@optimystic/db-p2p 0.24.1 → 0.25.0

package/dist/src/cluster/block-transfer-service.d.ts

@@ -1,7 +1,9 @@
 import type { Startable } from '@libp2p/interface';
-import type { IRepo, PeerId, IPeerNetwork, ActionId, ActionRev, IBlock, BlockId } from '@optimystic/db-core';
+import type { IRepo, PeerId, IPeerNetwork, ActionId, ActionRev, GetBlockResult, IBlock, BlockId } from '@optimystic/db-core';
 import { ProtocolClient } from '../protocol-client.js';
 import { type InboundStreamAuthorizationInit } from '../inbound-authorization.js';
+import type { BlockCommitProof } from './commit-proof.js';
+import { type ArchiveServingRepo } from '../storage/block-archive.js';
 export declare const buildBlockTransferProtocol: (protocolPrefix?: string) => string;
 /** Request to transfer blocks */
 export interface BlockTransferRequest {
@@ -22,7 +24,76 @@ export interface BlockTransferRequest {
         rev: number;
         actionId: ActionId;
     }>;
+    /**
+     * For push: the cohort's commit proof for each block's revision. Verified against the pushed
+     * bytes AND against the declared {@link blockMeta} before anything is persisted — one
+     * `certifyContent` call covers the signatures and thresholds, the claim matching the declared
+     * `(rev, actionId)`, and the declared digest matching the pushed bytes.
+     *
+     * Optional on the wire so an un-upgraded sender still parses; whether a proof-less push is
+     * ACCEPTED is the receiver's `requirePushCertificate` decision (default: reject).
+     */
+    blockProofs?: Record<string, BlockCommitProof>;
 }
+/**
+ * The `blockMeta` a pusher sends alongside one block: the source's own `state.latest`, so the
+ * replica lands at the source's `(rev, actionId)` rather than a fabricated one. That match is what
+ * later lets the replica CORROBORATE the source in a read-repair quorum vote — a fabricated action
+ * id never matches the source's claim, so the vote sees one claimant, not two.
+ *
+ * `undefined` when the source repo reports no `latest`; the receiver then falls back to its
+ * deterministic rev-1 replica (see `IBlockStorage.saveReplica`).
+ *
+ * Every push path (rebalance confirm/push, spread-on-churn) builds it here so the wire shape stays
+ * defined in one place alongside {@link BlockTransferRequest.blockMeta}.
+ *
+ * The caller must read the block UNPINNED (no `BlockGets.context`). `state.latest` is the newest
+ * revision the source holds, while `block` is the revision `materialized` names; those agree only
+ * for an unpinned read. Pairing pinned (older) content with `latest` would label content with a
+ * revision it is not — so the pairing is guarded below and drops the meta rather than lying.
+ *
+ * Dropping, rather than labelling the older content with its own (now known) `materialized`
+ * revision, is deliberate: a push is "here is my latest replica" — the receiver lands it as its
+ * replica and the source's `latest` is what the cohort corroborates — and no push path reads
+ * pinned, so a mismatch here is a caller bug, not a historical serve. A repair fetch of an older
+ * revision is a different wire (`serveBlockArchive`), and that one DOES label from `materialized`.
+ */
+export declare function sourceBlockMeta(blockId: BlockId, result: Pick<GetBlockResult, 'state' | 'materialized'> | undefined): Record<string, ActionRev> | undefined;
+/**
+ * Everything a push carries ABOUT the blocks it pushes, as one value: the source's revision
+ * metadata and the cohort commit proof for that same revision. One parameter rather than two so a
+ * caller cannot attach a proof for one revision beside metadata for another — the two are built
+ * together by {@link sourceBlockCertification} from a single unpinned read, or not at all.
+ */
+export type PushCertification = {
+    blockMeta?: Record<string, ActionRev>;
+    blockProofs?: Record<string, BlockCommitProof>;
+};
+/**
+ * Build a push's {@link PushCertification} for ONE block from a single unpinned read: the
+ * {@link sourceBlockMeta} for the source's `state.latest`, plus the locally-retained
+ * {@link BlockCommitProof} for exactly that revision.
+ *
+ * The proof comes from {@link servableProof} — the same accessor that decides what a peer attaches
+ * to a served repair archive — so a push and a repair fetch can never disagree about which proof
+ * pairs with which revision. It fails closed on every unhappy path (repo with no proof accessor, a
+ * throwing lookup, a stored proof whose message names a different `(blockId, rev, actionId)`), so a
+ * mis-paired artifact is never pushed.
+ *
+ * **A proof is never attached without its meta.** Without the declared `(rev, actionId)` a receiver
+ * has no claim to verify the proof against, and it rejects the block (see
+ * `BlockTransferService.handlePush`).
+ *
+ * **Meta IS still attached when no proof exists.** That is the pre-proof push, unchanged: a
+ * receiver running the default `requirePushCertificate: true` rejects it either way, and one
+ * migrating with the flag `false` needs the meta to land the replica at the source's revision
+ * instead of a fabricated rev 1. Dropping the meta alongside the missing proof would regress the
+ * legacy path without making the strict path any stricter.
+ *
+ * Like `sourceBlockMeta`, the caller must have read the block UNPINNED, so `block`, the meta and
+ * the proof all describe the same revision.
+ */
+export declare function sourceBlockCertification(repo: ArchiveServingRepo, blockId: BlockId, result: Pick<GetBlockResult, 'state' | 'materialized'> | undefined): Promise<PushCertification>;
 /** Response with block data */
 export interface BlockTransferResponse {
     /** Blocks successfully transferred: blockId → base64-encoded data */
@@ -42,11 +113,36 @@ export interface IBlockReplicaStore extends IRepo {
      * Seeds metadata if absent, advances `latest` monotonically, and makes the block
      * durably servable via `get`. Idempotent for a fixed `(rev, actionId)`; a no-op
      * (still durable) when an equal-or-newer revision is already present.
+     *
+     * `verifiedProof` MUST already have been verified against these exact bytes and this exact
+     * `source` (`certifyContent` — the digest check is what binds a proof to the content). It is
+     * retained so the receiver can re-prove onward what it just verified, instead of becoming a
+     * holder that can only corroborate.
      */
-    saveReplicatedBlock(blockId: BlockId, block: IBlock, source?: ActionRev): Promise<void>;
+    saveReplicatedBlock(blockId: BlockId, block: IBlock, source?: ActionRev, verifiedProof?: BlockCommitProof): Promise<void>;
 }
 export interface BlockTransferServiceInit extends InboundStreamAuthorizationInit {
     protocolPrefix?: string;
+    /**
+     * Reject a pushed block that carries no verifying commit proof. Default `true`.
+     * A deployment holding pre-proof data sets this `false` during migration.
+     *
+     * **Why the strict default.** `handlePush` persists what a peer hands it, and
+     * `saveReplicatedBlock` advances `latest` monotonically — so an uncertified push makes the
+     * pusher's bytes this node's authoritative revision, after which this node *corroborates* the
+     * pusher in a later read-repair vote. That is how a peer manufactures its own corroborators.
+     *
+     * The failure mode of `true` is that legacy blocks stop gaining new holders via push — visible
+     * in a `push:reject-uncertified` log line, and those blocks stay readable while two or more
+     * holders remain. The failure mode of `false` is silent acceptance of forged content. Pre-proof
+     * blocks can never be certified (the signatures no longer exist), but any block written again
+     * under the current code gets a proof, so only cold, never-updated blocks stay uncertified.
+     *
+     * With the flag `false` an uncertified push falls back to the pre-proof behaviour, logged as
+     * `push:accept-uncertified`. A push carrying a proof that FAILS verification is rejected
+     * regardless of the flag — that is not a legacy block, it is a bad one.
+     */
+    requirePushCertificate?: boolean;
 }
 export interface BlockTransferServiceComponents {
     registrar: {
@@ -54,6 +150,20 @@ export interface BlockTransferServiceComponents {
         unhandle: (...args: any[]) => Promise<void>;
     };
     repo: IBlockReplicaStore;
+    /**
+     * The cohort's configured super-majority fraction, used to verify a pushed block's commit proof.
+     *
+     * REQUIRED rather than defaulted: the node factory must hand this down from the single resolved
+     * `consensusConfig` every other consensus consumer reads (`libp2p-node-base.ts`, which already
+     * fail-fast asserts member/coordinator coupling on exactly this value). A local default here
+     * would be a third copy that silently disagrees with a deployment that tuned the threshold.
+     *
+     * The simple-majority half of {@link ProofThresholds} is deliberately NOT threaded: it must
+     * mirror what members actually enforce (`count > total / 2`), not the configured 0.51 — see
+     * `proofThresholds` in `certified-claims.ts`, the one helper every proof-verifying path builds
+     * its thresholds with.
+     */
+    superMajorityThreshold: number;
     /**
      * Optional libp2p component logger. Supplied by the node factory so authorization denials
      * land on the same `logger.forComponent(...).error` sink as the repo/cluster/sync services;
@@ -78,6 +188,10 @@ export declare class BlockTransferService implements Startable {
     private readonly registrar;
     /** Optional embedder authorization gate; `undefined` (the default) means no check runs. */
     private readonly authorization;
+    /** Built once from the node's configured super-majority — see {@link BlockTransferServiceComponents.superMajorityThreshold}. */
+    private readonly proofThresholds;
+    /** See {@link BlockTransferServiceInit.requirePushCertificate}. */
+    private readonly requirePushCertificate;
     constructor(components: BlockTransferServiceComponents, init?: BlockTransferServiceInit);
     start(): Promise<void>;
     stop(): Promise<void>;
@@ -86,8 +200,18 @@ export declare class BlockTransferService implements Startable {
     /**
      * Persist pushed blocks into local storage so the new owner holds a durable
      * replica after churn. A block is reported `accepted` only if it was both
-     * received (parseable) AND successfully persisted; a parse or persist failure
+     * received (parseable) AND successfully persisted; a parse, certification or persist failure
      * surfaces it as `missing` so the sender does not falsely treat it as replicated.
+     *
+     * **Certification.** A pushed block is content this node will serve — and, because
+     * `saveReplicatedBlock` advances `latest`, content it will later CORROBORATE in a read-repair
+     * vote. So by default the pusher must show the cohort's commit proof for the revision it
+     * declares, verified here against both the declared `(rev, actionId)` and the pushed bytes. See
+     * {@link BlockTransferServiceInit.requirePushCertificate} for the migration flag and its
+     * rationale.
+     *
+     * Decisions are strictly PER BLOCK: in a multi-block push a block that verifies is accepted
+     * beside one that does not. `handlePull` is unaffected — it serves this node's own storage.
      */
     private handlePush;
 }
@@ -115,9 +239,11 @@ export declare class BlockTransferClient extends ProtocolClient {
     /**
      * Push blocks to the remote peer.
      *
-     * @param blockMeta Optional per-block source revision metadata (the sender's
-     *   `state.latest`). When provided, the receiver replicates at the source's
-     *   `(rev, actionId)`; when omitted, it falls back to a deterministic rev-1 replica.
+     * @param certification What this push claims about the blocks — the source's revision metadata
+     *   and the cohort commit proof for that same revision, built as one unit by
+     *   {@link sourceBlockCertification}. Without a proof the receiver rejects the block under its
+     *   default `requirePushCertificate: true`; without metadata it replicates at a deterministic
+     *   rev-1 (and rejects any proof, which then covers nothing).
      * @param options Optional per-call deadlines/cancellation forwarded to the
      *   underlying request. `dialTimeoutMs` bounds connecting; `responseTimeoutMs`
      *   bounds waiting for the reply once connected (so a peer that connects but goes
@@ -125,10 +251,7 @@ export declare class BlockTransferClient extends ProtocolClient {
      *   cancels the whole request. Omitting all of them preserves the previous
      *   uncapped behavior.
      */
-    pushBlocks(blockIds: string[], blockDataBuffers: Uint8Array[], reason?: BlockTransferRequest['reason'], blockMeta?: Record<string, {
-        rev: number;
-        actionId: ActionId;
-    }>, options?: {
+    pushBlocks(blockIds: string[], blockDataBuffers: Uint8Array[], reason?: BlockTransferRequest['reason'], certification?: PushCertification, options?: {
         signal?: AbortSignal;
         dialTimeoutMs?: number;
         responseTimeoutMs?: number;

package/dist/src/cluster/block-transfer-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"block-transfer-service.d.ts","sourceRoot":"","sources":["../../../src/cluster/block-transfer-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,SAAS,EAAU,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAK7G,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAAqE,KAAK,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAQrJ,eAAO,MAAM,0BAA0B,GAAI,iBAAgB,MAAW,KAAG,MACJ,CAAC;AAEtE,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;CAChE;AAED,+BAA+B;AAC/B,MAAM,WAAW,qBAAqB;IACrC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAID;;;;;GAKG;AACH,MAAM,WAAW,kBAAmB,SAAQ,KAAK;IAChD;;;;;OAKG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,wBAAyB,SAAQ,8BAA8B;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,8BAA8B;IAC9C,SAAS,EAAE;QAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACtG,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;SAAE,CAAA;KAAE,CAAC;CACtG;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,SAAS;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;IACxE,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyC;gBAGtE,UAAU,EAAE,8BAA8B,EAC1C,IAAI,GAAE,wBAA6B;IAU9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,aAAa;YA8Cb,UAAU;IAkBxB;;;;;OAKG;YACW,UAAU;CA8CxB;AAED,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,GAAI,OAAM,wBAA6B,MACtE,YAAY,8BAA8B,yBAA+C,CAAC;AAI5F;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,YAAY,EACzB,cAAc,GAAE,MAAW;IAM5B;;;;;;;OAOG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,GAAE,oBAAoB,CAAC,QAAQ,CAAe,EACpD,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,qBAAqB,CAAC;IAKjC;;;;;;;;;;;;OAYG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,gBAAgB,EAAE,UAAU,EAAE,EAC9B,MAAM,GAAE,oBAAoB,CAAC,QAAQ,CAAe,EACpD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,EAC/D,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,qBAAqB,CAAC;CAQjC"}
+{"version":3,"file":"block-transfer-service.d.ts","sourceRoot":"","sources":["../../../src/cluster/block-transfer-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,SAAS,EAAU,MAAM,mBAAmB,CAAC;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAK7H,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD,OAAO,EAAqE,KAAK,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAErJ,OAAO,KAAK,EAAE,gBAAgB,EAAmB,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AASrF,eAAO,MAAM,0BAA0B,GAAI,iBAAgB,MAAW,KAAG,MACJ,CAAC;AAEtE,iCAAiC;AACjC,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,0BAA0B;IAC1B,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;IACjD,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IAChE;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,eAAe,CAC9B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,cAAc,CAAC,GAAG,SAAS,GAChE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,SAAS,CAUvC;AAED;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACtC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC/C,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,wBAAwB,CAC7C,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,cAAc,CAAC,GAAG,SAAS,GAChE,OAAO,CAAC,iBAAiB,CAAC,CAY5B;AAED,+BAA+B;AAC/B,MAAM,WAAW,qBAAqB;IACrC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,mDAAmD;IACnD,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAID;;;;;GAKG;AACH,MAAM,WAAW,kBAAmB,SAAQ,KAAK;IAChD;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1H;AAED,MAAM,WAAW,wBAAyB,SAAQ,8BAA8B;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;;;;;;;;;;OAkBG;IACH,sBAAsB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC9C,SAAS,EAAE;QAAE,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;IACtG,IAAI,EAAE,kBAAkB,CAAC;IACzB;;;;;;;;;;;;OAYG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAC/B;;;;OAIG;IACH,MAAM,CAAC,EAAE;QAAE,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK;YAAE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;SAAE,CAAA;KAAE,CAAC;CACtG;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,YAAW,SAAS;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAqB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA8C;IACxE,2FAA2F;IAC3F,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAyC;IACvE,gIAAgI;IAChI,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,mEAAmE;IACnE,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAU;gBAGhD,UAAU,EAAE,8BAA8B,EAC1C,IAAI,GAAE,wBAA6B;IAY9B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;YAOb,aAAa;YA8Cb,UAAU;IAkBxB;;;;;;;;;;;;;;;OAeG;YACW,UAAU;CAgGxB;AAED,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,GAAI,OAAM,wBAA6B,MACtE,YAAY,8BAA8B,yBAA+C,CAAC;AAI5F;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,cAAc;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;gBAGjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,YAAY,EACzB,cAAc,GAAE,MAAW;IAM5B;;;;;;;OAOG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,GAAE,oBAAoB,CAAC,QAAQ,CAAe,EACpD,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,qBAAqB,CAAC;IAKjC;;;;;;;;;;;;;;OAcG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,gBAAgB,EAAE,UAAU,EAAE,EAC9B,MAAM,GAAE,oBAAoB,CAAC,QAAQ,CAAe,EACpD,aAAa,CAAC,EAAE,iBAAiB,EACjC,OAAO,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,WAAW,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,GACpF,OAAO,CAAC,qBAAqB,CAAC;CAYjC"}

package/dist/src/cluster/block-transfer-service.js

@@ -6,11 +6,85 @@ import { ProtocolClient } from '../protocol-client.js';
 import { MAX_BLOCK_MESSAGE_BYTES } from '../protocol-limits.js';
 import { createLogger } from '../logger.js';
 import { createInboundStreamAuthorization } from '../inbound-authorization.js';
+import { certifyContent, proofThresholds } from './certified-claims.js';
+import { servableProof } from '../storage/block-archive.js';
+import { registerProtocolHandler } from '../network/register-protocol-handler.js';
 const log = createLogger('block-transfer-service');
 /** Protocol path */
 const BLOCK_TRANSFER_PREFIX = '/db-p2p/block-transfer/';
 const BLOCK_TRANSFER_VERSION = '1.0.0';
 export const buildBlockTransferProtocol = (protocolPrefix = '') => `${protocolPrefix}${BLOCK_TRANSFER_PREFIX}${BLOCK_TRANSFER_VERSION}`;
+/**
+ * The `blockMeta` a pusher sends alongside one block: the source's own `state.latest`, so the
+ * replica lands at the source's `(rev, actionId)` rather than a fabricated one. That match is what
+ * later lets the replica CORROBORATE the source in a read-repair quorum vote — a fabricated action
+ * id never matches the source's claim, so the vote sees one claimant, not two.
+ *
+ * `undefined` when the source repo reports no `latest`; the receiver then falls back to its
+ * deterministic rev-1 replica (see `IBlockStorage.saveReplica`).
+ *
+ * Every push path (rebalance confirm/push, spread-on-churn) builds it here so the wire shape stays
+ * defined in one place alongside {@link BlockTransferRequest.blockMeta}.
+ *
+ * The caller must read the block UNPINNED (no `BlockGets.context`). `state.latest` is the newest
+ * revision the source holds, while `block` is the revision `materialized` names; those agree only
+ * for an unpinned read. Pairing pinned (older) content with `latest` would label content with a
+ * revision it is not — so the pairing is guarded below and drops the meta rather than lying.
+ *
+ * Dropping, rather than labelling the older content with its own (now known) `materialized`
+ * revision, is deliberate: a push is "here is my latest replica" — the receiver lands it as its
+ * replica and the source's `latest` is what the cohort corroborates — and no push path reads
+ * pinned, so a mismatch here is a caller bug, not a historical serve. A repair fetch of an older
+ * revision is a different wire (`serveBlockArchive`), and that one DOES label from `materialized`.
+ */
+export function sourceBlockMeta(blockId, result) {
+    const latest = result?.state?.latest;
+    if (!latest)
+        return undefined;
+    const materialized = result?.materialized;
+    if (materialized !== undefined && materialized.rev !== latest.rev) {
+        log('meta:skip block=%s materialized=%d latest=%d (pinned read — refusing to mislabel content)', blockId, materialized.rev, latest.rev);
+        return undefined;
+    }
+    return { [blockId]: { rev: latest.rev, actionId: latest.actionId } };
+}
+/**
+ * Build a push's {@link PushCertification} for ONE block from a single unpinned read: the
+ * {@link sourceBlockMeta} for the source's `state.latest`, plus the locally-retained
+ * {@link BlockCommitProof} for exactly that revision.
+ *
+ * The proof comes from {@link servableProof} — the same accessor that decides what a peer attaches
+ * to a served repair archive — so a push and a repair fetch can never disagree about which proof
+ * pairs with which revision. It fails closed on every unhappy path (repo with no proof accessor, a
+ * throwing lookup, a stored proof whose message names a different `(blockId, rev, actionId)`), so a
+ * mis-paired artifact is never pushed.
+ *
+ * **A proof is never attached without its meta.** Without the declared `(rev, actionId)` a receiver
+ * has no claim to verify the proof against, and it rejects the block (see
+ * `BlockTransferService.handlePush`).
+ *
+ * **Meta IS still attached when no proof exists.** That is the pre-proof push, unchanged: a
+ * receiver running the default `requirePushCertificate: true` rejects it either way, and one
+ * migrating with the flag `false` needs the meta to land the replica at the source's revision
+ * instead of a fabricated rev 1. Dropping the meta alongside the missing proof would regress the
+ * legacy path without making the strict path any stricter.
+ *
+ * Like `sourceBlockMeta`, the caller must have read the block UNPINNED, so `block`, the meta and
+ * the proof all describe the same revision.
+ */
+export async function sourceBlockCertification(repo, blockId, result) {
+    const blockMeta = sourceBlockMeta(blockId, result);
+    if (!blockMeta) {
+        return {};
+    }
+    const latest = result.state.latest;
+    const proof = await servableProof(repo, blockId, latest);
+    if (!proof) {
+        log('cert:no-local-proof block=%s rev=%d (pushing uncertified)', blockId, latest.rev);
+        return { blockMeta };
+    }
+    return { blockMeta, blockProofs: { [blockId]: proof } };
+}
 /**
  * Libp2p service that handles incoming block transfer requests.
  *
@@ -24,17 +98,23 @@ export class BlockTransferService {
     registrar;
     /** Optional embedder authorization gate; `undefined` (the default) means no check runs. */
     authorization;
+    /** Built once from the node's configured super-majority — see {@link BlockTransferServiceComponents.superMajorityThreshold}. */
+    proofThresholds;
+    /** See {@link BlockTransferServiceInit.requirePushCertificate}. */
+    requirePushCertificate;
     constructor(components, init = {}) {
         this.protocol = buildBlockTransferProtocol(init.protocolPrefix ?? '');
         this.repo = components.repo;
         this.registrar = components.registrar;
+        this.proofThresholds = proofThresholds(components.superMajorityThreshold);
+        this.requirePushCertificate = init.requirePushCertificate ?? true;
         const componentLog = components.logger?.forComponent('db-p2p:block-transfer');
         this.authorization = createInboundStreamAuthorization(init, this.protocol, componentLog ? (msg, ...args) => componentLog.error(msg, ...args) : (msg, ...args) => log(msg, ...args));
     }
     async start() {
         if (this.running)
             return;
-        await this.registrar.handle(this.protocol, async (data, connection) => {
+        await registerProtocolHandler(this.registrar, this.protocol, async (data, connection) => {
             // libp2p invokes the stream handler with the Stream as the FIRST positional argument
             // (see cluster/repo/dispute services, which all use `(stream, connection)`). The block-
             // transfer handler previously read `data.stream`, which is `undefined` for the positional
@@ -118,8 +198,18 @@ export class BlockTransferService {
     /**
      * Persist pushed blocks into local storage so the new owner holds a durable
      * replica after churn. A block is reported `accepted` only if it was both
-     * received (parseable) AND successfully persisted; a parse or persist failure
+     * received (parseable) AND successfully persisted; a parse, certification or persist failure
      * surfaces it as `missing` so the sender does not falsely treat it as replicated.
+     *
+     * **Certification.** A pushed block is content this node will serve — and, because
+     * `saveReplicatedBlock` advances `latest`, content it will later CORROBORATE in a read-repair
+     * vote. So by default the pusher must show the cohort's commit proof for the revision it
+     * declares, verified here against both the declared `(rev, actionId)` and the pushed bytes. See
+     * {@link BlockTransferServiceInit.requirePushCertificate} for the migration flag and its
+     * rationale.
+     *
+     * Decisions are strictly PER BLOCK: in a multi-block push a block that verifies is accepted
+     * beside one that does not. `handlePull` is unaffected — it serves this node's own storage.
      */
     async handlePush(request) {
         const blocks = {};
@@ -150,10 +240,60 @@ export class BlockTransferService {
                 missing.push(blockId);
                 continue;
             }
+            // Certify BEFORE persisting: `saveReplicatedBlock` advances `latest`, so anything that
+            // reaches it becomes this node's authoritative revision.
+            const source = request.blockMeta?.[blockId];
+            const proof = request.blockProofs?.[blockId];
+            let verifiedProof;
+            if (proof !== undefined) {
+                if (!source) {
+                    // No declared `(rev, actionId)` means no claim to verify the proof against, and
+                    // `saveReplica` would fabricate a rev-1 replica the proof does not cover.
+                    log('push:reject-uncertified block=%s reason=proof-without-meta', blockId);
+                    missing.push(blockId);
+                    continue;
+                }
+                // One call covers the signatures and thresholds, the claim matching the declared
+                // `(rev, actionId)`, and the declared digest matching these exact bytes. Routed through
+                // `certifyContent` rather than the raw verifier so the wire-facing signer cap
+                // (MAX_PROOF_SIGNERS) the verifier requires of its callers is applied before any
+                // signature work — this input comes from an unauthenticated peer.
+                //
+                // NOTE: no `ProofAnchoring` is threaded here, unlike the other two proof-verifying
+                // paths (`ReconcileBlockDeps.anchoring`, `CoordinatorRepo`'s). Nothing wires anchoring
+                // in production today, so all three behave identically; when
+                // `feat-cluster-membership-threshold-cert-anchoring` lands, this call needs the same
+                // optional dep or the push path becomes the one place the unanchored residual is
+                // neither compared nor surfaced.
+                //
+                // NOTE: verification cost per REQUEST is unbounded in a way per-proof caps do not
+                // cover — one inbound push frame is capped at MAX_BLOCK_MESSAGE_BYTES (8 MiB, not the
+                // 1 MiB control cap `MAX_PROOF_SIGNERS`' note reasons about) and may carry one proof
+                // per block id. Each proof is bounded (≤ 256 signers), but their number is the
+                // sender's choice. Acceptable today because the pre-proof path already did per-block
+                // parse + disk write on the same frame; if inbound push CPU ever shows up in a
+                // profile, bound the per-request proof count (or total proof bytes) here.
+                const verdict = await certifyContent(proof, { blockId, rev: source.rev, actionId: source.actionId }, block, this.proofThresholds);
+                if (!verdict.contentCertified) {
+                    log('push:reject-uncertified block=%s rev=%d reason=%s', blockId, source.rev, verdict.failure);
+                    missing.push(blockId);
+                    continue;
+                }
+                verifiedProof = proof;
+            }
+            else if (this.requirePushCertificate) {
+                // The documented migration case: an un-upgraded sender, or a block committed before
+                // proofs existed. Diagnosable by this line alone.
+                log('push:reject-uncertified block=%s rev=%s reason=no-proof', blockId, source?.rev);
+                missing.push(blockId);
+                continue;
+            }
+            else {
+                log('push:accept-uncertified block=%s rev=%s (requirePushCertificate disabled)', blockId, source?.rev);
+            }
             // Persist locally. Only a received-AND-persisted block is reported accepted.
             try {
-                const source = request.blockMeta?.[blockId];
-                await this.repo.saveReplicatedBlock(blockId, block, source);
+                await this.repo.saveReplicatedBlock(blockId, block, source, verifiedProof);
                 blocks[blockId] = data;
             }
             catch (error) {
@@ -191,9 +331,11 @@ export class BlockTransferClient extends ProtocolClient {
     /**
      * Push blocks to the remote peer.
      *
-     * @param blockMeta Optional per-block source revision metadata (the sender's
-     *   `state.latest`). When provided, the receiver replicates at the source's
-     *   `(rev, actionId)`; when omitted, it falls back to a deterministic rev-1 replica.
+     * @param certification What this push claims about the blocks — the source's revision metadata
+     *   and the cohort commit proof for that same revision, built as one unit by
+     *   {@link sourceBlockCertification}. Without a proof the receiver rejects the block under its
+     *   default `requirePushCertificate: true`; without metadata it replicates at a deterministic
+     *   rev-1 (and rejects any proof, which then covers nothing).
      * @param options Optional per-call deadlines/cancellation forwarded to the
      *   underlying request. `dialTimeoutMs` bounds connecting; `responseTimeoutMs`
      *   bounds waiting for the reply once connected (so a peer that connects but goes
@@ -201,12 +343,16 @@ export class BlockTransferClient extends ProtocolClient {
      *   cancels the whole request. Omitting all of them preserves the previous
      *   uncapped behavior.
      */
-    async pushBlocks(blockIds, blockDataBuffers, reason = 'rebalance', blockMeta, options) {
+    async pushBlocks(blockIds, blockDataBuffers, reason = 'rebalance', certification, options) {
         const blockData = {};
         for (let i = 0; i < blockIds.length; i++) {
             blockData[blockIds[i]] = Buffer.from(blockDataBuffers[i]).toString('base64');
         }
-        const request = { type: 'push', blockIds, reason, blockData, ...(blockMeta ? { blockMeta } : {}) };
+        const request = {
+            type: 'push', blockIds, reason, blockData,
+            ...(certification?.blockMeta ? { blockMeta: certification.blockMeta } : {}),
+            ...(certification?.blockProofs ? { blockProofs: certification.blockProofs } : {})
+        };
         return await this.processMessage(request, this.protocol, { ...options, maxDataLength: MAX_BLOCK_MESSAGE_BYTES });
     }
 }

package/dist/src/cluster/block-transfer-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"block-transfer-service.js","sourceRoot":"","sources":["../../../src/cluster/block-transfer-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gCAAgC,EAAwE,MAAM,6BAA6B,CAAC;AAErJ,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAEnD,oBAAoB;AACpB,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,iBAAyB,EAAE,EAAU,EAAE,CACjF,GAAG,cAAc,GAAG,qBAAqB,GAAG,sBAAsB,EAAE,CAAC;AA6DtE;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACxB,OAAO,GAAG,KAAK,CAAC;IACP,QAAQ,CAAS;IACjB,IAAI,CAAqB;IACzB,SAAS,CAA8C;IACxE,2FAA2F;IAC1E,aAAa,CAAyC;IAEvE,YACC,UAA0C,EAC1C,OAAiC,EAAE;QAEnC,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,GAAG,gCAAgC,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EACxE,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAS,EAAE,UAAuB,EAAE,EAAE;YACvF,qFAAqF;YACrF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,4EAA4E;YAC5E,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;YACpC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,UAAuB;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACJ,iFAAiF;YACjF,8DAA8D;YAC9D,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;gBAAE,OAAO;YAC5G,gFAAgF;YAChF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,iFAAiF;YACjF,sFAAsF;YACtF,yBAAyB;YACzB,MAAM,SAAS,GAAG,IAAI,CACrB,MAAM,EACN,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,EACzE,KAAK,SAAS,CAAC,EAAE,MAAM;gBACtB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAyB,CAAC;oBACvF,GAAG,CAAC,qCAAqC,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBAClG,IAAI,QAA+B,CAAC;oBACpC,IAAI,CAAC;wBACJ,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM;4BACjC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;4BAChC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBACnC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,GAAG,CAAC,WAAW,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;wBAC3C,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBACxC,CAAC;oBACD,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;oBACrD,OAAO,CAAC,wCAAwC;gBACjD,CAAC;YACF,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7B,CAAC;YACF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClD,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,kDAAkD;YAClD,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAW,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,8EAA8E;YAC9E,gFAAgF;YAChF,iFAAiF;YACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3F,GAAG,CAAC,wDAAwD,EAAE,OAAO,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,6EAA6E;YAC7E,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,8BAA8B,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;CACD;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAiC,EAAE,EAAE,EAAE,CAC3E,CAAC,UAA0C,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAE5F,iBAAiB;AAEjB;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACrC,QAAQ,CAAS;IAElC,YACC,MAAc,EACd,WAAyB,EACzB,iBAAyB,EAAE;QAE3B,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACf,QAAkB,EAClB,SAAyC,WAAW,EACpD,OAAsF;QAEtF,MAAM,OAAO,GAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACzE,OAAO,MAAM,IAAI,CAAC,cAAc,CAAwB,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzI,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,UAAU,CACf,QAAkB,EAClB,gBAA8B,EAC9B,SAAyC,WAAW,EACpD,SAA+D,EAC/D,OAAsF;QAEtF,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACzH,OAAO,MAAM,IAAI,CAAC,cAAc,CAAwB,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzI,CAAC;CACD"}
+{"version":3,"file":"block-transfer-service.js","sourceRoot":"","sources":["../../../src/cluster/block-transfer-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,UAAU,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,gCAAgC,EAAwE,MAAM,6BAA6B,CAAC;AACrJ,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExE,OAAO,EAAE,aAAa,EAA2B,MAAM,6BAA6B,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAElF,MAAM,GAAG,GAAG,YAAY,CAAC,wBAAwB,CAAC,CAAC;AAEnD,oBAAoB;AACpB,MAAM,qBAAqB,GAAG,yBAAyB,CAAC;AACxD,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAEvC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,iBAAyB,EAAE,EAAU,EAAE,CACjF,GAAG,cAAc,GAAG,qBAAqB,GAAG,sBAAsB,EAAE,CAAC;AA8BtE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,eAAe,CAC9B,OAAgB,EAChB,MAAkE;IAElE,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,CAAC;IAC1C,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC;QACnE,GAAG,CAAC,2FAA2F,EAC9F,OAAO,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACtE,CAAC;AAaD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,IAAwB,EACxB,OAAgB,EAChB,MAAkE;IAElE,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,MAAO,CAAC,KAAM,CAAC,MAAO,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,GAAG,CAAC,2DAA2D,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACtF,OAAO,EAAE,SAAS,EAAE,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;AACzD,CAAC;AAkFD;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACxB,OAAO,GAAG,KAAK,CAAC;IACP,QAAQ,CAAS;IACjB,IAAI,CAAqB;IACzB,SAAS,CAA8C;IACxE,2FAA2F;IAC1E,aAAa,CAAyC;IACvE,gIAAgI;IAC/G,eAAe,CAAkB;IAClD,mEAAmE;IAClD,sBAAsB,CAAU;IAEjD,YACC,UAA0C,EAC1C,OAAiC,EAAE;QAEnC,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC;QAC5B,IAAI,CAAC,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;QAC1E,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,sBAAsB,IAAI,IAAI,CAAC;QAClE,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,uBAAuB,CAAC,CAAC;QAC9E,IAAI,CAAC,aAAa,GAAG,gCAAgC,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EACxE,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,KAAK;QACV,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,MAAM,uBAAuB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAS,EAAE,UAAuB,EAAE,EAAE;YACzG,qFAAqF;YACrF,wFAAwF;YACxF,0FAA0F;YAC1F,uFAAuF;YACvF,wFAAwF;YACxF,4EAA4E;YAC5E,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,CAAC;YACpC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI;QACT,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACrB,GAAG,CAAC,SAAS,CAAC,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,UAAuB;QAClE,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACJ,iFAAiF;YACjF,8DAA8D;YAC9D,IAAI,IAAI,CAAC,aAAa,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;gBAAE,OAAO;YAC5G,gFAAgF;YAChF,mFAAmF;YACnF,qFAAqF;YACrF,mFAAmF;YACnF,iFAAiF;YACjF,sFAAsF;YACtF,yBAAyB;YACzB,MAAM,SAAS,GAAG,IAAI,CACrB,MAAM,EACN,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,EACzE,KAAK,SAAS,CAAC,EAAE,MAAM;gBACtB,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;oBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAyB,CAAC;oBACvF,GAAG,CAAC,qCAAqC,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBAClG,IAAI,QAA+B,CAAC;oBACpC,IAAI,CAAC;wBACJ,QAAQ,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM;4BACjC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;4BAChC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBACnC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBAChB,GAAG,CAAC,WAAW,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;wBAC3C,QAAQ,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;oBACxC,CAAC;oBACD,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBACnG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;oBACrD,OAAO,CAAC,wCAAwC;gBACjD,CAAC;YACF,CAAC,EACD,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7B,CAAC;YACF,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,EAAG,GAAa,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAClG,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEnE,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACpC,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrF,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,UAAU,CAAC,OAA6B;QACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;QAClD,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,kDAAkD;YAClD,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAW,CAAC;YAC5E,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,8EAA8E;YAC9E,gFAAgF;YAChF,iFAAiF;YACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAAgB,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3F,GAAG,CAAC,wDAAwD,EAAE,OAAO,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;YAED,uFAAuF;YACvF,yDAAyD;YACzD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,aAA2C,CAAC;YAChD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,gFAAgF;oBAChF,0EAA0E;oBAC1E,GAAG,CAAC,4DAA4D,EAAE,OAAO,CAAC,CAAC;oBAC3E,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACtB,SAAS;gBACV,CAAC;gBACD,iFAAiF;gBACjF,wFAAwF;gBACxF,8EAA8E;gBAC9E,iFAAiF;gBACjF,kEAAkE;gBAClE,EAAE;gBACF,mFAAmF;gBACnF,uFAAuF;gBACvF,6DAA6D;gBAC7D,qFAAqF;gBACrF,iFAAiF;gBACjF,iCAAiC;gBACjC,EAAE;gBACF,kFAAkF;gBAClF,sFAAsF;gBACtF,qFAAqF;gBACrF,+EAA+E;gBAC/E,qFAAqF;gBACrF,+EAA+E;gBAC/E,0EAA0E;gBAC1E,MAAM,OAAO,GAAG,MAAM,cAAc,CACnC,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9F,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBAC/B,GAAG,CAAC,mDAAmD,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC/F,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACtB,SAAS;gBACV,CAAC;gBACD,aAAa,GAAG,KAAK,CAAC;YACvB,CAAC;iBAAM,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACxC,oFAAoF;gBACpF,kDAAkD;gBAClD,GAAG,CAAC,yDAAyD,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBACrF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,SAAS;YACV,CAAC;iBAAM,CAAC;gBACP,GAAG,CAAC,2EAA2E,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YACxG,CAAC;YAED,6EAA6E;YAC7E,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,CAAC;gBAC3E,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,8BAA8B,EAAE,OAAO,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;gBACvE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC;CACD;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAiC,EAAE,EAAE,EAAE,CAC3E,CAAC,UAA0C,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAE5F,iBAAiB;AAEjB;;GAEG;AACH,MAAM,OAAO,mBAAoB,SAAQ,cAAc;IACrC,QAAQ,CAAS;IAElC,YACC,MAAc,EACd,WAAyB,EACzB,iBAAyB,EAAE;QAE3B,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,0BAA0B,CAAC,cAAc,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACf,QAAkB,EAClB,SAAyC,WAAW,EACpD,OAAsF;QAEtF,MAAM,OAAO,GAAyB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACzE,OAAO,MAAM,IAAI,CAAC,cAAc,CAAwB,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzI,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,UAAU,CACf,QAAkB,EAClB,gBAA8B,EAC9B,SAAyC,WAAW,EACpD,aAAiC,EACjC,OAAsF;QAEtF,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC1C,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,OAAO,GAAyB;YACrC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS;YACzC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC;QACF,OAAO,MAAM,IAAI,CAAC,cAAc,CAAwB,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC,CAAC;IACzI,CAAC;CACD"}

package/dist/src/cluster/block-transfer.d.ts

@@ -1,7 +1,8 @@
-import type { IRepo, IPeerNetwork } from '@optimystic/db-core';
+import type { IPeerNetwork } from '@optimystic/db-core';
 import type { PartitionDetector } from './partition-detector.js';
 import type { RestorationCoordinator } from '../storage/restoration-coordinator.js';
-import type { RebalanceEvent } from './rebalance-monitor.js';
+import type { ProofRetainingRepo } from '../storage/block-archive.js';
+import type { GrowthOutcome, RebalanceEvent } from './rebalance-monitor.js';
 export interface BlockTransferConfig {
     /** Max concurrent transfers. Default: 4 */
     maxConcurrency?: number;
@@ -26,6 +27,22 @@ export interface RebalanceReactionResult {
     released: string[];
     /** Lost blocks whose replication could not be confirmed — keep serving, retry later. */
     retained: string[];
+    /** Grown blocks confirmed pushed to every newly co-responsible peer (capped by the floor). */
+    replicated: string[];
+    /**
+     * Grown blocks that could not be confirmed on the new peers this pass. Nothing is released off
+     * this list — the node keeps the block either way. The retry lives in the monitor: the caller
+     * feeds each block's {@link GrowthOutcome} (in `growth`) back via
+     * `RebalanceMonitor.recordGrowthOutcome`, so an unconfirmed peer stays out of the seen set and
+     * the next check re-detects it.
+     */
+    underReplicated: string[];
+    /**
+     * Per-block feedback for the growth arm, keyed by block id. A block reported `grown` that the
+     * reaction had NO information about (its confirm was deduped against one already in flight) has
+     * no entry — the monitor must leave that block's state untouched.
+     */
+    growth: Map<string, GrowthOutcome>;
 }
 /**
  * Coordinates block transfers in response to rebalance events.
@@ -37,6 +54,13 @@ export interface RebalanceReactionResult {
  * via the BlockTransfer protocol.
  */
 export declare class BlockTransferCoordinator {
+    /**
+     * The node's OWN store, proof accessor REQUIRED (not the optional `ArchiveServingRepo`
+     * shape): every push this class makes is certified out of it, and a repo without the
+     * accessor would make `sourceBlockCertification` return meta-only for every block — so
+     * every push would be refused by a receiver running the default `requirePushCertificate`,
+     * silently and with no type error. Same reasoning as `createServedRepoProxy`'s.
+     */
     private readonly repo;
     private readonly peerNetwork;
     private readonly restorationCoordinator;
@@ -49,7 +73,15 @@ export declare class BlockTransferCoordinator {
     private inFlight;
     private concurrency;
     private readonly waitQueue;
-    constructor(repo: IRepo, peerNetwork: IPeerNetwork, restorationCoordinator: RestorationCoordinator, partitionDetector: PartitionDetector, protocolPrefix?: string, config?: BlockTransferConfig);
+    constructor(
+    /**
+     * The node's OWN store, proof accessor REQUIRED (not the optional `ArchiveServingRepo`
+     * shape): every push this class makes is certified out of it, and a repo without the
+     * accessor would make `sourceBlockCertification` return meta-only for every block — so
+     * every push would be refused by a receiver running the default `requirePushCertificate`,
+     * silently and with no type error. Same reasoning as `createServedRepoProxy`'s.
+     */
+    repo: ProofRetainingRepo, peerNetwork: IPeerNetwork, restorationCoordinator: RestorationCoordinator, partitionDetector: PartitionDetector, protocolPrefix?: string, config?: BlockTransferConfig);
     /**
      * Pull blocks that this node has gained responsibility for.
      * Uses RestorationCoordinator to discover holders and fetch block data.
@@ -76,6 +108,27 @@ export declare class BlockTransferCoordinator {
      * hole (`docs/arachnode-ring-handoff.md` § Why the current code violates it #2).
      */
     handleRebalanceEvent(event: RebalanceEvent): Promise<RebalanceReactionResult>;
+    /**
+     * Push each GROWN block (still owned; new peers became co-responsible) to its newly
+     * co-responsible peers, reusing {@link executeConfirm} per block. The per-block floor is
+     * `min(event floor, new-peer count)`: passing the raw event floor would be wrong when fewer new
+     * peers exist than the floor — `executeConfirm` could then never reach the floor and would burn
+     * `maxRetries` re-pushing peers that already accepted. Nothing is released off this path (the
+     * node KEEPS the block either way); the confirmed/unconfirmed split is reporting only. The
+     * in-flight `confirm:<id>` key dedups against a concurrent lost-confirm for the same block —
+     * such a block gets NO `growth` entry (no information), so the monitor leaves it untouched.
+     * `enablePush` deliberately does not gate this (same rationale as the NOTE in
+     * {@link confirmReplicated}); the growth arm as a whole is gated by the `rebalance.enabled`
+     * wiring in `libp2p-node-base`.
+     *
+     * Per-block {@link GrowthOutcome} rules:
+     * - floor met → all reported peers satisfied, complete. Deliberately includes peers
+     *   `executeConfirm` skipped once the floor was reached — the block is adequately replicated,
+     *   and re-pushing the remainder on every check forever would be a live loop.
+     * - no local data → all reported peers satisfied, complete (nothing to replicate; see NOTE).
+     * - otherwise → only the peers that actually confirmed, incomplete (retried by the monitor).
+     */
+    private replicateGrown;
     /**
      * Confirm each block is replicated to at least `floor` qualifying owners — the gate the ring-shift
      * handoff (Phase B) and the rebalance release both open before a block may stop being served.
@@ -99,10 +152,17 @@ export declare class BlockTransferCoordinator {
     private executePull;
     private executePush;
     /**
-     * Confirm one block replicated to ≥ `floor` distinct qualifying owners. Reads the local block once,
-     * pushes to each candidate owner (stopping once the floor is reached), and counts distinct owners
-     * that report holding it (not `missing`). Retries the whole round up to `maxRetries` before giving
-     * up. Records the block in `confirmed` iff the floor was met, otherwise in `unconfirmed`.
+     * Confirm one block replicated to ≥ `floor` distinct qualifying owners. Reads the local block once
+     * per attempt, pushes to each candidate owner (stopping once the floor is reached), and counts
+     * distinct owners that report holding it (not `missing`). Retries the whole round up to
+     * `maxRetries` before giving up.
+     *
+     * Returns `null` when a confirm for this block is already in flight (no information — the caller
+     * must not record anything for it). Otherwise: `confirmed` iff the floor was met; `confirmedPeers`
+     * is the union of owners that confirmed across every attempt (a peer that accepted a push holds a
+     * replica even if a later round missed it — the floor decision itself stays per-round, unchanged);
+     * `noLocalData` marks the nothing-local-to-push case. The lost-block release path uses only
+     * `confirmed`; the growth arm consumes the other two.
      */
     private executeConfirm;
     private acquireSemaphore;

package/dist/src/cluster/block-transfer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"block-transfer.d.ts","sourceRoot":"","sources":["../../../src/cluster/block-transfer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAE/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAEpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAK7D,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACvC,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IAUnC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAbhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;gBAGjC,IAAI,EAAE,KAAK,EACX,WAAW,EAAE,YAAY,EACzB,sBAAsB,EAAE,sBAAsB,EAC9C,iBAAiB,EAAE,iBAAiB,EACpC,cAAc,GAAE,MAAW,EAC5C,MAAM,GAAE,mBAAwB;IAQjC;;;OAGG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAgBxF;;OAEG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAC9B,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmBrD;;;;;;;;;OASG;IACG,oBAAoB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsBnF;;;;;;;;;;;;;;;OAeG;IACG,iBAAiB,CACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC7B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;YAyB5C,WAAW;YAyCX,WAAW;IA0EzB;;;;;OAKG;YACW,cAAc;YAgFd,gBAAgB;IAS9B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,WAAW;CAMnB"}
+{"version":3,"file":"block-transfer.d.ts","sourceRoot":"","sources":["../../../src/cluster/block-transfer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAK5E,MAAM,WAAW,mBAAmB;IACnC,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,UAAU,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACvC,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,wFAAwF;IACxF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,wBAAwB;IAUnC;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc;IApBhC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAqB;IACrC,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;;IAGlD;;;;;;OAMG;IACc,IAAI,EAAE,kBAAkB,EACxB,WAAW,EAAE,YAAY,EACzB,sBAAsB,EAAE,sBAAsB,EAC9C,iBAAiB,EAAE,iBAAiB,EACpC,cAAc,GAAE,MAAW,EAC5C,MAAM,GAAE,mBAAwB;IAQjC;;;OAGG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAgBxF;;OAEG;IACG,UAAU,CACf,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAC9B,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAmBrD;;;;;;;;;OASG;IACG,oBAAoB,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC;IA4BnF;;;;;;;;;;;;;;;;;;;OAmBG;YACW,cAAc;IAoD5B;;;;;;;;;;;;;;;OAeG;IACG,iBAAiB,CACtB,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAC7B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;YA6B5C,WAAW;YAyCX,WAAW;IA+EzB;;;;;;;;;;;;OAYG;YACW,cAAc;YAqFd,gBAAgB;IAS9B,OAAO,CAAC,gBAAgB;IAQxB,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,WAAW;CAMnB"}