@optimystic/db-p2p 0.13.5 → 0.14.1

package/dist/src/cohort-topic/topic-router.js

@@ -0,0 +1,63 @@
+import { bytesToB64url, b64urlToBytes, encodeCohortMessage } from "@optimystic/db-core";
+import { bytesToPeerId } from "./peer-codec.js";
+import { requestResponse, DEFAULT_STREAM_MAX_BYTES } from "./stream-util.js";
+import { PROTOCOL_COHORT_REGISTER } from "./protocols.js";
+/** A FRET `routeAct` result carrying a cohort reply. */
+function isCommit(res) {
+    return typeof res === "object" && res !== null && "commitCertificate" in res;
+}
+/**
+ * FRET-backed {@link ITopicRouter}.
+ *
+ * `routeAndAct` maps onto FRET's `RouteAndMaybeAct` (`FretService.routeAct`): the `RegisterV1` frame
+ * rides the `activity` field (base64url), routed to the cohort owning `key = coord_d(self, topicId)`,
+ * collecting `want_k = k` participants and `min_sigs = k − x`. The cohort's activity callback (set by
+ * the host) runs the willingness / cold-start / admission decision and returns the encoded
+ * `RegisterReplyV1` as the `commitCertificate`; this adapter decodes it back to bytes. A bare
+ * `NearAnchorV1` (no in-cluster activity ran) is surfaced to the walk as `no_state`.
+ *
+ * `dialMember` is the post-registration direct path: a libp2p dial of the `/register` protocol to the
+ * cached primary, used by the renewal ping (`docs/cohort-topic.md` §FRET integration L457-460).
+ */
+export class FretTopicRouter {
+    node;
+    fret;
+    registerProtocol;
+    ttl;
+    maxBytes;
+    clock;
+    constructor(node, fret, options = {}) {
+        this.node = node;
+        this.fret = fret;
+        this.registerProtocol = options.registerProtocol ?? PROTOCOL_COHORT_REGISTER;
+        this.ttl = options.ttl ?? 16;
+        this.maxBytes = options.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+        this.clock = options.clock ?? (() => Date.now());
+    }
+    async routeAndAct(key, activity, opts) {
+        const now = this.clock();
+        const msg = {
+            v: 1,
+            key: bytesToB64url(key),
+            want_k: opts.wantK,
+            min_sigs: opts.minSigs,
+            ttl: this.ttl,
+            activity: bytesToB64url(activity),
+            correlation_id: bytesToB64url(key) + ":" + now,
+            timestamp: now,
+            signature: "",
+        };
+        const res = await this.fret.routeAct(msg);
+        if (isCommit(res)) {
+            return b64urlToBytes(res.commitCertificate);
+        }
+        // No in-cluster activity ran (we only reached an anchor hint): the walk treats this as NoState
+        // and steps toward the root.
+        return encodeCohortMessage({ v: 1, result: "no_state" }, this.maxBytes);
+    }
+    async dialMember(member, activity) {
+        const peer = bytesToPeerId(member.id);
+        return requestResponse(this.node, peer, this.registerProtocol, activity, this.maxBytes);
+    }
+}
+//# sourceMappingURL=topic-router.js.map

package/dist/src/cohort-topic/topic-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"topic-router.js","sourceRoot":"","sources":["../../../src/cohort-topic/topic-router.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAGxF,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAE1D,wDAAwD;AACxD,SAAS,QAAQ,CAAC,GAAiD;IAClE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,mBAAmB,IAAI,GAAG,CAAC;AAC9E,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,eAAe;IAME;IAA+B;IAL3C,gBAAgB,CAAS;IACzB,GAAG,CAAS;IACZ,QAAQ,CAAS;IACjB,KAAK,CAAe;IAErC,YAA6B,IAAY,EAAmB,IAAiB,EAAE,UAAkC,EAAE;QAAtF,SAAI,GAAJ,IAAI,CAAQ;QAAmB,SAAI,GAAJ,IAAI,CAAa;QAC5E,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,wBAAwB,CAAC;QAC7E,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,wBAAwB,CAAC;QAC7D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAc,EAAE,QAAoB,EAAE,IAAwC;QAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAuB;YAC/B,CAAC,EAAE,CAAC;YACJ,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC;YACvB,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,OAAO;YACtB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,aAAa,CAAC,QAAQ,CAAC;YACjC,cAAc,EAAE,aAAa,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG;YAC9C,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,EAAE;SACb,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,OAAO,aAAa,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7C,CAAC;QACD,+FAA+F;QAC/F,6BAA6B;QAC7B,OAAO,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAe,EAAE,QAAoB;QACrD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzF,CAAC;CACD"}

package/dist/src/dispute/cascade.d.ts

@@ -0,0 +1,179 @@
+import type { ActionId, BlockId, CollectionId, Log, DisputeResolutionProof, RevertedBlock, ReadDependency } from '@optimystic/db-core';
+import type { IBlockStorage } from '../storage/i-block-storage.js';
+import { type CertificateTarget } from './invalidation.js';
+export type CascadeConfig = {
+    /**
+     * Maximum number of re-evaluation rounds. Each round rescans the in-scope collections for fresh
+     * read-dependents of everything invalidated so far; a linear chain processed in revision order
+     * collapses into a single round, so this caps pathological out-of-order dependency graphs.
+     */
+    readonly maxCascadeDepth: number;
+    /** Maximum transactions the cascade may invalidate, counting the root. */
+    readonly maxCascadeTransactions: number;
+};
+export declare const DEFAULT_CASCADE_CONFIG: CascadeConfig;
+/**
+ * Everything the cascade needs from one collection: its append-only log (where child invalidation
+ * entries land and where read-dependents are discovered) and a resolver for the per-block storage
+ * its actions wrote. The caller supplies one per collection in the cascade's universe — the root's
+ * collections plus every collection reachable via a cross-collection read edge. (Discovering that
+ * universe requires a block→collection read index; the engine consumes the universe rather than
+ * computing it — see the handoff's cross-collection note.)
+ */
+export type CollectionEnv = {
+    readonly collectionId: CollectionId;
+    readonly log: Log<unknown>;
+    readonly createBlockStorage: (blockId: BlockId) => IBlockStorage;
+};
+/**
+ * A block revision proven invalid: a committed action wrote `blockId` at `rev`, and that action has
+ * been invalidated (the root, or a cascade child). Any committed transaction whose read set contains
+ * `(blockId, rev)` observed this now-invalid revision and is a read-dependent.
+ *
+ * `restoredContentHash` is the content hash of the as-if-absent (reverted) value — the hash the
+ * invalidation recorded. The default re-evaluator compares it against the content the dependent
+ * actually observed: equal ⇒ the revert did not change what was read ⇒ retain.
+ */
+export type InvalidatedPair = {
+    readonly blockId: BlockId;
+    readonly rev: number;
+    readonly restoredContentHash: string;
+    /** The collection whose invalidation produced this pair (so same-collection rev ordering is checkable). */
+    readonly collectionId: CollectionId;
+    /** Resolves storage for this block, from its owning collection — the dependent may live elsewhere. */
+    readonly createBlockStorage: (blockId: BlockId) => IBlockStorage;
+};
+/** A candidate read-dependent under re-evaluation against post-invalidation state. */
+export type CascadeCandidate = {
+    readonly env: CollectionEnv;
+    readonly collectionId: CollectionId;
+    readonly actionId: ActionId;
+    readonly rev: number;
+    /** Blocks this action wrote (its entry's blockIds) — what gets reverted if it is invalidated. */
+    readonly blockIds: ReadonlyArray<BlockId>;
+    /** This action's persisted read set, or `undefined` for a legacy (pre-cascade) entry. */
+    readonly reads: ReadonlyArray<ReadDependency> | undefined;
+    /** The subset of `reads` intersecting an invalidated `(blockId, rev)`. Empty for a legacy candidate. */
+    readonly matched: ReadonlyArray<InvalidatedPair>;
+};
+/**
+ * Verdict for a candidate re-evaluated against the reverted state:
+ *  - `retain`      — the read still holds; the transaction stands untouched (the re-evaluation prune).
+ *  - `invalidate`  — the read no longer holds; revert this transaction and recurse into its dependents.
+ *  - `unevaluable` — cannot decide from available data (e.g. a legacy entry with no persisted reads,
+ *                    and no engine to re-execute). Escalated rather than guessed.
+ */
+export type CascadeVerdict = 'retain' | 'invalidate' | 'unevaluable';
+/** Decides whether a candidate still holds against the reverted state. */
+export type Reevaluate = (candidate: CascadeCandidate) => Promise<CascadeVerdict>;
+/**
+ * The default, engine-free re-evaluator: deterministic from stored revisions alone (no engine replay),
+ * matching the compensating-state philosophy of the single-collection core.
+ *
+ * For each of the candidate's intersecting reads `(blockId, rev)`, it compares the content the
+ * candidate *observed* (the immutable historical revision `blockId@rev`) against the `restoredContentHash`
+ * the invalidation recorded (the as-if-absent value):
+ *  - any read whose observed content differs from the restored content ⇒ the read no longer holds ⇒ **invalidate**;
+ *  - a writer that *created* the block (deleted-block sentinel) ⇒ the observed content no longer exists ⇒ **invalidate**;
+ *  - all intersecting reads unchanged ⇒ **retain** (e.g. a structural-block false dependent whose content the
+ *    revert did not actually alter, or a redundant write that reverted to the same bytes).
+ *  - a legacy entry (no persisted reads) ⇒ **unevaluable** (escalate, never guess independent).
+ *
+ * This is *sound but conservative* at block granularity: it never wrongly retains, but because reads are
+ * block-granular it may invalidate a dependent that read an unchanged *field* of a changed block. That is
+ * safe (over-invalidation just resubmits the transaction). Field/operation-granular pruning — re-executing
+ * the transaction and checking its operations still reproduce — requires an engine and is provided by
+ * injecting a custom {@link Reevaluate} instead (see the handoff).
+ */
+export declare function contentEqualityReevaluator(): Reevaluate;
+/** A `(blockId, rev)` the root invalidation proved invalid in a given collection, with its restored hash. */
+export type CascadeSeed = {
+    readonly collectionId: CollectionId;
+    readonly blockId: BlockId;
+    readonly rev: number;
+    readonly restoredContentHash: string;
+};
+export type CascadeInput = {
+    /** actionId of the root invalidation — recorded as `cascadeRoot` on every child entry. */
+    readonly rootActionId: ActionId;
+    /** The root's invalidation certificate; reused to authorize each child invalidation. */
+    readonly proof: DisputeResolutionProof;
+    /** The `(blockId, rev)` pairs the root reversal produced — seeds the dependency frontier. */
+    readonly seed: ReadonlyArray<CascadeSeed>;
+    /**
+     * The target the root proof's votes are bound to — `(rootActionId, root blockIds)`. Every child
+     * reuses the root proof, whose votes were signed over the *root's* targetHash, so each child's
+     * certificate verification must be against this target, not the child's own. Defaults to the root
+     * action id plus the distinct block ids across {@link seed} (the root's reverted blocks). Pass it
+     * explicitly when the seed is not a faithful 1:1 image of the root's commit blockIds.
+     */
+    readonly certificateTarget?: CertificateTarget;
+    /** Every collection the cascade may walk: the root's, plus any reachable via cross-collection reads. */
+    readonly envs: ReadonlyArray<CollectionEnv>;
+    readonly config?: CascadeConfig;
+    /** Re-evaluation strategy; defaults to {@link contentEqualityReevaluator}. */
+    readonly reevaluate?: Reevaluate;
+    /**
+     * Operator-escalation health signal: invoked once when the cascade stops at a hard horizon (or hits
+     * an unevaluable candidate) and the affected collection(s) need a full re-sync. Never throws past here.
+     */
+    readonly onEscalation?: (escalation: CascadeEscalation) => void;
+};
+export type CascadeChild = {
+    readonly collectionId: CollectionId;
+    readonly actionId: ActionId;
+    readonly rev: number;
+    readonly reverted: ReadonlyArray<RevertedBlock>;
+};
+export type CascadeStanding = {
+    readonly collectionId: CollectionId;
+    readonly actionId: ActionId;
+    readonly rev: number;
+};
+export type CascadeEscalation = {
+    readonly reason: 'max-depth' | 'max-transactions' | 'unevaluable';
+    /** Collections to flag for operator-escalated full re-sync. */
+    readonly collections: ReadonlyArray<CollectionId>;
+    /** Read-dependents left un-cascaded at the horizon — surfaced, never silently dropped. */
+    readonly remainder: ReadonlyArray<CascadeStanding>;
+    /** Candidates that could not be re-evaluated (e.g. legacy entries with no engine to re-execute them). */
+    readonly unevaluable: ReadonlyArray<CascadeStanding>;
+};
+export type CascadeResult = {
+    readonly rootActionId: ActionId;
+    /** Read-dependents invalidated by the cascade (children only — the root is the caller's to apply). */
+    readonly invalidated: ReadonlyArray<CascadeChild>;
+    /** Read-dependents re-evaluated and retained (appeared in the chain but did not actually depend). */
+    readonly retained: ReadonlyArray<CascadeStanding>;
+    /** Re-evaluation rounds run (dependency-graph depth proxy). */
+    readonly rounds: number;
+    /** Present iff the cascade stopped at a hard horizon or hit an unevaluable candidate. */
+    readonly escalation?: CascadeEscalation;
+};
+/**
+ * Detects and re-evaluates the transitive read-dependents of an already-applied root invalidation,
+ * invalidating only those that no longer hold against the reverted state and leaving the rest in place.
+ *
+ * Preconditions: the caller has already applied the *root* reversal (driven through cluster consensus)
+ * and supplies its proven-invalid `(blockId, rev)` pairs as `seed`. This engine owns only the *cascade*:
+ * each child invalidation is appended via {@link applyInvalidation} carrying `cascadeRoot`, exactly the
+ * deterministic primitive every member runs — so a member replaying the same seed + logs converges on
+ * the same children (no per-child consensus round is required while the re-evaluator is deterministic;
+ * a non-deterministic/engine-based re-evaluator would need each child driven through consensus instead).
+ *
+ * Algorithm (fixpoint):
+ *  1. Seed the invalidated `(blockId, rev)` frontier from the root.
+ *  2. Each round, walk every in-scope collection log forward, collecting unprocessed actions whose read
+ *     set intersects the frontier (legacy reads-less entries are always candidates — unknown dependency).
+ *  3. Process candidates in `(rev, collectionId, actionId)` order, deduped by actionId. Re-evaluate each
+ *     against the reverted state; **retain** leaves it (revisited next round in case a later ancestor
+ *     reverts), **invalidate** appends its child entry and feeds its reverted blocks back into the frontier.
+ *  4. Repeat until a round makes no progress (fixpoint) or a horizon trips (escalate, applying what it did).
+ *
+ * Diamonds: a dependent of two invalidated ancestors is evaluated once (dedup), after both are reverted
+ * (revision order within a collection; cross-collection retains are re-examined every round until fixpoint).
+ * Cycle-freedom: a read observes a strictly earlier write, so within a collection a child's rev exceeds the
+ * pair it depends on — a back-edge is corruption and throws.
+ */
+export declare function cascadeInvalidate(input: CascadeInput): Promise<CascadeResult>;
+//# sourceMappingURL=cascade.d.ts.map

package/dist/src/dispute/cascade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade.d.ts","sourceRoot":"","sources":["../../../src/dispute/cascade.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EACpC,sBAAsB,EAAE,aAAa,EAAE,cAAc,EACrD,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAA8D,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAOvH,MAAM,MAAM,aAAa,GAAG;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;CACxC,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,aAGpC,CAAC;AAIF;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,QAAQ,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,aAAa,CAAC;CACjE,CAAC;AAIF;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,2GAA2G;IAC3G,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,sGAAsG;IACtG,QAAQ,CAAC,kBAAkB,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,aAAa,CAAC;CACjE,CAAC;AAkBF,sFAAsF;AACtF,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,GAAG,SAAS,CAAC;IAC1D,wGAAwG;IACxG,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACjD,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,aAAa,CAAC;AAErE,0EAA0E;AAC1E,MAAM,MAAM,UAAU,GAAG,CAAC,SAAS,EAAE,gBAAgB,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;AAElF;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,0BAA0B,IAAI,UAAU,CAwBvD;AAID,6GAA6G;AAC7G,MAAM,MAAM,WAAW,GAAG;IACzB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;CACrC,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IAC1B,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC,6FAA6F;IAC7F,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAC/C,wGAAwG;IACxG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,iBAAiB,KAAK,IAAI,CAAC;CAChE,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IAC1B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,kBAAkB,GAAG,aAAa,CAAC;IAClE,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD,0FAA0F;IAC1F,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IACnD,yGAAyG;IACzG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;CACrD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;IAChC,sGAAsG;IACtG,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD,qGAAqG;IACrG,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,eAAe,CAAC,CAAC;IAClD,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,yFAAyF;IACzF,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACxC,CAAC;AAIF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAuKnF"}

package/dist/src/dispute/cascade.js

@@ -0,0 +1,315 @@
+import { applyInvalidation, hashBlockContent, DELETED_BLOCK_RESTORE } from './invalidation.js';
+import { createLogger } from '../logger.js';
+const log = createLogger('cascade');
+export const DEFAULT_CASCADE_CONFIG = {
+    maxCascadeDepth: 32,
+    maxCascadeTransactions: 1000,
+};
+function pairKey(blockId, rev) {
+    return `${blockId}\0${rev}`;
+}
+/**
+ * Dedup identity for a reverted log entry: the (collectionId, actionId) pair, not the actionId
+ * alone. A transaction spanning N collections has one entry per collection (same actionId,
+ * different collection/blockIds/rev) — each must be reverted independently, tracked separately.
+ * Uses a NUL separator, mirroring {@link pairKey}, so ids containing spaces cannot collide.
+ */
+function entryKey(collectionId, actionId) {
+    return `${collectionId}\0${actionId}`;
+}
+/**
+ * The default, engine-free re-evaluator: deterministic from stored revisions alone (no engine replay),
+ * matching the compensating-state philosophy of the single-collection core.
+ *
+ * For each of the candidate's intersecting reads `(blockId, rev)`, it compares the content the
+ * candidate *observed* (the immutable historical revision `blockId@rev`) against the `restoredContentHash`
+ * the invalidation recorded (the as-if-absent value):
+ *  - any read whose observed content differs from the restored content ⇒ the read no longer holds ⇒ **invalidate**;
+ *  - a writer that *created* the block (deleted-block sentinel) ⇒ the observed content no longer exists ⇒ **invalidate**;
+ *  - all intersecting reads unchanged ⇒ **retain** (e.g. a structural-block false dependent whose content the
+ *    revert did not actually alter, or a redundant write that reverted to the same bytes).
+ *  - a legacy entry (no persisted reads) ⇒ **unevaluable** (escalate, never guess independent).
+ *
+ * This is *sound but conservative* at block granularity: it never wrongly retains, but because reads are
+ * block-granular it may invalidate a dependent that read an unchanged *field* of a changed block. That is
+ * safe (over-invalidation just resubmits the transaction). Field/operation-granular pruning — re-executing
+ * the transaction and checking its operations still reproduce — requires an engine and is provided by
+ * injecting a custom {@link Reevaluate} instead (see the handoff).
+ */
+export function contentEqualityReevaluator() {
+    return async (candidate) => {
+        if (candidate.reads === undefined) {
+            return 'unevaluable';
+        }
+        // Defensive: a candidate with no intersecting reads is not actually a dependent.
+        if (candidate.matched.length === 0) {
+            return 'retain';
+        }
+        for (const pair of candidate.matched) {
+            if (pair.restoredContentHash === DELETED_BLOCK_RESTORE) {
+                return 'invalidate';
+            }
+            const observed = await pair.createBlockStorage(pair.blockId).getBlock(pair.rev);
+            if (!observed) {
+                // Cannot confirm the observed revision still materializes → conservative invalidate.
+                return 'invalidate';
+            }
+            if (await hashBlockContent(observed.block) !== pair.restoredContentHash) {
+                return 'invalidate';
+            }
+        }
+        return 'retain';
+    };
+}
+// ─── Engine ───
+/**
+ * Detects and re-evaluates the transitive read-dependents of an already-applied root invalidation,
+ * invalidating only those that no longer hold against the reverted state and leaving the rest in place.
+ *
+ * Preconditions: the caller has already applied the *root* reversal (driven through cluster consensus)
+ * and supplies its proven-invalid `(blockId, rev)` pairs as `seed`. This engine owns only the *cascade*:
+ * each child invalidation is appended via {@link applyInvalidation} carrying `cascadeRoot`, exactly the
+ * deterministic primitive every member runs — so a member replaying the same seed + logs converges on
+ * the same children (no per-child consensus round is required while the re-evaluator is deterministic;
+ * a non-deterministic/engine-based re-evaluator would need each child driven through consensus instead).
+ *
+ * Algorithm (fixpoint):
+ *  1. Seed the invalidated `(blockId, rev)` frontier from the root.
+ *  2. Each round, walk every in-scope collection log forward, collecting unprocessed actions whose read
+ *     set intersects the frontier (legacy reads-less entries are always candidates — unknown dependency).
+ *  3. Process candidates in `(rev, collectionId, actionId)` order, deduped by actionId. Re-evaluate each
+ *     against the reverted state; **retain** leaves it (revisited next round in case a later ancestor
+ *     reverts), **invalidate** appends its child entry and feeds its reverted blocks back into the frontier.
+ *  4. Repeat until a round makes no progress (fixpoint) or a horizon trips (escalate, applying what it did).
+ *
+ * Diamonds: a dependent of two invalidated ancestors is evaluated once (dedup), after both are reverted
+ * (revision order within a collection; cross-collection retains are re-examined every round until fixpoint).
+ * Cycle-freedom: a read observes a strictly earlier write, so within a collection a child's rev exceeds the
+ * pair it depends on — a back-edge is corruption and throws.
+ */
+export async function cascadeInvalidate(input) {
+    const config = input.config ?? DEFAULT_CASCADE_CONFIG;
+    const reevaluate = input.reevaluate ?? contentEqualityReevaluator();
+    const envByCollection = new Map(input.envs.map(e => [e.collectionId, e]));
+    // Invalidated frontier, seeded from the root's reverted blocks.
+    const pairs = new Map();
+    for (const s of input.seed) {
+        const env = envByCollection.get(s.collectionId);
+        if (!env) {
+            throw new Error(`cascade: seed references collection ${s.collectionId} not present in envs`);
+        }
+        pairs.set(pairKey(s.blockId, s.rev), {
+            blockId: s.blockId, rev: s.rev, restoredContentHash: s.restoredContentHash,
+            collectionId: s.collectionId, createBlockStorage: env.createBlockStorage,
+        });
+    }
+    const rootActionId = input.rootActionId;
+    // The root proof's votes are bound to the ROOT's target; every child reuses that proof, so each
+    // child's applyInvalidation must verify against the root's target rather than the child's own. The
+    // child-specific justification is THIS deterministic read-dependency derivation, replayed identically
+    // by every member — not the certificate (which only attests the root is invalid).
+    const rootCertificateTarget = input.certificateTarget
+        ?? { invalidatedActionId: rootActionId, blockIds: [...new Set(input.seed.map(s => s.blockId))] };
+    // Dedup identity is per collection-entry (collectionId, actionId), not actionId alone: a
+    // multi-collection transaction has one entry per collection and each must be reverted separately.
+    const processedEntries = new Set(); // entryKey() of collection-entries reverted this cascade
+    // The horizon counts distinct transactions (the root counts once, a multi-collection dependent once),
+    // so a transaction is never split across the budget — reverted in some collections, escalated in others.
+    const invalidatedTxns = new Set([rootActionId]);
+    const children = [];
+    const affectedCollections = new Set(input.seed.map(s => s.collectionId));
+    const unevaluable = [];
+    let retained = [];
+    let rounds = 0;
+    let escalation;
+    // Set once a new transaction is refused at the transaction horizon. We do NOT break the cascade
+    // on that refusal: already-counted transactions must still finish every remaining collection-entry
+    // (all-or-nothing), so we skip only the over-budget newcomer and let the round complete. The
+    // max-transactions escalation is built once at the end, after the protected transactions drain.
+    let horizonReached = false;
+    while (true) {
+        // Depth horizon: stop before another rescan, surfacing the un-cascaded frontier.
+        if (rounds >= config.maxCascadeDepth) {
+            const remainder = await collectCandidates(input.envs, pairs, rootActionId, processedEntries);
+            escalation = makeEscalation('max-depth', affectedCollections, remainder, unevaluable);
+            break;
+        }
+        rounds++;
+        const candidates = await collectCandidates(input.envs, pairs, rootActionId, processedEntries);
+        if (candidates.length === 0) {
+            break; // fixpoint: no remaining read-dependents
+        }
+        retained = [];
+        let progressed = false;
+        for (const cand of candidates) {
+            if (processedEntries.has(entryKey(cand.collectionId, cand.actionId))) {
+                continue; // diamond: an ancestor pass already reverted this collection-entry
+            }
+            // Recompute matches against the live frontier (picks up same-round ancestors, ordered by rev).
+            const matched = matchReads(cand.reads, pairs);
+            const isLegacy = cand.reads === undefined;
+            if (matched.length === 0 && !isLegacy) {
+                continue; // no longer a dependent this round — revisit next round
+            }
+            assertForwardOnly(cand, matched);
+            const verdict = await reevaluate({ ...cand, matched });
+            if (verdict === 'retain') {
+                retained.push(standing(cand));
+                continue;
+            }
+            if (verdict === 'unevaluable') {
+                if (!unevaluable.some(u => u.collectionId === cand.collectionId && u.actionId === cand.actionId)) {
+                    unevaluable.push(standing(cand));
+                }
+                affectedCollections.add(cand.collectionId);
+                continue;
+            }
+            // invalidate — but never START a new transaction past the horizon. An already-counted
+            // transaction's remaining collection-entries pass freely (the `has` short-circuit), so a
+            // multi-collection dependent is reverted all-or-nothing and is never split across the budget.
+            // Crucially we only SKIP the over-budget newcomer here — we must not break the round, or a
+            // counted transaction's later-sorted sibling entry would be abandoned (silent partial revert).
+            if (!invalidatedTxns.has(cand.actionId) && invalidatedTxns.size + 1 > config.maxCascadeTransactions) {
+                horizonReached = true;
+                continue;
+            }
+            const env = cand.env;
+            const result = await applyInvalidation({ log: env.log, createBlockStorage: env.createBlockStorage }, {
+                invalidatedActionId: cand.actionId,
+                invalidatedRev: cand.rev,
+                blockIds: cand.blockIds,
+                proof: input.proof,
+                cascadeRoot: input.rootActionId,
+                // Verify the reused root proof against the root's target, not this child's own.
+                certificateTarget: rootCertificateTarget,
+            });
+            // `applied:false, already-applied` is the idempotent re-run path: the child entry already
+            // exists (prior cascade run / restart). Treat it as invalidated and reuse its reverted blocks
+            // so the frontier still grows and the cascade reconverges without a second entry.
+            if (!result.applied && result.reason !== 'already-applied') {
+                // invalid-certificate should be impossible: the child verifies the root proof against the
+                // root's target (rootCertificateTarget), and the root proof is a valid challenger-wins cert.
+                log('child-apply-rejected actionId=%s reason=%s', cand.actionId, result.reason);
+                continue;
+            }
+            processedEntries.add(entryKey(cand.collectionId, cand.actionId));
+            invalidatedTxns.add(cand.actionId);
+            progressed = true;
+            affectedCollections.add(cand.collectionId);
+            children.push({ collectionId: cand.collectionId, actionId: cand.actionId, rev: cand.rev, reverted: result.reverted });
+            for (const rb of result.reverted) {
+                pairs.set(pairKey(rb.blockId, cand.rev), {
+                    blockId: rb.blockId, rev: cand.rev, restoredContentHash: rb.restoredContentHash,
+                    collectionId: cand.collectionId, createBlockStorage: env.createBlockStorage,
+                });
+            }
+        }
+        if (!progressed) {
+            break; // only retains / unevaluable / over-budget newcomers remain — fixpoint
+        }
+    }
+    // Transaction-horizon escalation, built after the protected transactions have fully drained so the
+    // remainder reflects only what was genuinely left un-cascaded (never a half-reverted transaction).
+    if (horizonReached && !escalation) {
+        const remainder = await collectCandidates(input.envs, pairs, rootActionId, processedEntries);
+        escalation = makeEscalation('max-transactions', affectedCollections, remainder, unevaluable);
+    }
+    if (!escalation && unevaluable.length > 0) {
+        escalation = makeEscalation('unevaluable', affectedCollections, [], unevaluable);
+    }
+    if (escalation) {
+        log('escalate reason=%s collections=%d remainder=%d unevaluable=%d', escalation.reason, escalation.collections.length, escalation.remainder.length, escalation.unevaluable.length);
+        try {
+            input.onEscalation?.(escalation);
+        }
+        catch (err) {
+            log('escalation-sink-error error=%s', err.message);
+        }
+    }
+    return {
+        rootActionId: input.rootActionId,
+        invalidated: children,
+        retained,
+        rounds,
+        ...(escalation ? { escalation } : {}),
+    };
+}
+// ─── Walk / match helpers ───
+/** Walk every in-scope collection log forward, collecting unprocessed actions that are read-dependents. */
+async function collectCandidates(envs, pairs, rootActionId, processedEntries) {
+    const candidates = [];
+    for (const env of envs) {
+        for await (const entry of env.log.select()) {
+            const action = entry.action;
+            // Exclude the root (invalidated by the caller across all its collections) and any
+            // collection-entry already reverted this cascade — but a not-yet-reverted entry of the
+            // same transaction in a different collection is still a live candidate.
+            if (!action || action.actionId === rootActionId || processedEntries.has(entryKey(env.collectionId, action.actionId))) {
+                continue;
+            }
+            const reads = action.reads;
+            const isLegacy = reads === undefined;
+            const matched = matchReads(reads, pairs);
+            if (matched.length === 0 && !isLegacy) {
+                continue;
+            }
+            candidates.push({
+                env,
+                collectionId: env.collectionId,
+                actionId: action.actionId,
+                rev: entry.rev,
+                blockIds: action.blockIds,
+                reads,
+                matched,
+            });
+        }
+    }
+    // Deterministic processing order: revision, then collection, then actionId.
+    candidates.sort((a, b) => a.rev - b.rev
+        || (a.collectionId < b.collectionId ? -1 : a.collectionId > b.collectionId ? 1 : 0)
+        || (a.actionId < b.actionId ? -1 : a.actionId > b.actionId ? 1 : 0));
+    return candidates;
+}
+/** The subset of `reads` that intersect the invalidated frontier; `[]` for a legacy (reads-less) entry. */
+function matchReads(reads, pairs) {
+    if (!reads) {
+        return [];
+    }
+    const matched = [];
+    for (const r of reads) {
+        const pair = pairs.get(pairKey(r.blockId, r.revision));
+        if (pair) {
+            matched.push(pair);
+        }
+    }
+    return matched;
+}
+/**
+ * Cycle-freedom guard. A read observes a strictly earlier write, so within a single collection a
+ * dependent's revision must exceed the pair it depends on. A same-collection back-edge means the log
+ * is corrupt — throw rather than risk a non-terminating walk. Cross-collection pairs live in
+ * independent revision sequences and are not comparable, so they are skipped.
+ */
+function assertForwardOnly(cand, matched) {
+    for (const pair of matched) {
+        if (pair.collectionId === cand.collectionId && cand.rev <= pair.rev) {
+            throw new Error(`cascade: back-edge detected — action ${cand.actionId} at rev ${cand.rev} reads ${pair.blockId}@${pair.rev} in the same collection (dependency graph must be a forward DAG)`);
+        }
+    }
+}
+function standing(cand) {
+    return { collectionId: cand.collectionId, actionId: cand.actionId, rev: cand.rev };
+}
+function makeEscalation(reason, collections, remainder, unevaluable) {
+    const affected = new Set(collections);
+    for (const r of remainder) {
+        affected.add(r.collectionId);
+    }
+    return {
+        reason,
+        collections: [...affected],
+        remainder: remainder.map(standing),
+        unevaluable: [...unevaluable],
+    };
+}
+//# sourceMappingURL=cascade.js.map

package/dist/src/dispute/cascade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cascade.js","sourceRoot":"","sources":["../../../src/dispute/cascade.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAA0B,MAAM,mBAAmB,CAAC;AACvH,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAepC,MAAM,CAAC,MAAM,sBAAsB,GAAkB;IACpD,eAAe,EAAE,EAAE;IACnB,sBAAsB,EAAE,IAAI;CAC5B,CAAC;AAuCF,SAAS,OAAO,CAAC,OAAgB,EAAE,GAAW;IAC7C,OAAO,GAAG,OAAO,KAAK,GAAG,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,YAA0B,EAAE,QAAkB;IAC/D,OAAO,GAAG,YAAY,KAAK,QAAQ,EAAE,CAAC;AACvC,CAAC;AA8BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,0BAA0B;IACzC,OAAO,KAAK,EAAE,SAA2B,EAA2B,EAAE;QACrE,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,aAAa,CAAC;QACtB,CAAC;QACD,iFAAiF;QACjF,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,mBAAmB,KAAK,qBAAqB,EAAE,CAAC;gBACxD,OAAO,YAAY,CAAC;YACrB,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,qFAAqF;gBACrF,OAAO,YAAY,CAAC;YACrB,CAAC;YACD,IAAI,MAAM,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACzE,OAAO,YAAY,CAAC;YACrB,CAAC;QACF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC,CAAC;AACH,CAAC;AA0ED,iBAAiB;AAEjB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAmB;IAC1D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,sBAAsB,CAAC;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,0BAA0B,EAAE,CAAC;IACpE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAU,CAAC,CAAC,CAAC;IAEnF,gEAAgE;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,YAAY,sBAAsB,CAAC,CAAC;QAC9F,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE;YACpC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC,mBAAmB;YAC1E,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;SACxE,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IACxC,gGAAgG;IAChG,mGAAmG;IACnG,sGAAsG;IACtG,kFAAkF;IAClF,MAAM,qBAAqB,GAAsB,KAAK,CAAC,iBAAiB;WACpE,EAAE,mBAAmB,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,yFAAyF;IACzF,kGAAkG;IAClG,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC,CAAC,yDAAyD;IACrG,sGAAsG;IACtG,yGAAyG;IACzG,MAAM,eAAe,GAAG,IAAI,GAAG,CAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAe,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACvF,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,IAAI,QAAQ,GAAsB,EAAE,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,UAAyC,CAAC;IAC9C,gGAAgG;IAChG,mGAAmG;IACnG,6FAA6F;IAC7F,gGAAgG;IAChG,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,OAAO,IAAI,EAAE,CAAC;QACb,iFAAiF;QACjF,IAAI,MAAM,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YACtC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAC7F,UAAU,GAAG,cAAc,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;YACtF,MAAM;QACP,CAAC;QACD,MAAM,EAAE,CAAC;QAET,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAC9F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,yCAAyC;QACjD,CAAC;QAED,QAAQ,GAAG,EAAE,CAAC;QACd,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC/B,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACtE,SAAS,CAAC,mEAAmE;YAC9E,CAAC;YACD,+FAA+F;YAC/F,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC;YAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvC,SAAS,CAAC,wDAAwD;YACnE,CAAC;YAED,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAEjC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAC1B,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9B,SAAS;YACV,CAAC;YACD,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAClG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAClC,CAAC;gBACD,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC3C,SAAS;YACV,CAAC;YAED,sFAAsF;YACtF,yFAAyF;YACzF,8FAA8F;YAC9F,2FAA2F;YAC3F,+FAA+F;YAC/F,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC;gBACrG,cAAc,GAAG,IAAI,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACrC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,EAC5D;gBACC,mBAAmB,EAAE,IAAI,CAAC,QAAQ;gBAClC,cAAc,EAAE,IAAI,CAAC,GAAG;gBACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,WAAW,EAAE,KAAK,CAAC,YAAY;gBAC/B,gFAAgF;gBAChF,iBAAiB,EAAE,qBAAqB;aACxC,CACD,CAAC;YAEF,0FAA0F;YAC1F,8FAA8F;YAC9F,kFAAkF;YAClF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;gBAC5D,0FAA0F;gBAC1F,6FAA6F;gBAC7F,GAAG,CAAC,4CAA4C,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChF,SAAS;YACV,CAAC;YAED,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjE,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnC,UAAU,GAAG,IAAI,CAAC;YAClB,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEtH,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAClC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE;oBACxC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC,mBAAmB;oBAC/E,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;iBAC3E,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,CAAC,uEAAuE;QAC/E,CAAC;IACF,CAAC;IAED,mGAAmG;IACnG,mGAAmG;IACnG,IAAI,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,gBAAgB,CAAC,CAAC;QAC7F,UAAU,GAAG,cAAc,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,UAAU,GAAG,cAAc,CAAC,aAAa,EAAE,mBAAmB,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,UAAU,EAAE,CAAC;QAChB,GAAG,CAAC,+DAA+D,EAClE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC/G,IAAI,CAAC;YACJ,KAAK,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,gCAAgC,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;IACF,CAAC;IAED,OAAO;QACN,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,WAAW,EAAE,QAAQ;QACrB,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrC,CAAC;AACH,CAAC;AAED,+BAA+B;AAE/B,2GAA2G;AAC3G,KAAK,UAAU,iBAAiB,CAC/B,IAAkC,EAClC,KAAmC,EACnC,YAAsB,EACtB,gBAA6B;IAE7B,MAAM,UAAU,GAAuB,EAAE,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC5B,kFAAkF;YAClF,uFAAuF;YACvF,wEAAwE;YACxE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,YAAY,IAAI,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACtH,SAAS;YACV,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YAC3B,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC;YACrC,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACzC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACvC,SAAS;YACV,CAAC;YACD,UAAU,CAAC,IAAI,CAAC;gBACf,GAAG;gBACH,YAAY,EAAE,GAAG,CAAC,YAAY;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK;gBACL,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IACD,4EAA4E;IAC5E,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACxB,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG;WACV,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;WAChF,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACnE,CAAC;IACF,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,2GAA2G;AAC3G,SAAS,UAAU,CAAC,KAAgD,EAAE,KAAmC;IACxG,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,IAAsB,EAAE,OAAuC;IACzF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACd,wCAAwC,IAAI,CAAC,QAAQ,WAAW,IAAI,CAAC,GAAG,UAAU,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,kEAAkE,CAC5K,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,IAAsB;IACvC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,cAAc,CACtB,MAAmC,EACnC,WAA8B,EAC9B,SAA0C,EAC1C,WAA2C;IAE3C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO;QACN,MAAM;QACN,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC;QAC1B,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClC,WAAW,EAAE,CAAC,GAAG,WAAW,CAAC;KAC7B,CAAC;AACH,CAAC"}

package/dist/src/dispute/client.d.ts

@@ -1,5 +1,6 @@
 import type { PeerId, IPeerNetwork } from '@optimystic/db-core';
 import { ProtocolClient } from '../protocol-client.js';
+import { type RpcDeadlineOptions } from '../rpc-deadline.js';
 import type { DisputeChallenge, DisputeResolution, ArbitrationVote } from './types.js';
 /**
  * Client for the dispute protocol. Sends challenges to arbitrators
@@ -12,6 +13,6 @@ export declare class DisputeClient extends ProtocolClient {
     /** Send a challenge to an arbitrator and get their vote */
     sendChallenge(challenge: DisputeChallenge, timeoutMs?: number): Promise<ArbitrationVote>;
     /** Send a resolution to a peer (broadcast) */
-    sendResolution(resolution: DisputeResolution): Promise<void>;
+    sendResolution(resolution: DisputeResolution, options?: RpcDeadlineOptions): Promise<void>;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/src/dispute/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/dispute/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAkB,MAAM,YAAY,CAAC;AAEvG;;;GAGG;AACH,qBAAa,aAAc,SAAQ,cAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM;IAK9E,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,aAAa;IAIhG,2DAA2D;IACrD,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAW9F,8CAA8C;IACxC,cAAc,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAOlE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/dispute/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAoD,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC/G,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAkB,MAAM,YAAY,CAAC;AAEvG;;;GAGG;AACH,qBAAa,aAAc,SAAQ,cAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAEtB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM;IAK9E,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,aAAa;IAIhG,2DAA2D;IACrD,aAAa,CAAC,SAAS,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAiB9F,8CAA8C;IACxC,cAAc,CAAC,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAUhG"}

package/dist/src/dispute/client.js

@@ -1,4 +1,5 @@
 import { ProtocolClient } from '../protocol-client.js';
+import { DEFAULT_DIAL_TIMEOUT_MS, withRpcDeadlineDefaults } from '../rpc-deadline.js';
 /**
  * Client for the dispute protocol. Sends challenges to arbitrators
  * and broadcasts resolutions.
@@ -15,14 +16,22 @@ export class DisputeClient extends ProtocolClient {
     /** Send a challenge to an arbitrator and get their vote */
     async sendChallenge(challenge, timeoutMs) {
         const message = { type: 'challenge', challenge };
+        // Preserve the existing `timeoutMs`→`signal` contract callers rely on. Post the
+        // processMessage response-deadline work, this `signal` now tears down the
+        // *response read* (not merely the dial) — the desired "give up on a silent
+        // arbitrator" behavior. Also apply the default dial cap so a challenge to an
+        // unreachable arbitrator fails the dial fast even when no `timeoutMs` is given;
+        // this does not alter the response semantics (still bounded only by the signal).
         const signal = timeoutMs ? AbortSignal.timeout(timeoutMs) : undefined;
-        const response = await this.processMessage(message, this.protocol, { signal });
+        const response = await this.processMessage(message, this.protocol, { signal, dialTimeoutMs: DEFAULT_DIAL_TIMEOUT_MS });
         return response.vote;
     }
     /** Send a resolution to a peer (broadcast) */
-    async sendResolution(resolution) {
+    async sendResolution(resolution, options) {
         const message = { type: 'resolution', resolution };
-        await this.processMessage(message, this.protocol);
+        // This is a broadcast/ack, so the response cap is what matters: a peer that
+        // connects but never acks must not hang the broadcast. Absent keys default.
+        await this.processMessage(message, this.protocol, withRpcDeadlineDefaults(options));
     }
 }
 //# sourceMappingURL=client.js.map