@optimystic/db-p2p 0.22.0 → 0.24.1

package/src/cohort-topic/fret-trust-anchor.ts

@@ -1,153 +1,153 @@
-/**
- * Cohort-topic substrate — the **FRET-ring direct trust anchor** (db-p2p side of `IMembershipTrustAnchor`).
- *
- * `cohort-topic-trust-anchor-core` added the db-core trust gate (`membership/verifier.ts`): a (re)fetched
- * `MembershipCertV1` is believed only if it is self-consistent **and** anchored by a trust root, the
- * injected direct anchor, or the attestation chain — else it falls to interim trust-on-first-use. db-core
- * ships only `noAuthorityTrustAnchor` (every coord `"unknown"`), so until db-p2p binds a real anchor the
- * gate stays at TOFU. This module binds the **direct anchor** to the one coord→keyset authority FRET
- * exposes today.
- *
- * **What authority FRET offers.** p2p-fret 0.5.0 has **no transferable stabilization proof** — there is no
- * membership-cert/attestation API and the cert's `fretAttestation` field is never populated. The only
- * coord→keyset authority FRET offers is `assembleCohort(coord, wants)` — the ring's two-sided closest-`k`
- * selection — which is **local**: it answers correctly only for coords the node's routing table actually
- * covers (coords the node is near / serves). That is exactly the amplification-exposed `promote`-handler
- * path (`verifyAndApplyNotice` verifies against `target.servedCoord`, a coord the node serves), so binding
- * the anchor to `assembleCohort` rejects the forged-cert attack precisely where the core ticket calls it out.
- *
- * **The rule (`directAnchor(cert, tier)`):**
- *
- * - **Committed tiers (T0/T1)** route to the tx-log commit certificate, not the FRET ring, so this anchor
- *   returns `"unknown"` for them — it composes with (does not fight) the future tx-log anchor.
- * - **No local authority** — the node cannot cover the coord (cold/partitioned table, or a distant coord the
- *   node is nowhere near, so `assembleCohort` does not yield a populated neighborhood the node is part of) →
- *   `"unknown"`. The db-core gate then falls through to the chain / interim TOFU, so distant verification is
- *   never broken or falsely rejected.
- * - **Covered coord** — compare the cert's **signing quorum** (`cert.signers`, the `≥ minSigs` that actually
- *   signed) against the ring-expected cohort, widened by a small {@link FretTrustAnchorOptions.churnSlack} to
- *   tolerate stabilization skew (membership stabilizes slightly behind the live ring):
- *   - every signer is in the slack-widened ring view → `"anchored"`;
- *   - the quorum is **disjoint** from the ring view (the ring says a wholly different cohort owns this coord)
- *     → `"rejected"` (a forgery — fatal even though it is internally self-consistent);
- *   - partial overlap beyond the slack (genuinely ambiguous within churn tolerance) → `"unknown"` (do not
- *     over-reject on transient skew; defer to the chain / TOFU).
- *
- * **Why anchoring on `signers` (not exact member-set equality) is sound and sufficient.** A forged cert
- * must sign its threshold multisig with keys the adversary controls; those keys are not in the legitimate
- * ring cohort, so a forged quorum is disjoint from `assembleCohort(coord)` → `"rejected"`. A legitimate
- * cert's signers are real cohort members — present in the ring view (within slack) → `"anchored"`. The
- * adversary cannot list real members as `signers` without their keys (the message multisig would not
- * verify), so the quorum-subset test has teeth without demanding brittle full-set equality across churn.
- *
- * **db-core never imports FRET.** This adapter lives in db-p2p and depends only on the narrow
- * {@link FretRingView} (satisfied by `FretService`), keeping the db-core trust gate transport-agnostic.
- */
-
-import type { IMembershipTrustAnchor, MembershipCertV1, RingCoord, TrustAnchorVerdict } from "@optimystic/db-core";
-import { b64urlToBytes, DEFAULT_MAX_NO_POW_TIER } from "@optimystic/db-core";
-import { bytesToPeerIdString } from "./peer-codec.js";
-
-/**
- * The minimal slice of `FretService` the trust anchor needs: the ring's local two-sided cohort assembly
- * around a coord, plus an optional partition signal. `FretService` satisfies it directly; a test (and the
- * mock-mesh harness facade) can supply a stub with just `assembleCohort`.
- */
-export interface FretRingView {
-	/** Two-sided closest-`wants` selection around `coord` from the node's routing table (peer-id strings). */
-	assembleCohort(coord: Uint8Array, wants: number, exclude?: Set<string>): string[];
-	/** Optional: `true` when the node believes it is partitioned (table unreliable → never reject). */
-	detectPartition?(): boolean;
-}
-
-/** Configuration for a {@link FretTrustAnchor}. */
-export interface FretTrustAnchorOptions {
-	/**
-	 * Requested cohort size — must match the host's `wantK`, so the ring view the anchor computes lines up
-	 * with the cohort the cohort-side `cohortAround` published the cert over.
-	 */
-	readonly k: number;
-	/** This node's own peer-id string — used for the coverage check (the node must be in the coord's cohort). */
-	readonly selfPeerId: string;
-	/**
-	 * Stabilization-skew slack: the ring-expected cohort is widened to `k + churnSlack` members before the
-	 * quorum-subset test, so a legit cert whose signing quorum lags the live ring by a rotation or two is
-	 * still `"anchored"`. Kept small so a disjoint forged keyset cannot hide in the slack. Default
-	 * {@link DEFAULT_CHURN_SLACK}.
-	 */
-	readonly churnSlack?: number;
-	/**
-	 * Highest tier whose membership is anchored in the tx-log commit certificate (T0/T1), for which this
-	 * FRET-ring anchor has no authority and returns `"unknown"`. Mirrors the membership-source dispatch
-	 * (`createMembershipSourceRouter` treats tier 0/1 as committed). Default {@link DEFAULT_MAX_NO_POW_TIER}.
-	 */
-	readonly maxCommittedTier?: number;
-}
-
-/**
- * Default stabilization-skew slack (`churn_slack ≈ 2`): a legit cert may lag the live ring by ~1–2 members
- * (one rotates in, one rotates out) between stabilization and the verifier's table view; widening to
- * `k + 2` admits that skew while still rejecting a wholly-disjoint forged keyset.
- */
-export const DEFAULT_CHURN_SLACK = 2;
-
-/**
- * The FRET-ring {@link IMembershipTrustAnchor}: judges a cert's `coord → keyset` binding against the
- * node's local FRET cohort assembly. See the module header for the full rule.
- */
-export class FretTrustAnchor implements IMembershipTrustAnchor {
-	private readonly k: number;
-	private readonly selfPeerId: string;
-	private readonly churnSlack: number;
-	private readonly maxCommittedTier: number;
-
-	constructor(private readonly fret: FretRingView, options: FretTrustAnchorOptions) {
-		this.k = options.k;
-		this.selfPeerId = options.selfPeerId;
-		this.churnSlack = options.churnSlack ?? DEFAULT_CHURN_SLACK;
-		this.maxCommittedTier = options.maxCommittedTier ?? DEFAULT_MAX_NO_POW_TIER;
-	}
-
-	directAnchor(cert: MembershipCertV1, tier: number): TrustAnchorVerdict {
-		// Committed tiers (T0/T1) are the tx-log anchor's job, not the FRET ring's — defer.
-		if (tier <= this.maxCommittedTier) {
-			return "unknown";
-		}
-		try {
-			// A partitioned table is unreliable: never reject a legit cert during a partition — defer to TOFU.
-			if (this.fret.detectPartition?.() === true) {
-				return "unknown";
-			}
-			const coord: RingCoord = b64urlToBytes(cert.cohortCoord);
-			const expected = this.fret.assembleCohort(coord, this.k);
-			// Coverage / local authority: a populated neighborhood the node is itself part of. A cold or
-			// partitioned table yields `< k`; a distant coord the node is nowhere near omits self. Either way
-			// the node cannot judge → `"unknown"` (no regression on coords nothing can anchor).
-			if (expected.length < this.k || !expected.includes(this.selfPeerId)) {
-				return "unknown";
-			}
-			const widened = new Set(this.fret.assembleCohort(coord, this.k + this.churnSlack));
-			// Decode the cert's signing quorum into FRET peer-id strings (the same form `assembleCohort` yields).
-			const signers = cert.signers.map((s) => bytesToPeerIdString(b64urlToBytes(s)));
-			if (signers.length === 0) {
-				return "unknown"; // nothing to judge (a self-consistent cert always has signers; defensive)
-			}
-			let inRing = 0;
-			for (const signer of signers) {
-				if (widened.has(signer)) {
-					inRing++;
-				}
-			}
-			if (inRing === signers.length) {
-				return "anchored"; // the whole signing quorum is a subset of a reasonable ring view
-			}
-			if (inRing === 0) {
-				return "rejected"; // a wholly-disjoint quorum — the ring knows a different cohort owns this coord
-			}
-			return "unknown"; // partial overlap beyond the slack — ambiguous churn; defer rather than over-reject
-		} catch {
-			// Any decode failure on attacker-supplied bytes → the ring cannot judge it. Total, never throws.
-			return "unknown";
-		}
-	}
-}
+/**
+ * Cohort-topic substrate — the **FRET-ring direct trust anchor** (db-p2p side of `IMembershipTrustAnchor`).
+ *
+ * `cohort-topic-trust-anchor-core` added the db-core trust gate (`membership/verifier.ts`): a (re)fetched
+ * `MembershipCertV1` is believed only if it is self-consistent **and** anchored by a trust root, the
+ * injected direct anchor, or the attestation chain — else it falls to interim trust-on-first-use. db-core
+ * ships only `noAuthorityTrustAnchor` (every coord `"unknown"`), so until db-p2p binds a real anchor the
+ * gate stays at TOFU. This module binds the **direct anchor** to the one coord→keyset authority FRET
+ * exposes today.
+ *
+ * **What authority FRET offers.** p2p-fret 0.5.0 has **no transferable stabilization proof** — there is no
+ * membership-cert/attestation API and the cert's `fretAttestation` field is never populated. The only
+ * coord→keyset authority FRET offers is `assembleCohort(coord, wants)` — the ring's two-sided closest-`k`
+ * selection — which is **local**: it answers correctly only for coords the node's routing table actually
+ * covers (coords the node is near / serves). That is exactly the amplification-exposed `promote`-handler
+ * path (`verifyAndApplyNotice` verifies against `target.servedCoord`, a coord the node serves), so binding
+ * the anchor to `assembleCohort` rejects the forged-cert attack precisely where the core ticket calls it out.
+ *
+ * **The rule (`directAnchor(cert, tier)`):**
+ *
+ * - **Committed tiers (T0/T1)** route to the tx-log commit certificate, not the FRET ring, so this anchor
+ *   returns `"unknown"` for them — it composes with (does not fight) the future tx-log anchor.
+ * - **No local authority** — the node cannot cover the coord (cold/partitioned table, or a distant coord the
+ *   node is nowhere near, so `assembleCohort` does not yield a populated neighborhood the node is part of) →
+ *   `"unknown"`. The db-core gate then falls through to the chain / interim TOFU, so distant verification is
+ *   never broken or falsely rejected.
+ * - **Covered coord** — compare the cert's **signing quorum** (`cert.signers`, the `≥ minSigs` that actually
+ *   signed) against the ring-expected cohort, widened by a small {@link FretTrustAnchorOptions.churnSlack} to
+ *   tolerate stabilization skew (membership stabilizes slightly behind the live ring):
+ *   - every signer is in the slack-widened ring view → `"anchored"`;
+ *   - the quorum is **disjoint** from the ring view (the ring says a wholly different cohort owns this coord)
+ *     → `"rejected"` (a forgery — fatal even though it is internally self-consistent);
+ *   - partial overlap beyond the slack (genuinely ambiguous within churn tolerance) → `"unknown"` (do not
+ *     over-reject on transient skew; defer to the chain / TOFU).
+ *
+ * **Why anchoring on `signers` (not exact member-set equality) is sound and sufficient.** A forged cert
+ * must sign its threshold multisig with keys the adversary controls; those keys are not in the legitimate
+ * ring cohort, so a forged quorum is disjoint from `assembleCohort(coord)` → `"rejected"`. A legitimate
+ * cert's signers are real cohort members — present in the ring view (within slack) → `"anchored"`. The
+ * adversary cannot list real members as `signers` without their keys (the message multisig would not
+ * verify), so the quorum-subset test has teeth without demanding brittle full-set equality across churn.
+ *
+ * **db-core never imports FRET.** This adapter lives in db-p2p and depends only on the narrow
+ * {@link FretRingView} (satisfied by `FretService`), keeping the db-core trust gate transport-agnostic.
+ */
+
+import type { IMembershipTrustAnchor, MembershipCertV1, RingCoord, TrustAnchorVerdict } from "@optimystic/db-core";
+import { b64urlToBytes, DEFAULT_MAX_NO_POW_TIER } from "@optimystic/db-core";
+import { bytesToPeerIdString } from "./peer-codec.js";
+
+/**
+ * The minimal slice of `FretService` the trust anchor needs: the ring's local two-sided cohort assembly
+ * around a coord, plus an optional partition signal. `FretService` satisfies it directly; a test (and the
+ * mock-mesh harness facade) can supply a stub with just `assembleCohort`.
+ */
+export interface FretRingView {
+	/** Two-sided closest-`wants` selection around `coord` from the node's routing table (peer-id strings). */
+	assembleCohort(coord: Uint8Array, wants: number, exclude?: Set<string>): string[];
+	/** Optional: `true` when the node believes it is partitioned (table unreliable → never reject). */
+	detectPartition?(): boolean;
+}
+
+/** Configuration for a {@link FretTrustAnchor}. */
+export interface FretTrustAnchorOptions {
+	/**
+	 * Requested cohort size — must match the host's `wantK`, so the ring view the anchor computes lines up
+	 * with the cohort the cohort-side `cohortAround` published the cert over.
+	 */
+	readonly k: number;
+	/** This node's own peer-id string — used for the coverage check (the node must be in the coord's cohort). */
+	readonly selfPeerId: string;
+	/**
+	 * Stabilization-skew slack: the ring-expected cohort is widened to `k + churnSlack` members before the
+	 * quorum-subset test, so a legit cert whose signing quorum lags the live ring by a rotation or two is
+	 * still `"anchored"`. Kept small so a disjoint forged keyset cannot hide in the slack. Default
+	 * {@link DEFAULT_CHURN_SLACK}.
+	 */
+	readonly churnSlack?: number;
+	/**
+	 * Highest tier whose membership is anchored in the tx-log commit certificate (T0/T1), for which this
+	 * FRET-ring anchor has no authority and returns `"unknown"`. Mirrors the membership-source dispatch
+	 * (`createMembershipSourceRouter` treats tier 0/1 as committed). Default {@link DEFAULT_MAX_NO_POW_TIER}.
+	 */
+	readonly maxCommittedTier?: number;
+}
+
+/**
+ * Default stabilization-skew slack (`churn_slack ≈ 2`): a legit cert may lag the live ring by ~1–2 members
+ * (one rotates in, one rotates out) between stabilization and the verifier's table view; widening to
+ * `k + 2` admits that skew while still rejecting a wholly-disjoint forged keyset.
+ */
+export const DEFAULT_CHURN_SLACK = 2;
+
+/**
+ * The FRET-ring {@link IMembershipTrustAnchor}: judges a cert's `coord → keyset` binding against the
+ * node's local FRET cohort assembly. See the module header for the full rule.
+ */
+export class FretTrustAnchor implements IMembershipTrustAnchor {
+	private readonly k: number;
+	private readonly selfPeerId: string;
+	private readonly churnSlack: number;
+	private readonly maxCommittedTier: number;
+
+	constructor(private readonly fret: FretRingView, options: FretTrustAnchorOptions) {
+		this.k = options.k;
+		this.selfPeerId = options.selfPeerId;
+		this.churnSlack = options.churnSlack ?? DEFAULT_CHURN_SLACK;
+		this.maxCommittedTier = options.maxCommittedTier ?? DEFAULT_MAX_NO_POW_TIER;
+	}
+
+	directAnchor(cert: MembershipCertV1, tier: number): TrustAnchorVerdict {
+		// Committed tiers (T0/T1) are the tx-log anchor's job, not the FRET ring's — defer.
+		if (tier <= this.maxCommittedTier) {
+			return "unknown";
+		}
+		try {
+			// A partitioned table is unreliable: never reject a legit cert during a partition — defer to TOFU.
+			if (this.fret.detectPartition?.() === true) {
+				return "unknown";
+			}
+			const coord: RingCoord = b64urlToBytes(cert.cohortCoord);
+			const expected = this.fret.assembleCohort(coord, this.k);
+			// Coverage / local authority: a populated neighborhood the node is itself part of. A cold or
+			// partitioned table yields `< k`; a distant coord the node is nowhere near omits self. Either way
+			// the node cannot judge → `"unknown"` (no regression on coords nothing can anchor).
+			if (expected.length < this.k || !expected.includes(this.selfPeerId)) {
+				return "unknown";
+			}
+			const widened = new Set(this.fret.assembleCohort(coord, this.k + this.churnSlack));
+			// Decode the cert's signing quorum into FRET peer-id strings (the same form `assembleCohort` yields).
+			const signers = cert.signers.map((s) => bytesToPeerIdString(b64urlToBytes(s)));
+			if (signers.length === 0) {
+				return "unknown"; // nothing to judge (a self-consistent cert always has signers; defensive)
+			}
+			let inRing = 0;
+			for (const signer of signers) {
+				if (widened.has(signer)) {
+					inRing++;
+				}
+			}
+			if (inRing === signers.length) {
+				return "anchored"; // the whole signing quorum is a subset of a reasonable ring view
+			}
+			if (inRing === 0) {
+				return "rejected"; // a wholly-disjoint quorum — the ring knows a different cohort owns this coord
+			}
+			return "unknown"; // partial overlap beyond the slack — ambiguous churn; defer rather than over-reject
+		} catch {
+			// Any decode failure on attacker-supplied bytes → the ring cannot judge it. Total, never throws.
+			return "unknown";
+		}
+	}
+}

package/src/cohort-topic/host.ts

@@ -57,7 +57,7 @@
 import type { Libp2p } from "libp2p";
 import type { Connection, PeerId, PrivateKey, Stream } from "@libp2p/interface";
 import type { FretService } from "p2p-fret";
-import { hashPeerId, readAllBounded } from "p2p-fret";
+import { hashPeerId, readFramed, sendFramed } from "p2p-fret";
 import {
 	RingHash,
 	createRegistrationStore,
@@ -2810,7 +2810,7 @@ async function registerProtocolHandlers(
 	await Promise.all([
 		// register: a direct dial carries a RenewV1 (ping), a ChildLinkV1 (a child cohort registering with this
 		// parent), or a RegisterV1 (re-attach walk fallback). The three shapes are disjoint, so try each in turn.
-		node.handle(protocols.register, makeFrameHandler(async (frame): Promise<Uint8Array | undefined> => {
+		node.handle(protocols.register, makeRequestHandler(async (frame): Promise<Uint8Array> => {
 			const decoded = decodeCohortMessage(frame, maxBytes);
 			const renew = tryValidate(() => validateRenewV1(decoded));
 			if (renew !== undefined) {
@@ -2830,23 +2830,21 @@ async function registerProtocolHandlers(
 		// every coord engine's bus; per-bus epoch matching governs which engine merges the record deltas.
 		// First, if this is a verified co-member frame for a coord we hold no engine for, instantiate that
 		// engine (§Cold-start instantiation) so its freshly-subscribed bus merges this very frame on `deliver`.
-		node.handle(protocols.gossip, makeFrameHandler(async (frame, from): Promise<Uint8Array | undefined> => {
+		node.handle(protocols.gossip, makeOneWayHandler(async (frame, from): Promise<void> => {
 			maybeInstantiateColdSibling(frame);
 			gossipTransport.deliver(from.toString(), frame);
-			return undefined;
 		}, maxBytes)),
 
 		// promote: threshold-signed promotion/demotion notices (one-way, gossip-style fan-out). The dialing
 		// peer arrives as `from`, so the handler can gate per-(peer, topic) before any expensive work. The
 		// full pipeline (rate limit → findServing → effectiveAt high-water → verify+apply, bounded
 		// refetch) lives in the exported `handleInboundNotice`; it logs and never throws on the stream.
-		node.handle(protocols.promote, makeFrameHandler(async (frame, from): Promise<Uint8Array | undefined> => {
+		node.handle(protocols.promote, makeOneWayHandler(async (frame, from): Promise<void> => {
 			await handleInboundNotice(frame, peerIdToBytes(from), registry, verifier, promoteGate, Date.now(), maxBytes);
-			return undefined; // one-way: match the gossip-style fan-out (no ack frame)
 		}, maxBytes)),
 
 		// membership: serve this node's latest published cert; cache any cert the requester returns.
-		node.handle(protocols.membership, makeFrameHandler(async (frame): Promise<Uint8Array | undefined> => {
+		node.handle(protocols.membership, makeRequestHandler(async (frame): Promise<Uint8Array> => {
 			void frame; // request frame is the raw coord; this node serves its own cohort cert
 			const latest = publishSink.latest();
 			if (latest !== undefined) {
@@ -2858,7 +2856,7 @@ async function registerProtocolHandlers(
 		// sign: per-member endorsement for threshold-signature assembly. Validate the request, run the
 		// endorsement policy, and reply with this node's peer-key signature over the request payload (or a
 		// refusal). One Ed25519 sign and nothing more — the cohort + epoch gate bounds who we sign for.
-		node.handle(protocols.sign, makeFrameHandler(async (frame, from): Promise<Uint8Array | undefined> => {
+		node.handle(protocols.sign, makeRequestHandler(async (frame, from): Promise<Uint8Array> => {
 			const request = validateSignRequestV1(decodeCohortMessage(frame, maxBytes));
 			const reply = await signEndorse(request, from.toString());
 			return encodeCohortMessage(reply, maxBytes);
@@ -2866,7 +2864,40 @@ async function registerProtocolHandlers(
 	]);
 }
 
-/** Wrap a frame handler in the read-one / reply-one libp2p stream lifecycle. */
+/**
+ * Serve a request/reply protocol: read one framed request, reply with exactly one framed response.
+ *
+ * `handle` cannot return `undefined`, and that is the point. The dialer's `readFramed` treats bare
+ * end-of-stream as a truncation error rather than an empty reply, so a reply-reading protocol
+ * (register, membership, sign) must always put a frame on the wire — an empty one for "no result".
+ * Making that a separate constructor from {@link makeOneWayHandler} puts the invariant in the type,
+ * where a later edit cannot silently opt out of it. (`stream-util.ts#handleRequestResponse` takes
+ * the other route for the same reason: every consumer of it is a reply-reading protocol, so it maps
+ * a handler's `undefined` onto an explicit zero-length frame itself.)
+ */
+function makeRequestHandler(
+	handle: (frame: Uint8Array, from: PeerId) => Promise<Uint8Array>,
+	maxBytes: number,
+): (stream: Stream, connection: Connection) => void {
+	return makeFrameHandler(handle, maxBytes);
+}
+
+/**
+ * Serve a one-way protocol: read one framed message and send nothing back (cohort-gossip, promote).
+ * Their dialers use `sendOneWay`, never read, and have typically already closed the stream — a reply
+ * would be wasted at best and a write into a closed stream at worst.
+ */
+function makeOneWayHandler(
+	handle: (frame: Uint8Array, from: PeerId) => Promise<void>,
+	maxBytes: number,
+): (stream: Stream, connection: Connection) => void {
+	return makeFrameHandler(async (frame, from): Promise<undefined> => {
+		await handle(frame, from);
+		return undefined;
+	}, maxBytes);
+}
+
+/** Shared read-one / maybe-reply-one libp2p stream lifecycle behind the two constructors above. */
 function makeFrameHandler(
 	handle: (frame: Uint8Array, from: PeerId) => Promise<Uint8Array | undefined>,
 	maxBytes: number,
@@ -2874,10 +2905,10 @@ function makeFrameHandler(
 	return (stream: Stream, connection: Connection): void => {
 		void (async (): Promise<void> => {
 			try {
-				const frame = await readAllBounded(stream, maxBytes);
+				const frame = await readFramed(stream, maxBytes);
 				const reply = await handle(frame, connection.remotePeer);
 				if (reply !== undefined) {
-					stream.send(reply);
+					sendFramed(stream, reply);
 				}
 				await stream.close();
 			} catch {

package/src/cohort-topic/index.ts

@@ -1,13 +1,13 @@
-export * from "./protocols.js";
-export * from "./peer-codec.js";
-export * from "./peer-sig.js";
-export * from "./stream-util.js";
-export * from "./topic-router.js";
-export * from "./cohort-gossip-transport.js";
-export * from "./cohort-gossip-driver.js";
-export * from "./membership-source.js";
-export * from "./membership-publish-sink.js";
-export * from "./threshold-crypto.js";
-export * from "./size-estimator.js";
-export * from "./host.js";
-export * from "./change-bridge.js";
+export * from "./protocols.js";
+export * from "./peer-codec.js";
+export * from "./peer-sig.js";
+export * from "./stream-util.js";
+export * from "./topic-router.js";
+export * from "./cohort-gossip-transport.js";
+export * from "./cohort-gossip-driver.js";
+export * from "./membership-source.js";
+export * from "./membership-publish-sink.js";
+export * from "./threshold-crypto.js";
+export * from "./size-estimator.js";
+export * from "./host.js";
+export * from "./change-bridge.js";

package/src/cohort-topic/membership-publish-sink.ts

@@ -1,20 +1,20 @@
-import type { IMembershipPublishSink } from "@optimystic/db-core";
-
-/**
- * FRET-backed {@link IMembershipPublishSink}: holds the cohort's latest threshold-signed
- * `MembershipCertV1` (already encoded) and serves it over `/optimystic/cohort-topic/1.0.0/membership`.
- * A node publishes only its own cohort's cert, so the most-recent encoded cert is all the host's
- * membership protocol handler needs to answer inbound requests.
- */
-export class FretMembershipPublishSink implements IMembershipPublishSink {
-	private latestCert: Uint8Array | undefined;
-
-	publish(encodedCert: Uint8Array): void {
-		this.latestCert = encodedCert;
-	}
-
-	/** The most recently published encoded cert, or `undefined` if none yet (host serves this). */
-	latest(): Uint8Array | undefined {
-		return this.latestCert;
-	}
-}
+import type { IMembershipPublishSink } from "@optimystic/db-core";
+
+/**
+ * FRET-backed {@link IMembershipPublishSink}: holds the cohort's latest threshold-signed
+ * `MembershipCertV1` (already encoded) and serves it over `/optimystic/cohort-topic/1.0.0/membership`.
+ * A node publishes only its own cohort's cert, so the most-recent encoded cert is all the host's
+ * membership protocol handler needs to answer inbound requests.
+ */
+export class FretMembershipPublishSink implements IMembershipPublishSink {
+	private latestCert: Uint8Array | undefined;
+
+	publish(encodedCert: Uint8Array): void {
+		this.latestCert = encodedCert;
+	}
+
+	/** The most recently published encoded cert, or `undefined` if none yet (host serves this). */
+	latest(): Uint8Array | undefined {
+		return this.latestCert;
+	}
+}

package/src/cohort-topic/membership-source.ts

@@ -1,68 +1,68 @@
-import type { IMembershipSource, RingCoord } from "@optimystic/db-core";
-import { bytesToB64url } from "@optimystic/db-core";
-import { peerIdFromString } from "@libp2p/peer-id";
-import type { Libp2p } from "libp2p";
-import type { CohortPeerResolver } from "./cohort-gossip-transport.js";
-import { requestResponse, DEFAULT_STREAM_MAX_BYTES } from "./stream-util.js";
-import { PROTOCOL_COHORT_MEMBERSHIP } from "./protocols.js";
-
-export interface FretMembershipSourceOptions {
-	readonly membershipProtocol?: string;
-	/** Cohort fan-out probed on a `fetch`. Default 16. */
-	readonly wants?: number;
-	readonly maxBytes?: number;
-}
-
-/**
- * FRET-backed {@link IMembershipSource}: cohort membership snapshots over
- * `/optimystic/cohort-topic/1.0.0/membership`. `current` serves the locally-cached encoded
- * `MembershipCertV1`; `fetch` forces one refresh by requesting the cert from an assembled cohort
- * member (the stale-cache retry the participant-side verifier drives). The host feeds inbound certs
- * into the cache via {@link cache}.
- */
-export class FretMembershipSource implements IMembershipSource {
-	private readonly byCoord = new Map<string, Uint8Array>();
-	private readonly membershipProtocol: string;
-	private readonly wants: number;
-	private readonly maxBytes: number;
-
-	constructor(private readonly node: Libp2p, private readonly resolver: CohortPeerResolver, options: FretMembershipSourceOptions = {}) {
-		this.membershipProtocol = options.membershipProtocol ?? PROTOCOL_COHORT_MEMBERSHIP;
-		this.wants = options.wants ?? 16;
-		this.maxBytes = options.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
-	}
-
-	current(coord: RingCoord): Promise<Uint8Array | undefined> {
-		return Promise.resolve(this.byCoord.get(bytesToB64url(coord)));
-	}
-
-	/**
-	 * Synchronous local existence read over the in-memory cache: true iff a `MembershipCertV1` is cached for
-	 * `coord` (no network I/O). The parent-reference bootstrap-evidence verifier's existence view consults
-	 * this — an admission gate must never dial — so it reads the same `byCoord` map `current()` resolves from.
-	 */
-	has(coord: RingCoord): boolean {
-		return this.byCoord.has(bytesToB64url(coord));
-	}
-
-	async fetch(coord: RingCoord): Promise<Uint8Array | undefined> {
-		const request = coord; // the membership request frame is the raw coord bytes
-		for (const peerStr of this.resolver.cohortPeers(coord, this.wants)) {
-			try {
-				const reply = await requestResponse(this.node, peerIdFromString(peerStr), this.membershipProtocol, request, this.maxBytes);
-				if (reply.length > 0) {
-					this.cache(coord, reply);
-					return reply;
-				}
-			} catch {
-				// Try the next member; a stale-cache refetch tolerates an unreachable holder.
-			}
-		}
-		return undefined;
-	}
-
-	/** Cache an encoded cert for its coord (host feeds inbound/served certs here). */
-	cache(coord: RingCoord, encodedCert: Uint8Array): void {
-		this.byCoord.set(bytesToB64url(coord), encodedCert);
-	}
-}
+import type { IMembershipSource, RingCoord } from "@optimystic/db-core";
+import { bytesToB64url } from "@optimystic/db-core";
+import { peerIdFromString } from "@libp2p/peer-id";
+import type { Libp2p } from "libp2p";
+import type { CohortPeerResolver } from "./cohort-gossip-transport.js";
+import { requestResponse, DEFAULT_STREAM_MAX_BYTES } from "./stream-util.js";
+import { PROTOCOL_COHORT_MEMBERSHIP } from "./protocols.js";
+
+export interface FretMembershipSourceOptions {
+	readonly membershipProtocol?: string;
+	/** Cohort fan-out probed on a `fetch`. Default 16. */
+	readonly wants?: number;
+	readonly maxBytes?: number;
+}
+
+/**
+ * FRET-backed {@link IMembershipSource}: cohort membership snapshots over
+ * `/optimystic/cohort-topic/1.0.0/membership`. `current` serves the locally-cached encoded
+ * `MembershipCertV1`; `fetch` forces one refresh by requesting the cert from an assembled cohort
+ * member (the stale-cache retry the participant-side verifier drives). The host feeds inbound certs
+ * into the cache via {@link cache}.
+ */
+export class FretMembershipSource implements IMembershipSource {
+	private readonly byCoord = new Map<string, Uint8Array>();
+	private readonly membershipProtocol: string;
+	private readonly wants: number;
+	private readonly maxBytes: number;
+
+	constructor(private readonly node: Libp2p, private readonly resolver: CohortPeerResolver, options: FretMembershipSourceOptions = {}) {
+		this.membershipProtocol = options.membershipProtocol ?? PROTOCOL_COHORT_MEMBERSHIP;
+		this.wants = options.wants ?? 16;
+		this.maxBytes = options.maxBytes ?? DEFAULT_STREAM_MAX_BYTES;
+	}
+
+	current(coord: RingCoord): Promise<Uint8Array | undefined> {
+		return Promise.resolve(this.byCoord.get(bytesToB64url(coord)));
+	}
+
+	/**
+	 * Synchronous local existence read over the in-memory cache: true iff a `MembershipCertV1` is cached for
+	 * `coord` (no network I/O). The parent-reference bootstrap-evidence verifier's existence view consults
+	 * this — an admission gate must never dial — so it reads the same `byCoord` map `current()` resolves from.
+	 */
+	has(coord: RingCoord): boolean {
+		return this.byCoord.has(bytesToB64url(coord));
+	}
+
+	async fetch(coord: RingCoord): Promise<Uint8Array | undefined> {
+		const request = coord; // the membership request frame is the raw coord bytes
+		for (const peerStr of this.resolver.cohortPeers(coord, this.wants)) {
+			try {
+				const reply = await requestResponse(this.node, peerIdFromString(peerStr), this.membershipProtocol, request, this.maxBytes);
+				if (reply.length > 0) {
+					this.cache(coord, reply);
+					return reply;
+				}
+			} catch {
+				// Try the next member; a stale-cache refetch tolerates an unreachable holder.
+			}
+		}
+		return undefined;
+	}
+
+	/** Cache an encoded cert for its coord (host feeds inbound/served certs here). */
+	cache(coord: RingCoord, encodedCert: Uint8Array): void {
+		this.byCoord.set(bytesToB64url(coord), encodedCert);
+	}
+}