@mcsherrylabs/pi-meerkat 0.10.1 → 0.11.0

package/dist/installer-runtime/dist/src/announcements.js

@@ -30,7 +30,7 @@
 //     stores and floods the body it will later serve. This is why the group-chat deployment
 //     has a "DA group = the app nodes" step, and why an app cannot simply write to a channel
 //     it claimed with defaults.
-import { buildSignedTx, claimBody, channelBody, createGroupBody, addMemberBody, fString, fVarint, fMessage, concat, LEDGER, } from "@mcsherrylabs/evolver-client";
+import { fString, fVarint, fMessage, concat } from "@mcsherrylabs/evolver-client";
 /**
  * The channel this app owns — ONE variable, read by the app AND by the node's
  * `subscribed-channels` declaration in docker-compose.devnet.yml, because the two must agree
@@ -47,23 +47,6 @@ import { buildSignedTx, claimBody, channelBody, createGroupBody, addMemberBody,
  * rather than a literal.
  */
 export const CHANNEL = process.env.EVOLVER_CHANNEL?.trim() || "announcements1";
-/**
- * The DA threshold. ZERO — best-effort — because this app's DA group has ONE member.
- *
- * The scheduler's own validation states the rule and I had it wrong: at one DA node a
- * threshold of 1 can never be satisfied, because a node is never its own flood target and
- * does not self-attest, so a write needing one attestation waits for one that will not come
- * and ends in `503 da_unavailable`.
- *
- * ⚠ And best-effort means what it says: one member is ONE VOLUME. Lose it and every message
- * that member alone held is unrecoverable — and any future processing node declaring this
- * channel WEDGES on the first such message, permanently, because apply is forward-only. That
- * is not hypothetical: it is what happened to `announcements`, and it is why this app is on
- * `announcements1` (evolver#83). Two members on separate volumes is the answer when the
- * messages matter.
- */
-export const DA_THRESHOLD_M = Number(process.env.EVOLVER_DA_THRESHOLD_M?.trim() || 0);
-const utf8 = (s) => new TextEncoder().encode(s);
 /** The channel's terms as a NAMED node sees them — pass the devnet url to ask the chain, or
  *  this app's node to ask its own cursor. The difference is the point (fact 2). */
 export async function channelTerms(baseUrl, ledgerId = CHANNEL) {
@@ -111,27 +94,6 @@ export async function groupMembers(baseUrl, group) {
         return { known: false };
     }
 }
-/**
- * This node's OWN on-chain identity, which the app needs because the DA group's member is the
- * NODE, not the app.
- *
- * Read from `/status`, which is an HTML page — the honest state of things: a node reports its
- * own identity to a human and has no machine-readable equivalent. A JSON status route would
- * make this a question instead of a parse (see evolver#82, which asks for the same thing about
- * readiness).
- */
-export async function nodeSelfId(baseUrl) {
-    try {
-        const res = await fetch(`${baseUrl}/status`, { signal: AbortSignal.timeout(10_000) });
-        if (!res.ok)
-            return null;
-        const m = /<h1>\s*Node:\s*([A-Za-z0-9]+)\s*<\/h1>/.exec(await res.text());
-        return m ? m[1] : null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Submit a write and then CONFIRM IT BY READING — the only reliable shape on a node whose
  * apply this app paces (fact 3).
@@ -176,61 +138,6 @@ export async function submitAndConfirm(node, stx, label, confirm, say, opts) {
     }
     throw new Error(`${label}: not visible on chain within the deadline — outcome UNKNOWN, nothing resent`);
 }
-/**
- * Create the DA group and put this app's NODE in it.
- *
- * Both steps are best-effort and SAY what happened, because neither is the gate: from run two
- * onward "already exists" is the normal answer, and on a paced node a submit routinely returns
- * `timeout` and commits anyway. The real gate is the CLAIM below — it cannot succeed unless the
- * group exists with this node in it, so a silent failure here surfaces there rather than
- * passing unnoticed.
- */
-export async function ensureDaGroup(node, baseUrl, owner, signer, group, memberNodeId, say, pace) {
-    say(`   DA group '${group}', member '${memberNodeId}' — the NODE's identity, not the app's`);
-    // READ FIRST, AND SUBMIT ONLY WHAT IS MISSING.
-    //
-    // This used to submit CreateGroup and AddMember unconditionally on every run. A CreateGroup
-    // for a name that already exists is not simply refused: the node ACCEPTS it, then rejects it
-    // PRE-COMMIT every round ("name 'x' taken by group") and RETAINS it, re-proposing until its
-    // TTL. On the live devnet that did two things — three rejection warnings per round in the
-    // leader's log, and, far worse, it kept the tx queue permanently non-empty, which SUPPRESSES
-    // wake-on-work for the whole chain (evolver#85: the wake fires only on the queue's empty →
-    // non-empty edge). Every submitter, ours and everyone else's, then waited up to the
-    // five-minute idle heartbeat — which is also what burned an identity name through
-    // evolver#86. A pointless resubmission is not free, and on a shared chain it is not local.
-    const before = await groupMembers(baseUrl, group);
-    if (before.known && "members" in before && before.members.includes(memberNodeId)) {
-        say(`   group '${group}' exists with '${memberNodeId}' as a member — nothing to submit`);
-        return;
-    }
-    if (!before.known) {
-        throw new Error(`could not read group '${group}' from ${baseUrl} — refusing to guess: ` +
-            `submitting a CreateGroup for a name that already exists poisons the ` +
-            `chain's tx queue (evolver#85), so this needs an answer, not an attempt.`);
-    }
-    const steps = [];
-    if ("absent" in before) {
-        steps.push([`create group '${group}'`, createGroupBody(group),
-            async () => { const g = await groupMembers(baseUrl, group); return g.known && !("absent" in g); }]);
-    }
-    else {
-        say(`   group '${group}' already exists — adding the member only`);
-    }
-    steps.push([`add '${memberNodeId}' to '${group}'`, addMemberBody(group, memberNodeId),
-        async () => {
-            const g = await groupMembers(baseUrl, group);
-            return g.known && "members" in g && g.members.includes(memberNodeId);
-        }]);
-    for (const [label, body, confirm] of steps) {
-        const stx = buildSignedTx({
-            ledgerId: LEDGER.groups, senderNodeId: owner.nodeId, body,
-            ttlRound: BigInt((await node.currentRound()) + 50), signers: [signer],
-        });
-        // Confirmed by READING, like every other write here: a submit that times out has an
-        // unknown outcome, and on a quiescent chain the block is minutes away.
-        await submitAndConfirm(node, stx, label, confirm, say, { pace });
-    }
-}
 /**
  * `UpdateChannelDaTxBody` (097) — OwnersTxBody variant 4.
  *
@@ -251,198 +158,3 @@ export function updateChannelDaBody(args) {
         parts.push(...fVarint(3, args.daThresholdM));
     return concat(fMessage(4, concat(parts)));
 }
-/**
- * Make the channel exist, owned by us, WITH a DA group — the only shape that accepts a
- * body-form write (fact 4).
- *
- * Idempotent, and the three cases are genuinely different: nothing claimed (claim it, carrying
- * the DA policy), claimed by us with the WRONG DA policy (converge it in place with
- * `UpdateChannelDa`), claimed by somebody else (stop: that is a real conflict on a shared
- * chain).
- */
-export async function ensureChannelWithDa(node, chainUrl, owner, signer, group, say, pace) {
-    const ask = () => channelTerms(chainUrl);
-    const read = await ask();
-    if (!read.ok)
-        throw new Error(`could not read the terms of '${CHANNEL}' from ${chainUrl}: ${read.why}\n` +
-            `  Refusing to guess: an unreadable answer used to mean "unclaimed", and acting on ` +
-            `that submits a Claim for a channel someone else may own — accepted, then rejected ` +
-            `every round until its TTL (evolver#85).`);
-    const terms = read.terms;
-    const ownedByUs = terms.owners.some((o) => o.name === owner.nodeId);
-    const someoneElse = terms.owners.length > 0 && !ownedByUs;
-    // A CHANNEL NAME IS GLOBAL ON A SHARED CHAIN, and whoever claims it owns it. A second
-    // deployment of this app — new identities, same channel name — is therefore a READER, not a
-    // broken installation: it can declare the channel, subscribe, and fold the ordered stream,
-    // which is most of what an announcements channel is for. Only the owner may write (the
-    // default write policy is owner-or-group; 156 lets an owner open it to any writer).
-    //
-    // Dying here instead would be wrong in the ordinary case and would make the name a
-    // first-come landmine.
-    if (someoneElse) {
-        say(`   '${CHANNEL}' is owned by ${terms.owners.map((o) => o.name).join(", ")} — this app will READ it, not write`);
-        return "reader";
-    }
-    // THE POLICY MUST MATCH, not merely exist — and "wrong" includes a threshold this app now
-    // knows is unsatisfiable. A mismatch is converged with `UpdateChannelDa`, in place; a second
-    // Claim would not do it (on an already-claimed ledger a Claim is a committed NO-OP).
-    //
-    // Measured on the deployment: `announcements1` was claimed at m=1 with a single-member
-    // group, this function said "already claimed by us with a DA group — reusing", and the very
-    // next write died with `fetch failed` — the attestation that can never arrive, waited out
-    // until the connection dropped. Checking only for PRESENCE is what let that through twice.
-    const daOk = !!terms.da && terms.da.group === group && terms.da.thresholdM === DA_THRESHOLD_M;
-    if (ownedByUs && daOk) {
-        say(`   '${CHANNEL}' already claimed by us with DA group '${group}' (m=${DA_THRESHOLD_M}) — reusing`);
-        return "owner";
-    }
-    if (ownedByUs && !daOk) {
-        const had = terms.da ? `DA group '${terms.da.group}' (m=${terms.da.thresholdM})` : "NO DA group";
-        say(`   '${CHANNEL}' is claimed by us with ${had}, but this app needs '${group}' (m=${DA_THRESHOLD_M})`);
-        // ⚠️ A TARGETED UPDATE, NOT UNCLAIM-THEN-RECLAIM.
-        //
-        // This used to drop the claim and re-claim, on the belief that a DA policy is set at claim
-        // time and cannot be changed. That belief is wrong — `UpdateChannelDa` (097) exists and is
-        // owner-gated (OwnersLedgerOrchestrator validates it and sets the policy in place) — and
-        // the belief made the app do something irreversible to fix something reversible:
-        // `clearChannelPolicies` drops all three policy rows, and BETWEEN the unclaim and the
-        // re-claim the channel name is UNOWNED, so on a shared chain anyone can claim it and the
-        // name is lost for good. A second Claim would not even have converged it: on an
-        // already-claimed ledger a Claim is a committed NO-OP, which is why the unclaim was there
-        // at all. evolver-scheduler's provisioner had this right first.
-        say(`   converging in place with UpdateChannelDa — an unclaim would expose the name to being taken`);
-        const upd = buildSignedTx({
-            ledgerId: LEDGER.owners, senderNodeId: owner.nodeId,
-            body: updateChannelDaBody({ ledgerId: CHANNEL, daGroup: group, daThresholdM: DA_THRESHOLD_M }),
-            ttlRound: BigInt((await node.currentRound()) + 50), signers: [signer],
-        });
-        await submitAndConfirm(node, upd, `update '${CHANNEL}' DA policy to '${group}' (m=${DA_THRESHOLD_M})`, async () => {
-            const r = await ask();
-            return r.ok && !!r.terms.da && r.terms.da.group === group &&
-                r.terms.da.thresholdM === DA_THRESHOLD_M;
-        }, say, { pace });
-        return "owner";
-    }
-    // Nothing owns it: claim it, carrying the DA policy in the claim itself.
-    const claim = buildSignedTx({
-        ledgerId: LEDGER.owners, senderNodeId: owner.nodeId,
-        body: claimBody({ ledgerId: CHANNEL, daGroup: group, daThresholdM: DA_THRESHOLD_M }),
-        ttlRound: BigInt((await node.currentRound()) + 50), signers: [signer],
-    });
-    await submitAndConfirm(node, claim, `claim '${CHANNEL}' with DA group '${group}' (m=${DA_THRESHOLD_M})`, async () => {
-        const r = await ask();
-        return r.ok && !!r.terms.da && r.terms.da.group === group &&
-            r.terms.da.thresholdM === DA_THRESHOLD_M &&
-            r.terms.owners.some((o) => o.name === owner.nodeId);
-    }, say, { pace });
-    return "owner";
-}
-/** Write one announcement. Plain UTF-8: this channel is public by intent. */
-export async function announce(node, from, signer, text, say) {
-    const stx = buildSignedTx({
-        ledgerId: CHANNEL, senderNodeId: from.nodeId,
-        body: channelBody(utf8(text)), ttlRound: BigInt((await node.currentRound()) + 50), signers: [signer],
-    });
-    // submitTxWithDa: the node collects the channel's DA attestations over the overlay and
-    // assembles the transaction. A client cannot do that for itself — it has no overlay.
-    const r = await node.submitTxWithDa(stx);
-    if (r.kind === "committed") {
-        say(`   announced: "${text}"`);
-        return;
-    }
-    if (r.kind === "timeout") {
-        say(`   announce: submit timed out — the stream below is the confirmation`);
-        return;
-    }
-    // A duplicate is not a failure of this app: the txId is a function of the body, the sender
-    // and the TTL, so an identical announcement that already committed answers `duplicate` —
-    // which means the message IS on the channel, which is exactly what the stream below checks.
-    if (r.kind === "failed" && r.reason === "duplicate") {
-        say(`   announce: this exact message is already on the chain — the stream below is the confirmation`);
-        return;
-    }
-    throw new Error(`the announcement was refused: ${JSON.stringify(r)}\n` +
-        `  insufficient_da means the DA group could not be mustered — is this app's node a member?\n` +
-        `  out-of-band means the channel has no DA group at all (see ensureChannelWithDa).`);
-}
-// The demo reads the shared collector's durable inbox. There is no local handler map,
-// volatile receive buffer, cursor probe or second consumer of the channel route.
-export async function retainedMessages(store, channel) {
-    const messages = [];
-    let after;
-    do {
-        const page = await store.inboxPage(channel, { limit: 100, after });
-        for (const entry of page.entries)
-            if (entry.body !== null)
-                messages.push(new TextDecoder().decode(entry.body));
-        if (!page.more)
-            return messages;
-        if (!page.next || (after && (BigInt(page.next.round) < BigInt(after.round) ||
-            (page.next.round === after.round && BigInt(page.next.index) <= BigInt(after.index)))))
-            throw new Error("inbox readback did not advance its continuation");
-        after = page.next;
-    } while (true);
-}
-/** Pace the processor forward until this node stops making progress — which is how a processing
- *  node applies blocks at all (fact 2). Anything of ours it passes on the way is KEPT. */
-export async function paceApply(pace, say) {
-    const MAX = 200;
-    // A walk stops at its budget whether or not the cursor reached the tip, so the report
-    // distinguishes the two. Claiming "to its tip" after a truncated walk is a statement the code
-    // cannot make — a backlog longer than MAX leaves apply behind, and the reads that follow would
-    // silently answer as of an earlier round.
-    let walked = 0;
-    let caughtUp = false;
-    for (let attempts = 0; attempts < 10 && walked < MAX; attempts++) {
-        const r = await pace();
-        walked += r.inboxed + r.missed + r.duplicates;
-        if (r.stoppedBecause === "body-pending")
-            throw new Error("node is waiting for a channel body; nothing skipped");
-        if (r.stoppedBecause === "caught-up") {
-            caughtUp = true;
-            break;
-        }
-    }
-    if (!caughtUp)
-        say(`   paced this node's apply, stopping at ${walked} delivery(ies) — the backlog is longer, so apply may still be behind`);
-    else
-        say(`   paced this node's apply to its tip; original deliveries are retained in the inbox`);
-}
-/** Pacing with no narration, for use inside a wait loop. Keeps what it walks past, as above. */
-export async function paceQuietly(pace) {
-    await pace();
-}
-/**
- * Follow the stream until our own message arrives.
- *
- * The delivery is the app's write coming back THROUGH CONSENSUS, which is the only evidence
- * that matters: a submit says the transaction was ordered; a delivery says the app can read
- * what was ordered, in order, from its own node.
- *
- * A submit that timed out has an UNKNOWN outcome and the block carrying it can be minutes away
- * on a quiescent chain, so this waits to a DEADLINE rather than for a fixed number of idle polls
- * (20s of idle was the old bound, and it expired before the block existed). Nothing is ever
- * resent — the transaction id is fixed, so waiting is the only correct move.
- */
-export async function readBack(pace, want, say, opts) {
-    // ⚠️ A CALLER THAT CANNOT MATCH MUST PASS ITS OWN DEADLINE. This waits for a specific
-    // message, so with a sentinel that never matches it waits out the whole budget — five
-    // minutes of "following the stream" for the reader-mode caller, which only wants to watch
-    // briefly. That regression arrived with the deadline itself, from changing this function's
-    // contract without revisiting its second call site.
-    const deadline = Date.now() + (opts.deadlineMs ?? 300_000);
-    let received = [...await opts.messages()];
-    while (!received.some((t) => t.includes(want)) && Date.now() < deadline) {
-        // Pending/quiet is an outcome; storage, module and transport failures are errors. Never
-        // disguise one as an empty read or a successful wait. The app's finally releases its owner.
-        const r = await pace();
-        received = [...await opts.messages()];
-        if ((r.stoppedBecause === "caught-up" || r.stoppedBecause === "body-pending") && !received.some(t => t.includes(want)))
-            await new Promise(res => setTimeout(res, 500));
-    }
-    const found = received.some((t) => t.includes(want));
-    say(`   retained ${received.length} message(s) on '${CHANNEL}'`);
-    return { seen: [...received], found };
-}
-// Only the node's body-unavailable outcome permits advancement. No application timer
-// converts pending/unreadable outcomes into absence; the shared collector owns that rule.