@serfab/cadre-core 0.10.0 → 0.11.0

package/src/strand-instance-manager.ts

@@ -1,6 +1,7 @@
 import debug from 'debug';
 import type { PrivateKey } from '@libp2p/interface';
 import { createLibp2pNode, type IRawStorage } from '@optimystic/db-p2p';
+import { wrapStorageWithCache, disposeStorageCache } from '@serfab/quereus-plugin-sereus';
 import { StrandDatabase } from './strand-database.js';
 import { StrandBackfill, type StrandBackfillConfig } from './strand-backfill.js';
 import { assertSchemaSignature } from './schema-verification.js';
@@ -14,7 +15,6 @@ import type {
   SAppConfig,
   SAppInfo,
   RawStorageProvider,
-  StrandMode,
   Libp2pNodeWithRepo
 } from './types.js';
 import { resolveStrandClusterSize, STRAND_CLUSTER_POLICY } from './types.js';
@@ -37,12 +37,6 @@ export interface StartStrandConfig {
   privateKey?: PrivateKey;
   /** Cohort-derived discovery seed (multiaddr strings). Defaults to [] when omitted. */
   bootstrapNodes?: string[];
-  /**
-   * Lifecycle mode for this strand; selects the default transactor used by the
-   * StrandDatabase. When omitted, the StrandDatabase falls back to `'networked'`;
-   * callers (CadreNode) infer it from cohort membership before reaching here.
-   */
-  mode?: StrandMode;
   /**
    * Require a valid author signature on the sApp schema before bring-up.
    * Defaults to true (fail closed) when omitted; set false only for dev/test
@@ -70,23 +64,21 @@ export interface StartStrandConfig {
    * Tuning for the strand peer-join block catch-up ({@link StrandBackfill}),
    * forwarded from {@link CadreNodeConfig.strandBackfill}. When the strand's
    * libp2p node connects to a peer this runtime has not yet caught up, every
-   * block in the strand's own raw store is pushed to it. Runs only on
-   * `networked` strands with per-strand storage; `{ enabled: false }` restores
-   * the pre-existing no-backfill behaviour.
+   * block in the strand's own raw store is pushed to it. Runs only on strands
+   * with per-strand storage; `{ enabled: false }` restores the pre-existing
+   * no-backfill behaviour.
    */
   backfill?: StrandBackfillConfig;
 }
 
 /**
- * Volatile inputs re-resolved when resuming a quiesced strand. These may have
- * changed since the strand first launched — the cohort discovery seed grows as
- * peers are learned, and cohort membership can push a strand `bootstrap → networked`.
+ * Volatile inputs re-resolved when resuming a quiesced strand. The cohort
+ * discovery seed is the only one — it grows as peers are learned since the
+ * strand first launched.
  */
 export interface ResumeStrandOverrides {
   /** Freshly-resolved cohort discovery seed (multiaddr strings). */
   bootstrapNodes?: string[];
-  /** Freshly-resolved lifecycle mode. */
-  mode?: StrandMode;
 }
 
 /**
@@ -128,6 +120,9 @@ export function getStrandStoragePath(basePath: string, strandId: string): string
  * Resolve a storage provider for a specific strand.
  * If the provider is a factory function, call it with the strandId.
  *
+ * Called only from {@link StrandInstanceManager.startStrand}, which owns the result
+ * for the instance's lifetime — see `strandStorages`.
+ *
  * @param provider - Storage provider (instance or factory)
  * @param strandId - The strand ID to create storage for
  * @returns The resolved IRawStorage instance, or undefined if no provider
@@ -139,7 +134,11 @@ function resolveStrandStorage(
   if (!provider) {
     return undefined;
   }
-  return typeof provider === 'function' ? provider(strandId) : provider;
+  const storage = typeof provider === 'function' ? provider(strandId) : provider;
+  // Wrapped in the write-through raw-storage cache (quereus-plugin-sereus's cached-storage.ts).
+  // Called ONCE per strand launch — `startStrand` keeps the result for the instance's
+  // lifetime — so the wrap survives every runtime rebuild the instance goes through.
+  return wrapStorageWithCache(storage, strandId);
 }
 
 /**
@@ -163,6 +162,26 @@ export class StrandInstanceManager {
    * missed writes).
    */
   private backfills: Map<string, StrandBackfill> = new Map();
+  /**
+   * The resolved (cache-wrapped) raw storage per strand id — the instance's OWN
+   * store, resolved once in `startStrand` and held until `stopStrand` disposes it.
+   * Private for the same reason `backfills` is: runtime plumbing, not part of the
+   * public {@link StrandInstance}.
+   *
+   * Deliberately NOT touched by `releaseRuntime`: that is what lets a quiesce →
+   * resume cycle rebuild the libp2p node over the SAME store, keeping its
+   * write-through cache warm (and, on an in-memory backend, keeping the strand's
+   * blocks at all). An entry exists iff `instances` does AND the launch config
+   * supplied a storage provider.
+   *
+   * NOTE: a hibernating strand therefore keeps its store — and its share of the
+   * process-wide cache pool — resident for as long as the instance is tracked. That
+   * is the point (a warm wake), and the pool evicts under pressure, so the cost is
+   * one map entry per hibernating strand today. If a device ever hibernates strands
+   * by the hundred, revisit: dropping the store at quiesce and paying for a cold
+   * wake becomes the better trade.
+   */
+  private strandStorages: Map<string, IRawStorage> = new Map();
   private stopping = false;
 
   constructor() {
@@ -201,6 +220,10 @@ export class StrandInstanceManager {
    * of the failure from the rejected promise (and, on the control-discovered
    * path, from CadreNode's `strand:error` event), not from an error record left
    * behind in `instances`.
+   *
+   * The strand's raw storage is resolved HERE, once, and held for the instance's
+   * lifetime (see `strandStorages`) — `buildStrandRuntime` only reads it, so a
+   * hibernation wake never re-enters the embedder's provider.
    */
   async startStrand(config: StartStrandConfig): Promise<StrandInstance> {
     const { strandRow, sAppConfig } = config;
@@ -231,6 +254,15 @@ export class StrandInstanceManager {
       signature: sAppConfig.signature
     };
 
+    // Resolve this strand's storage ONCE, before anything is recorded. If a factory
+    // function is provided, it is called with the strandId to create strand-specific
+    // storage (e.g. strand-isolated directories). A provider that throws therefore
+    // fails the launch alongside the schema-signature check, leaving nothing tracked.
+    const strandStorage = resolveStrandStorage(config.storage?.provider, strandId);
+    if (strandStorage) {
+      log('Strand %s using provided storage provider', strandId);
+    }
+
     // Determine latency hint: sApp config > default
     const latencyHint = sAppConfig.latencyHint ?? config.defaultLatencyHint;
 
@@ -241,14 +273,14 @@ export class StrandInstanceManager {
       memberPrivateKey: strandRow.MemberPrivateKey ?? undefined,
       connectedPeers: 0,
       lastActivity: new Date(),
-      latencyHint,
-      // Seed only — buildStrandRuntime overwrites this with the same resolution,
-      // so an instance that errors mid-build still reads sensibly.
-      mode: config.mode ?? 'networked'
+      latencyHint
     };
 
     this.instances.set(strandId, instance);
     this.launchConfigs.set(strandId, config);
+    if (strandStorage) {
+      this.strandStorages.set(strandId, strandStorage);
+    }
 
     try {
       await this.buildStrandRuntime(instance, config);
@@ -265,6 +297,9 @@ export class StrandInstanceManager {
       // reads both, and a config without an instance would strand the config.
       this.instances.delete(strandId);
       this.launchConfigs.delete(strandId);
+      // The store this launch resolved goes with it: nothing owns it any more, and a
+      // retained cache wrapper would be handed back (already retired) on a retry.
+      await this.disposeStrandStorage(strandId);
       throw error;
     }
   }
@@ -273,22 +308,18 @@ export class StrandInstanceManager {
    * Build (or rebuild) the libp2p node + StrandDatabase for an instance and
    * attach them, transitioning it to `active`. Shared by `startStrand` (fresh
    * launch) and `resumeStrand` (rehydrating a quiesced instance). Reads all
-   * volatile inputs (bootstrapNodes, mode, storage, network, profile,
-   * privateKey, sApp config) from `config`, so the caller controls the
-   * cohort-derived values.
+   * volatile inputs (bootstrapNodes, network, profile, privateKey, sApp config)
+   * from `config`, so the caller controls the cohort-derived values. Storage is the
+   * one input it does NOT re-read from `config`: that belongs to the instance and
+   * comes from `strandStorages`.
    */
   private async buildStrandRuntime(instance: StrandInstance, config: StartStrandConfig): Promise<void> {
     const strandId = instance.strandId;
     const { sAppConfig } = config;
-    const mode = config.mode ?? 'networked';
 
-    // Resolve storage for this strand. If a factory function is provided, it is
-    // called with the strandId to create strand-specific storage (e.g.,
-    // strand-isolated directories).
-    const strandStorage = resolveStrandStorage(config.storage?.provider, strandId);
-    if (strandStorage) {
-      log('Strand %s using provided storage provider', strandId);
-    }
+    // The store the instance OWNS (resolved once in `startStrand`), not a fresh
+    // resolution: a rebuild must reach the same backend through the same warm cache.
+    const strandStorage = this.strandStorages.get(strandId);
 
     // db-p2p namespaces every one of the node's protocol ids by network name
     // (`/optimystic/<networkName>/...`), so anything dialing this node's own
@@ -337,15 +368,8 @@ export class StrandInstanceManager {
       timing('[buildStrandRuntime:%s] createLibp2pNode: %dms', strandId, Math.round(performance.now() - t0));
 
       instance.libp2pNode = node;
-      // Assigned on every runtime (re)build — resume re-enters here with
-      // resumeConfig, so a bootstrap → networked shift refreshes the field.
-      instance.mode = mode;
-
-      // Create and initialize the StrandDatabase. In bootstrap mode the same
-      // strandStorage instance also backs the optimystic local transactor so
-      // DML lands on the host's persistent storage (e.g. LevelDB on RN). Sharing
-      // the instance — not creating a second one over the same id+prefix —
-      // avoids cache divergence between the libp2p and database paths.
+
+      // Create and initialize the StrandDatabase.
       //
       // Attach before initialize so a failed init is cleaned up by
       // releaseRuntime below (close() is safe on a partially-initialized db).
@@ -355,8 +379,6 @@ export class StrandInstanceManager {
         sAppConfig,
         libp2pNode: node,
         coordinatedRepo: node.coordinatedRepo,
-        mode,
-        rawStorage: strandStorage,
         // Founder bootstrap inputs: the strand's type drives which membership rows
         // are written, and the closed-strand MemberPrivateKey derives the founding
         // Member/Manager key. Both come off the control-network strand row.
@@ -370,9 +392,18 @@ export class StrandInstanceManager {
 
       // Peer-join block catch-up: push this strand's own blocks to each newly
       // connected peer, so a machine that joined after blocks were committed
-      // still ends up physically holding them (a bootstrap strand has no mesh
-      // to catch up, and without per-strand storage there is nothing to copy).
-      if (mode === 'networked' && strandStorage && config.backfill?.enabled !== false) {
+      // still ends up physically holding them (without per-strand storage there
+      // is nothing to copy). Armed for EVERY stored strand: `StrandBackfill`
+      // only does work when the strand's libp2p node reports a peer connection,
+      // so on a device that is genuinely alone it is inert, and arming it at
+      // launch is what closes the "founded alone, never replicates" hole — a
+      // peer that joins later gets the founder's blocks without any relaunch.
+      //
+      // NOTE: cost is one StrandBackfill object + one `connection:open` listener
+      // per running strand — linear in strand count, negligible at the handful a
+      // device or host runs today. If a node ever hosts strands by the hundred,
+      // move to one shared listener that dispatches by strand id.
+      if (strandStorage && config.backfill?.enabled !== false) {
         if (node.keyNetwork) {
           const backfill = new StrandBackfill({
             strandId,
@@ -410,6 +441,9 @@ export class StrandInstanceManager {
    * and zeroing connectedPeers. Tolerant of partially-built state — either handle
    * may be absent — so it doubles as rollback for a failed `buildStrandRuntime`.
    * Shared by `quiesceStrand`, `stopStrand`, and that rollback path.
+   *
+   * Leaves `strandStorages` untouched by design — the store outlives the runtime it
+   * was built into, which is what makes a resume warm. Only `stopStrand` disposes it.
    */
   private async releaseRuntime(instance: StrandInstance): Promise<void> {
     // Backfill first — before the database closes and the libp2p node stops — so
@@ -431,6 +465,29 @@ export class StrandInstanceManager {
     instance.connectedPeers = 0;
   }
 
+  /**
+   * Drop the strand's owned store and release its cache registration with the shared
+   * pool. Called only where the strand's whole lifetime ends (`stopStrand`, and the
+   * failed-launch rollback) — never on a quiesce.
+   *
+   * A dispose failure is logged, not thrown: the store is already unreferenced here,
+   * and failing the stop over a cache-bookkeeping error would leave the caller unable
+   * to tear the strand down. `disposeStorageCache` no-ops for an unwrapped store
+   * (e.g. `MemoryRawStorage`), so no instanceof test is needed.
+   */
+  private async disposeStrandStorage(strandId: string): Promise<void> {
+    const storage = this.strandStorages.get(strandId);
+    if (!storage) {
+      return;
+    }
+    this.strandStorages.delete(strandId);
+    try {
+      await disposeStorageCache(storage);
+    } catch (error) {
+      log('Failed to dispose storage cache for strand %s: %o', strandId, error);
+    }
+  }
+
   /**
    * Quiesce a strand: release its strand-network resources (stop the libp2p node,
    * close the StrandDatabase) while RETAINING the instance record — identity,
@@ -459,9 +516,9 @@ export class StrandInstanceManager {
    * Resume a previously-quiesced strand: rebuild its libp2p node + StrandDatabase
    * from the retained launch config and re-attach them, transitioning it back to
    * `active`. `overrides` re-applies volatile inputs that may have changed since
-   * launch (cohort `bootstrapNodes`, lifecycle `mode`) and updates the retained
-   * config so a later resume reuses the latest values. Returns the live instance
-   * unchanged if it is already running.
+   * launch (the cohort `bootstrapNodes` seed) and updates the retained config so
+   * a later resume reuses the latest values. Returns the live instance unchanged
+   * if it is already running.
    */
   async resumeStrand(strandId: string, overrides?: ResumeStrandOverrides): Promise<StrandInstance> {
     if (this.stopping) {
@@ -486,8 +543,7 @@ export class StrandInstanceManager {
     // Re-apply volatile inputs and persist them so a subsequent resume reuses them.
     const resumeConfig: StartStrandConfig = {
       ...launchConfig,
-      bootstrapNodes: overrides?.bootstrapNodes ?? launchConfig.bootstrapNodes,
-      mode: overrides?.mode ?? launchConfig.mode
+      bootstrapNodes: overrides?.bootstrapNodes ?? launchConfig.bootstrapNodes
     };
     this.launchConfigs.set(strandId, resumeConfig);
 
@@ -523,6 +579,8 @@ export class StrandInstanceManager {
       instance.status = 'stopped';
       this.instances.delete(strandId);
       this.launchConfigs.delete(strandId);
+      // Storage is released only here — NOT in releaseRuntime, which a quiesce shares.
+      await this.disposeStrandStorage(strandId);
       log('Strand %s stopped successfully', strandId);
     } catch (error) {
       instance.status = 'error';

package/src/strand-member-key.ts

@@ -1,39 +1,39 @@
-import { generateKeyPair, privateKeyToProtobuf, privateKeyFromProtobuf } from '@libp2p/crypto/keys';
-import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
-import { ed25519KeyPairFromLibp2p, type Ed25519KeyPair } from './ed25519-key.js';
-
-/**
- * Mint a fresh ed25519 strand member private key, encoded as base64 protobuf.
- *
- * Closed strands (`Type:'c'`) gate membership on a `MemberPrivateKey` column
- * (see the `Strand` control-schema table). This produces one in the SAME
- * encoding {@link StrandSolicitationService.formStrand} uses for its
- * `invitePrivateKey`, so a host-minted key and a formation-issued key are
- * interchangeable when attaching a closed strand.
- */
-export async function generateStrandMemberKey(): Promise<string> {
-  const privateKey = await generateKeyPair('Ed25519');
-  return uint8ArrayToString(privateKeyToProtobuf(privateKey), 'base64');
-}
-
-/**
- * Bridge a strand's `MemberPrivateKey` (base64 protobuf libp2p ed25519 key, as
- * minted by {@link generateStrandMemberKey} or issued by formation) into the
- * base64url keypair the strand RBAC constraints consume.
- *
- * The `Strand` control-layer `MemberPrivateKey` is the closed-strand read-gating
- * secret; the founding `Member.Key`/`Manager.MemberKey` (the strand RBAC layer)
- * are *derived from it* — they are the `publicKeyB64` of the keypair this returns.
- * Decode the protobuf to a libp2p private key, then reuse
- * {@link ed25519KeyPairFromLibp2p} so the same seed→public derivation used for node
- * owner keys yields a stable `{ privateKeyB64, publicKeyB64 }` whose public
- * key a later strand signature verifies against.
- *
- * @param memberPrivateKey - The strand's `MemberPrivateKey` (base64 protobuf).
- * @returns The base64url seed/public-key pair for founding membership/manager.
- * @throws If the decoded key is not Ed25519 or the raw bytes are malformed.
- */
-export function strandMemberKeyPair(memberPrivateKey: string): Ed25519KeyPair {
-  const privateKey = privateKeyFromProtobuf(uint8ArrayFromString(memberPrivateKey, 'base64'));
-  return ed25519KeyPairFromLibp2p(privateKey);
-}
+import { generateKeyPair, privateKeyToProtobuf, privateKeyFromProtobuf } from '@libp2p/crypto/keys';
+import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
+import { ed25519KeyPairFromLibp2p, type Ed25519KeyPair } from './ed25519-key.js';
+
+/**
+ * Mint a fresh ed25519 strand member private key, encoded as base64 protobuf.
+ *
+ * Closed strands (`Type:'c'`) gate membership on a `MemberPrivateKey` column
+ * (see the `Strand` control-schema table). This produces one in the SAME
+ * encoding {@link StrandSolicitationService.formStrand} uses for its
+ * `invitePrivateKey`, so a host-minted key and a formation-issued key are
+ * interchangeable when attaching a closed strand.
+ */
+export async function generateStrandMemberKey(): Promise<string> {
+  const privateKey = await generateKeyPair('Ed25519');
+  return uint8ArrayToString(privateKeyToProtobuf(privateKey), 'base64');
+}
+
+/**
+ * Bridge a strand's `MemberPrivateKey` (base64 protobuf libp2p ed25519 key, as
+ * minted by {@link generateStrandMemberKey} or issued by formation) into the
+ * base64url keypair the strand RBAC constraints consume.
+ *
+ * The `Strand` control-layer `MemberPrivateKey` is the closed-strand read-gating
+ * secret; the founding `Member.Key`/`Manager.MemberKey` (the strand RBAC layer)
+ * are *derived from it* — they are the `publicKeyB64` of the keypair this returns.
+ * Decode the protobuf to a libp2p private key, then reuse
+ * {@link ed25519KeyPairFromLibp2p} so the same seed→public derivation used for node
+ * owner keys yields a stable `{ privateKeyB64, publicKeyB64 }` whose public
+ * key a later strand signature verifies against.
+ *
+ * @param memberPrivateKey - The strand's `MemberPrivateKey` (base64 protobuf).
+ * @returns The base64url seed/public-key pair for founding membership/manager.
+ * @throws If the decoded key is not Ed25519 or the raw bytes are malformed.
+ */
+export function strandMemberKeyPair(memberPrivateKey: string): Ed25519KeyPair {
+  const privateKey = privateKeyFromProtobuf(uint8ArrayFromString(memberPrivateKey, 'base64'));
+  return ed25519KeyPairFromLibp2p(privateKey);
+}