@peerbit/shared-log 13.2.32 → 13.2.34

package/src/replication-info-v2-send.ts

@@ -1,5 +1,4 @@
-import { serialize } from "@dao-xyz/borsh";
-import { type PublicSignKey, randomBytes, sha256Sync } from "@peerbit/crypto";
+import { type PublicSignKey, randomBytes } from "@peerbit/crypto";
 import { logger as loggerFn } from "@peerbit/logger";
 import type { RPC } from "@peerbit/rpc";
 import {
@@ -8,7 +7,7 @@ import {
 } from "@peerbit/stream-interface";
 import type { TransportMessage } from "./message.js";
 import type { ReplicationRangeIndexable } from "./ranges.js";
-import { concat, fromString } from "uint8arrays";
+import { deriveReplicationInfoV2ReceiverBinding } from "./replication-info-v2-binding.js";
 import {
 	AddedReplicationInfoV2Message,
 	AddedReplicationSegmentMessage,
@@ -22,46 +21,11 @@ import {
 const logger = loggerFn("peerbit:shared-log:replication-info-v2-send");
 
 const MAX_U64 = (1n << 64n) - 1n;
-const RECEIVER_BINDING_DOMAIN = fromString(
-	"peerbit/shared-log/replication-info-v2/receiver-binding/v1",
-);
-
-const lengthPrefixed = (bytes: Uint8Array): Uint8Array => {
-	const length = new Uint8Array(4);
-	new DataView(length.buffer).setUint32(0, bytes.byteLength, true);
-	return concat([length, bytes]);
-};
-
-const u64LittleEndian = (value: bigint): Uint8Array => {
-	const bytes = new Uint8Array(8);
-	new DataView(bytes.buffer).setBigUint64(0, value, true);
-	return bytes;
-};
+const DEFAULT_SEND_RETRY_MS = 1_000;
+const DEFAULT_MAX_SEND_RETRY_MS = 30_000;
+const MAX_BACKOFF_EXPONENT = 20;
 
-/**
- * Derive the token echoed by V2 data frames. Delivery recipients are unsigned,
- * so the receiver's nonce alone is not a destination binding. Folding both
- * authenticated identities and signed transport sessions into the 32-byte
- * field prevents a copied request nonce from creating an interchangeable
- * stream for another receiver.
- */
-export const deriveReplicationInfoV2ReceiverBinding = (properties: {
-	receiverChallenge: Uint8Array;
-	receiver: PublicSignKey;
-	receiverTransportSession: bigint;
-	sender: PublicSignKey;
-	senderTransportSession: bigint;
-}): Uint8Array =>
-	sha256Sync(
-		concat([
-			lengthPrefixed(RECEIVER_BINDING_DOMAIN),
-			lengthPrefixed(properties.receiverChallenge),
-			lengthPrefixed(serialize(properties.receiver)),
-			u64LittleEndian(properties.receiverTransportSession),
-			lengthPrefixed(serialize(properties.sender)),
-			u64LittleEndian(properties.senderTransportSession),
-		]),
-	);
+export { deriveReplicationInfoV2ReceiverBinding } from "./replication-info-v2-binding.js";
 
 export type LegacyReplicationInfoMessage =
 	| AllReplicatingSegmentsMessage
@@ -78,15 +42,19 @@ export type ReplicationInfoV2SendState = {
 	peerSession: object;
 	receiverTransportSession: bigint;
 	senderTransportSession: bigint;
+	capabilityTimestamp: bigint;
 	lastRequestTimestamp: bigint;
 	receiverRequestChallenge: Uint8Array;
 	receiverChallenge: Uint8Array;
 	senderEpoch: Uint8Array;
 	ownershipLifecycleController: AbortController;
+	ownershipAbortListener: () => void;
 	nextSequence: bigint;
 	established: boolean;
 	suspended: boolean;
 	inFlightSequence?: bigint;
+	retryTimer?: ReturnType<typeof setTimeout>;
+	retryAttempts: number;
 	controller: AbortController;
 	pending?: SendRequest;
 	worker?: Promise<void>;
@@ -101,11 +69,14 @@ export type ReplicationInfoV2SendDeps<R extends "u32" | "u64"> = {
 		ranges: readonly { mode: unknown }[],
 	) => void;
 	isClosed: () => boolean;
+	isPeerSessionCurrent: (peerHash: string, peerSession: object) => boolean;
 	isPeerSessionOpen: (peerHash: string, peerSession: object) => boolean;
 	captureReplicationOwnershipLifecycle: () => AbortController;
 	isReplicationOwnershipLifecycleActive: (
 		controller: AbortController,
 	) => boolean;
+	sendRetryMs?: number;
+	maxSendRetryMs?: number;
 };
 
 const bytesEqual = (left: Uint8Array, right: Uint8Array): boolean => {
@@ -131,7 +102,15 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 	_spentPeerSessions!: WeakSet<object>;
 	_retiringWorkersByPeer!: Map<string, Promise<void>>;
 
+	private readonly sendRetryMs: number;
+	private readonly maxSendRetryMs: number;
+
 	constructor(private readonly deps: ReplicationInfoV2SendDeps<R>) {
+		this.sendRetryMs = Math.max(1, deps.sendRetryMs ?? DEFAULT_SEND_RETRY_MS);
+		this.maxSendRetryMs = Math.max(
+			this.sendRetryMs,
+			deps.maxSendRetryMs ?? DEFAULT_MAX_SEND_RETRY_MS,
+		);
 		this._senderEpoch = randomBytes(32);
 		this._sendStates = new Map();
 		this._spentPeerSessions = new WeakSet();
@@ -169,6 +148,14 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 
 	private clearState(state: ReplicationInfoV2SendState): void {
 		this.trackRetiringWorker(state);
+		if (state.retryTimer) {
+			clearTimeout(state.retryTimer);
+			state.retryTimer = undefined;
+		}
+		state.ownershipLifecycleController.signal.removeEventListener(
+			"abort",
+			state.ownershipAbortListener,
+		);
 		state.controller.abort();
 		if (this._sendStates.get(state.peerHash) === state) {
 			this._sendStates.delete(state.peerHash);
@@ -201,25 +188,72 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 			!this.deps.isClosed() &&
 			!state.controller.signal.aborted &&
 			this._sendStates.get(state.peerHash) === state &&
-			this.deps.isPeerSessionOpen(state.peerHash, state.peerSession) &&
+			this.deps.isPeerSessionCurrent(state.peerHash, state.peerSession) &&
 			this.deps.getSenderTransportSession() === state.senderTransportSession
 		);
 	}
 
-	private isCurrent(state: ReplicationInfoV2SendState): boolean {
+	private isDestinationReady(state: ReplicationInfoV2SendState): boolean {
 		return (
 			this.isDestinationCurrent(state) &&
+			this.deps.isPeerSessionOpen(state.peerHash, state.peerSession)
+		);
+	}
+
+	private isCurrent(state: ReplicationInfoV2SendState): boolean {
+		return (
+			this.isDestinationReady(state) &&
 			this.deps.isReplicationOwnershipLifecycleActive(
 				state.ownershipLifecycleController,
 			)
 		);
 	}
 
+	private retireSpentState(state: ReplicationInfoV2SendState): void {
+		this._spentPeerSessions.add(state.peerSession);
+		this.clearState(state);
+	}
+
+	/**
+	 * Collapse every interrupted normal-send path to one authoritative snapshot.
+	 * A closed readiness gate is temporary while the exact PeerSession remains
+	 * current, so it parks instead of destroying the receiver binding. Sequence
+	 * exhaustion is terminal even when readiness or ownership changed at the same
+	 * time as an in-flight transport attempt.
+	 */
+	private parkSnapshotForRetry(state: ReplicationInfoV2SendState): void {
+		state.inFlightSequence = undefined;
+		if (state.nextSequence > MAX_U64) {
+			this.retireSpentState(state);
+			return;
+		}
+		if (!this.isDestinationCurrent(state)) {
+			this.clearState(state);
+			return;
+		}
+		if (
+			!this.deps.isReplicationOwnershipLifecycleActive(
+				state.ownershipLifecycleController,
+			)
+		) {
+			if (state.retryTimer) {
+				clearTimeout(state.retryTimer);
+				state.retryTimer = undefined;
+			}
+			state.pending = undefined;
+			return;
+		}
+
+		state.suspended = true;
+		state.pending = { kind: "snapshot" };
+		this.scheduleRetry(state);
+	}
+
 	/**
 	 * Accept a signed receiver request. An exact newer retry asks for another
 	 * full snapshot without resetting the epoch/sequence. A different challenge
-	 * cannot replace the first binding within one PeerSession; this prevents a
-	 * signed request flood from spawning unbounded orphan snapshot reads.
+	 * can replace the binding only after a strictly newer signed capability;
+	 * retiring work is drained before the replacement can start.
 	 */
 	acceptRequest(
 		request: RequestReplicationInfoV2Message,
@@ -227,6 +261,7 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 			from: PublicSignKey;
 			peerSession: object;
 			receiverTransportSession: bigint;
+			capabilityTimestamp: bigint;
 			requestTimestamp: bigint;
 		},
 	): boolean {
@@ -244,6 +279,7 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 		if (
 			this._retiringWorkersByPeer.has(peerHash) ||
 			this._spentPeerSessions.has(properties.peerSession) ||
+			!this.deps.isPeerSessionCurrent(peerHash, properties.peerSession) ||
 			!this.deps.isPeerSessionOpen(peerHash, properties.peerSession)
 		) {
 			return false;
@@ -261,6 +297,16 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 				return false;
 			}
 		}
+		if (
+			previous &&
+			!this.deps.isReplicationOwnershipLifecycleActive(
+				previous.ownershipLifecycleController,
+			)
+		) {
+			// Ownership teardown retains the binding only so close/drop can send its
+			// terminal empty Full. A later request must not revive normal delivery.
+			return false;
+		}
 		if (previous) {
 			const sameBinding =
 				previous.peerSession === properties.peerSession &&
@@ -275,22 +321,43 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 					return false;
 				}
 				previous.lastRequestTimestamp = properties.requestTimestamp;
+				previous.capabilityTimestamp = properties.capabilityTimestamp;
+				if (previous.retryTimer) {
+					clearTimeout(previous.retryTimer);
+					previous.retryTimer = undefined;
+				}
 				previous.suspended = false;
+				previous.pending = { kind: "snapshot" };
 				this.enqueueState(previous, { kind: "snapshot" });
 				return true;
 			}
 
-			return false;
+			if (properties.capabilityTimestamp <= previous.capabilityTimestamp) {
+				return false;
+			}
+			this.clearState(previous);
+			previous = undefined;
+			if (this._retiringWorkersByPeer.has(peerHash)) {
+				return false;
+			}
 		}
 
 		const ownershipLifecycleController =
 			this.deps.captureReplicationOwnershipLifecycle();
+		if (
+			!this.deps.isReplicationOwnershipLifecycleActive(
+				ownershipLifecycleController,
+			)
+		) {
+			return false;
+		}
 		const state: ReplicationInfoV2SendState = {
 			peerHash,
 			target: properties.from,
 			peerSession: properties.peerSession,
 			receiverTransportSession: properties.receiverTransportSession,
 			senderTransportSession,
+			capabilityTimestamp: properties.capabilityTimestamp,
 			lastRequestTimestamp: properties.requestTimestamp,
 			receiverRequestChallenge: request.receiverChallenge.slice(),
 			receiverChallenge: deriveReplicationInfoV2ReceiverBinding({
@@ -301,12 +368,26 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 				senderTransportSession,
 			}),
 			senderEpoch: this._senderEpoch.slice(),
+			ownershipAbortListener: () => {},
 			nextSequence: 1n,
 			established: false,
 			suspended: false,
+			retryAttempts: 0,
 			controller: new AbortController(),
 			ownershipLifecycleController,
 		};
+		state.ownershipAbortListener = () => {
+			if (state.retryTimer) {
+				clearTimeout(state.retryTimer);
+				state.retryTimer = undefined;
+			}
+			state.pending = undefined;
+		};
+		ownershipLifecycleController.signal.addEventListener(
+			"abort",
+			state.ownershipAbortListener,
+			{ once: true },
+		);
 		this._sendStates.set(peerHash, state);
 		this.enqueueState(state, { kind: "snapshot" });
 		return true;
@@ -329,20 +410,15 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 		state: ReplicationInfoV2SendState,
 		request: SendRequest,
 	): void {
-		if (!this.isCurrent(state)) {
-			state.pending = undefined;
-			if (
-				!this.isDestinationCurrent(state) ||
-				this.deps.isReplicationOwnershipLifecycleActive(
-					state.ownershipLifecycleController,
-				)
-			) {
-				this.clearState(state);
-			}
+		if (state.nextSequence > MAX_U64 || !this.isCurrent(state)) {
+			this.parkSnapshotForRetry(state);
 			return;
 		}
 		if (state.suspended) {
-			state.pending = undefined;
+			// Delivery is ambiguous while the backoff is armed. Never retain a
+			// potentially stale delta: one authoritative Full represents every
+			// mutation that arrives before the retry fires.
+			this.parkSnapshotForRetry(state);
 			return;
 		}
 
@@ -352,12 +428,14 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 			worker = Promise.resolve()
 				.then(() => this.runWorker(state))
 				.catch((error) => {
-					const ownershipActive =
+					// Sequence cleanup and exhaustion fencing must happen before any
+					// readiness/ownership classification in the recovery path.
+					this.parkSnapshotForRetry(state);
+					if (
+						this._sendStates.get(state.peerHash) === state &&
 						this.deps.isReplicationOwnershipLifecycleActive(
 							state.ownershipLifecycleController,
-						);
-					if (
-						ownershipActive &&
+						) &&
 						!state.controller.signal.aborted &&
 						!this.deps.isClosed()
 					) {
@@ -367,28 +445,6 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 							(error as Error)?.message ?? String(error),
 						);
 					}
-					state.pending = undefined;
-					const ordinaryFailure =
-						ownershipActive && this.isDestinationCurrent(state);
-					if (ordinaryFailure) {
-						if (state.inFlightSequence !== undefined) {
-							state.inFlightSequence = undefined;
-							if (state.nextSequence > MAX_U64) {
-								this._spentPeerSessions.add(state.peerSession);
-								this.clearState(state);
-								return;
-							}
-						}
-						// A delivery error is ambiguous: the receiver may already have
-						// applied this sequence. Retain the exact grant, stop ordinary
-						// deltas, and require a newer same-challenge request to resume
-						// with an authoritative Full at the next safe sequence.
-						state.suspended = true;
-						return;
-					}
-					if (!this.isDestinationCurrent(state)) {
-						this.clearState(state);
-					}
 				})
 				.finally(() => {
 					if (state.worker === worker) {
@@ -397,7 +453,7 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 						// before this promise reaction clears `worker`. Re-arm that item
 						// here so the one-slot bound cannot become a stranded queue.
 						const pending = state.pending;
-						if (pending && this.isCurrent(state)) {
+						if (pending) {
 							state.pending = undefined;
 							this.enqueueState(state, pending);
 						}
@@ -417,6 +473,51 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 		state.pending = { kind: "snapshot" };
 	}
 
+	private retryDelay(state: ReplicationInfoV2SendState): number {
+		const exponent = Math.max(0, state.retryAttempts - 1);
+		return Math.min(
+			this.maxSendRetryMs,
+			this.sendRetryMs * 2 ** Math.min(exponent, MAX_BACKOFF_EXPONENT),
+		);
+	}
+
+	private scheduleRetry(state: ReplicationInfoV2SendState): void {
+		if (state.retryTimer) {
+			return;
+		}
+		if (state.nextSequence > MAX_U64) {
+			this.retireSpentState(state);
+			return;
+		}
+		if (!this.isDestinationCurrent(state)) {
+			this.clearState(state);
+			return;
+		}
+		if (
+			!this.deps.isReplicationOwnershipLifecycleActive(
+				state.ownershipLifecycleController,
+			)
+		) {
+			state.pending = undefined;
+			return;
+		}
+		state.retryAttempts = Math.min(
+			state.retryAttempts + 1,
+			MAX_BACKOFF_EXPONENT + 1,
+		);
+		state.retryTimer = setTimeout(() => {
+			state.retryTimer = undefined;
+			if (state.nextSequence > MAX_U64 || !this.isCurrent(state)) {
+				this.parkSnapshotForRetry(state);
+				return;
+			}
+			state.suspended = false;
+			state.pending = { kind: "snapshot" };
+			this.enqueueState(state, { kind: "snapshot" });
+		}, this.retryDelay(state));
+		state.retryTimer.unref?.();
+	}
+
 	private async createMessage(
 		state: ReplicationInfoV2SendState,
 		request: SendRequest,
@@ -455,19 +556,19 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 	}
 
 	private async runWorker(state: ReplicationInfoV2SendState): Promise<void> {
-		while (this.isCurrent(state)) {
+		while (true) {
+			if (state.nextSequence > MAX_U64 || !this.isCurrent(state)) {
+				this.parkSnapshotForRetry(state);
+				return;
+			}
 			const request = state.pending;
 			if (!request) {
 				return;
 			}
 			state.pending = undefined;
-			if (state.nextSequence > MAX_U64) {
-				this.clearState(state);
-				return;
-			}
-
 			const message = await this.createMessage(state, request);
-			if (!this.isCurrent(state)) {
+			if (state.nextSequence > MAX_U64 || !this.isCurrent(state)) {
+				this.parkSnapshotForRetry(state);
 				return;
 			}
 			// Consume the sequence before the transport attempt. From this point on
@@ -488,15 +589,12 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 				]),
 			});
 			state.inFlightSequence = undefined;
-			if (!this.isCurrent(state)) {
+			if (state.nextSequence > MAX_U64 || !this.isCurrent(state)) {
+				this.parkSnapshotForRetry(state);
 				return;
 			}
+			state.retryAttempts = 0;
 			state.established = true;
-			if (state.nextSequence > MAX_U64) {
-				this._spentPeerSessions.add(state.peerSession);
-				this.clearState(state);
-				return;
-			}
 		}
 	}
 
@@ -518,22 +616,38 @@ export class ReplicationInfoV2SendCoordinator<R extends "u32" | "u64"> {
 				continue;
 			}
 			state.pending = undefined;
+			const sequence = state.nextSequence;
+			state.nextSequence += 1n;
 			const message = new FullReplicationInfoV2Message({
 				receiverChallenge: state.receiverChallenge.slice(),
 				senderEpoch: state.senderEpoch.slice(),
-				sequence: state.nextSequence,
+				sequence,
 				segments: [],
 			});
-			sends.push(
-				this.deps.getRpc().send(message, {
-					mode: new AcknowledgeDelivery({
-						to: [state.target],
-						redundancy: 1,
-					}),
-					priority: CONVERGENCE_MESSAGE_PRIORITY,
-					signal,
-				}),
-			);
+			if (sequence === MAX_U64) {
+				// Retire the exhausted normal stream before transport invocation. The
+				// terminal attempt remains valid because it carries its caller-owned
+				// signal rather than the state controller that clearState aborts.
+				this.retireSpentState(state);
+			}
+			try {
+				sends.push(
+					Promise.resolve(
+						this.deps.getRpc().send(message, {
+							mode: new AcknowledgeDelivery({
+								to: [state.target],
+								redundancy: 1,
+							}),
+							priority: CONVERGENCE_MESSAGE_PRIORITY,
+							signal,
+						}),
+					),
+				);
+			} catch (error) {
+				// Keep one synchronous transport failure isolated to its destination;
+				// the sequence was already consumed and later peers must still reset.
+				sends.push(Promise.reject(error));
+			}
 		}
 		await Promise.allSettled(sends);
 	}