): any;
  */
 export class Network extends ReadyResource {
     /** @param {NetworkOpts} [opts] */
-    constructor({ identity, bootstrap, firewall, relayThrough, channel, store, mirrors }?: NetworkOpts);
+    constructor({ identity, bootstrap, firewall, relayThrough, backoffs, channel, store, mirrors }?: NetworkOpts);
     identity: import("../index.js").Identity;
     bootstrap: {
         host: string;
@@ -25,6 +26,7 @@ export class Network extends ReadyResource {
     }[];
     firewall: (remotePublicKey: Uint8Array, payload: any) => boolean;
     relayThrough: Uint8Array<ArrayBufferLike>[];
+    backoffs: number[];
     channel: string;
     store: any;
     mirrors: any[];
@@ -152,6 +154,10 @@ export type NetworkOpts = {
      * Relay public keys to tunnel through.
      */
     relayThrough?: Uint8Array[];
+    /**
+     * Reconnect backoff tiers in ms; the default escalates to ~10min, far too slow for local nets.
+     */
+    backoffs?: number[];
     /**
      * Optional network-isolation label; only same-channel peers meet.
      */