@cero-base/core 1.15.0 → 1.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cero-base/core",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "description": "cero p2p primitives — identity, storage, network, database, blobs, rpc, pairing.",
   "type": "module",
   "sideEffects": false,

package/src/database/index.js

@@ -195,13 +195,16 @@ export class Database extends ReadyResource {
       // no cero row records another writer's oplog length to fall back to.
       isTrusted: async (writer, view) => {
         try {
-          if (await view.get(`@${this.ns}/devices`, { id: toId(writer) })) return true
-          // before any device record exists (a boot's genesis-era reference)
-          // only the genesis writer may vouch — its core IS the db key, and
-          // its signatures are unforgeable. Anyone else stays refused: an
-          // empty view is exactly the window an ex-member would target.
-          const any = await view.find(`@${this.ns}/devices`, { limit: 1 }).toArray()
-          return any.length === 0 && !!this.key && b4a.equals(writer, this.key)
+          const row = await bounded(view.get(`@${this.ns}/devices`, { id: toId(writer) }))
+          if (!row) return false
+          if (row.v) return true
+          // only where the view PROVABLY holds no device yet (a boot's
+          // genesis-era reference) may the genesis writer vouch — its core IS
+          // the db key, and its signatures are unforgeable. Everyone else
+          // stays refused: an empty view is the window an ex-member targets.
+          const any = await bounded(view.find(`@${this.ns}/devices`, { limit: 1 }).toArray())
+          if (!any) return false
+          return any.v.length === 0 && !!this.key && b4a.equals(writer, this.key)
         } catch {
           return false
         }
@@ -1240,6 +1243,17 @@ export class Database extends ReadyResource {
   }
 }
 
+// A trust decision reads a historic checkout view, whose blocks may not be
+// servable yet — an unbounded read there wedges autobee's drain forever. The
+// value is wrapped so a timeout (null) is never mistaken for what the read
+// would have returned; undecidable in time means "not trusted", and the
+// caller retries.
+const bounded = (promise, ms = 2000) =>
+  Promise.race([
+    promise.then((v) => ({ v })),
+    new Promise((resolve) => setTimeout(() => resolve(null), ms))
+  ])
+
 // Fields the write path stamps itself — always allowed even if not user-declared.
 const SYSTEM_FIELDS = new Set(['id', 'memberId', 'index', 'createdAt', 'updatedAt'])